| jamielennox | dstanek, gyee: thanks | 00:00 |
|---|---|---|
| jamielennox | gyee, bknudson: going back through some of my older reviews i had marked this one WIP https://review.openstack.org/#/c/90632/ | 00:03 |
| jamielennox | the reason being that if nova or something with a tenant_id in the service catalog URL it won't be able to just trim a suffix | 00:04 |
| jamielennox | do we think it matters? does it need to be a regexp or something? | 00:05 |
| gyee | jamielennox, ++ for backward compatibility | 00:08 |
| gyee | wtf? tenant_id in the url? | 00:10 |
| jamielennox | gyee: we definitely need something like that, and i had bknudson's +2 on it already - it just won't work for the ocmpute endpoints | 00:10 |
| *** Dafna has joined #openstack-keystone | 00:11 | |
| *** morganbird has joined #openstack-keystone | 00:11 | |
| jamielennox | for nova i see: | 00:11 |
| jamielennox | http://localhost:$(compute_port)s/v1.1/$(tenant_id) | 00:11 |
| jamielennox | also | 00:11 |
| jamielennox | http://localhost:8776/v1/$(tenant_id)s | 00:11 |
| jamielennox | http://localhost:8888/v1/AUTH_$(tenant_id)s | 00:12 |
| jamielennox | who is 8776 and 8888? | 00:12 |
| *** xianghui has quit IRC | 00:12 | |
| gyee | probably Swift | 00:12 |
| gyee | Swift have this reseller prefix thingy | 00:12 |
| *** xianghui has joined #openstack-keystone | 00:12 | |
| jamielennox | swift is 8888 | 00:12 |
| jamielennox | the other is volume | 00:13 |
| *** morganbird has quit IRC | 00:13 | |
| gyee | I remember seeing Swift adding reseller prefix in the url | 00:13 |
| *** morganbird has joined #openstack-keystone | 00:14 | |
| gyee | jamielennox, but for that review, we only care about identity url right? | 00:14 |
| jamielennox | maybe there's nothing i can do for them | 00:14 |
| jamielennox | gyee: not really, everything will go through this point | 00:14 |
| jamielennox | when i say i want a compute (3, 0) endpoint it will get this opportunity to munge the 'compute' endponit | 00:15 |
| gyee | oh, I see what you mean | 00:15 |
| gyee | bloody | 00:15 |
| jamielennox | this is horrible | 00:16 |
| jamielennox | i can see why nova just added a computev3 service type | 00:16 |
| *** tpatil_ has quit IRC | 00:18 | |
| *** morganbird has quit IRC | 00:19 | |
| jamielennox | gyee: i'm not actually sure how it would work for nova anyway | 00:20 |
| jamielennox | if i have to strip back to / and then i do discovery and find i should use the v1 url then i would have to add that stripped part back to the URL before returning it | 00:21 |
| gyee | jamielennox, I would think you do one or the other, both not mix the two | 00:22 |
| gyee | either get it from the SC, or discovery | 00:22 |
| gyee | s/both/but/ | 00:22 |
| gyee | perhaps like you said, add a regex_match param to get_endpoint()? | 00:24 |
| jamielennox | so with keystone it's not too hard because if i strip the /v2.0 i get / and then i do discovery to find that i either want /v2.0 or /v3 | 00:26 |
| jamielennox | with nova if i strip the /v1/(tenant_id) to / and do discovery i'll get /v1 and /v3 - but that's not enough because the v1 response has to return /v1/(tenant_id) to work | 00:27 |
| *** nbarnett has joined #openstack-keystone | 00:35 | |
| *** nbarnett has quit IRC | 00:36 | |
| jamielennox | gyee: lol, but cry - it makes no difference, nova's discovery is broken anyway: http://paste.openstack.org/show/91788/ | 00:37 |
| bknudson | I doubt there will ever be a compute v3 | 00:39 |
| bknudson | I don't see how anyone's ever going to have a new version | 00:39 |
| bknudson | I think glance might have a v2 | 00:39 |
| bknudson | jamielennox: that is funny | 00:39 |
| bknudson | let's just use json home instaed. | 00:39 |
| jamielennox | bknudson: it's actually my fault the correct url is /v2 not /v2.0 - but it's still broken | 00:40 |
| jamielennox | json home doesn't solve the initial problem though | 00:40 |
| bknudson | what's the initial problem? | 00:40 |
| jamielennox | we still have these values in the service catalog | 00:40 |
| bknudson | we can return JSON Home for /v2 also | 00:41 |
| jamielennox | i get timeout errors asking for /v2 and /v3 - this will be interesting | 00:41 |
| bknudson | just return the same document for all /v2 whatevers | 00:41 |
| jamielennox | the problem is doing the stripping of the URLs to do discovery on what's available, if i strip /v1/(tenant_id) down to / to do discovery and then decide i want to use v1 then i've lost the (tenant_id) part of the url that needs to be returned | 00:43 |
| bknudson | change nova to return the JSON Home for /v1/(tenant_id) | 00:44 |
| bknudson | just return JSON Home for everything | 00:44 |
| jamielennox | the complete home? v1 and v3? | 00:44 |
| bknudson | good question.. maybe it's just v1? (since v3 is experimental and will be going away) | 00:45 |
| *** zzzeek has quit IRC | 00:45 | |
| jamielennox | also how will JSON home handle returning URLs with a (tenant_id) in them that changes based on authentication? | 00:45 |
| *** marcoemorais has quit IRC | 00:45 | |
| jamielennox | i mean i can see that you can do it - it's just horrible | 00:45 |
| *** diegows has quit IRC | 00:46 | |
| jamielennox | i think it's a shame they are killing off v3 for the sake of precedent it sets. There are good reasons to make a new api version and if they feel they need it they should make it | 00:47 |
| jamielennox | at this rate no-one will ever be able to make a new versio | 00:47 |
| bknudson | we really are stuck with what we've got | 00:48 |
| bknudson | you get too much baggage | 00:48 |
| jamielennox | this was part of the goal of all this session and discovery work - make it easier to run multiple APIs side by side | 00:49 |
| jamielennox | make it easier to transition between them | 00:49 |
| gyee | jamielennox, yeah, not much we can do there | 00:50 |
| bknudson | maybe solve it for keystone and we go from there. | 00:50 |
| jamielennox | i think one day we'll want a v4 - that will be fun | 00:51 |
| gyee | jamielennox, I've got a feeling you are going to propose a "lets fix this fucking service catalong" session in Paris | 00:51 |
| jamielennox | gyee: honestly i don't care about the format, i'm at the point i just want it to work | 00:51 |
| jamielennox | i want the services to all be consistent in what they do | 00:51 |
| jamielennox | any 'fix' will take ages to come through and from a client perspective i'm still going to have to be backwards compatible with the broken crap we have now | 00:52 |
| gyee | uh, version the SCs? :) | 00:53 |
| jamielennox | lol | 00:53 |
| *** ayoung has joined #openstack-keystone | 00:53 | |
| jamielennox | the basics of the data structure we need are there - the problem is coming up with a migration path for the data from what we have now to what should go in the catalog | 00:54 |
| jamielennox | wtf thought that /v1/AUTH_%(tenant_id) was a good idea | 00:55 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Remove intersphinx mappings https://review.openstack.org/112479 | 00:56 |
| gyee | not me :) | 00:57 |
| jamielennox | hey novaclient approved the conversion to requests-mock :) some good news for this morning | 00:59 |
| *** morganbird has joined #openstack-keystone | 01:15 | |
| stevemar | dstanek, thoughts about the notifications for role_assignments? | 01:16 |
| *** morganbird has quit IRC | 01:20 | |
| *** gyee has quit IRC | 01:21 | |
| stevemar | ohhh can i get a review of: https://review.openstack.org/#/c/111170/ it a whopping 3 lines :D | 01:21 |
| *** spandhe_ has joined #openstack-keystone | 01:32 | |
| *** amerine has quit IRC | 01:51 | |
| *** morganbird has joined #openstack-keystone | 02:15 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystonemiddleware: Add composite authentication support https://review.openstack.org/108384 | 02:20 |
| *** morganbird has quit IRC | 02:20 | |
| *** mitz has joined #openstack-keystone | 02:30 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Versioned Endpoint hack for Sessions https://review.openstack.org/90632 | 03:07 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: [WIP] Add template hacks to identity plugins https://review.openstack.org/112752 | 03:07 |
| jamielennox | morganfainberg: interesting, i just pushed those two patches behind the one you just approved but it included a rebase to master | 03:08 |
| jamielennox | it seems to have gone ok | 03:08 |
| jamielennox | it's still in the queue | 03:08 |
| openstackgerrit | A change was merged to openstack/identity-api: add name filter on list services https://review.openstack.org/111818 | 03:09 |
| jamielennox | i guess because zuul must do a rebase before tying to put it through the gate? | 03:09 |
| morganfainberg | jamielennox, usually | 03:10 |
| morganfainberg | jamielennox, but git review does magic sometimes | 03:10 |
| jamielennox | morganfainberg: yea, i looked to make sure it was still unapproved before i rebased - then saw it had been approved in the mean time, expected it to be ejected from gate | 03:11 |
| *** morganbird has joined #openstack-keystone | 03:16 | |
| *** morganbird has quit IRC | 03:21 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: expose the revoke token for V3 https://review.openstack.org/102701 | 03:26 |
| *** richm has quit IRC | 03:32 | |
| *** oomichi has quit IRC | 03:48 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Isolate get_discovery function https://review.openstack.org/107569 | 04:05 |
| *** morganbird has joined #openstack-keystone | 04:17 | |
| *** morganbird has quit IRC | 04:21 | |
| *** jaosorior has joined #openstack-keystone | 04:48 | |
| *** spandhe_ has quit IRC | 04:48 | |
| openstackgerrit | Qiu Yu proposed a change to openstack/python-keystoneclient: Ensure using int type for revocation_cache_time https://review.openstack.org/112756 | 04:50 |
| *** ncoghlan has joined #openstack-keystone | 04:50 | |
| *** Muhammad_Efendi has joined #openstack-keystone | 04:57 | |
| *** Muhamma__ has joined #openstack-keystone | 05:13 | |
| *** Muhammad_Efendi has quit IRC | 05:16 | |
| *** morganbird has joined #openstack-keystone | 05:17 | |
| openstackgerrit | A change was merged to openstack/keystone: Trust unit tests should target additional threat scenarios https://review.openstack.org/109120 | 05:22 |
| *** morganbird has quit IRC | 05:22 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Mark the keystoneclient s3_token middleware deprecated https://review.openstack.org/111847 | 05:23 |
| *** chandankumar has joined #openstack-keystone | 05:24 | |
| *** chandankumar_ has joined #openstack-keystone | 05:24 | |
| *** ukalifon has joined #openstack-keystone | 05:27 | |
| *** ukalifon has quit IRC | 05:27 | |
| stevemar | bump | 05:32 |
| *** bknudson has quit IRC | 05:35 | |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 05:39 |
| *** ajayaa has joined #openstack-keystone | 05:40 | |
| *** ukalifon1 has joined #openstack-keystone | 05:41 | |
| *** ukalifon1 has quit IRC | 05:53 | |
| *** wanghong has quit IRC | 05:59 | |
| *** k4n0 has joined #openstack-keystone | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:04 |
| *** wanghong has joined #openstack-keystone | 06:05 | |
| *** henrynash has joined #openstack-keystone | 06:10 | |
| *** henrynash has quit IRC | 06:15 | |
| *** morganbird has joined #openstack-keystone | 06:18 | |
| *** morganbird has quit IRC | 06:23 | |
| *** Muhamma__ has quit IRC | 06:33 | |
| *** chandankumar_ has quit IRC | 06:39 | |
| *** tomoiaga has joined #openstack-keystone | 06:57 | |
| *** bvandenh has joined #openstack-keystone | 06:58 | |
| *** bvandenh has quit IRC | 07:07 | |
| openstackgerrit | A change was merged to openstack/keystone: Update CADF auditing example to show non-payload information https://review.openstack.org/111657 | 07:12 |
| *** morganfainberg is now known as morganfainberg_Z | 07:17 | |
| *** morganbird has joined #openstack-keystone | 07:19 | |
| *** ncoghlan has quit IRC | 07:19 | |
| *** morganbird has quit IRC | 07:24 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Replace httpretty with requests-mock https://review.openstack.org/112777 | 07:25 |
| *** henrynash has joined #openstack-keystone | 07:32 | |
| *** jamielennox is now known as jamielennox|away | 07:33 | |
| *** morganfainberg_Z is now known as morganfainberg | 07:34 | |
| *** Dafna has quit IRC | 07:35 | |
| *** Dafna has joined #openstack-keystone | 07:37 | |
| *** bvandenh has joined #openstack-keystone | 07:59 | |
| *** stevemar has quit IRC | 08:03 | |
| *** henrynash has quit IRC | 08:06 | |
| *** morganbird has joined #openstack-keystone | 08:20 | |
| *** morganbird has quit IRC | 08:25 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/keystone: Check for empty string value in REMOTE_USER https://review.openstack.org/111953 | 08:30 |
| *** lsmola has joined #openstack-keystone | 09:04 | |
| lsmola | does anybody know why Service name is not forced as unique? | 09:04 |
| *** morganbird has joined #openstack-keystone | 09:20 | |
| *** morganbird has quit IRC | 09:25 | |
| *** amirosh has joined #openstack-keystone | 09:36 | |
| *** henrynash has joined #openstack-keystone | 09:48 | |
| *** morganbird has joined #openstack-keystone | 10:21 | |
| *** bvandenh has quit IRC | 10:23 | |
| *** rwsu has quit IRC | 10:23 | |
| *** arunkant has quit IRC | 10:23 | |
| *** arunkant has joined #openstack-keystone | 10:25 | |
| *** bvandenh has joined #openstack-keystone | 10:25 | |
| *** morganbird has quit IRC | 10:26 | |
| *** rwsu has joined #openstack-keystone | 10:27 | |
| *** ajayaa has quit IRC | 10:36 | |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Keystone service throws error on receiving SIGHUP https://review.openstack.org/107482 | 10:42 |
| *** henrynash has quit IRC | 10:46 | |
| *** ajayaa has joined #openstack-keystone | 10:53 | |
| *** abhishekk has joined #openstack-keystone | 10:54 | |
| *** henrynash has joined #openstack-keystone | 11:21 | |
| *** morganbird has joined #openstack-keystone | 11:22 | |
| *** morganbird has quit IRC | 11:27 | |
| *** andreaf_ has quit IRC | 11:31 | |
| *** __afazekas has quit IRC | 11:32 | |
| *** morganbird has joined #openstack-keystone | 11:32 | |
| *** ajayaa has quit IRC | 11:35 | |
| *** diegows has joined #openstack-keystone | 11:41 | |
| *** andreaf has joined #openstack-keystone | 11:49 | |
| *** ajayaa has joined #openstack-keystone | 11:52 | |
| *** ayoung has quit IRC | 12:13 | |
| *** __afazekas has joined #openstack-keystone | 12:18 | |
| *** diegows has quit IRC | 12:19 | |
| dstanek | jaosorior: you around? | 12:19 |
| jaosorior | yo | 12:20 |
| jaosorior | dstanek, wazzup? | 12:21 |
| dstanek | jaosorior: i was just thinking about your name-based filtering review. do you have a feel for how many service records would be in a large openstack installation? | 12:21 |
| jaosorior | dstanek: You are wondering if a migration script should be written instead of filtering by extra attributes, I guess. | 12:22 |
| *** miqui has joined #openstack-keystone | 12:23 | |
| dstanek | jaosorior: yeah. i suspect number or records is really low anyway. but i have no idea | 12:24 |
| dstanek | jaosorior: if the table is small then the query optimizer may determine a full table scan is more efficient than and index scan anyway | 12:25 |
| dstanek | s/than and/than an/ | 12:25 |
| jaosorior | I don't think theyŕe that many dude, at least not as many as to loose much performance. | 12:25 |
| jaosorior | and not in our deployments at least | 12:26 |
| *** bknudson has joined #openstack-keystone | 12:32 | |
| jaosorior | *they're | 12:32 |
| *** morganbird has quit IRC | 12:35 | |
| *** bknudson has quit IRC | 12:37 | |
| *** morganbird has joined #openstack-keystone | 12:38 | |
| *** david-lyle has joined #openstack-keystone | 12:40 | |
| *** morganbird has quit IRC | 12:42 | |
| *** Muhammad_Efendi has joined #openstack-keystone | 12:44 | |
| *** david-lyle has quit IRC | 12:46 | |
| *** david-lyle has joined #openstack-keystone | 12:46 | |
| *** dhellmann_ is now known as dhellmann | 12:47 | |
| *** Muhamma__ has joined #openstack-keystone | 12:49 | |
| *** Muhammad_Efendi has quit IRC | 12:50 | |
| *** david-lyle has quit IRC | 12:51 | |
| *** bknudson has joined #openstack-keystone | 12:54 | |
| *** gordc has joined #openstack-keystone | 12:56 | |
| *** morganbird has joined #openstack-keystone | 13:07 | |
| *** henrynash has quit IRC | 13:07 | |
| *** hrybacki has joined #openstack-keystone | 13:09 | |
| *** henrynash has joined #openstack-keystone | 13:09 | |
| *** zzzeek has joined #openstack-keystone | 13:10 | |
| *** henrynash has quit IRC | 13:11 | |
| *** joesavak has joined #openstack-keystone | 13:18 | |
| *** richm has joined #openstack-keystone | 13:22 | |
| *** __afazekas has quit IRC | 13:24 | |
| *** Muhamma__ has quit IRC | 13:24 | |
| *** ajayaa has quit IRC | 13:41 | |
| *** henrynash has joined #openstack-keystone | 13:46 | |
| *** amirosh has quit IRC | 13:46 | |
| *** amirosh has joined #openstack-keystone | 13:47 | |
| *** abhishekk has quit IRC | 13:47 | |
| *** jorge_munoz has joined #openstack-keystone | 13:49 | |
| *** russellb is now known as rustlebee | 13:50 | |
| *** amirosh has quit IRC | 13:51 | |
| *** jasondotstar has joined #openstack-keystone | 13:52 | |
| *** ayoung has joined #openstack-keystone | 13:53 | |
| *** ajayaa has joined #openstack-keystone | 13:53 | |
| *** jasondotstar has quit IRC | 13:54 | |
| *** jasondotstar has joined #openstack-keystone | 13:54 | |
| *** tomoiaga has quit IRC | 13:57 | |
| *** gabriel-bezerra has joined #openstack-keystone | 14:03 | |
| *** saipandi has joined #openstack-keystone | 14:06 | |
| *** ildikov has joined #openstack-keystone | 14:08 | |
| *** tomoiaga has joined #openstack-keystone | 14:15 | |
| *** bvandenh has quit IRC | 14:18 | |
| ildikov | hi All | 14:20 |
| ildikov | I'm kinda fighting with this bug: https://bugs.launchpad.net/ceilometer/+bug/1350533 | 14:21 |
| uvirtbot | Launchpad bug 1350533 in ceilometer "CommandError: Unable to determine the Keystone version to authenticate with using the given auth_url: http://127.0.0.1:35357/v2.0" [High,Confirmed] | 14:21 |
| ildikov | I tried to use ceilometer client in a freshly installed devstack env, and I got the same error message that was reported in the bug report above | 14:21 |
| ildikov | ... the strange is that if I change the auth url to use port 5000 instead of 35357, then it works fine | 14:22 |
| ildikov | ... I found the 'Could not find version: v2.0' in Keystone log | 14:23 |
| ildikov | ... what I do not understand is that why the port matters in the auth url as it should work with 35357 too according to my knowledge | 14:24 |
| ildikov | ... I would appreciate any hint on this, if it rings a bell for any of you | 14:26 |
| ildikov | ... I also need to drop off soon, but I will read the logs later | 14:27 |
| *** saipandi has quit IRC | 14:28 | |
| *** stevemar has joined #openstack-keystone | 14:28 | |
| ayoung | henrynash, so with what you have commited today, can I use LDAP and SQL identity backends together? Service users in SQL, LDAP for humans? | 14:34 |
| henrynash | ayoung: as long as they are in different domains, yes | 14:35 |
| *** elmiko has joined #openstack-keystone | 14:35 | |
| elmiko | yo | 14:35 |
| ayoung | henrynash, what do I need to do to test that? | 14:35 |
| henrynash | ayoung: thinking | 14:36 |
| *** vhoward has joined #openstack-keystone | 14:36 | |
| ayoung | elmiko, it was henrynash that wrote the multi-backend stuff. I asked him and I can hear the gears grinding all the way from Jolluy Ole England to Boston | 14:36 |
| elmiko | nice | 14:37 |
| *** hrybacki has quit IRC | 14:37 | |
| ayoung | elmiko, the issue we had to solve was that things need to have a unique identifier, even across all domains. THe solution was to hash the User ID/domain combination and stick it into another table | 14:38 |
| ayoung | there are some grandfathered aspects for existing LDAP deployments | 14:38 |
| ayoung | so we don't need to rewrite userids for a working backend... | 14:38 |
| *** k4n0 has quit IRC | 14:39 | |
| ayoung | at least, in theory | 14:39 |
| elmiko | makes sense | 14:39 |
| henrynash | ayoung: so one way I think would be to have ldap set up in the main conf file | 14:39 |
| elmiko | would you even accept a blueprint for something that would allow refreshing a token in use? | 14:39 |
| elmiko | s/even/ever | 14:39 |
| henrynash | ayoung: and one domain set aside for servcie users…could be teh default, could be a special one - so you create domain specific conf file for that | 14:40 |
| ayoung | elmiko, actually I wrote a spec for one, but now I think it is a mistake and I have a better approach | 14:41 |
| elmiko | ayoung: cool, so it sounds like that idea is at least floating around somewhere | 14:41 |
| ayoung | henrynash, So if I have LDAP as the default domain, but they are stored in SQL, what goes in the domain specific config file? | 14:42 |
| henrynash | ayoung: and specify the sql driver in that domain-specific conf file | 14:42 |
| ayoung | move the LDAP config to it? | 14:42 |
| ayoung | elmiko, no | 14:42 |
| elmiko | :( | 14:42 |
| ayoung | elmiko, tokens are the wrong abstraction for that | 14:42 |
| elmiko | ahh ok | 14:42 |
| ayoung | elmiko, we have other mechanisms that will work for you. | 14:42 |
| elmiko | ayoung: here's another question, is it possible to learn the expiration time of a token given only the token? | 14:43 |
| henrynash | so if you want a specific domain to have the SQL service users in….create a domain specific config file taht specifies the sql driver in it | 14:44 |
| elmiko | i'm thinking theoretically, the nodes in our cluster could just gain new tokens from the old ones before they expire | 14:44 |
| ayoung | elmiko, yes. | 14:44 |
| henrynash | ayoung:…have to admit I never tested thjis way round :-) | 14:45 |
| ayoung | I can work with you on that. The token validation process provide the contents of the token. Assuming you are using a PKI token, you can read all of the data in it. | 14:45 |
| ayoung | henrynash, how did you test it? | 14:45 |
| ayoung | LDAP was in the domain specific config file? | 14:45 |
| henrynash | ayoung: I had smultiple separate LDAP domains, with SQL as teh default for other domains | 14:46 |
| elmiko | ayoung: we may not be able to control the keystone config, is it possible to gain the PKI token if we had a UUID? | 14:47 |
| ayoung | henrynash, So if I have an LDAP default domain, I move that to a domain specific config file, I can have multiple non-default domains in SQL, just the remote services need to be able to pass domain from Auth-token middleware | 14:47 |
| ayoung | elmiko, authenticating a token against Keystone is a priviledged operation | 14:47 |
| ayoung | er validating a token | 14:47 |
| bknudson | ayoung: henrynash: you have +2s on the child reviews of https://review.openstack.org/#/c/109041/ , and that one looks good to me | 14:48 |
| ayoung | which, come to think of it is kindof dumb. | 14:48 |
| ayoung | but validating a token returns information that you would not want to hand out to everyone.... | 14:48 |
| * ayoung files some notes away on that | 14:49 | |
| henrynash | ayoung: yes | 14:49 |
| elmiko | ayoung: ok, but if i start with a token, i can use that token to gain a new one. is that a form of validation, or something else? | 14:49 |
| henrynash | ayoung: if you look in test_backend_ldap.py you’ll see the class tests I did to test this | 14:50 |
| ayoung | elmiko, hmmm, good question. I think it could be. When you exchnage one token for another, you get back the token data for the new token....this whole thing sucks | 14:50 |
| henrynash | ayoung: MultiLDAPandSQLIdentity | 14:50 |
| elmiko | ayoung: but it might work for our needs. the instances could be seeded with a good token. then they could acquire new ones from that original | 14:51 |
| ayoung | elmiko, that is bad | 14:51 |
| ayoung | lets not go there unless under duress | 14:51 |
| elmiko | ok, why bad? | 14:52 |
| ayoung | focus | 14:52 |
| *** Muhammad_Efendi has joined #openstack-keystone | 14:52 | |
| elmiko | better to let our controller distribute the tokens? | 14:52 |
| ayoung | we are trying to get to the good solution...the token-for-token approach doesn't get you that | 14:52 |
| elmiko | agreed | 14:52 |
| ayoung | no. better to let the nodes request tokens when they need them | 14:52 |
| ayoung | elmiko, assume a token only lives for 5 minutes | 14:52 |
| henrynash | ayoung: be offline for a while, back on in a bit | 14:52 |
| elmiko | ayoung: good point | 14:53 |
| ayoung | that is wehere we want to head with this. A token lives for a short lived task/ | 14:53 |
| elmiko | right | 14:53 |
| ayoung | trusts are the mechanism for your use case, but they require authentication | 14:53 |
| ayoung | authentication for the trustee, and I think that is the most secure approach | 14:53 |
| ayoung | we have trust re-delegation, so proxy user should be able to redelegate to the nodes for a hadoop job | 14:54 |
| ayoung | that reduces the complexity to the nodes authenticating | 14:54 |
| ayoung | and that is solvable with the multiple domains approach. | 14:54 |
| elmiko | my main concern with the nodes having credentials to acquire tokens as needed is that then our controller needs to store those credentials, which is what we are trying to avoid. | 14:54 |
| ayoung | elmiko, those credentials should be for such a limited user as to be irrelevant | 14:55 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111873 | 14:55 |
| ayoung | the node users will have no roles on any project | 14:55 |
| ayoung | they exist solely to execute trusts | 14:55 |
| ayoung | then the password gets synced between the node and keystone | 14:56 |
| elmiko | ayoung: they would need to at least have some sort of membership role delegated to gain swift access? | 14:56 |
| ayoung | no | 14:56 |
| ayoung | they are going to use the trust token to gain access to swift | 14:56 |
| elmiko | right, but don't we need a role_names when we create the trust? | 14:56 |
| ayoung | nope | 14:56 |
| *** ildikov has quit IRC | 14:56 | |
| elmiko | ahh interesting | 14:56 |
| ayoung | the user creates the trust, not the proxy | 14:56 |
| *** hrybacki has joined #openstack-keystone | 14:56 | |
| elmiko | user = trustor, proxy = trustee, no role needeD? | 14:57 |
| mhu | marekd, you got a shibboleth SP config file you could share with me ? I am struggling to enable ECP on the Service Provider | 14:57 |
| ayoung | elmiko, what we need is an exchange from the scheduler to the user saying "here are the roles we are going to need. PLease submit this trust creation request to let us work on your behalf." | 14:57 |
| marekd | mhu: sure. | 14:57 |
| marekd | mhu: one sec. | 14:57 |
| mhu | marekd, thanks a lot | 14:58 |
| marekd | mhu: you want shibboleth2.xml only? | 14:58 |
| elmiko | ayoung: not sure i'm following | 14:58 |
| mhu | marekd, should be enough | 14:58 |
| marekd | mhu@enovance.com? | 14:58 |
| mhu | marekd, yep | 14:58 |
| mhu | we don't have our redhat addresses yet :) | 14:59 |
| ayoung | elmiko, what system does the user talk to in order to set up the Hadoop job? | 15:00 |
| ayoung | mhu, we got you too? AWESOME! | 15:00 |
| elmiko | ayoung: could be ReST api to sahara, saharaclient, or horizon | 15:00 |
| elmiko | i guess horizon counts as saharaclient | 15:00 |
| ayoung | elmiko, ok, lets start with sahara | 15:00 |
| marekd | ayoung: a long time ago i think :-) | 15:01 |
| *** henrynash has quit IRC | 15:01 | |
| ayoung | user says "submit hadoop job:" | 15:01 |
| ayoung | response comes back with a bunc of JSON, part of which is "trust_request" | 15:01 |
| ayoung | marekd, so many awesome people from eNovance are now my co-workers. So many more people that know Keystone, I can finally be fired! | 15:02 |
| elmiko | lol | 15:02 |
| marekd | mhu: sent | 15:02 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: add i18n to lxml error https://review.openstack.org/112914 | 15:03 |
| ayoung | elmiko, any further keystone questions you have should be sent to mhu@redhat.com | 15:03 |
| *** chandankumar has quit IRC | 15:03 | |
| elmiko | nice | 15:03 |
| mhu | ayoung, lol | 15:03 |
| mhu | marekd, thanks | 15:03 |
| mhu | nice ! I was wondering how to configure the SP for a multi-IdP setting, I guess I got this as an extra ! | 15:04 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: swap import order of lxml https://review.openstack.org/112915 | 15:04 |
| marekd | mhu: yeah :-) | 15:04 |
| ayoung | mhu, here is what I am going to try: | 15:04 |
| ayoung | I have a FreeIPA setup in our lab. I'm going to set up a new devstack machine, and then try to link the LDAP from the FreeIPA setup as a seoncd Domain there. lets see what happens | 15:05 |
| elmiko | ayoung: thanks for the help, i think we might have to investige distributing the proxy user creds to the nodes. i'm not sure it's ideal, but it seems better than a situation where tokens are being updated every five minutes | 15:10 |
| ayoung | elmiko, there are many ways to do it. X509 is probably the best option | 15:11 |
| ayoung | and I have not yet tested that...but soon | 15:11 |
| elmiko | i'm only vaguely familiar with X509 in general | 15:11 |
| ayoung | elmiko, the short of it is that the nodes would generate a private/public keypair, and use the public key to authenticate | 15:12 |
| elmiko | ayoung: that would be ideal | 15:12 |
| ayoung | Working on it | 15:12 |
| elmiko | well, this feature might gets pushed until Kilo given the difficulties we are running into | 15:13 |
| ayoung | elmiko, you can do it in Juno. | 15:13 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Merge "Update CADF auditing example to show non-payload information" https://review.openstack.org/112919 | 15:14 |
| ayoung | elmiko, I have to do a Camp pickup here in 15 minutes (gumble half day) and then I'll be back on line after lunch | 15:14 |
| mhu | marekd, could you check if any other config file mentions ECP in /etc/shibboleth/ ? I feel like I am still missing something | 15:14 |
| elmiko | ayoung: ok, we'll talk more later | 15:14 |
| ayoung | meanwhile, I'm spinning up a VM to try the multi backend approach for identity | 15:14 |
| ayoung | lets see what happens | 15:14 |
| marekd | mhu: what are the errors/warns ? | 15:15 |
| elmiko | ayoung: ah very cool | 15:16 |
| marekd | mhu: what IdP are you using? | 15:16 |
| mhu | marekd, my very own, so I wouldn't be surprised if things go wrong | 15:16 |
| *** fish_ has left #openstack-keystone | 15:17 | |
| marekd | mhu: mhu you very own which is...? | 15:17 |
| marekd | mhu: what are the errors? | 15:17 |
| marekd | I would try with something that's proven to work - like testshib. However I didn't have any problems with adding extra IdPs. | 15:17 |
| *** saipandi has joined #openstack-keystone | 15:17 | |
| mhu | marekd, it's a shibboleth idp in a lab. From its logs, I think the pb is due to an AttributeConsumingService that is not set, possibly in my SP metadata | 15:18 |
| marekd | mhu: oh, this looks like XML debugging...;/ | 15:19 |
| marekd | mhu: well, the Shibboleth IdP should have ECP enabled by default starting from ver 2.4 | 15:21 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Merge "Update CADF auditing example to show non-payload information" https://review.openstack.org/112926 | 15:21 |
| marekd | I guess you have that ver. | 15:21 |
| *** jorge_munoz has quit IRC | 15:21 | |
| mhu | marekd, yes, all I needed to do was add the basic auth on the ECP endpoint | 15:21 |
| *** ajayaa has quit IRC | 15:22 | |
| mhu | marekd, I think the IdP part is working correctly, I've tried it with this payload and it goes well: http://paste.openstack.org/show/92127/ | 15:22 |
| mhu | but when I try it with keystoneclient, I get this notification about AttributeConsumingService, and redirected to the IdP login page | 15:24 |
| marekd | mhu: what's exactly in this notification ? | 15:24 |
| mhu | marekd, I'd like to see your SP metadata if possible, I think that might be the key | 15:24 |
| mhu | "AttributeConsumingService candidate list was empty, can not select service" | 15:25 |
| marekd | mhu: you have your keystone on port 443 or 5000 ? | 15:25 |
| mhu | 5000, with SSL activated | 15:25 |
| marekd | i dont see it exposed in the xml you pasted. | 15:26 |
| marekd | how did you generate your metadata from SP ? | 15:26 |
| *** ayoung has quit IRC | 15:26 | |
| marekd | you should use URL: host.com:5000/Shibboleth.sso/Metadata | 15:26 |
| marekd | (with port) | 15:26 |
| mhu | marekd, I used shib-metagen and copied it on my IdP | 15:28 |
| *** henrynash has joined #openstack-keystone | 15:28 | |
| *** david-lyle has joined #openstack-keystone | 15:29 | |
| marekd | mhu: https://gist.github.com/zaccone/080c6bd69f13257e50c4 | 15:30 |
| marekd | mhu: i dont know this script to be honst. | 15:30 |
| marekd | what I usually do is use my browser and enter UrL : https://host:5000/Shibboleth.sso/Metadata | 15:30 |
| marekd | and it creates the file for me. | 15:30 |
| marekd | it's important to put the port | 15:30 |
| marekd | and shibboleth will respect that when creating the xml file. | 15:31 |
| openstackgerrit | A change was merged to openstack/keystone: Refactor serializer import to XmlBodyMiddleware https://review.openstack.org/111108 | 15:31 |
| openstackgerrit | Anne Gentle proposed a change to openstack/identity-api: Removes WADL references from Identity v2.0 API https://review.openstack.org/112620 | 15:32 |
| mhu | marekd, yeah, you can use both to generate metadata. The CLI shib-metagen allows you to configure some additional info in the metadata | 15:33 |
| marekd | mhu: ok | 15:34 |
| mhu | marekd, hmm .... I am definitely missing some AssertionConsumerService definitions in my metadata | 15:35 |
| mhu | and there's one for ECP, so it looks like I got my culprit | 15:35 |
| mhu | thanks again for the help, I should be fine from then on ! | 15:35 |
| marekd | mhu: that's a relief the code is not broken (I hope so!) :-) | 15:36 |
| henrynash | ayoung: I’ve been thinking about adding some more tests for domain-specific backends…happy to add on that matches a real use case that you have... | 15:36 |
| stevemar | marekd, mhu not sure if you guys covered this, but i found you need to manually put the port # :5000 in the md:AssertionConsumerService Locations | 15:36 |
| marekd | mhu: anyway, let me know whether you succedded | 15:36 |
| marekd | stevemar: if you generate the metadata and specify the port shib should take care of that... | 15:37 |
| marekd | at least I never had co edit metadata | 15:37 |
| mhu | marekd, stevemar yeah I had to tinker my metadata manually, since at first I had set shib for use on SSL (keystone wasn't installed yet) | 15:37 |
| stevemar | mhu, ah, i wasn't using shib as my idp | 15:37 |
| mhu | so I had to add the ports manually | 15:37 |
| marekd | stevemar: he talks about shib sp. | 15:37 |
| stevemar | oh | 15:37 |
| mhu | marekd, stevemar : correct, shib sp | 15:38 |
| stevemar | then i guess i just didn't specify the port correctly | 15:38 |
| stevemar | weird | 15:38 |
| marekd | stevemar: there are many ways to achieve the goal :-) | 15:39 |
| stevemar | true enough | 15:39 |
| stevemar | bknudson, another revision of the control exchange patch coming up | 15:41 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 15:41 |
| *** bknudson has left #openstack-keystone | 15:44 | |
| *** comstud is now known as bearhands | 15:45 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: move attributes of v3.client.Client into alphabetical order https://review.openstack.org/111939 | 15:47 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update control_exchange value in keystone.conf https://review.openstack.org/111170 | 15:47 |
| *** elmiko is now known as _elmiko | 15:52 | |
| *** Raildo has joined #openstack-keystone | 15:53 | |
| *** bknudson has joined #openstack-keystone | 15:54 | |
| *** Raildo_ has joined #openstack-keystone | 15:56 | |
| *** amerine has joined #openstack-keystone | 15:57 | |
| *** Raildo has quit IRC | 15:59 | |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Make API specification match our token format for role list. https://review.openstack.org/112959 | 16:00 |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Make API specification match our token format for role list. https://review.openstack.org/112959 | 16:01 |
| *** gyee has joined #openstack-keystone | 16:01 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 federated authentication for ADFS. https://review.openstack.org/111771 | 16:01 |
| *** marekd is now known as marekd|weekend | 16:02 | |
| henrynash | is there somewhere that lists the latest commit mesasge cmds in terms of closes-bug/partial-closes/implenents etc….I can never seem to get them right… | 16:05 |
| morganfainberg | henrynash, i always go with related-bug, partial-bug, closes-bug (the last one the only one that *really* acts differently) and "bp: <bp>" | 16:06 |
| henrynash | morganfaingerg: ok..thanks..and is the “:” significant? e.g. closes_bug vs closes-bug: ? | 16:07 |
| openstackgerrit | A change was merged to openstack/keystone: Check for empty string value in REMOTE_USER https://review.openstack.org/111953 | 16:07 |
| morganfainberg | henrynash, i've never tried closes_bug | 16:07 |
| morganfainberg | only closes-bug | 16:07 |
| henrynash | oops, I meand closes-bug | 16:07 |
| morganfainberg | ah, uh, i alwayse use the ':' but dunno | 16:08 |
| henrynash | ok, thx! | 16:08 |
| dstanek | henrynash: i use this as a reference | 16:08 |
| dstanek | https://wiki.openstack.org/wiki/GitCommitMessages | 16:08 |
| morganfainberg | hm. | 16:08 |
| morganfainberg | https://review.openstack.org/#/c/110575/5/keystone/common/config.py i think we need a default cache time for this. | 16:08 |
| morganfainberg | not "indefinite" but... i might be wrong | 16:08 |
| henrynash | dstaneK; thx…yes, have used that…thx | 16:09 |
| dstanek | anyone know why these methods weren't implemented for LDAP? https://review.openstack.org/#/c/102244/5/keystone/assignment/backends/ldap.py | 16:11 |
| *** david-lyle has quit IRC | 16:19 | |
| *** david-lyle has joined #openstack-keystone | 16:19 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure roles created by unit tests have correct attributes. https://review.openstack.org/112965 | 16:19 |
| *** henrynash has quit IRC | 16:22 | |
| *** david-lyle has quit IRC | 16:23 | |
| morganfainberg | dstanek, because ldap assignment has been kindof a hack/languishing compared to sql assignment? | 16:24 |
| morganfainberg | dstanek, also might have been related to some of the domain-specific logic that doesn't work with ldap assignment (initially) | 16:24 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Mark auth plugin options as secret https://review.openstack.org/112462 | 16:25 |
| dstanek | morganfainberg: ok, so there's no reason to hold up that patch once the fix it up? | 16:34 |
| morganfainberg | dstanek, none that *i* can think of | 16:34 |
| dstanek | morganfainberg: what sucks about the patch is that is has to do lots of queries like get_role(id) instead of get_roles([ids]) | 16:35 |
| morganfainberg | dstanek, i'd 2x check with ayoung maybe nkinder_away in case i'm missing something | 16:35 |
| morganfainberg | dstanek, that might have been part of it as well | 16:35 |
| morganfainberg | dstanek, the ldap assignmnet isn't exactly *efficient* | 16:35 |
| nkinder_away | dstanek, morganfainberg: I think the general assumption was that using LDAP for assignment isn't common (and doesn't offer much/any benefit over SQL). | 16:39 |
| nkinder_away | This has caused it to be ignored for some things that were implemented to the identity LDAP driver. | 16:40 |
| nkinder_away | It certainly has room for improvement, but it's unclear how important it is. | 16:40 |
| dstanek | nkinder_away: that makes sense; looks like there is at least one interested party | 16:41 |
| *** hrybacki has quit IRC | 16:42 | |
| morganfainberg | nkinder_away, thanks! | 16:44 |
| *** spandhe has joined #openstack-keystone | 16:45 | |
| *** marcoemorais has joined #openstack-keystone | 16:48 | |
| *** diegows has joined #openstack-keystone | 16:52 | |
| *** bknudson has quit IRC | 17:03 | |
| stevemar | gate has been super flakely lately | 17:06 |
| *** zzzeek has quit IRC | 17:09 | |
| *** dvorak has quit IRC | 17:09 | |
| *** zzzeek has joined #openstack-keystone | 17:09 | |
| *** traz__ has quit IRC | 17:10 | |
| *** dvorak has joined #openstack-keystone | 17:13 | |
| *** _elmiko is now known as elmiko | 17:14 | |
| *** tomoiaga has quit IRC | 17:20 | |
| *** henrynash has joined #openstack-keystone | 17:20 | |
| *** Raildo_ has quit IRC | 17:22 | |
| *** jaosorior has quit IRC | 17:22 | |
| openstackgerrit | A change was merged to openstack/identity-api: Add OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111873 | 17:22 |
| *** cray\ejp has joined #openstack-keystone | 17:26 | |
| *** david-lyle has joined #openstack-keystone | 17:28 | |
| *** marcoemorais has quit IRC | 17:31 | |
| *** marcoemorais has joined #openstack-keystone | 17:31 | |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Make API specification match our token format. https://review.openstack.org/112959 | 17:38 |
| dstanek | looks like we're on a +A roll today | 17:39 |
| *** saipandi has quit IRC | 17:40 | |
| henrynash | morgainfainberg: fyi, the “:” is signifcant in commit comments…. | 17:40 |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Make API specification match our token format. https://review.openstack.org/112959 | 17:50 |
| *** saipandi has joined #openstack-keystone | 17:53 | |
| *** hrybacki has joined #openstack-keystone | 17:53 | |
| *** Muhammad_Efendi has quit IRC | 17:53 | |
| *** ayoung has joined #openstack-keystone | 17:54 | |
| *** amirosh has joined #openstack-keystone | 17:56 | |
| openstackgerrit | A change was merged to openstack/keystone: Delete intersphinx mappings https://review.openstack.org/112485 | 18:01 |
| morganbird | Hey all, is there documentation somewhere with examples of adding a saml idp to keystone? The one example I've found doesn't seem to match what's in the v3 identity APIs. | 18:02 |
| *** Muhammad_Efendi has joined #openstack-keystone | 18:03 | |
| *** Muhammad_Efendi has quit IRC | 18:08 | |
| marekd|weekend | morganbird: what about https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#identity-provider-api ? | 18:09 |
| morganbird | Where would I put the cert from the idp in that case? | 18:11 |
| marekd|weekend | you need to conigure mod_shib | 18:12 |
| marekd|weekend | configure | 18:12 |
| morganbird | Okay, gotcha. The docs were a little vague on that and shib is complicated. Thanks. | 18:13 |
| marekd|weekend | i suggest reading: http://docs.openstack.org/developer/keystone/extensions/federation.html and http://docs.openstack.org/developer/keystone/configure_federation.html | 18:14 |
| *** browne has joined #openstack-keystone | 18:14 | |
| marekd|weekend | shib is not the easiest, but not super complicated, unless you want to do something really non standard | 18:14 |
| morganbird | Yeah, those are what I've been working from. | 18:15 |
| marekd|weekend | morganbird: allrigthy. | 18:15 |
| marekd|weekend | good luck then. | 18:15 |
| *** jasondotstar has quit IRC | 18:15 | |
| dstanek | stevemar: wha? http://logs.openstack.org/70/111170/5/check/gate-keystone-python26/1153c20/console.html i don't think the gate is very happy with you | 18:15 |
| stevemar | dstanek, seems that way | 18:16 |
| morganbird | Oh, fyi, the links under "Add Identity Provider(s), Mapping(s), and Protocol(s)" are all broken. | 18:16 |
| morganbird | On the configure federation doc. | 18:16 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Use oslosphinx in keystonemiddlware for documentation https://review.openstack.org/111909 | 18:17 |
| stevemar | dstanek, rpm: command not found | 18:17 |
| stevemar | interesting | 18:17 |
| dstanek | morganbird: this is our version of where's waldo | 18:17 |
| stevemar | jeez, abt time that one merged, it only took 4 rechecks | 18:17 |
| stevemar | lots of pip related errors lately, either sporadic timeout, or rax mirror failed | 18:18 |
| *** amirosh has quit IRC | 18:18 | |
| stevemar | morganbird, whaaa | 18:18 |
| *** henrynash_ has joined #openstack-keystone | 18:19 | |
| stevemar | morganfainberg, sigh, this is why we don't link to github | 18:19 |
| *** andreaf has quit IRC | 18:20 | |
| *** henrynash has quit IRC | 18:20 | |
| *** henrynash_ is now known as henrynash | 18:20 | |
| *** morganbird has quit IRC | 18:23 | |
| *** morganbird has joined #openstack-keystone | 18:23 | |
| *** browne has quit IRC | 18:24 | |
| *** jaosorior has joined #openstack-keystone | 18:26 | |
| *** jsavak has joined #openstack-keystone | 18:30 | |
| *** miqui has quit IRC | 18:32 | |
| *** joesavak has quit IRC | 18:33 | |
| *** stevemar has quit IRC | 18:43 | |
| *** stevemar has joined #openstack-keystone | 18:44 | |
| *** jorge_munoz has joined #openstack-keystone | 18:49 | |
| jorge_munoz | Hi all, how are endpoint in version 3 of keystone associated to a user’s project? What links them together? | 18:49 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 18:52 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add an OS-FEDERATION section to scoped federation tokens https://review.openstack.org/111070 | 18:58 |
| *** huats has quit IRC | 18:59 | |
| *** henrynash_ has joined #openstack-keystone | 19:01 | |
| *** henrynash has quit IRC | 19:01 | |
| *** henrynash_ is now known as henrynash | 19:01 | |
| *** david-lyle has quit IRC | 19:06 | |
| *** david-lyle has joined #openstack-keystone | 19:06 | |
| *** amirosh has joined #openstack-keystone | 19:07 | |
| *** jdennis has quit IRC | 19:07 | |
| *** jorge_munoz has quit IRC | 19:11 | |
| *** morganbird has quit IRC | 19:19 | |
| *** gabriel-bezerra has quit IRC | 19:21 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:22 | |
| *** jorge_munoz has joined #openstack-keystone | 19:27 | |
| *** gabriel-bezerra has quit IRC | 19:27 | |
| *** gabriel-bezerra has joined #openstack-keystone | 19:29 | |
| *** jdennis has joined #openstack-keystone | 19:31 | |
| *** ukalifon has joined #openstack-keystone | 19:35 | |
| *** ukalifon has quit IRC | 19:36 | |
| *** jorge_munoz has quit IRC | 19:36 | |
| *** jorge_munoz has joined #openstack-keystone | 19:41 | |
| *** morganfainberg has quit IRC | 19:43 | |
| *** morganfainberg has joined #openstack-keystone | 19:43 | |
| *** dickson.freenode.net sets mode: +o morganfainberg | 19:43 | |
| *** miqui has joined #openstack-keystone | 19:46 | |
| *** amirosh has quit IRC | 19:46 | |
| *** amirosh has joined #openstack-keystone | 19:47 | |
| *** amirosh has quit IRC | 19:51 | |
| *** ukalifon has joined #openstack-keystone | 19:56 | |
| *** spandhe has quit IRC | 19:59 | |
| *** hrybacki has quit IRC | 20:03 | |
| stevemar | two merges in a row! | 20:05 |
| *** saipandi has quit IRC | 20:09 | |
| *** hrybacki has joined #openstack-keystone | 20:14 | |
| *** openstackgerrit has quit IRC | 20:20 | |
| jorge_munoz | :qa | 20:21 |
| *** cray\ejp has left #openstack-keystone | 20:31 | |
| dstanek | stevemar: now you're done it...don't anger the gate | 20:31 |
| stevemar | dstanek, sorry sorry! | 20:32 |
| dstanek | dolphm: Alan didn't like https://review.openstack.org/#/c/111519/ | 20:32 |
| *** ukalifon has quit IRC | 20:38 | |
| henrynash | stevemar: if you’ve got the gate in a good mood….let’s sneak this tiddler in: https://review.openstack.org/#/c/112965/1 | 20:38 |
| *** david-lyle has quit IRC | 20:38 | |
| stevemar | henrynash, now i'm scared, i don't know what a tiddler is, or how the gate's going to like it :) | 20:39 |
| stevemar | done :) | 20:39 |
| henrynash | stevemar: be brave, mon veux, be brace | 20:39 |
| henrynash | (brave, even) | 20:39 |
| henrynash | stevemar: http://www.oxforddictionaries.com/definition/english/tiddler | 20:41 |
| dstanek | what in the world is this: https://review.openstack.org/#/c/112926/ | 20:43 |
| dstanek | and this https://review.openstack.org/#/c/112919/ | 20:44 |
| henrynash | dstanek: well at least jenkins didn’t fail it :-) | 20:44 |
| henrynash | dstanek: i saw this - I have now idea | 20:44 |
| dstanek | henrynash: i think the infra tools are just biased toward the other infra tools | 20:44 |
| stevemar | dstanek, i have no idea | 20:45 |
| henrynash | dstanek: ahh, infratoolswars | 20:45 |
| stevemar | henrynash, ahh a small fish | 20:46 |
| stevemar | or a small person | 20:46 |
| stevemar | anything small | 20:46 |
| henrynash | stevemar: yes, no slight on your manhood intended… | 20:46 |
| stevemar | henrynash, lol | 20:47 |
| stevemar | henrynash, dstanek not quite a tiddler, but it was already +2'ed, just needed a rebase: https://review.openstack.org/#/c/111070/ | 20:47 |
| stevemar | and since you both have already reviewed this one... i'd appreciate another go at: https://review.openstack.org/#/c/112204/ | 20:47 |
| *** hrybacki has quit IRC | 20:49 | |
| dstanek | stevemar: you needs to get your pep8s in order | 20:53 |
| henrynash | stevemar: that’s teh trouble with non-tiddlers…. | 20:54 |
| henrynash | willl be back on later | 20:54 |
| *** stevemar has quit IRC | 20:55 | |
| *** saipandi has joined #openstack-keystone | 21:01 | |
| *** jorge_munoz has left #openstack-keystone | 21:03 | |
| *** gordc has quit IRC | 21:07 | |
| *** saipandi has quit IRC | 21:08 | |
| ayoung | this is how you get a certificate with certmonger. sudo ipa-getcert request -d /etc/httpd/alias -n Server-Cert -K HTTP/keystone.younglogic.net@YOUNGLOGIC.NET -N 'CN=keystone.younglogic.net,O=YOUNGLOGIC.NET' | 21:30 |
| elmiko | ayoung: hey, i kinda lost track of the time. could we catch up on monday? | 21:37 |
| *** gabriel-bezerra has quit IRC | 21:37 | |
| ayoung | elmiko, yes. I was sucked into a bug hunt | 21:37 |
| elmiko | ayoung: no worries :) | 21:37 |
| ayoung | the devstack setup just finished | 21:37 |
| elmiko | lol wow | 21:37 |
| ayoung | nah, I had not kicked it off until recently | 21:38 |
| elmiko | ahh ok | 21:38 |
| ayoung | I got the vm started, then had to shift gears... | 21:38 |
| elmiko | tocha | 21:38 |
| elmiko | gotcha even... | 21:38 |
| ayoung | elmiko, so the next step is to figure out how to add an LDAP config on top of it, but I think henrynash is doing family stuff at the moment | 21:38 |
| ayoung | means I have to think for myseld | 21:38 |
| ayoung | dammit | 21:39 |
| elmiko | sounds dangerous ;) | 21:39 |
| ayoung | Be thankful I'm not on your hardware | 21:39 |
| elmiko | lol | 21:39 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:39 | |
| ayoung | elmiko, you have a public key you can send me, I'll get you into the VM where I set up devstack | 21:40 |
| elmiko | sure, email ok? | 21:40 |
| *** jsavak has quit IRC | 21:41 | |
| ayoung | elmiko, works fine, or PM | 21:41 |
| *** spandhe_ has joined #openstack-keystone | 21:42 | |
| elmiko | ayoung: mail sent | 21:42 |
| elmiko | i'm remote, will i need to use the vpn to access the machine? | 21:42 |
| *** marzif_ has joined #openstack-keystone | 21:43 | |
| *** david-lyle has joined #openstack-keystone | 21:48 | |
| *** miqui has quit IRC | 21:48 | |
| elmiko | ayoung: gotta run, i might be back later. if not, have a good weekend :) | 21:52 |
| *** elmiko is now known as _elmiko | 21:52 | |
| *** Raildo_ has joined #openstack-keystone | 21:53 | |
| *** spandhe_ has quit IRC | 21:57 | |
| *** spandhe_ has joined #openstack-keystone | 21:58 | |
| *** Raildo has joined #openstack-keystone | 22:01 | |
| *** spandhe_ has quit IRC | 22:03 | |
| *** spandhe_ has joined #openstack-keystone | 22:03 | |
| *** Raildo_ has quit IRC | 22:04 | |
| *** spandhe_ has joined #openstack-keystone | 22:05 | |
| *** spandhe_ has quit IRC | 22:09 | |
| *** henrynash has quit IRC | 22:11 | |
| *** spandhe_ has joined #openstack-keystone | 22:11 | |
| *** Raildo has quit IRC | 22:11 | |
| *** stevemar has joined #openstack-keystone | 22:25 | |
| stevemar | dstanek, apparently when i'm offline everything gets merged | 22:26 |
| dstanek | stevemar: that may be the universe trying to tell you to go grab a beer | 22:29 |
| stevemar | dstanek, and a burger | 22:30 |
| *** david-lyle has quit IRC | 22:37 | |
| *** david-lyle has joined #openstack-keystone | 22:37 | |
| *** david-lyle has quit IRC | 22:37 | |
| *** david-lyle has joined #openstack-keystone | 22:38 | |
| *** openstackgerrit has joined #openstack-keystone | 22:38 | |
| *** spandhe_ has quit IRC | 22:39 | |
| *** david-lyle has quit IRC | 22:42 | |
| *** gabriel-bezerra has quit IRC | 22:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 23:03 | |
| *** stevemar has quit IRC | 23:40 | |
| *** jaosorior has quit IRC | 23:42 | |
| *** richm has left #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!