| *** hrybacki has quit IRC | 00:14 | |
| *** ayoung has quit IRC | 01:25 | |
| openstackgerrit | A change was merged to openstack/keystone: Use functions in oslo.utils https://review.openstack.org/112157 | 01:32 |
|---|---|---|
| openstackgerrit | A change was merged to openstack/keystone: Remove strutils and timeutils from openstack-common.conf https://review.openstack.org/112158 | 01:32 |
| *** ayoung has joined #openstack-keystone | 01:37 | |
| ayoung | morganfainberg, in case you are awake https://bugs.launchpad.net/keystone/+bug/1354765 | 01:38 |
| uvirtbot | Launchpad bug 1354765 in keystone "Valid V3 tokens reported as invalid" [Critical,New] | 01:38 |
| *** grantbow has joined #openstack-keystone | 01:41 | |
| *** stevemar has quit IRC | 02:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove fixture from openstack-common.conf https://review.openstack.org/103255 | 02:31 |
| morganfainberg | ayoung, i saw the email, i'll look at it on monday | 02:37 |
| morganfainberg | ayoung, however, the unique id calculation shouldn't have changed and/or we have a test gap (tempest AND unit) | 02:38 |
| morganfainberg | ayoung, also uhhh, "unscoped" token list domains? | 02:39 |
| *** xianghui has quit IRC | 02:40 | |
| morganfainberg | ayoung, or are you just using the wrong phrase at the top of the bug? | 02:40 |
| *** xianghui has joined #openstack-keystone | 02:41 | |
| *** stevemar has joined #openstack-keystone | 02:42 | |
| *** xianghui has quit IRC | 03:00 | |
| ayoung | morganfainberg, yeah, that was a typo. I have unscoped tokens on the brain | 03:09 |
| morganfainberg | ayoung, likely this has been broken for a while | 03:10 |
| ayoung | morganfainberg, it caught me by surprise. It smells like something is out of sync between creating the token, hashing it, persisting, and hashing the persisted form | 03:10 |
| ayoung | I don't think so | 03:10 |
| morganfainberg | ayoung, the way we create the unique id *hasn't* changed | 03:10 |
| ayoung | I've been pointing people at thje v3 token example for a while | 03:10 |
| ayoung | I know. | 03:10 |
| ayoung | it should be md5 everywhere still | 03:10 |
| morganfainberg | ayoung, like i said, i think it's been broken for a while (as in sometime in the juno cycle) | 03:10 |
| ayoung | morganfainberg, do you have a devstack handy? Maybe its just mine? | 03:11 |
| morganfainberg | nope, and i need to get dinner. wont be able to take more than the code glance at it till monday | 03:11 |
| ayoung | seems to me this is something that should be caught by unit tests | 03:11 |
| ayoung | no problem | 03:11 |
| morganfainberg | exactly. | 03:11 |
| morganfainberg | check your admin account's roels on demo | 03:11 |
| morganfainberg | make sure it actually has admin | 03:11 |
| ayoung | Not policy | 03:11 |
| ayoung | I've run in the debugger that far | 03:12 |
| ayoung | Oh, BTW, remote-pdb is easy | 03:12 |
| ayoung | unlike pydevd, when remote hits a breakpoint, it sits and waits and listens on a socket. Then you telnet to that port and you are in a debug session | 03:12 |
| ayoung | No, it fails in the middleware get_token call because the token_id is invalid | 03:13 |
| morganfainberg | my guess is this will resolve itself once i fix the middleware | 03:13 |
| morganfainberg | which is blocking on the federated user domain stuff | 03:13 |
| ayoung | Yeah. That is kindof what I was thinking | 03:13 |
| ayoung | feh, really? | 03:13 |
| morganfainberg | yes | 03:13 |
| morganfainberg | revocation events *cant* handle a token with a user that has no domain :( | 03:14 |
| morganfainberg | so can't pass the unit tests. | 03:14 |
| ayoung | that is a trivial thing to fix | 03:14 |
| morganfainberg | right, but the question is do we "fix" revocation events or do we fix the token? | 03:14 |
| ayoung | both | 03:14 |
| ayoung | there is no reason to hard require a domain in the token | 03:15 |
| morganfainberg | negative. if tokens always have users with domain data, we make it so a token w/o it can't validate | 03:15 |
| morganfainberg | we should make that a determiniation, which we haven't | 03:15 |
| morganfainberg | that was part of that conversation | 03:15 |
| ayoung | because the user id comes from a domain, and if the domain is disabled we want to have the token disabled? | 03:15 |
| morganfainberg | is a token (currently malformed without user['domain'] based on identity-api) valid | 03:15 |
| morganfainberg | yep | 03:15 |
| ayoung | hmmm....I agree on that point | 03:16 |
| morganfainberg | if all tokens for XXX domain are invalid users for domain XXX i think are invalid (i think thats the way it works) | 03:16 |
| morganfainberg | erm tokens for any user on domain XXX | 03:16 |
| * morganfainberg is only half thinking keystone atm. i was merrily about to grab dinner | 03:16 | |
| morganfainberg | :P | 03:16 |
| ayoung | still, it should not be up to revocation events to check that the token has all required values | 03:17 |
| ayoung | just that a token it is given is revoked or not... | 03:17 |
| morganfainberg | no, that should be part of .validate_token | 03:17 |
| morganfainberg | :) | 03:17 |
| ayoung | let split it into two pieces | 03:17 |
| ayoung | first, hack the revocation events code such that it passes. Then add an explicit check that at token has all required data | 03:17 |
| morganfainberg | fixing the middleware will run this all through validate and validate *should* start ensuring all the values we expect are there | 03:17 |
| morganfainberg | eh. | 03:18 |
| morganfainberg | i think we have a lot of fixing in revocation events to make that happen | 03:18 |
| morganfainberg | your build tokenmodel makes some assumptions about format | 03:18 |
| morganfainberg | easier to just do the latter | 03:18 |
| ayoung | yeah | 03:18 |
| morganfainberg | and gets us to the same place :) | 03:19 |
| ayoung | then the broken v3 stuff needs to be addressed first | 03:19 |
| ayoung | I'll see if i can find a root cause | 03:19 |
| ayoung | just wondered if you could see something that might have changed to break it? | 03:19 |
| ayoung | Anyway, go eat. I'm headed to bed | 03:19 |
| morganfainberg | nah, i commented on the bug w/ my quick trace of the code | 03:19 |
| morganfainberg | and that it looked the same as before | 03:19 |
| morganfainberg | catch ya on monday | 03:20 |
| ayoung | I have a feeling it is something about the marshalling of the PKIZ token, such that what is getting hashed the first time does not match what keys hashed the second time | 03:20 |
| morganfainberg | we can do more indepth searching (also, very curious what gap we have in testing ) | 03:20 |
| ayoung | keys -> gets | 03:21 |
| morganfainberg | eh, could be keystoneclient cms being dumb about re-hashing tokens | 03:21 |
| ayoung | nope | 03:21 |
| ayoung | I did straight curl | 03:21 |
| morganfainberg | that would be unfortunate | 03:21 |
| morganfainberg | cms.hash_token | 03:21 |
| morganfainberg | or whatever it is | 03:21 |
| ayoung | Maybe, but I'll trace it can get you more data | 03:21 |
| morganfainberg | need to make sure cms.hash_token(cms.hash_token(token)) isn't being dumb because thats how we get the id. | 03:21 |
| morganfainberg | sure | 03:21 |
| morganfainberg | or we can just sync up and do the deep dive on monday | 03:22 |
| morganfainberg | it *is* the weekend dude :) | 03:22 |
| ayoung | Oh. Yeah. Hadn't noticed | 03:22 |
| * morganfainberg goes to watch GotG post dinner, lets see if i can get the non-make-me-want-to-vomit-3d version | 03:22 | |
| ayoung | Kids asleep upstairs. Wife is in NT. | 03:23 |
| morganfainberg | e.g. non-3d | 03:23 |
| morganfainberg | hehe | 03:23 |
| morganfainberg | well, have a good evening man. catch ya monday | 03:23 |
| morganfainberg | :) | 03:23 |
| ayoung | GotG was pretty good. I'm with you on non 3d | 03:23 |
| *** stevemar has quit IRC | 03:44 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Clean whitespace off token. https://review.openstack.org/113108 | 03:57 |
| *** stevemar has joined #openstack-keystone | 04:04 | |
| stevemar | ayoung, morganfainberg i was supposed to watch GotG this weekend, but it's gonna have to wait til later on in the week :( | 04:18 |
| *** ayoung has quit IRC | 04:18 | |
| *** marzif_ has quit IRC | 04:26 | |
| *** chandankumar_ has joined #openstack-keystone | 04:29 | |
| *** amirosh has joined #openstack-keystone | 04:57 | |
| *** chandankumar_ has quit IRC | 04:59 | |
| *** RicoLin has joined #openstack-keystone | 05:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| *** amirosh has quit IRC | 06:05 | |
| *** ukalifon has joined #openstack-keystone | 06:08 | |
| *** rkofman has joined #openstack-keystone | 06:16 | |
| *** bvandenh has quit IRC | 06:20 | |
| *** RicoLin has quit IRC | 06:45 | |
| *** RicoLin has joined #openstack-keystone | 06:46 | |
| *** rkofman has left #openstack-keystone | 06:51 | |
| *** amirosh has joined #openstack-keystone | 07:02 | |
| *** amirosh has quit IRC | 07:07 | |
| *** RicoLin has quit IRC | 07:19 | |
| *** RicoLin has joined #openstack-keystone | 07:20 | |
| *** bvandenh has joined #openstack-keystone | 07:59 | |
| *** hrybacki has joined #openstack-keystone | 07:59 | |
| *** chandankumar has joined #openstack-keystone | 08:03 | |
| *** amirosh has joined #openstack-keystone | 08:03 | |
| *** amirosh has quit IRC | 08:08 | |
| *** tomoiaga has joined #openstack-keystone | 08:09 | |
| *** tomoiaga has quit IRC | 08:16 | |
| *** bvandenh has quit IRC | 08:20 | |
| *** bvandenh has joined #openstack-keystone | 08:21 | |
| *** chandankumar has quit IRC | 08:24 | |
| *** bvandenh has quit IRC | 08:26 | |
| *** chandankumar has joined #openstack-keystone | 08:32 | |
| *** hrybacki has quit IRC | 08:41 | |
| *** chandankumar has quit IRC | 08:43 | |
| *** amirosh has joined #openstack-keystone | 09:04 | |
| *** henrynash has joined #openstack-keystone | 09:05 | |
| *** amirosh has quit IRC | 09:09 | |
| *** chandankumar has joined #openstack-keystone | 09:18 | |
| *** bvandenh has joined #openstack-keystone | 09:31 | |
| *** chandankumar has quit IRC | 09:48 | |
| *** bvandenh has quit IRC | 09:51 | |
| *** bvandenh has joined #openstack-keystone | 09:53 | |
| *** RicoLin has quit IRC | 09:55 | |
| *** RicoLin has joined #openstack-keystone | 09:56 | |
| *** RicoLin has quit IRC | 10:00 | |
| *** amirosh has joined #openstack-keystone | 10:05 | |
| *** bvandenh has quit IRC | 10:09 | |
| *** amirosh has quit IRC | 10:09 | |
| *** henrynash has quit IRC | 10:38 | |
| *** stevemar has quit IRC | 10:47 | |
| *** rico has joined #openstack-keystone | 10:55 | |
| *** rico has quit IRC | 10:58 | |
| *** RicoLin has joined #openstack-keystone | 10:58 | |
| *** amirosh has joined #openstack-keystone | 11:06 | |
| *** amirosh_ has joined #openstack-keystone | 11:08 | |
| *** amirosh has quit IRC | 11:08 | |
| *** amirosh_ has quit IRC | 11:12 | |
| *** henrynash has joined #openstack-keystone | 11:24 | |
| *** RicoLin has quit IRC | 11:55 | |
| *** amirosh has joined #openstack-keystone | 12:08 | |
| *** amirosh has quit IRC | 12:13 | |
| *** amirosh has joined #openstack-keystone | 12:30 | |
| *** henrynash has quit IRC | 12:36 | |
| *** henrynash has joined #openstack-keystone | 12:36 | |
| *** diegows has joined #openstack-keystone | 12:56 | |
| *** henrynash has quit IRC | 13:40 | |
| *** boris-42 has quit IRC | 14:02 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Support the hints mechanism in list_credentials() https://review.openstack.org/113091 | 14:06 |
| *** amirosh has quit IRC | 14:07 | |
| *** amirosh has joined #openstack-keystone | 14:07 | |
| *** amirosh has quit IRC | 14:12 | |
| *** ukalifon has quit IRC | 14:37 | |
| *** henrynash has joined #openstack-keystone | 14:40 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Remove __BaseFederationExtension. https://review.openstack.org/113136 | 14:54 |
| *** henrynash has quit IRC | 14:55 | |
| *** rustlebee is now known as russellb | 14:55 | |
| *** ayoung has joined #openstack-keystone | 14:59 | |
| *** amirosh has joined #openstack-keystone | 15:11 | |
| *** amirosh has quit IRC | 15:39 | |
| *** amirosh has joined #openstack-keystone | 15:39 | |
| *** amirosh has quit IRC | 15:44 | |
| *** stevemar has joined #openstack-keystone | 16:06 | |
| *** stevemar has quit IRC | 16:09 | |
| *** amirosh has joined #openstack-keystone | 16:48 | |
| *** rwsu has quit IRC | 16:50 | |
| *** hrybacki has joined #openstack-keystone | 17:18 | |
| *** amirosh has quit IRC | 17:30 | |
| *** amirosh has joined #openstack-keystone | 17:31 | |
| *** amirosh has quit IRC | 17:36 | |
| *** hrybacki has quit IRC | 17:47 | |
| *** diegows has quit IRC | 18:10 | |
| *** amirosh has joined #openstack-keystone | 18:11 | |
| *** amirosh has quit IRC | 18:16 | |
| *** henrynash has joined #openstack-keystone | 18:33 | |
| *** stevemar has joined #openstack-keystone | 18:44 | |
| *** amirosh has joined #openstack-keystone | 18:52 | |
| *** jorge_munoz has joined #openstack-keystone | 19:01 | |
| *** jorge_munoz has quit IRC | 19:03 | |
| *** ukalifon has joined #openstack-keystone | 19:10 | |
| *** nbarnett has joined #openstack-keystone | 19:16 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Support the hints mechanism in list_credentials() https://review.openstack.org/113091 | 19:18 |
| *** nbarnett has quit IRC | 19:25 | |
| *** amirosh has quit IRC | 19:25 | |
| *** ukalifon has quit IRC | 19:25 | |
| *** nbarnett has joined #openstack-keystone | 19:25 | |
| *** amirosh has joined #openstack-keystone | 19:25 | |
| *** nbarnett has quit IRC | 19:27 | |
| *** PsionTheory has joined #openstack-keystone | 19:28 | |
| *** amirosh has quit IRC | 19:30 | |
| *** hrybacki has joined #openstack-keystone | 19:48 | |
| *** hrybacki has quit IRC | 19:53 | |
| *** bvandenh has joined #openstack-keystone | 20:13 | |
| *** openstack has joined #openstack-keystone | 20:17 | |
| *** joesavak has joined #openstack-keystone | 20:26 | |
| *** hrybacki has joined #openstack-keystone | 20:29 | |
| *** bvandenh has quit IRC | 20:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 20:32 |
| *** joesavak has quit IRC | 20:33 | |
| *** PsionTheory has quit IRC | 20:38 | |
| *** stevemar has quit IRC | 21:14 | |
| *** boris-42 has joined #openstack-keystone | 21:14 | |
| *** henrynash has quit IRC | 21:19 | |
| *** hrybacki has quit IRC | 21:37 | |
| *** fifieldt__ has joined #openstack-keystone | 21:44 | |
| *** fifieldt_ has quit IRC | 21:48 | |
| *** joesavak has joined #openstack-keystone | 22:23 | |
| *** diegows has joined #openstack-keystone | 22:30 | |
| *** jsavak has joined #openstack-keystone | 22:58 | |
| *** joesavak has quit IRC | 23:00 | |
| *** hrybacki has joined #openstack-keystone | 23:04 | |
| *** jamielennox|away is now known as jamielennox | 23:32 | |
| *** oomichi has joined #openstack-keystone | 23:45 | |
| *** hrybacki has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!