| *** wwriverrat1 has left #openstack-keystone | 00:04 | |
| *** wwriverrat1 has joined #openstack-keystone | 00:04 | |
| *** nkinder has quit IRC | 00:10 | |
| *** gyee has quit IRC | 00:25 | |
| *** gokrokve has quit IRC | 00:35 | |
| *** joesavak has joined #openstack-keystone | 00:46 | |
| *** joesavak has quit IRC | 00:51 | |
| *** joesavak has joined #openstack-keystone | 00:52 | |
| *** jsavak has joined #openstack-keystone | 00:57 | |
| *** joesavak has quit IRC | 00:59 | |
| *** amcrn has quit IRC | 01:02 | |
| *** gus has joined #openstack-keystone | 01:03 | |
| *** packet has joined #openstack-keystone | 01:03 | |
| *** jsavak has quit IRC | 01:04 | |
| gus | Request for reviews on https://review.openstack.org/#/c/110512/ - simple/obvious fix to issue one sql statement per execute() call | 01:05 |
|---|---|---|
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone-specs: Update JSON Home for docs location https://review.openstack.org/113413 | 01:09 |
| *** packet has quit IRC | 01:10 | |
| *** hrybacki has quit IRC | 01:10 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Standardize AccessInfo token setting https://review.openstack.org/113415 | 01:14 |
| *** xianghuihui has quit IRC | 01:21 | |
| *** xianghui has joined #openstack-keystone | 01:26 | |
| *** richm has left #openstack-keystone | 01:27 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 01:28 |
| *** gokrokve has joined #openstack-keystone | 01:29 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/identity-api: JSON Home support https://review.openstack.org/109881 | 01:34 |
| *** xianghui has quit IRC | 01:34 | |
| *** xianghuihui has joined #openstack-keystone | 01:34 | |
| morganfainberg | gus, +2 LGTM | 01:36 |
| gus | morganfainberg: thanks! (still need a second +2) | 01:40 |
| morganfainberg | gus, yep. | 01:40 |
| morganfainberg | gus, but it is a clean/easy to read change. and it wont affect anything except enabling mysqlconnector | 01:40 |
| morganfainberg | gus, you'll probably get another +2 without too much hassle (** this statement is no guarantee on that) | 01:41 |
| gus | yeah. Unfortunately this particular piece of code is cut+pasted across ~every openstack project, so I have to repeat this half a dozen times :( | 01:41 |
| *** nkinder has joined #openstack-keystone | 01:51 | |
| morganfainberg | gus, heh | 02:00 |
| *** gokrokve has quit IRC | 02:14 | |
| morganfainberg | bknudson, ping we merged the fix for revocation events that reduced the accuracy to 1s right? | 02:21 |
| morganfainberg | bknudson, for revoke by expiration | 02:21 |
| bknudson | morganfainberg: in keystone, yes | 02:21 |
| morganfainberg | bknudson, well crap | 02:21 |
| bknudson | it was also backported to icehouse | 02:21 |
| morganfainberg | bknudson, that is now breaking my work to try and convert to validate_token :(. i guess i could sleep(1) to guarantee a different expires time | 02:22 |
| bknudson | should be easy to revert... although it will cause the tests to fail again | 02:22 |
| morganfainberg | nah, i'll add a sleep 1 in the affected tests (2 tests around revocation list) | 02:22 |
| bknudson | morganfainberg: the test should control the clock... don't sleep | 02:22 |
| morganfainberg | bknudson, uh. | 02:22 |
| bknudson | you can override utcnow()... | 02:22 |
| morganfainberg | bknudson, oh. mock it? | 02:22 |
| morganfainberg | bknudson, sure. *cringes* | 02:23 |
| bknudson | y, I think there's examples in keystoneclient | 02:23 |
| morganfainberg | yeah i've done it before | 02:23 |
| morganfainberg | we really need to fix the issue w/ mysql's token expires | 02:23 |
| * morganfainberg shrugs/ | 02:24 | |
| bknudson | morganfainberg: http://git.openstack.org/cgit/openstack/oslo.utils/tree/oslo/utils/timeutils.py#n106 | 02:24 |
| morganfainberg | no don't use override | 02:24 |
| morganfainberg | actually use mock and mock out utcnow | 02:24 |
| morganfainberg | i actually went through and removed a bunch of setting that overide value in icehouse iirc | 02:25 |
| bknudson | morganfainberg: don't use set_time_override()? or don't use timeutils.utcnow? | 02:25 |
| morganfainberg | don't use .set_time_override | 02:25 |
| bknudson | what's wrong with it? | 02:26 |
| morganfainberg | it's better to just use mock, since it will automatically undo itself (context manager) etc | 02:26 |
| bknudson | and if we're not supposed to use it then shouldn't it say to not use it? | 02:26 |
| morganfainberg | you don't need to remember to clean up, and iirc oslo team wanted to remove it | 02:26 |
| morganfainberg | yeah there might be a missing comment/deprecation warning | 02:26 |
| bknudson | I'm surprised it wasn't removed in the switch to a lib | 02:26 |
| morganfainberg | yeah i dunno :( i just remeber the conversation | 02:26 |
| bknudson | I think dhellmann was talking about this at the oslo meeting on Fri. | 02:27 |
| bknudson | he mentioned adding a fixture or something. | 02:27 |
| bknudson | I like the advance_time_delta functions... that's kind of neat | 02:27 |
| bknudson | our tests should have full control of the clock all the time. | 02:28 |
| morganfainberg | bknudson, yeah it's not hard to do w/ mock, just did: | 02:33 |
| morganfainberg | http://pasteraw.com/bnf7dkf9juv3qh2t6iircizhp5uyeq | 02:34 |
| morganfainberg | works like a charm | 02:34 |
| bknudson | neat! | 02:34 |
| morganfainberg | yeah | 02:34 |
| morganfainberg | thanks for saying don't sleep, made me remember about mock :) | 02:35 |
| bknudson | sleep is evil | 02:35 |
| morganfainberg | reminds me i'll fix a couple of the slow cache tests that use sleep | 02:35 |
| morganfainberg | should save us ~10s on test runs (yeah i know 10s isn't *that* much) | 02:36 |
| morganfainberg | hm. or .. maybe it was already fixed | 02:37 |
| bknudson | 10s is a lot for unit tests | 02:38 |
| morganfainberg | oooh it's not the test that sleeps, it's the actual lock blocking | 02:38 |
| morganfainberg | yeah can still fix this with magic mock stuff | 02:39 |
| *** david-lyle has joined #openstack-keystone | 02:44 | |
| *** diegows has quit IRC | 02:49 | |
| * morganfainberg taps foot waiting on a merge | 03:06 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 03:12 |
| openstackgerrit | A change was merged to openstack/keystone: Enhance V3 router class for resources https://review.openstack.org/111568 | 03:13 |
| openstackgerrit | A change was merged to openstack/keystone: Remove assignment controller dependency on token_api https://review.openstack.org/109162 | 03:13 |
| openstackgerrit | A change was merged to openstack/keystone: add i18n to lxml error https://review.openstack.org/112914 | 03:13 |
| stevemar | morganfainberg, yay most of it merged | 03:17 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 03:18 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 03:20 |
| morganfainberg | stevemar, lol the next one is "fun" | 03:21 |
| morganfainberg | stevemar, but i think the vision is starting to come together | 03:21 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 03:27 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove default check keys in assertValidEntity https://review.openstack.org/112573 | 03:28 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 03:29 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 03:30 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 03:30 |
| jamielennox | do you think people would care if i broke keyring support in shell? | 03:34 |
| morganfainberg | jamielennox, they probably would :( | 03:35 |
| jamielennox | morganfainberg: what about if i can keep it in shell, but rip it out of the client - it never belonged there anyway | 03:35 |
| morganfainberg | jamielennox, lots of people use ksc not osc (older installs) and i'm *sure* someone would be vocally unhappy about it | 03:35 |
| morganfainberg | jamielennox, i don't see any issue with that personally. it afact should *only* be shell, if someone is using it otherwise I'd tell them "uhh. store your token another way" though you *might* want to deprecate that with a warning message first | 03:36 |
| *** rwsu has quit IRC | 03:38 | |
| * morganfainberg needs food badly </gauntlet> | 03:38 | |
| *** KimJ has quit IRC | 03:42 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent password authentication plugin https://review.openstack.org/81147 | 03:54 |
| *** chandankumar has joined #openstack-keystone | 03:55 | |
| *** david-lyle has quit IRC | 04:08 | |
| *** david-lyle has joined #openstack-keystone | 04:08 | |
| *** david-lyle has quit IRC | 04:13 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 04:13 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 04:18 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 04:18 |
| morganfainberg | wow.. rebase *FAIL* | 04:19 |
| *** chandankumar has quit IRC | 04:20 | |
| morganfainberg | bknudson, so, can't control the test w/o a sleep. it's making a restful call, and changing utcnow with a mock isn't affecting the app | 04:24 |
| morganfainberg | :( | 04:24 |
| jamielennox | if i was starting again with shell do you think it makes sense to provide --os-token | 04:24 |
| jamielennox | that time mock should go to upstream fixtures | 04:24 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 04:31 |
| morganfainberg | jamielennox, in this case it wont help | 04:31 |
| morganfainberg | jamielennox, we're doing a restful call, and restful calls will hit code that wont see the mock :( | 04:32 |
| morganfainberg | ^^ fix + large todo comment | 04:32 |
| jamielennox | morganfainberg: yea, was just an observation in the past | 04:32 |
| jamielennox | observation i'd made before that i thought we should do sometime | 04:32 |
| morganfainberg | ah | 04:32 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 04:34 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 04:34 |
| morganfainberg | jamielennox, no sure about --os-token :( | 04:34 |
| jamielennox | morganfainberg: i don't know if i have a choice, it exists | 04:34 |
| morganfainberg | jamielennox, i'm running on a bit low blood sugar so i'm not in an optimal state to make a call on that | 04:34 |
| jamielennox | morganfainberg: no worries, tomorrow morning at the meeting i'm going to try and push some client reviews on people - so i'll get you then anyway | 04:37 |
| jamielennox | s/morning/some time | 04:37 |
| morganfainberg | jamielennox, hehe hey i've been reviewing client stuff! | 04:37 |
| jamielennox | morganfainberg: you have, thanks - still need to crack the whip occasionally :) | 04:37 |
| morganfainberg | jamielennox, this is likely a quick review: https://review.openstack.org/#/c/113108/ if you have a second to look at a 1-liner | 04:41 |
| jamielennox | morganfainberg: done | 04:41 |
| morganfainberg | jamielennox, thanks | 04:41 |
| *** ildikov has quit IRC | 05:03 | |
| *** ajayaa has joined #openstack-keystone | 05:05 | |
| *** rharwood has quit IRC | 05:07 | |
| *** jamielen- has joined #openstack-keystone | 05:07 | |
| *** jamielennox has quit IRC | 05:08 | |
| *** rharwood has joined #openstack-keystone | 05:08 | |
| *** wanghong has quit IRC | 05:15 | |
| *** jamielen- is now known as jamielennox | 05:15 | |
| *** chandankumar has joined #openstack-keystone | 05:16 | |
| *** wanghong has joined #openstack-keystone | 05:16 | |
| *** chandankumar has quit IRC | 05:17 | |
| *** chandankumar has joined #openstack-keystone | 05:17 | |
| *** k4n0 has joined #openstack-keystone | 05:37 | |
| openstackgerrit | A change was merged to openstack/keystone: Clean whitespace off token. https://review.openstack.org/113108 | 05:42 |
| *** rharwood has quit IRC | 05:43 | |
| *** jamielen| has joined #openstack-keystone | 05:44 | |
| *** jamielen| has quit IRC | 05:44 | |
| *** jasondotstar has quit IRC | 05:45 | |
| *** jamielen| has joined #openstack-keystone | 05:45 | |
| *** jamielen| has quit IRC | 05:45 | |
| *** jamielennox has quit IRC | 05:46 | |
| *** rharwood has joined #openstack-keystone | 05:46 | |
| *** jamielennox has joined #openstack-keystone | 05:47 | |
| *** jasondotstar has joined #openstack-keystone | 05:47 | |
| *** tomoiaga has joined #openstack-keystone | 05:54 | |
| *** rushiagr_away is now known as rushiagr | 05:54 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Implemented caching in identity layer. https://review.openstack.org/110575 | 05:55 |
| *** ukalifon has joined #openstack-keystone | 05:57 | |
| *** abhishekk has joined #openstack-keystone | 06:01 | |
| *** jamielen- has joined #openstack-keystone | 06:01 | |
| *** rharwood has quit IRC | 06:01 | |
| *** jasondotstar has quit IRC | 06:02 | |
| *** portante has quit IRC | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:04 |
| *** jamielennox has quit IRC | 06:05 | |
| *** portante has joined #openstack-keystone | 06:06 | |
| *** jasondotstar has joined #openstack-keystone | 06:06 | |
| *** rharwood has joined #openstack-keystone | 06:07 | |
| *** wwriverrat has joined #openstack-keystone | 06:08 | |
| *** wwriverrat1 has quit IRC | 06:09 | |
| *** ildikov has joined #openstack-keystone | 06:15 | |
| *** ajayaa has quit IRC | 06:18 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 06:19 |
| *** amirosh has joined #openstack-keystone | 06:23 | |
| *** ildikov has quit IRC | 06:27 | |
| *** stevemar has quit IRC | 06:34 | |
| *** ajayaa has joined #openstack-keystone | 06:39 | |
| *** bvandenh has joined #openstack-keystone | 06:44 | |
| *** abhishekk has quit IRC | 06:54 | |
| *** abhishekk has joined #openstack-keystone | 06:54 | |
| *** henrynash has joined #openstack-keystone | 07:14 | |
| *** jaosorior has joined #openstack-keystone | 07:29 | |
| *** afazekas has joined #openstack-keystone | 07:31 | |
| *** Krast has joined #openstack-keystone | 07:55 | |
| *** fifieldt__ is now known as fifieldt | 07:59 | |
| *** tomoiaga has quit IRC | 08:00 | |
| *** Krast has quit IRC | 08:02 | |
| *** Krast has joined #openstack-keystone | 08:06 | |
| *** Dafna has joined #openstack-keystone | 08:07 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 08:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 08:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 08:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to requests-mock https://review.openstack.org/110210 | 08:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 08:12 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 08:12 |
| *** andreaf has quit IRC | 08:23 | |
| *** andreaf_ has joined #openstack-keystone | 08:23 | |
| *** jamielen- is now known as jamielennox|away | 08:24 | |
| *** abhishekk has quit IRC | 08:36 | |
| *** abhishekk has joined #openstack-keystone | 08:37 | |
| *** andreaf has joined #openstack-keystone | 08:37 | |
| *** Krast has quit IRC | 08:40 | |
| *** andreaf_ has quit IRC | 08:40 | |
| *** Krast has joined #openstack-keystone | 08:40 | |
| *** andreaf_ has joined #openstack-keystone | 08:42 | |
| *** andreaf has quit IRC | 08:45 | |
| *** tomoiaga has joined #openstack-keystone | 08:46 | |
| *** abhishekk has quit IRC | 08:46 | |
| *** abhishekk has joined #openstack-keystone | 08:47 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Enable filtering of credentials by user ID https://review.openstack.org/113232 | 09:17 |
| *** wolsen has quit IRC | 09:20 | |
| *** wolsen has joined #openstack-keystone | 09:25 | |
| *** andreaf has joined #openstack-keystone | 09:40 | |
| *** andreaf has quit IRC | 09:40 | |
| *** andreaf has joined #openstack-keystone | 09:41 | |
| *** andreaf_ has quit IRC | 09:42 | |
| *** andreaf has quit IRC | 09:46 | |
| *** serverascode has quit IRC | 09:47 | |
| *** zhiyan has quit IRC | 09:47 | |
| *** serverascode has joined #openstack-keystone | 09:49 | |
| *** ctracey has quit IRC | 09:49 | |
| *** jraim has quit IRC | 09:51 | |
| *** zhiyan has joined #openstack-keystone | 09:52 | |
| *** jaosorior has quit IRC | 09:52 | |
| *** serverascode has quit IRC | 09:53 | |
| *** ctracey has joined #openstack-keystone | 09:53 | |
| *** jraim has joined #openstack-keystone | 09:54 | |
| *** jaosorior has joined #openstack-keystone | 09:57 | |
| *** zhiyan has quit IRC | 09:57 | |
| *** zhiyan has joined #openstack-keystone | 09:59 | |
| *** serverascode has joined #openstack-keystone | 10:00 | |
| *** andreaf has joined #openstack-keystone | 10:04 | |
| *** ajayaa has quit IRC | 10:19 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow registering indeividual plugin CONF options https://review.openstack.org/113478 | 10:23 |
| *** ajayaa has joined #openstack-keystone | 10:30 | |
| *** andreaf_ has joined #openstack-keystone | 10:35 | |
| *** andreaf has quit IRC | 10:37 | |
| *** andreaf_ has quit IRC | 10:43 | |
| *** Krast has quit IRC | 10:50 | |
| *** RockKuo_Home has joined #openstack-keystone | 10:51 | |
| *** andreaf has joined #openstack-keystone | 11:01 | |
| *** andreaf_ has joined #openstack-keystone | 11:04 | |
| *** andreaf has quit IRC | 11:08 | |
| *** jasondotstar has quit IRC | 11:18 | |
| *** afaranha has joined #openstack-keystone | 11:33 | |
| *** jamielennox|away has quit IRC | 11:34 | |
| *** jamielennox|away has joined #openstack-keystone | 11:37 | |
| *** rushiagr is now known as rushiagr_away | 11:44 | |
| *** andreaf_ has quit IRC | 11:45 | |
| *** andreaf_ has joined #openstack-keystone | 11:45 | |
| *** rushiagr_away is now known as rushiagr | 11:52 | |
| *** diegows has joined #openstack-keystone | 11:57 | |
| *** henrynash has quit IRC | 11:58 | |
| *** cjellick has joined #openstack-keystone | 12:15 | |
| *** cjellick has quit IRC | 12:18 | |
| *** cjellick has joined #openstack-keystone | 12:19 | |
| *** Dafna has quit IRC | 12:44 | |
| *** gordc has joined #openstack-keystone | 12:47 | |
| *** henrynash has joined #openstack-keystone | 12:49 | |
| *** k4n0 has quit IRC | 12:53 | |
| *** vhoward has left #openstack-keystone | 12:53 | |
| *** henrynash has quit IRC | 12:54 | |
| *** bknudson has quit IRC | 13:09 | |
| *** nkinder has quit IRC | 13:11 | |
| *** bknudson has joined #openstack-keystone | 13:30 | |
| *** jasondotstar has joined #openstack-keystone | 13:32 | |
| *** ayoung has joined #openstack-keystone | 13:32 | |
| *** stevemar has joined #openstack-keystone | 13:44 | |
| *** nkinder has joined #openstack-keystone | 13:56 | |
| *** joesavak has joined #openstack-keystone | 14:04 | |
| *** afazekas has quit IRC | 14:05 | |
| *** afaranha has quit IRC | 14:09 | |
| *** raildo has quit IRC | 14:09 | |
| *** rodrigods has quit IRC | 14:09 | |
| *** richm has joined #openstack-keystone | 14:10 | |
| *** jasondotstar has quit IRC | 14:10 | |
| *** raildo has joined #openstack-keystone | 14:11 | |
| *** jasondotstar has joined #openstack-keystone | 14:15 | |
| *** rodrigods has joined #openstack-keystone | 14:15 | |
| *** rodrigods has joined #openstack-keystone | 14:15 | |
| *** afaranha has joined #openstack-keystone | 14:15 | |
| *** joesavak has quit IRC | 14:16 | |
| *** hrybacki has joined #openstack-keystone | 14:16 | |
| marekd | dolphm: what is a 'federated swift client' from Grizzly version? | 14:19 |
| *** afazekas has joined #openstack-keystone | 14:20 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Enable filtering of credentials by user ID https://review.openstack.org/113232 | 14:21 |
| *** abhishekk has quit IRC | 14:23 | |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| dolphm | stevemar: boop | 14:28 |
| dolphm | marekd: i have no idea | 14:29 |
| marekd | dolphm: ok i am responding to him in the bug comment | 14:29 |
| marekd | dolphm: as i cannot find aby better place to contact him... | 14:29 |
| dolphm | marekd: i didn't know how else to contact him either | 14:30 |
| marekd | dolphm: sure. | 14:30 |
| *** amirosh has quit IRC | 14:31 | |
| dolphm | stevemar: beep | 14:31 |
| *** amirosh has joined #openstack-keystone | 14:31 | |
| stevemar | dolphm, boop | 14:32 |
| dolphm | stevemar: bop! | 14:32 |
| dolphm | stevemar: openid connect https://blueprints.launchpad.net/keystone/+spec/openid-connect | 14:33 |
| stevemar | dolphm, oh joy | 14:33 |
| dolphm | stevemar: looks to be less important than k2k federation, and less started | 14:33 |
| dolphm | stevemar: bump to k or can you put it into review, like, yesterday? | 14:33 |
| stevemar | dolphm, yes, it should in theory just be using mod_openidc instead of mod_shib | 14:34 |
| stevemar | dolphm, i'm OK with punting to K, better check with henrynash though | 14:34 |
| dolphm | stevemar: feature proposal freeze is next week | 14:34 |
| marekd | dolphm: which means stuff must be passing jenking tests and be in a 'reviewable' state, right? | 14:35 |
| *** Dafna has joined #openstack-keystone | 14:35 | |
| *** amirosh has quit IRC | 14:36 | |
| dolphm | marekd: yes | 14:36 |
| *** mrmoje has joined #openstack-keystone | 14:39 | |
| stevemar | dolphm, it would also depend on the re-engineer federation thing from kent | 14:39 |
| marekd | stevemar: dolphm: they have been quiet recently :/ | 14:40 |
| stevemar | dolphm, as mentioned here: http://specs.openstack.org/openstack/keystone-specs/specs/juno/openid-connect.html#dependencies | 14:40 |
| dolphm | stevemar: marekd: the linked review is merged, what's missing? | 14:41 |
| dolphm | oh, that's a spec | 14:41 |
| stevemar | thats a spec | 14:41 |
| dolphm | damn, and i'm not tracking that with a bp | 14:41 |
| stevemar | https://review.openstack.org/#/c/105597/ | 14:42 |
| stevemar | dolphm, `bp generic-mapping-federation11 | 14:42 |
| stevemar | <https://blueprints.launchpad.net/keystone/+spec/generic-mapping-federation>` | 14:42 |
| stevemar | the actual code is here: https://review.openstack.org/#/c/105597/ | 14:42 |
| *** rushiagr is now known as rushiagr_away | 14:44 | |
| stevemar | dolphm, fwiw, i've had a patch for this since I release :P | 14:45 |
| dolphm | stevemar: it's just set to WIP - do you know how close to being ready to review it is? | 14:45 |
| stevemar | https://review.openstack.org/#/c/61662/ | 14:45 |
| dolphm | stevemar: i know :( | 14:45 |
| stevemar | dolphm, i would need to re-work it for mod_auth_openidc, which i think i have in my dev env | 14:45 |
| stevemar | i specifically asked at the summit, if anyone wanted this, and there was silence | 14:46 |
| marekd | stevemar: oidc ? | 14:46 |
| stevemar | henry brought it up again, but not sure if he needs it for J or K | 14:46 |
| stevemar | yeah | 14:46 |
| stevemar | we can bug him at the meeting i suppose | 14:47 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add openID Connect auth plugin for federation https://review.openstack.org/61662 | 14:47 |
| dolphm | stevemar: thanks ^ | 14:49 |
| dolphm | stevemar: should that also be dependent on kristy's change? | 14:50 |
| *** gokrokve has joined #openstack-keystone | 14:50 | |
| stevemar | dolphm, i guess so | 14:51 |
| dolphm | an interesting look at all of the "starred" reviews in gerrit in keystone repos: http://pasteraw.com/ox2dzcet6u4bn0pw9tuqvbjvihvaqgv | 14:52 |
| dolphm | starred by *anyone* | 14:52 |
| *** tomoiaga has quit IRC | 14:52 | |
| dolphm | it took 4 hours of crawling the gerrit API to generate that lol | 14:52 |
| stevemar | i star a lot of things | 14:53 |
| bknudson | pretty short compared to the # of reviews | 14:53 |
| stevemar | star'ed and open? | 14:53 |
| dolphm | stevemar: yes | 14:54 |
| bknudson | I use star to mark something that I've reviewed. | 14:54 |
| dolphm | bknudson: yeah, my goal was to see if enough people were starring enough stuff to use it as a means of prioritizing reviews for other people | 14:54 |
| dolphm | bknudson: yeah, you had a bunch of stars :) | 14:54 |
| marekd | dolphm: i have starred this: https://review.openstack.org/#/c/110542/ and your list is missing. (+ I have some more reviews starred ofc) | 14:54 |
| dolphm | marekd: hmm, did you star it before yesterday? | 14:55 |
| marekd | yes | 14:55 |
| stevemar | dolphm, i've had 'Add example script for oauth1 functions' starred for a looong time now, and it's not on the list :( | 14:55 |
| *** jorge_munoz has joined #openstack-keystone | 14:55 | |
| dolphm | marekd: i was wondering if i got a complete list of users - this is only based on users that has signed the individual CLA | 14:55 |
| dolphm | the full list of users is not public in gerrit | 14:56 |
| marekd | dolphm: did you put any constraints like: review cannot have -1 from Jenkins or so? | 14:56 |
| dstanek | dolphm: do you have the count of how many times those things got starred? | 14:56 |
| dolphm | marekd: nothing like that - only that the review be open | 14:56 |
| marekd | dolphm: ok, so something is not fully working... | 14:56 |
| dolphm | dstanek: yes- first column is number of stars http://pasteraw.com/47ggjka02kzabdgn1eqt9trbjb9l65d | 14:56 |
| dstanek | ah, nice | 14:57 |
| *** mrmoje has quit IRC | 15:00 | |
| *** radez_g0n3 is now known as radez | 15:04 | |
| ajayaa | dolphm : https://bugs.launchpad.net/keystone/+bug/1321378. I was going through this bug. I think the problem is assignment_api.delete_user(user_id) is called individually in each driver with some additional logic. | 15:04 |
| uvirtbot | Launchpad bug 1321378 in keystone "keystone user-role-delete operation fails when user no longer exists in underlying catalog" [Medium,Triaged] | 15:04 |
| ajayaa | In kvs driver there is no implementation of assignment_api.delete_user(user_id) at all. | 15:05 |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Keystone part of a PoC for Horizon/Keystone WebSSO https://review.openstack.org/106096 | 15:06 |
| ajayaa | I think best way to solve this is to make a call to assignment_api.delete_user(user_id) in core.py with some exception handling. | 15:06 |
| dstanek | lbragstad: ping | 15:06 |
| lbragstad | dstanek: pong | 15:06 |
| dstanek | lbragstad: i was reading one of your comments in a review about the LDAP live tests - did you ever find the env var to make them run? | 15:07 |
| lbragstad | dstanek: this change? https://review.openstack.org/#/c/76002/19 | 15:07 |
| *** ukalifon has quit IRC | 15:08 | |
| dstanek | lbragstad: no, i'll see if i can find it again. it was one of the two about running the live tests. | 15:08 |
| *** afazekas has quit IRC | 15:08 | |
| lbragstad | dstanek: ok | 15:09 |
| dstanek | lbragstad: i think you had mentioned that you couldn't reproduce the failure and i think that was because the tests are skipped by default | 15:09 |
| lbragstad | dstanek: oh, right | 15:10 |
| dstanek | lbragstad: https://review.openstack.org/#/c/94668/ | 15:10 |
| lbragstad | yeah I *think* I rememeber that | 15:10 |
| dstanek | lbragstad: in case you didn't look into it anymore: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_ldap_livetest.py#n45 | 15:11 |
| lbragstad | dstanek: perfect | 15:11 |
| lbragstad | dstanek: I can give that a shot | 15:11 |
| lbragstad | I'll put it on my queue for today | 15:12 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 15:15 |
| dstanek | lbragstad: i spent a fair amount of time yesterday fighting with ldap - was not a great day | 15:15 |
| lbragstad | dstanek: lol | 15:15 |
| dolphm | ajayaa: yeah, we need to get rid of the KVS backend for that reason (and similar ones) | 15:16 |
| lbragstad | dstanek: that reminds me that I have to get back to your commit and roll them into the jsonschema stuff | 15:16 |
| ajayaa | dolphm, That would just be deleting it from backend and document it. | 15:17 |
| ajayaa | or remove the documentation if present. | 15:17 |
| dstanek | lbragstad: i'm planning on fixing a bunch of the other jsd things today :-) it's on my list - currently 4th in the queue | 15:17 |
| ajayaa | dolphm, I would be happy to volunteer. :) | 15:18 |
| lbragstad | dstanek: awesome, hopefully by the time I get some stuff off my plate and I get to that after you push your fixes to jsd | 15:18 |
| dolphm | ajayaa: volunteer to do which part? lol | 15:18 |
| dolphm | ayoung: sounds like a critical in pkiz to me https://bugs.launchpad.net/keystone/+bug/1355125 | 15:19 |
| uvirtbot | Launchpad bug 1355125 in keystonemiddleware "keystonemiddleware appears not to hash PKIZ tokens" [Critical,Triaged] | 15:19 |
| ayoung | dolphm, looking | 15:19 |
| ajayaa | deleting the file obv :) | 15:19 |
| dolphm | ayoung: i'm assuming that's only a bug either in auth_token or in keystone - know which side of the fence it's on? | 15:19 |
| ayoung | auth token | 15:19 |
| dolphm | ajayaa: lol we can't just delete it... wrapping it with the oslo deprecator is about the best we can do | 15:19 |
| ayoung | dolphm, its only testing is_asn1 | 15:19 |
| dolphm | ajayaa: have to inform people that we're dropping it before we do, in case someone wants to volunteer support | 15:20 |
| ayoung | must have not made the transfer over from keystoneclient... | 15:20 |
| stevemar | dstanek, thanks for the review on adding url field to regions | 15:21 |
| ajayaa | dolphm, okay. What about that bug? Would it need still fixing? I guess, yes. | 15:21 |
| *** afazekas has joined #openstack-keystone | 15:21 | |
| dolphm | ajayaa: i think so, yes | 15:22 |
| *** zzzeek has joined #openstack-keystone | 15:22 | |
| ajayaa | dolphm, Thanks! I have some code to get reviewed. If you have time, please have a look. | 15:23 |
| ajayaa | https://review.openstack.org/#/c/110575/ | 15:23 |
| ajayaa | https://review.openstack.org/#/c/113277/ | 15:23 |
| dolphm | ajayaa: we all do :( | 15:24 |
| dolphm | on the upside, the gate is having a 92% merge rate today :D better than ~46% yesterday | 15:27 |
| dstanek | stevemar: either i am under caffeinated or something is wrong in https://review.openstack.org/#/c/113378 | 15:28 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 15:28 |
| dstanek | ajayaa: did you get any more opinions on the timeout issue we talked about yesterday? | 15:29 |
| stevemar | dstanek, i thought so too, but jenkins and my own dev env seemed happy | 15:29 |
| dstanek | stevemar: wow, i did not know that Python would create a local name for x if you do 'import x.y' | 15:32 |
| dstanek | it makes sense, but i never thought of it that way | 15:32 |
| stevemar | dstanek, that was my guess | 15:32 |
| stevemar | dstanek, file a bug under to enhance out pep8 tests :P | 15:33 |
| stevemar | our* | 15:33 |
| *** afazekas has quit IRC | 15:35 | |
| *** rwsu has joined #openstack-keystone | 15:35 | |
| ajayaa | dstanek, nope. morganfainberg had same opinion as you. We would invalidate the cache time to time. By reading the dogpilecache documentation it seems that you can still retrieve a expired key. | 15:37 |
| *** rushiagr_away is now known as rushiagr | 15:37 | |
| *** wwriverrat has quit IRC | 15:38 | |
| *** wwriverrat1 has joined #openstack-keystone | 15:38 | |
| dstanek | Who would invalidate the cache from time to time? | 15:38 |
| dstanek | ajayaa: ^ | 15:38 |
| dolphm | dstanek: i assume the intent was to have expiring cache values, not someone bouncing memcache or whatever | 15:39 |
| ajayaa | We would. If the user has not explicitly set a cache_time value, we would set some sensible default value. | 15:40 |
| dstanek | dolphm: the code as written will cache forever which would be bad | 15:40 |
| ajayaa | doplhm: ++ | 15:40 |
| dolphm | dstanek: also, your import x.y thing just blew my mind | 15:40 |
| dolphm | dstanek: yeah, that would be bad | 15:40 |
| ajayaa | *dolphm: | 15:40 |
| *** joesavak has joined #openstack-keystone | 15:41 | |
| ajayaa | dstanek, I will change it to have some default value if the user has not provided one. :) | 15:41 |
| dolphm | dstanek: also, line breaks by me: http://pasteraw.com/9cxomlke8ztrpa353bus8rw3v41378c | 15:42 |
| dolphm | stevemar: ^ | 15:42 |
| dstanek | ajayaa: i just added it to today's meeting agenda to see if anyone has any strong opinions on what a default should be | 15:45 |
| ajayaa | dstanek, cool. Thanks. | 15:45 |
| dolphm | dstanek: do we not already have default cache timeouts in other places? | 15:48 |
| dolphm | oh weird... all the cache_times are null by default ?! | 15:50 |
| dstanek | dolphm: not that i know of - it looks like assignment and catalog would currently cache forever if left to the defaults | 15:50 |
| dolphm | that's no good | 15:50 |
| dolphm | we should definitely have a default! | 15:50 |
| dolphm | everywhere! | 15:50 |
| morganfainberg | dolphm, yeah i noticed that we were missing a default in a couple places | 15:50 |
| morganfainberg | dolphm when reviewing that code | 15:50 |
| morganfainberg | :( | 15:50 |
| dolphm | dstanek: put a patch up with a reasonable value before the meeting :) | 15:51 |
| dstanek | dolphm: writing up a bug now - that's my next step :-) | 15:52 |
| morganfainberg | dolphm, i might be a few minutes late to the meeting today | 15:53 |
| morganfainberg | dolphm, my topic is just we should cleanup / plan on abandoning patches that aren't relevant with a comment (since auto-expire doesn't happen) | 15:53 |
| morganfainberg | dolphm, it'll help us keep eyes on the important stuff. | 15:54 |
| morganfainberg | dolphm, and any patch can be restored as needed | 15:54 |
| dolphm | morganfainberg: ++ | 15:54 |
| ayoung | dolphm, you want to finish the discussion on default token format? I'm only going to be able to make it to the first half of the meeting, and I realize it has the potential to take ver the discussion. | 15:56 |
| *** zzzeek has quit IRC | 16:01 | |
| *** zzzeek has joined #openstack-keystone | 16:02 | |
| ayoung | Crickets | 16:03 |
| ayoung | dolphm, if you want to table it, that is fine, too. | 16:04 |
| dolphm | ayoung: that's not on the agenda? | 16:04 |
| ayoung | Nah, too many weeks ago | 16:04 |
| dolphm | ayoung: i don't know if we need to spend more meeting time on it anyway | 16:04 |
| ayoung | dolphm, just setting the default in Keystone is not really going to affect anything. It is the puppet modules that really determine what people get in production. We just need to plan out what steps we are going to take before moving. | 16:06 |
| ayoung | For instane, people are going ask about time frame | 16:06 |
| ayoung | I do suspect that it will have the opposite effect from what you want. I think you are trying to simplify things, and I am sympathetic, but I think it will actually cause more churn | 16:07 |
| ayoung | So, before we make UUID the defaults, we need to have a plan. | 16:08 |
| *** joesavak has quit IRC | 16:08 | |
| ayoung | But we don't need to take up any more meeting time. If you have a feel for how you want it to play out, send it out in an email. | 16:09 |
| dolphm | ayoung: the defaults in keystone represent our recommendation for reasonable defaults that other deployments should be running. PKI is not and has never been a reasonable production choice. i don't think there's much to discuss beyond that. | 16:09 |
| ayoung | dolphm, do you foresee it being a reasonable production choice in the future? | 16:09 |
| *** vhoward has joined #openstack-keystone | 16:10 | |
| dolphm | ayoung: as of today, i care about what we're shipping in juno | 16:11 |
| *** ajayaa has quit IRC | 16:12 | |
| dolphm | ayoung: as for the stability argument, we have a PKI bug tag https://bugs.launchpad.net/keystone/+bugs?field.tag=pki and nothing open for uuid, afaik | 16:12 |
| *** bvandenh has quit IRC | 16:14 | |
| ayoung | dolphm, do you want to stop pursing the PKI approach altogether? | 16:15 |
| ayoung | dolphm, if you were planning on dropping PKI support, I would not have bothered with the effort for revocation events. I'd just like to get a sense of what direction you are trying to point us. | 16:19 |
| openstackgerrit | Salvatore Pinto proposed a change to openstack/python-keystoneclient: Add HTTP_X_AUTH_URI variable for use by the OpenStack service https://review.openstack.org/113579 | 16:26 |
| ayoung | morganfainberg, does pycharm know about venvs? I have the python interpreter set to .tox/py27/bin/python2.7 but that doesn't seem to resolve PYTHON_PATH properly. | 16:34 |
| *** chandankumar has quit IRC | 16:36 | |
| dstanek | ayoung: i have not used it, but i thought you could tell it where your projects venv was located | 16:40 |
| dstanek | ayoung: or you can activate in a shell and start pycharm from that shell and see if it works | 16:40 |
| ayoung | dstanek, It seems to think it has a venv, and it reports one, but running ./setup.py testr fails on import of iso8601 | 16:41 |
| ayoung | If I activate the venv from the shell and run | 16:41 |
| ayoung | python ./setup.py testr it succeeds | 16:41 |
| ayoung | if I don't activate the venv, it fails in the same way: | 16:41 |
| ayoung | .tox/py27/bin/python2.7 ./setup.py testr | 16:41 |
| ayoung | ... | 16:41 |
| ayoung | /usr/bin/python: cannot import name iso8601 | 16:41 |
| ayoung | maybe setup.py is returnning python and picking it up from the global env, not local | 16:42 |
| wwriverrat1 | ayoung, I typically create my venv manually via command line. When I fire up pycharm against it, I point my interpreter at the local project's venv. | 16:42 |
| ayoung | wwriverrat1, how do you run tests? | 16:43 |
| ayoung | pycharm wants to use Nose for them | 16:43 |
| wwriverrat1 | I run nose against them | 16:43 |
| dstanek | ayoung: i always install nose into our venvs - no a testr fan at all | 16:43 |
| ayoung | but that is not in our venvs, and manually adding nose seems to make the venvs not then work for command line. | 16:43 |
| dstanek | i only use testr right before i push | 16:43 |
| dstanek | you can't tdd with testr | 16:43 |
| ayoung | dstanek, why not? | 16:44 |
| dstanek | it's way too slow - the first thing it does is scan everything to find all possible tests - even when i just was to run a single module's tests | 16:45 |
| *** amerine has joined #openstack-keystone | 16:50 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Updates the sample config https://review.openstack.org/113585 | 16:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Sets a default timeout for cached data https://review.openstack.org/113586 | 16:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Sets a default timeout for cached data https://review.openstack.org/113586 | 16:52 |
| *** joesavak has joined #openstack-keystone | 17:01 | |
| marekd | everybody already on -meet? | 17:02 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 17:02 |
| dstanek | marekd: i think you are a little early | 17:03 |
| marekd | dstanek: oh, meen | 17:04 |
| marekd | right... | 17:04 |
| *** henrynash has joined #openstack-keystone | 17:04 | |
| *** henrynash has quit IRC | 17:04 | |
| grantbow | early by one hour I think http://www.timeanddate.com/worldclock/ | 17:05 |
| marekd | grantbow: yeah :-) | 17:05 |
| marekd | how can i access the config options from with my python interpreter/debugger. For instance in the code there is something like CONF = config.CONF ; CONF.federation.assertion_prefix. But doing so from my interpreter (under virtualenv) raises an exception oslo.config.cfg.NoSuchOptError | 17:07 |
| marekd | what am i doing wrong? | 17:07 |
| dstanek | marekd: import keystone.common.config to register the options | 17:09 |
| dolphm | ayoung: not looking to drop pki, i'd like to see it become a viable option. in the mean time, we just need to better communicate our stable, recommended defaults | 17:11 |
| marekd | dstanek: hm | 17:11 |
| marekd | but from within the code it raises samle excp. | 17:11 |
| marekd | same* | 17:12 |
| ayoung | dolphm, Understood. | 17:12 |
| marekd | dstanek: for instance here: https://review.openstack.org/#/c/110542/6/keystone/contrib/federation/samlgen.py lines 26 and later ~330. | 17:16 |
| marekd | do i use it all correctly? | 17:16 |
| *** hrybacki has quit IRC | 17:17 | |
| *** andreaf_ has quit IRC | 17:17 | |
| *** andreaf_ has joined #openstack-keystone | 17:17 | |
| dstanek | marekd: how is that code being called? a new command line app? | 17:18 |
| marekd | dstanek: http://paste.openstack.org/show/93967/ | 17:19 |
| dstanek | marekd: here is a simple example that should work http://paste.openstack.org/show/93966/ | 17:19 |
| dstanek | marekd: you are not actually registering the options - import config and call config.configure() | 17:19 |
| *** andreaf has joined #openstack-keystone | 17:20 | |
| marekd | dstanek: allright, I was simply copying the behaviour from https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py | 17:20 |
| dstanek | marekd: keystone-all example http://git.openstack.org/cgit/openstack/keystone/tree/bin/keystone-all#n115 | 17:20 |
| *** ajayaa has joined #openstack-keystone | 17:20 | |
| dstanek | marekd: that works because it gets called in a process that has already called configure at some point | 17:21 |
| marekd | dstanek: ok | 17:21 |
| *** amerine has quit IRC | 17:21 | |
| marekd | dstanek: what conf file shall i change to setup my own values (inside the virtualenv) | 17:22 |
| marekd | dstanek: something around keystone/etc/keystone.conf ? | 17:22 |
| *** andreaf_ has quit IRC | 17:22 | |
| marekd | i think this will not be /etc/keystone.conf? | 17:22 |
| dstanek | what are you tying to do? tests? | 17:22 |
| marekd | dstanek: no, make a simple wrapper and actually use this class | 17:23 |
| marekd | i need to generate an assertion and don't want tests atm. | 17:23 |
| dstanek | marekd: in your own scripts this is how you would specify config files to use https://github.com/openstack/keystone/blob/master/bin/keystone-all#L119 | 17:24 |
| marekd | dstanek: where config_files is a path to actual keystone.conf, right? | 17:27 |
| dstanek | marekd: if that's where you want to make your changes yes - you could copy the sample, hack it for what you are doing and then specify it | 17:28 |
| marekd | dstanek: ok, thanks. | 17:29 |
| *** gyee has joined #openstack-keystone | 17:31 | |
| *** stevemar has quit IRC | 17:34 | |
| *** gyee has quit IRC | 17:34 | |
| openstackgerrit | A change was merged to openstack/keystone: Change V3 router classes to use resources https://review.openstack.org/111569 | 17:39 |
| *** jsavak has joined #openstack-keystone | 17:45 | |
| openstackgerrit | A change was merged to openstack/keystone: V3 Extension class https://review.openstack.org/111570 | 17:47 |
| *** joesavak has quit IRC | 17:49 | |
| *** jsavak has quit IRC | 17:49 | |
| *** joesavak has joined #openstack-keystone | 17:49 | |
| *** spandhe_ has joined #openstack-keystone | 17:50 | |
| *** andrewss has joined #openstack-keystone | 17:51 | |
| andrewss | hello - i was wondering if anyone has any experience decoding the keystone token in Java? or would this be better suited for the 'ask' forum ? | 17:51 |
| *** gyee has joined #openstack-keystone | 17:56 | |
| *** jsavak has joined #openstack-keystone | 17:58 | |
| marekd | dolphm: normally when you configure federation, you can specify a IdP's url with it's metadata - something like https://idp.testshib.org/idp/shibboleth . A route /v3/OS-FEDERATION/idp exposing pretty much the same thing is also acceptable? | 17:58 |
| dolphm | ajayaa: the commit message on review 107194 indicates it's only a partial fix - what was missing at the time, and why is that now sufficient to close https://bugs.launchpad.net/keystone/+bug/1294737 ? | 17:59 |
| uvirtbot | Launchpad bug 1294737 in keystone "Disable domain doesn't remove domain scoped tokens" [Medium,Fix committed] | 17:59 |
| dolphm | marekd: that sounds fine | 18:00 |
| marekd | dolphm: allrighty. | 18:00 |
| *** joesavak has quit IRC | 18:00 | |
| *** topol has joined #openstack-keystone | 18:00 | |
| dolphm | marekd: amend the spec? | 18:00 |
| dolphm | marekd: err, api doc? | 18:00 |
| marekd | i think so. | 18:01 |
| *** jsavak has quit IRC | 18:02 | |
| *** abhishekk has joined #openstack-keystone | 18:04 | |
| *** amirosh has joined #openstack-keystone | 18:05 | |
| *** jamielennox|away is now known as jamielennox | 18:06 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 18:12 |
| *** jaosorior has quit IRC | 18:12 | |
| ayoung | I think that might be a mistake | 18:12 |
| marekd | ayoung: what? | 18:13 |
| ayoung | Transform a Keystone token to a SAML assertion | 18:13 |
| ayoung | marekd, we can talk about it later, | 18:13 |
| morganfainberg | ayoung, that is the K2K stuff, SAML (idp originated) was what we decided on at the hackathon. | 18:14 |
| morganfainberg | ayoung, but tabled till later (post meeting) | 18:14 |
| *** rushiagr is now known as rushiagr_away | 18:15 | |
| ayoung | morganfainberg, yeah. I need to disappear for about an hour, in 15 minutes. | 18:15 |
| morganfainberg | ayoung, sure, but i think this one made the most sense post hackathon (in reality) - when you're back lets discuss but lets not hold things up unless we have a really good reason to | 18:17 |
| ayoung | morganfainberg, agreed. | 18:17 |
| *** stevemar has joined #openstack-keystone | 18:21 | |
| *** spandhe_ has quit IRC | 18:31 | |
| *** ayoung has quit IRC | 18:36 | |
| *** spandhe_ has joined #openstack-keystone | 18:36 | |
| *** gokrokve_ has joined #openstack-keystone | 18:38 | |
| *** gokrokve has quit IRC | 18:41 | |
| *** gokrokve_ has quit IRC | 18:43 | |
| abhishekk | dstanek:hi, you there? | 18:47 |
| *** abhishekk has quit IRC | 18:52 | |
| *** gokrokve has joined #openstack-keystone | 18:52 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Enable filtering of credentials by user ID https://review.openstack.org/113232 | 18:55 |
| jamielennox | gyee: what do you want me to do with https://review.openstack.org/#/c/104771/16 ? it's kind of ugly for sure but i don't know if there's a way to make it better and it's needed before i can do session stuff from the CLI | 18:57 |
| jamielennox | it's at the head of a 6 or so long patch series | 18:58 |
| *** spandhe_ has quit IRC | 18:58 | |
| gyee | jamielennox, we need to rethink fundamentally how we handle endpoints, especially with federation into the picture | 19:00 |
| gyee | jamelennox, how do you envision the flow for federation? | 19:01 |
| *** spandhe_ has joined #openstack-keystone | 19:01 | |
| jamielennox | gyee: in general or related to that patch? | 19:01 |
| gyee | one auth_url for IdP and another for Keystone? | 19:01 |
| gyee | but 3rd party IdP doesn't know anything about Keystone | 19:02 |
| jamielennox | gyee: ideally we'd want some sort of lookup flow where you query available idps and go to those links - but i'm not sure what you're asking | 19:02 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Update JSON Home for docs location https://review.openstack.org/113413 | 19:03 |
| jamielennox | the problem for now is that in the case of an unscoped token if you want to do things like list available projects you have to use the AUTH_URL | 19:03 |
| gyee | jamielennox, say I am a federated user, how do I go about authenticating to my IdP, get the saml2 assertion, then take that assertion to Keystone in exchange for a token? | 19:03 |
| gyee | do it all from CLI | 19:03 |
| jamielennox | there's a great big plugin in ksc that handles the interaction | 19:04 |
| jamielennox | it takes a lot of parameters that i would like to have been discoverable but it apparently works for now | 19:04 |
| marekd | gyee: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py | 19:05 |
| marekd | gyee: https://gist.github.com/zaccone/509136cfa1c4efca6926 | 19:06 |
| jamielennox | as we add more plugins i think parts of that will be common and get refactored | 19:06 |
| gyee | so there are two endpoints | 19:06 |
| marekd | stevemar: something is signing the assertion | 19:06 |
| marekd | stevemar: but i cannot make one thing | 19:07 |
| morganfainberg | bknudson, dolphm, do we have revocation events enabled by default? | 19:07 |
| bknudson | morganfainberg: I believe they are... I think it's just in the pipeline | 19:07 |
| stevemar | marekd, oh? | 19:07 |
| morganfainberg | dolphm, bknudson, i think revocation events are getting in the way of https://review.openstack.org/#/c/113429/ *again* | 19:07 |
| bknudson | morganfainberg: http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini#n88 | 19:08 |
| bknudson | morganfainberg: it's the revocation list that can be disabled... that's also enabled by default. | 19:08 |
| marekd | There should be <Assertion ID=<hash> > and later <Reference URI="#<hash>" to indicate that assertion should be signed | 19:08 |
| dolphm | morganfainberg: yes and how? | 19:08 |
| gyee | jamielennox, so either that hack or catalog for unscoped token? | 19:08 |
| marekd | stevemar: ^^ | 19:08 |
| morganfainberg | dolphm, bknudson, basically... they cause weird token behavior (in part due to limited resolution on expiry) | 19:08 |
| marekd | stevemar: I don't know if its crucial, but i cannot make it work with those ids :-)000000000 | 19:08 |
| dolphm | morganfainberg: oh that | 19:08 |
| dolphm | morganfainberg: bknudson had the best fix for that | 19:08 |
| jamielennox | gyee: we'll need to carry the hack anyway, but a catalog would be nice here | 19:08 |
| morganfainberg | dolphm, basically. i think we can't enable them w/o all sorts of edge cases :( | 19:09 |
| marekd | stevemar: see the patch: https://review.openstack.org/#/c/110542/ | 19:09 |
| jamielennox | gyee: it's not pretty but it's actually better than the existing code IMO | 19:09 |
| bknudson | dolphm: I think morganfainberg is complaining about my "fix" | 19:09 |
| gyee | jamielennox, alrighty then, lgtm | 19:09 |
| morganfainberg | bknudson, i am, but not because your fix is wrong | 19:09 |
| gyee | jamielonnox, but Jenkins doesn't seem happy on that one | 19:09 |
| morganfainberg | bknudson, because revocation events are doing something bad in this case. the chain-revoke (child tokens revoked) and parent tokens revoked when child tokens are revoked is just bad | 19:10 |
| gyee | nm, you rechecked it | 19:10 |
| dolphm | morganfainberg: equally scoped tokens? or differently scoped tokens? | 19:11 |
| jamielennox | gyee: yea, it's transient | 19:11 |
| bknudson | morganfainberg: are you saying that the "fix" introduced a transient failure? | 19:11 |
| dolphm | morganfainberg: differently scoped tokens should not be revoked - that was specifically discussed in the HK summit | 19:11 |
| gyee | jamielennox, I think we may need a test or two on that change | 19:11 |
| bknudson | dolphm: revoking an unscoped token revokes the scoped tokens. | 19:11 |
| morganfainberg | bknudson, not too transient, but yes, i'm tyring to fix things to always be checked against revocations (everything goes through the provider) | 19:12 |
| *** marekd is now known as marekd|away | 19:12 | |
| morganfainberg | bknudson, dolphm, also revoking the scoped token revokes the unscoped token | 19:12 |
| bknudson | morganfainberg: no, it shouldn't work that way | 19:12 |
| morganfainberg | bknudson, it does it based on expiration time | 19:12 |
| morganfainberg | bknudson, in revocation events | 19:12 |
| morganfainberg | bknudson, the expiration time is the same for both tokens | 19:12 |
| bknudson | the revocation event should have the scope of the token | 19:12 |
| jamielennox | gyee: the auht_interface one? | 19:13 |
| *** amirosh has quit IRC | 19:13 | |
| bknudson | and it shouldn't match the scope of an unscoped token | 19:13 |
| gyee | jamielennox, this one https://review.openstack.org/#/c/104771/16 | 19:13 |
| morganfainberg | bknudson, the other issue is what happens if you have a scoped token, get another scoped token, then revoke the first token | 19:13 |
| *** amirosh has joined #openstack-keystone | 19:13 | |
| morganfainberg | bknudson, does it chain revoke? | 19:13 |
| bknudson | morganfainberg: no, it doesn't | 19:13 |
| jamielennox | gyee: it's fairly well tested already, and there were a couple of reviews that got lost in the rebase that already merged to test the changeover in behaviour - let me look | 19:13 |
| morganfainberg | bknudson, something wonky is going on still | 19:14 |
| bknudson | morganfainberg: y, if that's happening then there's something wonky going on | 19:14 |
| jamielennox | gyee: https://review.openstack.org/#/c/104767/ | 19:14 |
| bknudson | morganfainberg: add a test | 19:14 |
| jamielennox | gyee: ah, not that one | 19:14 |
| morganfainberg | bknudson, well that is how it used to work. unless you changed that, it's still how rev events work | 19:15 |
| morganfainberg | bknudson, when you revoke a token by id, it issues a revocation based on expiration time only | 19:15 |
| bknudson | morganfainberg: well, nothing worked when using sqlite db | 19:15 |
| bknudson | morganfainberg: y, that's what it used to do | 19:15 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/109389/ | 19:17 |
| morganfainberg | bknudson, maybe this is two unscoped tokens being issued in rapid succession | 19:17 |
| morganfainberg | bknudson, and revoking one is causing the other to be revoked? | 19:17 |
| bknudson | morganfainberg: those would both be revoked | 19:17 |
| gyee | jamielennox, i need to step out for an hour, if you can drop a note in the commit msg indicating its been tested else where that should be fine | 19:17 |
| *** amirosh has quit IRC | 19:18 | |
| morganfainberg | hm. but that doesn't make sense with the error i'm seeing, i'm seeing an issue deleting a tenant, invalid token | 19:18 |
| bknudson | morganfainberg: even if it was based on a millisecond timestamp they could get the same time. | 19:18 |
| jamielennox | gyee: will do | 19:18 |
| bknudson | just depends on how fast your computer is | 19:18 |
| dolphm | ajayaa: don't know if you responded earlier (was in the keystone meeting), but just noticed you updated the status on that bug. thanks! | 19:18 |
| morganfainberg | bknudson, this is a tempest test. | 19:18 |
| jamielennox | gyee: found one https://review.openstack.org/#/c/104770/ | 19:19 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 19:20 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 19:20 |
| morganfainberg | bknudson oh. uh. | 19:21 |
| morganfainberg | bknudson, nvm i think i know what it is. | 19:21 |
| morganfainberg | oh wait no this should be far wider spread if its that issue... hmm | 19:22 |
| *** stevemar has quit IRC | 19:22 | |
| bknudson | morganfainberg: I can imagine tempest getting messed up when its tokens get revoked unexpectedly | 19:25 |
| bknudson | for example if it's running in parallel and it gets 2 tokens for admin user | 19:25 |
| bknudson | but I don't think that tempest invalidates its tokens? | 19:25 |
| *** gokrokve has quit IRC | 19:26 | |
| *** stevemar has joined #openstack-keystone | 19:34 | |
| stevemar | marekd|away, thanks for the info, i'll take a look | 19:36 |
| *** ayoung has joined #openstack-keystone | 19:46 | |
| *** david-lyle has quit IRC | 19:49 | |
| *** david-lyle has joined #openstack-keystone | 19:49 | |
| *** david-ly_ has joined #openstack-keystone | 19:52 | |
| *** david-lyle has quit IRC | 19:53 | |
| *** gokrokve has joined #openstack-keystone | 19:57 | |
| *** stevemar has quit IRC | 20:03 | |
| *** ajayaa has quit IRC | 20:07 | |
| *** andreaf has quit IRC | 20:10 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change V3 router classes to provide JSON Home data https://review.openstack.org/111576 | 20:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extensions to provide JSON Home data https://review.openstack.org/103983 | 20:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the sub-routers to provide JSON Home data https://review.openstack.org/111577 | 20:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change OS-INHERIT extension to provide JSON Home data https://review.openstack.org/111578 | 20:11 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extension class to integrate JSON Home data https://review.openstack.org/111579 | 20:11 |
| *** andreaf has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 20:17 |
| *** andreaf_ has joined #openstack-keystone | 20:23 | |
| *** andreaf has quit IRC | 20:26 | |
| *** amcrn has joined #openstack-keystone | 20:28 | |
| *** stevemar has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change V3 router classes to provide JSON Home data https://review.openstack.org/111576 | 20:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extensions to provide JSON Home data https://review.openstack.org/103983 | 20:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the sub-routers to provide JSON Home data https://review.openstack.org/111577 | 20:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change OS-INHERIT extension to provide JSON Home data https://review.openstack.org/111578 | 20:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extension class to integrate JSON Home data https://review.openstack.org/111579 | 20:52 |
| *** jasondotstar has quit IRC | 21:06 | |
| morganfainberg | bknudson, in this case it's explicitly deleting a tokne, so it is invalidating the token :( | 21:06 |
| bknudson | morganfainberg: that's going to be dangerous now... | 21:07 |
| morganfainberg | bknudson, yeah digging into the test specifically to figure out *why* | 21:07 |
| morganfainberg | bknudson, it might be a side effect of a tenant delete | 21:08 |
| morganfainberg | or.. no.. wtf. | 21:08 |
| bknudson | morganfainberg: I don't know what the correct fix might be... make tempest tolerant to having its tokens revoked? | 21:08 |
| morganfainberg | bknudson, http://logs.openstack.org/29/113429/4/check/check-tempest-dsvm-postgres-full/c20a3d2/logs/screen-key.txt.gz#_2014-08-12_05_11_25_327 is where i'm seeing | 21:08 |
| bknudson | if we want keystone to have a very short token expiration then clients will have to handle that anyways | 21:08 |
| morganfainberg | and one of those following invalid token lines is where i'm failing tempest | 21:08 |
| morganfainberg | bknudson, yeah | 21:08 |
| bknudson | morganfainberg: it's trying to invalidate a token and it's already invalid. | 21:10 |
| morganfainberg | the failure is in setupclass following that as well | 21:10 |
| bknudson | morganfainberg: doesn't seem like tempest should fail if it's already doing what it wanted to do. | 21:10 |
| morganfainberg | bknudson, http://logs.openstack.org/29/113429/4/check/check-tempest-dsvm-postgres-full/c20a3d2/console.html#_2014-08-12_05_11_25_545 | 21:10 |
| bknudson | morganfainberg: I probably meant to bring this up at a meeting and forgot it, but we do have to decide if revoking by timestamp is the right thing to do. | 21:11 |
| morganfainberg | bknudson, i think it clearly is not the right thing to do. | 21:12 |
| bknudson | it's too similar to trying to compare floating point numbers for equivalency | 21:12 |
| bknudson | which is evil | 21:12 |
| bknudson | but the alternative is to have what is essentially a revocation list | 21:12 |
| morganfainberg | bknudson, we might *want* to put a non-token-id unique string in the token data that we can use to revoke on. | 21:12 |
| morganfainberg | bknudson, some data that can't be used for auth, but could also be maintained in unscoped->scoped transition (for parent token information) | 21:13 |
| morganfainberg | maybe just uuid.uuid4? (i hate putting random crap in tokens, but....) | 21:13 |
| bknudson | morganfainberg: I think that would work | 21:14 |
| bknudson | but then as you say it's more crap in the token | 21:14 |
| morganfainberg | bknudson, it's not a hard change. i can propose that, fix revocation events to use that instead expires, then layer my changed on top. I *bet* that is really what we need, some uuid or such as a "unique token chain identifier" | 21:14 |
| morganfainberg | bknudson, but without a change i think revocation events might be effectively doa. | 21:15 |
| bknudson | morganfainberg: you think that revoking other tokens is going to be too painful? this seems like something that clients really have to handle already anyways. | 21:16 |
| bknudson | clients have to handle their token becoming invalid at unexpected times | 21:16 |
| *** radez is now known as radez_g0n3 | 21:17 | |
| morganfainberg | bknudson, i think that we'll get a lot of "my token wasn't expired but it ended up revoked and i *know* it wasn't supposed to be revoked" complaints | 21:17 |
| bknudson | due to other potential changes, such as a user being disabled or password change. | 21:17 |
| morganfainberg | bknudson, especially if we run in revoke-by-id compatible mode (and people revoke specific tokens not "classes" of tokens, e.g. by user_id) | 21:18 |
| bknudson | then they can fix their app correctly or disable revocation events | 21:18 |
| morganfainberg | bknudson, sure, doesn't mean we wont have to continuously tell people "go fix your app" | 21:18 |
| bknudson | anyway I'm just playing devil's advocate... | 21:18 |
| morganfainberg | bknudson, sure, i'm fine with that. i'd rather have someone point out the flaws than just agreeing | 21:19 |
| bknudson | if we can come up with something that works more like someone would expect then let's | 21:19 |
| morganfainberg | bknudson, i think the *easiest* is to put some unique-id in the token (not a hash, but a random id) that persists on the token chain | 21:19 |
| bknudson | do we have to keep the entire chain in the token? | 21:20 |
| morganfainberg | bknudson, nah, only the unique id i think | 21:20 |
| openstackgerrit | A change was merged to openstack/keystone: remove unused import https://review.openstack.org/113378 | 21:20 |
| morganfainberg | bknudson, it should isolate any revocations to a specific chain (and with your fix chain + scope unless it's tyring to revoke the chain) | 21:20 |
| morganfainberg | no bleed because extra data matched (e.g. expires and project scope) | 21:21 |
| bknudson | morganfainberg: so it'll still hit extra tokens just not outside the chain | 21:21 |
| morganfainberg | for two unrelated tokens | 21:21 |
| morganfainberg | bknudson, it *can* hit extra tokens if you want to revoke the whole chain. i think with your fix it wouldn't unless you went unscoped -> scoped(project X), then unscoped -> scoped(project X), and revoked one of the project X tokens | 21:22 |
| morganfainberg | then both project X tokens would be revoked. | 21:22 |
| bknudson | morganfainberg: right... tempest probably doesn't do that | 21:22 |
| morganfainberg | bknudson, i *hope* tempest isn't doing that. it would be silly | 21:22 |
| * morganfainberg is looking at the code and it *shouldn't* be doing that with isolated creds. | 21:22 | |
| *** amerine has joined #openstack-keystone | 21:23 | |
| morganfainberg | unless... setupClass is only run once. | 21:23 |
| morganfainberg | oh. maybe it is. | 21:23 |
| morganfainberg | crap it's that they're using setupClass | 21:25 |
| morganfainberg | not just setUp | 21:25 |
| bknudson | morganfainberg: y, they need to do so much setup that it would take forever if it was per test | 21:25 |
| morganfainberg | bknudson, which means if anything revokes the token, and it hits revocation events, they'll 401 where previously it would be fine | 21:26 |
| bknudson | morganfainberg: I wouldn't assume it would work fine before since the token could have been revoked for other reasons, or expired | 21:27 |
| morganfainberg | something it looks like is doing an explicit delete on the token is where i think we're stumbling | 21:27 |
| bknudson | morganfainberg: I wrote a test that verifies deleting a token works as expected. | 21:28 |
| bknudson | I don't think that operation was even available before I added it. | 21:28 |
| morganfainberg | v2.0 | 21:28 |
| morganfainberg | ? | 21:28 |
| bknudson | morganfainberg: no, in the tempest client reimplementation | 21:28 |
| *** nkinder has quit IRC | 21:28 | |
| morganfainberg | hm. | 21:28 |
| bknudson | well, I know I added functions to get a scoped token from an unscoped one. | 21:29 |
| bknudson | maybe revoke token was already there | 21:29 |
| bknudson | I'm going to head home and will be back online when I get there. | 21:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert shell tests to requests-mock https://review.openstack.org/110210 | 21:31 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 21:32 |
| *** topol has quit IRC | 21:34 | |
| *** bknudson has quit IRC | 21:35 | |
| *** andrewss has quit IRC | 21:38 | |
| * morganfainberg goes an sets up a devstack to run tempest in... | 21:41 | |
| *** jorge_munoz has quit IRC | 21:41 | |
| *** amerine has quit IRC | 21:42 | |
| *** amerine has joined #openstack-keystone | 21:43 | |
| dolphm | well that shut him up http://i.imgur.com/fsMJQmz.png cc- stevemar | 21:46 |
| stevemar | dolphm, hehe | 21:47 |
| stevemar | or he had to pick up children or something | 21:47 |
| dolphm | probably | 21:47 |
| stevemar | dolphm, xml is a standard library in python? neat. | 21:51 |
| jamielennox | gyee: https://review.openstack.org/#/c/104771/ | 21:52 |
| stevemar | dolphm, oh btw ... did we end up deciding if a federation token user section should have a domain? | 21:54 |
| jamielennox | stevemar: an idp id from memory | 21:55 |
| stevemar | jamielennox, i remember the options were idp id, 'federated' dummy value, or fix clients/revoke/token model | 21:55 |
| stevemar | don't remember what we decided, moreover, if we decided | 21:55 |
| jamielennox | stevemar: these 'fixes' are a wonderful idea, somehow we always seem to end up hacking something | 21:56 |
| stevemar | jamielennox, sadly it happens too often :( | 21:56 |
| *** rkofman has joined #openstack-keystone | 21:56 | |
| dolphm | stevemar: etree? | 22:01 |
| stevemar | dolphm, yes | 22:02 |
| dolphm | stevemar: etree is an api - there's no standard implementation in python | 22:02 |
| dolphm | stevemar: lxml provides an etree implementation | 22:02 |
| dolphm | unless that changed recently / is changing | 22:02 |
| *** bknudson1 has joined #openstack-keystone | 22:02 | |
| stevemar | dolphm, maybe i'm wrong | 22:07 |
| * stevemar shrugs | 22:08 | |
| stevemar | dolphm, doing the spec for role assignment notifications now, blah | 22:08 |
| *** gordc has quit IRC | 22:10 | |
| *** cjellick_ has joined #openstack-keystone | 22:10 | |
| *** cjellick has quit IRC | 22:13 | |
| *** cjellick_ has quit IRC | 22:14 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Move openID Connect support to Kilo release https://review.openstack.org/113666 | 22:16 |
| stevemar | dolphm, ^ | 22:16 |
| dolphm | stevemar: tempted to just approve that since it's just procedural | 22:17 |
| dolphm | stevemar: but +2 | 22:17 |
| stevemar | yeah, | 22:17 |
| stevemar | dolphm, please wait til henry has voiced his opinion | 22:17 |
| dolphm | stevemar: oh ++ | 22:17 |
| *** amerine has quit IRC | 22:22 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Role assignment notifications https://review.openstack.org/113669 | 22:36 |
| stevemar | dolphm, and last one for today... ^ | 22:36 |
| dolphm | stevemar: woot! | 22:36 |
| stevemar | dolphm, you'll get the real joy of being PTL for the next month or so :P | 22:37 |
| dolphm | stevemar: it feels like we just released icehouse yesterday | 22:38 |
| *** david-ly_ is now known as david-lyle | 22:41 | |
| *** cjellick has joined #openstack-keystone | 22:41 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: DO NOT MERGE - DEBUGGING CHECK SPECIFIC FAILURE https://review.openstack.org/113670 | 22:42 |
| * morganfainberg grumbles about being unable to debug a check failure locally | 22:42 | |
| dolphm | morganfainberg: +2 | 22:44 |
| morganfainberg | LOL | 22:44 |
| morganfainberg | oh is zuul down... | 22:44 |
| stevemar | lol @ morganfainberg very specific instructions | 22:45 |
| stevemar | DO NOT MERGE | 22:45 |
| stevemar | we should totally merge it | 22:46 |
| * morganfainberg is elbow deep in revocation events and can't duplicate this tempest failure... | 22:46 | |
| morganfainberg | something stupid is happening :( | 22:46 |
| * morganfainberg greatly dislikes the tree search thing. | 22:47 | |
| morganfainberg | stevemar, i don't think it'll pass check :P | 22:49 |
| stevemar | morganfainberg, screw that, i;m merging it anyway | 22:49 |
| morganfainberg | lol | 22:49 |
| *** cjellick has quit IRC | 22:50 | |
| *** gokrokve_ has joined #openstack-keystone | 22:52 | |
| *** gokrokve has quit IRC | 22:56 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Role assignment notifications https://review.openstack.org/113669 | 23:07 |
| shufflebot | keystone server in icehouse can failover to sql over ldap without the custom hybrid driver correct/ | 23:12 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 23:17 |
| *** diegows has quit IRC | 23:26 | |
| bknudson1 | jamielennox: got a minute? | 23:31 |
| jamielennox | bknudson1: of courrse | 23:31 |
| bknudson1 | jamielennox: http://git.openstack.org/cgit/openstack/nova/tree/nova/network/neutronv2/__init__.py#n41 | 23:32 |
| bknudson1 | this is nova creating the neutronclient | 23:32 |
| bknudson1 | you can have CONF.neutron.admin_user_id | 23:32 |
| bknudson1 | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/identity/v2.py#n98 | 23:33 |
| bknudson1 | jamielennox: but the v2 password auth plugin doesn't allow user_id | 23:33 |
| bknudson1 | it only has username | 23:33 |
| bknudson1 | jamielennox: so is there some reason v2 auth plugin doesn't allow user_id? | 23:34 |
| jamielennox | bknudson1: ah, yes - i have noticed this with the version independant one i just did | 23:34 |
| jamielennox | bknudson1: i don't know if it was ever defined | 23:34 |
| jamielennox | so | 23:34 |
| jamielennox | picking a really old client: https://github.com/openstack/python-keystoneclient/blob/0.4.0/keystoneclient/v2_0/client.py#L168 is what i used as the basis of the auth plugin | 23:35 |
| jamielennox | user_id simply doesn't exist there | 23:35 |
| jamielennox | and it's not defined as an option to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tokens.py#L38 | 23:36 |
| bknudson1 | weird | 23:36 |
| jamielennox | and it's not defined: http://docs.openstack.org/api/openstack-identity-service/2.0/content/POST_authenticate-v2.0__v2.0_tokens_identity-auth-v2.html#POST_authenticate-v2.0__v2.0_tokens_identity-auth-v2-Request | 23:37 |
| jamielennox | however somewhere along the way i saw someone else has a v2 userid field | 23:38 |
| bknudson1 | http://git.openstack.org/cgit/openstack/python-neutronclient/tree/neutronclient/client.py#n202 | 23:38 |
| jamielennox | it's also not a CLI option to keystoneclient shell | 23:38 |
| bknudson1 | that's the neutronclient code to generate the request | 23:38 |
| jamielennox | yep | 23:39 |
| *** hrybacki has joined #openstack-keystone | 23:40 | |
| jamielennox | however here it is defined in keystone: https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L265-L288 | 23:41 |
| bknudson1 | jamielennox: y, we have test for it too | 23:41 |
| jamielennox | so i don't know how that happened | 23:41 |
| bknudson1 | so it works if you configure nova to use a user_id for neutron connection | 23:41 |
| jamielennox | so we really have no choice but to add userId to the password plugin | 23:42 |
| jamielennox | which is a little annoying because it messes with the parameters | 23:42 |
| bknudson1 | jamielennox: the parameters were very clean | 23:42 |
| bknudson1 | jamielennox: maybe a new class? UserPassword or something | 23:43 |
| jamielennox | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/identity/v2.py#n100 | 23:43 |
| bknudson1 | looks like tenant_id is supported in addition to tenant_name | 23:43 |
| jamielennox | yep, so i don't know how we make username an optional value there and add id | 23:43 |
| openstackgerrit | A change was merged to openstack/keystone: Enhance V3 extension class to use resources https://review.openstack.org/111571 | 23:43 |
| openstackgerrit | A change was merged to openstack/keystone: Change V3 extensions to use resources https://review.openstack.org/111572 | 23:43 |
| jamielennox | i think this is about where i got to once before :) | 23:44 |
| bknudson1 | I don't think that Nova | 23:45 |
| bknudson1 | 's going to accept a change that breaks user_id. | 23:45 |
| jamielennox | no, i don't think they will either | 23:45 |
| bknudson1 | this change is already going to be a little half-assed | 23:45 |
| bknudson1 | since for some reason neutronclient accepts an auth_strategy option | 23:46 |
| jamielennox | bknudson1: yea, i don't know who was responsible for that auth_strategy thing but it was badly implemented and badly adopted | 23:46 |
| jamielennox | it came out of nova and depending on when you forked your client might have it or not | 23:47 |
| bknudson1 | it only has 1 other option. | 23:47 |
| bknudson1 | noauth | 23:47 |
| jamielennox | just enough to make it really difficult to do a clean changeover | 23:47 |
| jamielennox | i was having the same problem with novaclient/shell | 23:47 |
| jamielennox | bknudson1: so what if we make all 3 parameters optional and then enforce it __init__ | 23:48 |
| bknudson1 | username and password? | 23:48 |
| bknudson1 | and, enforce that one of username or user_id is given? | 23:49 |
| bknudson1 | I think that's backwards compatible. | 23:49 |
| jamielennox | i think so, just looking now | 23:52 |
| jamielennox | the only thing i can see is that if you had explicity passed username or password as None | 23:52 |
| *** andreaf has joined #openstack-keystone | 23:53 | |
| bknudson1 | jamielennox: why would password=None be a prob with the change? | 23:54 |
| *** andreaf_ has quit IRC | 23:56 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing user_id to v2Password plugin https://review.openstack.org/113712 | 23:56 |
| jamielennox | bknudson1: ^ untested and raises TypeError which is probably bad | 23:56 |
| *** andreaf has quit IRC | 23:56 | |
| jamielennox | untested as in no explicit test cases | 23:57 |
| jamielennox | passes existing test | 23:57 |
| *** andreaf has joined #openstack-keystone | 23:57 | |
| bknudson1 | another difference with neutronclient's regular client vs session client is that the regular client takes a endpoint_url whereas it looks like session gets the endpoint from the catalog (via the name) | 23:57 |
| bknudson1 | jamielennox: is there any way around that ^ ? | 23:59 |
| jamielennox | hmm, that was something i though about earlier today in regards to that auth_token patch that uses session | 23:59 |
| jamielennox | we switched from using the explict URL to the service catalog | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
