| bknudson1 | jamielennox: what patch is that? | 00:00 |
|---|---|---|
| bknudson1 | the one that merged recently? | 00:00 |
| jamielennox | https://review.openstack.org/#/c/105031/ | 00:00 |
| bknudson1 | that still uses identity_uri | 00:01 |
| jamielennox | oh, yea it does | 00:01 |
| jamielennox | so you can use the same trick with neutron | 00:01 |
| jamielennox | if you specify a full url eg http://xxx/xx/xx it will use that instead of the service catalog | 00:01 |
| bknudson1 | jamielennox: specify a full url for what? | 00:03 |
| *** nkinder has joined #openstack-keystone | 00:03 | |
| jamielennox | bknudson1: whatever request that neutron is making to endpoint_url | 00:04 |
| jamielennox | i've no idea how practical that is | 00:04 |
| bknudson1 | jamielennox: here's the code in neutronclient: http://git.openstack.org/cgit/openstack/python-neutronclient/tree/neutronclient/client.py#n284 | 00:04 |
| bknudson1 | it takes interface, service_type, region_name | 00:04 |
| jamielennox | what the hell have they done | 00:05 |
| bknudson1 | I assume those are the interface, service_type, and region_name for neutron | 00:05 |
| bknudson1 | if you look down at line http://git.openstack.org/cgit/openstack/python-neutronclient/tree/neutronclient/client.py#n376 | 00:06 |
| bknudson1 | construct_http_client takes endpoint_url but it only passes it to HTTPClient and not SessionClient | 00:07 |
| jamielennox | hmm, so they've broken compatability for nova there | 00:07 |
| jamielennox | if you pass a session it will be ignored | 00:07 |
| jamielennox | i did that on purpose in novaclient | 00:08 |
| jamielennox | if you convert nova to use neutronclient with a session object then you should deprecated the endpoint_url option | 00:08 |
| bknudson1 | jamielennox: Nova actually defaults the neutron.url. | 00:08 |
| bknudson1 | jamielennox: y, that makes sense | 00:09 |
| jamielennox | bknudson1: where does it get that from, isn't it just from the service catalog? | 00:09 |
| jamielennox | it should just get it from the catalog, in which case it means you should just be passing the plugin (with catalog) to the session | 00:10 |
| bknudson1 | jamielennox: ha ha, good one! | 00:10 |
| bknudson1 | http://git.openstack.org/cgit/openstack/nova/tree/nova/network/neutronv2/api.py#n39 | 00:10 |
| bknudson1 | it's just hardcoded | 00:10 |
| bknudson1 | default='http://127.0.0.1:9696' | 00:11 |
| jamielennox | nice one | 00:11 |
| jamielennox | i remember this being one of the cases for allowing auth plugins to be reloaded from the config file | 00:12 |
| *** david-lyle has quit IRC | 00:12 | |
| bknudson1 | jamielennox: what do you mean reloaded? like with a signal tell it to re-read config? | 00:12 |
| jamielennox | s/reloaded/reused | 00:13 |
| jamielennox | so you don't need to specify username/password multiple times in the nova.conf for each of the different clients | 00:13 |
| *** wwriverrat has joined #openstack-keystone | 00:15 | |
| bknudson1 | jamielennox: I think what I'll do for now is have essentially a switch for using session... e.g., you have to have 'neutron.url' set to some special value or neutron.identity_version=v3. | 00:15 |
| bknudson1 | so they have to opt-in to using the session client | 00:16 |
| jamielennox | bknudson1: can we do something without adding a new value? | 00:16 |
| bknudson1 | and then deprecate the non-session client options. | 00:16 |
| jamielennox | eg if neutron.url isn't set, then don't use the default use a session | 00:16 |
| *** wwriverrat1 has quit IRC | 00:17 | |
| bknudson1 | jamielennox: it's got a default so we don't know if it isn't set or not, but I think we could remove the default then. | 00:17 |
| jamielennox | bknudson1: right, change the default to None | 00:18 |
| bknudson1 | but it still seems like we need more option | 00:18 |
| bknudson1 | more options | 00:18 |
| jamielennox | bknudson1: is there an error that makes sense: https://review.openstack.org/#/c/113712/1/keystoneclient/auth/identity/v2.py | 00:18 |
| bknudson1 | jamielennox: are we running out of exception types? If not, define a new one. | 00:19 |
| jamielennox | bknudson1: if you do the register_conf_options then it will add a auth_plugin option which you can check for | 00:20 |
| bknudson1 | jamielennox: I'm happy to switch to the register_conf_options at some point, but given the problems I've already run into I don't see how it's going to work yet. | 00:21 |
| bknudson1 | I think that will be a future change. | 00:21 |
| jamielennox | bknudson1: for auth or for session? | 00:21 |
| jamielennox | session should be ok | 00:21 |
| jamielennox | auth is still a problem i expect | 00:21 |
| bknudson1 | jamielennox: I haven't looked into the nova changes to support session to know how it's going to turn out yet. | 00:22 |
| *** zzzeek has quit IRC | 00:22 | |
| bknudson1 | jamielennox: the exception should be raised in the constructor rather than wait for get_auth_data | 00:22 |
| *** david-lyle has joined #openstack-keystone | 00:23 | |
| *** david-lyle has quit IRC | 00:24 | |
| *** wwriverrat has left #openstack-keystone | 00:24 | |
| jamielennox | bknudson1: i get test failures when i do it in __init__ | 00:25 |
| *** david-lyle has joined #openstack-keystone | 00:25 | |
| *** wwriverrat has joined #openstack-keystone | 00:25 | |
| bknudson1 | jamielennox: why do tests fail? | 00:25 |
| bknudson1 | they don't pass a username? | 00:25 |
| jamielennox | bknudson1: oh, my bad, had my order of operations wrong | 00:27 |
| *** david-lyle has quit IRC | 00:29 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow passing user_id to v2Password plugin https://review.openstack.org/113712 | 00:30 |
| morganfainberg | bknudson1, well looks like adding logging to detect the failure has just successfully removed the failure :( | 00:30 |
| bknudson1 | morganfainberg: nice, check it in quick. | 00:31 |
| morganfainberg | bknudson1, lol | 00:31 |
| jamielennox | bknudson1: ok ^ so that's userId, not sure what else can be done for now | 00:33 |
| bknudson1 | jamielennox: thanks! | 00:35 |
| dstanek | dolphm, stevemar: i see that you guys have both +2ed the default cache_time review; i have an update to it that implements morganfainberg's idea | 00:39 |
| stevemar | dstanek, what was his idea? | 00:40 |
| stevemar | its not in the review | 00:40 |
| dstanek | stevemar: running the tests now - to have a global cache_time similar to what we do with list_limits | 00:40 |
| morganfainberg | stevemar, the same way the enabled flag is overridden for cache, check global, check subsystem | 00:45 |
| morganfainberg | stevemar, so in this case if the subsystem doesn't define a cache time, fall back to the global default | 00:45 |
| morganfainberg | well crap. how the hell am i supposed to solve this issue if it's timing is narrow enough LOG lines can swing it to not happening | 00:47 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Sets a default timeout for cached data https://review.openstack.org/113586 | 00:47 |
| *** richm has quit IRC | 00:47 | |
| stevemar | lol morganfainberg poor you | 00:56 |
| jamielennox | gyee: https://review.openstack.org/#/c/104771/18 | 00:56 |
| jamielennox | or anyone else in search of a fairly simple review can they finish off ^ | 00:56 |
| stevemar | jamielennox, on the job! | 01:00 |
| ayoung | jamielennox, stevemar if I add a big "WARNING THIS CODE IS STILL EXPERIMENTAL" can we please just merge https://review.openstack.org/#/c/81166/30 | 01:01 |
| ayoung | that way, all of bknudson1 's bug fixes will be done on top of this code, and not be duplicated? | 01:02 |
| ayoung | and we can start writing tempest tests etc | 01:02 |
| jamielennox | ayoung: if tempest depends on it - how do we ever get rid of it later | 01:02 |
| ayoung | jamielennox, we don't get rid of this. we need tempest tests to ensure that real live revocation is done | 01:03 |
| stevemar | jamielennox, holy poop that was some ugly code before (wrt reset variable) | 01:03 |
| ayoung | this is in the client, and will be used by the server (like how CMS is done) | 01:03 |
| jamielennox | stevemar: yea, i hated that code so much, the new stuff isn't pretty but the stateful-ness of the old one was horrible | 01:04 |
| ayoung | ++ | 01:04 |
| *** wwriverrat1 has joined #openstack-keystone | 01:04 | |
| ayoung | jamielennox, can you look at the Kerberos plugin that Jose wrote? That is pretty much the single most important thing we need from client | 01:05 |
| *** wwriverrat has quit IRC | 01:05 | |
| ayoung | if its wrong, we need to get it fixed | 01:05 |
| stevemar | jamielennox, it was only those 2 methods that were affected? | 01:05 |
| jamielennox | stevemar: also i feel that bit is a vote in favour of putting a catalog in an unscoped token | 01:05 |
| ayoung | https://review.openstack.org/#/c/74974/ | 01:05 |
| jamielennox | stevemar: they are the only operations (i could see) that can be performed with an unscoped token | 01:05 |
| ayoung | it needs rebase etc, and I can handlethat, but the general approach looks good to me, and its super-critical path | 01:06 |
| ayoung | jamielennox, the things we need from an unscoped token are : list projects, list domains, and where to get tokens | 01:07 |
| ayoung | so /users/{userid}/projects /users/{userid}/domains and /auth/tokens | 01:07 |
| jamielennox | ayoung: reviewed | 01:09 |
| jamielennox | yep, and v2 doesn't have domain listing | 01:09 |
| jamielennox | i'm not sure why this stuff worked in v3 | 01:09 |
| *** wwriverrat1 has quit IRC | 01:10 | |
| stevemar | jamielennox, +A'ed | 01:13 |
| jamielennox | stevemar: cheers | 01:13 |
| *** cjellick has joined #openstack-keystone | 01:15 | |
| gyee | jamielennox, sorry I got stuck in a meeting, looks like someone approve that one already | 01:18 |
| jamielennox | gyee: that's alright stevemar got it | 01:18 |
| stevemar | dstanek, why don't you need parenthesis when you call get_expiration_time | 01:18 |
| stevemar | gyee, yeah thats right! | 01:19 |
| gyee | heh | 01:19 |
| stevemar | :D | 01:19 |
| dstanek | stevemar: it's being called, it's passed in as an arg | 01:19 |
| stevemar | dstanek, neato | 01:19 |
| dstanek | stevemar: if we called it at import time the config option wouldn't have been registed yet | 01:20 |
| *** rkofman has left #openstack-keystone | 01:21 | |
| stevemar | dstanek, i was referring to here: @cache.on_arguments(should_cache_fn=SHOULD_CACHE, expiration_time=get_expiration_time) | 01:21 |
| dstanek | stevemar: me too | 01:21 |
| stevemar | dstanek, but i guess there is specialness to passing a method in there | 01:21 |
| dstanek | if expiration is a callable it gets called | 01:22 |
| dstanek | stevemar: we were already passing a callable in; i just changed it from a lambda to a function | 01:22 |
| stevemar | ahhh | 01:22 |
| ayoung | jamielennox, so we would have to ship a separate library in order to get Kerberos support? | 01:24 |
| ayoung | I don;t know...I think Kerberos should just be something that is expected to be there | 01:24 |
| jamielennox | ayoung: i don't mind - i was providing it as an option | 01:25 |
| ayoung | jamielennox, I hear ya, but others sometimes dogpile on these things. I'd like to not put that high a barrier on adoption of Kerberos | 01:26 |
| ayoung | You've got the existing way of doing things that are so wide-open-insecure, and people don't realize why. Then we got and make Kerberos such a pain to work with, and people feel justified in staying away from it | 01:27 |
| jamielennox | ayoung: that's alright - i just don't think we want to get into the habbit of taking a new client dependency for everyone who adds a plugin | 01:29 |
| ayoung | jamielennox, I love the comment "this isn't used? how do the tests pass?" | 01:29 |
| jamielennox | :) | 01:29 |
| ayoung | its the whole "how did this ever work" phenomenon in programming | 01:29 |
| *** cjellick has quit IRC | 01:31 | |
| *** diegows has joined #openstack-keystone | 01:33 | |
| *** andreaf has quit IRC | 01:35 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow providing a default value to CLI loading https://review.openstack.org/113742 | 01:35 |
| jamielennox | ^ posted purely because the rebase is too difficult and i don't want to eject the current things from gate | 01:35 |
| *** andreaf has joined #openstack-keystone | 01:35 | |
| jamielennox | getting ridiculous ... | 01:35 |
| openstackgerrit | A change was merged to openstack/keystone: Updates the sample config https://review.openstack.org/113585 | 01:36 |
| *** andreaf has quit IRC | 01:40 | |
| *** gokrokve has joined #openstack-keystone | 01:40 | |
| *** andreaf has joined #openstack-keystone | 01:41 | |
| *** andreaf_ has joined #openstack-keystone | 01:44 | |
| *** andreaf has quit IRC | 01:44 | |
| *** gokrokve_ has quit IRC | 01:44 | |
| *** andreaf_ has quit IRC | 01:45 | |
| *** gokrokve has quit IRC | 01:45 | |
| *** andreaf_ has joined #openstack-keystone | 01:45 | |
| *** andreaf_ has quit IRC | 01:46 | |
| *** andreaf_ has joined #openstack-keystone | 01:46 | |
| *** andreaf_ has quit IRC | 01:46 | |
| *** andreaf_ has joined #openstack-keystone | 01:47 | |
| *** diegows has quit IRC | 01:51 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Refactor auth_token cache https://review.openstack.org/105314 | 01:52 |
| *** Krast has joined #openstack-keystone | 02:00 | |
| ayoung | jamielennox, we passed ridiculous back in late December | 02:00 |
| *** hrybacki has quit IRC | 02:00 | |
| ayoung | maybe earlier | 02:01 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Change unscoped token fallback to be session aware https://review.openstack.org/104771 | 02:07 |
| morganfainberg | ayoung, so... running into an issue with revocation events | 02:12 |
| morganfainberg | ayoung, looks like a timing issue. | 02:12 |
| *** med_ has joined #openstack-keystone | 02:13 | |
| *** med_ has joined #openstack-keystone | 02:13 | |
| *** amcrn has quit IRC | 02:13 | |
| ayoung | morganfainberg, running the tests? | 02:13 |
| morganfainberg | i can't duplicate it locally (unit OR tempest), but have it duplicated in gate consistently, adding logging output "fixes" it | 02:13 |
| morganfainberg | ayoung, it's a tempest issue | 02:13 |
| morganfainberg | this failure: https://review.openstack.org/#/c/113429/ | 02:13 |
| ayoung | morganfainberg, things reporting as not revoked that should be revoked? | 02:14 |
| morganfainberg | reporting as revokes that shouldn't be revoked | 02:14 |
| morganfainberg | and it's ... very tight timing. | 02:14 |
| ayoung | link? | 02:14 |
| morganfainberg | adding in https://review.openstack.org/#/c/113670/1/keystone/contrib/revoke/model.py (look at line 245) just for debugging to see what was matching resolved the issue. | 02:15 |
| morganfainberg | ayoung, http://logs.openstack.org/29/113429/4/check/check-tempest-dsvm-full/024fced/console.html#_2014-08-13_00_07_13_205 | 02:15 |
| morganfainberg | it's sporatic and changes which ones it fails on. | 02:15 |
| morganfainberg | test wise | 02:16 |
| ayoung | it happening in tear down, or is that just where it is reported? | 02:16 |
| morganfainberg | i can't tell if it's 2 unscoped tokens colliding in revocation events because the resolution in mysql being 1s not microsecond | 02:16 |
| morganfainberg | it actually happens in teardownclass | 02:16 |
| morganfainberg | in other cases it happend in setupclass | 02:16 |
| morganfainberg | it's moved around some | 02:16 |
| ayoung | are they revoking their own token? | 02:17 |
| morganfainberg | they do a revocation of a token at one point in the tests | 02:17 |
| morganfainberg | and when they do they revoke their own token expecting it to fail next call | 02:17 |
| morganfainberg | (testing for a 401) | 02:17 |
| ayoung | and maybe iun the cleanup they try to use it, or one that matches the same criteria | 02:17 |
| morganfainberg | ayoung, that is what i'm thinking but... i can't confirm it because i can't log :P log pushes the timing outside the window of occurence | 02:18 |
| ayoung | clear_isolated_creds | 02:18 |
| morganfainberg | this all stems from tokens and events have a 1s resolution because mysql sucks | 02:18 |
| morganfainberg | as far as i cant tell | 02:18 |
| ayoung | can we get around that? | 02:18 |
| morganfainberg | not without breaking compatibility with versions of mysql | 02:19 |
| ayoung | I'm sure that mysql must be able to deal with something finer | 02:19 |
| ayoung | what if we use a different datatype? | 02:19 |
| morganfainberg | it can after a certain version. but it would probably break a lot of things. | 02:19 |
| morganfainberg | we could migrate to varchar | 02:19 |
| morganfainberg | my other thought is stop revoking by expires time | 02:19 |
| morganfainberg | inject a "token chain id" (uuid4?) that is carried forward on chaining tokens. | 02:20 |
| ayoung | 5.6.4 according to http://stackoverflow.com/questions/15526597/how-to-retrieve-microseconds-or-milliseconds-from-mysql-current-time | 02:20 |
| morganfainberg | you revoke on this chain id (request id, whatever) | 02:20 |
| ayoung | hmmm, yeah | 02:20 |
| morganfainberg | ayoung, right but you need to specifically migrate the tables to datetime(6) because they default to datetime(0) [all other SQL servers default to datetime(6)] | 02:20 |
| morganfainberg | and ... older versions of mysql may puke/explode/etc (not sure what the minimum mysql for openstack is... it's not really documented) | 02:21 |
| ayoung | I'm on 5.5.38-MariaDB, | 02:21 |
| ayoung | \and that is Fedora | 02:21 |
| ayoung | SO the broken version is the norm | 02:21 |
| morganfainberg | i don't think migration to datetime(6) is a good idea | 02:21 |
| ayoung | ok, we know what is happening. revoke on expiration is matching too broadly | 02:22 |
| morganfainberg | unless RH backported the datetime support (i think unlikely) | 02:22 |
| morganfainberg | ayoung, i *think* that is it, but it's hard to be 100% sure | 02:22 |
| ayoung | when you revoke a token, it revokes based on userid and expires_at | 02:22 |
| ayoung | if you requested two tokens too close together, the "other" one would be revoked by mistake | 02:22 |
| ayoung | It smells right | 02:22 |
| morganfainberg | yep | 02:22 |
| ayoung | and I was assuming microsecond granularity | 02:23 |
| morganfainberg | i'm thinking the quickest / easiest fix is change what we use as the unique id for token chains | 02:23 |
| ayoung | the revoke all by expires_at is very elegant | 02:23 |
| ayoung | ugh | 02:23 |
| ayoung | makes the token larger, and it can't be the shared secret | 02:23 |
| *** Krast has quit IRC | 02:23 | |
| ayoung | it would be good if it could be "forward only" | 02:24 |
| morganfainberg | ayoung, yes it does, but i think we can justify 32bytes (ascii hex) | 02:24 |
| *** andreaf_ has quit IRC | 02:24 | |
| ayoung | which means that if I get an unscoped, then use that to get a scoped, revoking the scoped token does not revoke the unscoped | 02:24 |
| morganfainberg | i think i can lump that into this fix idea easily | 02:24 |
| morganfainberg | with limited token bloat. | 02:24 |
| ayoung | don't jump...this is tricky | 02:24 |
| *** andreaf_ has joined #openstack-keystone | 02:24 | |
| ayoung | right now, we have no limitation on token to token transfers | 02:25 |
| *** hrybacki has joined #openstack-keystone | 02:25 | |
| morganfainberg | ayoung, and this wouldn't change that. | 02:25 |
| ayoung | logically there is no difference between going scoped to unscoped back to scoped.... | 02:25 |
| ayoung | OTOH this unique identifier could be usedfor Audit | 02:26 |
| morganfainberg | ayoung, yeah a nice side effect | 02:26 |
| ayoung | so if we say "yeah, you are always going to revoke the whole chain....we still break Horizon" | 02:26 |
| morganfainberg | ayoung, i was thinking *when* we make unscoped from scoped not allowed, we make the "original" token identifiable | 02:27 |
| morganfainberg | or we do that now but don't use that functionality | 02:27 |
| morganfainberg | token.get('is_subtoken', false) [name sucks i know] | 02:27 |
| ayoung | how about when a user requests a new token, it it would already be revoked, wait one second | 02:28 |
| morganfainberg | we can lay *some* ground work here | 02:28 |
| ayoung | nah...my guess is the token was alreayd issued | 02:28 |
| ayoung | mysql sucks | 02:28 |
| morganfainberg | ayoung, ++ that is my guess | 02:28 |
| ayoung | lets just switch to a real Database already | 02:28 |
| morganfainberg | ayoung, lets talk about real answers to fixing this :P | 02:28 |
| morganfainberg | it does also affect postgres because we had to "fix" it based on lowest common lameness | 02:29 |
| ayoung | db = sqlalchemy.create_engine('postgresql:///tutorial.db') | 02:29 |
| ayoung | add an additional field to the token. expires_at_microseconds. Store it in an integer | 02:30 |
| morganfainberg | doesn't mean it'll fly "oh keystone requires postgres an everyone else uses <insert options>" | 02:30 |
| ayoung | morganfainberg, I've been raging impotently against MySQL for well over a Decade at this point | 02:31 |
| ayoung | morganfainberg, damnit, we can't use it for audit | 02:32 |
| morganfainberg | ? | 02:32 |
| ayoung | two tokens would show up using the same id | 02:32 |
| ayoung | a begets b | 02:32 |
| ayoung | both have the same "source" | 02:32 |
| ayoung | unless we gave each a unique audit ID, and then when we revoke we revoke on audit id, and now we've lost the chain | 02:33 |
| ayoung | it unbreaks horizon | 02:33 |
| ayoung | hmmm | 02:33 |
| ayoung | but maybe that moves us forward, and we make revoke-all-with-expires-at a different call | 02:33 |
| ayoung | one we can use explicitly when we want it | 02:33 |
| morganfainberg | ayoung, sure. | 02:34 |
| *** topol has joined #openstack-keystone | 02:36 | |
| ayoung | morganfainberg, run it past dolphm ... | 02:37 |
| ayoung | it means adding the audit id to every token. how do we make that unique? another uuid? | 02:37 |
| ayoung | morganfainberg, or we put a one second delay in the tempest tests. | 02:38 |
| ayoung | nah.. | 02:39 |
| morganfainberg | ayoung, i already had to put a 1s delay in one of our unit tests... lets not be silly | 02:41 |
| ayoung | morganfainberg, surprised we haven't seen more problems along these lines. The "issued_at" hack was to make two tokens different even if they were issued with the exact same data | 02:41 |
| ayoung | yeah, lets try to undo that change | 02:41 |
| *** Krast has joined #openstack-keystone | 02:42 | |
| * ayoung trying to think of a way to do this without adding data to the token | 02:42 | |
| ayoung | they must be of different scopes. Otherwise the DB would complain | 02:43 |
| morganfainberg | ayoung, issued_at is actually useful though for things like revocation events | 02:43 |
| ayoung | morganfainberg, oh, I'm aware, just that it was supposed to be more fine grained than one second for exactly this reason. Is it? | 02:44 |
| ayoung | We had unit tests failing until I put that in | 02:44 |
| ayoung | ah..but it is in the token data, not a database column | 02:44 |
| morganfainberg | yep | 02:44 |
| ayoung | expires at must be treated differently, but maybe we can fix that | 02:45 |
| morganfainberg | expires is a first order column in the db | 02:45 |
| ayoung | it should be in the body of the token | 02:45 |
| morganfainberg | because we use it as an indexed value | 02:45 |
| ayoung | too | 02:45 |
| morganfainberg | hm, we do *wonky* crap with rebuilding the tokens | 02:45 |
| ayoung | yeah,but we don't need to use that copy to test the revocation event, or even to treat it as cannonical | 02:45 |
| morganfainberg | it's what i'm trying to solve with all this get rid of token_api | 02:46 |
| * ayoung goes to look | 02:46 | |
| morganfainberg | that way we don't have multiple forms of tokens being worked with inside keystone | 02:46 |
| morganfainberg | anyway. i need dinner | 02:46 |
| * morganfainberg is starving | 02:46 | |
| morganfainberg | i'll poke you / dolph about this tomorrow cause this is one of the last major changes needed to deprecate token_api (tests can be mucked with more easily) | 02:47 |
| morganfainberg | this assignment_api and a couple of small others. | 02:47 |
| morganfainberg | then it becomes stupid easy to turn off token persistence :) | 02:47 |
| ayoung | morganfainberg, I think we can fix this without any changes to the data in the token. We have to duplicate the expires at value, and keep the millisecond version around | 02:48 |
| ayoung | persistance get_token just creates a dict...where is the logic | 02:48 |
| morganfainberg | it's the issue token | 02:48 |
| morganfainberg | issue does the store of the dict | 02:49 |
| stevemar | dstanek, ping | 02:49 |
| ayoung | expires=token_data['access']['token']['expires'], | 02:49 |
| dstanek | stevemar: pong | 02:51 |
| stevemar | dstanek, your second comment here: https://review.openstack.org/#/c/112204/7/keystone/notifications.py | 02:52 |
| stevemar | you mean, access them via ['project_id'] instead of .get() ? | 02:52 |
| dstanek | stevemar: yes | 02:52 |
| stevemar | dstanek, cool, minor performance enhancement i guess | 02:52 |
| dstanek | stevemar: i actually reworked it just now...gimme a sec and i'll paste it for you to take a look at | 02:53 |
| stevemar | dstanek, that would be great | 02:53 |
| *** andreaf_ has quit IRC | 02:53 | |
| morganfainberg | ayoung, and we explicitly set expires to the value from the db column in format_token | 02:53 |
| stevemar | dstanek, for the raising exception, i just copy / pasta'ed the other manager wrapper | 02:54 |
| *** andreaf_ has joined #openstack-keystone | 02:54 | |
| morganfainberg | ayoung, http://pasteraw.com/c6tz5zf1oe5978qr8o660sz4inywp9u | 02:54 |
| dstanek | stevemar: ha, then i'll fix that now :-) | 02:54 |
| *** andreaf_ has quit IRC | 02:54 | |
| morganfainberg | ayoung, https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L44-L52 | 02:54 |
| stevemar | i think it's to raise the exception that might be called if the actual function fails | 02:54 |
| stevemar | dstanek, neato, and comment here ^ | 02:54 |
| stevemar | dstanek, also the spec is here: https://review.openstack.org/#/c/113669/ | 02:55 |
| morganfainberg | ayoung, so ... if we *didn't* override the value there (unless it didn't exist) i think all our timing issues go away (though... a unique chain id would be better that comparing microseconds in a distributed keystone front end) | 02:55 |
| ayoung | morganfainberg, but adding an audit_id would be a more invasive change | 02:56 |
| ayoung | lets fix the timing first. | 02:56 |
| morganfainberg | ayoung, have i mentioned i hate the revocation event tree code. it gave me a headache again today :P | 02:56 |
| ayoung | I'm still on the fence about the horizon issue | 02:56 |
| dstanek | stevemar: http://paste.openstack.org/show/94121/ | 02:56 |
| ayoung | morganfainberg, well, I origianlly wrote it as a series of functions, pseudo-recursive | 02:57 |
| ayoung | I still think that was easier to read | 02:57 |
| ayoung | this code...not so much | 02:57 |
| morganfainberg | ayoung, might have been easier to read. the tree is not *fast* | 02:57 |
| stevemar | dstanek, errr my gawd, inspect.getcallargs | 02:57 |
| morganfainberg | considering those tests always top the slowest tests. | 02:57 |
| stevemar | that is so freaking cool | 02:58 |
| morganfainberg | not saying it's horrible, just not blazing fast :P | 02:58 |
| ayoung | morganfainberg, not sure if recursion would fix that or not. I suspect it is the hashtable lookups that are the real bottleneck there | 02:58 |
| morganfainberg | stevemar, you can do EVIL things with inspect :) | 02:58 |
| morganfainberg | ayoung, if it was the same cost to do the lookups/validate revocation i'd opt for easier to read code | 02:58 |
| stevemar | TIL inspect | 02:59 |
| ayoung | morganfainberg, ok...let me pull up the original version in the review and you can tell me | 02:59 |
| morganfainberg | stevemar, i've done evil dirty things... including things like monkey patching and using inspect to do cryptographic verification of overrideen functions | 02:59 |
| morganfainberg | ayoung, nah, lets not go down that path in Juno | 02:59 |
| morganfainberg | ayoung, lets evaluate that in Kilo | 03:00 |
| morganfainberg | ayoung, we have this now and it *mostly* works | 03:00 |
| dstanek | stevemar: yeah, pretty nice - it does all of that work for you | 03:00 |
| morganfainberg | if we can make it better in K at little cost, we do so. if not we can think about other options if they make sense | 03:00 |
| stevemar | dstanek, technically the role_id is not part of the actor OR'ing :) | 03:00 |
| ayoung | morganfainberg, OH, YEAH | 03:00 |
| ayoung | Change-Id: If76c8cd5d01a5b991c58a4d1a9d534b2a3da875a | 03:01 |
| stevemar | dstanek, did you intend to upload a new patch? o/w i'll poke around | 03:01 |
| ayoung | 82 REVISIONS! | 03:01 |
| ayoung | I'll find the latest non-tree version via binary search! | 03:01 |
| dstanek | stevemar: sure i can do that | 03:02 |
| morganfainberg | lol | 03:02 |
| dstanek | stevemar: role_id shouldn't be there? | 03:02 |
| stevemar | dstanek, alrighty, i just didn't want to be in a state of limbo | 03:03 |
| stevemar | dstanek, role_id is always passed in | 03:03 |
| stevemar | dstanek, rm line 52 in your pastie | 03:03 |
| stevemar | it's in the right spot, line 59 | 03:04 |
| dstanek | stevemar: oh, i think i got confused in the 'if actor is None' block | 03:04 |
| ayoung | morganfainberg, here is a fairly late revision https://review.openstack.org/#/c/55908/56/keystone/contrib/revoke/model.py,cm prior to the rewrite | 03:04 |
| morganfainberg | ayoung, i think.. 60 is the last pre-tree one | 03:04 |
| morganfainberg | ayoung, honestly, it is easier to read. there is less magic. | 03:05 |
| ayoung | morganfainberg, I suspect that code would also be faster. Fewer hashtable lookups | 03:05 |
| morganfainberg | ayoung, lets slate that for K1 ? | 03:05 |
| morganfainberg | ayoung, do some testing. | 03:05 |
| ayoung | ++ | 03:05 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 03:06 |
| morganfainberg | ayoung, ok tomorrow i'll see if i can "not" override the token expires at if it already exists in the data structure | 03:06 |
| morganfainberg | ayoung, maybe that'll make things all happy | 03:07 |
| stevemar | damn you make some pretty code dstanek | 03:08 |
| ayoung | morganfainberg, the expires at time has to be inside the token data when the token is signed. Modifying that value at any point is going to break things. I'm surprised that the Hashes matched | 03:11 |
| ayoung | but I don't think we are hashing the database generated times. | 03:11 |
| morganfainberg | ayoung, we don't | 03:11 |
| ayoung | then, maybe the problem is just where I am getting the expires at value | 03:12 |
| morganfainberg | ayoung, we pull from the DB and never hash we compare values from the decoded token to the db values (at most) | 03:12 |
| ayoung | not for revocation events we don't | 03:12 |
| morganfainberg | ayoung, nah, the data is in the DB, we just need to not override it in format_token (and the v3) equiv | 03:12 |
| morganfainberg | ayoung, we do, it's part of validate_token | 03:12 |
| morganfainberg | ayoung, validate token re-writes the token in many ways. | 03:12 |
| morganfainberg | ayoung, once everything uses validate token instead of get_token, it's easy to use the openssl stuff and decode the token and use that raw value never touching the db, in the case of loading from the db, we need to just be smarter | 03:13 |
| morganfainberg | ayoung, easy enough fix. thanks for talking through it. | 03:14 |
| ayoung | morganfainberg, so places like this http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/common.py#n560 | 03:14 |
| morganfainberg | nah in the token_data_helper | 03:15 |
| morganfainberg | there as well. | 03:15 |
| morganfainberg | hm, maybe just there | 03:15 |
| ayoung | expires=token_ref['expires'], that kind of call is the sin | 03:15 |
| * morganfainberg is headed out. | 03:15 | |
| ayoung | gnigh | 03:15 |
| *** rushiagr_away is now known as rushiagr | 03:16 | |
| stevemar | dstanek, ping | 03:39 |
| dstanek | stevemar: pong | 03:41 |
| stevemar | dstanek, looks like inspect.getcallargs doesn't work in py26 :( | 03:42 |
| stevemar | looks like inspect.getargspec(fn) has to be used ... i think | 03:42 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Standardize AccessInfo token setting https://review.openstack.org/113415 | 03:43 |
| dstanek | Hmmm...let me have a look | 03:43 |
| *** ayoung has quit IRC | 03:50 | |
| dstanek | stevemar: ugg...the python impl or getcallargs is about 88 lines of code | 03:54 |
| stevemar | blah | 03:57 |
| stevemar | not worth it since we only use it in 1 spot | 03:57 |
| stevemar | might be worth proposing to oslo or something | 03:57 |
| dstanek | i think i have a shorter version - working on a few tests now | 03:58 |
| *** hrybacki has quit IRC | 04:00 | |
| stevemar | dstanek, m'alright | 04:00 |
| stevemar | thanks for looking at this | 04:00 |
| dstanek | 2.6 is dead to me! | 04:00 |
| dstanek | stevemar: ma pleasure - just going through the reviews in my inbox | 04:00 |
| stevemar | i think 2.6 is dead to most | 04:01 |
| *** rushiagr is now known as rushiagr_away | 04:01 | |
| *** hrybacki has joined #openstack-keystone | 04:02 | |
| *** hrybacki has quit IRC | 04:06 | |
| *** andreaf has joined #openstack-keystone | 04:12 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Convert shell tests to requests-mock https://review.openstack.org/110210 | 04:13 |
| *** andreaf has quit IRC | 04:15 | |
| *** Kuo_ has joined #openstack-keystone | 04:30 | |
| *** david-lyle has joined #openstack-keystone | 04:31 | |
| *** RockKuo_Home has quit IRC | 04:33 | |
| *** gokrokve has joined #openstack-keystone | 04:36 | |
| *** chandankumar has joined #openstack-keystone | 04:50 | |
| *** chandankumar has quit IRC | 05:02 | |
| stevemar | dstanek, still alive? | 05:05 |
| *** alex_xu has joined #openstack-keystone | 05:06 | |
| *** spandhe_ has quit IRC | 05:08 | |
| *** chandankumar has joined #openstack-keystone | 05:12 | |
| *** amirosh has joined #openstack-keystone | 05:13 | |
| *** ajayaa has joined #openstack-keystone | 05:19 | |
| *** Dafna has quit IRC | 05:22 | |
| *** Dafna has joined #openstack-keystone | 05:24 | |
| *** topol has quit IRC | 05:28 | |
| *** k4n0 has joined #openstack-keystone | 05:30 | |
| *** ukalifon1 has joined #openstack-keystone | 05:33 | |
| dstanek | stevemar: mostly | 05:42 |
| stevemar | dstanek, great to hear! don't let the zombies get you | 05:43 |
| *** gokrokve_ has joined #openstack-keystone | 05:44 | |
| *** gokrokve has quit IRC | 05:47 | |
| *** gokrokve_ has quit IRC | 05:48 | |
| *** tomoiaga has joined #openstack-keystone | 05:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:06 |
| *** abhishekk has joined #openstack-keystone | 06:25 | |
| *** yasukun has joined #openstack-keystone | 06:28 | |
| *** openstackgerrit_ has joined #openstack-keystone | 06:33 | |
| *** gokrokve has joined #openstack-keystone | 06:37 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 06:39 |
| *** gokrokve has quit IRC | 06:42 | |
| *** stevemar has quit IRC | 06:42 | |
| *** stevemar has joined #openstack-keystone | 06:42 | |
| *** stevemar has quit IRC | 06:47 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: convert the conf value into correct type https://review.openstack.org/113191 | 07:04 |
| *** amcrn has joined #openstack-keystone | 07:10 | |
| *** jaosorior has joined #openstack-keystone | 07:18 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow registering individual plugin CONF options https://review.openstack.org/113478 | 07:19 |
| *** yasukun has quit IRC | 07:21 | |
| *** yasukun has joined #openstack-keystone | 07:22 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Convert keystone CLI to use auth plugins https://review.openstack.org/95680 | 07:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow unauthenticated discovery https://review.openstack.org/107570 | 07:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 07:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow providing a default value to CLI loading https://review.openstack.org/113742 | 07:23 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 07:23 |
| *** david-lyle has quit IRC | 07:29 | |
| *** david-lyle has joined #openstack-keystone | 07:29 | |
| *** david-lyle has quit IRC | 07:34 | |
| *** rwsu has quit IRC | 07:34 | |
| *** gokrokve has joined #openstack-keystone | 07:36 | |
| *** gokrokve has quit IRC | 07:37 | |
| *** gokrokve has joined #openstack-keystone | 07:38 | |
| *** bvandenh has joined #openstack-keystone | 07:40 | |
| *** gokrokve has quit IRC | 07:43 | |
| *** rwsu has joined #openstack-keystone | 07:52 | |
| *** ajayaa has quit IRC | 07:53 | |
| *** afazekas has joined #openstack-keystone | 07:54 | |
| *** alex_xu has quit IRC | 08:02 | |
| *** marekd|away is now known as marekd | 08:05 | |
| *** ajayaa has joined #openstack-keystone | 08:06 | |
| *** alex_xu has joined #openstack-keystone | 08:15 | |
| *** alex_xu has quit IRC | 08:15 | |
| *** alex_xu has joined #openstack-keystone | 08:16 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Bump hacking to 0.9.x series https://review.openstack.org/98996 | 08:24 |
| *** yasukun has quit IRC | 08:29 | |
| *** gokrokve has joined #openstack-keystone | 08:37 | |
| *** gokrokve has quit IRC | 08:41 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Keystone part of a PoC for Horizon/Keystone WebSSO https://review.openstack.org/106096 | 09:28 |
| *** david-lyle has joined #openstack-keystone | 09:30 | |
| *** renlt has joined #openstack-keystone | 09:32 | |
| *** david-lyle has quit IRC | 09:35 | |
| *** gokrokve has joined #openstack-keystone | 09:37 | |
| *** david-lyle has joined #openstack-keystone | 09:38 | |
| *** gokrokve has quit IRC | 09:38 | |
| *** gokrokve has joined #openstack-keystone | 09:39 | |
| *** david-lyle has quit IRC | 09:43 | |
| *** gokrokve has quit IRC | 09:43 | |
| *** alex_xu has quit IRC | 09:45 | |
| *** amcrn has quit IRC | 09:47 | |
| *** andreaf has joined #openstack-keystone | 09:47 | |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystone: Rename bash8 requirement https://review.openstack.org/113828 | 09:55 |
| *** bvandenh has quit IRC | 10:00 | |
| *** med_ has quit IRC | 10:00 | |
| *** gyee has quit IRC | 10:00 | |
| *** nonameentername has quit IRC | 10:00 | |
| *** bvandenh has joined #openstack-keystone | 10:07 | |
| *** med_ has joined #openstack-keystone | 10:07 | |
| *** gyee has joined #openstack-keystone | 10:07 | |
| *** nonameentername has joined #openstack-keystone | 10:07 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 10:10 |
| openstackgerrit | Andreas Jaeger proposed a change to openstack/keystone: Rename bash8 requirement https://review.openstack.org/113828 | 10:17 |
| *** bvandenh has quit IRC | 10:23 | |
| *** med_ has quit IRC | 10:23 | |
| *** gyee has quit IRC | 10:23 | |
| *** nonameentername has quit IRC | 10:23 | |
| openstackgerrit | Sergey Lukjanov proposed a change to openstack/keystone: Remove trailing space in tox.ini https://review.openstack.org/113837 | 10:26 |
| *** bvandenh has joined #openstack-keystone | 10:30 | |
| *** med_ has joined #openstack-keystone | 10:30 | |
| *** gyee has joined #openstack-keystone | 10:30 | |
| *** nonameentername has joined #openstack-keystone | 10:30 | |
| *** abhishekk has quit IRC | 10:31 | |
| *** abhishekk has joined #openstack-keystone | 10:32 | |
| *** gokrokve has joined #openstack-keystone | 10:37 | |
| *** david-lyle has joined #openstack-keystone | 10:39 | |
| *** gokrokve has quit IRC | 10:41 | |
| *** david-lyle has quit IRC | 10:43 | |
| *** henrynash has joined #openstack-keystone | 10:46 | |
| *** henrynash has quit IRC | 10:54 | |
| *** topol has joined #openstack-keystone | 10:55 | |
| *** renlt has quit IRC | 11:01 | |
| *** henrynash has joined #openstack-keystone | 11:02 | |
| *** miqui has joined #openstack-keystone | 11:06 | |
| *** ukalifon1 has quit IRC | 11:12 | |
| *** diegows has joined #openstack-keystone | 11:19 | |
| *** ukalifon has joined #openstack-keystone | 11:26 | |
| *** andreaf_ has joined #openstack-keystone | 11:32 | |
| *** andreaf has quit IRC | 11:34 | |
| *** henrynash has quit IRC | 11:37 | |
| *** gokrokve has joined #openstack-keystone | 11:37 | |
| *** andreaf_ has quit IRC | 11:38 | |
| *** david-lyle has joined #openstack-keystone | 11:40 | |
| *** gokrokve has quit IRC | 11:42 | |
| *** david-lyle has quit IRC | 11:44 | |
| *** ajayaa has quit IRC | 11:48 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Implemented caching in identity layer. https://review.openstack.org/110575 | 11:52 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Fix handling of deprecated opts in CLI https://review.openstack.org/113859 | 12:00 |
| *** jamielennox is now known as jamielennox|away | 12:02 | |
| *** ajayaa has joined #openstack-keystone | 12:05 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Implemented caching in trust layer. https://review.openstack.org/113277 | 12:08 |
| *** boris-42 has quit IRC | 12:21 | |
| *** chandankumar has quit IRC | 12:32 | |
| *** bknudson1 has quit IRC | 12:32 | |
| *** cjellick has joined #openstack-keystone | 12:32 | |
| *** boris-42 has joined #openstack-keystone | 12:32 | |
| *** chandankumar has joined #openstack-keystone | 12:33 | |
| *** gokrokve has joined #openstack-keystone | 12:37 | |
| *** david-lyle has joined #openstack-keystone | 12:40 | |
| *** gokrokve has quit IRC | 12:41 | |
| *** david-lyle has quit IRC | 12:45 | |
| *** bknudson has joined #openstack-keystone | 12:52 | |
| *** radez_g0n3 is now known as radez | 12:54 | |
| *** henrynash has joined #openstack-keystone | 13:03 | |
| *** topol has quit IRC | 13:04 | |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Implemented caching in policy layer. https://review.openstack.org/113236 | 13:05 |
| *** ajayaa has quit IRC | 13:07 | |
| *** gordc has joined #openstack-keystone | 13:10 | |
| *** nkinder has quit IRC | 13:11 | |
| *** andreaf has joined #openstack-keystone | 13:14 | |
| *** henrynash has quit IRC | 13:17 | |
| *** ajayaa has joined #openstack-keystone | 13:20 | |
| *** stevemar has joined #openstack-keystone | 13:24 | |
| *** andreaf_ has joined #openstack-keystone | 13:25 | |
| marekd | dolphm: What is more preferable in k2k token to saml exchange? another endpoint, say /v3/OS-FEDERATION/saml or sending a request to /v3/auth/tokens ? | 13:25 |
| dolphm | marekd: definitely a new endpoint because you're not getting back a token (which is what /tokens implies) | 13:27 |
| dolphm | marekd: /v3/auth/OS-FEDERATION/saml2 ? | 13:27 |
| marekd | dolphm: ok | 13:27 |
| *** andreaf has quit IRC | 13:28 | |
| *** rushiagr_away is now known as rushiagr | 13:29 | |
| marekd | i think we will return a json object, where a saml assertion should be an attribute. | 13:29 |
| *** andreaf_ has quit IRC | 13:31 | |
| *** andreaf has joined #openstack-keystone | 13:32 | |
| *** ayoung has joined #openstack-keystone | 13:32 | |
| *** henrynash has joined #openstack-keystone | 13:33 | |
| *** kwss has joined #openstack-keystone | 13:33 | |
| *** zzzeek has joined #openstack-keystone | 13:34 | |
| *** andreaf has quit IRC | 13:34 | |
| *** andreaf has joined #openstack-keystone | 13:35 | |
| *** vhoward has left #openstack-keystone | 13:36 | |
| *** gokrokve has joined #openstack-keystone | 13:37 | |
| *** radez is now known as radez_g0n3 | 13:40 | |
| *** gokrokve has quit IRC | 13:42 | |
| dolphm | marekd: what other attribute do you need to return with the saml doc? | 13:43 |
| raildo | henrynash: I answered your comments about multitenancy hierarchical, if you can check there, I will thank you | 13:43 |
| *** chandankumar has quit IRC | 13:44 | |
| henrynash | raildo: Ok, will do | 13:44 |
| henrynash | raildo: thx | 13:44 |
| dolphm | bknudson: any chance you know if there are *two* oslo config generators? perhaps one in python and in bash? | 13:46 |
| bknudson | dolphm: I think markmc was working on a different sample config generator | 13:46 |
| marekd | dolphm: essentually nothing else. | 13:47 |
| henrynash | raildo: responded….I think you if you make those changes, then I’mm good with the spec | 13:47 |
| dolphm | bknudson: hmm https://github.com/openstack/oslo.config/blob/master/oslo/config/generator.py | 13:48 |
| bknudson | dolphm: y, that's the new one | 13:48 |
| raildo | henrynash: Perfect! :D | 13:48 |
| henrynash | raildo: :-) | 13:49 |
| dolphm | bknudson: that one actually works for me, but produces completely different results | 13:49 |
| marekd | dolphm: we might want to return region id as well, but if not, I will make keystoneclient remember it. | 13:49 |
| bknudson | dolphm: I'd expect it to produce different output... it also has support for other plugins to modify the output | 13:49 |
| dolphm | bknudson: any reason for us not to switch? | 13:50 |
| *** ajayaa has quit IRC | 13:50 | |
| stevemar | marekd, i figured we would just return the saml assertion | 13:51 |
| bknudson | dolphm: I think we should switch. I assume the generator in oslo-incubator is abandoned. | 13:51 |
| stevemar | also, good morning marekd! | 13:51 |
| *** andreaf_ has joined #openstack-keystone | 13:52 | |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/openstack/common/config/generator.py | 13:52 |
| stevemar | henrynash, ping! | 13:52 |
| dolphm | bknudson: cool, thanks | 13:52 |
| henrynash | stevemar: hi | 13:52 |
| bknudson | dolphm: the oslo.config generator just worked without changes? | 13:53 |
| stevemar | henrynash, we need you to voice you opinion on https://review.openstack.org/#/c/113666/ | 13:53 |
| stevemar | henrynash, dolph suggested maybe moving openidconnect support to K | 13:53 |
| bknudson | it's backwards compat? | 13:53 |
| stevemar | i wanted to make sure i wasn't breaking you | 13:54 |
| dolphm | bknudson: seems to, but i'll ping you with a patch in a minute | 13:54 |
| henrynash | stevemar: thx for checking, let me quickly get a read from a couple of my colleagues… | 13:54 |
| *** andreaf has quit IRC | 13:55 | |
| *** nkinder has joined #openstack-keystone | 13:55 | |
| marekd | stevemar: hey ! | 13:55 |
| dolphm | bknudson: new keystone.conf.sample in the mean time, if you're interested http://pasteraw.com/kn1ocrtj9m33ewpe33fldda2we4lvi7 | 13:55 |
| bknudson | `oslo-config-generator --namespace keystone` generated some output for me | 13:56 |
| marekd | stevemar: but prely and xml? | 13:56 |
| marekd | purely | 13:56 |
| *** jasondotstar has joined #openstack-keystone | 13:56 | |
| bknudson | dolphm: looks like we need to add entry points for the oslo libraries that keystone uses. | 13:57 |
| stevemar | marekd, yep, some of the controllers already return XML | 13:57 |
| dolphm | bknudson: that's already done in setup.cfg | 13:57 |
| dolphm | bknudson: unless we're going to have different config for keystone-manage or something | 13:57 |
| *** zzzeek has quit IRC | 13:58 | |
| marekd | stevemar: not very openstacky, but whatevs :-) | 13:59 |
| bknudson | dolphm: missing from http://pasteraw.com/kn1ocrtj9m33ewpe33fldda2we4lvi7 are "Options defined in oslo.messaging" | 13:59 |
| bknudson | for example | 13:59 |
| marekd | stevemar: you prefer to send a region_id in the json request or specify in the URL ? | 14:00 |
| stevemar | marekd, http://docs.openstack.org/api/openstack-identity-service/2.0/content/ ctrl+f XML, all the v2 controllers have xml support :) | 14:00 |
| bknudson | dolphm: when I ran `oslo-config-generator --namespace keystone --namespace oslo.messaging` it also output "From oslo.messaging" | 14:01 |
| dolphm | bknudson: ++ and oslo.db | 14:01 |
| bknudson | I thought we had to add entry points in setup.cfg for those but I guess not. | 14:02 |
| *** andreaf_ has quit IRC | 14:02 | |
| *** andreaf_ has joined #openstack-keystone | 14:02 | |
| stevemar | marekd, i'm not sure, what did you think? dolphm your thoughts (on specifying the region when you want a saml assertion?) | 14:02 |
| *** abhishekk has quit IRC | 14:03 | |
| marekd | if we specify region id keystone will make +1 db lookup :P | 14:03 |
| *** ajayaa has joined #openstack-keystone | 14:03 | |
| marekd | stevemar: ah, it will always make a lookup | 14:03 |
| marekd | i would specify the region in the url. | 14:04 |
| stevemar | hehe, yeah, can't get out of that one | 14:04 |
| marekd | we actually don't want to POST/PUT anything, we only want to get something new. | 14:05 |
| marekd | so GET seems like a logical HTTP method. | 14:05 |
| stevemar | marekd, hmmmm... i guess so | 14:09 |
| *** richm has joined #openstack-keystone | 14:10 | |
| marekd | dolphm: for token -> saml exchange - seems like stevemar agrees that region should be specified in the URL and then we can use HTTP GET instead os POST/PUT and sending the region in the request body. | 14:10 |
| *** Krast has quit IRC | 14:13 | |
| *** radez_g0n3 is now known as radez | 14:13 | |
| *** Krast has joined #openstack-keystone | 14:14 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 14:16 |
| *** openstackgerrit has quit IRC | 14:16 | |
| *** openstackgerrit has joined #openstack-keystone | 14:17 | |
| dolphm | bknudson: ^^ config file appears to be shorter because it's actually wrapping differently | 14:18 |
| dstanek | stevemar: i got side tracked last night because i found getcallargs in oslo | 14:19 |
| stevemar | dstanek, i noticed in the comments, i was hoping it was in oslo | 14:20 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 14:21 |
| dstanek | stevemar: theirs is broken for decorators :-( | 14:21 |
| stevemar | bahhhh | 14:21 |
| dstanek | testing my simple version now | 14:21 |
| bknudson | dolphm: it's missing "Options defined in keystone.notifications" | 14:21 |
| bknudson | "default_publisher_id" | 14:22 |
| bknudson | dolphm: and "backdoor_port" | 14:23 |
| dolphm | bknudson: wtf is backdoor_port? | 14:23 |
| bknudson | dolphm: that's my secret port for hacking into systems. | 14:23 |
| bknudson | dolphm: and the options from keystone.openstack.common.log | 14:24 |
| dolphm | bknudson: are these from more oslo namespaces? | 14:24 |
| bknudson | keystone.openstack.common.policy | 14:24 |
| bknudson | dolphm: no, they're from oslo-incubator | 14:25 |
| bknudson | I assume these are registered on import | 14:25 |
| bknudson | Looks like the new config generator alphabetizes rather than taking them in order. | 14:26 |
| dolphm | bknudson: it does | 14:26 |
| openstackgerrit | henry-nash proposed a change to openstack/identity-api: Extension for endpoint policy association. https://review.openstack.org/112292 | 14:26 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 14:26 |
| dstanek | boo...really? so you can't group related options within a section? | 14:26 |
| morganfainberg | dstanek, isn't the point of a section to group related options? | 14:27 |
| *** gokrokve has joined #openstack-keystone | 14:27 | |
| bknudson | dstanek: They'll be grouped based on the file they're in, too. | 14:27 |
| bknudson | or is it the entry point now? | 14:27 |
| dolphm | dstanek: it seems to sort by group, then by option | 14:28 |
| *** Krast has quit IRC | 14:28 | |
| dstanek | morganfainberg: yes, but some of our sections span multiple pages in my editor | 14:28 |
| *** Krast has joined #openstack-keystone | 14:28 | |
| bknudson | dstanek: but it does separate "admin_workers" and "public_workers", which is not ideal | 14:28 |
| bknudson | maybe we should have separate entry points. | 14:29 |
| dstanek | bknudson: right. i'm sure there are other cases where they are defined together in code because they are somehow related | 14:29 |
| *** Krast has quit IRC | 14:31 | |
| *** Krast has joined #openstack-keystone | 14:31 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Role assignment notifications https://review.openstack.org/113669 | 14:31 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 14:35 |
| *** ajayaa has quit IRC | 14:35 | |
| dolphm | as far as i can tell, no other project is using oslo-config-generator yet, and i have no idea how to include logging options | 14:37 |
| *** kwss has quit IRC | 14:38 | |
| stevemar | dstanek, thanks for adding yourself as co-author, saves me the trouble :D | 14:40 |
| dstanek | stevemar: i figured i'd be deflecting blame if others dislike the inspect based approach | 14:42 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 14:42 |
| raildo | henrynash: I'll wait for someone else to review, if you receive a -1 I will fix this together, ok? | 14:43 |
| raildo | henrynash: Thanks for all your help this time. This was my first spec, I promise that in the next spec I will give you less work. | 14:43 |
| henrynash | raildo: you got hieracjical-projects for your first spec!!! Ouch!!! | 14:43 |
| stevemar | i just realized i forgot to eat breakfast | 14:44 |
| raildo | hahahahaha yes | 14:44 |
| henrynash | raildo: tehy couldn’t find anything harder :-) | 14:44 |
| morganfainberg | stevemar, go eat! | 14:44 |
| morganfainberg | breakfast is important!!!! | 14:44 |
| henrynash | stevemar: go west | 14:45 |
| stevemar | morganfainberg, may as well wait for lunch | 14:45 |
| morganfainberg | stevemar, even if you're only eating a snack @11am it's better to eat breakfast then lunch | 14:45 |
| raildo | henrynash: Well, it's a big change and a big challenge for me and my team but it will come out all right in the end :) | 14:46 |
| henrynash | raildo: I’m sure | 14:46 |
| stevemar | morganfainberg, alllright | 14:46 |
| *** henrynash has quit IRC | 14:48 | |
| *** ajayaa has joined #openstack-keystone | 14:48 | |
| *** gokrokve has quit IRC | 14:50 | |
| *** gokrokve has joined #openstack-keystone | 14:50 | |
| *** samuelmz has joined #openstack-keystone | 14:52 | |
| *** gokrokve has quit IRC | 14:55 | |
| *** ajayaa has quit IRC | 15:01 | |
| *** jorge_munoz has joined #openstack-keystone | 15:04 | |
| stevemar | dolphm, can you use your PTL powers to get attention to this guy: https://review.openstack.org/#/c/113294/ | 15:05 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 15:05 |
| *** amirosh has quit IRC | 15:08 | |
| *** amirosh has joined #openstack-keystone | 15:09 | |
| *** amirosh_ has joined #openstack-keystone | 15:12 | |
| *** amirosh has quit IRC | 15:12 | |
| *** hrybacki has joined #openstack-keystone | 15:20 | |
| *** hrybacki has quit IRC | 15:21 | |
| *** hrybacki has joined #openstack-keystone | 15:21 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove unnecessary declaration of CONF https://review.openstack.org/113930 | 15:23 |
| *** bvandenh has quit IRC | 15:31 | |
| *** jaosorior has quit IRC | 15:32 | |
| ayoung | dagnabit, henrynash, where are you? | 15:37 |
| *** topol has joined #openstack-keystone | 15:37 | |
| ayoung | stevemar, use your -2 | 15:39 |
| ayoung | Oh, wait | 15:39 |
| ayoung | that is not what you want.. | 15:39 |
| ayoung | I'll look at it | 15:39 |
| stevemar | ayoung, hola | 15:39 |
| ayoung | looks clean. | 15:39 |
| stevemar | which patch you talking about? | 15:40 |
| ayoung | the pysaml2 global req | 15:40 |
| stevemar | ah | 15:40 |
| ayoung | stevemar, ok, need to talk something over with someone. | 15:40 |
| stevemar | yeah, but none of us have power there :( | 15:40 |
| ayoung | SHould be henry | 15:40 |
| ayoung | but he's not here, and you are smart | 15:40 |
| ayoung | and this will, I think, affect SAML | 15:40 |
| ayoung | I have a set up where I can use both password and kerberos to get a token for a user in a domain specific backend | 15:41 |
| stevemar | write it out, we can fwd him a copy of the transcript | 15:41 |
| ayoung | password succeeds, kereberos fails | 15:41 |
| ayoung | I think it is due to the password code calling authenticate | 15:41 |
| ayoung | cuz authenticate does this | 15:41 |
| *** amirosh_ has quit IRC | 15:41 | |
| *** gokrokve has joined #openstack-keystone | 15:41 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py#n526 | 15:41 |
| ayoung | seems to me that the logic to do that should not be specific to "authenticate" but should instead happen somewhere between the auth plugin and the rest of the token provider | 15:42 |
| ayoung | Now, I can hack the "external" plugin to support that call | 15:42 |
| ayoung | but every plugin needs to do that logic. | 15:43 |
| stevemar | i'm not sure every plugin calls identity.core.authenticate | 15:43 |
| *** diegows has quit IRC | 15:43 | |
| stevemar | when you authN with kerberos, the users exist in keystone? | 15:44 |
| topol | dolphm, you there | 15:44 |
| topol | or dstanek, you there? | 15:45 |
| ayoung | not every plugin calls authenticate | 15:45 |
| ayoung | that is the problem | 15:45 |
| ayoung | the problem is that the authenticate code currently does the line: | 15:45 |
| ayoung | domain_id, driver, entity_id = ( | 15:45 |
| ayoung | self._get_domain_driver_and_entity_id(user_id)) | 15:45 |
| *** rushiagr is now known as rushiagr_away | 15:46 | |
| ayoung | stevemar, so if the user is, as is my case 'ayoung' in LDAP, that needs to become | 15:46 |
| ayoung | sha256(ayoung:<domainid>) | 15:46 |
| ayoung | stevemar, with kerberso, the users are in LDAP | 15:47 |
| ayoung | I have ldap mounted as an domain specific backend | 15:47 |
| stevemar | ayoung, so, one thing about the identity.core.authenticate, the only thing that should be calling it is the password auth plugin http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/password.py#n128 | 15:48 |
| ayoung | stevemar, exactly | 15:48 |
| stevemar | do you plan on creating a kerberos plugin? | 15:48 |
| ayoung | but the other plugins need to do the same userid transform | 15:48 |
| ayoung | stevemar, I'd like to avoid that | 15:48 |
| ayoung | kerberos should be one of many handled by the mapping approach | 15:49 |
| ayoung | right now I am using the external plauijng but with a "method" of Kerberos | 15:49 |
| *** tomoiaga has quit IRC | 15:49 | |
| ayoung | stevemar, you are going to want https://review.openstack.org/#/c/107873/ | 15:49 |
| ayoung | mapping is the generic plugin, but authentiation is done on the "pre-mapped" userid | 15:50 |
| ayoung | so id a SAML assertion set REMOTE_USER=stevemar the saml/mapping plugin will have to do the sha256 transform | 15:51 |
| stevemar | yeah, i don't get the whole method_name thing | 15:51 |
| dstanek | topol: yup | 15:51 |
| stevemar | why it was there in the first place | 15:51 |
| ayoung | stevemar, one was for MultiFactor: | 15:51 |
| ayoung | but also, I think, it was a nod toward a need for dependency injection without getting it quite right | 15:52 |
| topol | dstanek, can you help me with the following? http://paste.openstack.org/show/94466/ | 15:52 |
| ayoung | stevemar, but we are now using that as part of the client | 15:52 |
| ayoung | 's way of setting up the connection | 15:52 |
| ayoung | client plugins are making use of the method to figure out how to structure the request | 15:53 |
| ayoung | a kerberos request for tokne looks like this: | 15:53 |
| * ayoung WAITS FRO A SLOW SERVER | 15:53 | |
| ayoung | {"auth":{"identity":{"methods":["kerberos"],"kerberos":{}}}} | 15:54 |
| ayoung | since there is no kerberos specific data to send, its a little redundant | 15:54 |
| ayoung | and the ,"kerberos":{} probably should be optional | 15:54 |
| ayoung | but its part of the contract | 15:55 |
| stevemar | i remember trying to make that optional, but it broke things | 15:55 |
| ayoung | yeah. | 15:55 |
| ayoung | but on the client side, if you use the kerberos plugin, its like setting --negotiate on a curl call | 15:55 |
| dolphm | stevemar: set your bp to blocked and escalated | 15:56 |
| dolphm | topol: yesish | 15:56 |
| dstanek | topol: that's trying to make a new venv using tox? | 15:56 |
| topol | dstanek, so bknudson said my virutalenv was backlevel. I just upgraded virtualenv and am hoping that fixes it | 15:57 |
| ayoung | stevemar, so the question is where to put that self._get_domain_driver_and_entity_id(user_id)) call . | 15:57 |
| topol | dstanek but yes | 15:57 |
| dstanek | topol: a couple of people have had to update virtualenv and tox because they were using older versions | 15:58 |
| ayoung | It probably should not have been embedded inside the authenticate call, but rather put into the password plugin | 15:58 |
| ayoung | and the comparable code in the v2 token controller | 15:58 |
| *** henrynash has joined #openstack-keystone | 15:58 | |
| topol | dstanek, ok I just updated virutal env. If that doesnt fix stuff I'll try updating tox | 15:59 |
| stevemar | dolphm, was that a statement or a request? | 16:00 |
| dolphm | stevemar: statement | 16:01 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add notifications for role assignment created and deleted events https://review.openstack.org/112204 | 16:01 |
| stevemar | blocked against what? | 16:01 |
| dolphm | stevemar: the patch to openstack/requirements | 16:01 |
| stevemar | oh | 16:01 |
| *** k4n0 has quit IRC | 16:01 | |
| stevemar | meh, i figure that's procedural | 16:01 |
| stevemar | thanks | 16:01 |
| dolphm | stevemar: yeah, but if that patch doesn't land by next tuesday, it'll be on the cross-project agenda and get a ton of attention | 16:02 |
| topol | dstanek, dolphm, I'm good now. THANKS bknudson!!! | 16:02 |
| dstanek | stevemar: thanks! just saw the red screen of failure | 16:02 |
| stevemar | dstanek, np, i saw it too, easy enough | 16:02 |
| *** gyee_ has joined #openstack-keystone | 16:02 | |
| *** rushiagr_away is now known as rushiagr | 16:03 | |
| ayoung | stevemar, I think the password code actually does the transform http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/password.py#n82 | 16:04 |
| *** henrynash has quit IRC | 16:05 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/password.py#n103 user_ref = self.identity_api.get_user(user_id) | 16:05 |
| stevemar | ayoung, yeah, definitely only the password does it atm | 16:06 |
| ayoung | stevemar, hmmm, but something should call http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py#n557 | 16:06 |
| ayoung | AH! | 16:06 |
| ayoung | Problem is the kerberos is using the default domain | 16:07 |
| ayoung | it wasn't this code at all | 16:07 |
| ayoung | hmmm, so the REALM is going to be YOUNGLOGIC.NET | 16:08 |
| ayoung | I wonder if | 16:08 |
| ayoung | keystone.YOUNGLOGIC.NET.conf is a valid domain config file...lets try this out... | 16:08 |
| gyee_ | stevemar, ayoung, morganfainberg, ran into something interesting while looking at Kristy's generic map plugin | 16:11 |
| ayoung | ? | 16:11 |
| gyee_ | plugin to method used to be a one-to-many relationship | 16:11 |
| gyee_ | meaning I can have something like this | 16:12 |
| gyee_ | methods = a,b,c | 16:12 |
| gyee_ | a = keystone.auth.plugins.SomePlugin | 16:12 |
| gyee_ | b = keystone.auth.plugins.SomePlugin | 16:12 |
| gyee_ | c = keystone.auth.plugins.SamePlugin | 16:12 |
| gyee_ | with morganfainberg's patch sometime ago, we no longer allow this | 16:12 |
| stevemar | a,b and c all point to the same plugin? | 16:12 |
| gyee_ | all plugins must specific a single "method" | 16:13 |
| gyee_ | stevemar, yes | 16:13 |
| gyee_ | that's essentiall for generic map | 16:13 |
| stevemar | what patch was that (morgan's)? | 16:13 |
| gyee_ | where a plugin can serve multiple methods | 16:13 |
| gyee_ | morganfainberg submitted a patch to allow specify the class directly in methods | 16:14 |
| stevemar | gyee, they could just have it: | 16:14 |
| stevemar | a = keystone.auth.plugins.a; b = keystone.auth.plugins.b; c = keystone.auth.plugins.c | 16:14 |
| gyee_ | however, he also restricted to plugin-method as a one to one relationship | 16:14 |
| stevemar | and they all inherit from some base class | 16:14 |
| gyee_ | stevemar, with generic map *plugin*, it should be able to serve multiple methods | 16:15 |
| ayoung | gyee_, I have a patch to fix that | 16:15 |
| gyee_ | ayoung, link? | 16:15 |
| ayoung | coming up | 16:15 |
| ayoung | gyee_, https://review.openstack.org/#/c/107873/ | 16:15 |
| gyee_ | wtf? | 16:15 |
| ayoung | gyee_, it means that you could have kerberos= ....plugins.Mapping | 16:16 |
| gyee_ | dolphm, why the big red cross? we used to allow one-to-many relationship | 16:16 |
| gyee_ | ayoung, exactly | 16:16 |
| ayoung | and also x509= ....plugins.Mapping | 16:16 |
| gyee_ | amen brother! | 16:16 |
| ayoung | nah, the big red X is just to get the docs in line | 16:16 |
| gyee_ | ah, sorry, I thought he doesn't like the idea | 16:17 |
| gyee_ | my bad | 16:17 |
| ayoung | "Patch Set 6: Code-Review-1 Workflow-1 | 16:17 |
| ayoung | so, either the configuration file defines a package path to a plugin and the plugin defines it's own method name... or we pre-register plugins and then map them to a method in conf. supporting two solutions to the same problem is complex/confusing and needs strong documentation to justify both approaches. revise doc/ appropriately." | 16:17 |
| gyee_ | man this new UI is a bit confusing, the big red cross man mean two different things now | 16:18 |
| ayoung | I'll try to update that one later on today | 16:18 |
| * gyee_ needs to get use to it | 16:18 | |
| ayoung | gyee_, yeah and its a WIP if the owner sets Workflow -1 | 16:18 |
| ayoung | which is really what he meant by it | 16:19 |
| ayoung | lets see what the docs say... | 16:19 |
| * ayoung hasn't looked yet | 16:19 | |
| gyee_ | ayoung, I know, I need to relearn how to read :) | 16:19 |
| *** wwriverrat has joined #openstack-keystone | 16:19 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/doc/source/configuration.rst#n207 | 16:19 |
| ayoung | I don't think the alternative ways of specifying the auth plugins are documented] | 16:20 |
| gyee_ | ayoung, yeah, you're right | 16:21 |
| *** wwriverrat1 has joined #openstack-keystone | 16:23 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Do not require method attribute on plugins https://review.openstack.org/107873 | 16:23 |
| ayoung | gyee_, lets see if it passes check. If so, please +2 and comment | 16:24 |
| stevemar | marekd, | 16:24 |
| gyee_ | ayoung, definitely, its blocking the generic map work | 16:24 |
| stevemar | ping | 16:24 |
| ayoung | gyee_, y'all will catch up to me someday | 16:24 |
| *** wwriverrat has quit IRC | 16:24 | |
| gyee_ | heh, u da man | 16:25 |
| ayoung | I'm just a simple caveman | 16:25 |
| *** wwriverrat1 has left #openstack-keystone | 16:27 | |
| *** wwriverrat1 has joined #openstack-keystone | 16:28 | |
| *** rm_work has quit IRC | 16:29 | |
| *** rm_work has joined #openstack-keystone | 16:30 | |
| *** henrynash has joined #openstack-keystone | 16:30 | |
| *** rm_work has quit IRC | 16:34 | |
| *** rm_work has joined #openstack-keystone | 16:35 | |
| *** rm_work has quit IRC | 16:35 | |
| *** rm_work has joined #openstack-keystone | 16:35 | |
| *** andreaf_ has quit IRC | 16:36 | |
| *** fifieldt has quit IRC | 16:37 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 16:39 |
| *** rm_work has quit IRC | 16:41 | |
| *** rm_work has joined #openstack-keystone | 16:42 | |
| *** rm_work has quit IRC | 16:42 | |
| *** rm_work has joined #openstack-keystone | 16:42 | |
| *** afazekas has quit IRC | 16:42 | |
| *** fifieldt has joined #openstack-keystone | 16:44 | |
| *** rm_work has quit IRC | 16:47 | |
| *** amerine has joined #openstack-keystone | 16:47 | |
| *** rm_work has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 16:48 |
| *** spandhe_ has joined #openstack-keystone | 16:52 | |
| *** rm_work has quit IRC | 16:52 | |
| *** rm_work has joined #openstack-keystone | 16:53 | |
| *** rm_work has quit IRC | 16:53 | |
| *** rm_work has joined #openstack-keystone | 16:53 | |
| *** gyee_ has quit IRC | 16:53 | |
| *** hrybacki has quit IRC | 16:57 | |
| *** amirosh has joined #openstack-keystone | 16:58 | |
| *** rm_work has quit IRC | 16:58 | |
| *** rm_work has joined #openstack-keystone | 16:58 | |
| *** rm_work has quit IRC | 16:58 | |
| *** rm_work has joined #openstack-keystone | 16:58 | |
| *** rm_work has quit IRC | 17:03 | |
| *** rm_work has joined #openstack-keystone | 17:04 | |
| *** rm_work has quit IRC | 17:04 | |
| *** rm_work has joined #openstack-keystone | 17:04 | |
| *** rm_work has quit IRC | 17:08 | |
| *** arborism has joined #openstack-keystone | 17:09 | |
| *** arborism is now known as amcrn | 17:09 | |
| *** rm_work has joined #openstack-keystone | 17:10 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 17:10 |
| *** zzzeek has joined #openstack-keystone | 17:11 | |
| *** rm_work has quit IRC | 17:15 | |
| *** diegows has joined #openstack-keystone | 17:16 | |
| *** rm_work has joined #openstack-keystone | 17:19 | |
| *** rm_work has quit IRC | 17:19 | |
| *** rm_work has joined #openstack-keystone | 17:19 | |
| *** henrynash has quit IRC | 17:21 | |
| *** rm_work has quit IRC | 17:26 | |
| *** rm_work has joined #openstack-keystone | 17:27 | |
| *** amcrn has quit IRC | 17:29 | |
| *** rm_work has quit IRC | 17:32 | |
| *** rm_work has joined #openstack-keystone | 17:32 | |
| *** abhishekk has joined #openstack-keystone | 17:35 | |
| *** abhishekk has left #openstack-keystone | 17:35 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 17:37 |
| *** dguitarbite has joined #openstack-keystone | 17:37 | |
| bknudson | dolphm: includes some more of the options ^ | 17:37 |
| *** rm_work has quit IRC | 17:37 | |
| *** rm_work has joined #openstack-keystone | 17:38 | |
| *** rm_work has quit IRC | 17:38 | |
| *** rm_work has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 17:43 |
| *** rm_work has quit IRC | 17:43 | |
| *** rm_work has joined #openstack-keystone | 17:44 | |
| *** rm_work has quit IRC | 17:44 | |
| *** rm_work has joined #openstack-keystone | 17:44 | |
| dguitarbite | hello | 17:45 |
| dguitarbite | I have a weird question | 17:45 |
| dguitarbite | about nova endpoints | 17:45 |
| dguitarbite | can someone answer them? | 17:45 |
| dguitarbite | *it | 17:45 |
| *** rm_work has quit IRC | 17:49 | |
| *** rm_work has joined #openstack-keystone | 17:49 | |
| *** rm_work has quit IRC | 17:50 | |
| *** rm_work has joined #openstack-keystone | 17:50 | |
| *** radez is now known as radez_g0n3 | 17:51 | |
| ayoung | dguitarbite, Fire away. No promises on the quality of the answer | 17:52 |
| *** amcrn has joined #openstack-keystone | 17:53 | |
| *** rm_work has quit IRC | 17:54 | |
| dguitarbite | why does nova endpoints require "tenant_id" in the URL? | 17:54 |
| dguitarbite | --publicurl=http://controller:8774/v2/%\(tenant_id\)s \ | 17:54 |
| ayoung | dguitarbite, because someone at some point made a bad decision about scoping | 17:54 |
| *** portante has quit IRC | 17:55 | |
| ayoung | dguitarbite, it really shouldn't be, but the nova client, and all of the code is written assuming it gets the url that way | 17:55 |
| *** radez_g0n3 is now known as radez | 17:56 | |
| dguitarbite | ayoung: it pains me | 17:58 |
| ayoung | dguitarbite, you knowthat /v2 part before it. That is dumb, too | 17:58 |
| dguitarbite | *it pains to see the inconsistencies in the code | 17:58 |
| dguitarbite | I know :) | 17:58 |
| dguitarbite | Im with you in this | 17:58 |
| ayoung | and that is keeping people on older versions of the apis | 17:59 |
| dguitarbite | and if I try to fix it and put a patch they will say its not required | 17:59 |
| dguitarbite | we dont have the required time for this level of patching | 17:59 |
| dguitarbite | even the "db sync" and "db_sync" issue | 17:59 |
| amirosh | hi guys, could somebody review https://review.openstack.org/#/c/111200/ (updated Aug 5 - it feels so lonely)? | 18:01 |
| *** portante has joined #openstack-keystone | 18:02 | |
| *** CaioBrentano has joined #openstack-keystone | 18:04 | |
| ayoung | amirosh, looking | 18:05 |
| *** rm_work has joined #openstack-keystone | 18:05 | |
| *** rm_work has quit IRC | 18:05 | |
| *** rm_work has joined #openstack-keystone | 18:05 | |
| amirosh | ayoung: thanks! | 18:05 |
| dguitarbite | ayoung: thanks :) | 18:05 |
| ayoung | amirosh, +2 | 18:06 |
| amirosh | ayoung: awesome! I have 2 more in the queue:) | 18:08 |
| CaioBrentano | does anybody ever had any "CRITICAL IOError" with eventlet_server on a keystone-all process? | 18:08 |
| *** rm_work has quit IRC | 18:11 | |
| *** rm_work has joined #openstack-keystone | 18:12 | |
| *** rm_work has quit IRC | 18:16 | |
| *** rm_work has joined #openstack-keystone | 18:16 | |
| *** amirosh has quit IRC | 18:19 | |
| *** amirosh has joined #openstack-keystone | 18:19 | |
| *** jasond` has joined #openstack-keystone | 18:23 | |
| *** amirosh has quit IRC | 18:24 | |
| *** ayoung has quit IRC | 18:26 | |
| *** rm_work has quit IRC | 18:29 | |
| *** rm_work has joined #openstack-keystone | 18:29 | |
| *** rm_work has quit IRC | 18:33 | |
| *** rm_work has joined #openstack-keystone | 18:33 | |
| *** miqui_ has joined #openstack-keystone | 18:34 | |
| *** ukalifon has quit IRC | 18:37 | |
| *** raildo has quit IRC | 18:40 | |
| *** portante_ has joined #openstack-keystone | 18:40 | |
| *** portante has quit IRC | 18:41 | |
| *** openstackgerrit has quit IRC | 18:41 | |
| *** miqui has quit IRC | 18:41 | |
| *** openstackgerrit has joined #openstack-keystone | 18:49 | |
| *** diegows has quit IRC | 18:52 | |
| *** rushiagr is now known as rushiagr_away | 18:56 | |
| dolphm | CaioBrentano: are you hacking on keystone, or deploying it? | 18:59 |
| morganfainberg | dolphm, sanity check, are we *really* at 4007 tests? | 19:00 |
| CaioBrentano | deploying it… I have 2 servers running keystone, and one instance suddenly stopped | 19:00 |
| CaioBrentano | and I got a IOError on the logs | 19:01 |
| CaioBrentano | related with "keystone/common/environment/eventlet_server.py" | 19:02 |
| bknudson | morganfainberg: skips=1092 | 19:03 |
| morganfainberg | bknudson, yep. thats what i have | 19:03 |
| bknudson | so we skip 25% of the tests... | 19:03 |
| morganfainberg | bknudson, yeah a lot of skips in ldap backend | 19:03 |
| morganfainberg | bknudson, we should *fix* that and stop skipping and verify we get the response (exception) we should get. | 19:03 |
| bknudson | it might turn out that some of them actually work | 19:04 |
| *** henrynash has joined #openstack-keystone | 19:05 | |
| morganfainberg | bknudson, hehe | 19:05 |
| dolphm | ooh, detailed jenkins votes at the top now | 19:06 |
| morganfainberg | bknudson, iirc you ran across this: if we validate a v3 token via v2 interface, the issued_at time changes. | 19:06 |
| dolphm | morganfainberg: that includes the copy/pasted ones | 19:06 |
| morganfainberg | bknudson, was that *not* really fixable. | 19:06 |
| bknudson | morganfainberg: y, it should be fixed | 19:06 |
| dolphm | CaioBrentano: can you open a bug report with the full traceback and whatever led to the behavior? | 19:07 |
| morganfainberg | bknudson, huh. i just pulled master still seeing: 'issued_at': timeutils.strtime() | 19:07 |
| morganfainberg | in format_data | 19:07 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/111772/ | 19:07 |
| morganfainberg | erm format_token | 19:07 |
| morganfainberg | ah the inverse is also true | 19:08 |
| morganfainberg | converting a v3 token to v2 changes issued_at | 19:08 |
| bknudson | morganfainberg: ah.. I didn't look into that | 19:08 |
| morganfainberg | bknudson, you fixed v2 to v3 | 19:08 |
| morganfainberg | bknudson, no worries, i'll fix it while i'm in here. | 19:08 |
| henrynash | morganfainberg: let me know if added eoungh to https://review.openstack.org/#/c/99842/ for you to +2 (see lines 57-64) | 19:08 |
| bknudson | morganfainberg: it was a security vulnerability... since it cause revocation events to not work | 19:09 |
| morganfainberg | bknudson, i'll split it out into it's own patch and tag it as related | 19:09 |
| morganfainberg | to the bug you had | 19:09 |
| morganfainberg | or should i open a new bug? | 19:09 |
| bknudson | morganfainberg: I'd open a new bug since that one's closed | 19:09 |
| morganfainberg | bknudson, ++ will do shortly | 19:09 |
| morganfainberg | henrynash, looks good to me | 19:10 |
| morganfainberg | henrynash, just so we have a target to hit and people can't complain that we don't re-fetch the policy etc | 19:10 |
| henrynash | morganfainberg: agreed, thx | 19:11 |
| morganfainberg | henrynash, +2 | 19:11 |
| henrynash | morganfainberg: ta | 19:12 |
| morganfainberg | dolphm, ooooh i see what you mean by the scoring by jenkins. sweeeeeeet | 19:12 |
| *** amirosh has joined #openstack-keystone | 19:13 | |
| henrynash | stevemar: any chance you could check out: https://review.openstack.org/#/c/99842/ | 19:23 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 19:23 |
| stevemar | henrynash, you betcha | 19:24 |
| stevemar | henrynash, perfect reading material for my coffee break! | 19:24 |
| henrynash | stevemar: ha! | 19:25 |
| henrynash | stevemar: fyi, your view.openstack.org/#/c/106935/ is on its way… | 19:25 |
| *** vhoward has joined #openstack-keystone | 19:25 | |
| henrynash | (https://review.openstack.org/#/c/106935/) | 19:26 |
| *** med_ has quit IRC | 19:26 | |
| stevemar | hooray! | 19:27 |
| stevemar | thanks for keeping me honest on the tests | 19:28 |
| *** radez is now known as radez_g0n3 | 19:30 | |
| *** portante_ is now known as portante | 19:34 | |
| henrynash | stevemar: yw | 19:38 |
| *** amirosh has quit IRC | 19:50 | |
| *** andreaf_ has joined #openstack-keystone | 19:53 | |
| *** andreaf_ is now known as andreaf | 19:53 | |
| *** elmiko has joined #openstack-keystone | 19:55 | |
| *** henrynash has quit IRC | 19:56 | |
| elmiko | hey folks, i'm trying to do some experiments with creating a domain and adding users to that domain. so far so good, but i find that keystoneclient won't create clients for the users unless i give the user id, username doesn't work even when the client is scoped to the domain. is this normal behavior? | 19:56 |
| elmiko | fwiw, these are roleless, projectless, domains | 19:57 |
| *** andreaf has quit IRC | 19:57 | |
| *** andreaf has joined #openstack-keystone | 20:01 | |
| *** amcrn has quit IRC | 20:05 | |
| wwriverrat1 | back | 20:05 |
| *** henrynash has joined #openstack-keystone | 20:05 | |
| *** zzzeek_ has joined #openstack-keystone | 20:06 | |
| *** zzzeek has quit IRC | 20:06 | |
| *** zzzeek_ is now known as zzzeek | 20:06 | |
| *** ayoung has joined #openstack-keystone | 20:15 | |
| stevemar | henrynash, have you got any identity-api spec drafted for endpoint policy? | 20:17 |
| *** jasond` has left #openstack-keystone | 20:18 | |
| henrynash | stevenar: yep: https://review.openstack.org/#/c/112292/ | 20:18 |
| marekd | stevemar: pong. | 20:20 |
| stevemar | marekd, hola | 20:20 |
| stevemar | henrynash, ty | 20:21 |
| stevemar | i'm having trouble putting the endpoint->policy stuff all together | 20:21 |
| marekd | stevemar: what's up. I see you want POST for trading token for saml assertion... | 20:22 |
| stevemar | marekd, yes, i put this up | 20:22 |
| stevemar | https://review.openstack.org/#/c/113998/1/v3/src/markdown/identity-api-v3-os-federation-ext.md | 20:22 |
| marekd | why post not get? to follow authn methods? | 20:22 |
| *** RockKuo_Home has joined #openstack-keystone | 20:23 | |
| *** Kuo_ has quit IRC | 20:26 | |
| *** topol has quit IRC | 20:26 | |
| dolphm | marekd: i'd expect to get the same response back for subsequent GET requests - would that be the case? | 20:29 |
| marekd | dolphm: that response would be a saml assertion? | 20:30 |
| marekd | dolphm: plus I think stevemar proposed returning pure saml assertion, not wrapped with any json structure. | 20:31 |
| dolphm | marekd:always the same assertion | 20:31 |
| dolphm | marekd: stevemar: you'd also have to do GET /v3/auth/OS-FEDERATION/saml2?region_id={region_id} + scoped X-Auth-Token | 20:31 |
| dolphm | and the query string would be required, so 400 without it? that's odd | 20:31 |
| stevemar | dolphm, ohhh i like that | 20:31 |
| stevemar | that is a bit odd | 20:32 |
| stevemar | henrynash, so it's still kinda RBACish? | 20:32 |
| dolphm | GET /v3/regions/{region_id}/OS-FEDERATION/saml2 + scoped X-Auth-Token? lol | 20:32 |
| henrynash | stevemar: yes, the idea is just so that you can specify your RBAC rules by endpoint (or group of endpoints) | 20:33 |
| marekd | dolphm: ok ok, i get it :P | 20:34 |
| stevemar | henrynash, oh, rather than one that applies to all of keystone | 20:34 |
| stevemar | henrynash, why didn't you say that! | 20:34 |
| marekd | dolphm: so for POST /v3/auth/OS-FEDERATION/saml2 do you expect to send json like we send for /auth/tokens? | 20:34 |
| henrynash | stevemar: well, today we allow a service to store its policy in keystone and then its endpoints would retrieve it by Policy ID | 20:35 |
| stevemar | henrynash, comparatively, this now allows you set one for each endpoint | 20:36 |
| henrynash | steevmar: this allows a cloud provider to allow the endpint ID, or its poisiton in region hierachy to get a more specific policy | 20:37 |
| henrynash | stevemar: you could, although I suspect the example in the spec is more likely….I want all the nova endpoints in the production region to have this speciiic polciy… | 20:38 |
| henrynash | stevemar: and those in the test region to ahve this different one | 20:38 |
| dolphm | marekd: some subset of it, yes | 20:38 |
| *** wwriverrat1 has left #openstack-keystone | 20:38 | |
| *** hrybacki has joined #openstack-keystone | 20:39 | |
| stevemar | marekd, dolphm i'm gone in a few, but if you guys update the etherpad, i'll have a new patch ready for tomorrow morning | 20:41 |
| marekd | stevemar: sure. | 20:43 |
| * marekd even stevemar sometimes rests | 20:43 | |
| *** stevemar has quit IRC | 20:47 | |
| ayoung | gyee, https://review.openstack.org/#/c/107873/ | 20:49 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Endpoint policy extension https://review.openstack.org/99842 | 20:51 |
| henrynash | stevemar: fixed those 4 nits | 20:52 |
| *** hrybacki has quit IRC | 20:54 | |
| *** rm_work has quit IRC | 20:57 | |
| *** rm_work has joined #openstack-keystone | 20:57 | |
| *** rm_work has quit IRC | 20:58 | |
| *** rm_work has joined #openstack-keystone | 20:58 | |
| gyee | ayoung, thanks, lgtm | 21:01 |
| *** rm_work has quit IRC | 21:01 | |
| openstackgerrit | A change was merged to openstack/keystone: Filter List Regions by 'parent_region_id' https://review.openstack.org/111200 | 21:03 |
| openstackgerrit | A change was merged to openstack/keystone: Add a URL field to region table https://review.openstack.org/106935 | 21:03 |
| *** hrybacki has joined #openstack-keystone | 21:03 | |
| *** rm_work has joined #openstack-keystone | 21:04 | |
| *** rm_work has quit IRC | 21:04 | |
| *** rm_work has joined #openstack-keystone | 21:04 | |
| elmiko | ayoung: question about roleless domains and whatnot, i've been working on implementing some of the stuff we talked about earlier, but i'm having an issue creting Client objects from usernames. it works if i use user id's but not names, thoughts? | 21:04 |
| ayoung | elmiko, Client objects? you mean keystoneclient? | 21:04 |
| elmiko | yea | 21:05 |
| elmiko | keystoneclient.v3.Client | 21:05 |
| *** miqui_ is now known as miqui | 21:06 | |
| *** cjellick_ has joined #openstack-keystone | 21:06 | |
| henrynash | stevemar, morganfainberg: when you have a moment, could you guys re-apply +2s (and maybe even a +A !) for https://review.openstack.org/#/c/99842/ - only change from last vesion is fixing 4 nits commented by stevemar | 21:07 |
| *** rm_work has quit IRC | 21:07 | |
| *** rm_work has joined #openstack-keystone | 21:07 | |
| *** rm_work has quit IRC | 21:07 | |
| *** rm_work has joined #openstack-keystone | 21:07 | |
| *** cjellick has quit IRC | 21:09 | |
| *** cjellick_ has quit IRC | 21:11 | |
| *** afaranha has quit IRC | 21:12 | |
| *** samuelmz has quit IRC | 21:12 | |
| *** rushiagr_away has quit IRC | 21:12 | |
| *** fifieldt has quit IRC | 21:13 | |
| *** afaranha has joined #openstack-keystone | 21:13 | |
| *** fifieldt has joined #openstack-keystone | 21:13 | |
| *** henrynash has quit IRC | 21:14 | |
| *** rm_work has quit IRC | 21:14 | |
| *** samuelmz has joined #openstack-keystone | 21:14 | |
| *** rushiagr_away has joined #openstack-keystone | 21:15 | |
| *** amcrn has joined #openstack-keystone | 21:16 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 21:18 |
| *** rm_work has joined #openstack-keystone | 21:18 | |
| *** rm_work has quit IRC | 21:19 | |
| *** rm_work has joined #openstack-keystone | 21:19 | |
| ayoung | elmiko, do you pass the domain in when creating the client? | 21:19 |
| elmiko | ayoung: i tried that, and it didn't like the username | 21:19 |
| ayoung | elmiko, let me give it a try | 21:20 |
| elmiko | ayoung: but it did work with user id, i'm gonna put together a pastebin to make things clearer | 21:20 |
| ayoung | elmiko, yes, please | 21:20 |
| elmiko | ayoung: might take me a few minutes, formatting got all screwed up | 21:20 |
| *** jasondotstar has quit IRC | 21:26 | |
| elmiko | ayoung: ok, setup for this is that i used the rest api to create a domain named "sahara_proxy_domain", added a user "sahara_proxy_user" with pw "openstack", i got the domain id from the keystone cli tool. https://gist.github.com/elmiko/903fda01adef71e09155 | 21:33 |
| *** rm_work has quit IRC | 21:33 | |
| ayoung | elmiko, let me try it with a setup I have here | 21:33 |
| *** rm_work has joined #openstack-keystone | 21:33 | |
| morganfainberg | bknudson, ayoung, so i think i need to make revocation events sql us a varchar for the expiration. | 21:34 |
| elmiko | ayoung: cool, thanks | 21:34 |
| morganfainberg | bknudson, ayoung, and issues/thoughts with doing that? | 21:34 |
| ayoung | morganfainberg, why can't we use the extra data | 21:35 |
| bknudson | morganfainberg: not that I can think of. I considered it as an option at one point. | 21:35 |
| bknudson | morganfainberg: or it could be an integer | 21:35 |
| morganfainberg | ayoung, this is in the revocation event itself | 21:35 |
| *** rm_work has quit IRC | 21:35 | |
| bknudson | morganfainberg: also, could consider storing both the timestamp and the string / integer | 21:36 |
| ayoung | crud | 21:36 |
| *** rm_work has joined #openstack-keystone | 21:36 | |
| * ayoung stifles a MySQL rant. | 21:36 | |
| *** CaioBrentano has left #openstack-keystone | 21:37 | |
| bknudson | morganfainberg: oh, you wouldn't have to store the timestamp string in the event. | 21:37 |
| ayoung | bknudson, morganfainberg what about storing just the chopped portion as an integer | 21:37 |
| morganfainberg | ayoung, no | 21:38 |
| bknudson | ayoung: I think he's saying chopping doesn't work | 21:38 |
| morganfainberg | ayoung, once it hits mysql it trims microseconds | 21:38 |
| bknudson | the 1s granularity is inadequate | 21:38 |
| morganfainberg | but we don't know that has occured until it's stored | 21:38 |
| bknudson | but apparently 1ms granularity is ok | 21:38 |
| ayoung | morganfainberg, right, so we store microseconds in their own field, and then recompose | 21:38 |
| ayoung | expires_at_microsecons #this field exists becuz mysql chops microsecs | 21:39 |
| morganfainberg | ayoung, that kinda makes me cringe | 21:39 |
| ayoung | morganfainberg, it makes the workaround specific to mysql | 21:39 |
| morganfainberg | ayoung, i'd rather just store isotime, it's less effort to compare at the sql level that way. | 21:39 |
| morganfainberg | ayoung, right but now i need to *check* both columns to see if something is actually expired. | 21:40 |
| openstackgerrit | A change was merged to openstack/keystone: Remove _BaseFederationExtension https://review.openstack.org/113136 | 21:40 |
| ayoung | morganfainberg, I want to keep the "get all from a particular point" as a Database query | 21:40 |
| ayoung | the revocation event itself can then compose the time from the two fields | 21:40 |
| ayoung | and the check uses the value out of the model | 21:40 |
| morganfainberg | ayoung, revocation event expires at is *not* "revoked_at" | 21:41 |
| ayoung | the "compose" would only be done on databases that require it....IE migh sequel | 21:41 |
| morganfainberg | ayoung, "expires_at" is from the token data | 21:41 |
| bknudson | I didn't think of the "get all from a particular point" query... that would miss events since mysql chops the timestamp. | 21:41 |
| ayoung | ah, try, we don';t qure on that, do we | 21:41 |
| morganfainberg | ayoung, yeah :P different column... maybe we should call that "token_expires_at" :P | 21:42 |
| ayoung | heh | 21:42 |
| ayoung | you won't make this Adam proof. Adam will still find ways to confuse things | 21:42 |
| ayoung | OK, varchar should be fine | 21:42 |
| morganfainberg | ayoung, i'll make the migration and i'll *rename* the column to token_expires_at for clarity | 21:42 |
| ayoung | um, no | 21:43 |
| ayoung | don't rename the column | 21:43 |
| morganfainberg | why not? | 21:43 |
| ayoung | that will have 2nd order effects through the code | 21:43 |
| bknudson | y, that's going to be confusing | 21:43 |
| bknudson | if the col is token_expires_at and the model is expires_at that will be confusing | 21:43 |
| morganfainberg | bknudson, no i was going to rename both. | 21:44 |
| ayoung | yeah, and the confusion was not over what was expiring, it was over which we were querying on | 21:44 |
| bknudson | morganfainberg: that's not backwards compatible | 21:44 |
| morganfainberg | bknudson, by column rename i meant "fix the model and make the column match" | 21:44 |
| morganfainberg | bknudson, it isn't? | 21:44 |
| ayoung | morganfainberg, nah, just change the datatype, please. | 21:44 |
| bknudson | morganfainberg: I assume these wind up in the response for fetching the revocation list? | 21:45 |
| morganfainberg | bknudson, only the events that nothing consumes yet. | 21:45 |
| morganfainberg | bknudson, but whatever, doesn't bug me - i just will point out I'll say "i told you so" if this convo comes up again :) | 21:45 |
| ayoung | morganfainberg, all of the fields refer to the token. Putting that in there is redundant | 21:46 |
| morganfainberg | ayoung, except "revoked_at" :P | 21:46 |
| ayoung | token_revoked_at | 21:46 |
| ayoung | even that | 21:46 |
| ayoung | its just not afield On the token | 21:46 |
| morganfainberg | no it's when the *event* occured. | 21:46 |
| morganfainberg | ayoung, it's not relevant to the token | 21:46 |
| bknudson | morganfainberg: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-revoke-ext.md | 21:47 |
| bknudson | you'd have to change the spec | 21:47 |
| ayoung | it absolutely is. It means that if a token was used before that time it was valid. | 21:47 |
| morganfainberg | ayoung, i thought we were going to make revocation events pkey auto_inc ints | 21:47 |
| ayoung | morganfainberg, its an open request | 21:47 |
| ayoung | I haven't implemented it yet. | 21:47 |
| morganfainberg | ayoung, ah haven't gotten there yet, ok. | 21:48 |
| ayoung | So much other churn on events | 21:48 |
| marekd | dolphm: hm, something like this? http://pasteraw.com/2ze1c6tb5bewttdig9jpac9p4xszncd . | 21:48 |
| marekd | dolphm: we can pass roles only but some other values could also be useful (like expiration date) | 21:49 |
| *** hrybacki has quit IRC | 21:52 | |
| *** marekd is now known as marekd|away | 22:00 | |
| bknudson | morganfainberg: were you also going to backport the migration to icehouse? | 22:00 |
| morganfainberg | bknudson, i could | 22:00 |
| morganfainberg | bknudson, hadn't gotten that far yet | 22:00 |
| bknudson | I think you'll need to | 22:01 |
| *** nkinder has quit IRC | 22:05 | |
| elmiko | ayoung: i figured it out, i was using domain_id instead of user_domain_id | 22:08 |
| ayoung | ++ | 22:08 |
| elmiko | ayoung: a question that came up during review of my updated spec was, is there any concern with sahara creating perhaps 100s of users in this proxy domain? | 22:10 |
| ayoung | elmiko, I don't think so | 22:10 |
| elmiko | ayoung: that's what i thought, but due dilligence :) | 22:11 |
| ayoung | elmiko, list users might be a problem. I'm not certain, but that call might be domain agnostic. | 22:12 |
| ayoung | that is something we could fix. | 22:12 |
| ayoung | I think that the v2 call will only list users in the default domain...and v3 requires a domain, I think | 22:12 |
| elmiko | ayoung: ok, we probably won't need to list the users, but good to know. | 22:13 |
| elmiko | ideally, we will create them, hand them off to the cluster, then delete them when a job is complete | 22:13 |
| ayoung | morganfainberg, what happens with list users if no domain is specified? | 22:13 |
| morganfainberg | ayoung, uhm. i think you get told to fly a kite | 22:13 |
| elmiko | lol | 22:14 |
| ayoung | elmiko, try it out, would you? | 22:14 |
| elmiko | sure | 22:14 |
| ayoung | I can look at the code, too | 22:14 |
| morganfainberg | bknudson, sure. easy enough | 22:14 |
| ayoung | yeah, v2 is deafult domain http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n47 | 22:15 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/controllers.py#n218 looks like it select the scope from self._get_domain_id_for_list_request | 22:15 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n559 | 22:16 |
| elmiko | ayoung: i'm not seeing them show up through the cli tool | 22:16 |
| ayoung | so you will have domain specific drivers... | 22:16 |
| ayoung | other wise, it looks like it grabs the users domain id | 22:17 |
| ayoung | from the token | 22:17 |
| ayoung | elmiko, you should be good | 22:17 |
| elmiko | ayoung: k, cool. i tried this workflow all the way through to accessing swift with a trust scoped token from the proxy user and it worked. we're just trying to understand the ask we are making on operators to make the domain specific driver change. | 22:18 |
| elmiko | ayoung: or in a best case scenario, having operators specify a domain that sahara can use as a proxy. | 22:19 |
| ayoung | elmiko, I have a proof of concept of the LDAP as a domain working | 22:19 |
| elmiko | ayoung: is that different than the blog post you shared the other day? | 22:19 |
| ayoung | it might take a little reworking if you wanted LDAP as the default domain, but I think we could make that work, to | 22:19 |
| ayoung | elmiko, not really | 22:20 |
| elmiko | i inferred from your post that if an op wanted to they could create a domain specific driver for the sql backed domain as well | 22:20 |
| ayoung | elmiko, I have not idea how that would work | 22:20 |
| elmiko | oh.. maybe my inferrence went too far lol | 22:20 |
| *** rwsu has quit IRC | 22:21 | |
| ayoung | the domain table is in the assignment backend. It might work, but I'm not willing to swear on it | 22:21 |
| elmiko | ayoung: gotcha | 22:22 |
| *** henrynash has joined #openstack-keystone | 22:22 | |
| elmiko | so many backends... | 22:22 |
| * elmiko head spins | 22:22 | |
| ayoung | elmiko, I think it would work like this | 22:22 |
| ayoung | the main identity backend would be SQL | 22:22 |
| ayoung | you would set up domain specific backends, and create a file domains/keystone.default.conf and make sure that the domain-id for that one was set in the keystone.conf file as the default domain id | 22:23 |
| *** joesavak has joined #openstack-keystone | 22:24 | |
| ayoung | services would be required to use V3 for the service users | 22:24 |
| *** jorge_munoz has quit IRC | 22:25 | |
| elmiko | is keystone recommending using domain specific confs from juno and beyond? | 22:26 |
| ayoung | morganfainberg, can you please bless https://review.openstack.org/#/c/107873/ as it is needed for the mapping stuff | 22:26 |
| ayoung | elmiko, I think so. Certainly for the AD use cases it makes sense | 22:26 |
| * ayoung has to disappear into family time now | 22:27 | |
| elmiko | take care | 22:27 |
| *** ayoung is now known as ayoung_is_a_Dad | 22:27 | |
| morganfainberg | ayoung_is_a_Dad, i think that might break things. | 22:29 |
| morganfainberg | ayoung_is_a_Dad, i think that change is going make it so we require the awful "here is the list of my plugins option" and then each one of those needs to have it's own option that is dynamically registered to point ot the class | 22:31 |
| morganfainberg | ayoung_is_a_Dad, you can't use the "load by classname" method of loading auth plugins | 22:32 |
| morganfainberg | i *think* | 22:32 |
| * morganfainberg continues to look at that code | 22:32 | |
| *** elmiko is now known as _elmiko | 22:33 | |
| *** rwsu has joined #openstack-keystone | 22:36 | |
| *** joesavak has quit IRC | 22:41 | |
| *** henrynash has joined #openstack-keystone | 22:41 | |
| *** bknudson has quit IRC | 22:45 | |
| *** andreaf has quit IRC | 22:53 | |
| *** henrynash has quit IRC | 22:53 | |
| *** rkofman has joined #openstack-keystone | 22:54 | |
| _elmiko | ayoung_is_a_Dad: fyi, i did a GET on /v3/users and i do see the proxy users in that list. not sure if that has any impact. | 22:59 |
| *** andreaf has joined #openstack-keystone | 22:59 | |
| *** andreaf_ has joined #openstack-keystone | 23:04 | |
| *** andreaf has quit IRC | 23:07 | |
| *** nkinder has joined #openstack-keystone | 23:14 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove unnecessary declaration of CONF https://review.openstack.org/113930 | 23:15 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 23:19 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/114059 | 23:19 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/114067 | 23:24 |
| *** gordc has quit IRC | 23:36 | |
| *** RockKuo_Home has quit IRC | 23:38 | |
| *** jamielennox|away is now known as jamielennox | 23:51 | |
| *** gokrokve has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!