| openstackgerrit | Boris Pavlovic proposed a change to openstack/python-keystoneclient: Add shell --profile option to tirgger osprofiler from CLI https://review.openstack.org/114856 | 00:01 |
|---|---|---|
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Update revoke-ext https://review.openstack.org/114857 | 00:01 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 00:03 |
| boris-42 | morganfainberg hi | 00:03 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 00:04 |
| *** mriedem has quit IRC | 00:06 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Update revoke-ext https://review.openstack.org/114857 | 00:13 |
| boris-42 | morganfainberg I made using & testing of Osprofiler much simpler | 00:15 |
| boris-42 | morganfainberg if you have some free slots could you take a look at https://review.openstack.org/#/c/114856/ | 00:15 |
| *** mitz has joined #openstack-keystone | 00:32 | |
| *** hrybacki has joined #openstack-keystone | 00:38 | |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 00:39 |
| *** hrybacki has quit IRC | 00:43 | |
| *** oomichi has joined #openstack-keystone | 00:47 | |
| *** xianghui has joined #openstack-keystone | 00:55 | |
| *** harlowja is now known as harlowja_away | 00:58 | |
| *** shakayumi is now known as shakamunyi | 00:59 | |
| *** alex_xu has joined #openstack-keystone | 01:20 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sync with oslo-incubator https://review.openstack.org/114863 | 01:21 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Revoke by Audit Id / Audit Id Chain instead of expires https://review.openstack.org/114864 | 01:21 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/python-keystoneclient: Add shell --profile option to tirgger osprofiler from CLI https://review.openstack.org/114856 | 01:25 |
| *** ncoghlan has joined #openstack-keystone | 01:31 | |
| *** morganfainberg is now known as morganfainberg_Z | 01:35 | |
| *** RicoLin has joined #openstack-keystone | 01:39 | |
| *** hrybacki has joined #openstack-keystone | 01:40 | |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 01:40 |
| *** yasukun has joined #openstack-keystone | 01:44 | |
| *** shakayumi has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Jeffrey Zhang proposed a change to openstack/keystone: Redirect stdout and stderr when using subprocess https://review.openstack.org/51610 | 01:47 |
| *** shakamunyi has quit IRC | 01:49 | |
| *** yasukun has quit IRC | 01:52 | |
| *** nonameentername has quit IRC | 01:53 | |
| *** nonameentername has joined #openstack-keystone | 01:53 | |
| jamielennox | do we not have an equivalent to /users/{id}/projects for domains? | 02:22 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: trustor_user_id not available in v2 trust token https://review.openstack.org/101829 | 02:34 |
| *** morganfainberg_Z is now known as morganfainberg | 02:37 | |
| *** hrybacki has quit IRC | 02:44 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/pass https://review.openstack.org/112230 | 02:47 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Revert "Use oslo.utils" https://review.openstack.org/114825 | 02:49 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Revert "Add oslo.utils requirement" https://review.openstack.org/114833 | 02:50 |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 02:52 |
| *** andreaf_ has joined #openstack-keystone | 02:57 | |
| *** andreaf has quit IRC | 03:00 | |
| *** hrybacki has joined #openstack-keystone | 03:02 | |
| openstackgerrit | Boris Pavlovic proposed a change to openstack/keystone: Integrate OSprofiler in Keystone https://review.openstack.org/103368 | 03:03 |
| *** RicoLin has quit IRC | 03:06 | |
| *** RicoLin has joined #openstack-keystone | 03:06 | |
| *** hrybacki has quit IRC | 03:07 | |
| openstackgerrit | A change was merged to openstack/keystone: Use mail for the default LDAP email attribute name https://review.openstack.org/94668 | 03:08 |
| *** hrybacki has joined #openstack-keystone | 03:10 | |
| *** stevemar has joined #openstack-keystone | 03:14 | |
| boris-42 | jamielennox around/ | 03:15 |
| boris-42 | ? | 03:17 |
| *** alex_xu has quit IRC | 03:21 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 03:41 |
| *** alex_xu has joined #openstack-keystone | 03:43 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Update revoke-ext https://review.openstack.org/114857 | 03:44 |
| *** cjellick has joined #openstack-keystone | 03:54 | |
| *** cjellick has quit IRC | 03:55 | |
| *** cjellick has joined #openstack-keystone | 03:55 | |
| *** Krast has joined #openstack-keystone | 03:56 | |
| *** cjellick has quit IRC | 04:00 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:04 | |
| *** KanagarajM has joined #openstack-keystone | 04:04 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:27 | |
| *** hrybacki has quit IRC | 04:32 | |
| *** nkinder has quit IRC | 04:34 | |
| *** nkinder has joined #openstack-keystone | 04:35 | |
| *** stevemar has quit IRC | 04:44 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Update revoke-ext https://review.openstack.org/114857 | 04:50 |
| *** chandankumar has joined #openstack-keystone | 05:00 | |
| morganfainberg | jamielennox, thanks for responding to ayoung's comment on your spec. lets 2x check w/ others and if no issues i'm still +2 on it. | 05:10 |
| morganfainberg | jamielennox, anyway.. catch you tomorrow | 05:10 |
| jamielennox | morganfainberg: i don't think they are a problem for this patch | 05:11 |
| morganfainberg | jamielennox, fairly certain you addressed his comments directly and well | 05:11 |
| jamielennox | morganfainberg: i'm doing the impl now and it's more involved than expected but will be ok | 05:11 |
| jamielennox | we don't have a list domains for user operation at all | 05:11 |
| morganfainberg | but... /me is sleepy and hurting cause of revocation event cleanup | 05:11 |
| morganfainberg | i *think* i know the last couple fixes to tests to make this work | 05:12 |
| morganfainberg | but ugh. so many assumptions that things *will* be a certain way | 05:12 |
| jamielennox | morganfainberg: yea, that would be a PITA i remember trying to review it | 05:12 |
| jamielennox | there's still the one on client side which i haven't done for that because i just have no idea | 05:12 |
| morganfainberg | jamielennox, we should hold off on that until we get it solid in keystone | 05:12 |
| morganfainberg | jamielennox, right now... it's getting close to re-writing a chunk of it | 05:13 |
| jamielennox | morganfainberg: have always agreed with that | 05:13 |
| jamielennox | morganfainberg: anyway, sleep i'll talk to you later | 05:14 |
| *** amirosh has joined #openstack-keystone | 05:21 | |
| *** ukalifon1 has joined #openstack-keystone | 05:39 | |
| *** ajayaa has joined #openstack-keystone | 05:50 | |
| *** tomoiaga has joined #openstack-keystone | 05:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Revoke by Audit Id / Audit Id Chain instead of expires https://review.openstack.org/114864 | 06:13 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sync with oslo-incubator https://review.openstack.org/114863 | 06:13 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add audit ids to tokens https://review.openstack.org/114306 | 06:13 |
| jamielennox | morganfainberg: you were leaving an hour ago | 06:14 |
| morganfainberg | jamielennox, yeah i am actually leaving now | 06:14 |
| morganfainberg | jamielennox, was trying to solve the last few of those test failures ^^ | 06:14 |
| morganfainberg | down to ~5, and i know what they are from | 06:14 |
| morganfainberg | so will deal with them tomorrow.. then more rebase hell | 06:15 |
| jamielennox | morganfainberg: yea, know that feeling | 06:15 |
| *** ncoghlan is now known as ncoghlan_afk | 07:00 | |
| *** ncoghlan_afk is now known as ncoghlan | 07:11 | |
| *** mflobo has joined #openstack-keystone | 07:53 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Create authentication specific routes https://review.openstack.org/114903 | 08:08 |
| *** henrynash has joined #openstack-keystone | 08:08 | |
| *** afazekas_ has joined #openstack-keystone | 08:14 | |
| *** mflobo has quit IRC | 08:19 | |
| *** jamielennox is now known as jamielennox|away | 08:26 | |
| *** xianghui has quit IRC | 08:27 | |
| *** xianghui has joined #openstack-keystone | 08:31 | |
| *** ncoghlan is now known as ncoghlan_afk | 08:33 | |
| *** henrynash has quit IRC | 08:38 | |
| *** aix has joined #openstack-keystone | 08:43 | |
| *** aix has quit IRC | 08:53 | |
| *** henrynash has joined #openstack-keystone | 08:56 | |
| *** alex_xu has quit IRC | 09:05 | |
| *** afazekas has quit IRC | 09:09 | |
| *** afazekas_ is now known as afazekas | 09:09 | |
| *** aix has joined #openstack-keystone | 09:14 | |
| *** ajayaa has quit IRC | 09:23 | |
| *** ajayaa has joined #openstack-keystone | 09:35 | |
| *** Clabbe has quit IRC | 10:42 | |
| *** kwss has joined #openstack-keystone | 10:43 | |
| *** cosss has joined #openstack-keystone | 10:43 | |
| *** Clabbe has joined #openstack-keystone | 10:58 | |
| *** cosss has quit IRC | 10:59 | |
| *** KanagarajM has quit IRC | 11:01 | |
| *** henrynash has quit IRC | 11:01 | |
| *** xianghui has quit IRC | 11:07 | |
| *** xianghui has joined #openstack-keystone | 11:08 | |
| *** Clabbe has quit IRC | 11:10 | |
| *** Clabbe has joined #openstack-keystone | 11:12 | |
| *** fifieldt has joined #openstack-keystone | 11:23 | |
| *** afaranha has joined #openstack-keystone | 11:25 | |
| *** Clabbe has quit IRC | 11:25 | |
| *** Clabbe has joined #openstack-keystone | 11:32 | |
| *** bvandenh has joined #openstack-keystone | 11:32 | |
| *** hrybacki has joined #openstack-keystone | 11:54 | |
| *** bvandenh has quit IRC | 11:54 | |
| *** hrybacki has quit IRC | 11:58 | |
| *** miqui has quit IRC | 12:07 | |
| *** afaranha has quit IRC | 12:07 | |
| *** gordc has joined #openstack-keystone | 12:08 | |
| *** andreaf has joined #openstack-keystone | 12:10 | |
| *** andreaf has quit IRC | 12:11 | |
| *** andreaf has joined #openstack-keystone | 12:11 | |
| *** andreaf_ has quit IRC | 12:13 | |
| *** htruta has joined #openstack-keystone | 12:14 | |
| openstackgerrit | Kristy Siu proposed a change to openstack/keystone: Standardizing the Federation Process https://review.openstack.org/105597 | 12:17 |
| *** rodrigods has joined #openstack-keystone | 12:21 | |
| *** raildo has joined #openstack-keystone | 12:27 | |
| *** radez_g0n3 is now known as radez | 12:47 | |
| ajayaa | Hi. If I have to add something to http://developer.openstack.org/api-ref-identity-v2.html, where do I do it? | 12:50 |
| *** hrybacki has joined #openstack-keystone | 12:50 | |
| *** ukalifon3 has joined #openstack-keystone | 12:58 | |
| *** ukalifon1 has quit IRC | 12:59 | |
| *** RicoLin has quit IRC | 13:00 | |
| *** richm has joined #openstack-keystone | 13:04 | |
| *** bknudson1 has quit IRC | 13:08 | |
| *** nkinder has quit IRC | 13:10 | |
| dolphm | ajayaa: that's either in https://github.com/openstack/api-site or based on XSD/WADLs in https://github.com/openstack/identity-api/tree/master/v2.0/src | 13:11 |
| *** radez is now known as radez_g0n3 | 13:18 | |
| *** joesavak has joined #openstack-keystone | 13:20 | |
| *** hrybacki has quit IRC | 13:23 | |
| *** chandankumar has quit IRC | 13:42 | |
| *** ukalifon3 has quit IRC | 13:45 | |
| *** ukalifon has joined #openstack-keystone | 13:53 | |
| *** nkinder has joined #openstack-keystone | 13:56 | |
| *** Krast_ has joined #openstack-keystone | 14:04 | |
| *** xianghuihui has joined #openstack-keystone | 14:06 | |
| *** zzzeek has joined #openstack-keystone | 14:06 | |
| *** hyakuhei_ has joined #openstack-keystone | 14:06 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/keystone-specs: Hierarchical Multitenacy https://review.openstack.org/101017 | 14:08 |
| *** kevinbenton_ has joined #openstack-keystone | 14:10 | |
| *** alex_xu has joined #openstack-keystone | 14:10 | |
| *** xianghui has quit IRC | 14:11 | |
| *** Krast has quit IRC | 14:11 | |
| *** wanghong has quit IRC | 14:11 | |
| *** gabriel-bezerra has quit IRC | 14:11 | |
| *** kevinbenton has quit IRC | 14:11 | |
| *** hyakuhei has quit IRC | 14:11 | |
| *** kevinbenton_ is now known as kevinbenton | 14:12 | |
| ajayaa | dolphm, What purpose does default_project_id server when creating an user? | 14:14 |
| ajayaa | serve* | 14:14 |
| dolphm | ajayaa: if you don't specify an explicit scope (project ID / domain ID) during authentication, then it attempts to scope of your default project | 14:14 |
| dolphm | ajayaa: on v2, it provides implicit authorization, and on v3 requires seperate explicit authorization | 14:15 |
| dolphm | user.tenant_id in v2 == user.default_project_id in v3 | 14:15 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Implement validation on the Catalog V3 resources https://review.openstack.org/96266 | 14:15 |
| dolphm | ajayaa: docs- https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#users-v3users | 14:15 |
| *** oomichi has quit IRC | 14:16 | |
| *** gabriel-bezerra has joined #openstack-keystone | 14:17 | |
| ajayaa | I can create a user with a non existent project. In v2 there is a check for existence of project whereas in v3 it is not. | 14:18 |
| *** wanghong has joined #openstack-keystone | 14:18 | |
| ajayaa | dolphm, now makes sense. What role is granted in v2? member? | 14:18 |
| dolphm | ajayaa: yes, keystone.conf [DEFAULT] member_role_id + member_role_name | 14:19 |
| dolphm | ajayaa: and that role is created if it doesn't exist at v2 user creation | 14:20 |
| dolphm | s/at v2 user creation/at some point =)/ | 14:20 |
| dolphm | might be on auth | 14:20 |
| ajayaa | dolphm, it is in auth I suppose. I am currently looking at user creation v2. | 14:21 |
| ajayaa | :) | 14:21 |
| *** henrynash has joined #openstack-keystone | 14:23 | |
| *** ayoung has joined #openstack-keystone | 14:25 | |
| *** david-lyle has joined #openstack-keystone | 14:26 | |
| *** topol has joined #openstack-keystone | 14:27 | |
| *** topol has quit IRC | 14:27 | |
| ayoung | marekd, . ``xmlsec1`` cannot read input data from stdin ? Really | 14:33 |
| ayoung | What is it doing? | 14:33 |
| *** radez_g0n3 is now known as radez | 14:38 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Error on _ldap_get_list without attrlist value https://review.openstack.org/114986 | 14:45 |
| *** rustlebee is now known as russellb | 14:52 | |
| *** bknudson has joined #openstack-keystone | 14:54 | |
| *** gpocente1 is now known as gpocentek | 15:07 | |
| *** gpocentek has quit IRC | 15:07 | |
| *** gpocentek has joined #openstack-keystone | 15:07 | |
| *** stevemar has joined #openstack-keystone | 15:11 | |
| *** tomoiaga has quit IRC | 15:18 | |
| *** joesavak has quit IRC | 15:19 | |
| *** chandankumar has joined #openstack-keystone | 15:20 | |
| *** Jean-Daniel has joined #openstack-keystone | 15:22 | |
| Jean-Daniel | hi all | 15:22 |
| Jean-Daniel | I'm trying to fine tune my policy.json | 15:23 |
| Jean-Daniel | in few words, i'm trying to have a super_admin and admin | 15:24 |
| Jean-Daniel | only super admin can CRUD specific user/tenant/endpoint | 15:25 |
| Jean-Daniel | where I can find docs on this question? | 15:25 |
| openstackgerrit | Ajaya Agrawal proposed a change to openstack/keystone: Validation of parameters during user creation https://review.openstack.org/114997 | 15:26 |
| *** ajayaa has quit IRC | 15:26 | |
| ayoung | Jean-Daniel, are you starting with the standart policy.json, or are you using the cloudsample version? | 15:27 |
| Jean-Daniel | the standart one | 15:28 |
| *** bearhands is now known as comstud | 15:28 | |
| Jean-Daniel | I'm still using APIv2 | 15:29 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Expose context to create and delete role_assignments https://review.openstack.org/114809 | 15:32 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Expose context to create grant and delete grant https://review.openstack.org/114809 | 15:33 |
| *** ukalifon has quit IRC | 15:35 | |
| Jean-Daniel | nobody to give me a good docs ? | 15:37 |
| *** jorge_munoz has joined #openstack-keystone | 15:39 | |
| ayoung | APVv2 is not going to work for you across the board | 15:40 |
| *** amirosh has quit IRC | 15:40 | |
| ayoung | not all of the the Calls are protected by anything other than "is_admin" which is not a policy check | 15:40 |
| ayoung | sorry | 15:40 |
| ayoung | Jean-Daniel, an no, there are no good docs yet/ | 15:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Revoke by Audit Id / Audit Id Chain instead of expires https://review.openstack.org/114864 | 15:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 15:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sync with oslo-incubator https://review.openstack.org/114863 | 15:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add audit ids to tokens https://review.openstack.org/114306 | 15:40 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 15:41 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 15:41 |
| *** cjellick has joined #openstack-keystone | 15:45 | |
| *** joesavak has joined #openstack-keystone | 15:47 | |
| *** afazekas has quit IRC | 15:49 | |
| *** Kui has quit IRC | 15:51 | |
| Jean-Daniel | ok thx for your answers ;) | 15:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Expose context to create grant and delete grant https://review.openstack.org/114809 | 15:55 |
| *** gyee has joined #openstack-keystone | 15:57 | |
| *** amirosh has joined #openstack-keystone | 16:04 | |
| *** chandankumar has quit IRC | 16:10 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 16:22 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 16:22 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove SAML2 plugin dependency on token_api https://review.openstack.org/115012 | 16:22 |
| *** kwss has quit IRC | 16:26 | |
| *** gokrokve has joined #openstack-keystone | 16:36 | |
| *** hrybacki has joined #openstack-keystone | 16:42 | |
| *** zzzeek has quit IRC | 16:42 | |
| *** harlowja_away is now known as harlowja | 16:45 | |
| ayoung | Pucking Phython | 16:49 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Expose context to create grant and delete grant https://review.openstack.org/114809 | 16:50 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 16:50 |
| *** zzzeek has joined #openstack-keystone | 16:50 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Expose context to create grant and delete grant https://review.openstack.org/114809 | 16:51 |
| dstanek | ayoung: ? | 16:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 16:51 |
| ayoung | dstanek, debugging in Pycharm | 16:52 |
| dstanek | haha - i've never done that before | 16:52 |
| ayoung | dstanek, its the testing stuff | 16:52 |
| ayoung | and the fact that everyone wants to rewrite base tools, like unit testing frameworks | 16:52 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create additional docs for role assignment events https://review.openstack.org/114813 | 16:53 |
| ayoung | so tox doesn't work with nose and I can't run just the test I want to in the debugger | 16:53 |
| ayoung | dstanek, and the failure was that the self object in setup didn't have a conft attribute, and that is just something I don't want to look at | 16:53 |
| ayoung | dolphm, morganfainberg OK, I figured out why the copy of the old test is failing. The old test was passing incorrectly. We need to clean the cache before the test. The test was working with a Hashed version that was being validated by "Keystone" (mock call) and not due to the caching. | 16:59 |
| morganfainberg | ayoung, ah | 17:00 |
| ayoung | And....there is the whole issue of which hash to store | 17:00 |
| ayoung | morganfainberg, and I think the test is using the MD5 version, but the "server" caches using SHA | 17:00 |
| morganfainberg | ayoung, why do we invalidate tokens for a user when we add the user to a group? | 17:00 |
| morganfainberg | that seems... broken | 17:01 |
| ayoung | morganfainberg, it should be scaled back to only on remove | 17:01 |
| morganfainberg | figured as much | 17:01 |
| ayoung | we were hyperaggresive on revocations | 17:01 |
| ayoung | didn't realize I miss that one | 17:01 |
| morganfainberg | hm. now i need to figure out how to make a callback with notifications work for when a user is removed from a group | 17:02 |
| ayoung | morganfainberg, so if the client passes a MD5 token to auth_token middleware, it is going to be a cache miss | 17:02 |
| morganfainberg | and i'll have token_api removed from identity.core | 17:02 |
| ayoung | morganfainberg, is there a notification only for change? | 17:03 |
| morganfainberg | not for user being added/removed from a group | 17:03 |
| morganfainberg | for user password changes i made a new internal notification class (worthwhile) | 17:03 |
| morganfainberg | but... i feel silly making new notification (resource_types) for things like 'user_removed_from_group | 17:04 |
| ayoung | morganfainberg, be silly | 17:04 |
| morganfainberg | yeah thats kindof where i'm going | 17:04 |
| ayoung | morganfainberg, so we awere hasing in the test code with MD5, but caching with sha256 | 17:09 |
| ayoung | I think I have it fixed...testing now, will resubmit | 17:10 |
| morganfainberg | ayoung, i think that was intentional, e.g. the MD5 should be a 200, the sha1 should fail | 17:10 |
| morganfainberg | the first time | 17:10 |
| ayoung | I'll wait until middleware gets approved before resubmitting in keystonclient | 17:10 |
| ayoung | nope | 17:10 |
| morganfainberg | the md5 would fail subsequently | 17:10 |
| ayoung | not the way the code is written | 17:10 |
| ayoung | md5 will never actually validate with the code the way it is wrrite | 17:10 |
| morganfainberg | the test says provide hashes for [md5, sha1] | 17:10 |
| morganfainberg | oh because we only cache token_ids[0] | 17:11 |
| morganfainberg | right | 17:11 |
| ayoung | morganfainberg, that will work, but its only cached on sha1 | 17:11 |
| ayoung | and the old test passed because we use the sample data to respond to an online lookup. Its a shortcoming in out test code that we use the same token for both hashed and unhahsed version of the tokens | 17:11 |
| openstackgerrit | ayoung proposed a change to openstack/keystonemiddleware: Hash for PKIZ https://review.openstack.org/114646 | 17:15 |
| *** rwsu has joined #openstack-keystone | 17:23 | |
| ayoung | morganfainberg, what do you think about this idea: we have an LDAP server available for gate tests. It is read only, with known, fixed values in it. Anyone can test against it, or duplicate. Then, as part of the devstack setup for gate, we do the multi-domain setup, and point at that preconfigured LDAP? | 17:29 |
| morganfainberg | hm | 17:35 |
| morganfainberg | perhaps. though i think that is going to run into issues. | 17:35 |
| morganfainberg | probably better to setup an LDAP tempest (runs only for keystone) and have the multi-domain stuff come from a separate tree in the ldap hierarchy | 17:36 |
| *** joesavak has quit IRC | 17:39 | |
| *** marcoemorais has joined #openstack-keystone | 17:45 | |
| *** marcoemorais has quit IRC | 17:46 | |
| *** harlowja is now known as harlowja_away | 17:46 | |
| *** marcoemorais has joined #openstack-keystone | 17:47 | |
| dstanek | how did we generate the sample config in havana? by hand? | 17:48 |
| *** marcoemorais has quit IRC | 17:50 | |
| *** marcoemorais has joined #openstack-keystone | 17:50 | |
| morganfainberg | dstanek, yeah | 17:55 |
| dstanek | morganfainberg: good times | 18:00 |
| *** aix has quit IRC | 18:02 | |
| *** zzzeek has quit IRC | 18:03 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity_api dependency on token_api https://review.openstack.org/115045 | 18:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 18:03 |
| *** zzzeek has joined #openstack-keystone | 18:05 | |
| *** marcoemorais has quit IRC | 18:05 | |
| *** marcoemorais has joined #openstack-keystone | 18:05 | |
| *** marcoemorais has quit IRC | 18:08 | |
| *** marcoemorais has joined #openstack-keystone | 18:08 | |
| *** radez is now known as radez_g0n3 | 18:08 | |
| *** afazekas has joined #openstack-keystone | 18:09 | |
| *** ncoghlan_afk is now known as ncoghlan | 18:11 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 18:11 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __str__ and __repr__ to KeystoneToken model https://review.openstack.org/113430 | 18:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 18:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove SAML2 plugin dependency on token_api https://review.openstack.org/115012 | 18:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity_api dependency on token_api https://review.openstack.org/115045 | 18:12 |
| *** radez_g0n3 is now known as radez | 18:14 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 18:18 |
| raildo | henrynash: I sent a version of the spec earlier today, if you can review :) | 18:19 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 18:20 |
| *** ncoghlan is now known as ncoghlan_afk | 18:21 | |
| *** marcoemorais has quit IRC | 18:23 | |
| *** marcoemorais has joined #openstack-keystone | 18:24 | |
| *** marcoemorais has quit IRC | 18:24 | |
| *** marcoemorais has joined #openstack-keystone | 18:25 | |
| *** marcoemorais has quit IRC | 18:25 | |
| *** marcoemorais has joined #openstack-keystone | 18:26 | |
| *** harlowja_away is now known as harlowja | 18:26 | |
| *** marcoemorais has quit IRC | 18:27 | |
| *** marcoemorais has joined #openstack-keystone | 18:27 | |
| *** marcoemorais has quit IRC | 18:27 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/identity-api: Updated from global requirements https://review.openstack.org/115053 | 18:28 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 18:28 |
| *** marcoemorais has joined #openstack-keystone | 18:30 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/114067 | 18:33 |
| *** hrybacki has quit IRC | 18:41 | |
| *** amerine__ is now known as amerine | 18:49 | |
| henrynash | raildo: will look at it later tonight, thank | 18:52 |
| henrynash | thanks | 18:52 |
| raildo | henrynash: great, thank you! | 18:52 |
| richm | Is there a known problem currently with running keystone tests in pdb? | 18:57 |
| richm | and stopping in tests? | 18:57 |
| richm | If I try to stop in/step into tests, the interpreter gets some sort of "too many levels of recursion" exception | 18:58 |
| richm | If I just continue, I see no such exception but my breakpoints are never hit | 18:58 |
| richm | I know it is executing the test function | 18:59 |
| richm | tools/with_venv.sh python -m pdb .venv/lib/python2.7/site-packages/testtools/run.py keystone.tests.test_backend_ldap.LDAPIdentity.test_something | 18:59 |
| openstackgerrit | A change was merged to openstack/identity-api: Updated from global requirements https://review.openstack.org/115053 | 19:00 |
| raildo | henrynash: I was interested to start contributing to the endpoint policy. Could you give me information about the progress, if you ou ayoung need help to implementing or something like that? | 19:03 |
| ayoung | raildo, I think the spec is bascially OKed | 19:06 |
| ayoung | richm, yes | 19:06 |
| ayoung | richm, eventlet messes with it, so use --standard-threads switch | 19:06 |
| raildo | ayoung: I was reading it. | 19:06 |
| richm | ayoung: option --standard-threads not recognized | 19:10 |
| richm | ayoung: I'm not trying to debug a keystone server, just a test | 19:10 |
| richm | so I didn't think threading would be involved | 19:11 |
| ayoung | richm, export STANDARD_THREAD=True | 19:12 |
| ayoung | er | 19:12 |
| ayoung | STANDARD_THREADS | 19:12 |
| ayoung | richm, eventlet monkeypatches the Python thread code. | 19:13 |
| ayoung | which means that the debugger can't switch threads upon hitting a breakpoint. | 19:13 |
| ayoung | our tests are usually run with eventlet, but we put in the work around for the debugger | 19:14 |
| richm | ah, ok | 19:14 |
| richm | I didn't have to do this a few months ago, when last I tried to debug a test using pdb | 19:14 |
| boris-42 | ayoung hi | 19:16 |
| ayoung | richm, you lie | 19:16 |
| ayoung | richm, I am pretty certain all of out tests monkeypatch eventlet in the setup code, and overriding must be done for debuggers | 19:17 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 19:18 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create additional docs for role assignment events https://review.openstack.org/114813 | 19:18 |
| dstanek | ayoung: i believe you are correct. we set STANDARD_THREADS in debug_helper.sh | 19:18 |
| ayoung | stevemar, morganfainberg I suspect that we are going to want to merge the CADF and internal notifications into one code path | 19:19 |
| dolphm | stevemar: cool http://pasteraw.com/b76mhgiq3p888knlhizym443l9i4yud | 19:19 |
| stevemar | ayoung, yes, it's definitely something we should think of | 19:20 |
| ayoung | dolphm, https://review.openstack.org/#/c/114646/ I've incorporated your test in there....sort of. It turns out the old test was getting a pass incorrectly | 19:20 |
| dolphm | ayoung: yeah, i saw your comment earlier | 19:20 |
| ayoung | dolphm, I'm guessing gate is wedged since that hasn't been accepted/rejected | 19:21 |
| stevemar | dolphm, i'm not sure what to make of your pastie | 19:21 |
| ayoung | morganfainberg, does keystonemiddleware not kick off the gate jobs? | 19:21 |
| henrynash | stevemar: if i want to receive notifications…and the ones I want are CADF, do I have to do know that and do different things (just thinking about other projects that might subscribe to our notifcations)? | 19:21 |
| dolphm | stevemar: just started listening to the gerrit event queue, and your thing was the first to pop up | 19:22 |
| stevemar | dolphm, appropriate | 19:24 |
| stevemar | henrynash, nope, it shouldn't matter really, they are all on the message bus | 19:24 |
| stevemar | henrynash, the payload will be a slightly different format, non-cadf (the payload is just a uuid) vs cadf (elaborate dict) | 19:25 |
| dolphm | stevemar: what's the topic use for auth cadf notifications? | 19:26 |
| *** mitz has quit IRC | 19:26 | |
| henrynash | stevemar: I wonder if you should be able to “read” the event in non-cadf form, even if (unbeknown to you) it is in cadf format | 19:26 |
| *** mitz has joined #openstack-keystone | 19:27 | |
| henrynash | stevemar: otherwise we are setting ourselves up for a maintenance nightmare once lots of peopele start subscribing and we want to change an event from non-cadf to cadf | 19:28 |
| stevemar | dolphm, no idea. auth cadf notifications... that was last release | 19:29 |
| stevemar | henrynash, i'm not sure, i think it should be the other way | 19:30 |
| henrynash | stevemar: oh, you mean…all our evenst are in cadf format? | 19:30 |
| henrynash | stevemar: (which would be ok too) | 19:30 |
| stevemar | henrynash, theres 2 main reasons for notifications right, as a callback function, and for auditing, | 19:31 |
| henrynash | stevemar: yep | 19:31 |
| stevemar | i don't think all the non-cadf ones are necessarily valid audit events (like creating a project) | 19:31 |
| dolphm | stevemar: callbacks aren't emitted to messaging | 19:31 |
| dolphm | stevemar: they just sort of hijack the messaging pattern internally | 19:31 |
| dolphm | public=False # no message bus involved | 19:32 |
| stevemar | dolphm, so whats the point of the identity / assignment CRUD notifications? | 19:32 |
| henrynash | dolphm: but, say, nova could receive it? | 19:32 |
| dolphm | stevemar: assignment - auditing only? | 19:32 |
| dolphm | henrynash: nova should listen for non-cadf events that it cares about, like project deletion | 19:33 |
| henrynash | dolphm: agreed | 19:33 |
| dolphm | henrynash: i don't think other services (besides maybe ceilometer or a CADF capture tool) should listen for anything CADF-ish | 19:33 |
| stevemar | dolphm, so really the assignment ones should be CADF | 19:33 |
| dolphm | stevemar: yes | 19:33 |
| henrynash | dolphm: my only point was, today (and our docs say this), we chose, for any given event type, whether we will emit it as non-cadf or cadf | 19:34 |
| stevemar | what about the identity ones, deleting a user is pretty auditable | 19:34 |
| dolphm | henrynash: yes. but i don't know what we should do in the case of an audit-relevant event that other services would be interested in (not that i have an example today) - do we emit CADF or non CADF there? | 19:35 |
| henrynash | dolphm: I think that’s exxactly what I’m trying to explore…today we emit one or the other…so it’s CADF | 19:35 |
| henrynash | stevemar: correct me if I’m wrong here | 19:35 |
| henrynash | dolphm: and my concern is, say, in the future we decided to make some event that is (today) non-cadf into a cadf one becuase peopel want it for auditing, all our scubscribers would have to change their code | 19:37 |
| dolphm | henrynash: i think we'd have to emit two notifications there | 19:37 |
| henrynash | dolphm: which if so, I’d argue we should be emiting two for any cadf events today…for different types of subscriber (audit or just other interetsed parties) | 19:38 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Hash for PKIZ https://review.openstack.org/114654 | 19:38 |
| stevemar | dolphm, ++ for the 2 notifications, it sounds good to me | 19:39 |
| stevemar | bknudson, thanks for the suggestion re: defaulting the context, instead of updating the tests | 19:45 |
| lbragstad | dstanek: have you updated the jsd library lately/ | 19:46 |
| lbragstad | ? | 19:46 |
| lbragstad | dstanek: just out of curiosity | 19:46 |
| dstanek | lbragstad: i have a ton of updates, but i have yet to make a release - i've started to get emails about adding other features of the spec | 19:47 |
| lbragstad | dstanek: nice! | 19:47 |
| dstanek | lbragstad: there are a few tests i need to get green before i release again. so maybe tonight or early tomorrow | 19:48 |
| lbragstad | other openstack projects want to use it? or not openstack specific? | 19:48 |
| dstanek | not openstack specific | 19:48 |
| lbragstad | cool | 19:48 |
| *** shakayumi has quit IRC | 19:53 | |
| *** nkinder has quit IRC | 19:54 | |
| *** henrique_ has joined #openstack-keystone | 19:57 | |
| *** gpocente1 has joined #openstack-keystone | 19:57 | |
| *** gyee_ has joined #openstack-keystone | 19:57 | |
| *** gyee has quit IRC | 19:58 | |
| *** htruta has quit IRC | 19:58 | |
| *** wolsen has quit IRC | 19:58 | |
| *** gpocentek has quit IRC | 19:58 | |
| richm | ayoung: http://paste.openstack.org/show/96997/ | 19:59 |
| richm | This does not work - does not hit any of my breakpoints | 19:59 |
| *** wolsen has joined #openstack-keystone | 19:59 | |
| richm | If anyone knows how to run tests in a debugger, and set and hit breakpoints in test functions, I would appreciate any advice | 19:59 |
| ayoung | richm, I don't run the tests that way. | 20:00 |
| stevemar | richm, if you're not running keystone under apache, you can use the `debug` tox environment | 20:03 |
| ayoung | richm, try putting a breakpoint in test setup before the environment setup | 20:04 |
| stevemar | richm, tox -e debug test_backend_ldap.LDAPIdentity.test_deleteTree << if you're not running under apache, and using pdb | 20:04 |
| richm | I'm not running keystone under apache, I'm trying to debug keystone/tests/test_backend_ldap.py | 20:04 |
| richm | ok | 20:04 |
| *** amirosh has quit IRC | 20:11 | |
| *** amirosh has joined #openstack-keystone | 20:11 | |
| *** amirosh has quit IRC | 20:16 | |
| dstanek | richm: did you get it working yet? | 20:24 |
| ayoung | stevemar, is there a way to get that to stop on a breakpoint right away, as opposed to having to edit your code to set a breakpoint? | 20:25 |
| stevemar | ayoung, not that i know of, dstanek ^ | 20:26 |
| dstanek | ayoung, stevemar: you mean no 'import pdb; pdb.set_trace()'? | 20:27 |
| ayoung | dstanek, exactly | 20:28 |
| ayoung | editing source is antisocial | 20:28 |
| richm | dstanek: ayoung: yes, it is working - pdb.set_trace() makes it work | 20:28 |
| richm | which is not ideal, but at least I can proceed | 20:28 |
| dstanek | the only way i know of is to run the app with pdb and then use normal gdb-line command to set a breakpoint on a file | 20:29 |
| ayoung | dstanek, you taunt me | 20:30 |
| ayoung | dstanek, what would that look like? | 20:30 |
| dstanek | ayoung: i thought the IDEs like pycharm could do that | 20:30 |
| ayoung | dstanek, I'd like to not have to use an IDE | 20:30 |
| dstanek | in our environment i'm not 100% sure | 20:31 |
| *** radez is now known as radez_g0n3 | 20:31 | |
| ayoung | dstanek, lets assume that richm 's line worked | 20:31 |
| ayoung | STANDARD_THREADS=True tools/with_venv.sh python -m pdb .venv/lib/python2.7/site-packages/testtools/run.py keystone.tests.test_backend_ldap.LDAPIdentity.test_deleteTree | 20:32 |
| dstanek | ayoung: that looks like it would work, but testtools give me nightmares | 20:33 |
| richm | hmm - fakeldap search_s with SCOPE_SUBTREE does not return the given dn | 20:33 |
| ayoung | dstanek, Pucking Phython | 20:44 |
| dstanek | it'll grow on you | 20:44 |
| dstanek | like a rash | 20:44 |
| ayoung | dstanek, I had the dermatologist remove it | 20:44 |
| ayoung | dstanek, its been 4 years. Ain't gonna happen | 20:44 |
| ayoung | anyway, removing all the multiple ways we can obfuscate | 20:45 |
| ayoung | say I did this | 20:45 |
| ayoung | . .venv/bin/activate | 20:45 |
| ayoung | and then python -m pdb .venv/lib/python2.7/site-packages/testtools/run.py keystone.tests.test_backend_ldap.LDAPIdentity.test_deleteTree | 20:45 |
| ayoung | How would I get pdb to stop before running the code | 20:46 |
| ayoung | like a normal debugger | 20:46 |
| stevemar | anyone why I can't reference the example certs/keys in a test? they don't seem to be there | 20:48 |
| stevemar | correction, i can refer to them in a test, but jenkins doesn't like that | 20:48 |
| ayoung | stevemar, liar | 20:49 |
| ayoung | stevemar, which project? | 20:49 |
| stevemar | ayoung, in keystone, i just want the patch to any .pem file, to sign something | 20:50 |
| ayoung | stevemar, this for the SAML? | 20:50 |
| ayoung | signing step? | 20:50 |
| stevemar | ayoung, yep, i just want to make sure the library signs it correctly | 20:50 |
| ayoung | you trying to use the keystone signing cert from the conf file? | 20:50 |
| stevemar | yep | 20:51 |
| stevemar | and it works in my dev. env | 20:51 |
| ayoung | stevemar, its done by keystoneclient now | 20:51 |
| stevemar | but when i check it in, kablewie | 20:51 |
| stevemar | ah | 20:51 |
| ayoung | stevemar, got a link? | 20:51 |
| stevemar | sec | 20:52 |
| stevemar | line 1584, https://review.openstack.org/#/c/110542/16/keystone/tests/test_v3_federation.py - i am just using the one for signing.keyfile | 20:52 |
| stevemar | i set the value to be the same, i figured it was hacky/lazy | 20:53 |
| stevemar | just testing it out | 20:53 |
| stevemar | and that works in my env. | 20:53 |
| stevemar | ayoung, but the tests, http://logs.openstack.org/42/110542/16/check/gate-keystone-python26/ff82992/testr_results.html.gz don't pass because the value isn't set to the full path, just '' | 20:54 |
| ayoung | stevemar, the other tests that do token_signing have to do something. | 20:56 |
| stevemar | ayoung, yeah, looking at test_cert_setup now, trying to figure out whats going on | 20:57 |
| ayoung | the default value for that field is in /etc/keystone/ssl, IIRC. But the tests point to local. Its in one of the test conf files | 20:57 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 21:00 |
| *** bknudson has quit IRC | 21:03 | |
| *** hrybacki has joined #openstack-keystone | 21:03 | |
| *** nkinder has joined #openstack-keystone | 21:10 | |
| *** gordc has quit IRC | 21:11 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity_api dependency on token_api https://review.openstack.org/115045 | 21:19 |
| *** ncoghlan_afk is now known as ncoghlan | 21:31 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 21:33 |
| *** ncoghlan is now known as ncoghlan_afk | 21:41 | |
| *** henrynash has quit IRC | 21:45 | |
| *** marcoemorais1 has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 21:58 |
| *** marcoemorais has quit IRC | 21:59 | |
| *** stevemar2 has joined #openstack-keystone | 22:02 | |
| *** zzzeek_ has joined #openstack-keystone | 22:03 | |
| *** stevemar2 has quit IRC | 22:09 | |
| *** chmouel_ has joined #openstack-keystone | 22:10 | |
| *** toddnni has quit IRC | 22:11 | |
| *** zzzeek has quit IRC | 22:11 | |
| *** stevemar has quit IRC | 22:11 | |
| *** chmouel has quit IRC | 22:11 | |
| *** toddnni has joined #openstack-keystone | 22:11 | |
| *** zzzeek_ is now known as zzzeek | 22:11 | |
| *** marcoemorais1 has quit IRC | 22:31 | |
| *** marcoemorais has joined #openstack-keystone | 22:31 | |
| *** jamielennox|away is now known as jamielennox | 22:42 | |
| *** hrybacki has quit IRC | 22:43 | |
| *** marcoemorais has quit IRC | 22:50 | |
| *** marcoemorais has joined #openstack-keystone | 22:51 | |
| *** zzzeek has quit IRC | 22:53 | |
| *** zzzeek has joined #openstack-keystone | 22:53 | |
| *** zzzeek has quit IRC | 22:53 | |
| *** jorge_munoz has quit IRC | 22:57 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystone: Create authentication specific routes https://review.openstack.org/114903 | 22:59 |
| jamielennox | ayoung: thanks for the run of reviews, did you figure out your problem with the service catalog and your review? | 23:00 |
| *** jorge_munoz has joined #openstack-keystone | 23:01 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __repr__ to KeystoneToken model https://review.openstack.org/113430 | 23:01 |
| *** alex_xu has quit IRC | 23:08 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Sync with oslo-incubator https://review.openstack.org/114863 | 23:11 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Revoke by Audit Id / Audit Id Chain instead of expires https://review.openstack.org/114864 | 23:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 23:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 23:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove SAML2 plugin dependency on token_api https://review.openstack.org/115012 | 23:12 |
| *** jorge_munoz has quit IRC | 23:12 | |
| jamielennox | morganfainberg: i got a question on a review https://review.openstack.org/#/c/113579 about how to raise the correct unauthenticated message | 23:13 |
| jamielennox | (picking on you because you are the only erson thats been active for a while) | 23:13 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity_api dependency on token_api https://review.openstack.org/115045 | 23:13 |
| *** marcoemorais has quit IRC | 23:13 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __repr__ to KeystoneToken model https://review.openstack.org/113430 | 23:13 |
| jamielennox | what do you think? | 23:13 |
| *** marcoemorais has joined #openstack-keystone | 23:13 | |
| jamielennox | i thought if we raised an error and it got caught by the middleware it could transform it | 23:14 |
| jamielennox | however most projects have a catch all exception handler so that the service doesn't cratch | 23:14 |
| jamielennox | s/cratch/crash | 23:14 |
| jamielennox | if the middleware is not being used then this is a bad idea to raise an exc | 23:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add extra guarding to revoke_by_audit_id methods https://review.openstack.org/115147 | 23:15 |
| morganfainberg | jamielennox, hmm? | 23:15 |
| jamielennox | morganfainberg: trying to reason something out, you were the only other person making noise in the channel | 23:16 |
| morganfainberg | jamielennox, i don't have a good answer. | 23:17 |
| morganfainberg | jamielennox, :( | 23:17 |
| morganfainberg | blech, brain is so deep in this token stuff at the moment... | 23:17 |
| jamielennox | morganfainberg: fair enough | 23:18 |
| boris-42 | morganfainberg hi | 23:18 |
| *** jorge_munoz has joined #openstack-keystone | 23:19 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Add information about audit_id in token docs https://review.openstack.org/114590 | 23:22 |
| morganfainberg | boris-42, hi, warning i'm pretty focused on something that is taking a lot of concentration to keep track of | 23:22 |
| morganfainberg | boris-42, so, may not be much help at the moment | 23:23 |
| boris-42 | morganfainberg I just would like to point you guys | 23:23 |
| boris-42 | morganfainberg that I finished work on integration of OSProfiler in keystone | 23:23 |
| boris-42 | morganfainberg and it works well | 23:23 |
| boris-42 | morganfainberg here is nova/glance/keystone enabled http://boris-42.github.io/ngk.html (sample of trace) | 23:23 |
| *** bknudson has joined #openstack-keystone | 23:32 | |
| *** jorge_munoz has quit IRC | 23:35 | |
| dstanek | boris-42: neat | 23:48 |
| boris-42 | dstanek hi there | 23:48 |
| boris-42 | dstanek yep now there is simple interface to do this | 23:48 |
| boris-42 | dstanek --profile in any python client, and then osprofiler trace show --html <TRACE_ID> | 23:48 |
| boris-42 | dstanek btw this will be available in rally performance jobs (with benchmarking together) | 23:48 |
| dstanek | boris-42: does that assume that profiling is enabled on the server side all the time? | 23:49 |
| boris-42 | dstanek yep | 23:49 |
| boris-42 | dstanek I designed it for that | 23:49 |
| boris-42 | dstanek that's why we have HMAC_KEY | 23:49 |
| boris-42 | dstanek by default osprofiler middleware does nothing | 23:50 |
| dstanek | boris-42: what's the HMAC_KEY used for? | 23:50 |
| boris-42 | dstanek it's secret key, that user should know to trigger profiler | 23:50 |
| boris-42 | dstanek it's specified in api-paste.ini (so only admin knows it) | 23:50 |
| dstanek | boris-42: ah, i see | 23:50 |
| boris-42 | dstanek code from osprofiler https://github.com/stackforge/osprofiler/blob/master/osprofiler/web.py#L101-L103 | 23:51 |
| boris-42 | dstanek so we are sign trace header with HMAC key | 23:51 |
| dstanek | boris-42: do you still have an open keystone review? i don't remember seeing it when i was looking through my list of todos | 23:51 |
| boris-42 | dstanek heh.. | 23:51 |
| boris-42 | dstanek https://review.openstack.org/#/c/103368/ | 23:51 |
| boris-42 | https://review.openstack.org/#/c/114856/ | 23:52 |
| dstanek | boris-42: great, thanks | 23:52 |
| boris-42 | dstanek btw one patch is already merged | 23:52 |
| boris-42 | dstanek https://review.openstack.org/#/c/103367/ | 23:52 |
| boris-42 | dstanek but cinder guys asked this neat --profile argument in CLI | 23:52 |
| boris-42 | dstanek and I thought yaaa that is nice=) | 23:53 |
| boris-42 | dstanek so it took some time to get it done | 23:53 |
| *** gokrokve has quit IRC | 23:57 | |
| *** david-lyle has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!