| *** henrynash has joined #openstack-keystone | 00:00 | |
| *** bknudson has joined #openstack-keystone | 00:03 | |
| *** topol has quit IRC | 00:04 | |
| *** harlowja has quit IRC | 00:15 | |
| *** harlowja_ has joined #openstack-keystone | 00:15 | |
| *** dims has joined #openstack-keystone | 00:16 | |
| *** zzzeek has quit IRC | 00:19 | |
| *** gyee_ has quit IRC | 00:21 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance GET /v3 to handle Accept header https://review.openstack.org/115462 | 00:25 |
|---|---|---|
| *** cjellick has quit IRC | 00:30 | |
| *** cjellick has joined #openstack-keystone | 00:30 | |
| *** cjellick has quit IRC | 00:35 | |
| *** diegows has quit IRC | 00:37 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use ConfigFilter for auth_token options https://review.openstack.org/115830 | 00:44 |
| *** jorge_munoz has joined #openstack-keystone | 00:51 | |
| *** jorge_munoz has quit IRC | 00:56 | |
| *** jorge_munoz has joined #openstack-keystone | 00:59 | |
| *** alex_xu has joined #openstack-keystone | 01:01 | |
| jamielennox | ayoung: if i simply https://review.openstack.org/#/c/113415/ it will change how it works | 01:02 |
| jamielennox | that is a horrible function | 01:03 |
| ayoung | jamielennox, ugh | 01:04 |
| jamielennox | ayoung: i don't know who wrote it, but they never considered anything beyond there immediate use case | 01:04 |
| ayoung | jamielennox, are all of those subordinate things not throwing exceptions? | 01:04 |
| jamielennox | (i try not to git blame in anger) | 01:05 |
| ayoung | heh | 01:05 |
| jamielennox | no the is_valids are booleans | 01:05 |
| jamielennox | function just needs to be deprecated | 01:05 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Implements the controller for the endpoint policy extension https://review.openstack.org/115746 | 01:05 |
| ayoung | jamielennox, yeah, but if you send (None, **{}) in to them do they return true or false? | 01:07 |
| *** topol has joined #openstack-keystone | 01:07 | |
| ayoung | henrynash, go to bed | 01:07 |
| jamielennox | they return an AccessInfoV2 apparently | 01:07 |
| henrynash | ayoung: yeah..i must do that! | 01:07 |
| henrynash | ayoung: just one more… | 01:07 |
| ayoung | henrynash, do you trust the code you write at 2 AM? I sure don't | 01:08 |
| jamielennox | that's what code review is for | 01:08 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add delete notifications for policy, region and service. https://review.openstack.org/115763 | 01:08 |
| henrynash | ayoung: teh code at 2am is not so bad….in the old days it was the code I wrote after 3 pints on england’s finest “old thumper’ ale that I never trusted | 01:09 |
| *** diegows has joined #openstack-keystone | 01:09 | |
| ayoung | Missed the Balmer peak. One way or the other henrynash | 01:09 |
| jamielennox | henrynash: they are often the best ideas, you just need to come back later and make the code sane | 01:10 |
| ayoung | http://xkcd.com/323/ | 01:10 |
| henrynash | ayoung: nice! | 01:10 |
| ayoung | question was, which side of the peak were you on? | 01:10 |
| ayoung | "just one more" | 01:10 |
| henrynash | ok, that now is me done…. | 01:10 |
| *** amerine has joined #openstack-keystone | 01:11 | |
| henrynash | time for bed (said zebedee) | 01:11 |
| henrynash | left field reference: http://www.magicroundabout.com/Time-For-Bed-Said-Zebedee.asp | 01:12 |
| ayoung | Good work. Sleep well. I'll most likely kill you in the morning. | 01:12 |
| *** henrynash has quit IRC | 01:12 | |
| ayoung | jamielennox, OK, let me give it a try. I think I can at least make it legible... | 01:15 |
| jamielennox | ayoung: go for it | 01:15 |
| *** shakamunyi has joined #openstack-keystone | 01:17 | |
| ayoung | jamielennox, is this code wrong: | 01:25 |
| ayoung | if body is None and not len(kwargs): | 01:25 |
| ayoung | auth_ref = AccessInfoV2(**kwargs) | 01:25 |
| ayoung | auth_ref.auth_token = auth_toke | 01:25 |
| ayoung | assuming, for a moment, that auth_token is None, would it be wrong to set the auth_ref.auth_token to none? | 01:25 |
| jamielennox | umm, i assume not because the default value of auth_token will be None | 01:27 |
| jamielennox | actually no it wont | 01:27 |
| jamielennox | the default will be KeyError | 01:27 |
| ayoung | jamielennox, is that the same as auth_ref = AccessInfoV2() | 01:27 |
| jamielennox | no because you're still setting a value to auth_token even if it's none | 01:28 |
| ayoung | or, better yet | 01:28 |
| ayoung | auth_ref = AccessInfoV2({auth_token: auth_token}) | 01:28 |
| *** richm has quit IRC | 01:28 | |
| ayoung | so auth_token == None is different from no auth_token property set> | 01:28 |
| ayoung | ? | 01:28 |
| *** marcoemorais has quit IRC | 01:29 | |
| *** gokrokve has joined #openstack-keystone | 01:30 | |
| jamielennox | most of AccessInfo throws KeyError when a value isn't set | 01:31 |
| jamielennox | that's terrible but i don't want to change the behaviour for one thing | 01:31 |
| ayoung | jamielennox, what about something like cloning the kwargs and sticking auth_token in it if it exists? | 01:32 |
| jamielennox | ayoung: think you're overreaching | 01:33 |
| ayoung | jamielennox, it also helps me to understand the code better. Even if all this is futile, at the end, I'll *get* it | 01:33 |
| jamielennox | so i don't think we should clone kwargs, and if we don't have auth_token as a header then our checks will fail | 01:34 |
| jamielennox | because we will get a NotImplemented rather than an empty AccessInfo (which is a dumb default) | 01:34 |
| ayoung | Wow this is some nasty cod | 01:37 |
| ayoung | code | 01:37 |
| ayoung | jamielennox, last question. You have a couple early returns on return AccessInfoV3(auth_token, **kwargs) etc. Where do they get their auth_token from? | 01:38 |
| ayoung | OK, I see the param | 01:39 |
| ayoung | why do we not do the same thing for V2? | 01:39 |
| jamielennox | ayoung: oh, i had something i thought made more sense but it got -1ed in an earlier review | 01:39 |
| jamielennox | ayoung: :) | 01:39 |
| jamielennox | ayoung: because horrible | 01:39 |
| *** diegows has quit IRC | 01:39 | |
| jamielennox | because in V2 the token is supposed to be in the body and in v3 it's the header | 01:40 |
| jamielennox | so whoever wrote the code figured we didn't need it for v2 | 01:40 |
| jamielennox | which is terrible, and will fail whenever we have CMS tokens | 01:40 |
| ayoung | jamielennox, why do you only get the token out of the resp for v3? | 01:40 |
| jamielennox | this patch is the minimum effort i could put into that broken thing and make it sane | 01:41 |
| ayoung | if resp and not auth_token: | 01:41 |
| ayoung | auth_token = resp.headers['X-Subject-Token'] | 01:41 |
| ayoung | wouldn't we want that for all cases? | 01:41 |
| jamielennox | as above, in v3 it's in the headers, in v2 it's in the body | 01:41 |
| jamielennox | why he didn't take token as a parameter rather than the whole resp i don't know | 01:41 |
| jamielennox | amongst the problems here is that the body token id is wrong when we use CMS tokens | 01:43 |
| ayoung | jamielennox, so if auth_token: | 01:43 |
| ayoung | auth_ref.auth_token = auth_token is only for v2 tokens ever? | 01:43 |
| jamielennox | i've no idea why that hasn't bitten us yet | 01:43 |
| *** dims has quit IRC | 01:44 | |
| jamielennox | ayoung: have a look at patch set one | 01:44 |
| *** dims has joined #openstack-keystone | 01:44 | |
| *** dims has quit IRC | 01:45 | |
| *** dims_ has joined #openstack-keystone | 01:45 | |
| *** hrybacki has quit IRC | 01:48 | |
| *** gokrokve has quit IRC | 01:50 | |
| *** amerine has quit IRC | 01:52 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/identity-api: Update revoke-ext https://review.openstack.org/114857 | 01:55 |
| *** alex_xu has quit IRC | 01:56 | |
| *** hrybacki has joined #openstack-keystone | 02:00 | |
| *** dims_ has quit IRC | 02:02 | |
| *** dims has joined #openstack-keystone | 02:03 | |
| ayoung | jamielennox, so, I don't know if my code is any better. It seems clearer at least: | 02:03 |
| ayoung | jamielennox, http://paste.openstack.org/show/97986/ | 02:04 |
| jamielennox | ayoung: yea, not sure | 02:05 |
| *** gokrokve has joined #openstack-keystone | 02:06 | |
| ayoung | jamielennox, want me to submit it or toss it? | 02:07 |
| jamielennox | ayoung: umm, i dont' mind it's probably a bit clearer, though not as concise | 02:08 |
| jamielennox | doesn't do any better job explaining the stupid decisions that were made | 02:08 |
| ayoung | I'll toss it, and that way I can +2 yours | 02:10 |
| *** dims has quit IRC | 02:12 | |
| *** dims has joined #openstack-keystone | 02:12 | |
| *** alex_xu has joined #openstack-keystone | 02:14 | |
| jamielennox | ayoung: i'm glad to share the pain :) | 02:21 |
| ayoung | jamielennox, just so as you see what I am dealing with in Horizon: https://review.openstack.org/#/c/115460/ | 02:22 |
| ayoung | that is all proof-of-concept code...needs to be severly cleaned up | 02:22 |
| *** dims has quit IRC | 02:22 | |
| ayoung | your generic plugin patch will help | 02:22 |
| *** dims has joined #openstack-keystone | 02:23 | |
| jamielennox | ayoung: the generic plugin stuff is really hard to make work with existing code | 02:23 |
| jamielennox | i'm playing with that myself now | 02:23 |
| *** rushiagr_away is now known as rushiagr | 02:23 | |
| jamielennox | i just deprecated half the options to auth_token middleware :) | 02:23 |
| ayoung | jamielennox, what is the pain point | 02:23 |
| jamielennox | including some that i only recently added | 02:24 |
| ayoung | that should read | 02:24 |
| ayoung | jamielennox, what are the pain points cuz I'm sure there is more than one | 02:24 |
| jamielennox | oh, you mean the version independant stuff? | 02:24 |
| jamielennox | yea that should be good | 02:24 |
| jamielennox | i was thinking of the load generic plugins from a CONF file | 02:24 |
| jamielennox | load any plugin from a CONF file | 02:24 |
| *** shakayumi has joined #openstack-keystone | 02:25 | |
| ayoung | jamielennox, BTW, I kindof need a way to confim a login for a session/auth_plugin pair. Does it make sense to do that via the "list_projects" call? The old code did it as two calls... | 02:26 |
| ayoung | but now you delay authentication until Keystone makes some other call. | 02:26 |
| jamielennox | ayoung: if you call get_token() it will force an auth | 02:27 |
| ayoung | yeah. | 02:27 |
| jamielennox | if it's already authed it will return the cached one | 02:27 |
| ayoung | It would be nice if authenticate returned the set of projects. | 02:27 |
| *** dims has quit IRC | 02:27 | |
| jamielennox | authenticate? | 02:27 |
| ayoung | would turn it into a single call | 02:27 |
| jamielennox | like unscoped token? | 02:27 |
| ayoung | POST /v3/auth | 02:27 |
| *** dims has joined #openstack-keystone | 02:27 | |
| ayoung | POST /v3/auth/tokens | 02:27 |
| jamielennox | i had thought about that | 02:27 |
| *** shakamunyi has quit IRC | 02:28 | |
| ayoung | doesn't need to be in the token, just in the response body | 02:28 |
| ayoung | list of domains would probably make sense, too, if user can get a domain scoped token | 02:28 |
| jamielennox | ayoung: we need to make a better distincition then that not everything in the response body form /auth/tokens is in the actual token | 02:28 |
| ayoung | yep | 02:29 |
| jamielennox | ayoung: well the calls are available there now, the auth-specific-data patch is on gate | 02:29 |
| ayoung | jamielennox, there is acutally no reason that they have to be at all related. | 02:29 |
| jamielennox | so it's just take that code and include it in the response | 02:29 |
| ayoung | jamielennox, with auth-specific data, can I call that without a token, and get back a token? | 02:30 |
| jamielennox | no | 02:30 |
| ayoung | like, if I post to /v3/auth/projects? | 02:30 |
| ayoung | damn | 02:30 |
| ayoung | that would be cool | 02:30 |
| jamielennox | would break the federation use | 02:30 |
| ayoung | POST? I didn't think it would do anything on POST? | 02:30 |
| *** alexiz has joined #openstack-keystone | 02:30 | |
| jamielennox | oh | 02:31 |
| jamielennox | yea, you're right | 02:31 |
| ayoung | maybe the rule is that if you post to anything under /auth/ you can get back a token | 02:31 |
| jamielennox | i think i would -1 having post to /v3/auth/projects, but i like the projects and domains as part of the unscoped token response | 02:31 |
| jamielennox | because it's almost always going to be the very next thing you do | 02:32 |
| jamielennox | + a service catalog | 02:32 |
| ayoung | what would be cool is posting to /v3/auth/projects/<projectid> with an empty auth body and basic-auth, and getting back a scoped token | 02:32 |
| ayoung | or supporting form auth that way | 02:33 |
| jamielennox | i think the key will be making auth discoverable, that way you could put it in an extension or whereever you like | 02:33 |
| ayoung | but, yeah, I suggested returning projects/domains to you before and you didn't seem so keen on it. You've come around, or was I not clear? | 02:33 |
| jamielennox | ayoung: i don't know, can't remember what my problem with it last time was | 02:34 |
| ayoung | so GET /v3/auth could return the set of suburls for different auth methods | 02:34 |
| ayoung | like /v3/auth/krb /v3/auth/password /v3/auth/saml .... | 02:34 |
| *** shakayumi has quit IRC | 02:34 | |
| jamielennox | krb - yes, saml would probably have to point to /OS-FEDERATION/identity_providers/ | 02:35 |
| jamielennox | is /password basic or methods = ['password']? | 02:35 |
| *** dims has quit IRC | 02:35 | |
| *** dims has joined #openstack-keystone | 02:36 | |
| ayoung | password would be current password. | 02:37 |
| ayoung | basic could be a separate plugin as well. | 02:38 |
| *** amerine has joined #openstack-keystone | 02:38 | |
| ayoung | thing is, it is an interesting dance between what happens in wsgi and what is provided by HTTPD | 02:38 |
| jamielennox | ayoung: does that go instead of methods=['password']? | 02:38 |
| ayoung | nah, this would be used to discover where to go for a given mechanism | 02:39 |
| jamielennox | i have a real problem at the moment with anything that is duplicated between body and URI | 02:39 |
| ayoung | and to see what mechanisms a given keystone server supported | 02:39 |
| jamielennox | for example finding data about the logged in user and needing to specify the user_id on the URI | 02:39 |
| jamielennox | then somewhere in policy we check that uri user_id == token user_id | 02:39 |
| jamielennox | if it's in the token it should not need to be on the cmdline | 02:40 |
| *** dims has quit IRC | 02:40 | |
| jamielennox | s/cmdline/uri | 02:40 |
| *** hrybacki has quit IRC | 02:40 | |
| *** RicoLin has quit IRC | 02:40 | |
| *** RicoLin has joined #openstack-keystone | 02:41 | |
| *** harlowja_ is now known as harlowja_away | 02:42 | |
| ayoung | yeah, that one has come up a couple times | 02:45 |
| *** amerine has quit IRC | 02:49 | |
| ayoung | jamielennox, how do you feel about the state of https://review.openstack.org/#/c/81147/ ? | 02:54 |
| *** RicoLin has quit IRC | 02:56 | |
| jamielennox | ayoung: i don't think it'll pass review because there are no tests for the token one | 02:56 |
| ayoung | hmmm | 02:57 |
| ayoung | can I cherry pick that one? | 02:57 |
| *** RicoLin has joined #openstack-keystone | 02:57 | |
| ayoung | I guess I need the two before it in series | 02:57 |
| jamielennox | you'll need https://review.openstack.org/#/c/107570/13 as well | 02:57 |
| *** jeffrey4l has quit IRC | 02:58 | |
| jamielennox | the default values one is fine | 02:58 |
| jamielennox | i can't even remember why it's in that series | 02:58 |
| jamielennox | oh, because i was using that to mess with the shell stuff | 02:58 |
| *** cjellick has joined #openstack-keystone | 03:01 | |
| *** cjellick has joined #openstack-keystone | 03:02 | |
| *** KanagarajM has joined #openstack-keystone | 03:19 | |
| *** stevemar has joined #openstack-keystone | 03:19 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Add v3scopedsaml entry to the setup.cfg. https://review.openstack.org/110770 | 03:25 |
| *** chandankumar has joined #openstack-keystone | 03:27 | |
| *** hrybacki has joined #openstack-keystone | 03:32 | |
| *** amerine has joined #openstack-keystone | 03:39 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Convert authentication into a plugin https://review.openstack.org/115857 | 03:43 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Create a custom session object for retries https://review.openstack.org/115858 | 03:43 |
| *** chandankumar has quit IRC | 03:44 | |
| *** gokrokve has quit IRC | 03:51 | |
| *** shakamunyi has joined #openstack-keystone | 03:54 | |
| *** alexiz has quit IRC | 03:57 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:00 | |
| *** amirosh has joined #openstack-keystone | 04:04 | |
| *** hrybacki has quit IRC | 04:05 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 04:19 |
| *** praneshp has joined #openstack-keystone | 04:22 | |
| praneshp | dolphm: you around? | 04:22 |
| praneshp | dolphm: How do I get to the bp for https://github.com/openstack/keystone/commit/ec995b33763f99755e8512e0e0aa497c01e37449 | 04:23 |
| praneshp | launchpad search seems to return nothing | 04:24 |
| *** stevemar has quit IRC | 04:26 | |
| *** alex_xu has quit IRC | 04:31 | |
| *** gokrokve has joined #openstack-keystone | 04:36 | |
| morganfainberg | praneshp, https://blueprints.launchpad.net/keystone/+spec/role-assignments-unified-sql but fyi that blueprint is marked as completed, if there are missing items it would need to be either a bug or some other bp | 04:38 |
| morganfainberg | praneshp, i found it by searching for it under the icehouse release | 04:38 |
| praneshp | morganfainberg: np, thanks | 04:38 |
| praneshp | morganfainberg: correct, I did a generic google search and found it | 04:38 |
| praneshp | clicking the bp link on the review didn’t help | 04:39 |
| morganfainberg | https://blueprints.launchpad.net/keystone/icehouse | 04:39 |
| morganfainberg | yeah because the default is master / juno development, and the search only works for specific releases | 04:39 |
| praneshp | morganfainberg: no new bugs, an old internal patch of ours broke because of the changes there | 04:39 |
| praneshp | and I want to find out how to change our patch to match the changes | 04:39 |
| *** cjellick_ has joined #openstack-keystone | 04:47 | |
| *** cjellick has quit IRC | 04:50 | |
| *** cjellick_ has quit IRC | 04:51 | |
| *** rushiagr is now known as rushiagr_away | 04:58 | |
| *** rushiagr_away is now known as rushiagr | 05:01 | |
| *** rushiagr is now known as rushiagr_away | 05:01 | |
| *** amerine has quit IRC | 05:04 | |
| *** RicoLin has quit IRC | 05:08 | |
| *** RicoLin has joined #openstack-keystone | 05:08 | |
| openstackgerrit | A change was merged to openstack/keystone: Fixing simple type in comment https://review.openstack.org/115429 | 05:13 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Auth plugin serialization https://review.openstack.org/113163 | 05:15 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 05:16 |
| *** alex_xu has joined #openstack-keystone | 05:23 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 05:25 |
| *** chandankumar has joined #openstack-keystone | 05:25 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Move fake session to HTTPClient https://review.openstack.org/108868 | 05:29 |
| *** ncoghlan_afk is now known as ncoghlan | 05:34 | |
| *** shakamunyi has quit IRC | 05:37 | |
| *** tomoiaga has joined #openstack-keystone | 05:43 | |
| *** tomoiaga has left #openstack-keystone | 05:43 | |
| openstackgerrit | A change was merged to openstack/keystone: Allow LDAP lock attributes to be used as enable attributes https://review.openstack.org/104408 | 05:43 |
| openstackgerrit | A change was merged to openstack/keystone: Create authentication specific routes https://review.openstack.org/114903 | 05:43 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Unsort pbr and hacking in requirements files https://review.openstack.org/114707 | 05:46 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Remove cruft from setup.cfg https://review.openstack.org/114708 | 05:46 |
| *** cjellick has joined #openstack-keystone | 05:48 | |
| *** ajayaa has joined #openstack-keystone | 05:55 | |
| *** cjellick has quit IRC | 05:56 | |
| *** gokrokve_ has joined #openstack-keystone | 06:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| *** gokrokve has quit IRC | 06:08 | |
| *** gokrokve_ has quit IRC | 06:09 | |
| *** amerine has joined #openstack-keystone | 06:14 | |
| *** rushiagr_away is now known as rushiagr | 06:20 | |
| *** k4n0 has joined #openstack-keystone | 06:25 | |
| *** mflobo has joined #openstack-keystone | 06:39 | |
| *** ukalifon has joined #openstack-keystone | 06:45 | |
| *** amerine has quit IRC | 06:49 | |
| *** afazekas is now known as __afazekas | 06:55 | |
| *** topol has quit IRC | 07:03 | |
| *** shakamunyi has joined #openstack-keystone | 07:04 | |
| *** shakamunyi has quit IRC | 07:08 | |
| *** afazekas has joined #openstack-keystone | 07:18 | |
| *** afazekas has quit IRC | 07:18 | |
| *** ajayaa has quit IRC | 07:20 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 07:23 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 07:23 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Routes for Keystone-IdP metadata endpoint. https://review.openstack.org/115883 | 07:23 |
| *** marekd|away is now known as marekd | 07:26 | |
| *** ncoghlan has quit IRC | 07:29 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Generate IdP Metadata with keystone-manage. https://review.openstack.org/115564 | 07:31 |
| *** ajayaa has joined #openstack-keystone | 07:42 | |
| *** afazekas has joined #openstack-keystone | 07:43 | |
| *** aix has joined #openstack-keystone | 07:53 | |
| *** henrynash has joined #openstack-keystone | 08:10 | |
| *** BAKfr has joined #openstack-keystone | 08:22 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 08:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 08:22 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Correct the signature for some catlog abstract method signatures. https://review.openstack.org/115895 | 08:31 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Correct the signature for some catalog abstract method signatures. https://review.openstack.org/115895 | 08:32 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 08:43 |
| *** aix has quit IRC | 08:46 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 08:47 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 08:47 |
| *** praneshp has quit IRC | 08:53 | |
| *** mrmoje has joined #openstack-keystone | 08:55 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Distinguish between name not provided and incorrect https://review.openstack.org/115903 | 08:58 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 09:24 |
| *** ajayaa has quit IRC | 09:24 | |
| *** aix has joined #openstack-keystone | 09:24 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 09:34 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 09:36 |
| *** ajayaa has joined #openstack-keystone | 09:38 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Generate IdP Metadata with keystone-manage. https://review.openstack.org/115564 | 09:39 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Routes for Keystone-IdP metadata endpoint. https://review.openstack.org/115883 | 09:43 |
| *** mrmoje_ has joined #openstack-keystone | 09:54 | |
| *** mrmoje has quit IRC | 09:56 | |
| *** henrynash has quit IRC | 10:27 | |
| *** topol has joined #openstack-keystone | 10:59 | |
| *** topol_ has joined #openstack-keystone | 11:00 | |
| *** topol has quit IRC | 11:03 | |
| *** topol_ has quit IRC | 11:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 11:14 |
| *** mikedillion has joined #openstack-keystone | 11:18 | |
| *** yasukun has joined #openstack-keystone | 11:19 | |
| *** dims has joined #openstack-keystone | 11:20 | |
| *** dims has quit IRC | 11:20 | |
| *** RicoLin has quit IRC | 11:20 | |
| *** RicoLin has joined #openstack-keystone | 11:20 | |
| *** dims has joined #openstack-keystone | 11:20 | |
| *** diegows has joined #openstack-keystone | 11:31 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/102244 | 11:32 |
| *** mikedillion has quit IRC | 11:35 | |
| openstackgerrit | Kanagaraj Manickam proposed a change to openstack/keystone: endpoint table is missing reference to region table https://review.openstack.org/113183 | 11:42 |
| *** afaranha has joined #openstack-keystone | 11:45 | |
| *** hrybacki has joined #openstack-keystone | 11:49 | |
| *** KanagarajM has quit IRC | 11:54 | |
| *** hrybacki has quit IRC | 11:54 | |
| *** hrybacki has joined #openstack-keystone | 11:59 | |
| BAKfr | I've a question about the method delete_grant in assignment/core.py https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L527 | 12:01 |
| BAKfr | When we revoke a role on a specific project, all tokens of concerned users are revoked. | 12:01 |
| BAKfr | Is there a reason the code doesn't revoke only tokens associated to the project ? | 12:02 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 12:05 |
| *** diegows has quit IRC | 12:16 | |
| *** wanghong has quit IRC | 12:29 | |
| *** wanghong has joined #openstack-keystone | 12:33 | |
| *** hrybacki has quit IRC | 12:40 | |
| *** yasukun has quit IRC | 12:47 | |
| *** radez_g0n3 is now known as radez | 12:48 | |
| *** dims has quit IRC | 12:54 | |
| *** dims has joined #openstack-keystone | 12:54 | |
| *** cjellick has joined #openstack-keystone | 12:54 | |
| *** aix has quit IRC | 12:57 | |
| *** cjellick has quit IRC | 12:59 | |
| *** xianghuihui has joined #openstack-keystone | 13:06 | |
| *** gordc has joined #openstack-keystone | 13:08 | |
| *** xianghui has quit IRC | 13:09 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 routers to store basic resource description https://review.openstack.org/111573 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Provide the V3 routers to the V3 extension controller https://review.openstack.org/111574 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 version controller to provide JSON Home response https://review.openstack.org/111575 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change V3 router classes to provide JSON Home data https://review.openstack.org/111576 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extensions to provide JSON Home data https://review.openstack.org/103983 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the sub-routers to provide JSON Home data https://review.openstack.org/111577 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change OS-INHERIT extension to provide JSON Home data https://review.openstack.org/111578 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance V3 extension class to integrate JSON Home data https://review.openstack.org/111579 | 13:10 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Enhance GET /v3 to handle Accept header https://review.openstack.org/115462 | 13:10 |
| *** xianghui has joined #openstack-keystone | 13:10 | |
| *** henrynash has joined #openstack-keystone | 13:11 | |
| *** xianghui has quit IRC | 13:12 | |
| *** xianghui has joined #openstack-keystone | 13:12 | |
| *** xianghuihui has quit IRC | 13:13 | |
| *** ajayaa has quit IRC | 13:13 | |
| *** richm has joined #openstack-keystone | 13:14 | |
| *** jasondotstar has joined #openstack-keystone | 13:19 | |
| *** nkinder has quit IRC | 13:20 | |
| *** bknudson has quit IRC | 13:20 | |
| *** openstackgerrit has quit IRC | 13:21 | |
| *** topol has joined #openstack-keystone | 13:22 | |
| *** henrynash has quit IRC | 13:26 | |
| *** henrynash has joined #openstack-keystone | 13:26 | |
| henrynash | anyone have a good understanding of how/if (currently) peope link endpoints to regions in keystone? | 13:27 |
| *** radez is now known as radez_g0n3 | 13:43 | |
| *** bknudson has joined #openstack-keystone | 13:44 | |
| *** jdennis has quit IRC | 13:46 | |
| *** jdennis has joined #openstack-keystone | 13:48 | |
| *** jamielennox is now known as jamielennox|away | 13:48 | |
| *** diegows has joined #openstack-keystone | 13:52 | |
| *** k4n0 has quit IRC | 13:55 | |
| *** openstackgerrit has joined #openstack-keystone | 13:58 | |
| *** gokrokve has joined #openstack-keystone | 14:01 | |
| *** nkinder has joined #openstack-keystone | 14:05 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: ldap/core deleteTree not always supported https://review.openstack.org/74897 | 14:08 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: ldap/core deleteTree not always supported https://review.openstack.org/74897 | 14:13 |
| *** topol_ has joined #openstack-keystone | 14:14 | |
| dstanek | richm: ^ | 14:16 |
| *** topol has quit IRC | 14:16 | |
| *** topol_ is now known as topol | 14:17 | |
| *** mrmoje_ has quit IRC | 14:17 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 14:18 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 14:18 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 14:18 |
| *** mrmoje has joined #openstack-keystone | 14:19 | |
| *** aix has joined #openstack-keystone | 14:20 | |
| *** david-lyle has joined #openstack-keystone | 14:21 | |
| *** raildo has joined #openstack-keystone | 14:24 | |
| marekd | gyee: hello | 14:28 |
| *** stevemar has joined #openstack-keystone | 14:28 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 14:28 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add parent_project_id field https://review.openstack.org/111840 | 14:28 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 14:28 |
| *** mrmoje has quit IRC | 14:29 | |
| *** rushiagr is now known as rushiagr_away | 14:30 | |
| marekd | gyee: i cant remember - did you postpone your x509 auth plugin for K release? | 14:30 |
| *** henrynash has quit IRC | 14:38 | |
| openstackgerrit | Kanagaraj Manickam proposed a change to openstack/keystone: endpoint table is missing reference to region table https://review.openstack.org/113183 | 14:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 14:40 |
| dstanek | stevemar: ping | 14:40 |
| stevemar | dstanek, pong | 14:40 |
| *** bknudson has left #openstack-keystone | 14:40 | |
| *** bknudson has joined #openstack-keystone | 14:40 | |
| stevemar | apparently I missed some eventful stuff yesterday | 14:41 |
| dstanek | stevemar: do you think what i did made sense? | 14:41 |
| stevemar | dstanek, the only issue i have is the user_id attribute | 14:41 |
| dstanek | stevemar: yesterday is ancient history in OpenStack terms | 14:41 |
| dstanek | marekd: i don't see it here https://gist.github.com/dolph/651c6a1748f69637abd0 | 14:42 |
| dstanek | stevemar: how do you mean? | 14:42 |
| stevemar | dstanek, i'll show you a pastie of why i don't like user_id | 14:42 |
| dstanek | stevemar: k | 14:42 |
| stevemar | dstanek, http://paste.openstack.org/show/98201/ | 14:43 |
| dstanek | yeah, i can see that being confusing | 14:44 |
| dstanek | what about target_user and target_group? | 14:44 |
| stevemar | actor* | 14:44 |
| dstanek | ...or that :-) | 14:45 |
| dstanek | user_actor/group_actor? | 14:45 |
| stevemar | dstanek, i was also thinking of placing it at the event level instead of the initiator level | 14:45 |
| dstanek | stevemar: i'd be OK with anything because I don't really understand the systems that use this data | 14:46 |
| stevemar | dstanek, so it would look like this | 14:47 |
| stevemar | http://paste.openstack.org/show/98202/ | 14:47 |
| dstanek | stevemar: that's what i was hoping to get yesterday. "this is where the data goes and what it should be called because that easiest for auditors or is inline with the spec." | 14:47 |
| dstanek | stevemar: what does that target block represent? | 14:48 |
| stevemar | dstanek, apparently we just declare it once: target=resource.Resource(typeURI=taxonomy.ACCOUNT_USER), | 14:50 |
| stevemar | and never change it | 14:50 |
| stevemar | i think it means a 'security' event happened | 14:51 |
| stevemar | other values would be compute or volume | 14:51 |
| *** hrybacki has joined #openstack-keystone | 14:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 14:55 |
| *** ayoung has quit IRC | 14:55 | |
| dstanek | i think the typeURI is throwing me off. is there a list of those? | 14:57 |
| *** ukalifon2 has joined #openstack-keystone | 14:57 | |
| dstanek | stevemar: yesterday mrutkows was refering to an OpenStack spec for CADF - do you know where that lives? | 14:57 |
| *** ukalifon has quit IRC | 14:58 | |
| *** gokrokve_ has joined #openstack-keystone | 15:01 | |
| *** ayoung has joined #openstack-keystone | 15:03 | |
| stevemar | dstanek, no idea to both your questions | 15:04 |
| *** gokrokve_ has quit IRC | 15:04 | |
| *** gokrokve has quit IRC | 15:05 | |
| *** gokrokve_ has joined #openstack-keystone | 15:05 | |
| *** mikedillion has joined #openstack-keystone | 15:05 | |
| stevemar | your second statement sounds like a mini spec of a spec | 15:05 |
| dstanek | stevemar: "CADF spec", "OpenStack profile" and "OpenStack spec" were talked about yesterday - but i have no idea where the OpenStack things are defined (maybe topol knows?) | 15:14 |
| *** henrynash has joined #openstack-keystone | 15:14 | |
| *** vhoward has joined #openstack-keystone | 15:14 | |
| dstanek | stevemar: feels like we can't get audit right without understanding how it will be used | 15:15 |
| *** cjellick has joined #openstack-keystone | 15:16 | |
| henrynash | anyone have a good understanding of how/if (currently) peope link endpoints to regions in keystone? | 15:17 |
| topol | dstanek, stevemar, please connect with mrutkowski. he can explain where all the profiles are and how things are used | 15:17 |
| dstanek | topol: i asked yesterday :-( | 15:17 |
| topol | dtsanek, what did you ask yesterday? | 15:17 |
| dstanek | where to find the specs/profile for OpenStack | 15:18 |
| dstanek | starting to read http://www.dmtf.org/standards/cadf now to get an overview | 15:18 |
| topol | dstanek, did you see this? | 15:19 |
| topol | https://wiki.openstack.org/w/images/e/e1/Introduction_to_Cloud_Auditing_using_CADF_Event_Model_and_Taxonomy_2013-10-22.pdf | 15:19 |
| henrynash | gyee: ping | 15:20 |
| topol | dstanek or https://wiki.openstack.org/wiki/Ceilometer/blueprints/support-standard-audit-formats | 15:20 |
| dstanek | topol: no, but that looks like a lot of good information | 15:20 |
| dstanek | topol: that one looks good too - reading over the usecase pdf now | 15:21 |
| henrynash | bknudson: ping | 15:21 |
| *** rwsu has quit IRC | 15:23 | |
| *** cjellick has quit IRC | 15:23 | |
| *** cjellick has joined #openstack-keystone | 15:24 | |
| *** henrynash has quit IRC | 15:26 | |
| *** gokrokve_ has quit IRC | 15:27 | |
| bknudson | I was too slow | 15:27 |
| *** gokrokve has joined #openstack-keystone | 15:27 | |
| *** afazekas has quit IRC | 15:29 | |
| *** gokrokve has quit IRC | 15:32 | |
| *** chandankumar has quit IRC | 15:36 | |
| *** rwsu has joined #openstack-keystone | 15:39 | |
| *** KanagarajM2 has joined #openstack-keystone | 15:41 | |
| *** amirosh has quit IRC | 15:44 | |
| *** amirosh has joined #openstack-keystone | 15:45 | |
| *** amirosh has quit IRC | 15:49 | |
| *** hrybacki has quit IRC | 15:50 | |
| dolphm | dstanek: have time to investigate the failures here? https://review.openstack.org/#/c/115941/ https://review.openstack.org/#/c/115947/ all the failed jobs are the same & look legit | 15:53 |
| dstanek | stevemar: after browsing the spec (specifically table 3 in section 4.2) it seems that the components are supposed to differentiate type..maybe...messing around i came up with http://paste.openstack.org/show/98239/ | 15:54 |
| dstanek | stevemar: i still don't understand the context behind most of that | 15:54 |
| dstanek | dolphm: sure | 15:54 |
| stevemar | dstanek, action eh | 15:55 |
| dolphm | dstanek: ooh, i bet tempest needs the tox fix before keystone | 15:55 |
| dolphm | dstanek: nevermind, i bet that's exactly what it is https://review.openstack.org/#/c/115963/ | 15:56 |
| stevemar | dstanek, i'd argue that inherited goes under action too | 15:56 |
| dstanek | stevemar: probably, because that's metadata about the grant right? | 15:57 |
| stevemar | yes | 15:57 |
| dstanek | dolphm: yeah, i'll wait then until we know for sure there's an issue | 15:58 |
| *** mikedillion has quit IRC | 15:58 | |
| stevemar | dstanek, not sure if the typeURI you have there is valid | 15:58 |
| *** gyee_ has joined #openstack-keystone | 15:59 | |
| stevemar | also, the spec makes it seem like action is usually just a string, not dict | 15:59 |
| *** mikedillion has joined #openstack-keystone | 16:00 | |
| *** aix has quit IRC | 16:00 | |
| *** dguitarbite has quit IRC | 16:01 | |
| *** topol has quit IRC | 16:02 | |
| *** topol has joined #openstack-keystone | 16:03 | |
| dstanek | stevemar: yeah...check out B3 | 16:03 |
| *** ukalifon2 has quit IRC | 16:03 | |
| *** stevemar has quit IRC | 16:05 | |
| dstanek | stevemar: interesting..B.3.2 seems to recommend multiple events for our scenario | 16:06 |
| *** stevemar has joined #openstack-keystone | 16:06 | |
| stevemar | dstanek, B3? | 16:07 |
| dstanek | http://www.dmtf.org/sites/default/files/standards/documents/DSP0262_1.0.0.pdf | 16:07 |
| dstanek | "Multi-target events" | 16:07 |
| *** praneshp has joined #openstack-keystone | 16:08 | |
| *** aix has joined #openstack-keystone | 16:13 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Revoke by Audit Id / Audit Id Chain instead of expires https://review.openstack.org/114864 | 16:21 |
| *** aix has quit IRC | 16:21 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Update AuthContextMiddleware to not use token_api https://review.openstack.org/113429 | 16:22 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Add __repr__ to KeystoneToken model https://review.openstack.org/113430 | 16:22 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove trust dependency on token_api https://review.openstack.org/109462 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove SAML2 plugin dependency on token_api https://review.openstack.org/115012 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity_api dependency on token_api https://review.openstack.org/115045 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove wsgi and base controller dependency on token_api https://review.openstack.org/115205 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Notification Constant Cleanup and internal notify type https://review.openstack.org/115337 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove assignment_api dependency on token_api https://review.openstack.org/115338 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove oauth controller dependency on token_api https://review.openstack.org/115343 | 16:23 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Mark methods on token_api deprecated https://review.openstack.org/115347 | 16:23 |
| *** andreaf has joined #openstack-keystone | 16:24 | |
| *** andreaf has quit IRC | 16:24 | |
| *** andreaf has joined #openstack-keystone | 16:25 | |
| *** andreaf has quit IRC | 16:25 | |
| *** gokrokve has joined #openstack-keystone | 16:26 | |
| *** marcoemorais has joined #openstack-keystone | 16:28 | |
| *** amerine has joined #openstack-keystone | 16:33 | |
| *** BAKfr has quit IRC | 16:34 | |
| *** dims_ has joined #openstack-keystone | 16:38 | |
| dstanek | morganfainberg: it looks like something happened to you rebase - https://review.openstack.org/#/c/113430/ | 16:40 |
| *** dims has quit IRC | 16:40 | |
| bambam1 | Hello, does anybody know if I have to enable something to get the list of users using the v2 REST API?? I can't pass a 400 'Bad Request' error and i'm querying this path /v2.0/users | 16:44 |
| ayoung | stevemar, bknudson have either of you guys looked at Henrynash's endpoint backend patch? His commit message has this in it: | 16:51 |
| ayoung | This patch needs to be re-based on the patch to formally link endpoint region_id to the region table, | 16:51 |
| ayoung | does that imply that his patch should be rebased, or just that without it, it is missing some functionality? | 16:51 |
| ayoung | I have a rebased version I can submit, but don't know if it will mess him up | 16:52 |
| stevemar | ayoung, let me take a look | 16:52 |
| stevemar | ayoung, i think his works depends on that other patch | 16:58 |
| ayoung | stevemar, then I'll post | 16:58 |
| ayoung | it rebases cleanly | 16:58 |
| *** hrybacki has joined #openstack-keystone | 16:59 | |
| stevemar | cause the other patch adds an endpoint column to the region table | 16:59 |
| *** dguitarbite has joined #openstack-keystone | 17:00 | |
| stevemar | ayoung, i can't figure out why henry mentions rebasing, the two seem separate | 17:02 |
| ayoung | stevemar, yeah. I was confused by that, too | 17:03 |
| morganfainberg | dstanek, doh! | 17:04 |
| morganfainberg | dstanek, i think jgit got cranky | 17:04 |
| morganfainberg | or.. something merged and invalidated the whole tree | 17:04 |
| morganfainberg | yep. | 17:05 |
| morganfainberg | dstanek, ok i think i'm stuck again until things merge or i kick them out of check/gate. | 17:07 |
| morganfainberg | dstanek, since i can't fix without rebasing the whole chain | 17:07 |
| *** Jean-Daniel has quit IRC | 17:09 | |
| bknudson | seems like jenkins is notifying us of merge conflicts in existing reviews whenever something merges now. | 17:09 |
| morganfainberg | bknudson, yeah it's because everyone is touching the same sections of code :P | 17:11 |
| dstanek | well you guys should stop that :-P | 17:12 |
| dstanek | that's probably why i feel like i'm reviewing the same thing over and over | 17:13 |
| morganfainberg | dstanek, either that or you're stuck in a loop and really are reviewing the same things over and over | 17:13 |
| dstanek | morganfainberg: that's also true - i'd like to get a lot of this stuff merged so that i don't have to see it anymore | 17:14 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Base methods to handle hierarchical projects https://review.openstack.org/111841 | 17:14 |
| morganfainberg | so slightly related | 17:14 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 17:14 |
| morganfainberg | hm. nvm | 17:15 |
| morganfainberg | i think i'm gonna go get breakfast before it gets too late | 17:15 |
| *** amirosh has joined #openstack-keystone | 17:15 | |
| *** RicoLin has quit IRC | 17:22 | |
| *** amirosh has quit IRC | 17:23 | |
| *** amirosh has joined #openstack-keystone | 17:24 | |
| *** harlowja_away is now known as harlowja_ | 17:25 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: backend for policy endpoint extension https://review.openstack.org/115362 | 17:28 |
| *** amirosh has quit IRC | 17:28 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone: controller for the endpoint policy extension https://review.openstack.org/115746 | 17:29 |
| ayoung | stevemar, does that look right to you? | 17:29 |
| morganfainberg | dolphm, ping | 17:30 |
| stevemar | ayoung, i suppose, but you've just added another review for me :( | 17:30 |
| morganfainberg | dolphm, did we want to push through dstanek's stable/icehouse fixes for catalog still (just noticed they've been lingering around for a bit) - beyond stable needing more people to review was there a reason? | 17:31 |
| *** hrybacki has quit IRC | 17:31 | |
| ayoung | stevemar, blue on black, tears on a river.... | 17:31 |
| ayoung | "Like adding Frost to Snow" | 17:31 |
| dolphm | morganfainberg: link? | 17:31 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/111519/4 this chain | 17:31 |
| morganfainberg | it's the v3 catalog 500 error | 17:31 |
| stevemar | ayoung, woe is me! | 17:32 |
| * morganfainberg has +2 on stable now, so... can help get these things in. | 17:32 | |
| dolphm | morganfainberg: yes, but just icehouse | 17:32 |
| morganfainberg | right | 17:32 |
| morganfainberg | ok i'm looking over the chain it's looking good. if i don't see anything i'll press go on it. (actually, *eyes gate* maybe i'll press go tonight when things calm down) | 17:32 |
| *** chandankumar has joined #openstack-keystone | 17:34 | |
| morganfainberg | dolphm, unrelated, i should have the V3 "validate pki tokens like auth_token does" bits done today but the v2 version of that is going to be a lot more work because v2 validate/issue are less friendly | 17:35 |
| morganfainberg | maybe ... maybe we should only issue v3 tokens and make validate/issue v2 do an explicit conversion to the v2 format. | 17:35 |
| morganfainberg | (something at the controller level) | 17:35 |
| dolphm | morganfainberg: +++++++++++++++++++ | 17:36 |
| morganfainberg | dolphm, ok i'll go down that path, i think i'll be easier than "fixing" v2 issue (it's really bad) | 17:36 |
| *** chandankumar has quit IRC | 17:37 | |
| dstanek | anyone have a chance to look at my comments on the review for endpoint policy association? https://review.openstack.org/#/c/112292/ | 17:40 |
| dstanek | wondering if my "this is not REST" is useful or not | 17:40 |
| *** diegows has quit IRC | 17:41 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens https://review.openstack.org/106838 | 17:41 |
| bknudson | dstanek: if you have a better design for the REST API then that would be interesting to see | 17:42 |
| bknudson | dstanek: but the API presented there is similar to other APIs that already exist in Keystone | 17:42 |
| dstanek | bknudson: nothing beyond my gist | 17:44 |
| bknudson | dstanek: ok, thanks. | 17:45 |
| dstanek | bknudson: https://gist.github.com/dstanek/5d6e4380377bef46c765 | 17:45 |
| bknudson | dstanek: I don't think that what you have there is going to work with the xml translator | 17:46 |
| bknudson | dstanek: might need to do "policy": {"id": "--policy-id--"} | 17:46 |
| dstanek | bknudson: yeah, i think so too. also because it's more like the GET format. | 17:47 |
| dstanek | that way just me doing a quick copy-paste to get the idea out | 17:47 |
| bknudson | dstanek: there's no Link header in http | 17:47 |
| bknudson | dstanek: supposed to be Location ? | 17:48 |
| dstanek | link isn't defined in 2616 it's defined in 5988 | 17:49 |
| bknudson | dstanek: fancy! | 17:49 |
| morganfainberg | dstanek, i agree with your comment,s but i didn't have a better design. | 17:50 |
| morganfainberg | dstanek, bknudson, also documenting HEAD is a bit weird, we should start documenting GET and say "HEAD is also supported" | 17:50 |
| morganfainberg | bknudson, so i agree with your comment a lot :) | 17:51 |
| dstanek | morganfainberg: i think that's a side effect of the original spec only defining HEAD | 17:51 |
| morganfainberg | dstanek, probably | 17:51 |
| *** hrybacki has joined #openstack-keystone | 18:00 | |
| *** mikedillion has quit IRC | 18:05 | |
| *** wanghong has quit IRC | 18:06 | |
| *** amirosh has joined #openstack-keystone | 18:10 | |
| *** morganfainberg is now known as morganfainberg_Z | 18:13 | |
| *** diegows has joined #openstack-keystone | 18:15 | |
| *** radez_g0n3 is now known as radez | 18:17 | |
| *** mrmoje has joined #openstack-keystone | 18:26 | |
| *** mrutkows has joined #openstack-keystone | 18:26 | |
| *** mikedillion has joined #openstack-keystone | 18:28 | |
| *** mikedill_ has joined #openstack-keystone | 18:32 | |
| *** mikedillion has quit IRC | 18:33 | |
| *** mikedill_ has quit IRC | 18:34 | |
| *** mikedillion has joined #openstack-keystone | 18:36 | |
| *** gyee_ has quit IRC | 18:36 | |
| *** ukalifon1 has joined #openstack-keystone | 18:40 | |
| *** bknudson has quit IRC | 18:40 | |
| *** hockeynut has joined #openstack-keystone | 18:42 | |
| stevemar | dstanek, https://gist.github.com/stevemart/c5f52d0592ca6944b3a2 | 18:42 |
| stevemar | dstanek, i think we need to move it from the code, from initiator to the top level event objcet | 18:44 |
| *** radez is now known as radez_g0n3 | 18:45 | |
| *** morganfainberg_Z is now known as morganfainberg | 18:47 | |
| *** radez_g0n3 is now known as radez | 18:53 | |
| KanagarajM2 | dolphm: could you please review https://review.openstack.org/#/c/113183/ Thanks. | 18:56 |
| dolphm | KanagarajM2: it's already near the top of our list of things to do to complete juno-3 https://gist.github.com/dolph/651c6a1748f69637abd0 | 18:59 |
| dstanek | stevemar: that sounds perfect | 19:00 |
| *** praneshp has quit IRC | 19:00 | |
| KanagarajM2 | dolphm: sure thanks. | 19:01 |
| *** mikedillion has quit IRC | 19:05 | |
| dstanek | KanagarajM2: i haven't tried it yet, but does your patch change the responses for listing endpoints? | 19:07 |
| *** amirosh has quit IRC | 19:07 | |
| KanagarajM2 | dstanek: there is no changes made to the REST API lelve | 19:07 |
| *** amirosh has joined #openstack-keystone | 19:08 | |
| *** mikedillion has joined #openstack-keystone | 19:08 | |
| *** harlowja_ has quit IRC | 19:08 | |
| dstanek | KanagarajM2: this was already on my list because Henry has patches based on this that I am interested in | 19:09 |
| KanagarajM2 | dstanek: yes, today discussed with him in detail about my patch | 19:09 |
| KanagarajM2 | dstanek: what is your patch | 19:10 |
| dstanek | KanagarajM2: i don't have any patches for this | 19:11 |
| KanagarajM2 | dstanek: ok | 19:11 |
| *** amirosh has quit IRC | 19:12 | |
| *** praneshp has joined #openstack-keystone | 19:14 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Hash for PKIZ https://review.openstack.org/114654 | 19:14 |
| *** harlowja has joined #openstack-keystone | 19:15 | |
| *** hrybacki has quit IRC | 19:17 | |
| *** harlowja has quit IRC | 19:19 | |
| *** radez is now known as radez_g0n3 | 19:20 | |
| *** morganfainberg has quit IRC | 19:25 | |
| dstanek | KanagarajM2: how will region_id be used in the future? | 19:26 |
| dstanek | KanagarajM2: i'm also a little concerned that the region field won't be output anymore for an endpoint | 19:27 |
| *** morganfainberg has joined #openstack-keystone | 19:27 | |
| *** harlowja has joined #openstack-keystone | 19:28 | |
| *** ukalifon1 has quit IRC | 19:30 | |
| KanagarajM2 | dstanek: with my patch, endpoint['region'] is migrated to endpoint[region_id] | 19:32 |
| dstanek | how would i set that in the REST API? | 19:32 |
| KanagarajM2 | dstanek: in the db level, next step would be make it still API level which is having side effect on the client consuming the endpoint. | 19:33 |
| *** harlowja has quit IRC | 19:34 | |
| KanagarajM2 | dstaneK: i will be submitting a another blueprint for the 2nd step, which may come up for K release | 19:34 |
| dstanek | KanagarajM2: doesn't your migration break all existing endpoints that contain a region entry? i don't see how it would be returned in the API | 19:34 |
| KanagarajM2 | dstanek: in the REST API there is no change made | 19:35 |
| *** harlowja has joined #openstack-keystone | 19:40 | |
| dstanek | KanagarajM2: i was mixing up what your _wrap_* methods do, our current behavior and what the spec says | 19:42 |
| KanagarajM2 | dstanek: could n't get your point, can you please explain in details | 19:44 |
| openstackgerrit | Henrique Truta proposed a change to openstack/python-keystoneclient: Implementing inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 19:44 |
| *** rm_work is now known as rm_work|away | 19:46 | |
| dstanek | KanagarajM2: we don't seem to be returning region_id like it says in the spec http://docs.openstack.org/api/openstack-identity-service/3/content/list-endpoints-get-endpoints.html and your _wrap methods had me confused | 19:47 |
| *** mrutkows has quit IRC | 19:50 | |
| openstackgerrit | Thiago Paiva Brito proposed a change to openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/111842 | 19:53 |
| KanagarajM2 | dstanek: _wrap method is provided to make sure that the current endpoint is not borken at the api level | 19:55 |
| dstanek | KanagarajM2: i think this is actually broken | 19:57 |
| dstanek | endpoint new refers to region.name instead of region.id so if a user takes the endpoint.region and tries to use it as endpoint.id they will run into trouble | 19:57 |
| KanagarajM2 | dstanek: I will look at this tomorrow. | 19:58 |
| dstanek | k, i'll put a note on the review | 19:58 |
| morganfainberg | ugh.... | 20:01 |
| KanagarajM2 | dstanek: before go to bed, let me summarize the change, endpoint[region] will be converted to endpoint[region_id] then region[id] will be haing endpoint[region_id], this will break the keystone client and middleware also, | 20:01 |
| morganfainberg | v2 tokens are a trainwreck :( | 20:01 |
| morganfainberg | we just pull random crap from all over the place shove it into the issue_token method and get something out the other end | 20:02 |
| *** mrmoje has quit IRC | 20:03 | |
| *** wanghong has joined #openstack-keystone | 20:07 | |
| dstanek | dolphm: what is the driver behind making region_id a uuid? | 20:09 |
| dolphm | morganfainberg: ++ | 20:09 |
| dolphm | dstanek: vs user-specified? | 20:09 |
| dstanek | dolphm: yes | 20:09 |
| morganfainberg | dolphm, i'm honestly not sure how this actually works :P | 20:09 |
| morganfainberg | but aparently it does. | 20:10 |
| dolphm | dstanek: just a fallback behavior | 20:10 |
| dolphm | dstanek: backwards compatibility with previously established conventions? | 20:10 |
| dolphm | i.e. not specifying an ID | 20:10 |
| dolphm | morganfainberg: barely | 20:10 |
| dstanek | dolphm: i think that creates a disconnect in the API because the user specified value is no longer the id | 20:11 |
| *** dims has joined #openstack-keystone | 20:15 | |
| dstanek | where does http://docs.openstack.org/api/openstack-identity-service/3/content/list-endpoints-get-endpoints.html get generated from? | 20:17 |
| dstanek | and why is it not the same as http://developer.openstack.org/api-ref-identity-v3.html ? | 20:17 |
| *** dims_ has quit IRC | 20:18 | |
| ayoung | dstanek, can I dynamically create a variable in the local context out of a string? | 20:20 |
| ayoung | I do this all the time: | 20:21 |
| ayoung | try: | 20:21 |
| ayoung | OS_USERNAME = os.environ['OS_USERNAME'] | 20:21 |
| ayoung | for about 5 different variables. I'd like to do it with a loop | 20:21 |
| *** dims has quit IRC | 20:21 | |
| *** dims has joined #openstack-keystone | 20:22 | |
| dstanek | ayoung: not in any good way | 20:22 |
| dstanek | being explicit is almost always better anyway | 20:23 |
| ayoung | dstanek, nah | 20:23 |
| ayoung | :) | 20:23 |
| *** radez_g0n3 is now known as radez | 20:26 | |
| dstanek | ayoung: sometimes you make me sad :-) | 20:31 |
| ayoung | dstanek, I'm going to do this | 20:31 |
| *** morganfainberg is now known as morganfainberg_Z | 20:31 | |
| ayoung | _os·=·Object()$ | 20:31 |
| ayoung | |$ | 20:31 |
| ayoung | |$ | 20:31 |
| ayoung | |try:$ | 20:31 |
| ayoung | |····params·=·['USERNAME',·'PASSWORD',·'AUTH_URL',·'TENANT_NAME']$ | 20:31 |
| ayoung | |····for·p·in·params:$ | 20:31 |
| ayoung | |········setattr(_os·,·p,·os.environ['OS_'+p])$ | 20:31 |
| ayoung | |····except·KeyError·as·e:$ | 20:31 |
| ayoung | |········raise·SystemExit('%s·environment·variables·not·set.'·%·e.message)$ | 20:32 |
| ayoung | AHHH! | 20:32 |
| ayoung | sory for the spew | 20:32 |
| ayoung | I'm usoing emacs in a split view terminal. Of course it did that | 20:32 |
| openstackgerrit | A change was merged to openstack/keystone: Add notifications for policy, region, service and endpoint. https://review.openstack.org/115763 | 20:32 |
| ayoung | dstanek, the alternative is to make a bunch of attributes on the object and use those to generate strings to get the values out of the dictionary. That is more my usual approach to these | 20:33 |
| *** adam_g has joined #openstack-keystone | 20:37 | |
| *** rm_work|away is now known as rm_work | 20:38 | |
| adam_g | trying to debug consistent tempest XML client failures, seem to be pointing to something in keystone. is this error obvious to anyone here? http://paste.ubuntu.com/8109045/ seems to have just crept into the ironic gate just today | 20:39 |
| *** radez is now known as radez_g0n3 | 20:44 | |
| *** wanghong has quit IRC | 20:45 | |
| *** morganfainberg_Z is now known as morganfainberg | 20:47 | |
| dstanek | adam_g: looks like an XML issue? is there anyway to see the XML? | 20:48 |
| dstanek | adam_g: one possible way this could happen is a messed up declaration like: http://paste.ubuntu.com/8109124/ | 20:49 |
| adam_g | dstanek, hmm not able to get at the XML from the archived logs.. trying to reproduce the issue locally. hopefully will have more | 20:51 |
| dstanek | topol: i found a few interesting QRadar videos on YouTube | 20:52 |
| topol | dstanek, this one is short and sweet: | 20:53 |
| topol | http://thoughtsoncloud.com/2014/04/guide-openstack-icehouse-release/ | 20:53 |
| topol | dstanek shows Openstack CADF events triggering alerts in QRadar | 20:54 |
| topol | dstanek its only two mins long | 20:54 |
| *** henrynash has joined #openstack-keystone | 20:55 | |
| henrynash | anyone have a good understanding of how/if (currently) peope link endpoints to regions in keystone? | 20:55 |
| *** hrybacki has joined #openstack-keystone | 20:56 | |
| *** gokrokve has quit IRC | 20:57 | |
| dstanek | topol: very nice | 20:58 |
| topol | dstanek, THANKS | 20:59 |
| dolphm | henrynash: i'm working on a small patch for the endpoint policy API review if you don't mind | 20:59 |
| henrynash | dolphm: sure | 20:59 |
| dolphm | henrynash: also, regarding your question above, have you seen https://review.openstack.org/#/c/113183/ ? | 21:00 |
| topol | dstanek, tools like QRadar allow you to setup rules and triggers and can even use the extra key value pairs you and stevemar were discussing | 21:01 |
| henrynash | dolphm: that was what prompted my question - I was reviewing that patch (and thinking about teh endpoint policy_ | 21:01 |
| henrynash | dolphm: teh assumption made by https://review.openstack.org/#/c/113183/ is that nobody has created any region entites | 21:01 |
| dolphm | henrynash: the short answer is that most people aren't yet, or are doing so very arbitrarily since we don't provide much in the way of structure there | 21:02 |
| henrynash | dolphm: while I had assumed that people would have created region entities with a mtaching ID to the endpoint[‘region’] attribute (kept in sync manually, today) | 21:02 |
| dolphm | henrynash: eek, the migration should take that into account. i think the spec documents all the possible migration scenarios IIRC? | 21:03 |
| henrynash | dolphm: teh migration doesn’t take that into account (at least, I don’t think so)…it will create a new region entity (with a new concealed ID), but with a ‘name’ attribute that has the old ID in it | 21:04 |
| henrynash | dolphm: see my comment at 10:27am on that patch….which describes my worry | 21:04 |
| dolphm | henrynash: regions don't have names :( | 21:05 |
| dolphm | henrynash: they're id + optional description | 21:05 |
| henrynash | dolphm: the do INTERNALLY with this patch, but the name is not exposed | 21:05 |
| dstanek | dolphm: not with this patch | 21:05 |
| dolphm | henrynash: that's... odd | 21:05 |
| dstanek | henrynash: i think the name is exposed where the ID is exposed today which is why i think this breaks the API | 21:05 |
| dolphm | henrynash: also, i'd consider this out of scope for now, but your endpoint policy patch made me remember this: instead of returning the policy immediately on `GET /OS-ENDPOINT-POLICY/endpoints/{endpoint_id}/policy` ... we should 302 to the actual `GET /v3/policies/{policy_id}`. advantages: one resource to cache, one resource to provide real RBAC on, etc | 21:07 |
| henrynash | dolphm, dstanel: oops, yes, sorry the (new) name attribute is exposed | 21:07 |
| dolphm | dstanek: that sounds bad | 21:07 |
| *** elmiko has joined #openstack-keystone | 21:07 | |
| dolphm | dstanek: and not what i recall the spec outlining | 21:08 |
| elmiko | hey folks, are usernames unique within a domain? | 21:08 |
| henrynash | dolphm: interesting…I had thought that it might be good to do something like that.. | 21:08 |
| henrynash | elmiko: yep | 21:08 |
| elmiko | henrynash: thanks! | 21:08 |
| henrynash | dstanek, dolphm: this was how I described my worry with the current approach: | 21:09 |
| henrynash | Prior to this patch, a region has a region_id (which was usually supplied by the caller of create_region()). For an endpoint to be in that region, the endpoint['region'] field contains this region_id. After this patch, the "old region id" will be put in region['name'] and a real (but concealed) uuid region['id] will be created, and the new endpoint['region_id'] will point to it. So far so good. But think of the following sequence (happening | 21:09 |
| henrynash | after this patch is in): | 21:09 |
| henrynash | I read an endpoint, and it looks like it always did (since you have wrapped the get_endpoint() call to re-instate the endpoint['region']). This endpoint['region'] field contains what is (now) in the region['name'] column. | 21:09 |
| henrynash | So as a caller I want to read the region entity for this endpoint...so I do what I always did and call get_region() with the endpoint['region']...and...it fails! Since get_region wants the REAL region_id, which has been concealed. | 21:09 |
| dolphm | that's super overly complicated :( | 21:10 |
| dstanek | henrynash: yeah, that's exactly what i was thinking/saying in my comment | 21:10 |
| henrynash | now it isn’t taht bad as long as nobody has created any region entities before…but I’m not sure we can assuem that | 21:10 |
| dolphm | that patch should primarily just be a sequence of migrations that don't affect the data model other than by making the endpoint region attribute a FK, not a bunch of obfuscated behavior in controllers | 21:11 |
| dolphm | henrynash: we certainly cannot assume that | 21:11 |
| henrynash | i had a long conversation with KanagarajM today on this…..and they are basically assuming no regions before this patch | 21:12 |
| dstanek | dolphm: that's what i was thinking - making the existing region column a fk to the region table | 21:12 |
| henrynash | be back in a bit… | 21:13 |
| *** nkinder has quit IRC | 21:15 | |
| *** bknudson has joined #openstack-keystone | 21:17 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 21:20 |
| dstanek | dolphm, henrynash: i think that spec is flawed | 21:21 |
| dolphm | dstanek: which one? | 21:22 |
| dstanek | http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/juno/endpoint-table-missing-reference-to-region-table.rst | 21:22 |
| *** jasondotstar has quit IRC | 21:27 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/identity-api: Extension for endpoint policy association. https://review.openstack.org/112292 | 21:28 |
| dolphm | henrynash: ^ | 21:28 |
| *** gokrokve has joined #openstack-keystone | 21:28 | |
| morganfainberg | dolphm, i'm sad to say this but i don't know if we'll hit the non-persistent tokens with v2 tokens. | 21:28 |
| dolphm | morganfainberg: it's a LONG road, what's left? | 21:28 |
| morganfainberg | dolphm, reworking all of the v2 validate/check/issue code to not assume random crap is shoved into it all over the place | 21:29 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 21:29 |
| dolphm | morganfainberg: let's land what we can, and suppress the config options for juno? | 21:30 |
| dolphm | whatever doesn't make sense to expose, anyway | 21:30 |
| dolphm | slash, advertise | 21:30 |
| morganfainberg | dolphm, well, i don't think adding the options to go persistentless makes sense. but the rest of the scafolding is in place | 21:30 |
| openstackgerrit | A change was merged to openstack/keystone: Correct the signature for some catalog abstract method signatures. https://review.openstack.org/115895 | 21:31 |
| morganfainberg | dolphm, revocation events should be doable (have to hit middleware with that one), v3 from cms decode should be doable | 21:31 |
| morganfainberg | for pki | 21:31 |
| morganfainberg | provided the long chain of patches i have open lands / doesn't keep getting caught in rebase hell | 21:31 |
| morganfainberg | *most* of the hard work has been done, we now have a very limited path of token validation/check/issue | 21:32 |
| morganfainberg | but the last big hurdle will be the v2 token issue/validate/etc that just assumes we pass junk to it and we can shove that exact junk into the token, which is how we end up with random crap in like token_ref['metadata'] | 21:32 |
| dolphm | dstanek: bknudson: i think i addressed your concerns on https://review.openstack.org/#/c/112292/ cc- henrynash | 21:35 |
| dstanek | dolphm: i still think it's a little funky at the REST API level, but i wouldn't hold things up because of that | 21:36 |
| bknudson | dolphm is not lazy! | 21:36 |
| dolphm | morganfainberg: ack. | 21:36 |
| dolphm | bknudson: ha | 21:37 |
| dolphm | bknudson: i'm lazy quite often | 21:37 |
| *** henrynash has quit IRC | 21:39 | |
| *** hrybacki has quit IRC | 21:40 | |
| stevemar | dolphm, re: the endpoint policy api, shouldn't return something on a GET? | 21:42 |
| *** hrybacki has joined #openstack-keystone | 21:42 | |
| stevemar | also, whats with the random 3 dashes :P | 21:42 |
| *** zzzeek has joined #openstack-keystone | 21:46 | |
| *** hrybacki has quit IRC | 21:47 | |
| dstanek | stevemar: six is third-party | 21:51 |
| dstanek | dolphm: things have to be proposed tonight and in review right? not actually merged | 21:52 |
| dolphm | stevemar: a 204 is fine for that GET | 21:53 |
| dolphm | stevemar: don't *have* to return a body, ever | 21:53 |
| dolphm | stevemar: our HEAD requests have been defined wrongly for awhile. the way the patchset above is now written is how they should all work. support GET first, with a 204 response, and then support HEAD on top of that that has the *exact* same response, but with a guaranteed lack of a response body | 21:54 |
| bknudson | I wonder what apache does if you point it at an empty file. | 21:54 |
| dolphm | bknudson: like, static content apache serving an empty file? | 21:55 |
| bknudson | dolphm: ye | 21:55 |
| bknudson | yes | 21:55 |
| dstanek | bknudson: i would guess 200 | 21:56 |
| bknudson | y, I got 200 OK with Content-Length: 0 | 21:57 |
| bknudson | think of all the bytes they could have saved with a 204 No Content | 21:57 |
| dolphm | lol | 21:57 |
| dolphm | bknudson: wonder if nginx does something different... | 21:58 |
| bknudson | a HEAD request doesn't include the Content-Length. | 21:58 |
| bknudson | but it does if the file isn't empty | 21:58 |
| dolphm | bknudson: well then that's a bit weird | 21:59 |
| bknudson | saving a few bytes, I guess. | 21:59 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Add CADF notifications for role assignment create and delete https://review.openstack.org/112204 | 22:01 |
| dstanek | stevemar: ^ fixed my nit and i think i'm happy now | 22:02 |
| stevemar | dstanek, oops, thanks boss | 22:04 |
| dolphm | bknudson: this is nginx http://pasteraw.com/2u9ah4s6dpfoc0sspscw5nr57ebq97o | 22:05 |
| bknudson | keep-alive by default... risky | 22:06 |
| *** marcoemorais has quit IRC | 22:07 | |
| dolphm | *shrug* on wheezy | 22:07 |
| *** nkinder has joined #openstack-keystone | 22:07 | |
| *** marcoemorais has joined #openstack-keystone | 22:07 | |
| dstanek | dolphm: squid? | 22:07 |
| dolphm | dstanek: i was wondering about that too. i'm at a coffee shop | 22:07 |
| dstanek | odd | 22:08 |
| bknudson | they're sniffing all your traffic | 22:08 |
| bknudson | they're going to wonder why you're downloading 0-byte files | 22:09 |
| *** henrynash has joined #openstack-keystone | 22:09 | |
| *** marcoemorais has quit IRC | 22:09 | |
| bknudson | seems like a bug in httpd to not send the content-length header, the way I read the rfc | 22:10 |
| *** jamielennox|away is now known as jamielennox | 22:10 | |
| *** marcoemorais has joined #openstack-keystone | 22:10 | |
| *** marcoemorais has quit IRC | 22:10 | |
| *** marcoemorais has joined #openstack-keystone | 22:11 | |
| *** marcoemorais has quit IRC | 22:11 | |
| *** marcoemorais has joined #openstack-keystone | 22:11 | |
| *** elmiko is now known as _elmiko | 22:12 | |
| bknudson | the tempest failure on this one is kind of interesting -- http://logs.openstack.org/73/111573/4/check/check-tempest-dsvm-full/c5ce3bd/console.html | 22:12 |
| *** gokrokve_ has joined #openstack-keystone | 22:12 | |
| bknudson | because it's actually keystone... "code": 401, "title": "Unauthorized"}} | 22:12 |
| *** gokrokve has quit IRC | 22:15 | |
| bknudson | the keystone log is horrible now | 22:15 |
| *** kwss has joined #openstack-keystone | 22:17 | |
| henrynash | dolphm: you ok to approve the endpoint policy API? I might go back in after and tweak the position of OS-ENDPOINT-POLICY in the url….but let’s get a baseline in there | 22:18 |
| ayoung | henrynash, did I jump the gun on rebasing your patches? | 22:19 |
| henrynash | ayoung: i doubt it! | 22:19 |
| henrynash | ayoung: just off to look at those | 22:19 |
| ayoung | henrynash, I rebased ontop of the endpoint region patch as you suggested in the comment | 22:19 |
| ayoung | henrynash, that and cleaned up the commit headers lines...removed the comment about rebasing. No code changes | 22:20 |
| henrynash | ayoung:…ahh good…and bad….since I hadn’t done taht yet since I had concerns over that patch…as dolph and I were discussing earlier | 22:20 |
| dstanek | lbragstad: have you worked on the validation stuff recently? | 22:20 |
| dolphm | henrynash: yes to the above | 22:20 |
| henrynash | dolphm: ok | 22:21 |
| henrynash | ayoung: but thanks for doing the rebase!!!! | 22:21 |
| ayoung | henrynash, its easy enough to break the link, but it seems like you are implicitly depending on it. I wanted to ask you how? | 22:22 |
| bknudson | the keystone log doesn't have the request or response line in it anymore... this is going to make things difficult | 22:22 |
| dolphm | henrynash: ooh, don't know if you looked at the diff, but i also added an explanation in parens to one of the first paragraphs | 22:22 |
| henrynash | dolphm: let me check | 22:23 |
| dolphm | henrynash: something about being in descending priority | 22:23 |
| dolphm | henrynash: although really, that behavior is implementation specific and doesn't belong in the API spec *shrug* | 22:23 |
| henrynash | dolphm: ah, yes, nice description. great | 22:23 |
| dolphm | (now that i think about it) | 22:23 |
| bknudson | where would the request / response line be... apache access.log? | 22:24 |
| henrynash | dolphm: ah well | 22:24 |
| dolphm | bknudson: yes | 22:24 |
| bknudson | I don't think the jenkins runs gather that info | 22:24 |
| dolphm | bknudson: i think we still have apache-style access log middleware in conrib | 22:24 |
| *** kwss has quit IRC | 22:25 | |
| henrynash | ayoung: well when I wrote that comment…I was assuming that the region-endpoint patch would change things like endpoint[region] to endpoint[region_id].... | 22:25 |
| henrynash | ayoung: and the CURRENT (and I think concensus view is broken) patch is that although this is happening under teh covers, it’s not exposed at the driver api level | 22:26 |
| ayoung | henrynash, so drop the rebase? | 22:27 |
| ayoung | Or do we need to rework the endpoint region patch regardless? | 22:27 |
| dolphm | henrynash: ++ it should be endpoint['region_id'] | 22:27 |
| henrynash | ayoung: I think we need that rework regardless | 22:27 |
| henrynash | ayoung: we just need to get the design of that patch right | 22:27 |
| dolphm | ayoung: yeah, it needs that reworked and it's only about 60% of the spec implemented | 22:27 |
| dolphm | ayoung: and frankly, i'd want the whole spec in one patch, otherwise things will have wonky (if not broken) behavior | 22:28 |
| ayoung | henrynash, OK, then lets keep it as a strict sequence of patches. | 22:28 |
| morganfainberg | bknudson, if we're missing log info we need to grab it. | 22:28 |
| henrynash | ayoung:++ | 22:28 |
| henrynash | ayoung: so, indeed, thanks for teh rebase! | 22:28 |
| dolphm | bknudson: easy patch to some file buried in infra i'm sure :) | 22:28 |
| morganfainberg | bknudson, if that is captureing another log from apache or whatever, let me know if i can help | 22:28 |
| ayoung | dolphm, and you agree that the endpoint-region one should land before henrynash 's? | 22:28 |
| bknudson | morganfainberg: I'll take a look at it. | 22:29 |
| morganfainberg | bknudson, sounds good | 22:29 |
| dolphm | ayoung: probably, yes | 22:29 |
| ayoung | ok. henrynash let me know if you need a hand. | 22:29 |
| henrynash | ayoung: thx | 22:30 |
| * dolphm kinda want a daemon to give me growl notifications when a review i have starred has any sort of activity | 22:31 | |
| *** marcoemorais has quit IRC | 22:31 | |
| *** marcoemorais has joined #openstack-keystone | 22:31 | |
| *** marcoemorais has quit IRC | 22:31 | |
| *** marcoemorais has joined #openstack-keystone | 22:32 | |
| *** marcoemorais has quit IRC | 22:32 | |
| *** marcoemorais has joined #openstack-keystone | 22:33 | |
| openstackgerrit | A change was merged to openstack/identity-api: Extension for endpoint policy association. https://review.openstack.org/112292 | 22:35 |
| *** topol has quit IRC | 22:36 | |
| *** marcoemorais has quit IRC | 22:36 | |
| *** marcoemorais has joined #openstack-keystone | 22:37 | |
| bknudson | devstack should set up log rotation for /var/log/apache2/keystone | 22:37 |
| *** mrmoje has joined #openstack-keystone | 22:37 | |
| *** hrybacki has joined #openstack-keystone | 22:37 | |
| morganfainberg | dolphm, that'd be cool | 22:41 |
| morganfainberg | dolphm, i pressed go on the stable backports for the catalog stuff (icehouse) | 22:41 |
| morganfainberg | dolphm, they all had recent checks and passed cleanly. | 22:41 |
| bknudson | is there a way to tail -f 2 files? | 22:44 |
| *** ayoung is now known as ayoung-afk | 22:45 | |
| morganfainberg | bknudson, ... i think there is? | 22:45 |
| morganfainberg | bknudson, just put both like: tail -f <file 1> <file2> | 22:45 |
| morganfainberg | ? | 22:45 |
| bknudson | I'll try | 22:45 |
| morganfainberg | looks like it works | 22:46 |
| bknudson | morganfainberg: does it read from both files? | 22:46 |
| morganfainberg | bknudson, it should | 22:46 |
| morganfainberg | bknudson, bknudson http://paste.openstack.org/show/98406/ | 22:47 |
| morganfainberg | bknudson, i did an echo 1 >> to each file there | 22:47 |
| bknudson | I'm going to see what happens. | 22:47 |
| bknudson | morganfainberg: it does work... looks funny though. | 22:50 |
| morganfainberg | bknudson, yeah it's awkward :( | 22:50 |
| bknudson | would be nice to not have the ==> keystone_access.log <== | 22:50 |
| bknudson | I could grep them out. | 22:50 |
| bknudson | sed | 22:51 |
| *** shakamunyi has joined #openstack-keystone | 22:51 | |
| morganfainberg | bknudson, i also need to circle back and finish https://review.openstack.org/#/c/102425/ so we have better formatted error log out of apache | 22:52 |
| morganfainberg | (back to oslo fmt) | 22:52 |
| bknudson | morganfainberg: that would help! | 22:53 |
| morganfainberg | bknudson, yeah need to fix the fedora case and it should be good. | 22:53 |
| morganfainberg | bknudson, i'll put tha ton my todo for tomorrow since i have a dentist thing - so less headache prior to teeh ache :P | 22:54 |
| *** mrmoje has quit IRC | 23:05 | |
| *** marcoemorais has quit IRC | 23:10 | |
| *** marcoemorais has joined #openstack-keystone | 23:10 | |
| *** marcoemorais has quit IRC | 23:14 | |
| *** marcoemorais has joined #openstack-keystone | 23:14 | |
| *** stevemar has quit IRC | 23:15 | |
| *** joesavak has joined #openstack-keystone | 23:27 | |
| bknudson | morganfainberg: https://review.openstack.org/#/c/116134/ | 23:29 |
| morganfainberg | bknudson, i'm going to need to start using ==> [stuff] <== in keystone logs >.> | 23:30 |
| morganfainberg | bknudson, nice. | 23:30 |
| bknudson | you're going to wonder where it went. | 23:31 |
| bknudson | ==> GOT HERE <== | 23:32 |
| *** gordc has quit IRC | 23:34 | |
| *** henrynash has quit IRC | 23:35 | |
| *** zzzeek_ has joined #openstack-keystone | 23:40 | |
| *** zzzeek has quit IRC | 23:40 | |
| *** zzzeek_ is now known as zzzeek | 23:40 | |
| *** david-lyle has quit IRC | 23:41 | |
| *** alex_xu has quit IRC | 23:42 | |
| *** jorge_munoz has quit IRC | 23:45 | |
| *** zzzeek has quit IRC | 23:49 | |
| *** zzzeek has joined #openstack-keystone | 23:50 | |
| *** gokrokve has joined #openstack-keystone | 23:53 | |
| *** gokrokve_ has quit IRC | 23:53 | |
| *** gokrokve has quit IRC | 23:58 | |
| *** zzzeek has quit IRC | 23:58 | |
| *** oomichi has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!