| *** amcrn has quit IRC | 00:00 | |
| morganfainberg | jamielennox, 'recheck' if it's in the queue shouldn't affect anything | 00:04 |
|---|---|---|
| morganfainberg | jamielennox, recheck should be ignored if it's actually in zuul already | 00:04 |
| morganfainberg | (even queued) | 00:04 |
| jamielennox | morganfainberg: ah - ok so it was lost | 00:06 |
| morganfainberg | yeah | 00:06 |
| *** zzzeek has quit IRC | 00:09 | |
| *** jimhoagland has quit IRC | 00:09 | |
| *** arborism has joined #openstack-keystone | 00:12 | |
| *** arborism is now known as amcrn | 00:12 | |
| *** rm_work is now known as rm_work|away | 00:17 | |
| *** shakamunyi has joined #openstack-keystone | 00:19 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 00:20 |
| bknudson | morganfainberg: I almost wonder if we shouldn't use python logging when running in apache. | 00:30 |
| bknudson | actually, could use the same for both apache and eventlet. | 00:30 |
| *** morganfainberg is now known as morganfainberg_Z | 00:32 | |
| *** morganfainberg_Z is now known as morganfainberg | 00:33 | |
| *** shakamunyi has quit IRC | 00:35 | |
| *** amcrn has quit IRC | 00:40 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: JSON Home data is required https://review.openstack.org/117663 | 00:47 |
| *** shakamunyi has joined #openstack-keystone | 00:50 | |
| *** gokrokve has joined #openstack-keystone | 00:51 | |
| *** stevemar has joined #openstack-keystone | 00:52 | |
| *** morganfainberg is now known as morganfainberg_Z | 00:53 | |
| *** zzzeek has joined #openstack-keystone | 00:53 | |
| *** r-daneel has quit IRC | 00:53 | |
| *** zzzeek has quit IRC | 00:54 | |
| *** gyee has quit IRC | 00:54 | |
| gabriel-bezerra | bknudson, jamielennox: do you know whether it is possible to have cross-domain role assignments? | 00:59 |
| bknudson | gabriel-bezerra: yes, it is. | 01:00 |
| jamielennox | gabriel-bezerra: sure, it's just a bit tricky to set up | 01:00 |
| gabriel-bezerra | and is that true with domain-specific back ends? | 01:00 |
| bknudson | gabriel-bezerra: why wouldn't it be possible? | 01:00 |
| jamielennox | yes | 01:00 |
| gabriel-bezerra | bknudson: I saw there was some trouble with ids in the past | 01:00 |
| gabriel-bezerra | id mapping | 01:00 |
| bknudson | gabriel-bezerra: it doesn't work in icehouse | 01:01 |
| bknudson | but you've always been able to have cross-domain assignments | 01:01 |
| gabriel-bezerra | is there any doc that explain how to set it up? | 01:01 |
| gabriel-bezerra | jamielennox: as you said it is tricky | 01:02 |
| jamielennox | so you still have user_ids project_ids and role_ids | 01:02 |
| jamielennox | so cross domain is no different to regular role assignments | 01:02 |
| jamielennox | the tricky part is in that your permissions are generally within a domain | 01:02 |
| bknudson | http://docs.openstack.org/developer/keystone/configuration.html#domain-specific-drivers | 01:02 |
| jamielennox | so you *generally* don't have access to list the user_ids from another domain | 01:03 |
| jamielennox | if you have the ids though there's nothing to stop you | 01:03 |
| gabriel-bezerra | oh, I see.. | 01:03 |
| gabriel-bezerra | thank you, guys | 01:03 |
| *** shakamunyi has quit IRC | 01:09 | |
| *** RicoLin has joined #openstack-keystone | 01:11 | |
| *** topol has joined #openstack-keystone | 01:15 | |
| openstackgerrit | A change was merged to openstack/keystone: Add bash code style to some portions of configuration.rst https://review.openstack.org/117308 | 01:19 |
| *** gokrokve has quit IRC | 01:19 | |
| *** gokrokve has joined #openstack-keystone | 01:19 | |
| *** shakamunyi has joined #openstack-keystone | 01:21 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add version parameter to adapter. https://review.openstack.org/117669 | 01:25 |
| stevemar | dstanek, dolphm can either of you approve, it's sitting on 2 x +2's https://review.openstack.org/#/c/114118/ | 01:25 |
| dolphm | stevemar: you're welcome to approve that if there wasn't a reason dstanek withheld a +A | 01:26 |
| dolphm | stevemar: just looks like he +2'd around the same time i was reviewing it though | 01:26 |
| stevemar | dolphm, yeah, i figured... but i didn't want to overstep | 01:26 |
| dolphm | stevemar: you're good | 01:26 |
| stevemar | dolphm, thanks for reviewing the token2saml too | 01:26 |
| stevemar | i'll fix it up tonight | 01:26 |
| stevemar | how were the classes? | 01:26 |
| dolphm | stevemar: actually super useful | 01:27 |
| bknudson | classes? | 01:27 |
| *** marcoemorais has quit IRC | 01:27 | |
| *** shakamunyi has quit IRC | 01:29 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 01:34 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 01:34 |
| *** diegows has quit IRC | 01:44 | |
| *** yasukun has joined #openstack-keystone | 01:49 | |
| *** yasukun has quit IRC | 01:49 | |
| lbragstad | stevemar: https://review.openstack.org/#/c/114118/ looks good | 01:50 |
| *** alex_xu has joined #openstack-keystone | 01:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: JSON Home data is required https://review.openstack.org/117663 | 01:56 |
| *** ncoghlan_afk is now known as ncoghlan | 02:05 | |
| *** soulxu_ has joined #openstack-keystone | 02:06 | |
| *** wwriverrat has joined #openstack-keystone | 02:08 | |
| *** alex_xu has quit IRC | 02:10 | |
| openstackgerrit | A change was merged to openstack/identity-api: Update region entries to include URLs https://review.openstack.org/114118 | 02:15 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 API https://review.openstack.org/86484 | 02:16 |
| *** richm has quit IRC | 02:54 | |
| stevemar | dolphm, ping? | 02:54 |
| *** cjellick has joined #openstack-keystone | 02:55 | |
| *** cjellick_ has quit IRC | 02:57 | |
| jamielennox | i hate working with the other services, nobody does things the same way | 02:57 |
| *** harlowja_ is now known as harlowja_away | 02:58 | |
| dolphm | stevemar: pong ish | 02:59 |
| dolphm | jamielennox: for better or worse? | 02:59 |
| dolphm | jamielennox: or just *different* | 02:59 |
| jamielennox | cinder went to v2 API ages ago and they brought /{tenant_id}/ in the URL with them | 03:00 |
| jamielennox | at least everyone else ditched it | 03:00 |
| dolphm | yeah i told them not to, and they said they'd remove it before going stable | 03:00 |
| *** soulxu_ has quit IRC | 03:00 | |
| jamielennox | just makes it really difficult to come up with general solutions to thing | 03:00 |
| dolphm | had the same conversation with nova, but that took a different direction | 03:00 |
| jamielennox | ds | 03:00 |
| jamielennox | barbican had it for a while, they are/were going to remove it before v1 stable | 03:01 |
| jamielennox | anyway, makes it really difficult to do unversioned endpoints in the catalog when you've got to figure out project ids as well | 03:01 |
| jamielennox | because GET cinder/v2/{tenant_id}/ gives a 404 :( | 03:02 |
| ncoghlan | jamielennox: I saw python-ldap was one of Keystone's blockers for Py3. Do you know if anyone has poked around at python3-ldap? (despite the name, it also works on Py2) | 03:03 |
| stevemar | dolphm, just wanted to know what i can do about XML/SAML in the docstrings | 03:03 |
| stevemar | i'm leaning toward nuking them | 03:03 |
| dolphm | stevemar: my diff showed the only fix i was looking for | 03:03 |
| dolphm | stevemar: the diff in the main review comment | 03:03 |
| dolphm | stevemar: it's just missing some whitespace | 03:03 |
| jamielennox | ncoghlan: i think this is the one where python-ldap now works on py3 they just haven't done a release in a year | 03:03 |
| stevemar | dolphm, i'm referring to line 86 here | 03:04 |
| stevemar | https://review.openstack.org/#/c/110542/37/keystone/contrib/federation/idp.py | 03:04 |
| dolphm | stevemar: so am i | 03:04 |
| dolphm | stevemar: put a blank line after L86 | 03:04 |
| stevemar | dolphm, oh that's it? | 03:05 |
| jamielennox | ncoghlan: but essentially a bigger issue is paste and eventlet, there's not much point worrying about the rest of them until that works | 03:05 |
| stevemar | but you said it's redundant | 03:05 |
| dolphm | stevemar: that's all that's necessary for the next version of hacking, yeah | 03:05 |
| dolphm | stevemar: L86 is redundant with the method name -- it doesn't add any information for me | 03:05 |
| stevemar | gotcha | 03:05 |
| *** alex_xu has joined #openstack-keystone | 03:06 | |
| stevemar | dolphm, "Create an object that represents a SAML Status" << ? | 03:06 |
| dolphm | stevemar: what's a saml status? | 03:07 |
| dolphm | stevemar: but yes, that's much better :) | 03:07 |
| * dolphm heads to bed | 03:07 | |
| stevemar | it's a valid saml tag | 03:07 |
| stevemar | alright, go to beds | 03:07 |
| ncoghlan | jamielennox: yeah, I saw the thread on the python-ldap mailing list. It just kinda trailed of with "there's a patch, dunno if it will get merged" | 03:08 |
| jamielennox | ncoghlan: i had a github issue against it but i can't find it now | 03:09 |
| jamielennox | i don't know if anyone is doing anything with that repo - as i said it's been a long time since a release | 03:10 |
| *** chandankumar has joined #openstack-keystone | 03:11 | |
| jamielennox | why won't github show me all the issues i've been involved in .... | 03:11 |
| *** morganfainberg_Z is now known as morganfainberg | 03:15 | |
| morganfainberg | wheeeee. 'reheck' | 03:16 |
| *** mfisch has quit IRC | 03:19 | |
| *** mfisch has joined #openstack-keystone | 03:20 | |
| *** mfisch has quit IRC | 03:20 | |
| *** mfisch has joined #openstack-keystone | 03:20 | |
| ncoghlan | jamielennox: no worries - just came across python3-ldap in a different context, and became curious | 03:20 |
| *** chandankumar has quit IRC | 03:25 | |
| *** stevemar has quit IRC | 03:36 | |
| *** stevemar has joined #openstack-keystone | 03:36 | |
| *** alex_xu has quit IRC | 03:39 | |
| *** alex_xu has joined #openstack-keystone | 03:42 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 03:54 |
| *** jimhoagland has joined #openstack-keystone | 03:55 | |
| jamielennox | so i thought cinderclient just went right ahead and converted to using the session with no tests at all - not true, they did the shell so it's tested by jenkins | 03:59 |
| *** bobt has quit IRC | 04:05 | |
| morganfainberg | lol | 04:10 |
| morganfainberg | jamielennox, so... does it ... work? | 04:10 |
| jamielennox | well i guess it passes gate | 04:10 |
| morganfainberg | yeaaaah | 04:11 |
| morganfainberg | dunno if that qualifies as "working" | 04:11 |
| jamielennox | just means i can't run the unit tests and know i broke something | 04:11 |
| morganfainberg | heh | 04:12 |
| jamielennox | it's slightly better than when i though they checked it in without any tests at all i guess | 04:12 |
| *** chandankumar has joined #openstack-keystone | 04:14 | |
| jamielennox | but i removed the 'authenticate()' function and the unit tests never bothered to tell me there was a problem | 04:17 |
| morganfainberg | sounds ... annoying | 04:19 |
| *** amirosh has joined #openstack-keystone | 04:21 | |
| *** amirosh has quit IRC | 04:24 | |
| *** amirosh has joined #openstack-keystone | 04:25 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation https://review.openstack.org/114337 | 04:26 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not load auth plugins by class in tests https://review.openstack.org/117062 | 04:29 |
| *** amirosh has quit IRC | 04:30 | |
| *** chandankumar has quit IRC | 04:32 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Do not load auth plugins by class in tests https://review.openstack.org/117062 | 04:32 |
| *** shakamunyi has joined #openstack-keystone | 04:39 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:58 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:58 | |
| *** shakamunyi has quit IRC | 04:58 | |
| *** chandankumar has joined #openstack-keystone | 05:01 | |
| *** alex_xu has quit IRC | 05:01 | |
| *** chandankumar has quit IRC | 05:08 | |
| *** xianghui has quit IRC | 05:09 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:13 | |
| *** chandankumar has joined #openstack-keystone | 05:15 | |
| *** xianghui has joined #openstack-keystone | 05:16 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation https://review.openstack.org/114337 | 05:16 |
| *** jimhoagland has quit IRC | 05:16 | |
| *** jimhoagland has joined #openstack-keystone | 05:19 | |
| *** chandankumar has quit IRC | 05:21 | |
| *** chandankumar has joined #openstack-keystone | 05:22 | |
| *** henrynash has joined #openstack-keystone | 05:26 | |
| *** andreaf has joined #openstack-keystone | 05:42 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:44 | |
| *** ncoghlan_ has joined #openstack-keystone | 05:47 | |
| *** jamielennox has quit IRC | 05:48 | |
| *** ncoghlan__ has joined #openstack-keystone | 05:48 | |
| *** jamielennox has joined #openstack-keystone | 05:48 | |
| *** jaosorior has joined #openstack-keystone | 05:49 | |
| *** jamielennox has quit IRC | 05:50 | |
| *** jamielennox has joined #openstack-keystone | 05:50 | |
| *** ncoghlan_ has quit IRC | 05:52 | |
| *** ncoghlan has quit IRC | 05:52 | |
| *** ncoghlan__ has quit IRC | 05:54 | |
| *** chandankumar has quit IRC | 05:56 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Test cleanup: do not leak FDs during test runs https://review.openstack.org/117692 | 06:03 |
| *** jimhoagland has quit IRC | 06:05 | |
| morganfainberg | stevemar, ^ | 06:06 |
| morganfainberg | :P | 06:06 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:06 |
| stevemar | ha | 06:06 |
| stevemar | morganfainberg, thanks :) | 06:07 |
| morganfainberg | stevemar also | 06:07 |
| morganfainberg | you might want: https://github.com/openstack/keystone/blob/master/keystone/openstack/common/fileutils.py#L122-L146 | 06:08 |
| stevemar | ................ | 06:08 |
| morganfainberg | stevemar, so fileutils.write_to_tempfile(assertion.to_string()) | 06:08 |
| morganfainberg | i mean... | 06:08 |
| stevemar | yeah, i know what you mean | 06:08 |
| stevemar | i had no idea it was there | 06:08 |
| henrynash | morganfainberg: hi…did you do the cleanup of the database migrations (i.e. creation of 034_havana)? | 06:08 |
| stevemar | henrynash, bknudson did | 06:09 |
| morganfainberg | henrynash, i did the squash, brant moves us backed to 034 as the base | 06:09 |
| morganfainberg | because there was a bug that 034 existed at havana release, but 035 and 036 were added during havana | 06:09 |
| morganfainberg | henrynash, running into an issue? | 06:09 |
| henrynash | anyone tested this outside of sqllite? can’t seem to make it work on either mysql or postres | 06:10 |
| henrynash | do we do that in tempest….surely we must? | 06:10 |
| morganfainberg | henrynash, upgrade or clean devstack | 06:10 |
| morganfainberg | because i'm sure it works in mysql on devstack | 06:10 |
| morganfainberg | i just stood one up earlier today | 06:10 |
| henrynash | just runing test_sql_migration | 06:10 |
| morganfainberg | test_sql_migration might be wonky outside of sqlite. we dont' do live tests in gate (i do plan on fixing that either this cycle post FF or kilo) | 06:11 |
| *** rushiagr_away has quit IRC | 06:11 | |
| henrynash | I don’t quite see how with everythineg squashed into 34, how we can delete, say, the domain table in teardown, since ther are other (initial) tables with FK to it | 06:12 |
| morganfainberg | you shouldn't ever try and downgrade below havana | 06:12 |
| morganfainberg | so we might have a bug in that testcase then | 06:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Test cleanup: do not leak FDs during test runs https://review.openstack.org/117692 | 06:13 |
| *** rushiagr_away has joined #openstack-keystone | 06:13 | |
| henrynash | maybe…everytest cases will tear the Db down I think, which tries to delte all teh tables…maybe it shouldn’t…ok, at least I know now that I’m not going mad | 06:14 |
| morganfainberg | yeah | 06:14 |
| morganfainberg | probably an easy fix | 06:14 |
| *** amirosh has joined #openstack-keystone | 06:14 | |
| morganfainberg | henrynash, this test_sql_upgrade? or test_sql_livetests? or? | 06:15 |
| henrynash | test_sql_upgrdade | 06:15 |
| morganfainberg | right ok | 06:16 |
| henrynash | ahhh…is that actually supported outside sqllte? | 06:16 |
| morganfainberg | if you use test_sql_livetest it should be | 06:16 |
| * morganfainberg dislikes sqlite a lot | 06:17 | |
| morganfainberg | there is talk about moving to functional tests in-tree. i think we're mostly there with the way we do things, but we should move away from sqlite where we can (but it'll slow testing down) | 06:18 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 06:19 |
| henrynash | ah, think taht’s my problme - i was running test_sql_upgrade directly | 06:19 |
| *** gokrokve has quit IRC | 06:19 | |
| morganfainberg | stevemar, you *probably* still want a try/except IOError finally | 06:20 |
| morganfainberg | stevemar, popen can ioerror i think, and so can mkstemp even from the fileutils function | 06:20 |
| morganfainberg | and i'm not sure but i think os.unlink doesn't error if a file is missing but os.remove does? | 06:21 |
| morganfainberg | nvm still errors | 06:21 |
| morganfainberg | do you probably need a try/except in the finally block *omg* | 06:21 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 06:22 |
| stevemar | sec, just rebasing | 06:22 |
| morganfainberg | ++ | 06:22 |
| morganfainberg | henrynash, there might be some assumptions in the test_sql_upgrade that we have a clean schema each time | 06:23 |
| morganfainberg | which *may* not be the case in mysql | 06:23 |
| morganfainberg | henrynash, which sounds like what you're running up against | 06:23 |
| stevemar | morganfainberg, why is it taking so long for your patches to land :( | 06:24 |
| henrynash | I think it expects to unwind teh DB to clean after everytest | 06:24 |
| morganfainberg | henrynash, yeah | 06:24 |
| morganfainberg | henrynash, sqlite works because we just create a new one | 06:24 |
| morganfainberg | henrynash, should be *not-too-hard-to-fix* but annoying none-the-less | 06:24 |
| henrynash | and since we don’t have the downgrade steps to go below 034, there are FK constraints around and it fails to delete the tables | 06:24 |
| morganfainberg | just need a cleanup step that does 'for table in db, drop' | 06:25 |
| morganfainberg | yeah. | 06:25 |
| morganfainberg | i think you can drop all tables in a single transaction and solve that. | 06:25 |
| henrynash | one that ignores FKs? | 06:25 |
| *** chandankumar has joined #openstack-keystone | 06:25 | |
| morganfainberg | if you drop all tables in a single transaction it might work, but there is a way to turn off FK constraints in at least mysql | 06:26 |
| morganfainberg | so it wouldn't be hard to do that, i'd need to look into pgsql and db2 | 06:26 |
| morganfainberg | file a bug, ping me in the morning, i'll fix it unless you want to take it on :) | 06:26 |
| stevemar | morganfainberg, http://paste.openstack.org/show/102224/ | 06:28 |
| morganfainberg | stevemar, because "OMG TRANSIENT BUG" | 06:28 |
| stevemar | morganfainberg, i think that's safest ^ | 06:28 |
| morganfainberg | stevemar, http://paste.openstack.org/show/102225/ | 06:28 |
| morganfainberg | unless you want to it to raise if something else swept up that file | 06:29 |
| stevemar | try: | 06:29 |
| stevemar | os.remove(filename) | 06:29 |
| stevemar | except OSError: | 06:29 |
| stevemar | pass | 06:29 |
| *** rm_work|away is now known as rm_work | 06:33 | |
| *** henrynash has quit IRC | 06:42 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 06:44 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 06:45 |
| *** gokrokve has joined #openstack-keystone | 06:55 | |
| *** chandankumar has quit IRC | 06:55 | |
| *** jorge_munoz has joined #openstack-keystone | 06:56 | |
| *** jorge_munoz has quit IRC | 06:58 | |
| *** gokrokve has quit IRC | 07:00 | |
| *** jorge_munoz has joined #openstack-keystone | 07:08 | |
| *** jorge_munoz has quit IRC | 07:08 | |
| *** bvandenh has joined #openstack-keystone | 07:10 | |
| *** stevemar has quit IRC | 07:16 | |
| *** andreaf has quit IRC | 07:18 | |
| *** andreaf has joined #openstack-keystone | 07:18 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 07:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 07:24 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Expose auth methods on the adapter https://review.openstack.org/117709 | 07:24 |
| *** andreaf_ has joined #openstack-keystone | 07:26 | |
| *** andreaf has quit IRC | 07:30 | |
| *** jorge_munoz has joined #openstack-keystone | 07:30 | |
| *** henrynash has joined #openstack-keystone | 07:36 | |
| *** cjellick has quit IRC | 07:40 | |
| *** cjellick has joined #openstack-keystone | 07:41 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 07:42 |
| *** cjellick has quit IRC | 07:45 | |
| *** jamielennox is now known as jamielennox|away | 07:46 | |
| *** lsmola has joined #openstack-keystone | 07:54 | |
| *** gokrokve has joined #openstack-keystone | 07:56 | |
| *** jorge_munoz has quit IRC | 07:59 | |
| *** gokrokve has quit IRC | 08:01 | |
| *** jorge_munoz has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Razumovsky Peter proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 08:08 |
| *** jorge_munoz has quit IRC | 08:11 | |
| *** chandankumar has joined #openstack-keystone | 08:13 | |
| *** jorge_munoz has joined #openstack-keystone | 08:14 | |
| *** jorge_munoz has quit IRC | 08:15 | |
| *** jorge_munoz has joined #openstack-keystone | 08:18 | |
| *** jorge_munoz has quit IRC | 08:21 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Add delete notification to endpoint grouping https://review.openstack.org/117723 | 08:41 |
| *** topol has quit IRC | 08:49 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Add delete notification to endpoint grouping https://review.openstack.org/117723 | 08:50 |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 08:55 |
| *** alex_xu has joined #openstack-keystone | 08:55 | |
| *** gokrokve has joined #openstack-keystone | 08:56 | |
| *** rm_work is now known as rm_work|away | 08:58 | |
| *** gokrokve has quit IRC | 08:58 | |
| *** gokrokve has joined #openstack-keystone | 08:58 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 09:00 |
| *** gokrokve has quit IRC | 09:02 | |
| *** jorge_munoz has joined #openstack-keystone | 09:07 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 09:07 |
| *** chandankumar has quit IRC | 09:09 | |
| *** jorge_munoz has quit IRC | 09:10 | |
| *** chandankumar has joined #openstack-keystone | 09:11 | |
| *** jorge_munoz has joined #openstack-keystone | 09:14 | |
| *** andreaf_ has quit IRC | 09:16 | |
| *** bvandenh has quit IRC | 09:16 | |
| *** xianghui has quit IRC | 09:16 | |
| *** boris-42 has quit IRC | 09:16 | |
| *** toddnni has quit IRC | 09:16 | |
| *** dhellmann_ has quit IRC | 09:16 | |
| *** uvirtbot` has quit IRC | 09:16 | |
| *** dvorak has quit IRC | 09:16 | |
| *** XEye has quit IRC | 09:16 | |
| *** andreaf_ has joined #openstack-keystone | 09:17 | |
| *** bvandenh has joined #openstack-keystone | 09:17 | |
| *** xianghui has joined #openstack-keystone | 09:17 | |
| *** boris-42 has joined #openstack-keystone | 09:17 | |
| *** toddnni has joined #openstack-keystone | 09:17 | |
| *** dhellmann_ has joined #openstack-keystone | 09:17 | |
| *** uvirtbot` has joined #openstack-keystone | 09:17 | |
| *** dvorak has joined #openstack-keystone | 09:17 | |
| *** XEye has joined #openstack-keystone | 09:17 | |
| *** RicoLin has quit IRC | 09:17 | |
| *** notmyname has quit IRC | 09:17 | |
| *** medberry has quit IRC | 09:17 | |
| *** grantbow has quit IRC | 09:17 | |
| *** jorge_munoz has quit IRC | 09:20 | |
| *** RicoLin has joined #openstack-keystone | 09:30 | |
| *** notmyname has joined #openstack-keystone | 09:30 | |
| *** grantbow has joined #openstack-keystone | 09:30 | |
| *** aix has joined #openstack-keystone | 09:40 | |
| *** anteaya has quit IRC | 09:46 | |
| *** samuelmz_ has joined #openstack-keystone | 09:47 | |
| *** anteaya has joined #openstack-keystone | 09:47 | |
| *** marzif_ has joined #openstack-keystone | 09:48 | |
| *** andreaf has joined #openstack-keystone | 09:49 | |
| *** mhu1 has joined #openstack-keystone | 09:50 | |
| *** samuelmz has quit IRC | 09:50 | |
| *** marzif has quit IRC | 09:50 | |
| *** mhu has quit IRC | 09:50 | |
| *** d34dh0r53 has quit IRC | 09:50 | |
| *** mhu1 is now known as mhu | 09:50 | |
| *** russellb has quit IRC | 09:51 | |
| *** russellb has joined #openstack-keystone | 09:51 | |
| *** comstud has quit IRC | 09:51 | |
| *** andreaf_ has quit IRC | 09:51 | |
| *** d34dh0r53 has joined #openstack-keystone | 09:53 | |
| *** comstud has joined #openstack-keystone | 09:54 | |
| *** gokrokve has joined #openstack-keystone | 09:56 | |
| *** gus_ has joined #openstack-keystone | 09:57 | |
| *** zhiyan_ has joined #openstack-keystone | 09:58 | |
| *** vish1 has joined #openstack-keystone | 09:59 | |
| *** gokrokve has quit IRC | 10:01 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Fix test_versions that is currently breaking pep8 in master. https://review.openstack.org/117732 | 10:01 |
| openstackgerrit | Razumovsky Peter proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 10:01 |
| *** EmilienM_ has joined #openstack-keystone | 10:01 | |
| *** rm_workz has joined #openstack-keystone | 10:02 | |
| *** rm_workz is now known as rm_work | 10:02 | |
| *** rm_work has joined #openstack-keystone | 10:02 | |
| *** mitz_ has joined #openstack-keystone | 10:03 | |
| *** sudorandom_ has joined #openstack-keystone | 10:03 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Fix test_versions that is currently breaking pep8 in master. https://review.openstack.org/117732 | 10:04 |
| XEye | Greetings! Are there any instructions or how-to about configuring Keystone to use LDAP backend? All I found is just a configuration file with comments - is it all documentation available? Thanks in advance :) | 10:06 |
| *** swartulv has quit IRC | 10:09 | |
| *** zhiyan has quit IRC | 10:09 | |
| *** rm_work|away has quit IRC | 10:09 | |
| *** vishy has quit IRC | 10:09 | |
| *** jamiec has quit IRC | 10:09 | |
| *** marekd|away has quit IRC | 10:09 | |
| *** dobson has quit IRC | 10:09 | |
| *** sudorandom has quit IRC | 10:09 | |
| *** mitz- has quit IRC | 10:09 | |
| *** gus has quit IRC | 10:09 | |
| *** EmilienM has quit IRC | 10:09 | |
| *** sudorandom_ is now known as sudorandom | 10:09 | |
| *** vish1 is now known as vishy | 10:09 | |
| *** EmilienM_ is now known as EmilienM | 10:10 | |
| *** jamiec has joined #openstack-keystone | 10:10 | |
| *** zhiyan_ is now known as zhiyan | 10:11 | |
| *** dobson has joined #openstack-keystone | 10:12 | |
| *** swartulv has joined #openstack-keystone | 10:12 | |
| *** marekd|away has joined #openstack-keystone | 10:15 | |
| *** wolsen_ has joined #openstack-keystone | 10:33 | |
| *** openstackgerrit has quit IRC | 10:34 | |
| *** bknudson has quit IRC | 10:34 | |
| *** wolsen has quit IRC | 10:34 | |
| *** topol has joined #openstack-keystone | 10:37 | |
| *** bknudson has joined #openstack-keystone | 10:40 | |
| *** openstackgerrit has joined #openstack-keystone | 10:40 | |
| *** boris-42 has quit IRC | 10:43 | |
| *** ctracey_ has joined #openstack-keystone | 10:51 | |
| *** alex_xu has quit IRC | 10:55 | |
| *** EmilienM has quit IRC | 10:55 | |
| *** ctracey has quit IRC | 10:56 | |
| *** EmilienM has joined #openstack-keystone | 10:56 | |
| *** gokrokve has joined #openstack-keystone | 10:56 | |
| *** alex_xu has joined #openstack-keystone | 10:57 | |
| *** ctracey_ is now known as ctracey | 11:00 | |
| *** gokrokve has quit IRC | 11:01 | |
| *** andreaf has quit IRC | 11:04 | |
| *** med_ has joined #openstack-keystone | 11:05 | |
| *** med_ has joined #openstack-keystone | 11:05 | |
| *** andreaf has joined #openstack-keystone | 11:05 | |
| *** Dafna has joined #openstack-keystone | 11:13 | |
| *** alex_xu has quit IRC | 11:19 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove SAML2 plugin dependency on token_api https://review.openstack.org/115012 | 11:20 |
| openstackgerrit | A change was merged to openstack/keystone: Mark methods on token_api deprecated https://review.openstack.org/115347 | 11:20 |
| openstackgerrit | A change was merged to openstack/keystone: Add extra guarding to revoke_by_audit_id methods https://review.openstack.org/115147 | 11:20 |
| *** bambam1 has quit IRC | 11:22 | |
| *** bambam1 has joined #openstack-keystone | 11:22 | |
| openstackgerrit | A change was merged to openstack/keystone: Make persistence manager in token_provider_api private https://review.openstack.org/116961 | 11:22 |
| openstackgerrit | A change was merged to openstack/keystone: Update tests to not use token_api https://review.openstack.org/116962 | 11:24 |
| openstackgerrit | A change was merged to openstack/keystone: Notification cleanup: namespace actions https://review.openstack.org/117330 | 11:24 |
| openstackgerrit | A change was merged to openstack/keystone: Comments to docstrings for notification emit methods https://review.openstack.org/117331 | 11:24 |
| *** Jean-Daniel1 has quit IRC | 11:27 | |
| *** Jean-Daniel has joined #openstack-keystone | 11:28 | |
| *** gmurphy has quit IRC | 11:30 | |
| *** chandankumar has quit IRC | 11:32 | |
| *** gmurphy has joined #openstack-keystone | 11:33 | |
| *** chandankumar has joined #openstack-keystone | 11:44 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Add information regarding HTTPS for SSL enabled endpoints https://review.openstack.org/95545 | 11:44 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make keystoneclient use an adapter https://review.openstack.org/97681 | 11:46 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 11:46 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Expose auth methods on the adapter https://review.openstack.org/117709 | 11:46 |
| *** diegows has joined #openstack-keystone | 11:48 | |
| *** gokrokve has joined #openstack-keystone | 11:56 | |
| *** gokrokve has quit IRC | 12:01 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 API https://review.openstack.org/86484 | 12:03 |
| *** topol has quit IRC | 12:11 | |
| *** HenryG has joined #openstack-keystone | 12:12 | |
| *** alexander has joined #openstack-keystone | 12:14 | |
| *** alexander is now known as Guest51960 | 12:14 | |
| *** Guest51960 has quit IRC | 12:14 | |
| *** XEye has quit IRC | 12:15 | |
| *** Xeye has joined #openstack-keystone | 12:16 | |
| *** Xeye is now known as XEye | 12:16 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 12:21 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 12:43 |
| *** chandankumar has quit IRC | 12:49 | |
| *** kleini has joined #openstack-keystone | 12:54 | |
| *** radez_g0n3 is now known as radez | 12:54 | |
| kleini | I am trying to test keystone Juno and have LDAP for default domain and SQL for the heat domain. furthermore I want to store roles, projects and so on in SQL. I configured assignment storage in SQL. Now I am encountering the problem that keystone searches for roles in LDAP. Do you have any idea, what is configured wrong? | 12:56 |
| *** gokrokve has joined #openstack-keystone | 12:56 | |
| kleini | The same setup works with keystone Icehouse | 12:56 |
| *** zzzeek has joined #openstack-keystone | 12:56 | |
| *** joesavak has joined #openstack-keystone | 12:58 | |
| *** richm has joined #openstack-keystone | 13:00 | |
| *** gokrokve has quit IRC | 13:01 | |
| *** jaosorior has quit IRC | 13:02 | |
| *** russellb is now known as rustlebee | 13:09 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Adds tests that show how update with validation works https://review.openstack.org/116954 | 13:15 |
| *** bknudson has quit IRC | 13:24 | |
| *** jimhoagland has joined #openstack-keystone | 13:24 | |
| *** gordc has joined #openstack-keystone | 13:27 | |
| openstackgerrit | A change was merged to openstack/keystone: Add commas for ease of maintenance https://review.openstack.org/117332 | 13:27 |
| *** topol has joined #openstack-keystone | 13:40 | |
| *** thiagop has joined #openstack-keystone | 13:43 | |
| dolphm | raildo: the branch is now available https://github.com/openstack/keystone/tree/feature/hierarchical-multitenancy | 13:49 |
| raildo | dolphm: Great! Thank you | 13:50 |
| *** r-daneel has joined #openstack-keystone | 13:52 | |
| *** bvandenh has quit IRC | 13:52 | |
| *** gokrokve has joined #openstack-keystone | 13:56 | |
| *** gokrokve has quit IRC | 14:01 | |
| *** cjellick has joined #openstack-keystone | 14:01 | |
| *** bknudson has joined #openstack-keystone | 14:02 | |
| *** ukalifon1 has joined #openstack-keystone | 14:18 | |
| *** alex_xu has joined #openstack-keystone | 14:21 | |
| *** jimhoagland has quit IRC | 14:21 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Add delete notification to endpoint grouping https://review.openstack.org/117723 | 14:25 |
| henrynash | kleini: you want to make sure you set the assignment driver to sql explicitely…since by default it will follow the one you have for identity (in the main config file) | 14:33 |
| *** david-lyle has joined #openstack-keystone | 14:34 | |
| *** david-lyle has quit IRC | 14:34 | |
| *** david-lyle has joined #openstack-keystone | 14:35 | |
| *** ukalifon1 has quit IRC | 14:37 | |
| *** david-lyle has quit IRC | 14:38 | |
| *** gokrokve has joined #openstack-keystone | 14:38 | |
| *** stevemar has joined #openstack-keystone | 14:38 | |
| kleini | henrynash: is | 14:40 |
| kleini | [assignment] | 14:40 |
| kleini | driver=keystone.assignment.backends.sql.Assignment | 14:40 |
| kleini | sufficient? | 14:40 |
| *** amirosh has quit IRC | 14:40 | |
| henrynash | kleini: that should be ok | 14:40 |
| kleini | so, it does not work within keystone Juno | 14:41 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Mark the trust kvs backend deprecated, for removal in Kilo https://review.openstack.org/117804 | 14:42 |
| kleini | henrynash: do you have any advice, what I can check/change regarding the wrong search for a role? | 14:43 |
| henrynash | kleini: hold on..back in a sec | 14:46 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Mark the trust kvs backend deprecated, for removal in Kilo https://review.openstack.org/117804 | 14:48 |
| henrynash | kleini: ok, back… | 14:48 |
| stevemar | bknudson, dstanek https://review.openstack.org/#/c/111920/ << request from doc team to merge translations sooner rather than later | 14:48 |
| dstanek | stevemar: there nothing to check for this right? | 14:49 |
| henrynash | kleini: so when you say “it searches for roles in LDAP”….how does this manifets itself? | 14:49 |
| bknudson | did we ever go through and do the _LI, _LW, etc? | 14:49 |
| dstanek | bknudson: no | 14:49 |
| bknudson | is there a translation cutoff? | 14:50 |
| dstanek | Is the _LI, etc. needed? | 14:50 |
| *** alex_xu has quit IRC | 14:50 | |
| bknudson | it's not needed, but if we do it now it's going to change all these. | 14:50 |
| dstanek | i doubt we'll get it dont and reviewed by the FF | 14:51 |
| *** andreaf has quit IRC | 14:51 | |
| bknudson | it's not a feature | 14:51 |
| kleini | henrynash: https://bugs.launchpad.net/keystone/+bug/1362678/comments/5 | 14:51 |
| uvirtbot` | Launchpad bug 1362678 in keystone "multi-domain has problems with LDAP identity on default domain" [Undecided,New] | 14:51 |
| dstanek | no, but when do they cut a tag/brach or whatever | 14:51 |
| *** andreaf has joined #openstack-keystone | 14:51 | |
| kleini | henrynash: keystone tells me, it can not find the role with identifier abc | 14:51 |
| bknudson | dstanek: I went through 111920 and didn't see any probs | 14:52 |
| dstanek | bknudson: same here | 14:53 |
| bknudson | I think someone proposed the change to use _LI, etc... | 14:53 |
| kleini | henrynash: I traced SQL traffic and saw, roles are read from SQL: SELECT role.id AS role_id, role.name AS role_name, role.extra AS role_extra FROM role. but later the identifier of the role heat_stack_owner is tried to resolve in LDAP 8dc819df55184eba8552949788a49b77 | 14:54 |
| *** lsmola has quit IRC | 14:54 | |
| kleini | hmm, will try to give the user that role. maybe that helps | 14:54 |
| dstanek | bknudson: for at least some https://review.openstack.org/#/c/95381 | 14:54 |
| mflobo | kleini, I've reported a similar issue https://bugs.launchpad.net/keystone/+bug/1362181 | 14:54 |
| uvirtbot` | Launchpad bug 1362181 in keystone "Multi-domain has problems with domain drivers" [Undecided,Incomplete] | 14:54 |
| dstanek | but that needs to be revised | 14:54 |
| bknudson | dstanek: do you have time to rebase it? | 14:55 |
| dstanek | bknudson: yeah | 14:55 |
| bknudson | there's also https://review.openstack.org/#/c/93013/9 (no debug logs), and https://review.openstack.org/#/c/94184/ (more xlations) | 14:57 |
| *** wwriverrat has quit IRC | 14:59 | |
| henrynash | kleini, mflobo: ok, im going have to take a detailed look at what’s going on….I’nm baclked up today, but will get to it asap (probably over the weekend) | 14:59 |
| kleini | I will post my results in my bug report | 15:00 |
| kleini | I added the role heat_stack_owner to the user creating stacks and now it seems to work | 15:00 |
| kleini | it does not search anymore for the role identifier in LDAP | 15:00 |
| *** jimhoagland has joined #openstack-keystone | 15:00 | |
| mflobo | henrynash, thanks, I'll still work on it. If I find something, I'll report it | 15:03 |
| lbragstad | topol: might need a rebase here? https://review.openstack.org/#/c/114337/ | 15:03 |
| *** david-lyle has joined #openstack-keystone | 15:03 | |
| topol | lbragstad, BIG TIME! working on it now. Morgan!!!!! did it to me 3 times :-) | 15:04 |
| topol | morganfainberg--^ | 15:04 |
| *** cjellick has quit IRC | 15:09 | |
| *** lsmola has joined #openstack-keystone | 15:09 | |
| *** PsionTheory has joined #openstack-keystone | 15:10 | |
| *** cjellick has joined #openstack-keystone | 15:13 | |
| *** zzzeek has quit IRC | 15:22 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Adds tests that show how update with validation works https://review.openstack.org/116954 | 15:22 |
| *** zzzeek has joined #openstack-keystone | 15:24 | |
| *** shakamunyi has joined #openstack-keystone | 15:25 | |
| dstanek | bknudson: ha, we can chat here instead of on the review! | 15:32 |
| dstanek | bknudson: i agree about the error code, but right now it is what it is :-( | 15:32 |
| bknudson | we don't need to use it for new code | 15:32 |
| bknudson | create a TheRealValidationError and use that | 15:33 |
| dstanek | is it now backward compatible to swap error codes? | 15:33 |
| dstanek | that would be idea so we don't have to remember which ones are different | 15:34 |
| bknudson | https://wiki.openstack.org/wiki/APIChangeGuidelines#Generally_Not_Acceptable | 15:34 |
| dstanek | oh, good then no! | 15:35 |
| *** wwriverrat has joined #openstack-keystone | 15:35 | |
| *** gokrokve has quit IRC | 15:35 | |
| dstanek | there is a lot of debate in the rest community over 400 vs 403 | 15:35 |
| bknudson | there's no guideline there for changing the error code that's returned | 15:35 |
| bknudson | "Changing an error response code to be more accurate" is in the generally considered OK category | 15:36 |
| dstanek | ah, yes....i was answering myself as if i said 'if is wrong to swap errors codes' | 15:36 |
| bknudson | the debate is silly. The status codes are too coarse grained to be useful anyways. | 15:37 |
| dstanek | for the 400 some people wonder about the definition of malformed (is it only structural or can it also be bad data) | 15:37 |
| bknudson | you need an error document with more information to be useful | 15:37 |
| dstanek | for the 403 people complain that the spec says that the request shouldn't be sent again | 15:37 |
| bknudson | y, it's not going to do any good to send the same request again, it'll fail | 15:37 |
| bknudson | it'll always 403 if you don't have a name for a user. | 15:38 |
| dstanek | but a 400 (i'm pretty sure) says fix and try againg - 403 says don't try again | 15:38 |
| dstanek | i'm happy with either just because it tells the client that they messed up vs. our 500s right now | 15:39 |
| dstanek | or 404s in some cases | 15:39 |
| bknudson | I don't think a 403 means you can't ever talk to the server again. | 15:40 |
| *** gokrokve has joined #openstack-keystone | 15:41 | |
| *** wwriverrat has left #openstack-keystone | 15:41 | |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation https://review.openstack.org/114337 | 15:41 |
| topol | morganfainberg I assume token_ref.audit_id is meant for me to use?? Wanted to talk to you before I plug itin | 15:43 |
| bknudson | topol: audit_id can be used all over. | 15:46 |
| bknudson | logs | 15:46 |
| bknudson | revocation lists | 15:46 |
| topol | bknudson, in the cadf I should replace token_id in the record with token_ref.audit_id correct? | 15:46 |
| bknudson | topol: yes!!! | 15:47 |
| topol | bknudson, I caught that all byt myself. I swear | 15:47 |
| bknudson | we shouldn't be using token ids anywhere it's not required | 15:47 |
| topol | bknudson +++ | 15:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Adds tests that show how update with validation works https://review.openstack.org/116954 | 15:48 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Assignment V3 API https://review.openstack.org/86484 | 15:49 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add string id type validation https://review.openstack.org/108862 | 15:49 |
| henrynash | KanagarajM: ping | 15:52 |
| *** kleini has left #openstack-keystone | 15:55 | |
| dstanek | dolphm: ping | 15:57 |
| dolphm | dstanek: le pong | 15:57 |
| dolphm | #practicefrenchforparis | 15:57 |
| dstanek | dolphm: i fixed up that null description in region thing. just wanted to confirm that you want None's treated as empty strings there? | 15:58 |
| openstackgerrit | Brad Topol proposed a change to openstack/keystone: Add audit support to keystone federation https://review.openstack.org/114337 | 15:58 |
| lbragstad | oui | 15:58 |
| lbragstad | oui oui! | 15:58 |
| dstanek | it is optional, but i just wante to double check | 15:59 |
| dolphm | dstanek: ++ | 15:59 |
| dstanek | dolphm: cool, i found a bug in the create and update related to that - just have to submit a bug report so i can push my change | 15:59 |
| dolphm | dstanek: ack | 16:01 |
| morganfainberg | omg... things... merged | 16:02 |
| dstanek | the list is getting shorter! | 16:02 |
| topol | morganfainberg token_model.KeystoneToken is awesome except for the rebase you caused me... AGAIN | 16:03 |
| dstanek | dolphm: actually it's the other side of this bug https://bugs.launchpad.net/keystone/+bug/1284972 | 16:03 |
| uvirtbot` | Launchpad bug 1284972 in keystone "Creating a region using V3 api fails in backend code when missing description" [High,Fix released] | 16:03 |
| morganfainberg | topol, LOL | 16:03 |
| *** gokrokve has quit IRC | 16:03 | |
| *** saipandi has joined #openstack-keystone | 16:03 | |
| *** gokrokve has joined #openstack-keystone | 16:04 | |
| topol | morganfainberg, I used token_ref.audit_id in the CADF record instead of token_id | 16:04 |
| morganfainberg | topol, ++++++++ | 16:04 |
| morganfainberg | topol, that is *exactly* what it is meant to be used for | 16:04 |
| topol | morganfainberg but I did not use audit_chain for anything. did I fail my final exam? | 16:04 |
| morganfainberg | topol, nah | 16:04 |
| morganfainberg | topol, audit_chain is mostly un-used but there for future proofing | 16:05 |
| topol | morganfainberg if you can look at https://review.openstack.org/114337 to keep me and my nasty rebase honest it would be much appreciated | 16:05 |
| *** r-daneel has quit IRC | 16:06 | |
| morganfainberg | topol, looking now | 16:07 |
| topol | morganfainberg but token_model.KeystoneToken is awesome. | 16:07 |
| topol | morganfainberg I was gonna jump ship and start contributing to Trove, but token_model.KeystoneToken makes life so much better I think I'll stay :-) | 16:08 |
| morganfainberg | topol, lol | 16:08 |
| *** saipandi has quit IRC | 16:08 | |
| *** gokrokve has quit IRC | 16:08 | |
| morganfainberg | topol, a follow up patch to change token_ref['user']['id'] to token_ref.user_id would be perfect but otherwise LGTM | 16:10 |
| topol | morganfainberg, K makes sense | 16:11 |
| topol | happy to do itin a follow up patch | 16:11 |
| morganfainberg | topol, yep +2 on your notification patch | 16:11 |
| topol | morganfainberg, THANKS | 16:12 |
| *** f13o has quit IRC | 16:12 | |
| morganfainberg | henrynash did that live test work for you? | 16:13 |
| henrynash | morgainfaingerq: no..fails teh same way | 16:13 |
| henrynash | morganfainberg: I tried teh simple thing of setting contraints checks to zero in teardown | 16:14 |
| morganfainberg | ah | 16:14 |
| henrynash | morgainfainberg: and that improved it but didn’t solve it , oddle | 16:14 |
| henrynash | oddly | 16:14 |
| morganfainberg | yeah ok. so we need some more smarts in there | 16:14 |
| henrynash | morgainfainberg: I was trying to write something that read all the constraints and dropped them one by one…but had trouble getting it right… I Guess fall back is we add the fk constrainsts to the big table in 034 and drop them on down grade? | 16:15 |
| morganfainberg | henrynash, well except we don't want to support a downgrade below 034, it's *scary* | 16:16 |
| henrynash | morgainfainberg: oh, I agree | 16:16 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 16:16 |
| henrynash | morganfainberg: I guess we could use that table in teardown to kill the FKs? | 16:17 |
| morganfainberg | henrynash, i think the solution is a smart cleanup or a per-test schema builder | 16:17 |
| morganfainberg | henrynash, doing schema introspection and dropping constraints is kinda ugly. but doable | 16:18 |
| morganfainberg | henrynash, it's something we need to look at fixing anyway if we want to run the test suite against a real DB (on my long list of things to do) | 16:19 |
| henrynash | morganfainberg: agrred | 16:19 |
| bknudson | I've run the test suite against db2 before, when I was working on initial support | 16:19 |
| *** XEye has quit IRC | 16:20 | |
| bknudson | the issues were typically related to hardcoded sql rather than using sqlalchemy to build the statement | 16:20 |
| morganfainberg | bknudson, i actually want to be able to do it as part of Gate. | 16:20 |
| bknudson | it took a long time. | 16:20 |
| bknudson | that would slow things down. | 16:20 |
| morganfainberg | all of our restful tests are pretty much what the qa folks have been taking about when it comes to in-tree functional | 16:21 |
| bknudson | morganfainberg: that's what I was thinking too | 16:21 |
| morganfainberg | it would be solid to have all of that able to run against mysql or postgres (not just sqlite). | 16:21 |
| bknudson | morganfainberg: but it's easier for us in keystone since we don't need a keystone server running. | 16:22 |
| morganfainberg | sure. | 16:22 |
| morganfainberg | we technically run keystone just locally. | 16:22 |
| morganfainberg | a chunk of those tests could be done sharing a single keystone though, just requires changing what we're looking for (probably user/project isolation) rather than complete new schema | 16:23 |
| henrynash | morganfainberq: I’m needing to test it since I’m trying to test a potential issue of clasing PK when we reduce column size….whicih I think will work in sqllite, but not in the others | 16:23 |
| morganfainberg | and better *cleanup* of each setup | 16:23 |
| henrynash | morganfainberq: (I mean - which won’t error with sqllite, but is likely to on the others) | 16:24 |
| morganfainberg | henrynash, right | 16:24 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: region.description is optional and be null https://review.openstack.org/117611 | 16:26 |
| *** marcoemorais has joined #openstack-keystone | 16:27 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: region.description is optional and be null https://review.openstack.org/117611 | 16:29 |
| bknudson | dstanek: string freeze is 9/4: https://wiki.openstack.org/wiki/Juno_Release_Schedule | 16:29 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: region.description is optional and can be null https://review.openstack.org/117611 | 16:32 |
| dstanek | bknudson: halfway through rebasing that patch now - i think every file had a conflict | 16:32 |
| *** marcoemorais has quit IRC | 16:33 | |
| *** marcoemorais has joined #openstack-keystone | 16:34 | |
| morganfainberg | dstanek, :( | 16:34 |
| dstanek | morganfainberg: ? | 16:34 |
| morganfainberg | dstanek, tons to rebase conflicts, sorry i feel your pain | 16:34 |
| bknudson | that change was proposed 2 months ago, I think. | 16:34 |
| dstanek | morganfainberg: ah, yes. | 16:35 |
| dstanek | bknudson: last time it was modified was June 2 | 16:35 |
| *** gyee has joined #openstack-keystone | 16:36 | |
| *** Dafna has quit IRC | 16:36 | |
| morganfainberg | dolphm, i don't know why your conf generation isn't working on OS X, it works fine for me :( | 16:36 |
| *** pabelanger has joined #openstack-keystone | 16:38 | |
| pabelanger | moreing | 16:38 |
| pabelanger | morning* | 16:38 |
| pabelanger | anybody else having some issues with python-keystoneclient and the new requests 2.4.0 release? | 16:39 |
| pabelanger | specifically, error handling messages have changed | 16:39 |
| * morganfainberg loves stable interfaces on minor point releases in 3rd party libararies. | 16:40 | |
| morganfainberg | pabelanger, what kind of issues is that raising? | 16:40 |
| dstanek | bknudson: why are the hints (_LI, etc) not defined in oslo.i18n? | 16:40 |
| pabelanger | For example running: /usr/local/bin/keystone --os-token=ADMIN --os-endpoint http://127.0.0.1:35357/v2.0/ service-list if keystone is not ready | 16:41 |
| pabelanger | requests 2.3.0 = Unable to establish connection to http://127.0.0.1:35357/v2.0/OS-KSADM/services | 16:41 |
| pabelanger | requests 2.4.0 = ('Connection aborted.', error(111, 'Connection refused')) | 16:41 |
| bknudson | dstanek: they don't know what translator you want. | 16:42 |
| pabelanger | morganfainberg, see example above | 16:42 |
| morganfainberg | pabelanger, ok less friendly message but it's not breaking things. | 16:42 |
| bknudson | dstanek: we have to create a translator that specifies the keystone domain | 16:42 |
| pabelanger | morganfainberg, well, for me, it breaks puppet-keystone | 16:42 |
| bknudson | dstanek: oslo.i18n doesn't know what domain the request is for. | 16:42 |
| morganfainberg | pabelanger, sure. puppet is looking for specific output? not a return code? | 16:43 |
| pabelanger | but I don't think anything directly related to other openstack projects is affected | 16:43 |
| bknudson | dstanek: when we used oslo-incubator it knew because the script to copy the file over changed "oslo" to "keystone" | 16:43 |
| pabelanger | morganfainberg, Ya, the module parses the return message, not code | 16:43 |
| morganfainberg | pabelanger, ick! | 16:43 |
| pabelanger | morganfainberg, indeed | 16:43 |
| morganfainberg | pabelanger, i think that is broken behavior on the puppet module :P | 16:44 |
| bknudson | dstanek: I don't think anything should be using oslo.i18n except keystone.i18n. | 16:44 |
| pabelanger | morganfainberg, could be argued that error messages are breakage. But, ya. Could be fixed in both | 16:45 |
| morganfainberg | pabelanger, well if we just let the error message from requests fall through, then it's not really our message. i haven't looked at that in a bit | 16:45 |
| *** lsmola has quit IRC | 16:45 | |
| pabelanger | morganfainberg, Ya, it looks to be a new exception in requests that keystoneclient is not away of | 16:46 |
| pabelanger | I'm assuming, at some point, keystoneclient would trap the error and reformat it | 16:46 |
| morganfainberg | pabelanger, looking now | 16:46 |
| morganfainberg | yeah the exception must have changed | 16:47 |
| morganfainberg | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L348-L350 | 16:47 |
| pabelanger | morganfainberg, https://github.com/kennethreitz/requests/commit/811ee4eb5d9edba50a62b906420dec8e079532ae | 16:47 |
| pabelanger | is the commit that adds it | 16:47 |
| *** gokrokve has joined #openstack-keystone | 16:49 | |
| morganfainberg | pabelanger, ugh. | 16:50 |
| morganfainberg | oookay i see the fix. we need | 16:50 |
| morganfainberg | wow, this is kind of sloppy | 16:50 |
| morganfainberg | pabelanger, mind filing a but for me at bugs.launchpad.net/python-keystoneclient | 16:51 |
| morganfainberg | s/but/bug | 16:51 |
| pabelanger | morganfainberg, ya, working on it | 16:51 |
| morganfainberg | ? | 16:51 |
| pabelanger | morganfainberg, sorry, the bug report | 16:52 |
| morganfainberg | pabelanger, no worries. | 16:52 |
| morganfainberg | pabelanger, i think i have a fix ready just running tests. and let me know the bug number when you're ready | 16:57 |
| pabelanger | morganfainberg, bug 1363179 | 17:02 |
| uvirtbot` | Launchpad bug 1363179 in python-keystoneclient "requests 2.4.0 adds 'Connection aborted' error message when unable to establish connection" [Undecided,New] https://launchpad.net/bugs/1363179 | 17:02 |
| *** nkinder has quit IRC | 17:02 | |
| morganfainberg | oh boy this is actually worse than i thought, they changed how all of this worked | 17:06 |
| dstanek | morganfainberg: what's that? | 17:06 |
| morganfainberg | dstanek, requests 2.4.0 | 17:06 |
| morganfainberg | dstanek, they restructured a ton of things and broke keystoneclient's error capturing | 17:07 |
| morganfainberg | actually looks like they also busted our unit tests badly | 17:07 |
| dstanek | morganfainberg: were we relying on internals or did they change interfaces? | 17:07 |
| morganfainberg | bascially they "changed" from raising a simple ConnectionError to raising a ProtocolError and moved to urllib 1.9 | 17:07 |
| morganfainberg | dstanek, they changed the exception handling and the underlying urllib in a minor point patch. | 17:08 |
| dstanek | that's not nice | 17:08 |
| morganfainberg | no | 17:08 |
| morganfainberg | ^ that bug is the result, but it's not a simple fix, urllib is now complaining it can't detect if the FP is closed in our unit tests (might be a lacking in the requests mock lib | 17:09 |
| morganfainberg | in one of our tests that is. the rest seem "ok" | 17:09 |
| *** marcoemorais has quit IRC | 17:11 | |
| *** marcoemorais has joined #openstack-keystone | 17:12 | |
| *** rustlebee is now known as russellb | 17:14 | |
| *** harlowja_away is now known as harlowja_ | 17:15 | |
| *** Lordanat3 has joined #openstack-keystone | 17:19 | |
| morganfainberg | dstanek, http://pasteraw.com/4x7qh64sq8gguw06101rjy6rtmkftpg :( | 17:20 |
| *** chandankumar has joined #openstack-keystone | 17:20 | |
| *** marcoemorais has quit IRC | 17:21 | |
| *** Lordanat1 has quit IRC | 17:21 | |
| *** marcoemorais has joined #openstack-keystone | 17:21 | |
| *** saipandi has joined #openstack-keystone | 17:22 | |
| dstanek | morganfainberg: is that with your new fixture or in master? | 17:22 |
| morganfainberg | dstanek, master | 17:22 |
| dstanek | ugg | 17:22 |
| morganfainberg | dstanek, you know let me make sure it's isn't an OSX ism | 17:23 |
| morganfainberg | dstanek, i *think* it's a legit failure, but.... | 17:23 |
| *** harlowja has joined #openstack-keystone | 17:24 | |
| morganfainberg | dstanek, yep, master now fails. | 17:25 |
| morganfainberg | yay requests breaking tests for kystoneclient | 17:25 |
| *** harlowja_ has quit IRC | 17:26 | |
| *** marcoemorais has quit IRC | 17:26 | |
| morganfainberg | and with requests 2.3 it works | 17:26 |
| morganfainberg | ok | 17:26 |
| *** marcoemorais has joined #openstack-keystone | 17:26 | |
| morganfainberg | so blah i'll keep hunting on this | 17:26 |
| dstanek | morganfainberg: i don't know if this helps, but "sigmavirus24: i suspect it's either the 301 caching or connection keep-alive on by default" | 17:30 |
| morganfainberg | it might be | 17:30 |
| morganfainberg | dstanek, i'm going to breakfast, i let -infra know so if it starts exploding a lot of things besides ksc, they can wedge a pin in to <2.4 until post milestone | 17:34 |
| morganfainberg | dstanek, ill work on a fix unless someone beats me to it when i'm back from food. | 17:34 |
| morganfainberg | if it's only ksc exploding, it really is on us to fix it. (ksc and puppet) vs. needing a pin | 17:35 |
| *** boris-42 has joined #openstack-keystone | 17:36 | |
| morganfainberg | dstanek, went with High prio on this onehttps://bugs.launchpad.net/python-keystoneclient/+bug/1363179 or should it be critical? | 17:36 |
| uvirtbot` | Launchpad bug 1363179 in python-keystoneclient "requests 2.4.0 adds 'Connection aborted' error message when unable to establish connection" [High,Triaged] | 17:36 |
| *** saipandi has quit IRC | 17:37 | |
| *** saipandi has joined #openstack-keystone | 17:38 | |
| dstanek | morganfainberg: high, is probably good enough - i'll start poking around in a few | 17:38 |
| morganfainberg | dstanek, thanks. infra is proposing a pin (WIP) patch so it's ready to go if things get ugly, but i *think* only affects KSC. | 17:38 |
| morganfainberg | or minimally other things | 17:39 |
| *** grantbow has quit IRC | 17:54 | |
| *** grantbow has joined #openstack-keystone | 17:54 | |
| *** aix has quit IRC | 17:54 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 17:56 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: add missing log hints for level C/E/I/W https://review.openstack.org/95381 | 17:57 |
| *** andreaf_ has joined #openstack-keystone | 18:04 | |
| pabelanger | morganfainberg, that is the work around I've done locally for my puppet manifests. | 18:04 |
| *** andreaf has quit IRC | 18:05 | |
| *** amcrn has joined #openstack-keystone | 18:06 | |
| *** amirosh has joined #openstack-keystone | 18:24 | |
| henrynash | dumb question….anyone know who how to easily test the length of a field return by sqlalchem? i.e. i can’t seem to do len(region.id)... | 18:26 |
| *** andreaf_ has quit IRC | 18:30 | |
| dstanek | henrynash: are you looking for the columns length or the data in a returned row? | 18:37 |
| henrynash | dstanek: yes…best I can come up with is len(str(region.id)) | 18:38 |
| dstanek | henrynash: region.id should be a unicode if you are looking for the length of the data in the DB | 18:38 |
| dstanek | what are you seeing it come back as? | 18:38 |
| henrynash | if i do len(region_.id) it says NoneType has no methof len() | 18:39 |
| henrynash | ( or something liek that) | 18:39 |
| dstanek | henrynash: if you are getting region from the database it should have an id - that's very strange | 18:40 |
| henrynash | so region.id is there…I just want teh length of the value…. | 18:41 |
| *** bambam1 has quit IRC | 18:41 | |
| henrynash | so len(region.id) doesn’t seem to work | 18:41 |
| dstanek | is it not unicode for you? | 18:41 |
| dstanek | i just checked and i get a unicode value back | 18:41 |
| *** bambam1 has joined #openstack-keystone | 18:42 | |
| henrynash | i think it is unicode….since if I try somthing dump like region.id.length is says unicode type hasn’t got length, but then if i do len(region.id) it says NoneType doesn’t have len() | 18:43 |
| henrynash | weird | 18:43 |
| henrynash | len(str(region.id)) seems to work, however….which I’m going with for now…but odd | 18:44 |
| bknudson | henrynash: you might want to ask zzzeek if he's around | 18:53 |
| zzzeek | im here | 18:53 |
| *** amcrn has quit IRC | 18:55 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 18:57 |
| *** chandankumar has quit IRC | 18:58 | |
| *** RicoLin has quit IRC | 19:04 | |
| *** sigmavirus24 has joined #openstack-keystone | 19:04 | |
| sigmavirus24 | morganfainberg: dstanek any luck tracking down what was going wrong in requests? | 19:05 |
| *** saipandi has quit IRC | 19:11 | |
| *** chandankumar has joined #openstack-keystone | 19:12 | |
| bknudson | morganfainberg: have you tried keystone-manage token_flush lately? | 19:16 |
| *** saipandi has joined #openstack-keystone | 19:17 | |
| sigmavirus24 | morganfainberg: dstanek in case it wasn't obvious from the things I listed as possibilities I'm fairly confident this is the redirect cache that requests added in 2.4.0 | 19:22 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/116682 | 19:26 |
| dstanek | sigmavirus24: i took a late lunch and just got back | 19:26 |
| dstanek | sigmavirus24: is there an easy way to turn it off? | 19:26 |
| sigmavirus24 | we had discussed it and I'm forgetting | 19:27 |
| sigmavirus24 | it's on the PR which I'm looking for | 19:27 |
| *** amirosh has quit IRC | 19:29 | |
| *** amirosh has joined #openstack-keystone | 19:29 | |
| sigmavirus24 | https://github.com/kennethreitz/requests/pull/2095 is the relevant PR and https://github.com/kennethreitz/requests/pull/2095#issuecomment-45977320 was the solution | 19:30 |
| *** andreaf has joined #openstack-keystone | 19:30 | |
| pabelanger | morganfainberg, Looks like a bug has been reported upstream with requests: https://github.com/kennethreitz/requests/issues/2192 | 19:33 |
| sigmavirus24 | ugh | 19:34 |
| *** amirosh has quit IRC | 19:34 | |
| sigmavirus24 | Thanks for pointing that out pabelanger | 19:34 |
| *** cjellick has quit IRC | 19:35 | |
| *** cjellick has joined #openstack-keystone | 19:35 | |
| *** chandankumar has quit IRC | 19:38 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix token flush fails with recursion depth exception https://review.openstack.org/117869 | 19:38 |
| *** cjellick has quit IRC | 19:39 | |
| dstanek | I'm not sure this is the same issue that I am seeing - i did the null session cache thing and i am still getting 'Unable to determine whether fp is closed' | 19:40 |
| sigmavirus24 | hm | 19:41 |
| sigmavirus24 | dstanek: can you get more detail in the stacktrace? | 19:45 |
| dstanek | sigmavirus24: this is a little bit more accurate http://paste.openstack.org/raw/102578/ | 19:46 |
| dstanek | somehow the Stream's _fp attribute is None when it shouldn't be | 19:46 |
| sigmavirus24 | If you're mocking it out with fixtures though | 19:47 |
| dstanek | sigmavirus24: that's what i don't get yet. i'm not sure what jamielennox|away is actually mocking | 19:47 |
| sigmavirus24 | yeah this level of mocking is making my head spin since I haven't dug into the clients much before | 19:48 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Endpoint table is missing reference to region table https://review.openstack.org/113183 | 19:53 |
| henrynash | dolphm, dstanek: i have update the endpoint region patch (since it seemed to be lanquishing) - let me knwo if I missed anything (https://review.openstack.org/#/c/113183/) | 19:55 |
| morganfainberg | dstanek, back | 19:56 |
| morganfainberg | dstanek ah catching up on the scroll back | 19:57 |
| dstanek | morganfainberg: for giggles, i'm converting to responses to see if that works better | 19:57 |
| morganfainberg | lol | 19:57 |
| morganfainberg | dstanek, if it's easier we can have infra push the "pin this" and work to resolve the issue post milestone | 19:58 |
| sigmavirus24 | morganfainberg: in all candor a bunch of requests endusers are going to be pinning to 2.3.0 | 19:59 |
| dstanek | morganfainberg: that's probably a good idea | 19:59 |
| morganfainberg | sigmavirus24, that might be a good enough reason to do so for now. | 19:59 |
| morganfainberg | ok | 19:59 |
| *** diegows has quit IRC | 20:05 | |
| dolphm | henrynash: thank you! | 20:05 |
| *** PsionTheory has quit IRC | 20:06 | |
| *** radez is now known as radez_g0n3 | 20:07 | |
| morganfainberg | dstanek, hah, i just saw your recheck comment on a review i issued a recheck on after :P | 20:13 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: backend for policy endpoint extension https://review.openstack.org/115362 | 20:19 |
| sigmavirus24 | dstanek: https://github.com/shazow/urllib3/blob/0cdc47e88141263717a173dd815e1756d1140a9f/urllib3/response.py#L255 is the line you're having trouble with. Requests streams every response at first and then caches it if stream=False on our end | 20:21 |
| dstanek | sigmavirus24: that's the line indeed | 20:21 |
| sigmavirus24 | Whatever requests-mock/fixtures is doing to mock out the HTTPResponse would seem to be causing the problem | 20:22 |
| dstanek | self._fp is None when it gets there | 20:22 |
| sigmavirus24 | It defaults to None https://github.com/shazow/urllib3/blob/0cdc47e88141263717a173dd815e1756d1140a9f/urllib3/response.py#L90 | 20:22 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 20:22 |
| sigmavirus24 | If the body passed in has no read method it stays None | 20:22 |
| bknudson | morganfainberg: what is [token] driver supposed to be set to now? keystone.token.backends.sql.Token or keystone.token.persistence.backends.sql.Token ? | 20:22 |
| dstanek | sigmavirus24: that is my feeling as well, but i've bailed temporarily to focus on reviews that need to be done | 20:22 |
| morganfainberg | bknudson, the latter | 20:22 |
| sigmavirus24 | Fix the body used in mocking, fix the regression | 20:22 |
| sigmavirus24 | dstanek: where did you leave off (if anywhere)? | 20:23 |
| morganfainberg | bknudson, he backends.sql.Token is for compat so we don't break anyone | 20:23 |
| dstanek | sigmavirus24: i'd love revisit and see if we can use what already existed instead of inventing our own | 20:23 |
| morganfainberg | it just is effectively an alias to the .persistence one | 20:23 |
| bknudson | morganfainberg: devstack looks like it's using the former | 20:23 |
| morganfainberg | bknudson, ah need to fix that then in devstack. | 20:23 |
| morganfainberg | bknudson, easy fix thankfully | 20:24 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 20:24 |
| dstanek | sigmavirus24: i was in the process of converting to use responses; not very far was working on getting the first test running | 20:24 |
| morganfainberg | bknudson, have a patch ready to go if you haven't pushed one yet | 20:25 |
| bknudson | morganfainberg: to devstack? | 20:26 |
| morganfainberg | yeah | 20:26 |
| bknudson | morganfainberg: I haven't been looking at it. | 20:26 |
| morganfainberg | bknudson, ok, i'll push it, it was a 3 line change | 20:26 |
| sigmavirus24 | dstanek: I might just fix requests-mock | 20:26 |
| bknudson | morganfainberg: if the old value is supposed to work, it wasn't with token_flush for some reason. | 20:26 |
| dstanek | sigmavirus24: that would be great | 20:26 |
| morganfainberg | bknudson, huh, | 20:27 |
| henrynash | dolphm, dstanek: quick one to push through: https://review.openstack.org/#/c/117804/ | 20:27 |
| morganfainberg | bknudson, ok i'll take a look at that, but it *should* work even with token_flush | 20:27 |
| sigmavirus24 | I fortunately have a lot of experience mocking out HTTPResonse objects | 20:27 |
| bknudson | morganfainberg: bug 1363224 | 20:27 |
| uvirtbot` | Launchpad bug 1363224 in keystone "token_flush is failing with recursion depth error" [Undecided,In progress] https://launchpad.net/bugs/1363224 | 20:27 |
| bknudson | and I proposed a fix: https://review.openstack.org/#/c/117869/ | 20:27 |
| morganfainberg | bknudson, ah yeah | 20:28 |
| morganfainberg | bknudson, thanks! that looks like the correct fix. | 20:28 |
| morganfainberg | or probably should go through token_provider_api, but eh. that will work too | 20:28 |
| bknudson | morganfainberg: ok, thanks... I was seeing if I could write up a test. | 20:28 |
| morganfainberg | bknudson, yeah i think thats the best approach, not sure how to test it, but def. that fix looks good | 20:30 |
| bknudson | it should be easy to call cli.TokenFlush.main()... not sure why it's proving difficult to recreate. | 20:30 |
| morganfainberg | bknudson, https://review.openstack.org/117878 for devstack fix | 20:31 |
| *** saipandi has quit IRC | 20:38 | |
| *** raildo has left #openstack-keystone | 20:41 | |
| bknudson | the debugger seems to make something weird happen when there's a stack recursion. | 20:47 |
| *** arborism has joined #openstack-keystone | 20:53 | |
| *** shakamunyi has quit IRC | 20:58 | |
| dolphm | henrynash: have time for another patchset? only found a couple slightly-bigger-than-nits https://review.openstack.org/#/c/113183/ | 21:01 |
| henrynash | dolphm: yep, already working on it | 21:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix token flush fails with recursion depth exception https://review.openstack.org/117869 | 21:03 |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| dolphm | henrynash: +A'd the trust kvs one | 21:05 |
| henrynash | dolphm: gerat | 21:05 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Endpoint table is missing reference to region table https://review.openstack.org/113183 | 21:11 |
| henrynash | dolphm: new patch for: https://review.openstack.org/#/c/113183/ | 21:11 |
| *** gokrokve has quit IRC | 21:21 | |
| sigmavirus24 | jamielennox|away: https://review.openstack.org/#/c/117890/ is crucial to the bug that morganfainberg and dstanek were researching earlier | 21:23 |
| dstanek | sigmavirus24: you rock - thx! | 21:23 |
| morganfainberg | sigmavirus24, ++ agree w/ dstanek | 21:23 |
| *** saipandi has joined #openstack-keystone | 21:23 | |
| sigmavirus24 | It was easy to miss | 21:24 |
| *** andreaf has quit IRC | 21:31 | |
| *** andreaf has joined #openstack-keystone | 21:32 | |
| *** gordc has quit IRC | 21:32 | |
| dolphm | dstanek: is this change correct? https://review.openstack.org/#/c/113183/26..27/keystone/common/sql/migrate_repo/versions/053_endpoint_to_region_association.py | 21:33 |
| morganfainberg | dolphm, did we want to revisit https://review.openstack.org/#/c/85210/ or should we just skip havana at this point (being that it's security maint only) | 21:38 |
| morganfainberg | i'm thinking we should just skip it. | 21:38 |
| dolphm | dstanek: morganfainberg: bknudson: can one of ya'll help stevemar get xmlsec1 installed in devstack for k2k? | 21:38 |
| morganfainberg | it also is changing the behavior. | 21:39 |
| stevemar | dolphm, note that that's what we *think* the problem is | 21:39 |
| bknudson | devstack is setting up a k2k configuratoin? | 21:39 |
| dolphm | stevemar: it's likely, unless it's already installed for some reason | 21:39 |
| dolphm | bknudson: oh not devstack. to run keystone unit tests | 21:39 |
| dolphm | functional test | 21:39 |
| stevemar | bknudson, we need it for tests | 21:39 |
| dolphm | s | 21:39 |
| morganfainberg | ah | 21:39 |
| bknudson | tempest? | 21:40 |
| morganfainberg | bknudson, pysaml lib i think | 21:40 |
| bknudson | what is xmlsec1? | 21:40 |
| morganfainberg | Library providing support for "XML Signature" and "XML Encryption" standards | 21:40 |
| stevemar | bknudson, yeah what morganfainberg said... http://www.aleksey.com/xmlsec/ | 21:41 |
| bknudson | looks like sudo apt-get install xmlsec1 | 21:41 |
| bknudson | on my ubuntu 12.04 | 21:41 |
| stevemar | yep | 21:41 |
| dolphm | morganfainberg: abandoned that stable/havana backport | 21:43 |
| morganfainberg | k | 21:43 |
| dolphm | bknudson: or xmlsec1-dev ? | 21:43 |
| dolphm | actually i guess it needs the binary | 21:43 |
| dolphm | nvm | 21:43 |
| stevemar | dolphm, bknudson i think I might have to skip that test in our test suite until it's installed | 21:43 |
| dolphm | stevemar: or check if it's installed first? | 21:44 |
| *** zzzeek_ has joined #openstack-keystone | 21:44 | |
| *** marzif__ has joined #openstack-keystone | 21:45 | |
| stevemar | dolphm, should just be xmlsec1 | 21:50 |
| dolphm | stevemar: yeah, test.skipIf( < something about subprocess.call which xmlsec1 return code happiness > ) | 21:51 |
| *** boris-42_ has joined #openstack-keystone | 21:51 | |
| *** notmyname_ has joined #openstack-keystone | 21:51 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add index for actor_id in assignments table. https://review.openstack.org/117541 | 21:51 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:51 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: backend for policy endpoint extension https://review.openstack.org/115362 | 21:52 |
| *** boris-42 has quit IRC | 21:52 | |
| *** zzzeek has quit IRC | 21:52 | |
| *** bknudson has quit IRC | 21:52 | |
| *** richm has quit IRC | 21:52 | |
| *** med_ has quit IRC | 21:52 | |
| *** marzif_ has quit IRC | 21:52 | |
| *** grantbow has quit IRC | 21:52 | |
| *** notmyname has quit IRC | 21:52 | |
| *** notmyname_ is now known as notmyname | 21:52 | |
| *** zzzeek_ is now known as zzzeek | 21:52 | |
| stevemar | dolphm, thats what i'm doing now | 21:54 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: controller for the endpoint policy extension https://review.openstack.org/115746 | 21:54 |
| *** stevemar2 has joined #openstack-keystone | 22:01 | |
| *** stevemar has quit IRC | 22:01 | |
| *** bknudson has joined #openstack-keystone | 22:03 | |
| *** richm has joined #openstack-keystone | 22:03 | |
| stevemar2 | dolphm, alright, i got something cookin | 22:04 |
| *** dolphm is now known as dolphm2 | 22:04 | |
| dolphm2 | stevemar2: k | 22:04 |
| *** dolphm2 is now known as dolphm | 22:04 | |
| bknudson | we're all 2 now | 22:04 |
| stevemar2 | either my isp or wifi drops a lot | 22:04 |
| stevemar2 | probably wifi | 22:04 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 22:05 |
| *** stevemar2 is now known as bknudson3 | 22:06 | |
| bknudson3 | bknudson, 3>2 | 22:08 |
| henrynash | dolphm, dstanek, morganfainberq: another relatively small one (https://review.openstack.org/#/c/117541/), more stats on performance issue in the big report | 22:09 |
| henrynash | (or bug report, even) | 22:09 |
| *** med_ has joined #openstack-keystone | 22:11 | |
| bknudson3 | lbragstad, ping | 22:11 |
| *** bknudson3 is now known as bknudsondplgner | 22:12 | |
| bknudson | I think the doppleganger problem only exists when your names are close and noone can tell you apart | 22:12 |
| *** med_ has quit IRC | 22:12 | |
| bknudson | like stevemar and stevelle | 22:12 |
| bknudson | and HenryG and henrynash | 22:13 |
| morganfainberg | henrynash, i am leery of the index=True kwarg | 22:14 |
| *** grantbow has joined #openstack-keystone | 22:14 | |
| morganfainberg | henrynash, it got us into a bind in a migraiton in the past (not that you're using it as such now) | 22:14 |
| morganfainberg | henrynash, but even in the model it might make sense to explicitly declare the index expected | 22:15 |
| *** morganfainberg is now known as dolphm3 | 22:15 | |
| dolphm3 | >.> | 22:15 |
| dolphm3 | <.< | 22:15 |
| *** dolphm3 is now known as morganfainberg | 22:15 | |
| henrynash | morgainfainberg: so origionally decalred it explicitely…it was dolphm who suggested to do it index=True :-) | 22:16 |
| morganfainberg | ah | 22:16 |
| morganfainberg | yeah that is what caused us to need to rebuild the whole region table that one migration | 22:16 |
| bknudson | is the index in the model going to make any difference? | 22:17 |
| morganfainberg | bknudson, it does if someone uses reflection to build the schema (our testing) | 22:17 |
| *** topol has quit IRC | 22:17 | |
| morganfainberg | henrynash, still +2 on that | 22:17 |
| henrynash | morganfainberg: here’s how I used to do it: https://review.openstack.org/#/c/117541/3/keystone/assignment/backends/sql.py | 22:18 |
| morganfainberg | right | 22:19 |
| morganfainberg | henrynash, def not giving a -1 on using index=true | 22:19 |
| morganfainberg | henrynash, just saying i'm always leery of it | 22:19 |
| *** bknudson has quit IRC | 22:21 | |
| *** marcoemorais has quit IRC | 22:32 | |
| *** marcoemorais has joined #openstack-keystone | 22:32 | |
| *** joesavak has quit IRC | 22:33 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 22:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 22:43 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 22:43 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on Policy V3 API https://review.openstack.org/104065 | 22:43 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 22:43 |
| dolphm | dstanek: addressed the 255 char limit of policy types in https://review.openstack.org/#/c/104065/ | 22:44 |
| dolphm | morganfainberg: henrynash: oh what was the bind? | 22:47 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 22:48 |
| bknudsondplgner | dolphm, lbragstad thanks for reviewing ^ | 22:48 |
| lbragstad | bknudsondplgner: yo | 22:51 |
| lbragstad | I had to scroll a while to figure out who you were ;) | 22:51 |
| openstackgerrit | Sarvesh Ranjan proposed a change to openstack/keystone: Fixed spelling error from sane to same https://review.openstack.org/117902 | 22:52 |
| bknudsondplgner | hehe | 22:52 |
| lbragstad | bknudsondplgner: I have a question for you on the federation stuff | 22:52 |
| *** bknudsondplgner is now known as ramevets | 22:52 | |
| ramevets | lbragstad, certainly | 22:52 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 22:52 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Implement validation on Credential V3 https://review.openstack.org/98522 | 22:52 |
| lbragstad | ramevets: ok, so you are leveraging the validator in the federation plugin (++, awesome) | 22:53 |
| lbragstad | wondering if if would make sense to structure the tests that test the validator specifically in /keystone/tests/test_validator.py as a new test class | 22:53 |
| ramevets | lemme take a look | 22:54 |
| *** dolphm is now known as pong | 22:55 | |
| ramevets | lbragstad, i dunno, they seem kinda genericy | 22:55 |
| ramevets | generic-y | 22:55 |
| *** pong is now known as Guest24670 | 22:55 | |
| ramevets | Guest24670, the only gues to have mod priv | 22:56 |
| ramevets | guest* | 22:56 |
| lbragstad | so, test_validator.py would house a new test class FederationTestCase | 22:56 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/tests/test_validation.py#L37 | 22:56 |
| lbragstad | ramevets: I think dstanek has some ideas for breaking that out too? | 22:57 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 22:57 |
| ramevets | lbragstad, the only argument against it is that I already have some methods (used in test_v3_federation) that create the body | 22:58 |
| ramevets | lbragstad, tbh, i don't care where the tests exist, but i could certainly add things in a follow up patch or something if you want more coverage | 22:59 |
| ramevets | lbragstad, Guest24670 i'm out for a few hours | 23:04 |
| Guest24670 | ramevets: noooooo | 23:04 |
| *** notmyname has quit IRC | 23:04 | |
| lbragstad | ramevets: sure thing, I would be fine with an additional patch in the future | 23:05 |
| *** notmyname has joined #openstack-keystone | 23:05 | |
| lbragstad | ramevets: the functionality it tested, so at some point in the future we could test just the validators for the federation controller | 23:05 |
| openstackgerrit | Sarvesh Ranjan proposed a change to openstack/keystone: In https://github.com/openstack/keystone/blob/master/keystone/common/base64utils.py Typos: Line No : 143 "enconding" in place of "encoding" Line No : 296 and 300 "multple" in place of "multiple" Line No :313, 350 and 372 "whitepace" in place of "whitespac https://review.openstack.org/117906 | 23:07 |
| *** ramevets has quit IRC | 23:08 | |
| Guest24670 | +2's on https://review.openstack.org/#/c/104065/ https://review.openstack.org/#/c/98522/ and https://review.openstack.org/#/c/96266/ | 23:09 |
| Guest24670 | if anyone wants to review them :) ^ | 23:09 |
| *** amerine_ has quit IRC | 23:15 | |
| openstackgerrit | Rishabh proposed a change to openstack/keystone: Spelling errors fixed in the comments https://review.openstack.org/117911 | 23:21 |
| *** jasondotstar has quit IRC | 23:21 | |
| *** jasondotstar has joined #openstack-keystone | 23:27 | |
| *** xianghui has quit IRC | 23:29 | |
| *** jamielennox|home has joined #openstack-keystone | 23:39 | |
| *** amerine has joined #openstack-keystone | 23:41 | |
| morganfainberg | Guest24670 really guest eh? | 23:43 |
| *** jamielennox|home has quit IRC | 23:43 | |
| *** morganfainberg is now known as SkepticalCore | 23:44 | |
| *** amerine has quit IRC | 23:46 | |
| Guest24670 | SkepticalCore: for sure | 23:46 |
| Guest24670 | to whom it may concern some one please help me install the openstack i downloaded the ubuntu thank you | 23:47 |
| *** david-lyle has quit IRC | 23:47 | |
| SkepticalCore | Guest24670, why cannot i obtain to connect? My internet is the cable and the error reads error | 23:48 |
| Guest24670 | SkepticalCore: try plugging in the and spin in circle | 23:48 |
| *** jamielennox has joined #openstack-keystone | 23:48 | |
| SkepticalCore | Guest24670, instructions unclear ... i'll just stop that meme before it goes too far... | 23:49 |
| *** andreaf has quit IRC | 23:51 | |
| SkepticalCore | Guest24670, +2 on the first two in that series, no +A (pending jenkins vote, feel free and jump the +A if you want) | 23:52 |
| SkepticalCore | Guest24670, still looking at the third one (it's a bit more complex) | 23:52 |
| Guest24670 | SkepticalCore: YAY lbragstad | 23:52 |
| SkepticalCore | omg, my open list of reviews is so much shorter now | 23:53 |
| SkepticalCore | (ones i initiated) | 23:53 |
| SkepticalCore | it's... like i should be reviewing other code instead of rebasing my changes now! :P | 23:53 |
| Guest24670 | SkepticalCore: we're definitely not sitting at a bar approving code reviews just sayin' | 23:53 |
| SkepticalCore | Guest24670, damn, good point, maybe we need a meetup at a bar to approve code! | 23:54 |
| SkepticalCore | quick everyone descend on.. hmm.. it's a bit toasty in SAT now, maybe uhm.. where is the temperature nice? PDX? SEA? | 23:54 |
| Guest24670 | SkepticalCore: both sound nice | 23:54 |
| SkepticalCore | PDX, close to deschuttes then :P | 23:55 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Transform a Keystone token to a SAML assertion https://review.openstack.org/110542 | 23:55 |
| SkepticalCore | this validation code is so much easier to read than the old versions | 23:55 |
| SkepticalCore | it's like i know what to expect the request to look like... or something | 23:56 |
| Guest24670 | SkepticalCore: question! | 23:57 |
| SkepticalCore | Guest24670, Dodgy Answer! | 23:57 |
| Guest24670 | SkepticalCore: the bottom of this file https://review.openstack.org/#/c/110542/45/keystone/contrib/federation/idp.py | 23:57 |
| SkepticalCore | yes | 23:57 |
| Guest24670 | SkepticalCore: see the subprocess call? | 23:57 |
| SkepticalCore | sure do | 23:57 |
| Guest24670 | SkepticalCore: we need to .wait() to avoid a race, right? | 23:57 |
| SkepticalCore | uhm. | 23:57 |
| SkepticalCore | oh.. actually we should use lockutils for this. | 23:58 |
| SkepticalCore | probably | 23:58 |
| Guest24670 | SkepticalCore: ? | 23:58 |
| Guest24670 | SkepticalCore: it's to a random tempfile | 23:58 |
| SkepticalCore | oh wait random temp | 23:58 |
| Guest24670 | SkepticalCore: what will lockutils provide | 23:58 |
| SkepticalCore | then what is the race concern? | 23:58 |
| *** arborism is now known as amcrn | 23:58 | |
| Guest24670 | SkepticalCore: trying to read the tempfile before the subprocess has written one? | 23:58 |
| SkepticalCore | line 410 writes the file | 23:59 |
| SkepticalCore | and closes it | 23:59 |
| Guest24670 | SkepticalCore: oh. i mean reading the stdout before there is anything useful to read | 23:59 |
| SkepticalCore | so no wait needed. it isn't a .flush() or buffer, you're already closed context on the file descriptor by using the write_to_tempfile | 23:59 |
| SkepticalCore | ooooooh | 23:59 |
| SkepticalCore | OH | 23:59 |
| Guest24670 | SkepticalCore: me facepalm | 23:59 |
| Guest24670 | slash | 23:59 |
| Guest24670 | insert | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!