| *** lsmola has quit IRC | 00:00 | |
| *** lsmola has joined #openstack-keystone | 00:12 | |
| *** dims has joined #openstack-keystone | 00:47 | |
| *** gokrokve_ has joined #openstack-keystone | 00:50 | |
| *** gokrokve has quit IRC | 00:52 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 00:53 |
|---|---|---|
| *** gokrokve_ has quit IRC | 00:55 | |
| *** gokrokve has joined #openstack-keystone | 00:56 | |
| *** jamielen- has joined #openstack-keystone | 00:58 | |
| *** jamielennox has quit IRC | 01:00 | |
| *** gokrokve has quit IRC | 01:00 | |
| *** jamielen- is now known as jamielennox | 01:01 | |
| *** jamielennox_ has joined #openstack-keystone | 01:10 | |
| *** jamielen- has joined #openstack-keystone | 01:11 | |
| *** jamielen| has joined #openstack-keystone | 01:12 | |
| *** ncoghlan has joined #openstack-keystone | 01:12 | |
| *** jamielennox has quit IRC | 01:13 | |
| *** jamielennox_ has quit IRC | 01:15 | |
| *** jamielen- has quit IRC | 01:15 | |
| *** jamielen| is now known as jamielennox | 01:18 | |
| *** hrybacki has quit IRC | 01:25 | |
| *** gokrokve has joined #openstack-keystone | 01:26 | |
| *** gokrokve has quit IRC | 01:27 | |
| *** ncoghlan_ has joined #openstack-keystone | 01:27 | |
| *** jamielennox_ has joined #openstack-keystone | 01:28 | |
| *** gokrokve has joined #openstack-keystone | 01:28 | |
| *** ncoghlan__ has joined #openstack-keystone | 01:28 | |
| *** dims has quit IRC | 01:28 | |
| *** ncoghlan has quit IRC | 01:30 | |
| *** jamielennox has quit IRC | 01:31 | |
| *** ncoghlan_ has quit IRC | 01:32 | |
| *** gokrokve has quit IRC | 01:32 | |
| *** gokrokve has joined #openstack-keystone | 01:40 | |
| *** jamielennox_ is now known as jamielennox | 01:40 | |
| *** gokrokve has quit IRC | 01:44 | |
| *** packet has joined #openstack-keystone | 01:45 | |
| *** stevemar has joined #openstack-keystone | 01:53 | |
| *** ncoghlan has joined #openstack-keystone | 02:09 | |
| *** ncoghlan_ has joined #openstack-keystone | 02:10 | |
| *** jamielen- has joined #openstack-keystone | 02:10 | |
| *** jamielennox has quit IRC | 02:13 | |
| *** ncoghlan__ has quit IRC | 02:13 | |
| *** ncoghlan has quit IRC | 02:13 | |
| *** amerine has quit IRC | 02:19 | |
| *** diegows has quit IRC | 02:19 | |
| *** miqui has joined #openstack-keystone | 02:19 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: trustor_user_id not available in v2 trust token https://review.openstack.org/101829 | 02:21 |
| *** wanghong has quit IRC | 02:25 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/password https://review.openstack.org/112230 | 02:30 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Return v3 JSON Home for GET / and GET /v2.0 https://review.openstack.org/118240 | 02:35 |
| *** gokrokve has joined #openstack-keystone | 02:40 | |
| *** wanghong has joined #openstack-keystone | 02:41 | |
| *** gokrokve has quit IRC | 02:45 | |
| *** jamielennox has joined #openstack-keystone | 02:47 | |
| *** ncoghlan__ has joined #openstack-keystone | 02:48 | |
| *** jamielennox_ has joined #openstack-keystone | 02:48 | |
| *** alex_xu has joined #openstack-keystone | 02:49 | |
| *** packet has quit IRC | 02:50 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:51 | |
| *** packet has joined #openstack-keystone | 02:51 | |
| *** packet has quit IRC | 02:51 | |
| *** ncoghlan_ has quit IRC | 02:51 | |
| *** jamielen- has quit IRC | 02:52 | |
| *** jamielennox has quit IRC | 02:52 | |
| *** KanagarajM has joined #openstack-keystone | 02:56 | |
| stevemar | dstanek thanks for reviewing today and yesterday! | 03:00 |
| stevemar | bknudson too, but he's not online | 03:01 |
| *** ncoghlan has joined #openstack-keystone | 03:01 | |
| *** ncoghlan_ has joined #openstack-keystone | 03:01 | |
| *** jamielen- has joined #openstack-keystone | 03:01 | |
| *** ncoghlan__ has quit IRC | 03:03 | |
| *** jamielennox_ has quit IRC | 03:05 | |
| *** ncoghlan has quit IRC | 03:05 | |
| dstanek | stevemar: my pleasure | 03:08 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 03:08 |
| dstanek | stevemar: i only did a few reviews here and there | 03:08 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: API for metadata generation https://review.openstack.org/118074 | 03:10 |
| stevemar | dstanek, i still appreciate it | 03:11 |
| openstackgerrit | A change was merged to openstack/keystone: Implement validation on the Catalog V3 API https://review.openstack.org/96266 | 03:16 |
| *** ncoghlan_ is now known as ncoghlan | 03:17 | |
| *** rkofman has joined #openstack-keystone | 03:19 | |
| *** alex_xu has quit IRC | 03:28 | |
| *** xianghuihui has joined #openstack-keystone | 03:39 | |
| *** alex_xu has joined #openstack-keystone | 03:39 | |
| *** gokrokve has joined #openstack-keystone | 03:40 | |
| *** xianghui has quit IRC | 03:42 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Create SAML generation route and controller https://review.openstack.org/114138 | 03:44 |
| *** gokrokve has quit IRC | 03:45 | |
| *** alex_xu has quit IRC | 03:45 | |
| *** ncoghlan is now known as ncoghlan_afk | 03:46 | |
| *** jamielennox has joined #openstack-keystone | 03:47 | |
| *** jamielennox_ has joined #openstack-keystone | 03:48 | |
| *** ncoghlan_ has joined #openstack-keystone | 03:48 | |
| *** jamielen- has quit IRC | 03:50 | |
| *** ncoghlan_afk has quit IRC | 03:51 | |
| *** jamielennox has quit IRC | 03:52 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:53 | |
| *** ncoghlan_ is now known as ncoghlan_afk | 03:55 | |
| *** alex_xu has joined #openstack-keystone | 03:58 | |
| *** rkofman has left #openstack-keystone | 04:03 | |
| *** rkofman has joined #openstack-keystone | 04:03 | |
| stevemar | dstanek, if you're still there... what did you mean by your first comment here: https://review.openstack.org/#/c/114850/19/keystone/tests/test_v3_federation.py | 04:07 |
| *** chandankumar has joined #openstack-keystone | 04:11 | |
| *** ncoghlan_afk is now known as ncoghlan_ | 04:11 | |
| *** jamielennox has joined #openstack-keystone | 04:14 | |
| *** ncoghlan__ has joined #openstack-keystone | 04:14 | |
| *** ncoghlan has joined #openstack-keystone | 04:15 | |
| *** jamielen- has joined #openstack-keystone | 04:15 | |
| *** jamielennox_ has quit IRC | 04:18 | |
| *** ncoghlan_ has quit IRC | 04:18 | |
| *** xianghuihui has quit IRC | 04:19 | |
| *** ncoghlan__ has quit IRC | 04:19 | |
| *** jamielennox has quit IRC | 04:19 | |
| *** xianghui has joined #openstack-keystone | 04:20 | |
| *** amirosh has joined #openstack-keystone | 04:21 | |
| *** chandankumar has quit IRC | 04:38 | |
| *** gokrokve has joined #openstack-keystone | 04:48 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:50 | |
| *** chandankumar has joined #openstack-keystone | 04:51 | |
| *** gokrokve has quit IRC | 04:52 | |
| *** amirosh has quit IRC | 04:59 | |
| *** amerine has joined #openstack-keystone | 05:00 | |
| openstackgerrit | A change was merged to openstack/keystone: controller for the endpoint policy extension https://review.openstack.org/115746 | 05:02 |
| *** ncoghlan_afk is now known as ncoghlan | 05:03 | |
| *** alex_xu has quit IRC | 05:04 | |
| *** rushiagr_away is now known as rushiagr | 05:05 | |
| dstanek | stevemar: there is a config fixture that i think we got from oslo.config - http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_versions.py#n362 | 05:08 |
| stevemar | ah | 05:08 |
| *** gokrokve has joined #openstack-keystone | 05:13 | |
| *** ajayaa has joined #openstack-keystone | 05:16 | |
| *** gokrokve has quit IRC | 05:18 | |
| *** alex_xu has joined #openstack-keystone | 05:23 | |
| *** gokrokve has joined #openstack-keystone | 05:40 | |
| *** gokrokve has quit IRC | 05:46 | |
| *** ncoghlan_ has joined #openstack-keystone | 05:50 | |
| *** ncoghlan__ has joined #openstack-keystone | 05:51 | |
| *** jamielennox has joined #openstack-keystone | 05:52 | |
| *** ncoghlan has quit IRC | 05:54 | |
| *** jamielen- has quit IRC | 05:54 | |
| *** ncoghlan_ has quit IRC | 05:55 | |
| *** alex_xu has quit IRC | 06:04 | |
| *** k4n0 has joined #openstack-keystone | 06:06 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: API for metadata generation https://review.openstack.org/118074 | 06:06 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 06:08 |
| *** ukalifon has joined #openstack-keystone | 06:10 | |
| *** ncoghlan__ is now known as ncoghlan_afk | 06:10 | |
| *** henrynash has joined #openstack-keystone | 06:11 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: API for metadata generation https://review.openstack.org/118074 | 06:12 |
| *** KanagarajM has quit IRC | 06:13 | |
| *** Clabbe has quit IRC | 06:23 | |
| *** alex_xu has joined #openstack-keystone | 06:24 | |
| jamielennox | stevemar: why can't you just take the token information from X-Auth-Token when generating a SAML assertion? | 06:24 |
| jamielennox | why do you need to submit an auth request? | 06:25 |
| stevemar | jamielennox, ... i don't have a good reason | 06:26 |
| stevemar | yeah that seems like a good fit | 06:26 |
| stevemar | bah | 06:26 |
| jamielennox | are you ever going to need to get a saml assertion for a token that you aren't currently using | 06:26 |
| jamielennox | (also because scope['region']['id'] is not a real thing) | 06:27 |
| stevemar | jamielennox, i think i was just trying to base if off the current rescoping model | 06:27 |
| jamielennox | it's not really a rescoping IMO (and i'm coming to a lot of this late) | 06:28 |
| jamielennox | why not just do it at GET /auth/OS-FEDERATION/saml2/assertion | 06:28 |
| *** jimhoagland has joined #openstack-keystone | 06:28 | |
| jamielennox | stevemar: what happens to region? is it going into the assertion somewhere? (can't see it) | 06:30 |
| jamielennox | region is not something we traditionally deal with as part of auth | 06:31 |
| *** jimhoagland has quit IRC | 06:32 | |
| *** rm_work|away is now known as rm_work | 06:32 | |
| *** ncoghlan_afk is now known as ncoghlan__ | 06:33 | |
| *** alex_xu has quit IRC | 06:34 | |
| stevemar | jamielennox, the region is part of the assertion too | 06:37 |
| stevemar | we get a URL from region | 06:37 |
| stevemar | jamielennox, https://review.openstack.org/#/c/114138/32/keystone/contrib/federation/controllers.py line 268 | 06:38 |
| stevemar | the thinking was that each SP would have a region, and within the URL field, it could specify some data it would want to include in the assertion | 06:38 |
| stevemar | this way the catalog makes a bit more sense, since it'll have endpoints for a different region | 06:39 |
| jamielennox | I don't object to making the catalog make more sense - but it's not how the rest of it works | 06:39 |
| jamielennox | especially to make it a required argument | 06:40 |
| stevemar | region? | 06:40 |
| jamielennox | yea | 06:40 |
| stevemar | you need to determine who the SAML assertion is for | 06:40 |
| jamielennox | why wouldn't that be done via GET /OS-FEDERATION/idp/{id}/ or similar | 06:41 |
| jamielennox | (this is the first i've seen of using regions in federation - so i might be behind on the logic) | 06:42 |
| *** rkofman has quit IRC | 06:43 | |
| *** alex_xu has joined #openstack-keystone | 06:47 | |
| *** bvandenh has joined #openstack-keystone | 06:50 | |
| stevemar | jamielennox, well it would be an sp, not an idp | 06:50 |
| stevemar | so rather than building an entire /OS-FEDERATION/sp/{sp} framework, we opted to just leverage regions | 06:50 |
| stevemar | jamielennox, before i forget - log your comments in the API spec: https://review.openstack.org/#/c/113998/ | 06:51 |
| *** jamielennox_ has joined #openstack-keystone | 06:52 | |
| *** ncoghlan has joined #openstack-keystone | 06:52 | |
| *** ncoghlan_ has joined #openstack-keystone | 06:53 | |
| *** jamielen- has joined #openstack-keystone | 06:53 | |
| jamielen- | stevemar: this seems to imply we have SPs listed in the service catalog? | 06:54 |
| jamielen- | bah - network has been flaky all day | 06:55 |
| *** jamielennox has quit IRC | 06:56 | |
| jamielen- | I would think that SPs that require a SAML assertion are rare - essentially only when you want to talk to a new keystone | 06:56 |
| *** ncoghlan__ has quit IRC | 06:56 | |
| jamielen- | that seems like a good thing to have controlled via an admin in some sort of /sp/{id} framework | 06:56 |
| *** jamielennox_ has quit IRC | 06:57 | |
| *** ncoghlan has quit IRC | 06:57 | |
| jamielen- | stevelle: would an external keystone have the same public/private/admin endpoints that a catalog endpoint does? | 06:58 |
| jamielen- | stevemar: ^ | 06:58 |
| stevemar | jamielen-, so we already have keystone as an SP being able to talk SAML (icehouse impl.) | 06:59 |
| jamielen- | right - that's token issuing | 07:00 |
| stevemar | jamielen-, re: sp/{sp} framework, i thought so too, but apparently too much overhead for just a url | 07:00 |
| *** chandankumar has quit IRC | 07:01 | |
| stevemar | jamielen-, so if i connect to my keystone, i get back a catalog (regionIBM is my local keystone), regionRH is the other service provider | 07:01 |
| stevemar | then I can get an SAML assertion by giving a token ID and regionRH | 07:01 |
| jamielen- | so the SP url is just in the regular catalog? | 07:01 |
| jamielen- | under some bogus service_type? | 07:02 |
| *** openstackgerrit has quit IRC | 07:02 | |
| stevemar | jamielen-, i was working w/ the assumption that different regions were in the catalog | 07:04 |
| jamielen- | stevemar: oh god - when did we add a url to a region | 07:04 |
| stevemar | i guess it depends on the endpoint | 07:04 |
| jamielen- | how is that more lightweight than having an SP url? | 07:05 |
| stevemar | few weeks back | 07:05 |
| jamielen- | aww, this is such a bad idea.... | 07:05 |
| stevemar | jamielen-, it was a whole discussion about adding less code | 07:06 |
| jamielen- | stevemar: by overloading concepts | 07:06 |
| jamielen- | what does a URL on a region mean if we aren't using federtaion? | 07:06 |
| stevemar | jamielen-, ugh | 07:07 |
| jamielen- | cause at the moment a region is pretty much just a label | 07:07 |
| jamielen- | something that you can filter the catalog by | 07:07 |
| stevemar | jamielen-, blah, we had the impl: https://review.openstack.org/#/c/104623/ | 07:08 |
| jamielen- | even hierarchically it's just a way to filter | 07:08 |
| stevemar | jamielen-, talk it over with dolphm and marekd ... maybe i'm forgetting something fundamental here | 07:09 |
| stevemar | it is > 3am for me | 07:09 |
| stevemar | i don't want to add to the fear machine that we f*ed things up | 07:09 |
| jamielen- | stevemar: yea, i figured it was late as it's end of day for me | 07:09 |
| stevemar | by giving you bad info | 07:09 |
| stevemar | keystone meeting in <12 hrs | 07:10 |
| stevemar | you might be able to catch marekd, he's starting soon | 07:10 |
| jamielen- | i'll add it to the agenda - feature freeze is in 2 days, maybe we can revert at least the regions bit for now because it won't be ready for juno anyway | 07:10 |
| morganfainberg | ... | 07:11 |
| stevemar | jamielen-, thanks for looking at the API, add your concern about the region in scope there too | 07:11 |
| * morganfainberg reads the scrollback | 07:11 | |
| stevemar | ah crap | 07:11 |
| stevemar | you're awake | 07:11 |
| *** KanagarajM has joined #openstack-keystone | 07:11 | |
| jamielen- | morganfainberg: better late than never - but only just | 07:11 |
| stevemar | jamielen-, fwiw: http://specs.openstack.org/openstack/keystone-specs/specs/juno/keystone-to-keystone-federation.html | 07:11 |
| morganfainberg | stevemar, i've been awaek, ijust been ignoreing irc :P | 07:11 |
| stevemar | morganfainberg, good idea | 07:11 |
| *** jamielen- is now known as jamielennox | 07:11 | |
| * jamielennox is whole again | 07:12 | |
| morganfainberg | issue with k2k stuff? | 07:12 |
| stevemar | yeah | 07:12 |
| stevemar | well maybe | 07:12 |
| stevemar | morganfainberg, you were at the hackathon | 07:12 |
| jamielennox | not k2k specifically - just it's overloading core concepts that i think is a bad idea | 07:12 |
| morganfainberg | yes | 07:12 |
| jamielennox | damnit i was wondering where all this was discussed and i missed it | 07:12 |
| morganfainberg | i was at the hackathon | 07:12 |
| stevemar | what was the argument for using URL in regions vs adding OS-FED/sp/{sp} instead? | 07:12 |
| morganfainberg | there was an argument for urls in regions? | 07:13 |
| jamielennox | lol | 07:13 |
| morganfainberg | oh the auth url | 07:13 |
| stevemar | i swear i'm not making this up | 07:13 |
| morganfainberg | yes, the auth url so you know where to send the SAML to | 07:13 |
| stevemar | yes | 07:13 |
| morganfainberg | it's IDP originated SAML assertions (vs. the normal SP originated[requested]) | 07:14 |
| morganfainberg | since you need a token from the remote IDP, the thought was (adn this might have been token, pre-saml) you then know who to re-auth with (exchange tokens) | 07:15 |
| stevemar | morganfainberg, i recall someone mentioning that it wasn't worth adding OS-FEDERATION/sp/{sp} because of all the new code it would introduce (routers, controller, core, tests), when we could just add a field to regions (maybe dolphm?) | 07:15 |
| morganfainberg | i think that was the argument when usng keystone tokens as a transport | 07:15 |
| stevemar | ah yes | 07:15 |
| stevemar | i think it was the argument for either? (keystone tokens or saml assertions) | 07:16 |
| morganfainberg | now you need to exchange for SAML anyway, so that isn't as relevant | 07:16 |
| morganfainberg | and i *think* it needed to be signed for the specific destination? | 07:16 |
| morganfainberg | honestly | 07:16 |
| stevemar | that sounds right | 07:16 |
| morganfainberg | i don't remember all of it. | 07:17 |
| morganfainberg | i know that the auth url bit was *really* for the token transport | 07:17 |
| morganfainberg | if you're using mod_shib i think most of those concerns go out the window. | 07:17 |
| morganfainberg | or maybe not | 07:18 |
| morganfainberg | maybe it still works out "get me a saml assertion, then use the auth_url for whatever region you're going to?" | 07:18 |
| stevemar | morganfainberg, i think that sums up the intention | 07:19 |
| stevemar | morganfainberg, now i'm worried about how the user is going to know the region ID? | 07:19 |
| stevemar | morganfainberg, it's not exactly in the catalog | 07:20 |
| stevemar | because it's not an endpoint | 07:20 |
| morganfainberg | isn't region id supposed to be region name? | 07:20 |
| stevemar | morganfainberg, it can be | 07:20 |
| morganfainberg | iirc that was the original intent, not opaque uuid | 07:20 |
| morganfainberg | unless you *really* want uuid regions (i dunno, maybe some govt install?) | 07:21 |
| morganfainberg | get_region_by_name? | 07:21 |
| morganfainberg | method | 07:21 |
| stevemar | morganfainberg, so it's OK to assume that the client can figure that part out? (the region user defined name / id) ? | 07:21 |
| morganfainberg | might need to add an api foe it | 07:22 |
| morganfainberg | region names are unique right? | 07:22 |
| morganfainberg | if so obly use region namses not ids | 07:23 |
| ajayaa | morganfainberg, can you please do a review of https://review.openstack.org/#/c/110575/ | 07:24 |
| morganfainberg | anyway i need to sleep | 07:24 |
| morganfainberg | stevemar, talk tomorrow | 07:24 |
| stevemar | morganfainberg, region's do not have names, they have user defined id's | 07:24 |
| stevemar | yeah | 07:24 |
| stevemar | see ya | 07:24 |
| morganfainberg | ajayaa, it's unfortunately past midnight, code reviewing is not in the books right now | 07:25 |
| ajayaa | morganfainberg, tommorw then | 07:25 |
| ajayaa | :) | 07:25 |
| morganfainberg | ajayaa ++ | 07:25 |
| jamielennox | morganfainberg: sorry missed that part of the conversation | 07:27 |
| jamielennox | morganfainberg: so what does a url on a region mean if you aren't using federation? | 07:27 |
| jamielennox | how does the concept of a federated region affect just using regions for the exsiting purposed | 07:28 |
| jamielennox | purposes | 07:28 |
| morganfainberg | an auth url you can use? i think it also is used for unscoped tokens (concept, where you have auth endpoints) | 07:28 |
| *** afazekas has joined #openstack-keystone | 07:28 | |
| jamielennox | how do i get a list of other SPs that i can send an assertion to? | 07:28 |
| morganfainberg | i think... | 07:28 |
| morganfainberg | i or maybe regions with urls are federated and otherwise don | 07:29 |
| morganfainberg | t have urls | 07:29 |
| morganfainberg | i think that *is* what we talked about | 07:29 |
| morganfainberg | only federated regions would have url | 07:29 |
| jamielennox | morganfainberg: you're mixing core and extension concepts | 07:29 |
| morganfainberg | sorry it's late :( | 07:29 |
| *** stevemar has quit IRC | 07:29 | |
| morganfainberg | i absolutely dislike the extensions mechanism we have in keystone | 07:29 |
| jamielennox | are we expecting k2k to be a part of juno? | 07:30 |
| morganfainberg | ideally. | 07:30 |
| jamielennox | morganfainberg: what is a federated region? | 07:30 |
| jamielennox | a region is just a region | 07:30 |
| morganfainberg | a remote keystone you can send an asserttion to and get a token | 07:30 |
| jamielennox | shit, so it's too late for me to propose backing this out | 07:30 |
| jamielennox | morganfainberg: why would we mix that with the existing concepts of regions | 07:30 |
| morganfainberg | because something something extension concepts are awful and segregate things in weird ways | 07:31 |
| jamielennox | morganfainberg: but we have that already | 07:31 |
| jamielennox | morganfainberg: my problem is that if you aren't using federation then this whole thing is wrong | 07:31 |
| jamielennox | a URL is completely ignore | 07:32 |
| jamielennox | d | 07:32 |
| morganfainberg | it is likely because instead of asking for OS-FEDERATION for a list of k2k endpoints, just use the current service catalog | 07:32 |
| jamielennox | if we are using federation how do we know which regions are 'federated' and not | 07:32 |
| morganfainberg | origoinally we were going to use tokens as the transport, not saml | 07:32 |
| jamielennox | morganfainberg: what if i want to use my token to get access to an endpoint in a different region to my saml provider | 07:33 |
| morganfainberg | and therefore didn't need to ask the local keystone to do a transform | 07:33 |
| morganfainberg | you must *always* get a token from the authoritative keystone for a federated region | 07:33 |
| jamielennox | the only way this works is if we suddenly enforce that region is part of authentication - currently it's not, it's just a filter | 07:33 |
| morganfainberg | keystone for region X cannot issue a token that works in region Y, you must ask region y for a token | 07:34 |
| jamielennox | so what happens with our existing regions that are just kind of floating? | 07:34 |
| morganfainberg | you pass the assertion to region Y and it gives a token | 07:34 |
| morganfainberg | rgions w/o that are authed normally. | 07:34 |
| morganfainberg | e.g. standard auth endpoint | 07:34 |
| morganfainberg | existing regions wouldn't have a url iirc | 07:35 |
| morganfainberg | because the token from any of those regions would work | 07:35 |
| morganfainberg | honestly, you need to ask marekd at this point. it's too late and i don't remember | 07:35 |
| morganfainberg | i'm making things up and giving bad info i'm sure | 07:36 |
| morganfainberg | also, if this can't land in Juno it can't land. broken = worse than waiting for K | 07:36 |
| morganfainberg | too late = omg past midnight here and i'm tired | 07:36 |
| jamielennox | morganfainberg: right, does this falls under feature freeze? | 07:36 |
| morganfainberg | afaik yes | 07:37 |
| morganfainberg | i also think we can revert post FF if it's not viable | 07:37 |
| morganfainberg | we could easily get it on a feature branch and get it right there, then in K move it to master | 07:38 |
| morganfainberg | (same as the heirarchyg stuff) | 07:38 |
| jamielennox | i tagged it for tomorrows meeting | 07:38 |
| jamielennox | and next time i think i need to push to go to the midcycles | 07:38 |
| *** gokrokve has joined #openstack-keystone | 07:40 | |
| *** gokrokve has quit IRC | 07:42 | |
| *** gokrokve has joined #openstack-keystone | 07:42 | |
| *** henrynash has quit IRC | 07:42 | |
| *** gokrokve has quit IRC | 07:46 | |
| *** dims has joined #openstack-keystone | 07:56 | |
| *** dims has quit IRC | 08:00 | |
| *** afazekas has quit IRC | 08:05 | |
| *** afazekas has joined #openstack-keystone | 08:06 | |
| *** wanghong has quit IRC | 08:08 | |
| *** jamielennox is now known as jamielennox|away | 08:09 | |
| *** morganfainberg is now known as morganfainberg_Z | 08:12 | |
| *** amirosh has joined #openstack-keystone | 08:18 | |
| *** KanagarajM has quit IRC | 08:19 | |
| *** jaosorior has joined #openstack-keystone | 08:25 | |
| *** wanghong has joined #openstack-keystone | 08:27 | |
| *** gokrokve has joined #openstack-keystone | 08:40 | |
| *** gokrokve has quit IRC | 08:46 | |
| *** andreaf has joined #openstack-keystone | 08:47 | |
| *** mflobo_ has joined #openstack-keystone | 08:58 | |
| *** mflobo has quit IRC | 09:01 | |
| *** ncoghlan_ has quit IRC | 09:09 | |
| *** i159 has joined #openstack-keystone | 09:20 | |
| *** mflobo has joined #openstack-keystone | 09:22 | |
| *** mflobo_ has quit IRC | 09:25 | |
| *** alex_xu has quit IRC | 09:25 | |
| *** mflobo_ has joined #openstack-keystone | 09:26 | |
| *** mflobo has quit IRC | 09:29 | |
| *** aix has joined #openstack-keystone | 09:29 | |
| *** mflobo has joined #openstack-keystone | 09:32 | |
| *** mflobo_ has quit IRC | 09:36 | |
| *** rm_work is now known as rm_work|away | 09:37 | |
| *** gokrokve has joined #openstack-keystone | 09:40 | |
| *** gokrokve has quit IRC | 09:45 | |
| *** rm_work|away is now known as rm_work | 09:59 | |
| *** rm_work is now known as rm_work|away | 10:13 | |
| *** ajayaa has quit IRC | 10:32 | |
| *** KanagarajM has joined #openstack-keystone | 10:33 | |
| *** ajayaa has joined #openstack-keystone | 10:33 | |
| *** gokrokve has joined #openstack-keystone | 10:40 | |
| *** gokrokve has quit IRC | 10:44 | |
| *** dims has joined #openstack-keystone | 10:46 | |
| *** dims has quit IRC | 10:50 | |
| *** gokrokve has joined #openstack-keystone | 11:40 | |
| *** dims has joined #openstack-keystone | 11:42 | |
| *** gokrokve has quit IRC | 11:45 | |
| *** k4n0 has quit IRC | 11:46 | |
| *** alex_xu has joined #openstack-keystone | 11:48 | |
| *** jaosorior has quit IRC | 12:02 | |
| *** dims has quit IRC | 12:08 | |
| *** dims has joined #openstack-keystone | 12:08 | |
| *** AJaeger has joined #openstack-keystone | 12:16 | |
| *** KanagarajM has quit IRC | 12:17 | |
| *** jasondotstar has quit IRC | 12:19 | |
| *** rushiagr is now known as rushiagr_away | 12:22 | |
| *** diegows has joined #openstack-keystone | 12:22 | |
| *** htruta has joined #openstack-keystone | 12:24 | |
| *** htruta has quit IRC | 12:27 | |
| *** alex_xu has quit IRC | 12:29 | |
| *** gordc has joined #openstack-keystone | 12:58 | |
| *** samuelmz has joined #openstack-keystone | 13:09 | |
| *** AJaeger has left #openstack-keystone | 13:12 | |
| *** ayoung has joined #openstack-keystone | 13:14 | |
| *** htruta has joined #openstack-keystone | 13:16 | |
| *** jaosorior has joined #openstack-keystone | 13:17 | |
| *** bknudson has joined #openstack-keystone | 13:23 | |
| *** joesavak has joined #openstack-keystone | 13:24 | |
| *** rushiagr_away is now known as rushiagr | 13:27 | |
| *** gokrokve has joined #openstack-keystone | 13:40 | |
| *** jasondotstar has joined #openstack-keystone | 13:41 | |
| *** gokrokve has quit IRC | 13:45 | |
| *** BAKfr has joined #openstack-keystone | 13:47 | |
| *** openstackgerrit has joined #openstack-keystone | 13:50 | |
| *** openstackgerrit has joined #openstack-keystone | 13:51 | |
| *** lnxnut has joined #openstack-keystone | 13:51 | |
| *** r-daneel has joined #openstack-keystone | 13:54 | |
| *** gokrokve has joined #openstack-keystone | 13:56 | |
| *** zzzeek has joined #openstack-keystone | 13:59 | |
| *** openstackgerrit has joined #openstack-keystone | 14:01 | |
| *** stevemar has joined #openstack-keystone | 14:04 | |
| *** _d34dh0r53_ is now known as d34dh0r53 | 14:04 | |
| *** openstackgerrit has joined #openstack-keystone | 14:05 | |
| *** topol has joined #openstack-keystone | 14:07 | |
| *** montanvi is now known as bambam1 | 14:14 | |
| marekd | stevemar: ping. | 14:14 |
| stevemar | marekd, pong | 14:14 |
| stevemar | im awake now | 14:14 |
| marekd | stevemar: erm, token2saml is merged, but my metadata generator still depends on the previous commit. Any quick advice how to push the commit fast? Simply type 'yes' when gerrit asks if I really want to push two commits (like you always do in case depending patches)? | 14:15 |
| stevemar | marekd, i'll do something quick | 14:16 |
| marekd | stevemar: ok. | 14:16 |
| marekd | well, actually my question can be answered by anybody :-) | 14:16 |
| stevemar | marekd, i'll rebase it, and upload a new version, thats ok? | 14:16 |
| marekd | token2saml? | 14:16 |
| marekd | or metadata gen? | 14:17 |
| stevemar | marekd, the rebase button in gerrit doesn't work? | 14:19 |
| stevemar | metadata gen | 14:19 |
| stevemar | marekd, when it asks you to upload 2 versions, what's the change id? | 14:19 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 14:20 |
| *** amirosh has quit IRC | 14:21 | |
| marekd | stevemar: IdP Metadata Generator: I9e4b2f068a8190215749b95f31d634eb09c1e3f1 | 14:21 |
| marekd | so the same as on the review.openstack.org | 14:21 |
| *** amirosh has joined #openstack-keystone | 14:21 | |
| *** david-lyle has joined #openstack-keystone | 14:22 | |
| stevemar | nah, the other one... when you type in git review | 14:22 |
| i159 | bknudson: Hi! I'm sorry for disturbing you... I have couple of KS patches, which you had reviewed. Can you please pay a little more attention to it? https://review.openstack.org/#/c/80630/ https://review.openstack.org/#/c/93558/ Thanks! | 14:24 |
| *** bvandenh has quit IRC | 14:25 | |
| marekd | stevemar: http://pasteraw.com/jya2kalpz9tjhk7br7z20d2n0vudgtx | 14:25 |
| *** amirosh has quit IRC | 14:26 | |
| bknudson | i159: I've been reviewing changes for the feature freeze deadline lately | 14:26 |
| stevemar | marekd, looks like you posted something | 14:27 |
| marekd | rebase | 14:27 |
| marekd | so generator is not depending on the token2saml | 14:28 |
| *** nkinder has joined #openstack-keystone | 14:28 | |
| stevemar | marekd, cool | 14:28 |
| marekd | stevemar: but it doesn't reflect my changes | 14:28 |
| marekd | that address your comments. | 14:29 |
| marekd | w8 | 14:29 |
| stevemar | sure | 14:29 |
| *** andreaf has quit IRC | 14:31 | |
| *** alex_xu has joined #openstack-keystone | 14:32 | |
| dstanek | lbragstad: where you still working on trust validation? | 14:33 |
| *** rkofman has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Fix minor nits for token2saml generation. https://review.openstack.org/118272 | 14:34 |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Initial kerberos plugin implementation. https://review.openstack.org/74317 | 14:35 |
| i159 | bknudson: yep, ok. So, if you will have several minutes, I'll be very grateful! | 14:36 |
| dstanek | stevemar: ping | 14:41 |
| stevemar | dstanek, pong | 14:42 |
| dstanek | stevemar: quick question about https://review.openstack.org/#/c/113998/ - the token id in the body - is it the id of the token in the header? | 14:42 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 14:42 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:43 | |
| stevemar | dstanek, yeah, i guess it should be ... someone should only be able to swap their own token for a SAML assertion | 14:44 |
| dstanek | stevemar: if that's the case do you need it in the body? | 14:45 |
| dstanek | stevemar: i'm assuming the thought there was that i could specify the id for an of my valid tokens, but i'm not sure what that buys yo | 14:46 |
| dstanek | u | 14:46 |
| stevemar | dstanek, that's true | 14:46 |
| stevemar | but tokens only last for so long before they expire, do people really have a bunch of token ids they can use? | 14:47 |
| *** shakamunyi has joined #openstack-keystone | 14:48 | |
| dstanek | stevemar: i doubt it which is why i think taking the token from the header would be enough | 14:49 |
| stevemar | marekd, hit that rebase button on your other patches! | 14:49 |
| marekd | stevemar: yeah | 14:49 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Generate IdP Metadata with keystone-manage. https://review.openstack.org/115564 | 14:50 |
| stevemar | dstanek, alright, you and jamielennox|away think it's better that way, i'll start working on new patches, hoping dolphm can weigh in | 14:50 |
| stevemar | dstanek, it's all going to be hidden from the user anyway, by using keystoneclient | 14:50 |
| lbragstad | dstanek: yeah, hitting an issue with it | 14:51 |
| marekd | stevemar: you are talking returning saml assertion in a header now? | 14:52 |
| lbragstad | dstanek: I think it boils down to how far we want to take validating the expires_at field | 14:52 |
| stevemar | marekd, no, it would still be returned in the body | 14:53 |
| stevemar | just the keystone token, does it go in header vs in body | 14:53 |
| lbragstad | dstanek: this is already in the controller, https://github.com/openstack/keystone/blob/master/keystone/trust/controllers.py#L183 | 14:53 |
| lbragstad | dstanek: we could try and leverage the format checking provided in jsonschema, but that depends on strict-rfc3999, which is GNU licensed I believe. | 14:56 |
| dstanek | lbragstad: i just commented on the review | 14:59 |
| dstanek | i think that the date needs to be nullable | 14:59 |
| lbragstad | dstanek: yeah, I worked that in, here is what it looks like now: http://paste.openstack.org/show/104783/ | 15:01 |
| *** ukalifon has quit IRC | 15:01 | |
| marekd | stevemar: thanks for the +2!:-) | 15:01 |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Routes for Keystone-IdP metadata endpoint https://review.openstack.org/115883 | 15:01 |
| marekd | stevemar: however, please take a look here https://review.openstack.org/#/c/114850/19..21/keystone/contrib/federation/idp.py, especially my comment about sigver.read_cert_from_file() in patch version 19. | 15:03 |
| *** diegows has quit IRC | 15:03 | |
| stevemar | marekd, yeah, i read it this morning, i think it's fine to make our own function | 15:03 |
| marekd | stevemar: ok. | 15:03 |
| marekd | stevemar: thanks. | 15:03 |
| stevemar | i used sigver.read_cert_from_file in a test, but i guess thats OK | 15:03 |
| marekd | stevemar: test is not a real code :-) | 15:04 |
| stevemar | yep | 15:04 |
| marekd | stevemar: and i think the function is not correct | 15:04 |
| marekd | (no close() on a file handler) | 15:04 |
| stevemar | yeah | 15:04 |
| *** marekd is now known as marekd|away | 15:04 | |
| *** shakamunyi has quit IRC | 15:07 | |
| *** alex_xu has quit IRC | 15:08 | |
| stevemar | dstanek, ping | 15:10 |
| dstanek | stevemar: poing | 15:10 |
| stevemar | dstanek, so if i go towards x-auth-token in the header for that call | 15:10 |
| stevemar | how should i change the request body? i don't think i can use /auth at the beginning either | 15:11 |
| dstanek | stevemar: with the API as written you'd already be expecting the token right? | 15:11 |
| *** shakamunyi has joined #openstack-keystone | 15:11 | |
| dstanek | stevemar: or i guess you probably wouldn't | 15:12 |
| stevemar | correct | 15:13 |
| stevemar | dstanek, | 15:13 |
| dstanek | stevemar: what does the api for exchanging a token for another token look like? i'm not at all opposed to what you have - i just wanted to understand the discussion | 15:13 |
| stevemar | https://etherpad.openstack.org/p/token2saml | 15:13 |
| stevemar | dstanek, it looks exactly like what I initially had | 15:14 |
| dstanek | stevemar: then i'm fine with leaving it as is - makes sense to be the same | 15:14 |
| *** gokrokve has quit IRC | 15:15 | |
| stevemar | dstanek, it looks like http://docs.openstack.org/developer/keystone/api_curl_examples.html#getting-a-token-from-a-token | 15:16 |
| dstanek | stevemar: brb - picking up my son from his first day at preschool | 15:17 |
| stevemar | definitely more important | 15:17 |
| *** gokrokve has joined #openstack-keystone | 15:19 | |
| raildo1 | dstanek: dolphm, We have a question about our branch of hierarchical multitenancy. | 15:23 |
| raildo1 | What better way to keep it updated with the master? | 15:23 |
| raildo1 | We want to commit our code, but it shows that will commit all the other changes together. (as you can see here: http://paste.openstack.org/show/104791/) | 15:24 |
| raildo1 | What we should do to keep our branch updated and commit only our change? | 15:24 |
| *** ukalifon has joined #openstack-keystone | 15:35 | |
| dstanek | stevemar: back | 15:41 |
| stevemar | dstanek, that was quick | 15:41 |
| dstanek | raildo1: did you checkout that branch locally and put your changes on top? | 15:42 |
| *** cjellick has joined #openstack-keystone | 15:43 | |
| dstanek | raildo1: it looks like you are pushing all master commit to it - i think you would normally do that with a single merge commit | 15:43 |
| openstackgerrit | Sergey Kraynev proposed a change to openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 15:44 |
| stevemar | bknudson, whats the option for enumerating values for an oslo config option? | 15:45 |
| bknudson | stevemar: I don't know if there is one. | 15:45 |
| bknudson | seems like there should be. | 15:45 |
| *** gyee has joined #openstack-keystone | 15:45 | |
| bknudson | I don't see one... we'd have to roll our own. | 15:46 |
| *** shakamunyi has quit IRC | 15:46 | |
| *** mflobo has quit IRC | 15:46 | |
| stevemar | bknudson, https://github.com/openstack/oslo.config/blob/master/oslo/config/cfg.py#L579-L632 | 15:46 |
| stevemar | i don't see one either | 15:46 |
| stevemar | bknudson, regarding the defaults and such | 15:47 |
| bknudson | ok, let's just stick with a StrOpt and validate it ourselves. | 15:48 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 15:48 | |
| *** mflobo has joined #openstack-keystone | 15:48 | |
| stevemar | bknudson, idp_entity_id and idp_sso_endpoint are the only ones that are really required | 15:48 |
| dstanek | stevemar: he was right down the street | 15:48 |
| stevemar | we can generate a valid metadata without contact person info, some SPs might require it, but we don't need to enforce it | 15:48 |
| bknudson | stevemar: ok... then the command should fail with a useful error message if they're not present. | 15:49 |
| stevemar | bknudson, so bail out / error out if the 2 required ones are not present | 15:49 |
| stevemar | and if the contact related ones are present, then we should build the contact info, otherwise, don't | 15:49 |
| *** radez_g0` is now known as radez | 15:49 | |
| stevemar | bknudson, so for the two required ones, do we want to put some default value in there? | 15:50 |
| stevemar | or because it'll be meaningless, we shouldn't default, but rather error out... ? | 15:50 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Trust V3 API https://review.openstack.org/104066 | 15:50 |
| dstanek | stevemar, bknudson: i thought there was an easy way to iterate over the config | 15:51 |
| bknudson | stevemar: if there's no meaningful default then don't put one there and fail if it wasn't set | 15:52 |
| *** richm has joined #openstack-keystone | 15:56 | |
| *** rkofman has quit IRC | 15:56 | |
| *** andreaf has joined #openstack-keystone | 15:57 | |
| *** rkofman has joined #openstack-keystone | 15:58 | |
| *** wwriverrat has joined #openstack-keystone | 15:59 | |
| *** afazekas has quit IRC | 15:59 | |
| *** i159 has quit IRC | 16:03 | |
| *** andreaf has quit IRC | 16:04 | |
| *** shakamunyi has joined #openstack-keystone | 16:04 | |
| stevemar | bknudson, if the options are not there, error out on 400? | 16:05 |
| bknudson | stevemar: I'm going to get a 400 response from keystone-manage ? | 16:06 |
| *** dhu_super_super has quit IRC | 16:08 | |
| stevemar | bknudson, OK that doesn't fit? any suggestions? | 16:08 |
| bknudson | stevemar: raise an exception | 16:08 |
| *** morganfainberg_Z is now known as morganfainberg | 16:11 | |
| *** andreaf has joined #openstack-keystone | 16:17 | |
| morganfainberg | mornin | 16:18 |
| *** andreaf has quit IRC | 16:18 | |
| *** andreaf has joined #openstack-keystone | 16:18 | |
| morganfainberg | lbragstad, ping | 16:19 |
| *** shakamunyi has quit IRC | 16:20 | |
| *** hrybacki has joined #openstack-keystone | 16:23 | |
| dstanek | raildo1: looks like you got it working OK now | 16:23 |
| dstanek | lbragstad: running those tests locally now | 16:23 |
| *** BAKfr has quit IRC | 16:24 | |
| dstanek | morganfainberg: that date validation is a little tricky | 16:30 |
| morganfainberg | dstanek, i'd just use a custom formatchecker that overrides datetime to parse_isotime() | 16:30 |
| morganfainberg | dstanek, it's really what we expect internally for the most part | 16:31 |
| *** marcoemorais has joined #openstack-keystone | 16:31 | |
| dstanek | yep, i totally agree | 16:31 |
| *** rushiagr is now known as rushiagr_away | 16:32 | |
| morganfainberg | should be an easy addon, but doesn't need to go in that patchset | 16:32 |
| morganfainberg | that can be done as a bug fix / followup | 16:32 |
| lbragstad | morganfainberg: dstanek back | 16:33 |
| lbragstad | needed a reboot | 16:33 |
| lbragstad | well, the computer needed a reboot | 16:33 |
| lbragstad | morganfainberg: dstanek do you want a FIXME added to the schema for trusts? | 16:36 |
| morganfainberg | lbragstad, nah, just do it as a followup patch :) | 16:36 |
| lbragstad | morganfainberg: ok, sounds good | 16:36 |
| morganfainberg | lbragstad, we are going to want the timevalidation for other things. | 16:36 |
| lbragstad | morganfainberg: like tokens | 16:36 |
| lbragstad | ? | 16:36 |
| morganfainberg | lbragstad, in K i'm going to convert the token model to use it | 16:36 |
| morganfainberg | lbragstad, ++ yep | 16:37 |
| lbragstad | morganfainberg: cool | 16:37 |
| lbragstad | morganfainberg: what formats do we want to validate for timestamps? | 16:39 |
| morganfainberg | lbragstad, funnel it through parse_isotime | 16:39 |
| morganfainberg | it's how we validate strings, ISO8601 format | 16:39 |
| dstanek | lbragstad: morganfainberg: look at the very bottom of https://python-jsonschema.readthedocs.org/en/latest/validate/#validating-formats | 16:40 |
| morganfainberg | dstanek, that is what i was looking at | 16:41 |
| lbragstad | For backwards compatibility, isodate is also supported, but it will allow any ISO 8601 date-time, not just RFC 3339 as mandated by the JSON Schema specification. | 16:41 |
| dstanek | lbragstad: yep, unfortunately that's what we accept | 16:43 |
| dolphm | jamielennox|away: when you're up, can you follow up on https://review.openstack.org/#/c/113998/ | 16:44 |
| *** bklei has joined #openstack-keystone | 16:44 | |
| dolphm | dstanek: you're probably already looking at this, but this implements the API you just reviewed https://review.openstack.org/#/c/114138/ | 16:45 |
| dolphm | dstanek: if jamie is +1, then i'd like to be ready to +A that one | 16:45 |
| dstanek | dolphm: k, i'll look again now. since it's WF-1 it doesn't show up in my searches | 16:46 |
| dolphm | dstanek: =D https://review.openstack.org/#/q/starredby:dolph+is:open,n,z | 16:46 |
| *** wwriverrat has left #openstack-keystone | 16:46 | |
| *** bobt has joined #openstack-keystone | 16:46 | |
| dolphm | dstanek: thanks! | 16:46 |
| dstanek | dolphm: yeah, i went through all of those once so now I'm back to my original patterns... | 16:47 |
| *** gokrokve has quit IRC | 16:47 | |
| morganfainberg | lbragstad, +2, a couple more comments | 16:47 |
| morganfainberg | lbragstad, once jenkins weighs in, anyone can +A | 16:48 |
| lbragstad | awesome | 16:48 |
| lbragstad | morganfainberg: just to double check | 16:48 |
| dstanek | dolphm: we have a pattern of returning 404s when we should probably be returning 400s | 16:48 |
| morganfainberg | dstanek,++ | 16:48 |
| lbragstad | we are going to use a regex to validate timestamps very similar to how we do url validation, | 16:48 |
| lbragstad | which means we won't rely on the format checker built in jsonschema/ | 16:49 |
| dstanek | lbragstad: a regex instead of using the python lib? | 16:49 |
| dstanek | i would rather leave it as string/null - i think it would be too hard to make a regex and be sure it's backward compatible | 16:49 |
| morganfainberg | also, if it doesn't pass parse_isotime, it would fail anyway | 16:50 |
| dolphm | stevemar: marekd|away: is it really text/xml instead of application/xml on https://review.openstack.org/#/c/118074/4/v3/src/markdown/identity-api-v3-os-federation-ext.md | 16:50 |
| lbragstad | so we are going to use isodate? | 16:50 |
| morganfainberg | don't do a regex if there is a method that we use to validate/handle it that would work in the same manner | 16:50 |
| dstanek | morganfainberg: but we may fail valid dates before the get there | 16:50 |
| lbragstad | or strict-rfc3999? | 16:50 |
| dstanek | we can't use rfc3999 | 16:51 |
| lbragstad | that's what i thought | 16:51 |
| morganfainberg | dstanek, with parse_isotime? how weould we fail valid dates since we already use that and would have weird results otherwise | 16:51 |
| dstanek | it's GPL (a no, no right?) and we actually accept iso dates not 3999 dates | 16:51 |
| lbragstad | ok | 16:51 |
| dstanek | morganfainberg: if we use a regex in the jsonschema we can fail before it ever gets to our code | 16:52 |
| morganfainberg | dstanek, ++ yeah i mean we should use a formatchecker that runs it through parse_isotime | 16:52 |
| morganfainberg | dstanek, doable, but more work than just a regex | 16:52 |
| morganfainberg | afaict | 16:52 |
| stevemar | dolphm, i think so | 16:53 |
| morganfainberg | though i *guess* that isn't needed | 16:53 |
| morganfainberg | if we're already running it through parse_isotime in our code | 16:53 |
| dstanek | morganfainberg: i think a formatter would be pretty quick, but i don't think we need to rush to get it in today | 16:53 |
| dstanek | morganfainberg: exactly | 16:53 |
| morganfainberg | it feels weird to validate one thing at the validator level and something else in the code | 16:53 |
| morganfainberg | dstanek, ++ yeah some followup patch not a rush, i still +2'd that validator :) | 16:54 |
| rodrigods | dstanek, raildo1 so we created this review https://review.openstack.org/#/c/118405/ to keep track from the changes from master. All the other HM patches will depend on it. Seems correct? | 16:55 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix type in common/controller.py https://review.openstack.org/118406 | 16:55 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix typo in common/controller.py https://review.openstack.org/118406 | 16:55 |
| morganfainberg | dolphm, https://review.openstack.org/#/c/111949/ | 16:56 |
| morganfainberg | dolphm, i think we approved a spec for that. | 16:56 |
| morganfainberg | dolphm, for Juno, might want to get eyes on it today. (adding to the meeting) | 16:56 |
| *** rkofman1 has joined #openstack-keystone | 16:57 | |
| *** amcrn has joined #openstack-keystone | 16:58 | |
| morganfainberg | lbragstad, psst | 16:58 |
| morganfainberg | can we get DNS name on 50.56.175.133 :P | 16:59 |
| morganfainberg | http://50.56.175.133/weekly-bug-reports/keystone-weekly-bug-report.html ;) | 16:59 |
| lbragstad | morganfainberg: lol, it's on my todo list | 16:59 |
| morganfainberg | lbragstad, i can point a subdomain of my personal domains over to it if it's deep on your todo list | 16:59 |
| morganfainberg | keystone-weekly-bugs.<somedomain> | 17:00 |
| lbragstad | sure | 17:00 |
| morganfainberg | so.. | 17:00 |
| dstanek | it would be nice to be able to search gerrit and eliminate reviews i've already reviewed | 17:00 |
| dolphm | morganfainberg: i'm happy to see it land if it's ready, but i'm probably not going to commit too many brain cells to it | 17:00 |
| morganfainberg | dolphm, i added to the meeting, if it can't land it can't land | 17:01 |
| dolphm | dstanek: that's one reason i wrote next-review | 17:01 |
| *** harlowja has joined #openstack-keystone | 17:04 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix typos in common/base64utils.py https://review.openstack.org/118407 | 17:04 |
| *** rushiagr_away is now known as rushiagr | 17:07 | |
| *** hrybacki_ has joined #openstack-keystone | 17:11 | |
| *** hrybacki has quit IRC | 17:13 | |
| *** diegows has joined #openstack-keystone | 17:15 | |
| *** portante_ is now known as portante | 17:18 | |
| *** marcoemorais has quit IRC | 17:24 | |
| *** marcoemorais has joined #openstack-keystone | 17:24 | |
| *** hrybacki_ has quit IRC | 17:25 | |
| *** jimbaker` is now known as jimbaker | 17:32 | |
| bknudson | dstanek: if you go to https://review.openstack.org/#/ the incoming reviews are bold if you haven't reviewed it | 17:34 |
| dstanek | bknudson: yeah, but that doesn't happen on a search | 17:35 |
| *** aix has quit IRC | 17:35 | |
| bknudson | dstanek: search what? | 17:36 |
| *** bklei has quit IRC | 17:37 | |
| dstanek | bknudson: here is a simple example http://bit.ly/1pERPbg | 17:37 |
| bknudson | fancy | 17:38 |
| bknudson | dstanek: other projects have dashboards in gerrit | 17:38 |
| dstanek | i also would love to see the current votes in the emails | 17:39 |
| bknudson | https://review.openstack.org/#/projects/openstack/nova,dashboards/important-changes:review-inbox-dashboard | 17:41 |
| bknudson | here's an example | 17:41 |
| bknudson | https://review.openstack.org/#/projects/openstack/keystone,dashboards/important-changes:review-inbox-dashboard | 17:41 |
| bknudson | keystone works, too | 17:41 |
| *** dencaval has joined #openstack-keystone | 17:43 | |
| *** nkinder has quit IRC | 17:43 | |
| dstanek | bknudson: that's pretty neat | 17:43 |
| *** amcrn has quit IRC | 17:51 | |
| *** arborism has joined #openstack-keystone | 17:52 | |
| *** arborism is now known as amcrn | 17:52 | |
| *** hrybacki has joined #openstack-keystone | 17:58 | |
| *** hrybacki has quit IRC | 17:59 | |
| *** bobt has quit IRC | 17:59 | |
| dolphm | stevemar: marekd|away: sent https://review.openstack.org/#/c/114138/ off to the gate, but holding on the API review until jamielennox|away speaks up (who's probably still asleep) | 17:59 |
| *** miqui has quit IRC | 18:00 | |
| stevemar | thanks dolphm | 18:00 |
| *** rodrigods has quit IRC | 18:01 | |
| *** rodrigods has joined #openstack-keystone | 18:02 | |
| *** rodrigods has quit IRC | 18:02 | |
| *** rodrigods has joined #openstack-keystone | 18:02 | |
| *** gothicmindfood has quit IRC | 18:03 | |
| *** gothicmindfood has joined #openstack-keystone | 18:04 | |
| *** rm_work|away is now known as rm_work | 18:04 | |
| *** nkinder has joined #openstack-keystone | 18:06 | |
| *** bklei has joined #openstack-keystone | 18:07 | |
| *** marcoemorais has quit IRC | 18:08 | |
| *** marcoemorais has joined #openstack-keystone | 18:08 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Implement validation on Trust V3 API https://review.openstack.org/104066 | 18:09 |
| lbragstad | dstanek: dolphm fixed ^ | 18:09 |
| *** jamielennox|away is now known as jamielennox_ | 18:09 | |
| *** bklei has quit IRC | 18:12 | |
| *** harlowja has quit IRC | 18:12 | |
| *** harlowja has joined #openstack-keystone | 18:13 | |
| *** rm_work is now known as rm_work|away | 18:14 | |
| dolphm | dstanek: morganfainberg: one of ya'll want to rubberstamp the pep8 fix ^? https://review.openstack.org/#/c/104066/ | 18:15 |
| morganfainberg | dolphm, done | 18:16 |
| dstanek | morganfainberg: damn, you beat me to it :-) | 18:16 |
| dstanek | raildo1: you should only have your new commits on that branch and nothing else from master | 18:17 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix typoes in keytone/common/config.py https://review.openstack.org/118427 | 18:17 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix typos in keystone/common/config.py https://review.openstack.org/118427 | 18:18 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 18:19 |
| stevemar | bknudson, https://review.openstack.org/#/c/114850/ not sure if i'm handling the exceptions exactly the way you want, but it's better than before | 18:20 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:22 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Generate IdP Metadata with keystone-manage. https://review.openstack.org/115564 | 18:25 |
| raildo1 | dstanek: So we will not do git rebase with master? just keep our code in this branch | 18:26 |
| raildo1 | dstanek: Sounds good to me. Thanks! | 18:26 |
| dstanek | raildo1: yes, i think you just want to work on your branch | 18:26 |
| openstackgerrit | A change was merged to openstack/identity-api: Add SAML generation route to OS-FEDERATION https://review.openstack.org/113998 | 18:27 |
| *** richm has quit IRC | 18:28 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Routes for Keystone-IdP metadata endpoint https://review.openstack.org/115883 | 18:29 |
| *** rushiagr is now known as rushiagr_away | 18:33 | |
| openstackgerrit | Brent Roskos proposed a change to openstack/keystone: Error trapping for ldap2py https://review.openstack.org/118430 | 18:34 |
| *** marcoemorais1 has joined #openstack-keystone | 18:35 | |
| *** marcoemorais has quit IRC | 18:36 | |
| *** ajayaa has quit IRC | 18:38 | |
| *** rkofman has quit IRC | 18:39 | |
| *** afazekas has joined #openstack-keystone | 18:40 | |
| *** richm has joined #openstack-keystone | 18:42 | |
| *** gokrokve has joined #openstack-keystone | 18:44 | |
| *** adam_g` is now known as adaM_g | 18:44 | |
| *** adaM_g is now known as adam_g | 18:44 | |
| *** bklei has joined #openstack-keystone | 18:46 | |
| *** amirosh has joined #openstack-keystone | 18:52 | |
| dolphm | jamielennox_: will you start an etherpad stating your concern? then we can enumerate alternatives and compare them? | 18:53 |
| dolphm | stevemar: ^ | 18:53 |
| *** jimbaker has quit IRC | 18:54 | |
| stevemar | dolphm, jamielennox_ https://etherpad.openstack.org/p/token2saml | 18:56 |
| *** jimbaker has joined #openstack-keystone | 18:58 | |
| *** jimbaker has quit IRC | 18:58 | |
| *** jimbaker has joined #openstack-keystone | 18:58 | |
| topol | here | 19:00 |
| jamielennox_ | dolphm, bknudson: so we have an existing discovery object that is queried to determine the available versions | 19:01 |
| dolphm | i'm being poked IRL, brb | 19:01 |
| jamielennox_ | the way i thought of supporting json home would be to ask that discovery object for the URL to use for a resource - with a fallback | 19:01 |
| bknudson | that sounds like a good way to go. | 19:02 |
| jamielennox_ | so like disc.resource_url(service_type='identity', version=3, resource_type='users', default='/users') | 19:02 |
| jamielennox_ | of something like that | 19:02 |
| bknudson | I figured there'd be a fake JSON Home document if the server didn't provide one. | 19:02 |
| jamielennox_ | so that if jsonhome is available we could use that and if not we had a default to fall back to to enable the current behaviour | 19:03 |
| *** marekd|away is now known as marekd | 19:03 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 19:03 |
| *** ChanServ sets mode: +o morganfainberg | 19:03 | |
| openstackgerrit | Sergey Kraynev proposed a change to openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 19:03 |
| bknudson | jamielennox_: having the discovery do resource lookup looks like the right way to do it to me. | 19:04 |
| jamielennox_ | if we have /v2.0 linking to /v3 resources then if i make the above call for a v2 resource then i'll get back a v3 url and my requests won't make sense | 19:04 |
| jamielennox_ | i don't want to support it for v2 - it's more that this is happening at a version independant point | 19:04 |
| bknudson | jamielennox_: the v3 resources have a rel like http://identity/3/users | 19:04 |
| bknudson | a v2 resource would have http://identity/2/users | 19:04 |
| bknudson | so there's no confusion | 19:05 |
| * dolphm is catching up. | 19:05 | |
| jamielennox_ | bknudson: ok - that's fine and how i assumed it would work, i was just thrown by the suggestion of returning v3 resource URLs for everything | 19:05 |
| bknudson | I could also make a JSON Home document for v2.0 | 19:06 |
| bknudson | that might take more than a day | 19:06 |
| jamielennox_ | bknudson: i don't think we need it, there will need to be fallback URLs anyway - just don't return something that's not real | 19:06 |
| dolphm | bknudson: but as a client, i shouldn't have to introspect the URLs i'm given | 19:07 |
| jamielennox_ | bknudson: do you have a sample output from the jsonhome we are using for keystone? | 19:07 |
| bknudson | you won't have to introspect the urls, the href or href-template for http://identity/3/users will tell you where to go whether you do / /v3 or /v2.0 | 19:08 |
| bknudson | jamielennox_: curl -H "Accept: application/json-home" http://localhost:5000/v3 | 19:08 |
| jamielennox_ | oh, merged - i've been really bad on keeping up on server side this cycle | 19:08 |
| bknudson | if you GET / , the href for users is /v3/users , if you GET /v3 the href for users is /users | 19:09 |
| bknudson | if you GET /v2.0 , the href for users is ../v3/users | 19:09 |
| bknudson | the client doesn't introspect is just takes the href given back and uses it. | 19:09 |
| jamielennox_ | bknudson: ah - that will be a problem because i will want to do discovery with v2 and get a v2 url | 19:10 |
| bknudson | then we'd need a JSON Home document for /v2.0 | 19:10 |
| jamielennox_ | bknudson: or just ignore the accept header on /v2.0 | 19:10 |
| dolphm | jamielennox_: which i'm in favor of for juno, i think | 19:11 |
| bknudson | ok, it should be quick to finish up the GET / work. | 19:11 |
| bknudson | I assume you all realize how crazy the version controller is. | 19:11 |
| dolphm | bknudson: it has grown quite crazy lol | 19:12 |
| jamielennox_ | bknudson: very well | 19:12 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix Policy backend driver documentation https://review.openstack.org/118443 | 19:13 |
| dolphm | raildo1: so there's some instructions for keeping a feature branch up to date here https://wiki.openstack.org/wiki/GerritJenkinsGit#Merge_Commits | 19:13 |
| dolphm | raildo1: but i think you need to be in the keystone-milestone group to follow them, because infra doesn't want A) anyone uploading merge commits, which are dangerous, or B) people to upload hundreds/thousands of changes to feature branches gerrit at once to keep the branch up to date | 19:15 |
| jamielennox_ | bknudson: is there any way for me to tell in one go what the version number is | 19:15 |
| bknudson | jamielennox_: all the v3 resources have a rel like http://docs.openstack.org/api/openstack-identity/3/rel/user_groups | 19:15 |
| jamielennox_ | the thing i rely most on in the current discovery is the id field | 19:16 |
| bknudson | so they all have http://docs.openstack.org/api/openstack-identity/3 | 19:16 |
| bknudson | an extension is like http://docs.openstack.org/api/openstack-identity/3/ext/OS-TRUST/1.0/rel/trust_role | 19:17 |
| jamielennox_ | bknudson: is there any thing else we can do to be able to distinguish between api versions? | 19:17 |
| bknudson | jamielennox_: this is all we have now... we could add a "hint" to all the relationships with a version? | 19:18 |
| bknudson | I'm not sure why this would be necessary | 19:18 |
| bknudson | If I want the v3 users resource then I use http://docs.openstack.org/api/openstack-identity/3/rel/user | 19:18 |
| bknudson | if I want the v2 users resource then I'd use http://docs.openstack.org/api/openstack-identity/2/rel/user | 19:18 |
| dolphm | raildo1: so updating the feature branch looks funky, but this is a merge commit produced by those instructions https://review.openstack.org/#/c/118445/ | 19:18 |
| bknudson | (that should have been http://docs.openstack.org/api/openstack-identity/3/rel/users) | 19:19 |
| jamielennox_ | bknudson: so i guess i'm trying to retrofit it to current behaviour where i expect a version parameter | 19:19 |
| morganfainberg | dolphm, merge commits are weird | 19:20 |
| bknudson | jamielennox_: your example before was like discovery.get_url(version=3, rel='users') | 19:20 |
| jamielennox_ | if i get a json home document rather than the old style but i don't know the resource name i have the fallback where do i source the url/v3 from | 19:20 |
| bknudson | so this would turn into looking up the http://docs.openstack.org/api/openstack-identity/3/rel/users rel and following that link | 19:21 |
| bknudson | jamielennox_: you wouldn't get a json home document rather than the old style, you need to do Accept: application/json-home | 19:21 |
| jamielennox_ | bknudson: but i only ever want to do one of these version discoveries and then cache it for as long as possible | 19:22 |
| jamielennox_ | that means it can serve multiple cases | 19:22 |
| bknudson | jamielennox_: you'd have to store the original request URL, because all the URLs in the JSON Home document are relative to it. | 19:22 |
| jamielennox_ | bknudson: ugh | 19:23 |
| bknudson | if you get the JSON Home document and it doesn't have the relationship that you want then the server doesn't support it. | 19:23 |
| jamielennox_ | bknudson: ugh - not because this way isn't better but because i did a lot to support the existing way of doing it | 19:23 |
| jamielennox_ | bknudson: so i guess what i want then is a fallback kind of root relationship | 19:23 |
| bknudson | jamielennox_: as dolphm mentioned, we'll still have to support the old way for old servers. | 19:24 |
| jamielennox_ | bknudson: yea - i guess i just have to fetch both | 19:24 |
| *** bobt has joined #openstack-keystone | 19:24 | |
| bknudson | if you ask for JSON Home and the server doesn't support it then you get the old version doc | 19:24 |
| bknudson | which is probably incorrect behavior since the server should return 406 Not Acceptable but that's how it works | 19:25 |
| jamielennox_ | yep, so what i was thinking of was the case where i get a json-home document and store that in my discovery, but the requests the client is giving me are not jsonhome aware | 19:26 |
| bknudson | jamielennox_: like what? | 19:26 |
| jamielennox_ | because all of this stuff is global now - so we're not just thinking of keystoneclient | 19:26 |
| bknudson | maybe I can work on JSON Home for the other projects in K | 19:27 |
| jamielennox_ | bknudson: it should be alright. i haven't tried to implement any of this stuff i'm just trying to reason through issues | 19:28 |
| bknudson | dolphm: 0 files changed, 0 insertions(+), 0 deletions(-) | 19:29 |
| dolphm | bknudson: yeah, it's weird | 19:29 |
| bknudson | dolphm: are you the only one with permissions to push a merge? | 19:30 |
| dolphm | bknudson: that wiki says you need to be in the keystone-milestone group... not sure who's in that | 19:31 |
| morganfainberg | dolphm, you | 19:31 |
| morganfainberg | dolphm, and the rest of us | 19:32 |
| morganfainberg | :P | 19:32 |
| morganfainberg | https://review.openstack.org/#/admin/groups/57,members | 19:32 |
| morganfainberg | actually... we probably should clean that list up :P | 19:32 |
| dolphm | ha termie is in there | 19:32 |
| morganfainberg | maybe just make it inherit keystone-core ? | 19:32 |
| dolphm | morganfainberg: fixed | 19:32 |
| morganfainberg | ++ | 19:33 |
| *** amirosh has quit IRC | 19:33 | |
| jamielennox_ | bknudson: i managed to get nova and neutronclient working with sessions | 19:33 |
| topol | dolphm well thats awkward :-) | 19:33 |
| jamielennox_ | bknudson: https://github.com/jamielennox/nova/blob/session-test/nova/network/neutronv2/__init__.py | 19:33 |
| dolphm | morganfainberg: bknudson: raildo1: nothing special, but i also just scripted the merge process. https://github.com/dolph/dotfiles/blob/master/bin/git-update | 19:34 |
| morganfainberg | dolphm, ++ | 19:34 |
| jamielennox_ | bknudson: requires fixes to keystoneclient and neutronclient that i've pushed up | 19:34 |
| dolphm | morganfainberg: don't want to screw that up and owe infra a case of beer :) | 19:34 |
| topol | dolphm, do they accept domestic? | 19:34 |
| morganfainberg | screwing that one up might owe them a keg of something really nice not just a case | 19:34 |
| bknudson | jamielennox_: working with sessions, and also supporting v3? | 19:35 |
| topol | dolphm, we could buy them a case of Keystone!!!! | 19:35 |
| jamielennox_ | bknudson: yes | 19:35 |
| bknudson | jamielennox_: ah, the conf options | 19:35 |
| topol | dolphm witht he specially lined aluminum can | 19:36 |
| jamielennox_ | bknudson: if you put auth_plugin=v3password in the config file it will pick it up in priority to the existing | 19:36 |
| bknudson | that is easier. | 19:36 |
| morganfainberg | topol, ... keystone ... light? | 19:36 |
| morganfainberg | erm lite | 19:36 |
| topol | morganfainberg, +++ even better. so smooth | 19:36 |
| *** marcoemorais1 has quit IRC | 19:37 | |
| *** marcoemorais has joined #openstack-keystone | 19:38 | |
| *** marcoemorais has quit IRC | 19:38 | |
| *** bambam1 has quit IRC | 19:38 | |
| *** marcoemorais has joined #openstack-keystone | 19:39 | |
| *** bambam1 has joined #openstack-keystone | 19:40 | |
| *** miqui has joined #openstack-keystone | 19:40 | |
| *** rushiagr_away is now known as rushiagr | 19:43 | |
| lbragstad | dstanek: just curious if you have a follow up here? https://review.openstack.org/#/c/116374/ | 19:49 |
| dstanek | lbragstad: it's probably fine, i think the existence of the optional decorator is the real bug :-) | 19:50 |
| *** jasondotstar has quit IRC | 19:54 | |
| *** morganfainberg is now known as needs | 19:57 | |
| *** needs is now known as needscoffee | 19:57 | |
| *** jsavak has joined #openstack-keystone | 19:59 | |
| *** jasondotstar has joined #openstack-keystone | 19:59 | |
| *** joesavak has quit IRC | 20:01 | |
| *** marcoemorais has quit IRC | 20:02 | |
| *** bobt has quit IRC | 20:03 | |
| *** marcoemorais has joined #openstack-keystone | 20:04 | |
| stevemar | dolphm, bknudson, dstanek can y'all review: https://review.openstack.org/#/c/118074/ | 20:05 |
| stevemar | it's the API for mareks patch | 20:05 |
| stevemar | i'm hoping to get all his stuff landed today too | 20:05 |
| *** afazekas has quit IRC | 20:09 | |
| jamielennox_ | ayoung: as a member of the defence, you have anything you want to add to https://etherpad.openstack.org/p/token2saml | 20:10 |
| bknudson | stevemar: why is it text/xml and not application/xml? | 20:10 |
| ayoung | jamielennox_, uhm...probably | 20:10 |
| *** Lordanat3 has joined #openstack-keystone | 20:11 | |
| stevemar | bknudson, afaik, the only difference is if it's easy to read ? | 20:11 |
| bknudson | stevemar: does the spec say to use one or the other? | 20:12 |
| bknudson | saml? | 20:12 |
| *** rushiagr is now known as rushiagr_away | 20:12 | |
| *** Lordanat1 has quit IRC | 20:12 | |
| stevemar | bknudson, last time i looked it up, i couldn't find anything about that. | 20:13 |
| gyee | stevemar, did you ever tested saml2 stuff against Microsoft IdP? | 20:25 |
| gyee | just curious | 20:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: API for metadata retrieval https://review.openstack.org/118074 | 20:25 |
| stevemar | bknudson, responded to a few nits ^ | 20:26 |
| stevemar | gyee, i believe marekd has | 20:26 |
| gyee | http://en.wikipedia.org/wiki/Active_Directory_Federation_Services | 20:26 |
| stevemar | gyee, shameless self promotion: https://www.ibm.com/developerworks/cloud/library/cl-keystone-tfim/index.html | 20:26 |
| stevemar | gyee, also marek was working on it: https://review.openstack.org/#/c/111771/ | 20:27 |
| bknudson | stevemar: hopefully it will show up in the openstack weekly newsletter | 20:27 |
| gyee | oh I am a fan of Tivoli | 20:27 |
| stevemar | gyee, yeah so marek also had ADFS on his radar too, and he's got patches for it | 20:28 |
| gyee | nice! | 20:28 |
| stevemar | it's all here: https://review.openstack.org/#/c/111771/ | 20:28 |
| stevemar | gyee, i'm betting he has it working in-house, and he's just contributing it back | 20:29 |
| gyee | stevemar, I am setting up ADFS to try it out | 20:29 |
| raildo1 | bknudson: sorry but i don't understand your comment, what did you say with "Home relationship information"? https://review.openstack.org/#/c/111355/9/v3/src/markdown/identity-api-v3-os-inherit-ext.md | 20:30 |
| stevemar | gyee, you will probably need his patch to full use keystone client | 20:30 |
| gyee | do I need an eval license for Tivoli? | 20:30 |
| gyee | I may ended up trying both | 20:30 |
| bknudson | raildo1: Look at all the other existing operations, they have Relationship: `http://docs.openstack.org/api/openstack-identity/3/ext/OS-INHERIT/1.0/rel/<whatever` | 20:30 |
| *** marcoemorais has quit IRC | 20:31 | |
| bknudson | raildo1: this is so that applications can discover if the resource is available. | 20:31 |
| *** marcoemorais has joined #openstack-keystone | 20:32 | |
| raildo1 | bknudson: OK, i get it, thanks :) | 20:32 |
| raildo1 | bknudson: I will abandon that patch and create a new patch in the hierarchical multitenancy branch and I will correct with your comments. | 20:45 |
| bknudson | raildo1: there's a HMT branch in identity-api? | 20:46 |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Enumerate Projects with Unscoped Tokens https://review.openstack.org/106838 | 20:47 |
| raildo1 | Good thinking, the branch was just for keystone. :-( | 20:47 |
| raildo1 | bknudson: so, i will not abandon this patch hahaha | 20:47 |
| openstackgerrit | Brent Roskos proposed a change to openstack/keystone: Error trapping for ldap2py https://review.openstack.org/118430 | 20:52 |
| marekd | gyee: I have. | 20:52 |
| marekd | gyee: ADFS | 20:52 |
| gyee | marekd, excellent! I probably will some questions for you later :) | 20:53 |
| *** andreaf has quit IRC | 20:54 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 20:54 |
| marekd | gyee: i am on a work training this week so i am little bit quiet there days :-) If you don't find me here, it's better to shoot me an email marek.denis@cern.ch :-) | 20:54 |
| marekd | these* | 20:54 |
| gyee | marekd, will do, thanks! | 20:54 |
| marekd | gyee: but basically stevemar is right. I have a patch proposed for keystoneclient and it just waits for a review a hopefully one day a merge :-) | 20:55 |
| gyee | marekd, sorry I am a bit behind on the saml2 stuff, but catching up | 20:56 |
| *** needscoffee is now known as morganfainberg | 20:56 | |
| *** henrynash has joined #openstack-keystone | 20:56 | |
| *** rushiagr_away is now known as rushiagr | 20:56 | |
| samuelmz | hey, KvsInheritanceTests does not use backend KVS as identity driver, could you take a look at bug #1364618 | 20:56 |
| uvirtbot | Launchpad bug 1364618 in keystone "KvsInheritanceTests does not use backend KVS" [Undecided,New] https://launchpad.net/bugs/1364618 | 20:56 |
| morganfainberg | samuelmz, are you using KVS identity as a real backend? | 20:57 |
| morganfainberg | samuelmz, i only ask because that is a little scary :) even in testing it's an odd backend | 20:57 |
| samuelmz | morganfainberg, no | 20:57 |
| morganfainberg | samuelmz, *phew* :) | 20:57 |
| samuelmz | morganfainberg, :) | 20:57 |
| morganfainberg | samuelmz, that backend is slated for removal in K btw. | 20:58 |
| *** marcoemorais has quit IRC | 20:58 | |
| samuelmz | morganfainberg, yes .. do you think it's worth to fix it? | 20:58 |
| *** marcoemorais has joined #openstack-keystone | 20:59 | |
| samuelmz | morganfainberg, as they are today, we are testing with backend SQL (again) | 20:59 |
| morganfainberg | samuelmz, eh. not sure. | 20:59 |
| *** marcoemorais has quit IRC | 20:59 | |
| morganfainberg | samuelmz, if it's an easy fix i mean i wont block it, but i wouldn't put a ton of effort into the fix | 20:59 |
| *** marcoemorais has joined #openstack-keystone | 20:59 | |
| samuelmz | morganfainberg, I just created the config_overrides method and ran the tests | 21:00 |
| samuelmz | morganfainberg, everything is working | 21:00 |
| morganfainberg | samuelmz, sure! submit the fix :) | 21:00 |
| samuelmz | morganfainberg, can you confirm the bug? | 21:00 |
| samuelmz | morganfainberg, :) | 21:00 |
| morganfainberg | samuelmz, looks legitimate. | 21:01 |
| *** marcoemorais has quit IRC | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| henrynash | dolphm: a) sorry I missed the call, and b) would be good to get this small kvs deprecated item in: https://review.openstack.org/#/c/118067/ | 21:04 |
| lbragstad | dolphm: thanks for the recheck | 21:05 |
| lbragstad | just about retriggered | 21:05 |
| *** jsavak has quit IRC | 21:07 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Making KvsInheritanceTests use backend KVS https://review.openstack.org/118466 | 21:07 |
| samuelmz | morganfainberg, ^ | 21:07 |
| morganfainberg | samuelmz, cool! | 21:07 |
| *** crinkle has joined #openstack-keystone | 21:14 | |
| *** rushiagr is now known as rushiagr_away | 21:14 | |
| dolphm | henrynash: eek, i crossed that off my list as if it had landed! | 21:15 |
| dolphm | henrynash: i'll make sure it gets in | 21:15 |
| dolphm | henrynash: thank you! | 21:15 |
| *** rkofman has joined #openstack-keystone | 21:16 | |
| henrynash | dolphm: np | 21:18 |
| henrynash | dolphm: other kvs ones got in…this was an extra request form morganfainberg to mark the revoke kvs as well | 21:18 |
| bknudson | adding support for JSON Home for GET / is proving to be more complicated than expected... the v3 service gets instantiated twice and doesn't know if it's public or admin. | 21:19 |
| morganfainberg | dolphm, yeah saw an extra kvs backend we missed | 21:19 |
| bknudson | as I told you the version controllers are freaky | 21:19 |
| openstackgerrit | Brent Roskos proposed a change to openstack/keystone: Error trapping for ldap2py https://review.openstack.org/118430 | 21:19 |
| *** jasondotstar has quit IRC | 21:20 | |
| dolphm | morganfainberg: henrynash: ooh wow totally glossed over that | 21:21 |
| morganfainberg | dolphm, it doesn't use the old KVS backend, but it is very limited and suffers from the same drawbacks as the other kvs drivers | 21:21 |
| dolphm | marekd: stevemar: is /metadata intended to be a no-auth API? | 21:22 |
| dolphm | morganfainberg: ++ | 21:23 |
| stevemar | dolphm, yes, it should be publicly available | 21:23 |
| dolphm | stevemar: why does the controller not extend V3Controller? | 21:23 |
| dolphm | stevemar: oh the other federation specific controllers do the same, nvm. | 21:24 |
| stevemar | it does | 21:24 |
| dolphm | stevemar: commented on some nits https://review.openstack.org/#/c/115883/ | 21:25 |
| bknudson | we should regenerate the man page | 21:27 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 21:28 |
| dolphm | stevelle: while you're rebasing stuff, i posted a suggested diff on/for 115883 | 21:30 |
| dolphm | stevemar: ^ (sorry stevelle) | 21:30 |
| * stevelle hides | 21:31 | |
| *** stevelle has left #openstack-keystone | 21:31 | |
| stevemar | dolphm, thanks, i'm addressing brants nits on the other one | 21:31 |
| stevemar | the rebase blew away from votes :( | 21:31 |
| dolphm | new rule: you're not allowed to share the same first two characters of your nick with anyone else because i autocomplete fail | 21:31 |
| dolphm | stevemar: i know | 21:31 |
| *** morganfainberg is now known as steve_notmorgan | 21:32 | |
| steve_notmorgan | >.> | 21:32 |
| *** amerine_ has joined #openstack-keystone | 21:32 | |
| *** steve_notmorgan is now known as morganfainberg | 21:32 | |
| stevemar | dolphm, so for pep8, does _ come before _LE ? | 21:35 |
| dolphm | stevemar: do not understand question | 21:35 |
| bknudson | put them on the same line | 21:35 |
| bknudson | _, _LE | 21:36 |
| stevemar | thanks brant | 21:36 |
| stevemar | dolphm, take notes | 21:36 |
| dolphm | steve_notmorgan: will do | 21:36 |
| dolphm | dammit | 21:36 |
| *** amerine has quit IRC | 21:36 | |
| dolphm | stevemar: was the potential merge conflict just in tests? | 21:37 |
| stevemar | yes | 21:38 |
| *** henrynash has quit IRC | 21:38 | |
| dolphm | stevemar: you made pep8 sad https://review.openstack.org/#/c/114850/ | 21:38 |
| stevemar | dolphm, sommmmmm B | 21:39 |
| stevemar | new one coming in two shakes | 21:39 |
| dolphm | stevemar: two shakes of whitespace might be too much | 21:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: IdP SAML Metadata generator https://review.openstack.org/114850 | 21:40 |
| stevemar | dolphm, there ya go ^ | 21:41 |
| stevemar | it's rebased on top of the one thats gating | 21:41 |
| stevemar | and it has fixes for brants nits | 21:41 |
| stevemar | bknudson, ^ | 21:41 |
| * stevemar is hoping to get that one approved, hint hint | 21:41 | |
| dolphm | stevemar: comments from patchset 22? | 21:41 |
| stevemar | yes | 21:42 |
| dolphm | stevemar: does oslo not support enum options? | 21:43 |
| dolphm | oslo.config | 21:43 |
| morganfainberg | dolphm, afaik no | 21:45 |
| dolphm | oh. | 21:45 |
| dolphm | boo. | 21:45 |
| *** lnxnut has quit IRC | 21:46 | |
| *** rodrigods has quit IRC | 21:46 | |
| stevemar | dolphm, nope, bknudson and i both took a peek at it, nada | 21:48 |
| bknudson | Do we know why we have both these VersionV3 routers? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/service.py#n104 | 21:48 |
| dolphm | last 7 days of gate depth. the gate is loading up again! http://graphite.openstack.org/render/?from=-7days&width=1920&height=160&margin=0&hideLegend=true&hideAxes=false&hideGrid=true&target=color(stats.gauges.zuul.pipeline.gate.current_changes,%20%27000000%27)&bgcolor=ffffff | 21:48 |
| *** nkinder has quit IRC | 21:48 | |
| dolphm | bknudson: for v3, i do not recall | 21:49 |
| bknudson | seems like it wouldn't work... it maps / twice. | 21:49 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Generate IdP Metadata with keystone-manage. https://review.openstack.org/115564 | 21:50 |
| morganfainberg | bknudson, we have both routers because it's in both pipelines? | 21:50 |
| bknudson | morganfainberg: that makes sense... only I don't think it works that way. | 21:51 |
| stevemar | dolphm, alright one more rebase | 21:51 |
| morganfainberg | bknudson, it shouldn't matter though, they are the same for V3 as long as both pipelines respond who cares. | 21:51 |
| bknudson | I'm going to check. | 21:51 |
| morganfainberg | bknudson, try removing one? | 21:51 |
| morganfainberg | bknudson, i'm guessing it's doing it wrong :P | 21:51 |
| bknudson | it would actually return the wrong link... | 21:52 |
| morganfainberg | oh. huh | 21:52 |
| dolphm | stevemar: you mean, one left to go? | 21:53 |
| bknudson | yep, it does: curl http://localhost:5000/v3 -- http://192.168.122.176:35357/v3/ | 21:53 |
| bknudson | should hvae been 5000/v3 | 21:53 |
| stevemar | dolphm, yep, the one that creates the controller/routers for metadata generation | 21:53 |
| dolphm | stevemar: don't forget my nits ;) | 21:53 |
| dolphm | stevemar: curl http://pasteraw.com/uhnf0obeqhd9ilk2dmxfu6fypea1s0 | git apply | 21:53 |
| *** ayoung has quit IRC | 21:54 | |
| *** bklei has quit IRC | 21:54 | |
| stevemar | oh ok | 21:54 |
| *** bklei has joined #openstack-keystone | 21:54 | |
| stevemar | dolphm, just saw them now, adding them now... | 21:55 |
| dolphm | stevemar: readying +2 | 21:55 |
| stevemar | dolphm, what do you want the help text to be? | 21:56 |
| dolphm | stevemar: just remove the -- | 21:56 |
| stevemar | alright | 21:56 |
| dolphm | stevemar: i just won't want it to be *wrong* | 21:56 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Routes for Keystone-IdP metadata endpoint https://review.openstack.org/115883 | 21:58 |
| stevemar | dolphm, ^ | 21:58 |
| *** bklei has quit IRC | 21:59 | |
| dolphm | stevemar: changes look good. and it passes flake8 | 21:59 |
| stevemar | yahoo | 21:59 |
| dolphm | stevemar: +2! i'm going to keep an eye on them, but as soon as they pass jenkins, +A | 22:00 |
| stevemar | dolphm, re: +A'ing and timeliness, are you fine with me +A'ing, after the first patch in the chain merges | 22:00 |
| dolphm | stevemar: yes | 22:00 |
| stevemar | dolphm, get out of my brain! | 22:00 |
| dolphm | stevemar: the sooner the +A the better the +A | 22:01 |
| bknudson | what do you think about changing api-paste.ini to have 2 v3_api pipelines, a public and an admin? | 22:01 |
| stevemar | dolphm, OK, thats cool, i think i'm only co-author on the first one of marek's patches, but you and brant have +2'ed | 22:01 |
| stevemar | so I don't break any rules there | 22:01 |
| stevemar | bknudson, i thought we wanted to not do that for as long as possible | 22:02 |
| bknudson | and then I'd probably have to have a PublicVersionV3 and AdminVersionV3 | 22:02 |
| dolphm | bknudson: why? we chose to only have one pipeline because no one understood or took advantage of the multi-port thing, and it just caused bugs | 22:02 |
| dolphm | and RBAC was a better solution, really. | 22:02 |
| bknudson | dolphm: I'll have to look into this more but there is something seriously fishy going on. | 22:03 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Fix minor nits for token2saml generation. https://review.openstack.org/118272 | 22:04 |
| bknudson | I didn't notice this before but the JSON Home response is different for :5000 and :35357. | 22:05 |
| bknudson | I have to run to bowling league | 22:05 |
| *** bknudson has quit IRC | 22:05 | |
| dolphm | :D | 22:07 |
| openstackgerrit | A change was merged to openstack/identity-api: API for metadata retrieval https://review.openstack.org/118074 | 22:07 |
| *** dims has quit IRC | 22:07 | |
| *** dims has joined #openstack-keystone | 22:08 | |
| stevemar | yay something merged | 22:08 |
| dolphm | YAY API | 22:09 |
| stevemar | i wonder how well bknudson bowls | 22:09 |
| stevemar | probably well | 22:09 |
| dolphm | stevemar: i imagine he has the patience to not throw bowling balls into the other lanes | 22:09 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:09 | |
| openstackgerrit | Sarvesh Ranjan proposed a change to openstack/keystone: Spelling Correction in comments https://review.openstack.org/117919 | 22:09 |
| stevemar | dolphm, he has the patience to put up with me and my 1000 patches | 22:09 |
| dolphm | WHY CAN'T YOU BOWL BETTER HERE LET ME HELP YOU WITH THOSE LAST TEN PINS | 22:09 |
| stevemar | so yeah, balls in other lanes should be easy | 22:09 |
| stevemar | see, ibmers do fun things | 22:10 |
| stevemar | brant goes to bowling on tuesday, i go to softball on wednesday, henry goes to .... on thursday | 22:10 |
| stevemar | cricket? | 22:11 |
| dolphm | ride planes | 22:11 |
| stevemar | oh that too | 22:11 |
| dolphm | henry rides airplanes | 22:11 |
| stevemar | he does that very often | 22:11 |
| stevemar | he must enjoy it | 22:11 |
| dolphm | professional hobbyist | 22:11 |
| stevemar | topol rides a lot of planes too | 22:11 |
| dolphm | i eat pizza so i'm going to go do that TTYL HAPPY FEATURE FREEZE EVERYONE | 22:11 |
| jamielennox_ | dolphm, stevemar: if i rant a lot on this etherpad about regions - is there some sort of goal? | 22:11 |
| dolphm | \o/ | 22:12 |
| jamielennox_ | :( - and that's my concern - FF | 22:12 |
| dolphm | jamielennox_: oh crap i didn't follow up on that | 22:12 |
| *** dims has quit IRC | 22:12 | |
| stevemar | dolphm, https://etherpad.openstack.org/p/token2saml | 22:13 |
| dolphm | stevemar: already pinned the tab in my browser for later / tomorrow. i'll follow up jamielennox_ | 22:13 |
| dolphm | gtg! | 22:13 |
| stevemar | see ya dolphm | 22:13 |
| jamielennox_ | later | 22:13 |
| stevemar | jamielennox_, i'm equally tired of keystone/openstack for today, i'm out | 22:13 |
| stevemar | jamielennox_, tomorrow as well for me, but honestly thanks for looking at it | 22:14 |
| openstackgerrit | Sarvesh Ranjan proposed a change to openstack/keystone: Spelling corrections in comments https://review.openstack.org/117919 | 22:14 |
| jamielennox_ | stevemar: no worries - you were doing it late last night | 22:14 |
| jamielennox_ | stevemar: tomorrow i'm going to make people do client reviews | 22:14 |
| jamielennox_ | well i'm going to try that today but it looks like everyone's gone | 22:14 |
| *** amerine_ has quit IRC | 22:14 | |
| stevemar | we'll figure out the region malarky, it shouldn't be that much work (compared to what we've done to support it) | 22:15 |
| stevemar | jamielennox_, if i get a second wind, i'll take a look at client | 22:15 |
| stevemar | see ya tmrw | 22:15 |
| jamielennox_ | stevemar: bye | 22:15 |
| *** stevemar has quit IRC | 22:21 | |
| *** jaosorior has quit IRC | 22:22 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Fix return from list role assignments on KVS https://review.openstack.org/118482 | 22:25 |
| samuelmz | morganfainberg, ping | 22:26 |
| *** marcoemorais has quit IRC | 22:26 | |
| morganfainberg | samuelmz, pong | 22:26 |
| samuelmz | morganfainberg, ^ another simple patch :) | 22:26 |
| *** marcoemorais has joined #openstack-keystone | 22:27 | |
| morganfainberg | samuelmz, ty for contributing, expect we'll circle back on most of this opnce the milestone lands in a couple days (things are really impacted right now) | 22:27 |
| morganfainberg | samuelmz, but def. fixes to get in prior to RC | 22:27 |
| samuelmz | morganfainberg, ok thanks | 22:28 |
| *** gordc has quit IRC | 22:28 | |
| *** amerine has joined #openstack-keystone | 22:33 | |
| *** bobt has joined #openstack-keystone | 22:33 | |
| *** henrynash has joined #openstack-keystone | 22:42 | |
| *** stevemar has joined #openstack-keystone | 22:54 | |
| openstackgerrit | Bob Thyne proposed a change to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 22:56 |
| *** david-lyle has quit IRC | 23:02 | |
| *** bklei has joined #openstack-keystone | 23:05 | |
| *** zzzeek has quit IRC | 23:05 | |
| *** bklei has quit IRC | 23:06 | |
| *** marcoemorais has quit IRC | 23:07 | |
| *** marcoemorais has joined #openstack-keystone | 23:08 | |
| *** marcoemorais has quit IRC | 23:09 | |
| *** marcoemorais has joined #openstack-keystone | 23:09 | |
| *** zzzeek has joined #openstack-keystone | 23:12 | |
| *** rm_work|away is now known as rm_work | 23:16 | |
| *** jamielen^ has joined #openstack-keystone | 23:18 | |
| *** jamielennox_ has quit IRC | 23:20 | |
| *** gokrokve has quit IRC | 23:23 | |
| *** gokrokve has joined #openstack-keystone | 23:23 | |
| *** topol has quit IRC | 23:24 | |
| *** jamielennox has joined #openstack-keystone | 23:27 | |
| *** jamielen^ has left #openstack-keystone | 23:28 | |
| *** marcoemorais has quit IRC | 23:33 | |
| *** marcoemorais has joined #openstack-keystone | 23:33 | |
| *** alex_xu has joined #openstack-keystone | 23:33 | |
| *** marcoemorais has quit IRC | 23:34 | |
| *** marcoemorais has joined #openstack-keystone | 23:34 | |
| *** stevemar has quit IRC | 23:35 | |
| *** oomichi has quit IRC | 23:35 | |
| *** jamielennox|home has joined #openstack-keystone | 23:35 | |
| *** bklei has joined #openstack-keystone | 23:37 | |
| *** jamielennox|home has quit IRC | 23:38 | |
| *** bklei has quit IRC | 23:42 | |
| *** jamielennox|home has joined #openstack-keystone | 23:44 | |
| *** gokrokve has quit IRC | 23:44 | |
| *** jamielennox|home has quit IRC | 23:44 | |
| *** oomichi has joined #openstack-keystone | 23:45 | |
| *** gokrokve has joined #openstack-keystone | 23:45 | |
| *** zzzeek has quit IRC | 23:48 | |
| *** gokrokve has quit IRC | 23:49 | |
| morganfainberg | bobt, +2 on that review (following stevemar's review) | 23:53 |
| morganfainberg | bobt, +A can come once jenkins weighs in | 23:53 |
| *** alex_xu has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!