| *** bklei has joined #openstack-keystone | 00:02 | |
| *** nkinder has joined #openstack-keystone | 00:03 | |
| *** bklei has quit IRC | 00:05 | |
| *** gokrokve has joined #openstack-keystone | 00:12 | |
| bobt | morganfainberg: thanks (plus thanks to stevemar, gyee, henry-nash, bknudson, dstanek, and fabio) for the reviews. | 00:17 |
|---|---|---|
| *** bklei has joined #openstack-keystone | 00:18 | |
| bobt | and wu! | 00:18 |
| *** bklei has quit IRC | 00:27 | |
| *** bklei has joined #openstack-keystone | 00:28 | |
| *** bklei_ has joined #openstack-keystone | 00:31 | |
| *** bklei has quit IRC | 00:32 | |
| *** gokrokve_ has joined #openstack-keystone | 00:33 | |
| *** gokrokve has quit IRC | 00:34 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:39 | |
| *** gokrokve_ has quit IRC | 00:51 | |
| *** r-daneel has quit IRC | 01:00 | |
| dstanek | bobt: thanks for the code | 01:00 |
| *** amerine has quit IRC | 01:00 | |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 01:03 |
| *** gyee has quit IRC | 01:04 | |
| *** lnxnut has joined #openstack-keystone | 01:06 | |
| *** dims has joined #openstack-keystone | 01:11 | |
| *** lnxnut has quit IRC | 01:16 | |
| *** gokrokve has joined #openstack-keystone | 01:17 | |
| *** bknudson has joined #openstack-keystone | 01:18 | |
| *** dims has quit IRC | 01:23 | |
| *** rkofman has quit IRC | 01:23 | |
| *** dims has joined #openstack-keystone | 01:23 | |
| *** marcoemorais has quit IRC | 01:23 | |
| *** marcoemorais has joined #openstack-keystone | 01:24 | |
| *** crinkle has left #openstack-keystone | 01:25 | |
| *** dims_ has joined #openstack-keystone | 01:26 | |
| *** ayoung_ has joined #openstack-keystone | 01:26 | |
| *** dims has quit IRC | 01:28 | |
| *** rushiagr_away is now known as rushiagr | 01:29 | |
| *** bobt has quit IRC | 01:31 | |
| *** cjellick has quit IRC | 01:32 | |
| *** cjellick has joined #openstack-keystone | 01:33 | |
| *** marcoemorais has quit IRC | 01:36 | |
| *** cjellick has quit IRC | 01:37 | |
| *** richm has quit IRC | 01:39 | |
| *** rushiagr is now known as rushiagr_away | 01:45 | |
| *** stevemar has joined #openstack-keystone | 01:46 | |
| *** diegows has quit IRC | 01:49 | |
| *** dims_ has quit IRC | 02:03 | |
| *** dims has joined #openstack-keystone | 02:03 | |
| *** alex_xu has joined #openstack-keystone | 02:06 | |
| *** rushiagr_away is now known as rushiagr | 02:08 | |
| *** dims has quit IRC | 02:08 | |
| *** dims has joined #openstack-keystone | 02:13 | |
| *** gokrokve_ has joined #openstack-keystone | 02:14 | |
| ayoung_ | jamielennox, so, what is the right approach to enumerating projects for a user with an unscoped token? We don't have a service catalog. | 02:14 |
| ayoung_ | https://review.openstack.org/#/c/106838/ | 02:15 |
| *** gokrokve_ has quit IRC | 02:16 | |
| *** gokrokve has quit IRC | 02:18 | |
| *** stevemar has quit IRC | 02:18 | |
| jamielennox | ayoung_: something like https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tenants.py#L122-L127 | 02:19 |
| *** stevemar has joined #openstack-keystone | 02:19 | |
| ayoung_ | jamielennox, I thought that was what I was doing | 02:20 |
| *** gokrokve has joined #openstack-keystone | 02:21 | |
| jamielennox | ayoung_: so i'm still just looking at what you're actually doing in the projects bit | 02:21 |
| jamielennox | but this: https://review.openstack.org/#/c/106838/9/keystoneclient/v3/client.py is what i really don't want | 02:21 |
| ayoung_ | I also don;t know why it fails | 02:21 |
| jamielennox | i'm trying to figure out why you can't call super on that list - why you had to do all that query handling | 02:22 |
| ayoung_ | jamielennox ok, I can move that logic into the DOA code, but I need to know if the user would be authenticated separate from the Project list call failing due to insufficient permissions | 02:23 |
| ayoung_ | I guess it could be done all at once, but I need the unscoped token and then the scoped token | 02:23 |
| *** ayoung_ is now known as ayoung | 02:23 | |
| *** gokrokve has quit IRC | 02:25 | |
| jamielennox | ayoung: oh, ok so that is so that the auth happens, you can get a user_id, and then you get the url based on that user id | 02:27 |
| ayoung | yep | 02:27 |
| *** amerine has joined #openstack-keystone | 02:27 | |
| jamielennox | too early this morning .... struggling | 02:27 |
| ayoung | because, as You know, we have now way of asking keystone "who am I anyway" | 02:27 |
| jamielennox | you need ..... | 02:28 |
| morganfainberg | hey keystone whoami? | 02:28 |
| morganfainberg | keystone: 401 | 02:28 |
| jamielennox | https://review.openstack.org/#/c/97681/29/keystoneclient/httpclient.py | 02:28 |
| jamielennox | then you can just do self.api.user_id | 02:29 |
| jamielennox | but user is being passed. where does that normally come from? | 02:30 |
| jamielennox | oh, horizon expects to call client.auth_ref.user_id i bet | 02:31 |
| jamielennox | this will be better in Juno because or /auth/projects | 02:32 |
| *** amerine has quit IRC | 02:32 | |
| ayoung | jamielennox, yeah that "Best effort to retrieve the user_id from the plugin." sounds about right | 02:32 |
| jamielennox | ayoung: i think i may have no choice but to give plugins a get_user_id and get_project_id method | 02:32 |
| ayoung | jamielennox, the first, maybe, but project_id... | 02:33 |
| ayoung | not so certain | 02:33 |
| jamielennox | ah - the wisdom of cinder, nova v1 and all the other APIs that put /{project_id}/ in the url | 02:34 |
| ayoung | shudder | 02:37 |
| *** amcrn has quit IRC | 02:38 | |
| jamielennox | yea, i'm killing things off but some remain - so user_id and project_id might be needed, i'll do them as seperate reviews anyway | 02:38 |
| jamielennox | it's better than 'best guess' | 02:39 |
| *** david-lyle has joined #openstack-keystone | 02:39 | |
| ayoung | jamielennox, cool. let me know when I can review and try them with mine | 02:41 |
| jamielennox | so you can rebase onto that adapter one | 02:41 |
| jamielennox | the chain that that review is a part of is the ones i need in | 02:41 |
| ayoung | morganfainberg, http://adam.younglogic.com/2014/09/three-types-of-keystone-users/ thought you might like that. | 02:41 |
| jamielennox | and the first few are fairly easay | 02:41 |
| *** alex_xu has quit IRC | 02:45 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:46 | |
| *** alex_xu has joined #openstack-keystone | 02:50 | |
| *** harlowja is now known as harlowja_away | 02:52 | |
| *** bklei_ has quit IRC | 02:54 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Allow fetching user_id from an auth plugin https://review.openstack.org/118520 | 02:55 |
| jamielennox | ayoung: ^ | 02:55 |
| ayoung | jamielennox, thanks | 02:55 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add V3 JSON Home support to GET / https://review.openstack.org/118240 | 02:55 |
| ayoung | jamielennox, I'll still need a deliberate process_token with that, right? | 02:55 |
| bknudson | this might make you throw up a little ^ | 02:56 |
| jamielennox | ayoung: no | 02:56 |
| *** dims has quit IRC | 02:56 | |
| ayoung | jamielennox, ah | 02:56 |
| ayoung | because when I call it and there is no token, it will get one | 02:56 |
| *** dims has joined #openstack-keystone | 02:57 | |
| jamielennox | ayoung: i'll need to rebase my existing queue around that a little but it will become a part of the adapter | 02:57 |
| ayoung | cool. I'll rebase and test. Probably have more for you tomorrow. | 02:57 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add V3 JSON Home support to GET / https://review.openstack.org/118240 | 02:58 |
| jamielennox | ayoung, bknudson, morganfainberg: have a look at the first 2 or 3 of this series https://review.openstack.org/#/c/117399/2 all < 100 lines of change and easy to comprehend | 02:59 |
| jamielennox | sigh and i'll have a look at json home | 02:59 |
| ayoung | jamielennox, "always" seems wrong | 03:00 |
| ayoung | I don't know if I need to use the auth url until I get the unscoped token | 03:00 |
| *** rushiagr is now known as rushiagr_away | 03:00 | |
| ayoung | jamielennox, or is it just "fall back" if no service catalog? | 03:00 |
| jamielennox | always? | 03:00 |
| jamielennox | what am i looking at? | 03:01 |
| ayoung | https://review.openstack.org/#/c/117399/2/keystoneclient/adapter.py,cm | 03:01 |
| *** KanagarajM has joined #openstack-keystone | 03:01 | |
| ayoung | Always use this endpoint URL for requests | 03:01 |
| jamielennox | ayoung: no it's an override | 03:01 |
| *** dims has quit IRC | 03:01 | |
| jamielennox | so use this in preference of whatever is in the catalog | 03:01 |
| ayoung | hmmmm | 03:02 |
| jamielennox | like how keystoneclient let's you set management_url, or nova has --bypass-url | 03:02 |
| jamielennox | all sorts of nasty things like that | 03:02 |
| ayoung | so this is not for my use case? | 03:02 |
| jamielennox | it came up with bknudson the other day as well where neutronclient in nova is configured to use a particular URL not the catalog | 03:02 |
| jamielennox | ayoung: no, not your usecase | 03:03 |
| ayoung | K | 03:03 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove extra V3 version router https://review.openstack.org/118522 | 03:11 |
| jamielennox | bknudson: ugh, is it really necessary to store latest_app? | 03:21 |
| *** amerine has joined #openstack-keystone | 03:28 | |
| *** alex_xu has quit IRC | 03:32 | |
| *** amerine has quit IRC | 03:33 | |
| *** alex_xu has joined #openstack-keystone | 03:41 | |
| *** radez is now known as radez_g0n3 | 03:46 | |
| *** rkofman has joined #openstack-keystone | 04:01 | |
| *** rushiagr_away is now known as rushiagr | 04:07 | |
| *** ajayaa has joined #openstack-keystone | 04:24 | |
| *** ukalifon has quit IRC | 04:31 | |
| *** KanagarajM has quit IRC | 04:34 | |
| *** ajayaa has quit IRC | 04:59 | |
| *** jaosorior has joined #openstack-keystone | 05:01 | |
| *** yasukun has joined #openstack-keystone | 05:12 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add docs for enabling endpoint policy https://review.openstack.org/118530 | 05:12 |
| *** chandankumar has joined #openstack-keystone | 05:13 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 05:14 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Add auth manager https://review.openstack.org/118531 | 05:14 |
| *** ajayaa has joined #openstack-keystone | 05:19 | |
| *** amirosh has joined #openstack-keystone | 05:19 | |
| ajayaa | jamielennox, Hi. | 05:24 |
| ajayaa | When a token is cached and then it is revoked, is it still usable? | 05:25 |
| ajayaa | *cached by keystonemiddleware | 05:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the federation configuration docs for saml2 https://review.openstack.org/118532 | 05:31 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update paste pipelines in configuration docs https://review.openstack.org/118533 | 05:38 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update paste pipelines in configuration docs https://review.openstack.org/118533 | 05:49 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 05:51 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/identity-api: Remove expected dates for new features https://review.openstack.org/118537 | 05:55 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/111920 | 06:05 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the docs that list sections in keystone.conf https://review.openstack.org/118550 | 06:09 |
| *** jimhoagland has joined #openstack-keystone | 06:15 | |
| *** stevemar has quit IRC | 06:16 | |
| *** k4n0 has joined #openstack-keystone | 06:18 | |
| *** afazekas has joined #openstack-keystone | 06:18 | |
| *** david-lyle has quit IRC | 06:19 | |
| *** ukalifon1 has joined #openstack-keystone | 06:23 | |
| *** ncoghlan has joined #openstack-keystone | 06:24 | |
| jamielennox | ajayaa: it can be yes | 06:34 |
| jamielennox | there is a setting to prevent that - which for some reason i forget is turned off by default | 06:34 |
| *** rkofman has left #openstack-keystone | 06:35 | |
| ajayaa | jamielennox, how does revocation list of tokens work? Each time you try to verify a token, does the middleware fetch the revocation list? | 06:36 |
| ekarlso | jamielennox: has the session stuff stabilized yet ? | 06:37 |
| jamielennox | ajayaa: it fetches it after some timeout - i think it's 30 sec by default | 06:39 |
| jamielennox | and then it should compare every request | 06:39 |
| jamielennox | check_revocations_for_cached should be set to true | 06:40 |
| jamielennox | ekarlso: yes, it's still being driven in a number of ways but it's usable | 06:40 |
| ekarlso | jamielennox: what does that mean ? ;P | 06:40 |
| jamielennox | ekarlso: i'm still doing a lot with it, but it's usable as it and everything that uses it will get the new stuff as it becomes availbae | 06:41 |
| ekarlso | jamielennox: what new stuff ? :) | 06:41 |
| jamielennox | um, serializing auth plugins, theres some new plugins, some better work on adapters... | 06:43 |
| jamielennox | none of this would prevent you using it | 06:43 |
| ajayaa | jamielennox, If you use that option, does it not defeat the whole purpose of caching? | 06:43 |
| *** ncoghlan is now known as ncoghlan_afk | 06:44 | |
| jamielennox | ajayaa: it's disabled by default :( - i would argue yes, there was a political reason not to switch it that i don't understand | 06:44 |
| ajayaa | jamielennox, unless the backend calls are optimized for checking revocation request. That's still a htpp call over network. | 06:44 |
| ajayaa | jamielennox, okay. | 06:44 |
| jamielennox | ajayaa: not really, it will still cache the http response - it just wants to know about things that have expired after it has been cached | 06:45 |
| ajayaa | jamielennox, How does complete ephemeral pki token and token revocation play out? | 06:46 |
| jamielennox | ephemeral pki? | 06:47 |
| jamielennox | so pki is signing the token response and passing that around | 06:47 |
| jamielennox | auth_token then verifies the signature and trusts the response rather than fetch from the server | 06:48 |
| jamielennox | it still needs to look at revocations | 06:48 |
| ajayaa | sorry non-persistent* | 06:48 |
| *** wanghong has quit IRC | 06:48 | |
| jamielennox | it means it doesn't need to do the http request | 06:48 |
| *** wanghong has joined #openstack-keystone | 06:49 | |
| *** chandankumar has quit IRC | 07:07 | |
| *** chandan_kumar has joined #openstack-keystone | 07:13 | |
| *** lsmola has quit IRC | 07:16 | |
| *** chandan_kumar has quit IRC | 07:33 | |
| *** alex_xu has quit IRC | 07:45 | |
| *** chandan_kumar has joined #openstack-keystone | 07:47 | |
| ekarlso | jamielennox: how would you say the best way is to determine v2 / v3 auth in https://github.com/openstack/python-designateclient/blob/master/designateclient/v1/__init__.py#L26-L70 ? | 07:51 |
| ekarlso | I want to port that to use sessions instead of what we have now | 07:51 |
| *** ncoghlan_afk is now known as ncoghlan | 07:52 | |
| jamielennox | ekarlso: you need to maintain consistency with the existing arguments? | 07:55 |
| ekarlso | jamielennox: yeah, I don't wanna break stuff for people using just the bindings ;) | 07:55 |
| ekarlso | for v1 anyways | 07:55 |
| jamielennox | cause ideally you don't test the difference at all you just accept the auth plugin | 07:55 |
| ekarlso | ? | 07:55 |
| *** alex_xu has joined #openstack-keystone | 07:56 | |
| ekarlso | jamielennox: not following that one | 07:57 |
| jamielennox | so ideally a client would never deal with figuring out the auth type at all, you just accept the plugin as an argument | 07:58 |
| ekarlso | yeah | 07:58 |
| ekarlso | but if I change that, that's breaking the existing API | 07:58 |
| ekarlso | which kinda sucks :) | 07:59 |
| jamielennox | yep | 07:59 |
| ekarlso | and will def get a -1 on first attempt :P | 07:59 |
| ekarlso | is there a "good way" to figure it out ? | 07:59 |
| ekarlso | for v2 client we're dropping anything but session + auth as arguments anyways | 07:59 |
| jamielennox | ok so you want to look at keysteonclient.adapter.Adapter | 07:59 |
| *** bvandenh has joined #openstack-keystone | 08:00 | |
| jamielennox | you should take and pass the __init__(**kwargs) to it | 08:00 |
| ekarlso | what's that for ? | 08:00 |
| jamielennox | makes the arguments that are passed to a client the same for all clients | 08:01 |
| jamielennox | makes handling of sessions the same | 08:01 |
| jamielennox | it's the httpclient object that other clients have | 08:01 |
| jamielennox | i don't see if you guys have one of those | 08:01 |
| ekarlso | so it's a wrapper around a session kinda | 08:02 |
| ekarlso | ? | 08:02 |
| jamielennox | session is global | 08:02 |
| jamielennox | you can pass it to as many clients as you have | 08:03 |
| jamielennox | adapter is local, you make one for every client that you have using the session | 08:03 |
| ekarlso | I guess what I was wanting to do | 08:03 |
| ekarlso | is to create the auth / session if there's none provided | 08:04 |
| jamielennox | yea, ideally you want https://review.openstack.org/#/c/81147/ | 08:05 |
| jamielennox | obviously it's not merged yet :p | 08:05 |
| ekarlso | oooooooooooh | 08:05 |
| ekarlso | NICE! | 08:05 |
| ekarlso | :D | 08:05 |
| * ekarlso gives jamielennox a vHug | 08:05 | |
| ekarlso | will that make it for juno ? | 08:06 |
| jamielennox | umm, not sure | 08:06 |
| jamielennox | clients don't really work like that we release when it's ready | 08:06 |
| ekarlso | ?ah | 08:06 |
| ekarlso | would be nice to see that in soon | 08:06 |
| ekarlso | I want to use session stuff badly for designate | 08:07 |
| jamielennox | yea, i want to see it used for everything | 08:07 |
| ekarlso | and btw, I really thinkg your work with this is absolutely awesome | 08:07 |
| *** lsmola has joined #openstack-keystone | 08:07 | |
| jamielennox | ekarlso: thanks very much - it's taken a while, but its starting to be really useful | 08:07 |
| ekarlso | I've been using many of the python-<name>client lately on something in HP and it's scary to see how many different patterns there is to constructing the clients | 08:08 |
| ekarlso | nor that the clients have parity when it comes to what keystone version they support :'( | 08:08 |
| jamielennox | yea, i've spent a lot of time working with them - they're a mess | 08:08 |
| *** jimhoagland has quit IRC | 08:08 | |
| ekarlso | ideally bindings would just use your stuff from keystone and kick out all the other stuff | 08:08 |
| jamielennox | and various levels of code control | 08:08 |
| ekarlso | at least that's what I'm hoping to do in designate | 08:09 |
| jamielennox | i would love that - unfortunately backwards compatability is a real issue | 08:09 |
| jamielennox | my hope is that if i can at least move everyone across and it becomes a pattern it gets much easier to convert everyone else | 08:09 |
| ekarlso | you know when that review is gonan be merged ? | 08:10 |
| jamielennox | my big problem at the moment is that there is no 'clean' implementation of what a client should look like cause they all have hacks for there own weird stuff | 08:10 |
| jamielennox | ekarlso: not really, i've been pushing other reviews recently | 08:10 |
| ekarlso | would be cool if you could get that one at least in ;P | 08:11 |
| jamielennox | that one doesn't look like its seen action in two weeks | 08:11 |
| jamielennox | yea, i want that one | 08:11 |
| jamielennox | ok - i'll push that one | 08:11 |
| ekarlso | cause then I can do sessions in designateclient : ) | 08:11 |
| ekarlso | bothj for v1 and v2 | 08:11 |
| jamielennox | so for the existing code it's not too hard to tell the difference | 08:11 |
| jamielennox | essentially if you do session.get_endpoint(auth, endpoint_filter={'service_type': 'identity', 'interface': 'public', 'version': 2) | 08:12 |
| jamielennox | if that returns a URL then that is the keystone v2 url | 08:13 |
| jamielennox | switch 2 for 3 to test for version 3 support | 08:13 |
| jamielennox | then it's just a matter of doing keystone.auth.identity.[v2|v3].[Password|Token] depending on the provided parameters | 08:14 |
| jamielennox | ah scrap that, actually you need to use keystoneclient.discover.Discovery() and do url_for there because get_endpoint relies on having a catalog already | 08:15 |
| ekarlso | is discovery just for keystone though ? | 08:15 |
| jamielennox | no | 08:16 |
| jamielennox | if your root GET / returns the same format as either nova/keystone/cinder it will work | 08:17 |
| *** zeridon has joined #openstack-keystone | 08:17 | |
| jamielennox | they're the one i think we test against anywya | 08:17 |
| *** BAKfr has joined #openstack-keystone | 08:21 | |
| zeridon | morning guys | 08:21 |
| zeridon | Is it possible to use keystone just as identity/authorization provider for a service not related to openstack at all | 08:21 |
| zeridon | e.g. are there specific assumptions that there is an openstack installation available | 08:22 |
| jamielennox | zeridon: you could... and there are definetly things we do that are for openstack | 08:24 |
| jamielennox | zeridon: do you have a keystone already and you want to integrate with it or you want to use a new keystone for something competely different | 08:25 |
| *** oomichi has quit IRC | 08:25 | |
| zeridon | jamielennox, no keystone available, starting from scratch to try and implement api style (token/header/etc) authn/authz infrastructure | 08:26 |
| jamielennox | zeridon: so there's nothing that would prevent you from using it. on the other hand there are a lot of assumptions that are for openstack | 08:26 |
| jamielennox | if you're looking for a generic auth system there are others available | 08:26 |
| zeridon | ok thanks, can you point me to something considered stable that has the tenant/user paradigm | 08:28 |
| jamielennox | um, depends on scale, user base etc | 08:29 |
| *** chandan_kumar has quit IRC | 08:29 | |
| zeridon | small scale ... ~500 - 1000 tenants, 1 - 5 users per tenant | 08:29 |
| jamielennox | freeipa or anything ldap based can handle that stuff easily | 08:30 |
| zeridon | thanks | 08:31 |
| zeridon | you have a beer if i bump into you someday :) | 08:31 |
| jamielennox | np | 08:31 |
| *** andreaf has joined #openstack-keystone | 08:53 | |
| *** alex_xu has quit IRC | 09:08 | |
| *** aix has joined #openstack-keystone | 09:13 | |
| *** amerine has joined #openstack-keystone | 09:20 | |
| *** amerine has quit IRC | 09:24 | |
| *** ncoghlan is now known as ncoghlan_afk | 09:56 | |
| *** ajayaa has quit IRC | 10:00 | |
| *** topol has joined #openstack-keystone | 10:08 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 10:10 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 10:12 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Add docs for enabling endpoint policy https://review.openstack.org/118530 | 10:15 |
| *** Xeye is now known as amakarov | 10:18 | |
| *** amakarov is now known as xeye | 10:19 | |
| *** xeye is now known as x-eye | 10:19 | |
| x-eye | Greetings! | 10:19 |
| x-eye | I ran into strange thing with LDAP models in backend: | 10:20 |
| *** amerine has joined #openstack-keystone | 10:20 | |
| x-eye | if I try to validate LDAP search results against required model fields many tests fail | 10:22 |
| x-eye | seems current code depend on such ORM behaviour: incomplete models are freely stored in LDAP | 10:23 |
| x-eye | there are even tests rely on it | 10:24 |
| x-eye | I uploaded a patch with validation issuing warnings instead of raising errors | 10:25 |
| *** ncoghlan_afk is now known as ncoghlan | 10:25 | |
| *** amerine has quit IRC | 10:25 | |
| x-eye | https://review.openstack.org/#/c/118590/ | 10:25 |
| x-eye | Somebody please explain: are requried model fields really required or what purpose of it otherwise? | 10:28 |
| openstackgerrit | A change was merged to openstack/keystone: Remove TODO that was done https://review.openstack.org/118204 | 10:34 |
| *** ncoghlan is now known as ncoghlan_afk | 10:35 | |
| *** htruta has quit IRC | 10:43 | |
| *** ajayaa has joined #openstack-keystone | 10:43 | |
| *** bvandenh has quit IRC | 10:44 | |
| *** bvandenh has joined #openstack-keystone | 10:45 | |
| *** Ephur has quit IRC | 11:03 | |
| *** jraim_ has quit IRC | 11:03 | |
| *** sbasam has quit IRC | 11:03 | |
| *** sbasam has joined #openstack-keystone | 11:03 | |
| *** comstud has quit IRC | 11:03 | |
| *** miqui has quit IRC | 11:05 | |
| *** jraim__ has joined #openstack-keystone | 11:06 | |
| *** dims has joined #openstack-keystone | 11:06 | |
| ekarlso | jamielennox: you around still ? | 11:06 |
| *** sigmavirus24_awa has quit IRC | 11:06 | |
| *** dolphm has quit IRC | 11:06 | |
| jamielennox | ekarlso: sort of | 11:07 |
| ekarlso | jamielennox: https://review.openstack.org/#/c/81147/19/keystoneclient/auth/identity/generic/token.py for example is that a authmethod or plugin ? | 11:07 |
| ekarlso | aka does it go in the session.auth or not | 11:07 |
| *** Ephur has joined #openstack-keystone | 11:08 | |
| jamielennox | it's a plugin | 11:08 |
| ekarlso | so session.auth = generic.Password() f ex ? | 11:08 |
| jamielennox | yep | 11:08 |
| *** comstud has joined #openstack-keystone | 11:08 | |
| *** dolphm has joined #openstack-keystone | 11:11 | |
| *** dims has quit IRC | 11:12 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 11:12 | |
| *** jdennis1 has joined #openstack-keystone | 11:12 | |
| *** jdennis has quit IRC | 11:13 | |
| *** dims has joined #openstack-keystone | 11:13 | |
| *** dims_ has joined #openstack-keystone | 11:14 | |
| *** jdennis has joined #openstack-keystone | 11:14 | |
| ekarlso | hmmm jamielennox I'm getting a recursion error : | | 11:15 |
| jamielennox | really... i have tested it but i don't think it's had much practical use | 11:15 |
| jamielennox | what do you get? | 11:15 |
| ekarlso | http://paste.ubuntu.com/8222761/ but wondering if it's due to that it's hitting designate api or keystone | 11:16 |
| *** jdennis1 has quit IRC | 11:17 | |
| *** dims has quit IRC | 11:17 | |
| jamielennox | ekarlso: damn - auth/identity/generic/base.py:124 | 11:20 |
| jamielennox | get_discovery() | 11:20 |
| ekarlso | :'( | 11:20 |
| ekarlso | care for a quick fix ? ;) | 11:20 |
| jamielennox | add authenticated=False to the end of that call | 11:21 |
| *** amerine has joined #openstack-keystone | 11:22 | |
| *** amerine has quit IRC | 11:26 | |
| ekarlso | q though jamielennox, will it attempt a new discovery each time it does a api call ? | 11:26 |
| ekarlso | or is that cached somehow | 11:26 |
| jamielennox | cached on the session and on the auth plugin | 11:27 |
| jamielennox | so if you share either of them it will stay cached | 11:27 |
| ekarlso | i mean discovery for the service not keystone | 11:27 |
| jamielennox | same | 11:27 |
| ekarlso | oh o k | 11:27 |
| *** dims_ has quit IRC | 11:29 | |
| *** dims has joined #openstack-keystone | 11:29 | |
| jamielennox | ekarlso: did authenticated=False fix it? i'll update the review | 11:30 |
| ekarlso | jamielennox: ya | 11:33 |
| *** dims has quit IRC | 11:34 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Version independent plugins https://review.openstack.org/81147 | 11:34 |
| ekarlso | jamielennox: how does that fair though if the keystone (hp public cloud) for example doesn't support discovery ? ;P | 11:35 |
| jamielennox | ekarlso: seriously? | 11:35 |
| ekarlso | jamielennox: ? ;) | 11:36 |
| jamielennox | hp public cloud doesn't do discovery? | 11:36 |
| ekarlso | don't think so | 11:36 |
| jamielennox | so it will fallback to looking for a /v2 or /v3 in the URL so i expect that would still be ok | 11:36 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 11:36 |
| ekarlso | k | 11:36 |
| jamielennox | after that it will fail | 11:37 |
| ekarlso | i'll test it later towards our public cloud : ) | 11:37 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 11:37 |
| *** dims has joined #openstack-keystone | 11:37 | |
| *** zeridon has quit IRC | 11:49 | |
| *** dims has quit IRC | 11:50 | |
| *** diegows has joined #openstack-keystone | 11:50 | |
| *** dims has joined #openstack-keystone | 11:50 | |
| jamielennox | alright, im out | 11:50 |
| *** dims_ has joined #openstack-keystone | 11:51 | |
| *** dims has quit IRC | 11:54 | |
| *** topol has quit IRC | 11:55 | |
| *** KanagarajM has joined #openstack-keystone | 12:00 | |
| *** lsmola has quit IRC | 12:01 | |
| *** HenryG is now known as HenryG_afk | 12:04 | |
| *** lsmola has joined #openstack-keystone | 12:10 | |
| *** amerine has joined #openstack-keystone | 12:22 | |
| *** amerine has quit IRC | 12:27 | |
| *** dims_ has quit IRC | 12:29 | |
| *** dims has joined #openstack-keystone | 12:30 | |
| *** dims_ has joined #openstack-keystone | 12:32 | |
| *** dims has quit IRC | 12:34 | |
| *** KanagarajM has quit IRC | 12:38 | |
| *** yasukun has quit IRC | 12:38 | |
| *** dims_ has quit IRC | 12:45 | |
| *** dims has joined #openstack-keystone | 12:46 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Refactor LDAP backend using context manager for connection https://review.openstack.org/118138 | 12:47 |
| *** aix has quit IRC | 12:58 | |
| *** aix has joined #openstack-keystone | 13:01 | |
| *** richm has joined #openstack-keystone | 13:02 | |
| *** bklei has joined #openstack-keystone | 13:06 | |
| *** vhoward has joined #openstack-keystone | 13:07 | |
| *** henrynash has quit IRC | 13:08 | |
| *** nkinder has quit IRC | 13:11 | |
| ayoung | dstanek, https://review.openstack.org/#/c/118383/2 looks right to me. But it got me to realize that we are broken when it comes to the client. We really need to run the client against a live Keystone server for unit testing. We really should be building keystoneclient, keystonemiddleware and keystone server out of the same repository and just packaging them separately. | 13:18 |
| *** henrynash has joined #openstack-keystone | 13:18 | |
| *** joesavak has joined #openstack-keystone | 13:20 | |
| *** gordc has joined #openstack-keystone | 13:21 | |
| dstanek | ayoung: we do right? in unit tests to some extent and tempest. looks like our coverage is great | 13:22 |
| *** radez_g0n3 is now known as radez | 13:22 | |
| ayoung | dstanek, not from the client side | 13:22 |
| ayoung | dstanek, client side unit tests are not against a live server | 13:23 |
| *** zzzeek has joined #openstack-keystone | 13:23 | |
| dstanek | they go against an in memory server which should be good enough | 13:23 |
| ayoung | dstanek, no | 13:23 |
| ayoung | that was the old testing in the server code | 13:23 |
| ayoung | client goes against fixtures only | 13:23 |
| dstanek | those fixtures that up servers that listen on real ports | 13:24 |
| ayoung | tempest is better, but having the tests in someone elses repository means they cannot be modified with the code. In the case of "region" vs "region_id" it means we don't test what the server really responds to | 13:24 |
| *** rodrigods has joined #openstack-keystone | 13:25 | |
| ayoung | dstanek, nah, its all httpretty style responses | 13:25 |
| dstanek | so it sounds like the change wasn't backward compatible | 13:25 |
| dstanek | ayoung: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_keystoneclient.py | 13:25 |
| ayoung | dstanek, that is inthe keystone server tree, not in client | 13:25 |
| dstanek | ayoung: i know - that's were we test for compatibility which should have caught this | 13:26 |
| *** bknudson has quit IRC | 13:26 | |
| ayoung | dstanek, sure. But look at the state right now. There is no way to add a test. If we added a test to server, that test would fail | 13:27 |
| ayoung | so we fix things in the client, but then there is no live server test | 13:27 |
| ayoung | finally we can add the test to server | 13:27 |
| ayoung | but there is no way Gerrit can track that for us, because things are in separate repos | 13:27 |
| dstanek | ayoung: i think the client fix isn't the right fix to make | 13:28 |
| ayoung | ? | 13:28 |
| dstanek | the API should have been backward compatible and that needs to be fixed | 13:28 |
| ayoung | should be fixed on server side? | 13:28 |
| dstanek | i'm looking for what went wrong now | 13:28 |
| ayoung | cool | 13:28 |
| dstanek | absolutely | 13:28 |
| *** ukalifon1 has quit IRC | 13:29 | |
| dstanek | the guidelines say that we are not supposed to remove stuff | 13:29 |
| *** topol has joined #openstack-keystone | 13:33 | |
| *** jasondotstar has joined #openstack-keystone | 13:39 | |
| *** bknudson has joined #openstack-keystone | 13:44 | |
| *** r-daneel has joined #openstack-keystone | 13:47 | |
| dstanek | i need to spend some time this weekend making these tests faster/better/stronger | 13:48 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add V3 JSON Home support to GET / https://review.openstack.org/118240 | 13:51 |
| *** dhellmann has quit IRC | 13:57 | |
| *** dhellmann has joined #openstack-keystone | 13:58 | |
| *** nkinder has joined #openstack-keystone | 13:58 | |
| *** jdennis has quit IRC | 13:59 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes formatting error in debug log statement https://review.openstack.org/118640 | 14:03 |
| *** rm_work is now known as rm_work|away | 14:03 | |
| openstackgerrit | A change was merged to openstack/keystone: Fix follow up review issues with endpoint policy backend patch. https://review.openstack.org/118072 | 14:08 |
| *** jdennis has joined #openstack-keystone | 14:09 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Notify a consumer that all dependenices injected https://review.openstack.org/117523 | 14:11 |
| *** saipandi has joined #openstack-keystone | 14:12 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:13 | |
| *** sigmavirus24 has joined #openstack-keystone | 14:13 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 14:14 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: LDAP additional attribute mappings validation https://review.openstack.org/118590 | 14:15 |
| *** bklei has quit IRC | 14:15 | |
| *** bklei has joined #openstack-keystone | 14:16 | |
| *** ukalifon1 has joined #openstack-keystone | 14:18 | |
| *** ajayaa has quit IRC | 14:19 | |
| *** htruta has joined #openstack-keystone | 14:19 | |
| *** htruta has quit IRC | 14:19 | |
| *** htruta has joined #openstack-keystone | 14:20 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Fix return from list role assignments on KVS https://review.openstack.org/118482 | 14:21 |
| *** amerine has joined #openstack-keystone | 14:24 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the federation configuration docs for saml2 https://review.openstack.org/118532 | 14:27 |
| *** rushiagr is now known as rushiagr_away | 14:28 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update paste pipelines in configuration docs https://review.openstack.org/118533 | 14:28 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 14:28 |
| *** andreaf has quit IRC | 14:28 | |
| *** amerine has quit IRC | 14:28 | |
| *** BAKfr has quit IRC | 14:31 | |
| *** ChanServ sets mode: +o dolphm | 14:33 | |
| *** HenryG_afk is now known as HenryG | 14:36 | |
| *** david-lyle has joined #openstack-keystone | 14:36 | |
| *** stevemar has joined #openstack-keystone | 14:36 | |
| *** bdossant has joined #openstack-keystone | 14:38 | |
| bdossant | hi! Can anyone tell me if it is possible to list the users of a domain using the openstackclient? | 14:39 |
| bdossant | I always get this error: ERROR: cliff.app The request you have made requires authentication. | 14:39 |
| bdossant | I can create users but not list or delete them | 14:39 |
| bdossant | keystone says: Invalid token found while getting domain ID for list request | 14:41 |
| x-eye | Hi! Look into keystone.conf: [ldap]user_allow_delete and so on | 14:43 |
| x-eye | Just a suggestion | 14:43 |
| *** BAKfr has joined #openstack-keystone | 14:44 | |
| *** ukalifon1 has quit IRC | 14:46 | |
| bdossant | x-eye: im using different domains, i can list the users from ldap | 14:46 |
| *** dolphm changes topic to "Dearest keystone-core, please avoiding sending non-juno3-critical patches to the gate until next week. <3 -dolphm" | 14:53 | |
| dolphm | ayoung, bknudson, dstanek, jamielennox, morganfainberg, stevemar, gyee, henrynash, lbragstad: ^ | 14:53 |
| bknudson | what are juno3-critical patches? | 14:54 |
| dolphm | bknudson: ones fulfilling blueprints | 14:54 |
| dolphm | bknudson: or wishlist bugs | 14:54 |
| dolphm | bknudson: if it can wait to land it until rc1, we should. the gate is waaay overloaded | 14:55 |
| bknudson | btw, I posted https://review.openstack.org/#/c/118240/ to provide V3 JSON Home from / | 14:55 |
| bknudson | it's ugly but seems to work | 14:55 |
| lbragstad | aren't we close to 20 hours on the gate? | 14:56 |
| stevemar | lbragstad, yeah, something silly like that | 14:56 |
| dolphm | gate load http://graphite.openstack.org/render/?from=-135days&width=1920&height=160&margin=0&hideLegend=true&hideAxes=false&hideGrid=true&target=color(stats.gauges.zuul.pipeline.gate.current_changes,%20%27000000%27)&bgcolor=ffffff | 14:57 |
| stevemar | so only approve things that really need to be in within the next 24 hrs | 14:59 |
| stevemar | gotcha | 14:59 |
| *** rushiagr_away is now known as rushiagr | 14:59 | |
| bknudson | everything on https://review.openstack.org/#/q/starredby:dolph+is:open,n,z is approved | 14:59 |
| *** ajayaa has joined #openstack-keystone | 15:03 | |
| *** gokrokve has joined #openstack-keystone | 15:16 | |
| *** amerine has joined #openstack-keystone | 15:25 | |
| *** cjellick has joined #openstack-keystone | 15:29 | |
| *** aix has quit IRC | 15:29 | |
| *** amerine has quit IRC | 15:29 | |
| dstanek | dolphm: ping | 15:30 |
| dolphm | dstanek: o/ | 15:30 |
| dolphm | bknudson: the head saml2 one failed gate this morning though :( | 15:31 |
| dstanek | dolphm: i'm working on a bug with the new endpoint->region reference | 15:31 |
| dstanek | dolphm: fixed it, but have a question about the original impl | 15:31 |
| bknudson | this is why you never split up changes. | 15:31 |
| dstanek | dolphm: why did we add the region creation logic to the controller instead of the backend? https://review.openstack.org/#/c/113183/27/keystone/catalog/controllers.py | 15:31 |
| dolphm | dstanek: the only reason i can think of is that it applies equally to all backends. manager probably would have been a better choice with that reasoning | 15:33 |
| dstanek | dolphm: that's what i though too. i'm going to put up a patch for that, but it's very, very non-critical | 15:33 |
| dolphm | dstanek: cool | 15:34 |
| dstanek | dolphm: the bug fix is critical because it seems to be breaking lots o'stuff | 15:34 |
| dolphm | dstanek: is it in LP? | 15:34 |
| dstanek | dolphm: https://bugs.launchpad.net/keystone/+bug/1364463?comments=all | 15:34 |
| uvirtbot | Launchpad bug 1364463 in keystone "Incorrect key in endpoint dictionary" [Undecided,New] | 15:34 |
| dstanek | they posted a client fix, but that's not the right thing to do | 15:34 |
| *** hrybacki has joined #openstack-keystone | 15:35 | |
| *** gokrokve has quit IRC | 15:37 | |
| dstanek | dolphm: it was a simple change, just fixing up the tests now | 15:37 |
| dolphm | dstanek: is the fix to ensure that both appear in the response? | 15:38 |
| dstanek | dolphm: yes | 15:38 |
| *** gokrokve has joined #openstack-keystone | 15:39 | |
| dstanek | the original review removed region from the response | 15:39 |
| *** andreaf has joined #openstack-keystone | 15:39 | |
| *** andreaf_ has joined #openstack-keystone | 15:42 | |
| dolphm | dstanek: crap. is that what caused this? http://logs.openstack.org/88/110488/2/gate/gate-tempest-dsvm-full/3cb4c30/console.html | 15:43 |
| *** mflobo has quit IRC | 15:43 | |
| *** amirosh has quit IRC | 15:43 | |
| dstanek | dolphm: i believe so | 15:43 |
| dolphm | dstanek: we need to get your fix prioritized in the gate then | 15:43 |
| *** amirosh has joined #openstack-keystone | 15:44 | |
| *** andreaf has quit IRC | 15:45 | |
| *** aix has joined #openstack-keystone | 15:48 | |
| *** amirosh has quit IRC | 15:48 | |
| x-eye | Bug https://bugs.launchpad.net/keystone/+bug/1274715 seems to be a feature :) | 15:51 |
| uvirtbot | Launchpad bug 1274715 in keystone "LOG.debug not working in LDAP code" [Medium,Triaged] | 15:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds region back into the catalog endpoint https://review.openstack.org/118667 | 15:51 |
| x-eye | mfisch, can you please recall where LOG.debug didn't work? | 15:52 |
| x-eye | I can't reproduce it | 15:53 |
| *** bdossant has quit IRC | 15:54 | |
| *** bvandenh has quit IRC | 15:54 | |
| dolphm | dstanek: elastic-recheck query is gating https://review.openstack.org/#/c/118668/ | 15:57 |
| *** jorge_munoz has joined #openstack-keystone | 15:58 | |
| dolphm | dstanek: the bug in heat was reported before the offending code landed in keystone?! | 16:00 |
| dstanek | dolphm: i think https://review.openstack.org/118667 fixes the catalog | 16:00 |
| dolphm | dstanek: that looks correct, but we also need to return both 'region_id' and 'region' in all the /endpoints calls | 16:01 |
| dstanek | dolphm: at least for v3, i don't think the v2 catalog has the problem | 16:01 |
| *** marcoemorais has joined #openstack-keystone | 16:03 | |
| dolphm | dstanek: is heat tripping up on the catalog or endpoint crud? | 16:03 |
| *** vish1 has joined #openstack-keystone | 16:04 | |
| dstanek | dolphm: has to be catalog, because as far as i can tell the crud is fine | 16:04 |
| dstanek | dolphm: also their client fix is in the catalog | 16:04 |
| *** mrutkows has joined #openstack-keystone | 16:05 | |
| *** sbasam_ has joined #openstack-keystone | 16:05 | |
| dstanek | dolphm: this is their fix https://review.openstack.org/#/c/118383/2 | 16:05 |
| dolphm | dstanek: they should still land that | 16:06 |
| *** diegows has quit IRC | 16:06 | |
| *** wwriverrat has joined #openstack-keystone | 16:06 | |
| dolphm | dstanek: v2 catalog does look good to me | 16:07 |
| *** afazekas has quit IRC | 16:07 | |
| *** ctracey_ has joined #openstack-keystone | 16:08 | |
| *** ctracey has quit IRC | 16:08 | |
| *** vishy has quit IRC | 16:08 | |
| *** vish1 is now known as vishy | 16:08 | |
| *** swartulv has quit IRC | 16:08 | |
| *** jasondotstar has quit IRC | 16:08 | |
| *** sbasam has quit IRC | 16:08 | |
| *** k4n0 has quit IRC | 16:08 | |
| *** jaosorior has quit IRC | 16:08 | |
| *** arunkant has quit IRC | 16:08 | |
| *** rushiagr has quit IRC | 16:08 | |
| *** nonameentername has quit IRC | 16:08 | |
| *** _nonameentername has joined #openstack-keystone | 16:08 | |
| *** ctracey_ is now known as ctracey | 16:08 | |
| *** Ugallu has joined #openstack-keystone | 16:08 | |
| *** arunkant has joined #openstack-keystone | 16:09 | |
| *** k4n0_ has joined #openstack-keystone | 16:09 | |
| dolphm | dstanek: jamielennox: +2 on https://review.openstack.org/#/c/118383/ | 16:09 |
| *** rushiagr has joined #openstack-keystone | 16:10 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds region back into the catalog endpoint https://review.openstack.org/118667 | 16:10 |
| *** amcrn has joined #openstack-keystone | 16:10 | |
| *** jaosorior has joined #openstack-keystone | 16:10 | |
| *** BAKfr has quit IRC | 16:11 | |
| *** swartulv has joined #openstack-keystone | 16:11 | |
| dolphm | dstanek: did you look at making the same fix to kvs? cc- bknudson | 16:12 |
| dstanek | dolphm: i just commented on it | 16:12 |
| dstanek | dolphm: bknudson: i don't think it's an issue, but I'm testing it now | 16:12 |
| dolphm | dstanek: ack | 16:12 |
| bknudson | dstanek: ok, thanks | 16:12 |
| dolphm | dstanek: the kvs backend wouldn't have caused the gate bug, at least | 16:13 |
| bknudson | just seems strange that the backend should have to care | 16:13 |
| bknudson | would expect this to be handled in the controller | 16:13 |
| dolphm | bknudson: AGREE | 16:13 |
| dolphm | bknudson: but the catalog code is in a funky spot | 16:13 |
| bknudson | y, if we need this fix it can be redone to put it in the controller later | 16:14 |
| dstanek | bknudson: kvs and templated use this http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/core.py#n450 but sql implements it's own | 16:14 |
| bknudson | dstanek: y, we needed to translate since there isn't really a v3 format for the templated backend. | 16:14 |
| bknudson | so templated doesn't have region_id. | 16:15 |
| dstanek | bknudson: sql: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends/sql.py#n306 | 16:15 |
| *** amirosh has joined #openstack-keystone | 16:16 | |
| *** andreaf_ is now known as andreaf | 16:17 | |
| bknudson | dstanek: and make_v3_endpoints creates the v3 catalog for the token? | 16:17 |
| openstackgerrit | A change was merged to openstack/keystone: Mark the revoke kvs backend deprecated, for removal in Kilo https://review.openstack.org/118067 | 16:17 |
| openstackgerrit | A change was merged to openstack/keystone: Mark the revoke kvs backend deprecated, for removal in Kilo https://review.openstack.org/118067 | 16:17 |
| bknudson | oh, never mind, that's a function-scoped function | 16:18 |
| *** gyee has joined #openstack-keystone | 16:20 | |
| *** amirosh has quit IRC | 16:21 | |
| *** amerine has joined #openstack-keystone | 16:22 | |
| *** rm_work|away is now known as rm_work | 16:22 | |
| openstackgerrit | David J Hu proposed a change to openstack/python-keystoneclient: Proper handling of catalog err cond w/os-token and os-endpoint https://review.openstack.org/118682 | 16:24 |
| dstanek | does the catalog kvs backend actually work? i don't think it can be used in practice at all | 16:30 |
| morganfainberg | dstanek, fairly certain it doesn't really work | 16:31 |
| *** wwriverrat has left #openstack-keystone | 16:31 | |
| morganfainberg | dstanek, tbh i didn't even realize we had a kvs catalog backend | 16:31 |
| openstackgerrit | guang-yee proposed a change to openstack/keystone: Use id attribute map for read-only LDAP https://review.openstack.org/117658 | 16:32 |
| dstanek | morganfainberg: i don't think it can either | 16:32 |
| dstanek | morganfainberg: the only way to get a catalog is to have this private method called first - http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends/kvs.py#n139 | 16:32 |
| dstanek | and only tests do | 16:32 |
| morganfainberg | yeah. | 16:32 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: warn against sorting requirements https://review.openstack.org/118683 | 16:32 |
| bknudson | Set "KEYSTONE_CATALOG_BACKEND=Template" in localrc for devstack to run with it. | 16:32 |
| morganfainberg | that isn't broken or anything :P | 16:33 |
| morganfainberg | bknudson, that uses the template not the KVS one, right? | 16:33 |
| morganfainberg | oh | 16:33 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: warn against sorting requirements https://review.openstack.org/118685 | 16:33 |
| bknudson | the template backend uses kvs. | 16:33 |
| morganfainberg | templated is a subclass of kvs | 16:33 |
| morganfainberg | i see | 16:34 |
| bknudson | that doesn't mean you can use kvs by itself... not sure how that would work. | 16:34 |
| morganfainberg | bknudson, the point is it doesn't. | 16:34 |
| *** amirosh has joined #openstack-keystone | 16:36 | |
| dstanek | i don't think templated needs to be a subclass of kvs because i think the only thing that actually works is get_catalog (the kvs inherited methods AFAICT dont' work) | 16:37 |
| dstanek | i'm glad all of that crap is deprecated | 16:37 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: warn against sorting requirements https://review.openstack.org/118686 | 16:41 |
| dolphm | dstanek: they don't work, but they should. if all the templated driver did was populate the kvs backend, and inherit everything else from it... it'd be fine | 16:42 |
| dstanek | dolphm: it doesn't even populate kvs at all. it stores its data in a variable called templates and only uses that | 16:43 |
| dolphm | dstanek: yeah, i'm saying it *should* populate kvs | 16:44 |
| morganfainberg | dolphm, or use caching instead of kvs to store the data faster | 16:44 |
| morganfainberg | dolphm, (would be my choice) | 16:44 |
| morganfainberg | store the data in a system that is faster to retrive from | 16:44 |
| morganfainberg | that is | 16:44 |
| bknudson | how is caching faster than kvs? | 16:45 |
| morganfainberg | bknudson, kvs and caching are faster than reading the templated files | 16:45 |
| morganfainberg | bknudson, wasn't implying kvs was faster than caching | 16:45 |
| morganfainberg | or didn't mean to | 16:45 |
| morganfainberg | or vise versa | 16:46 |
| dstanek | shouldn't matter because the file is only read once | 16:48 |
| *** vhoward has left #openstack-keystone | 16:49 | |
| *** amirosh has quit IRC | 16:50 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: warn against sorting requirements https://review.openstack.org/118683 | 16:50 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/python-keystoneclient: warn against sorting requirements https://review.openstack.org/118685 | 16:51 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystonemiddleware: warn against sorting requirements https://review.openstack.org/118686 | 16:51 |
| morganfainberg | dolphm, +2 on that | 16:51 |
| dolphm | morganfainberg: thanks | 16:52 |
| *** hrybacki has quit IRC | 16:54 | |
| *** hrybacki has joined #openstack-keystone | 16:55 | |
| *** rkofman1 has quit IRC | 16:57 | |
| *** rkofman1 has joined #openstack-keystone | 16:58 | |
| openstackgerrit | A change was merged to openstack/keystone: Implement validation on Trust V3 API https://review.openstack.org/104066 | 16:59 |
| *** marcoemorais has quit IRC | 17:00 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:02 | |
| *** amcrn_ has joined #openstack-keystone | 17:02 | |
| *** gokrokve_ has joined #openstack-keystone | 17:03 | |
| *** gokrokve has quit IRC | 17:05 | |
| *** marcoemorais1 has quit IRC | 17:06 | |
| *** amcrn has quit IRC | 17:06 | |
| *** marcoemorais2 has joined #openstack-keystone | 17:06 | |
| *** marcoemorais2 has quit IRC | 17:06 | |
| *** amcrn_ is now known as amcrn | 17:06 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:07 | |
| *** ncoghlan_afk is now known as ncoghlan | 17:07 | |
| *** ajayaa has quit IRC | 17:09 | |
| *** ajayaa has joined #openstack-keystone | 17:12 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed a change to openstack/identity-api: API documentation for Hierarchical Multitenancy https://review.openstack.org/111355 | 17:16 |
| *** ncoghlan is now known as ncoghlan_afk | 17:17 | |
| *** bobt has joined #openstack-keystone | 17:18 | |
| *** harlowja_away is now known as harlowja | 17:20 | |
| bknudson | Do we need to get the latest translations in ? https://review.openstack.org/#/c/111920/ | 17:26 |
| bknudson | we tried once but then it keeps getting updated | 17:26 |
| ayoung | bknudson, I think that does not have to be a J3 commit | 17:31 |
| *** bobt has quit IRC | 17:32 | |
| *** mrutkows has quit IRC | 17:32 | |
| *** ajayaa has quit IRC | 17:42 | |
| *** ajayaa has joined #openstack-keystone | 17:43 | |
| *** morganfainberg is now known as morganfainberg_Z | 17:53 | |
| stevemar | whoa the gate is finally at <100 patches | 17:55 |
| stevemar | endpoint grouping is gonna merge :O | 17:58 |
| openstackgerrit | A change was merged to openstack/keystone: Implementation of Endpoint Grouping https://review.openstack.org/111949 | 17:58 |
| stevemar | dstanek, your last comment abt copyrights | 18:00 |
| *** aix has quit IRC | 18:00 | |
| dstanek | stevemar: howdy | 18:00 |
| stevemar | dstanek, i honestly don't know... i think it's similar enough to the others, but IIRC i made the others and it was just copy pasta | 18:01 |
| stevemar | last i checked, i don't work for the foundation :( | 18:01 |
| stevemar | rm the line? | 18:01 |
| dstanek | that's what i figured... dolphm ^? | 18:01 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add docs for enabling endpoint policy https://review.openstack.org/118530 | 18:05 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the federation configuration docs for saml2 https://review.openstack.org/118532 | 18:05 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update paste pipelines in configuration docs https://review.openstack.org/118533 | 18:05 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the revocation configuration docs https://review.openstack.org/118536 | 18:05 |
| *** radez is now known as radez_g0n3 | 18:06 | |
| stevemar | dstanek, i rm'ed it, it was unnecessary | 18:07 |
| stevemar | i kinda want to make 'configuring extensions' a top level item on our dev docs landing page | 18:07 |
| stevemar | instead of having it nestled under configuration | 18:07 |
| *** marcoemorais1 has quit IRC | 18:08 | |
| dstanek | stevemar: lgtm | 18:08 |
| *** marcoemorais has joined #openstack-keystone | 18:09 | |
| ayoung | morganfainberg_Z, WAKEY WAKEY EGGS AND BACKEY | 18:18 |
| dstanek | ayoung: based on the bug we were discussing this morning https://review.openstack.org/#/c/118667/ | 18:19 |
| ayoung | dstanek, so we will have both values in the dictionary? | 18:20 |
| dstanek | yes, which is what we do for endpoint crud too | 18:20 |
| *** radez_g0n3 is now known as radez | 18:21 | |
| ayoung | dstanek, +2ed. | 18:21 |
| *** diegows has joined #openstack-keystone | 18:22 | |
| dstanek | ayoung: thx | 18:25 |
| *** marcoemorais has quit IRC | 18:28 | |
| dstanek | what is legacy_endpoint_id? seems rather pointless | 18:28 |
| *** marcoemorais has joined #openstack-keystone | 18:28 | |
| *** gokrokve has joined #openstack-keystone | 18:29 | |
| *** marcoemorais has quit IRC | 18:29 | |
| *** marcoemorais has joined #openstack-keystone | 18:29 | |
| *** bklei has quit IRC | 18:31 | |
| *** gokrokve_ has quit IRC | 18:31 | |
| *** gokrokve has quit IRC | 18:33 | |
| *** rushiagr is now known as rushiagr_away | 18:33 | |
| dolphm | stevemar: dstanek: the foundation's recommendation was to leave foundation-attributed copyrights alone, unless you want to go back and prove they're not valid... which probably isn't worth the hassle. if you just created one because copy/paste, definitely nuke it | 18:34 |
| dstanek | dolphm: that was a new file | 18:34 |
| dolphm | dstanek: do you want this to land before marking the bp implemented? https://review.openstack.org/#/c/117723/ | 18:37 |
| dolphm | dstanek: legacy_endpoint_id is the v2 endpoint ID, which is for endpoints that contain the trifecta of public + internal + admin as one "endpoint" | 18:38 |
| dolphm | dstanek: in the backend, we split it into (up to) 3 records, sharing a legacy_endpoint_id, but each having discrete v3 endpoint ID | 18:39 |
| dolphm | dstanek: so basically, it's a workaround for v2 endpoint != v3 endpoint (they're basically different concepts) | 18:39 |
| dstanek | dolphm: we probably don't absolutely need that to mark the bp implemented | 18:39 |
| dstanek | dolphm: i'll have to take a deeper look sometime - at a high level it was not obvious that there was a purpose, but i didn't look at the tests | 18:40 |
| dolphm | dstanek: i'd be happy to document it better if you point me to where you think an explanation belongs | 18:42 |
| dstanek | dolphm: ha, i don't even know :-( | 18:42 |
| dstanek | dolphm: it was right near the code i was changing and made me wonder | 18:43 |
| dolphm | henrynash: o/ | 18:43 |
| dolphm | stevemar: ^ | 18:43 |
| henrynash | dolphm: hi | 18:43 |
| dolphm | henrynash: see the /topic for the channel | 18:43 |
| henrynash | err….oops | 18:43 |
| dolphm | henrynash: no worries | 18:44 |
| henrynash | ok, now sitting on hands | 18:44 |
| dolphm | henrynash: just doing our part to reduce unnecessary gate load | 18:44 |
| stevemar | henrynash, we're a union for the next 24 hrs, no extra work mr nash | 18:44 |
| henrynash | blimey, is that the time, gotta be tea break, guv | 18:44 |
| dolphm | fwiw, there's a few non-critical things already in the gate queue that i'm going to let go until they either merge or fail. if they fail, i'll try to keep them from requeing | 18:44 |
| *** Ugallu has quit IRC | 18:45 | |
| dolphm | stevemar: lol | 18:45 |
| stevemar | dolphm, i honestly wonder if it'll all get merged in 24 hrs | 18:46 |
| stevemar | the gate is SO long | 18:46 |
| dolphm | stevemar: k2k is the only one at risk for being blocked by the gate load... if it doesn't make it, i'd be happy to use a feature freeze exception since it's already gating | 18:47 |
| *** richm has quit IRC | 18:49 | |
| dolphm | henrynash: you can still remove the +A on this before it enters the gate :) https://review.openstack.org/#/c/118530/ it's still in the check queue | 18:50 |
| henrynash | dolphmL sure | 18:50 |
| henrynash | dolphm: done | 18:51 |
| dolphm | henrynash: thanks! | 18:51 |
| *** amcrn_ has joined #openstack-keystone | 18:51 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Moves create region from controller to manager https://review.openstack.org/118741 | 18:53 |
| *** amcrn has quit IRC | 18:54 | |
| samuelmz | Hi. If I have an inherited role on a domain, can I get a token on a project in that domain? (even if I don't have a role on that project, ofc) | 18:54 |
| dolphm | samuelmz: yes | 18:58 |
| samuelmz | dolphm, so the token api should use the role assignments one? | 18:59 |
| dolphm | samuelmz: i don't understand the question | 18:59 |
| samuelmz | dolphm, to provide a token , we should verify if that user is who he is saying to be (checking password) and if that user has permissions on a project/domain, right? | 19:01 |
| dolphm | samuelmz: that's a reasonable statement, yes | 19:01 |
| samuelmz | dolphm, in that second part (verify permissions), do we use the role_assignments api? | 19:01 |
| dolphm | henrynash: should this be invalid now? https://bugs.launchpad.net/keystone/+bug/1363019 | 19:02 |
| uvirtbot | Launchpad bug 1363019 in keystone "test_versions.py is currently breaking pep8 in master" [Medium,In progress] | 19:02 |
| dolphm | samuelmz: it uses the assignments manager/backend | 19:03 |
| *** richm has joined #openstack-keystone | 19:03 | |
| samuelmz | dolphm, do you have an entry point for this? It'd be great :) | 19:03 |
| henrynash | dolphm: so I think there is a minor issu, but the title is wroung….test_versions fails flake8 on machine, but passes on master and if I fix it on my machine, it fails on master! | 19:03 |
| dolphm | samuelmz: start with the token providers? i'm not quite sure what you're after | 19:04 |
| *** diegows has quit IRC | 19:04 | |
| dolphm | henrynash: what versions of pep8, flake8 and hacking do you have installed? | 19:04 |
| samuelmz | dolphm, I'm part of the team implementing hierarchical projects and extending the inherited roles concept to it | 19:05 |
| henrynash | dolphm: checking | 19:05 |
| samuelmz | dolphm, I'd like to see how it's being done for inherited roles on domain, and then do the same to a project hierarchy | 19:06 |
| samuelmz | dolphm, I'll take a look at the token providers, thanks | 19:07 |
| henrynash | dolphm: pep8: 0.6.1-2ubuntu2 | 19:08 |
| dolphm | henrynash: is there a better answer to samuelmz's question than "token providers"? | 19:09 |
| dolphm | henrynash: that pep8 is *crazy* old -- be sure to install one from pip! | 19:09 |
| dolphm | henrynash: what's the output of pep8 --version when you're seeing that error? | 19:10 |
| henrynash | dolphm: what this about token-provdiers? | 19:10 |
| dstanek | henrynash: dolphm: i have a patch for test_versions that i haven't push up yet - i think because of the newest hacking | 19:10 |
| samuelmz | dolphm, henrynash, if the better answer is 'token providers', it's strange the fact that we haven't any test for inherited role at test_token_provider | 19:10 |
| dolphm | henrynash: where to look for how role assignments are inherited to projects, and consumed during the token generation process? | 19:10 |
| dstanek | i also updated my logging hacking check to look for _LW instead of _ | 19:10 |
| henrynash | dolphm: there’s a common methond in assignmentts…hold on | 19:11 |
| dolphm | samuelmz: ^^ | 19:11 |
| henrynash | dolphm, samuelmz: get_roles_for_user_and_project() | 19:12 |
| henrynash | samuelmz: in assignment/core.py | 19:12 |
| samuelmz | henrynash, I'm gonna take a look at this | 19:14 |
| *** radez is now known as radez_g0n3 | 19:15 | |
| samuelmz | henrynash, I can't find the place where the domain is expanded to its porjects tho | 19:16 |
| samuelmz | henrynash, I mean something like 'if extension is enabled, get user's domain and then check get_roles_for_user_and_project for each project in that domain' | 19:17 |
| henrynash | samuelmz: start looking at line 188 | 19:17 |
| samuelmz | henrynash, does this make sense? | 19:17 |
| henrynash | samuelmz: if CONF.os_inherit.enabled: | 19:17 |
| samuelmz | henrynash, I guess I'm not in the correct file | 19:18 |
| henrynash | assgnment/core.py | 19:18 |
| henrynash | samuelmz: ^^ | 19:18 |
| samuelmz | henrynash, that's clear | 19:19 |
| *** gokrokve has joined #openstack-keystone | 19:19 | |
| samuelmz | henrynash, but where do we call get_roles_for_user_and_project at the token controller/api? | 19:19 |
| samuelmz | henrynash, wow I'm sorry | 19:20 |
| samuelmz | henrynash, I got confused, it's clear now | 19:20 |
| henrynash | samuelmz: ok :-) | 19:20 |
| henrynash | samuelmz: no I haven’t looked at the variouschanges we have done in tokens in Juno in details, but I think it probably still flows trhough here. | 19:21 |
| henrynash | samuwlmz: fyi, the whole _get_metadata() thing is assignment/core is yukky..and we’re gonna kill it in Kilo (!), now that teh kvs backends will be deprcated…but the logic is still sond | 19:22 |
| henrynash | sound | 19:22 |
| samuelmz | henrynash, great | 19:23 |
| samuelmz | henrynash, get_roles_for_user_and_project does the same work of list_role_assignments, do you agree? | 19:25 |
| samuelmz | henrynash, the only difference is that it returns only the role_id of each entry | 19:25 |
| samuelmz | henrynash, filtered by user_id and project_id | 19:26 |
| henrynash | samelmz: so yes, list_role_assignments is a newer api | 19:27 |
| henrynash | samelmz: and we always kind of had it in mind that eventually we would use teh effective mode of role_assignment to do this | 19:28 |
| samuelmz | henrynash, yes, and list_role_assignment is pretty inefficient | 19:29 |
| henrynash | samuelmz: …there is work going on elsewhere to enable filtering in the backend method for that…whcih is really needed ahead of switching over to using that in place of what the get_roles_for_user_and_project() doe stoday | 19:30 |
| samuelmz | henrynash, but this will be changed https://review.openstack.org/#/c/116682/ | 19:31 |
| henrynash | samuelmz: yep, that’s the work I was refering to | 19:31 |
| samuelmz | henrynash, yes I'm doing it with my team :) | 19:31 |
| henrynash | samuelmz: ah, ok..sorry! | 19:31 |
| samuelmz | henrynash, also, we are implementing the hierarchical projects concept | 19:32 |
| henrynash | samuelmz: yep, guessed that bit :-) | 19:32 |
| samuelmz | henrynash, and now I'm not able to get a token from an inherited role.. I'm gonna implement the 'effective' part for hierarchical projects on get_roles_for_user_and_project | 19:33 |
| henrynash | samuelmz: rght | 19:33 |
| samuelmz | henrynash, even if we've already implemented the list_role_assignments and the code will be kept duplicated | 19:33 |
| henrynash | samuelmz: ok, got it | 19:34 |
| samuelmz | henrynash, I think the best approach is to do a refactoring once everything is merged | 19:34 |
| henrynash | samuelmz: yep, ok | 19:34 |
| samuelmz | henrynash, great | 19:35 |
| samuelmz | henrynash, I couldn't find a test for token through an inherited domain role tho | 19:36 |
| henrynash | samuelmz: so there are certinly lots of inhertied tests….I’d be surprised if we didn;t test that | 19:37 |
| samuelmz | henrynash, ok.. I'm gonna create a test for it at IdentityInheritanceTestCase, is that a good place? | 19:38 |
| *** bambam1 has quit IRC | 19:38 | |
| samuelmz | henrynash, and I am gonna submit a patch for this test today | 19:38 |
| *** bambam1 has joined #openstack-keystone | 19:40 | |
| *** ajayaa has quit IRC | 19:46 | |
| bknudson | ayoung: I think I know what the fix is for bug 1343579 -- were you looking at it? | 19:49 |
| uvirtbot | Launchpad bug 1343579 in keystone "Versionless GET on keystone gives different answer with port 5000 and 35357" [High,Triaged] https://launchpad.net/bugs/1343579 | 19:49 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/service.py#n57 | 19:49 |
| *** radez_g0n3 is now known as radez | 19:51 | |
| *** raildo1 has left #openstack-keystone | 19:51 | |
| *** raildo1 has joined #openstack-keystone | 19:51 | |
| *** raildo1 has left #openstack-keystone | 19:54 | |
| *** raildo has joined #openstack-keystone | 19:55 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix admin server doesn't report v2 support in Apache httpd https://review.openstack.org/118757 | 20:00 |
| *** joesavak has quit IRC | 20:03 | |
| *** radez is now known as radez_g0n3 | 20:06 | |
| *** stevemar has quit IRC | 20:07 | |
| *** marcoemorais has quit IRC | 20:10 | |
| *** marcoemorais has joined #openstack-keystone | 20:11 | |
| *** marcoemorais has quit IRC | 20:12 | |
| *** marcoemorais1 has joined #openstack-keystone | 20:13 | |
| ayoung | bknudson, um | 20:16 |
| ayoung | bknudson, thought I submitted a patch for that, but I know the problem | 20:16 |
| ayoung | yep | 20:16 |
| bknudson | ayoung: oh, I just saw the bug and there wasn't a patch listed. | 20:17 |
| *** fifieldt_ has joined #openstack-keystone | 20:17 | |
| ayoung | bknudson, I've no problem with your submitting a patch. Looks like I missed it one way or another | 20:17 |
| bknudson | ayoung: it's here https://review.openstack.org/118757 ... was only the one line | 20:18 |
| ayoung | bknudson, I bet if I look through my private git repo I will have exactly that change checked in to some nameless branch | 20:18 |
| ayoung | so happy to +2 | 20:19 |
| *** fifieldt has quit IRC | 20:21 | |
| *** gordc has quit IRC | 20:24 | |
| samuelmz | henrynash, ping | 20:25 |
| openstackgerrit | Jeremy Stanley proposed a change to openstack/keystone: Work toward Python 3.4 support and testing https://review.openstack.org/118778 | 20:29 |
| openstackgerrit | Jeremy Stanley proposed a change to openstack/keystonemiddleware: Work toward Python 3.4 support and testing https://review.openstack.org/118779 | 20:29 |
| openstackgerrit | Jeremy Stanley proposed a change to openstack/python-keystoneclient: Work toward Python 3.4 support and testing https://review.openstack.org/118802 | 20:30 |
| dstanek | dolphm: i didn't realize that they could prioritze gate jobs like that | 20:48 |
| dolphm | dstanek: it's mostly reserved for pushing fixes that address transient issues through.. fortunately, we don't have too many of those :) | 20:49 |
| *** marcoemorais1 has quit IRC | 20:50 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a spacing issue that causes pep8 to complain https://review.openstack.org/118882 | 20:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds missing log hints for level E/I/W https://review.openstack.org/118883 | 20:51 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Extends hacking check for logging to verify i18n hints https://review.openstack.org/118884 | 20:51 |
| *** marcoemorais1 has joined #openstack-keystone | 20:54 | |
| *** htruta has quit IRC | 20:58 | |
| *** jimhoagland has joined #openstack-keystone | 21:03 | |
| *** jasondotstar has joined #openstack-keystone | 21:05 | |
| samuelmz | Hi. Should we be able to update a grant? I know if we want to change its role or its project/domain, it will be no more the same grant, then delete it and create a new one | 21:06 |
| samuelmz | But what about a grant becoming inherited? It will always be the same grant, but its effect will be propagated | 21:07 |
| samuelmz | What are you thoughts on this? | 21:08 |
| *** david-lyle has quit IRC | 21:12 | |
| *** dencaval has quit IRC | 21:16 | |
| samuelmz | dolphm, ^ | 21:17 |
| dolphm | samuelmz: they're immutable. they don't have a reference exposed to the HTTP API upon which to mutate anything | 21:17 |
| *** saranjan has joined #openstack-keystone | 21:18 | |
| samuelmz | dolphm, yes... that's the point. Now with the inherit attribute, it does make sense to make a grant inherited, doesn't? | 21:19 |
| samuelmz | dolphm, if so, we could expose this to the HTTP API | 21:20 |
| *** dhellmann is now known as dhellmann_ | 21:28 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: use one indentation style https://review.openstack.org/118894 | 21:29 |
| *** david-lyle has joined #openstack-keystone | 21:33 | |
| dstanek | dolphm: i like your fix better than mine | 21:37 |
| dolphm | dstanek: to the indentation thing? | 21:37 |
| bknudson | dolphm really didn't like the way I formatted that structure. | 21:37 |
| bknudson | my excuse is that pep8 only gives us like 40 characters to work with. | 21:38 |
| dolphm | bknudson: you used that mixed style through that bp :P but you slipped up here! | 21:38 |
| *** ncoghlan_afk is now known as ncoghlan | 21:38 | |
| *** henrynash has quit IRC | 21:39 | |
| dstanek | dolphm: yes, i just fixed the glitch | 21:41 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Fix admin server doesn't report v2 support in Apache httpd https://review.openstack.org/118757 | 21:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add test for single app loaded version response https://review.openstack.org/118902 | 21:42 |
| *** jimbaker has quit IRC | 21:44 | |
| *** jimbaker has joined #openstack-keystone | 21:45 | |
| *** jimbaker has quit IRC | 21:45 | |
| *** jimbaker has joined #openstack-keystone | 21:45 | |
| *** diegows has joined #openstack-keystone | 21:45 | |
| dstanek | mfisch: ping | 21:47 |
| mfisch | dstanek: pong | 21:48 |
| *** ncoghlan is now known as ncoghlan_afk | 21:48 | |
| dstanek | mfisch: is that ldap debug logging bug still valid? | 21:49 |
| dstanek | https://bugs.launchpad.net/keystone/+bug/1274715 | 21:50 |
| uvirtbot | Launchpad bug 1274715 in keystone "LOG.debug not working in LDAP code" [Medium,Triaged] | 21:50 |
| mfisch | dstanek: I've been reading the follow-up on it but I've not had anytime to test it | 21:50 |
| *** andreaf has quit IRC | 21:51 | |
| mfisch | why the sudden interest? I'm about 6 months past needing it to work | 21:51 |
| dstanek | the issue you were having is that basically the log level was alway info and up regardless of the config setting? so the logs messages never appeared? | 21:51 |
| mfisch | dstanek: yes, it appeared that the LDAP code did not inherit the setting from the main config file | 21:52 |
| mfisch | dstanek: when I was debugging I ended up doing %s/info/warn/g and then reverting it later | 21:52 |
| dstanek | mfisch: mostly because it show up in my inbox today and it seems like someone is interested in fixing | 21:52 |
| dstanek | mfisch: OK thx | 21:52 |
| mfisch | I was using H when it happened I believe, possible its been fixed. It should be easy to repro | 21:52 |
| mfisch | assuming its not fixed | 21:52 |
| * mfisch notes to send bugs to dstanek's inbox for immediate processing | 21:53 | |
| dstanek | mfisch: if i get too many i'll have to add a filter :-) | 21:54 |
| *** rm_work has quit IRC | 21:54 | |
| mfisch | pretty sure I have an open PO for beer though | 21:54 |
| mfisch | anyway if it cannot repro I'm +1 to close | 21:55 |
| dstanek | haha | 21:55 |
| openstackgerrit | A change was merged to openstack/keystone: Adds region back into the catalog endpoint https://review.openstack.org/118667 | 21:59 |
| *** rm_work|away has joined #openstack-keystone | 22:01 | |
| *** rm_work|away is now known as rm_work | 22:01 | |
| *** rm_work has joined #openstack-keystone | 22:01 | |
| *** jaosorior has quit IRC | 22:02 | |
| *** topol has quit IRC | 22:02 | |
| *** henrynash has joined #openstack-keystone | 22:04 | |
| *** marcoemorais1 has quit IRC | 22:05 | |
| *** marcoemorais has joined #openstack-keystone | 22:06 | |
| mfisch | ok | 22:06 |
| *** saipandi has quit IRC | 22:06 | |
| *** nkinder has quit IRC | 22:10 | |
| *** openstack has joined #openstack-keystone | 22:10 | |
| openstackgerrit | Sarvesh Ranjan proposed a change to openstack/keystone: Fixed spelling mistakes in comments. https://review.openstack.org/118913 | 22:18 |
| *** packet has joined #openstack-keystone | 22:22 | |
| *** nkinder has joined #openstack-keystone | 22:26 | |
| *** ncoghlan_afk is now known as ncoghlan | 22:30 | |
| *** saranjan has quit IRC | 22:33 | |
| *** marcoemorais has quit IRC | 22:33 | |
| *** marcoemorais has joined #openstack-keystone | 22:34 | |
| *** amerine has quit IRC | 22:34 | |
| *** amerine_ has joined #openstack-keystone | 22:34 | |
| *** ncoghlan is now known as ncoghlan_afk | 22:40 | |
| *** bknudson has quit IRC | 22:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:44 | |
| *** yasukun has joined #openstack-keystone | 22:46 | |
| *** dims has quit IRC | 22:52 | |
| *** dims has joined #openstack-keystone | 22:52 | |
| *** nkinder has quit IRC | 22:53 | |
| *** dims has quit IRC | 22:57 | |
| *** diegows has quit IRC | 22:58 | |
| *** gyee has quit IRC | 22:59 | |
| *** david-lyle has quit IRC | 23:14 | |
| *** openstackstatus has quit IRC | 23:19 | |
| jamielennox | dolphm: did you have a look at that etherpad? i'm going back through logs but i can't find the link | 23:19 |
| *** openstackstatus has joined #openstack-keystone | 23:20 | |
| *** ChanServ sets mode: +v openstackstatus | 23:20 | |
| *** henrynash has quit IRC | 23:20 | |
| *** ncoghlan_ has joined #openstack-keystone | 23:25 | |
| *** ncoghlan_afk has quit IRC | 23:29 | |
| jamielennox | keystone friends - in the next week i need to pass about 10 patches to keystoneclient so that they will be available in the next release which i expect will happen around RC time | 23:35 |
| jamielennox | i'm willing to walk people through the logic, bribes and favours are available | 23:35 |
| jamielennox | i WIPed most things that aren't important or still need work | 23:36 |
| jamielennox | thanks for listening :) | 23:36 |
| ayoung | jamielennox, if you don't, do you still get married? | 23:37 |
| jamielennox | ayoung: something tells me that "getting things gated" is not a reasonable excuse | 23:38 |
| *** rkofman has joined #openstack-keystone | 23:39 | |
| ayoung | jamielennox, we'll work on them. I think the post J3 lull should be perfect for some quality Client time | 23:39 |
| jamielennox | i want to do the nova changes as early as possible in kilo so i don't want this stuff to slip a release | 23:40 |
| ayoung | ++ | 23:40 |
| ayoung | jamielennox, I need it, too | 23:40 |
| ayoung | all of the Kerberos work depends on the client being sane | 23:40 |
| jamielennox | ayoung: yea, figured it's easier then - need to start applying guilt now so that next week isn't the first people here about it | 23:40 |
| jamielennox | ayoung: did you see https://review.openstack.org/#/c/118531/ | 23:41 |
| *** jimhoagland has quit IRC | 23:45 | |
| *** gokrokve has quit IRC | 23:50 | |
| *** nkinder has joined #openstack-keystone | 23:51 | |
| *** hrybacki has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!