| *** oomichi has quit IRC | 00:00 | |
| *** amerine has quit IRC | 00:00 | |
| jamielennox | ayoung: can you take a look at https://review.openstack.org/#/c/117709/ | 00:00 |
|---|---|---|
| gyee | jamielennox, you have more for me? | 00:02 |
| jamielennox | gyee: https://review.openstack.org/#/c/118520/ again it had a +A and needed a rebase | 00:02 |
| jamielennox | it's currently got a transient -1 from jenkins but if i do a recheck it'll be 4 hours | 00:02 |
| *** david-lyle has quit IRC | 00:05 | |
| gyee | jamielennox, I don't understand the wisdom behind that one | 00:06 |
| jamielennox | gyee: sure | 00:06 |
| gyee | so we have two ways of getting user_id and project_id? | 00:06 |
| gyee | one from the plugin and the other from access_info? | 00:06 |
| *** gordc has quit IRC | 00:07 | |
| jamielennox | so access_info is mostly an implementation detail of Identity plugins | 00:07 |
| jamielennox | we shouldn't restrict this to only working with keystone auth | 00:07 |
| jamielennox | (thinking pure SSL certs and the like for auth) | 00:07 |
| *** jimhoagland has quit IRC | 00:07 | |
| gyee | k, you have me at SSL | 00:08 |
| jamielennox | there are certain commands like change my own password where you have to be able to retrieve the user id from the auth plugin to construct the URL | 00:08 |
| *** amerine has joined #openstack-keystone | 00:08 | |
| jamielennox | to me this is broken, you shouldn't need to specify your own information in the URL, however that's what we have now | 00:08 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds hint about filter placement to extension docs https://review.openstack.org/119834 | 00:09 |
| *** cjellick has quit IRC | 00:09 | |
| jamielennox | so i don't want to give people access to everything, but if there is a way to determine user_id from the auth plugin then i guess it's better to allow the plugin to expose it | 00:09 |
| gyee | I hear ya | 00:09 |
| *** gokrokve has quit IRC | 00:10 | |
| gyee | changing password is update_use right now | 00:10 |
| gyee | update_user | 00:10 |
| jamielennox | so i have this in a later review: https://review.openstack.org/#/c/97681/30/keystoneclient/httpclient.py | 00:10 |
| jamielennox | a user_id property that does its best to figure out the user_id and i've already seen this being replicated in other projects that need the user_id for whatever reason | 00:11 |
| ayoung | jamielennox, looking | 00:12 |
| jamielennox | same with project_id. i need it in to be exposed so that for those stupid apis that have /v1/{project_id}/ in the url i can construct it | 00:12 |
| jamielennox | gyee: anyway - i agree, i never wanted to expose that information at the base plugin level - i'm just not sure what else to do | 00:13 |
| ayoung | +A | 00:14 |
| jamielennox | ayoung: thanks, should mean i can rebase a few things now so they aren't all queued up | 00:15 |
| *** ncoghlan is now known as ncoghlan_afk | 00:16 | |
| jamielennox | now we pray and offer sacrifice to zuul so that this actually merges | 00:17 |
| *** gyee is now known as zuul | 00:18 | |
| zuul | jamielennox, what do you have for me? | 00:18 |
| jamielennox | zuul: you appear much easier to bribe now | 00:18 |
| *** zuul is now known as gyee | 00:18 | |
| jamielennox | s/bribe/offering obviously | 00:18 |
| gyee | :) | 00:19 |
| jamielennox | gyee: so if you aren't sure about that one put a -1 on it | 00:19 |
| jamielennox | i can work around that one until i have some more evidence | 00:20 |
| gyee | still thinking over it | 00:20 |
| jamielennox | for new code, i think this is exciting: https://review.openstack.org/#/c/107222/ | 00:21 |
| jamielennox | actually did that service_token stuff merge? i might have to rebase that | 00:22 |
| jamielennox | ayoung: https://review.openstack.org/#/c/119261/ | 00:23 |
| gyee | jamielennox, so the plugin can get that information from the token right? or are we envisioning a scenario where we don't operate on tokens? | 00:29 |
| jamielennox | gyee: the auth_token one? | 00:29 |
| gyee | even with SSL, we are still getting a token | 00:29 |
| gyee | yes | 00:29 |
| jamielennox | auth_token is keystone specific and should always be | 00:29 |
| *** ncoghlan_afk is now known as ncoghlan | 00:30 | |
| jamielennox | if you want to do something else there then i think you replace auth_token with something else | 00:30 |
| jamielennox | opening that up to non-keystone auth methods is just too hard | 00:30 |
| gyee | jamielennox, k, why do we need these then https://review.openstack.org/#/c/118520/3/keystoneclient/auth/base.py | 00:33 |
| gyee | we can just get those from access_info right? | 00:33 |
| jamielennox | gyee: sure, in the auth_token case we can do that or use the headers | 00:34 |
| gyee | get_token() | 00:34 |
| gyee | identity.base.BaseIdentityPlugin.get_token_ref() | 00:35 |
| jamielennox | what do you mean? | 00:36 |
| gyee | I mean I can get user_id and project_id from get_token_ref() | 00:37 |
| jamielennox | assuming you have get_token_ref | 00:37 |
| jamielennox | (i think it's get_auth_ref or get_access) | 00:37 |
| gyee | right | 00:37 |
| jamielennox | that's limited to identity plugins | 00:37 |
| gyee | can't we move get_token_ref to base? | 00:38 |
| gyee | since we assume we are working with keystone tokens | 00:38 |
| gyee | if they are designed to be generic then I would think we need more than just user_id and project_id | 00:39 |
| jamielennox | i possibly made it hard for myself by ever allowing an auth plugin that wasn't a keystone plugin | 00:39 |
| gyee | nah, its a noble thing | 00:40 |
| jamielennox | but given that we have the distinction i don't think so because you can only construct an AccessInfo from the keystone token data | 00:40 |
| gyee | not really, AccessInfo is just a dict, a plugin can populate it with their own auth context | 00:41 |
| gyee | its basically identity attributes | 00:42 |
| jamielennox | so take the TokenEndpoint plugin - which is essentially the only thing we have ATM which isn't an identity plugin | 00:42 |
| jamielennox | i don't know how i could construct an AccessInfo from that that would make sense | 00:43 |
| *** stevemar has joined #openstack-keystone | 00:43 | |
| jamielennox | so here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/shell.py#L347 | 00:44 |
| jamielennox | actually here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/shell.py#L362 | 00:44 |
| jamielennox | i don't know how to do this fallback to auth_user_id generically | 00:45 |
| *** Ephur has quit IRC | 00:46 | |
| *** russellb has quit IRC | 00:46 | |
| gyee | For TokenEndpoint, we may just need to make an extra call to validate the token to get the access info | 00:47 |
| jamielennox | what if it's an ADMIN_TOKEN | 00:47 |
| gyee | sound crazy, but it'll cleaner | 00:47 |
| gyee | then error out | 00:47 |
| gyee | no body uses ADMIN_TOKEN to list roles | 00:48 |
| jamielennox | actually i have that bug in bugzilla right now | 00:48 |
| gyee | ADMIN_TOKEN is for bootstrapping purposes only | 00:49 |
| jamielennox | because OS_ENDPOINT and OS_SERVICE_TOKEN take priority in the cli | 00:49 |
| gyee | it should not be (ab)use for anything else | 00:49 |
| *** russellb has joined #openstack-keystone | 00:49 | |
| jamielennox | so the admin guide says do all this stuff to create a user | 00:49 |
| *** Ephur has joined #openstack-keystone | 00:49 | |
| jamielennox | then source the new rc file | 00:49 |
| gyee | we need to change that | 00:49 |
| jamielennox | however that doesn't unset the old variables and it's a weird error that's returned | 00:49 |
| *** gokrokve has joined #openstack-keystone | 00:50 | |
| jamielennox | anyway, we can leave that one for now | 00:51 |
| jamielennox | i can implement it locally for what i need in keystoneclient and then we'll wait and see where else it's needed | 00:51 |
| gyee | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L7 | 00:52 |
| gyee | "This "token" does not represent a user" :) | 00:52 |
| gyee | so we should rightfully error out if that token is used to request any "user" data | 00:52 |
| gyee | k, man | 00:53 |
| gyee | gym time | 00:53 |
| jamielennox | gyee: ok - have fun, thanks | 00:53 |
| *** gyee has quit IRC | 00:55 | |
| *** hrybacki has joined #openstack-keystone | 01:06 | |
| jamielennox | morganfainberg: is experimental job better/worse that a non-voting check job? | 01:14 |
| morganfainberg | better | 01:14 |
| *** dims_ has joined #openstack-keystone | 01:14 | |
| morganfainberg | it doesn't consume resources unless you explicitly trigger it | 01:14 |
| jamielennox | ok - that's probably what we should do for all these server side python3 jobs | 01:15 |
| morganfainberg | ++ | 01:15 |
| morganfainberg | py34 now | 01:15 |
| jamielennox | ... if we make a new project with no data with python tox jobs - is that going to be an issue? or we just need to fix it on first run? | 01:16 |
| jamielennox | s/run/commit | 01:16 |
| jamielennox | maybe i should populate a repo first | 01:18 |
| morganfainberg | jamielennox, hm. | 01:18 |
| morganfainberg | jamielennox, i think it doesn't matter, first commit needs to have it though | 01:18 |
| *** ncoghlan is now known as ncoghlan_afk | 01:27 | |
| *** oomichi has joined #openstack-keystone | 01:35 | |
| ayoung | morganfainberg, you seem insistant that it is python34. What is the real difference? | 01:35 |
| ayoung | jamielennox, BTW, I got a response back from one of the apple devs over python-kerberos. | 01:35 |
| jamielennox | ayoung: you mentioned briefly but no details about what they said | 01:36 |
| ayoung | jamielennox, bascially he said "file tickets and also tell what are your blockers." | 01:36 |
| ayoung | http://trac.calendarserver.org/report/1?sort=component&asc=1&page=2 | 01:37 |
| ayoung | so...lets see if they do something about the patches carried by Fedora | 01:37 |
| ayoung | big thing is first they need a new release...considering the fork called their 1.1.5 I wonder what these guys will number it as... | 01:38 |
| jamielennox | probably doesn't matter | 01:39 |
| jamielennox | they haven't had a release in years - how active is it? | 01:39 |
| *** gokrokve_ has joined #openstack-keystone | 01:40 | |
| *** gokrokve has quit IRC | 01:41 | |
| jamielennox | i'm not a github fanbuy but it has certainly made things easier | 01:41 |
| morganfainberg | ayoung, py34 has minor changes iirc | 01:43 |
| morganfainberg | ayoung, but infra is stopping supporting py33 that is why it's important to be p34 | 01:43 |
| ayoung | morganfainberg, makes no real difference to me, so long as we have a reasonable chance of hitting something. | 01:45 |
| *** gokrokve has joined #openstack-keystone | 01:48 | |
| *** gokrokve_ has quit IRC | 01:48 | |
| *** gus has quit IRC | 01:49 | |
| *** gus has joined #openstack-keystone | 01:51 | |
| *** amcrn has quit IRC | 01:55 | |
| *** r-daneel has quit IRC | 02:02 | |
| jamielennox | ayoung: so i can see patches for python3 | 02:03 |
| jamielennox | http://trac.calendarserver.org/ticket/798 | 02:03 |
| jamielennox | though it's not commitd | 02:03 |
| *** fifieldt_ is now known as fifieldt | 02:03 | |
| *** marcoemorais has quit IRC | 02:20 | |
| *** ayoung has quit IRC | 02:24 | |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: ldap/core deleteTree not always supported https://review.openstack.org/74897 | 02:24 |
| *** harlowja is now known as harlowja_away | 02:25 | |
| *** diegows has quit IRC | 02:26 | |
| *** richm has quit IRC | 02:29 | |
| *** ncoghlan_afk is now known as ncoghlan | 02:35 | |
| *** hrybacki has quit IRC | 02:52 | |
| *** jimbaker has quit IRC | 02:58 | |
| *** KanagarajM has joined #openstack-keystone | 03:00 | |
| *** jimbaker has joined #openstack-keystone | 03:00 | |
| *** dims_ has quit IRC | 03:01 | |
| *** dims_ has joined #openstack-keystone | 03:01 | |
| *** wanghong has quit IRC | 03:05 | |
| *** dguitarbite has quit IRC | 03:12 | |
| *** dims_ has quit IRC | 03:14 | |
| *** dims_ has joined #openstack-keystone | 03:15 | |
| *** dims_ has quit IRC | 03:19 | |
| *** alex_xu has joined #openstack-keystone | 03:21 | |
| *** meker12 has quit IRC | 03:31 | |
| stevemar | man bknudson just made the most awesome change to devstcak | 03:34 |
| stevemar | having that extra screen for the access logs, freakin awesome | 03:34 |
| *** wwriverrat has joined #openstack-keystone | 03:39 | |
| Morgan_ | stevemar: hehe | 04:00 |
| stevemar | Morgan_, i was just about to type :O | 04:00 |
| stevemar | jamielennox, i'm a fan of that slide deck you shared about federation :) | 04:00 |
| jamielennox | stevemar: glad you liked it, it borrowed a lot from the one you guys did at atlanta | 04:01 |
| jamielennox | and showed of my skills as an artist :) | 04:01 |
| stevemar | jamielennox, saw some bits that looks familiar, but i've had to present it a bunch of times now, it all starts to blur | 04:02 |
| stevemar | i saw! i'm going to have to borrow the diagram you have with apache | 04:02 |
| stevemar | jamielennox, could you send it to me? I don't want to have to create a slideshare account just to download :( | 04:03 |
| jamielennox | it's been a while since i've had to do that sort of stuff, it's all online javascript and css stuff | 04:03 |
| jamielennox | slideshare makes you do that? | 04:04 |
| jamielennox | you want the pics or the pdf? | 04:04 |
| jamielennox | stevemar: https://fedorapeople.org/~jamielennox/federation.pdf is the pdf | 04:07 |
| jamielennox | stevemar: https://www.dropbox.com/sh/g3jz0v36p7ktd0m/AADd5m1whhHQIUJCOnLVa2F7a?dl=0 for all the bits | 04:09 |
| stevemar | jamielennox, pdf is good enough, thanks sir | 04:09 |
| stevemar | that works too | 04:10 |
| *** amerine_ has joined #openstack-keystone | 04:10 | |
| *** amerine has quit IRC | 04:11 | |
| jamielennox | stevemar: https://review.openstack.org/#/c/120104/1 gives me: | 04:12 |
| jamielennox | ImportError: Start directory is not importable: './python-keystoneclient/tests' | 04:12 |
| *** ncoghlan is now known as ncoghlan_afk | 04:13 | |
| stevemar | jamielennox, ahhh! right because it tries to find the name by doing: PACKAGENAME=$(python setup.py --name) | 04:14 |
| jamielennox | yep | 04:14 |
| jamielennox | just looking and i can't see anything in setup.py that will give just keystoneclient | 04:14 |
| stevemar | shoot | 04:15 |
| stevemar | works for keystone/keystonemiddleware/pycadf and ceilometer | 04:16 |
| stevemar | *grumble grumble* | 04:16 |
| jamielennox | still, funny that none of the clients have noticed this | 04:16 |
| jamielennox | a sed rule perhaps? | 04:16 |
| stevemar | mmmaybe | 04:17 |
| stevemar | i wonder if i can just hack it and chop off the 'python-' bits if that comes up | 04:19 |
| *** amerine_ has quit IRC | 04:19 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:20 | |
| *** amerine has joined #openstack-keystone | 04:20 | |
| *** jorge_munoz has joined #openstack-keystone | 04:23 | |
| jamielennox | stevemar: that or i guess accept an environment variable if provided to the script | 04:25 |
| stevemar | jamielennox, oh thats more elegant :) | 04:25 |
| jamielennox | stevemar: actually a --module-name would be better than an env | 04:27 |
| jamielennox | or --test-dir | 04:27 |
| stevemar | jamielennox, i'm blanking on how to make the -- thing happen, but i got it working with a positional argument | 04:38 |
| *** rushiagr_away is now known as rushiagr | 04:40 | |
| stevemar | jamielennox, if you are interested: https://review.openstack.org/120316 | 04:43 |
| stevemar | jamielennox, it would mean changing the proposed change to: commands = oslo_debug_helper.sh keystoneclient {posargs} | 04:44 |
| stevemar | bah, have to make it $2, not $1, thats for the tests! | 04:47 |
| *** ajayaa has joined #openstack-keystone | 04:51 | |
| *** vhoward has joined #openstack-keystone | 04:58 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:02 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/python-keystoneclient: Use oslo_debug_helper and remove our own version https://review.openstack.org/120104 | 05:04 |
| stevemar | jamielennox, welp, best i can think of at this hour: https://review.openstack.org/#/c/120316/ | 05:13 |
| *** wanghong has joined #openstack-keystone | 05:14 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:19 | |
| *** afazekas_ has joined #openstack-keystone | 05:27 | |
| *** dguitarbite has joined #openstack-keystone | 05:30 | |
| *** k4n0 has joined #openstack-keystone | 05:45 | |
| *** stevemar has quit IRC | 05:49 | |
| *** jimhoagland has joined #openstack-keystone | 05:55 | |
| *** jimhoagland has quit IRC | 06:01 | |
| openstackgerrit | Sasikanth Eda proposed a change to openstack/keystone: Fix user-role-add in LDAP backend https://review.openstack.org/119345 | 06:22 |
| *** jaosorior has joined #openstack-keystone | 06:25 | |
| *** gokrokve has quit IRC | 06:29 | |
| *** ajayaa has quit IRC | 06:30 | |
| *** ajayaa has joined #openstack-keystone | 06:39 | |
| *** rushiagr is now known as rushiagr_away | 06:48 | |
| *** rushiagr_away is now known as rushiagr | 06:49 | |
| *** jimhoagland has joined #openstack-keystone | 06:55 | |
| *** gokrokve has joined #openstack-keystone | 06:56 | |
| *** gokrokve has quit IRC | 06:59 | |
| *** gokrokve has joined #openstack-keystone | 07:00 | |
| *** jimhoagland has quit IRC | 07:00 | |
| *** gokrokve has quit IRC | 07:05 | |
| *** k4n0 has quit IRC | 07:07 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/python-keystoneclient: Removed keystoneclient.apiclient https://review.openstack.org/107926 | 07:19 |
| *** ukalifon1 has joined #openstack-keystone | 07:21 | |
| *** k4n0 has joined #openstack-keystone | 07:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 07:26 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 07:31 |
| *** wanghong has quit IRC | 07:32 | |
| *** henrynash has joined #openstack-keystone | 07:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 07:34 |
| *** jorge_munoz has quit IRC | 07:37 | |
| *** wanghong has joined #openstack-keystone | 07:44 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: correct docstring https://review.openstack.org/120333 | 07:49 |
| *** BAKfr has joined #openstack-keystone | 07:55 | |
| *** jimhoagland has joined #openstack-keystone | 07:55 | |
| *** bvandenh has joined #openstack-keystone | 07:57 | |
| *** jimhoagland has quit IRC | 08:00 | |
| *** gokrokve has joined #openstack-keystone | 08:00 | |
| *** gokrokve has quit IRC | 08:05 | |
| mflobo | Some good tutorial to enable LiveLDAP on devstack, please? | 08:05 |
| *** wanghong has quit IRC | 08:07 | |
| *** ncoghlan has quit IRC | 08:11 | |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Added config value for cache backend arguments https://review.openstack.org/120340 | 08:20 |
| openstackgerrit | Yuriy Taraday proposed a change to openstack/keystone: Add a pool of memcached clients https://review.openstack.org/119452 | 08:21 |
| bjornar | I keep seeing "mysql server has gone away" in master... | 08:24 |
| *** wanghong has joined #openstack-keystone | 08:25 | |
| *** bdossant has joined #openstack-keystone | 08:33 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Distinguish between name not provided and incorrect https://review.openstack.org/115903 | 08:44 |
| *** jimhoagland has joined #openstack-keystone | 08:55 | |
| *** jimhoagland has quit IRC | 09:00 | |
| *** gokrokve has joined #openstack-keystone | 09:00 | |
| *** gokrokve has quit IRC | 09:05 | |
| *** rushiagr is now known as rushiagr_away | 09:18 | |
| *** rushiagr_away is now known as rushiagr | 09:18 | |
| *** x-eye has quit IRC | 09:21 | |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Keystone part of a PoC for Horizon/Keystone WebSSO https://review.openstack.org/106096 | 09:26 |
| *** Xeye has joined #openstack-keystone | 09:27 | |
| *** aix has quit IRC | 09:47 | |
| *** alex_xu has quit IRC | 09:48 | |
| *** jimhoagland has joined #openstack-keystone | 09:55 | |
| *** jimhoagland has quit IRC | 10:00 | |
| *** gokrokve has joined #openstack-keystone | 10:00 | |
| *** gokrokve has quit IRC | 10:01 | |
| *** Bharat_Kobagana has joined #openstack-keystone | 10:02 | |
| *** gokrokve has joined #openstack-keystone | 10:02 | |
| *** gokrokve has quit IRC | 10:07 | |
| *** bvandenh has quit IRC | 10:07 | |
| *** Bharat_Kobagana is now known as bharat_kobagana | 10:10 | |
| *** amakarov has joined #openstack-keystone | 10:11 | |
| *** aix has joined #openstack-keystone | 10:21 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 10:23 |
| *** alex_xu has joined #openstack-keystone | 10:32 | |
| *** garnav has joined #openstack-keystone | 10:40 | |
| *** diegows has joined #openstack-keystone | 10:47 | |
| *** dims_ has joined #openstack-keystone | 10:57 | |
| *** bvandenh has joined #openstack-keystone | 10:58 | |
| *** miqui has quit IRC | 11:00 | |
| *** gokrokve has joined #openstack-keystone | 11:00 | |
| *** bharat_kobagana has left #openstack-keystone | 11:03 | |
| *** gokrokve has quit IRC | 11:05 | |
| *** dims_ has quit IRC | 11:21 | |
| *** dims_ has joined #openstack-keystone | 11:21 | |
| *** dims__ has joined #openstack-keystone | 11:22 | |
| *** topol has joined #openstack-keystone | 11:23 | |
| *** dims_ has quit IRC | 11:25 | |
| *** ekarlso- has quit IRC | 11:37 | |
| *** ekarlso- has joined #openstack-keystone | 11:37 | |
| *** KanagarajM has quit IRC | 11:46 | |
| *** jimhoagland has joined #openstack-keystone | 11:55 | |
| openstackgerrit | A change was merged to openstack/keystone: Fixed typo 'in sane manner' to 'in a sane manner' https://review.openstack.org/117902 | 11:59 |
| *** jimhoagland has quit IRC | 12:00 | |
| *** gokrokve has joined #openstack-keystone | 12:00 | |
| *** gokrokve has quit IRC | 12:05 | |
| *** samuelmz-zzz is now known as samuelmz | 12:11 | |
| samuelmz | Does 'identity' in test_v3_identity mean the identity api or does it mean the identity component, as for assignment? | 12:13 |
| *** hrybacki has joined #openstack-keystone | 12:27 | |
| openstackgerrit | Victor Sergeyev proposed a change to openstack/keystone: Remove of using session in migration 042 https://review.openstack.org/120146 | 12:27 |
| *** hrybacki has quit IRC | 12:31 | |
| *** dims__ has quit IRC | 12:34 | |
| *** dims_ has joined #openstack-keystone | 12:35 | |
| *** dims_ has quit IRC | 12:38 | |
| *** dims_ has joined #openstack-keystone | 12:38 | |
| *** radez_g0n3 is now known as radez | 12:43 | |
| *** gordc has joined #openstack-keystone | 12:45 | |
| *** hrybacki has joined #openstack-keystone | 12:47 | |
| *** KanagarajM has joined #openstack-keystone | 12:49 | |
| *** oomichi has quit IRC | 12:54 | |
| *** jimhoagland has joined #openstack-keystone | 12:55 | |
| *** gokrokve has joined #openstack-keystone | 13:00 | |
| *** jimhoagland has quit IRC | 13:00 | |
| *** afazekas_ has quit IRC | 13:01 | |
| *** aix has quit IRC | 13:02 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 13:03 |
| *** aix has joined #openstack-keystone | 13:04 | |
| *** gokrokve has quit IRC | 13:05 | |
| *** richm1 has joined #openstack-keystone | 13:07 | |
| *** joesavak has joined #openstack-keystone | 13:12 | |
| *** nkinder has quit IRC | 13:13 | |
| *** saipandi has joined #openstack-keystone | 13:16 | |
| *** afazekas_ has joined #openstack-keystone | 13:16 | |
| *** jimhoagland has joined #openstack-keystone | 13:19 | |
| *** jsavak has joined #openstack-keystone | 13:23 | |
| openstackgerrit | Peter Razumovsky proposed a change to openstack/keystone: Add a simple module to work with filters and DNs to LDAP backend https://review.openstack.org/117484 | 13:24 |
| *** joesavak has quit IRC | 13:25 | |
| *** ayoung has joined #openstack-keystone | 13:29 | |
| *** bknudson has joined #openstack-keystone | 13:34 | |
| *** bdossant has quit IRC | 13:37 | |
| *** hrybacki has quit IRC | 13:49 | |
| ekarlso- | so can anyone tell my why ksclient doesn't pickup cacerts installed systemwide ? | 13:57 |
| dolphm | samuelmz: it's intended to be identity-related API calls, like those on /v3/users | 13:59 |
| openstackgerrit | Marcos FermÃn Lobo proposed a change to openstack/keystone: Templated catalog backend not implemented https://review.openstack.org/120011 | 14:00 |
| dolphm | samuelmz: a bunch of authz tests ended up in there, which should be pulled out in test_v3_assignments but such a file does not exist :) | 14:00 |
| samuelmz | dolphm, yeah that's the point | 14:00 |
| *** gokrokve has joined #openstack-keystone | 14:00 | |
| samuelmz | dolphm, I'd be glad to make this refactoring | 14:00 |
| dolphm | samuelmz: awesome, please do! | 14:01 |
| samuelmz | dolphm, in addition, we have all grant/assignment tests there | 14:01 |
| samuelmz | dolphm, :-) | 14:01 |
| dolphm | samuelmz: ++ | 14:01 |
| *** gokrokve has quit IRC | 14:02 | |
| *** gokrokve has joined #openstack-keystone | 14:02 | |
| *** nkinder has joined #openstack-keystone | 14:03 | |
| *** gabriel-bezerra has quit IRC | 14:03 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** stevemar has joined #openstack-keystone | 14:05 | |
| *** afazekas_ has quit IRC | 14:08 | |
| *** jimhoagland has quit IRC | 14:16 | |
| samuelmz | dolphm, identity -> domains, projects, users, groups and roles | 14:23 |
| samuelmz | dolphm, assignment -> grants/role assignments | 14:24 |
| samuelmz | dolphm, right? | 14:24 |
| dolphm | samuelmz: users and groups are in identity, everything else there is in assignment | 14:24 |
| *** ajayaa has quit IRC | 14:24 | |
| samuelmz | dolphm, ok | 14:26 |
| *** rwsu has joined #openstack-keystone | 14:30 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: improve dependency injection doc strings https://review.openstack.org/120438 | 14:34 |
| samuelmz | dolphm, https://bugs.launchpad.net/keystone/+bug/1367778 | 14:38 |
| uvirtbot | Launchpad bug 1367778 in keystone "Extract Assignment related tests from IdentityTestCase" [Undecided,New] | 14:38 |
| *** dhellmann is now known as dhellmann_ | 14:39 | |
| *** dhellmann_ is now known as dhellmann | 14:40 | |
| *** rwsu has quit IRC | 14:48 | |
| *** david-lyle has joined #openstack-keystone | 14:51 | |
| ayoung | rm_work, you should not have LBaaS create a trust for a user. It is actually going to be impossible for you to do except under the most trivial of situations | 14:51 |
| ayoung | namely, only if the user requests something of the LBaaServer directly. But HEAT is going to be working off of Trust tokens, and a trust token cannot create a new trust | 14:52 |
| ayoung | samuelmz, domains are enumerated in the assignment backend, but identity subdivieds along domain lines. So each groups and user HAS-A domain assigned | 14:55 |
| ayoung | Roles are a global set of strings. Role assignements are a tuple of (<identity>, role, <target>) with identity being user or group, and target being domain or project | 14:56 |
| dolphm | ayoung: can you create a trust with yourself? | 14:57 |
| ayoung | so while a user maintained inside exactly one domain, it can also have roles in other domains, or in projects in other domains | 14:57 |
| ayoung | dolphm, I think so | 14:57 |
| ayoung | I have not tried it, but I have not prevented it, and I often think it would be super useful | 14:57 |
| ayoung | dolphm, let me try.... | 14:57 |
| *** wwriverrat has quit IRC | 14:57 | |
| dolphm | ayoung: and trusts are not mutable, correct? | 14:57 |
| ayoung | dolphm, correct | 14:58 |
| *** jimhoagland has joined #openstack-keystone | 14:58 | |
| ayoung | dolphm, have I showed you the javascript prototype yet? | 14:58 |
| dolphm | ayoung: no - i'm documenting https://bugs.launchpad.net/ossn/+bug/1331882 for the OSSN at the moment though | 14:58 |
| uvirtbot | Launchpad bug 1331882 in keystone "trustor_user_id not available in v2 trust token" [Wishlist,In progress] | 14:58 |
| ayoung | dolphm, OK, we should set aside some time for me to walk you through it. It leads to the whole CORS discussion we had earlier, and also a better approach for Horizon to Keystone integration. | 14:59 |
| ayoung | I'm planning on adding trusts to the prototype, but I have not done so yet | 14:59 |
| ayoung | but for now... | 14:59 |
| dolphm | ayoung: are trusts deletable through the API? | 15:00 |
| ayoung | yes | 15:00 |
| dolphm | ayoung: and do v2 trust tokens contain the trust ID? | 15:00 |
| ayoung | yes...I am pretty sure, let me confirm | 15:01 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/common.py#n87 dolphm yes it does | 15:01 |
| ayoung | dolphm, we missed the trustor_id, but the trustee_id and the trust_id are both in the token | 15:02 |
| *** jimhoagland has quit IRC | 15:07 | |
| morganfainberg | mornin | 15:09 |
| topol | Whats up | 15:11 |
| *** morganfainberg is now known as morgan | 15:12 | |
| *** jimhoagland has joined #openstack-keystone | 15:13 | |
| *** morgan is now known as Morgan | 15:13 | |
| *** annasort has quit IRC | 15:14 | |
| *** Morgan is now known as morgan | 15:15 | |
| *** aix has quit IRC | 15:17 | |
| *** cjellick has joined #openstack-keystone | 15:18 | |
| *** jorge_munoz has joined #openstack-keystone | 15:20 | |
| *** stevemar has quit IRC | 15:20 | |
| *** stevemar has joined #openstack-keystone | 15:21 | |
| *** jasondotstar has joined #openstack-keystone | 15:22 | |
| *** garnav has quit IRC | 15:25 | |
| samuelmz | ayoung, ok ... so identity handle user and project, and bind them to their owning domain | 15:26 |
| ayoung | yeah | 15:26 |
| samuelmz | ayoung, we can have multiple identity providers? multiple ldap, for instance? | 15:26 |
| ayoung | samuelmz, we can as of Juno | 15:26 |
| ayoung | samuelmz, http://adam.younglogic.com/2014/08/getting-service-users-out-of-ldap/ | 15:27 |
| samuelmz | ayoung, ok .. but can multiple providers take care of a single domain? | 15:27 |
| ayoung | samuelmz, nope | 15:27 |
| ayoung | samuelmz, but users from multiple domains, and thus from multiple providers, can all be assigned to roles in one domain | 15:28 |
| samuelmz | ayoung, ok .. thanks for the link .. | 15:28 |
| ayoung | samuelmz, for instance, say I set up a domain just for service users | 15:28 |
| samuelmz | ayoung, yeah makes sense | 15:28 |
| ayoung | and then I have two domains, one for your org, onme for mine, both served out of our respective LDAP servers | 15:29 |
| samuelmz | ayoung, domains for service users and domains for assignments | 15:29 |
| ayoung | we could both be administrators for the service domain | 15:29 |
| samuelmz | ayoung, something like this? | 15:29 |
| samuelmz | ayoung, cool | 15:29 |
| *** aix has joined #openstack-keystone | 15:30 | |
| *** gyee has joined #openstack-keystone | 15:32 | |
| samuelmz | ayoung, thanks for clarifying | 15:32 |
| ayoung | samuelmz, NP | 15:32 |
| *** k4n0 has quit IRC | 15:34 | |
| samuelmz | ayoung, is there a way to map ldap groups on keystone groups? | 15:37 |
| ayoung | samuelmz, nope | 15:37 |
| ayoung | samuelmz, LDAP groups ARE keystone groups | 15:37 |
| ayoung | no additional mapping allowed or required | 15:37 |
| ayoung | you can specify a separate query for how to fetch the groups if you really need to, but usually its the memberOf thing... | 15:38 |
| ayoung | well, that is for group assignments | 15:38 |
| samuelmz | ayoung, ok it makes sense | 15:41 |
| samuelmz | ayoung, the think we were talking about having multiple ldap identity backends ... | 15:42 |
| ayoung | samuelmz, and you can do that, too | 15:42 |
| ayoung | one per domain | 15:43 |
| samuelmz | ayoung, we had your org's domain, my org's domain and the service domain ... | 15:43 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Fix Policy backend driver documentation https://review.openstack.org/118443 | 15:43 |
| samuelmz | ayoung, so the service domain users should be = ur org users + my org users? | 15:43 |
| ayoung | samuelmz, so service stays in SQL, and then create to LDAP config files, one per backend | 15:43 |
| *** jsavak has quit IRC | 15:43 | |
| samuelmz | ayoung, my concern is about domain isolation | 15:43 |
| ayoung | "create two" | 15:43 |
| ayoung | samuelmz, each LDAP server gets its own domain. You create that first, but don't put any users in SQL | 15:44 |
| ayoung | just follow the same steps I laid out a second time | 15:44 |
| ayoung | samuelmz, each LDAP server will have its own domain, and the domain gets an UUID to identify it | 15:45 |
| ayoung | the users are generated an ID based on a sha256 of their ID attribute from LDAP and the domain_id | 15:45 |
| ayoung | it goes in a separate table in SQL. | 15:46 |
| samuelmz | ayoung, i got it .. but where will be placed the projects? | 15:46 |
| samuelmz | ayoung, in a third domain? | 15:46 |
| ayoung | samuelmz, those go in SQL | 15:46 |
| ayoung | if you want, or let each of the LDAP domains have their own set | 15:46 |
| *** wwriverrat has joined #openstack-keystone | 15:46 | |
| ayoung | you can assign users from domain A to roles in projects in domain B and vice versa | 15:46 |
| *** joesavak has joined #openstack-keystone | 15:47 | |
| samuelmz | ayoung, it's clear now .. :-) | 15:52 |
| ayoung | awesome. Glad I could help | 15:52 |
| *** stevelle_ has joined #openstack-keystone | 15:58 | |
| *** ukalifon1 has quit IRC | 15:59 | |
| *** gokrokve has quit IRC | 15:59 | |
| *** bvandenh has quit IRC | 16:09 | |
| *** rwsu has joined #openstack-keystone | 16:12 | |
| lbragstad | nonameentername: around? | 16:20 |
| *** BAKfr has quit IRC | 16:23 | |
| gyee | jamielennox, you still awak? | 16:23 |
| *** marcoemorais has joined #openstack-keystone | 16:25 | |
| *** jaosorior has quit IRC | 16:32 | |
| *** gokrokve has joined #openstack-keystone | 16:32 | |
| *** marcoemorais has quit IRC | 16:35 | |
| *** marcoemorais has joined #openstack-keystone | 16:36 | |
| *** marcoemorais has quit IRC | 16:36 | |
| *** marcoemorais has joined #openstack-keystone | 16:36 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: LDAP: refactor use of "1.1" OID https://review.openstack.org/120478 | 16:40 |
| *** zzzeek has joined #openstack-keystone | 16:42 | |
| dolphm | ayoung: nkinder: bknudson: ^ small refactor | 16:44 |
| dolphm | bknudson: you beat me to it | 16:44 |
| ayoung | dolphm, thanks.... | 16:44 |
| nkinder | dolphm: good idea | 16:44 |
| ayoung | dolphm, I'm pretty sure I just got a self trust to work...let me see if I can create a token with it. | 16:45 |
| nkinder | dolphm: but now I won't get to look up RFC references when people ask what 1.1 means... :( | 16:45 |
| dolphm | nkinder: my bad :P | 16:46 |
| *** wwriverrat has left #openstack-keystone | 16:46 | |
| rm_work | ayoung: "But HEAT is going to be working off of Trust tokens, and a trust token cannot create a new trust" Ok, that is quite interesting. I was wondering what use case would cause us to not have the right token. | 16:47 |
| ayoung | rm_work, yeah, I worked long and hard to keep you from being able to do what you are suggesting that you want to do. :) | 16:47 |
| rm_work | ayoung: heh | 16:48 |
| rm_work | well, possibly we'll have two different workflows, for HEAT vs. not | 16:48 |
| ayoung | rm_work, it would be a horrible security mechanism if that worked | 16:48 |
| rm_work | or we'll TRY to set up the trust, and if it fails (which is part of our syncronous API) then we'll tell the user to do it at that point | 16:48 |
| ayoung | yeah, the whole "I give you a whole token and you can do whatever you want with it" is broken | 16:48 |
| ayoung | and I aim to fix it | 16:49 |
| rm_work | ayoung: right, I actually was complaining about it (my use of the term "hijack" originally was a form of protest) but it really is a shitty workflow if the user has to do it manually | 16:49 |
| ayoung | but in order to do so, I need to lead this target by about, oh, three years | 16:49 |
| rm_work | 99% of our users are NOT using the API, but are using HEAT/similar | 16:49 |
| rm_work | and there isn't even a way to create a Trust in HEAT, as far as I know? | 16:49 |
| rm_work | or is there now | 16:49 |
| ayoung | rm_work, users should be creating their own trusts...start with that, and give me a workflow that makes sense. | 16:49 |
| ayoung | There better not be | 16:49 |
| rm_work | ayoung: i mean, is there even a way in HEAT for the *user* to create a trust? | 16:50 |
| *** amakarov has quit IRC | 16:50 | |
| rm_work | because again, our users are not API users. If we tell them "go create this Trust with the API using this JSON" they're going to go over and use AWS >_> | 16:50 |
| ayoung | rm_work, ask the heat team. | 16:50 |
| rm_work | forcing the user to make an API call to create a Trust is pretty much a no-go | 16:51 |
| rm_work | so we need to find an alternative solution | 16:51 |
| ekarlso- | jamielennox: u here still ? | 16:51 |
| ayoung | rm_work, they are not going to ues AWS because they can't host it on site, but that is a different issue | 16:51 |
| ekarlso- | guess he's zzz | 16:51 |
| ayoung | ekarlso-, he's in Australia, likely asleep | 16:51 |
| ekarlso- | :D | 16:51 |
| rm_work | ayoung: well, our *particular* users aren't concerned about that | 16:51 |
| rm_work | I know that a lot of Openstack users are private-cloud anyway, but I have to code for the users that pay my salary T_T | 16:52 |
| ekarlso- | guys, is there any chance we can get https://review.openstack.org/#/c/81147/ in for the next release ? | 16:52 |
| *** stevelle_ has quit IRC | 16:53 | |
| ayoung | rm_work, yeah, I hear you, but if the workflow includes "go to keystone and create this trust" that should be OK, so long as it is syncronos. THat is pretty much true across the board. I know that Horizon HEAT UI does Keystone stuff, not sure if it is direct or indirect | 16:53 |
| ayoung | so if you get a token up front, (not a trust token) then, yes, you will be able to create a trust | 16:54 |
| ayoung | If heat needs to do this for the end user, Heat will need to create the trust | 16:54 |
| ayoung | up front when the user registers for LBaaS | 16:54 |
| rm_work | ayoung: yeah... | 16:54 |
| *** marcoemorais has quit IRC | 16:54 | |
| ayoung | rm_work, as shardy, I'm sure he has an answer for you | 16:54 |
| *** marcoemorais has joined #openstack-keystone | 16:55 | |
| rm_work | ayoung: is there a way to retrieve a TrustID for a Trust that was created by someone else, if you know their user/tenant/project/whateverID? | 16:55 |
| rm_work | ayoung: like, if I created a Trust on my account with you as the Trustee, could you get the TrustID without me giving it to you? | 16:55 |
| rm_work | wondering mostly about discovery -- like, do we ACTUALLY need to store the trustID in our DB, or can we look it up at runtime? | 16:56 |
| *** aix has quit IRC | 16:58 | |
| *** harlowja_away is now known as harlowja | 16:58 | |
| samuelmz | ayoung, I saw your post 'Getting Service Users out of LDAP' | 17:01 |
| ayoung | rm_work, we keep those under close hold. They really are not secrets per-se, but we don;t allow enumeration of trusts by anyone other than the trustor. Its a policy decision, and could be varied on a deployment basis | 17:01 |
| samuelmz | ayoung, to have multiple LDAP backends, I need to create multiple keystone.<domainname>.conf files, right? | 17:01 |
| ayoung | samuelmz, that is correct | 17:02 |
| samuelmz | ayoung, and then create every <domainname> domain to have things synchronized, right? | 17:02 |
| rm_work | ayoung: ok, makes sense | 17:02 |
| ayoung | samuelmz, yes | 17:03 |
| rm_work | ayoung: so, I think 90% of our users will probably come in through Horizon -- is the same thing an issue there? | 17:03 |
| ayoung | rm_work, ask Heat | 17:03 |
| ayoung | but I think you are OK there | 17:03 |
| rm_work | ask Heat about Horizon? :P | 17:03 |
| ayoung | Horizon tokens are not trust tokens | 17:03 |
| rm_work | ok | 17:03 |
| ayoung | rm_work, yes, there is a Heat section to Horizon, | 17:03 |
| samuelmz | ayoung, that's amazing | 17:03 |
| ayoung | and I think you will have the same issues | 17:03 |
| ayoung | samuelmz, thank henrynash , as he's the one that made it happen | 17:03 |
| rm_work | ayoung: alright I'll ask around in heat/horizon channels, thanks | 17:04 |
| *** rkofman has quit IRC | 17:05 | |
| samuelmz | henrynash, great work on making multiple backends for domains :-) | 17:05 |
| samuelmz | henrynash, that's just amazing | 17:05 |
| samuelmz | ayoung, thanks again for clarifying :) | 17:05 |
| ayoung | ++ | 17:05 |
| *** rkofman has joined #openstack-keystone | 17:05 | |
| *** amcrn has joined #openstack-keystone | 17:05 | |
| openstackgerrit | A change was merged to openstack/keystone: Fixes formatting error in debug log statement https://review.openstack.org/118640 | 17:06 |
| openstackgerrit | A change was merged to openstack/keystone: Stop skipping LDAP tests https://review.openstack.org/119970 | 17:07 |
| *** ukalifon has joined #openstack-keystone | 17:08 | |
| samuelmz | henrynash, ping | 17:11 |
| ayoung | nkinder, in your IPA setups, do you do anything about the "enabled" field? | 17:12 |
| nkinder | ayoung: heh, I just fixed a but to allow that to work recently | 17:12 |
| ayoung | nkinder, is it a config option, or a patch? | 17:13 |
| nkinder | ayoung: https://review.openstack.org/#/c/104408/ | 17:13 |
| nkinder | config option | 17:13 |
| *** rushiagr is now known as rushiagr_away | 17:13 | |
| nkinder | the true/false logic needs to be reversed | 17:13 |
| ayoung | nkinder, without that, does the user_ref not have an "enabled" attribute? | 17:13 |
| ayoung | I'm getting | 17:13 |
| ayoung | if not trustor_user_ref['enabled']: | 17:13 |
| ayoung | [Wed Sep 10 17:11:19.989991 2014] [:error] [pid 13636] 13636 TRACE keystone.common.wsgi KeyError: 'enabled' | 17:13 |
| nkinder | ayoung: it can, but the logic will be wrong. The attribtue is nsAccountLock | 17:14 |
| nkinder | there is no 'enabled' attribute in LDAP | 17:14 |
| ayoung | right, so I need your patch...let me start with that | 17:14 |
| nkinder | ayoung: it can work without it, but you would use the emulated enabled approach | 17:14 |
| ayoung | nkinder, besides the patch, do I need to set a config option? | 17:15 |
| *** ukalifon has quit IRC | 17:15 | |
| ayoung | nkinder, so | 17:16 |
| ayoung | user_enable_invert=true | 17:16 |
| ayoung | user_enable_attribute=nsAccountLock | 17:16 |
| ayoung | er enableD | 17:17 |
| nkinder | yes, and there is a default value too... | 17:18 |
| ayoung | ah, now I am getting 403, better | 17:18 |
| nkinder | user_enabled_default? Let me look it up | 17:18 |
| ayoung | Trustor is disabled... | 17:18 |
| nkinder | ayoung: user_enabled_default needs to be set to the value as represented in ldap | 17:19 |
| nkinder | ayoung: so, a default of True with invert set means the user is diabled by default | 17:19 |
| nkinder | ayoung: I added docs on that in keystone.conf (around the new user_enabled_invert setting) | 17:20 |
| *** richm1 has quit IRC | 17:20 | |
| samuelmz | ayoung, If we want federation with multiple LDAP identity providers... we can have the same behavior with 'Multiple backends for domains', can't we? | 17:24 |
| ayoung | samuelmz, that is the idea, yes | 17:24 |
| samuelmz | ayoung, :DD | 17:24 |
| *** marcoemorais has quit IRC | 17:30 | |
| *** marcoemorais has joined #openstack-keystone | 17:31 | |
| *** marcoemorais has quit IRC | 17:32 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** richm1 has joined #openstack-keystone | 17:34 | |
| *** rushiagr_away is now known as rushiagr | 17:36 | |
| *** amirosh has joined #openstack-keystone | 17:38 | |
| nkinder | ayoung: so it the enabled stuff working for you? | 17:42 |
| ayoung | nkinder, nope | 17:42 |
| *** david-lyle has quit IRC | 17:42 | |
| ayoung | nkinder, I was a few weeks behind, so I just resynced, had to pip install oslo.utils.... | 17:42 |
| ayoung | just tests again, and it still fails | 17:43 |
| ayoung | nkinder, I have | 17:43 |
| ayoung | user_enabled_invert=false | 17:43 |
| ayoung | user_enabled_attribute=nsAccountLock | 17:43 |
| ayoung | #user_enabled_default=true | 17:43 |
| ayoung | right now... | 17:43 |
| ayoung | just commentd out the default | 17:43 |
| ayoung | still getting the key error | 17:43 |
| nkinder | ayoung: you need user_enabled_invert=true | 17:44 |
| nkinder | and user_enabled_default=false | 17:44 |
| ayoung | nkinder, but I shouldn't get a key error either way | 17:44 |
| nkinder | ayoung: so something else may have changed here that makes keystone not deal with the attribute not being present | 17:45 |
| ayoung | nkinder, with those values set, I get a 403 (Trustor is disabled) | 17:46 |
| nkinder | ayoung: when I wrote this, a missing lock attribute would result in user_enabled_default being used | 17:46 |
| nkinder | ayoung: does 'keystone user-list' show enabled/disabled for your users? | 17:46 |
| ayoung | nkinder, I wonder if I need to drop the attribute to get the default...let me try that, and I'll come back to the nsAccountLock value | 17:46 |
| ayoung | nkinder, I'm trying to create a token from a trust | 17:46 |
| nkinder | ayoung: I'd make sure the enabled stuff is just working in a basic case first | 17:47 |
| ayoung | yep | 17:47 |
| *** david-lyle has joined #openstack-keystone | 17:48 | |
| ayoung | nkinder, so user_enabled_default=True should work no matter what, right? | 17:50 |
| ayoung | even if I don't have #user_enabled_attribute=nsAccountLock set | 17:50 |
| nkinder | ayoung: that setting would mean that we shoudl think we got "nsAccountLock: true" from the LDAP server, even if it wasn't there. | 17:50 |
| nkinder | ayoung: which would mean the account is locked | 17:51 |
| *** rushiagr is now known as rushiagr_away | 17:51 | |
| nkinder | ayoung: it's meaning is inverted | 17:51 |
| ayoung | nkinder, but I should not get a key error. And I am not inverting | 17:51 |
| ayoung | nkinder, if All I set is that value, all users should be enabled | 17:51 |
| nkinder | ayoung: you need to be inverting, but you should not get a key error | 17:51 |
| nkinder | ayoung: ah, not necessarily | 17:52 |
| nkinder | ayoung: you have no user_enabled_attribute set | 17:52 |
| nkinder | ayoung: so it wants an "enabled" attribute, but doesn't find it | 17:52 |
| nkinder | ayoung: I wouldn't expect a key error | 17:52 |
| nkinder | I would expect it to think all accounts are enabled | 17:53 |
| ayoung | nkinder, the code that runs this is LDAP and trusts. I'm not certain how well tested a code path that is | 17:53 |
| nkinder | ayoung: this must have changed, and we need a unit test that covers no enabled attr being returned from LDAP | 17:53 |
| nkinder | ayoung: does this fail without trusts? | 17:53 |
| nkinder | please take trusts out of the picture first | 17:54 |
| ayoung | nkinder, the code is not exectued without a trust | 17:54 |
| ayoung | nkinder, I'll link so you see | 17:54 |
| *** jaosorior has joined #openstack-keystone | 17:54 | |
| nkinder | ayoung: I know what you're saying, but is enabled/disabled even working properly without trusts right now? | 17:54 |
| ayoung | I don't think so | 17:54 |
| ayoung | the user can get a token regardless of what I have in there | 17:55 |
| ayoung | nkinder, it is failing here https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L219 | 17:56 |
| ayoung | that ref is returned from the LDAP identity provider, and should do the ldap->model transform | 17:56 |
| ayoung | let me try enabled_emulation: | 17:57 |
| nkinder | ayoung: res_to_model should be filling that in | 17:57 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L222 | 17:57 |
| ayoung | nkinder, OK, with just user_enabled_emulation I should always get a user being enabled, no? | 18:03 |
| nkinder | ayoung: well, you need an enabled group set then, and the user needs to be a member to be enabled | 18:04 |
| ayoung | ah...that is right...not what I want | 18:05 |
| ayoung | nkinder, I suspect that using Kerberos is bypassing the authenticate call, which is where enabled is usually checke | 18:06 |
| ayoung | lemme see | 18:06 |
| richm1 | hey - is Morgan Fainberg around? I have a question about his proposal that I rebase my commit 74897 on top of Dolph's 120478 | 18:09 |
| richm1 | I followed https://wiki.openstack.org/wiki/Gerrit_Workflow#Add_dependency | 18:09 |
| richm1 | When I do git review, it asks me if I want to submit both commits | 18:10 |
| ayoung | richm1, morgan and Morgan_ are both aliasesto morganfainberg. Not sure why he is in cog neeto! | 18:10 |
| richm1 | http://paste.openstack.org/show/109683/ | 18:10 |
| ayoung | nkinder, OK, right now with no value set, I can get a token using userid/password against a FreeIPA based LDAP | 18:11 |
| richm1 | ^^^ - should I type yes here? If not, where did I go wrong? | 18:11 |
| ayoung | nkinder, now, let me try it with a fake user, so I don't lock myself out.... | 18:11 |
| dstanek | richm1: i think you want to 'git review -R'....i'm pretty sure that's the no-rebase flag and if set it won't change the exising review | 18:11 |
| *** amirosh has quit IRC | 18:11 | |
| ayoung | OK...now let me disable that user and lets see... | 18:12 |
| dstanek | richm1: git review --help will show you for sure | 18:12 |
| richm1 | dstanek: with git review -R I get the same thing | 18:12 |
| ayoung | nkinder, now I get a 401 | 18:12 |
| dstanek | richm1: it will show both patches, but shouldn't rebase | 18:13 |
| richm1 | dstanek: does that mean I should type "yes" to the prompt and submit both commits? | 18:15 |
| nkinder | richm1: you are making one patch depend on another? | 18:15 |
| richm1 | yes | 18:16 |
| nkinder | richm1: if so, type "yes" | 18:16 |
| dstanek | richm1: yes | 18:16 |
| openstackgerrit | Richard Megginson proposed a change to openstack/keystone: ldap/core deleteTree not always supported https://review.openstack.org/74897 | 18:16 |
| nkinder | richm1: it will do the right thing (though that message is scary the first time you do this) | 18:16 |
| morgan | richm1, hey | 18:22 |
| morgan | ayoung, I am incognito because i was snagging this as an IRC alias. | 18:22 |
| morgan | richm1, and typing "yes" was the right answer :) | 18:23 |
| *** morgan is now known as morganfainberg | 18:23 | |
| *** morganfainberg is now known as morgan | 18:24 | |
| ayoung | nkinder, hmmm I might have been executing a bogus trusts. I was doing a blanket list_trusts, with no param, which lists all trusts...let me try again with a scoped list, and see what I find | 18:24 |
| *** thiagop has joined #openstack-keystone | 18:26 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 18:27 |
| nkinder | morgan, dolphm: can you explain the --no-rebase option when submitting a review with a dependency? | 18:29 |
| dolphm | nkinder: sure... | 18:29 |
| morgan | nkinder, git review does some rebase magic | 18:29 |
| nkinder | I saw dolphm's comment in the review, and want to be sure I understand | 18:29 |
| morgan | nkinder, i use it when things are in gate already | 18:29 |
| dolphm | nkinder: when you do a normal git-review, it rebases onto master automatically before uploading | 18:30 |
| nkinder | dolphm: ah, so it would attempt to rebase your 1.1 patch too | 18:30 |
| dolphm | nkinder: the fear (and what morgan's referring to) is if a change has already spent time in the gate, and it's pulled back out by git-review uploading a trivially rebased patch, it has to start all over again in the gate | 18:31 |
| nkinder | dolphm: and that would start your review back over in the gate (with the rebase)? | 18:31 |
| dolphm | nkinder: yeah | 18:31 |
| dolphm | nkinder: ++ | 18:31 |
| nkinder | yeah, that's no good | 18:31 |
| *** Morgan_ is now known as morgan_remote | 18:31 | |
| nkinder | I always manually rebase off of master just before submitting a review for normal patches | 18:31 |
| nkinder | but it sounds like --no-rebase should almost always be used when depending on another patch | 18:31 |
| morgan | nkinder, well, it depends. | 18:32 |
| nkinder | I can see if I wanted to rebase one of my own other proposals at the same time | 18:32 |
| dolphm | nkinder: if it's someone else's patch, i'd recommend --no-rebase so as to not confuse people :) | 18:32 |
| nkinder | but rebasing someone else's seems bad | 18:32 |
| nkinder | yeah, ok. Thanks for the explanations! | 18:32 |
| *** jsavak has joined #openstack-keystone | 18:33 | |
| *** joesavak has quit IRC | 18:33 | |
| *** rushiagr_away is now known as rushiagr | 18:33 | |
| *** ChanServ sets mode: +o morgan | 18:36 | |
| *** vhoward has left #openstack-keystone | 18:38 | |
| morgan | YorikSar, ping re https://review.openstack.org/#/c/120340/ | 18:38 |
| morgan | YorikSar, we went back and forth on supporting a JSON string in the config, in short it was nixxed | 18:39 |
| morgan | YorikSar, i don't want to re-open that discussion this late in the cycle. I know you prefer the json, it is awful for deployers tbh to need to craft json strings to put in a config file. | 18:39 |
| morgan | YorikSar, it looks like you have a fixed number of arguments for the pool, lets just add one option per argument (url is handled) for the pool in [memcache] for the keystone server | 18:40 |
| morgan | it is *memcache* specific configuration. | 18:40 |
| YorikSar | morgan: Oh, it's not like I like JSON in config. I just don't know other extensible way to put these options there. | 18:41 |
| YorikSar | morgan: Sure, I understand. | 18:41 |
| YorikSar | morgan: And what about [cache]? | 18:41 |
| morgan | YorikSar, i meant like it compared to specific args in [memcache] | 18:41 |
| morgan | YorikSar, i'm ok with piggybackiing the same pool arguments | 18:41 |
| morgan | YorikSar, if you feel we *need* separate args for cache we can add them there too or only use the backend_argument multi-opt | 18:42 |
| YorikSar | morgan: I'll scrap this CR then and add all those args to these two sections in the pool CR, ok? | 18:42 |
| morgan | YorikSar, i meant like json compared to the alternative of individual opts :) | 18:42 |
| morgan | YorikSar, ++ works for me, feel free to use the same changeid | 18:42 |
| morgan | YorikSar, that way you don't need to change the commit msg of the other one :) | 18:42 |
| openstackgerrit | Michael Bayer proposed a change to openstack/keystone: Ensure a consistent transactional context is used https://review.openstack.org/120146 | 18:43 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Add RSS feed https://review.openstack.org/120522 | 18:43 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Remove templates from toctrees https://review.openstack.org/120523 | 18:43 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Use the current date for the copyright statement https://review.openstack.org/120524 | 18:43 |
| YorikSar | morgan: I actually understood that we've been passing strings where backend expected ints... So I'm not sure backend_argument really worked for pool. | 18:44 |
| morgan | YorikSar, ah. i'm ok with the options being in both sections | 18:44 |
| morgan | YorikSar they are specific to the different functions (kvs/memcache token and caching) | 18:44 |
| YorikSar | morgan: So I'll name them memcache_* in [cache] and w/o prefix in [memcache], ok? | 18:45 |
| morgan | YorikSar, ++ | 18:45 |
| YorikSar | morgan: Great. I'll do that first thing in the morning. (11pm here already) | 18:46 |
| morgan | YorikSar, works for me. tyvm | 18:46 |
| ayoung | Gahdamnint... "add the OSTRUST: to the token messes up angular.js" | 18:47 |
| *** bjornar_ has joined #openstack-keystone | 18:48 | |
| YorikSar | ayoung: So don't use that monster :) | 18:48 |
| ayoung | YorikSar, you have that so backwards | 18:48 |
| bjornar_ | I keep seeing these in master: http://pastie.org/pastes/9542821/text ... dont see it in icehouse | 18:48 |
| *** bknudson has quit IRC | 18:48 | |
| ayoung | its a good thing you are on another continent, or I would tackle you just to vent my frustration | 18:48 |
| * ayoung gonna kick the wavemaster instead | 18:49 | |
| * YorikSar enjoys Russian safety | 18:49 | |
| ayoung | YorikSar, isn't that an Oxymoron? | 18:50 |
| morgan | bjornar_, https://bugs.launchpad.net/oslo.db/+bug/1361378 | 18:50 |
| uvirtbot | Launchpad bug 1361378 in oslo.db ""MySQL server has gone away" again" [Undecided,Incomplete] | 18:50 |
| YorikSar | ayoung: Nah, especially in this context :) | 18:51 |
| *** gabriel-bezerra has joined #openstack-keystone | 18:51 | |
| nkinder | ayoung: how's the kerberos auth plug-in github seed coming along? | 18:52 |
| ayoung | nkinder, jamielennox submitted it, it was awaiting the admins to approve last I looked | 18:52 |
| ayoung | https://review.openstack.org/#/c/120261/ nkinder | 18:53 |
| morgan | dhellmann, +2 on the spec changes. | 18:53 |
| YorikSar | ayoung: btw, I hope you didn't think I called anyone but angular a monster in that message. | 18:53 |
| ayoung | YorikSar, I thought you called OSTRUSTS a monster | 18:53 |
| dhellmann | morgan: thanks | 18:54 |
| ayoung | Angular is not the problem, really | 18:54 |
| bjornar_ | morgan, Invalid!? | 18:54 |
| morgan | bjornar_, it's invalid in keystone, its an issue (if anything) in the oslo.db lib | 18:54 |
| morgan | bjornar_, as far as we can tell. | 18:54 |
| bjornar_ | sure.. but is the but "forwarded" to oslo? | 18:54 |
| YorikSar | ayoung: No-no. Angular is a real monster. It's like writing in Python in Java-style. | 18:54 |
| *** bknudson has joined #openstack-keystone | 18:55 | |
| morgan | bjornar_, it was added to the oslo team as "incomplete" (needs more info) | 18:55 |
| morgan | bjornar_, but yes it was. | 18:55 |
| bjornar_ | huh.. | 18:55 |
| *** ukalifon1 has joined #openstack-keystone | 18:55 | |
| bjornar_ | db errors like these are critical | 18:55 |
| morgan | bjornar_, if you look at the url up there that is under oslo.db, which handles all the connection logic | 18:55 |
| bjornar_ | sure | 18:55 |
| morgan | bjornar_, so if there is more info, please add it to the bug so we can get it fixed | 18:56 |
| bjornar_ | thats the info I have (pastebin) | 18:56 |
| morgan | bjornar_, even if it's something keystone is doing wrong we can reopen, but it *looks* like it's an oslo issue. see what is listed in the bug. | 18:56 |
| bjornar_ | And I know for a fact this is only happening on master, not icehouse branch | 18:56 |
| morgan | bjornar_, i definitely (as i'm sure the oslo team will) want to see this fixed | 18:56 |
| morgan | bjornar_, master uses oslo.db, iirc icehouse does not | 18:57 |
| morgan | bjornar_, indicating it's an oslo.db issue we need to fix there (likely) | 18:57 |
| bjornar_ | I dont see any oslo.db in the trace... | 18:58 |
| ayoung | nkinder, the trust thing seems to work OK for SQL, just not for LDAP. | 18:58 |
| ayoung | I'm trying to script it to show the problem... | 18:58 |
| ayoung | YorikSar, the problem is javascript. I get the token, and it correctly marshalls the JSON to an object, but then it gets to | 18:59 |
| nkinder | ayoung: ok, so jamielennox will need ot make the jobs non-voting as AJ suggested | 18:59 |
| ayoung | token.OSTRUST:trust which is not a valid identifier | 18:59 |
| ayoung | nkinder, yes | 18:59 |
| *** radez is now known as radez_g0n3 | 18:59 | |
| ayoung | YorikSar, I didn't choose angular, blame the Horizon folks | 19:00 |
| bjornar_ | morgan, should I not see oslo.db referenced in the trace? | 19:00 |
| YorikSar | ayoung: Well... Client can use token["OSTRUST:trust"] just as easy.. | 19:00 |
| morgan | bjornar_, i don't think you will | 19:00 |
| ayoung | Ah YorikSar that is it. I've been doing Python so long, I forget that ' != " | 19:00 |
| morgan | bjornar_, oslo.db is a bunch of helpers around sqla but i don't think it ends up in the trace | 19:01 |
| morgan | bjornar_, this might be needed https://github.com/openstack/oslo.db/blob/master/oslo/db/api.py#L62-L93 but typically the issue is really that you've lost connection with MySQL [legitimate error is 'mysql has gone away' in that case] | 19:01 |
| YorikSar | ayoung: Huh! In Keystone ' != " :) (I've got a really long conversation on this topic with morgan recently, it was like 3 mins) | 19:02 |
| *** rushiagr is now known as rushiagr_away | 19:02 | |
| ayoung | YorikSar, in Javascript ' and " are different | 19:02 |
| morgan | ayoung, hehe | 19:02 |
| ayoung | But the error was OSTRUSTS != OS-TRUST | 19:02 |
| morgan | YorikSar, yeah python is a bit less picky than json :P | 19:03 |
| morgan | for " vs ' | 19:03 |
| bjornar_ | morgan, lost connections should be no problem if you manage to reestablish.. | 19:05 |
| bjornar_ | a warning at most then | 19:05 |
| morgan | bjornar_, if you lose the connection middle of a transaction, you're getting that error afaict. | 19:05 |
| morgan | bjornar_, now, like i said might need the decorator. | 19:06 |
| bjornar_ | then its not handled right | 19:06 |
| morgan | bjornar_, can you confirm what is actually happening in this case when the error is raise? are you dropping from mysql? is the mysql server not responding anymore for some reason? is it purely python failing mid transaction? | 19:07 |
| morgan | bjornar_, i've not been able to duplicate it short of turning off mysql, so, more info helps. | 19:07 |
| morgan | if we need the decorator we can prioritize that as a bugfix. | 19:07 |
| morgan | and if mysql is turned off (in my case) yes it should tell me the server went away :) | 19:08 |
| bjornar_ | morgan, 140910 21:06:13 [Warning] Aborted connection 20571 to db: 'keystone' user: 'keystone' host: '172.16.0.19' (Unknown error) | 19:09 |
| ayoung | nkinder, OK, I think that Trusts are broken under LDAP and Keystone. I see no effect from setting any of the config variables...I don't need to set them for authenticate: disableing hte user seems to work fine, kereberos or userid/password | 19:09 |
| morgan | bjornar_, i need to go (have to get somewhere for an appointment) i'll be back alter on and can circle back. | 19:10 |
| morgan | bjornar_, if you want to add more information to that bug (or if it's something else, a new bug) please do. we should evaluate if anything is needed as an RC blocker on this front. | 19:11 |
| morgan | dolphm, ^ re mysql server has gone away. | 19:11 |
| morgan | dolphm, we might need to rule out / add this as an RC blocker. | 19:12 |
| morgan | bjornar_, in either case i'll circle back and take a closer look when i'm back online. | 19:12 |
| *** mgagne has quit IRC | 19:18 | |
| *** dtroyer has quit IRC | 19:19 | |
| *** mgagne has joined #openstack-keystone | 19:19 | |
| *** mgagne is now known as Guest75250 | 19:19 | |
| bjornar_ | morgan, ok. Hope you take this serious | 19:20 |
| *** dtroyer has joined #openstack-keystone | 19:21 | |
| *** KanagarajM has quit IRC | 19:23 | |
| samuelmz | ayoung, ping | 19:23 |
| ayoung | samuelmz, I'm here...Better to just ask your question and send a Ping message. | 19:24 |
| samuelmz | ayoung, still about your post about multiple backends for domains .. | 19:24 |
| ayoung | Uh oh | 19:24 |
| ayoung | now you are getting smart, and you are going to show me how something is broken, aren't you? | 19:24 |
| samuelmz | ayoung, in that case you have a ldap structure like this (http://paste.openstack.org/show/109718/) | 19:25 |
| samuelmz | ayoung, haha no :-) | 19:25 |
| samuelmz | ayoung, you have that structure, right? | 19:25 |
| ayoung | yeah, that is roughly it | 19:25 |
| *** ukalifon1 has quit IRC | 19:25 | |
| samuelmz | ayoung, what about if I had this (http://paste.openstack.org/show/109719/) | 19:25 |
| bknudson | that dit makes no sense. why would you put users under groups? | 19:26 |
| bknudson | can't you have the same user in 2 groups? | 19:26 |
| ayoung | samuelmz, depends. Is IPB , IPC...something you expect to have created dynamically | 19:26 |
| ayoung | bknudson, I think he's just asking about multiple trees | 19:26 |
| bknudson | oh, you can have multiple trees. | 19:26 |
| samuelmz | ayoung, yes multiple trees | 19:26 |
| ayoung | samuelmz, there are two ways | 19:27 |
| ayoung | probably what you want is to search by object class in subtrees | 19:27 |
| bknudson | just point your ldap configs at different subtrees. | 19:27 |
| samuelmz | I have to tell him to get groups from org.freeipa.cloudlab.ipa and org.freeipa.cloudlab.ipb | 19:27 |
| ayoung | and I think you need to change from | 19:27 |
| bknudson | you could use referrals for that. | 19:27 |
| bknudson | (I think... haven't tried it) | 19:27 |
| ayoung | query_scope=one to query_scope=sub | 19:28 |
| samuelmz | How it'd be in the config/keystone? A domain for each tree? | 19:28 |
| bknudson | it would have to be a domain for each tree | 19:28 |
| ayoung | samuelmz, it really depends on what you are trying to do. If you just have a deeply nested tree, then you change the query scope to do subtree queries, and I suspect that is what you want | 19:29 |
| ayoung | if, On the other hand, you have two organizations, and their trees are radiacally diffferent, you could treat them as two different LDAP server and put them in two domains | 19:29 |
| ayoung | samuelmz, you are at a University, right? So you have people in undergrad, gradschool, faculty etc? | 19:30 |
| samuelmz | ayoung, yes | 19:30 |
| ayoung | samuelmz, OK, so you want to try setting | 19:31 |
| ayoung | user_query_scope=sub and group_query_scope=sub | 19:31 |
| ayoung | wait no | 19:32 |
| ayoung | its just query_scope=sub | 19:32 |
| ayoung | that is not one that is per entity...sorry | 19:32 |
| bknudson | that sounds like a bug | 19:32 |
| ayoung | bknudson, that it is not per entity? | 19:33 |
| bknudson | ayoung: yes. should be per entity | 19:33 |
| ayoung | bknudson, maybe | 19:33 |
| ayoung | bknudson, sub could easily be the default, with one as a tuning thing. | 19:34 |
| samuelmz | in ldap how do we associate users to groups? | 19:34 |
| ayoung | samuelmz, usually it is via "memberOf" | 19:34 |
| bknudson | group has a member attribute | 19:34 |
| samuelmz | cool .. so we have a list | 19:34 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n695 | 19:35 |
| samuelmz | ayoung, in our case we have a list of members in the group, is it/ | 19:35 |
| bknudson | that's standard ldap stuff... nothing keystone specific | 19:35 |
| *** saipandi has quit IRC | 19:41 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Extracting common code to private method https://review.openstack.org/120563 | 19:42 |
| dolphm | bjornar_: are you referring to this bug? https://bugs.launchpad.net/keystone/+bug/1361378 | 19:43 |
| uvirtbot | Launchpad bug 1361378 in oslo.db ""MySQL server has gone away" again" [Undecided,Incomplete] | 19:43 |
| samuelmz | ayoung, look at this http://paste.openstack.org/show/109728/ | 19:43 |
| samuelmz | ayoung, I'd like to map ug_students, master and doctor to groups | 19:43 |
| ayoung | samuelmz, yeah, sub is going to be required for that | 19:43 |
| ayoung | samuelmz, ugh | 19:43 |
| ayoung | samuelmz, they are not already groups? | 19:44 |
| ayoung | samuelmz, that you might want to do as three different domains. | 19:44 |
| samuelmz | ayoung, import as keystone ones | 19:44 |
| samuelmz | ayoung, I meant | 19:44 |
| samuelmz | ayoung, make keystone use them ... sorry I dont know the better way to say it, but i got it | 19:45 |
| samuelmz | ayoung, :-) | 19:45 |
| ayoung | samuelmz, that is probably not a good LDAP setup, BTW. What happens when someone finishes a masters degree and goes on for the Doctorate? You end up having to change their DN | 19:45 |
| samuelmz | ayoung, I know and imagine you have the worst ldap setup you can imagine | 19:46 |
| samuelmz | ayoung, and your enterprise dont want you to change the ldap | 19:46 |
| ayoung | samuelmz I'd try it as 3 domains, then. One for each of those major groups | 19:46 |
| ayoung | I imagine that could get nasty if there are also actual groups there, too | 19:47 |
| samuelmz | ayoung, ok we have different approaches | 19:47 |
| ayoung | and a group could contain undergrad, master and doctor... | 19:47 |
| ayoung | I don't think there is a solution. | 19:47 |
| ayoung | You can't magically create a Keystone group out of a container | 19:47 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Use the current date for the copyright statement https://review.openstack.org/120524 | 19:48 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Remove templates from toctrees https://review.openstack.org/120523 | 19:48 |
| samuelmz | ayoung, and if we could do something like this in the config ? http://paste.openstack.org/show/109730/ | 19:49 |
| bjornar_ | dolphm, looks similar, yes | 19:51 |
| dolphm | bjornar_: to what? | 19:51 |
| samuelmz | ayoung, hmm.. I got the query_scope thing | 19:54 |
| samuelmz | ayoung, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/config.py#n491 | 19:54 |
| bjornar_ | dolphm, ......to that bug.... | 19:54 |
| samuelmz | ayoung, thanks :-) | 19:55 |
| samuelmz | ayoung, and I'll be back if I get smarter | 19:55 |
| lbragstad | dolphm: ping, figured out why the tests are failing for the user role assignment stuff | 19:57 |
| dolphm | lbragstad: o/ what's the bad news | 19:57 |
| lbragstad | turns out that call is dependent on the user being in the backend, even for V3 | 19:57 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/password.py#L107-L109 | 19:57 |
| lbragstad | ^ that guy | 19:57 |
| dolphm | lbragstad: that shouldn't be LOG.exception() either... but i digress | 19:58 |
| lbragstad | dolphm: it's kinda misleading | 19:58 |
| dolphm | lbragstad: which user has to be in the backend? just the calling user? | 19:58 |
| lbragstad | the user your assigning the role to | 19:58 |
| *** david-lyle has quit IRC | 19:58 | |
| lbragstad | it's confusing because for UserNotFound, we get Unauthorized, but I'd agree that's a different matter | 19:59 |
| *** hrybacki has joined #openstack-keystone | 20:03 | |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Use the current date for the copyright statement https://review.openstack.org/120524 | 20:03 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Remove templates from toctrees https://review.openstack.org/120523 | 20:03 |
| openstackgerrit | Doug Hellmann proposed a change to openstack/keystone-specs: Add RSS feed https://review.openstack.org/120522 | 20:03 |
| openstackgerrit | Henrique Truta proposed a change to openstack/python-keystoneclient: Implementing inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 20:08 |
| openstackgerrit | Henrique Truta proposed a change to openstack/python-keystoneclient: Creating parameter to list inherited role assignments https://review.openstack.org/117300 | 20:10 |
| *** david-lyle has joined #openstack-keystone | 20:11 | |
| bjornar_ | dolphm, I did not see these errors before moving to master | 20:12 |
| dolphm | bjornar_: have you filed a bug report? i have no context for what you and morgan were discussing | 20:13 |
| bjornar_ | oh, I filed to pastie: https://bugs.launchpad.net/oslo.db/+bug/1361378 | 20:14 |
| bjornar_ | ;) | 20:14 |
| uvirtbot | Launchpad bug 1361378 in oslo.db ""MySQL server has gone away" again" [Undecided,Incomplete] | 20:14 |
| bjornar_ | sorry: http://pastie.org/pastes/9542821/text | 20:15 |
| *** marcoemorais has quit IRC | 20:25 | |
| *** saipandi has joined #openstack-keystone | 20:25 | |
| *** marcoemorais has joined #openstack-keystone | 20:26 | |
| *** marcoemorais has quit IRC | 20:27 | |
| *** marcoemorais has joined #openstack-keystone | 20:28 | |
| *** marcoemorais has quit IRC | 20:30 | |
| *** marcoemorais has joined #openstack-keystone | 20:30 | |
| *** topol has quit IRC | 20:32 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 20:33 |
| *** amcrn has quit IRC | 20:35 | |
| *** hockeynut_ has quit IRC | 20:40 | |
| *** rm_work has quit IRC | 20:40 | |
| *** rm_work has joined #openstack-keystone | 20:41 | |
| *** hockeynut has joined #openstack-keystone | 20:42 | |
| nkinder | jamielennox: I made the jobs non-voting for the kerberos plugin repo request - https://review.openstack.org/#/c/120261 | 20:42 |
| nkinder | jamielennox: ...at least I think I did. :) It seemed safe to leave the merge check and pypi templates in there. | 20:43 |
| ayoung | nkinder, I have user_enabled_attribute=nsAccountLock and I traced as far as the LDAP query requesting that. ldap has | 20:47 |
| ayoung | nsaccountlock: FALSE | 20:47 |
| ayoung | but the attribute did not come back from the query | 20:48 |
| ayoung | LDAP search: base=cn=users,cn=accounts,dc=younglogic,dc=net scope=1 filterstr=(&(uid=ayoung)(objectClass=inetOrgPerson)) attrs=['mail', 'userPassword', 'uid', 'nsAccountLock'] attrsonly=0 search_s /opt/stack/keystone/keystone/common/ldap/core.py:918 | 20:49 |
| ayoung | but the line | 20:50 |
| nkinder | ayoung: it has to be asked for, as it's an operational attribute IIRC | 20:50 |
| nkinder | yet that shows it's being asked for | 20:50 |
| ayoung | yep | 20:50 |
| ayoung | but not returned from | 20:50 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L908 | 20:51 |
| ayoung | nkinder, just to confirm, you had this working with IPA, right? | 20:51 |
| nkinder | ayoung: yes | 20:51 |
| ayoung | OK...I'm going to keep digging | 20:51 |
| nkinder | ayoung: so are you saying it is returned via ldapsearch? | 20:51 |
| nkinder | ayoung: because it will not always be present in an entry | 20:51 |
| ayoung | nkinder, well, I did ipa user-show --all --raw | 20:51 |
| ayoung | and it was there | 20:52 |
| * ayoung got a little lazy | 20:52 | |
| nkinder | ayoung: I'd use ldapsearch directly | 20:52 |
| nkinder | ayoung: IIRC, if you create a new user the nsAccountLock attr won't exist | 20:52 |
| nkinder | if you lock the user, it gets added with a value of True | 20:52 |
| nkinder | if you then unlock the user, the value is replaced with False (and the attr exists) | 20:52 |
| nkinder | ayoung: moral of the story = the attribute will not always be present | 20:53 |
| ayoung | nkinder, I wonder if IPA fakes it, too | 20:53 |
| ayoung | nkinder, so I don't get it if I do | 20:53 |
| ayoung | ldapsearch -Y gssapi "(uid=ayoung)" | grep -i lock | 20:53 |
| nkinder | ayoung: it's operational, so ask for it | 20:54 |
| nkinder | ayoung: I don't have an IPA install handy on my laptop ATM | 20:54 |
| ayoung | nkinder, I have one, public, and in the cloud...and you already have an accout...but I want to keep hunting this.... | 20:54 |
| *** joesavak has joined #openstack-keystone | 20:54 | |
| ayoung | yeah, nothing comes back.... | 20:56 |
| ayoung | ldapsearch -Y gssapi "(uid=ayoung)" uid nsAccountLock | 20:56 |
| ayoung | # requesting: uid nsAccountLock | 20:56 |
| ayoung | # | 20:56 |
| ayoung | # ayoung, users, compat, younglogic.net | 20:56 |
| ayoung | dn: uid=ayoung,cn=users,cn=compat,dc=younglogic,dc=net | 20:56 |
| ayoung | uid: ayoung | 20:56 |
| ayoung | nkinder, OK, let see for the one I locked | 20:57 |
| nkinder | ayoung: ok, now lock your user using the IPA tools | 20:57 |
| nkinder | then search, then unlock, then search again | 20:57 |
| ayoung | yep | 20:57 |
| ayoung | # jafo, users, accounts, younglogic.net | 20:57 |
| ayoung | dn: uid=jafo,cn=users,cn=accounts,dc=younglogic,dc=net | 20:57 |
| ayoung | uid: jafo | 20:57 |
| ayoung | nsAccountLock: FALSE | 20:57 |
| *** jsavak has quit IRC | 20:57 | |
| nkinder | ayoung: that's the unlocked user? | 20:57 |
| ayoung | nkinder, yes...locked and then unlocked | 20:57 |
| nkinder | ayoung: correction... the user formerly known as the locked user :) | 20:57 |
| nkinder | ayoung: yeah, so that fits with what I remember. With my patch (and the proper config), 'keystone user-list' was showing enabled for users who were never locked | 20:58 |
| ayoung | OK, so this makes sense | 20:59 |
| nkinder | ayoung: basically, I think res_to_model needs to set the enabled value based off of the default when we don't find the enabled attribute in the LDAP resource | 21:00 |
| nkinder | ayoung: so the 'enabled' key should always be present in the model | 21:00 |
| ayoung | nkinder, yes, but it doesn't seem to do that now | 21:03 |
| nkinder | ayoung: ok, it really should do that IMHO | 21:03 |
| *** marcoemorais has quit IRC | 21:04 | |
| nkinder | ayoung: but strange that it was working for me with 'keystone user-list' | 21:04 |
| *** marcoemorais has joined #openstack-keystone | 21:04 | |
| *** marcoemorais has quit IRC | 21:05 | |
| *** marcoemorais has joined #openstack-keystone | 21:06 | |
| ayoung | nkinder, we should be checking the enabled value later on | 21:06 |
| *** marcoemorais has quit IRC | 21:07 | |
| *** marcoemorais has joined #openstack-keystone | 21:08 | |
| ayoung | nkinder, so we check it in the password plugin: | 21:09 |
| ayoung | and in the token controller, but not in external | 21:09 |
| ayoung | http://paste.openstack.org/show/109766/ nkinder | 21:09 |
| ayoung | and that call is | 21:09 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py#n565 | 21:10 |
| ayoung | if not user.get('enabled', True): | 21:10 |
| ayoung | so we default it in core.py but then it fails in the token provider because that goes directly against the user_driver | 21:11 |
| ayoung | I think I can just make a change in the provider: | 21:11 |
| ayoung | let me test that | 21:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 21:14 |
| *** jimhoagland has quit IRC | 21:15 | |
| nkinder | ayoung: ok, that is a less invasive change | 21:15 |
| ayoung | nkinder, OK, that worked | 21:16 |
| ayoung | but not with your config values set | 21:16 |
| ayoung | let me confirm what I had | 21:16 |
| ayoung | #user_enabled_invert=True | 21:16 |
| ayoung | #user_enabled_attribute=nsAccountLock | 21:16 |
| ayoung | #user_enabled_default=True | 21:16 |
| ayoung | I think that last option was reversed | 21:17 |
| ayoung | let me try it with false | 21:17 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add a functional tests for role assignments https://review.openstack.org/119843 | 21:17 |
| nkinder | all commented out though? | 21:17 |
| lbragstad | dolphm: I have the test fixed up that exposes the bug, we can iterate in the bug report how to best go about fixing? ^ | 21:17 |
| ayoung | nkinder, nope, user is disabled... | 21:18 |
| ayoung | hmm | 21:18 |
| ayoung | nkinder, it should be | 21:18 |
| ayoung | user_enabled_invert=True | 21:18 |
| ayoung | user_enabled_attribute=nsAccountLock | 21:18 |
| ayoung | user_enabled_default=False | 21:18 |
| ayoung | right? | 21:18 |
| nkinder | yes | 21:18 |
| nkinder | ayoung: does that work for password auth? | 21:18 |
| ayoung | let me see if password...heh | 21:19 |
| nkinder | and does user-list show the right thing? | 21:19 |
| ayoung | I was able to get a token using password | 21:19 |
| nkinder | ayoung: now lock a user using the ipa CLI | 21:19 |
| ayoung | Ah...no I didn;t | 21:19 |
| ayoung | 401 | 21:19 |
| ayoung | (me defaulted UI to Kerberos) | 21:20 |
| ayoung | nkinder...ok, one sec | 21:20 |
| ayoung | jafo failed too | 21:20 |
| ayoung | let me try locking his account | 21:20 |
| ayoung | doesn't seem to make a difference | 21:21 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds pipeline hints to the example paste config https://review.openstack.org/119827 | 21:22 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Make the extension docs a top level entry in the landing page https://review.openstack.org/119159 | 21:22 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adds hint about filter placement to extension docs https://review.openstack.org/119834 | 21:22 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Document Keystone2Keystone federation https://review.openstack.org/120584 | 21:22 |
| ayoung | BAH | 21:22 |
| nkinder | ayoung: is that a good BAH (as in there was some stupid problem), or a BAH of frustration? | 21:23 |
| ayoung | it was due to me not setting the user domain correctly and riunning a bunch of crap tests | 21:24 |
| ayoung | ok...when I set it correctly | 21:24 |
| ayoung | jafo gets a 401 with the config options set | 21:24 |
| ayoung | now removing them.... | 21:25 |
| ayoung | and he still gets a 401 | 21:25 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Document Keystone2Keystone federation https://review.openstack.org/120584 | 21:26 |
| ayoung | kinit: Clients credentials have been revoked while getting initial credentials | 21:26 |
| ayoung | ok, guessing his account is locked... | 21:26 |
| ayoung | now he's unlocked...tested with Kerberos...got a token. tested with password got a token..., | 21:28 |
| ayoung | and that is without the config options set | 21:28 |
| ayoung | not let me set them and see... | 21:29 |
| ayoung | 401 | 21:29 |
| ayoung | nkinder, if all I set is nsAccountLock, it works... | 21:30 |
| ayoung | which is really strange | 21:30 |
| *** bjornar_ has quit IRC | 21:31 | |
| *** hrybacki has quit IRC | 21:38 | |
| *** henrynash has quit IRC | 21:40 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add V3 JSON Home support to GET / https://review.openstack.org/118240 | 21:52 |
| *** amcrn has joined #openstack-keystone | 21:53 | |
| ayoung | nkinder, I richm1 I approved your subtree patch. Keep an eye on it, and if it fails gate, let me know. | 21:54 |
| dolphm | bknudson: is the only change here? https://review.openstack.org/#/c/118240/6/keystone/controllers.py (plus dropping the name kwarg) | 21:54 |
| bknudson | dolphm: y, it should just be the comment and name= removal | 21:55 |
| bknudson | and I rebased it ... no conflicts | 21:55 |
| dolphm | bknudson: +2 | 21:56 |
| morgan | dolphm, this is related to the mysql server has gone away thing | 21:58 |
| morgan | dolphm, the discussion with bjornar | 21:58 |
| openstackgerrit | ayoung proposed a change to openstack/keystone: Safer check for enabled in trusts https://review.openstack.org/120592 | 21:58 |
| dolphm | morgan: https://bugs.launchpad.net/keystone/+bug/1361378 ? | 21:58 |
| uvirtbot | Launchpad bug 1361378 in oslo.db ""MySQL server has gone away" again" [Undecided,Incomplete] | 21:59 |
| morgan | that was the one | 21:59 |
| morgan | it *may* actually be relevant, we get that error if we're losing connection mid-transaction | 21:59 |
| morgan | it looks like | 21:59 |
| dolphm | morgan: did you see comment #2? | 21:59 |
| morgan | there are ways to auto retry | 21:59 |
| morgan | right | 21:59 |
| morgan | but this was also in bjornar's environment not in gate | 22:00 |
| morgan | afaik | 22:00 |
| *** saipandi has quit IRC | 22:00 | |
| ayoung | dolphm, well, it took me all day, and I had to do another bug fix, but I confirmed that a user can, infact, execute a "self" trust and get a token | 22:00 |
| morgan | so not *that* bug but a similarly related one, where midtransaction causes the query to fail vs. retry (there is that decorator?) *shrug* i'm not sure. | 22:01 |
| dolphm | ayoung: thanks for checking... it seems like a useless edge case we should prevent? | 22:01 |
| ayoung | dolphm, nope | 22:01 |
| ayoung | dolphm, I see it as the right path forward | 22:01 |
| morgan | dolphm, was willing to look at little closer before dismissing for RC, but not willing to give it an absolute RC blocker status | 22:01 |
| ayoung | dolphm, specifically, it is the only way I can create a token with a subset of my roles | 22:02 |
| ayoung | there is no risk | 22:02 |
| dolphm | morgan: add it to juno-rc-potential then | 22:02 |
| morgan | dolphm, yeah will do once i am sure it's a *bug*. i don't think we want to use that bug id though. looks like it's only semi-related | 22:02 |
| ayoung | dolphm, it has a second side effect I like too: a trust token cannot be used to create a new trust. This means that I an use it to hand over a token and not worry that the remote service then creates a trust granting it full privs to my account | 22:03 |
| richm1 | ayoung: thanks - I'll just keep doing "recheck" until it passes, as per usual | 22:04 |
| ekarlso- | ayoung: from 1 to 10 how hard btw is dogtag to get up ? | 22:04 |
| ayoung | richm1, I can't seem to add you to a review | 22:05 |
| ayoung | richm1, but please look at https://review.openstack.org/120592 | 22:05 |
| ayoung | ekarlso-, install FreeIPA and it is trivial | 22:05 |
| *** saipandi has joined #openstack-keystone | 22:05 | |
| ekarlso- | ayoung: does it require the whole ipa suite ? :| | 22:06 |
| ayoung | ekarlso-, doing it by hand is not too bad, and alee in #openstack-barbican is one of the cores on it | 22:06 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:06 | |
| ayoung | ekarlso-, you want FreeIPA. You crave it. It fills a void in your life you didn't know you had | 22:06 |
| ekarlso- | haha | 22:06 |
| ayoung | ekarlso-, LDAP and Kerberos and DNS...Oh My | 22:07 |
| ayoung | and Dogtag for good measure... | 22:07 |
| ayoung | ekarlso-, why are you asking? | 22:07 |
| ekarlso- | ayoung: just wondering :) | 22:07 |
| ayoung | ekarlso-, Its a tomcat app, but you want to use the python based deployment scripts, as it does a lot of Security hardening that is essential | 22:08 |
| ayoung | ekarlso-, NSS enforces that the Private Keys stay inside the NSS database, unlike OpenSSL where you extract them and sign in your current process. The net effect is that a crashed program does not have private keys in the memory dump | 22:09 |
| ayoung | this is essential to things like getting the US government to use it. | 22:09 |
| ayoung | (FIPS/Common criteria type stuff) | 22:09 |
| ayoung | ekarlso-, I think its pki-silent that you want. nkinder is that right? | 22:10 |
| *** nkinder has quit IRC | 22:12 | |
| *** dims__ has joined #openstack-keystone | 22:13 | |
| *** joesavak has quit IRC | 22:13 | |
| ayoung | bknudson, https://review.openstack.org/#/c/118240/6 makes a change in keystone all that I do not see reflected in the HTML code...is this correct? | 22:13 |
| ayoung | Oh, wait as keystone_service | 22:14 |
| ayoung | OK...I guess we'll catch that in devstack | 22:14 |
| bknudson | ayoung: httpd/keystone.py ? | 22:16 |
| ayoung | bknudson, I see it now...it was the paste cleanup | 22:16 |
| ayoung | bknudson, it makes sense, but why is it in this patch? | 22:16 |
| bknudson | ayoung: the version controller needs to be able to do a GET /v3 call... | 22:17 |
| bknudson | in order to do that it needs the public or admin application | 22:17 |
| *** dims_ has quit IRC | 22:17 | |
| bknudson | so in order to get the public or admin application, the application needs to be stored when it's loaded | 22:17 |
| bknudson | so in order to store the application, rather than calling deploy.loadapp, keystone.service.loadapp() is called | 22:18 |
| ayoung | bknudson, a controller is doing another Call? | 22:18 |
| *** dims__ has quit IRC | 22:18 | |
| bknudson | ayoung: yes, version controller is doing GET /v3. I couldn't figure out a better way to do it. | 22:18 |
| ayoung | hmmm | 22:18 |
| bknudson | because the extensions modify the /v3 response to fill in their resources. | 22:19 |
| *** dims_ has joined #openstack-keystone | 22:19 | |
| bknudson | dolphm asked me to write the JSON Home code that way... seemed pretty slick. | 22:19 |
| *** david-lyle has quit IRC | 22:19 | |
| *** marcoemorais has quit IRC | 22:20 | |
| *** marcoemorais has joined #openstack-keystone | 22:20 | |
| bknudson | dolphm: about https://bugs.launchpad.net/keystone/+bug/1315049 -- it's not a problem on master so seems like there shouldn't be a change to master... it was only affecting a stable/icehouse. | 22:20 |
| uvirtbot | Launchpad bug 1315049 in keystone "'Provider' object has no attribute 'revoke_api'" [Medium,In progress] | 22:20 |
| *** gordc has quit IRC | 22:20 | |
| *** marcoemorais has quit IRC | 22:20 | |
| ayoung | bknudson, my head is spinning on this. | 22:20 |
| gyee | ayoung, for trust, where's the part that check for trust expiration when issuing a trust token? | 22:21 |
| ayoung | bknudson, my knee jerk reaction is that some of the slop we've been doing in the versions code path has come home to bite us | 22:21 |
| *** marcoemorais has joined #openstack-keystone | 22:21 | |
| ayoung | gyee, no idea. | 22:21 |
| bknudson | ayoung: the versions code is a mess. | 22:21 |
| gyee | I can't seem to find that code | 22:21 |
| ayoung | gyee, should be in the issue trust | 22:21 |
| ayoung | gyee, look in token/providers/common.py | 22:21 |
| ayoung | if its not there, it should be | 22:22 |
| gyee | ayoung, I did, but doesn't appear its check for expires_at | 22:22 |
| ayoung | gyee, unless it is in the get code? | 22:22 |
| *** jaosorior has quit IRC | 22:22 | |
| gyee | not there either | 22:22 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/core.py#n83 | 22:23 |
| ayoung | yes it is | 22:23 |
| * ayoung is probably lying | 22:23 | |
| gyee | I mean the checking for expires_at part | 22:23 |
| ayoung | gyee, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/backends/sql.py#n139 | 22:23 |
| ayoung | gyee, if the trust expired, get_trust returns None | 22:24 |
| gyee | ayoung, that's it! | 22:24 |
| gyee | thanks! | 22:24 |
| ayoung | gyee, YW | 22:24 |
| ayoung | gyee, we should do that same logic for get_user | 22:24 |
| ayoung | and for any get | 22:24 |
| gyee | oh, you mean a common layer to check for expiration? yes, good idea | 22:25 |
| ayoung | gyee, I mean that we should have a pattern where the get_ returns None if the object is invalid | 22:25 |
| gyee | ayoung, ++ | 22:25 |
| morgan | ayoung, instead of raising a 404? | 22:25 |
| ayoung | and an override switch for the cases where we still want to see them | 22:26 |
| ayoung | morgan, I mean in the providers | 22:26 |
| morgan | ayoung, oh. | 22:26 |
| ayoung | morgan, if a user is disabled, we still return it, but then explicitly have to check that | 22:26 |
| ayoung | versus trusts which enforce it at the provider level (see above link) | 22:26 |
| *** morgan is now known as morganfainberg | 22:27 | |
| gyee | hey guys, on a different topic, Stuart raised a concern on version discovery, which I think its legit | 22:27 |
| gyee | this maybe application to JSON home as well | 22:27 |
| gyee | consider this | 22:27 |
| gyee | two instance of keystone running behind a VIP/LB, both servicing v2 and v3 | 22:28 |
| gyee | one is being upgraded to service v3 only | 22:28 |
| bknudson | JSON Home only supports v3. | 22:29 |
| gyee | client got routed to first instance which advertise both v2 and v3 | 22:29 |
| gyee | on the second call, client got LBed to the second instance which no longer supports v2 | 22:29 |
| bknudson | the client should get routed to the same server... wouldn't that be an odd LB that switches the client's server? | 22:30 |
| gyee | bknudson, REST api are sessionless | 22:30 |
| bknudson | also, if the server says it supports both v2 and v3 then the client should be picking v3 and not v2. | 22:30 |
| gyee | bknudson, right, but if client just want to do v2 | 22:31 |
| gyee | for whatever reason | 22:31 |
| bknudson | then you'd better not change your server to only support v3. | 22:31 |
| gyee | bkudson, wouldn't JSON home face the same issue when we have v4 or v5 | 22:31 |
| bknudson | we'll never have v4 or v5. | 22:31 |
| gyee | hehe | 22:31 |
| bknudson | we didn't learn our lesson? | 22:32 |
| gyee | bkundson, man this rolling upgrade stuff is breaking my head | 22:32 |
| bknudson | we can't do a rolling upgrade if we have data in sql | 22:33 |
| gyee | yeah we can | 22:33 |
| gyee | version the data | 22:33 |
| bknudson | at some point you're going to have to migrate sql | 22:34 |
| *** dims_ has quit IRC | 22:34 | |
| gyee | bknudson, rolling upgrade sql too | 22:34 |
| *** dims_ has joined #openstack-keystone | 22:35 | |
| gyee | just need to do some LB magik | 22:35 |
| bknudson | nova's got their nova-conductor | 22:35 |
| bknudson | so you can upgrade all those | 22:35 |
| bknudson | but then you'll still need to do the db_sync and that's going to require quiesce the clients | 22:36 |
| gyee | isn't that a grenade requirement that conf file, binary, and backend can be independently upgraded? | 22:36 |
| bknudson | they don't try to run current keystone with old database. | 22:36 |
| gyee | but clients are talking to a VIP | 22:36 |
| morganfainberg | jamielennox, ping | 22:36 |
| morganfainberg | jamielennox, stevemar, for keystoneclient we really need to break the dep on lxml. we can either develop an egrep ourselves or we need to split federated plugin to it's own repo | 22:37 |
| bknudson | if you can have the clients not do updates to the database then you could keep read-only going at least. | 22:37 |
| *** alex_xu has quit IRC | 22:38 | |
| *** dims_ has quit IRC | 22:39 | |
| bknudson | for keystone that would be no tokens so kind of a non-starter | 22:39 |
| jamielennox | morganfainberg: i agree | 22:41 |
| jamielennox | develop an egrep? | 22:41 |
| morganfainberg | jamielennox, grep for the builtin default parser | 22:41 |
| morganfainberg | jamielennox, xml in python that is | 22:42 |
| jamielennox | i think that we definitely want federation plugins into a new repo | 22:42 |
| morganfainberg | jamielennox, i think that is what is needed. | 22:42 |
| morganfainberg | jamielennox, ok i am happy to do that i'll work on that tomorrow. | 22:42 |
| morganfainberg | jamielennox, erm. crud... wait | 22:42 |
| jamielennox | and yea, if there is a simple xml parser that can be done from python to at least keep the compatability with the old stuff | 22:42 |
| morganfainberg | hmm. | 22:42 |
| morganfainberg | lets see if we can do simple xml parser things first. | 22:42 |
| morganfainberg | might be quicker and then we get the new repo spun up | 22:43 |
| gyee | bknudson, yeah, that's a problem | 22:43 |
| dstanek | can't you use the parser that python provides? interface isn't as good as lxml, but you don't have the installation headaches | 22:43 |
| morganfainberg | dstanek, i think we can | 22:44 |
| jamielennox | morganfainberg: have we had a release with xml? | 22:44 |
| jamielennox | lxml | 22:44 |
| morganfainberg | jamielennox, checking | 22:44 |
| *** jorge_munoz has quit IRC | 22:44 | |
| morganfainberg | jamielennox... yep. | 22:44 |
| morganfainberg | 10.1 | 22:45 |
| morganfainberg | at least | 22:45 |
| jamielennox | morganfainberg: damn, but i figured as much | 22:45 |
| morganfainberg | if not more | 22:45 |
| morganfainberg | ok we use the built-in parser | 22:45 |
| morganfainberg | i'll work on that instead | 22:45 |
| morganfainberg | we can worry about the split later (ugh) | 22:46 |
| jamielennox | morganfainberg: i just re-uploaded the patch for the kerberos plugin, the federation one will be exactly the same if you think we should do it now | 22:47 |
| morganfainberg | jamielennox, yeah lets get it going. | 22:47 |
| jamielennox | keystoneclient-federation? keystoneclient-saml? | 22:47 |
| jamielennox | to what level do we split it? | 22:47 |
| jamielennox | i think -federation is ok | 22:48 |
| *** bknudson has quit IRC | 22:53 | |
| jamielennox | morganfainberg: ^ ? | 22:53 |
| jamielennox | wow, gate is stupidly backed up | 22:57 |
| *** nkinder has joined #openstack-keystone | 23:02 | |
| *** wanghong has quit IRC | 23:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/111620 | 23:04 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/119142 | 23:04 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/116255 | 23:09 |
| morganfainberg | jamielennox, sure -federation sounds good | 23:09 |
| morganfainberg | crud, we're using more xpath support than xml.etree.ElementTree can support :( | 23:10 |
| morganfainberg | jamielennox, i don't think this is going to be easy to do in pure python. | 23:12 |
| morganfainberg | pure python seems to be missing some of the xpath logic we actually need/use. | 23:13 |
| jamielennox | i don't know that code well. Does that mean we have to manually parse it out | 23:15 |
| ekarlso- | jamielennox: yo | 23:15 |
| jamielennox | ekarlso-: | 23:15 |
| ekarlso- | up ? :) | 23:15 |
| jamielennox | hi | 23:15 |
| ekarlso- | good morning australia ;) | 23:15 |
| jamielennox | beautiful day it's shaping up to be as well | 23:15 |
| ekarlso- | jamielennox: is there a way to register opts into a parser atm in the plugins ? | 23:19 |
| jamielennox | ekarlso-: yes, keystoneclient.auth.register_argparse_arguments and load_from_argparse_arguments | 23:20 |
| jamielennox | that creates an --os-auth-plugin field so that people can set the plugin they want and load those arguments to the parser | 23:21 |
| jamielennox | if you want to create a default set of options (so you don't have to use --os-auth-plugin) then you can though it's not as obvious as i would like yet | 23:21 |
| stevemar | morganfainberg, yo | 23:22 |
| stevemar | morganfainberg, just caught up, wasn't this resolved by moving it to test-req? | 23:22 |
| morganfainberg | stevemar, seems like not? -infra was still having issues | 23:22 |
| jamielennox | ekarlso-: the return value from register_argparse_arguments is either the plugin that the user specified or none | 23:22 |
| jamielennox | ekarlso-: if it's none then you can register a different plugin | 23:23 |
| jamielennox | i had a review for that... | 23:23 |
| ekarlso- | jamielennox: why not one way to register all opts for all plugins ? :/ | 23:23 |
| jamielennox | ekarlso-: i'm not sure that makes sense, that list could get long | 23:23 |
| jamielennox | but if you want it you can do it fairly easily | 23:24 |
| ekarlso- | so --os-auth-plugin can be password or token ? | 23:24 |
| jamielennox | use stevedore, iterate the plugins on the auth namespace, then each plugin object has a function register_argparse_arguments | 23:25 |
| jamielennox | so you can load them all if you ilke | 23:25 |
| stevemar | morganfainberg, bah | 23:25 |
| jamielennox | but argparse doesn't allow you to have different plugins register the same parameter names | 23:25 |
| jamielennox | so if you have multiple plugins saying they want --os-auth-url (like almost all will) you will need to do some sort of conflict resolution | 23:26 |
| jamielennox | --os-auth-plugin can take any plugin name, so password, token, v2password, v3token whatever | 23:26 |
| ekarlso- | jamielennox: any progress on the generic plugin | 23:27 |
| jamielennox | ekarlso-: gating as we speak i think | 23:28 |
| jamielennox | ekarlso-: so this patch https://review.openstack.org/#/c/113742/ was to let you specify a default value for cli | 23:29 |
| jamielennox | because i don't think you should make all users specify a --os-auth-plugin on the cli | 23:29 |
| jamielennox | merged, not release i think | 23:29 |
| jamielennox | i had another patch i can't find... | 23:29 |
| ekarlso- | jamielennox: | 23:30 |
| jamielennox | ah, because it's wrapped up in here: https://review.openstack.org/#/c/95680/9 | 23:30 |
| ekarlso- | well before u would just set OS_USERNAME OS_PASS or OS_TOKEN | 23:30 |
| ekarlso- | and it just worked :p | 23:30 |
| jamielennox | so there is a file in there called auth/identity/cli.py | 23:30 |
| jamielennox | it's not ready - i was waiting for the generic stuff | 23:30 |
| jamielennox | so that plugin will be called cli | 23:30 |
| jamielennox | so my intention is that other clients will do register_argparse_arguments(parser, default='cli') | 23:31 |
| jamielennox | so that if a user doesn't specify an --os-auth-plugin it will invoke one that we prepared earlier and will accept the env variables like you said | 23:31 |
| ekarlso- | when will that be done ? :D | 23:31 |
| jamielennox | umm, i haven't played with that one for a while, i was waiting for the generics | 23:32 |
| ekarlso- | :P | 23:32 |
| morganfainberg | stevemar, not sure how we can fix the need for full xpath support (with the idea that people should move to the new repo we're spinning off that can be lxml based) | 23:32 |
| jamielennox | also the CLIs i've tried to convert in the past are so tangled up with there own stuff that i was having to write a plugin specific to each CLI so i haven't been worried about a new standard one | 23:32 |
| ekarlso- | jamielennox: i guess no luck in getting it done before honeymoon :D | 23:33 |
| dstanek | do commits with requirements changes in openstack-specs need to only use deps that are in global-requirements? | 23:33 |
| jamielennox | ekarlso-: doubtful, however i'll have a look today | 23:33 |
| ekarlso- | ;P | 23:33 |
| ekarlso- | doh | 23:33 |
| jamielennox | ekarlso-: because it's not really that complex when you have the generic plugins | 23:34 |
| morganfainberg | dstanek, hm. it *should* be enforced | 23:34 |
| morganfainberg | dstanek, but it might not be | 23:34 |
| morganfainberg | dstanek, and honestly it probably doesn't matter | 23:34 |
| morganfainberg | stevemar, this might work in test-requires actually | 23:34 |
| jamielennox | ekarlso-: more i don't really know what people want there, obviously they want user/pass, i see various support for auth_url/token, and some that let you do endpoint/token | 23:35 |
| ekarlso- | :P | 23:35 |
| dstanek | morganfainberg: ok, i have a scripts that tests for that and one of the reviews was failing | 23:35 |
| morganfainberg | dstanek, dhellmann's? | 23:36 |
| dstanek | yeah | 23:36 |
| stevemar | morganfainberg, i was under the assumption that having it there would work | 23:36 |
| ekarlso- | jamielennox: could you try to whip up some stuff and I can try to follow up when you're away ;P | 23:36 |
| morganfainberg | stevemar, it does sortof work, but reality we still need lxml in -infra build machines for unit tests (icky) | 23:36 |
| morganfainberg | stevemar, long term losing lxml wont hurt anyone's feelings :P | 23:37 |
| jamielennox | ekarlso-: so what's in that review is a pretty good start, the concept is exactly the same as any other plugin | 23:38 |
| jamielennox | ekarlso-: you need to specify all the parameters your plugin takes, then you need a way to load the plugin from those parameters | 23:38 |
| jamielennox | essentially then it's a matter of saying if --username or --user-id or whatever was passed then i want to use the password plugin | 23:39 |
| jamielennox | if --token was passed i want to use the token plugin | 23:39 |
| jamielennox | and load those plugins from your parameters | 23:39 |
| jamielennox | the reason that plugin is failing i think is more to do with me trying to hack that into what keystoneclient is using rather than a problem with the plugin itself | 23:40 |
| ekarlso- | jamielennox: u got some reviews I can look at ? | 23:40 |
| jamielennox | https://review.openstack.org/#/c/95680/9/keystoneclient/auth/identity/cli.py | 23:40 |
| jamielennox | for more general how to write plugins there is a little bit in the docs | 23:40 |
| jamielennox | otherwise your best bet is to look at the plugins that we already have | 23:41 |
| jamielennox | there is a fair bit of in-file documentation | 23:41 |
| jamielennox | (at least like function docs and such | 23:41 |
| jamielennox | ) | 23:41 |
| ekarlso- | jamielennox: hmmm | 23:43 |
| jamielennox | gyee: is dhu around? | 23:43 |
| ekarlso- | what plugin ops should the cli thing register ? | 23:43 |
| ekarlso- | I mean to me it seems it would need to have the opts of all the plugins :/ | 23:43 |
| ekarlso- | at least generic | 23:43 |
| jamielennox | anything that you want to pass from --os-* | 23:43 |
| ekarlso- | use "generiC" plugin ? | 23:43 |
| jamielennox | so the combination of password and token i expect | 23:43 |
| jamielennox | yes | 23:43 |
| ekarlso- | if you could get the generic ting merged it would ber awesome | 23:44 |
| jamielennox | yep, gating - it's just really slow at the moment | 23:44 |
| ekarlso- | :;D | 23:44 |
| *** richm1 has quit IRC | 23:44 | |
| *** harlowja has quit IRC | 23:48 | |
| *** harlowja_ has joined #openstack-keystone | 23:48 | |
| gyee | jamielennox, no, he's in training this week afaik | 23:50 |
| jamielennox | gyee: damn, is he going to summit? | 23:50 |
| gyee | jamielennox, not sure, I'll check with him | 23:51 |
| jamielennox | i really need to have a talk with him about some of this session stuff | 23:51 |
| jamielennox | just saw a patch he did for heatclient which is gating | 23:51 |
| gyee | jamielennox, what's the issue? | 23:52 |
| gyee | I think he's also working on a Nova CLI patch | 23:52 |
| jamielennox | gyee: not the worst, he's reusing a lot of the old client code that i'm trying to destroy | 23:53 |
| gyee | ah | 23:53 |
| jamielennox | also the adapters and stuff are in a release now and so the code he's copying and pasting no longer needs to be | 23:53 |
| jamielennox | i've seen the nova one | 23:53 |
| *** zzzeek has quit IRC | 23:53 | |
| jamielennox | i didn't see the heat one till now | 23:53 |
| gyee | nice!, we can submit another patch to use the latest and greatest | 23:53 |
| gyee | unless you want to do it | 23:54 |
| gyee | I did ask him to add you to all his patches | 23:54 |
| jamielennox | i might have been added - i've given up on trying to keep the gerrit mail under control | 23:55 |
| gyee | jamielennox, same here, my Outlook filter suck big time | 23:55 |
| ekarlso- | jamielennox: is the gate borked ? :D | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!