| *** marcoemorais has quit IRC | 00:02 | |
| *** marcoemorais has joined #openstack-keystone | 00:10 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:11 | |
| *** openstackgerrit has quit IRC | 00:16 | |
| *** openstackgerrit has joined #openstack-keystone | 00:17 | |
| *** stevemar has quit IRC | 00:17 | |
| *** dims has quit IRC | 00:18 | |
| *** zzzeek has joined #openstack-keystone | 00:21 | |
| *** wwriverrat has joined #openstack-keystone | 00:26 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Extracting common code to private method https://review.openstack.org/120563 | 00:35 |
|---|---|---|
| *** cjellick has quit IRC | 00:38 | |
| *** Tahmina has quit IRC | 00:41 | |
| *** dims has joined #openstack-keystone | 00:48 | |
| *** wwriverrat1 has joined #openstack-keystone | 00:50 | |
| *** wwriverrat has quit IRC | 00:51 | |
| *** harlowja_ has quit IRC | 00:51 | |
| openstackgerrit | Victor Silva proposed a change to openstack/python-keystoneclient: Explicit complaint about old OpenSSL when testing https://review.openstack.org/123619 | 00:52 |
| *** soulxu_ has joined #openstack-keystone | 00:55 | |
| *** alex_xu has quit IRC | 00:59 | |
| *** _cjones_ has quit IRC | 01:01 | |
| *** _cjones_ has joined #openstack-keystone | 01:01 | |
| *** marcoemorais has quit IRC | 01:02 | |
| *** _cjones_ has quit IRC | 01:05 | |
| *** thedodd_ has joined #openstack-keystone | 01:12 | |
| *** zzzeek has quit IRC | 01:12 | |
| *** thedodd_ has quit IRC | 01:13 | |
| *** thedodd has joined #openstack-keystone | 01:14 | |
| *** stevemar has joined #openstack-keystone | 01:14 | |
| *** marcoemorais has joined #openstack-keystone | 01:15 | |
| *** harlowja has joined #openstack-keystone | 01:18 | |
| *** marcoemorais has quit IRC | 01:19 | |
| *** stevemar has quit IRC | 01:22 | |
| *** stevemar has joined #openstack-keystone | 01:23 | |
| *** soulxu__ has joined #openstack-keystone | 01:27 | |
| *** soulxu_ has quit IRC | 01:31 | |
| *** thedodd has quit IRC | 01:40 | |
| *** wwriverrat1 has quit IRC | 01:43 | |
| *** diegows has quit IRC | 01:53 | |
| *** victsou has joined #openstack-keystone | 01:56 | |
| *** bknudson has quit IRC | 02:04 | |
| *** victsou` has joined #openstack-keystone | 02:10 | |
| *** victsou is now known as victsou___ | 02:11 | |
| *** victsou` has quit IRC | 02:15 | |
| *** victsou has joined #openstack-keystone | 02:15 | |
| *** rodrigod` has joined #openstack-keystone | 02:15 | |
| *** rodrigods has quit IRC | 02:16 | |
| *** thedodd has joined #openstack-keystone | 02:16 | |
| *** rodrigod` has quit IRC | 02:19 | |
| *** rodrigods has joined #openstack-keystone | 02:19 | |
| *** dims has quit IRC | 02:23 | |
| *** victsou___ has quit IRC | 02:25 | |
| *** victsou___ has joined #openstack-keystone | 02:26 | |
| *** rodrigods_ has quit IRC | 02:27 | |
| *** thedodd has quit IRC | 02:28 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:29 | |
| *** victsou___ has quit IRC | 02:34 | |
| *** I has joined #openstack-keystone | 02:37 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient-kerberos: Initial kerberos plugin implementation. https://review.openstack.org/123614 | 02:37 |
| *** I is now known as Guest66232 | 02:37 | |
| *** Guest66232 has quit IRC | 02:39 | |
| *** victsou__ has joined #openstack-keystone | 02:41 | |
| *** victsou has quit IRC | 02:42 | |
| *** victsou has joined #openstack-keystone | 02:42 | |
| *** marcoemorais has joined #openstack-keystone | 02:48 | |
| morganfainberg | ayoung, i finally found the source of the need to index user_id on token table. | 02:50 |
| morganfainberg | ayoung, it makes me sad :( | 02:50 |
| *** marcoemorais1 has joined #openstack-keystone | 02:50 | |
| *** richm has quit IRC | 02:52 | |
| *** marcoemorais has quit IRC | 02:53 | |
| *** victsou has quit IRC | 02:53 | |
| *** victsou has joined #openstack-keystone | 02:53 | |
| *** victsou__ has quit IRC | 02:54 | |
| *** thedodd has joined #openstack-keystone | 03:03 | |
| *** thedodd has quit IRC | 03:09 | |
| *** thedodd has joined #openstack-keystone | 03:09 | |
| *** thedodd has quit IRC | 03:10 | |
| morganfainberg | dstanek, stevemar, lbragstad, so might need you guys' help to push through a sql migration change that is looking like an RC blocker. | 03:13 |
| stevemar | morganfainberg, ahoy | 03:13 |
| stevemar | link me! | 03:13 |
| morganfainberg | dstanek, stevemar, lbragstad, you know that user_id index on the token table? | 03:13 |
| morganfainberg | found the root cause of why we need that index. | 03:13 |
| stevemar | i remember some work being done around it | 03:14 |
| morganfainberg | with 15k rows, a search on user_id (where clause) for delete_tokens_for_user can consume 150000000 bytes of buffer | 03:14 |
| morganfainberg | assuming avg size of 10k for the token body | 03:14 |
| morganfainberg | since we select the data and are where clausing on an unindexed value | 03:14 |
| morganfainberg | so we load 15k rows and scan them | 03:15 |
| morganfainberg | this is likely the fix https://review.openstack.org/#/c/102041 | 03:15 |
| morganfainberg | but i am sad we're migrating the token table. | 03:15 |
| morganfainberg | and it needs a rebase/update | 03:16 |
| morganfainberg | but basically heat creates temporary users | 03:17 |
| morganfainberg | and deletes them | 03:17 |
| morganfainberg | a query that results in 0 tokens returned can be 200+s | 03:17 |
| morganfainberg | stevemar, thoughts? | 03:17 |
| stevemar | yeesh that's awful | 03:19 |
| morganfainberg | stevemar, i can give you profile pastes for 15k select queries | 03:20 |
| morganfainberg | but i'm ready to bump this to RC if you agree. | 03:20 |
| morganfainberg | and unabandon/un-block that fix | 03:21 |
| morganfainberg | i don't know if there is a good way to fix this without a token_table migration | 03:21 |
| morganfainberg | stevemar, the issue is https://github.com/openstack/keystone/blob/master/keystone/token/persistence/backends/sql.py#L133-L136 we might want to index trust as well | 03:23 |
| *** dims has joined #openstack-keystone | 03:23 | |
| stevemar | morganfainberg, i don't think there is - what are the implications to the end user if we migrate the token table? | 03:23 |
| stevemar | why so gun shy about it? | 03:23 |
| morganfainberg | stevemar, token table migrations with tons of rows take forever | 03:24 |
| morganfainberg | 42k rows was ~Query OK, 0 rows affected (2 min 8.90 sec) | 03:24 |
| morganfainberg | to add the index | 03:24 |
| morganfainberg | if you have millions of tokens | 03:24 |
| morganfainberg | ugh | 03:24 |
| stevemar | and i'm assuming most token tables have >150K at least | 03:24 |
| morganfainberg | we could do a truncate of the table. | 03:25 |
| morganfainberg | before the migrate... but not sure if that would make people happy. | 03:25 |
| morganfainberg | ok restoring the change and bug. | 03:25 |
| ayoung | looking | 03:26 |
| morganfainberg | ayoung, ++ waiting for you then before starting on it. | 03:26 |
| morganfainberg | ayoung, stevemar, here is an example profile: http://paste.openstack.org/show/115165/ | 03:27 |
| morganfainberg | pretty standard deployment options. | 03:27 |
| morganfainberg | query 1 was the explain, 2 without index, 3 with the index | 03:27 |
| morganfainberg | same dataset | 03:27 |
| morganfainberg | and as you can see 0 rows returned | 03:27 |
| *** wanghong has quit IRC | 03:28 | |
| *** dims has quit IRC | 03:28 | |
| ayoung | morganfainberg, up the poll frequency | 03:29 |
| morganfainberg | ayoung, on? | 03:29 |
| stevemar | ughhhh 200s | 03:29 |
| ayoung | the cleanup | 03:29 |
| morganfainberg | ayoung, these are all valid tokens | 03:29 |
| ayoung | removing expired tokens | 03:29 |
| morganfainberg | ayoung, 15k valid tokens | 03:30 |
| morganfainberg | just none for that user | 03:30 |
| ayoung | I guess I'm missing the problem then | 03:30 |
| morganfainberg | 15k tokens, takes 200 seconds to return 0 rows | 03:30 |
| ayoung | doing delete token? | 03:30 |
| morganfainberg | trying to delete tokens for a user with no active tokens | 03:31 |
| dstanek | morganfainberg: ahoy | 03:31 |
| stevemar | dstanek, tl;dr -> we need user_id as an index in the token table | 03:31 |
| ayoung | so is it a select ordering problem? We should be selecting on user_id first, and the index forces that? | 03:31 |
| morganfainberg | ayoung, yeah, so user with no tokens, delete the user, we cleanup tokens. that takes ~200s in this case bcause while we're indexed on expires and valid, we're not indexed on user, so all valid tokens = 15 or 20 or 40k and now we need to scan *all* tokens for that user's id | 03:32 |
| dstanek | yeah, i just got done reading up | 03:32 |
| stevemar | ayoung, wouldn't that still search all the entries? | 03:32 |
| ayoung | morganfainberg, could we do this by rewriting the query instead? | 03:32 |
| morganfainberg | ayoung, don't think we can. | 03:32 |
| ayoung | select * from token where user_id = "balh' so what if it isn;t indexed... | 03:32 |
| morganfainberg | ayoung, that is the issue | 03:33 |
| morganfainberg | we're loading the entire token in because of the extra blog | 03:33 |
| morganfainberg | blob | 03:33 |
| morganfainberg | that isn't a small amount of data | 03:33 |
| ayoung | morganfainberg, so unless we index on user_id we have to load the whole record? What? | 03:33 |
| morganfainberg | the query needs the token.extra | 03:33 |
| morganfainberg | since tenant_id and consumer_id aren't columns | 03:34 |
| morganfainberg | and we use those for deletes too. | 03:34 |
| dstanek | does Justin's fix actually fix the issue? | 03:34 |
| morganfainberg | this wouldn't be an issue without needing to load token.extra (~5-10k due to catalog and everything) | 03:34 |
| morganfainberg | dstanek, yep. we might want to index trust_id too | 03:34 |
| ayoung | why does it need extra to delete tokens? | 03:34 |
| morganfainberg | ayoung, tenant_id is in token body, not a column. | 03:35 |
| morganfainberg | ayoung, same with consumer_id (oauth) in cases. | 03:35 |
| dstanek | morganfainberg: is that in the where clause too? | 03:35 |
| morganfainberg | even still, this likely should be index even if it was a cloumn | 03:35 |
| morganfainberg | dstanek, no, it's just being selected | 03:35 |
| morganfainberg | example with 42k tokens: | 03:36 |
| morganfainberg | mysql> SELECT token.id AS token_id, token.expires AS token_expires, token.extra AS token_extra, token.valid AS token_valid, token.user_id AS token_user_id, token.trust_id AS token_trust_id FROM token WHERE token.valid = 1 AND token.expires > '2014-09-25 02:06:09.862473' AND token.user_id = 'fed8182b6b1049c3845a14d522b80f0a'; | 03:36 |
| morganfainberg | Empty set (0.00 sec) | 03:36 |
| ayoung | is this just slow deletes that we are seeing, or some other api affected as well? | 03:36 |
| morganfainberg | that is with the index | 03:36 |
| morganfainberg | without the index 208.17972825 | 03:36 |
| morganfainberg | ayoung, it locks up the entire keystone worker (in multi worker) and can cause issues with the underlying mysql buffer pool | 03:36 |
| morganfainberg | ayoung, because SQL queries do not yeild eventlet | 03:36 |
| morganfainberg | ayoung, mysqlDB vs pure python+socket | 03:37 |
| ayoung | joy | 03:37 |
| morganfainberg | ayoung, in single worker it's *really* bad | 03:37 |
| dstanek | morganfainberg: why would you need to index trust_id too? | 03:37 |
| ayoung | ok, so you think index is the solution? | 03:37 |
| morganfainberg | dstanek, we're selecing on it to delete by trust, same issue as deleting for a user | 03:37 |
| morganfainberg | dstanek, less common, but still can occur | 03:37 |
| ayoung | adding an index will slow down writing a new token | 03:37 |
| morganfainberg | ayoung, we could probably index(4) and be way better | 03:38 |
| morganfainberg | ayoung, 4 byte index shouldn't be bad on slower writes, we don't need to index 64 | 03:38 |
| morganfainberg | my test was with an index(10) | 03:38 |
| dstanek | ah, yeah - then we probably do need it - have you done an explain plan at all? | 03:38 |
| ayoung | I'll take your word on it. | 03:38 |
| morganfainberg | dstanek, sec | 03:39 |
| morganfainberg | dstanek, http://paste.openstack.org/show/115166/ | 03:39 |
| morganfainberg | pre index | 03:39 |
| morganfainberg | post index: http://paste.openstack.org/show/115167/ (index(10)) | 03:40 |
| morganfainberg | dstanek, not even a full column index | 03:40 |
| morganfainberg | dstanek, so, i'm open to alternatives to touching the token table :) much rather python code to sql migration in this case. | 03:43 |
| ayoung | do we even need to do it at all? | 03:44 |
| ayoung | is there someway we can avoid all the work? | 03:44 |
| *** wanghong has joined #openstack-keystone | 03:45 | |
| ayoung | Oh, wait, that kind of thinking lead to revocation events | 03:45 |
| ayoung | sorry | 03:45 |
| dstanek | hmmm...the issue is the range scan so i don't think you can do much in Python to stop that | 03:46 |
| morganfainberg | ayoung, i mean, could we *only* use revocation events in keystone for this. | 03:46 |
| ayoung | morganfainberg, nope | 03:46 |
| morganfainberg | ayoung, right revocation_list | 03:46 |
| dstanek | maybe select by pages and search a subset of the data to not lock everyone | 03:46 |
| ayoung | morganfainberg, drop token revokations all together | 03:46 |
| morganfainberg | ayoung, dagnabit | 03:46 |
| ayoung | 5 minute tokens | 03:46 |
| ayoung | I'm serious as all hell | 03:46 |
| morganfainberg | ayoung, i know you are, but that isn't a juno fix :( | 03:47 |
| ayoung | revocations are dumb, I should never have put them in | 03:47 |
| ayoung | tell people to set their token time out to 5 minutes | 03:47 |
| ayoung | meh | 03:47 |
| ayoung | morganfainberg, is the index a fix or no? | 03:47 |
| morganfainberg | ayoung, the index fixes the issue. | 03:47 |
| ayoung | do the index | 03:47 |
| morganfainberg | dstanek, possible, but we could miss tokens that way | 03:48 |
| ayoung | index on user_id, trust_id...any others? | 03:48 |
| morganfainberg | ayoung, only two we don't have indexed | 03:49 |
| morganfainberg | well we don't need to index 'extra' thats silly | 03:49 |
| ayoung | morganfainberg, submit the fix, and lets notificy the performance people about it. I have some at RH I can shout at | 03:49 |
| morganfainberg | ayoung, ok restored the change and all. | 03:52 |
| morganfainberg | ayoung, thanks. | 03:52 |
| ayoung | morganfainberg, do you want to put both indexes in one migration? | 03:52 |
| morganfainberg | ayoung, yeah, going to do it since they're both related. | 03:53 |
| ayoung | morganfainberg, do you need this to go through tonight? | 03:53 |
| morganfainberg | ayoung, let me update the patch to the correct migration id and toss in a test. | 03:53 |
| morganfainberg | ayoung, ideally we should try and get it in tonight (well at least gating) but... we can hit it tomorrow. | 03:53 |
| morganfainberg | ayoung, this *looks* like a RC blocker to me, and i feel back for blocking it earlier in the cycle now. | 03:54 |
| ayoung | morganfainberg, its late here, and tomorrow is a Holiday. | 03:54 |
| morganfainberg | ayoung, i'm fine with bugging stevemar and dstanek :) | 03:54 |
| ayoung | why is it now an RC blocker? | 03:54 |
| ayoung | what brought it to your attention? | 03:54 |
| morganfainberg | ayoung, because with a nominal heat deploy this can lockup / cause failures in triple-o | 03:54 |
| ayoung | OK | 03:54 |
| ayoung | get to work...I'll check in the morning | 03:55 |
| morganfainberg | ayoung, spent most of this afternoon looking through the infra triple-o install. | 03:55 |
| morganfainberg | and came up with this. | 03:55 |
| stevemar | morganfainberg, either way it's gotta be done | 03:55 |
| morganfainberg | ayoung, sounds good. by the way on the topic of holiday, happy new year [Rosh Hashanah? or some other holiday]? | 03:55 |
| ayoung | Yeah Rosh Hashana | 03:55 |
| stevemar | so i'm OK with adding this, it's one of those performance pieces we really should have | 03:55 |
| morganfainberg | ayoung, uhmm. Shana Tovah (gah my hebrew is rusty) | 03:56 |
| dstanek | stevemar: i agree | 03:56 |
| stevemar | shouldn't you be saying shanah tovah? :) | 03:56 |
| stevemar | gah morganfainberg beat me to it | 03:56 |
| ayoung | You got it right. Thanks, and its a transliteration, you are both correct | 03:56 |
| morganfainberg | ok got it to RC1 and restored. | 03:57 |
| ayoung | לשנה טובה | 03:57 |
| stevemar | morganfainberg, yippie | 03:57 |
| morganfainberg | joyous. | 03:57 |
| morganfainberg | just what i wanted to do tonight :( | 03:57 |
| morganfainberg | dstanek, do we index the whole column or do a partial index? | 03:57 |
| stevemar | ayoung, testing out bidi and double bye characters of irc clients everywhere :) | 03:57 |
| stevemar | byte | 03:58 |
| morganfainberg | dstanek, whole column is quicker to write. | 03:58 |
| ayoung | whole column | 03:58 |
| morganfainberg | k | 03:58 |
| dstanek | yeah, i agree | 03:58 |
| ayoung | get the patch in, and we'll let the DB folks argue it out. | 03:58 |
| dstanek | morganfainberg: are you just going to restore the existing patch? | 04:03 |
| morganfainberg | dstanek, yep | 04:03 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Adding an index on token.user_id and token.trust_id https://review.openstack.org/102041 | 04:05 |
| morganfainberg | probably needs tests too... | 04:05 |
| morganfainberg | i guess | 04:05 |
| morganfainberg | dstanek, stevemar , does that really need tests? i'm happy to add them if it does. | 04:07 |
| dstanek | morganfainberg: what would you test? | 04:07 |
| morganfainberg | that the indexes were created / deleted | 04:08 |
| morganfainberg | *shrug* | 04:08 |
| morganfainberg | i mean. eh | 04:08 |
| ayoung | the existing tests are probably sufficient | 04:08 |
| ayoung | headed to bed. good luck | 04:09 |
| morganfainberg | ayoung, g'night! | 04:09 |
| morganfainberg | ayoung, oh sent some HP folks your way for the token constraints spec | 04:09 |
| morganfainberg | ayoung, was bobt, he's interested in the endpoint binding, told him we'd love to have the collaboration :) | 04:10 |
| morganfainberg | ayoung, anyway, g'night | 04:10 |
| stevemar | maybe some for just the db table structure | 04:10 |
| morganfainberg | stevemar, thats the only test i can think of it needed / benefitting from | 04:11 |
| morganfainberg | could go either way on it myself. | 04:11 |
| stevemar | morganfainberg, yep, that's all i was asking for when the change was proposed | 04:11 |
| stevemar | morganfainberg, it's more red tape than anything else | 04:11 |
| morganfainberg | yeah | 04:11 |
| morganfainberg | you know, if we fix the migration test(s) in K that red-tape might be easy to make go away | 04:12 |
| morganfainberg | the structure type tests that is | 04:12 |
| stevemar | morganfainberg, how would we 'fix' migration tests? | 04:13 |
| morganfainberg | move to something like nova's and do the model == schema test | 04:14 |
| stevemar | hmm neat | 04:15 |
| stevemar | i'll have to look into that | 04:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Adding an index on token.user_id and token.trust_id https://review.openstack.org/102041 | 04:19 |
| morganfainberg | stevemar, dstanek, ^ | 04:19 |
| morganfainberg | added structural tests | 04:19 |
| morganfainberg | ok i need to go get food. | 04:26 |
| morganfainberg | long since past my dinner time | 04:27 |
| dstanek | morganfainberg: noted one thing on the review | 04:27 |
| dstanek | i can fix and push it back up - it's a copy-pasta error | 04:27 |
| morganfainberg | dstanek, ah i have it here | 04:28 |
| morganfainberg | easy fix | 04:28 |
| dstanek | k | 04:28 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Adding an index on token.user_id and token.trust_id https://review.openstack.org/102041 | 04:28 |
| morganfainberg | fixed | 04:29 |
| dstanek | thx | 04:29 |
| *** gokrokve has joined #openstack-keystone | 04:35 | |
| *** morgan_remote_ has joined #openstack-keystone | 04:39 | |
| morgan_remote_ | Ok. Let me know if you need anything else. | 04:39 |
| *** yasu_ has joined #openstack-keystone | 04:41 | |
| stevemar | lookin now | 04:42 |
| stevemar | morganfainberg, dstanek 2 stray comments | 04:45 |
| *** amcrn has quit IRC | 04:46 | |
| morgan_remote_ | stevemar: yah valid comments. | 04:52 |
| morgan_remote_ | stevemar: will fix unless you get to it first. | 04:54 |
| *** lsmola has quit IRC | 04:57 | |
| nkinder_ | morgan_remote_: the identity API docs still say that successful HEAD requests should return 204. That's supposed to be 200 now, right? | 05:01 |
| nkinder_ | morgan_remote_: that changed during the whole GET vs. HEAD fiasco when we switched to httpd in the gate IIRC | 05:02 |
| morgan_remote_ | nkinder_: sounds right. | 05:02 |
| nkinder_ | morgan_remote_: Ok, I'll look at updating it tomorrow. Crash time for me. | 05:03 |
| morgan_remote_ | Thanks | 05:03 |
| *** kashyap has joined #openstack-keystone | 05:03 | |
| *** gokrokve has quit IRC | 05:04 | |
| *** lsmola has joined #openstack-keystone | 05:11 | |
| openstackgerrit | A change was merged to openstack/keystone: Prevent infinite recursion on persistence core on init https://review.openstack.org/123612 | 05:12 |
| *** oomichi has joined #openstack-keystone | 05:19 | |
| morgan_remote_ | Yay. | 05:21 |
| *** _cjones_ has joined #openstack-keystone | 05:33 | |
| *** _cjones_ has quit IRC | 05:37 | |
| *** _cjones_ has joined #openstack-keystone | 05:38 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update 'Configuring Services' documentation https://review.openstack.org/123933 | 05:41 |
| *** harlowja is now known as harlowja_away | 05:53 | |
| *** amcrn has joined #openstack-keystone | 05:55 | |
| *** ajayaa has joined #openstack-keystone | 05:57 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Work toward Python 3.4 support and testing https://review.openstack.org/118779 | 06:02 |
| *** vdreamarkitex has quit IRC | 06:08 | |
| *** vdreamarkitex has joined #openstack-keystone | 06:09 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update architecture documentation https://review.openstack.org/123938 | 06:13 |
| *** ajayaa has quit IRC | 06:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/123941 | 06:18 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Adding an index on token.user_id and token.trust_id https://review.openstack.org/102041 | 06:19 |
| morganfainberg | stevemar, dstanek ^ | 06:19 |
| morganfainberg | stevemar, darn cant get a second +2/+A on this tonight | 06:21 |
| morganfainberg | was hoping it would be in gate while we sleep | 06:21 |
| stevemar | morganfainberg, i figured we would want the db guys to look at it anyway | 06:22 |
| morganfainberg | stevemar, i don't think there's much to say about it :P | 06:22 |
| morganfainberg | but sure | 06:22 |
| *** andreaf has quit IRC | 06:23 | |
| stevemar | morganfainberg, i think we're out of luck for tonight, the rest are snoozing | 06:23 |
| morganfainberg | stevemar, yeah i know | 06:23 |
| *** ajayaa has joined #openstack-keystone | 06:34 | |
| *** k4n0 has joined #openstack-keystone | 06:37 | |
| marekd | morning all | 06:39 |
| morganfainberg | allo marekd and... good night :P | 06:51 |
| *** ukalifon has joined #openstack-keystone | 06:54 | |
| *** lufix has joined #openstack-keystone | 06:58 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: local configuration should be allowed in "keystone-paste.ini" https://review.openstack.org/121439 | 06:59 |
| marekd | morganfainberg: yeah, good night :-) | 07:00 |
| openstackgerrit | Ankit Agrawal proposed a change to openstack/python-keystoneclient: Redact x-subject-token from response headers https://review.openstack.org/123954 | 07:01 |
| morganfainberg | oh marekd, stevemar, nkinder_ was asking about what parts of K2K federation actually landed, I tried to answer, but you may want to follow up and check to make sure i covered it all. | 07:02 |
| marekd | morganfainberg: it's on the channel some ml thread or somewhere else? | 07:03 |
| stevemar | marekd, on the channel | 07:03 |
| morganfainberg | marekd, was here | 07:03 |
| marekd | OK | 07:03 |
| marekd | i guess he is asleep right now. | 07:03 |
| morganfainberg | marekd, might hit him up later today | 07:03 |
| morganfainberg | yeah | 07:03 |
| morganfainberg | he's in the bay area iirc (so same timezone as me, california) | 07:04 |
| marekd | morganfainberg: ok, so late afternoon. | 07:04 |
| *** ankit_ag has joined #openstack-keystone | 07:04 | |
| morganfainberg | marekd, probably | 07:04 |
| morganfainberg | marekd, oh also will bug you in a couple days to figure out visiting CERN :) if thats still an option | 07:05 |
| marekd | morganfainberg: it is :-) | 07:05 |
| morganfainberg | post summit | 07:05 |
| morganfainberg | awesome! | 07:05 |
| * morganfainberg is super excited about that. | 07:05 | |
| marekd | :D | 07:06 |
| marekd | stevemar: are you also planning to stay in the area after the summit? | 07:06 |
| morganfainberg | seriously, makes me feel like a kid knowing i get to visit one of the places doing science in stuff I am super interested in. | 07:07 |
| stevemar | marekd, sadly i'm not staying :( | 07:07 |
| marekd | morganfainberg: we will try to get you 100m underground so you can see everything :-) | 07:08 |
| marekd | stevemar: :((((( | 07:08 |
| morganfainberg | marekd, woohoo! | 07:08 |
| morganfainberg | stevemar, bah, change your plans stay longer... bring the gf...or the wife... whichever :P i mean... | 07:08 |
| marekd | ...or both :P | 07:08 |
| morganfainberg | lol | 07:09 |
| morganfainberg | marekd, i really hope she's looking over his shoulder right about now. | 07:09 |
| morganfainberg | :) | 07:09 |
| * marekd was obviously joking | 07:09 | |
| morganfainberg | marekd, of course, same here. | 07:09 |
| morganfainberg | oh no, maybe she was looking... what has happened to poor stevemar !! ok ok... gnight i'm getting punchy | 07:10 |
| marekd | see ya | 07:10 |
| stevemar | hhaa | 07:11 |
| stevemar | nah, i have to get back for personal stuff, i might be back in europe in december, we'll see | 07:11 |
| marekd | stevemar: cool | 07:11 |
| marekd | visiting italy? | 07:11 |
| *** ankit_ag has left #openstack-keystone | 07:12 | |
| *** ajayaa has quit IRC | 07:12 | |
| stevemar | marekd, nah, heading right back home | 07:15 |
| marekd | in dec | 07:15 |
| stevemar | marekd, oh then, i dunno, that's TBD | 07:15 |
| stevemar | marekd, wherever my lady wants to go | 07:15 |
| marekd | stevemar: sure :-) | 07:16 |
| marekd | if they are happy we are happy :-) | 07:17 |
| stevemar | precisely | 07:19 |
| stevemar | we are thinking somewhere in europe or somewhere in the states... don't know yet | 07:19 |
| stevemar | tbh, i really liked san antonio when we were there, maybe i'll go back | 07:19 |
| marekd | uhm | 07:20 |
| stevemar | marekd, i guess you didn't like it as much :) | 07:20 |
| *** ajayaa has joined #openstack-keystone | 07:20 | |
| marekd | stevemar: why would you think that? | 07:21 |
| stevemar | marekd, you said 'uhm' | 07:21 |
| marekd | stevemar: ah, no, i liked it :-) | 07:21 |
| stevemar | marekd, ahhh | 07:21 |
| *** BAKfr has joined #openstack-keystone | 07:21 | |
| marekd | maybe a little bit too hot, but since i don't have to work as a farmer i didn't mind that much. | 07:22 |
| stevemar | marekd, yeah but in december the warmth will be appreciated :D | 07:22 |
| marekd | stevemar: yep | 07:22 |
| *** soulxu_ has joined #openstack-keystone | 07:29 | |
| *** ajayaa has quit IRC | 07:32 | |
| *** soulxu__ has quit IRC | 07:32 | |
| *** ukalifon has quit IRC | 07:33 | |
| *** ajayaa has joined #openstack-keystone | 07:34 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Clean up the Configuration documentation https://review.openstack.org/123960 | 07:52 |
| *** YorikSar has joined #openstack-keystone | 07:56 | |
| *** rushiagr_away is now known as rushiagr | 08:00 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Add an optional advanced pool of memcached clients https://review.openstack.org/119774 | 08:01 |
| *** soulxu_ has quit IRC | 08:04 | |
| *** morgan_remote_ has quit IRC | 08:10 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: New section for CLI examples in docs https://review.openstack.org/123969 | 08:16 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Clean up the Configuration documentation https://review.openstack.org/123960 | 08:17 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: New section for CLI examples in docs https://review.openstack.org/123969 | 08:17 |
| *** stevemar has quit IRC | 08:23 | |
| *** alex_xu has joined #openstack-keystone | 08:32 | |
| *** marcoemorais1 has quit IRC | 08:38 | |
| *** afazekas has joined #openstack-keystone | 08:39 | |
| *** andreaf_ is now known as andreaf | 08:39 | |
| *** _cjones_ has quit IRC | 08:44 | |
| *** _cjones_ has joined #openstack-keystone | 08:44 | |
| *** openstackgerrit has quit IRC | 08:48 | |
| *** _cjones_ has quit IRC | 08:48 | |
| *** rushiagr is now known as rushiagr_away | 08:52 | |
| *** Dafna has joined #openstack-keystone | 09:17 | |
| *** rushiagr_away is now known as rushiagr | 09:56 | |
| *** diegows has joined #openstack-keystone | 09:56 | |
| *** dims has joined #openstack-keystone | 10:09 | |
| *** dims has quit IRC | 10:14 | |
| *** f13o has joined #openstack-keystone | 10:20 | |
| *** junhongl_ has joined #openstack-keystone | 10:46 | |
| *** junhongl_ has quit IRC | 11:01 | |
| samuelmz | henrynash, just saw your comments on review #123585 | 11:08 |
| henrynash | samuelmz: I’m just testing a modified patch…sorry to jump on this…but it is more serious than it appears…and I updated the bug report as well | 11:09 |
| samuelmz | henrynash, ok np | 11:09 |
| henrynash | samuelz: I’ll add testing for the specific issue to the main patch | 11:09 |
| henrynash | samuelmz: thanks for kicking this off…we’d never have found it otherwise | 11:10 |
| samuelmz | henrynash, np :) | 11:10 |
| samuelmz | henrynash, I found that when creating tests for role grants on backends .. we don't have any tests ... | 11:11 |
| samuelmz | henrynash, bug #1367480 | 11:11 |
| uvirtbot | Launchpad bug 1367480 in keystone "Add test for grant CRUD on test_backend" [Low,In progress] https://launchpad.net/bugs/1367480 | 11:12 |
| henrynash | samuelmz: so that’d not quite true…we have quite a few…what happens is that they are skipped for ldap! | 11:12 |
| samuelmz | henrynash, I mean grant crud tests ... on test_backend | 11:12 |
| samuelmz | henrynash, I think we have tests on test_v3_identity | 11:12 |
| henrynash | samuelmz: yes, there are lots in there.... | 11:12 |
| henrynash | samuelmz: in test_backend... | 11:13 |
| henrynash | samuelmz: e.g. test_get_and_remove_role_grant_by_group_and_domain | 11:13 |
| samuelmz | henrynash, I haven't realized that .. so the bug #1367480 is invalid ... | 11:15 |
| uvirtbot | Launchpad bug 1367480 in keystone "Add test for grant CRUD on test_backend" [Low,In progress] https://launchpad.net/bugs/1367480 | 11:15 |
| samuelmz | henrynash, thanks .. | 11:16 |
| henrynash | samuelmz: yes…but what I did do was add: https://bugs.launchpad.net/keystone/+bug/1373865 | 11:16 |
| uvirtbot | Launchpad bug 1373865 in keystone "Refactor domain usage in test_backend" [Wishlist,New] | 11:16 |
| samuelmz | henrynash, actually I think we should stop skipping tests .. | 11:16 |
| henrynash | samuelmz: absolutely! | 11:17 |
| samuelmz | henrynash, take a look at lines 260-263 at https://review.openstack.org/#/c/123590/1/keystone/tests/test_backend_ldap.py | 11:18 |
| *** jasondotstar has joined #openstack-keystone | 11:20 | |
| henrynash | morganfainberg: fyi, I think we need to get this into RC1: https://review.openstack.org/#/c/123585/ | 11:34 |
| samuelmz | henrynash, I'd vote +2 if I could :p | 11:36 |
| henrynash | samuelmz: :-) | 11:38 |
| *** dims has joined #openstack-keystone | 11:41 | |
| *** dims has quit IRC | 11:46 | |
| *** henrynash has quit IRC | 11:55 | |
| *** alex_xu has quit IRC | 12:06 | |
| *** alex_xu has joined #openstack-keystone | 12:06 | |
| *** dims has joined #openstack-keystone | 12:07 | |
| *** amcrn has quit IRC | 12:10 | |
| *** soulxu_ has joined #openstack-keystone | 12:12 | |
| *** rodrigods_ has joined #openstack-keystone | 12:15 | |
| *** alex_xu has quit IRC | 12:15 | |
| *** rodrigods_ has quit IRC | 12:15 | |
| *** soulxu__ has joined #openstack-keystone | 12:18 | |
| *** soulxu_ has quit IRC | 12:21 | |
| *** soulxu_ has joined #openstack-keystone | 12:25 | |
| *** victsou is now known as I | 12:26 | |
| *** rushiagr is now known as rushiagr_away | 12:26 | |
| *** I is now known as victsou | 12:26 | |
| *** htruta has left #openstack-keystone | 12:28 | |
| *** rushiagr_away is now known as rushiagr | 12:28 | |
| *** soulxu__ has quit IRC | 12:29 | |
| *** yasu_ has quit IRC | 12:30 | |
| *** soulxu_ has quit IRC | 12:30 | |
| *** soulxu_ has joined #openstack-keystone | 12:31 | |
| *** soulxu__ has joined #openstack-keystone | 12:37 | |
| *** soulxu_ has quit IRC | 12:40 | |
| *** soulxu_ has joined #openstack-keystone | 12:42 | |
| *** soulxu__ has quit IRC | 12:45 | |
| thiagop | morganfainberg: Thanks for the doc links yesterday. It appears that my googles didn't help that much in finding something in our docs. I'll try to look more carefully in the future. | 12:49 |
| *** yasu_ has joined #openstack-keystone | 12:53 | |
| *** soulxu__ has joined #openstack-keystone | 12:58 | |
| *** diegows has quit IRC | 12:59 | |
| *** andreaf is now known as andreaf_ | 12:59 | |
| *** soulxu_ has quit IRC | 13:02 | |
| *** soulxu__ has quit IRC | 13:03 | |
| *** soulxu__ has joined #openstack-keystone | 13:04 | |
| *** richm has joined #openstack-keystone | 13:08 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:08 | |
| *** yasu_ has quit IRC | 13:09 | |
| *** marcoemorais has joined #openstack-keystone | 13:09 | |
| *** dhellmann has quit IRC | 13:10 | |
| *** soulxu_ has joined #openstack-keystone | 13:10 | |
| *** dhellmann has joined #openstack-keystone | 13:11 | |
| *** marcoemorais1 has joined #openstack-keystone | 13:11 | |
| *** openstackgerrit has joined #openstack-keystone | 13:12 | |
| *** openstackgerrit has quit IRC | 13:12 | |
| *** nkinder_ has quit IRC | 13:12 | |
| *** soulxu__ has quit IRC | 13:13 | |
| *** marcoemorais has quit IRC | 13:14 | |
| *** soulxu__ has joined #openstack-keystone | 13:20 | |
| *** soulxu_ has quit IRC | 13:23 | |
| *** soulxu_ has joined #openstack-keystone | 13:26 | |
| *** oomichi has quit IRC | 13:26 | |
| *** soulxu__ has quit IRC | 13:29 | |
| *** soulxu__ has joined #openstack-keystone | 13:32 | |
| *** soulxu_ has quit IRC | 13:35 | |
| *** soulxu_ has joined #openstack-keystone | 13:38 | |
| *** radez_g0n3 is now known as radez | 13:38 | |
| *** soulxu__ has quit IRC | 13:40 | |
| *** soulxu__ has joined #openstack-keystone | 13:43 | |
| *** diegows has joined #openstack-keystone | 13:45 | |
| *** soulxu_ has quit IRC | 13:47 | |
| *** soulxu_ has joined #openstack-keystone | 13:49 | |
| *** soulxu__ has quit IRC | 13:52 | |
| *** soulxu__ has joined #openstack-keystone | 13:55 | |
| *** joesavak has joined #openstack-keystone | 13:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 13:56 | |
| *** soulxu_ has quit IRC | 13:58 | |
| *** morgan_remote_ has joined #openstack-keystone | 13:59 | |
| *** radez is now known as radez_g0n3 | 13:59 | |
| *** soulxu_ has joined #openstack-keystone | 14:01 | |
| *** gokrokve has joined #openstack-keystone | 14:02 | |
| *** soulxu__ has quit IRC | 14:03 | |
| *** soulxu_ has quit IRC | 14:06 | |
| *** soulxu_ has joined #openstack-keystone | 14:06 | |
| *** nkinder_ has joined #openstack-keystone | 14:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:08 | |
| *** dims has quit IRC | 14:08 | |
| *** dims has joined #openstack-keystone | 14:09 | |
| *** soulxu__ has joined #openstack-keystone | 14:12 | |
| *** gokrokve has quit IRC | 14:14 | |
| *** gokrokve has joined #openstack-keystone | 14:14 | |
| *** openstackgerrit has joined #openstack-keystone | 14:15 | |
| *** soulxu_ has quit IRC | 14:15 | |
| *** stevemar has joined #openstack-keystone | 14:16 | |
| *** henrynash has joined #openstack-keystone | 14:17 | |
| *** bknudson has joined #openstack-keystone | 14:19 | |
| *** soulxu__ is now known as alex_xu | 14:20 | |
| henrynash | morganfainberg, dolphm: not sure how to add something to the RC1 blocker list… | 14:21 |
| *** david-lyle has joined #openstack-keystone | 14:24 | |
| lbragstad | henrynash: what review? | 14:25 |
| lbragstad | link? | 14:25 |
| henrynash | lbragstad: https://review.openstack.org/#/c/123585/ | 14:25 |
| *** david-ly_ has joined #openstack-keystone | 14:27 | |
| *** david-lyle has quit IRC | 14:29 | |
| bknudson | at some point we need to consider what gate tests are running for keystone changes. | 14:37 |
| bknudson | are keystone changes really going to break check-tempest-dsvm-neutron-heat-slow ? | 14:37 |
| *** henrynash has quit IRC | 14:37 | |
| bknudson | and, have we ever broken check-tempest-dsvm-neutron-full ? | 14:37 |
| dstanek | i think it will get there the next time the script runs | 14:38 |
| *** openstackgerrit has quit IRC | 14:40 | |
| *** openstackgerrit has joined #openstack-keystone | 14:41 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: New section for CLI examples in docs https://review.openstack.org/123969 | 14:41 |
| *** marcoemorais1 has quit IRC | 14:46 | |
| *** radez_g0n3 is now known as radez | 14:47 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update 'Configuring Services' documentation https://review.openstack.org/123933 | 14:47 |
| *** andreaf_ is now known as andreaf | 14:52 | |
| *** david-ly_ has quit IRC | 14:52 | |
| *** david-lyle has joined #openstack-keystone | 14:53 | |
| *** bdossant has joined #openstack-keystone | 14:56 | |
| *** joesavak has quit IRC | 14:57 | |
| *** joesavak has joined #openstack-keystone | 15:01 | |
| *** andreaf is now known as andreaf_ | 15:01 | |
| *** jsavak has joined #openstack-keystone | 15:09 | |
| *** henrynash has joined #openstack-keystone | 15:10 | |
| *** joesavak has quit IRC | 15:12 | |
| *** TemporalBeing has joined #openstack-keystone | 15:12 | |
| *** r-daneel has joined #openstack-keystone | 15:14 | |
| *** bdossant has quit IRC | 15:14 | |
| marekd | i have a function f(argument): do sth with argument; return new_argument | 15:16 |
| *** zzzeek has joined #openstack-keystone | 15:16 | |
| marekd | now i want to write a test using mock.patch where my f() will behave like def f(argument): return argument | 15:16 |
| *** ericpeterson has joined #openstack-keystone | 15:16 | |
| marekd | how do i make mock simply return what was received in the function arg? | 15:16 |
| *** ericpeterson has left #openstack-keystone | 15:16 | |
| dstanek | marekd: how about "patch('thing.to.patch.f', lambda a: a)"? | 15:17 |
| morganfainberg | marekd, you can use mock.patch.object and provide a new function to replace the old one | 15:17 |
| morganfainberg | dstanek, ++ | 15:17 |
| dstanek | i'd have to see the code to know the exact thing to use, but when patching you can provide the thing mock will use to patch | 15:18 |
| *** bdossant has joined #openstack-keystone | 15:19 | |
| *** bdossant has quit IRC | 15:20 | |
| marekd | dstanek: https://github.com/openstack/keystone/blob/master/keystone/tests/test_v3_federation.py#L1682so this is what i have now, and what i need is to patch _sign_assertion so it simply returns what it gets. | 15:20 |
| bknudson | mod_wsgi isn't going to invoke bash is it? | 15:21 |
| bknudson | I wouldn't think so. | 15:21 |
| dstanek | bknudson: ? | 15:22 |
| marekd | dstanek: bash vuln. | 15:22 |
| bknudson | marekd: you should be able to use side_effect: lambda x: x | 15:22 |
| marekd | bknudson: so: with ock.patch.object(keystone_idp, '_sign_assertion', side_effect=lambda x:x): (...) ?? | 15:24 |
| dstanek | bknudson: we use invoke subprocesses, but I'm not sure if we use the shell | 15:25 |
| bknudson | marekd: http://www.voidspace.org.uk/python/mock/mock.html#mock.Mock.side_effect | 15:25 |
| *** joesavak has joined #openstack-keystone | 15:26 | |
| bknudson | dstanek: y, if we invoke subprocess we could be vulnerable, but I believe the vuln also requires accepting env var values from the user. I don't think we do that when signing tokens, etc. | 15:26 |
| *** _cjones_ has joined #openstack-keystone | 15:26 | |
| bknudson | marekd: so, yes, your example looks like it would do it to me. | 15:26 |
| marekd | bknudson: it does, thanks! | 15:27 |
| *** _cjones_ has quit IRC | 15:27 | |
| *** _cjones_ has joined #openstack-keystone | 15:28 | |
| *** jsavak has quit IRC | 15:28 | |
| *** andreaf has joined #openstack-keystone | 15:30 | |
| *** _cjones_ has quit IRC | 15:32 | |
| *** rwsu has quit IRC | 15:33 | |
| *** diegows has quit IRC | 15:37 | |
| *** andreaf has quit IRC | 15:37 | |
| *** andreaf has joined #openstack-keystone | 15:38 | |
| nkinder_ | dstanek, bknudson: subprocess.Popen() will inherit the environment of the parent process unless the 'env' arg is set | 15:41 |
| nkinder_ | I don't see anywhere that we pass a different env in | 15:41 |
| dstanek | nkinder_: yeah, i couldn't either | 15:42 |
| *** wwriverrat has joined #openstack-keystone | 15:42 | |
| bknudson | nkinder_: y, I can't think of any reason we would unless the application we're calling used env vars rather than command-line args. | 15:42 |
| *** k4n0 has quit IRC | 15:43 | |
| *** rwsu has joined #openstack-keystone | 15:45 | |
| *** cjellick has joined #openstack-keystone | 15:47 | |
| *** bdossant has joined #openstack-keystone | 15:51 | |
| *** gokrokve_ has joined #openstack-keystone | 15:52 | |
| *** gokrokve has quit IRC | 15:55 | |
| *** marcoemorais has joined #openstack-keystone | 15:55 | |
| *** diegows has joined #openstack-keystone | 15:56 | |
| *** gokrokve_ has quit IRC | 15:56 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Add version attribute to the SAML2 Assertion object. https://review.openstack.org/124092 | 15:58 |
| *** bdossant has quit IRC | 15:58 | |
| morganfainberg | marekd, how important is that change? ^ | 15:59 |
| morganfainberg | marekd, as in.. does it break things badly if it's not there? | 15:59 |
| marekd | morganfainberg: sadly yes. | 15:59 |
| marekd | my SP will not even talk to me. | 15:59 |
| morganfainberg | ugh | 15:59 |
| *** wwriverrat has left #openstack-keystone | 16:00 | |
| *** lufix has quit IRC | 16:00 | |
| *** ajayaa has quit IRC | 16:03 | |
| stevemar | marekd, thanks for reporting it | 16:05 |
| marekd | stevemar: sure, no problem. | 16:05 |
| marekd | stevemar: regarding your comment: why would you think issue_instant would become redundant? | 16:05 |
| morganfainberg | marekd, i think he meant the next line down | 16:06 |
| morganfainberg | version 2.0 | 16:06 |
| stevemar | marekd, just making sure | 16:06 |
| morganfainberg | ? | 16:06 |
| dstanek | marekd: was there a change in something that made our code not work? | 16:06 |
| marekd | dstanek: yes, in k2k | 16:06 |
| marekd | https://review.openstack.org/124092 | 16:06 |
| marekd | dstanek: ^^ | 16:06 |
| morganfainberg | dstanek, part of the problem of not having a real mod_shib gate check. | 16:07 |
| marekd | morganfainberg: ++ | 16:07 |
| dstanek | hmm...so this was never working? | 16:07 |
| morganfainberg | dstanek, looks like it couldn't have been | 16:07 |
| morganfainberg | not that our code was wrong, just mod_shib would reject it | 16:08 |
| *** ukalifon has joined #openstack-keystone | 16:08 | |
| morganfainberg | in Kilo we definitely need real tests for this stuff. | 16:08 |
| dstanek | morganfainberg: k. i was just worried that we were testing on mod_shib and a new version (or something) changed and that caused this to change | 16:09 |
| marekd | morganfainberg: that's what I added to the Kilo etherpad.. | 16:09 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to use openstackclient https://review.openstack.org/124095 | 16:09 |
| morganfainberg | marekd, ++ yeah on the long list of CI stuff we need to do | 16:09 |
| morganfainberg | dstanek, yeah if we had been gating on mod_shib i'd have been shocked and wondering how things broke suddenly. | 16:10 |
| *** morgan_remote_ has quit IRC | 16:10 | |
| marekd | morganfainberg: i have some floating ideas about that, but i don't know ye how to add such testsuites (both technically and politicaly) so they are in jenkins. But I also might be allowed to work on it next cycle. | 16:11 |
| dstanek | i won't lie. i'm a little frightened that this code has never been used with mod_shib | 16:11 |
| *** rushiagr is now known as rushiagr_away | 16:11 | |
| morganfainberg | marekd, this is something we can probably stand up with the functional testing and an apache deployed keystone | 16:11 |
| *** lsmola has quit IRC | 16:12 | |
| marekd | morganfainberg: i will bug you somewhere around summit about that. | 16:12 |
| morganfainberg | marekd, sounds good. and with that fix, can you confirm that k2k is working as expected? | 16:12 |
| marekd | morganfainberg: no, i can't. I have another bug that i found today, also one liner. | 16:13 |
| morganfainberg | this worries me. | 16:14 |
| morganfainberg | a lot. | 16:14 |
| stevemar | what's the bug? | 16:14 |
| *** Dafna has quit IRC | 16:14 | |
| marekd | stevemar: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L265 this should be rather CONF.saml.entity_id | 16:16 |
| marekd | otherwise entity_id value from WSGI might be something like https://<IPv4>:5000/blah/bla | 16:16 |
| marekd | and entityID from assertion in metadata must be equal. | 16:17 |
| stevemar | marekd, yeah, good call. | 16:18 |
| stevemar | marekd, yeah, i was using that one before the config option was around, we should use the config option instead of the public url | 16:19 |
| morganfainberg | dstanek, marekd, stevemar, does it make sense to pull the K2K stuff and re-land it in Kilo when we're not under the wire and can get real drive time on it? | 16:22 |
| morganfainberg | dstanek, marekd, stevemar, or at the least mark it as "expirimental enable at your own risk"? | 16:22 |
| *** _cjones_ has joined #openstack-keystone | 16:23 | |
| morganfainberg | i don't particularly want broken code lingering around in keystone generating bug reports, but this feature is a good feature to have as well. | 16:23 |
| dstanek | morganfainberg: i'm think experimental would be good enough because we haven't successfully run this yet - can we just remove it from the docs and leave the code in? | 16:23 |
| stevemar | morganfainberg, et all, i say keep and mark experimental - as it has very few branches to other code | 16:24 |
| morganfainberg | dstanek, I'd be ok with that or at least toss the big ..warning blocks like we had for the multi-id backend stuff | 16:24 |
| stevemar | it's just the router | 16:24 |
| stevemar | morganfainberg, definitely big warning blocks | 16:24 |
| morganfainberg | stevemar, can you propose a doc fix for that please so we can get that in. | 16:24 |
| stevemar | morganfainberg, okie | 16:25 |
| marekd | morganfainberg: stevemar dstanek ++ | 16:25 |
| marekd | ok for experimental. | 16:25 |
| morganfainberg | marekd, cool. | 16:26 |
| *** packet has joined #openstack-keystone | 16:26 | |
| marekd | morganfainberg: so, assuming this would become experimental as from now I should still file bugs (in case i find something) or fix it on my own branch and wait for K-1 ? | 16:26 |
| morganfainberg | marekd, i've tagged the version 2.0 bug as RC1. Yeah, that would be good. | 16:26 |
| morganfainberg | if it's a small number of fixes we can look at backporting to Juno if they end up being invasive we might only get them for Kilo and beyond. | 16:27 |
| morganfainberg | dstanek, any concerns about holding https://review.openstack.org/#/c/88207/ till K1? | 16:29 |
| morganfainberg | i'm thinking thats a nice to have but nothing required. | 16:29 |
| dstanek | not from me - it's just a developer thing | 16:29 |
| morganfainberg | k | 16:29 |
| morganfainberg | dstanek, stevemar, i'm approving https://review.openstack.org/#/c/123938/ since it would be nice to have up-to-date docs if it can land. | 16:31 |
| *** marekd is now known as marekd|away | 16:31 | |
| stevemar | morganfainberg, theres a bunch more | 16:31 |
| stevemar | but they are all non-critical | 16:31 |
| morganfainberg | stevemar, a bunch more as in... easier to wait for K? | 16:31 |
| *** aix has quit IRC | 16:31 | |
| stevemar | as in https://review.openstack.org/#/c/123960/ and https://review.openstack.org/#/c/123933/ and https://review.openstack.org/#/c/123969/ | 16:32 |
| stevemar | but they all change docs.openstack.org/developer/keystone/ so they can go in after RC | 16:33 |
| morganfainberg | right | 16:33 |
| stevemar | when the K branch opens | 16:33 |
| *** openstackgerrit has quit IRC | 16:33 | |
| *** gyee has joined #openstack-keystone | 16:34 | |
| *** edmondsw has joined #openstack-keystone | 16:35 | |
| *** packet has quit IRC | 16:35 | |
| stevemar | dstanek, marekd|away morganfainberg https://review.openstack.org/#/c/124107/ | 16:36 |
| henrynash | stevemar: quick question on those docs…the link to teh cli_eamples….that should .html as you have it, right? | 16:36 |
| stevemar | henrynash, yep, .html is correct there | 16:36 |
| henrynash | stevemar: ok | 16:36 |
| *** packet has joined #openstack-keystone | 16:36 | |
| morganfainberg | stevemar, that looks good to me. | 16:36 |
| henrynash | stevemar: nice job on thise….and GREAT to get openstack client examples!!!! | 16:37 |
| stevemar | henrynash, click on the gate-keystone-docs job link to check out the generated docs :) | 16:37 |
| henrynash | stevemar: ah yes, I keep forgetting where to find that…duh... | 16:38 |
| stevemar | henrynash, i'm on a mission to eliminate the word tenant from our docs - once and for all | 16:40 |
| henrynash | stevemar: “tenants…just say no, you know it makes sense” | 16:40 |
| *** TemporalBeing has left #openstack-keystone | 16:42 | |
| stevemar | henrynash, i wanted to put the openstackclient examples in a separate patch, in case the team wasn't too keen on changing it all over | 16:44 |
| morganfainberg | stevemar, can we add something about feedback for the IdP in the message? | 16:44 |
| morganfainberg | stevemar, we had this message for rhe per-domain stuff: This feature is experimental and unsupported in Havana (with several known issues that will not be fixed). Feedback welcome for Icehouse! | 16:44 |
| morganfainberg | you don't need to add the "known issues". | 16:44 |
| morganfainberg | but maybe just "Feedback welcome on this feature." | 16:45 |
| morganfainberg | stevemar, if you think that is overkill i'm fine with it as is | 16:45 |
| *** gokrokve has joined #openstack-keystone | 16:45 | |
| stevemar | morganfainberg, i'll change it super quickly | 16:46 |
| morganfainberg | stevemar, ++ | 16:46 |
| stevemar | morganfainberg, henrynash new version of experimental warning is up | 16:47 |
| *** rushiagr_away is now known as rushiagr | 16:48 | |
| stevemar | afk for a bit | 16:48 |
| *** BAKfr has quit IRC | 16:49 | |
| *** bdossant has joined #openstack-keystone | 16:50 | |
| *** bdossant_ has joined #openstack-keystone | 16:51 | |
| morganfainberg | henrynash, this look good to you? https://review.openstack.org/#/c/124107/ | 16:52 |
| *** openstackgerrit has joined #openstack-keystone | 16:52 | |
| henrynash | morganfainberg: yep, +2/A's | 16:53 |
| *** ukalifon has quit IRC | 16:53 | |
| *** bdossant has quit IRC | 16:54 | |
| *** arunkant has joined #openstack-keystone | 16:55 | |
| *** diegows has quit IRC | 17:02 | |
| *** packet has left #openstack-keystone | 17:03 | |
| *** packet has joined #openstack-keystone | 17:03 | |
| *** lufix has joined #openstack-keystone | 17:06 | |
| *** _cjones_ has quit IRC | 17:09 | |
| *** _cjones_ has joined #openstack-keystone | 17:09 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 17:11 |
| *** harlowja_away is now known as harlowja | 17:12 | |
| *** _cjones_ has quit IRC | 17:14 | |
| *** _cjones_ has joined #openstack-keystone | 17:16 | |
| *** lufix has quit IRC | 17:17 | |
| *** swartulv has quit IRC | 17:23 | |
| *** diegows has joined #openstack-keystone | 17:24 | |
| *** swartulv has joined #openstack-keystone | 17:29 | |
| *** openstackgerrit has quit IRC | 17:33 | |
| *** afazekas has quit IRC | 17:38 | |
| *** openstackgerrit has joined #openstack-keystone | 17:39 | |
| *** morgan_remote_ has joined #openstack-keystone | 17:40 | |
| dims | dolphm: other keystone-cores... we were looking at ./openstack/common/crypto/utils.py over in oslo-incubator and wondering if anyone needs or uses it | 17:59 |
| morganfainberg | dimsm, hm | 18:00 |
| morganfainberg | dims, not sure. | 18:00 |
| openstackgerrit | A change was merged to openstack/keystone: Fix a spelling mistake in keystone/common/utils.py https://review.openstack.org/123857 | 18:01 |
| morganfainberg | dims, keystone, keystoneclient, and keystonemiddleware don't use it | 18:01 |
| dims | morganfainberg: k. worst case it will still be in oslo-incubator juno stable branch if anyone needs it for later, we may just not turn it into a library | 18:01 |
| dims | morganfainberg: y i checked the usual suspects :) | 18:01 |
| dims | thanks for looking! | 18:01 |
| morganfainberg | ah, sec | 18:02 |
| morganfainberg | did we conver the memcache_crypt to use something else? | 18:02 |
| morganfainberg | i guess we did | 18:02 |
| morganfainberg | we use hmac directly | 18:02 |
| morganfainberg | and Crypto.Cipher | 18:02 |
| morganfainberg | ok | 18:02 |
| morganfainberg | yeah i think we're not using it for sure then | 18:03 |
| dims | cool | 18:03 |
| *** jasondotstar has quit IRC | 18:04 | |
| *** Daviey has quit IRC | 18:07 | |
| *** marcoemorais has quit IRC | 18:20 | |
| *** marcoemorais has joined #openstack-keystone | 18:20 | |
| *** marcoemorais has quit IRC | 18:20 | |
| *** rushiagr is now known as rushiagr_away | 18:20 | |
| *** Daviey has joined #openstack-keystone | 18:21 | |
| *** marcoemorais has joined #openstack-keystone | 18:21 | |
| stevemar | henrynash, great suggestions for the docs, i can't believe i forgot to actually update the configuration.rst portion hehe | 18:41 |
| *** mikedillion has joined #openstack-keystone | 18:48 | |
| *** topol has joined #openstack-keystone | 18:54 | |
| *** andreaf has quit IRC | 18:59 | |
| *** andreaf has joined #openstack-keystone | 19:00 | |
| *** marcoemorais has quit IRC | 19:01 | |
| *** marcoemorais has joined #openstack-keystone | 19:01 | |
| *** marcoemorais has quit IRC | 19:02 | |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:04 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| *** amcrn has joined #openstack-keystone | 19:17 | |
| *** soulxu_ has joined #openstack-keystone | 19:25 | |
| *** alex_xu has quit IRC | 19:28 | |
| *** thedodd has joined #openstack-keystone | 19:34 | |
| *** nkinder_ has quit IRC | 19:34 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:39 | |
| *** marcoemorais has quit IRC | 19:41 | |
| *** zzzeek has quit IRC | 19:42 | |
| *** zzzeek has joined #openstack-keystone | 19:45 | |
| *** _cjones_ has quit IRC | 19:46 | |
| *** _cjones_ has joined #openstack-keystone | 19:46 | |
| *** gyee has quit IRC | 19:50 | |
| *** morgan_remote_ has quit IRC | 19:50 | |
| *** _cjones_ has quit IRC | 19:51 | |
| *** gordc has quit IRC | 19:56 | |
| *** gordc has joined #openstack-keystone | 19:57 | |
| *** marcoemorais1 has quit IRC | 19:59 | |
| *** marcoemorais has joined #openstack-keystone | 19:59 | |
| *** marcoemorais has quit IRC | 19:59 | |
| *** marcoemorais has joined #openstack-keystone | 20:00 | |
| *** marcoemorais has quit IRC | 20:00 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** marcoemorais has quit IRC | 20:02 | |
| *** marcoemorais has joined #openstack-keystone | 20:02 | |
| *** marcoemorais has quit IRC | 20:07 | |
| *** radez is now known as radez_g0n3 | 20:08 | |
| *** radez_g0n3 is now known as radez | 20:10 | |
| *** radez is now known as radez_g0n3 | 20:11 | |
| *** jdandrea has joined #openstack-keystone | 20:13 | |
| *** mikedillion has quit IRC | 20:15 | |
| *** _cjones_ has joined #openstack-keystone | 20:17 | |
| *** andreaf has quit IRC | 20:23 | |
| *** andreaf has joined #openstack-keystone | 20:23 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Set issuer value to CONF.saml.idp_entity_id. https://review.openstack.org/124176 | 20:24 |
| *** dhellmann is now known as dhellmann_ | 20:29 | |
| *** edmondsw has quit IRC | 20:31 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 20:33 | |
| *** david-lyle has quit IRC | 20:37 | |
| *** _cjones_ has quit IRC | 20:38 | |
| *** _cjones_ has joined #openstack-keystone | 20:38 | |
| *** gyee has joined #openstack-keystone | 20:52 | |
| *** HenryG has quit IRC | 20:53 | |
| *** nkinder_ has joined #openstack-keystone | 20:53 | |
| *** thedodd has quit IRC | 20:54 | |
| *** gyee has quit IRC | 20:54 | |
| *** gokrokve has quit IRC | 20:54 | |
| *** thedodd has joined #openstack-keystone | 20:54 | |
| *** gokrokve has joined #openstack-keystone | 20:54 | |
| *** thedodd has quit IRC | 20:55 | |
| *** thedodd has joined #openstack-keystone | 20:56 | |
| *** thedodd has quit IRC | 20:56 | |
| *** thedodd has joined #openstack-keystone | 20:56 | |
| *** comstud has quit IRC | 20:56 | |
| *** thedodd has quit IRC | 21:00 | |
| *** thedodd has joined #openstack-keystone | 21:00 | |
| *** gyee has joined #openstack-keystone | 21:00 | |
| *** thedodd has quit IRC | 21:01 | |
| *** thedodd has joined #openstack-keystone | 21:06 | |
| *** david-lyle has joined #openstack-keystone | 21:06 | |
| *** david-ly_ has joined #openstack-keystone | 21:08 | |
| *** david-lyle has quit IRC | 21:11 | |
| *** _cjones_ has quit IRC | 21:14 | |
| *** _cjones_ has joined #openstack-keystone | 21:15 | |
| *** boltR has joined #openstack-keystone | 21:18 | |
| *** _cjones_ has quit IRC | 21:18 | |
| *** _cjones_ has joined #openstack-keystone | 21:18 | |
| boltR | hello, if I wanted single sign on for horizon, I just need to configure keystone to do the mappings right? | 21:19 |
| boltR | there doesn't need to be anything done on the Horizon side other than using the keystone server I configured? | 21:19 |
| *** david-ly_ has quit IRC | 21:23 | |
| *** dims has quit IRC | 21:41 | |
| *** dims has joined #openstack-keystone | 21:42 | |
| *** dims has quit IRC | 21:46 | |
| *** packet has quit IRC | 21:55 | |
| *** rkofman has quit IRC | 21:56 | |
| *** rkofman has joined #openstack-keystone | 21:57 | |
| *** joesavak has quit IRC | 21:59 | |
| *** gordc has quit IRC | 22:04 | |
| dolphm | ayoung: stevemar: marekd|away: ^ | 22:08 |
| dolphm | boltR: the short answer is that horizon is not quite there yet :( those mentioned above can fill you in on the details better than i if you'd like to contribute on the horizon side | 22:09 |
| stevemar | dolphm, what am i looking at? | 22:10 |
| dolphm | stevemar: an SSO question from boltR | 22:11 |
| *** gokrokve has quit IRC | 22:12 | |
| stevemar | boltR as dolphm suggests SSO isn't *quite* there yet | 22:12 |
| *** morgan_remote_ has joined #openstack-keystone | 22:12 | |
| boltR | stevemar: dolphm thanks for responding | 22:13 |
| *** gokrokve has joined #openstack-keystone | 22:13 | |
| boltR | i've been looking at some emails in the openstack-dev list | 22:13 |
| boltR | and see people having been suggesting different approaches | 22:13 |
| stevemar | boltR, https://www.mail-archive.com/openstack-dev@lists.openstack.org/msg35326.html | 22:14 |
| stevemar | boltR, yeah, that's kind of been the issue | 22:14 |
| stevemar | boltR, that most recent suggestion on the mailing list makes the most sense to me, at the moment | 22:15 |
| *** marcoemorais has joined #openstack-keystone | 22:15 | |
| *** gokrokve has quit IRC | 22:18 | |
| boltR | stevemar: thanks for the link | 22:19 |
| stevemar | boltR, if you are familiar with SSO technologies let us know :) respond to the mailing list if possible | 22:19 |
| stevemar | boltR, we're at a lack of SSO experts around here | 22:19 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add placeholders for reserved migrations https://review.openstack.org/124204 | 22:25 |
| *** joesavak has joined #openstack-keystone | 22:26 | |
| *** thedodd has quit IRC | 22:30 | |
| *** bknudson has quit IRC | 22:31 | |
| morganfainberg | dolphm, you're alive! :) | 22:33 |
| dolphm | morganfainberg: a bit! | 22:33 |
| morganfainberg | dolphm, hehe | 22:33 |
| dolphm | morganfainberg: been trying to go through the last couple weeks of bug activity, but it's really boring when everything is already taken care of :P | 22:34 |
| morganfainberg | dolphm, at least it's the right kind of boring ;) | 22:35 |
| * morganfainberg glares at the gate queue | 22:35 | |
| *** andreaf has quit IRC | 22:38 | |
| *** andreaf has joined #openstack-keystone | 22:39 | |
| dolphm | morganfainberg: the gate queue is the wrong kind of boring | 22:40 |
| morganfainberg | dolphm, yes | 22:40 |
| morganfainberg | dolphm, oh ooh something merged! i saw it move... | 22:40 |
| morganfainberg | or.. failed to merge | 22:40 |
| morganfainberg | dolphm, why does this list not go down faster https://gist.github.com/dolph/651c6a1748f69637abd0 :( | 22:41 |
| *** gokrokve has joined #openstack-keystone | 22:42 | |
| dolphm | since when does centos use LP? | 22:43 |
| dolphm | https://bugs.launchpad.net/centos/+bug/1362039 | 22:43 |
| uvirtbot | Launchpad bug 1362039 in centos "Cannot Upgrade from Keystone Essex to Keystone Icehouse" [Undecided,New] | 22:43 |
| morganfainberg | dolphm, lol | 22:43 |
| morganfainberg | dolphm, no idea. | 22:43 |
| *** gokrokve_ has joined #openstack-keystone | 22:44 | |
| *** gokrokve has quit IRC | 22:45 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 22:47 | |
| *** gokrokve_ has quit IRC | 22:50 | |
| boltR | stevemar: i'm kind of curious, why are people suggesting to use AJAX/CORS to do the token exchange? | 22:51 |
| boltR | versus redirects | 22:51 |
| *** soulxu__ has joined #openstack-keystone | 22:54 | |
| stevemar | boltR, not sure tbh... | 22:57 |
| *** soulxu_ has quit IRC | 22:57 | |
| *** HenryG has joined #openstack-keystone | 22:59 | |
| *** joesavak has quit IRC | 23:01 | |
| *** jorge_munoz has quit IRC | 23:02 | |
| *** HenryG has quit IRC | 23:04 | |
| *** joesavak has joined #openstack-keystone | 23:05 | |
| *** gokrokve has joined #openstack-keystone | 23:06 | |
| *** HenryG has joined #openstack-keystone | 23:07 | |
| *** marcoemorais has quit IRC | 23:10 | |
| *** marcoemorais has joined #openstack-keystone | 23:10 | |
| *** marcoemorais has quit IRC | 23:10 | |
| *** marcoemorais has joined #openstack-keystone | 23:11 | |
| *** marcoemorais has quit IRC | 23:11 | |
| *** marcoemorais has joined #openstack-keystone | 23:11 | |
| *** marcoemorais has quit IRC | 23:17 | |
| *** marcoemorais has joined #openstack-keystone | 23:17 | |
| *** gyee has quit IRC | 23:21 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:24 | |
| *** gyee has joined #openstack-keystone | 23:25 | |
| *** _cjones_ has quit IRC | 23:27 | |
| *** _cjones_ has joined #openstack-keystone | 23:27 | |
| morganfainberg | stevemar, ping re: https://bugs.launchpad.net/keystone/+bug/1371620 | 23:28 |
| uvirtbot | Launchpad bug 1371620 in keystone "Setting up database schema with db_sync fails with OperationalError: (OperationalError) database is locked u'DELETE FROM user_project_metadata' ()" [Undecided,New] | 23:28 |
| morganfainberg | stevemar, was your comment here a "i've confirmed this" or just a "i see what the issue looks like"? | 23:29 |
| *** _cjones_ has quit IRC | 23:32 | |
| *** marcoemorais has quit IRC | 23:33 | |
| stevemar | morganfainberg, the latter | 23:33 |
| *** marcoemorais has joined #openstack-keystone | 23:33 | |
| *** marcoemorais has quit IRC | 23:33 | |
| stevemar | definitely not confirming it, just wanted to narrow down the stack trace | 23:33 |
| *** marcoemorais has joined #openstack-keystone | 23:33 | |
| morganfainberg | stevemar, ok i guess this means i need to stand up a 12.04 box and try to duplicate | 23:34 |
| morganfainberg | stevemar, i'd hate for that to be something we ship as a bug. | 23:34 |
| morganfainberg | but i don't think it is or we'd have a lot more complaining | 23:35 |
| *** dims has joined #openstack-keystone | 23:35 | |
| stevemar | morganfainberg, the author hasn't given back much info | 23:35 |
| morganfainberg | stevemar, well i'll take a pass at it tonight sometime after OpenStack LA meetup | 23:36 |
| morganfainberg | stevemar, worst scenario, i'll incomplete it. | 23:36 |
| morganfainberg | erm best. | 23:36 |
| morganfainberg | worst we have another blocker. but like i said i think we'd have a lot of complaining on that one | 23:36 |
| *** david-lyle has joined #openstack-keystone | 23:37 | |
| *** HenryG has quit IRC | 23:37 | |
| *** david-lyle has quit IRC | 23:38 | |
| *** bknudson has joined #openstack-keystone | 23:41 | |
| *** _cjones_ has joined #openstack-keystone | 23:41 | |
| *** boris-42 has quit IRC | 23:47 | |
| *** boris-42 has joined #openstack-keystone | 23:48 | |
| *** soulxu__ is now known as alex_xu | 23:50 | |
| *** gokrokve has quit IRC | 23:51 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 23:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 23:52 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 23:52 |
| *** joesavak has quit IRC | 23:53 | |
| boltR | I think I understand why AJAX is needed now | 23:57 |
| boltR | for doing a SAML exchange for horizon | 23:58 |
| boltR | i'm guessing it's because there's no way to redirect from keystone back to Horizon | 23:58 |
| *** bknudson1 has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!