| *** openstack has joined #openstack-keystone | 12:40 | |
| *** alex_xu has joined #openstack-keystone | 12:41 | |
| *** ayoung has joined #openstack-keystone | 12:50 | |
| *** saipandi has joined #openstack-keystone | 12:52 | |
| *** saipandi has quit IRC | 12:55 | |
| *** saipandi has joined #openstack-keystone | 12:56 | |
| *** nkinder has quit IRC | 13:12 | |
| *** joesavak has joined #openstack-keystone | 13:17 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 13:18 |
|---|---|---|
| *** samuelmz has joined #openstack-keystone | 13:21 | |
| *** alex_xu has quit IRC | 13:22 | |
| *** richm has joined #openstack-keystone | 13:26 | |
| *** andreaf is now known as andreaf_ | 13:26 | |
| *** joesavak has quit IRC | 13:28 | |
| *** bdossant has quit IRC | 13:28 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/endpoint_policy/routers.py#n34 this is the API I call to get policy for a given endpoint, right? | 13:28 |
| Daviey | ayoung: Can you give me a hand getting the kerberos plugin to work? I might be missunderstanding how stevedore works. | 13:30 |
| ayoung | Daviey, server side or client? | 13:31 |
| Daviey | client | 13:31 |
| ayoung | Daviey, you have the server working? | 13:31 |
| Daviey | Yes | 13:31 |
| ayoung | Cool | 13:31 |
| Daviey | ayoung: --os-auth-plugin $PLUGINNAME | 13:31 |
| ayoung | I've got a meeting/call supposed to start now, but I'll help you until Iget dragged away | 13:31 |
| Daviey | I thought that was all i needed to do | 13:32 |
| ayoung | Daviey, hmmm....maybe | 13:32 |
| Daviey | Great | 13:32 |
| ayoung | Daviey, lets start with Python code | 13:32 |
| Daviey | python-keystoneclient-kerberos is in my pythonpath | 13:32 |
| Daviey | OK | 13:32 |
| *** gokrokve has joined #openstack-keystone | 13:32 | |
| ayoung | I wasn't using stevedore, though, sooo | 13:32 |
| ayoung | Daviey, http://paste.openstack.org/show/116709/ | 13:34 |
| ayoung | which should basically be the code in the scripts directory | 13:34 |
| Daviey | Okay, let me try that | 13:34 |
| ayoung | Daviey, hmmm, meant to leave that code in the commit. I might make that a follow up commit. | 13:35 |
| *** bknudson has joined #openstack-keystone | 13:35 | |
| ayoung | Daviey, wanna know a secret? | 13:36 |
| ayoung | I don't understand Stevedor myself | 13:36 |
| *** gokrokve has quit IRC | 13:36 | |
| Daviey | ayoung: hah :) | 13:38 |
| Daviey | ayoung: So, I am seeing the sort of issue i'd expect.. | 13:38 |
| Daviey | Failing to import keystoneclient.contrib.auth.v3 import kerberos | 13:38 |
| Daviey | Are you putting the plugin directly in keystoneclient contrib/ ? | 13:38 |
| ayoung | Daviey, er...let me see, that might be older code | 13:40 |
| ayoung | Daviey, sorry, that was pre-split code | 13:41 |
| ayoung | edit the import to be | 13:41 |
| ayoung | from import keystoneclient_kerberos import kerberos | 13:41 |
| Daviey | right | 13:42 |
| gordc | Daviey: we use stevedore quite extensively in ceilometer if you want examples. | 13:42 |
| *** sigmavirus24 has joined #openstack-keystone | 13:43 | |
| ayoung | gordc, no, I want someone to hold my hand and show me how I should be doing it in the kerberos plugin | 13:44 |
| ayoung | gordc, and that way someone else reviews it, too :) | 13:44 |
| Daviey | gordc / ayoung: Well the thing that is confusing me, is that i expected it to provide runtime plugin infra.. right? | 13:44 |
| ayoung | https://review.openstack.org/#/c/123614/ | 13:44 |
| gordc | ayoung: lol you on your own then. enjoy your lonely walk | 13:44 |
| Daviey | But what i am currently seeing is a custom glue client? | 13:44 |
| ayoung | Daviey, baby steps | 13:44 |
| Daviey | ayoung: That is fair, i just assumed i was doing it wrong :) | 13:45 |
| ayoung | Daviey, but I is entirely likely I messed up the Stevedore setup | 13:45 |
| ayoung | Daviey, better to assume I am just faking it | 13:45 |
| Daviey | :) | 13:45 |
| ayoung | you'll have better odds than at the Roulette table, that is for certain | 13:45 |
| Daviey | The House always wins. | 13:46 |
| ayoung | Daviey, I think I might have dropped the entry points registration when I merged the code with the new repo project structure | 13:46 |
| *** radez_g0n3 is now known as radez | 13:46 | |
| Daviey | Ah | 13:46 |
| ayoung | they were in setup.cfg | 13:46 |
| ayoung | [entry_points] | 13:47 |
| ayoung | keystoneclient.auth.plugin = | 13:47 |
| gordc | at a highlevel, add an entry_point to a specific namespace | 13:47 |
| gordc | https://github.com/openstack/ceilometer/blob/master/setup.cfg#L231-L238 | 13:47 |
| ayoung | and then we need the updated path | 13:47 |
| ayoung | Daviey, I don't think we ever had them set up right | 13:48 |
| gordc | and then load driver when needed: https://github.com/openstack/ceilometer/blob/master/ceilometer/publisher/__init__.py#L27-L35 | 13:48 |
| ayoung | gordc, lets assume I already have keystoneclient.auth.plugin = defeinid from the core keystone client | 13:49 |
| ayoung | how do I add the kerberos plugin to it? | 13:49 |
| ayoung | if I do | 13:49 |
| ayoung | keystoneclient.auth.plugin = [newline] kerberos = keystoneclient-kerberos.kerberos | 13:49 |
| ayoung | will that append, or overwrite the old dictionary? | 13:50 |
| gordc | ayoung: you want to load a driver defined in another library? | 13:50 |
| ayoung | gordc, we have the stevedore infrastructure in Keystone client | 13:50 |
| morganfainberg | dolphm, https://bugs.launchpad.net/keystone/+bug/1375139 is the only bug i can see as potentially a blocker. | 13:50 |
| uvirtbot | Launchpad bug 1375139 in keystone "LDAP, non ascii characters in CN field couse error while switching projects" [Undecided,New] | 13:50 |
| ayoung | gordc, yes | 13:50 |
| morganfainberg | dolphm, of the four that are "new" state. | 13:51 |
| ayoung | gordc, we want to be able to add additional plugins from third party libraries | 13:51 |
| morganfainberg | dolphm, it also clearly shows me we need to get to a "real" ldap test so we can definitely rule some of these out/catch them. | 13:52 |
| *** joesavak has joined #openstack-keystone | 13:53 | |
| *** Dafna has joined #openstack-keystone | 13:53 | |
| gordc | ayoung: i assume you'd need to do something similar. | 13:53 |
| morganfainberg | dolphm, also, i put a +1 on https://review.openstack.org/#/c/124692/ consider that a +2 if all bugs look in order. | 13:54 |
| dolphm | morganfainberg: ++ | 13:54 |
| gordc | ayoung: we technically load in drivers from oslo.messaging in ceilometer: https://github.com/openstack/ceilometer/blob/master/setup.cfg#L290-L295 | 13:54 |
| ayoung | gordc, in the same namespace? | 13:54 |
| ayoung | gordc, the namespace is oslo.messaging.notify.drivers | 13:54 |
| ayoung | but you don't add any drivers to that | 13:54 |
| morganfainberg | dolphm, only a +1 so no one else feels the need to approve too quickly (not that I think they would, but it's early, pre-coffee, you know) | 13:55 |
| dolphm | morganfainberg: also, congratulations, sir! | 13:56 |
| morganfainberg | dolphm, hehe thanks. time for you to get a break from some of the craziness huh? :) | 13:56 |
| dolphm | morganfainberg: https://bugs.launchpad.net/keystone/+bug/1363047 ? | 13:57 |
| uvirtbot | Launchpad bug 1363047 in keystone "test_sql_upgrade and live_test not working for non-sqllite DBs" [High,In progress] | 13:57 |
| ayoung | morganfainberg, dolphm does that mean it is official? | 13:58 |
| *** topol has joined #openstack-keystone | 13:58 | |
| *** gokrokve has joined #openstack-keystone | 13:58 | |
| *** topol is now known as Guest26391 | 13:58 | |
| dolphm | ayoung: pretty much! technically we have a lame duck period where i finish juno, and morgan is free to start on kilo - but finger is on the button to open kilo already :) | 13:58 |
| *** Guest26391 has quit IRC | 13:59 | |
| ayoung | dolphm, is your day job changing? | 13:59 |
| dolphm | ayoung: PTL has been my day job, so i suppose yes :) | 13:59 |
| morganfainberg | dolphm, that one we need to fix, but it like is something we'll want to backport to juno. It requires knowing how to tear down the schema. I have two ideas on how to fix it, either drop tables (programatically) or redo the upgrade tests to not need a fullt downgrade (my preference) | 14:00 |
| dolphm | ayoung: i'll still try to help out in the same manner though | 14:00 |
| gordc | ayoung: hmm... do you have the patch/code where you're actually using stevedore? i'm not quite sure what you mean. | 14:00 |
| ayoung | gordc, nope, not yet. | 14:00 |
| *** nkinder has joined #openstack-keystone | 14:00 | |
| ayoung | Daviey was the one who made me realize I had not yet supported it in the Kerberos plugin | 14:00 |
| gordc | ayoung: ah i see... i'll try to take a look again later. got to run to a meeting | 14:01 |
| ayoung | NP | 14:01 |
| ayoung | thanks gordc | 14:01 |
| morganfainberg | dolphm, i think nova has the "right" approach for it, where you do each migrationa dn look for a pre/post migration check script instead of recreate, check, recreate. it's a large test restructure though. if we want to get that in we can try but not sure how long it'll take. | 14:02 |
| dolphm | morganfainberg: and the dev that wrote that for nova wrote it *twice* for keystone :( | 14:02 |
| dolphm | morganfainberg: we never merged it, mostly because it was a huge set of giant patches, and timing was poor for those kind of reviews | 14:02 |
| morganfainberg | ayoung, I'm *hoping* we get to keep dolphm doing lots of stuff, but freeing him up from some of the daily PTL tasks. | 14:02 |
| morganfainberg | dolphm, i think we can probably land it K1 here and have it ready for Juno-stable right away, which *should* be sufficient for most cases. | 14:03 |
| morganfainberg | dolphm, and K1 is kind of the time for that type of stuff. | 14:03 |
| ayoung | morganfainberg, he needs to break the "I'm free, time to disappear" tradition of former Keystone PTLs, but he's been pretty good at breaking tradition so far | 14:03 |
| dolphm | morganfainberg: yeah, this was H3, i think | 14:03 |
| dolphm | ayoung: ++ | 14:04 |
| morganfainberg | ayoung, ++ | 14:04 |
| ayoung | there was some talk of replacing SQLite with MySQL running on a memory based backing store | 14:04 |
| *** vhoward has joined #openstack-keystone | 14:06 | |
| *** lbragstad has joined #openstack-keystone | 14:06 | |
| morganfainberg | ayoung, i would like SQLite to go away as a valid target | 14:06 |
| ayoung | morganfainberg, yeah, that was part of the rational | 14:06 |
| ayoung | e | 14:07 |
| ayoung | morganfainberg, I think there is a way to run MySQL like that now...maybe a different backend, though | 14:07 |
| ayoung | "MEMORY tables are stored differently than InnoDB," | 14:08 |
| morganfainberg | ayoung, there are a few ways to do it with MySQL, but not sure how well they'd work for keystone. though with no tokens in the DB, they might be a good target in general (NDB can be cool). | 14:08 |
| morganfainberg | ayoung, and could be very fast compared to innodb. | 14:08 |
| ayoung | morganfainberg, only if it doesn't add yet another variable, like the isam/innodb split | 14:09 |
| morganfainberg | might need a lot of schema massaging though | 14:09 |
| ayoung | not worth it | 14:09 |
| ayoung | morganfainberg, I think I would rather create a shared memory file system and run the existing Mysql code on top of that | 14:09 |
| morganfainberg | the schema massaging to get there is (in my experience) generall good practice anyway | 14:09 |
| morganfainberg | but that work in itself might be enough | 14:10 |
| ayoung | s/shared memory/in memory/ | 14:10 |
| dolphm | ayoung: yeah, there was some odd behavior of mysql that made using MEMORY tables almost as undesirable as sqlite itself | 14:10 |
| morganfainberg | ayoung, though if we fix our tests to not require a full clean schema everytime a lot of the benefit of sqlite goes away | 14:11 |
| dolphm | wonder if postgres or someone else does it right | 14:11 |
| ayoung | dolphm, probably not. postgres et alles is more concerned with actually doing database stuff right | 14:11 |
| ayoung | more so than MySQL even | 14:11 |
| ayoung | but...let me look | 14:11 |
| dolphm | morganfainberg: given that https://bugs.launchpad.net/keystone/+bug/1375139 was in icehouse, and it feels like Medium impact to me, i don't think it should block rc1 | 14:12 |
| uvirtbot | Launchpad bug 1375139 in keystone "LDAP, non ascii characters in CN field couse error while switching projects" [Undecided,New] | 14:12 |
| dolphm | morganfainberg: i also went through our last 20 bugs or so, and nothing stood out | 14:12 |
| morganfainberg | dolphm, ++ works for me, i'm testing it now | 14:12 |
| dolphm | morganfainberg: testing what? | 14:13 |
| morganfainberg | dolphm, the LDAP one. | 14:13 |
| dolphm | morganfainberg: oh, you have a fix already? | 14:13 |
| morganfainberg | dolphm, but i agree that it is medium + non blocker | 14:13 |
| morganfainberg | dolphm, nah, confirming when/if/how it breaks | 14:13 |
| morganfainberg | in juno | 14:13 |
| dolphm | morganfainberg: ah | 14:13 |
| morganfainberg | dolphm, doesn't change my agreement with medium + non-blocker | 14:14 |
| dolphm | morganfainberg: well i was going to say, if you have a quick fix, we can get it in | 14:14 |
| ayoung | dolphm, morganfainberg, but http://stackoverflow.com/questions/9407442/optimise-postgresql-for-fast-testing looks like good reading | 14:15 |
| dolphm | ayoung: ooo | 14:15 |
| ayoung | dolphm, yeah. | 14:15 |
| ayoung | http://www.postgresql.org/docs/current/static/non-durability.html | 14:15 |
| *** doug-fish has joined #openstack-keystone | 14:16 | |
| ayoung | dolphm, so on my system, postgres data gets written to: | 14:16 |
| morganfainberg | ayoung, dolphm, i'm also *trying* to convince my buddy who is DB engineer extrodinaire to join OpenStack and help out (initially helping us get our schemas "better" | 14:16 |
| ayoung | ++ | 14:16 |
| morganfainberg | and by join openstack.. i do mean find a place on monty's team :) | 14:16 |
| ayoung | morganfainberg, I'm a Postgresql fan. Have been for a long while | 14:17 |
| dolphm | morganfainberg: :) | 14:17 |
| dolphm | i wish i was a db engineer extrodinaire | 14:18 |
| morganfainberg | dolphm, so do i! | 14:18 |
| dolphm | morganfainberg: db's are fun! | 14:18 |
| ayoung | dolphm, its a thankless job | 14:18 |
| ayoung | yeah, but DB mgmt jobs are not fun | 14:18 |
| dolphm | ayoung: i know, but i'd get a ton of satisfaction out of it, regardless | 14:18 |
| morganfainberg | ugh. | 14:19 |
| morganfainberg | haha wow, braaaaavo... http://paste.openstack.org/show/116722/ | 14:19 |
| morganfainberg | https://github.com/openstack-dev/devstack/blob/master/lib/ldap#L115-L119 yeah... thats ... special | 14:20 |
| ayoung | morganfainberg, did topol write that? | 14:20 |
| morganfainberg | we *really* don't ever test that do we. | 14:20 |
| *** foo_topol has joined #openstack-keystone | 14:20 | |
| ayoung | morganfainberg, is that devstacl? | 14:20 |
| morganfainberg | yes that is *actually* in devstack | 14:20 |
| ayoung | morganfainberg, foo_topol wrote that , at my instigation | 14:20 |
| ayoung | he got the LDAP code into devstack, but, no, we don't run it on install | 14:21 |
| morganfainberg | been broken since https://github.com/openstack-dev/devstack/commit/b9e25135c51ee29edbdf48d41e1cb637188cc358 | 14:21 |
| morganfainberg | wow. such broken | 14:21 |
| morganfainberg | so amaze | 14:21 |
| ayoung | morganfainberg, which was it broken on, Ubuntu? | 14:21 |
| morganfainberg | or longer. | 14:21 |
| morganfainberg | yeah ubuntu | 14:21 |
| morganfainberg | we just never instlal ldap in ubuntu | 14:21 |
| ayoung | Does that mean everyone is running Fedora that actually cares about LDAP? | 14:21 |
| morganfainberg | it's not possible | 14:21 |
| *** dolphm changes topic to "Currently gating to open development for Kilo https://review.openstack.org/#/c/124692/ | Release blockers https://gist.github.com/dolph/651c6a1748f69637abd0" | 14:22 | |
| *** stevemar has joined #openstack-keystone | 14:22 | |
| morganfainberg | ayoung, for devstack | 14:22 |
| dolphm | morganfainberg: ^ | 14:22 |
| morganfainberg | dolphm, woot! | 14:22 |
| morganfainberg | dolphm, so i put up the *wrong* link for the session proposals *doh*, will migrate stuff over to the correct one from ttx | 14:22 |
| morganfainberg | etherpad. | 14:22 |
| ayoung | morganfainberg, dolphm has left you some mighty big shoes to fill. I'd recommend wearing 2 sets of socks. | 14:22 |
| morganfainberg | ayoung, i bought 15 pairs extra, was figuring I'd wear all 15 to start and see how many i need tot ake off before they fit. | 14:23 |
| ayoung | Nice | 14:23 |
| ayoung | Good think wool ski socks, I'm sure | 14:23 |
| *** zzzeek has joined #openstack-keystone | 14:24 | |
| ayoung | OK, postgresql puts its data in /var/lib/pgsql/data | 14:24 |
| ayoung | On a new install I have nothing there | 14:24 |
| *** foo_topol is now known as topol_ | 14:24 | |
| ayoung | I'll mess around with the Postgresql tests and see if I can get it to work in memory | 14:24 |
| ayoung | and non-durable | 14:24 |
| morganfainberg | ayoung, cool | 14:25 |
| morganfainberg | ayoung, whatever we plan on doing, we'll do it for our conversion to the functional tests if possible (that is to say, for ditching SqlIte) | 14:25 |
| ayoung | morganfainberg, I think we might be able to start the postgresql one this way | 14:25 |
| ayoung | and then later switch the unit tests to do the same thing | 14:25 |
| *** topol_ is now known as topol | 14:26 | |
| topol | omg I had to work so hard to be known as topol | 14:26 |
| *** dstanek has joined #openstack-keystone | 14:26 | |
| morganfainberg | ayoung, well we don't test *anything* against postgres except in tempest right now | 14:26 |
| doug-fish | Hi keystone friends. | 14:27 |
| doug-fish | I'm harassing/helping sambetts in Horizon. He'd like to make some of our user settings actually persist on a per user basis. | 14:27 |
| doug-fish | I'm afraid his current approach might cause problems https://review.openstack.org/#/c/118334/ | 14:27 |
| doug-fish | Does keystone have any support for unstructured metadata on the user that could store this sort of thing? something like glace image properties except for users? | 14:27 |
| lbragstad | doug-fish: some of the Keystone resources allow for additional attributes to be passed on creation | 14:28 |
| *** sigmavirus24 has left #openstack-keystone | 14:28 | |
| ayoung | lbragstad, don't encourage that! | 14:29 |
| lbragstad | and if you're using an SQL backend driver for identity, those additional attributes would be stored in an 'extras' column | 14:29 |
| doug-fish | lbragstad: cool! I couldn't figure out which API | 14:29 |
| ayoung | doug-fish, no...its impossible | 14:29 |
| ayoung | don't even ask! | 14:29 |
| lbragstad | doug-fish: but forget I said that | 14:29 |
| doug-fish | lol | 14:29 |
| ayoung | heh | 14:29 |
| lbragstad | we want that to go away | 14:29 |
| doug-fish | well if its a bad idea I don't want to | 14:29 |
| ayoung | doug-fish, seriously, Horizon<->keystone is a tricky relationship | 14:29 |
| doug-fish | Are you suggesting I shouldn't call you "friends"? | 14:30 |
| ayoung | doug-fish, I would not actually assume that Horizon has write access to the user data | 14:30 |
| doug-fish | ah sure | 14:30 |
| ayoung | if it is in LDAP, which is the norm, you will not | 14:30 |
| doug-fish | that's reasonable | 14:30 |
| doug-fish | so using keystone to store this really isn't viable... at least not if its going to be updated from Horizon. | 14:30 |
| ayoung | doug-fish, it puts Horizon in a tricky position | 14:30 |
| ayoung | you have no guaranteed datastore per users | 14:31 |
| *** aix has quit IRC | 14:31 | |
| ayoung | cookies are your best bet, but those are not shared across users | 14:31 |
| ayoung | er devices | 14:31 |
| morganfainberg | doug-fish, correct, it is more or less not guaranteed nor guaranteed to be available for write. | 14:31 |
| doug-fish | ayoung: right,a nd they are shared across users in shared computer scenarios | 14:31 |
| morganfainberg | ayoung, doug-fish, sadly this is why most "web apps" use DBs for user prefs. | 14:31 |
| ayoung | doug-fish, if Horizon wants this data, Horizon needs a Database | 14:31 |
| ayoung | you really can't offload that requirement any more | 14:32 |
| doug-fish | awww | 14:32 |
| ayoung | I would not say that you should have a database, though | 14:32 |
| doug-fish | understood | 14:32 |
| ayoung | but, maybe we could work out something with swift? | 14:32 |
| doug-fish | oh that's an interesting idea | 14:32 |
| ayoung | doug-fish, understand, I want Horizon to become completely stateless anyway | 14:32 |
| morganfainberg | ooh swift is a cool idea. | 14:32 |
| ayoung | nothing more than static HTML and javascript, so fetching preferences from a web url makes sense | 14:33 |
| *** rwsu has joined #openstack-keystone | 14:33 | |
| ayoung | and then the user would need to be able to store their preferences themself anyway | 14:33 |
| ayoung | doug-fish, lets assume all preferences could be of the form of css. | 14:33 |
| *** k4n0 has quit IRC | 14:34 | |
| morganfainberg | doug-fish, ayoung, i think it makes the most sense to just have a *way* (generic) in horizon to store user pref(s). Could be cookies, swift, db, etc. let the deployer pick the mechanism. | 14:34 |
| ayoung | Then in horizon's startup, you include the users custom css | 14:34 |
| ayoung | morganfainberg, needs to be Web accessable | 14:34 |
| *** sambetts has joined #openstack-keystone | 14:34 | |
| ayoung | DB is a deployment option, but not end user | 14:34 |
| doug-fish | right - I think we are talking about a pluggable user prefs backend | 14:35 |
| *** gokrokve_ has joined #openstack-keystone | 14:35 | |
| ayoung | doug-fish, I'd start by prototyping something with swift | 14:35 |
| doug-fish | ayoung: that's an interesting approach; it seems workable (custom js I think though, not css) | 14:35 |
| morganfainberg | ayoung, doug-fish, correct i'm saying make a pluggable backend that does $stuff$ in a generic way (i think django has a framework for that already) | 14:35 |
| ayoung | morganfainberg, NO...lets not do anything more that is Django specific | 14:36 |
| doug-fish | ayoung: I'm getting the impression you aren't a django fan? | 14:36 |
| ayoung | doug-fish, I like Django well enough | 14:36 |
| ayoung | I am not a server-side-scripting fan | 14:36 |
| *** gokrokve_ has quit IRC | 14:37 | |
| morganfainberg | ayoung, also weigh the benefit of not re-implementing. | 14:37 |
| *** gokrokve_ has joined #openstack-keystone | 14:37 | |
| ayoung | doug-fish, does it need to be full javascript? | 14:37 |
| doug-fish | ayoung:morganfainberg: I appreciate your thoughts on this. Certainly the swift approach is something to consider. | 14:37 |
| ayoung | CSS is a muchj safer option | 14:37 |
| *** afazekas has quit IRC | 14:37 | |
| ayoung | doug-fish, the stateless Horizon is coming | 14:37 |
| doug-fish | full javascript? no. I was actually thinking JSON. | 14:37 |
| ayoung | doug-fish, shoot for CSS | 14:37 |
| ayoung | ah, but you want stuff like | 14:38 |
| ayoung | default project? | 14:38 |
| *** topol is now known as topol_ | 14:38 | |
| doug-fish | maybe one day: right now preferences are only language, rows per page and time zone. | 14:38 |
| ayoung | OpenStack specific data, not just visual elements | 14:38 |
| *** topol_ is now known as topol | 14:38 | |
| doug-fish | right | 14:38 |
| *** gokrokve has quit IRC | 14:38 | |
| ayoung | doug-fish, language should come from the browser | 14:38 |
| ayoung | rows per page...ok | 14:38 |
| ayoung | time zone comes from the browser | 14:39 |
| *** saipandi has quit IRC | 14:39 | |
| *** john-davidge has joined #openstack-keystone | 14:39 | |
| doug-fish | ayoung: rather the timezone and langauge _could_ come from the browser. | 14:39 |
| doug-fish | but they don't today | 14:39 |
| ayoung | doug-fish, as I said *should* | 14:40 |
| ayoung | don't fight the standards | 14:40 |
| doug-fish | I overlooked that word | 14:40 |
| doug-fish | yep | 14:40 |
| *** topol has quit IRC | 14:40 | |
| ayoung | "I fought the standards and the standards won." | 14:40 |
| doug-fish | The Clash? | 14:40 |
| *** topol has joined #openstack-keystone | 14:40 | |
| ayoung | I thought is was Johnny Cash | 14:40 |
| doug-fish | hey you have your music and I have mine | 14:41 |
| doug-fish | I'm hearing the clash sing it. | 14:41 |
| ayoung | "Sonny Curtis of the Crickets " | 14:41 |
| ayoung | But I knew Cash had to have covered that one | 14:41 |
| * ayoung on youtube listening now | 14:41 | |
| sambetts | the user should be able to override the default language setting though, without changing their entire browser | 14:41 |
| ayoung | Ah Bobby Fuller version | 14:42 |
| sambetts | shouldn't they | 14:42 |
| sambetts | ? | 14:42 |
| doug-fish | sambetts: why? | 14:42 |
| ayoung | sambetts, hells no! | 14:42 |
| *** bradjones has joined #openstack-keystone | 14:43 | |
| ayoung | OK, the Clash Version is better | 14:43 |
| morganfainberg | sambetts, doug-fish, ayoung, the default should *absolutely* come from the browser. But it is largely valuable to allow users to select any language they want. | 14:44 |
| sambetts | morganfainberg: ++ | 14:44 |
| morganfainberg | sambetts, doug-fish, ayoung, just based on every web app / ux out there these days. | 14:44 |
| john-davidge | morganfainberg: That approach sounds sensible to me | 14:45 |
| ayoung | morganfainberg, if all your friends were jumping off a bridge...oh, wait, XKCD ruined that expression | 14:45 |
| morganfainberg | sambetts, doug-fish, ayoung, same thing with the TZ. | 14:45 |
| morganfainberg | i'd say even mor so TZ | 14:45 |
| ayoung | http://xkcd.com/1170/ | 14:46 |
| morganfainberg | why do i need to change my system timezone (if thats where the browser is getting data from) if all my work is in UTC, therefore i want horizon to show me stuff in UTC | 14:46 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use openstackclient examples in configuration documentation https://review.openstack.org/124270 | 14:46 |
| doug-fish | morganfainberg: generally Horizon converts from the local TZ to UTC | 14:46 |
| morganfainberg | doug-fish, sure i mean from a display perspective. | 14:47 |
| morganfainberg | if everything i run is specific to a timezone, let me pick the timezone. | 14:47 |
| doug-fish | oh okay | 14:47 |
| doug-fish | got it | 14:47 |
| morganfainberg | both of these are pretty far down the list of things i'd worry about implementing | 14:47 |
| morganfainberg | general user prefs (rows displayed, columns, etc) are more important | 14:48 |
| ayoung | morganfainberg, and if each Datacenter is in a different timezone? | 14:48 |
| ayoung | and different countires, and you routinely get on an airplane and visually inspect them? | 14:48 |
| ayoung | Yeah, lets customize the UI for that guy | 14:48 |
| doug-fish | wow the keystone channel is really lively! | 14:49 |
| morganfainberg | ayoung, i'd like you to meet the strawman argument | 14:49 |
| morganfainberg | ayoung, :) | 14:49 |
| dolphm | ayoung: doug-fish: it's actually by Sonny Curtis of the Crickets (?!) http://en.wikipedia.org/wiki/I_Fought_the_Law | 14:49 |
| ayoung | morganfainberg, I thought we burnt him in the middle of the desert? | 14:49 |
| ayoung | was that a different burnable man? | 14:49 |
| morganfainberg | ayoung, might have been | 14:49 |
| ayoung | dolphm, I can't believe Johnny Cash didn't cover that one | 14:50 |
| doug-fish | dolphm: I'm still trying to find the Johnny Cash ramake | 14:50 |
| doug-fish | ooh | 14:50 |
| doug-fish | that's why I can't find it | 14:50 |
| morganfainberg | ayoung, my point is we *can* support that stuff and should open the doors for that... but other ux/usability stuff is far more important first which requires generic pref store first. | 14:50 |
| dolphm | doug-fish: lol i was trying to do the same | 14:50 |
| morganfainberg | dolphm, ayoung, you mean Green Day didn't originally make that song /s | 14:50 |
| ayoung | morganfainberg, listening to the Green Day version now. Not bad | 14:51 |
| dolphm | morganfainberg: no no, kanye invented it | 14:51 |
| nkinder | I was thinking of the Dead Kennedy's version | 14:51 |
| ayoung | https://www.youtube.com/watch?v=YDVCMHX9r0k I think is what I must have been thinking of | 14:51 |
| sambetts | yes, generic prefs store please :-) | 14:51 |
| morganfainberg | dolphm, ++ I KNEW IT, was he in his zone when he did it? | 14:51 |
| lbragstad | morganfainberg: ++ clearly | 14:52 |
| doug-fish | sambetts: not sure when you joined the channel, but there was a suggestion to consider using swift to store these prefs | 14:52 |
| *** andreaf has joined #openstack-keystone | 14:52 | |
| sambetts | I hit the tail end of it, wouldn't that be dependant on the openstack supporting Swift? | 14:53 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 14:53 |
| ayoung | sambetts, doug-fish I was hoping for straight CSS, but JSON would work. | 14:53 |
| doug-fish | ayoung: I'm still struggling to see how CSS does the job | 14:53 |
| morganfainberg | sambetts, it's worth supporting swift as a target if it exists, you'd need something more pluggable to handle cases where swift is not a viable (valid/available) target | 14:53 |
| ayoung | doug-fish, I've seen some truely amzing things with just CSS | 14:54 |
| ayoung | and for custome theming, it is the right starting point | 14:54 |
| doug-fish | sure, no doubt its powerful, but things like TZ, language, preferred projects don't seem to be a good fit | 14:54 |
| sambetts | I dont think we want to make Horizon dependant on any more components, swift could be a possiblity in the future, but we need a solution that works with the bare minimum openstack | 14:56 |
| sambetts | swift support could be an extension of that | 14:57 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 14:57 |
| morganfainberg | sambetts, so, make it a pluggable backend, allow for "cookies" to be one, db to be another, swift a third. let the deployers pick which one they want | 14:57 |
| ayoung | sambetts, then Horizon should run its own database cuz there aint' nothing guaranteed to work | 14:58 |
| *** ajayaa has quit IRC | 14:58 | |
| ayoung | sambetts, the way most people run Keystone is with Users in LDAP | 14:58 |
| ayoung | LDAP is read only as far as OpenStack is concerned | 14:58 |
| stevemar | lbragstad, why can't i add you to any reviews | 14:59 |
| ayoung | morganfainberg, why not let the user pick? | 14:59 |
| ayoung | don't run it through the Horizon server at all | 14:59 |
| morganfainberg | ayoung, it's not a user choice where the prefs get stored. | 14:59 |
| ayoung | why not | 14:59 |
| stevemar | whenever i add "Lance Bragstad <lbragstad@gmail.com>" gerrit says "does not identify a registered user or group" | 14:59 |
| doug-fish | I agree with morganfainberg on the storage | 14:59 |
| ayoung | doug-fish, Horizon is going stateles | 14:59 |
| morganfainberg | ayoung, because users are dumb :P | 14:59 |
| doug-fish | I don't think that's user configurable | 14:59 |
| sambetts | morganfainberg: the cookie idea is whats implemented right now, but that means that every user that uses the browser gets the same prefs | 14:59 |
| lbragstad | stevemar: use ldbragst | 14:59 |
| ayoung | morganfainberg, make it a service, register it as an endpoint | 15:00 |
| lbragstad | Gerrit has my lbragstad account messed up | 15:00 |
| stevemar | lbragstad, it worked - what magick is that | 15:00 |
| morganfainberg | ayoung, more tot he point the user usually doesn't know enough about the system to make a smart choice about that | 15:00 |
| lbragstad | stevemar: I'm not sure, it's weird... | 15:00 |
| doug-fish | ayoung: you've mentioned that a couple of times... is there a prototype of what you have in mind with that statement? | 15:00 |
| ayoung | doug-fish, Horizon going stateless? | 15:00 |
| morganfainberg | ayoung, the deployer will know if swift is a good option, or a DB is available, or if *only* cookies are | 15:00 |
| doug-fish | "stateless" is a pretty strong word. A browser page has a state. | 15:00 |
| ayoung | doug-fish, let me see ... | 15:01 |
| morganfainberg | doug-fish, sambetts, you can have per-user cookie data but it gets wonky iirc. | 15:01 |
| doug-fish | morganfainberg: yeah that's what sambetts did initially | 15:01 |
| ayoung | doug-fish, hmmmm I thought I had written it up. I do have an ugly-as-sin prototype | 15:01 |
| *** andreaf has quit IRC | 15:01 | |
| ayoung | doug-fish, ah, its on the mailing list...one second | 15:02 |
| *** Daviey has quit IRC | 15:02 | |
| sambetts | this is the fix I proposed -> https://review.openstack.org/#/c/118334/ | 15:02 |
| morganfainberg | ayoung, the other concern about "user picking" becomes XSS issues, if you load data from an untrusted source (argument against non-signed cookies) it's bad. | 15:02 |
| ayoung | CORS | 15:02 |
| morganfainberg | ayoung, i think my only point is you're assuming the user has a place to store these prefs | 15:03 |
| morganfainberg | ayoung, and that it would be considered secure from a CORS standpoint | 15:03 |
| ayoung | morganfainberg, make it a service and get it from the service catalog | 15:03 |
| ayoung | morganfainberg, ugh...I cleanup up my mail and now I can't find it | 15:04 |
| ayoung | http://openstack.10931.n7.nabble.com/Keystone-Horizon-CORS-and-Federation-td52693.html | 15:04 |
| morganfainberg | ayoung, i think the pluggable generic store would allow a deployer to set that then. it's still a deployer selection in this case. | 15:04 |
| ayoung | ok, that was one part | 15:04 |
| morganfainberg | the deployer needs to provide that service then, right? | 15:05 |
| morganfainberg | and add it to the catalog | 15:05 |
| ayoung | morganfainberg, yes | 15:06 |
| *** Daviey has joined #openstack-keystone | 15:06 | |
| ayoung | morganfainberg, It would probably be like Glance: | 15:06 |
| morganfainberg | ok, so i don't argue that its a good approach to have said service. | 15:06 |
| ayoung | could be backed to Swift, but doesn't have to be | 15:07 |
| morganfainberg | ayoung, but if a deployer wanted something that wrote to a DB, would that be an awful mode (no it shouldn't be the default) to support? | 15:07 |
| ayoung | morganfainberg, nope, would not be bad at all | 15:08 |
| ayoung | just like Glance can store to multiple backends | 15:08 |
| morganfainberg | i think it still comes down to providing a framework to do this and let the deployer pick the way they want users to store the prefs. - we obviously pick the winner for devstack as the default, and encourage people going that way. | 15:08 |
| *** ukalifon has quit IRC | 15:08 | |
| morganfainberg | and it might be the default is "load JSON from location and use that" | 15:09 |
| ayoung | morganfainberg, works for me | 15:10 |
| doug-fish | sambetts: are you up for this? It seems a more significant effort that just creating a user-per-cookie. | 15:11 |
| ayoung | doug-fish, it bascially is another way of saying: | 15:11 |
| doug-fish | ayoung: morganfainberg: lbragstad: I do appreciate you guys exploring/sharing these ideas. | 15:11 |
| ayoung | Horizon needs its own damn database | 15:12 |
| doug-fish | lol | 15:12 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Change saml2.ADFSUnscopedToken method signature. https://review.openstack.org/124767 | 15:12 |
| doug-fish | ayoung: I'm not sure we ready for that kind of responsibility yet. | 15:12 |
| doug-fish | :-) | 15:12 |
| ayoung | doug-fish, no, you aren't | 15:12 |
| ayoung | then again, none of us are | 15:12 |
| sambetts | doug-fish: So we're going with the write a file approach? Maybe a Sqlite backend then?? | 15:13 |
| ayoung | fake it until you make it | 15:13 |
| ayoung | sambetts, start with dogpile | 15:13 |
| ayoung | use morganfainberg 's approach to the KVS backend in Keystone | 15:13 |
| doug-fish | sambetts: I think the solution has to be configurable | 15:13 |
| doug-fish | and a chief option is keep it the way it is (one cookie per browser) | 15:13 |
| ayoung | morganfainberg, might be time to think about making your Dogpile code an Oslo utility | 15:13 |
| morganfainberg | ayoung, it's on the list of things to do this cycle actually | 15:14 |
| morganfainberg | ayoung, had a spec for last cycle that ended up pushing too late to get accepted | 15:14 |
| morganfainberg | ayoung, the plan is to replace memorycache in oslo + add memoization decorators | 15:14 |
| ayoung | morganfainberg, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/cache right? | 15:14 |
| morganfainberg | ayoung, that isn't useful in it's current state, but yes that is where it will go | 15:15 |
| ayoung | morganfainberg, so a related but different problem is caching data from Keystone in the endpoints. middleware.auth_token and also....policy | 15:15 |
| morganfainberg | https://review.openstack.org/#/c/97155/ | 15:15 |
| *** andreaf has joined #openstack-keystone | 15:15 | |
| morganfainberg | ayoung, i'll be resubmitting in a day or so for kilo acceptance | 15:16 |
| ayoung | policy keeps coming up in this context | 15:16 |
| morganfainberg | ayoung, and a lot of it is scraping keystone code + cleanup and making it oslo. | 15:16 |
| ayoung | ++ | 15:16 |
| morganfainberg | ayoung, and then auth_token etc becomes able to use it as we see fit | 15:16 |
| ayoung | morganfainberg, the one issue is that openssl will need access to the data from a file; I don't think we can abstract that away yet | 15:17 |
| morganfainberg | ayoung, i also have some folks who've said they are *very* interested in making that happen. | 15:17 |
| ayoung | so the certs etc... | 15:17 |
| ayoung | promises promises... | 15:17 |
| morganfainberg | ayoung, metacloud^wmetacisco? has implemented largely what i did for keystone in the nova metadata service | 15:18 |
| morganfainberg | they'd love to have it as a library for both internal / non-keystone stuff | 15:18 |
| lbragstad | doug-fish: no problem | 15:23 |
| *** zeus has joined #openstack-keystone | 15:24 | |
| morganfainberg | doug-fish, sambetts, happy to help | 15:24 |
| zeus | hi all | 15:26 |
| dolphm | potentially less than 10 minutes from kilo... | 15:27 |
| *** cjellick has joined #openstack-keystone | 15:27 | |
| sambetts | morganfainberg: Thanks so much! | 15:28 |
| *** Guest73730 is now known as mgagne | 15:29 | |
| *** mgagne has quit IRC | 15:29 | |
| *** mgagne has joined #openstack-keystone | 15:29 | |
| morganfainberg | ayoung, https://review.openstack.org/#/c/124776/ | 15:29 |
| ayoung | morganfainberg, really should keep the original change id. I know you were told to abandon it, but all the history is gone | 15:29 |
| morganfainberg | ayoung, it was explicitly abandoned | 15:30 |
| ayoung | yep, I know | 15:30 |
| morganfainberg | ayoung, so i'm going with that | 15:30 |
| ayoung | link to the abandoned one, so people can see this is a well beaten up concept | 15:30 |
| morganfainberg | will do. | 15:30 |
| ayoung | morganfainberg, http://adam.younglogic.com/2014/09/multiple-signers/ | 15:31 |
| ayoung | dolphm ^^ | 15:32 |
| ayoung | morganfainberg, dolphm read it when you get a chance | 15:32 |
| morganfainberg | ayoung, oh a new take on the multiple signers. | 15:32 |
| ayoung | morganfainberg, yeah | 15:32 |
| morganfainberg | ayoung, yeah will try and read it today | 15:32 |
| ayoung | morganfainberg, the biggest realization was that one Keystone is still considered authoritative | 15:33 |
| morganfainberg | dolphm, annnd gate reset! 1h and counting | 15:33 |
| ayoung | ok...back to stevedore | 15:33 |
| morganfainberg | dolphm, ~1h | 15:33 |
| *** thedodd has joined #openstack-keystone | 15:34 | |
| ayoung | morganfainberg, so, would you be infavor/opposed to Keystone-team managed repos for maintain RPM spec file and Debian Package data? | 15:35 |
| dolphm | ayoung: the TC is opposed to that -- we tried once | 15:36 |
| dolphm | ayoung: packagers weren't happy | 15:36 |
| morganfainberg | ayoung, i'd rather not have to manage those directly. I also think that would be a question for the packagers (e.g. zigo, and whoever is managing the RPM side). I think it's not the right place for it. | 15:36 |
| ayoung | dolphm, maybe we should float it again | 15:36 |
| *** shakamunyi has joined #openstack-keystone | 15:36 | |
| ayoung | morganfainberg, nah, packagers are dumb | 15:36 |
| ayoung | morganfainberg, heh | 15:36 |
| zigo | morganfainberg: ayoung: May I help? | 15:36 |
| *** radez is now known as radez_g0n3 | 15:36 | |
| ayoung | actually, packagers are wikked smart | 15:36 |
| zigo | ayoung: Thanks ! | 15:36 |
| ayoung | they just have to answer to different masters | 15:37 |
| morganfainberg | if the packagers legitimately liked it / wanted it, it would be worth floating | 15:37 |
| *** jorge_munoz has joined #openstack-keystone | 15:37 | |
| morganfainberg | if they would rather not, i don't see how providing it will help anyone | 15:37 |
| ayoung | having a standard packaging repo would make the packaging process more visible | 15:37 |
| morganfainberg | since the authoriatative packagers wont use it anyway | 15:37 |
| ayoung | I'd almost want to put both the RPM and the Debian packaging into the same repo, so peope would be able to view them side by side | 15:37 |
| *** gokrokve has joined #openstack-keystone | 15:38 | |
| zigo | ayoung: We have different policies, in Debian, upstream should *not* include a debian folder. In RedHat stuff, it's fine (and desirable) to have the .spec file upstreamed. | 15:38 |
| *** Guest68643 is now known as redrobot | 15:38 | |
| ayoung | zigo, not in keystone repo | 15:39 |
| ayoung | zigo, have a new repo: | 15:39 |
| ayoung | keystone-packages | 15:39 |
| ayoung | or keystonepackaging | 15:39 |
| *** hockeynut has quit IRC | 15:39 | |
| *** cjellick has quit IRC | 15:40 | |
| morganfainberg | zigo, i can tell you it's def. not going into keystone's tree directly ;) | 15:40 |
| *** cjellick_ has joined #openstack-keystone | 15:40 | |
| morganfainberg | zigo, in either case. | 15:40 |
| zigo | ayoung: Everthing that I do is easilly accessible using Git. I'd be happy (and asked already) to have this happen directly within the OpenStack infra. | 15:40 |
| ayoung | zigo, https://bugzilla.redhat.com/show_bug.cgi?id=1147084 | 15:40 |
| uvirtbot | ayoung: Error: Could not parse XML returned by bugzilla.redhat.com: HTTP Error 404: Not Found | 15:40 |
| *** hockeynut has joined #openstack-keystone | 15:40 | |
| zigo | Though currently it's only hosted on alioth.debian.org. | 15:40 |
| morganfainberg | uvirtbot, nice try, maybe next time. | 15:40 |
| uvirtbot | morganfainberg: Error: "nice" is not a valid command. | 15:40 |
| ayoung | zigo, let me take a look at what you are doing | 15:41 |
| ayoung | zigo, link to your repo? | 15:41 |
| zigo | ayoung: https://qa.debian.org/developer.php?login=openstack-devel@lists.alioth.debian.org | 15:41 |
| zigo | That's the list of packages I maintain. | 15:41 |
| zigo | Plus some more within the Debian Python Module Team (DPMT). | 15:41 |
| *** Sharath_ has joined #openstack-keystone | 15:42 | |
| zigo | Everything is like: git://anonscm.debian.org/openstack/<project>.git | 15:42 |
| ayoung | PTS? Is that like a TPS report? | 15:42 |
| *** lufix has quit IRC | 15:42 | |
| zigo | So for keystone, that'd be: git://anonscm.debian.org/openstack/keystone.git | 15:42 |
| *** gokrokve_ has quit IRC | 15:42 | |
| ayoung | pacakge testing summary | 15:42 |
| *** gokrokve has quit IRC | 15:42 | |
| *** radez_g0n3 is now known as radez | 15:42 | |
| zigo | A clone will get you the Icehouse branch currently, though there's debian/juno branches for core packages, and some in debian/experimental (for libs). | 15:42 |
| Sharath_ | Hi , am new to openstack started with keystone understanding , am unable to get the flow , from where it will start and how it generate key , can any one tell me the flow. Thank you | 15:43 |
| *** cjellick has joined #openstack-keystone | 15:44 | |
| ayoung | zigo, lets see if we can reduce this list of custom patches http://anonscm.debian.org/cgit/openstack/keystone.git/tree/debian/patches | 15:44 |
| *** gyee has joined #openstack-keystone | 15:44 | |
| ayoung | Pretty sure we dealt with http://anonscm.debian.org/cgit/openstack/keystone.git/tree/debian/patches/fix-missing-gettextutil.py-import.patch | 15:44 |
| ayoung | but maybe you need that for backports | 15:44 |
| zigo | That'd be very much appreciated ! | 15:45 |
| ayoung | http://anonscm.debian.org/cgit/openstack/keystone.git/tree/debian/patches/fixes-default-connection.patch looks just plain evil | 15:45 |
| Sharath_ | hi ayong , i gone through the code as per ur instructions | 15:45 |
| ayoung | but only cuz it says "sqlite" | 15:45 |
| ayoung | Sharath_, you will never be able to make my IRC client flash until you get my name right | 15:45 |
| Sharath_ | but still i didnt get the flow ayong , can u help to find out ? | 15:45 |
| dolphm | Sharath_: there are several authentication code paths, but you might try looking at keystone.auth.controllers.Auth:authenticate() | 15:45 |
| zigo | ayoung: I default to sqlite because it's usefull for doing automated install/upgrades without prompting for a MySQL password. | 15:46 |
| ayoung | zigo, you have the requirement that, once the package is installed you have a working system, right> | 15:46 |
| ayoung | ? | 15:46 |
| zigo | Right. | 15:46 |
| ayoung | modifying the default conf file is not really the right way to go about that, as it is an autogenerated, document file | 15:47 |
| zigo | Basically, in Debian, you just do "apt-get install keystone", and there's nothing more to configure by hand. | 15:47 |
| ayoung | but not a cardinal sin | 15:47 |
| *** cjellick_ has quit IRC | 15:47 | |
| ayoung | zigo, I thought Debian had a way of managing config files across updates/upgrades | 15:47 |
| zigo | Well, in more recent versions, I just do a sed when building the package, that works better (no need to rebase). | 15:47 |
| ayoung | zigo, what about the issues with PBR? | 15:48 |
| zigo | ayoung: We do, but not when upstream decides every week, to rename and move accross sections every directive. | 15:48 |
| ayoung | apt and rpm both want to manage the package versions. | 15:48 |
| zigo | ayoung: Do you mean about the export OSLO_PACKAGE_VERSION=$(VERSION)? | 15:48 |
| ayoung | yeah...where is that done? | 15:49 |
| zigo | Well, I do that in every package, since I'm using a Git based workflow. | 15:49 |
| zigo | That tells PBR to use whatever I put on top of debian/changelog. | 15:49 |
| Sharath_ | not really like that ayong , | 15:50 |
| *** ayoung is now known as ayong | 15:50 | |
| ayong | Sharath_, I give up | 15:50 |
| ayong | you win | 15:50 |
| Sharath_ | ok , thank you dolphm | 15:50 |
| zigo | If I don't do that, then PBR doesn't know what version I'm using. | 15:50 |
| zigo | We went through *many* iteration before having this system, and I'm very happy with it. | 15:50 |
| ayong | zigo, where is that done? | 15:51 |
| lbragstad | stevemar: what review did you add me to? | 15:51 |
| zigo | ayong: PBR has that feature to look at OSLO_PACKAGE_VERSION env, and use that ... | 15:52 |
| ayong | zigo, yes, but where is it called? assu,me I know nothing about debian package build process | 15:52 |
| zigo | Let me explain quickly. | 15:52 |
| zigo | I use Git for packaging, eg *not* the release tarballs. | 15:52 |
| zigo | Meaning that I don't have the egg-info, PKG-INFO, and so on. | 15:53 |
| zigo | But when I do "git-buildpackage" it's not using Git anymore, it's pushing stuff into a chroot for building. | 15:53 |
| zigo | Then there would be no way for PBR to know the version number without the OSLO_PACKAGE_VERSION. | 15:53 |
| * stevemar shrugs at lbragstad | 15:56 | |
| stevemar | lbragstad, this one i think https://review.openstack.org/#/c/122989/ | 15:56 |
| stevemar | lbragstad, then this chain: https://review.openstack.org/#/c/124270/4 | 15:56 |
| lbragstad | stevemar: sweet, thanks | 15:57 |
| *** thedodd has quit IRC | 16:00 | |
| ayong | zigo, OK, I think that is pretty much what I proposed with my RPM patches | 16:03 |
| ayong | zigo, is OSLO_PACKAGE_VERSION set anywhere in your build files linked above? | 16:04 |
| *** ayong is now known as ayoung | 16:04 | |
| zigo | ayong: I just put it in debian/rules, but $(VERSION) is populated thanks to what lives in /usr/share/openstack/pkgos.make (which is in openstack-pkg-tools). | 16:05 |
| zigo | Basically, it's a couple of dpkg-parsechangelog plus grep/sed calls to get the version number. | 16:06 |
| ayoung | zigo, so an env var set in debian/rules is in effect for the whole build process? | 16:06 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use openstackclient examples in configuration documentation https://review.openstack.org/124270 | 16:06 |
| zigo | ayoung: Yes. | 16:06 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 16:07 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 16:07 |
| ayoung | zigo, in the RPM version, we build using the released tarball, and the versions need to match | 16:07 |
| ayoung | so the RPM spec file has the version numbers in it, but I don't really like it; | 16:07 |
| ayoung | I want it to be something an end devloper can use without having to modify the rpm spec file | 16:08 |
| ayoung | unfortunately, all of the projects I've seen have had to modify that file, using a template or something | 16:08 |
| ayoung | which makes sense, since the build needs to be reproducible | 16:08 |
| *** thedodd has joined #openstack-keystone | 16:09 | |
| ayoung | zigo, what if the PBR code did not assume git, but only did the rebuild of PKG-INFO if it was inside a git repo and if a flag was left unset? | 16:10 |
| zigo | ayoung: We went through many kinds of changes in PBR to try to make it double-guess, but it never worked out. The env var works best, and I don't want this to change again. | 16:11 |
| zigo | I think we had about 5 different systems ... | 16:11 |
| zigo | Over probably a period of more than a year. | 16:12 |
| ayoung | zigo, and I assume this was across all of the projects, not just Keystone | 16:12 |
| zigo | ayoung: In PBR itself. | 16:12 |
| zigo | (so yes, all the projects) | 16:13 |
| ayoung | zigo, I guess in general I am OK with the approach, just that it seems a little strange to release the tarball with a version string in it, and then to rewrite that data | 16:13 |
| openstackgerrit | Julien Danjou proposed a change to openstack/keystonemiddleware: Switch to oslo.utils https://review.openstack.org/124435 | 16:13 |
| ayoung | its not in git, so maybe it should not be in the tarball | 16:13 |
| openstackgerrit | Julien Danjou proposed a change to openstack/keystonemiddleware: Update oslo-incubator https://review.openstack.org/124726 | 16:13 |
| openstackgerrit | Julien Danjou proposed a change to openstack/keystonemiddleware: Switch to oslo.serialization https://review.openstack.org/124436 | 16:13 |
| zigo | ayoung: Again, I do *not* use the release tarballs, I use the upstream git from github directly. | 16:13 |
| ayoung | but then there is no way to map from the tarball back to the git commit | 16:13 |
| ayoung | zigo, does the .deb contain the git hash somehow? | 16:14 |
| zigo | The release tarballs are using a 20 years old compression (.gz instead of .xz), and do not have pgp signed tags ... | 16:14 |
| *** rm_work is now known as rm_work|away | 16:14 | |
| *** marcoemorais has joined #openstack-keystone | 16:14 | |
| zigo | ayoung: It's based on a release *tag*. | 16:15 |
| zigo | git archive --prefix=$(DEBPKGNAME)-$(VERSION)/ $(GIT_TAG) | xz >../$(DEBPKGNAME)_$(VERSION).orig.tar.xz | 16:15 |
| zigo | I also prefer this way because it's much much more efficient. | 16:15 |
| zigo | Basically, I do: edition of debian/changelog, then ./debian/rules fetch-upstream-remote, then git merge -X theirs <version> | 16:16 |
| zigo | That's it ... | 16:16 |
| zigo | No need to download a huge tarball, just the incremental commits. | 16:17 |
| *** praneshp has joined #openstack-keystone | 16:17 | |
| zigo | No need to bother storing the tarballs in Git using something like pristine-tar. | 16:17 |
| zigo | Everything is self-contained in a single packaging branch. | 16:17 |
| zigo | Also, I don't want the release artifacts like changelog (which is too big, and which the Debian FTP masters wined about), or the AUTHORS file, which gives a wrong idea of who's the copyright holder, I don't want either the egg-info files, which are anyway generated at build time. | 16:19 |
| ayoung | zigo, yep | 16:19 |
| stevemar | topol, ping test | 16:19 |
| zigo | BTW, didn't we suppose to have rc at this time? | 16:20 |
| ayoung | zigo, incipient | 16:20 |
| topol | thanks stevemar. and yes its me. | 16:20 |
| zigo | During the Juno summit, the plan was to have rc on the 25th of October. | 16:20 |
| *** rm_work|away is now known as rm_work | 16:20 | |
| zigo | Yet, I haven't found any project releasing RC yet... | 16:20 |
| ayoung | zigo, Keystone is ready | 16:20 |
| zigo | ayoung: But there's no rc tags, is there? | 16:21 |
| morganfainberg | zigo, we're merging the change that RC will be tagged from | 16:21 |
| zigo | Ok. | 16:21 |
| morganfainberg | zigo, https://review.openstack.org/#/c/124692/ | 16:21 |
| zigo | Good to know. | 16:21 |
| ayoung | "STAND IN THE DOOR!" | 16:22 |
| *** __TheDodd__ has joined #openstack-keystone | 16:22 | |
| *** thedodd has quit IRC | 16:22 | |
| *** hockeynut has quit IRC | 16:22 | |
| *** hockeynut has joined #openstack-keystone | 16:23 | |
| *** dimsum_ is now known as dims | 16:23 | |
| ayoung | http://www.youtube.com/watch?v=tHLgC6Ioyf4 | 16:24 |
| *** wwriverrat has joined #openstack-keystone | 16:24 | |
| ayoung | The most beautiful sight I ever did see/ was my fully inflated canopy. | 16:25 |
| *** __TheDodd__ has quit IRC | 16:25 | |
| dims | ayoung: awesome! | 16:26 |
| *** thedodd has joined #openstack-keystone | 16:26 | |
| *** radez is now known as radez_g0n3 | 16:27 | |
| ayoung | chmouel, you need to use a fragment of ^^ for openstack reactions | 16:27 |
| ayoung | "How I feel when waiting for rc tag to get cut" | 16:28 |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 16:28 |
| *** jasondotstar has joined #openstack-keystone | 16:29 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: SAML2 wrapper plugin for full federation authN https://review.openstack.org/106751 | 16:30 |
| *** Sharath_ has quit IRC | 16:31 | |
| *** sambetts has quit IRC | 16:34 | |
| *** gokrokve has joined #openstack-keystone | 16:34 | |
| *** radez_g0n3 is now known as radez | 16:34 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 16:36 |
| openstackgerrit | A change was merged to openstack/keystone: Open Kilo development https://review.openstack.org/124692 | 16:39 |
| *** ChanServ sets mode: +o morganfainberg | 16:39 | |
| * dolphm OPEN FOR KILO | 16:39 | |
| *** morganfainberg changes topic to "Development for Kilo is now open on Master." | 16:40 | |
| *** dolphm changes topic to "Now open for Kilo development! Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0" | 16:40 | |
| dolphm | lol | 16:40 |
| stevemar | dolphm, the peasants rejoice! | 16:40 |
| morganfainberg | LOL | 16:40 |
| stevemar | i'm a fan of the blocking reviews, can we keep it :) | 16:40 |
| ayoung | I thought it was Pheasants that were rejoicing | 16:40 |
| dolphm | stevemar: yeah, i'd like to formalize it and make it available to other projects | 16:41 |
| stevemar | they are squaking | 16:41 |
| stevemar | dolphm, fair enough | 16:41 |
| dolphm | stevemar: i'll certainly keep the gist running for now | 16:41 |
| stevemar | thats all i ask | 16:41 |
| morganfainberg | yeah it's a good thing to have. | 16:41 |
| *** wwriverrat has left #openstack-keystone | 16:42 | |
| Daviey | ayoung: I didn't have v3 api enabled, i do now.. and works via curl + negotiate. However, I can't get your snippet working.. I think it is because it is lacking tenantName/name. | 16:46 |
| ayoung | Daviey, could be...do you have a curretn keystonclient repo? | 16:46 |
| Daviey | ayoung: Doesn't seem to be related to the Session object, but it is that where you call get_token()... So i think it is | 16:46 |
| Daviey | ayoung: I have Master from this morning | 16:47 |
| ayoung | Daviey, you are backing kerberso with LDAP? | 16:47 |
| ayoung | I assume no default project? | 16:47 |
| ayoung | should be doing the same thing...I just confirmed I had it working | 16:48 |
| ayoung | tenantName/name should not be necessary | 16:48 |
| Daviey | ayoung: Hmm, currently sql | 16:48 |
| ayoung | Daviey, NP | 16:48 |
| Daviey | achudnovets: | 16:49 |
| ayoung | should work, too, but I haven't tested that | 16:49 |
| ayoung | Gesudnheit | 16:49 |
| Daviey | ayoung: Well, if i miuss out the name from my curl request it also fails | 16:49 |
| ayoung | what name? | 16:49 |
| Daviey | null | 16:49 |
| ayoung | ok, so it is a server side issue | 16:49 |
| ayoung | what "name" | 16:50 |
| ayoung | username? | 16:50 |
| ayoung | '{ "auth": { "identity": { "methods": ["kerberos"], "kerberos": {}}}}' is all I pass | 16:50 |
| Daviey | let me try that | 16:52 |
| Daviey | ayoung: http://pb.daviey.com/4pYn/ | 16:55 |
| Daviey | ayoung: specifying the other details provides the valid response | 16:57 |
| ayoung | Daviey, you have "kerberos" as an auth methon in your server? | 16:59 |
| *** gokrokve has quit IRC | 16:59 | |
| Daviey | Dug | 16:59 |
| Daviey | Duh | 16:59 |
| ayoung | [auth] | 16:59 |
| ayoung | methods=kerberos,password,token | 16:59 |
| *** gokrokve has joined #openstack-keystone | 16:59 | |
| Daviey | When i made that empty, your example also worked | 16:59 |
| Daviey | should be external, i guess | 16:59 |
| ayoung | Nope | 17:00 |
| ayoung | we are standardizing on Kerberos | 17:00 |
| ayoung | but, last release you would have been correct | 17:00 |
| Daviey | ayoung: ok, right.. when i s/external/kerberos in keystone.conf - your example worked | 17:05 |
| ayoung | schweet | 17:05 |
| Daviey | So seems i was wrong about it being the tenantName | 17:05 |
| ayoung | Daviey, ok, so lets see if we can get stevedore working | 17:05 |
| Daviey | ayoung: Did you work out how stevedore works? | 17:06 |
| ayoung | Daviey, not a clue | 17:06 |
| * ayoung just gonna wing it | 17:06 | |
| Daviey | :) | 17:07 |
| Daviey | Stevedore claims to make use of stevedore, and i am using an old version 1.4... but it doesn't declare a minimal version, so pretty sure it is ok | 17:07 |
| Daviey | err, Stevedore claims to make use of setuputils* | 17:08 |
| Daviey | setuptools*. Bah | 17:08 |
| *** thedodd has quit IRC | 17:10 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove token persistence proxy https://review.openstack.org/124809 | 17:11 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove unused ec2 driver option https://review.openstack.org/124810 | 17:15 |
| *** harlowja has joined #openstack-keystone | 17:16 | |
| dstanek | dolphm: yay! kilo | 17:21 |
| *** Dafna has quit IRC | 17:21 | |
| ayoung | Daviey, OK, got it | 17:21 |
| morganfainberg | dstanek, stevemar, dolphm, I pressed go on the placeholder migrations | 17:22 |
| *** harlowja has quit IRC | 17:22 | |
| ayoung | Daviey, needs a change to the kerberos plugin | 17:22 |
| ayoung | I added, in setup .cfg | 17:22 |
| ayoung | Daviey, http://paste.openstack.org/show/116787/ | 17:22 |
| ayoung | then | 17:22 |
| ayoung | instead of importing the kerberos plugin directly, do | 17:23 |
| ayoung | kerb_mgr = driver.DriverManager( | 17:23 |
| ayoung | namespace='keystoneclient.auth.plugin', | 17:23 |
| ayoung | name='kerberos', | 17:23 |
| ayoung | invoke_on_load=False, | 17:23 |
| ayoung | ) | 17:23 |
| ayoung | sess=session.Session(kerb_mgr.driver(OS_AUTH_URL), verify=OS_CACERT) | 17:23 |
| ayoung | Daviey, I still don't know where Stevedore stores the mapping of entrypoints to plugins, so I might be overwriting something that way.... | 17:24 |
| ayoung | should check that password still works: | 17:24 |
| *** harlowja has joined #openstack-keystone | 17:24 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove unused ec2 driver option https://review.openstack.org/124810 | 17:24 |
| Daviey | brb | 17:24 |
| ayoung | Daviey, added http://paste.openstack.org/show/116789/ and got a token using the token plugin from the token feched via the kerberos plugin | 17:29 |
| *** marcoemorais has quit IRC | 17:30 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 17:30 |
| ayoung | morganfainberg, now that I look at the stevedore code, and see how it works, I know where termie was going with the manager/driver thing | 17:31 |
| *** john-davidge has quit IRC | 17:31 | |
| morganfainberg | ayoung, makes a bit more sense right? | 17:31 |
| *** marcoemorais has joined #openstack-keystone | 17:33 | |
| *** marcoemorais has quit IRC | 17:33 | |
| *** marcoemorais has joined #openstack-keystone | 17:34 | |
| *** Sharath_ has joined #openstack-keystone | 17:34 | |
| *** Daviey has quit IRC | 17:37 | |
| *** Daviey has joined #openstack-keystone | 17:41 | |
| *** Sharath_ has quit IRC | 17:51 | |
| *** marcoemorais has quit IRC | 17:52 | |
| *** vishy has joined #openstack-keystone | 17:52 | |
| vishy | ing | 17:52 |
| morganfainberg | vishy, hello there | 17:53 |
| vishy | hi | 17:53 |
| morganfainberg | vishy, how goes? | 17:53 |
| vishy | lost all my scrollback :( | 17:53 |
| vishy | 17:53 | |
| morganfainberg | vishy, boo :( | 17:53 |
| vishy | durn xen bug | 17:53 |
| *** marcoemorais has joined #openstack-keystone | 17:53 | |
| *** montanvi is now known as bambam1 | 17:54 | |
| *** marcoemorais has quit IRC | 17:55 | |
| *** marcoemorais has joined #openstack-keystone | 17:56 | |
| dolphm | morganfainberg: p.s. i'm working on juno release notes | 17:56 |
| morganfainberg | dolphm, yay juno release notes! | 17:57 |
| dolphm | morganfainberg: and all the reviews i blocked for kilo myself should now be unblocked - let me know if i missed any | 17:57 |
| morganfainberg | dolphm, yeah i looked earlier, looks like you unblocked them. | 17:57 |
| morganfainberg | i unblocked the ones i tossed a -2 on as well | 17:58 |
| *** marcoemorais has quit IRC | 17:58 | |
| *** marcoemorais has joined #openstack-keystone | 17:58 | |
| *** marcoemorais has quit IRC | 17:58 | |
| *** marcoemorais has joined #openstack-keystone | 17:59 | |
| Daviey | ayoung: Sorry, had to go afk.. But that worked, thanks :)... Stevedore makes more sense to me now | 18:00 |
| morganfainberg | oh i should go create the LP project for keystoneclient-federation | 18:00 |
| morganfainberg | hm. wonder if we could just move those plugins to storyboard instead... | 18:01 |
| ayoung | morganfainberg, you go PTL! | 18:01 |
| * morganfainberg goes to poke at infra folks | 18:01 | |
| ayoung | er | 18:01 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Update hacking to 0.9.x https://review.openstack.org/122989 | 18:01 |
| ayoung | PTL2B | 18:01 |
| morganfainberg | ayoung hehe :) | 18:01 |
| *** lsmola has quit IRC | 18:01 | |
| *** zeus has quit IRC | 18:03 | |
| *** zeus has joined #openstack-keystone | 18:05 | |
| *** zeus is now known as Guest1974 | 18:05 | |
| *** Guest1974 has quit IRC | 18:10 | |
| *** sigmavirus24 has joined #openstack-keystone | 18:10 | |
| ayoung | Daviey, I'm trying to decide if I should make Django-OpenStack auth use stevedore now | 18:14 |
| *** gokrokve has quit IRC | 18:14 | |
| ayoung | I'd ask the horizon folks, but pretty sure I alienate them all earier | 18:15 |
| ayoung | earlier | 18:15 |
| ayoung | doug-fish, what do you think? Should Horizon use Stevedore to load the auth plugins for keystone client? | 18:15 |
| *** marcoemorais has quit IRC | 18:16 | |
| doug-fish | ayoung: I don't know enough about it to have an opinion. | 18:17 |
| ayoung | doug-fish, that never stopped me | 18:17 |
| doug-fish | lol | 18:17 |
| doug-fish | why the change? | 18:17 |
| *** marcoemorais has joined #openstack-keystone | 18:18 | |
| doug-fish | ayoung: is this question specific to Horizon? Aren't other OS components going to need to do the same? | 18:19 |
| ayoung | nope | 18:20 |
| ayoung | doug-fish, only Horizon is a consumer of the auth plugins | 18:20 |
| ayoung | well, Heat too | 18:20 |
| doug-fish | CLI? | 18:21 |
| rodrigods | now that kilo is open, time to review HM patches!!! =) | 18:22 |
| Daviey | ayoung: Funnily enough, stevedore does seem to be a pretty good way of doing runtime plugin handling. | 18:23 |
| ayoung | Daviey, well, yeah, it does now, doesn't it | 18:23 |
| Daviey | ayoung: But now, my reading up on stevedore is filling my adsense with job opportunities working at the docks. | 18:24 |
| *** sigmavirus24 has left #openstack-keystone | 18:24 | |
| Daviey | So.. Either i'll work at Docker, or my local Port. | 18:24 |
| ayoung | Dawka! | 18:24 |
| ayoung | Dawka!Dawka!Dawka!Dawka!Dawka! | 18:24 |
| *** vdreamarkitex has joined #openstack-keystone | 18:25 | |
| *** gokrokve has joined #openstack-keystone | 18:26 | |
| *** gokrokve has quit IRC | 18:27 | |
| *** marcoemorais1 has joined #openstack-keystone | 18:28 | |
| *** gokrokve has joined #openstack-keystone | 18:29 | |
| ayoung | Daviey, the thing is, now I need a way to figure out how to pass config options from Horizon through to the plugin in a non-threatening manner. Django OpenStack Auth gets a conifg object from Django with is a python object....its just icky | 18:30 |
| *** marcoemorais has quit IRC | 18:30 | |
| ayoung | But using Stevedore to replace registered components with the proper Mock objects for a unit tests sounds right to me | 18:31 |
| *** thedodd has joined #openstack-keystone | 18:32 | |
| *** ukalifon has joined #openstack-keystone | 18:34 | |
| *** gokrokve has quit IRC | 18:34 | |
| *** gokrokve has joined #openstack-keystone | 18:35 | |
| Daviey | ayoung: I was following your thread... but confused now.. Surely you want to just do it in js, rather than using request-kerberos? | 18:36 |
| openstackgerrit | Terry Howe proposed a change to openstack/python-keystoneclient: Identity plugin that manages passwords and tokens https://review.openstack.org/124830 | 18:50 |
| ayoung | Daviey, ah...phased approach. | 18:52 |
| ayoung | I want to do Kerberos in JS, yes | 18:52 |
| ayoung | but I need something to work with the current set up | 18:52 |
| ayoung | which means a Horizon server side auth plugin | 18:52 |
| *** morgan_remote_ has joined #openstack-keystone | 18:52 | |
| ayoung | Daviey, I have a proof of concept working (well it was working, seems to break each time I turn around) of Kerberos and Horizon | 18:53 |
| ayoung | I uses black magic from Hades to get a Kerberos service ticket for the end user that Horizon can use | 18:54 |
| ayoung | Its called Nosforuto Proxy, or S4U2Proxy for short | 18:54 |
| *** andreaf has quit IRC | 19:03 | |
| *** andreaf has joined #openstack-keystone | 19:04 | |
| Daviey | ayoung: Right, that has been on my todo.. But i couldn't quite follow why this wasn't just done in pure js | 19:05 |
| Daviey | As in, i can see people not wanting to use the delegation extensions of kerberos for the proxy | 19:05 |
| ayoung | Daviey, because unless Keystone and Horizon are on the same machine you have issues with same origin policy and need proper CORS support | 19:05 |
| ayoung | and that scares people....probably rightfully so | 19:06 |
| Daviey | Ahhh, yes. | 19:06 |
| * morgan_remote_ hides from the scary CORS. | 19:07 | |
| *** marcoemorais1 has quit IRC | 19:11 | |
| openstackgerrit | A change was merged to openstack/keystone: add --rebuild option for ssl/pki_setup https://review.openstack.org/88207 | 19:12 |
| *** flwang has quit IRC | 19:13 | |
| *** marcoemorais has joined #openstack-keystone | 19:15 | |
| *** Tahmina has quit IRC | 19:19 | |
| *** radez is now known as radez_g0n3 | 19:20 | |
| *** marcoemorais has quit IRC | 19:21 | |
| *** marcoemorais has joined #openstack-keystone | 19:21 | |
| Daviey | ayoung: Maybe i am smoking crack, but if you rely on external auth and REMOTE_USER is valid.. kerberos in horizon is less interesting (other than to validate token binding?). If Horizon serverside can retrieve a token directly from keystone on behalf of the user, without getting into the kerberos path - things seem simpler, no? | 19:21 |
| ayoung | Daviey, how does Horizon get a token as the user? | 19:21 |
| ayoung | Should Keystone just trust Horizon? | 19:22 |
| ayoung | It can't use password | 19:22 |
| Daviey | That is what i was thinking.. | 19:24 |
| Daviey | horizon / apache can have pre-stashed tokens, no? | 19:24 |
| Daviey | KRB5 tokens | 19:25 |
| ayoung | Daviey, For Kerberos in the short term, we Do S4U2. Longer term, user gets the token from Keystone and hands it to Horizon | 19:25 |
| ayoung | longer term, there is no Horizon, user hands the token direct to Nova et alles | 19:25 |
| Daviey | ok | 19:26 |
| *** vhoward has left #openstack-keystone | 19:31 | |
| ayoung | zigo, Running Sphinx v1.1.3 | 19:41 |
| ayoung | fatal: Not a git repository (or any of the parent directories): .git | 19:41 |
| ayoung | I assume you have a work around for that as well? | 19:42 |
| *** ukalifon has quit IRC | 19:50 | |
| *** harlowja has quit IRC | 19:50 | |
| *** topol has quit IRC | 19:52 | |
| *** radez_g0n3 is now known as radez | 19:53 | |
| *** marcoemorais has quit IRC | 19:54 | |
| *** harlowja has joined #openstack-keystone | 19:55 | |
| *** marcoemorais has joined #openstack-keystone | 19:55 | |
| *** NM1 has joined #openstack-keystone | 19:57 | |
| *** ukalifon has joined #openstack-keystone | 19:57 | |
| *** gokrokve has quit IRC | 19:58 | |
| *** flwang has joined #openstack-keystone | 19:58 | |
| *** marcoemorais has quit IRC | 19:58 | |
| *** marcoemorais has joined #openstack-keystone | 19:59 | |
| *** gokrokve has joined #openstack-keystone | 19:59 | |
| *** flwang1 has joined #openstack-keystone | 20:01 | |
| stevemar | dolphm, whats the deal with kilo design session proposals this time around? | 20:03 |
| stevemar | dolphm, also if you know what's going on with the cross-project ones, that would be great too | 20:04 |
| stevemar | cc morganfainberg ^ | 20:04 |
| dolphm | stevemar: there won't be a summit.openstack.org to submit ideas through | 20:04 |
| morganfainberg | stevemar, ah i need to migrate the topics over, but there is an etherpad TTX put up | 20:04 |
| dolphm | stevemar: it'll be more of a collaborative schedule design per program (via eitherpad, etc) | 20:04 |
| bknudson | https://etherpad.openstack.org/p/kilo-crossproject-summit-topics -- cross-project | 20:05 |
| dolphm | so, basically what keystone did the last two cycles, without the red tape | 20:05 |
| bknudson | https://etherpad.openstack.org/p/keystone-kilo-summit-sessions | 20:05 |
| morganfainberg | https://etherpad.openstack.org/p/kilo-keystone-summit-topics | 20:07 |
| morganfainberg | need to move our topics to that one | 20:07 |
| bknudson | picked the wrong name. | 20:07 |
| *** serverascode_ has joined #openstack-keystone | 20:08 | |
| flwang1 | bknudson: any lucky you around? | 20:09 |
| ekarlso | is domains gonna be removed ? | 20:09 |
| bknudson | flwang1: I am around... not sure why a question would be specific to me... | 20:10 |
| flwang1 | oh, sorry, not specific for you, because I just know you :) | 20:10 |
| bknudson | I don't know anything. | 20:10 |
| *** sigmavirus24 has joined #openstack-keystone | 20:10 | |
| flwang1 | :( | 20:10 |
| ekarlso | I just see domains under the deprecate list ? | 20:10 |
| flwang1 | bknudson: and because I had discussed the similar question with you, so I assume you're the best guy I can ask for help | 20:11 |
| *** ayoung is now known as ayoung-afk | 20:11 | |
| bknudson | flwang1: if you ask the question here somebody might know the answer. | 20:12 |
| ekarlso | bknudson: u kniw the answer to the domains q ? | 20:12 |
| bknudson | assuming it's keystone related. | 20:12 |
| flwang1 | bknudson: ok, i apologize if I'm making any troubles | 20:12 |
| bknudson | flwang1: what's the questions? | 20:13 |
| flwang1 | 1. as a user, can I add more user for my tenant? | 20:13 |
| flwang1 | 2. as a user, can I add a ^sub tenant^ under my tenant? | 20:14 |
| flwang1 | seems v3 can resolve partial of above questions, but I'm not really sure | 20:14 |
| ekarlso | guess noone wants to answer my thing then :) | 20:14 |
| bknudson | flwang1: for 2, there are no sub tenants. | 20:14 |
| flwang1 | how about the domain in v3? | 20:15 |
| bknudson | flwang1: for 1, that depends on the policy | 20:15 |
| bknudson | flwang1: domains are only in v3. There's no domains in v2, other than the default domain. | 20:15 |
| flwang1 | bknudson: for #1, may I know more details? | 20:15 |
| ekarlso | bknudson: is it under discussion to remove them or ? | 20:15 |
| bknudson | ekarlso: I haven't heard any discussions to remove domains. | 20:16 |
| bknudson | flwang1: domains are documented in the identity api v3 spec: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#openstack-identity-api-v3 | 20:16 |
| flwang1 | bknudson: cool | 20:17 |
| flwang1 | so do you think the domain can resolve my #2? | 20:17 |
| bknudson | flwang1: domains and projects are different things. | 20:18 |
| bknudson | a domain just provides a namespace. | 20:18 |
| flwang1 | bknudson: ok, I will dig into it. then how about the #1? | 20:19 |
| ekarlso | nkinder: around ? | 20:19 |
| bknudson | flwang1: I think this will depend on your policy configuration. | 20:19 |
| bknudson | not something I'm really familiar with... haven't had to work with policy configuratoin | 20:20 |
| flwang1 | bknudson: ok, got it. thanks a lot | 20:20 |
| *** marcoemorais has quit IRC | 20:21 | |
| flwang1 | ekarlso: do you know who is guy working on keystone of HP cloud? | 20:21 |
| ekarlso | flwang1: not sure :/ | 20:21 |
| ekarlso | think we have a few | 20:21 |
| flwang1 | because I saw HP cloud allow current user send invitation to a new user | 20:22 |
| flwang1 | so i'm curious if there are some guys know more | 20:22 |
| *** ukalifon has quit IRC | 20:28 | |
| *** thedodd has quit IRC | 20:29 | |
| *** ukalifon has joined #openstack-keystone | 20:30 | |
| *** thedodd has joined #openstack-keystone | 20:32 | |
| *** comstud has joined #openstack-keystone | 20:38 | |
| *** marcoemorais has joined #openstack-keystone | 20:39 | |
| *** thedodd has quit IRC | 20:45 | |
| *** ayoung-afk is now known as ayoung | 20:45 | |
| *** radez is now known as radez_g0n3 | 20:48 | |
| *** andreaf has quit IRC | 20:49 | |
| *** andreaf has joined #openstack-keystone | 20:50 | |
| *** aix has joined #openstack-keystone | 20:56 | |
| *** thedodd has joined #openstack-keystone | 21:10 | |
| *** NellyK has joined #openstack-keystone | 21:20 | |
| *** joesavak has quit IRC | 21:21 | |
| *** thedodd has quit IRC | 21:25 | |
| nkinder | ekarlso: hey, what's up? | 21:28 |
| *** ukalifon has quit IRC | 21:29 | |
| *** stevemar has quit IRC | 21:35 | |
| *** stevemar has joined #openstack-keystone | 21:36 | |
| openstackgerrit | Terry Howe proposed a change to openstack/python-keystoneclient: Identity plugin that manages passwords and tokens https://review.openstack.org/124830 | 21:37 |
| *** zzzeek has quit IRC | 21:43 | |
| *** zzzeek has joined #openstack-keystone | 21:43 | |
| *** dims_ has joined #openstack-keystone | 21:44 | |
| *** NellyK has quit IRC | 21:45 | |
| *** NM1 has quit IRC | 21:46 | |
| *** dims_ has quit IRC | 21:47 | |
| *** dims has quit IRC | 21:47 | |
| *** dims has joined #openstack-keystone | 21:47 | |
| *** aix_ has joined #openstack-keystone | 21:57 | |
| openstackgerrit | A change was merged to openstack/keystone: Add placeholders for reserved migrations https://review.openstack.org/124204 | 21:57 |
| *** aix has quit IRC | 22:00 | |
| *** rkofman has quit IRC | 22:01 | |
| *** rkofman has joined #openstack-keystone | 22:02 | |
| *** samuelmz has quit IRC | 22:09 | |
| *** mikedillion has joined #openstack-keystone | 22:10 | |
| *** nkinder has quit IRC | 22:13 | |
| *** ayoung is now known as ayoung-afk | 22:14 | |
| *** NellyK has joined #openstack-keystone | 22:15 | |
| *** Tahmina has joined #openstack-keystone | 22:16 | |
| *** NellyK has quit IRC | 22:21 | |
| *** thedodd has joined #openstack-keystone | 22:21 | |
| *** mikedillion has quit IRC | 22:23 | |
| *** mikedillion has joined #openstack-keystone | 22:31 | |
| *** thedodd has quit IRC | 22:33 | |
| *** jasondotstar has quit IRC | 22:33 | |
| *** bknudson has quit IRC | 22:40 | |
| *** gordc has quit IRC | 22:40 | |
| *** andreaf has quit IRC | 22:44 | |
| *** andreaf has joined #openstack-keystone | 22:45 | |
| *** andreaf has quit IRC | 22:47 | |
| *** andreaf has joined #openstack-keystone | 22:47 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 22:48 | |
| *** marcoemorais has quit IRC | 23:01 | |
| *** marcoemorais has joined #openstack-keystone | 23:01 | |
| *** marcoemorais has quit IRC | 23:02 | |
| *** marcoemorais has joined #openstack-keystone | 23:02 | |
| *** jaosorior has quit IRC | 23:03 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:08 | |
| *** nkinder has joined #openstack-keystone | 23:10 | |
| nkinder | Anyone have some time to give this keystoneclient issue a review? https://review.openstack.org/#/c/123954/ | 23:11 |
| nkinder | This would be a good one to knock out from a security hardening standpoint, and it looks good to me. | 23:11 |
| *** dims has quit IRC | 23:12 | |
| *** dims has joined #openstack-keystone | 23:13 | |
| *** dims has quit IRC | 23:17 | |
| *** doug-fish has left #openstack-keystone | 23:17 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 23:24 | |
| *** mikedillion has quit IRC | 23:25 | |
| *** wanghong has quit IRC | 23:40 | |
| *** shakamunyi has quit IRC | 23:51 | |
| *** Tahmina has quit IRC | 23:53 | |
| *** andreaf has quit IRC | 23:54 | |
| *** gokrokve has quit IRC | 23:55 | |
| *** andreaf has joined #openstack-keystone | 23:55 | |
| *** wanghong has joined #openstack-keystone | 23:56 | |
| *** harlowja is now known as harlowja_away | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!