| *** rodrigods has quit IRC | 00:01 | |
| *** rodrigods has joined #openstack-keystone | 00:03 | |
| *** bambam1 has quit IRC | 00:04 | |
| *** lcheng has joined #openstack-keystone | 00:08 | |
| *** lcheng has quit IRC | 00:12 | |
| *** marcoemorais has quit IRC | 00:19 | |
| *** shakamunyi has joined #openstack-keystone | 00:21 | |
| *** marcoemorais has joined #openstack-keystone | 00:21 | |
| *** praneshp has quit IRC | 00:26 | |
| *** andreaf has quit IRC | 00:26 | |
| *** marcoemorais has quit IRC | 00:27 | |
| *** andreaf has joined #openstack-keystone | 00:27 | |
| *** marcoemorais has joined #openstack-keystone | 00:27 | |
| *** praneshp has joined #openstack-keystone | 00:30 | |
| *** dims has joined #openstack-keystone | 00:32 | |
| *** cjellick has quit IRC | 00:38 | |
| *** cjellick has joined #openstack-keystone | 00:38 | |
| *** cjellick_ has joined #openstack-keystone | 00:39 | |
| *** cjellick_ has quit IRC | 00:39 | |
| *** cjellick_ has joined #openstack-keystone | 00:39 | |
| *** bradjones has quit IRC | 00:40 | |
| *** cjellick has quit IRC | 00:42 | |
| *** marcoemorais has quit IRC | 00:43 | |
| *** shakayumi has joined #openstack-keystone | 00:43 | |
| *** shakamunyi has quit IRC | 00:43 | |
| *** cjellick_ has quit IRC | 00:44 | |
| *** gyee has quit IRC | 00:46 | |
| *** bradjones has joined #openstack-keystone | 00:48 | |
| *** bradjones has joined #openstack-keystone | 00:48 | |
| *** rwsu has quit IRC | 00:49 | |
| *** gokrokve has joined #openstack-keystone | 00:49 | |
| *** harlowja_away is now known as harlowja | 00:49 | |
| *** gokrokve has quit IRC | 00:51 | |
| *** gokrokve_ has joined #openstack-keystone | 00:51 | |
| *** praneshp has joined #openstack-keystone | 00:51 | |
| ayoung-afk | nkinder, done. +A | 00:58 |
|---|---|---|
| ayoung-afk | I like the refactoring in that patch | 00:59 |
| ayoung-afk | morganfainberg, nkinder lookupd was the answer I was looking for WRT "how do we make mod_lookup_identity work on a mac" | 01:00 |
| morganfainberg | aha | 01:00 |
| *** marcoemorais has joined #openstack-keystone | 01:01 | |
| ayoung-afk | morganfainberg, so, it leads to the approach of "letting the OS handle LDAP" and then using federation for the keystone side | 01:03 |
| *** ayoung-afk is now known as ayoung | 01:03 | |
| morganfainberg | makes sense as long as we get enough of the info. | 01:05 |
| *** andreaf has quit IRC | 01:05 | |
| morganfainberg | which we should (and we don't have the *bad* PAM module back) | 01:06 |
| *** andreaf has joined #openstack-keystone | 01:06 | |
| *** gokrokve_ has quit IRC | 01:14 | |
| *** marcoemorais has quit IRC | 01:15 | |
| *** rwsu has joined #openstack-keystone | 01:15 | |
| *** gokrokve has joined #openstack-keystone | 01:15 | |
| *** wanghong has quit IRC | 01:18 | |
| *** marcoemorais has joined #openstack-keystone | 01:18 | |
| *** marcoemorais has quit IRC | 01:19 | |
| *** gokrokve has quit IRC | 01:20 | |
| *** marcoemorais has joined #openstack-keystone | 01:20 | |
| nkinder | ayoung: thanks! That one was sort of the second half of an issue that brant previously fixed. | 01:20 |
| *** marcoemorais has quit IRC | 01:24 | |
| *** marcoemorais has joined #openstack-keystone | 01:26 | |
| *** wanghong has joined #openstack-keystone | 01:31 | |
| *** cyeoh has joined #openstack-keystone | 01:32 | |
| *** mikedillion has joined #openstack-keystone | 01:33 | |
| *** marcoemorais has quit IRC | 01:39 | |
| *** samuelmz has joined #openstack-keystone | 01:39 | |
| *** mikedillion has quit IRC | 01:47 | |
| *** shakayumi has quit IRC | 01:49 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/password https://review.openstack.org/112230 | 01:57 |
| *** diegows has quit IRC | 02:09 | |
| *** alex_xu has joined #openstack-keystone | 02:15 | |
| *** shakamunyi has joined #openstack-keystone | 02:16 | |
| *** nkinder has quit IRC | 02:31 | |
| *** nkinder has joined #openstack-keystone | 02:34 | |
| *** lcheng has joined #openstack-keystone | 02:41 | |
| *** dims has quit IRC | 02:42 | |
| *** dims has joined #openstack-keystone | 02:43 | |
| *** dims has quit IRC | 02:47 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 02:47 | |
| *** shakamunyi has quit IRC | 02:49 | |
| *** shakamunyi has joined #openstack-keystone | 02:49 | |
| *** shakayumi has joined #openstack-keystone | 02:52 | |
| *** shakamunyi has quit IRC | 02:56 | |
| *** shakayumi has quit IRC | 02:56 | |
| *** alexiz has joined #openstack-keystone | 02:57 | |
| *** dims has joined #openstack-keystone | 02:57 | |
| *** lcheng has quit IRC | 03:00 | |
| *** lcheng has joined #openstack-keystone | 03:01 | |
| *** andreaf has quit IRC | 03:04 | |
| *** andreaf has joined #openstack-keystone | 03:05 | |
| *** lcheng has quit IRC | 03:05 | |
| *** zzzeek has quit IRC | 03:06 | |
| *** dims has quit IRC | 03:07 | |
| *** dims has joined #openstack-keystone | 03:08 | |
| *** dims has quit IRC | 03:12 | |
| *** ayoung has quit IRC | 03:23 | |
| *** harlowja is now known as harlowja_away | 03:26 | |
| *** harlowja_away is now known as harlowja | 03:32 | |
| *** andreaf has quit IRC | 03:33 | |
| *** andreaf has joined #openstack-keystone | 03:34 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: wrong logic in assertValidRoleAssignmentListResponse method https://review.openstack.org/119303 | 03:37 |
| *** alex_xu has quit IRC | 03:38 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 03:42 | |
| *** alex_xu has joined #openstack-keystone | 03:45 | |
| *** lcheng has joined #openstack-keystone | 03:50 | |
| *** marcoemorais has joined #openstack-keystone | 04:03 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:05 | |
| *** KanagarajM has joined #openstack-keystone | 04:07 | |
| *** marcoemorais has quit IRC | 04:08 | |
| *** richm has quit IRC | 04:13 | |
| *** jaosorior has joined #openstack-keystone | 04:34 | |
| *** KanagarajM has quit IRC | 04:35 | |
| *** flwang has quit IRC | 04:36 | |
| *** gokrokve has joined #openstack-keystone | 04:56 | |
| *** alexiz has quit IRC | 05:00 | |
| *** YorikSar has quit IRC | 05:01 | |
| *** YorikSar has joined #openstack-keystone | 05:03 | |
| *** KanagarajM has joined #openstack-keystone | 05:03 | |
| *** KanagarajM2 has joined #openstack-keystone | 05:19 | |
| *** KanagarajM has quit IRC | 05:20 | |
| *** andreaf has quit IRC | 05:20 | |
| *** andreaf has joined #openstack-keystone | 05:21 | |
| *** ajayaa has joined #openstack-keystone | 05:45 | |
| *** andreaf has quit IRC | 05:46 | |
| *** praneshp has quit IRC | 05:53 | |
| *** harlowja is now known as harlowja_away | 06:05 | |
| *** rwsu has quit IRC | 06:09 | |
| *** ajayaa has quit IRC | 06:17 | |
| *** stevemar has quit IRC | 06:24 | |
| *** praneshp has joined #openstack-keystone | 06:27 | |
| *** k4n0 has joined #openstack-keystone | 06:27 | |
| *** praneshp_ has joined #openstack-keystone | 06:30 | |
| *** lcheng has quit IRC | 06:31 | |
| *** praneshp has quit IRC | 06:32 | |
| *** praneshp_ is now known as praneshp | 06:32 | |
| *** ukalifon1 has joined #openstack-keystone | 06:34 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 06:40 |
| marekd | mhu: appreciate your eyes on https://review.openstack.org/#/c/124767/1 and https://review.openstack.org/#/c/106751/ ;-) | 06:50 |
| *** ajayaa has joined #openstack-keystone | 07:02 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: use expected_length parameter to assert expected length https://review.openstack.org/124957 | 07:05 |
| *** lufix has joined #openstack-keystone | 07:08 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/password https://review.openstack.org/112230 | 07:09 |
| *** alex_xu has quit IRC | 07:24 | |
| *** gokrokve has quit IRC | 07:26 | |
| *** alex_xu has joined #openstack-keystone | 07:26 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: correct docstring https://review.openstack.org/120333 | 07:29 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 07:31 | |
| *** alex_xu has quit IRC | 07:33 | |
| *** alex_xu has joined #openstack-keystone | 07:34 | |
| *** alex_xu has quit IRC | 07:39 | |
| *** sunrenjie6 has joined #openstack-keystone | 07:40 | |
| *** alex_xu has joined #openstack-keystone | 07:43 | |
| *** Dafna has joined #openstack-keystone | 07:53 | |
| *** aix_ has quit IRC | 07:55 | |
| *** gokrokve has joined #openstack-keystone | 07:58 | |
| *** lsmola has joined #openstack-keystone | 07:59 | |
| *** gokrokve has quit IRC | 08:00 | |
| *** gokrokve has joined #openstack-keystone | 08:00 | |
| *** YorikSar has quit IRC | 08:02 | |
| *** YorikSar has joined #openstack-keystone | 08:04 | |
| *** gokrokve has quit IRC | 08:05 | |
| mhu | marekd, will do, I got to fix one of my patches first :) | 08:05 |
| *** alex_xu has quit IRC | 08:07 | |
| *** alex_xu has joined #openstack-keystone | 08:10 | |
| *** jaosorior has quit IRC | 08:13 | |
| *** afazekas has joined #openstack-keystone | 08:18 | |
| *** RockKuo_Office has joined #openstack-keystone | 08:20 | |
| *** flwang has joined #openstack-keystone | 08:21 | |
| *** henrynash has joined #openstack-keystone | 08:21 | |
| *** alex_xu has quit IRC | 08:26 | |
| openstackgerrit | Julien Danjou proposed a change to openstack/keystonemiddleware: Update oslo-incubator and switch to oslo.{utils,serialization} https://review.openstack.org/124979 | 08:26 |
| *** NellyK has joined #openstack-keystone | 08:29 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: V2 token from trust cannot be generated with user/password https://review.openstack.org/112230 | 08:31 |
| *** jistr has joined #openstack-keystone | 08:31 | |
| *** NellyK has quit IRC | 08:32 | |
| *** junhongl_ has joined #openstack-keystone | 08:34 | |
| *** Tahmina has joined #openstack-keystone | 08:36 | |
| *** aix has joined #openstack-keystone | 08:42 | |
| *** alex_xu has joined #openstack-keystone | 08:43 | |
| *** aix_ has joined #openstack-keystone | 08:46 | |
| *** marcoemorais1 has quit IRC | 08:47 | |
| *** garcianavalon has joined #openstack-keystone | 08:48 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed a change to openstack/keystone: Refactor assignment expansion related functions https://review.openstack.org/119363 | 08:53 |
| *** junhongl__ has joined #openstack-keystone | 08:56 | |
| *** andreaf_ is now known as andreaf | 08:59 | |
| *** junhongl_ has quit IRC | 08:59 | |
| *** gokrokve has joined #openstack-keystone | 08:59 | |
| *** flwang has quit IRC | 09:02 | |
| marekd | mhu: thanks. | 09:03 |
| *** flwang has joined #openstack-keystone | 09:04 | |
| *** junhongl__ has quit IRC | 09:04 | |
| *** gokrokve has quit IRC | 09:04 | |
| ekarlso | nkinder: a q, how you mean by splitting out the ID part of keystone ? | 09:08 |
| *** alex_xu has quit IRC | 09:23 | |
| *** praneshp has quit IRC | 09:34 | |
| *** nellysmitt has joined #openstack-keystone | 09:35 | |
| *** gokrokve has joined #openstack-keystone | 09:59 | |
| *** gokrokve has quit IRC | 10:03 | |
| *** ajayaa has quit IRC | 10:05 | |
| *** nellysmitt has quit IRC | 10:12 | |
| *** keith_ has joined #openstack-keystone | 10:12 | |
| keith_ | hi after a power failure keystone is not allowing any user to login,httpd log shows invalid login | 10:13 |
| keith_ | no user is able to authenticate.. tried creating new user but its not working.. but keystone commands are working for the user admin,but not throgh dashboard | 10:14 |
| *** wanghong has quit IRC | 10:23 | |
| *** ajayaa has joined #openstack-keystone | 10:29 | |
| *** jaosorior has joined #openstack-keystone | 10:35 | |
| *** diegows has joined #openstack-keystone | 10:43 | |
| *** flwang has quit IRC | 10:50 | |
| *** RockKuo_Office has quit IRC | 10:53 | |
| mhu | keith_, what backend do you use for users ? Could be that the power failure corrupted the user base | 10:54 |
| keith_ | mhu: Mysql ,i can perform keystone commands against admin endpoint using admin credentials but in horizon it shows invalid user | 10:56 |
| mhu | the admin endpoint auth doesn't use the users backend, if I were you I'd check the db state | 10:57 |
| *** gokrokve has joined #openstack-keystone | 10:59 | |
| *** gokrokve has quit IRC | 11:04 | |
| keith_ | mhu : db has all the user entries checked in keystone.user | 11:06 |
| *** bjornar has quit IRC | 11:06 | |
| *** dims has joined #openstack-keystone | 11:09 | |
| *** topol has joined #openstack-keystone | 11:11 | |
| *** NM1 has joined #openstack-keystone | 11:13 | |
| *** bjornar has joined #openstack-keystone | 11:17 | |
| *** NM1 has quit IRC | 11:17 | |
| *** bjornar has quit IRC | 11:20 | |
| *** bjornar has joined #openstack-keystone | 11:21 | |
| mhu | keith_, anything in keystone logs ? | 11:21 |
| keith_ | mhu : no log is not showing anything | 11:24 |
| *** topol has quit IRC | 11:24 | |
| keith_ | mhu: tenant-list shows all the projects | 11:25 |
| *** jistr is now known as jistr|english | 11:31 | |
| mhu | keith_, set logging to DEBUG level | 11:35 |
| keith_ | mhu : still no error in logs | 11:41 |
| *** viklund has joined #openstack-keystone | 11:42 | |
| viklund | I think I've found a bug, introduced by the patch to fix bug 1340041 | 11:43 |
| uvirtbot | Launchpad bug 1340041 in keystone "OpenLDAP 2.3: naming attribute [...] is not present in entry; Naming violation" [Medium,Fix released] https://launchpad.net/bugs/1340041 | 11:43 |
| viklund | (nice) | 11:43 |
| viklund | does this work for change-id: I1ed3f53d325eb280e036fbbf8e83d2e645db53cd | 11:44 |
| viklund | oh well | 11:44 |
| viklund | anyhow | 11:44 |
| viklund | I have searched the launchpad for this and haven't found anything, thought I'd stop by here first | 11:45 |
| viklund | in line 1672 (keystone/common/ldap/core.py) in the patch for the above bug the ldap.dn.str2dn array gets converted to a string | 11:45 |
| viklund | which causes naming_rdn to contain "[" and then I get an exception on line 1675 because the string has length one | 11:46 |
| *** dhellmann has quit IRC | 11:48 | |
| *** dhellmann has joined #openstack-keystone | 11:50 | |
| *** gokrokve has joined #openstack-keystone | 11:59 | |
| *** gokrokve has quit IRC | 12:00 | |
| *** gokrokve has joined #openstack-keystone | 12:01 | |
| *** gus has quit IRC | 12:06 | |
| *** gokrokve has quit IRC | 12:06 | |
| *** KanagarajM2 has quit IRC | 12:10 | |
| *** dims has quit IRC | 12:29 | |
| *** dims has joined #openstack-keystone | 12:30 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Add test for getting a token with inherited role https://review.openstack.org/119206 | 12:30 |
| *** waterkinfe has joined #openstack-keystone | 12:33 | |
| dolphm | viklund: can you open a new bug report with the above? | 12:34 |
| *** KanagarajM has joined #openstack-keystone | 12:34 | |
| *** waterkinfe has quit IRC | 12:34 | |
| viklund | dolphm: yes I can do that | 12:34 |
| viklund | I just wanted to check first | 12:34 |
| *** waterkinfe has joined #openstack-keystone | 12:35 | |
| dolphm | viklund: sounds like a valid concern to me, that perhaps we can address before juno is released | 12:38 |
| viklund | dolphm: yes, that would be nice | 12:39 |
| *** gordc has joined #openstack-keystone | 12:44 | |
| viklund | submitted | 12:48 |
| keith_ | mhu : disabled selinux and it works | 12:49 |
| *** miqui has joined #openstack-keystone | 12:49 | |
| mhu | keith_, glad you found a solution | 12:50 |
| marekd | mhu: i must say your auth plugins patch looks pretty advanced :-) | 12:50 |
| mhu | marekd, hopefully it'll look pretty merged soon too ! :D | 12:51 |
| mhu | marekd, now I can have a look at your patches | 12:52 |
| *** jistr|english is now known as jistr | 12:56 | |
| *** NM1 has joined #openstack-keystone | 12:57 | |
| marekd | mhu: i am hoping for that too. | 12:57 |
| marekd | mhu: i need to restore crud operations for mappings and protocols. | 12:57 |
| *** gokrokve has joined #openstack-keystone | 12:59 | |
| *** k4n0 has quit IRC | 13:01 | |
| *** gokrokve has quit IRC | 13:03 | |
| *** nkinder has quit IRC | 13:13 | |
| *** richm has joined #openstack-keystone | 13:16 | |
| jaosorior | amakarov: are you around? | 13:27 |
| *** keith_ has quit IRC | 13:29 | |
| *** KanagarajM has quit IRC | 13:33 | |
| *** topol has joined #openstack-keystone | 13:42 | |
| samuelmz | dolphm, now that we are open for kilo dev ... could you approve this patch (https://review.openstack.org/#/c/119206/) ? | 13:42 |
| samuelmz | dolphm, it has 2 +2 for a while .. | 13:43 |
| dolphm | samuelmz: i'll run a recheck on it first since it's been a couple weeks | 13:43 |
| dolphm | samuelmz: oh nvm, you just rebased | 13:43 |
| samuelmz | dolphm, I just did a rebase . | 13:43 |
| dolphm | samuelmz: +A! | 13:44 |
| samuelmz | dolphm, yep :p | 13:44 |
| samuelmz | dolphm, thanks | 13:44 |
| *** jasondotstar has joined #openstack-keystone | 13:46 | |
| *** radez_g0n3 is now known as radez | 13:49 | |
| *** waterkinfe has quit IRC | 13:51 | |
| afaranha | henrynash, regarding endpoint policy, is there a way to get the date the policy was assigned to the endpoint? | 13:51 |
| afaranha | We need to get the date because we plan to use it on Horizon, to remove the copy of the policies it has. For this, we need to get the policy to Horizon and then, in the following actions, just check is the policy is updated | 13:52 |
| henrynash | afaranha: that’s an interesting idea…but right now I don’t think there is a way…let me have a quick look... | 13:53 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Redact x-subject-token from response headers https://review.openstack.org/123954 | 13:53 |
| afaranha | thanks | 13:54 |
| henrynash | afaranha: what would be the ideal…a notification on change of policy for an endpoint? | 13:55 |
| rodrigods | henrynash, this would be the ideal, but a last modified approach via a query would be great | 13:56 |
| henrynash | afrarana: Ok, so teh bad news is we don’t have anything there yet…although I’m certainly open to adding it. | 13:56 |
| henrynash | rodrigods: one problem with a datestamp, is that if your policy for an endpoint come by virtue of, say, what region you are in, then there is no datestamp related to an endpoint that you can look at... | 13:58 |
| samuelmz | henrynash, so we could use a sort of hash, right? | 13:58 |
| henrynash | rodigods: …but we could send notifications for all endpoints in a region that wer affected by a new policy being applied to that rgion | 13:58 |
| *** gokrokve has joined #openstack-keystone | 13:59 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:00 | |
| rodrigods | henrynash, so... would be possible for horizon to listen those notifications? | 14:00 |
| *** nkinder has joined #openstack-keystone | 14:01 | |
| *** sigmavirus24 has left #openstack-keystone | 14:01 | |
| henrynash | rodigods: yep | 14:01 |
| henrynash | rodigods: we do a similar thing when, say, a project is deleted, we send a notifcaiton so that, for insance, nova can delete the VMs are are owned by the project | 14:02 |
| raildo | henrynash, In fact, there is a bug for this, because Nova can not consume this notification :P | 14:03 |
| henrynash | raildo: :-) because? | 14:03 |
| raildo | henrynash, https://bugs.launchpad.net/keystone/+bug/967832 | 14:03 |
| uvirtbot | Launchpad bug 967832 in neutron "Resources owned by a project/tenant are not cleaned up after that project is deleted from keystone" [Undecided,In progress] | 14:03 |
| samuelmz | dolphm, regarding the bug for extracting assignment tests from test_v3_identity .. I've created a new file called test_v3_assignment .. | 14:03 |
| samuelmz | dolphm, I'd like to know if I'd add copyright info .. | 14:04 |
| samuelmz | dolphm, https://review.openstack.org/#/c/121653/1/keystone/tests/test_v3_assignment.py | 14:04 |
| *** kashyap has quit IRC | 14:04 | |
| *** gokrokve has quit IRC | 14:04 | |
| dolphm | samuelmz: since you're just splitting a file in two, i'd copy all the copyright headers from the original file in | 14:04 |
| dolphm | samuelmz: but copyrights attributed to the openstack foundation are generally wrong and can probably be removed :) | 14:05 |
| henrynash | raildo: ok, looks like we have stuff to talk about in Paris! | 14:06 |
| raildo | henrynash, great! | 14:06 |
| samuelmz | dolphm, ok .. I'm going to keep that ... thanks | 14:08 |
| samuelmz | dolphm, regarding test_backend ... shouldn't we also split that? | 14:09 |
| *** Tahmina has quit IRC | 14:09 | |
| samuelmz | dolphm, I mean tests for assignment and tests for identity .. | 14:09 |
| dolphm | samuelmz: certainly could! | 14:09 |
| dolphm | samuelmz: how big is that file now? | 14:09 |
| samuelmz | dolphm, cool ... | 14:09 |
| samuelmz | dolphm, 4.7k | 14:09 |
| *** ukalifon1 has quit IRC | 14:09 | |
| dolphm | samuelmz: lines? | 14:09 |
| samuelmz | dolphm, yes | 14:10 |
| morganfainberg | yeesh | 14:10 |
| dolphm | samuelmz: yes, split :D | 14:10 |
| samuelmz | :-) | 14:10 |
| *** andreaf_ has joined #openstack-keystone | 14:10 | |
| *** htruta has joined #openstack-keystone | 14:10 | |
| dolphm | test_backend_identity, test_backend_identity_sql, test_backend_identity_ldap, test_backend_assignment, test_backend_assignment_sql, test_backend_assignment_ldap, etc? | 14:11 |
| samuelmz | dolphm, exactly | 14:12 |
| *** andreaf has quit IRC | 14:13 | |
| *** andreaf_ is now known as andreaf | 14:14 | |
| *** andreaf_ has joined #openstack-keystone | 14:14 | |
| dolphm | morganfainberg: how many conflicting summit scheduling etherpads are there? :-/ | 14:21 |
| dolphm | morganfainberg: https://etherpad.openstack.org/p/kilo-keystone-summit-topics | 14:21 |
| dolphm | morganfainberg: https://etherpad.openstack.org/p/keystone-kilo-summit-sessions | 14:22 |
| morganfainberg | dolphm, those are the only two, use https://etherpad.openstack.org/p/kilo-keystone-summit-topics | 14:22 |
| morganfainberg | i'm slowly getting things moved over (started yesterday) | 14:22 |
| morganfainberg | should have it done today. but not fully awake yet. | 14:23 |
| dolphm | morganfainberg: then the other needs to be nuked with a link to the good one | 14:23 |
| morganfainberg | dolphm, yes. | 14:23 |
| *** ajayaa has quit IRC | 14:24 | |
| morganfainberg | dolphm, updated the link in the meeting agenda | 14:25 |
| *** andreaf has quit IRC | 14:26 | |
| *** gokrokve has joined #openstack-keystone | 14:27 | |
| *** bradjones has quit IRC | 14:27 | |
| *** gokrokve has quit IRC | 14:30 | |
| *** gokrokve has joined #openstack-keystone | 14:31 | |
| *** bambam1 has joined #openstack-keystone | 14:32 | |
| morganfainberg | dolphm, so next week i'm travelling | 14:34 |
| dolphm | morganfainberg: ack | 14:34 |
| morganfainberg | dolphm, i should be mostly around, on Tuesday for the meeting, but Wed->Friday will be busy | 14:36 |
| samuelmz | dolphm, morganfainberg: regarding the tests (again) .. | 14:39 |
| samuelmz | dolphm, morganfainberg: I also think having different classes to different entities would help developers to better find and create new tests in right place ... | 14:39 |
| *** bknudson has joined #openstack-keystone | 14:39 | |
| dstanek | morganfainberg: business or vacation? | 14:39 |
| morganfainberg | dstanek, business | 14:39 |
| morganfainberg | dstanek, defcore conversations on monday/tuesday and then hitting up HP in sunnyvale to talk about keystone | 14:39 |
| samuelmz | dolphm, morganfainberg: like having DomainTestCase, RoleTestCase etc.. for test_v3_identity ... instead having a single class IdentityTestCase with all tests .. | 14:40 |
| dstanek | samuelmz: i sorta agree - i wish they were aligned along use case more | 14:40 |
| samuelmz | dstanek, yep .. could be better | 14:41 |
| dolphm | samuelmz: problem with that level of segregation is that so many of the tests hit several entities in the same backend (for example, EndpointTestCase would require hitting services and regions) | 14:41 |
| bknudson | I hope we didn't get morganfainberg in trouble. | 14:41 |
| bknudson | I'm usually in trouble when somebody wants to talk to me about keystone | 14:41 |
| dolphm | morganfainberg: that's a long interview | 14:41 |
| bknudson | why don't pki tokens work... why don't uuid tokens work | 14:42 |
| bknudson | why doesn't the memcache backend work | 14:42 |
| samuelmz | dolphm, couldn't EndpointTestCase call service and regions setUp() ? | 14:42 |
| *** andreaf has joined #openstack-keystone | 14:42 | |
| bknudson | and of course they're always asking about grizzly | 14:42 |
| morganfainberg | lol. nah this is 100% voluntary, getting to chat about identity at HP and helping to get to know the people doing it. | 14:42 |
| dstanek | samuelmz: for the last few days i've been reworking all of my test/hacking patches against master - so many changes that have been killing my rebasing :-( | 14:42 |
| dolphm | samuelmz: yes, but you'd still want to test things like "what happens to the endpoint when i delete the parent service?" | 14:42 |
| *** openstackgerrit has quit IRC | 14:42 | |
| morganfainberg | i don't have faces / names with the people not spending time here in upstream. so figured now was a good time to figure out what they're trying to do etc. | 14:43 |
| morganfainberg | before Kilo gets too crazy. | 14:43 |
| dolphm | morganfainberg: ++ | 14:43 |
| *** bradjones has joined #openstack-keystone | 14:44 | |
| *** bradjones has joined #openstack-keystone | 14:44 | |
| bknudson | morganfainberg: just be ready... might be a trap. | 14:44 |
| *** bambam1 has quit IRC | 14:44 | |
| morganfainberg | well at least i shouldn't get corenered by "why doesn't grizzly work" questions ;) | 14:44 |
| samuelmz | dolphm, I don't see any problem in setting up services and regions for EndpoinTestCase .. we'd just replicate the code for creation of services and regions .. but we'd gain a lot of code clarity | 14:46 |
| samuelmz | dolphm, imo | 14:46 |
| dolphm | samuelmz: i don't totally disagree, just playing devil's advocate. dstanek: can you outline the bucket's you'd have if you organized tests by use case? | 14:48 |
| morganfainberg | dolphm, dstanek, well we should move "unit" tests to "unit" and also stop intermingling the functional vs unit tests | 14:48 |
| *** ayoung has joined #openstack-keystone | 14:49 | |
| dolphm | morganfainberg: yeah, that'd be a relatively easy change. the unit tests aren't generally well isolated | 14:50 |
| dolphm | self-contained, anyway | 14:50 |
| morganfainberg | dolphm, thats where i'd start. | 14:51 |
| nkinder | The review notification bot doesn't seem to be working... | 14:51 |
| nkinder | I just proposed a patch for the new LDAP bug that came in last night | 14:51 |
| nkinder | https://review.openstack.org/#/c/125083/ | 14:51 |
| *** thedodd has joined #openstack-keystone | 14:51 | |
| morganfainberg | it would get us to a much better place when it comes to moving towards functional testing. | 14:51 |
| morganfainberg | nkinder, ah thanks! | 14:51 |
| dolphm | nkinder: oh awesome! | 14:52 |
| morganfainberg | becuase there is some cleanup that is needed to allow those tests to work more smoothly against "real" backends as well. | 14:52 |
| dolphm | viklund: ^^ | 14:52 |
| morganfainberg | nkinder, there is also this one: https://bugs.launchpad.net/keystone/+bug/1375139 I've gotten an devstack *mostly* stood up | 14:53 |
| uvirtbot | Launchpad bug 1375139 in keystone "LDAP, non ascii characters in CN field couse error while switching projects" [Medium,New] | 14:53 |
| morganfainberg | turns out we can't run devstack + ldap in ubuntu at the moment | 14:53 |
| morganfainberg | it... uh fails spectacularly | 14:53 |
| morganfainberg | as in, we don't even install slapd. | 14:53 |
| nkinder | Yeah, I usually don't use devstack when doing LDAP. I just set up a real deployment | 14:54 |
| morganfainberg | nkinder, we'll need a way of setting up ldap *sanely* for functional testing. | 14:54 |
| morganfainberg | devstack or something else eventually. | 14:54 |
| nkinder | morganfainberg: absolutely. devstack makes the most sense | 14:55 |
| samuelmz | morganfainberg, when yoy say 'stop intermingling the functional vs unit tests' .. do you mean stop calling assignment_api directly from test_v3_identity, for example? | 14:55 |
| *** htruta has quit IRC | 14:55 | |
| samuelmz | morganfainberg, and then call everything via url | 14:55 |
| morganfainberg | samuelmz, no, i mean move anything that isn't a RESTful test case into keystone/tests/unit | 14:55 |
| morganfainberg | samuelmz, unit tests are not the full-stack tests. | 14:56 |
| samuelmz | morganfainberg, +1 | 14:56 |
| samuelmz | morganfainberg, dstanek, dolphm I'm going to create an etherpad to list test improvements I see (including what we've discussed now) | 14:57 |
| morganfainberg | samuelmz, cool. | 14:57 |
| samuelmz | morganfainberg, dstanek, dolphm and then we can have a better discussion | 14:57 |
| *** joesavak has joined #openstack-keystone | 14:57 | |
| samuelmz | :-) | 14:57 |
| nkinder | morganfainberg: so that bug looks to be using the assignment LDAP driver | 14:58 |
| morganfainberg | nkinder, ah ok. that was what i *figured* | 14:58 |
| morganfainberg | nkinder, but since you were around i thought i'd bug you about it. | 14:58 |
| nkinder | morganfainberg: yeah, I'll try to look at it some | 14:58 |
| marekd | mhu: thanks for the reviews! | 15:00 |
| marekd | i will give you more soon :-) | 15:00 |
| dstanek | samuelmz: see https://blueprints.launchpad.net/keystone/+spec/restructuring-tests and the etherpad for it | 15:01 |
| mhu | marekd, you're welcome ! I need to redeploy a test bed for federation and once I am done, I'll test your patch with mine and see how it goes | 15:01 |
| marekd | mhu: i checked the plugin today on my testbed before i submitted. but obviously you are encouraged to do your tests. i might have skipped something. | 15:02 |
| samuelmz | dstanek, great! taking a look at this .. thanks for this link | 15:03 |
| dstanek | samuelmz: in addition to making the tests follow a structure that I know my personal goal is to have all of the tests run in less than 60 seconds and not because they are run in parallel | 15:03 |
| nkinder | morganfainberg: I can take that one. It should be quick to knock out (the fix proposal is correct, but it just needs a test) | 15:04 |
| morganfainberg | nkinder, ok sounds good. | 15:04 |
| samuelmz | dstanek, ++ | 15:04 |
| morganfainberg | dstanek, i think we can absolutely do that for unit. I don't think functional should be constrained to 60s. | 15:05 |
| dstanek | morganfainberg: i'm not saying constrait - like i would force a failure, but the should run much, much faster | 15:05 |
| *** dims has quit IRC | 15:06 | |
| morganfainberg | dstanek, sure. | 15:06 |
| *** dims has joined #openstack-keystone | 15:06 | |
| dstanek | i will be very disappointed if i can't get it close to that this cycle | 15:06 |
| morganfainberg | dstanek, but i think it'll also matter what backend you're running on. e.g. once we get functional tests able to run mysql, pgsql, ldap, etc it'll be different profiles | 15:07 |
| *** andreaf has quit IRC | 15:07 | |
| morganfainberg | dstanek, a lot of the issues with "real" backends is also not needing to rebuild the schema every test. | 15:07 |
| morganfainberg | and not needing to restart the whole eventlet process each test. | 15:07 |
| *** andreaf has joined #openstack-keystone | 15:08 | |
| morganfainberg | s/not// | 15:08 |
| morganfainberg | in both of those | 15:08 |
| dstanek | morganfainberg: yeah, i've started working on that a little - in one of my environments i only run the tests against maria | 15:08 |
| dstanek | morganfainberg: the challenge right now is that they don't work | 15:09 |
| morganfainberg | dstanek, its a topic i expect to have open at the summit | 15:09 |
| morganfainberg | dstanek, some real sitdown time (either pod, session, something) | 15:09 |
| *** david-lyle has joined #openstack-keystone | 15:09 | |
| *** htruta has joined #openstack-keystone | 15:09 | |
| *** dims has quit IRC | 15:10 | |
| *** bambam1 has joined #openstack-keystone | 15:12 | |
| bknudson | btw, I have had no problem running devstack on ubuntu | 15:13 |
| samuelmz | morganfainberg, dstanek: on my machine : Ran 4796 tests in 229.958s for all keystone tests | 15:13 |
| morganfainberg | bknudson, ldap? | 15:13 |
| morganfainberg | bknudson, general devstack works fine. | 15:13 |
| samuelmz | morganfainberg, dstanek: if I run just test_backend_ldap tests : Ran 1572 tests in 102.614s | 15:13 |
| bknudson | morganfainberg: yes, running with ldap backend configured | 15:14 |
| morganfainberg | bknudson, but a clean VM failed pretty specatularly (didn't try and install any ldap utils) | 15:14 |
| bknudson | My VM is anything but clean. | 15:14 |
| morganfainberg | bknudson, ldaputils, slapd, etc all wasn't even tried to be installed | 15:14 |
| morganfainberg | somewhere they removed the call to 'start_ldap' which seems to install ldap packages | 15:14 |
| samuelmz | morganfainberg, dstanek: I have a feeling that we have too much inheritance on those backend_ldap tests .. and maybe we rerun tests that would not need to | 15:14 |
| morganfainberg | samuelmz, it's a lot of restructuring that is needed. | 15:15 |
| samuelmz | morganfainberg, dstanek: yes .. just ldap_backend took almost a half time of all keystone tests | 15:15 |
| *** gokrokve_ has joined #openstack-keystone | 15:15 | |
| *** gokrokve_ has quit IRC | 15:15 | |
| *** gokrokve_ has joined #openstack-keystone | 15:16 | |
| *** rwsu has joined #openstack-keystone | 15:16 | |
| morganfainberg | oooh oooh we ... we might get ourselves under 200 open bugs for keystone here! | 15:16 |
| dstanek | samuelmz: yes, in my etherpad i think i talk about over use of shared setup | 15:17 |
| *** cjellick has joined #openstack-keystone | 15:19 | |
| samuelmz | dstanek, hmm .. cool .. I'll take a deeper look at that later .. and write some additional ideas on etherpad .. and then I'll be back here :-) | 15:19 |
| *** gokrokve has quit IRC | 15:19 | |
| *** openstackgerrit has joined #openstack-keystone | 15:23 | |
| *** cjellick_ has joined #openstack-keystone | 15:24 | |
| *** cjellick has quit IRC | 15:27 | |
| openstackgerrit | Terry Howe proposed a change to openstack/python-keystoneclient: Identity plugin that manages passwords and tokens https://review.openstack.org/124830 | 15:32 |
| *** stevemar has joined #openstack-keystone | 15:32 | |
| *** zzzeek has joined #openstack-keystone | 15:34 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Convert unicode to UTF8 when calling ldap.str2dn() https://review.openstack.org/125097 | 15:34 |
| nkinder | morganfainberg: there you go ^^^ | 15:34 |
| morganfainberg | nkinder, awesome! | 15:34 |
| *** afazekas has quit IRC | 15:35 | |
| *** gyee has joined #openstack-keystone | 15:37 | |
| *** gokrokve_ has quit IRC | 15:37 | |
| *** gokrokve has joined #openstack-keystone | 15:38 | |
| *** gokrokve has quit IRC | 15:39 | |
| *** gokrokve has joined #openstack-keystone | 15:39 | |
| *** lufix has quit IRC | 15:40 | |
| stevemar | marekd, lol - thanks for the comment "Do not review" | 15:41 |
| *** gokrokve has quit IRC | 15:44 | |
| *** gsilvis has joined #openstack-keystone | 15:45 | |
| *** wwriverrat has joined #openstack-keystone | 15:55 | |
| *** wwriverrat has left #openstack-keystone | 15:55 | |
| *** lcheng has joined #openstack-keystone | 15:57 | |
| *** dims has joined #openstack-keystone | 16:00 | |
| *** dims_ has joined #openstack-keystone | 16:01 | |
| *** joesavak has quit IRC | 16:03 | |
| *** dims has quit IRC | 16:06 | |
| rodrigods | stevemar, ping | 16:08 |
| *** gokrokve has joined #openstack-keystone | 16:08 | |
| stevemar | rodrigods, pong-ish | 16:10 |
| rodrigods | stevemar, was having an issue here related to a missing "-----BEGIN CERTIFICATE-----" in the generated certificate by keystone-manager | 16:12 |
| rodrigods | was trying to find the place to fix it (if necessary) | 16:13 |
| *** gokrokve has quit IRC | 16:13 | |
| *** packet has joined #openstack-keystone | 16:14 | |
| *** packet is now known as Guest55921 | 16:14 | |
| *** marcoemorais has joined #openstack-keystone | 16:17 | |
| *** r-daneel has joined #openstack-keystone | 16:19 | |
| *** r-daneel has quit IRC | 16:20 | |
| *** jaosorior has quit IRC | 16:23 | |
| *** bradjones has quit IRC | 16:24 | |
| stevemar | rodrigods, the cert file needs to look like ... https://github.com/openstack/keystone/blob/master/examples/pki/certs/cacert.pem | 16:25 |
| stevemar | rodrigods, not much we can do on that issue, we're using pysaml2 to read the files | 16:25 |
| *** bradjones has joined #openstack-keystone | 16:26 | |
| *** bradjones has joined #openstack-keystone | 16:26 | |
| *** r-daneel has joined #openstack-keystone | 16:28 | |
| openstackgerrit | Nathan Kinder proposed a change to openstack/keystone: Convert unicode to UTF8 when calling ldap.str2dn() https://review.openstack.org/125097 | 16:28 |
| *** jistr has quit IRC | 16:28 | |
| *** thedodd has quit IRC | 16:28 | |
| *** Guest55921 has quit IRC | 16:28 | |
| *** marcoemorais has quit IRC | 16:31 | |
| *** joesavak has joined #openstack-keystone | 16:31 | |
| *** marcoemorais has joined #openstack-keystone | 16:31 | |
| *** ayoung has quit IRC | 16:32 | |
| *** lcheng has quit IRC | 16:32 | |
| *** lcheng has joined #openstack-keystone | 16:32 | |
| *** nellysmitt has joined #openstack-keystone | 16:32 | |
| *** amcrn has joined #openstack-keystone | 16:34 | |
| *** NM1 has quit IRC | 16:36 | |
| *** marcoemorais has quit IRC | 16:42 | |
| *** garcianavalon has quit IRC | 16:44 | |
| *** ayoung has joined #openstack-keystone | 16:46 | |
| *** dims_ has quit IRC | 16:49 | |
| *** dims has joined #openstack-keystone | 16:49 | |
| *** thedodd has joined #openstack-keystone | 16:50 | |
| rodrigods | morganfainberg, ping | 16:54 |
| morgan_remote_ | rodrigods: pong | 16:56 |
| rodrigods | morgan_remote_, we've added a topic regarding HM patches to today's meeting, but unfortunately, we won't be able to be present. | 16:57 |
| morgan_remote_ | Ah ok. I'll recommend reviewing the patches? Can you put links to the relevant reviews? | 16:58 |
| rodrigods | morgan_remote_, yeah... the link is at the topic =) | 16:58 |
| rodrigods | morgan_remote_, also... if you need an environment to test it, we can provide a VM with the full deployment (including keystone, keystoneclient and openstackclient) | 16:59 |
| morgan_remote_ | Ok! | 16:59 |
| rodrigods | morgan_remote_, thanks, and sorry for not being able to be there =) | 17:00 |
| morgan_remote_ | Ok. I think I can probably setup a devstack and test myself as well. If you have any special documentation that is always good. | 17:00 |
| morgan_remote_ | I'll definitely encourage reviews so we can get that stuff moving again. | 17:01 |
| rodrigods | morgan_remote_, yeah, it should work without any extra pain =) | 17:01 |
| rodrigods | thanks | 17:02 |
| morgan_remote_ | That's the best kind of new feature! | 17:02 |
| raildo | morgan_remote_, we have this patch about the API documentation https://review.openstack.org/#/c/111355/ | 17:02 |
| morgan_remote_ | Great! | 17:02 |
| *** marcoemorais has joined #openstack-keystone | 17:05 | |
| *** amakarov has quit IRC | 17:05 | |
| *** NM1 has joined #openstack-keystone | 17:05 | |
| *** thedodd has quit IRC | 17:09 | |
| *** gokrokve has joined #openstack-keystone | 17:09 | |
| dstanek | i'm really bad at naming things | 17:10 |
| rodrigods | dstanek, me too =( | 17:10 |
| raildo | dstanek, rodrigods http://minilua.com/wp-content/plugins/wp-nohotlink/cache/664564.jpg | 17:11 |
| raildo | hahaha | 17:11 |
| *** raildo has left #openstack-keystone | 17:11 | |
| *** raildo has joined #openstack-keystone | 17:12 | |
| dstanek | :-) | 17:12 |
| marekd | stevemar: well, i marked as WIP but aparently it doesn't really mean 'do not review' :P | 17:12 |
| afaranha | To test the policies in the sample policy patch https://review.openstack.org/#/c/123509/ , I would like to know where's the test in keystone that tests policy.v3cloudsample.json | 17:14 |
| *** gokrokve has quit IRC | 17:14 | |
| *** bradjones has quit IRC | 17:15 | |
| *** gokrokve has joined #openstack-keystone | 17:16 | |
| *** lufix has joined #openstack-keystone | 17:17 | |
| *** harlowja_away is now known as harlowja | 17:18 | |
| *** praneshp has joined #openstack-keystone | 17:23 | |
| stevemar | afaranha, i'm not sure it's tested much in keystone | 17:24 |
| stevemar | afaranha, the policy engine is actually oslo-incubator code, so the tests are there | 17:24 |
| stevemar | tests: https://github.com/openstack/oslo-incubator/blob/master/tests/unit/test_policy.py | 17:24 |
| stevemar | afaranha, engine code: https://github.com/openstack/oslo-incubator/blob/master/openstack/common/policy.py | 17:25 |
| stevemar | since many projects use policy, it's owned by oslo (at the moment anyway) | 17:25 |
| morgan_remote_ | It should also graduate to a lib in kilo. We (keystone) might adopt it based on some discussions with dhellmann. Depending on who ends up reviewing it most of course. | 17:26 |
| *** lufix has quit IRC | 17:27 | |
| *** bradjones has joined #openstack-keystone | 17:27 | |
| *** bradjones has quit IRC | 17:27 | |
| *** bradjones has joined #openstack-keystone | 17:27 | |
| *** nellysmitt has quit IRC | 17:28 | |
| stevemar | afaranha, there are also some keystone tests: https://github.com/openstack/keystone/blob/9a9f707eb2b4ad7c4a91f30ce2daf3763838f78f/keystone/tests/test_policy.py | 17:28 |
| stevemar | morgan_remote_, moar projects under the keystone umbrella tree | 17:28 |
| morgan_remote_ | Haha | 17:29 |
| morgan_remote_ | Totally digging having its access on the phone like this. | 17:29 |
| morgan_remote_ | S/its/irc | 17:30 |
| afaranha | stevemar: Let me see... If I want to test a new policy file, I just need to modify this line, right? https://github.com/openstack/keystone/blob/9a9f707eb2b4ad7c4a91f30ce2daf3763838f78f/keystone/tests/test_policy.py#L214 | 17:30 |
| *** nellysmitt has joined #openstack-keystone | 17:30 | |
| *** bambam1 has quit IRC | 17:31 | |
| afaranha | In Oslo test_policy.py, am I able to test a existing policy file? | 17:31 |
| stevemar | afaranha, nope, that tests to make sure policy.json and policy.v3cloudsample.json have the same content | 17:32 |
| stevemar | afaranha, here we go: https://github.com/openstack/keystone/blob/9a9f707eb2b4ad7c4a91f30ce2daf3763838f78f/keystone/tests/core.py#L335 | 17:32 |
| stevemar | afaranha, you will need to create a new test suite probably, and override that option to point to your new file | 17:33 |
| stevemar | then i guess setup your credentials (roles, projects, domains) properly and then issue requests to see if they work | 17:33 |
| *** Tahmina has joined #openstack-keystone | 17:36 | |
| *** mflobo_ has joined #openstack-keystone | 17:40 | |
| afaranha | stevemar: Is there an easy way to test this? As I see this class is used by many other, if I create a new one I need to create all it's subclasses also | 17:40 |
| *** mflobo has quit IRC | 17:43 | |
| *** mflobo__ has joined #openstack-keystone | 17:43 | |
| *** gokrokve has quit IRC | 17:45 | |
| *** mflobo_ has quit IRC | 17:46 | |
| *** gokrokve has joined #openstack-keystone | 17:46 | |
| stevemar | afaranha, just make a class that extends test_v3.RestfulTestCase, and overrides that option | 17:46 |
| stevemar | you shouldn't need to create all it's subclasses | 17:46 |
| afaranha | Lot better, thanks :D | 17:47 |
| *** gokrokve has quit IRC | 17:49 | |
| *** gokrokve has joined #openstack-keystone | 17:49 | |
| *** lsmola has quit IRC | 17:54 | |
| *** NM2 has joined #openstack-keystone | 18:03 | |
| *** david-lyle is now known as david-lyle_afk | 18:05 | |
| *** NM1 has quit IRC | 18:05 | |
| *** gokrokve has quit IRC | 18:08 | |
| *** gokrokve has joined #openstack-keystone | 18:09 | |
| *** gokrokve has quit IRC | 18:10 | |
| *** gokrokve has joined #openstack-keystone | 18:10 | |
| *** Ephur has joined #openstack-keystone | 18:13 | |
| *** aix_ has quit IRC | 18:13 | |
| *** aix has quit IRC | 18:13 | |
| *** gokrokve has quit IRC | 18:17 | |
| *** nellysmitt has quit IRC | 18:20 | |
| *** nellysmitt has joined #openstack-keystone | 18:20 | |
| *** nellysmitt has quit IRC | 18:21 | |
| dolphm | bknudson: p.s. you were summoned on https://review.openstack.org/#/c/124715/ | 18:28 |
| bknudson | dolphm: I'll try to look at it tonight... too busy during the day lately | 18:30 |
| *** diegows has quit IRC | 18:36 | |
| *** david-lyle_afk has quit IRC | 18:38 | |
| *** thedodd has joined #openstack-keystone | 18:41 | |
| *** jsavak has joined #openstack-keystone | 18:42 | |
| *** joesavak has quit IRC | 18:45 | |
| *** NM2 has quit IRC | 18:46 | |
| *** openstackgerrit has quit IRC | 18:47 | |
| *** openstackgerrit has joined #openstack-keystone | 18:47 | |
| *** henrynash has quit IRC | 18:51 | |
| *** diegows has joined #openstack-keystone | 18:53 | |
| *** henrynash has joined #openstack-keystone | 18:53 | |
| *** flwang has joined #openstack-keystone | 18:53 | |
| *** NM1 has joined #openstack-keystone | 18:55 | |
| *** flwang has quit IRC | 18:56 | |
| dolphm | dstanek: alright, i'm curious what you did with growler? what did you want notifications on beyond starred stuff? | 19:00 |
| *** morganfainberg changes topic to "Now open for Kilo development! Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Summit Topics, Think of a Goal/Question for each session: https://etherpad.openstack.org/p/kilo-keystone-summit-topics" | 19:01 | |
| dstanek | dolphm: i started with a hack that just looked for 'keystone' in the project name - so i would get a notification for changes i any keystone review | 19:02 |
| morganfainberg | dstanek, i downgraded py33 tests for keystone to expirimental, they're only triggered with a comment now | 19:02 |
| ayoung | gyee, MFA issue: unscoped to scoped drops the methods used to get the initial token. Is that a problem? | 19:02 |
| morganfainberg | dstanek, because they were *always* failing | 19:02 |
| ayoung | Or is that correct behaviour? | 19:02 |
| morganfainberg | ayoung, huh, interesting question | 19:02 |
| dolphm | dstanek: that's how the project originally started for me, filtering on any review that's is:watched -- but it was too much noise | 19:02 |
| dolphm | dstanek: jenkins spam on every change, etc | 19:03 |
| dstanek | dolphm: at certain times i was getting too many hits as yo can imagine, so i started looking for my name in the review and other key phrases i care about | 19:03 |
| dstanek | still a work in progress - but the thing i was definitely missig was new reviews | 19:03 |
| morganfainberg | nkinder, gyee, i'm still setting up my schedule for next week, i know on 10/8 i'm busy for a couple hours in the morning. - other than that pretty open | 19:03 |
| dstanek | morganfainberg: i'll get my py33 patches up to date with master - if we can get them merged then py33 would be working | 19:03 |
| morganfainberg | dstanek, we can bump it back to non-vote anytime | 19:04 |
| *** praneshp has quit IRC | 19:04 | |
| morganfainberg | dstanek, super easy, but it wasn't worth the resource consumption at the moment. | 19:04 |
| *** gokrokve has joined #openstack-keystone | 19:04 | |
| dolphm | dstanek: like a notification whenever a review is created on a watched project? | 19:04 |
| dstanek | dolphm: exactly | 19:04 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:04 | |
| dstanek | or if it's a review i've already been engaged in | 19:04 |
| gyee | ayoung, should be fine, MFA should be atomic | 19:05 |
| gyee | morganfainberg, are we meeting nkinder at a local bar? | 19:06 |
| dolphm | dstanek: hmm... maybe it should have a bunch of flags for which reviews to alert on | 19:06 |
| *** praneshp has joined #openstack-keystone | 19:06 | |
| morganfainberg | gyee, nkinder, that works for me. | 19:06 |
| dolphm | dstanek: i.e. --starred being the current behavior | 19:06 |
| gyee | morganfainberg, nkinder, http://tiedhouse.com/ | 19:06 |
| gyee | if you guys up for beer | 19:07 |
| nkinder | tied house is a 3 block walk from my office | 19:07 |
| morganfainberg | nkinder, nice! | 19:07 |
| gyee | Castro have a bunch of nice food places | 19:07 |
| dstanek | dolphm: that would probably bee good | 19:07 |
| *** praneshp has quit IRC | 19:08 | |
| nkinder | What's the history around token flushing? Why is it handled outside of the keystone server itself? | 19:09 |
| stevemar | nkinder, so folks can make a cron job out of it? | 19:09 |
| morganfainberg | nkinder, historically keystone had 1 worker and eventlet doesn't yeild on mysqldb calls | 19:10 |
| nkinder | stevemar: yeah, I know that's what's typically done | 19:10 |
| morganfainberg | nkinder, so it would lock up keystone (still does with gap lock in MySQL + innodb) while the flush occured | 19:10 |
| nkinder | morganfainberg: ok, so we'd lock up during a large flush | 19:10 |
| morganfainberg | nkinder, but with the new flush batch size code it should be a lot better | 19:10 |
| nkinder | morganfainberg: are there any thoughts of moving this into keystone at some point? | 19:11 |
| morganfainberg | nkinder, it would need a worker-type thread to really be effective | 19:11 |
| morganfainberg | nkinder, and i'm concerned about adding "worker" threads as a pattern in keystone | 19:11 |
| nkinder | morganfainberg: yeah, that makes sense. I'm trying to see if there is a nice way of avoiding the problem of someone not setting up a cron job | 19:12 |
| ayoung | gyee, ok | 19:12 |
| nkinder | I spoke with someone today who had a 42GB token database | 19:12 |
| morganfainberg | nkinder, ouch | 19:12 |
| nkinder | ....whoops | 19:12 |
| morganfainberg | nkinder, partition tables | 19:13 |
| morganfainberg | nkinder, *don't hurt me* | 19:13 |
| morganfainberg | nkinder, when they upgrade to juno... recommend they truncate the token table before running the migration(s) | 19:13 |
| nkinder | morganfainberg: a flush has been done for that database, which cut it down to 12MB | 19:15 |
| morganfainberg | way better | 19:15 |
| *** thedodd has quit IRC | 19:16 | |
| samuelmz | dolphm, something went wrong with the patch you have set workflow+1 (https://review.openstack.org/#/c/119206/) | 19:21 |
| samuelmz | dolphm, do we have a re-workflow statement ? :p | 19:22 |
| dolphm | samuelmz: you need to diagnose the failed build, file a bug if appropriate, and issue a recheck on it accordingly | 19:23 |
| *** david-lyle_afk has joined #openstack-keystone | 19:26 | |
| *** david-lyle_afk is now known as david-lyle | 19:26 | |
| samuelmz | dolphm, I found this related bug #1357055 | 19:31 |
| uvirtbot | Launchpad bug 1357055 in nova "Race to delete shared subnet in Tempest neutron full jobs" [Critical,Fix committed] https://launchpad.net/bugs/1357055 | 19:31 |
| samuelmz | dolphm, should I do `recheck bug 1357055` or `recheck no bug`? | 19:31 |
| samuelmz | dolphm, what's the difference? | 19:31 |
| dolphm | samuelmz: recheck against the relevant bug | 19:31 |
| samuelmz | dolphm, thanks | 19:33 |
| dolphm | samuelmz: "no bug" means the failure wasn't due to an issue that can/should be tracked, like "this depended on a change in another project, which has now merged, so the tests should succeed here this time" | 19:33 |
| bknudson | at some point we should decide if we're getting anything but trouble out of the -neutron- gate tests | 19:42 |
| *** praneshp has joined #openstack-keystone | 19:42 | |
| dstanek | bknudson: was this going to be taken care of on the oslo side? https://review.openstack.org/#/c/55648/ | 19:44 |
| samuelmz | dolphm, cool, thanks for this clarification .. :-) | 19:44 |
| dolphm | bknudson: that's a question the nova folks ask every day | 19:44 |
| bknudson | dstanek: that part doesn't look relevant to keystone... not sure why it's there in the first place? | 19:46 |
| bknudson | is some other oslo thing using it? | 19:46 |
| bknudson | it's not in openstack-common.conf, so it must be pulled in by some other dependency. http://git.openstack.org/cgit/openstack/keystone/tree/openstack-common.conf | 19:46 |
| dstanek | bknudson: we're tagged on the bug https://bugs.launchpad.net/oslo-incubator/+bug/1208734 | 19:47 |
| uvirtbot | Launchpad bug 1208734 in keystone "Drop openstack.common.exception" [Low,In progress] | 19:47 |
| dstanek | maybe we don't need to be? | 19:47 |
| bknudson | dstanek: the fix needs to be in oslo-incubator. | 19:47 |
| bknudson | there must be a module in oslo-incubator that still says it requires exceptions | 19:47 |
| dstanek | bknudson: the review was to delete it, but you mentioned that we can't because the path could be in a config file | 19:48 |
| bknudson | dstanek: I was probably confused and thought the change was made to keystoneclient and not keystone | 19:49 |
| bknudson | seems like a change that we'd make to keystoneclient | 19:49 |
| dstanek | bknudson: actually we don't have that anymore so i'm marking as fix released | 19:50 |
| bknudson | that is a weird comment... maybe it was a different Brant Knudson? | 19:50 |
| bknudson | I think the thing I had a problem with was that it's referenced in the config file | 19:51 |
| *** NM1 has quit IRC | 19:51 | |
| bknudson | see what I mean? | 19:51 |
| bknudson | it must be gone now from the sample config | 19:52 |
| bknudson | allowed_rpc_exception_modules isn't even a config option anymore. | 19:52 |
| *** openstackgerrit_ has joined #openstack-keystone | 19:54 | |
| *** radez is now known as radez_g0n3 | 19:55 | |
| *** thedodd has joined #openstack-keystone | 19:58 | |
| *** Tahmina has quit IRC | 19:59 | |
| dstanek | bknudson: i like it when things melt away | 20:04 |
| bknudson | it's kind of scary but things in our config file aren't under our control | 20:05 |
| *** samuelmz has quit IRC | 20:10 | |
| *** stevemar has quit IRC | 20:13 | |
| *** joesavak has joined #openstack-keystone | 20:15 | |
| *** ayoung has quit IRC | 20:16 | |
| *** jsavak has quit IRC | 20:17 | |
| *** jsavak has joined #openstack-keystone | 20:18 | |
| *** joesavak has quit IRC | 20:21 | |
| *** jasondotstar has quit IRC | 20:30 | |
| *** NM1 has joined #openstack-keystone | 20:32 | |
| dstanek | dolphm: closed this out because it appears to be user error: https://bugs.launchpad.net/keystone/+bug/1204964 | 20:32 |
| uvirtbot | Launchpad bug 1204964 in keystone "'extra' columns are nullable" [Low,Invalid] | 20:32 |
| dolphm | dstanek: wow that's old -- cool | 20:33 |
| morganfainberg | dstanek, oooh SO CLOSE TO UNDER 200 active bugs! | 20:33 |
| dstanek | morganfainberg: check again | 20:33 |
| morganfainberg | dstanek, 200 Open bugs (according to LP) | 20:33 |
| morganfainberg | yes that counts incompletes | 20:33 |
| morganfainberg | so, 190 | 20:34 |
| dstanek | morganfainberg: i've closed out a few today | 20:34 |
| morganfainberg | dstanek, yah so did I | 20:34 |
| morganfainberg | we were ~208 or so at the start of the day | 20:34 |
| *** BAKfr has left #openstack-keystone | 20:35 | |
| *** ayoung has joined #openstack-keystone | 20:35 | |
| morganfainberg | i think i kindof want to close this one https://bugs.launchpad.net/keystone/+bug/928042 | 20:35 |
| dolphm | nice :) | 20:35 |
| uvirtbot | Launchpad bug 928042 in keystone "clean up some of the various dict.copy() calls so that they don't confuse new developers" [Wishlist,Triaged] | 20:35 |
| *** BAKfr has joined #openstack-keystone | 20:35 | |
| dolphm | morganfainberg: i've thought the same, but they were actually a problem at one point - different backends behaved differently. it's probably not an issue anymore | 20:36 |
| dstanek | morganfainberg: so that bug is to stop doing the copy? | 20:36 |
| morganfainberg | dstanek, yeah | 20:36 |
| dolphm | dstanek: stop doing the copy in tests, specifically | 20:36 |
| morganfainberg | you know, i'm going to close it. | 20:36 |
| dstanek | hmm...i wouldn't expect that to be the confusing part of Keystone :-) | 20:37 |
| *** stevemar has joined #openstack-keystone | 20:37 | |
| dolphm | dstanek: it was just inconsistent | 20:37 |
| dstanek | there's lots of XML bugs too | 20:38 |
| morganfainberg | closed. | 20:38 |
| morganfainberg | we wont be able to remove XML in K | 20:38 |
| morganfainberg | we will be able to remove it from the pipeline | 20:38 |
| morganfainberg | unless we get special magic put in grenade | 20:38 |
| morganfainberg | to eliminate it on upgrade | 20:39 |
| *** andreaf has quit IRC | 20:39 | |
| dolphm | morganfainberg: ++ | 20:39 |
| morganfainberg | otherwise the upgrade fails because the old system has the files in the pipeline still and *splody* | 20:39 |
| *** andreaf has joined #openstack-keystone | 20:39 | |
| morganfainberg | :( | 20:39 |
| *** andreaf has quit IRC | 20:40 | |
| morganfainberg | what? https://bugs.launchpad.net/keystone/+bug/965502 | 20:40 |
| uvirtbot | Launchpad bug 965502 in keystone "lack of service endpoint filtering for token validation can be a security vulnerability" [Wishlist,Triaged] | 20:40 |
| *** andreaf has joined #openstack-keystone | 20:40 | |
| dstanek | there's things like this where i wonder how much i should care: https://bugs.launchpad.net/keystone/+bug/992214 | 20:40 |
| uvirtbot | Launchpad bug 992214 in keystone "GET /tenants XSD schema validation fails" [Medium,Triaged] | 20:40 |
| morganfainberg | dstanek, i wouldn't care tbh, i'd remove it from the pipeline and say "this is deprecated and slated for removal" | 20:41 |
| dolphm | morganfainberg: that message is basically already htere, right? | 20:41 |
| morganfainberg | dolphm, yeah. we say it's deprecated when you initalize the XML middleware | 20:42 |
| dolphm | dstanek: veeery little, on that one! | 20:42 |
| morganfainberg | so i'd remove it from the paste pipeline and have that patch close all the XML bugs ? :P | 20:42 |
| dstanek | i love it! | 20:43 |
| dolphm | morganfainberg: i'd be happy to see them marked as Won't Fix | 20:43 |
| morganfainberg | dolphm, probably better marking | 20:43 |
| *** gordc has quit IRC | 20:43 | |
| dolphm | maybe mark it as Opinion: You just *think* its broken, when in fact it was actually XML by design. | 20:44 |
| *** gordc has joined #openstack-keystone | 20:46 | |
| morganfainberg | dolphm, LOL | 20:46 |
| *** topol has quit IRC | 20:46 | |
| morganfainberg | dolphm, so.. https://bugs.launchpad.net/keystone/+bug/1131590 | 20:46 |
| uvirtbot | Launchpad bug 1131590 in keystone "migration 17: user_project_membership has no column 'project_id'" [Low,Confirmed] | 20:46 |
| morganfainberg | i'm content to mark that as invalid / incomplete? | 20:47 |
| dolphm | morganfainberg: already done | 20:47 |
| morganfainberg | k | 20:47 |
| morganfainberg | can't mark this as invalid https://bugs.launchpad.net/keystone/+bug/1194688 | 20:49 |
| uvirtbot | Launchpad bug 1194688 in keystone "Devstack uses keystone.middleware.s3_token in swift pipeline" [Wishlist,Confirmed] | 20:49 |
| morganfainberg | for keystone | 20:50 |
| morganfainberg | i can unset it affecting us. | 20:50 |
| morganfainberg | LP has wierd permissions | 20:50 |
| morganfainberg | and it went invalid | 20:50 |
| morganfainberg | ... | 20:50 |
| morganfainberg | oookay | 20:50 |
| stevemar | morganfainberg, *magic* | 20:53 |
| *** nellysmitt has joined #openstack-keystone | 20:53 | |
| morganfainberg | dolphm, does this not work for you: https://bugs.launchpad.net/keystone/+bug/1324610 ? | 20:53 |
| uvirtbot | Launchpad bug 1324610 in keystone "tools/config/generate_sample.sh has no effect on OS X" [Low,In progress] | 20:53 |
| morganfainberg | tox -esample_config always works for me | 20:53 |
| stevemar | morganfainberg, it's the bane of dolphm's existence | 20:54 |
| *** nellysmitt has quit IRC | 20:54 | |
| morganfainberg | i think we decided https://bugs.launchpad.net/keystone/+bug/1331884 was Wont fix a while ago? | 20:55 |
| uvirtbot | Launchpad bug 1331884 in keystone "A V2 token from trust cannot be generated with user/pass" [Wishlist,In progress] | 20:55 |
| morganfainberg | oh we have an active patch for it | 20:56 |
| morganfainberg | nvm | 20:56 |
| *** samuelmz has joined #openstack-keystone | 20:59 | |
| dolphm | morganfainberg: you mean, does it still not work for me? | 21:00 |
| morganfainberg | yeah | 21:00 |
| dolphm | morganfainberg: the python version works for me, but bknudson blocked it | 21:00 |
| bknudson | dolphm: because it was broken! | 21:00 |
| morganfainberg | i have an idea how to gate on sample config being up-to-date actually. | 21:01 |
| morganfainberg | without breaking when external libs update | 21:01 |
| dolphm | bknudson: i don't disagree | 21:01 |
| *** marcoemorais has quit IRC | 21:03 | |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 21:03 | |
| *** samuelmz is now known as samuelmz-awaw | 21:03 | |
| *** lcheng has quit IRC | 21:05 | |
| *** lcheng has joined #openstack-keystone | 21:05 | |
| ayoung | Funniest bug comment you will see all day. https://bugs.launchpad.net/keystonemiddleware/+bug/1375849 | 21:10 |
| *** jsavak has quit IRC | 21:10 | |
| uvirtbot | Launchpad bug 1375849 in keystonemiddleware "RFE: warn or act on expiring self-signed certs" [Undecided,New] | 21:10 |
| *** lcheng has quit IRC | 21:10 | |
| *** openstackgerrit_ has joined #openstack-keystone | 21:18 | |
| mhu | all commit messages should now end with "Love, Dad" | 21:19 |
| morganfainberg | haha | 21:23 |
| bknudson | seems like it should be love, grandpa | 21:27 |
| *** dhellmann is now known as dhellmann_ | 21:30 | |
| *** henrynash has quit IRC | 21:33 | |
| *** zzzeek has quit IRC | 21:37 | |
| *** andreaf has quit IRC | 21:39 | |
| *** andreaf has joined #openstack-keystone | 21:40 | |
| *** gordc has quit IRC | 21:51 | |
| dolphm | mhu: ++ | 21:53 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 21:53 | |
| stevemar | ayoung, oh that is great | 21:55 |
| *** bradjones has quit IRC | 21:55 | |
| stevemar | bknudson dropped a good joke in there too | 21:56 |
| *** ayoung has quit IRC | 22:00 | |
| rodrigods | tiny patches needing just +A: https://review.openstack.org/#/c/120563/ and https://review.openstack.org/#/c/123619/ | 22:00 |
| *** rkofman has quit IRC | 22:02 | |
| *** rkofman has joined #openstack-keystone | 22:03 | |
| *** lcheng has joined #openstack-keystone | 22:08 | |
| *** bknudson has quit IRC | 22:08 | |
| *** henrynash has joined #openstack-keystone | 22:08 | |
| *** david-lyle_ has joined #openstack-keystone | 22:11 | |
| *** david-lyle has quit IRC | 22:11 | |
| *** NM1 has quit IRC | 22:12 | |
| *** david-lyle has joined #openstack-keystone | 22:12 | |
| openstackgerrit | A change was merged to openstack/keystone: Add test for getting a token with inherited role https://review.openstack.org/119206 | 22:12 |
| *** thedodd has quit IRC | 22:13 | |
| *** david_lyle__ has joined #openstack-keystone | 22:14 | |
| *** david-lyle_ has quit IRC | 22:16 | |
| *** david-lyle has quit IRC | 22:17 | |
| *** david_lyle__ has quit IRC | 22:20 | |
| *** dims_ has joined #openstack-keystone | 22:20 | |
| *** zzzeek has joined #openstack-keystone | 22:21 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 22:21 | |
| *** dims_ has quit IRC | 22:22 | |
| *** dims_ has joined #openstack-keystone | 22:23 | |
| *** dims has quit IRC | 22:23 | |
| rm_work | Are Trusts only in the identity API v3? or are they in v2 as well? they're listed on http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html but not on the v2 page | 22:24 |
| stevemar | rm_work, they are only supported for v3 | 22:31 |
| rm_work | hmm, crap | 22:31 |
| *** praneshp has quit IRC | 22:31 | |
| rm_work | so if we rely on Trusts we will be introducing a hard-dependency on keystone identity v3 | 22:31 |
| *** praneshp has joined #openstack-keystone | 22:36 | |
| *** zzzeek has quit IRC | 22:38 | |
| *** david-lyle has joined #openstack-keystone | 22:39 | |
| *** david-lyle_ has joined #openstack-keystone | 22:41 | |
| *** david-lyle has quit IRC | 22:44 | |
| stevemar | rm_work, unofficially v2.0 tokens can use trusts, but like i said, we don't support that | 22:49 |
| stevemar | rm_work, https://bugs.launchpad.net/keystone/+bug/1331884 some info here | 22:50 |
| uvirtbot | Launchpad bug 1331884 in keystone "A V2 token from trust cannot be generated with user/pass" [Wishlist,In progress] | 22:50 |
| *** alex_xu has joined #openstack-keystone | 22:52 | |
| *** andreaf has quit IRC | 22:57 | |
| *** stevemar has quit IRC | 22:57 | |
| *** andreaf has joined #openstack-keystone | 22:58 | |
| *** david-lyle_ has quit IRC | 23:02 | |
| *** leonchio_ has joined #openstack-keystone | 23:06 | |
| *** NM1 has joined #openstack-keystone | 23:06 | |
| leonchio_ | hello, I try to get some help from someone who had setup keystone as federation service provider | 23:07 |
| leonchio_ | I am currently getting the following errors when creating a new identity provider | 23:07 |
| leonchio_ | [Tue Sep 30 16:04:12.379660 2014] [:error] [pid 5346:tid 139949496039168] 2014-09-30 16:04:12.375 5346 TRACE keystone.common.wsgi OperationalError: (OperationalError) attempt to write a readonly database u'INSERT INTO identity_provider (id, enabled, description) VALUES (?, ?, ?)' (u'sam_idp_id', 1, u'Stores AD/Ldap identities.') | 23:07 |
| dstanek | leonchio_: does the user you use to access your database have access to write to tables? | 23:08 |
| leonchio_ | I'm using ADMIN as the token for now | 23:09 |
| leonchio_ | I follow the steps from this doc http://docs.openstack.org/developer/keystone/configure_federation.html | 23:09 |
| leonchio_ | try to create groups giving me the same issue | 23:10 |
| dstanek | leonchio_: no not the token, the user that Keystone uses to access your database | 23:11 |
| dstanek | leonchio_: what rdbms are you using? | 23:11 |
| leonchio_ | I start apache as root | 23:12 |
| leonchio_ | sqlite | 23:12 |
| dstanek | hmmm..are the permissions of the db file OK? | 23:13 |
| *** dims_ has quit IRC | 23:13 | |
| leonchio_ | yeah, i tried if using using the federation extension with apache, but just the "plain" keystone, everything is fine | 23:14 |
| dstanek | leonchio_: when you say plain keystone do you use mod_wsgi? | 23:15 |
| leonchio_ | with the federation extension configured, creating groups and indentity providers, all those operations shuold be valid, right? | 23:15 |
| *** stevemar has joined #openstack-keystone | 23:16 | |
| dstanek | should be just find - i think the issue is the permissions of your db file | 23:16 |
| leonchio_ | I meant 'plain' refers to start keystone like 'keystone-all' | 23:16 |
| dstanek | leonchio_: who do you run that as root? | 23:16 |
| dstanek | leonchio_: who owns the db file and what are the permissions on it? | 23:17 |
| leonchio_ | that's a different user, let me change it's permissions .. | 23:17 |
| *** NM1 has quit IRC | 23:18 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure sql upgrade tests can run with non-sqlite databases. https://review.openstack.org/125228 | 23:20 |
| rm_work | thanks stevemar, I will give that a look | 23:25 |
| stevemar | np rm_work | 23:25 |
| rm_work | oh, that's actually not too bad if it works... one extra round-trip, but... it *works* | 23:26 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure sql upgrade tests can run with non-sqlite databases. https://review.openstack.org/125228 | 23:27 |
| leonchio_ | dstanek: it seems it does not matter the permission of the db file, it has the permission rw-rw-rw and I changed the owner to the root later, the result is the same though ... | 23:28 |
| leonchio_ | dstanek: do you know if anyone succefullly set up the federation with keystone? just curious ... | 23:28 |
| dstanek | leonchio_: probably not with sqlite - are you trying keystone-to-keystone federation? | 23:29 |
| leonchio_ | no, keystone-AD/Ldap | 23:29 |
| dstanek | leonchio_: are you trying to use AD as an IDP or do you really just want to use an LDAP backend? | 23:30 |
| leonchio_ | beside this link, http://docs.openstack.org/developer/keystone/configure_federation.html | 23:30 |
| nkinder | dolphm, morganfainberg: intersting (possible RC) issue related to the user enabled invert setting | 23:30 |
| leonchio_ | do you know any other links can be references, including the configurations on the AD/Ldap side? | 23:31 |
| dstanek | leonchio_: if you just want to use LDAP you don't need to do anything with federation | 23:31 |
| nkinder | dolphm, morganfainberg: I'll file a bug shortly, but the issue has to do with the returned value sometimes being a bool and sometimes being a string | 23:31 |
| nkinder | I have a fix, but I need to write some tests to cover the failure case | 23:32 |
| dstanek | leonchio_: http://docs.openstack.org/developer/keystone/configuration.html#configuring-the-ldap-identity-provider | 23:32 |
| dstanek | leonchio_: i'm not sure i understand exactly what you are looking to do. | 23:32 |
| leonchio_ | dstanek: I basically try to setup a federation service with keystone(sp) and ad/ldap(isp) and I found this doc http://docs.openstack.org/developer/keystone/configure_federation.html | 23:34 |
| leonchio_ | dstanek: and I just got stuck in the end when creating groups and providers ... | 23:35 |
| *** stevemar has quit IRC | 23:35 | |
| dstanek | leonchio_: the error message seems to imply a permission issue, but did you sync after adding the federation plugin? | 23:36 |
| dstanek | leonchio_: i haven't configured federation before - i've only used LDAP as a backend that allows a user to login using LDAP | 23:37 |
| *** alex_xu has quit IRC | 23:37 | |
| dstanek | through keystone | 23:37 |
| leonchio_ | dstanek: yeah, I did restart all the servers and sync the db ... and yeah, I aleady setup LDAP as the backend with keystone ... | 23:38 |
| leonchio_ | dstanek: thanks for your help! I will try to play around if the permissions is the issue ... | 23:40 |
| dstanek | leonchio_: what about the directory the DB is in? | 23:40 |
| leonchio_ | it is in /etc/keystone and keystone.conf has reference to it | 23:41 |
| dstanek | leonchio_: is that writable by root? your database is in /etc/keystone? | 23:41 |
| *** gus has joined #openstack-keystone | 23:41 | |
| nkinder | morganfainberg, dolphm: https://bugs.launchpad.net/keystone/+bug/1376053 | 23:41 |
| uvirtbot | Launchpad bug 1376053 in keystone "user_enabled_invert does not properly handle string values" [Undecided,In progress] | 23:41 |
| leonchio_ | dstanek: yeah, -rw-rw-rw- 1 root root 68608 Sep 30 15:34 keystone.db | 23:42 |
| dstanek | what's the perms on the directory? | 23:42 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes a spelling error in hacking tests https://review.openstack.org/119461 | 23:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds missing log hints for level E/I/W https://review.openstack.org/118883 | 23:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Extends hacking check for logging to verify i18n hints https://review.openstack.org/118884 | 23:43 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes aggressive use of translation hints https://review.openstack.org/125233 | 23:43 |
| morganfainberg | nkinder, ah i see how that bug can occur | 23:44 |
| nkinder | morganfainberg: yeah, though I'm not sure why the tests don't catch it | 23:45 |
| nkinder | morganfainberg: I have it fixed and tested it with a real LDAP server, but want to write tests that trigger the bug before proposing anything | 23:45 |
| morganfainberg | k | 23:45 |
| morganfainberg | marked it as "medium" and fixed the tag for you | 23:46 |
| *** andreaf has quit IRC | 23:46 | |
| *** andreaf has joined #openstack-keystone | 23:47 | |
| *** henrynash has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
