| dstanek | morganfainberg: yt? | 00:01 |
|---|---|---|
| morganfainberg | dstanek, hi | 00:01 |
| dstanek | morganfainberg: g'evening | 00:02 |
| morganfainberg | dstanek, was just about to go for a bike ride, what can i do for you? | 00:02 |
| dstanek | morganfainberg: ah, go ahead. we can talk later or tomorrow | 00:03 |
| morganfainberg | nah, this works | 00:03 |
| morganfainberg | i'm here:) | 00:03 |
| morganfainberg | i can do a bike ride tomorrow morning if i miss it tonight (it might be too late anyway... couldn't get off the phohe... family "got to go.. got to... *sigh* sure" :P | 00:04 |
| *** mikedillion has quit IRC | 00:04 | |
| *** marcoemorais has joined #openstack-keystone | 00:07 | |
| *** cjellick has quit IRC | 00:08 | |
| *** gyee has quit IRC | 00:08 | |
| *** mikedillion has joined #openstack-keystone | 00:08 | |
| dstanek | morganfainberg: you sure | 00:09 |
| dstanek | ? | 00:09 |
| morganfainberg | dstanek, yeah | 00:09 |
| morganfainberg | dstanek, i wouldn't have offered if i wasn't sure. | 00:10 |
| dstanek | i was looking at https://review.openstack.org/#/c/122037/ at it make me think about memcache in general | 00:10 |
| morganfainberg | hehe, thats a dangerous place to go filled with landmines and spiked pits and the like | 00:11 |
| dstanek | is it possible to use different memcache instances for each subsystem? one for tokens and another for identity caching, for instance | 00:11 |
| morganfainberg | right now, Token persistence has no bearing on caching | 00:12 |
| morganfainberg | or... well let me 2x check, but *shouldnt* | 00:12 |
| morganfainberg | it would absolutely be possible to split it up so each subsystem was it's own cache region | 00:12 |
| morganfainberg | so identity caching and assingment caching could be handled differently (for example) in different servers. | 00:12 |
| dstanek | so it can be independantly configured? that's what i thought based on browsing that review | 00:13 |
| morganfainberg | today all caching shares a set of memcache servers, but easy to expand on that as well | 00:13 |
| morganfainberg | dstanek, yeah token persistence *should* be separate from caching | 00:13 |
| morganfainberg | if it isn't, it's a bug. | 00:13 |
| dstanek | morganfainberg: cool, i'll play with it and see what i find | 00:14 |
| dstanek | morganfainberg: last qustion...https://review.openstack.org/#/c/125410/1/keystone/token/providers/common.py | 00:14 |
| dstanek | this passes unit tests, but seems to fail tempest | 00:15 |
| dstanek | that implies that when the audit_ids come back in they are strings, but when we create them they are binary | 00:15 |
| morganfainberg | json | 00:16 |
| morganfainberg | json is a u'' when decoded in py27 | 00:16 |
| morganfainberg | not a b'' or '' | 00:16 |
| dstanek | morganfainberg: would you prefer the review checks for both types or if i change the callers using base64 to convert to strings | 00:16 |
| morganfainberg | probably should convert to strings, iirc we said they are strings in the spec | 00:17 |
| dstanek | ok, that sounds good to me | 00:17 |
| dstanek | morganfainberg: thx! no go take that ride | 00:17 |
| dstanek | s/no/now/ | 00:17 |
| morganfainberg | "Each id in the audit_ids attribute is a randomly (unique) generated string that can be used to track the token" | 00:17 |
| morganfainberg | let me check sunset, it might, like i said already be too late. | 00:18 |
| morganfainberg | boo only 1h | 00:18 |
| morganfainberg | nope, tomorrow morning it is | 00:18 |
| morganfainberg | darn it. | 00:18 |
| dstanek | it's an easy change for sure; i'll also add some test(s) to catch a regression | 00:19 |
| morganfainberg | sounds good | 00:22 |
| *** lcheng has quit IRC | 00:30 | |
| *** praneshp has quit IRC | 00:31 | |
| *** zzzeek has quit IRC | 00:33 | |
| ayoung | rm_work, does this interest you: http://adam.younglogic.com/2014/09/multiple-signers/ | 00:43 |
| *** marcoemorais has quit IRC | 00:49 | |
| morganfainberg | ayoung, i have some concern with that proposal | 00:52 |
| ayoung | morganfainberg, lots of details to work out | 00:53 |
| morganfainberg | ayoung, mostly the data sync bit. we went around a lot on that with K2K | 00:53 |
| morganfainberg | i think we *cant* expect any kind of sync, especially in the "promise not to touch this" aspect | 00:53 |
| morganfainberg | it's the whole reason we ended up needing a second "local" token for the remote keystone. | 00:53 |
| morganfainberg | unless you're saying this is more akin to region 1 in HP vs Region 2 in HP where we *might* have full control | 00:54 |
| morganfainberg | we being the org running them. | 00:54 |
| morganfainberg | ayoung, and let me be clear, not saying "no", just voicing the same conclusion we came to for k2k. | 00:55 |
| *** gokrokve has joined #openstack-keystone | 00:57 | |
| *** gokrokve has quit IRC | 00:57 | |
| *** gokrokve has joined #openstack-keystone | 00:58 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: pki/ssl_setup configurable digest https://review.openstack.org/117366 | 01:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the default digest for pki/ssl_setup to sha256 https://review.openstack.org/117367 | 01:01 |
| *** gokrokve_ has joined #openstack-keystone | 01:01 | |
| *** lcheng has joined #openstack-keystone | 01:01 | |
| *** lcheng has quit IRC | 01:02 | |
| *** lcheng has joined #openstack-keystone | 01:02 | |
| *** praneshp has joined #openstack-keystone | 01:02 | |
| *** gokrokve has quit IRC | 01:04 | |
| nkinder | stevemar, ayoung: it's alive! I'm able to issue a token via OS-FEDERATION with mod_mellon and ipsilon. | 01:05 |
| stevemar | nkinder, it's ALIVE! | 01:05 |
| nkinder | I just have a stupid mapping right now, so I need to tweak my IdP to expose group membership in the assertion | 01:05 |
| nkinder | stevemar: one thing that threw me off is that everything defined in the "remote" part of the mapping must exist | 01:06 |
| stevemar | nkinder, within the assertion i assume? | 01:06 |
| nkinder | stevemar: yes | 01:06 |
| nkinder | stevemar: the example in the API for mappings maps the UserName and orgPersonType | 01:07 |
| stevemar | nkinder, that seems wrong, link? | 01:07 |
| nkinder | stevemar: I didn't have orgPersonType set up in my IdP, so it would think that no mapping rule applied | 01:08 |
| nkinder | stevemar: fetching it... | 01:08 |
| *** mikedillion has quit IRC | 01:08 | |
| nkinder | stevemar: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id | 01:08 |
| stevemar | nkinder, ahh, i think i know whats going on (with your claim that everything has to exist) | 01:09 |
| stevemar | nkinder, do you have the json of the mapping you used? | 01:09 |
| nkinder | stevemar: yeah, let me pastebin | 01:09 |
| ayoung | morganfainberg, you don;t need any data sync beyond the same definition of domain | 01:09 |
| nkinder | stevemar: they are both in a single rule, which is likely the problem | 01:10 |
| ayoung | each side can create their own projects if they really want | 01:10 |
| stevemar | nkinder, yep! | 01:10 |
| morganfainberg | ayoung, except if project names collide. | 01:10 |
| ayoung | or you let one Keystone be the definitive and the other just says "yeah, that one can sign for this domain" | 01:10 |
| nkinder | stevemar: http://paste.openstack.org/show/117613/ | 01:10 |
| stevemar | nkinder, if in a single rule {} then the remote values are AND'd | 01:10 |
| nkinder | stevemar: I did a cut/paste of that from somewhere (and tweaked UserName to user_id) | 01:10 |
| morganfainberg | ayoung, you're giving a *lot* of trust to the remote (aka not me) keystone, which was the big concern of just allowing signing like this, hence k2k | 01:10 |
| ayoung | morganfainberg, even then I think we are ok, as everything is done by id, but, yeah, I basically assume that it is possible for anyone to screw it up | 01:11 |
| morganfainberg | ayoung, yeah thats my major concern. | 01:11 |
| nkinder | stevemar: ok, that makes sense. So make them separate rules if I always want to map user_id (even if no groups are present) | 01:11 |
| ayoung | morganfainberg, where are quotas saved? | 01:11 |
| morganfainberg | ayoung, we don't have quotas in keystone iirc, and nova saves locally | 01:11 |
| stevemar | nkinder, yeppers! use something like this: http://paste.openstack.org/show/117614/ | 01:11 |
| *** gokrokve_ has quit IRC | 01:11 | |
| ayoung | morganfainberg, I mean in nova | 01:11 |
| morganfainberg | ayoung, in the db | 01:12 |
| ayoung | are they per project? | 01:12 |
| morganfainberg | ayoung, so locally. | 01:12 |
| morganfainberg | yeah nova isn't domain aware | 01:12 |
| stevemar | nkinder, *but* the result should be that after the mapping, user['name'] has to be *something* | 01:12 |
| ayoung | so once you have admin on a project you can set the quote for it? | 01:12 |
| morganfainberg | think so | 01:12 |
| stevemar | nkinder, otherwise we can't audit it, so we don't issue the token | 01:13 |
| ayoung | morganfainberg, I think that is going to be the lynchpin | 01:13 |
| nkinder | stevemar: so you potentially end up with a large mapping with rules for every local group, then a rule for user id/name most likely | 01:13 |
| morganfainberg | and it also means even if remote nova was listening for keystone events, without a mapping for k2k, you'd never know if a project was removed | 01:13 |
| stevemar | nkinder, you got it! | 01:13 |
| nkinder | stevemar: yeah, user['name'] wouldn't get set in my case, and boom | 01:13 |
| morganfainberg | with the mapping, always the local keystone knows/manages the project (just a mapped value) | 01:13 |
| ayoung | morganfainberg, that kind of stuff doesn't really worry me | 01:13 |
| stevemar | nkinder, thanks for trying this all out with mod_mellon and ipsilon (spelling?) | 01:14 |
| morganfainberg | ayoung, i think it does matter, we'd need a way to reconsile projects | 01:14 |
| ayoung | morganfainberg, notifications alwasy seemed suspect | 01:14 |
| morganfainberg | ayoung, unless you're allowing remote keystone to ask me (local) keystone about projects | 01:14 |
| nkinder | stevemar: sure! I'll be writing some stuff up for this | 01:14 |
| ayoung | morganfainberg, I'd not have direct Keystone to Keystone communication | 01:14 |
| ayoung | lets keep it manual to start | 01:14 |
| nkinder | stevemar: likely will start with a blog post and then we can see how to improve docs | 01:14 |
| morganfainberg | it's how the mapping table for federation bought us a lot of reuse, everything is always "local" for that keystone | 01:14 |
| ayoung | if project names collide...things get broken | 01:15 |
| nkinder | stevemar: the cool thing here is that I use kerberos to auth to my IdP, so no passwords are being used :) | 01:15 |
| stevemar | nkinder, nice | 01:15 |
| ayoung | the quota thing worries me, the rest not so much to start | 01:15 |
| ayoung | nkinder, I think I have the DOA thing under control | 01:15 |
| morganfainberg | ayoung, the quota thing is solved if we ensure local keystone knows some kind of "to local project" mapping :) | 01:15 |
| morganfainberg | ayoung, in either case, it's roughly the same issue. | 01:16 |
| morganfainberg | ayoung, something to keep in mind as it's explored. | 01:16 |
| ayoung | morganfainberg, yep...or if quotas are stored in the authoritative keystone for the Nova instance | 01:16 |
| ayoung | yep | 01:16 |
| stevemar | nkinder, i tried to make the docs have an obvious plug point for this stuff | 01:16 |
| nkinder | ayoung: awesome | 01:16 |
| ayoung | nkinder, I think I only need the one patch I have posted for the keystone client | 01:17 |
| stevemar | nkinder, just need a "Setup Mellon" instead of "Setup Shibbolet" at http://docs.openstack.org/developer/keystone/configure_federation.html#configure-apache-to-use-a-federation-capable-authentication-method | 01:17 |
| ayoung | https://review.openstack.org/#/c/122309/ | 01:17 |
| *** gokrokve has joined #openstack-keystone | 01:17 | |
| ayoung | I'm going to un -1 that one | 01:17 |
| ayoung | nkinder, here's the path | 01:17 |
| ayoung | right now, if you create a client without a session, it authenticates immediately, but if you create one with a session it defers authentication | 01:18 |
| ayoung | and the "authenticate" method on the client is not session aware | 01:18 |
| ayoung | so there is no way to say "just authenticate" | 01:18 |
| ayoung | hence the need for that patch | 01:18 |
| ayoung | once that patch is in, I think its a matter of adding an auth plugin and session creation before the client create, and an authenticate call afterwards | 01:19 |
| ayoung | I've been hacking on the Mox tests and I think I have them down. | 01:19 |
| ayoung | I'm about to start a refactoring effort on the DOA tests. There is a lot of duplicated code for creating mock Clients that I want to have written once and only once, so that when I make a change to the real code, I only have to make the change once in the tests | 01:20 |
| ayoung | right now, a one line change in the real code leads to fixing a dozen or more places in the tests | 01:20 |
| *** Tahmina has quit IRC | 01:20 | |
| ayoung | Once I have that clean up, adding in the session code is much easier. Once I have the session code, the kerberos stuff should be fairly minimal | 01:21 |
| ayoung | morganfainberg, do you know if there is any movement on either per Domain quotas or storing quotas in Keystone? | 01:22 |
| openstackgerrit | Kui Shi proposed a change to openstack/keystone: Add memcached_backend configuration https://review.openstack.org/122037 | 01:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Cleanup mock patch usage https://review.openstack.org/125533 | 01:26 |
| *** zzzeek has joined #openstack-keystone | 01:26 | |
| morganfainberg | ayoung, not that i'm aware of | 01:26 |
| ayoung | morganfainberg, so one other problem is the "where does it live" issue. Do you know if any of the services actually work with multiple endpoints of another service? | 01:27 |
| *** bknudson has quit IRC | 01:27 | |
| *** bknudson has joined #openstack-keystone | 01:27 | |
| morganfainberg | not sure. i think a lot of quota stuff is driven by nova [though this may have changed in the last year] | 01:27 |
| *** gokrokve_ has joined #openstack-keystone | 01:29 | |
| *** gokrokve has quit IRC | 01:30 | |
| ayoung | morganfainberg, there was a session at the last two summits about putting a unified quota extension somewhere. Of course people said Keystone | 01:31 |
| morganfainberg | ayoung, and i think it didn't go very far | 01:31 |
| ayoung | we said "well, we can store the absolute values, but we are not going to enforce"....and then said | 01:31 |
| morganfainberg | no one picked up the work. | 01:31 |
| morganfainberg | yeah | 01:31 |
| ayoung | "its the wrong place" | 01:31 |
| morganfainberg | then the whole congress thing | 01:31 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add an XML code directive to a shibboleth example https://review.openstack.org/125535 | 01:31 |
| morganfainberg | policy + lots of other stuff | 01:31 |
| *** lcheng has quit IRC | 01:37 | |
| *** lcheng has joined #openstack-keystone | 01:38 | |
| *** lcheng has quit IRC | 01:42 | |
| *** diegows has quit IRC | 01:58 | |
| openstackgerrit | Kui Shi proposed a change to openstack/keystone: Add memcached_backend configuration https://review.openstack.org/122037 | 01:59 |
| *** ncoghlan has joined #openstack-keystone | 02:03 | |
| *** zzzeek has quit IRC | 02:05 | |
| *** mitz_ has quit IRC | 02:11 | |
| *** mitz_ has joined #openstack-keystone | 02:18 | |
| *** gokrokve_ has quit IRC | 02:23 | |
| *** lcheng has joined #openstack-keystone | 02:39 | |
| *** lcheng has quit IRC | 02:44 | |
| *** andreaf has quit IRC | 02:54 | |
| *** andreaf has joined #openstack-keystone | 02:54 | |
| *** lcheng has joined #openstack-keystone | 02:59 | |
| *** praneshp has quit IRC | 03:02 | |
| *** openstackgerrit has quit IRC | 03:08 | |
| *** openstackgerrit has joined #openstack-keystone | 03:09 | |
| *** richm has quit IRC | 03:17 | |
| *** openstackgerrit has quit IRC | 03:18 | |
| *** openstackgerrit has joined #openstack-keystone | 03:18 | |
| *** oomichi has joined #openstack-keystone | 03:25 | |
| *** dguitarbite has quit IRC | 03:29 | |
| *** alex_xu has quit IRC | 03:37 | |
| *** praneshp has joined #openstack-keystone | 03:53 | |
| *** praneshp_ has joined #openstack-keystone | 03:57 | |
| *** praneshp has quit IRC | 03:58 | |
| *** praneshp_ is now known as praneshp | 03:58 | |
| *** dims has quit IRC | 04:00 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:00 | |
| *** dims has joined #openstack-keystone | 04:00 | |
| *** dims has quit IRC | 04:04 | |
| *** vdreamarkitex has quit IRC | 04:07 | |
| *** dguitarbite has joined #openstack-keystone | 04:30 | |
| *** gokrokve has joined #openstack-keystone | 04:50 | |
| *** praneshp has quit IRC | 04:54 | |
| *** lcheng has quit IRC | 04:55 | |
| *** lcheng has joined #openstack-keystone | 04:55 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:57 | |
| *** harlowja is now known as harlowja_away | 05:00 | |
| *** lcheng has quit IRC | 05:00 | |
| *** lcheng has joined #openstack-keystone | 05:17 | |
| *** lcheng has quit IRC | 05:17 | |
| *** lcheng has joined #openstack-keystone | 05:17 | |
| *** gokrokve_ has joined #openstack-keystone | 05:24 | |
| *** gokrokve has quit IRC | 05:26 | |
| *** gokrokve_ has quit IRC | 05:28 | |
| *** gokrokve has joined #openstack-keystone | 05:29 | |
| *** gokrokve has quit IRC | 05:36 | |
| *** gokrokve has joined #openstack-keystone | 05:36 | |
| *** gokrokve has quit IRC | 05:41 | |
| *** ukalifon has joined #openstack-keystone | 05:43 | |
| *** lcheng has quit IRC | 05:44 | |
| *** lhcheng has joined #openstack-keystone | 05:46 | |
| *** lhcheng_ has joined #openstack-keystone | 05:47 | |
| *** amcrn_ has quit IRC | 05:49 | |
| *** lhcheng has quit IRC | 05:50 | |
| *** lhcheng_ has quit IRC | 05:53 | |
| *** lhcheng has joined #openstack-keystone | 05:53 | |
| *** lhcheng has quit IRC | 05:54 | |
| *** lhcheng has joined #openstack-keystone | 05:56 | |
| *** lbragstad1 has joined #openstack-keystone | 05:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 06:04 |
| *** lhcheng has quit IRC | 06:07 | |
| *** lhcheng has joined #openstack-keystone | 06:07 | |
| *** oomichi__ has joined #openstack-keystone | 06:08 | |
| *** oomichi has quit IRC | 06:10 | |
| *** lhcheng has quit IRC | 06:15 | |
| *** lhcheng has joined #openstack-keystone | 06:17 | |
| *** jedix has quit IRC | 06:19 | |
| *** stevemar has quit IRC | 06:20 | |
| *** oomichi__ has quit IRC | 06:27 | |
| *** gokrokve has joined #openstack-keystone | 06:29 | |
| *** lhcheng has quit IRC | 06:29 | |
| *** lhcheng has joined #openstack-keystone | 06:31 | |
| *** gokrokve has quit IRC | 06:34 | |
| *** lbragstad1 has quit IRC | 06:35 | |
| *** ncoghlan has quit IRC | 06:46 | |
| *** lhcheng has quit IRC | 06:49 | |
| *** lhcheng has joined #openstack-keystone | 06:50 | |
| *** lufix has joined #openstack-keystone | 06:51 | |
| *** lhcheng has quit IRC | 06:55 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Implement group related methods for LDAP backend https://review.openstack.org/102244 | 07:15 |
| *** gokrokve has joined #openstack-keystone | 07:30 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 07:33 | |
| *** gokrokve has quit IRC | 07:35 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove unused cache functions from token.core https://review.openstack.org/119679 | 07:37 |
| *** jistr has joined #openstack-keystone | 07:42 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/python-keystoneclient: Attributes required using token for auth https://review.openstack.org/115228 | 07:51 |
| *** marekd|away is now known as marekd | 07:51 | |
| *** mitz_ has quit IRC | 07:53 | |
| *** mitz_ has joined #openstack-keystone | 07:55 | |
| *** lsmola has joined #openstack-keystone | 08:02 | |
| *** amerine has joined #openstack-keystone | 08:11 | |
| *** amerine_ has quit IRC | 08:12 | |
| *** andreaf has quit IRC | 08:17 | |
| *** amakarov_away is now known as amakarov | 08:17 | |
| openstackgerrit | Marcos Fermín Lobo proposed a change to openstack/keystone: Templated catalog backend not implemented https://review.openstack.org/120011 | 08:31 |
| *** afazekas has joined #openstack-keystone | 08:34 | |
| *** jedix has joined #openstack-keystone | 08:39 | |
| *** garcianavalon has joined #openstack-keystone | 08:42 | |
| *** nellysmitt has joined #openstack-keystone | 08:51 | |
| *** gokrokve has joined #openstack-keystone | 09:30 | |
| *** gokrokve has quit IRC | 09:35 | |
| *** aix has joined #openstack-keystone | 09:51 | |
| *** diegows has joined #openstack-keystone | 09:54 | |
| *** oomichi has joined #openstack-keystone | 10:03 | |
| *** nellysmitt has quit IRC | 10:04 | |
| *** vdreamarkitex has joined #openstack-keystone | 10:05 | |
| oomichi | hi bknudson | 10:17 |
| *** Dafna has quit IRC | 10:31 | |
| *** gokrokve has joined #openstack-keystone | 10:32 | |
| *** gokrokve has quit IRC | 10:36 | |
| *** Dafna has joined #openstack-keystone | 10:37 | |
| *** nellysmitt has joined #openstack-keystone | 10:46 | |
| *** diegows has quit IRC | 10:53 | |
| openstackgerrit | Alexey Miroshkin proposed a change to openstack/keystone: Notify a consumer that all dependenices injected https://review.openstack.org/117523 | 11:00 |
| *** dims has joined #openstack-keystone | 11:08 | |
| *** jaosorior has joined #openstack-keystone | 11:16 | |
| *** andreaf_ is now known as andreaf | 11:18 | |
| *** Tahmina has joined #openstack-keystone | 11:25 | |
| *** gokrokve has joined #openstack-keystone | 11:30 | |
| *** gokrokve has quit IRC | 11:34 | |
| *** dims has quit IRC | 12:06 | |
| *** dims has joined #openstack-keystone | 12:06 | |
| *** dims has quit IRC | 12:06 | |
| *** dims has joined #openstack-keystone | 12:07 | |
| *** NM1 has joined #openstack-keystone | 12:08 | |
| *** NM1 has quit IRC | 12:09 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Remove identity and assignment kvs backends https://review.openstack.org/125610 | 12:15 |
| *** topol has joined #openstack-keystone | 12:29 | |
| *** alex_xu has joined #openstack-keystone | 12:29 | |
| *** gokrokve has joined #openstack-keystone | 12:30 | |
| *** oomichi has quit IRC | 12:32 | |
| *** gokrokve has quit IRC | 12:35 | |
| ekarlso | shouldn't there be a admin v2.0 endpoint at http://localhost:35357/v2.0 ? | 12:37 |
| *** fifieldt has joined #openstack-keystone | 12:37 | |
| *** NM1 has joined #openstack-keystone | 12:41 | |
| *** miqui has joined #openstack-keystone | 12:50 | |
| *** henrynash has joined #openstack-keystone | 12:51 | |
| *** NM1 has quit IRC | 13:00 | |
| *** NM1 has joined #openstack-keystone | 13:01 | |
| *** breton_ has joined #openstack-keystone | 13:04 | |
| breton_ | hello fellas, I'm going to hang out here from now on | 13:06 |
| *** dims has quit IRC | 13:06 | |
| *** dims has joined #openstack-keystone | 13:07 | |
| *** gordc has joined #openstack-keystone | 13:07 | |
| *** breton_ is now known as breton | 13:07 | |
| marekd | breton: hello, welcome :-) | 13:10 |
| *** raildo_away is now known as raildo | 13:10 | |
| *** richm has joined #openstack-keystone | 13:10 | |
| *** dims has quit IRC | 13:11 | |
| *** nkinder has quit IRC | 13:13 | |
| *** radez_g0n3 is now known as radez | 13:20 | |
| *** bdossant_ has joined #openstack-keystone | 13:30 | |
| *** bdossant_ has quit IRC | 13:30 | |
| *** joesavak has joined #openstack-keystone | 13:30 | |
| *** gokrokve has joined #openstack-keystone | 13:30 | |
| *** bdossant has quit IRC | 13:31 | |
| *** gokrokve has quit IRC | 13:35 | |
| *** r-daneel has joined #openstack-keystone | 13:45 | |
| *** gokrokve has joined #openstack-keystone | 13:46 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:49 | |
| *** andreaf is now known as andreaf_ | 13:49 | |
| *** nellysmitt has quit IRC | 13:49 | |
| *** dguitarbite has quit IRC | 13:53 | |
| *** NM2 has joined #openstack-keystone | 13:54 | |
| *** NM1 has quit IRC | 13:54 | |
| *** ukalifon2 has joined #openstack-keystone | 13:56 | |
| *** ukalifon has quit IRC | 13:57 | |
| *** nkinder has joined #openstack-keystone | 13:59 | |
| ekarlso | hey guys, i've deployed keystone behind apache httpd but I can't GET on http://127.0.0.1:35357/v2.0 - it gives a 404 ? | 14:07 |
| ekarlso | apache config: http://paste.openstack.org/show/117771/ and the wsgi file mentionde in the config is: http://paste.openstack.org/show/117772/ | 14:08 |
| *** stevemar has joined #openstack-keystone | 14:08 | |
| richm | ekarlso: can you get on /v3? can you get on :5000? | 14:13 |
| *** nellysmitt has joined #openstack-keystone | 14:14 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: Remove depreacted kvs backends https://review.openstack.org/123122 | 14:15 |
| *** bdossant has joined #openstack-keystone | 14:23 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Remove dependencies from docs test env in tox.ini https://review.openstack.org/125650 | 14:24 |
| *** jdandrea has quit IRC | 14:24 | |
| *** nellysmitt has quit IRC | 14:28 | |
| *** nellysmitt has joined #openstack-keystone | 14:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/pycadf: Remove dependencies from docs test env in tox.ini https://review.openstack.org/125650 | 14:32 |
| *** bdossant has quit IRC | 14:33 | |
| *** nellysmitt has quit IRC | 14:33 | |
| morganfainberg | richm, ekarlso, hm. look at the apache error log, that might be a permissions error on the admin/main scripts | 14:36 |
| *** gokrokve has quit IRC | 14:36 | |
| morganfainberg | ekarlso, richm, see if mod_wsgi is actually executing the scripts. | 14:37 |
| *** david-lyle has joined #openstack-keystone | 14:37 | |
| *** nellysmitt has joined #openstack-keystone | 14:38 | |
| morganfainberg | dolphm, i'm going to point that BP at "removed as of kilo" instead, but otherwise +2 from me on it. | 14:38 |
| morganfainberg | dolphm, no need for lots of various bps for removing things. | 14:39 |
| dolphm | morganfainberg: ++ | 14:39 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Remove depreacted kvs backends https://review.openstack.org/123122 | 14:42 |
| dolphm | morganfainberg: when are we dropping the python 2.6 gate? | 14:43 |
| morganfainberg | dolphm, as soon as we get the"ok" from infrao | 14:43 |
| morganfainberg | :) | 14:43 |
| dolphm | morganfainberg: i'm looking at 2.6 bugs like https://bugs.launchpad.net/keystone/+bug/1306559 | 14:43 |
| uvirtbot | Launchpad bug 1306559 in keystone "Fix python26 compatibility for RFCSysLogHandler" [Low,Confirmed] | 14:43 |
| morganfainberg | this cycle, but we can't drop py26 from stable/* or client/middleware | 14:43 |
| morganfainberg | yeah, i'd probably expect us to mark it as wont fix soon | 14:44 |
| morganfainberg | as soon as py26 dies. | 14:44 |
| dolphm | morganfainberg: i'm going to leave it as Incomplete for the moment | 14:44 |
| morganfainberg | yeah | 14:45 |
| dolphm | with an explanation | 14:45 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1331884 | 14:45 |
| uvirtbot | Launchpad bug 1331884 in keystone "A V2 token from trust cannot be generated with user/pass" [Wishlist,In progress] | 14:45 |
| morganfainberg | i really don't want to add new functionality to v2 :( | 14:45 |
| dolphm | morganfainberg: +1 for killing it | 14:48 |
| NM2 | morganfainberg: Please, remember the swift users :'( | 14:48 |
| *** gokrokve has joined #openstack-keystone | 14:48 | |
| morganfainberg | NM2, please explain | 14:48 |
| dolphm | morganfainberg: you certainly don't need user/password authentication while consuming a trust in v2 to use swift | 14:48 |
| dolphm | NM2: ^ | 14:48 |
| morganfainberg | we're not killing V2 trusts, just the ability to get a trust token from the username/password directly | 14:49 |
| morganfainberg | which is that bug/wishlist item | 14:49 |
| morganfainberg | it doesn't work like that today. | 14:49 |
| morganfainberg | dolphm, neutron for LBaaS is looking to use trusts. they don't want to have a hard v3 keystone requirement for it, and would appreciate that ^ fix. I told them I didn't want extra functionality for V2 but it was under review if we wanted to accept the fix | 14:50 |
| morganfainberg | dolphm, to be upfront why this came up now. | 14:50 |
| morganfainberg | dolphm, it doesn't *really* change my view much, V2 should be frozen. | 14:51 |
| morganfainberg | short of security fixes and massive bugs, and this looks like "new functionality" to me. | 14:51 |
| *** ukalifon2 has quit IRC | 14:51 | |
| NM2 | Well, that is a good point. Frozen is fair. Just don't kill it :) | 14:52 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove identity and assignment kvs backends https://review.openstack.org/125610 | 14:52 |
| *** thedodd has joined #openstack-keystone | 14:53 | |
| morganfainberg | NM2, Ideally we will formally deprecate v2 within K, L, or M cycles [depending on the state] but V2 isn't dead for a while. | 14:53 |
| dolphm | morganfainberg: v3 has been "stable" long enough that they should be using it for new features as well - i don't really buy the argument | 14:54 |
| morganfainberg | dolphm, ++ | 14:54 |
| morganfainberg | dolphm, ok going to kill that bug then. | 14:55 |
| ayoung | dstanek, I'm doing some test cleanup and the following change does not work: http://paste.openstack.org/show/117787/ | 14:55 |
| ayoung | what am I missing? | 14:55 |
| morganfainberg | dolphm, +2 on the spec for kvs, +2 on the code (retargeted the bp tag in the code) | 14:55 |
| morganfainberg | dolphm, i'm good with the removal code going in as soon as the spec lands. | 14:55 |
| *** bdossant has joined #openstack-keystone | 14:55 | |
| *** lhcheng has joined #openstack-keystone | 14:56 | |
| *** dims has joined #openstack-keystone | 14:56 | |
| dolphm | morganfainberg: -- the spec filename should match the bp ID it's implementing | 14:58 |
| dolphm | or describing or whatever | 14:58 |
| morganfainberg | dolphm, should it? because it's not *really* completely implementing the bp | 14:58 |
| dolphm | morganfainberg: you have to get manual with ttx's bp management tools otherwise | 14:58 |
| ayoung | are we even continuing to use BPs? Is that so we have something to track? | 14:58 |
| dolphm | ayoung: yes and yes until storyboard | 14:58 |
| morganfainberg | ayoung, yeah its for Milestone tracking | 14:58 |
| ayoung | ++ | 14:58 |
| *** cjellick has joined #openstack-keystone | 14:59 | |
| morganfainberg | dolphm, easy enough to rename the file. | 14:59 |
| dolphm | which reminds me, i'm going to start attending storyboard meetings because holy crap we need that project running | 14:59 |
| nkinder | ekarlso: your pastebin links don't work. Did you figure out why you get a 404? | 14:59 |
| morganfainberg | dolphm, infra is moving to it this cycle | 14:59 |
| morganfainberg | dolphm, it's in beta | 14:59 |
| morganfainberg | once they feel "good about it" it'll open up to other projects | 14:59 |
| *** NM2 is now known as NM | 14:59 | |
| *** nellysmitt has quit IRC | 15:00 | |
| *** cjellick has quit IRC | 15:05 | |
| *** cjellick has joined #openstack-keystone | 15:06 | |
| dstanek | ayoung: what error are yo getting? | 15:11 |
| ayoung | dstanek, no idea. THe test just starts failing | 15:12 |
| ayoung | its mox, and thethings are not matchin | 15:12 |
| ayoung | matching | 15:12 |
| dstanek | ayoung: one thing is that you are using mox - i think that's been removed from most of our stuff | 15:12 |
| ayoung | dstanek, this is Django OpenStack Auth | 15:12 |
| ayoung | this is a refactoring effort toward getting Horizon to work with Kerberos | 15:13 |
| dstanek | ayoung: ah, nothing looks wrong at first glance | 15:13 |
| ayoung | If I do this right, it should be much easier to replace mox in this code | 15:13 |
| *** lhcheng has quit IRC | 15:14 | |
| ayoung | dstanek, interesting...I just forced it to work with this code: | 15:14 |
| ayoung | http://paste.openstack.org/show/117795/ | 15:15 |
| *** lhcheng has joined #openstack-keystone | 15:15 | |
| *** dguitarbite has joined #openstack-keystone | 15:17 | |
| *** lhcheng has quit IRC | 15:18 | |
| *** lhcheng has joined #openstack-keystone | 15:19 | |
| *** lhcheng has quit IRC | 15:24 | |
| ayoung | openstack_auth/tests/tests.py | 604 +++++++++++------------------------------- | 15:25 |
| ayoung | 1 file changed, 154 insertions(+), 450 deletions(-) | 15:25 |
| ayoung | amost 300 lines shorter | 15:25 |
| ayoung | I bet I could keep going | 15:25 |
| ayoung | https://review.openstack.org/125673 | 15:26 |
| *** vdreamarkitex has quit IRC | 15:32 | |
| ayoung | morganfainberg, dstanek we need to help out poor Horizon: https://review.openstack.org/#/c/123745/6/openstack_auth/user.py,cm | 15:33 |
| *** garcianavalon has quit IRC | 15:34 | |
| morganfainberg | hm, i was looking at something | 15:35 |
| morganfainberg | and got distracted | 15:35 |
| *** gokrokve_ has joined #openstack-keystone | 15:35 | |
| morganfainberg | dolphm, so do we need to swap back to the dedicated bp for that kvs removal one? | 15:35 |
| morganfainberg | dolphm, easy enough i guess to just toss in a second 'bp:' line if so | 15:36 |
| ayoung | maybe we should have a standard set of roles per project that mirrors wordpress: Subscriber, Contributor, Author, Editor, Administrator | 15:36 |
| dolphm | morganfainberg: let me fuss with the spec review | 15:36 |
| morganfainberg | dolphm, ok sounds good. | 15:37 |
| ayoung | Subscriber is read only, Contributor can change existing resources, but not add or delete, author can add new resources, editor can (mumble mumble) and Administrator can set quotas. | 15:37 |
| *** gokrokve has quit IRC | 15:38 | |
| ayoung | I can see atiwari's point that roles should be scoped to projects; some people should not be messing with network setups | 15:39 |
| morganfainberg | you have no idea how happy this makes me: https://bugs.launchpad.net/keystone/+bugs?search=Search&field.status=New | 15:39 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove OS-STATS monitoring https://review.openstack.org/125683 | 15:40 |
| ayoung | roles really should be inheritable | 15:41 |
| stevemar | dolphm, ^ | 15:41 |
| ayoung | morganfainberg, I think the server is down | 15:41 |
| ayoung | nothing is getting returned | 15:41 |
| ayoung | you broke it | 15:41 |
| morganfainberg | ayoung, lol | 15:42 |
| morganfainberg | stevemar, did we *officialy* deprecate stats? | 15:42 |
| morganfainberg | oh nope i see it | 15:42 |
| morganfainberg | nvm | 15:42 |
| stevemar | morganfainberg, i think so | 15:42 |
| * morganfainberg needs to scroll further down | 15:42 | |
| morganfainberg | stevemar, in_favor_of='external tooling', heh | 15:43 |
| stevemar | hehe | 15:43 |
| stevemar | i remember when we wrote that - was funny | 15:43 |
| ayoung | stevemar, new minus of 316 lines is OK in my book | 15:44 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: Remove deprecated kvs backends https://review.openstack.org/123122 | 15:45 |
| stevemar | morganfainberg, ayoung even if it wasn't targetted for Kilo, I was just going to but it WIP, i doubt the locations of the code was going to change.. | 15:45 |
| dolphm | morganfainberg: so, it's now one bp :: one spec, where the spec has room for to expand to cover more things for removal, if necessary | 15:45 |
| dolphm | morganfainberg: https://review.openstack.org/#/c/123122/4/specs/kilo/removed-as-of-kilo.rst | 15:45 |
| ayoung | stevemar, you know, instead of enumerating all the tests in tox.ini, we really should segregate them at the directory level | 15:47 |
| *** gokrokve has joined #openstack-keystone | 15:48 | |
| ayoung | somethinkg like test/unit test/live | 15:48 |
| ayoung | ah, that is 34...got it | 15:49 |
| *** gokrokve_ has quit IRC | 15:50 | |
| stevemar | ayoung, yeah, because py33 and py34 are 'spedcial' | 15:52 |
| ayoung | in a short bus sort of way | 15:52 |
| *** lufix has quit IRC | 15:55 | |
| *** ukalifon1 has joined #openstack-keystone | 16:09 | |
| ekarlso | morganfainberg: I can get :35357/v3 yes | 16:09 |
| *** gokrokve has quit IRC | 16:12 | |
| ekarlso | and I can do GET /v2.0 /v3 on :5000 | 16:13 |
| *** Clabbe has quit IRC | 16:13 | |
| *** Clabbe has joined #openstack-keystone | 16:13 | |
| ekarlso | but on :35357/v2.0 it fails with 404 :| | 16:14 |
| ekarlso | morganfainberg: / richm any clues ? | 16:14 |
| *** afazekas has quit IRC | 16:15 | |
| *** lhcheng has joined #openstack-keystone | 16:18 | |
| *** jasondotstar has joined #openstack-keystone | 16:25 | |
| *** praneshp has joined #openstack-keystone | 16:26 | |
| *** gyee has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Remove deprecated external authentication plugins https://review.openstack.org/125701 | 16:35 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove images directory from docs https://review.openstack.org/125702 | 16:36 |
| gyee | bknudson, ping | 16:37 |
| bknudson | gyee: will be available in a moment | 16:38 |
| gyee | k, got a oslo db question for ya whenever you have a moment | 16:38 |
| *** gokrokve has joined #openstack-keystone | 16:38 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: implied roles https://review.openstack.org/125704 | 16:38 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: remove deprecated access log middleware https://review.openstack.org/125703 | 16:38 |
| stevemar | dolphm, i see we're trying to find out who can clean up more stuff today? | 16:44 |
| dolphm | stevemar: BEST DAY EVER | 16:44 |
| dolphm | morganfainberg: Dear PTL, XML support is targeted for removal in Kilo, but need PTL input. Love, not-PTL. | 16:45 |
| gyee | heh | 16:45 |
| *** jistr has quit IRC | 16:45 | |
| lbragstad | I was just going to ask about that :) | 16:47 |
| lbragstad | Re: XML support | 16:47 |
| *** gokrokve has quit IRC | 16:47 | |
| dolphm | lbragstad: have you already started a patch to remove it? | 16:47 |
| lbragstad | not yet, but I can | 16:48 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystonemiddleware: Clean up the middleware docs https://review.openstack.org/125706 | 16:48 |
| dolphm | lbragstad: slash, what's your interest | 16:48 |
| *** lsmola has quit IRC | 16:48 | |
| *** gokrokve has joined #openstack-keystone | 16:48 | |
| lbragstad | I remember seeing the deprecation message in the XMLMiddleware, I can pull that out | 16:48 |
| dolphm | lbragstad: i was about to do the same, mostly just to see what it would look like / break. pretty sure tempest will argue | 16:48 |
| *** gokrokve has quit IRC | 16:48 | |
| lbragstad | yeah | 16:48 |
| *** gokrokve has joined #openstack-keystone | 16:48 | |
| dolphm | i also haven't followed the xml conversation on list anytime recently, so i don't know if it's still something we can remove? | 16:49 |
| nkinder | who's up for reviewing some of the pending proposed/juno backports? | 16:49 |
| nkinder | https://review.openstack.org/#/c/125467/ | 16:49 |
| lbragstad | the lxml import stuff that we fixed in Juno was under the impression that it would be removed in K | 16:49 |
| nkinder | https://review.openstack.org/#/c/125257/ | 16:49 |
| nkinder | https://review.openstack.org/#/c/125258/ | 16:50 |
| *** gokrokve has quit IRC | 16:50 | |
| *** gokrokve_ has joined #openstack-keystone | 16:50 | |
| *** lhcheng has quit IRC | 16:50 | |
| nkinder | Those all made it into master and were clean cherry-picks to juno | 16:50 |
| *** lhcheng has joined #openstack-keystone | 16:50 | |
| dolphm | nkinder: on it | 16:50 |
| nkinder | dolphm: thanks! | 16:51 |
| ekarlso | anyone got a clue on my error for :35357/v2.0 failin ? | 16:51 |
| stevemar | is the templated catalog dying with fire finally? | 16:51 |
| bknudson | gyee: ok, finally off the phone... what's up | 16:52 |
| *** lhcheng_ has joined #openstack-keystone | 16:52 | |
| *** lhcheng__ has joined #openstack-keystone | 16:52 | |
| gyee | bkudson, have a question on use_db_reconnect | 16:53 |
| gyee | for HA, we have multiple DB instances fronted by VIP, with keepalive enabled | 16:53 |
| *** praneshp has quit IRC | 16:53 | |
| gyee | support somebody yank the wire on one of the instances, does oslo.db do reconnect | 16:54 |
| gyee | assuming use_db_reconnect is set to True | 16:54 |
| gyee | I am worry about the "experimental use" part in the description | 16:54 |
| ayoung | nkinder, I'm looking now... | 16:55 |
| *** lhcheng has quit IRC | 16:55 | |
| ayoung | nkinder, I you sure https://review.openstack.org/#/c/125467/1 is not going to break anyone? | 16:56 |
| *** lhcheng_ has quit IRC | 16:56 | |
| bknudson | gyee: I thought that we had db reconnect forever... since I remember having to look at it for db2 support. | 16:56 |
| gyee | bknudson, have you use that option before? I just curious how reliable it is | 16:56 |
| *** marcoemorais has joined #openstack-keystone | 16:57 | |
| gyee | use_db_reconnect is Fase by default | 16:57 |
| *** praneshp has joined #openstack-keystone | 16:57 | |
| ayoung | oh,these are just to Juno...ok | 16:57 |
| *** lhcheng__ has quit IRC | 16:58 | |
| ekarlso | richm: morganfainberg ? | 16:58 |
| gyee | bkudson, see https://review.openstack.org/#/c/122114 | 16:58 |
| *** lhcheng has joined #openstack-keystone | 16:58 | |
| gyee | bknudson, https://review.openstack.org/#/c/122114 | 16:58 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove deprecated TemplatedCatalog class https://review.openstack.org/125708 | 16:59 |
| stevemar | dolphm, last one of the bunch i think ^ | 16:59 |
| bknudson | gyee: for some reason I'm not able to get to review.openstack.org lately... always get a connection reset :( | 16:59 |
| bknudson | maybe I need to restart the browser | 16:59 |
| dolphm | stevemar: nice | 17:00 |
| dolphm | bknudson: i haven't had an issue | 17:00 |
| *** lhcheng_ has joined #openstack-keystone | 17:00 | |
| stevemar | no issues here | 17:00 |
| bknudson | there must be something with the vpn. | 17:00 |
| gyee | bknudson, welcome to corporate email service man | 17:00 |
| bknudson | found a workaround since it works from my vm | 17:00 |
| gyee | I think I had murdered 5 IT guys over the years over email issues | 17:01 |
| dolphm | bknudson: although i once had issues like that and i think morganfainberg told me to kill my LP SSO session or something | 17:01 |
| bknudson | gyee: so the glance change looks like they're not using oslo.db? | 17:01 |
| gyee | bknudson, the commit message seem to suggest they are | 17:02 |
| bknudson | gyee: or is this saying we have to wrapper all keystone db calls? | 17:02 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:03 | |
| *** lhcheng has quit IRC | 17:03 | |
| gyee | bkundson, my understanding is that the patch is aim to mitigate db reconnect issue | 17:03 |
| bknudson | glance has one file with all their db calls? we should do that in keystone. | 17:03 |
| *** gokrokve_ has quit IRC | 17:03 | |
| *** Haneef has joined #openstack-keystone | 17:04 | |
| gyee | bknudson, I am not sure | 17:04 |
| bknudson | https://review.openstack.org/#/c/122114/2/glance/db/sqlalchemy/api.py is a pretty snazzy change but seems like it should be in oslo.db | 17:04 |
| gyee | Haneef, you encounter this issue with Keystone too right? | 17:05 |
| *** lufix has joined #openstack-keystone | 17:05 | |
| Haneef | Yes. we encounter this , when we use keepalive/haproxy due to keeplaive moving IP from one node to other | 17:05 |
| gyee | bknudson, Haneef, yeah, we should fix that in oslo.db | 17:06 |
| bknudson | you get 500 internal server errors for a while? | 17:06 |
| bknudson | what database backend? | 17:06 |
| bknudson | DB2? | 17:06 |
| gyee | mysql | 17:06 |
| bknudson | hp should write their own database someday. | 17:06 |
| gyee | yeah, vertica I think :) | 17:07 |
| Haneef | The error is : DBConnectionError: (OperationalError) (2006, 'MySQL server has gone away') | 17:07 |
| bknudson | y, I thought we had code in our DB code before to handle that, so this seems like a regression. | 17:07 |
| bknudson | I remember it was easy to recreate, just start keystone in devstack and restart it. | 17:08 |
| bknudson | restart mysqld | 17:08 |
| Haneef | bknudson: oslod.db has something reconnect on error config , but the comment is experimental. Do you have any idea on that | 17:08 |
| bknudson | Haneef: I don't know what that means... and I don't see zzzeek online... | 17:09 |
| gyee | let give it a whirl and find out | 17:09 |
| gyee | to paraphrase topol's comment on recreational drug, ya never try ya never know :) | 17:10 |
| Haneef | https://github.com/openstack/oslo.db/blob/master/oslo/db/options.py#L116 | 17:10 |
| bknudson | it looks like it does what the glance change does. | 17:11 |
| bknudson | catches DBConnectionError | 17:11 |
| morgan_remote_ | Haneef. There should be a fix coming for Oslo.db reconnect issues if it is what j think it is. | 17:11 |
| bknudson | and then it has a sleep in there which is ugly | 17:11 |
| morgan_remote_ | There was a bug where the reconnect code was moved. | 17:11 |
| richm | ekarlso: ? | 17:13 |
| morgan_remote_ | There is a larger fix keystone should make as well but it was not an rc "fix" as the code in Oslo.db broke previous functionality. The Oslo team agreed they'd release a new Oslo.db instead to restore he seamless reconnect. | 17:13 |
| *** lufix has quit IRC | 17:13 | |
| gyee | morgan_remote, what was the reason for pulling out that functionality? | 17:14 |
| morgan_remote_ | gyee: it was moved. But the way we are using it, that move broke things. | 17:14 |
| morgan_remote_ | Wasn't meant to be removed. | 17:14 |
| *** harlowja_away is now known as harlowja | 17:14 | |
| morgan_remote_ | The fix should be released soon or maybe has been released | 17:15 |
| morgan_remote_ | dhellmann: ping, the Oslo.db reconnect bug, has that been released yet or soon to be released? | 17:16 |
| bknudson | gyee: what version of oslo.db do you have? | 17:16 |
| Haneef | We have oslo.db>=0.2.0 | 17:18 |
| *** gokrokve has joined #openstack-keystone | 17:18 | |
| bknudson | what version is installed? | 17:18 |
| morgan_remote_ | Wow. Launchpad is awful. | 17:18 |
| gyee | bknudson, installed with devstack? | 17:18 |
| bknudson | gyee: what version is installed where you're seeing the problem? | 17:19 |
| vishy | is morgan_remote_ == morganfainberg | 17:19 |
| vishy | ? | 17:19 |
| morgan_remote_ | vishy: yep | 17:20 |
| vishy | morgan_remote_: are you aware of any way using the keystone api to make sure that you don’t accidentally create duplicate records? | 17:20 |
| vishy | especially for endpoints but it applies to other types as well | 17:20 |
| morgan_remote_ | vishy: what kind of duplicate records? | 17:20 |
| morgan_remote_ | Most cases we have unique constraints in the back ends. | 17:21 |
| vishy | i.e. if I could set the id of the record on create and have it fail if the id exists | 17:21 |
| *** vhosakot_ has joined #openstack-keystone | 17:21 | |
| bknudson | gyee Haneef: latest oslo.db is 1.0.2 | 17:21 |
| morgan_remote_ | vishy: that should be the case. Id should always be unique. | 17:21 |
| vishy | morgan_remote_: well you can create multiple copies of the same endpoint data very easily | 17:21 |
| vishy | morgan_remote_: except the id is not exposed to the api | 17:21 |
| vishy | so that doesn’t help | 17:21 |
| morgan_remote_ | Ah | 17:22 |
| vhosakot_ | Dear friends, I see error when I do keystone user-create.. Can someone please help | 17:22 |
| vhosakot_ | keystone --debug user-create --name localadmin --tenant-id admin --pass ubuntu --email vhosakot@cisco.com --enabled True | 17:22 |
| vishy | currently to deal with races we have to take out a global lock | 17:22 |
| vhosakot_ | DEBUG:keystoneclient.auth.identity.v2:Making authentication request to http://localhost:35357/v2.0/tokens INFO:urllib3.connectionpool:Starting new HTTP connection (1): localhost DEBUG:urllib3.connectionpool:Setting read timeout to 600.0 DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 401 143 DEBUG:keystoneclient.session:Request returned failure status: 401 DEBUG:keystoneclient.v2_0.client:Authorization Failed. | 17:22 |
| openstackgerrit | A change was merged to openstack/pycadf: Remove dependencies from docs test env in tox.ini https://review.openstack.org/125650 | 17:22 |
| vishy | which is just not very helpful | 17:22 |
| stevemar | dammit - i told myself to get lunch at 12:30 | 17:22 |
| morgan_remote_ | vishy: yes. I can see that | 17:22 |
| stevemar | now it's 1:22 | 17:22 |
| vishy | but I wasn’t sure if I was missing something | 17:23 |
| *** wwriverrat has joined #openstack-keystone | 17:23 | |
| morgan_remote_ | vishy: end points I think are a special case. Everything else should have unique constraints in a way that prevents duplicate data (ID, name+domain, etc) | 17:23 |
| vishy | endpoints could have a unique constraint on service/region perhaps | 17:23 |
| morgan_remote_ | Yeah. | 17:24 |
| vhosakot_ | Can some please share their /etc/keystone/keystone.conf if keystone is working for you.. | 17:24 |
| *** wwriverrat has quit IRC | 17:24 | |
| morgan_remote_ | vishy: valid point on some extra constraints probably needed there. | 17:24 |
| vishy | i can’t see sticking multiple copies of the same service in the same region | 17:24 |
| vhosakot_ | also, after changing /etc/keystone/keystone.conf, how do I retstart keystone ? | 17:24 |
| vhosakot_ | "service keystone restart" throws this error | 17:25 |
| vhosakot_ | keystone: unrecognized service | 17:25 |
| morgan_remote_ | vishy: probably not. Service shouldn't be duplicated afaict. But end points might have multiples for a service in a give. Region | 17:25 |
| morgan_remote_ | S/give. Region/given region | 17:26 |
| vishy | morgan_remote_: hmm ok, so we can’t have unique | 17:26 |
| richm | vhosakot_: try service openstack-keystone restart | 17:26 |
| vishy | morgan_remote_: I guess I will just work around this for now | 17:26 |
| *** amcrn has joined #openstack-keystone | 17:27 | |
| morgan_remote_ | vishy: not purely unique. But we might be able to make things a bit better (eg expose id) | 17:27 |
| *** amakarov is now known as amakarov_away | 17:27 | |
| vishy | that would give a way around it yes | 17:27 |
| vhosakot_ | vishy: same error for "service openstack-keystone restart" | 17:27 |
| vhosakot_ | openstack-keystone: unrecognized service | 17:27 |
| morgan_remote_ | vishy: mind opening a bug on it? I see value in ensuring your not duplicating unless you *really* want to | 17:28 |
| morgan_remote_ | It should be easy to determine if you've already got the data you need in the catalog. | 17:28 |
| morgan_remote_ | Or at least via the CRUD interface. | 17:28 |
| vhosakot_ | I see the error "openstack-keystone: unrecognized service" when I do "user-create" with keystone... | 17:29 |
| vhosakot_ | Can some please share their /etc/keystone/keystone.conf if keystone is working for you.. | 17:29 |
| morgan_remote_ | vhosakot_: how did you install keystone? Is this a devstack? And what version (master, Juno proposed, icehouse, etc)? | 17:31 |
| vhosakot_ | yeah... this is devstack | 17:31 |
| morgan_remote_ | vhosakot_: if it is a Juno or later vintage devstack. Keystone is run under Apache. So you'll restart / graceful / sighup Apache to load the new config. | 17:32 |
| vhosakot_ | keystone comes with devstack when I clone devstack from git right ? | 17:32 |
| *** gokrokve has quit IRC | 17:33 | |
| nkinder | vhosakot_: yes | 17:33 |
| morgan_remote_ | By default that is keystone is under Apache+mod_wagi. It is possible to run keystone under event let, and it is started in the devstack screen in that case. (Screen 1). | 17:33 |
| bknudson | also, if you're running devstack it doesn't start the servers as a service, just runs them under screen. | 17:33 |
| bknudson | except for keystone and horizon which can be run under apache httpd | 17:33 |
| bknudson | maybe somebody here can answer this question -- do you think it would be possible to have apache do reverse-proxy to keystone and still use federation? | 17:34 |
| vhosakot_ | nkinder, morgan_remote_ : I cloned devstack, and creating new user with keystone, and see the error "Authorization Failed. Could not find user: localadmin" | 17:34 |
| vhosakot_ | i ran stack.sh | 17:35 |
| morgan_remote_ | Localadmin? That's not one I've seen. | 17:35 |
| gyee | bknudson, sorry, looks like we are running a really old version | 17:35 |
| gyee | 0.4.0 | 17:35 |
| gyee | I need to talk to people, and people's people | 17:35 |
| bknudson | vhosakot_: ./rejoin-stack.sh and you can see the screen | 17:35 |
| *** david-lyle has quit IRC | 17:35 | |
| vhosakot_ | morgan_remote_ : should I use only admin for --name ? I thought I can use any name | 17:36 |
| dolphm | what response does keystone return when you try to PATCH a user's domains when domains are immutable? | 17:37 |
| dolphm | a user's domain* | 17:37 |
| morgan_remote_ | dolphm: huh. Good question. Should be, 403 right? | 17:37 |
| morgan_remote_ | vhosakot_: depends on what you told devstack to use. | 17:38 |
| gyee | yeah, should be 403 | 17:39 |
| morgan_remote_ | dolphm: no other status really makes sense. | 17:39 |
| vhosakot_ | I see this new error now.. I changed localadmin to admin for user-create | 17:41 |
| vhosakot_ | Invalid user / password (Disable debug mode to suppress these details.) (HTTP 401) | 17:41 |
| vhosakot_ | where can I see the user / password that I am supposed to use for net-create | 17:42 |
| vhosakot_ | (I'm new to keystone, please) | 17:42 |
| nkinder | vhosakot_: how are you trying to create a user? | 17:43 |
| nkinder | vhosakot_: could you pastebin the exact command/output? | 17:43 |
| *** aix has quit IRC | 17:44 | |
| vhosakot_ | nkinder : I have pasted my environment variables, command output, and my /etc/keystone/keystone.conf at pastebin at - http://pastebin.com/0mum6GM4 | 17:48 |
| nkinder | vhosakot_: you are trying to create the "admin" user while authenticating as the "admin" user? | 17:51 |
| nkinder | vhosakot_: there should be an "admin" user that devstack set up, with a password that you specified IIRC | 17:53 |
| nkinder | vhosakot_: so with that user's detail set in your OS_* environment variables, you should be able to do a 'keystone user-list'. | 17:53 |
| vhosakot_ | nkinder : yes.. I am following http://docs.openstack.org/user-guide/content/app_cheat_sheet.html... I need to create a network (create_network) in neutron for which I need keystone setup properly | 17:53 |
| nkinder | vhosakot_: make sure you can just do a user-list first | 17:54 |
| vhosakot_ | "keystone user-list" displays the error below | 17:54 |
| vhosakot_ | Invalid user / password (Disable debug mode to suppress these details.) (HTTP 401) | 17:54 |
| nkinder | vhosakot_: so the user/password in your environment variables is not correct | 17:54 |
| nkinder | vhosakot_: you need to use the values you used when you set up devstack | 17:55 |
| morgan_remote_ | Or not presented via cli args | 17:55 |
| morgan_remote_ | Present* | 17:55 |
| vhosakot_ | how I can see what user / password devstack setup ? | 17:55 |
| morgan_remote_ | Hm. Does that go into localrc still? | 17:56 |
| nkinder | it sets up an "admin" user by default. I think the password is spit out at the end of running stack.sh | 17:56 |
| nkinder | I don't have a devstack set up right now | 17:56 |
| vhosakot_ | do I need to use the same user / password that devstack setup in my environment variables for keystone to work ? | 17:56 |
| nkinder | vhosakot_: yes, those should be correct | 17:56 |
| vhosakot_ | oh right right.. I have saved devstack's output at end... 1 sec please | 17:56 |
| vhosakot_ | shatck.sh spit this output | 17:57 |
| vhosakot_ | Horizon is now available at http://192.168.122.93/ Keystone is serving at http://192.168.122.93:5000/v2.0/ Examples on using novaclient command line is in exercise.sh The default users are: admin and demo The password: nomoresecrete This is your host ip: 192.168.122.93 | 17:57 |
| nkinder | vhosakot_: ok, so set OS_PASSWORD to nomoresecrete | 17:57 |
| vhosakot_ | let me use nomoresecrete in my env variable, and rerun keystone | 17:57 |
| vhosakot_ | ok oh.. 1 sec nkinder :) | 17:57 |
| vhosakot_ | cool, "keystone user-list" worked.. let me create a network (create_network) in neutron for admin | 17:59 |
| vhosakot_ | localadmin@ubuntu-14:~/devstack$ keystone user-list +----------------------------------+----------+---------+----------------------+ | id | name | enabled | email | +----------------------------------+----------+---------+----------------------+ | c3462b4e0ef84de8b941c1cf5615c266 | admin | True | | | 75f62eb7016742e58903647f939ab5ae | alt_demo | | 17:59 |
| *** ctracey_ has joined #openstack-keystone | 18:00 | |
| *** stevemar has quit IRC | 18:00 | |
| *** stevemar has joined #openstack-keystone | 18:01 | |
| *** ctracey_ is now known as ctracey | 18:01 | |
| vhosakot_ | nkinder : I see the error below error when I create a network in neutron by doing "neutron net-create net1". Is the error below related to keystone or neutron? It looks like neutron (in which case I will jump to the neutron's ICR chat) | 18:02 |
| vhosakot_ | publicURL endpoint for network service not found | 18:02 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:03 | |
| vhosakot_ | nkinder : I will be back 3-5 mins | 18:03 |
| *** david-lyle has joined #openstack-keystone | 18:06 | |
| morganfainberg | stevemar, dolphm, henrynash, I'm not sure we actually need a spec for "removing" deprecated things. | 18:06 |
| morganfainberg | stevemar, dolphm, henrynash, if they were marked as deprecated as expected and being removed in the timeline they were expected to be removed (or later than) | 18:06 |
| nkinder | vhosakot_: so that sounds like neutron is not set up properly in the endpoint catalog. You can confirm that by running 'keystone endpoint-list' and correlating with 'keystone service-list' | 18:07 |
| morganfainberg | stevemar, dolphm, henrynash, I'm fine witht he spec as-is going in but expect we should expand it to mark everything we're removing then? | 18:07 |
| nkinder | vhosakot_: or just 'pip install python-openstackclient', then run 'openstack --os-auth-url http://127.0.0.1:5000/v3 --os-identity-api-version 3 endpoint list' for a nicer display with service names | 18:08 |
| dolphm | morganfainberg: this is a merge commit to update feature/hierarchical-multitenancy to be in sync with master... it should merge before anything else to that branch because that branch is already 170 commits behind :( https://review.openstack.org/#/c/125726/ | 18:09 |
| morganfainberg | dolphm, oh my | 18:10 |
| vhosakot_ | nkinder : yes, neutron is not seen in the output of "keystone service-list" | 18:10 |
| dolphm | morganfainberg: which is really 85 commits + merge commits | 18:10 |
| *** david-lyle has quit IRC | 18:10 | |
| morganfainberg | dolphm, well +2 on that provided jenkins doesn't complain... i doubt it will. | 18:10 |
| vhosakot_ | how do I add the publicURL endpoint for neutron ? Is it thru the neutron CLI or the keystone CLI ? | 18:11 |
| nkinder | vhosakot_: stack.sh should have done that | 18:11 |
| nkinder | vhosakot_: it's a keystone API call, but the fact that it's not registered makes me think that neutron wasn't set up properly | 18:12 |
| dolphm | vhosakot_: openstack endpoint create http://pasteraw.com/omek504dcx8f7qf9hu680s0heb7lufh | 18:12 |
| *** gokrokve has joined #openstack-keystone | 18:15 | |
| vhosakot_ | stack.sh has setup neutron (because I used the default local.conf that came from devstack's git).. If I pastebin my localrc of my devstack, could you please help me add the required parts for neutron, rerun stack.sh (restack ?), and add the publicURL endpoint for neutron thru keystone CLI | 18:16 |
| ekarlso | richm: the keystone apache problem I asked about ;) | 18:16 |
| vhosakot_ | I meant stack.sh has NOT setup neutron (because ... blah... blah... blah) | 18:16 |
| henrynash | morganfainberg: I’m cool with that! | 18:16 |
| morganfainberg | henrynash, lets see what everyone else has to say, but I'm def fine with not having a spec enumerating what was removed, it's why we have the BP and we can *always* revert something back in if needed. | 18:17 |
| nkinder | vhosakot_: https://wiki.openstack.org/wiki/NeutronDevstack | 18:19 |
| stevemar | morganfainberg, we should have a spec for it, just to doc what exactly we're taking away | 18:19 |
| vhosakot_ | nkinder : thanks for the steps for setting up neutron on devstack.. after I do the steps, Do i just run stack.sh so my changes in local.conf are taken in account in my env for keystone ? | 18:20 |
| *** ukalifon1 has quit IRC | 18:21 | |
| *** Tahmina has quit IRC | 18:21 | |
| *** sigmavirus24 has left #openstack-keystone | 18:22 | |
| *** nellysmitt has joined #openstack-keystone | 18:23 | |
| *** jaosorior has quit IRC | 18:23 | |
| vhosakot_ | is it ok if I run devstack's stack.sh multiple times when I change local.conf | 18:24 |
| stevemar | why is jenkins failing so often today :( | 18:25 |
| vhosakot_ | dolphm : thanks for the link about openstack endpoint create | 18:25 |
| *** webx has joined #openstack-keystone | 18:26 | |
| *** david-lyle has joined #openstack-keystone | 18:27 | |
| richm | ekarlso: does port 5000 or /v3 work? | 18:27 |
| nkinder | vhosakot_: unstack, then stack.sh again is how I've always done it | 18:28 |
| nkinder | stevemar: it was failing a bunch yesterday too | 18:28 |
| stevemar | nkinder, it makes me sad | 18:28 |
| *** henrynash has quit IRC | 18:29 | |
| vhosakot_ | cool, I will unstack and stack.sh again... thanks kinder! | 18:29 |
| vhosakot_ | nkinder* | 18:29 |
| openstackgerrit | A change was merged to openstack/keystone: Remove OS-STATS monitoring https://review.openstack.org/125683 | 18:29 |
| openstackgerrit | A change was merged to openstack/keystone: Fix tests comparing tokens https://review.openstack.org/125406 | 18:30 |
| *** henrynash has joined #openstack-keystone | 18:31 | |
| ekarlso | richm: correct | 18:33 |
| ekarlso | /v3 /v2.0 works on :5000 | 18:34 |
| ekarlso | /v3 on :35357 | 18:34 |
| richm | ekarlso: hmm - not sure why there is no /v2.0 on 35357 | 18:34 |
| ekarlso | richm: booo | 18:35 |
| morganfainberg | stevemar, then we need to update the spec for all things we're removing, | 18:36 |
| *** webx has left #openstack-keystone | 18:36 | |
| morganfainberg | stevemar, if we're doing that, lets just make sure we're getting it done. ^ also we merged remove os-stats already | 18:36 |
| vhosakot_ | nkinder : unstacked, now running stack.sh.. already saw "running setup.py for neutron" in the output of stack.sh... so, I'm hoping neutron comes up this tim | 18:36 |
| stevemar | yeah i saw that | 18:37 |
| vhosakot_ | time* | 18:37 |
| stevemar | morganfainberg, reason for the spec, because now we don't have any proof that we made a decision to remove os-stats | 18:37 |
| lbragstad | dolphm: I ripped out most everything xml and get all but one test to pass | 18:38 |
| vhosakot_ | nkinder : instead of chaining devstack's local.conf according https://wiki.openstack.org/wiki/NeutronDevstack, can I install the neutron networking service in http://docs.openstack.org/havana/install-guide/install/apt/content/neutron-install-network-node.html as well ? | 18:38 |
| vhosakot_ | changing* | 18:38 |
| henrynash | morganfainberg, stevemar: so this why I created a spec specifically for kvs backends…..so we can agree that we want to remove those….if we have to agree on spec of everything we are goingto remove, I’m just concerened it will delay us working on the individual pieces | 18:38 |
| ekarlso | noone that knows? /v2.0 is not available and breaks stuff atm when ks is behind keystone | 18:39 |
| *** marcoemorais has quit IRC | 18:39 | |
| *** marcoemorais has joined #openstack-keystone | 18:39 | |
| *** marcoemorais has quit IRC | 18:39 | |
| openstackgerrit | ayoung proposed a change to openstack/python-keystoneclient: Make client.authenticate use session if provided https://review.openstack.org/122309 | 18:40 |
| *** marcoemorais has joined #openstack-keystone | 18:40 | |
| stevemar | henrynash, considering it's pre-summit, i think a day or two delay won't hurt :) | 18:40 |
| henrynash | morganfainberg, stevemar: what I mean is - craming everything into one spec seems counter to incremental developemnt when the rationale or arguments may be different for the removal of un-related items | 18:40 |
| *** marcoemorais has quit IRC | 18:40 | |
| *** marcoemorais has joined #openstack-keystone | 18:41 | |
| morgan_remote_ | henrynash: I think if it is deprecated is where that rational comes from. | 18:41 |
| morgan_remote_ | The removal is more of a "we actually removed it and it was slated to be removed " | 18:41 |
| stevemar | morganfainberg, as the newly minted PTL, it's your call :D | 18:41 |
| henrynash | morgan_remote: meaning…the ship sailed when people approved thhe item being marked as deprecated? | 18:41 |
| *** leonchio_ has quit IRC | 18:42 | |
| henrynash | morgan_remote: I could be convinced by that argument | 18:43 |
| morgan_remote_ | Meaning if it is deprecated we have documentation of rational then. Do we need to rehash that for removal? We can say "yes we're good with removing" or "no we aren't" and we can always in deprecate between the first and second step | 18:43 |
| henrynash | morgan_remote: ok, sold….so the (new) bp is just the reference that we’ll hang these removals off | 18:45 |
| nkinder | ekarlso: It should work. I'm in the middle of a new setup of Keystone in httpd right now. I'll check and see if it's working for me once it's complete. | 18:45 |
| morgan_remote_ | Yeah. Sounds right | 18:46 |
| *** praneshp has quit IRC | 18:48 | |
| ekarlso | nkinder: it's not sadly | 18:49 |
| nkinder | ekarlso: I think is was working on my installation yesterday, but I'll confirm | 18:49 |
| henrynash | morgan_remote: and when we say bp, do we mean just bp or a spec? | 18:49 |
| nkinder | ekarlso: what does your httpd config look like? | 18:49 |
| nkinder | ekarlso: is it just a copy of http/wsgi-keystone.conf? | 18:50 |
| nkinder | ekarlso: I can say that my configuration is different, as I'm using puppet-keystone's support for deploying in httpd | 18:51 |
| ekarlso | nkinder: I already pasted it | 18:51 |
| nkinder | ekarlso: ah, I missed it. Let me scroll back | 18:51 |
| dolphm | lbragstad: what's the one test? | 18:52 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove deprecated TemplatedCatalog class https://review.openstack.org/125708 | 18:53 |
| nkinder | ekarlso: I don't see it. Mind supplying the link again? | 18:54 |
| lbragstad | dolphm: keystone.tests.test_v3_auth.TestPKIZTokenAPIs.test_v3_token_id | 18:54 |
| dolphm | lbragstad: why does that fail without xml? | 18:54 |
| lbragstad | dolphm: no idea. I was digging into it but couldn't find anything obvious | 18:55 |
| lbragstad | dolphm: pushing up the patch and marking as WIP, | 18:55 |
| dolphm | lbragstad: is that the bug that bknudson fixed this morning? | 18:55 |
| lbragstad | possibly? | 18:55 |
| dolphm | lbragstad: rebase onto https://review.openstack.org/#/c/125406/ | 18:55 |
| dolphm | lbragstad: which is in master | 18:55 |
| henrynash | lbragstad: that method just got change | 18:55 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 18:56 |
| lbragstad | ahh... | 18:56 |
| lbragstad | ok | 18:56 |
| *** praneshp has joined #openstack-keystone | 18:56 | |
| bknudson | I wonder why the test problem hasn't showed up until now... | 18:56 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 18:56 |
| dolphm | lbragstad: passes for me | 18:57 |
| bknudson | it's random | 18:57 |
| lbragstad | dolphm: cool, I bet that was it then | 18:57 |
| dolphm | bknudson: is the fix in juno and icehouse? | 18:57 |
| lbragstad | rerunning all the tests with that patch | 18:57 |
| bknudson | dolphm: it was backported to icehouse... not to juno-proposed | 18:57 |
| bknudson | at least I didn't notice if it was in juno-proposed | 18:57 |
| dolphm | bknudson: will you propose it? | 18:57 |
| bknudson | sure, just a min | 18:58 |
| dolphm | bknudson: proposed/juno | 18:58 |
| ekarlso | 16:08:23 ekarlso | apache config: http://paste.openstack.org/show/117771/ and the wsgi file mentionde in the config is: http://paste.openstack.org/show/117772/ │ bjornar | 18:58 |
| *** diegows has joined #openstack-keystone | 18:59 | |
| bknudson | wake up virtbot. | 19:02 |
| bknudson | https://review.openstack.org/#/c/125741/ is the backport | 19:02 |
| bknudson | I just pushed the button on gerrit | 19:02 |
| *** marcoemorais has quit IRC | 19:03 | |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| *** marcoemorais has quit IRC | 19:03 | |
| *** marcoemorais has joined #openstack-keystone | 19:04 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:04 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:05 | |
| *** marcoemorais has quit IRC | 19:05 | |
| lbragstad | ... wow, the weekly bug reports the lowest it's ever been... | 19:05 |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| lbragstad | 4 open bugs across all keystone projects in the last week... | 19:06 |
| *** vhosakot_ has quit IRC | 19:06 | |
| *** david-lyle has quit IRC | 19:07 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: remove deprecated access log middleware https://review.openstack.org/125703 | 19:07 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: Remove deprecated external authentication plugins https://review.openstack.org/125701 | 19:08 |
| dolphm | lbragstad: you're kidding | 19:09 |
| dolphm | lbragstad: all the devs are on vacation and everyone is waiting for packages? | 19:09 |
| bknudson | when removing functions, are we looking at updating the requirements.txt , and openstack-common.conf ? | 19:09 |
| lbragstad | dolphm: must be | 19:10 |
| dolphm | bknudson: i haven't, but access log and external auth don't have any unique deps | 19:10 |
| dolphm | bknudson: nor should kvs | 19:10 |
| dolphm | bknudson: stevemar's catalog removal certainly doesn't... | 19:10 |
| bknudson | and we still have xml in federation code? | 19:11 |
| dstanek | lbragstad that's amazing | 19:11 |
| lbragstad | bknudson: yes | 19:12 |
| lbragstad | I was going to ask stevemar and marekd about that | 19:12 |
| stevemar | dolphm, ++ stats/access log/external/catalog probably don't have any funky oslo or requirements bits | 19:12 |
| lbragstad | dstanek: ++ | 19:12 |
| stevemar | lbragstad, hmm, from that bug last release we already moved lxml to test-requirements | 19:13 |
| lbragstad | stevemar: yeah, that should be good | 19:17 |
| stevemar | lbragstad, so selfishly i want to say that we don't support XML output from the core APIs, but we'll still support it for federation | 19:18 |
| stevemar | which means carry the lxml req in test-req :( | 19:18 |
| lbragstad | stevemar: we have to support it for federation, right? | 19:18 |
| stevemar | yessum | 19:19 |
| lbragstad | ok | 19:20 |
| stevemar | lbragstad, marekd and i might just hack something up ourselves for this specific set of stuff | 19:20 |
| stevemar | we can probably use a template for most of it | 19:20 |
| lbragstad | stevemar: then you won't need XML? | 19:20 |
| stevemar | lbragstad, thats the hope | 19:20 |
| lbragstad | ok, | 19:20 |
| lbragstad | that sounds good, | 19:20 |
| lbragstad | that should be fine, XML support is out of the core apis | 19:21 |
| stevemar | lbragstad, no promises, we'd have to assess it first :) | 19:21 |
| bknudson | please don't try to generate XML (or any other structured document) without using a library. | 19:21 |
| lbragstad | yep, that understandable | 19:21 |
| lbragstad | library? | 19:22 |
| *** zzzeek has joined #openstack-keystone | 19:22 | |
| lbragstad | dolphm: sweet, passed 4607 tests without XML | 19:30 |
| *** jasondotstar has quit IRC | 19:32 | |
| morganfainberg | dolphm, i'm going to go ahead and approve that merge commit. | 19:40 |
| dolphm | morganfainberg: ++ | 19:40 |
| bknudson | can we merge the feature branch back into master now? | 19:42 |
| stevemar | lbragstad, i think bknudson's message was for me :) | 19:42 |
| dolphm | bknudson: did anything land in it? | 19:43 |
| lbragstad | stevemar: lol yeah, I figured | 19:43 |
| bknudson | dolphm: I don't think so... | 19:43 |
| dolphm | bknudson: then there's no reason to merge it, we can just nuke it. but then we're committing to delivering hierarhical in kilo | 19:44 |
| bknudson | dolphm: there's nothing landed but there's reviews posted to it. | 19:44 |
| lbragstad | yeah, I was reviewing a few of them.. | 19:44 |
| lbragstad | that had a pretty good list of reviews going | 19:44 |
| lbragstad | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:feature/hierarchical-multitenancy+topic:bp/hierarchical-multitenancy,n,z | 19:45 |
| bknudson | I hope that if someone has their code posted even before the release is open that we could get it in. | 19:46 |
| morganfainberg | bknudson, hehe | 19:46 |
| *** david-lyle has joined #openstack-keystone | 19:54 | |
| *** david-lyle_ has joined #openstack-keystone | 19:56 | |
| ekarlso | nkinder: did yoi hava a cle on it ? | 19:58 |
| *** david-lyle has quit IRC | 19:59 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 20:01 |
| *** radez is now known as radez_g0n3 | 20:06 | |
| *** radez_g0n3 is now known as radez | 20:06 | |
| ekarlso | nkinder: what's your config then for it ? | 20:07 |
| nkinder | ekarlso: not yet. I had some problems with my setup, so I'm fixing that up. | 20:07 |
| *** bknudson has quit IRC | 20:07 | |
| *** henrynash has quit IRC | 20:07 | |
| nkinder | ekarlso: let me paste my config, then I need to step away for a bit | 20:08 |
| nkinder | ekarlso: I have 2 separate wsgi files (one for 5000, one for 35357) - http://paste.openstack.org/show/117875/ | 20:11 |
| nkinder | ekarlso: bbiab | 20:11 |
| *** bknudson has joined #openstack-keystone | 20:13 | |
| ekarlso | nkinder: care to paste the wsgi files ? | 20:14 |
| ekarlso | or are they the same | 20:14 |
| *** david-lyle_ is now known as david-lyle | 20:15 | |
| bknudson | lbragstad: http://developer.openstack.org/api-ref-image-v2.html#image-schemas-v2 -- json schema publication | 20:16 |
| *** nkinder has quit IRC | 20:17 | |
| morganfainberg | ekarlso, in my experience they can be the same file (but linked/named differently) | 20:18 |
| ekarlso | j | 20:19 |
| ekarlso | morganfainberg: yeah, that's what i've done but doesn't work :( | 20:19 |
| morganfainberg | ekarlso, since i don't *know* your specific configuration the best thing I can do is recommend looking at what devstack does | 20:22 |
| morganfainberg | ekarlso, we know for sure devstack is standing up V2.0 behind apache in a sane way | 20:23 |
| ekarlso | morganfainberg: does it do behind apache as defaulr or ? | 20:23 |
| morganfainberg | ekarlso, https://github.com/openstack-dev/devstack/blob/master/lib/keystone#L142-L144 | 20:23 |
| *** nellysmitt has quit IRC | 20:23 | |
| lbragstad | bknudson: we need that for identity? | 20:23 |
| morganfainberg | ekarlso, current devstack deploys keystone behind apache by default | 20:23 |
| bknudson | lbragstad: yes, we should do the same | 20:24 |
| morganfainberg | ekarlso, and all gate tests are done with keystone behind apache | 20:24 |
| morganfainberg | ekarlso, and here is what it does to configure the apache conf: https://github.com/openstack-dev/devstack/blob/master/lib/keystone#L146-L158 | 20:25 |
| morganfainberg | ekarlso, and here is the template: https://github.com/openstack-dev/devstack/blob/master/files/apache-keystone.template | 20:25 |
| morganfainberg | ekarlso, for the apache conf | 20:25 |
| *** andreaf has joined #openstack-keystone | 20:27 | |
| morganfainberg | bknudson, gyee, https://bugs.launchpad.net/keystone/+bug/1374497 this isthe oslo.db thing I was talking about earlier | 20:29 |
| uvirtbot | Launchpad bug 1374497 in oslo.db "change in oslo.db "ping" handling is causing issues in projects that are not using transactions" [High,Fix committed] | 20:29 |
| *** marcoemorais1 has joined #openstack-keystone | 20:31 | |
| *** marcoemorais1 has quit IRC | 20:31 | |
| bknudson | morganfainberg: that looks like it. | 20:32 |
| bknudson | and I wish there weren't 2 morgan's in the room. | 20:32 |
| morganfainberg | bknudson, hah, | 20:32 |
| morganfainberg | morgan_remote_ is me too! | 20:32 |
| *** marcoemorais1 has joined #openstack-keystone | 20:32 | |
| morganfainberg | so, i'll see it either way :P | 20:32 |
| morganfainberg | i can probably change that name to something else. | 20:32 |
| morganfainberg | just dunno what to change it to. | 20:32 |
| bknudson | autocomplete doesn't work | 20:32 |
| *** andreaf has quit IRC | 20:33 | |
| *** marcoemorais has quit IRC | 20:34 | |
| morganfainberg | bknudson, ok i'll find some other name for it | 20:34 |
| morganfainberg | bknudson, for that bug ^ i think the juno fix might be getting a juno requirements update through | 20:34 |
| bknudson | morganfainberg: it's already allowed in requirements | 20:34 |
| bknudson | I assume it's not capped. | 20:34 |
| morganfainberg | the right, i mean a floor. | 20:34 |
| morganfainberg | *might* | 20:35 |
| morganfainberg | *shrug*. | 20:35 |
| morganfainberg | eh, anyway 1.0.2 fixes it. | 20:35 |
| ekarlso | tjnx morganfainberg :) | 20:35 |
| ekarlso | will check tmrw | 20:35 |
| bknudson | morganfainberg: gyee mentioned that they were using version 0.2 or something. | 20:36 |
| * morganfainberg pokes gyee | 20:37 | |
| bknudson | I thought you 2 worked together. | 20:37 |
| morganfainberg | bknudson, he's in the bay area and not directly on the same team as I am | 20:38 |
| morganfainberg | bknudson, i see him about as often (in person) as you do :P | 20:39 |
| * morganfainberg is in LA. | 20:39 | |
| bknudson | I thought you were moving? | 20:39 |
| morganfainberg | bknudson, saying around SoCal if I am | 20:40 |
| morganfainberg | staying* | 20:40 |
| morganfainberg | too much $ to live in the bay area | 20:40 |
| bknudson | must be the weather | 20:40 |
| morganfainberg | too hot here for me actually, and not enough rain, PDX would probably be my alternative choice. Santa Barbara or Santa Monica would be likely the best choices in SoCal | 20:40 |
| bknudson | portland? I've got some family there and have visited and it's a nice area. | 20:42 |
| morganfainberg | yeah i like portland a lot | 20:42 |
| *** raildo is now known as raildo_away | 20:46 | |
| *** andreaf has joined #openstack-keystone | 20:47 | |
| *** morgan_remote_ is now known as remote_morgan_ | 20:48 | |
| *** wwriverrat has joined #openstack-keystone | 20:50 | |
| *** remote_morgan_ is now known as morgan_remote_ | 20:50 | |
| *** morgan_remote_ is now known as morgan_remote | 20:50 | |
| *** morgan_remote is now known as remote_morgan_ | 20:51 | |
| remote_morgan_ | bknudson: better? | 20:52 |
| *** lhcheng_ has quit IRC | 20:52 | |
| bknudson | morganfainberg: can I still just type morganfainberg? | 20:52 |
| *** wwriverrat has left #openstack-keystone | 20:52 | |
| remote_morgan_ | bknudson: yes, will see it on both places highlighted | 20:52 |
| *** lhcheng has joined #openstack-keystone | 20:52 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:52 | |
| *** marcoemorais1 has quit IRC | 20:55 | |
| bknudson | I am happier since now it's just mo | 20:55 |
| *** HenryG has quit IRC | 20:55 | |
| morganfainberg | hehe unless mordred is in a channel | 20:56 |
| *** lhcheng has quit IRC | 20:57 | |
| *** gordc has quit IRC | 21:00 | |
| *** gokrokve has quit IRC | 21:00 | |
| *** gokrokve has joined #openstack-keystone | 21:00 | |
| *** lhcheng has joined #openstack-keystone | 21:01 | |
| *** amcrn has quit IRC | 21:01 | |
| *** marcoemorais has joined #openstack-keystone | 21:02 | |
| *** amcrn has joined #openstack-keystone | 21:04 | |
| *** stevemar has quit IRC | 21:05 | |
| *** radez is now known as radez_g0n3 | 21:15 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: pki/ssl_setup configurable digest https://review.openstack.org/117366 | 21:23 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Change the default digest for pki/ssl_setup to sha256 https://review.openstack.org/117367 | 21:23 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move unit tests from test_backend_ldap https://review.openstack.org/119928 | 21:32 |
| *** marcoemorais has quit IRC | 21:35 | |
| *** marcoemorais has joined #openstack-keystone | 21:36 | |
| *** marcoemorais has quit IRC | 21:37 | |
| *** marcoemorais has joined #openstack-keystone | 21:38 | |
| *** marcoemorais has quit IRC | 21:38 | |
| *** marcoemorais has joined #openstack-keystone | 21:38 | |
| *** amakarov_away has quit IRC | 21:39 | |
| *** amakarov_away has joined #openstack-keystone | 21:39 | |
| *** leveldoc has joined #openstack-keystone | 21:48 | |
| *** nkinder has joined #openstack-keystone | 21:53 | |
| vishy | remote_morgan_: https://bugs.launchpad.net/keystone/+bug/1376937 | 21:57 |
| uvirtbot | Launchpad bug 1376937 in keystone "No way to prevent duplicates in endpoints" [Undecided,New] | 21:57 |
| *** henrynash has joined #openstack-keystone | 22:01 | |
| *** gokrokve has quit IRC | 22:02 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Log token with sha1 https://review.openstack.org/123819 | 22:02 |
| *** praneshp has quit IRC | 22:03 | |
| *** rkofman has quit IRC | 22:03 | |
| *** topol has quit IRC | 22:04 | |
| *** praneshp has joined #openstack-keystone | 22:04 | |
| *** rkofman has joined #openstack-keystone | 22:04 | |
| *** thedodd has quit IRC | 22:06 | |
| *** praneshp has quit IRC | 22:07 | |
| bknudson | dstanek: one option for getting rid of dependency injection is to use notifications (publish/subscribe) where cross-backend communication is required. | 22:09 |
| *** praneshp has joined #openstack-keystone | 22:10 | |
| nkinder | bknudson: so why SHA1? | 22:10 |
| dstanek | bknudson: the tradeoff there is visibility - what happens when a user is deleted and in what order... | 22:10 |
| bknudson | nkinder: sha1 for what? | 22:11 |
| *** gokrokve has joined #openstack-keystone | 22:11 | |
| nkinder | bknudson: the patch you proposed 9 minutes ago ^^^ | 22:11 |
| nkinder | logging a sha1 hash of the token | 22:11 |
| bknudson | nkinder: oh, this is the scheme that was agreed to on -dev mailing list... there's probably a bug for it I should have referenced | 22:12 |
| bknudson | nkinder: https://bugs.launchpad.net/python-glanceclient/+bug/1329301 | 22:12 |
| *** wwriverrat has joined #openstack-keystone | 22:12 | |
| uvirtbot | Launchpad bug 1329301 in python-glanceclient "Update how tokens are redacted" [Undecided,Fix released] | 22:12 |
| bknudson | dstanek: the code will have to be written in such a way that the order doesn't matter. | 22:13 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Log token with sha1 https://review.openstack.org/123819 | 22:14 |
| dstanek | bknudson: and very idempodent - for instance doing X triggers Y and Z - doing Z also triggers Y | 22:14 |
| dstanek | *idempotent* | 22:14 |
| bknudson | dstanek: shouldn't that be the case anyways? | 22:15 |
| *** wwriverrat has left #openstack-keystone | 22:16 | |
| dstanek | bknudson: yes, but it would be in a single method and you wouldn't have to grep everything | 22:16 |
| dstanek | bknudson: you'd have to build a tree in your head...what is triggered by X...then for each of those things what do they trigger | 22:17 |
| bknudson | dstanek: if we have both publish/subscribe and DI, should we pick one or the other? | 22:17 |
| dstanek | bknudson: DI solves a different problem so you would need both | 22:18 |
| *** NM has quit IRC | 22:18 | |
| dstanek | DI is about composition of objects | 22:18 |
| bknudson | dstanek: here's an example, btw: https://review.openstack.org/#/c/125521/ | 22:18 |
| bknudson | dstanek: is that a place where DI should be used or notifications? | 22:18 |
| dstanek | bknudson: that's probably an OK use of notifications | 22:21 |
| bknudson | dstanek: is it better to use notifications there or DI? | 22:22 |
| nkinder | bknudson: I tend to agree with morganfainberg's comments in that thread. Logging the SHA1 of the token is not a great idea. | 22:23 |
| bknudson | nkinder: does it open a security hole? | 22:23 |
| dstanek | bknudson: you can't solve that with DI becase the object structure is bad - all DI does is allow you to build up object graphs , but that code has a circular dependency | 22:23 |
| nkinder | bknudson: one assumption in that thread was that PKI tokens were in use. There was a repeated argument that "we're hashing 4k of data", so it's safe. | 22:23 |
| nkinder | uuid is much smaller | 22:23 |
| morganfainberg | vishy, thanks | 22:23 |
| dstanek | morganfainberg: a new feature request https://bugs.launchpad.net/keystone/+bug/1376937 | 22:24 |
| nkinder | bknudson: it's not horrible, but I just don't see the strong reason to log them | 22:24 |
| uvirtbot | Launchpad bug 1376937 in keystone "No way to prevent duplicates in endpoints" [Undecided,New] | 22:24 |
| nkinder | bknudson: given that the tokens end up in server side logs (like horizon) | 22:25 |
| morganfainberg | dstanek, yeah | 22:25 |
| bknudson | nkinder: the difficulty that people are having is tracking a request through the system. | 22:25 |
| morganfainberg | dstanek, totally reasonable feature request imo | 22:25 |
| nkinder | bknudson: using a credential for tracking doesn't seem right though | 22:25 |
| bknudson | nkinder: I think you're correct and something better is needed. | 22:26 |
| morganfainberg | bknudson, nkinder, i *think* osprofiler was trying to solve some of this with the unique request id generation stuff | 22:26 |
| morganfainberg | but... it's not a clear line | 22:27 |
| bknudson | nkinder: I'm not sure I could be convinced the UUID tokens make this worse than PKI tokens... you won't be able to figure out the UUID from the sha1 either way | 22:27 |
| *** topol has joined #openstack-keystone | 22:27 | |
| bknudson | morganfainberg: I wish that request tracking wasn't tied into osprofiler, since that seems to be a tougher sell. | 22:27 |
| bknudson | split it out and build osprofiler on top of it | 22:27 |
| morganfainberg | so, wrt using something like audit_id from within the token, almost every single case we need to convert a UUID token -> token data, or pki token -> decoded token data, it means we *could* just use the audit_ids at that point | 22:28 |
| dstanek | morganfainberg: yes | 22:28 |
| morganfainberg | if the token is invalid / doesn't parse, we actually *could* log the token | 22:28 |
| morganfainberg | if needed. | 22:29 |
| topol | I just reconnected back to what sounds like an intersting conversation | 22:29 |
| morganfainberg | if this is a case of the clients are opaque and don't know the token info, e.g. passed in a uuid token-id into the client as auth, we could a) ask keystone, or b) not log it. once you're inside a wrapped app or you had to grab the token info, you have audit_ids | 22:30 |
| morganfainberg | in the case of a PKI id, we can again decode in the clients | 22:30 |
| bknudson | to decode a PKI token you're going to need the cert? | 22:31 |
| morganfainberg | bknudson, hm, i was wondering about that. I don't know if we need the cert. | 22:31 |
| morganfainberg | we aren't needing to validate the signature in that case | 22:32 |
| *** henrynash has quit IRC | 22:32 | |
| dstanek | why is this a foreign key error? http://paste.openstack.org/show/117897/ | 22:32 |
| morganfainberg | the client doesn't care, (middleware clearly does) | 22:32 |
| morganfainberg | as would keystone | 22:32 |
| morganfainberg | dstanek, where did that come from? | 22:32 |
| dstanek | morganfainberg: my experiments :-) | 22:33 |
| dstanek | i'm doing some form of science over here | 22:33 |
| morganfainberg | dstanek, because ... there is a FK for group on the id | 22:33 |
| morganfainberg | the idea is you shouldn't delete the id if it's part of a group | 22:33 |
| morganfainberg | unless it is supposed to cascade | 22:33 |
| dstanek | ah, i didn't think about the id being in other tables....i was too focused on the "i'm deleting by ID: | 22:34 |
| nkinder | bknudson: I don't think it's a horrible security issue, but it definitely doesn't make it more secure to log a SHA1 of the token | 22:34 |
| morganfainberg | dstanek, ahh | 22:35 |
| nkinder | morganfainberg: the idea of an audit_id would be better. If we want an id to track a request, we should use something designed for that (not a credential) | 22:35 |
| dstanek | i'm deleting/shuffling/screwing up large parts of our code to see what happens :-) | 22:35 |
| morganfainberg | nkinder, and each token juno and beyond all have audit ids | 22:35 |
| morganfainberg | nkinder, the only *issue* is you need the token body to know it. | 22:36 |
| bknudson | nkinder: I agree it's less secure since there's more info provided. | 22:36 |
| *** andreaf has quit IRC | 22:36 | |
| *** andreaf has joined #openstack-keystone | 22:36 | |
| bknudson | I also think that something designed for tracking requests would be the best approach. Not sure what it would look like. | 22:37 |
| morganfainberg | but unique request id and token audit id also serve two different purposes | 22:37 |
| morganfainberg | audit id is great for tracking authn/authz across reqeusts | 22:37 |
| bknudson | it would be nice to be able to be able to link an error that the user sees to the error in the log. | 22:37 |
| morganfainberg | bknudson, i'm actually a fan of pulling the osprofiler stuff out and making the request get a header that follows it | 22:38 |
| bknudson | not just say "contact your admin and tell him to look at the logs", but you should be able to say "contact your admin with this request ID" | 22:38 |
| morganfainberg | if everything used keystoneclient (it should) and sessions (it should) we could make session request_id aware | 22:39 |
| morganfainberg | and middleware just maintains the request from the header through to the context so we can reference it from within a service. | 22:39 |
| morganfainberg | then you can use both audit_id (tracking auth chain) and request_id (tracking specific request chain) -- an all around win? | 22:40 |
| morganfainberg | request id could become part of the pycadf middleware thing we adopted. | 22:41 |
| morganfainberg | or even some other middleware *shrug* | 22:41 |
| *** dims has quit IRC | 22:42 | |
| *** dims has joined #openstack-keystone | 22:43 | |
| *** joesavak has quit IRC | 22:46 | |
| *** dims has quit IRC | 22:47 | |
| gyee | morganfainberg, bknudson, sorry I missed the oslo.db conversation earlier. So if we are using 1.2.0 we should be fine right? | 22:47 |
| morganfainberg | gyee, 1.0.2 should be fixed for that bug | 22:47 |
| bknudson | what's this then? https://review.openstack.org/#/c/125347/ | 22:48 |
| morganfainberg | i think that is a longer term fi | 22:48 |
| bknudson | oh, this bug is just on startup | 22:48 |
| morganfainberg | x | 22:48 |
| morganfainberg | yeah | 22:48 |
| morganfainberg | or that create_engine | 22:49 |
| gyee | k, I'll ask the guys to pull that version and give it a shot | 22:49 |
| gyee | we were using a really old version | 22:49 |
| morganfainberg | gyee, yeah they just released 1.0.2 for that fix iirc | 22:49 |
| gyee | morganfainberg, bknudson, thanks for the info | 22:49 |
| *** david-lyle has quit IRC | 22:51 | |
| nkinder | ekarlso: I also get a 404 when trying to access 35357/v2.0 | 22:56 |
| dstanek | this test shouldn't work, but because sqlite sucks it does! http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_associate_project_endpoint_extension.py#n997 | 22:56 |
| ekarlso | nkinder: so a bug then ? | 23:05 |
| nkinder | ekarlso: not sure. Still investigating | 23:05 |
| *** wwriverrat has joined #openstack-keystone | 23:05 | |
| ekarlso | nkinder: funny is that it works fine when running keystone-all instead of behind httpd | 23:05 |
| nkinder | ekarlso: yeah, I don't get what would cause that | 23:05 |
| *** victsou has quit IRC | 23:06 | |
| ekarlso | :D | 23:06 |
| *** victsou has joined #openstack-keystone | 23:07 | |
| *** victsou is now known as vsilva | 23:09 | |
| *** HenryG has joined #openstack-keystone | 23:10 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 23:11 |
| dstanek | does anyone know if endpoint_filter actually works? | 23:11 |
| *** wwriverrat has left #openstack-keystone | 23:14 | |
| *** grantbow has quit IRC | 23:22 | |
| dstanek | the correct answer seems to be no, or at least not fully | 23:23 |
| *** grantbow has joined #openstack-keystone | 23:28 | |
| *** grantbow has quit IRC | 23:31 | |
| *** grantbow has joined #openstack-keystone | 23:36 | |
| *** andreaf has quit IRC | 23:47 | |
| *** andreaf has joined #openstack-keystone | 23:48 | |
| *** dims has joined #openstack-keystone | 23:49 | |
| *** dims has quit IRC | 23:54 | |
| *** dims has joined #openstack-keystone | 23:55 | |
| *** diegows has quit IRC | 23:57 | |
| *** topol has quit IRC | 23:58 | |
| *** dims has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!