| *** andreaf has quit IRC | 00:15 | |
| *** andreaf has joined #openstack-keystone | 00:16 | |
| *** shakamunyi has joined #openstack-keystone | 00:22 | |
| *** cjellick has joined #openstack-keystone | 00:25 | |
| *** shakamunyi has quit IRC | 00:29 | |
| *** cjellick has quit IRC | 00:29 | |
| *** shakamunyi has joined #openstack-keystone | 00:29 | |
| *** shakamunyi has quit IRC | 00:39 | |
| *** shakamunyi has joined #openstack-keystone | 01:04 | |
| *** henrynash has quit IRC | 01:12 | |
| *** shakamunyi has quit IRC | 01:14 | |
| *** andreaf has quit IRC | 01:19 | |
| *** andreaf has joined #openstack-keystone | 01:20 | |
| *** cjellick has joined #openstack-keystone | 01:26 | |
| *** andreaf has quit IRC | 01:30 | |
| *** andreaf has joined #openstack-keystone | 01:30 | |
| *** cjellick has quit IRC | 01:31 | |
| *** shakamunyi has joined #openstack-keystone | 01:39 | |
| *** dguitarbite has joined #openstack-keystone | 01:42 | |
| *** andreaf has quit IRC | 01:44 | |
| *** andreaf has joined #openstack-keystone | 01:45 | |
| *** dimsum_ has quit IRC | 01:47 | |
| *** diegows has quit IRC | 01:49 | |
| *** shakamunyi has quit IRC | 01:54 | |
| *** vsilva is now known as victsou | 01:55 | |
| *** dimsum_ has joined #openstack-keystone | 01:58 | |
| *** dimsum_ has quit IRC | 02:00 | |
| *** dguitarbite has quit IRC | 02:02 | |
| *** dimsum_ has joined #openstack-keystone | 02:10 | |
| *** Sunny__ has quit IRC | 02:14 | |
| *** shakamunyi has joined #openstack-keystone | 02:20 | |
| *** cjellick has joined #openstack-keystone | 02:27 | |
| *** cjellick has quit IRC | 02:32 | |
| *** andreaf has quit IRC | 02:34 | |
| *** andreaf has joined #openstack-keystone | 02:34 | |
| *** shakamunyi has quit IRC | 02:36 | |
| *** dimsum_ has quit IRC | 02:38 | |
| *** stevemar has joined #openstack-keystone | 02:43 | |
| *** shakamunyi has joined #openstack-keystone | 03:03 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 03:11 | |
| *** shakamunyi has quit IRC | 03:11 | |
| *** dimsum_ has joined #openstack-keystone | 03:16 | |
| *** dguitarbite has joined #openstack-keystone | 03:19 | |
| *** cjellick has joined #openstack-keystone | 03:28 | |
| *** dimsum_ has quit IRC | 03:30 | |
| *** cjellick has quit IRC | 03:32 | |
| *** gokrokve has joined #openstack-keystone | 03:51 | |
| *** gokrokve has quit IRC | 03:53 | |
| *** gokrokve has joined #openstack-keystone | 03:53 | |
| *** gokrokve has quit IRC | 03:53 | |
| *** shakamunyi has joined #openstack-keystone | 04:08 | |
| *** andreaf has quit IRC | 04:12 | |
| *** andreaf has joined #openstack-keystone | 04:12 | |
| *** shakamunyi has quit IRC | 04:20 | |
| *** fifieldt has joined #openstack-keystone | 04:25 | |
| *** gokrokve has joined #openstack-keystone | 04:25 | |
| *** gokrokve has quit IRC | 04:25 | |
| *** andreaf has quit IRC | 04:28 | |
| *** cjellick has joined #openstack-keystone | 04:29 | |
| *** andreaf has joined #openstack-keystone | 04:29 | |
| *** cjellick has quit IRC | 04:33 | |
| *** lcheng has joined #openstack-keystone | 04:57 | |
| *** lcheng has quit IRC | 04:58 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 04:58 | |
| *** lcheng has joined #openstack-keystone | 04:58 | |
| *** lcheng has quit IRC | 05:03 | |
| *** lcheng has joined #openstack-keystone | 05:06 | |
| *** shakamunyi has joined #openstack-keystone | 05:08 | |
| *** lcheng has quit IRC | 05:09 | |
| *** lcheng has joined #openstack-keystone | 05:10 | |
| *** ajayaa has joined #openstack-keystone | 05:13 | |
| *** jaosorior has joined #openstack-keystone | 05:22 | |
| *** shakamunyi has quit IRC | 05:24 | |
| *** ajayaa has quit IRC | 05:24 | |
| *** cjellick has joined #openstack-keystone | 05:29 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use jsonutils from oslo.serialization https://review.openstack.org/126116 | 05:34 |
|---|---|---|
| *** cjellick has quit IRC | 05:34 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use importutils from oslo.utils https://review.openstack.org/126115 | 05:34 |
| openstackgerrit | Haneef Ali proposed a change to openstack/keystone: Allow v3 policy file https://review.openstack.org/126217 | 05:34 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use importutils from oslo.utils https://review.openstack.org/126115 | 05:35 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Replace an instance of keystone/openstack/common/timeutils https://review.openstack.org/126125 | 05:35 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 05:40 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 05:41 |
| *** ajayaa has joined #openstack-keystone | 05:43 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update the CLI examples to also use openstackclient https://review.openstack.org/124095 | 05:44 |
| *** k4n0 has joined #openstack-keystone | 05:44 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 05:44 |
| *** ukalifon has joined #openstack-keystone | 05:49 | |
| *** shakamunyi has joined #openstack-keystone | 05:50 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add v3 openstackclient CLI examples https://review.openstack.org/124489 | 05:53 |
| *** shakamunyi has quit IRC | 05:57 | |
| *** andreaf has quit IRC | 05:57 | |
| *** andreaf has joined #openstack-keystone | 05:58 | |
| *** dguitarbite has quit IRC | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/124950 | 06:05 |
| *** cjellick has joined #openstack-keystone | 06:30 | |
| *** cjellick has quit IRC | 06:35 | |
| *** lufix has joined #openstack-keystone | 06:36 | |
| *** miqui has quit IRC | 06:38 | |
| *** shakamunyi has joined #openstack-keystone | 06:53 | |
| *** afazekas has joined #openstack-keystone | 06:53 | |
| *** lcheng has quit IRC | 06:56 | |
| *** andreaf has quit IRC | 07:02 | |
| *** shakamunyi has quit IRC | 07:19 | |
| *** jistr has joined #openstack-keystone | 07:23 | |
| *** cjellick has joined #openstack-keystone | 07:31 | |
| *** cjellick has quit IRC | 07:36 | |
| *** shakamunyi has joined #openstack-keystone | 07:40 | |
| *** stevemar has quit IRC | 07:44 | |
| *** shakamunyi has quit IRC | 07:55 | |
| marekd | nkinder: thanks for uploading openstack auth plugins patch! | 08:11 |
| *** nellysmitt has joined #openstack-keystone | 08:15 | |
| *** Dafna has joined #openstack-keystone | 08:22 | |
| *** cjellick has joined #openstack-keystone | 08:32 | |
| *** cjellick has quit IRC | 08:36 | |
| *** lsmola has joined #openstack-keystone | 08:37 | |
| *** oomichi has joined #openstack-keystone | 08:37 | |
| *** k4n0 has quit IRC | 08:46 | |
| openstackgerrit | Christian Berendt proposed a change to openstack/keystone: Change all used passwords/secrets to 'secretsecret' and 'secrete_token' to 'secret_token' https://review.openstack.org/120031 | 08:48 |
| *** dguitarbite has joined #openstack-keystone | 08:49 | |
| *** Clabbe has quit IRC | 08:52 | |
| *** k4n0 has joined #openstack-keystone | 09:00 | |
| *** aix has joined #openstack-keystone | 09:07 | |
| *** cjellick has joined #openstack-keystone | 09:33 | |
| *** cjellick has quit IRC | 09:37 | |
| *** shakamunyi has joined #openstack-keystone | 09:41 | |
| *** k4n0 has quit IRC | 09:41 | |
| *** shakamunyi has quit IRC | 09:45 | |
| *** amakarov has joined #openstack-keystone | 09:47 | |
| *** k4n0 has joined #openstack-keystone | 09:57 | |
| *** andreaf_ is now known as andreaf | 10:32 | |
| *** cjellick has joined #openstack-keystone | 10:34 | |
| *** kragniz has joined #openstack-keystone | 10:39 | |
| *** cjellick has quit IRC | 10:39 | |
| *** harlowja_away has quit IRC | 10:47 | |
| *** Kui has quit IRC | 10:50 | |
| *** diegows has joined #openstack-keystone | 10:53 | |
| *** nellysmitt has quit IRC | 10:58 | |
| *** shakamunyi has joined #openstack-keystone | 11:03 | |
| *** shakamunyi has quit IRC | 11:12 | |
| *** Tahmina has joined #openstack-keystone | 11:14 | |
| *** dimsum_ has joined #openstack-keystone | 11:19 | |
| *** nellysmitt has joined #openstack-keystone | 11:33 | |
| *** cjellick has joined #openstack-keystone | 11:34 | |
| *** mflobo has joined #openstack-keystone | 11:36 | |
| *** cjellick has quit IRC | 11:39 | |
| *** shakamunyi has joined #openstack-keystone | 12:26 | |
| *** cjellick has joined #openstack-keystone | 12:35 | |
| *** cjellick has quit IRC | 12:40 | |
| *** shakamunyi has quit IRC | 12:40 | |
| *** ayoung-ZzzZzzZzz is now known as ayoung | 12:44 | |
| *** dimsum_ has quit IRC | 12:45 | |
| *** dimsum_ has joined #openstack-keystone | 12:45 | |
| *** dimsum_ is now known as dims | 12:58 | |
| *** aix has quit IRC | 12:58 | |
| *** ukalifon3 has joined #openstack-keystone | 12:59 | |
| *** ukalifon has quit IRC | 12:59 | |
| *** aix has joined #openstack-keystone | 12:59 | |
| *** raildo_away has quit IRC | 13:02 | |
| *** vhoward has joined #openstack-keystone | 13:06 | |
| *** samuelmz has joined #openstack-keystone | 13:08 | |
| *** jdennis has joined #openstack-keystone | 13:11 | |
| *** amakarov has quit IRC | 13:12 | |
| *** gordc has joined #openstack-keystone | 13:13 | |
| *** mikedillion has joined #openstack-keystone | 13:26 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:30 | |
| *** amakarov has joined #openstack-keystone | 13:33 | |
| *** oomichi has quit IRC | 13:34 | |
| *** richm has joined #openstack-keystone | 13:36 | |
| *** cjellick has joined #openstack-keystone | 13:36 | |
| *** shakamunyi has joined #openstack-keystone | 13:37 | |
| *** thedodd has joined #openstack-keystone | 13:40 | |
| *** cjellick has quit IRC | 13:40 | |
| *** dhellmann is now known as dhellmann_ | 13:43 | |
| *** dhellmann_ is now known as dhellmann | 13:44 | |
| *** r-daneel has joined #openstack-keystone | 13:45 | |
| *** andreaf is now known as andreaf_ | 13:45 | |
| *** thedodd has quit IRC | 13:46 | |
| *** achampion has joined #openstack-keystone | 13:48 | |
| achampion | quick question, is there an easy way through the keystoneclient to get from username/password to a userid? | 13:49 |
| amakarov | achampion, m.b. custom script? | 13:52 |
| *** shakamunyi has quit IRC | 13:53 | |
| achampion | amkarov: m.b.? | 13:53 |
| amakarov | achampion, "may be" :) | 13:56 |
| amakarov | achampion, keystone api has no much porcelain actually | 13:58 |
| achampion | amakarov: :$, I was surprised, that I couldn't get access to the token details, just the token id. | 13:59 |
| amakarov | achampion, X-Subject-Token can be usable here | 14:00 |
| amakarov | Try base64decode on it | 14:01 |
| amakarov | if you use PKI, it holds everything you need | 14:01 |
| *** ukalifon3 has quit IRC | 14:02 | |
| tellesnobrega | hey morganfainberg, i'm starting to work on this bug https://bugs.launchpad.net/keystone/+bug/1291157 , the idea is to revoke all tokens from an idp, when this idp is deleted | 14:06 |
| uvirtbot | Launchpad bug 1291157 in python-keystoneclient "idp deletion should trigger token revocation" [High,Triaged] | 14:06 |
| tellesnobrega | my question here is, is there an way to list all tokens from an idp? | 14:07 |
| *** shakamunyi has joined #openstack-keystone | 14:07 | |
| tellesnobrega | nevermind, i saw dolph's comment in the bug and the approach is the other way around | 14:10 |
| marekd | tellesnobrega: there was a guy working on that. You may want to contact him. Besides, I'd suggest syncing whether this bug should be fixed for UUIDs or PKI tokens (then revocation events are to be used). | 14:12 |
| *** amakarov has quit IRC | 14:12 | |
| *** amakarov has joined #openstack-keystone | 14:13 | |
| *** shakamunyi has quit IRC | 14:21 | |
| rodrigods | lbragstad, went through your comments at the HM patch, you can continue your review =) | 14:21 |
| lbragstad | rodrigods: sure thing, I'll add it to my queue | 14:22 |
| tellesnobrega | marekd, i see. Who should I talk to about this bug? | 14:22 |
| marekd | tellesnobrega: both bugs are assigned to Navid Putschi. | 14:24 |
| tellesnobrega | i'll try to contact him | 14:25 |
| marekd | tellesnobrega: speaking about UUID/PKI -i suggest talking with ayoung | 14:25 |
| marekd | and morganfainberg | 14:25 |
| tellesnobrega | ok | 14:25 |
| marekd | otherwise you may waste your time | 14:26 |
| *** david-lyle has joined #openstack-keystone | 14:28 | |
| *** jistr has quit IRC | 14:28 | |
| *** gokrokve has joined #openstack-keystone | 14:28 | |
| *** jistr has joined #openstack-keystone | 14:30 | |
| dolphm | morganfainberg: clean backports to juno/proposed https://review.openstack.org/#/c/126307/ https://review.openstack.org/#/c/126308/ | 14:34 |
| *** radez_g0n3 is now known as radez | 14:34 | |
| dstanek | dolphm: nice | 14:35 |
| dolphm | anyone free to review this? i'd like to get it into juno as well https://review.openstack.org/#/c/125228/ | 14:35 |
| dolphm | dstanek: oh, just read your concern there .. ^ | 14:36 |
| dstanek | dolphm: yeah, like morganfainberg said it's probably fine for RC since we won't be adding new tables and relationships there, but for Kilo it would introduce a maint burdon | 14:37 |
| dolphm | dstanek: and agree, but it does work as-is | 14:37 |
| *** cjellick has joined #openstack-keystone | 14:37 | |
| dolphm | dstanek: ++ | 14:37 |
| dstanek | dolphm: if need be we can just replace it later after the merge | 14:37 |
| dstanek | dolphm: do you think it's worth fixing now or merging and fixing later | 14:41 |
| *** stevemar has joined #openstack-keystone | 14:41 | |
| *** cjellick has quit IRC | 14:41 | |
| *** topol has joined #openstack-keystone | 14:42 | |
| dolphm | dstanek: both? :) i'd like to get a fix into juno/proposed today so we can cut rc2 within the next 24 hours with it, but the fast we can get a better solution into master, the more happiness | 14:42 |
| remote_morgan_ | Hm. Let's merge it now so we can get it for rc fix as a following for better | 14:42 |
| *** raildo has joined #openstack-keystone | 14:42 | |
| remote_morgan_ | Yeah. Rc2 in 24hr would be nice. | 14:43 |
| dstanek | the code looks ok - i have not tried it out | 14:43 |
| remote_morgan_ | dolphm looking at those reviews while on the ground | 14:47 |
| dolphm | remote_morgan_: thanks | 14:47 |
| *** diegows has quit IRC | 14:47 | |
| *** achampion has quit IRC | 14:47 | |
| tellesnobrega | ayoung, morganfainberg do you guys have any considerations about the bug https://bugs.launchpad.net/keystone/+bug/1291157 regarding if this should be done for UUID or PKI tokens or both? | 14:47 |
| uvirtbot | Launchpad bug 1291157 in python-keystoneclient "idp deletion should trigger token revocation" [High,Triaged] | 14:47 |
| *** aix has quit IRC | 14:48 | |
| *** achampion has joined #openstack-keystone | 14:48 | |
| ayoung | tellesnobrega, needs to be done for both | 14:49 |
| tellesnobrega | ayoung, thanks | 14:50 |
| remote_morgan_ | dolphm: +2 on both of those. (Backports) | 14:52 |
| dolphm | tellesnobrega: if it's achieved with a token revocation event, then it covers both | 14:52 |
| dolphm | remote_morgan_: thank you, sir! | 14:52 |
| *** joesavak has joined #openstack-keystone | 14:53 | |
| remote_morgan_ | ayoung: I think it only is needed for events not revoke by id. | 14:55 |
| ayoung | remote_morgan_, it is needed for both | 14:55 |
| ayoung | revocation events are not used yet | 14:56 |
| remote_morgan_ | Is it? I thought we determined at the summit/meetup we'd make it event only. | 14:56 |
| remote_morgan_ | And events work for uuid tokens now. Just not consumed by middleware *yet* | 14:56 |
| tellesnobrega | dolphm, from your comment in the bug, the idea is to check the token by getting the idps. is this the better approach or should it be revoke tokens when deleting idps? | 14:57 |
| remote_morgan_ | I'm fine with doing it for both. But just checking if we really needed. | 14:58 |
| *** aix has joined #openstack-keystone | 15:00 | |
| remote_morgan_ | Anything else that I anyone needs me to look at before next flight? | 15:00 |
| dolphm | remote_morgan_: WIP backport https://review.openstack.org/#/c/126314/ for henry's patch https://review.openstack.org/#/c/125228/ | 15:00 |
| dstanek | dolphm: does that DB patch work for you? i'm getting lots of DatabaseAlreadyControlledErrors | 15:01 |
| dolphm | dstanek: i haven't run it! let me try | 15:01 |
| dstanek | dolphm: does that DB patch work for you? i'm getting lots of DatabaseAlreadyControlledErrors | 15:02 |
| dstanek | haha ignore that | 15:02 |
| *** jistr has quit IRC | 15:02 | |
| remote_morgan_ | dstanek: had your work layered on top of it? | 15:02 |
| ayoung | remote_morgan_, I guess that means that we can still make the DB backend ephemeral. I didn't enable it by default. Has anyone else done so? | 15:02 |
| *** jistr has joined #openstack-keystone | 15:02 | |
| dstanek | remote_morgan_: nope, just did a 'git review -d' and reconfigured the DB settings | 15:03 |
| *** richm has quit IRC | 15:03 | |
| remote_morgan_ | Ayoung: I thought we did make it on by default for Juno | 15:03 |
| *** diegows has joined #openstack-keystone | 15:03 | |
| remote_morgan_ | Or did we just migrate it by default? | 15:03 |
| remote_morgan_ | dstanek: ah. | 15:04 |
| ayoung | cfg.BoolOpt('revoke_by_id', default=True, | 15:04 |
| dstanek | hmm...works in sqlite | 15:04 |
| ayoung | well would you look at that | 15:04 |
| remote_morgan_ | ayoung: ah right. | 15:04 |
| *** gokrokve_ has joined #openstack-keystone | 15:05 | |
| *** ajayaa has quit IRC | 15:05 | |
| ayoung | remote_morgan_, are we going to switch it now, post RC1? | 15:05 |
| dstanek | morganfainberg: this is very similar to the error i was asking zzzeek about - he though it was some assumption SQA made about sqlite | 15:05 |
| remote_morgan_ | ayoung: no let's not change it now. | 15:06 |
| ayoung | remote_morgan_, ok, lets switch it now for Kilo | 15:06 |
| ayoung | get the early breakage reports | 15:06 |
| remote_morgan_ | ayoung: I think we need middleware to consume events first. | 15:06 |
| ayoung | nope | 15:06 |
| remote_morgan_ | For he PKI case. | 15:06 |
| remote_morgan_ | Right? Revoke by id is the old "revocation " list | 15:07 |
| ayoung | remote_morgan_, feh | 15:07 |
| ayoung | yeah | 15:07 |
| ayoung | yeah, or we need to link PKI to revoke by id...yuk | 15:07 |
| ayoung | I really think I want to torch the whole concept of revocations | 15:08 |
| remote_morgan_ | Yeah. Which would likely break the contract (I'd like revoke by id to be audit ids, but I don't think we can) | 15:08 |
| ayoung | I think we need to move to 5 minute tokens and no revocations | 15:08 |
| *** gokrokve has quit IRC | 15:08 | |
| remote_morgan_ | We will have an authz session at the summit to discuss just that. Tokens, fixing them, etx | 15:08 |
| remote_morgan_ | Revocations as well | 15:08 |
| ayoung | otherwise it will be bandaid after bandaid | 15:08 |
| *** Tahmina has quit IRC | 15:09 | |
| remote_morgan_ | That one and the client one are pretty much guaranteed. The others aren't really set. (CI we'll do as pod / meetup day) | 15:10 |
| *** henrynash has joined #openstack-keystone | 15:10 | |
| ayoung | remote_morgan_, do the other services actually consume the service catalog that is in the Keystone token? | 15:11 |
| ayoung | Cuz, if they don't...I have some work to do | 15:11 |
| ayoung | well, me and lots of other people | 15:11 |
| remote_morgan_ | dolphm datanek: henrynash's fix looks good to me, but I can't test it till I'm setup once I land. | 15:11 |
| remote_morgan_ | ayoung: some of them, I think, use it (eg nova to cinder). But not 100% sure | 15:12 |
| dolphm | remote_morgan_: i'm testing it now, and running into the problem it's fixing. investigating now | 15:12 |
| dolphm | dstanek: i never got a db already controlled error though | 15:12 |
| ayoung | remote_morgan_, the endpoint part of constraints would get you your ID-only service catalog. | 15:12 |
| remote_morgan_ | ayoung: right. And if we can make the full catalog a separate data bit (not in the signed part of the token) it should ease up token size issues significantly (improvement for both uuid and PKI) | 15:13 |
| ayoung | ++ | 15:14 |
| dolphm | dstanek: this is my test run http://pasteraw.com/amj69ppx7k91tv1ege9dqq2u7txjjd3 | 15:14 |
| dolphm | henrynash: ^ | 15:16 |
| dolphm | henrynash: this is running with your patch against mysql | 15:16 |
| henrynash | dolphm: hmmm | 15:16 |
| remote_morgan_ | dstanek: prob need to also drop the migrate_version table. Why you're getting already controlled issues | 15:16 |
| remote_morgan_ | dolphm: henrynash ^^ | 15:17 |
| dstanek | remote_morgan_: it was a brand new database :-) | 15:17 |
| henrynash | remote_morgan: than is dropped in teardown | 15:17 |
| remote_morgan_ | dstanek: right if that table isn't dropped int he cleanup it'll still fail since we re_init the db | 15:17 |
| remote_morgan_ | henrynash: ah ok. | 15:18 |
| remote_morgan_ | dstanek: between the migrate tests | 15:18 |
| dstanek | remote_morgan_: but doens't that mean that the tests are broken? | 15:18 |
| remote_morgan_ | SQLite uses a new (uncontrolled) schema each test. | 15:18 |
| dstanek | it runs fine in sqlite - i'm having the issue with mysql | 15:19 |
| remote_morgan_ | And in MySQL we didn't migrate down to 0 when we collapsed the migrates. | 15:19 |
| dstanek | henrynash's patch that is... | 15:19 |
| remote_morgan_ | dstanek: right. SQLite always worked, since it had no state between tests. | 15:19 |
| dolphm | remote_morgan_: why would i not have dstanek's issue then? | 15:20 |
| remote_morgan_ | dolphm: looking at your paste. But about to take off so ... | 15:20 |
| remote_morgan_ | Back in an hour or so. | 15:20 |
| dolphm | henrynash: oh your patch is at least missing the region table | 15:21 |
| remote_morgan_ | Ok I think the solution here is turning off FK constraints before dropping and turning hem back on at the tests | 15:21 |
| remote_morgan_ | Gotta go | 15:21 |
| dolphm | remote_morgan_: ++ | 15:21 |
| *** david-lyle has quit IRC | 15:22 | |
| dstanek | dolphm: jas, i'll paste my output | 15:22 |
| *** david-lyle has joined #openstack-keystone | 15:22 | |
| henrynash | dolphm: region table is not part of the initial table set….(the downgrades should delete it)..and if not I drop it anywya in the first part of teardown | 15:22 |
| dolphm | henrynash: all tests pass for me if you just add 'region' before 'service' | 15:22 |
| dolphm | henrynash: http://pasteraw.com/dp5mai4tped4dix70x7ecybk2g1rykh | 15:23 |
| henrynash | dolphm: sorry, on another call at the moment, so not quite abelt o gve this my fill attention | 15:23 |
| dolphm | henrynash: ack | 15:23 |
| *** arunkant has quit IRC | 15:24 | |
| dolphm | dstanek: are you running test_sq_upgrade roughly the same way i iam? | 15:24 |
| dolphm | typotypo | 15:24 |
| dstanek | i'm using - tox -e py27 -- test_sql_upgrade | 15:24 |
| dstanek | dolphm: hmmm different errors now | 15:29 |
| dolphm | dstanek: more or less like mine? | 15:29 |
| dolphm | dstanek: and what changed? | 15:29 |
| dstanek | i'm getting the same errors you have - the relationships won't let the table be removed | 15:29 |
| dstanek | dolphm: no idea, i dropped the table and recreated and it no longer fails that way | 15:30 |
| dolphm | dstanek: the migrate table? | 15:30 |
| dolphm | dstanek: or you mean the whole db? | 15:30 |
| *** portante_ is now known as portante | 15:31 | |
| dstanek | dolphm: yeah, i mean the whole db | 15:31 |
| dolphm | dstanek: i just got a DatabaseAlreadyControlled :) using the same db i was using with nosetests | 15:31 |
| dstanek | i guess it would be a transient issue, but i've tried a dozen time and i can't get it anymore | 15:31 |
| dstanek | hmm...interesting | 15:31 |
| dstanek | what was the first error that made removing the tables fail? | 15:32 |
| dolphm | dstanek: keystone.tests.test_sql_upgrade.VersionTests.test_initial_with_extension_version_None failed with DBError: (IntegrityError) (1217, 'Cannot delete or update a parent row: a foreign key constraint fails') '\nDROP TABLE region' () | 15:33 |
| *** lufix has quit IRC | 15:33 | |
| *** thedodd has joined #openstack-keystone | 15:34 | |
| dolphm | dstanek: i don't understand the db already controlled thing, because between runs the db is empty | 15:34 |
| dolphm | dstanek: oooh, is that a multithreading thing, maybe? | 15:35 |
| dstanek | dolphm: in my case it failed to remove the tables so every test after that failed with a already controlled error | 15:35 |
| dstanek | dolphm: i have the env set to only run one process | 15:35 |
| *** lcheng has joined #openstack-keystone | 15:36 | |
| dolphm | if i set --concurrency=1 then the tests pass | 15:36 |
| dolphm | dstanek: ^ | 15:36 |
| *** sigmavirus24 has left #openstack-keystone | 15:38 | |
| *** cjellick has joined #openstack-keystone | 15:38 | |
| dstanek | dolphm: it still fails for me | 15:40 |
| *** gokrokve_ has quit IRC | 15:40 | |
| *** cjellick has quit IRC | 15:42 | |
| *** lcheng has quit IRC | 15:43 | |
| *** virmitio has joined #openstack-keystone | 15:44 | |
| dstanek | dolphm: the only way i get it to work it to replace the table dropping logic | 15:46 |
| henrynash | dstanek: with the oslo-based cleanup? | 15:50 |
| dstanek | henrynash: yes | 15:50 |
| dstanek | henrynash, dolphm: do you guys still get errors or is it just me? | 15:50 |
| *** lcheng has joined #openstack-keystone | 15:51 | |
| *** lcheng has quit IRC | 15:52 | |
| *** cjellick has joined #openstack-keystone | 15:55 | |
| *** cjellick_ has joined #openstack-keystone | 15:57 | |
| *** lcheng_ has joined #openstack-keystone | 15:58 | |
| henrynash | dstanek: I’m fine with switching this to the “belt and braces” approach that oslo used.... | 15:58 |
| henrynash | dstanek: it shouldn’t be the job of teardown to spot, for instance, that we can’t remove a table if some downgrade method has left an FK hanging around | 15:59 |
| henrynash | dstanek: we just want to blow it out of the water | 15:59 |
| *** cjellick has quit IRC | 15:59 | |
| *** cjellick has joined #openstack-keystone | 16:00 | |
| *** cjellick_ has quit IRC | 16:00 | |
| henrynash | dstanek: do have that implemented locally? if so, do you want to update the patch with it, or should I ? | 16:00 |
| dstanek | henrynash: yeah, i have it applied - jas i'll push it | 16:02 |
| *** jistr has quit IRC | 16:02 | |
| henrynash | dtsaneK: cool! And I assume you dumped the INITIAL_DROP_TABLE_SEQUENCE or whatever I called it? | 16:02 |
| *** cjellick has quit IRC | 16:04 | |
| *** sigmavirus24 has joined #openstack-keystone | 16:04 | |
| *** cjellick has joined #openstack-keystone | 16:05 | |
| dstanek | henrynash: yes, i'm running the tests now | 16:06 |
| henrynash | dstanek: I’ll give it a whirl as well once you post | 16:06 |
| *** _cjones_ has joined #openstack-keystone | 16:07 | |
| henrynash | dstanek: as an aside, by means of light relief, the spec for deprecation in Kilo https://review.openstack.org/#/c/123122/ is probably ready to +A….I didn’t do it ‘cause otherwise it would be an all IBM approval | 16:08 |
| henrynash | dstanek: we can than at least start pulling the ones that are ready, out | 16:09 |
| *** jaosorior has quit IRC | 16:13 | |
| *** lcheng_ has quit IRC | 16:14 | |
| *** lhcheng has joined #openstack-keystone | 16:14 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Ensure sql upgrade tests can run with non-sqlite databases. https://review.openstack.org/125228 | 16:15 |
| dstanek | henrynash: ^ | 16:15 |
| dstanek | henrynash: ugg...i didn't change the commit message to match reality | 16:16 |
| henrynash | dstaneK; great, I’ll check it out | 16:16 |
| dolphm | dstanek: have an alternative patch? | 16:21 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Remove deprecated items from the Kilo release https://review.openstack.org/123122 | 16:21 |
| dstanek | dolphm: no, i just updated it to use oslo's approach | 16:22 |
| dstanek | now it always works for me on mysql and sqlite | 16:22 |
| dolphm | dstanek: alright, i'll test it | 16:24 |
| *** wwriverrat has joined #openstack-keystone | 16:26 | |
| *** nellysmitt has quit IRC | 16:26 | |
| dolphm | dstanek: awesome, passes with nosetests & tox, with and without concurrency, on mysql | 16:27 |
| *** nellysmitt has joined #openstack-keystone | 16:28 | |
| dstanek | dolphm: with concurrency is probably a fluke - i have a few other patches where i'm working on fixing all of that | 16:29 |
| dolphm | dstanek: it was pretty consistent | 16:29 |
| *** Guest84187 is now known as mfisch | 16:30 | |
| henrynash | dtsanek: I’ve tested it with sqlite, mysql and postgresql and they all seem to work (mind you, they did too with my version :-) ) | 16:30 |
| *** gokrokve has joined #openstack-keystone | 16:30 | |
| *** mfisch is now known as Guest9962 | 16:30 | |
| henrynash | dtsanek: for me, at least - but I prefer your version | 16:31 |
| dstanek | dolphm: henrynash: i have few things baking in my checkouts, but once done i just want to update that commit message | 16:31 |
| * dolphm is thinking about setting up a CI job for mysql & postgresql | 16:31 | |
| henrynash | dolphm: ++ | 16:31 |
| henrynash | dolphm: we’ve clearly not been testing the migrations for a while, since I found so many errors that meant the test_sql_upgrade could not have been run with them since | 16:32 |
| henrynash | dolphm: that couldn’t have passed when we release IceHouse | 16:33 |
| henrynash | dolphm: let alone now | 16:33 |
| dolphm | dstanek: i wonder if it would be easier to do that on my own, or to coerce jenkins to run limited tox jobs against mysql & postgres? | 16:34 |
| dstanek | dolphm: that would be great - i have a few fixes that will make the tests run on all non-sqlite databases | 16:34 |
| *** wwriverrat has left #openstack-keystone | 16:34 | |
| dstanek | dolphm: i'm hoping to get them all working on mysql/postgres/etc soon | 16:34 |
| dstanek | dolphm: i've been doing some experimenting and i've started to write a few specs about this later today | 16:35 |
| *** marcoemorais has joined #openstack-keystone | 16:36 | |
| *** _cjones_ has quit IRC | 16:36 | |
| *** _cjones_ has joined #openstack-keystone | 16:36 | |
| henrynash | dolphm: do you want to do the honors for: https://review.openstack.org/#/c/125610/, the spec has now been approved | 16:37 |
| henrynash | dolphm: I want to hear the sounds of those kvs bits dropping on the floor…. | 16:37 |
| dolphm | henrynash: done! | 16:38 |
| henrynash | dstanek: I think a spec of dos and don’t would be great….there are too many ways of doing things with SQA, that it’s esay to get yourself into trouble | 16:38 |
| henrynash | dolphm: crash, tinkle, crunch…. | 16:39 |
| *** _cjones_ has quit IRC | 16:41 | |
| *** arunkant has joined #openstack-keystone | 16:42 | |
| marekd | stevemar: thanks for +2 on osc-mapping | 16:43 |
| stevemar | marekd, np, thanks for running it :P | 16:43 |
| marekd | stevemar: LOL. | 16:44 |
| marekd | :-) | 16:44 |
| marekd | stevemar: anyway, we are *that* close to be able to configure federation with osc only | 16:44 |
| stevemar | marekd, 1 sec | 16:44 |
| stevemar | marekd, found 1 error i think | 16:44 |
| dstanek | dolphm: question on catalog substitution when yo have a sec | 16:44 |
| *** rwsu has joined #openstack-keystone | 16:44 | |
| marekd | stevemar: namely? | 16:44 |
| stevemar | marekd, commented | 16:45 |
| marekd | stevemar: ++++++++++ | 16:46 |
| marekd | stevemar: gonna fix it in a sec | 16:46 |
| marekd | anyways | 16:46 |
| marekd | i was thinking - do you think enforcing files with rules is a good idea? | 16:46 |
| *** afazekas has quit IRC | 16:48 | |
| stevemar | marekd, i think that's fine | 16:48 |
| stevemar | we do that with policy | 16:48 |
| marekd | in osc? | 16:48 |
| *** aix has quit IRC | 16:49 | |
| marekd | stevemar: uploaded new ver. | 16:49 |
| nkinder | marekd: so there are proposed changes to use osc for federation protocol and mapping calls? | 16:51 |
| marekd | nkinder: yes. | 16:51 |
| marekd | nkinder: 1 sec | 16:51 |
| nkinder | marekd: I'd be happy to review and test those | 16:51 |
| marekd | nkinder: https://review.openstack.org/#/c/86912/16 and https://review.openstack.org/#/c/125627/ | 16:52 |
| *** zzzeek has joined #openstack-keystone | 16:52 | |
| *** jorge_munoz has joined #openstack-keystone | 16:52 | |
| nkinder | marekd: thanks! | 16:52 |
| *** gokrokve has quit IRC | 16:52 | |
| marekd | nkinder: you welcome! :-) | 16:52 |
| *** gokrokve has joined #openstack-keystone | 16:52 | |
| nkinder | marekd: what's going on around federation support in the CLI? Is there an auth plug-in that uses ECP in the works? | 16:54 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:55 | |
| marekd | nkinder: well, to CRUD idps/protocols/mappings you simply need admin privileges. To authenticate and get unscoped federated token (and later scope it) there are plugins in keystoneclient: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py | 16:55 |
| nkinder | marekd: yes, I meant actually using SAML federation to get a token | 16:56 |
| marekd | nkinder: so, ECP in general and saml2 plugin from keystoneclient. | 16:56 |
| nkinder | marekd: I didn't realize that was already there | 16:56 |
| *** _cjones_ has joined #openstack-keystone | 16:57 | |
| nkinder | marekd: so as long as the apache module and IdP support ECP, we should be good from the CLI side? | 16:57 |
| marekd | nkinder: correct | 16:57 |
| nkinder | marekd: ok, great. I will have to see if mod_auth_mellon and Ipsilon have ECP support | 16:58 |
| nkinder | They both use lasso, and it appears to support ECP | 16:58 |
| nkinder | I haven't really looked into it any further than that though | 16:58 |
| *** _cjones_ has quit IRC | 16:58 | |
| marekd | unfortunately I don't know if mod_mellon has ECP built in. | 16:59 |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| nkinder | marekd: simo might know. I'll check with him. | 16:59 |
| *** _cjones_ has quit IRC | 16:59 | |
| marekd | nkinder: ah, right | 16:59 |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| dolphm | dstanek: o/ | 17:00 |
| stevemar | nkinder, i think most saml idp plugins has ecp support | 17:00 |
| marekd | stevemar: ++ | 17:01 |
| dolphm | dstanek: ooh, we didn't drop that for juno, did we? | 17:01 |
| *** marcoemorais has quit IRC | 17:01 | |
| dolphm | dstanek: looking to drop it for kilo? | 17:01 |
| marekd | nkinder: i think this is becoming kind of standard, just like websso | 17:01 |
| dstanek | dolphm: yes, in kilo - i have a patch somewhere that just removed the abiltity completely | 17:01 |
| *** bknudson has joined #openstack-keystone | 17:01 | |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| *** marcoemorais has quit IRC | 17:02 | |
| dstanek | dolphm: do we need to deprecate that functionality or can we just say that they we no longer do any substitution on urls? | 17:02 |
| remote_morgan_ | Ok on the ground now... | 17:02 |
| remote_morgan_ | dstanek: didn't we deprecate it already? | 17:02 |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| dstanek | remote_morgan_: i don't think so - pretty sure we just added the whitelisting | 17:03 |
| remote_morgan_ | Ah | 17:03 |
| dstanek | i could create a deprecation patch for rc if we want that in there | 17:03 |
| dstanek | it would be very noisey because of how may times we generate the catalog | 17:04 |
| remote_morgan_ | Well, it *should* only fire once per instantistion right? | 17:05 |
| remote_morgan_ | We could formally deprecate in K if it's a hassle. | 17:06 |
| *** _cjones_ has quit IRC | 17:06 | |
| dstanek | remote_morgan_: i can probably do once per catalog request, which could be a lot still | 17:06 |
| *** _cjones_ has joined #openstack-keystone | 17:06 | |
| dstanek | remote_morgan_: i would proabably implement this by cecking if the resulting url and endpoint['url'] are different here http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends/sql.py#n291 | 17:09 |
| *** _cjones_ has quit IRC | 17:09 | |
| dstanek | remote_morgan_: if any are different at all in the 'for' loop i would fire off a deprecation warning | 17:09 |
| *** _cjones_ has joined #openstack-keystone | 17:09 | |
| remote_morgan_ | Let's formally deprecate in K then vs squeezing into RC unless you think we *really* need this gone. | 17:10 |
| remote_morgan_ | That implementation sounds sane. | 17:10 |
| dstanek | remote_morgan_: now that the hole is closed it's just some code to maintain - deprecate in K and remove in +1? | 17:11 |
| dolphm | dstanek: we need to keep doing tenant_id and user_id for now | 17:11 |
| dolphm | dstanek: for as long as swift depends on it | 17:11 |
| dolphm | dstanek: and whatever other api's have tenant_id in their endpoints | 17:11 |
| remote_morgan_ | dstanek: sounds good. | 17:12 |
| dstanek | dolphm: hmmm...ok, that'll make it a bit messy, but doable | 17:12 |
| dolphm | dstanek: yeah -- can we only raise a deprecation when there's something besides tenant_id / user_id in an endpoint? | 17:12 |
| remote_morgan_ | dolphm: ah. Good point. | 17:12 |
| dolphm | dstanek: not sure that should go into rc at this point though | 17:12 |
| dstanek | dolphm: i don't know how i would do that exactly, but i'm sure i can come up with something that is somewhat performant | 17:13 |
| dolphm | dstanek: maybe try a hardcoded whitelist of tenant_id / user_id, catch a keyerror, and then fallback on the whitelist with a deprecation warning? | 17:14 |
| dstanek | dolphm: similar to what i was thinking, but i'm going to try not to have a deprecation warning for each url | 17:15 |
| dstanek | for a catalog that does this in every url it would be super noisy | 17:15 |
| dolphm | dstanek: ah ++ | 17:15 |
| *** lufix has joined #openstack-keystone | 17:16 | |
| dstanek | i think i'm going to call format_url twice (or something similar) | 17:16 |
| remote_morgan_ | bknudson: you going to continue as he oslo liaison for Keystone? / want to? | 17:19 |
| bknudson | morganfainberg: I can continue with it. | 17:20 |
| bknudson | morganfainberg: shouldn't be as much to do. | 17:21 |
| remote_morgan_ | bknudson: if you're not opposed to continuing, IMO you've done a great job and would def appreciate you continuing. | 17:22 |
| remote_morgan_ | Agreed shouldn't be as much as Juno | 17:22 |
| ayoung | dolphm, is there backport potential on PKIZ whitespace patch? https://review.openstack.org/#/c/120043 | 17:22 |
| dolphm | ayoung: it's a performance tune, so i don't think so | 17:24 |
| ayoung | OK | 17:24 |
| dolphm | ayoung: why should it be in juno? | 17:24 |
| ayoung | dolphm, just the whole "tokens are too big" thing | 17:24 |
| ayoung | I guess its too little of a benefit to backport though | 17:24 |
| ayoung | remote_morgan_, BTW, formal congrats on select for PTL | 17:25 |
| *** richm has joined #openstack-keystone | 17:25 | |
| remote_morgan_ | ayoung: thnx | 17:25 |
| * ayoung still catching up on email | 17:25 | |
| remote_morgan_ | Hehe | 17:25 |
| dolphm | ayoung: if it was major benefit with no risk, i might argue for it, but it's quite late, and there could be a funky json parser out there or whatever | 17:26 |
| ayoung | ++ | 17:26 |
| remote_morgan_ | dolphm: probably some Java implementation. | 17:27 |
| ayoung | I wonder why SAML doesn't have the size problem? It must be a full body post of the SAML assertion | 17:27 |
| *** nellysmitt has quit IRC | 17:27 | |
| remote_morgan_ | Yeah SAML doesn't go in a header. | 17:28 |
| marekd | remote_morgan_: ++ | 17:28 |
| marekd | remote_morgan_: SAML, at least ECP is wrapped with SOAP | 17:29 |
| remote_morgan_ | Ahh. | 17:29 |
| remote_morgan_ | dolphm: we had a dedicated "ops" keystone session outside of the ops track in ATL right? | 17:30 |
| ayoung | SAML sucks, but Keystpone sucks...differently? I was going to say more, but I'm not sure that is true | 17:31 |
| marekd | ayoung: SAML sucks. | 17:31 |
| ayoung | everything sucks, just in different ways | 17:32 |
| *** marekd is now known as marekd|away | 17:32 | |
| stevemar | ayoung, that's some philosophical stuff right there | 17:33 |
| *** harlowja has joined #openstack-keystone | 17:34 | |
| *** mewald has joined #openstack-keystone | 17:35 | |
| *** richm has quit IRC | 17:37 | |
| mewald | when http://docs.openstack.org/developer/keystone/architecture.html talks about the "policy service", does this refer to the local policy.json file that dictates permissions within this keystone instance or something else? | 17:37 |
| *** marcoemorais has quit IRC | 17:37 | |
| *** marcoemorais has joined #openstack-keystone | 17:38 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Enable tests on non-SQLite database https://review.openstack.org/126370 | 17:40 |
| *** diegows has quit IRC | 17:42 | |
| openstackgerrit | A change was merged to openstack/keystone: Remove identity and assignment kvs backends https://review.openstack.org/125610 | 17:42 |
| mewald | what does KVS stand for? | 17:44 |
| dstanek | mewald: key value store | 17:45 |
| mewald | stevemar: thx, but cannot SQL be a KVS, too, then? | 17:46 |
| mewald | its a very generic term | 17:46 |
| mewald | the document lists KVS next to SQL as a backend service - that's confusing me a bit | 17:46 |
| dstanek | mewald: we mean it more like a dictionary - actually our specific implementation | 17:46 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Enable tests on non-SQLite database https://review.openstack.org/126370 | 17:47 |
| *** amakarov is now known as amakarov_away | 17:47 | |
| mewald | ahh so KVS is more like an interface than an actual backend and - given I wanted to - I could implement this interface with a SQL backend (which would be of no point at all as SQL backend already exists) - correct? | 17:47 |
| dstanek | mewald: no it's a backend - if you used it your data would not be in a SQL database | 17:48 |
| *** amcrn has joined #openstack-keystone | 17:48 | |
| mewald | ahh damn I read "your" when you wrote "our" | 17:49 |
| mewald | got it - th | 17:49 |
| mewald | +x | 17:49 |
| dstanek | mewald: beside the token backend the rest of them are really for tests | 17:49 |
| dstanek | there is a review to delete most of the KVS backends this cycle | 17:49 |
| mewald | token backend? I thought there was a token service which could use the KVS backend - confusing is coming back riiiihgght NOW :D | 17:51 |
| *** david-lyle has quit IRC | 17:51 | |
| dstanek | mewald: keystone is divided into subsystems like identity, catalog, token, etc. | 17:52 |
| dstanek | mewald: each of those can be configured to use different backends | 17:52 |
| mewald | yeah | 17:52 |
| dstanek | mewald: for example, you could use ldap for identity and sql for everything else | 17:53 |
| mewald | can every subsystem use any of the backends? | 17:53 |
| dstanek | no, each subsystem has a different interface for the backend | 17:54 |
| *** Guest9962 is now known as mfisch | 17:54 | |
| *** lhcheng has quit IRC | 17:54 | |
| *** lhcheng has joined #openstack-keystone | 17:55 | |
| *** mfisch is now known as Guest33821 | 17:55 | |
| dstanek | mewald: interface definition for catalogs http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/core.py#n216 | 17:55 |
| dstanek | mewald: backend implementations http://git.openstack.org/cgit/openstack/keystone/tree/keystone/catalog/backends | 17:55 |
| openstackgerrit | Haneef Ali proposed a change to openstack/keystone: Migrate keystone to use v3 policy file https://review.openstack.org/126217 | 17:56 |
| mewald | dstanek: I see, now I know how to find out the rest :) Would you mind taking care of my first question from before what KVS stands for? | 17:57 |
| *** diegows has joined #openstack-keystone | 17:59 | |
| dstanek | mewald: jas...let me find it | 17:59 |
| dstanek | mewald: me guess it this http://developer.openstack.org/api-ref-identity-v3.html#policies-v3 | 17:59 |
| mewald | yeah this is what I am talking about | 18:00 |
| mewald | doesnt sound like local policy.json stuff | 18:00 |
| *** marcoemorais has quit IRC | 18:03 | |
| *** marcoemorais has joined #openstack-keystone | 18:03 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:04 | |
| *** marcoemorais has quit IRC | 18:04 | |
| *** marcoemorais has joined #openstack-keystone | 18:04 | |
| mewald | dstanek: this reads more like a central repository for all policy.json files throughout the environment | 18:05 |
| mewald | doest that cut it? | 18:05 |
| *** marcoemorais has quit IRC | 18:05 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| *** dguitarbite has quit IRC | 18:07 | |
| *** amakarov_away has quit IRC | 18:10 | |
| *** amakarov_away has joined #openstack-keystone | 18:10 | |
| *** ayoung has quit IRC | 18:11 | |
| dstanek | mewald: i think all of that predates me by a lot - i'm not sure what the intent was | 18:14 |
| mewald | you think we're going to see this in the next release? | 18:15 |
| *** marcoemorais has quit IRC | 18:17 | |
| dstanek | see the policy stuff i linked to? | 18:19 |
| *** ayoung has joined #openstack-keystone | 18:20 | |
| *** amcrn has quit IRC | 18:20 | |
| mewald | http://developer.openstack.org/api-ref-identity-v3.html ? yeah | 18:20 |
| dolphm | remote_morgan_: yes, regarding ops session | 18:20 |
| dstanek | mewald: that should already be release | 18:20 |
| dolphm | remote_morgan_: ours was apparently one of the few productive out-of-ops-track ops sessions though | 18:20 |
| dstanek | dolphm: mewald brought up a good question...what is keystone.policy used for? | 18:21 |
| remote_morgan_ | dolphm: I'll plan to have another one then. I liked it. | 18:21 |
| dolphm | dstanek: as a potential/future HTTP backend to oslo.policy | 18:21 |
| dstanek | dolphm: so it can't be used right now? | 18:22 |
| dolphm | dstanek: no, there's no oslo.policy driver to pull policy blobs from keystone | 18:22 |
| dolphm | dstanek: instead of from local disk (service's policy.json) | 18:22 |
| dstanek | dolphm: since it's in the API doc i would have thought it was usable | 18:22 |
| dolphm | dstanek: the API on keystone's side is certainly useable | 18:23 |
| dolphm | dstanek: it's just nothing is utilizing it | 18:23 |
| dolphm | remote_morgan_: if you're up for a code review, this is dstanek's oslo-based revision of henrynash's patch https://review.openstack.org/#/c/125228/ | 18:24 |
| *** arborism has joined #openstack-keystone | 18:24 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Enable tests on non-SQLite databases https://review.openstack.org/126370 | 18:26 |
| *** lufix has quit IRC | 18:28 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone-specs: Enable tests on non-SQLite databases https://review.openstack.org/126370 | 18:28 |
| *** mikedillion has quit IRC | 18:29 | |
| *** mikedillion has joined #openstack-keystone | 18:30 | |
| *** marcoemorais has joined #openstack-keystone | 18:33 | |
| mewald | I just had a look at the backend-folders in the keystone source code and found that PAM is not listed anywhere. But several documents state is as a backend to the identity subsystem - what's the truth? | 18:36 |
| *** gyee has joined #openstack-keystone | 18:37 | |
| *** victsou is now known as vsilva | 18:42 | |
| *** david-lyle has joined #openstack-keystone | 18:46 | |
| dstanek | mewald: PAM is gone - it was removed a while ago | 18:46 |
| mewald | aha - where would I be able to track that kind of stuff? | 18:46 |
| dstanek | mewald: where did you see a reference to it? | 18:47 |
| *** david-lyle_ has joined #openstack-keystone | 18:47 | |
| remote_morgan_ | dolphm: will look at it post lunch. | 18:49 |
| mewald | very good question .. can't find it adhoc | 18:49 |
| *** david-lyle has quit IRC | 18:50 | |
| dstanek | mewald: the functionality was removed in March, but the last bits of code docs where updated to remove it only a few weeks ago | 18:51 |
| mewald | ah probably that's why | 18:51 |
| mewald | again: where do you check this kind of thing? (X was removed Y weeks ago) | 18:51 |
| dstanek | i got that from the git history, but there was probably a bug or blueprint | 18:52 |
| dstanek | mewald: or not - http://git.openstack.org/cgit/openstack/keystone/commit/?id=6bd2307930256409cd7257144b3a7a2ac3bfe596 | 18:53 |
| mewald | ok thx | 18:56 |
| mewald | think I got most of what makes Keystone now :) | 18:56 |
| *** _cjones_ has quit IRC | 19:04 | |
| *** _cjones_ has joined #openstack-keystone | 19:05 | |
| *** marcoemorais has quit IRC | 19:05 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:06 | |
| *** marcoemorais has quit IRC | 19:07 | |
| dstanek | mewald: or not - http://git.openstack.org/cgit/openstack/keystone/commit/?id=6bd2307930256409cd7257144b3a7a2ac3bfe596 | 19:07 |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| dstanek | mewald: you're welcome - ignore that last link | 19:07 |
| mewald | done :) | 19:08 |
| *** _cjones_ has quit IRC | 19:09 | |
| henrynash | remote_morgan: are you au fait with the revoke by ID token mechanism? | 19:15 |
| *** gabriel-bezerra has quit IRC | 19:15 | |
| henrynash | (just getting ready for Paris….) | 19:15 |
| *** lufix has joined #openstack-keystone | 19:16 | |
| mewald | which are the supported databases with Keystone? I have learned it uses the ORM SQLAlchemy. Does Keystone generally support all the databases SQLAlchemy supports? | 19:17 |
| henrynash | mewald: yes | 19:18 |
| mewald | cool | 19:19 |
| *** andreaf has joined #openstack-keystone | 19:19 | |
| henrynash | mewald: but the onse we test with are MySQL, DB2, Postgresql | 19:19 |
| henrynash | mewald: I don’t know of anyone trying anything else | 19:19 |
| mewald | ok :) | 19:19 |
| *** gabriel-bezerra has joined #openstack-keystone | 19:22 | |
| *** lufix has quit IRC | 19:26 | |
| ayoung | nkinder, what is the right way to use ldapmodify to add a new memberPrincipal value? | 19:27 |
| ayoung | I have two machines already set for s4u2proxy dlegation, but I need to add a third | 19:27 |
| *** andreaf has quit IRC | 19:27 | |
| ayoung | mewald, you want the new SSSD goodness! | 19:27 |
| nkinder | ayoung: do you have an example of the entry you want to modify? | 19:28 |
| ayoung | nkinder, yep | 19:28 |
| mewald | henrynash: how can you guys test with DB2 while SQLAlchemy doesnt list it at all? | 19:28 |
| ayoung | http://adam.younglogic.com/2014/05/s4u2proxy-horizon/ nkinder the ldif at the bottom | 19:28 |
| ayoung | so | 19:28 |
| henrynash | mewald: we have magic pixie-dust | 19:28 |
| mewald | ayoung: what's SSSD? | 19:28 |
| ayoung | mewald, System Services Security Daemon | 19:28 |
| henrynash | mewald: …and also IBM provides a driver to make it work :-) | 19:29 |
| mewald | sorry my non-native english stops here :D can't follow neither of you | 19:29 |
| ayoung | mewald, http://adam.younglogic.com/2014/05/keystone-federation-via-mod_lookup_identity/ | 19:29 |
| mewald | ayoung: already found this but thx :) | 19:29 |
| ayoung | ++ | 19:29 |
| ayoung | nkinder, right now my ldif is | 19:29 |
| ayoung | changetype: add | 19:30 |
| ayoung | would it just be modify? | 19:30 |
| nkinder | ayoung: http://paste.openstack.org/show/119116/ | 19:30 |
| mewald | henrynash: so IBM provides a driver that has to be plugged into SQLAlchemy? | 19:30 |
| nkinder | it's still a modify operation, not an add, so changetype is "modify" | 19:31 |
| henrynash | mewald: yes, see “external Dialects” in http://docs.sqlalchemy.org/en/rel_0_9/dialects/ | 19:32 |
| mewald | ahh nice | 19:32 |
| ayoung | nkinder, I'm so steeeeenkin close on the Kerberos plugin.... | 19:32 |
| nkinder | ayoung: let me know when there's a new version to try | 19:32 |
| ayoung | nkinder, I;m talking about Horizon | 19:33 |
| nkinder | ayoung: ah, cool | 19:33 |
| ayoung | I have not hacked on the RPM yet | 19:33 |
| nkinder | ayoung: ok, I can't get back to that until tomorrow at the earliest myself | 19:33 |
| ayoung | nkinder, I need to go back through the #openstakc-keystone logs and find out who I was talking to...the debian mainter for the Keystone packages was the one that said they used the env var approach | 19:33 |
| * ayoung has no medium term memory for names | 19:34 | |
| ayoung | nkinder, but I suspect I missed one of the steps that Debian uses when dealing with PBR | 19:34 |
| *** _cjones_ has joined #openstack-keystone | 19:35 | |
| *** nellysmitt has joined #openstack-keystone | 19:40 | |
| *** marcoemorais has quit IRC | 19:41 | |
| ayoung | zigo, hey, when you have a moment: the RPM I built using PBR_VERSION still kciks off a the 'sdist tarball' message at run time...what did I forget or do wrong? Are you building off an sdist tarball? | 19:41 |
| ayoung | zigo, I thought you were building out of git... | 19:41 |
| *** andreaf has joined #openstack-keystone | 19:41 | |
| ayoung | nkinder, discussion re packaging was here: http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2014-09-29.log grep for zigo for the start of it | 19:42 |
| henrynash | ayoung: do you know much about the revoke_by_id config setting in token? | 19:43 |
| ayoung | henrynash, nope never heard of it. Let me see who wrote it....git blame...oh, I did. Yeah, I know about it | 19:43 |
| henrynash | ayoung: :-) | 19:43 |
| ayoung | henrynash, it is the way of saying "do what we've always done" | 19:43 |
| henrynash | ayoung: if it is set to True | 19:43 |
| ayoung | ie, revoke by the token id | 19:44 |
| ayoung | yep | 19:44 |
| ayoung | and we leave it as true thus far | 19:44 |
| henrynash | ayoung: so the comment in the config imples that if the revoke backend is not KVS we should set it to flase | 19:44 |
| henrynash | false, even | 19:44 |
| ayoung | should -> could | 19:45 |
| ayoung | but the middleware is not able to use it yet | 19:45 |
| ayoung | that patch died in subcommittee | 19:45 |
| henrynash | ayoung: Ok, so since I am just deprecating the revoke kvs backend…I’ll reword the comment for revoke_by_id | 19:45 |
| ayoung | https://review.openstack.org/#/c/81166/ | 19:46 |
| ayoung | henrynash, ^^ probably needs to be refreshed, as I suspect that some of the changes in keystone server are not yet reflected there | 19:46 |
| henrynash | ayoung: ok, thx | 19:46 |
| ayoung | revoke by ID in KVS...ah, the non-persisted version? | 19:47 |
| henrynash | ayoung: I’m not deprecateing the token kvs backend…. | 19:50 |
| henrynash | ayoung: only the revoke one | 19:50 |
| ayoung | henrynash why? | 19:50 |
| henrynash | ayoung: I think the token kvs backend is too valuable | 19:50 |
| ayoung | henrynash, I think you are confusing things | 19:51 |
| henrynash | ayoung: wouldn;t be the first time | 19:51 |
| ayoung | the KVS backend there is for all KVS backends, to include the persisted ones | 19:51 |
| henrynash | ayoung: when you say “the KVS backend”, you mean token.backends.kvs yes? | 19:52 |
| ayoung | _KVS_BACKEND = 'openstack.kvs.Memory' is not a good option | 19:52 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/revoke/backends/kvs.py | 19:52 |
| ayoung | someone deprecated it... | 19:52 |
| ayoung | Not I, said the cat | 19:52 |
| ayoung | henrynash, I think it might have gotten tarred with the "stop unit testing against KVS" brush | 19:53 |
| henrynash | ayoung: well, I did….at the request I think of morgan (taking his name in vain) | 19:53 |
| morganfainberg | hah | 19:53 |
| henrynash | ayoung: we can, of course, not deprecate it….I suspect the thought was sql was OK for revoke | 19:54 |
| mewald | is there any site that explains keystone trusts properly? I found this: https://wiki.openstack.org/wiki/Keystone/Trusts but for someone who knows nothing about it, it's completely useless | 19:54 |
| ayoung | henrynash, um, lets not | 19:54 |
| ayoung | I mean, I want to throw out the entire concept of revocations, but that is a different conversation | 19:54 |
| henrynash | OK, suggest you raise an update to: https://review.openstack.org/#/c/123122/ | 19:55 |
| ayoung | henrynash, does this mean we are not going to have any KVS backends at all? That will make some people sad | 19:55 |
| morganfainberg | dolphm, dstanek, henrynash, theSQL fix is lloking good | 19:55 |
| dolphm | morganfainberg: woot | 19:55 |
| dolphm | morganfainberg: i couldn't fault it | 19:56 |
| morganfainberg | dolphm, +3 | 19:56 |
| *** jorge_munoz has quit IRC | 19:56 | |
| dolphm | morganfainberg: danke! | 19:56 |
| henrynash | ayoung: so tokens, catalog I think survive | 19:56 |
| henrynash | dolphm: yep, it looks good | 19:57 |
| ayoung | henrynash, leave KVS for the time being | 19:57 |
| dolphm | morganfainberg: unblocked backport https://review.openstack.org/#/c/126314/ henrynash dstanek | 19:57 |
| *** jorge_munoz has joined #openstack-keystone | 19:57 | |
| henrynash | ayoung: OK….I’ll leave it for now… | 19:57 |
| ayoung | henrynash, until I have a clear view of what we are doing with revocation events, I don't know if I can get behind removing the KVS backend. It might be the right backend for someone | 19:58 |
| morganfainberg | dolphm, nice | 19:58 |
| henrynash | ayoung: ok | 19:58 |
| ayoung | henrynash, I really want to go to 5 minute tokens with no revocations | 19:58 |
| ayoung | really really | 19:58 |
| henrynash | ayoung: understand why | 19:58 |
| henrynash | ayoung: I do really | 19:58 |
| ayoung | in which case this whole extension goes away | 19:58 |
| morganfainberg | dolphm, ok +2ing that one as well (backport) | 19:59 |
| ayoung | but if we are not, and someone is using a memcached backend for tokens, and have worked to replicate it, then the revocation events maybe should piggyback on that work | 19:59 |
| *** mewald has left #openstack-keystone | 20:02 | |
| *** marcoemorais has joined #openstack-keystone | 20:05 | |
| *** Kui has joined #openstack-keystone | 20:07 | |
| *** dguitarbite has joined #openstack-keystone | 20:08 | |
| *** lhcheng has quit IRC | 20:08 | |
| *** lhcheng has joined #openstack-keystone | 20:08 | |
| *** sigmavirus24 has left #openstack-keystone | 20:11 | |
| *** _cjones_ has quit IRC | 20:12 | |
| *** _cjones_ has joined #openstack-keystone | 20:12 | |
| raildo | henrynash, ping | 20:17 |
| *** gabriel-bezerra has quit IRC | 20:22 | |
| *** virmitio has quit IRC | 20:25 | |
| rm_work | Hey guys, I have some questions about python-keystoneclient and sessions, regarding using Trusts and Composite auth (scanning through http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html now and it is not clear to me immediately how I would utilize a Trust this way) | 20:31 |
| dolphm | ayoung: morganfainberg: ^ | 20:33 |
| ayoung | rm_work, what are you trying to do? | 20:33 |
| rm_work | ayoung: do you remember the discussions I've had re: Neutron - > Barbican via Trusts and Composite Token auth? | 20:33 |
| rm_work | for reference: http://imgur.com/a/4u6Oz | 20:34 |
| dolphm | (when do mr & mrs jamielennox return?) | 20:34 |
| *** nellysmitt has quit IRC | 20:35 | |
| rm_work | I'm now at a point where I think we have the logistics nailed down -- so I was going to actually implement the basic workflow, but I need to get the Trust Token and then somehow send it through as an auth_plugin to the Barbican Client | 20:35 |
| rm_work | the Keystone session stuff looks like it all requires a user/pass for auth | 20:35 |
| *** gabriel-bezerra has joined #openstack-keystone | 20:36 | |
| ayoung | rm_work, so when the user first calls LBaaS, you need to establish the trust there and then | 20:36 |
| rm_work | obviously the user/pass I have won't actually work directly for communication with Barbican, because that'll just lead to the generation of our service user's token | 20:36 |
| rm_work | ayoung: we have decided to force the user to establish the Trust beforehand | 20:36 |
| rm_work | yes | 20:36 |
| ayoung | rm_work, OK, so the user is required to pass the trustid in the requst | 20:36 |
| rm_work | err | 20:37 |
| rm_work | yes | 20:37 |
| rm_work | they give us the TrustID, so we have that stored in our DB | 20:37 |
| * ayoung reads a little closer | 20:37 | |
| ayoung | rm_work, OK, so you want to know how to execute the trust? | 20:37 |
| rm_work | err well | 20:38 |
| rm_work | I know how to execute the trust using the keystone client | 20:38 |
| ayoung | ok | 20:38 |
| rm_work | but that gives me a Trust Token | 20:38 |
| ayoung | for the composite auth, you would pass both tokens | 20:38 |
| rm_work | right, and I know how I would do that if I were just using curl / etc | 20:38 |
| rm_work | but I am now using python-barbicanclient | 20:38 |
| ayoung | the trust token goes in -X-Auth_Token and the service users token goes in -X-Service-TOken or something | 20:39 |
| rm_work | which will (soon) be using keystone session as an auth_plugin | 20:39 |
| ayoung | ah | 20:39 |
| rm_work | as per http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html | 20:39 |
| rm_work | but I don't see a way to create a keystone-session using the Trust Token by itself even | 20:39 |
| rm_work | not to mention the Composite thing | 20:39 |
| ayoung | rm_work, you need jamielennox . I'm a poor facimile of him | 20:39 |
| rm_work | heh, k | 20:39 |
| ayoung | ok...I know some of this | 20:39 |
| ayoung | we don't a have a trust auth plugin | 20:40 |
| ayoung | you use the token plugin | 20:40 |
| ayoung | and pass the trust_id along with the token-id | 20:41 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/identity/v3.py#n59 | 20:41 |
| rm_work | ok | 20:41 |
| ayoung | its one of the base parameters for the auth plugin | 20:41 |
| rm_work | so like | 20:41 |
| *** david-lyle_ is now known as david-lyle | 20:42 | |
| rm_work | v3.Token(token_id= ... , trust_id = ... ) | 20:42 |
| rm_work | k | 20:42 |
| ayoung | yeah | 20:42 |
| rm_work | but for composite... | 20:42 |
| rm_work | hmm | 20:42 |
| ayoung | that is for creating the token itself | 20:42 |
| ayoung | not sure if we have an abstraction for the composite | 20:42 |
| rm_work | kk I will read more on that section | 20:42 |
| ayoung | I think you might need to explicitly set the second header | 20:43 |
| rm_work | I think I was in the wrong section anyway | 20:43 |
| ayoung | rm_work, I'm not even certain that the composite token work has merged | 20:44 |
| vsilva | hey ayoung, I heard you're the guy for PKI tokens. I'm working on this bug: https://bugs.launchpad.net/keystone/+bug/1291157, and still haven't figured out how dolph's suggestion applies for these newer tokens. | 20:44 |
| uvirtbot | Launchpad bug 1291157 in python-keystoneclient "idp deletion should trigger token revocation" [High,Triaged] | 20:44 |
| * ayoung looking in wrong repo... | 20:44 | |
| rm_work | I *think* it has | 20:44 |
| vsilva | His words: "As discussed in today's keystone meeting, keystoneclient.middleware.auth_token can track valid IdPs on GET /v3/OS-FEDERATION/identity_providers and compare them to tokens to test for validity." | 20:44 |
| ayoung | yep | 20:45 |
| ayoung | rm_work, I see it... | 20:45 |
| ayoung | ok | 20:45 |
| rm_work | hmm looks like even v2 accepts trust_id= | 20:45 |
| rm_work | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/identity/v2.py#n44 | 20:45 |
| vsilva | I don't quite have experience with keystone so I might be saying silly stuff here, but I thought PKI tokens didn't go back to keystone - how are we going to get the valid IdPs back from keystone? | 20:46 |
| rm_work | ok cool | 20:46 |
| rm_work | thanks ayoung this will definitely do me for now, I was dumb and looking in the wrong spot :) | 20:46 |
| ayoung | rm so I think you need to set -X-SERVICE-TOKEN explicitly | 20:46 |
| rm_work | alright, will look into that | 20:46 |
| ayoung | rm_work, thanks for doing this. | 20:46 |
| rm_work | ... or submitting a bug/CR for adding it to the client somehow :) | 20:46 |
| rm_work | will see what my motivation / sprint manager will allow :) | 20:47 |
| ayoung | rm_work, we def need client support for that | 20:48 |
| ayoung | rm_work, it is possible jamielennox has already submitted it for review | 20:49 |
| *** junhongl has quit IRC | 20:49 | |
| *** junhongl has joined #openstack-keystone | 20:49 | |
| rm_work | I've got a while before we need to really USE this anyway, probably late-kilo | 20:50 |
| rm_work | so i'm not worried yet | 20:50 |
| rm_work | we'll see | 20:50 |
| ayoung | vsilva, looking | 20:50 |
| ayoung | rm_work, so, for UUID tokens you need to be able to go from the token, to the userid (in all its forms, trusts and oauth included) and then for a federated token, you would follow that to the id_mapping table. At which point I think you would lose the trail, end up hungry and cold in the forest, and get eaten by a grue | 20:52 |
| ayoung | vsilva, you need to figure out what the connection is between IdP and domains. At this point, I become a smarty pants and say "I told you so" to some of the other devs. I think we have lost that link | 20:53 |
| ayoung | well...not lost....it is in the mapping tables. | 20:54 |
| ayoung | and when I say tables, I meant the JSON documents for the mapping | 20:58 |
| rodrigods | ayoung, vsilva , let's see if I understood it correctly. Since an IdP is related to a domain, when I delete an IdP I can figure out it's domain (via mappings), look what tokens are related to this domain and them to the revoked list? (PKI tokens) | 20:58 |
| rodrigods | for UUID tokens I would delete them from the tokens backend... | 20:59 |
| ayoung | rodrigods, that is the short of it yep | 20:59 |
| ayoung | rodrigods, deal with that first | 20:59 |
| ayoung | rodrigods, for PKI, it will also work | 20:59 |
| ayoung | its the revocation events that are not yet covered, and those would require probably revoking all by domain id | 21:00 |
| ayoung | rodrigods, so IdP -> domain_ids would still come out of the mapping | 21:00 |
| rodrigods | ayoung, nice | 21:02 |
| vsilva | thanks ayoung | 21:02 |
| rodrigods | ayoung, this revoking by domain_id has an bug that we can attack first? | 21:02 |
| *** marcoemorais has quit IRC | 21:03 | |
| ayoung | rodrigods, vsilva oy vey, is it going to be messy | 21:03 |
| *** marcoemorais has joined #openstack-keystone | 21:03 | |
| ayoung | rodrigods, vsilva OK, I just ran the db sync for the federation extension, and there is no clear way to map IdP to domain base on the database | 21:04 |
| vsilva | :o | 21:04 |
| ayoung | I think we need an explicit rule for that, but I've been overrulled in the past | 21:04 |
| ayoung | vsilva, this is what you get: | 21:05 |
| ayoung | idp_id to mapping_id | 21:05 |
| ayoung | and in the mapping table | 21:05 |
| ayoung | id to rules, which are text | 21:05 |
| lbragstad | rodrigods: is h-m not going to be implemented for ldap backends? | 21:05 |
| raildo | lbragstad, nope | 21:05 |
| lbragstad | ok | 21:05 |
| ayoung | and I shall cut short my rant about serializing objects into the database as opposed to normalizing them | 21:06 |
| ayoung | and just state that we need to put an external constraint on what IdP can map to what domain | 21:06 |
| rodrigods | lbragstad, we thought that would be unnecessary pain for now =) | 21:06 |
| ayoung | I think that is the context behind: | 21:06 |
| ayoung | https://review.openstack.org/#/c/100279/ | 21:06 |
| ayoung | but even then, I think it misses this point | 21:07 |
| *** ayoung is now known as ayoung-afk | 21:07 | |
| ayoung-afk | Gotta go pickup the kids | 21:07 |
| rodrigods | ayoung-afk, ok, we can chat about it latter =) | 21:07 |
| rodrigods | thanks | 21:08 |
| *** _cjones_ has quit IRC | 21:08 | |
| *** _cjones_ has joined #openstack-keystone | 21:08 | |
| *** raildo is now known as raildo-zzz | 21:08 | |
| *** _cjones_ has quit IRC | 21:11 | |
| *** _cjones_ has joined #openstack-keystone | 21:11 | |
| *** fifieldt_ has joined #openstack-keystone | 21:14 | |
| *** diegows has quit IRC | 21:15 | |
| rodrigods | lbragstad, thanks for the review, btw | 21:17 |
| lbragstad | rodrigods: no problem, trying to work through the rest of the series | 21:17 |
| *** fifieldt has quit IRC | 21:18 | |
| rodrigods | lbragstad, ++ | 21:19 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/116682 | 21:22 |
| *** gyee has quit IRC | 21:22 | |
| rodrigods | ^ for the brave | 21:24 |
| *** david-lyle has quit IRC | 21:27 | |
| *** joesavak has quit IRC | 21:42 | |
| *** gordc has quit IRC | 21:43 | |
| *** diegows has joined #openstack-keystone | 21:45 | |
| *** _cjones_ has quit IRC | 21:56 | |
| *** _cjones_ has joined #openstack-keystone | 21:57 | |
| *** _cjones_ has quit IRC | 21:59 | |
| *** _cjones_ has joined #openstack-keystone | 21:59 | |
| *** radez is now known as radez_g0n3 | 22:00 | |
| *** rkofman has quit IRC | 22:09 | |
| *** rkofman has joined #openstack-keystone | 22:10 | |
| *** vsilva is now known as victsou | 22:10 | |
| *** bknudson has quit IRC | 22:20 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Add an example of an audit event for a federated user https://review.openstack.org/126180 | 22:20 |
| *** david-lyle has joined #openstack-keystone | 22:29 | |
| *** gyee has joined #openstack-keystone | 22:32 | |
| *** david-lyle_ has joined #openstack-keystone | 22:35 | |
| *** dims has quit IRC | 22:36 | |
| *** dims has joined #openstack-keystone | 22:37 | |
| *** david-lyle has quit IRC | 22:39 | |
| *** dims has quit IRC | 22:41 | |
| *** Dafna has quit IRC | 22:49 | |
| *** henrynash has quit IRC | 22:49 | |
| *** rwsu has quit IRC | 22:51 | |
| *** david-lyle has joined #openstack-keystone | 22:53 | |
| *** dims has joined #openstack-keystone | 22:56 | |
| *** dims has quit IRC | 22:56 | |
| *** david-lyle_ has quit IRC | 22:56 | |
| *** dims has joined #openstack-keystone | 22:57 | |
| *** rwsu has joined #openstack-keystone | 23:04 | |
| *** mikedillion has quit IRC | 23:11 | |
| *** david-lyle has quit IRC | 23:22 | |
| *** david-lyle has joined #openstack-keystone | 23:23 | |
| *** topol has quit IRC | 23:24 | |
| *** thedodd has quit IRC | 23:30 | |
| openstackgerrit | A change was merged to openstack/keystone: Ensure sql upgrade tests can run with non-sqlite databases. https://review.openstack.org/125228 | 23:31 |
| *** dims has quit IRC | 23:31 | |
| *** dims has joined #openstack-keystone | 23:31 | |
| *** david-lyle has quit IRC | 23:34 | |
| *** dims has quit IRC | 23:36 | |
| *** bknudson has joined #openstack-keystone | 23:37 | |
| *** _cjones_ has quit IRC | 23:38 | |
| *** _cjones_ has joined #openstack-keystone | 23:39 | |
| *** dims has joined #openstack-keystone | 23:40 | |
| *** bknudson has quit IRC | 23:41 | |
| *** _cjones_ has quit IRC | 23:44 | |
| *** _cjones_ has joined #openstack-keystone | 23:45 | |
| *** zzzeek has quit IRC | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!