| morganfainberg | lol | 00:01 |
|---|---|---|
| *** lhcheng has quit IRC | 00:11 | |
| *** marcoemorais has quit IRC | 00:11 | |
| *** marcoemorais has joined #openstack-keystone | 00:11 | |
| *** lhcheng has joined #openstack-keystone | 00:11 | |
| *** zzzeek has quit IRC | 00:21 | |
| dstanek | morganfainberg: pong | 00:24 |
| morganfainberg | dstanek, added you as the leader for the obj. lifecycle design session | 00:24 |
| morganfainberg | https://etherpad.openstack.org/p/kilo-keystone-summit-topics | 00:24 |
| morganfainberg | dstanek, please feel free to update/fix the description / goals | 00:24 |
| morganfainberg | dstanek, if you don't mind leading that is | 00:24 |
| dstanek | sure, i don't have a problem with that | 00:25 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:25 | |
| morganfainberg | dstanek, cool | 00:26 |
| dstanek | i spend time today thinking about it - so i was on the right track :-) | 00:26 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:27 | |
| ayoung | morganfainberg, ah...but it won't work for GETS or Deletes | 00:42 |
| morganfainberg | ayoung, ? | 00:43 |
| ayoung | morganfainberg, token in the request body | 00:43 |
| morganfainberg | ayoung, ah true. | 00:44 |
| morganfainberg | everything would need to be post | 00:44 |
| ayoung | there is no request body for operations where it is all just the URL | 00:44 |
| morganfainberg | ick | 00:44 |
| ayoung | morganfainberg, if we do the endpoint constraints, and drop the service catalog, we can probably have tokens down at the 1K level | 00:44 |
| morganfainberg | ayoung, nah, 2-2.5k would be my expectation | 00:46 |
| morganfainberg | but still better | 00:46 |
| ayoung | gah, xchat detached this window. how do I reattach it? | 00:47 |
| ayoung | one sec | 00:47 |
| morganfainberg | uh... | 00:47 |
| *** ayoung has left #openstack-keystone | 00:47 | |
| *** ayoung has joined #openstack-keystone | 00:47 | |
| ayoung | brute force | 00:47 |
| morganfainberg | lol | 00:49 |
| rodrigods | just send a patch to horizon, trying to get groups in keystone v2 | 00:52 |
| rodrigods | and I thought I was learning something about keystone =( | 00:52 |
| nkinder | rodrigods: :) No groups in v2 | 00:53 |
| morganfainberg | hehe | 00:53 |
| rodrigods | nkinder, yeah... | 00:53 |
| nkinder | it'd all be so much simpler if there was only v3... | 00:53 |
| rodrigods | nkinder, ++ | 00:54 |
| rodrigods | I assumed that it was using v2, because it wasn't using role_assignments | 00:54 |
| rodrigods | (but I forgot that was me who added role_assignments to keystone client) | 00:54 |
| morganfainberg | rodrigods, one of those moments like "who wrote this!?! ... oh I did..." | 00:55 |
| *** mitz_ has quit IRC | 00:55 | |
| morganfainberg | i swear i've *never* done that :P | 00:55 |
| rodrigods | morganfainberg, totally believe you | 00:55 |
| morganfainberg | hehe | 00:55 |
| * morganfainberg glares at ubuntu installer | 00:56 | |
| rodrigods | detail: the patch was near +A (had two +2) | 00:56 |
| *** mitz_ has joined #openstack-keystone | 00:57 | |
| ayoung | I haven't done that all day | 00:59 |
| ayoung | mainly cuz I've been looking at other people's code | 00:59 |
| morganfainberg | hehe | 00:59 |
| ayoung | morganfainberg, so, question for you. If It turns out the data inside a keystone PKIZ token was improperly formattted (what was supposed to be binary was infact Base64 encded) would we have to release a new token version, or could we just silently fix it? | 01:00 |
| *** dims_ has quit IRC | 01:00 | |
| rodrigods | you cores, have a daily task: code review for X hours | 01:00 |
| rodrigods | ? | 01:00 |
| morganfainberg | ayoung, i'm... scared... why are you asking? | 01:00 |
| ayoung | https://bugs.launchpad.net/python-keystoneclient/+bug/1379782 | 01:00 |
| uvirtbot | Launchpad bug 1379782 in python-keystoneclient "PKIZ token processesing does PEM, not DER" [Undecided,In progress] | 01:00 |
| *** dims has joined #openstack-keystone | 01:01 | |
| ayoung | morganfainberg, its not huge. It probably has a minor effect on token size | 01:01 |
| ayoung | We could make the validation accept either der or cms encoding (which is what that patch does) | 01:01 |
| morganfainberg | ayoung, that is probably the right answer | 01:02 |
| ayoung | morganfainberg, so, the hiccup would be (I think) only if they deployed KC for Keystone server without doing the same change for the client | 01:02 |
| ayoung | so the server was issuing tokens that the client could not validate | 01:02 |
| *** shakayumi has quit IRC | 01:02 | |
| ayoung | and...I could split it up into two patches | 01:02 |
| morganfainberg | ayoung, so we *do* that now? | 01:02 |
| ayoung | one that does the validation for both forms | 01:02 |
| ayoung | morganfainberg, I just found this | 01:03 |
| morganfainberg | ah, ok | 01:03 |
| ayoung | wrote the patch over the weekend | 01:03 |
| morganfainberg | ok so we should support both versions for sure | 01:03 |
| ayoung | ah...py33 | 01:03 |
| morganfainberg | and then once we release the client that does so, we can fix server to issue it sanely | 01:03 |
| ayoung | Ok, I bet that the py33 thing is due to the binary format | 01:03 |
| ayoung | I'm almost tempted to leave it | 01:03 |
| ayoung | here;s the deal (IIUC) | 01:04 |
| ayoung | when running openssl -outform der you get a binary | 01:04 |
| ayoung | that was the plan, but I fat fingered in pem | 01:04 |
| ayoung | I'm guessing it was part of trying to get the thing to work, and I left it in when I got the "HEY IT works!" endorphin rush | 01:04 |
| *** shakayumi has joined #openstack-keystone | 01:05 | |
| ayoung | so if we leave it...probably no harm done | 01:05 |
| ayoung | lets see, I posted a patch with the updated sample data for the tokens...size difference.... | 01:05 |
| *** dims has quit IRC | 01:05 | |
| morganfainberg | ah | 01:06 |
| ayoung | cn't tell... | 01:06 |
| morganfainberg | not worried about the size of the token, it should be minimal in this case | 01:06 |
| morganfainberg | my concern is correctness and breaking someone if we change it | 01:06 |
| ayoung | let me see if I can get a size difference on the tokens. In theory, compressing binary and base64 encoded should reduce to the same size-ish | 01:06 |
| ayoung | yeah | 01:06 |
| ayoung | morganfainberg, http://paste.openstack.org/show/120861/ | 01:08 |
| ayoung | difference is significant enough to be interesting | 01:08 |
| ayoung | top is binary, bottom is Base64 | 01:08 |
| morganfainberg | sure. but again, breaking people = bad | 01:08 |
| ayoung | well, since I don';t have a python33 fix anyway, its a Mute point. | 01:08 |
| ayoung | You are just dying to correct that, aren;t you? | 01:09 |
| morganfainberg | what the pem -> der? | 01:09 |
| morganfainberg | or the py33 bit? | 01:09 |
| ayoung | no Mute to Moot | 01:09 |
| morganfainberg | oh | 01:09 |
| morganfainberg | didn't even realize you typo'd it | 01:09 |
| ayoung | Its mute point. we don't have to talk about it | 01:09 |
| ayoung | try the veal | 01:10 |
| * ayoung just a touch punchy | 01:10 | |
| morganfainberg | meh. | 01:10 |
| *** jorge_munoz has quit IRC | 01:10 | |
| *** stevemar has joined #openstack-keystone | 01:10 | |
| morganfainberg | ooh lookie a wild stevemar appears | 01:11 |
| stevemar | morganfainberg, howdy | 01:11 |
| stevemar | morganfainberg, been away for a few days, holiday and such | 01:11 |
| morganfainberg | welcome back | 01:12 |
| stevemar | morganfainberg, what i miss? | 01:12 |
| morganfainberg | nothin | 01:12 |
| morganfainberg | is quiet. | 01:12 |
| stevemar | quiet is good | 01:12 |
| *** jorge_munoz has joined #openstack-keystone | 01:13 | |
| ayoung | nkinder, question for you: I want to compare the signing data of two certificates. I've gotten enough of a handle on python asn1 that I can extract the signer info. Does it make sense that I could hash the signer info of a keystone token and check that it matched the signer info for a certificate? | 01:13 |
| morganfainberg | stevemar, https://etherpad.openstack.org/p/kilo-keystone-summit-topics added a tentative schedule | 01:14 |
| stevemar | morganfainberg, i'm gonna go hard on the CI stuff | 01:15 |
| stevemar | probably | 01:15 |
| morganfainberg | ? | 01:16 |
| *** dims has joined #openstack-keystone | 01:16 | |
| *** harlowja is now known as harlowja_away | 01:16 | |
| morganfainberg | you mean from the perspective of what you're working on this cycle? | 01:16 |
| *** harlowja_away is now known as harlowja | 01:16 | |
| stevemar | morganfainberg, yesssh | 01:18 |
| stevemar | morganfainberg, plus whatever topes has me workin on | 01:19 |
| morganfainberg | cool | 01:22 |
| nkinder | ayoung: so you'd hash the signer on both sides and compare? | 01:22 |
| stevemar | morganfainberg, probably something federation related, maybe finally adding openid connect :P | 01:22 |
| ayoung | nkinder, yeah, that is what the OCSP code I found seems to be doing | 01:22 |
| ayoung | nkinder, https://github.com/coruus/pyasn1-modules/blob/master/tools/ocspclient.py#L40 | 01:23 |
| ayoung | nkinder, it seems to make sense: why bother doing the whole string conversion and comparison when the ASN1 data is already in cannonical form? | 01:24 |
| ayoung | nkinder, since the OS-SIMPLE-CERT extension returns all certificates, whomever is checking would parse them down to the issuer, hash that, and then do the same for any tokens that come in. If there is a match, that is the certificate to use to try and validate the token | 01:26 |
| nkinder | ayoung: looks like that's part of the request in the spec - https://www.ietf.org/rfc/rfc2560.txt | 01:26 |
| ayoung | nkinder, yeah, I know. I was just looking around for pyasn1 examples, and came across that. Do you know if it is Kosher? | 01:26 |
| nkinder | ayoung: it sounds fine to me, but the right person to ask is Bob Relyea | 01:27 |
| ayoung | will do | 01:27 |
| ayoung | doesn;t he sit right behind you? | 01:27 |
| nkinder | ayoung: shoot him an e-mail and I'll bug him when I see him if he doesn't get back to you | 01:27 |
| nkinder | ayoung: yeah, a few desks over | 01:27 |
| ayoung | nkinder, so I'm guessing that token.signing_info[0].issuer.hash == cert.issuer.hash && a serial number check will do it | 01:29 |
| ayoung | and with that, we know how to identify which cert to use to validate a token | 01:29 |
| *** wpf has joined #openstack-keystone | 01:37 | |
| wpf | All, anyone know that when using multi-region, can we have the different service user/pw for different region ? such as nova1 for region1 and nova2 for region2? | 01:38 |
| ayoung | wpf, yes. so long as the nova uses that username when authenticating to keystone | 01:38 |
| ayoung | wpf, you can have a different user per endpoint. I'd almost suggest that is a best practice | 01:39 |
| wpf | ayoung: thanks for your answer, anyway, forgive my ignorance , do we need to configure all the components's conf file in one region to have the different user for it ? | 01:40 |
| ayoung | wpf, components? | 01:41 |
| ayoung | you mean endpoints? | 01:41 |
| wpf | nova ,glance ,neutron.... | 01:41 |
| wpf | yes | 01:41 |
| wpf | since I remember that there is no relationship between user and endpoints in the keystone db ? | 01:42 |
| ayoung | wpf, each endpoint only needs to know about its specific service user.So if region1_nova is using a different user thant region2_nova the conf files for Nova need to reflect that | 01:42 |
| ayoung | lets say, though, that you don't care about that for, say, glance, then you could use on glance user for all endpoints everywhere | 01:42 |
| ayoung | there is no explicit relationship between users and endpoints, that is correct | 01:43 |
| wpf | Ok, then we need to add the new users and assign it the same role with the normal service users manually, right ? | 01:44 |
| *** wwriverrat has quit IRC | 01:44 | |
| ayoung | wpf, that is correct | 01:53 |
| wpf | ayoung: thanks, you are a big help | 01:53 |
| *** shakamunyi has joined #openstack-keystone | 01:56 | |
| *** shakayumi has quit IRC | 01:57 | |
| *** marcoemorais has quit IRC | 01:58 | |
| *** lhcheng has quit IRC | 02:00 | |
| *** lhcheng has joined #openstack-keystone | 02:00 | |
| *** lhcheng has quit IRC | 02:05 | |
| *** lhcheng has joined #openstack-keystone | 02:06 | |
| *** lhcheng has quit IRC | 02:11 | |
| *** lhcheng has joined #openstack-keystone | 02:12 | |
| *** lhcheng has quit IRC | 02:19 | |
| *** lhcheng has joined #openstack-keystone | 02:19 | |
| *** samuelmz__ has quit IRC | 02:22 | |
| *** lhcheng has quit IRC | 02:24 | |
| *** alex_xu has joined #openstack-keystone | 02:24 | |
| *** dims has quit IRC | 02:29 | |
| *** alex_xu has quit IRC | 02:32 | |
| *** shakamunyi has quit IRC | 02:34 | |
| *** shakamunyi has joined #openstack-keystone | 02:35 | |
| *** gyee has quit IRC | 02:37 | |
| *** alex_xu has joined #openstack-keystone | 02:44 | |
| *** stevemar2 has joined #openstack-keystone | 02:45 | |
| *** shakayumi has joined #openstack-keystone | 02:46 | |
| *** breton_ has joined #openstack-keystone | 02:49 | |
| *** jaosorior_ has joined #openstack-keystone | 02:49 | |
| *** ctracey_ has joined #openstack-keystone | 02:49 | |
| *** serverascode__ has joined #openstack-keystone | 02:50 | |
| *** morgan has joined #openstack-keystone | 02:51 | |
| *** vsilva` has joined #openstack-keystone | 02:52 | |
| *** d0ugal_ has joined #openstack-keystone | 02:52 | |
| *** shakamunyi has quit IRC | 02:54 | |
| *** stevemar has quit IRC | 02:54 | |
| *** jaosorior has quit IRC | 02:54 | |
| *** Dafna has quit IRC | 02:54 | |
| *** HenryG has quit IRC | 02:54 | |
| *** morganfainberg has quit IRC | 02:54 | |
| *** mgagne has quit IRC | 02:54 | |
| *** sudorandom has quit IRC | 02:54 | |
| *** serverascode_ has quit IRC | 02:54 | |
| *** comstud has quit IRC | 02:54 | |
| *** d34dh0r53 has quit IRC | 02:54 | |
| *** vsilva has quit IRC | 02:54 | |
| *** junhongl has quit IRC | 02:54 | |
| *** swartulv has quit IRC | 02:54 | |
| *** ctracey has quit IRC | 02:54 | |
| *** breton has quit IRC | 02:54 | |
| *** vishy has quit IRC | 02:54 | |
| *** lbragstad has quit IRC | 02:54 | |
| *** sigmavirus24_awa has quit IRC | 02:54 | |
| *** dtroyer has quit IRC | 02:54 | |
| *** adam_g has quit IRC | 02:54 | |
| *** d0ugal has quit IRC | 02:54 | |
| *** gsilvis has quit IRC | 02:54 | |
| *** mhu has quit IRC | 02:54 | |
| *** d0ugal_ is now known as d0ugal | 02:54 | |
| *** morgan is now known as morganfainberg | 02:54 | |
| *** jaosorior_ is now known as jaosorior | 02:54 | |
| *** d0ugal is now known as Guest85887 | 02:54 | |
| *** jorge_munoz has quit IRC | 02:55 | |
| *** gsilvis has joined #openstack-keystone | 02:55 | |
| *** vishy has joined #openstack-keystone | 02:56 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 02:56 | |
| *** adam_g has joined #openstack-keystone | 02:57 | |
| *** adam_g has quit IRC | 02:58 | |
| *** adam_g has joined #openstack-keystone | 02:58 | |
| *** d34dh0r53 has joined #openstack-keystone | 02:58 | |
| *** ctracey_ is now known as ctracey | 02:59 | |
| *** richm has quit IRC | 02:59 | |
| *** Dafna has joined #openstack-keystone | 03:00 | |
| *** junhongl has joined #openstack-keystone | 03:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 03:04 | |
| *** sigmavirus24 has joined #openstack-keystone | 03:04 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:05 | |
| *** swartulv has joined #openstack-keystone | 03:07 | |
| *** thedodd has joined #openstack-keystone | 03:08 | |
| *** mhu has joined #openstack-keystone | 03:09 | |
| *** bknudson has quit IRC | 03:19 | |
| *** comstud has joined #openstack-keystone | 03:21 | |
| *** mgagne has joined #openstack-keystone | 03:21 | |
| *** mgagne is now known as Guest88785 | 03:21 | |
| *** dtroyer has joined #openstack-keystone | 03:22 | |
| *** sudorandom has joined #openstack-keystone | 03:22 | |
| *** lbragstad has joined #openstack-keystone | 03:23 | |
| *** alex_xu has quit IRC | 03:23 | |
| *** dims has joined #openstack-keystone | 03:29 | |
| *** lhcheng has joined #openstack-keystone | 03:31 | |
| *** dims has quit IRC | 03:34 | |
| *** lhcheng has quit IRC | 03:35 | |
| *** lhcheng has joined #openstack-keystone | 03:37 | |
| *** alex_xu has joined #openstack-keystone | 03:38 | |
| *** ayoung has quit IRC | 03:42 | |
| *** harlowja is now known as harlowja_away | 03:48 | |
| *** harlowja_away is now known as harlowja | 03:52 | |
| *** thedodd has quit IRC | 03:56 | |
| *** stevemar2 has quit IRC | 04:00 | |
| *** stevemar2 has joined #openstack-keystone | 04:01 | |
| *** ncoghlan has joined #openstack-keystone | 04:01 | |
| *** alex_xu has quit IRC | 04:04 | |
| *** HenryG has joined #openstack-keystone | 04:12 | |
| *** alex_xu has joined #openstack-keystone | 04:17 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 04:26 |
| *** mfisch has quit IRC | 04:28 | |
| *** dims has joined #openstack-keystone | 04:30 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 04:31 |
| *** dims has quit IRC | 04:35 | |
| *** swamireddy has joined #openstack-keystone | 04:37 | |
| *** lhcheng has quit IRC | 05:12 | |
| *** lhcheng has joined #openstack-keystone | 05:17 | |
| *** mfisch has joined #openstack-keystone | 05:20 | |
| *** mfisch is now known as Guest18588 | 05:20 | |
| *** stevemar2 has quit IRC | 05:28 | |
| *** stevemar has joined #openstack-keystone | 05:37 | |
| *** Guest18588 has quit IRC | 05:40 | |
| *** alex_xu has quit IRC | 05:40 | |
| *** vsilva` has quit IRC | 05:40 | |
| *** htruta has quit IRC | 05:40 | |
| *** afaranha has quit IRC | 05:40 | |
| *** mitz has quit IRC | 05:40 | |
| *** harlowja has quit IRC | 05:40 | |
| *** DavidHu__ has quit IRC | 05:40 | |
| *** Guest18588 has joined #openstack-keystone | 05:46 | |
| *** alex_xu has joined #openstack-keystone | 05:46 | |
| *** vsilva` has joined #openstack-keystone | 05:46 | |
| *** afaranha has joined #openstack-keystone | 05:46 | |
| *** htruta has joined #openstack-keystone | 05:46 | |
| *** mitz has joined #openstack-keystone | 05:46 | |
| *** harlowja has joined #openstack-keystone | 05:46 | |
| *** DavidHu__ has joined #openstack-keystone | 05:46 | |
| *** afazekas has joined #openstack-keystone | 05:48 | |
| *** dims has joined #openstack-keystone | 06:00 | |
| *** alex_xu has quit IRC | 06:01 | |
| *** ajayaa has joined #openstack-keystone | 06:01 | |
| *** dims has quit IRC | 06:05 | |
| *** ajayaa has quit IRC | 06:07 | |
| *** lhcheng has quit IRC | 06:12 | |
| *** lhcheng has joined #openstack-keystone | 06:12 | |
| *** alex_xu has joined #openstack-keystone | 06:15 | |
| *** lhcheng has quit IRC | 06:17 | |
| openstackgerrit | A change was merged to openstack/identity-api: Updated from global requirements https://review.openstack.org/128121 | 06:22 |
| *** alex_xu has quit IRC | 06:23 | |
| *** k4n0 has joined #openstack-keystone | 06:24 | |
| *** harlowja is now known as harlowja_away | 06:25 | |
| *** lufix has joined #openstack-keystone | 06:25 | |
| *** lufix has quit IRC | 06:25 | |
| *** lufix has joined #openstack-keystone | 06:25 | |
| *** shakayumi has quit IRC | 06:34 | |
| *** alex_xu has joined #openstack-keystone | 06:35 | |
| *** ajayaa has joined #openstack-keystone | 06:35 | |
| *** ukalifon1 has joined #openstack-keystone | 06:45 | |
| *** zzzeek has joined #openstack-keystone | 06:51 | |
| *** zzzeek has quit IRC | 06:51 | |
| *** stevemar has quit IRC | 06:52 | |
| *** ajayaa has quit IRC | 06:53 | |
| *** stevemar has joined #openstack-keystone | 06:59 | |
| openstackgerrit | Sergey Kraynev proposed a change to openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 07:02 |
| *** zarric has joined #openstack-keystone | 07:05 | |
| *** stevemar has quit IRC | 07:08 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: fix the wrong order of assertEqual args in test_v3 https://review.openstack.org/127110 | 07:23 |
| *** jaosorior has left #openstack-keystone | 07:31 | |
| *** Guest85887 has quit IRC | 07:32 | |
| *** alex_xu has quit IRC | 07:32 | |
| *** Guest50275 has joined #openstack-keystone | 07:32 | |
| *** Guest50275 has quit IRC | 07:35 | |
| *** dmatthews__ has joined #openstack-keystone | 07:36 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: use expected_length parameter to assert expected length https://review.openstack.org/128197 | 07:38 |
| *** amcrn has quit IRC | 07:38 | |
| *** dmatthews__ has quit IRC | 07:46 | |
| *** alex_xu has joined #openstack-keystone | 07:46 | |
| *** dmatthews__ has joined #openstack-keystone | 07:47 | |
| *** dmatthews__ has quit IRC | 07:52 | |
| *** d0ugal has joined #openstack-keystone | 07:53 | |
| *** d0ugal is now known as Guest56922 | 07:53 | |
| *** nellysmitt has joined #openstack-keystone | 07:53 | |
| *** Guest56922 is now known as d0ugal | 07:54 | |
| *** d0ugal has joined #openstack-keystone | 07:54 | |
| *** jistr has joined #openstack-keystone | 07:57 | |
| *** ncoghlan has quit IRC | 08:01 | |
| *** alex_xu has quit IRC | 08:11 | |
| *** alex_xu has joined #openstack-keystone | 08:23 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/python-keystoneclient: Add protocol as an argument for unscoped SAML-based plugins https://review.openstack.org/128103 | 08:24 |
| *** shakamunyi has joined #openstack-keystone | 08:27 | |
| openstackgerrit | Matthieu Huin proposed a change to openstack/python-keystoneclient: Add protocol as an argument for unscoped SAML-based plugins https://review.openstack.org/128103 | 08:28 |
| *** shakamunyi has quit IRC | 08:32 | |
| *** k4n0 has quit IRC | 09:01 | |
| *** aix_ has joined #openstack-keystone | 09:01 | |
| *** breton_ is now known as breton | 09:02 | |
| *** k4n0 has joined #openstack-keystone | 09:14 | |
| *** alex_xu has quit IRC | 09:15 | |
| *** Tahmina has joined #openstack-keystone | 09:19 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: call _choose_api_version in one place https://review.openstack.org/127866 | 09:21 |
| *** aix_ has quit IRC | 09:26 | |
| *** aix_ has joined #openstack-keystone | 09:27 | |
| *** swamireddy has quit IRC | 09:29 | |
| *** swamireddy has joined #openstack-keystone | 09:39 | |
| *** HenryG has quit IRC | 09:42 | |
| *** HenryG_ has joined #openstack-keystone | 09:42 | |
| *** HenryG_ has quit IRC | 09:43 | |
| *** HenryG has joined #openstack-keystone | 09:43 | |
| *** k4n0 has quit IRC | 10:33 | |
| *** shikui_ has joined #openstack-keystone | 10:35 | |
| *** Kui has quit IRC | 10:38 | |
| *** dims has joined #openstack-keystone | 10:38 | |
| *** dims has quit IRC | 10:43 | |
| *** dims has joined #openstack-keystone | 11:00 | |
| *** jistr is now known as jistr|english | 11:29 | |
| *** pc-m has joined #openstack-keystone | 11:53 | |
| *** amakarov_away is now known as amakarov | 12:03 | |
| *** k4n0 has joined #openstack-keystone | 12:14 | |
| *** ajayaa has joined #openstack-keystone | 12:15 | |
| *** dims has quit IRC | 12:24 | |
| *** dims has joined #openstack-keystone | 12:25 | |
| mhu | marekd: I finally got to use your saml2 wrapper in OSC, it works nicely | 12:28 |
| *** dims has quit IRC | 12:30 | |
| openstackgerrit | Masahito Muroi proposed a change to openstack/keystonemiddleware: hanging the value type of http_connect_timeout https://review.openstack.org/126543 | 12:30 |
| marekd | mhu: you mean https://review.openstack.org/#/c/106751/ ? | 12:33 |
| mhu | marekd, yes | 12:34 |
| marekd | mhu: did you have to hack anything? | 12:34 |
| marekd | or simply pull this review? | 12:34 |
| marekd | mhu: actually I already got into some design faults :( | 12:34 |
| marekd | nobody is using it and I will need to start deprecating few methods. | 12:35 |
| *** shakayumi has joined #openstack-keystone | 12:35 | |
| marekd | mhu: it was a good lesson for me (painful at the same time) | 12:35 |
| marekd | https://review.openstack.org/#/c/124767/1 <-- | 12:35 |
| *** shakayumi has quit IRC | 12:35 | |
| mhu | marekd, I pulled the review, installed the lib in a venv -had to remove the version pulled when installing osc though- and it pretty much worked out of the box | 12:36 |
| *** gordc has joined #openstack-keystone | 12:38 | |
| *** Tahmina has quit IRC | 12:38 | |
| mhu | marekd, bah, it happens, it's not easy to foresee everything | 12:43 |
| mhu | marekd, it'd be cool to make the wrapper patch non dependent from the signature change one, though, so that the wrapper can actually land in ksc's next version | 12:45 |
| marekd | mhu: i should work on that today or tommorow. | 12:48 |
| marekd | mhu: i was thinking about adding factory methods. | 12:48 |
| marekd | or decorators. | 12:48 |
| *** jasondotstar has quit IRC | 12:54 | |
| *** miqui has joined #openstack-keystone | 12:54 | |
| *** jistr|english is now known as jistr | 12:54 | |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 12:55 |
| openstackgerrit | Ilya Pekelny proposed a change to openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 12:55 |
| *** f13o_f13o has joined #openstack-keystone | 13:00 | |
| *** f13o_f13o has quit IRC | 13:00 | |
| *** packet has joined #openstack-keystone | 13:03 | |
| *** bknudson has joined #openstack-keystone | 13:05 | |
| *** shikui_ has quit IRC | 13:05 | |
| *** ayoung has joined #openstack-keystone | 13:14 | |
| *** Kui has joined #openstack-keystone | 13:17 | |
| *** kpavel has joined #openstack-keystone | 13:21 | |
| kpavel | Is there an option to delegate authorization and authentication from keystone to external service? For example in case i want to login to openstack using VCenter local users/passwords? | 13:23 |
| *** richm has joined #openstack-keystone | 13:24 | |
| ayoung | kpavel, you would need to have a common password store | 13:24 |
| ayoung | keystone is more made to consume external auth. | 13:24 |
| ayoung | kpavel, what do you mean by "local" for VCenter? Active Directory? Some SQL Backend? | 13:25 |
| openstackgerrit | A change was merged to openstack/identity-api: Correct response status for HEAD requests https://review.openstack.org/124243 | 13:25 |
| *** Kui has quit IRC | 13:27 | |
| rodrigods | anyone available to give some feedback in the comments here https://review.openstack.org/#/c/117785/22/keystone/assignment/backends/sql.py ? | 13:28 |
| ayoung | rodrigods, I'll do it if you review https://review.openstack.org/#/c/125673/ | 13:29 |
| * ayoung horse trader | 13:29 | |
| *** jasondotstar has joined #openstack-keystone | 13:29 | |
| ayoung | rodrigods, its a pity that the relational database world has niot standardized how to do hierarchical queries | 13:31 |
| rodrigods | ayoung, yeah... I didn't know about this MPTT thing | 13:31 |
| ayoung | rodrigods, why does def _get_children(self, session, project_ids) take a list of project_ids? It doesn't look recursive | 13:32 |
| rodrigods | but I think that the current solution is pretty simple and covers the first steps for HM | 13:32 |
| rodrigods | ayoung, in this way, we can do only one DB query | 13:32 |
| ayoung | yeah, its just a lot of Database hits for deep trees | 13:33 |
| *** packet has quit IRC | 13:33 | |
| kpavel | ayoung, i think VCenter uses Active Directory. | 13:33 |
| ayoung | kpavel, then, yes, use the LDAP backend for Keystone and point it at AD. | 13:33 |
| rodrigods | ayoung, would love to study more about MPTT and maybe use it to improve the HM implementation, but I think that it really fits in the "next steps" area | 13:34 |
| ayoung | ++ | 13:34 |
| kpavel | ayoung, thanks | 13:34 |
| rodrigods | and maybe the guys from my team can discuss it in the summit =) | 13:34 |
| rodrigods | ayoung, can you give your "core" opinion over there? | 13:36 |
| ayoung | I'll be there | 13:36 |
| *** vhoward has left #openstack-keystone | 13:36 | |
| rodrigods | ayoung, in the patch too =) | 13:36 |
| ayoung | meh... | 13:37 |
| ayoung | rodrigods, nah, that s all good...don't want to derail | 13:37 |
| rodrigods | ayoung, ++ | 13:38 |
| ayoung | rodrigods is there any upper limit to the number of parameters we can have in a sql query? Line 316, where we keep aedding more and more "parents" to the query as we go deeper? | 13:40 |
| * rodrigods checking | 13:41 | |
| *** topol has joined #openstack-keystone | 13:43 | |
| rodrigods | ayoung, never heard about size limits in this type of query... | 13:43 |
| ayoung | rodrigods, I don't think you need the explicit DB query for a leaf project. When you query from the top down, some of the projects are going to return with no children. You can detect at that point. | 13:43 |
| ayoung | and annotate on the record that it is a leaf | 13:44 |
| rodrigods | ayoung, if we use the "leaf" record, we could always change it to "not leaf" in the create_project() method | 13:45 |
| ayoung | yep | 13:45 |
| rodrigods | not necessarily in the traversal | 13:45 |
| *** andreaf has joined #openstack-keystone | 13:45 | |
| rodrigods | ayoung, but right now the "is_leaf_project" method is only used in the delete_project() | 13:46 |
| ayoung | then don't bother | 13:46 |
| rodrigods | ++ | 13:46 |
| ayoung | just do the query to delete children, | 13:47 |
| ayoung | where is the delete? not seeing it | 13:47 |
| rodrigods | it's in the next patch | 13:47 |
| rodrigods | ayoung, that patch only has the "util" methods part | 13:48 |
| ayoung | ah. funny how the hierarachy thing would be so much simpler in LDAP and we are not planning on supporting it there | 13:48 |
| rodrigods | ayoung, https://review.openstack.org/#/c/117786/22/keystone/assignment/core.py line 173 | 13:48 |
| ayoung | rodrigods, what was the reason for the split between those two patches? | 13:49 |
| rodrigods | ayoung, just to ease the reviews, I think reviewers get scared with huge patches =) | 13:49 |
| ayoung | yeah, but what was the rationale for what went into which? | 13:50 |
| rodrigods | ayoung, "util" methods / actual crud operations | 13:50 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:51 | |
| *** ajayaa has quit IRC | 13:58 | |
| *** kpavel has quit IRC | 14:00 | |
| *** radez_g0n3 is now known as radez | 14:07 | |
| *** swamireddy has quit IRC | 14:11 | |
| *** stevemar has joined #openstack-keystone | 14:12 | |
| *** dims has joined #openstack-keystone | 14:17 | |
| ukalifon1 | nkinder: should I recreate bug https://bugzilla.redhat.com/show_bug.cgi?id=1099628 with AD or with IPA? I am trying your ldapadd command and getting some strange connection errors (with AD) | 14:19 |
| uvirtbot | ukalifon1: Error: Could not parse XML returned by bugzilla.redhat.com: HTTP Error 404: Not Found | 14:19 |
| nkinder | ukalifon1: what errors do you get back from AD? | 14:20 |
| nkinder | ukalifon1: If you're not connecting to AD using SSL/TLS, it won't allow you to set the "unicodePassword" attribute. | 14:21 |
| nkinder | ukalifon1: that would be the most common reason for the add to fail | 14:21 |
| ukalifon1 | nkinder: so I need to connect to ldaps:// ? | 14:22 |
| ukalifon1 | nkinder: instead of ldap:// | 14:22 |
| nkinder | ukalifon1: yes, which means you'll need the CA cert, or you'll need to tell it to ignore validation (not ideal, but OK for testing) | 14:23 |
| nkinder | ukalifon1: Also, AD has password complexitity requirements | 14:23 |
| nkinder | ukalifon1: if you use too simple of a password, it will fail with an unhelpful error message | 14:23 |
| nkinder | ukalifon1: requirements are 8 characters, and 3 character "classes" must be represented (lower, upper, digit, 8-bit, special, etc.) | 14:24 |
| nkinder | ukalifon1: Something like Password123 would meet the requirements | 14:24 |
| ukalifon1 | nkinder: I didn't even get to the stage where I need to choose a password yet | 14:24 |
| nkinder | ukalifon1: your add doesn't include a password? | 14:24 |
| *** david-lyle has joined #openstack-keystone | 14:24 | |
| ukalifon1 | nkinder: I try this: ldapadd -H ldaps://192.168.122.86 -x -D "cn=Manager,dc=win2012dom,dc=com" -w 'my_passwoprd' | 14:25 |
| ukalifon1 | and I get: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) | 14:25 |
| nkinder | ukalifon1: did you set up Microsoft Certificate Services on your AD system when you set up the domain controller? | 14:26 |
| ukalifon1 | nkinder: I don't think so | 14:26 |
| nkinder | ukalifon1: if not, you don't have a CA and there is no certificate to allow LDAPS to be enabled | 14:26 |
| ukalifon1 | nkinder: can we tell it to ignore that? | 14:26 |
| nkinder | ukalifon1: You can just add the user through the GUI on AD then | 14:26 |
| nkinder | no | 14:26 |
| nkinder | it will not ignore it. | 14:27 |
| ukalifon1 | nkinder: If I use the GUI, can I add commas in the dn? | 14:27 |
| nkinder | ukalifon1: yes, I think so IIRC | 14:27 |
| ukalifon1 | nkinder: would ldapsearch work? | 14:28 |
| nkinder | ukalifon1: yes | 14:28 |
| nkinder | ukalifon1: the only thing that requires SSL/TLS is setting a password over a remote LDAP connection | 14:28 |
| nkinder | ukalifon1: so in theory, you can use ldapmodify to add a user without a password, then go use the GUI to set the password | 14:29 |
| *** k4n0 has quit IRC | 14:42 | |
| *** Dafna has quit IRC | 14:42 | |
| *** jorge_munoz has joined #openstack-keystone | 14:51 | |
| *** Dafna has joined #openstack-keystone | 14:55 | |
| *** thedodd has joined #openstack-keystone | 14:56 | |
| *** zzzeek has joined #openstack-keystone | 15:05 | |
| *** david-lyle has quit IRC | 15:06 | |
| *** roaet has joined #openstack-keystone | 15:19 | |
| *** gyee has joined #openstack-keystone | 15:20 | |
| *** roaet has left #openstack-keystone | 15:20 | |
| openstackgerrit | Chmouel Boudjnah proposed a change to openstack/keystonemiddleware: Encode middleware error message as bytes https://review.openstack.org/123451 | 15:25 |
| *** mpath-rax has joined #openstack-keystone | 15:34 | |
| *** ukalifon1 has quit IRC | 15:37 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: add doc8 validation https://review.openstack.org/128338 | 15:38 |
| dolphm | morganfainberg: dstanek: ^ | 15:38 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone-specs: add doc8 validation https://review.openstack.org/128338 | 15:38 |
| dstanek | dolphm: i love doc8! | 15:39 |
| mpath-rax | I'm looking for assistance with a keystone install - I'm seeing ImportError: Class TemplatedCatalog cannot be found. Does anyone know what this is about? | 15:39 |
| dolphm | dstanek: i'm adding it to all the repos, but figured -specs should be the first :) | 15:39 |
| morganfainberg | nice. | 15:40 |
| morganfainberg | ++ | 15:40 |
| *** andreaf has quit IRC | 15:41 | |
| dolphm | mpath-rax: change TemplatedCatalog to just Catalog IIRC - TemplatedCatalog has been deprecated for a couple releases | 15:43 |
| dolphm | mpath-rax: in keystone.conf | 15:43 |
| *** marcoemorais has joined #openstack-keystone | 15:43 | |
| mpath-rax | k thanks dolphm | 15:43 |
| dolphm | mpath-rax: err it's in your paste config, not keystone.conf necessarily | 15:43 |
| mpath-rax | yep, that worked. Thanks | 15:44 |
| *** thedodd has quit IRC | 15:47 | |
| *** thedodd has joined #openstack-keystone | 15:49 | |
| stevemar | hehe https://wiki.openstack.org/wiki/Summit/Kilo/Travel_Tips - "Do not drive your own car in Paris. Really, don't." | 15:52 |
| marekd | stevemar: lol | 15:53 |
| dolphm | 10 C isn't bad | 15:53 |
| dolphm | unless it's windy | 15:53 |
| stevemar | dolphm, shouldn't be an issue | 15:54 |
| stevemar | this shuttle seems like a good idea | 15:56 |
| stevemar | http://en.lescarsairfrance.com/les-navettes-roissy-cdg.html | 15:56 |
| dolphm | stevemar: does that go somewhere useful for us? | 15:57 |
| stevemar | dolphm, i believe right to the conference centre area | 15:57 |
| stevemar | from airport | 15:57 |
| stevemar | "If going to Porte Maillot, where the summit takes place ... take the "car Air France" coach that takes you directly from CDG to Porte Maillot" | 15:57 |
| stevemar | seems to leave every 30 minutes | 15:59 |
| dolphm | oh cool, so N 2? | 15:59 |
| stevemar | line number 2 | 16:00 |
| stevemar | i wonder if i can buy a ticket at the airport instead of online | 16:01 |
| mhu | I live 10 minutes away from Porte Maillot, I can confirm that cars Air France leave and go from/to there | 16:01 |
| mhu | there are also shuttles for ryan air/easyjet flights going there | 16:02 |
| *** afazekas has quit IRC | 16:02 | |
| mhu | stevemar, I think you have to buy the bus ticket when boarding the bus, IIRC | 16:03 |
| dolphm | morganfainberg: doc8 support is better for rst than for md - i'm tempted to convert all our api docs again | 16:04 |
| stevemar | mhu hmm there is an option to buy online, but i | 16:04 |
| stevemar | i'd prefer to buy when i board | 16:04 |
| *** _cjones_ has joined #openstack-keystone | 16:05 | |
| morganfainberg | dolphm, works for me | 16:05 |
| stevemar | i think finding the conference centre when exiting porte maillot should be easy :) *look for the giant building* | 16:05 |
| mhu | stevemar, yep, you can't really miss it ! | 16:07 |
| bknudson | the shuttle goes to palais maillot? | 16:10 |
| *** thedodd has quit IRC | 16:11 | |
| bknudson | oh, it's one of the stops | 16:11 |
| stevemar | bknudson, definitely cheaper than a taxi | 16:12 |
| dolphm | wonder how long the train takes | 16:12 |
| stevemar | the shuttle apparently takes 1h | 16:12 |
| stevemar | train is probably on par with that | 16:12 |
| stevemar | train is a few bucks cheaper | 16:13 |
| dolphm | it's a 6 hour walk | 16:13 |
| *** lufix has quit IRC | 16:13 | |
| morganfainberg | dolphm, walking it is then | 16:13 |
| dolphm | i can be there by lunch | 16:13 |
| stevemar | dolphm, landing at 6am? | 16:13 |
| dolphm | stevemar: ish | 16:13 |
| bknudson | at least you'd get to see something | 16:13 |
| bknudson | is there a river taxi? | 16:14 |
| dolphm | google maps is incapable of providing public transit directions | 16:14 |
| stevemar | dolphm, yay i won't be the only one missing the keystone | 16:14 |
| stevemar | dolphm, yeah :( | 16:14 |
| * morganfainberg will be there on Saturday. | 16:14 | |
| stevemar | let alone river taxi directions | 16:14 |
| bknudson | how long is the swim? 6 hours, too? | 16:14 |
| dolphm | same for bong maps | 16:14 |
| gordc | dolphm: there's an express train into city. i don't know why google maps is so useless. | 16:14 |
| lbragstad | ... bong maps? | 16:15 |
| *** Guest88785 is now known as mgagne | 16:15 | |
| dolphm | bing | 16:15 |
| lbragstad | :) | 16:15 |
| stevemar | gordc, oh yeah you've been already | 16:15 |
| stevemar | give me your knowledge! | 16:15 |
| dolphm | gordc: that's what i've heard | 16:15 |
| gordc | 'salut, ca va' | 16:15 |
| gordc | that's it. | 16:15 |
| *** mgagne is now known as Guest63293 | 16:15 | |
| dolphm | gordc: someone told me to take the train from the airport, but i have no idea which one | 16:15 |
| gordc | then walk away | 16:15 |
| stevemar | lies | 16:15 |
| bknudson | je mange un pomme is as far as I've gotten | 16:15 |
| gordc | bbl. grabbing food. | 16:15 |
| openstackgerrit | A change was merged to openstack/keystone-specs: add doc8 validation https://review.openstack.org/128338 | 16:16 |
| *** Guest63293 is now known as mgagne | 16:16 | |
| *** mgagne has joined #openstack-keystone | 16:16 | |
| stevemar | gordc, just drops some knowledge and leaves | 16:16 |
| *** thedodd has joined #openstack-keystone | 16:21 | |
| *** wwriverrat has joined #openstack-keystone | 16:26 | |
| *** wwriverrat1 has joined #openstack-keystone | 16:29 | |
| *** wwriverrat has quit IRC | 16:31 | |
| nkinder | dolphm: when I went 13-14 years ago, the train was the RER B line from CDG into the city. | 16:32 |
| nkinder | They had an "orange card" you could get, which was a week long metro pass and also covered the RER to/from the airport | 16:33 |
| *** afazekas has joined #openstack-keystone | 16:35 | |
| dolphm | nkinder: ooh, i need to look into train passes! thanks for the reminder | 16:36 |
| nkinder | dolphm: looks like the orange card still exists. It worked nicely for me last time | 16:37 |
| raildo | dolphm, I used the martha card in atlanta, what made ​​me save a good money | 16:47 |
| gordc | stevemar: lol that's all the knowledge i know. | 16:47 |
| * gordc is going to get lost. | 16:47 | |
| raildo | I hope it in paris works the same way | 16:47 |
| *** navid_ has joined #openstack-keystone | 16:48 | |
| navid_ | @dolphm | 16:48 |
| *** shakayumi has joined #openstack-keystone | 16:48 | |
| samuelms | dolphm, http://www.ratp.fr/en/ratp/r_61584/tickets/ | 16:49 |
| dolphm | navid_: ? | 16:49 |
| dolphm | samuelms: i'd have to get 3 five day cards, i think :) | 16:50 |
| dolphm | or 3 cards anyway, 11 days | 16:50 |
| samuelms | dolphm, nice | 16:53 |
| samuelms | dolphm, it looks like we can even buy it online | 16:53 |
| *** jistr has quit IRC | 16:53 | |
| raildo | dolphm, 38 euros per 5 days =O | 16:56 |
| marekd | dolphm: you are also arriving on Mondday? | 17:01 |
| *** lhcheng has joined #openstack-keystone | 17:07 | |
| *** harlowja_away is now known as harlowja | 17:13 | |
| morganfainberg | marekd: I think I need to bug you about post summit visit. Best way to get there, etc | 17:13 |
| morganfainberg | And which day makes the most sense. I'll be headed to Lyon for part of my trip this time (post summit) | 17:14 |
| dstanek | in looking at https://review.openstack.org/#/c/111982/1/specs/juno/email-attribute.rst it makes me wonder if we have an PII guidelines | 17:14 |
| marekd | morganfainberg: sure, why don't you drop me an e-mail with some more details: when do you want to come to Geneva/CERN, for how long etc. | 17:15 |
| morganfainberg | dstanek: nope. We should. And it's part of why I am a fan of splitting out identity to its own thing. We can be more restrictive and eliminate PII from being available to the main keystone APIA openstack uses. | 17:15 |
| marekd | morganfainberg: i will then try to advise what's worth seeing and try to organise some cern trips. :-) | 17:15 |
| morganfainberg | marekd: will do. ;) | 17:16 |
| samuelms | morganfainberg, Lyon is a great city .. I've lived there for a year :) | 17:16 |
| *** afazekas has quit IRC | 17:16 | |
| ayoung | morganfainberg here is the first shot at dealing with multiple signers. http://adam.younglogic.com/2014/10/who-can-sign-for-what/ | 17:16 |
| marekd | samuelms: oh, really? | 17:16 |
| marekd | morganfainberg: samuelms: it's indeed nice | 17:16 |
| morganfainberg | I'll only have a day or so in Geneva though. :(. Wish I'd have more but limited time. | 17:16 |
| samuelms | marekd, yes .. it was an exchange year at INSA de Lyon :) | 17:16 |
| marekd | samuelms: where are you from originally? | 17:17 |
| samuelms | marekd, I'm from Brazil | 17:17 |
| marekd | morganfainberg: :(((( so i'd say CERN trip and some of Geneva. | 17:17 |
| morganfainberg | samuelms: Lyon is one of the places I'd move to if I had the chance. | 17:17 |
| marekd | morganfainberg: why? | 17:17 |
| samuelms | morganfainberg, yes .. absolutely, Lyon is amazing | 17:17 |
| morganfainberg | marekd: why Lyon or why limited time? Lyon because I have friends there and it's great. | 17:18 |
| * marekd is wondering if we are talking about the same Lyon :P | 17:18 | |
| marekd | morganfainberg: why Lyon | 17:18 |
| samuelms | hehe | 17:19 |
| marekd | it's nice city but nothing that amazing in my opinion. Maybe that's because i went there for trips only. | 17:19 |
| marekd | morganfainberg: ok, drop me an e-mail, i need to disappear for ~1h. | 17:20 |
| *** david-lyle has joined #openstack-keystone | 17:20 | |
| *** lufix has joined #openstack-keystone | 17:20 | |
| morganfainberg | marekd: will do post meeting. | 17:21 |
| *** david-lyle has quit IRC | 17:29 | |
| *** david-lyle has joined #openstack-keystone | 17:29 | |
| *** lufix has quit IRC | 17:30 | |
| ayoung | dstanek, are bitwise operators the right way to do Boolean logic in python? Like all the &= here https://review.openstack.org/#/c/126897/5/keystone/trust/controllers.py,cm ? | 17:32 |
| dstanek | ayoung: use 'and' and 'or' for boolean logic - bitwise are really for mathematical things | 17:33 |
| ayoung | dstanek, he's doing it to maintain a 'valid' bool using &=. I think the right approach is to throw and exception at each possible failure point anyway | 17:34 |
| ayoung | morganfainberg, now that we have multiple backends for id, and users are cheap, can we say that all oauth consumers are users, and merge trusts and oauth into a single delegation mechanism? Please? | 17:36 |
| ayoung | Heh. "users are cheap" can mean so many things | 17:36 |
| *** david-lyle has quit IRC | 17:39 | |
| dstanek | ayoung: jas on a call | 17:39 |
| navid_ | @dolphm: hi how can i add a review to this https://review.openstack.org/#/c/81166 | 17:39 |
| *** david-lyle has joined #openstack-keystone | 17:39 | |
| ayoung | navid_, hey | 17:39 |
| ayoung | you want to update that review? | 17:40 |
| navid_ | @dolphm: I used this:git remote add gerrit ssh://Navid@review.openstack.org:29418/openstack/python-keystoneclient refs/changes/66/81166/30 | 17:40 |
| navid_ | @ayoung: yes | 17:40 |
| ayoung | navid_, no need for @ in IRC. Here @ is for email addresses | 17:40 |
| ayoung | heh | 17:40 |
| ayoung | navid_, OK, so you probably want to get git-review installed | 17:41 |
| ayoung | yum, apt, or pip all work. | 17:41 |
| ayoung | I think pip is your best bet, as that is the latest | 17:41 |
| navid_ | ayoung: I installed it | 17:42 |
| ayoung | navid_, should just be `git review` after that | 17:42 |
| *** navid_ has quit IRC | 17:42 | |
| morganfainberg | @ayoung, but I like the @ in IRC | 17:43 |
| *** edmondsw has joined #openstack-keystone | 17:43 | |
| rodrigods | lol | 17:43 |
| ayoung | morganfainberg, @ goes after the username, not before | 17:43 |
| rodrigods | hashtags are channels, though =/ | 17:43 |
| ayoung | flipping twits | 17:43 |
| *** navid_ has joined #openstack-keystone | 17:43 | |
| morganfainberg | ayoung@ am I doing it rite? | 17:43 |
| ayoung | yes | 17:43 |
| morganfainberg | ayoung@ great! | 17:44 |
| navid_ | ayoung: then i used git review | 17:45 |
| *** amcrn has joined #openstack-keystone | 17:45 | |
| ayoung | looking. But we should have seen a notification here in channel... | 17:45 |
| ayoung | navid_, anything in your command promp[t to suggest it didn't get sent? | 17:46 |
| morganfainberg | ayoung: only for master changes. If it's any other branch... No notification | 17:46 |
| ayoung | morganfainberg, that should be master | 17:46 |
| morganfainberg | K | 17:47 |
| ayoung | and the review didn't go through, but it is based on a handful of other changes, | 17:47 |
| ayoung | guessing a rebase problem in there somewhere | 17:47 |
| morganfainberg | The bot may also have died. (Happens a lot). But if the change isn't there, that's a diff story. | 17:47 |
| navid_ | ayoung: Errors running git rebase -p -i remotes/gerrit/master Cannot rebase: You have unstaged changes. Please commit or stash them. | 17:47 |
| morganfainberg | Ahh | 17:47 |
| dolphm | navid_: git-review --download <review-number> | 17:47 |
| ayoung | navid_, I couldn't have said that clearer myself: You have unstaged changes. Please commit or stash them. | 17:48 |
| dolphm | navid_: make your changes, git commit --amend, and then git-review to upload a revision | 17:48 |
| ayoung | ++ | 17:48 |
| morganfainberg | ayoung: oauth users are really just federated users. Right? Just not SAML based | 17:50 |
| ayoung | um...well, sort of? | 17:51 |
| ayoung | they are "consumers" not "users" | 17:51 |
| morganfainberg | Sure. | 17:51 |
| ayoung | So, I would treat them as federated users | 17:51 |
| morganfainberg | I meant functionally (not necessarily in keystone) | 17:51 |
| *** aix_ has quit IRC | 17:52 | |
| ayoung | probably should make a dedicated oauth domain and put all of the consumers in their as users | 17:52 |
| ayoung | I mean, they won't go through the Federation token process, cuz they can only get tokens via oauth | 17:52 |
| morganfainberg | Worth thinking about, as long as we don't break the current oauth user workflow. (We made our bed we get to sleep in it) | 17:52 |
| gyee | topol, stevemar, we have no CADF for project creation/deletion? | 17:53 |
| morganfainberg | Ok walking back home/to my desk for the meeting. Might be a minute late or sot starting it. | 17:53 |
| ayoung | morganfainberg, it would only be an issue today if: someone was running both oauth (stored in SQL) and LDAP for identity. | 17:53 |
| ayoung | not multi-backend identyt with LDAP in its own domain | 17:53 |
| stevemar | gyee, just a notification | 17:54 |
| gyee | stevemar, will you object if I add CADF to project? we need it to track billing and metering | 17:55 |
| topol | gyee, did you find me my next work item? | 17:55 |
| topol | gyee sure | 17:55 |
| gyee | topol, please | 17:55 |
| topol | gyee you want it or you want me to do it. or together? | 17:55 |
| stevemar | gyee, why doesn't the regular notification work? (just curious...) | 17:55 |
| stevemar | what info are you auditing? who did the project create/delete? | 17:56 |
| gyee | stevemar, we need end-to-end trace, and CADF is a mechanism | 17:56 |
| gyee | stevemar, yes, we need to know who f it up | 17:56 |
| stevemar | gyee, ain't that always the case, someone f ing something up | 17:56 |
| gyee | :) | 17:57 |
| gyee | but now we have the evidence | 17:57 |
| gyee | via CADF | 17:57 |
| stevemar | exactamundo | 17:58 |
| *** thedodd has quit IRC | 17:58 | |
| *** henrynash has joined #openstack-keystone | 18:00 | |
| rodrigods | amakarov, ping | 18:03 |
| amakarov | rodrigods, pong ) | 18:03 |
| *** browne has joined #openstack-keystone | 18:03 | |
| rodrigods | amakarov, did you see my reply in HM patch? | 18:03 |
| *** d0ugal has quit IRC | 18:04 | |
| amakarov | rodrigods, yes - just have forgotten to commit mine :) look | 18:06 |
| rodrigods | amakarov, ++ | 18:06 |
| *** d0ugal has joined #openstack-keystone | 18:06 | |
| *** d0ugal is now known as Guest86578 | 18:06 | |
| amakarov | rodrigods, I don't know if it's time to change data model like that, but if you want to handle tree structure effectively, you definitely need a way to flatten it somehow | 18:08 |
| amakarov | rodrigods, I know MPTT and MP | 18:08 |
| rodrigods | amakarov, yeah... you are right, the MPTT thing is awesome =) | 18:08 |
| rodrigods | haven't heard about it until your comment | 18:08 |
| amakarov | rodrigods, not always | 18:08 |
| amakarov | rodrigods, it has a performance issue | 18:09 |
| amakarov | rodrigods, updates are heavy | 18:09 |
| rodrigods | amakarov, yeah... really heavy | 18:09 |
| rodrigods | everything in life is a trade off right? =) | 18:09 |
| amakarov | I recommend to google for materialized path | 18:10 |
| amakarov | I used it in a commercial project - it really kicks ass ) | 18:10 |
| rodrigods | will do | 18:10 |
| *** radez is now known as radez_g0n3 | 18:11 | |
| *** afazekas has joined #openstack-keystone | 18:11 | |
| amakarov | rodrigods, since we use mysql as an RDBMS, we can use array field for path with all that bells and whistles like indexes | 18:12 |
| amakarov | same for postgres | 18:12 |
| rodrigods | amakarov, materialized path? | 18:13 |
| * rodrigods not googled yet | 18:13 | |
| amakarov | rodrigods, read my comment in review - i described MP there | 18:15 |
| rodrigods | amakarov, sorry, didn't find the comment explaining | 18:16 |
| amakarov | rodrigods, strange - it's still a draft... | 18:21 |
| *** thedodd has joined #openstack-keystone | 18:22 | |
| amakarov | rodrigods, my mistake ) done. | 18:23 |
| *** afazekas has quit IRC | 18:24 | |
| rodrigods | amakarov, ++ looks better than MPTT, and the update is also trivial | 18:24 |
| rodrigods | amakarov, 1 query to get the subtree, 1 query to get the parents and 1 query to update the tree (project creation) | 18:25 |
| rodrigods | really awesome | 18:25 |
| amakarov | rodrigods, welcome ) | 18:26 |
| *** nkinder is now known as not_jamielennox | 18:34 | |
| *** not_jamielennox is now known as nkinder | 18:37 | |
| *** radez_g0n3 is now known as radez | 18:49 | |
| *** vsilva` is now known as vsilva | 18:51 | |
| morganfainberg | session name: Policy Discussion of Doom, DOOM I say. | 19:00 |
| morganfainberg | i mean ... *shiftyeyes* | 19:00 |
| bknudson | it would be interesting to know from ops if the way openstack does policy meets what they need | 19:01 |
| stevemar | morganfainberg, i'm gonna wrangle up tqtran for the federation/horizon stuff | 19:02 |
| morganfainberg | bknudson, that is a good thing to get into the ops session | 19:02 |
| morganfainberg | topol, ^ | 19:02 |
| morganfainberg | stevemar, great. | 19:02 |
| stevemar | morganfainberg, he's been working with horizon for a while now, and i want him to toss him in the deepend, err.. i mean get his feet wet | 19:03 |
| morganfainberg | stevemar, also poke at david-lyle about that | 19:03 |
| stevemar | fo sho | 19:03 |
| *** shakayumi has quit IRC | 19:04 | |
| *** shakayumi has joined #openstack-keystone | 19:04 | |
| david-lyle | we talkin' policy? | 19:05 |
| stevemar | david-lyle, nah, SSO | 19:05 |
| stevemar | david-lyle, i'm requesting your presence on thursday at the summit, at 9:50 | 19:06 |
| amakarov | morganfainberg, can you please direct me where that fearsome "token problem" described? :) | 19:06 |
| david-lyle | ah, I don't have a very big soap-box for that | 19:06 |
| stevemar | david-lyle, info here https://etherpad.openstack.org/p/kilo-keystone-summit-topics | 19:06 |
| morganfainberg | if you're leading a session (or even if you're not) please feel free to help update the descriptions in the etherpad / goals for a session | 19:06 |
| stevemar | wait a tick... i think thats the time for my talk | 19:06 |
| morganfainberg | stevemar, i'm willing to try and trade someone for a slot if needed. | 19:07 |
| * morganfainberg looks to david-lyle ;) | 19:07 | |
| * david-lyle trying to remember when the horizon slots are | 19:07 | |
| morganfainberg | since keystone/horizon have limited overlap. | 19:07 |
| david-lyle | I think they're all in the PM | 19:07 |
| morganfainberg | ou have 2 morning ones i think | 19:07 |
| * morganfainberg was looking | 19:07 | |
| david-lyle | shows what I know | 19:07 |
| morganfainberg | the goal was to make sure the SSO one didn't overlap | 19:07 |
| stevemar | morganfainberg, nope, i'm going up on wednesday | 19:08 |
| david-lyle | I would appreciate | 19:08 |
| morganfainberg | david-lyle, i'll also make sure the policy one isn't an overlap if at all possible | 19:08 |
| david-lyle | morganfainberg, do you have thierry's link handy? | 19:08 |
| david-lyle | yes please | 19:08 |
| *** marcoemorais has quit IRC | 19:08 | |
| david-lyle | I've been living that pain for some time now | 19:08 |
| morganfainberg | david-lyle, i know you have, thats why i started that convo on the ML | 19:08 |
| david-lyle | trying to get to the ML thread | 19:09 |
| david-lyle | still unburying | 19:09 |
| morganfainberg | it *is* a problem and we need to solve it. | 19:09 |
| * david-lyle I hope this is dirt | 19:09 | |
| david-lyle | ++ | 19:09 |
| lhcheng | stevemar: "keystone to keystone federation" is this something for kilo? | 19:09 |
| stevemar | lhcheng, it's experimental in juno | 19:10 |
| david-lyle | morganfainberg, I'll have a horizon/keystone topic session too | 19:10 |
| stevemar | and the goal is to make it awesome in kilo | 19:10 |
| morganfainberg | david-lyle, ah cool, lets see if we can get those next to each other (ours and yours) | 19:10 |
| morganfainberg | so we can continue the conversation with the same group(s) of people | 19:10 |
| david-lyle | that's my hope | 19:10 |
| morganfainberg | my guess is the policy discussion of doom will be a morning session on Thursday. | 19:11 |
| morganfainberg | just a hunch based on schedules | 19:11 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Encode middleware error message as bytes https://review.openstack.org/123451 | 19:11 |
| lhcheng | stevemar: ++ for making features awesome. | 19:13 |
| morganfainberg | oh ops summit is thursday | 19:13 |
| morganfainberg | doh* | 19:13 |
| david-lyle | well that blows | 19:15 |
| david-lyle | I have 4 Horizon sessions that day | 19:15 |
| morganfainberg | yeah | 19:15 |
| morganfainberg | there is also ops summit on monday | 19:15 |
| morganfainberg | wow that is a *lot* of ops summit | 19:15 |
| *** Guest18588 is now known as mfisch | 19:16 | |
| *** mfisch has joined #openstack-keystone | 19:16 | |
| *** marcoemorais has joined #openstack-keystone | 19:16 | |
| morganfainberg | david-lyle, ok so i think the best bet will be to make the horizon side of the cross-project topic tobe 1430 on tuesday | 19:17 |
| morganfainberg | david-lyle, no overlap, and it will only be a couple sessions apart from the keystone | 19:17 |
| *** _cjones_ has quit IRC | 19:17 | |
| lbragstad | morganfainberg: do you remember seeing something on the Kilo session etherpad about running keystone with different pythons (i.e. jython, pypy, etc?) | 19:17 |
| *** _cjones_ has joined #openstack-keystone | 19:18 | |
| morganfainberg | david-lyle, or i could move the keystone one to the afternoon at 1630 if we really want them to be next to each other | 19:18 |
| morganfainberg | lbragstad, CI. | 19:18 |
| lbragstad | morganfainberg: gotcha, thanks! | 19:18 |
| morganfainberg | lbragstad, i made a comment we should gate on that external CI if possible (e.g. RAX does it) | 19:18 |
| david-lyle | I have thursday morning sessions right after yours, too | 19:20 |
| david-lyle | oops, didn't read back far enough | 19:20 |
| morganfainberg | i really wish sched would let me filter on *two* projects | 19:20 |
| morganfainberg | david-lyle, yeah i want to keep the auth/client/policy discussions for thursday so we can keep them bundled on that day, meaning SSO/federation goes on wed. | 19:22 |
| *** _cjones_ has quit IRC | 19:22 | |
| morganfainberg | david-lyle, ok i'm going to move the keystone ops session to 1720, and the SSO/federation one to the one right after yours | 19:26 |
| morganfainberg | so lets do horizon side 1530 on wed? | 19:26 |
| *** thedodd has quit IRC | 19:27 | |
| *** david-lyle_ has joined #openstack-keystone | 19:29 | |
| stevemar | morganfainberg, on the topic of migrating to graduated oslo libraries, create a spec or no? | 19:30 |
| morganfainberg | stevemar, nah. | 19:30 |
| stevemar | morganfainberg, fair enough | 19:30 |
| *** david-lyle has quit IRC | 19:33 | |
| *** amakarov is now known as amakarov_away | 19:35 | |
| *** david_lyle__ has joined #openstack-keystone | 19:35 | |
| *** thedodd has joined #openstack-keystone | 19:38 | |
| *** david-lyle has joined #openstack-keystone | 19:38 | |
| *** wwriverrat1 has left #openstack-keystone | 19:38 | |
| *** david-lyle_ has quit IRC | 19:39 | |
| *** david_lyle__ has quit IRC | 19:40 | |
| raildo | ayoung, ping | 19:40 |
| ayoung | raildo, sorry, I have notoriously long ping times | 19:42 |
| *** david-lyle_ has joined #openstack-keystone | 19:42 | |
| raildo | ayoung, haha no problem | 19:42 |
| raildo | ayoung, I'm working on the bug to revoke tokens if the IdP is deleted. | 19:43 |
| *** david-lyle has quit IRC | 19:43 | |
| ayoung | yep, and I'm thrilled | 19:44 |
| raildo | We could reproduce the bug and implement a solution | 19:44 |
| *** david_lyle__ has joined #openstack-keystone | 19:44 | |
| raildo | so, we implement the solution here https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/middleware/auth_token.py#L905 | 19:44 |
| raildo | At this point we get the IdP's token and validate it. | 19:45 |
| *** david-lyle has joined #openstack-keystone | 19:46 | |
| raildo | But when we execute any call on openstack client, it does not go through this code | 19:46 |
| raildo | this is not the correct place for this implementation? | 19:46 |
| ayoung | keystoneclient/middleware is not used anywhere anymore | 19:47 |
| *** david-lyle_ has quit IRC | 19:47 | |
| ayoung | its in keystonemiddleware, and it is only for the servers | 19:47 |
| ayoung | morganfainberg, can we remove the python-keystoneclient version of middleware/auth_token.py yet? | 19:47 |
| rodrigods | ayoung, raildo, this was just a PoC, right? | 19:47 |
| rodrigods | to ease the testing | 19:47 |
| ayoung | sure | 19:47 |
| morganfainberg | no | 19:47 |
| *** david-lyle_ has joined #openstack-keystone | 19:47 | |
| morganfainberg | ayoung, likely not until M cycle | 19:47 |
| ayoung | OK | 19:47 |
| ayoung | need to put a message in there "DO NOT USE" | 19:48 |
| morganfainberg | ayoung, there is a deprecation warning iirc | 19:48 |
| ayoung | that too | 19:48 |
| ayoung | raildo, so, the clients never validate tokens anyway | 19:48 |
| ayoung | its only the middleware that validates | 19:49 |
| raildo | ayoung, ok | 19:49 |
| stevemar | bknudson, morganfainberg why is it that when i change this line to oslo.config.generator it breaks everything https://github.com/openstack/keystone/blob/master/tools/config/generate_sample.sh#L124 | 19:49 |
| *** _cjones_ has joined #openstack-keystone | 19:49 | |
| *** david_lyle__ has quit IRC | 19:49 | |
| raildo | ayoung, I will modify the implementation, thank you | 19:49 |
| *** david-lyle has quit IRC | 19:50 | |
| ayoung | tellesnobrega, raildo why isn't this named _list_project_parents https://review.openstack.org/#/c/117785/23/keystone/assignment/core.py,cm | 19:51 |
| *** david_lyle__ has joined #openstack-keystone | 19:51 | |
| ayoung | line 475 | 19:52 |
| rodrigods | ayoung, we are following the pattern in the code | 19:52 |
| rodrigods | check list_projects_in_domain() | 19:52 |
| stevemar | dstanek, dolphm same question for you guys, ^ | 19:52 |
| ayoung | if it is internal, it should be named as such | 19:52 |
| stevemar | morganfainberg, fwiw -> trying to track all this https://etherpad.openstack.org/p/keystone-move-to-oslo-libraries | 19:53 |
| *** david_lyle has joined #openstack-keystone | 19:53 | |
| dstanek | stevemar: i'm not sure, but i remember talk of oslo.config's generator being different in some way | 19:53 |
| rodrigods | ayoung, there is a reason for not being _list_projects_in_domain() ? | 19:53 |
| stevemar | dstanek, seems like a waste to rely on the sycn'ed version when we have the library handy | 19:54 |
| ayoung | rodrigods, not that I am aware of. I suspect it was origianlly not expected to be private | 19:54 |
| *** david-lyle_ has quit IRC | 19:54 | |
| rodrigods | ayoung, ok, so will add the _ | 19:54 |
| ayoung | yeah, I think that is the right change. ask henrynash about the other | 19:55 |
| stevemar | dstanek, errr... it looks like config.py was removed from incubator | 19:55 |
| tellesnobrega | thanks rodrigods | 19:56 |
| stevemar | https://github.com/openstack/oslo-incubator/tree/master/openstack/common | 19:56 |
| *** david_lyle__ has quit IRC | 19:56 | |
| *** david-lyle has joined #openstack-keystone | 19:56 | |
| morganfainberg | stevemar, we have a couple keystoneclient things that need to move to oslo libs from incubator as well | 19:57 |
| stevemar | morganfainberg, yeah, tallying that up now | 19:58 |
| rodrigods | ayoung, is it ok to access an external class private method? | 19:58 |
| rodrigods | like, self.driver._list_project_parents() | 19:58 |
| rodrigods | because their implementation is different for each backend | 19:58 |
| *** david_lyle has quit IRC | 19:59 | |
| stevemar | theres a 'module=install_venv_common' in ksc, but shouldn't that be 'script=tools/install_venv_common' ... | 20:00 |
| ayoung | rodrigods, ah, so this is something called from the drivers? | 20:00 |
| rodrigods | ayoung, yep | 20:01 |
| ayoung | hmmm, no clue. probably OK to leave as is | 20:01 |
| rodrigods | ayoung, ++ | 20:03 |
| lhcheng | not that much, I think the familiar names would be: josh harlow and mark mcclain | 20:03 |
| lhcheng | oops wrong window, (facepalm) | 20:03 |
| *** Kui has joined #openstack-keystone | 20:03 | |
| morganfainberg | dolphm, ok i think we will classify BPs as "priority 'not'" if they need specs | 20:04 |
| *** shakayumi has quit IRC | 20:04 | |
| morganfainberg | dolphm, looks like all the other fields are settable by non-drivers | 20:04 |
| *** shakayumi has joined #openstack-keystone | 20:05 | |
| *** david-lyle has quit IRC | 20:06 | |
| *** edmondsw has quit IRC | 20:13 | |
| *** _cjones_ has quit IRC | 20:16 | |
| *** Kui has quit IRC | 20:16 | |
| *** Kui has joined #openstack-keystone | 20:16 | |
| morganfainberg | stevemar, topol: https://blueprints.launchpad.net/keystone/+spec/cadf-project-operations and https://blueprints.launchpad.net/keystone/+spec/cadf-notifications-everywhere which one wins? | 20:18 |
| *** _cjones_ has joined #openstack-keystone | 20:19 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: try removing oslo.config https://review.openstack.org/128440 | 20:19 |
| *** shakayumi has quit IRC | 20:20 | |
| stevemar | morganfainberg, you decide :P in case the everywhere option isn't popular we can still do projects | 20:20 |
| *** shikui_ has joined #openstack-keystone | 20:20 | |
| *** shakayumi has joined #openstack-keystone | 20:20 | |
| morganfainberg | uh | 20:20 |
| morganfainberg | lets do it as "everywhere" | 20:20 |
| morganfainberg | please merge them / mark topol's as superseded. | 20:21 |
| r1chardj0n3s | ayoung: just FYI, it looks like the CORS middleware is going to be nixed from oslo.middleware and we'll just use a generic 3rd party wsgi middleware, since there's no longer anything OpenStack specific ' | 20:21 |
| dstanek | stevemar: in Keystone i changed it to be explicit about the tools path | 20:21 |
| topol | morganfainberg, works for me | 20:21 |
| ayoung | r1chardj0n3s, do you have a link to the one we are considering? | 20:21 |
| r1chardj0n3s | ayoung: also, the angularjs prototype not using CORS is coming along swimmingly - I'd be interested to know your thoughts about using different auth mechanisms | 20:22 |
| stevemar | dstanek, i tossed up a patch | 20:22 |
| stevemar | https://review.openstack.org/#/c/128440/1/etc/keystone.conf.sample | 20:22 |
| ayoung | r1chardj0n3s, fantastic | 20:22 |
| r1chardj0n3s | ayoung: a quick search found wsgicors, but I've not fully looked at it | 20:22 |
| *** shikui__ has joined #openstack-keystone | 20:23 | |
| ayoung | so there is not an obvious project? | 20:23 |
| r1chardj0n3s | ayoung: https://github.com/r1chardj0n3s/angboard if you have time :) | 20:23 |
| r1chardj0n3s | ayoung: it's the top hit on pypi for wsgi cors middleware, and looks reasonable at first glance | 20:23 |
| *** Kui has quit IRC | 20:23 | |
| ayoung | r1chardj0n3s, you managed to merge Tolkien with Rock Climbing in that project name | 20:23 |
| r1chardj0n3s | ayoung: ;) | 20:23 |
| morganfainberg | stevemar, https://blueprints.launchpad.net/keystone/+spec/openid-connect please revisit and poke at the status of that. | 20:24 |
| r1chardj0n3s | ayoung: (you're the only person so far to make that connection) | 20:24 |
| *** shikui_ has quit IRC | 20:25 | |
| ayoung | http://www.younglogic.com/images/left.png | 20:25 |
| stevemar | morganfainberg, it definitely isn't blocked | 20:25 |
| morganfainberg | gyee, nkinder, ayoung, bknudson, we have this functionality right: https://blueprints.launchpad.net/keystone/+spec/ldap-posixgroup-support | 20:26 |
| ayoung | r1chardj0n3s, I def need to play around with that | 20:27 |
| ayoung | looking | 20:27 |
| *** topol has quit IRC | 20:27 | |
| bknudson | morganfainberg: nope | 20:27 |
| nkinder | morganfainberg: yes, I was using that functionality a few days ago | 20:27 |
| nkinder | well, I was able to use posixGroup with full DN member attributes | 20:27 |
| ayoung | morganfainberg, I think that requires the nested | 20:27 |
| morganfainberg | oh no, i have conflicting answers! HTTP 300 | 20:27 |
| *** Kui has joined #openstack-keystone | 20:28 | |
| nkinder | ah, this is for non-compliant groups that just use uid (like memberUID) | 20:28 |
| bknudson | our ldap implementation expects member to be the full dn | 20:28 |
| morganfainberg | ah | 20:28 |
| nkinder | mine expects full DN too (that's more standard) | 20:28 |
| morganfainberg | i'm going to say we should bug track that *not* bp it. | 20:28 |
| nkinder | morganfainberg: I'll check my installation and evaluate that bug a bit later this afternoon | 20:29 |
| bknudson | it's not a bug, it's working as designed | 20:29 |
| morganfainberg | ok so ... obsoltete not applicable | 20:29 |
| morganfainberg | bknudson, mind commenting and marking the bp as obsoltete | 20:29 |
| morganfainberg | or superseded *doesn't matter which* | 20:30 |
| ayoung | r1chardj0n3s, I thinky you have a type | 20:30 |
| ayoung | typo | 20:30 |
| *** david-lyle has joined #openstack-keystone | 20:30 | |
| bknudson | morganfainberg: why is it obsolete? | 20:30 |
| r1chardj0n3s | ayoung: yus? | 20:30 |
| ayoung | r1chardj0n3s, (install ruby / gem per your operating system) | 20:30 |
| ayoung | gem install compass | 20:30 |
| morganfainberg | bknudson, limited functionality to "close" bps. | 20:30 |
| ayoung | You can't really mean that you've built Ruby into your solution, right? | 20:31 |
| bknudson | morganfainberg: what do I set to mark it obsolete? there's lots of fields here. | 20:31 |
| morganfainberg | bknudson, definition | 20:31 |
| bknudson | morganfainberg: is there a wiki page? | 20:31 |
| r1chardj0n3s | ayoung: unfortunately, rubby and the node.js programming language are where the modern web development toolchain is at :( | 20:31 |
| ayoung | compass for compiled CSS http://compass-style.org/help/ | 20:31 |
| *** shikui__ has quit IRC | 20:31 | |
| morganfainberg | bknudson, LP's fields suck :P | 20:31 |
| morganfainberg | and i can't belive there isn't a "No we don't want this" option in LP | 20:32 |
| ayoung | I understand the need for the node module management | 20:32 |
| ayoung | can we get rid of the ruby? | 20:32 |
| bknudson | morganfainberg: this might be useful... I was just saying that it's not implemented yet. | 20:32 |
| morganfainberg | bknudson, ah ok | 20:32 |
| bknudson | and it doesn't look like anyone is signed up to do it. | 20:32 |
| morganfainberg | right. it's one of those... i want to close-up the BPs so we have something manageable to work from | 20:33 |
| ayoung | r1chardj0n3s, I know that django already has/does something along these lines. If it is just for performance, lets skip that for now | 20:33 |
| r1chardj0n3s | ayoung: ok, so this is a prototype, and if some less-rubby alternative to compass is proposed, sure, but for now, it's the one to use | 20:33 |
| ayoung | is there any real need for compiled css? | 20:33 |
| r1chardj0n3s | ayoung: the compiled css came with the project bootstrapper I used, and I had very little interest in messing about in that dimension of the prototype (also, compiled css can be very handy) | 20:34 |
| *** marcoemorais has quit IRC | 20:35 | |
| r1chardj0n3s | ayoung: basically, I am more interested in other aspects of the prototype, and using a bootstrapper to get the project started meant I didn't have to fart around with irrelevant details under the hood, I could just do the interesting part of the prototype | 20:35 |
| *** marcoemorais has joined #openstack-keystone | 20:35 | |
| morganfainberg | gyee, https://blueprints.launchpad.net/keystone/+spec/service-metadata | 20:35 |
| *** marcoemorais has quit IRC | 20:36 | |
| *** marcoemorais has joined #openstack-keystone | 20:36 | |
| ayoung | r1chardj0n3s, fair enough. Just be aware how complex that pulling in ruby can make the whole scenario | 20:36 |
| *** openstackgerrit has quit IRC | 20:36 | |
| *** marcoemorais has quit IRC | 20:36 | |
| r1chardj0n3s | ayoung: sure, but again: prototype :) | 20:36 |
| *** marcoemorais has joined #openstack-keystone | 20:36 | |
| *** shikui_ has joined #openstack-keystone | 20:37 | |
| ayoung | r1chardj0n3s, Rough Draft == Final Copy | 20:37 |
| r1chardj0n3s | ayoung: <wink> | 20:37 |
| r1chardj0n3s | ayoung: there are some Python tools which purport to do similar things, maybe someone will do the small amount of work to sub one of those in :) | 20:38 |
| *** Kui has quit IRC | 20:38 | |
| gyee | morganfainberg, we can kill that one | 20:39 |
| gyee | that was for quota aggregation and enforcement | 20:39 |
| *** shikui_ has quit IRC | 20:42 | |
| *** andreaf has joined #openstack-keystone | 20:46 | |
| *** nellysmitt has quit IRC | 20:46 | |
| *** nellysmitt has joined #openstack-keystone | 20:47 | |
| morganfainberg | dolphm, gyee, stevemar , ayoung, nkinder, topol, henrynash, dstanek, lbragstad, bknudson, https://review.openstack.org/#/c/116699/ that is the trivial bp guidelines for nova. | 20:47 |
| stevemar | so many checkmarks | 20:47 |
| bknudson | we should document our process, too. | 20:48 |
| morganfainberg | bknudson, +++++ | 20:48 |
| gyee | yes, I like that | 20:49 |
| *** nellysmitt has quit IRC | 20:51 | |
| *** gyee has quit IRC | 20:57 | |
| *** lhcheng has quit IRC | 20:58 | |
| *** lhcheng has joined #openstack-keystone | 20:58 | |
| *** lhcheng has quit IRC | 20:59 | |
| *** lhcheng has joined #openstack-keystone | 20:59 | |
| *** lhcheng has quit IRC | 21:00 | |
| *** lhcheng has joined #openstack-keystone | 21:00 | |
| morganfainberg | bknudson, https://blueprints.launchpad.net/keystone/+spec/v3-extension-adv json-home addresses this right? | 21:02 |
| morganfainberg | or somewhat? | 21:02 |
| *** lhcheng has quit IRC | 21:02 | |
| bknudson | morganfainberg: json-home covers this. | 21:02 |
| morganfainberg | great | 21:02 |
| *** marcoemorais has quit IRC | 21:04 | |
| *** marcoemorais has joined #openstack-keystone | 21:05 | |
| *** andreaf has quit IRC | 21:08 | |
| morganfainberg | dstanek, this is largely implemented right: https://blueprints.launchpad.net/keystone/+spec/more-code-style-automation ? | 21:09 |
| morganfainberg | dstanek, or are we only partially there? | 21:09 |
| *** marekd is now known as marekd|away | 21:09 | |
| * ayoung has that good feeling that comes from realizing a spec is "missing" because it has been approved. | 21:12 | |
| *** zigo has quit IRC | 21:16 | |
| navid_ | ayoung: hi I submitted for review anf i got the following:remote: Resolving deltas: 100% (17/17) remote: Processing changes: updated: 1, refs: 1, done To ssh://Navid@review.openstack.org:29418/openstack/python-keystoneclient * [new branch] HEAD -> refs/publish/master/bp/revocation-event-api | 21:17 |
| *** lhcheng has joined #openstack-keystone | 21:17 | |
| ayoung | navid_, cool | 21:19 |
| *** Kui has joined #openstack-keystone | 21:21 | |
| ayoung | navid_, I'm going to clean up the commit message. Remving the file list etc | 21:21 |
| *** andreaf has joined #openstack-keystone | 21:22 | |
| navid_ | ayoung: I am looking into 2 min tokens, and come back later to ask questions | 21:22 |
| navid_ | ayoung: sorry about that | 21:23 |
| rodrigods | ayoung, https://review.openstack.org/#/c/117785/24/keystone/assignment/core.py those methods weren't necessary at all =) | 21:23 |
| ayoung | navid_, rock on! | 21:23 |
| ayoung | rodrigods, cool | 21:23 |
| *** gyee has joined #openstack-keystone | 21:30 | |
| *** _cjones_ has quit IRC | 21:31 | |
| *** _cjones_ has joined #openstack-keystone | 21:31 | |
| *** _cjones_ has quit IRC | 21:36 | |
| *** _cjones_ has joined #openstack-keystone | 21:36 | |
| *** gordc has quit IRC | 21:38 | |
| *** harlowja is now known as harlowja_away | 21:39 | |
| stevemar | hmm, no automatic notification about client change? | 21:50 |
| ayoung | nkinder, what was the commit for openstack client that I need to have for the auth plugins? | 21:52 |
| ayoung | 0c77a9fe8baa4df9ea2d0055db9c700af3cae310 Support for keystone auth plugins | 21:52 |
| ayoung | ? | 21:52 |
| nkinder | ayoung: https://review.openstack.org/#/c/108325/ | 21:52 |
| ayoung | nkinder, good. I have that...testing now | 21:52 |
| *** morganfainberg has left #openstack-keystone | 21:53 | |
| *** morganfainberg has joined #openstack-keystone | 21:53 | |
| ayoung | and after rebasing I get | 21:54 |
| ayoung | $openstack hypervisor list | 21:54 |
| ayoung | ERROR: openstack 'Namespace' object has no attribute 'os_auth_plugin' | 21:54 |
| *** ChanServ sets mode: +o morganfainberg | 21:54 | |
| *** morganfainberg changes topic to "Now open for Kilo development! Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Tentative Keystone Design Session Schedule: https://etherpad.openstack.org/p/kilo-keystone-summit-topics" | 21:54 | |
| ayoung | ERROR: openstack SSL exception connecting to https://ayoungf20packstack.cloudlab.freeipa.org/keystone/main/v2.0/tokens | 21:54 |
| *** ChanServ sets mode: -o morganfainberg | 21:54 | |
| ayoung | better...I think | 21:54 |
| stevemar | bknudson, morganfainberg does this change make sense? https://review.openstack.org/#/c/128455/ | 21:55 |
| morganfainberg | stevemar, does that work? | 21:56 |
| stevemar | morganfainberg, it works in keystone server | 21:56 |
| morganfainberg | sure then... seems reasonable | 21:57 |
| stevemar | https://github.com/openstack/keystone/blob/master/openstack-common.conf | 21:57 |
| morganfainberg | to me | 21:57 |
| ayoung | openstack: error: argument --os-auth-plugin: invalid choice: 'kerberos' (choose from 'v2token', 'v2password', 'v3password', 'v3scopedsaml', 'v3unscopedadfs', 'token', 'v3token', 'password', 'v3unscopedsaml') | 21:57 |
| gyee | stevemar, do you have a nice slide/picture on K2K? | 21:57 |
| stevemar | gyee, i can share something with you on google docs if you PM your gmail address | 21:58 |
| dstanek | morganfainberg: partially right now, i think i got halfway through the list | 22:01 |
| morganfainberg | dstanek, ah | 22:01 |
| stevemar | marekd|away, great job on the slides! | 22:02 |
| *** ayoung has quit IRC | 22:03 | |
| *** dims_ has joined #openstack-keystone | 22:04 | |
| dstanek | morganfainberg: i actually had duplicate blueprints | 22:05 |
| morganfainberg | dstanek, you close one out then? | 22:05 |
| *** dims_ has quit IRC | 22:06 | |
| dstanek | morganfainberg: yes | 22:06 |
| *** dims_ has joined #openstack-keystone | 22:07 | |
| *** dims has quit IRC | 22:07 | |
| dstanek | morganfainberg: i abandoned the reviews for this since nobody seems to want this anymore - should this be a priority 'Not'? | 22:09 |
| morganfainberg | dstanek, either "not" or we can close the BP completly | 22:10 |
| morganfainberg | dstanek, your call | 22:10 |
| dstanek | morganfainberg: if it's closed is it still viewable/searchable? | 22:11 |
| morganfainberg | dstanek, no. | 22:11 |
| morganfainberg | dstanek, bps become hard to find when closed completly | 22:11 |
| morganfainberg | dstanek, i think this is where whishlist bugs win out | 22:11 |
| *** dims_ has quit IRC | 22:12 | |
| dstanek | too bad there isn't a 'convert to bug' button - i'll make as not for now and close it out next week if there is no feedback | 22:13 |
| dstanek | morganfainberg: does anyone have access to restore it if we want it back after closing? | 22:13 |
| *** jorge_munoz has quit IRC | 22:13 | |
| morganfainberg | dstanek, if you go directly to the bp link, we can change the status (anyone really can) | 22:13 |
| morganfainberg | not even restricted to keystone drivers it looks like | 22:14 |
| dstanek | ok, cool - i have a note to close after next week's meeting | 22:16 |
| morganfainberg | thnx | 22:16 |
| morganfainberg | i've cleaned up a bunch of bps (we had a bunch of duplicates) | 22:17 |
| morganfainberg | among other things | 22:17 |
| *** henrynash has quit IRC | 22:18 | |
| nkinder | morganfainberg: so this bp is valid still - https://blueprints.launchpad.net/keystone/+spec/ldap-posixgroup-support | 22:19 |
| nkinder | morganfainberg: but it's not a high priority. Most people are using groupOfNames or similar, where the member attribute is a full DN | 22:19 |
| *** dims has joined #openstack-keystone | 22:19 | |
| morganfainberg | nkinder, ok, now the question is, it is a BP or wishlist bug? | 22:20 |
| nkinder | morganfainberg: but this feature adds flexibility | 22:20 |
| morganfainberg | or something else | 22:20 |
| morganfainberg | i'll mark it as priority "not" pending approval | 22:20 |
| morganfainberg | we can revisit | 22:20 |
| nkinder | morganfainberg: well, I think we'd welcome this if someone wanted to contribute it | 22:21 |
| morganfainberg | right. | 22:21 |
| nkinder | morganfainberg: but I don't see a reason to focus on it | 22:21 |
| morganfainberg | sounds good | 22:21 |
| *** stevemar has quit IRC | 22:21 | |
| *** dims is now known as dimsum_ | 22:22 | |
| *** dimsum_ is now known as dims | 22:22 | |
| *** dims has quit IRC | 22:22 | |
| *** dims has joined #openstack-keystone | 22:23 | |
| *** harlowja_away is now known as harlowja | 22:25 | |
| *** andreaf has quit IRC | 22:27 | |
| *** andreaf has joined #openstack-keystone | 22:28 | |
| *** ChanServ sets mode: +o morganfainberg | 22:46 | |
| *** thedodd has quit IRC | 22:47 | |
| *** browne has quit IRC | 23:00 | |
| *** openstackgerrit has joined #openstack-keystone | 23:01 | |
| *** amerine has quit IRC | 23:04 | |
| *** amerine has joined #openstack-keystone | 23:05 | |
| *** dims has quit IRC | 23:12 | |
| *** dims has joined #openstack-keystone | 23:13 | |
| *** zzzeek has quit IRC | 23:21 | |
| *** dims has quit IRC | 23:22 | |
| *** marcoemorais has quit IRC | 23:23 | |
| *** david-lyle has quit IRC | 23:24 | |
| *** marcoemorais has joined #openstack-keystone | 23:24 | |
| *** marcoemorais has quit IRC | 23:24 | |
| *** marcoemorais has joined #openstack-keystone | 23:24 | |
| *** andreaf has quit IRC | 23:41 | |
| *** andreaf has joined #openstack-keystone | 23:42 | |
| *** amerine has quit IRC | 23:47 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:51 | |
| *** amerine has joined #openstack-keystone | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
