| *** cjellick has quit IRC | 00:00 | |
| *** zzzeek has quit IRC | 00:03 | |
| *** marcoemorais has quit IRC | 00:07 | |
| *** marcoemorais1 has joined #openstack-keystone | 00:07 | |
| *** gokrokve has quit IRC | 00:09 | |
| *** gokrokve has joined #openstack-keystone | 00:09 | |
| *** marcoemorais1 has quit IRC | 00:10 | |
| *** marcoemorais has joined #openstack-keystone | 00:11 | |
| *** gokrokve has quit IRC | 00:22 | |
| *** gokrokve has joined #openstack-keystone | 00:24 | |
| *** bknudson has joined #openstack-keystone | 00:27 | |
| *** david_lyle__ has joined #openstack-keystone | 00:30 | |
| *** raildo_ has joined #openstack-keystone | 00:30 | |
| *** david_lyle__ is now known as david_lyle | 00:31 | |
| *** bknudson has quit IRC | 00:31 | |
| *** david-lyle_ has quit IRC | 00:33 | |
| *** marcoemorais has quit IRC | 00:35 | |
| *** marcoemorais has joined #openstack-keystone | 00:36 | |
| *** marcoemorais has quit IRC | 00:37 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move unit tests from test_backend_ldap https://review.openstack.org/119928 | 00:38 |
|---|---|---|
| *** raildo_ has quit IRC | 00:42 | |
| *** jacer_huawei has joined #openstack-keystone | 00:45 | |
| *** bknudson has joined #openstack-keystone | 00:48 | |
| *** gokrokve_ has joined #openstack-keystone | 00:51 | |
| *** gokrokve_ has quit IRC | 00:51 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Remove string from URL in list_revoke_events() https://review.openstack.org/130408 | 00:51 |
| *** gokrokve_ has joined #openstack-keystone | 00:52 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Remove string from URL in list_revoke_events() https://review.openstack.org/130408 | 00:53 |
| *** gokrokve has quit IRC | 00:53 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 01:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 01:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 01:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 01:01 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change occurrences of keystone to identity server https://review.openstack.org/127062 | 01:02 |
| *** _cjones_ has quit IRC | 01:02 | |
| *** _cjones_ has joined #openstack-keystone | 01:03 | |
| *** raildo_ has joined #openstack-keystone | 01:05 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Improves feedback message in SSL error https://review.openstack.org/129769 | 01:06 |
| *** _cjones_ has quit IRC | 01:07 | |
| *** gokrokve_ has quit IRC | 01:07 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 01:18 | |
| *** gokrokve has joined #openstack-keystone | 01:20 | |
| *** gokrokve has quit IRC | 01:24 | |
| *** stevemar has joined #openstack-keystone | 01:26 | |
| *** gokrokve_ has joined #openstack-keystone | 01:27 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Improves feedback message in SSL error https://review.openstack.org/129769 | 01:39 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/130320 | 01:39 |
| openstackgerrit | A change was merged to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/130126 | 01:39 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:43 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/126679 | 01:49 |
| *** dims has quit IRC | 01:58 | |
| *** dims has joined #openstack-keystone | 01:58 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Remove string from URL in list_revoke_events() https://review.openstack.org/130408 | 01:59 |
| *** tellesnobrega has quit IRC | 02:00 | |
| *** gokrokve has joined #openstack-keystone | 02:01 | |
| *** gokrokve has quit IRC | 02:01 | |
| *** dims has quit IRC | 02:03 | |
| *** richm has quit IRC | 02:03 | |
| *** gokrokve_ has quit IRC | 02:04 | |
| *** diegows has joined #openstack-keystone | 02:04 | |
| *** nkinder has joined #openstack-keystone | 02:07 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Remove string from URL in list_revoke_events() https://review.openstack.org/130408 | 02:13 |
| *** lhcheng has quit IRC | 02:23 | |
| *** david_lyle has quit IRC | 02:24 | |
| *** david-lyle has joined #openstack-keystone | 02:25 | |
| *** lhcheng has joined #openstack-keystone | 02:32 | |
| *** diegows has quit IRC | 02:34 | |
| *** alex_xu has joined #openstack-keystone | 02:35 | |
| *** tellesnobrega has joined #openstack-keystone | 03:02 | |
| *** _cjones_ has joined #openstack-keystone | 03:04 | |
| *** raildo_ has quit IRC | 03:05 | |
| *** lhcheng has quit IRC | 03:15 | |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 03:16 | |
| *** r-daneel has joined #openstack-keystone | 03:22 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:23 | |
| *** _cjones_ has quit IRC | 03:28 | |
| *** _cjones_ has joined #openstack-keystone | 03:28 | |
| *** r-daneel has quit IRC | 03:30 | |
| *** zzzeek has joined #openstack-keystone | 03:36 | |
| *** harlowja is now known as harlowja_away | 03:39 | |
| *** gokrokve has joined #openstack-keystone | 03:49 | |
| *** gokrokve has quit IRC | 04:02 | |
| *** gokrokve has joined #openstack-keystone | 04:02 | |
| *** topol has joined #openstack-keystone | 04:03 | |
| *** gokrokve has quit IRC | 04:07 | |
| *** wwriverrat has joined #openstack-keystone | 04:10 | |
| *** wwriverrat has left #openstack-keystone | 04:11 | |
| *** lhcheng has joined #openstack-keystone | 04:11 | |
| *** alee has quit IRC | 04:12 | |
| *** alee has joined #openstack-keystone | 04:12 | |
| *** lhcheng_ has joined #openstack-keystone | 04:13 | |
| *** lhcheng has quit IRC | 04:15 | |
| *** lhcheng_ is now known as lhcheng | 04:15 | |
| *** soulxu_ has joined #openstack-keystone | 04:34 | |
| *** alex_xu has quit IRC | 04:37 | |
| *** marcoemorais has joined #openstack-keystone | 04:38 | |
| *** soulxu__ has joined #openstack-keystone | 04:39 | |
| *** marcoemorais1 has joined #openstack-keystone | 04:40 | |
| *** soulxu_ has quit IRC | 04:43 | |
| *** marcoemorais has quit IRC | 04:43 | |
| *** soulxu_ has joined #openstack-keystone | 04:45 | |
| *** _cjones_ has quit IRC | 04:47 | |
| *** _cjones_ has joined #openstack-keystone | 04:48 | |
| *** soulxu__ has quit IRC | 04:48 | |
| *** mrmoje has joined #openstack-keystone | 04:52 | |
| *** alex_xu has joined #openstack-keystone | 04:52 | |
| *** _cjones_ has quit IRC | 04:52 | |
| *** soulxu_ has quit IRC | 04:54 | |
| *** stevemar has quit IRC | 04:55 | |
| *** stevemar has joined #openstack-keystone | 04:56 | |
| *** lhcheng_ has joined #openstack-keystone | 04:57 | |
| *** lhcheng has quit IRC | 04:57 | |
| *** lhcheng_ is now known as lhcheng | 04:57 | |
| *** soulxu_ has joined #openstack-keystone | 04:58 | |
| *** alex_xu has quit IRC | 05:02 | |
| *** gokrokve has joined #openstack-keystone | 05:03 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 05:03 |
| *** soulxu__ has joined #openstack-keystone | 05:04 | |
| *** lhcheng has quit IRC | 05:05 | |
| *** lhcheng has joined #openstack-keystone | 05:06 | |
| *** gokrokve has quit IRC | 05:08 | |
| *** soulxu_ has quit IRC | 05:08 | |
| *** stevemar has quit IRC | 05:13 | |
| *** dims has joined #openstack-keystone | 05:25 | |
| *** soulxu_ has joined #openstack-keystone | 05:27 | |
| *** soulxu__ has quit IRC | 05:30 | |
| *** dims has quit IRC | 05:30 | |
| *** mrmoje has quit IRC | 06:01 | |
| *** lhcheng has quit IRC | 06:03 | |
| *** gokrokve has joined #openstack-keystone | 06:04 | |
| *** lsmola has quit IRC | 06:11 | |
| *** openstack has joined #openstack-keystone | 06:12 | |
| *** openstackstatus has quit IRC | 06:12 | |
| *** gokrokve has quit IRC | 06:15 | |
| *** breton_ has joined #openstack-keystone | 06:15 | |
| *** breton has quit IRC | 06:15 | |
| *** amcrn has quit IRC | 06:15 | |
| *** lsmola has joined #openstack-keystone | 06:20 | |
| *** zzzeek has quit IRC | 06:22 | |
| *** ukalifon1 has joined #openstack-keystone | 06:27 | |
| *** _cjones_ has joined #openstack-keystone | 06:42 | |
| *** bjornar has quit IRC | 06:46 | |
| *** tellesnobrega has quit IRC | 06:46 | |
| *** tellesnobrega has joined #openstack-keystone | 06:47 | |
| *** openstack has quit IRC | 06:59 | |
| *** openstack has joined #openstack-keystone | 14:17 | |
| jamielennox | marekd: yea, that's what i was seeing - which makes the wrapper kind of weird because you can't use the options list to figure out which params belong to which plugins | 14:17 |
| *** openstackstatus has joined #openstack-keystone | 14:18 | |
| *** ChanServ sets mode: +v openstackstatus | 14:18 | |
| *** joesavak has joined #openstack-keystone | 14:19 | |
| marekd | jamielennox: because most of the plugins do and will in the future share the same set of required options. | 14:19 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:19 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:19 | |
| ayoung | jamielennox, yeah, I have a simliar problem, where the Kerberos plugin basically ignores userid and password, but OSC requires values there | 14:19 |
| ayoung | the kerberos one really only needs auth_url | 14:20 |
| jamielennox | ayoung: that's an OSC issue though, not one of mine | 14:20 |
| jamielennox | i'm pretty sure anyway | 14:20 |
| ayoung | right, its how they are using oslo config, if I understand the code | 14:20 |
| ayoung | jamielennox, it needs to do something like : if no --os-auth-plugin assume --os-auth-plugin v3password and get the params from there, I think | 14:21 |
| ayoung | pretty soon we'll be reinventing SASL | 14:21 |
| jamielennox | marekd: you're going to hate this, but i think it might be easier just to fix the BaseSaml class to handle scoping there | 14:24 |
| marekd | jamielennox: hm, more details? | 14:26 |
| marekd | the problem is wih unscoped/scoped plugins or the wrapper? | 14:26 |
| jamielennox | marekd: so the structure of the two federated plugins is really similar | 14:26 |
| jamielennox | ADFS and unscoped essentially share the same get_auth_ref method | 14:27 |
| jamielennox | and they already report scoping options | 14:27 |
| marekd | well, get_auth_ref is completely different | 14:27 |
| marekd | different messages passed, different workflow | 14:27 |
| jamielennox | right, what happens is different, but the kick off is exactly the same | 14:27 |
| jamielennox | if we make the base class an Abstract | 14:28 |
| jamielennox | have a common get_auth_ref handler that calls out to the abstract method | 14:28 |
| *** gokrokve has quit IRC | 14:28 | |
| jamielennox | then we can handle the scoping data in get_auth_ref and the plugins work just like the regular keystoneclient ones | 14:28 |
| marekd | so i'd use it --os-auth-plugin v3adfs --username x --password y --project_id X and have scoped token in the end? | 14:29 |
| marekd | and unscoped token in case i don't provide project_id? | 14:30 |
| marekd | because at first call i might not now my projcts and would like to utilize /OS-FEDERATION/projects call to find out. | 14:30 |
| jamielennox | marekd: in which case your flow is no different to password | 14:32 |
| jamielennox | bah, other than we need that stupid Saml specific token scoping thing | 14:32 |
| jamielennox | but close | 14:32 |
| marekd | ayoung: i see you managed to catch up today with your today's e-mails :-) | 14:33 |
| ayoung | I skipped a few | 14:33 |
| marekd | jamielennox: hm, so maybe we can propose code in keystone that will accept os-federation tokens with 'token' auth method..it will simply distinguish an proceed accordingly | 14:33 |
| jamielennox | marekd: ++ oh please god yes | 14:34 |
| jamielennox | i thought there was a technical reason we couldn't do that? | 14:34 |
| *** henrynash has joined #openstack-keystone | 14:35 | |
| marekd | instead of doing if token.is_federated(): handle_federated() else: handle_classic() we did if method == 'saml2': handle_federated() else: handle_classic() | 14:36 |
| *** gokrokve has joined #openstack-keystone | 14:37 | |
| *** gokrokve has quit IRC | 14:39 | |
| jamielennox | marekd: that makes me want to cry | 14:41 |
| jamielennox | all of this work around stuff is because a federated unscoped token was somehow different to a regular unscoped token | 14:42 |
| jamielennox | i didn't realize it was just a case of where a switch was implemented | 14:42 |
| marekd | i hit me just now too | 14:42 |
| marekd | it* | 14:42 |
| *** vb has joined #openstack-keystone | 14:43 | |
| jamielennox | marekd: if that's doable - please fix it | 14:43 |
| marekd | jamielennox: ok | 14:44 |
| *** henrynash has quit IRC | 14:44 | |
| rodrigods | lbragstad, ping | 14:45 |
| *** diegows has joined #openstack-keystone | 14:45 | |
| bknudson | the method shouldn't be hardcoded to a specific string. | 14:46 |
| lbragstad | rodrigods: pong | 14:47 |
| *** david-lyle has joined #openstack-keystone | 14:47 | |
| rodrigods | lbragstad, the XML removal will fix the issue? | 14:47 |
| rodrigods | (get IdP metadata) | 14:47 |
| rodrigods | or at least, should it fix? | 14:48 |
| lbragstad | rodrigods: I'm not 100% sure, I just noticed you mentioned the deprecation and I posted the link for reference, in case anyone was digging for it. | 14:48 |
| marekd | bknudson: no no, it was not hardcoded. by using saml2 in 'method' attribute in a token Keystone was simply loading saml2 plugin from auth/plugins | 14:48 |
| rodrigods | lbragstad, will apply the review and see what happens =) | 14:49 |
| lbragstad | rodrigods: cool, let me know how it goes | 14:49 |
| rodrigods | lbragstad, ++ | 14:49 |
| *** Gippa has quit IRC | 14:51 | |
| *** david-lyle has quit IRC | 14:51 | |
| *** Gippa has joined #openstack-keystone | 14:52 | |
| *** vejdmn has quit IRC | 14:53 | |
| *** vejdmn has joined #openstack-keystone | 14:53 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Deprecates catalog substitution from config files https://review.openstack.org/130013 | 14:53 |
| *** david-lyle has joined #openstack-keystone | 14:53 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Create a framework for federation plugins https://review.openstack.org/130564 | 14:56 |
| jamielennox | marekd: have a look at ^, does it work? | 14:56 |
| *** thedodd has joined #openstack-keystone | 14:57 | |
| ayoung | dstanek, how dare you clean up crappy code in a deprecation patch! | 14:59 |
| *** afazekas has quit IRC | 14:59 | |
| marekd | jamielennox: looking. sorry i am doing 10 thing at the same time :( | 15:00 |
| dstanek | ayoung: sorry, but it's so fun | 15:00 |
| *** henrynash has joined #openstack-keystone | 15:03 | |
| *** gokrokve has joined #openstack-keystone | 15:05 | |
| *** ukalifon2 has quit IRC | 15:07 | |
| *** openstackgerrit has quit IRC | 15:07 | |
| *** joesavak has quit IRC | 15:08 | |
| lbragstad | bknudson: dstanek I have the tests passing here https://review.openstack.org/#/c/125738/ | 15:16 |
| bknudson | lbragstad: I was going to run the coverage test on this change and without it to see if there's any more lines skipped. | 15:16 |
| lbragstad | bknudson: ok | 15:17 |
| bknudson | actually the coverage is probably better since I'm sure some there were some untested things in there. | 15:17 |
| *** afazekas has joined #openstack-keystone | 15:17 | |
| lbragstad | bknudson: yeah, that's a good point | 15:17 |
| lbragstad | I'm not entirely sure what the coverage was on the XML cases | 15:17 |
| mfisch | is the revoke driver really deprecated in J? because it's still the default | 15:31 |
| mfisch | Deprecated: keystone.contrib.revoke.backends.kvs is deprecated as of Juno in favor of keystone.contrib.revoke.backends.sql and may be removed in Kilo. | 15:31 |
| *** henrynash has quit IRC | 15:31 | |
| marekd | jamielennox: works basically, needed to add two fixes but it worked. | 15:33 |
| marekd | jamielennox: uploading new patchset. | 15:33 |
| jamielennox | marekd: yea, i think there is an edge case or two i'm missing - and also some cleanup that can be don | 15:35 |
| *** cjellick has joined #openstack-keystone | 15:37 | |
| marekd | hm, do you think classes can be renamed? | 15:38 |
| marekd | or it will not be backwards compatible | 15:38 |
| marekd | from ADFSUnscopedToken to ADFSToken | 15:38 |
| *** marcoemorais has joined #openstack-keystone | 15:43 | |
| jamielennox | I think we should | 15:47 |
| jamielennox | or maybe we move them to the new -federated repo with the new names | 15:47 |
| jamielennox | marekd: there is some cleanup i'd like to do having poked around there for a bit, so maybe the cleaned up version can be the start of the new repo | 15:48 |
| marekd | jamielennox: uhm | 15:49 |
| jamielennox | well, we can copy it across directly now and then do stuff there | 15:53 |
| jamielennox | nothing i was looking at would be a compatibility problem, just a few things you don't need | 15:53 |
| *** gyee has joined #openstack-keystone | 15:58 | |
| *** openstack has joined #openstack-keystone | 16:01 | |
| jamielennox | bknudson: using https://review.openstack.org/#/c/129552/ i have devstack set up with some things running v3 auth and some using default auth | 16:06 |
| jamielennox | it's a longer chain than i though it would be, and there are some missing tests as you get higher up - but if you want to have a look | 16:06 |
| *** joesavak has joined #openstack-keystone | 16:07 | |
| jamielennox | alright, cya everyone | 16:08 |
| amakarov | jamielennox, good day to you! Please take a look https://review.openstack.org/#/c/125923/ I've reproduced the bug in devstack environment: client receives unexpected structure | 16:09 |
| marekd | jamielennox: cheers | 16:10 |
| amakarov | jamielennox, fixture for v3 tests does not match actual data structure | 16:10 |
| jamielennox | amakarov: in the bug you create a new nova service on a devstack deployment | 16:11 |
| jamielennox | this is my point, why not service-list and use the existing one | 16:11 |
| *** thedodd has quit IRC | 16:11 | |
| bknudson | jamielennox: did you update devstack to allow you to configure v3 auth? | 16:11 |
| bknudson | in middleware | 16:12 |
| jamielennox | no, i killed the n-api service from screen, editted the config file and then restarted the service | 16:13 |
| jamielennox | i'm not sure how we setup devstack to allow multiple config sections yet | 16:14 |
| amakarov | jamielennox, so it have to be an error if I create a new service? | 16:18 |
| amakarov | s/have/has | 16:18 |
| jamielennox | amakarov: given that it's an error now i would like to be really certain it's something we want before we let the code do it | 16:18 |
| jamielennox | because once we allow it in code we're stuck with it, and i see no reason for it to be allowed | 16:19 |
| jamielennox | amakarov: i'm still not sure why it's something you would want? | 16:20 |
| *** lhcheng has joined #openstack-keystone | 16:20 | |
| *** amerine has quit IRC | 16:20 | |
| *** amerine has joined #openstack-keystone | 16:21 | |
| amakarov | jamielennox, there was a task to create a new nova region. V2 accepted both service and region creation, V2 returns correct endpoint while V3 does not | 16:23 |
| lhcheng | rodrigods: ping | 16:24 |
| *** _cjones_ has joined #openstack-keystone | 16:25 | |
| amakarov | jamielennox, so it's an inconsistency. Or it must be explicitly forbidden to create a service with existing name/type | 16:26 |
| jamielennox | amakarov: i would vote for it should be explicitly forbidden | 16:26 |
| jamielennox | is this an internal task? what does v3 return that is different | 16:27 |
| jamielennox | because using OSC and v3 api you still seperate services from endpoints | 16:28 |
| amakarov | jamielennox, endpoint for one of regions is returned in v2 and lost in v3 | 16:28 |
| amakarov | I reproduced it using devstack - not any custom build | 16:30 |
| amakarov | jamielennox, here is one more thing: somebody else may use this bug/feature on v2 | 16:32 |
| jamielennox | amakarov: just trying to see how it could happen as that code you link to is common to both the v2 and the v3 catalog | 16:33 |
| amakarov | jamielennox, through ulr_for call | 16:34 |
| amakarov | s/ulr_for/url_for | 16:34 |
| jamielennox | why does keystone --debug no longer print the requests/responses? | 16:35 |
| jamielennox | or openstack --debug | 16:35 |
| *** marekd is now known as marekd|away | 16:35 | |
| *** vejdmn has quit IRC | 16:36 | |
| *** vejdmn1 has joined #openstack-keystone | 16:36 | |
| *** jsavak has joined #openstack-keystone | 16:36 | |
| morganfainberg | mornin | 16:37 |
| amakarov | jamielennox, maybe debug=False somewhere in config_overrides? | 16:38 |
| amakarov | jamielennox, btw we may make "service create" to return existing one if any... | 16:39 |
| jamielennox | amakarov: you would have to test name and description etc for an exact match | 16:40 |
| *** joesavak has quit IRC | 16:40 | |
| amakarov | jamielennox, got it. Better simply forbid | 16:41 |
| jamielennox | amakarov: ok, so this is the test file i'm looking at: http://paste.openstack.org/show/123627/ | 16:47 |
| *** vb has quit IRC | 16:48 | |
| jamielennox | a v2 token and a v3 token each with 2 equivalent service catalogs, containing 2 nova services | 16:48 |
| *** openstackgerrit has joined #openstack-keystone | 16:49 | |
| amakarov | jamielennox, yes that is the difference | 16:50 |
| amakarov | in v3 first endpoint will be lost | 16:51 |
| jamielennox | amakarov: right, but it could never have been found | 16:52 |
| amakarov | jamielennox, unless there are different regions | 16:53 |
| jamielennox | if the argument is that you should be able to list it twice then i disagree and we can debate it | 16:53 |
| jamielennox | my issue is if there is a difference from v2 to v3 | 16:53 |
| *** afazekas is now known as _afazekas | 16:53 | |
| jamielennox | so just tried that as well: http://paste.openstack.org/show/123633/ | 16:53 |
| jamielennox | gives Traceback (most recent call last): | 16:54 |
| jamielennox | File "t.py", line 33, in <module> | 16:54 |
| jamielennox | print "nova endpoint, region1", auth_ref2.service_catalog.url_for(service_type='nova', region_name='region1') | 16:54 |
| jamielennox | File "/home/jlennox/work/python-keystoneclient/keystoneclient/utils.py", line 318, in inner | 16:54 |
| jamielennox | return func(*args, **kwargs) | 16:54 |
| jamielennox | File "/home/jlennox/work/python-keystoneclient/keystoneclient/service_catalog.py", line 231, in url_for | 16:54 |
| jamielennox | raise exceptions.EndpointNotFound(msg) | 16:54 |
| jamielennox | keystoneclient.openstack.common.apiclient.exceptions.EndpointNotFound: publicURL endpoint for nova service in region1 region not found | 16:54 |
| jamielennox | so again, can't be found on v2 either | 16:54 |
| *** stevemar has joined #openstack-keystone | 16:55 | |
| *** jistr has quit IRC | 16:57 | |
| *** amcrn has joined #openstack-keystone | 16:57 | |
| *** afazekas has joined #openstack-keystone | 16:57 | |
| jamielennox | amakarov: alright, i've gotta go | 16:58 |
| jamielennox | amakarov: if you can modify that to show me an example where v2 does something that v3 doesn't then thats a bug | 16:58 |
| jamielennox | pop it into an email jamielennox@redhat.com because our IRC times are syncing up well | 16:59 |
| *** amcrn has quit IRC | 16:59 | |
| jamielennox | night! | 16:59 |
| jamielennox | s/are/aren't | 16:59 |
| amakarov | jamielennox, well, thanks - I'll dig this deeper ) | 16:59 |
| jamielennox | np | 17:00 |
| *** david-lyle has quit IRC | 17:03 | |
| *** david-lyle has joined #openstack-keystone | 17:03 | |
| *** alee is now known as alee_lunch | 17:07 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:10 | |
| *** thedodd has joined #openstack-keystone | 17:11 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: set close_fds=True in Popen https://review.openstack.org/129456 | 17:12 |
| morganfainberg | dolphm, ok going to see about getting a release cut here. | 17:12 |
| dolphm | morganfainberg: ++ | 17:12 |
| dolphm | jamielennox: unless there's some reason not to release ksc soon ^ | 17:12 |
| morganfainberg | dolphm, looks like we have *mostly* minor fixes | 17:14 |
| morganfainberg | https://bugs.launchpad.net/python-keystoneclient/?field.searchtext=&orderby=-importance&field.status%3Alist=FIXCOMMITTED | 17:15 |
| * morganfainberg debates making this 0.11.2 | 17:15 | |
| *** packet has joined #openstack-keystone | 17:16 | |
| dolphm | morganfainberg: i was crossing my fingers it could be a 0.0.1 release | 17:17 |
| morganfainberg | looks like it can be | 17:18 |
| dolphm | morganfainberg: i think you can definitely go either way | 17:18 |
| morganfainberg | i'd like to keep it 0.0.1 releass | 17:18 |
| bknudson | no new api so .1 | 17:18 |
| morganfainberg | this is really just minor fixes/bug fixes | 17:19 |
| morganfainberg | hmm. | 17:19 |
| morganfainberg | ok where do i register a new milestone? | 17:19 |
| dolphm | morganfainberg: Create milestone https://launchpad.net/python-keystoneclient/0.x.x | 17:19 |
| morganfainberg | i don't have that button | 17:20 |
| dolphm | uh oh | 17:20 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 17:20 | |
| dolphm | morganfainberg: how about now? | 17:21 |
| morganfainberg | ah now i do | 17:21 |
| dolphm | morganfainberg: i set the keystoneclient Release Manager to keystone-drivers - you should be able to change it on that same page if you'd like | 17:21 |
| morganfainberg | aha, got it | 17:21 |
| morganfainberg | do you have a script that will assign the "fix commeted" bugs to the milestone? | 17:23 |
| morganfainberg | or is it something done by hand? | 17:23 |
| dolphm | morganfainberg: scripted | 17:23 |
| dolphm | morganfainberg: https://github.com/dolph/launchpad/blob/master/release_client.py | 17:23 |
| dolphm | morganfainberg: without --release it'll set milestones | 17:24 |
| *** vb has joined #openstack-keystone | 17:24 | |
| dolphm | morganfainberg: with --release it'll set milestones for Fix Committed items, and flip them to Fix Released | 17:24 |
| dolphm | morganfainberg: so, python release_client.py python-keystoneclient 0.11.2 | 17:25 |
| morganfainberg | wow that is easy | 17:27 |
| morganfainberg | doh. | 17:29 |
| *** stevemar has quit IRC | 17:29 | |
| morganfainberg | i think i lost the secret key for my gpg key | 17:29 |
| * morganfainberg goes and looks | 17:29 | |
| dolphm | haha almost easy | 17:30 |
| *** amcrn has joined #openstack-keystone | 17:30 | |
| *** thedodd has quit IRC | 17:32 | |
| morganfainberg | aha, didn't have the keyid | 17:32 |
| morganfainberg | in the tag command | 17:32 |
| morganfainberg | ooh boy i need ot update this key | 17:32 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: remove XML middleware from default paste config https://review.openstack.org/130371 | 17:32 |
| *** diegows has quit IRC | 17:36 | |
| *** harlowja_away is now known as harlowja | 17:40 | |
| morganfainberg | dolphm, so... following your instructions... | 17:44 |
| morganfainberg | Unable to find milestone by name: 0.11.2 | 17:44 |
| morganfainberg | did i need to "mark as released" bnefore clicking "create release"? | 17:44 |
| rodrigods | lhcheng, pong | 17:47 |
| *** openstackgerrit has quit IRC | 17:48 | |
| *** openstackgerrit has joined #openstack-keystone | 17:48 | |
| lhcheng | rodrigods: question on hierarchical projects, is it not going to be supported for LDAP backed “ever” or not supported just for the first pass of the implementation? | 17:49 |
| *** vejdmn1 has quit IRC | 17:49 | |
| *** vejdmn has joined #openstack-keystone | 17:49 | |
| rodrigods | lhcheng, for this first one, I think | 17:50 |
| rodrigods | lhcheng, to be certain, we can ask morganfainberg =) | 17:51 |
| morganfainberg | ldap assignment? | 17:51 |
| morganfainberg | uh...... | 17:51 |
| * morganfainberg dodges the question. | 17:51 | |
| morganfainberg | i think that depends on what the state of ldap assignment is going to be ijn the long run | 17:51 |
| rodrigods | morganfainberg, ++ | 17:51 |
| rodrigods | that was exactly what I thought | 17:51 |
| lhcheng | morganfainberg: yes, ldap assignment backend | 17:51 |
| lhcheng | hmm do we know what percentage of the user does actually use ldap assignment? | 17:53 |
| rodrigods | lhcheng, there was a huge discussion about ldap in the previous keystone meeting | 17:54 |
| morganfainberg | CERN uses it. maybe one or two others. | 17:56 |
| morganfainberg | it is not commonly used | 17:56 |
| *** aix has quit IRC | 17:59 | |
| * rodrigods still getting used to ldap, was presented to it once started hacking with keystone | 18:00 | |
| lhcheng | ayoung raised a good point in the last meeting about assuming that the assignment LDAP will be the same as identity. Would be nice to split it up. | 18:00 |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: remove XML middleware from default paste config https://review.openstack.org/130371 | 18:01 |
| openstackgerrit | Anne Gentle proposed a change to openstack/keystone-specs: Adds Identity API v2.0 files https://review.openstack.org/130577 | 18:01 |
| morganfainberg | lhcheng, there is actually a topic that will cover that | 18:01 |
| morganfainberg | at the summit (somewhat) | 18:02 |
| morganfainberg | or lead to covering that | 18:02 |
| dolphm | morganfainberg: looks like you got it released okay? | 18:02 |
| dolphm | morganfainberg: the instructions that appear in the console are really for --release | 18:02 |
| dolphm | morganfainberg: they don't really apply to a dry run ... i should add a warning or something | 18:02 |
| morganfainberg | dolphm, i did the 6 bugs by hand. but your script couldn't "find" the milestone with --release | 18:02 |
| lhcheng | morganfainberg, great! I’ll be looking forward to that! | 18:02 |
| morganfainberg | once i did the release bit. | 18:02 |
| morganfainberg | in lp | 18:02 |
| ayoung | lhcheng, actually, I think that the assumption is safe, so long as both identity and assignement point to the same LDAP server, but it gets wonky if you try to store things in assignment where there is no corresponding identity elenment | 18:03 |
| dolphm | morganfainberg: yeah, don't follow the instructions at all unless you have done --release | 18:03 |
| morganfainberg | lhcheng, http://kilodesignsummit.sched.org/event/a2ad39a14ba7eeaa9fc9bd25f34d9741 | 18:03 |
| morganfainberg | dolphm, ah ok | 18:03 |
| lhcheng | ayoung: I’m just thinking for the case where keystone would only have read-only access to corp ldap. And would like to manage the assignment in a separate ldap. | 18:04 |
| morganfainberg | in theory that could be done with the per-domain backend config but it might get a little wonky | 18:05 |
| ayoung | lhcheng, yeah, that is going to require some deep LDAP Kung fu to get right. The DNs in assignment will not reflect objects in the Directory | 18:05 |
| morganfainberg | or a lot wonky | 18:06 |
| lhcheng | ayoung, perhaps replicate the identity into the keystone-owned ldap too | 18:06 |
| morganfainberg | oh wait assingment ldap = no domains | 18:06 |
| morganfainberg | nvm | 18:06 |
| morganfainberg | lhcheng, ick | 18:06 |
| morganfainberg | lhcheng, noooooo | 18:06 |
| ayoung | morganfainberg, one domain per subtree | 18:06 |
| morganfainberg | ayoung, not in assingment | 18:06 |
| ayoung | lhcheng, I don't think so, I think that it is more the other way: relax the constraints | 18:06 |
| ayoung | morganfainberg, yeah, even in assignment, maybe even more so...I think there is a place for it. Course, I don't intend to code it. | 18:07 |
| morganfainberg | i think this falls into the category of the previous convo, if we're doing r/w ldap lets really do r/w ldap, for r/o we can do other / better desgin that doesn't need to support the r/w/ case | 18:07 |
| lhcheng | ayoung, allowing r/w access would solve it, but it will be a battle to get r/w access to a corp ldap. | 18:14 |
| ayoung | lhcheng, you don't want that, but why LDAP at all? | 18:14 |
| lhcheng | ayoung. I agree that we will start to have data inconsistencies once we split identity and assignment into two ldaps :( | 18:15 |
| *** thedodd has joined #openstack-keystone | 18:16 | |
| lhcheng | multiple openstack cluster, like to have a single source of truth for identity rather than doing an ldap-to-db sync to each keystone in the cluster | 18:16 |
| ayoung | lhcheng, look into how FreeIPA does a Kerbers Trust relationship to a corporate LDAP , | 18:17 |
| amakarov | ayoung, greetings! I've implemented user chain validation, can you please look at it? https://review.openstack.org/#/c/126897/ | 18:18 |
| ayoung | amakarov, happy to do so | 18:18 |
| ayoung | amakarov, looks clean | 18:18 |
| ayoung | I'm assuming that the get_trust_pedigree would break if any of the delegations were revoked | 18:19 |
| morganfainberg | rodrigods, put a -2 on the CRUD patch for HM until the api change merges | 18:19 |
| ayoung | I'd like to see a test on that | 18:19 |
| morganfainberg | rodrigods, just as an FYI, that isn't because HM CRUD code is wrong, just we need the API change in first. | 18:19 |
| rodrigods | morganfainberg, fair enough | 18:19 |
| ayoung | amakarov, didn't you have tests before? | 18:20 |
| ayoung | ah...blind | 18:20 |
| rodrigods | morganfainberg, will start to ping people to review the API change hehe | 18:20 |
| morganfainberg | :) | 18:20 |
| lhcheng | ayoung, thanks! I’ll check FreeIPA. | 18:20 |
| amakarov | ayoung, there are tests for it | 18:20 |
| morganfainberg | the one before it is now gating fyi | 18:20 |
| amakarov | ayoung, a moment... | 18:20 |
| morganfainberg | rodrigods, i really do expect we'll have this all done by the summit. | 18:20 |
| * morganfainberg subscribed to the sched.org calendars for the summit | 18:22 | |
| amakarov | ayoung, keystone.tests.test_v3_auth.TestTrustRedelegation.test_intermediate_user_disabled | 18:22 |
| morganfainberg | wow... my phone's calendar is impossible to read w/ them turned on | 18:22 |
| ayoung | amakarov, looks good. On tests like those, I like to do a positive check before disabling, to ensure that the mechanism you are using is actuall responsible, so | 18:24 |
| ayoung | do a self.v3_authenticate_token(auth_data, expected_status=210) or whatever the status is prior to disabling | 18:24 |
| amakarov | ayoung, got it, thanks for the idea | 18:25 |
| ayoung | user_chain[0] is going to be first ancestor, right? So in a three person chain, it would be the one in the middle? | 18:25 |
| amakarov | ayoung, user_chain[0] is first trustee, the trustor is still self.user_id | 18:28 |
| ayoung | amakarov, it looks good. I'm just paranoid. But you know the old saying: | 18:28 |
| amakarov | so there is 2 in the middle. | 18:28 |
| ayoung | Just because I'm paranoid doesn't mean they are not out to get me. | 18:28 |
| ayoung | amakarov, so trustor to trustee1(t1), t1 to t2, t2 to t3? | 18:29 |
| amakarov | ayoung, ++ | 18:29 |
| ayoung | and user_chain[0] would point to t2 ot t1? | 18:29 |
| ayoung | or | 18:29 |
| ayoung | and user_chain[0] would point to t2 or t1? | 18:29 |
| *** _cjones_ has quit IRC | 18:30 | |
| *** _cjones_ has joined #openstack-keystone | 18:30 | |
| amakarov | ayoung, user_chain[0] == t1, user_chain[1] == t2 | 18:30 |
| ayoung | ah, so top down. | 18:30 |
| amakarov | ayoung, user_chain[2] is the last - he is to use the trust | 18:32 |
| *** gokrokve has quit IRC | 18:32 | |
| *** rodrigods has left #openstack-keystone | 18:32 | |
| *** rodrigods has joined #openstack-keystone | 18:33 | |
| *** gokrokve has joined #openstack-keystone | 18:33 | |
| *** _cjones_ has quit IRC | 18:34 | |
| *** jacer_huawei has quit IRC | 18:37 | |
| *** jacer_huawei has joined #openstack-keystone | 18:38 | |
| ayoung | amakarov, def test_redelegation_roles(self): seems strange. Why are you creating a new role? | 18:39 |
| amakarov | ayoung, it's the case when trustee tries to delegate role not delegated to him | 18:40 |
| ayoung | amakarov, ah. | 18:41 |
| ayoung | hmmm | 18:41 |
| ayoung | amakarov, so can I drop roles from a trust when I redelegate? Where is that tested? | 18:42 |
| amakarov | ayoung, yes, you can redelegate a subset of roles and never a superset. Subset redelegation wasn't tested ( | 18:43 |
| ayoung | amakarov, lets get that in there: check that the token from the redelgated trust has exactly the set of roles redelegated to it | 18:43 |
| *** nkinder has quit IRC | 18:45 | |
| amakarov | ayoung, ok, I'll make a more detailed test for roles | 18:45 |
| ayoung | amakarov, I like this patch | 18:45 |
| *** nellysmitt has quit IRC | 18:45 | |
| ayoung | I want dolphm to give it a once over, though, as he did a really thorough set of tests for the original trusts implementation | 18:45 |
| *** nellysmi_ has joined #openstack-keystone | 18:45 | |
| ayoung | amakarov, nicely done, though. This is just being thorough | 18:46 |
| amakarov | ayoung, pleased to hear that :) | 18:47 |
| ayoung | amakarov, now if only we could merge this with the oauth implementation | 18:47 |
| *** alee_lunch is now known as alee | 18:48 | |
| *** thedodd has quit IRC | 18:48 | |
| amakarov | ayoung, yes, that would be nice! Looking forward to make it in my future contributions :) | 18:49 |
| ayoung | very cool | 18:49 |
| ayoung | amakarov, you going to Paris? | 18:49 |
| amakarov | amakarov, for now I'm about to write a todo list and wish a good night to everybody! Yes, I'm going | 18:50 |
| amakarov | s/amakarov/ayoung/ | 18:50 |
| ayoung | amakarov, excellent, we'll walk this one through then. | 18:51 |
| ayoung | And maybe kidnam stevem for an oauth discussion, too | 18:52 |
| *** diegows has joined #openstack-keystone | 18:52 | |
| morganfainberg | ayoung, i kindof want to see trusts (OS-TRUSTS) go away and just make delegation a top-level bit of assingment... though not sure how we'd do that | 18:53 |
| morganfainberg | or at the very least make it so i can say "give me token with XXX roles". | 18:54 |
| ayoung | morganfainberg, first we merge the oauth and trust implementation on the backend | 18:54 |
| * morganfainberg looks at the policy discussion at the summit | 18:54 | |
| ayoung | nah, this is not policy | 18:54 |
| morganfainberg | it is related to the "what capabilities do i need | 18:54 |
| morganfainberg | " | 18:54 |
| morganfainberg | question | 18:54 |
| ayoung | more like the authorization session | 18:55 |
| ayoung | but, quibbles | 18:55 |
| ayoung | we need to sort it allout | 18:55 |
| morganfainberg | yeah | 18:56 |
| ayoung | but cleaning up the interface is harder than unifying the implementation | 18:56 |
| ayoung | I think that we can make oauth consumers into keystone users in their own domain | 18:56 |
| ayoung | and then we could have oauth potentiall reuse an existing user as a consumer | 18:57 |
| *** _cjones_ has joined #openstack-keystone | 18:57 | |
| morganfainberg | dang it... can't make it to nkinder's talk: https://openstacksummitnovember2014paris.sched.org/event/a8469094b8d211407c2554807a16d0d6 | 18:58 |
| morganfainberg | :( | 18:58 |
| * morganfainberg wonders about trading a session timeslot. | 18:58 | |
| ayoung | oooh, I need to be there, too. What's it conflict with? | 18:59 |
| morganfainberg | http://kilodesignsummit.sched.org/event/a2ad39a14ba7eeaa9fc9bd25f34d9741 | 18:59 |
| ayoung | Wednesday, November 5 • 09:00 - 09:40 | 18:59 |
| ayoung | Fer Fooks Sake! | 19:00 |
| morganfainberg | not a lot of options for trading :( | 19:01 |
| *** amakarov is now known as amakarov_away | 19:03 | |
| morganfainberg | that day is booked solid | 19:03 |
| morganfainberg | ugh | 19:03 |
| ayoung | morganfainberg, its OK, I can tell you what he is going to say. | 19:04 |
| morganfainberg | hehe | 19:04 |
| ayoung | the question, though, is whether I leave him unsupervised or not. | 19:04 |
| morganfainberg | ayoung, he'll be fine ;) | 19:05 |
| *** bknudson has quit IRC | 19:05 | |
| ayoung | Managers are a trickly lot and must be watched or they will get you into trouble. | 19:05 |
| morganfainberg | ok so i need to bail for a bit. have an appt to run to | 19:05 |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone-specs: This blueprint details the work required for Multi-factor Authentication https://review.openstack.org/130376 | 19:05 |
| ayoung | Fortunately, he has many years as an engineer, and it was not that long ago, hope he hasn't forgotten | 19:05 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 19:06 |
| ayoung | lbragstad, you like that :) | 19:06 |
| *** marcoemorais has quit IRC | 19:06 | |
| *** ayoung is now known as ayoung-afk | 19:07 | |
| lbragstad | nonameentername: ayoung-afk did you both push specs patches at the same time? | 19:08 |
| lbragstad | yes.. I think you did | 19:08 |
| *** thedodd has joined #openstack-keystone | 19:10 | |
| *** andreaf has quit IRC | 19:11 | |
| *** andreaf has joined #openstack-keystone | 19:12 | |
| *** __TheDodd__ has joined #openstack-keystone | 19:12 | |
| *** nellysmitt has joined #openstack-keystone | 19:12 | |
| *** david-lyle has quit IRC | 19:13 | |
| *** nellysmi_ has quit IRC | 19:16 | |
| *** saipandi has joined #openstack-keystone | 19:16 | |
| *** thedodd has quit IRC | 19:16 | |
| *** bknudson has joined #openstack-keystone | 19:25 | |
| *** mrmoje has joined #openstack-keystone | 19:25 | |
| *** marcoemorais has joined #openstack-keystone | 19:27 | |
| *** bknudson has quit IRC | 19:29 | |
| *** mrmoje has quit IRC | 19:31 | |
| *** mrmoje has joined #openstack-keystone | 19:31 | |
| *** ayoung-afk is now known as ayoung | 19:31 | |
| ayoung | lbragstad, nah, I just corrected his commit message | 19:31 |
| lbragstad | ayoung: gotcha, thanks! | 19:32 |
| *** aix has joined #openstack-keystone | 19:37 | |
| *** _cjones_ has quit IRC | 19:45 | |
| *** bknudson has joined #openstack-keystone | 19:45 | |
| nonameentername | ayoung: Thanks | 19:45 |
| *** _cjones_ has joined #openstack-keystone | 19:45 | |
| *** _cjones_ has quit IRC | 19:50 | |
| *** gokrokve has quit IRC | 19:54 | |
| *** gokrokve has joined #openstack-keystone | 19:56 | |
| *** gokrokve has quit IRC | 19:57 | |
| *** gokrokve has joined #openstack-keystone | 19:57 | |
| ayoung | import rpdb; rpbd.set_trace() | 20:05 |
| ayoung | # GAH | 20:05 |
| *** david-lyle has joined #openstack-keystone | 20:06 | |
| *** tristanC has quit IRC | 20:10 | |
| *** _cjones_ has joined #openstack-keystone | 20:12 | |
| bknudson | Does everything need to be an extension? | 20:13 |
| *** tristanC has joined #openstack-keystone | 20:16 | |
| *** andreaf has quit IRC | 20:17 | |
| *** andreaf has joined #openstack-keystone | 20:17 | |
| *** gyee has quit IRC | 20:21 | |
| *** nkinder has joined #openstack-keystone | 20:26 | |
| rodrigods | lbragstad, just tested with the Xml removal patch | 20:36 |
| rodrigods | now it's breaking in the AuthContextMiddleware | 20:36 |
| lbragstad | rodrigods: really? | 20:36 |
| lbragstad | hmmm | 20:36 |
| lbragstad | rodrigods: paste? | 20:36 |
| rodrigods | lbragstad, yeah, the request doesn't include a token | 20:37 |
| rodrigods | lbragstad, 2014-10-23 20:31:06.050548 27643 DEBUG keystone.middleware.core [-] Auth token not in the request header. Will not build auth context. process_request keystone/keystone/middleware/core.py:212 | 20:37 |
| *** nellysmitt has quit IRC | 20:37 | |
| lbragstad | rodrigods: interesting | 20:37 |
| rodrigods | lbragstad, we still have a bug, but not a Xml bug | 20:38 |
| rodrigods | =) | 20:38 |
| lbragstad | indeed | 20:38 |
| *** stevemar has joined #openstack-keystone | 20:38 | |
| rodrigods | lbragstad, any idea how can I explicit that an endpoint won't need the auth_context? | 20:38 |
| rodrigods | morganfainberg, ^ | 20:42 |
| morganfainberg | On the road. Can't look till I get home this evening. | 20:43 |
| morganfainberg | But I have an idea if you don't solve it before the. | 20:44 |
| morganfainberg | Then. | 20:44 |
| *** david-lyle has quit IRC | 20:44 | |
| rodrigods | morganfainberg, great, thanks! | 20:44 |
| morganfainberg | Look at how /v3/auth works | 20:45 |
| rodrigods | morganfainberg, ++ | 20:45 |
| *** jedix has left #openstack-keystone | 20:46 | |
| *** david-lyle has joined #openstack-keystone | 20:48 | |
| lbragstad | rodrigods: what was the link to that bug again? | 20:52 |
| * lbragstad is digging | 20:52 | |
| rodrigods | lbragstad, https://bugs.launchpad.net/keystone/+bug/1384382 | 20:52 |
| uvirtbot | Launchpad bug 1384382 in keystone "GET /OS-FEDERATION/saml2/metadata does not work" [Undecided,New] | 20:52 |
| lbragstad | rodrigods: thanks! | 20:52 |
| *** gyee has joined #openstack-keystone | 20:54 | |
| *** NM1 has quit IRC | 21:00 | |
| rodrigods | lbragstad, it worked here, i missed a configuration in the fed extension | 21:01 |
| rodrigods | =) | 21:01 |
| *** alex_xu has joined #openstack-keystone | 21:01 | |
| lbragstad | rodrigods: gotcha, so you didn't get the 'Auth token not in the request header' error? | 21:01 |
| lbragstad | with the XML removal patch? | 21:01 |
| rodrigods | lbragstad, nope, it worked beautifully =) | 21:02 |
| *** packet has quit IRC | 21:02 | |
| *** lhcheng has quit IRC | 21:02 | |
| * lbragstad high-fives rodrigods | 21:02 | |
| lbragstad | rodrigods: thanks for testing that | 21:03 |
| rodrigods | lbragstad, o/ | 21:03 |
| rodrigods | lbragstad, maybe change the review commit message to point that is also closing this bug? | 21:05 |
| rodrigods | makes sense? | 21:05 |
| lbragstad | rodrigods: yeah | 21:06 |
| *** gyee has quit IRC | 21:06 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 21:06 |
| rodrigods | lbragstad, ++ | 21:06 |
| *** lhcheng has joined #openstack-keystone | 21:11 | |
| *** HenryG has quit IRC | 21:11 | |
| *** jsavak has quit IRC | 21:21 | |
| *** alex_xu has quit IRC | 21:30 | |
| *** harlowja has quit IRC | 21:31 | |
| *** harlowja has joined #openstack-keystone | 21:36 | |
| *** marcoemorais has quit IRC | 21:38 | |
| *** alee is now known as alee_on_way_home | 21:45 | |
| *** alee_on_way_home has quit IRC | 21:49 | |
| *** stevemar has quit IRC | 21:51 | |
| *** mgagne has quit IRC | 22:05 | |
| *** mgagne has joined #openstack-keystone | 22:05 | |
| *** gokrokve has quit IRC | 22:12 | |
| *** david-lyle has quit IRC | 22:13 | |
| *** david-lyle has joined #openstack-keystone | 22:13 | |
| *** gokrokve has joined #openstack-keystone | 22:20 | |
| *** marcoemorais has joined #openstack-keystone | 22:20 | |
| *** esp has joined #openstack-keystone | 22:22 | |
| esp | hello, can someone help figure out how to enable keystone v3 support in devstack. I don’t believe this is enabled by default correct? | 22:23 |
| esp | $ keystone --debug --os-identity-api-version 3.0 tenant-list | 22:24 |
| esp | WARNING: unsupported identity-api-version 3.0, falling back to 2.0 | 22:24 |
| *** harlowja has quit IRC | 22:30 | |
| vsilva | hi esmute | 22:31 |
| vsilva | oops, esp | 22:31 |
| esp | hi vsilva :) | 22:31 |
| esp | np, me and esmute are pals | 22:31 |
| vsilva | I believe you can change that in openrc. OS_IDENTITY_API_VERSION=3, I think | 22:31 |
| vsilva | give it a try | 22:31 |
| esp | k, let me do that ;) | 22:32 |
| *** __TheDodd__ has quit IRC | 22:32 | |
| *** gyee has joined #openstack-keystone | 22:32 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:32 | |
| *** marcoemorais1 has quit IRC | 22:33 | |
| esp | OS_IDENTITY_API_VERSION=3 keystone --debug tenant-list | 22:33 |
| esp | WARNING: unsupported identity-api-version 3, falling back to 2.0 | 22:33 |
| *** marcoemorais has quit IRC | 22:33 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:33 | |
| esp | wonder if my client is outta date? | 22:33 |
| esp | I’ll try some curls maybe? | 22:33 |
| * esp shrugs | 22:33 | |
| vsilva | esp, did you auth with openrc? | 22:34 |
| vsilva | change that in openrc and auth again | 22:34 |
| esp | yep, but I have to admin my devstack is probably 2 weeks old | 22:34 |
| esp | ah, ok | 22:34 |
| esp | good idea | 22:34 |
| lhcheng | esp keystone v3 is not supported in keystoneclient CLI | 22:36 |
| lhcheng | you have to use the openstackclient for keystone v3 | 22:36 |
| esp | ahh | 22:36 |
| esp | makes sense lhcheng | 22:36 |
| esp | thank you! | 22:36 |
| lhcheng | esp np! | 22:36 |
| esp | but I bet curl will work | 22:36 |
| esp | I was gonna try that next | 22:36 |
| *** marcoemorais1 has quit IRC | 22:38 | |
| *** marcoemorais has joined #openstack-keystone | 22:39 | |
| *** vejdmn has quit IRC | 22:40 | |
| *** harlowja has joined #openstack-keystone | 22:41 | |
| *** saipandi has quit IRC | 22:41 | |
| *** saipandi has joined #openstack-keystone | 22:41 | |
| *** gokrokve has quit IRC | 22:46 | |
| *** gokrokve has joined #openstack-keystone | 22:46 | |
| *** marcoemorais has quit IRC | 22:47 | |
| *** marcoemorais has joined #openstack-keystone | 22:47 | |
| *** gordc has quit IRC | 22:49 | |
| *** david-lyle has quit IRC | 22:54 | |
| *** HenryG has joined #openstack-keystone | 23:04 | |
| *** gokrokve has quit IRC | 23:05 | |
| *** andreaf has quit IRC | 23:11 | |
| *** andreaf has joined #openstack-keystone | 23:11 | |
| *** gokrokve has joined #openstack-keystone | 23:14 | |
| *** gokrokve has quit IRC | 23:17 | |
| *** gokrokve has joined #openstack-keystone | 23:18 | |
| *** gokrokve has quit IRC | 23:23 | |
| *** david-lyle has joined #openstack-keystone | 23:24 | |
| *** david-lyle has quit IRC | 23:31 | |
| *** gokrokve has joined #openstack-keystone | 23:34 | |
| *** gokrokve has quit IRC | 23:34 | |
| *** gokrokve has joined #openstack-keystone | 23:34 | |
| *** gokrokve has quit IRC | 23:42 | |
| *** oomichi has joined #openstack-keystone | 23:49 | |
| *** oomichi__ has joined #openstack-keystone | 23:49 | |
| *** _cjones_ has quit IRC | 23:52 | |
| *** _cjones_ has joined #openstack-keystone | 23:52 | |
| *** alex_xu has joined #openstack-keystone | 23:52 | |
| *** _cjones_ has quit IRC | 23:57 | |
| *** diegows has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!