| *** oomichi__ has quit IRC | 00:02 | |
| *** dims_ has joined #openstack-keystone | 00:03 | |
| *** dims_ has quit IRC | 00:06 | |
| *** dims_ has joined #openstack-keystone | 00:06 | |
| *** thiagop has quit IRC | 00:07 | |
| *** dims has quit IRC | 00:07 | |
| *** _cjones_ has joined #openstack-keystone | 00:09 | |
| *** diegows has joined #openstack-keystone | 00:10 | |
| *** _cjones_ has quit IRC | 00:10 | |
| *** _cjones_ has joined #openstack-keystone | 00:11 | |
| *** _cjones_ has quit IRC | 00:15 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:16 | |
| *** HenryG has quit IRC | 00:18 | |
| *** cjellick has quit IRC | 00:21 | |
| *** gyee has quit IRC | 00:22 | |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Adds missing log hints for level E/I/W https://review.openstack.org/118883 | 00:25 |
|---|---|---|
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Extends hacking check for logging to verify i18n hints https://review.openstack.org/118884 | 00:26 |
| openstackgerrit | David Stanek proposed a change to openstack/keystone: Fixes aggressive use of translation hints https://review.openstack.org/125233 | 00:26 |
| *** alee_on_way_home has joined #openstack-keystone | 00:27 | |
| *** tellesnobrega_ has quit IRC | 00:27 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove nonexistant param from docstring https://review.openstack.org/130660 | 00:32 |
| *** raildo_ has joined #openstack-keystone | 00:32 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:38 | |
| *** jacer_huawei has quit IRC | 00:42 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move check_output and git() to test utils https://review.openstack.org/130662 | 00:45 |
| *** tellesnobrega_ has quit IRC | 00:47 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Remove netaddr package requirement https://review.openstack.org/130664 | 00:49 |
| *** marcoemorais has quit IRC | 00:52 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:58 | |
| *** jacer_huawei has joined #openstack-keystone | 00:59 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add fileutils module https://review.openstack.org/130666 | 01:01 |
| *** alex_xu has quit IRC | 01:01 | |
| *** oomichi has quit IRC | 01:02 | |
| openstackgerrit | A change was merged to openstack/keystone: PKI and PKIZ tokens unnecessary whitespace removed https://review.openstack.org/120043 | 01:10 |
| openstackgerrit | A change was merged to openstack/keystone: Move unit tests from test_backend_ldap https://review.openstack.org/119928 | 01:10 |
| *** alee_on_way_home is now known as alee | 01:13 | |
| *** k-kosaka has joined #openstack-keystone | 01:21 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove assignments for foreign actors when deleting domain https://review.openstack.org/127433 | 01:22 |
| *** topol has joined #openstack-keystone | 01:24 | |
| *** david-lyle has joined #openstack-keystone | 01:28 | |
| *** david-lyle has quit IRC | 01:32 | |
| *** diegows has quit IRC | 01:40 | |
| openstackgerrit | Kenjiro Kosaka proposed a change to openstack/keystone: Identity endpoint in tools/sample_data.sh changed versioned url to unversioned url https://review.openstack.org/130669 | 01:43 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Add fileutils module https://review.openstack.org/130666 | 02:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 02:02 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 02:06 |
| *** lhcheng has quit IRC | 02:08 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 02:23 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: test_utils use jsonutils from oslo.serialization https://review.openstack.org/130674 | 02:23 |
| *** harlowja is now known as harlowja_away | 02:23 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 02:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: test_utils use jsonutils from oslo.serialization https://review.openstack.org/130674 | 02:27 |
| *** david-lyle has joined #openstack-keystone | 02:29 | |
| *** NM has joined #openstack-keystone | 02:33 | |
| *** david-lyle has quit IRC | 02:33 | |
| *** raildo_ has quit IRC | 02:37 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 02:38 |
| *** richm has quit IRC | 02:47 | |
| *** mrmoje has quit IRC | 02:49 | |
| *** dims_ has quit IRC | 02:56 | |
| *** dims has joined #openstack-keystone | 02:57 | |
| *** dims has quit IRC | 03:01 | |
| *** esp has left #openstack-keystone | 03:08 | |
| *** tellesnobrega_ has quit IRC | 03:10 | |
| *** NM has quit IRC | 03:12 | |
| *** afazekas has quit IRC | 03:19 | |
| *** _afazekas has quit IRC | 03:19 | |
| *** david-lyle has joined #openstack-keystone | 03:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:20 | |
| *** topol has quit IRC | 03:21 | |
| *** jacer_huawei has quit IRC | 03:23 | |
| *** breton_ is now known as breton | 03:28 | |
| *** alex_xu has joined #openstack-keystone | 03:28 | |
| *** jacer_huawei has joined #openstack-keystone | 03:36 | |
| *** david-lyle has quit IRC | 03:36 | |
| *** afazekas has joined #openstack-keystone | 03:39 | |
| *** marcoemorais has joined #openstack-keystone | 03:49 | |
| *** marcoemorais has quit IRC | 03:56 | |
| *** lhcheng has joined #openstack-keystone | 04:05 | |
| *** david-lyle has joined #openstack-keystone | 04:07 | |
| *** HenryG has joined #openstack-keystone | 04:10 | |
| *** david-lyle has quit IRC | 04:13 | |
| *** oomichi has joined #openstack-keystone | 04:24 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: try removing oslo.config https://review.openstack.org/128440 | 04:39 |
| *** lhcheng_ has joined #openstack-keystone | 05:04 | |
| *** lhcheng has quit IRC | 05:07 | |
| *** lhcheng_ is now known as lhcheng | 05:07 | |
| *** vsilva is now known as victsou | 05:09 | |
| *** victsou is now known as vsilva | 05:11 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use new oslo.config generator https://review.openstack.org/128440 | 05:14 |
| *** vsilva is now known as victsou | 05:22 | |
| *** victsou is now known as vsilva | 05:22 | |
| *** vsilva is now known as victsou | 05:23 | |
| *** victsou is now known as vsilva | 05:24 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use new oslo.config generator https://review.openstack.org/128440 | 05:25 |
| *** gokrokve has joined #openstack-keystone | 05:28 | |
| *** gokrokve has quit IRC | 05:28 | |
| *** gokrokve has joined #openstack-keystone | 05:29 | |
| *** amcrn has quit IRC | 05:34 | |
| *** gokrokve has quit IRC | 05:41 | |
| *** gokrokve has joined #openstack-keystone | 05:42 | |
| *** vsilva is now known as victsou | 05:51 | |
| *** victsou is now known as vsilva | 05:52 | |
| *** gokrokve has quit IRC | 06:02 | |
| *** gokrokve has joined #openstack-keystone | 06:02 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 06:06 | |
| *** gokrokve has quit IRC | 06:23 | |
| *** mrmoje has joined #openstack-keystone | 06:28 | |
| *** gokrokve_ has joined #openstack-keystone | 06:32 | |
| *** gokrokve_ has quit IRC | 06:32 | |
| *** harlowja_away has quit IRC | 06:47 | |
| *** raildo has quit IRC | 06:47 | |
| *** f13o has quit IRC | 06:47 | |
| *** vsilva has quit IRC | 06:47 | |
| *** DavidHu__ has quit IRC | 06:47 | |
| *** jorge_munoz has quit IRC | 06:47 | |
| *** anteaya has quit IRC | 06:47 | |
| *** dhellmann has quit IRC | 06:47 | |
| *** oomichi has quit IRC | 06:47 | |
| *** aix has quit IRC | 06:47 | |
| *** mitz_ has quit IRC | 06:47 | |
| *** Guest28430 has quit IRC | 06:47 | |
| *** morganfainberg has quit IRC | 06:47 | |
| *** d0ugal has quit IRC | 06:47 | |
| *** marekd|away is now known as marekd | 06:48 | |
| *** rwsu_ has quit IRC | 06:48 | |
| *** rwsu_ has joined #openstack-keystone | 06:49 | |
| marekd | mhu: https://review.openstack.org/#/c/130564/2 | 06:57 |
| *** oomichi has joined #openstack-keystone | 07:00 | |
| *** aix has joined #openstack-keystone | 07:00 | |
| *** jorge_munoz has joined #openstack-keystone | 07:00 | |
| *** mitz_ has joined #openstack-keystone | 07:00 | |
| *** Guest28430 has joined #openstack-keystone | 07:00 | |
| *** morganfainberg has joined #openstack-keystone | 07:00 | |
| *** anteaya has joined #openstack-keystone | 07:00 | |
| *** d0ugal has joined #openstack-keystone | 07:00 | |
| *** dhellmann has joined #openstack-keystone | 07:00 | |
| *** vb has quit IRC | 07:07 | |
| *** vb has joined #openstack-keystone | 07:07 | |
| *** mrmoje has quit IRC | 07:09 | |
| openstackgerrit | Marek Denis proposed a change to openstack/python-keystoneclient: Create a framework for federation plugins https://review.openstack.org/130564 | 07:12 |
| *** nellysmitt has joined #openstack-keystone | 07:15 | |
| *** andreaf has quit IRC | 07:16 | |
| *** harlowja_away has joined #openstack-keystone | 07:16 | |
| *** raildo has joined #openstack-keystone | 07:16 | |
| *** f13o has joined #openstack-keystone | 07:16 | |
| *** vsilva has joined #openstack-keystone | 07:16 | |
| *** DavidHu__ has joined #openstack-keystone | 07:16 | |
| *** andreaf has joined #openstack-keystone | 07:16 | |
| *** andreaf has quit IRC | 07:28 | |
| *** harlowja_away has quit IRC | 07:28 | |
| *** raildo has quit IRC | 07:28 | |
| *** f13o has quit IRC | 07:28 | |
| *** vsilva has quit IRC | 07:28 | |
| *** DavidHu__ has quit IRC | 07:29 | |
| *** jorge_munoz has quit IRC | 07:29 | |
| *** anteaya has quit IRC | 07:29 | |
| *** dhellmann has quit IRC | 07:29 | |
| *** oomichi has quit IRC | 07:29 | |
| *** aix has quit IRC | 07:29 | |
| *** mitz_ has quit IRC | 07:29 | |
| *** Guest28430 has quit IRC | 07:29 | |
| *** morganfainberg has quit IRC | 07:29 | |
| *** d0ugal has quit IRC | 07:29 | |
| *** andreaf has joined #openstack-keystone | 07:32 | |
| *** d0ugal has joined #openstack-keystone | 07:32 | |
| *** morganfainberg has joined #openstack-keystone | 07:32 | |
| *** Guest28430 has joined #openstack-keystone | 07:32 | |
| *** mitz_ has joined #openstack-keystone | 07:32 | |
| *** aix has joined #openstack-keystone | 07:32 | |
| *** oomichi has joined #openstack-keystone | 07:32 | |
| *** harlowja_away has joined #openstack-keystone | 07:32 | |
| *** raildo has joined #openstack-keystone | 07:32 | |
| *** f13o has joined #openstack-keystone | 07:32 | |
| *** vsilva has joined #openstack-keystone | 07:32 | |
| *** DavidHu__ has joined #openstack-keystone | 07:32 | |
| *** lbragstad has quit IRC | 07:36 | |
| *** lbragstad has joined #openstack-keystone | 07:36 | |
| *** oomichi has quit IRC | 07:36 | |
| *** aix has quit IRC | 07:36 | |
| *** mitz_ has quit IRC | 07:36 | |
| *** Guest28430 has quit IRC | 07:36 | |
| *** morganfainberg has quit IRC | 07:36 | |
| *** d0ugal has quit IRC | 07:36 | |
| *** jorge_munoz has joined #openstack-keystone | 07:37 | |
| *** anteaya has joined #openstack-keystone | 07:37 | |
| *** dhellmann has joined #openstack-keystone | 07:37 | |
| *** Guest351 has joined #openstack-keystone | 07:39 | |
| *** Guest351 has quit IRC | 07:39 | |
| *** oomichi has joined #openstack-keystone | 07:40 | |
| *** aix has joined #openstack-keystone | 07:40 | |
| *** mitz_ has joined #openstack-keystone | 07:40 | |
| *** Guest28430 has joined #openstack-keystone | 07:40 | |
| *** morganfainberg has joined #openstack-keystone | 07:40 | |
| *** mitz_ has quit IRC | 07:40 | |
| *** dmatthews__ has joined #openstack-keystone | 07:40 | |
| *** mitz_ has joined #openstack-keystone | 07:42 | |
| *** dmatthews__ is now known as d0ugal | 07:46 | |
| *** d0ugal has quit IRC | 07:46 | |
| *** d0ugal has joined #openstack-keystone | 07:46 | |
| *** lhcheng has quit IRC | 08:15 | |
| *** jistr has joined #openstack-keystone | 08:21 | |
| *** oomichi has quit IRC | 08:26 | |
| *** andreaf has quit IRC | 08:32 | |
| *** andreaf has joined #openstack-keystone | 08:32 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Prevent AttributeError if no authorization https://review.openstack.org/100714 | 08:54 |
| *** andreaf has quit IRC | 08:55 | |
| *** andreaf has joined #openstack-keystone | 08:55 | |
| *** alex_xu has quit IRC | 08:58 | |
| *** k-kosaka has quit IRC | 09:04 | |
| marekd | mhu: U on Twitter? | 09:23 |
| mhu | marekd, no, I don't check it enough to justify an account :) | 09:24 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: unnecessary checks in assignment/controllers.py https://review.openstack.org/130722 | 09:26 |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove unnecessary checks in assignment/controllers.py https://review.openstack.org/130722 | 09:28 |
| marekd | mhu: | 09:49 |
| marekd | hmmm, i remember there was something | 09:50 |
| marekd | where osc was not recognizing | 09:50 |
| marekd | all auth plugins | 09:50 |
| marekd | do you remember how it was fixed? | 09:50 |
| marekd | http://pasteraw.com/2ab60r74290xdv0t220n46wytzow7lq | 09:52 |
| *** lsmola has quit IRC | 09:53 | |
| *** arunkant has quit IRC | 09:53 | |
| *** htruta has quit IRC | 09:53 | |
| *** wpf has quit IRC | 09:53 | |
| *** gsilvis has quit IRC | 09:53 | |
| *** lsmola has joined #openstack-keystone | 09:53 | |
| *** arunkant has joined #openstack-keystone | 09:53 | |
| *** htruta has joined #openstack-keystone | 09:53 | |
| *** wpf has joined #openstack-keystone | 09:53 | |
| *** gsilvis has joined #openstack-keystone | 09:53 | |
| mhu | marekd, IIRC it was because lxml wasn't installed | 09:54 |
| mhu | the *saml auth plugins are in contrib so dependencies are not in requirements.txt | 09:55 |
| *** andreaf has quit IRC | 09:55 | |
| *** aix has quit IRC | 09:55 | |
| *** Guest28430 has quit IRC | 09:55 | |
| *** morganfainberg has quit IRC | 09:55 | |
| *** andreaf has joined #openstack-keystone | 09:56 | |
| *** aix has joined #openstack-keystone | 09:56 | |
| *** Guest28430 has joined #openstack-keystone | 09:56 | |
| *** morganfainberg has joined #openstack-keystone | 09:56 | |
| *** samuelms has quit IRC | 09:58 | |
| *** xianghui has quit IRC | 09:58 | |
| *** jamiec has quit IRC | 09:58 | |
| *** csd has quit IRC | 09:58 | |
| *** ekarlso has quit IRC | 09:58 | |
| *** rharwood has quit IRC | 09:58 | |
| *** rodrigods has quit IRC | 09:58 | |
| *** palendae has quit IRC | 09:58 | |
| *** rodrigods has joined #openstack-keystone | 09:59 | |
| *** samuelms has joined #openstack-keystone | 09:59 | |
| *** xianghui has joined #openstack-keystone | 09:59 | |
| *** jamiec has joined #openstack-keystone | 09:59 | |
| *** csd has joined #openstack-keystone | 09:59 | |
| *** ekarlso has joined #openstack-keystone | 09:59 | |
| *** rharwood has joined #openstack-keystone | 09:59 | |
| *** palendae has joined #openstack-keystone | 09:59 | |
| marekd | mhu: yes yes yes yes :D | 09:59 |
| mhu | marked: this is going to be documented in OSC man page, this sounds like a problem that's going to be recurring :) | 10:00 |
| *** andreaf has quit IRC | 10:11 | |
| *** andreaf has joined #openstack-keystone | 10:11 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient-kerberos: kerberos client plugin https://review.openstack.org/123614 | 10:21 |
| jamielennox | ayoung: ^ | 10:21 |
| *** aix has quit IRC | 10:42 | |
| *** dims has joined #openstack-keystone | 10:47 | |
| *** andreaf has quit IRC | 10:48 | |
| *** andreaf has joined #openstack-keystone | 10:48 | |
| *** spligak has quit IRC | 11:10 | |
| *** aix has joined #openstack-keystone | 11:13 | |
| *** amakarov_away is now known as amakarov | 11:13 | |
| *** vb has quit IRC | 11:21 | |
| *** raildo_ has joined #openstack-keystone | 11:27 | |
| *** andreaf has quit IRC | 11:27 | |
| *** andreaf has joined #openstack-keystone | 11:28 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Log the CA cert with the debug statement https://review.openstack.org/130754 | 11:31 |
| *** NM has joined #openstack-keystone | 11:33 | |
| *** raildo_ has quit IRC | 11:34 | |
| ekarlso | jamielennox: you ever got to the CLI plugin btw ? | 11:35 |
| jamielennox | ekarlso: no, not as yet. i want to have a chat to the OSC guys at the summit and figure out what they want in it | 11:35 |
| jamielennox | cause i think they will be one of the primary users | 11:36 |
| jamielennox | because from what i can tell i think we could probably just use generic.Password and everyone would be fairly happy | 11:36 |
| *** diegows has joined #openstack-keystone | 11:50 | |
| *** radez_g0n3 is now known as radez | 12:30 | |
| *** andreaf_ has joined #openstack-keystone | 12:33 | |
| *** andreaf has quit IRC | 12:36 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/python-keystoneclient: Log the CA cert with the debug statement https://review.openstack.org/130754 | 12:44 |
| *** dims has quit IRC | 12:51 | |
| *** dims has joined #openstack-keystone | 12:52 | |
| *** gokrokve has joined #openstack-keystone | 12:58 | |
| ayoung | jamielennox, found a fun one out last night. You know how the updated cloudsample policy file does the smart thing and says that in order to list projects in a domain you have to be admin on that domain? Turns out that breaks Horizon | 13:00 |
| jamielennox | ayoung: why is horizon dealing with domains | 13:01 |
| rodrigods | ayoung, exactly... a teammate is working on a patch to fix that | 13:01 |
| jamielennox | oh - | 13:01 |
| jamielennox | mmm | 13:01 |
| rodrigods | https://review.openstack.org/#/c/126988/ | 13:02 |
| *** gokrokve has quit IRC | 13:08 | |
| ayoung | jamielennox, because Horizon only fetches project scoped tokens | 13:11 |
| *** afaranha has joined #openstack-keystone | 13:11 | |
| *** afaranha has quit IRC | 13:11 | |
| *** afaranha has joined #openstack-keystone | 13:11 | |
| ayoung | rodrigods, I think that anything we do there is going to be problematic | 13:11 |
| ayoung | rodrigods, thing is, we are working with the cloudsample policy file, which radically changes the rules | 13:11 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json | 13:12 |
| ayoung | rodrigods, in this case, the rule is_admin means | 13:12 |
| ayoung | well, this rule | 13:12 |
| ayoung | "identity:list_projects": "rule:admin_required and domain_id:%(domain_id)s", | 13:12 |
| ayoung | So: user must have the admin role, and the domain_id needs to match. | 13:13 |
| rodrigods | ayoung, yeah... | 13:13 |
| ayoung | But if you are using a default project, then the domain_id is probably for the wrong domain | 13:13 |
| ayoung | it is messy, and I think we need to sit down with the horizon folks to figure out a path forward | 13:14 |
| ayoung | rodrigods, but.... | 13:14 |
| ayoung | I want to collapse IdPs, Domains, and Projects all into one supertype | 13:14 |
| ayoung | Idps will have no parents | 13:14 |
| ayoung | domains will live under idp | 13:14 |
| ayoung | project under domain | 13:14 |
| ayoung | but we'll treat them all as roughly the same thing | 13:14 |
| ayoung | "tenants" | 13:15 |
| rodrigods | ayoung, ++ | 13:15 |
| rodrigods | this would simplify A LOT | 13:15 |
| rodrigods | this domain vs project scoping stuff | 13:16 |
| *** thiagop has joined #openstack-keystone | 13:16 | |
| rodrigods | ayoung, about the list_projects issue, shouldn't horizon use the list_projects_for_user() instead of listing the projects in a domain? | 13:17 |
| ayoung | rodrigods, nope | 13:18 |
| ayoung | this is on the admin panel | 13:18 |
| thiagop | ayoung: why? | 13:18 |
| ayoung | not on the users lists of projects | 13:18 |
| *** bknudson has quit IRC | 13:18 | |
| ayoung | for the list of projects, it does use list_projects_for_user | 13:18 |
| ayoung | thiagop, ^^ make sense? | 13:19 |
| thiagop | ayoung: you mean the project picker? | 13:19 |
| ayoung | in the project picker it uses list_projects_for_user | 13:19 |
| ayoung | but there is the admin panel, for administering projects (add new, etc) | 13:20 |
| thiagop | Identity/projects, right? | 13:20 |
| ayoung | yeah | 13:20 |
| jamielennox | lol never say tenants | 13:20 |
| jamielennox | and domains shouldn't live under idps, they should be different things | 13:21 |
| ayoung | domains should live under idps | 13:22 |
| ayoung | idps Own things | 13:22 |
| jamielennox | i thought that was one of the goals of hierarchical multitenancy | 13:22 |
| ayoung | domains should probably go away | 13:22 |
| jamielennox | ayoung: why | 13:22 |
| ayoung | cuz they are just projects | 13:22 |
| ayoung | if Idps own users | 13:22 |
| jamielennox | why does an idp own things | 13:22 |
| thiagop | I've always find it strange that I, as a user, could see projects that I don't have a role in | 13:23 |
| ayoung | really, these things are all namespaces | 13:23 |
| ayoung | thiagop, A general can see all of the Bridages in his Division. He doesn't have a role in those Brigades, he has a role in the organization that containes those brigades | 13:24 |
| ayoung | but..with Hierarchical Multitenancy they want to do information hiding | 13:24 |
| ayoung | so if Cloud provider sells to reseller who then sells to me, cloud provider should not see "me" | 13:24 |
| jamielennox | ayoung: right, but we collapse a domain into a project then | 13:25 |
| ayoung | yep. | 13:25 |
| jamielennox | which is great | 13:25 |
| ayoung | domain is a project | 13:25 |
| ayoung | domains are projects who have no parent | 13:25 |
| jamielennox | right, still not sure why an idp should live in that tree | 13:25 |
| ayoung | except when it comes to users | 13:25 |
| ayoung | in which case domains are projects | 13:25 |
| ayoung | and their parents are IdPs | 13:25 |
| ayoung | jamielennox, so we just make idps, projects, and domains all subclasses of one thing. | 13:27 |
| ayoung | call it tenants, and make everyone go away | 13:27 |
| jamielennox | a domains parent is not an idp | 13:29 |
| jamielennox | because i can map a user into multiple domains | 13:29 |
| jamielennox | and a user is owned by an idp | 13:30 |
| ayoung | https://twitter.com/admiyoung/status/525462365597601792/photo/1 | 13:30 |
| ayoung | "i can map a user into multiple domains" NONONONONONONO | 13:30 |
| ayoung | A user is owned by exactly one domain | 13:30 |
| ayoung | they can have roles in many | 13:30 |
| *** gordc has joined #openstack-keystone | 13:30 | |
| ayoung | we can't break that now | 13:30 |
| ayoung | domains are part of the literature | 13:30 |
| jamielennox | hierarchical gives us that a domain is essentially just a project without a parent | 13:30 |
| jamielennox | a user can have roles in multiple unrelated projects | 13:31 |
| ayoung | I';d argue that the parent of a domain is the IdP, with the implied IdP being Keystone itself | 13:31 |
| jamielennox | therefor a user can have roles in multiple domains | 13:31 |
| jamielennox | therefore you shouldn't have it owned | 13:31 |
| jamielennox | right - and the mistake there was ever assuming that the user was owned by a domain | 13:31 |
| ayoung | unless we drop the user_domain abstraction, which is codified into the APIs, and thus we are stuck with it | 13:31 |
| ayoung | users used to be owned by projects | 13:32 |
| jamielennox | user_domain_id should become user_idp_id | 13:32 |
| jamielennox | and i don't see how to handle all this with v3 :) | 13:32 |
| ayoung | well, we could merge domains and IdPs | 13:33 |
| ayoung | but then we are one to one with Idps and domains, which might not be right | 13:33 |
| ayoung | I always suspected that it should be one to at-least-one | 13:34 |
| *** radez is now known as radez_g0n3 | 13:34 | |
| amakarov | ayoung, hi! Steve Hardy wants redelegation enabled by default :) | 13:34 |
| ayoung | amakarov, OK | 13:34 |
| ayoung | I'm cool with that | 13:35 |
| ayoung | ask morganfainberg when he is around amakarov | 13:35 |
| ayoung | amakarov, it is backwards compatible. Its just a risk | 13:35 |
| ayoung | we tend to disable a new feature like that until its somewhat hardened | 13:35 |
| amakarov | ayoung, I understand | 13:36 |
| ayoung | He wants to know that it is something he can rely on | 13:36 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:36 | |
| ayoung | amakarov, so, not in the first patch | 13:36 |
| ayoung | but we can have the goal to have them enabled at release | 13:36 |
| *** bknudson has joined #openstack-keystone | 13:36 | |
| amakarov | ayoung, so I stick to current implementation for now? | 13:37 |
| ayoung | yep. | 13:37 |
| amakarov | ayoung, thanks ) | 13:37 |
| *** afazekas_ has joined #openstack-keystone | 13:39 | |
| ayoung | jamielennox, so we make a subclass for all of these things: Idps, projects, domains, and make sure that the Ids are unique across all of them | 13:41 |
| jamielennox | ayoung: ids are uuids now - with some fudging we assume that already | 13:41 |
| ayoung | yep | 13:41 |
| ayoung | it might be our saving grace here | 13:41 |
| *** bknudson has quit IRC | 13:42 | |
| *** vhoward has left #openstack-keystone | 13:43 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Use mask_password from oslo.utils.strutils https://review.openstack.org/130797 | 13:44 |
| rodrigods | marekd, just commented in the ECP/POST review, we can discuss it here =) | 13:44 |
| marekd | rodrigods: one main diference between websso and ecp is how you authenticate with idp | 13:46 |
| rodrigods | marekd, hm... | 13:46 |
| rodrigods | trade offs? | 13:46 |
| marekd | ? | 13:46 |
| marekd | websso assumes it browser and human being usin it | 13:47 |
| marekd | it will give him a webpage | 13:47 |
| *** vejdmn has joined #openstack-keystone | 13:47 | |
| marekd | usually with user/pass form. | 13:47 |
| marekd | super hard to parse and make sure python-requests will know how to use it, right? | 13:47 |
| marekd | that's why ECP comes into | 13:47 |
| marekd | it assumes that pure http client is used there, and it's aall XML/SOAP | 13:48 |
| marekd | more cli firnedly, right? | 13:48 |
| marekd | friendly | 13:48 |
| marekd | in k2k we break whole stuff | 13:48 |
| marekd | you authenticate with your idp actually by passing your openstack token | 13:49 |
| ayoung | ECP is pretty much required for SAML in a CLI use | 13:49 |
| *** bknudson has joined #openstack-keystone | 13:49 | |
| marekd | ayoung: ++ | 13:50 |
| marekd | ayoung: but only because websso will present you a webpage for authN | 13:50 |
| rodrigods | marekd, once we already have the SAML assertion in k2k, the webpage isn't required, right? | 13:51 |
| ayoung | jamielennox, for Horizon...should it attempt to get a domain scoped token for Admin panels? | 13:51 |
| ayoung | k2k should do ECP | 13:51 |
| rodrigods | but... since we are getting in the middle for both | 13:51 |
| rodrigods | i don't see how websso can be better than ECP for our case | 13:52 |
| jamielennox | ayoung: i guess the theory was always that you needed a domain scoped token to list users etc | 13:52 |
| ayoung | and list projects for a domain... | 13:52 |
| jamielennox | ayoung: we don't have the best 'admin token' story - so i think domain scoped token is the best we can do | 13:52 |
| marekd | not all sps can talk ecp | 13:52 |
| ayoung | Horizon just assumes a global project list, I think | 13:52 |
| rodrigods | marekd, good point | 13:52 |
| ayoung | jamielennox, or we do it all with an unscoped, and check permissions inside Keystone | 13:53 |
| marekd | saml2 was designed for browsers | 13:53 |
| rodrigods | marekd, but we need excellent support for both than | 13:53 |
| marekd | ecp is an extension. | 13:53 |
| ayoung | saml2 wasn';t designed. It crawled out of the primordial soup | 13:53 |
| jamielennox | ayoung: i'd be ok with that, i think we expect more from our policy layer that it can handle | 13:54 |
| ayoung | policy could handle it in Keystone | 13:54 |
| ayoung | just only in Keystone, since Keystone has all of the Roles assignments | 13:54 |
| marekd | rodrigods: it's something we cannot control. | 13:55 |
| marekd | you are supposed to federate your keystone along with non openstack products | 13:55 |
| marekd | it's not something you can control...it's not openstack ecosystem. | 13:55 |
| ayoung | jamielennox, of course, if we split the Identity part from the Assignment part....I thiin we'd still be good. It would all be managed from the Assignment part | 13:56 |
| marekd | rodrigods: joesavak was business suporter for k2k | 13:56 |
| marekd | so he may have some insignht on whether it should be websso or ecp | 13:57 |
| rodrigods | marekd, ++ | 13:57 |
| rodrigods | I vote for both | 13:57 |
| jamielennox | ayoung: if we roll domains into projects, do you think instead of going to api v4 next we can go to api v2.1 ? | 13:59 |
| marekd | ayoung: what was the initial concept of the domains, btw? | 13:59 |
| ayoung | jamielennox, yeah, sure! | 13:59 |
| ayoung | jamielennox, I say we go asymptotic to Pi | 14:00 |
| ayoung | marekd, namespaces for users | 14:01 |
| ayoung | marekd, I'd have to git log to find the commit...link to the blueprint that way, I think | 14:01 |
| *** marekd has quit IRC | 14:04 | |
| *** marekd has joined #openstack-keystone | 14:09 | |
| *** richm has joined #openstack-keystone | 14:11 | |
| *** radez_g0n3 is now known as radez | 14:18 | |
| lbragstad | marekd: rodrigods re: k2k stuff with jsavak. I believe he is on ETO today but he said to go ahead and email him if you have questions. | 14:21 |
| jamielennox | ayoung: if we roll domains into projects, do you think instead of going to api v4 next we can go to api v2.1 ? | 14:25 |
| jamielennox | woops, sorry up + enter | 14:25 |
| *** andreaf_ has quit IRC | 14:25 | |
| ayoung | I still think it is a great idea | 14:25 |
| *** andreaf_ has joined #openstack-keystone | 14:26 | |
| jamielennox | it's a horrible idea | 14:27 |
| gabriel-bezerra | ayoung, jamielennox: how is that change related to domain-specific drivers? | 14:28 |
| ayoung | gabriel-bezerra, we are not really planning on moving back to 2.1 | 14:28 |
| gabriel-bezerra | I mean.. it seems to me that a domain-specific identity backend would be an IdP, but how would domains fit there then? | 14:29 |
| gabriel-bezerra | ayoung: my question is about the (idp, domain, project) change | 14:30 |
| ayoung | gabriel-bezerra, just problem solving for now: I think that the solution lies in there. | 14:30 |
| ayoung | gabriel-bezerra, Don't take this as done-deal, rather as brainstorming, feel free to contribute | 14:31 |
| gabriel-bezerra | ok :) | 14:31 |
| marekd | lbragstad: ETO ? | 14:31 |
| ayoung | I agree that domain specific identity backend should be for an IdP | 14:31 |
| lbragstad | marekd: Earned Time Off | 14:31 |
| ayoung | I would think that Idp should have a one-to-one with a domain, but we could make them the same thing and have the same solution | 14:32 |
| jamielennox | lbragstad: ... is that a thing, or did i miss a joke there somewhere | 14:32 |
| ayoung | if we forces A ONE-TO-ONE between IdP and domains, it would probably work, too | 14:32 |
| ayoung | jamielennox, probably an accounting acronym for time off htat is accrued | 14:33 |
| jamielennox | ayoung: not always going to be on IRC so please assume I'm always going to say NO when you suggest that | 14:33 |
| ayoung | jamielennox, meaning IDP->domains? | 14:33 |
| ayoung | one to one? | 14:33 |
| jamielennox | yea, | 14:33 |
| gabriel-bezerra | I see domains as a user repository/namespace, so it would map directly to an idp | 14:34 |
| ayoung | meaning you want to drop the whole domain-around-users concept? | 14:34 |
| gabriel-bezerra | as domain-specific backends do | 14:34 |
| jamielennox | whilst ever domains own projects i think it's a bad idea | 14:34 |
| ayoung | we've already dug this ditch, we are just trying to climb out of it | 14:35 |
| jamielennox | in which case we should kill the term and move to idps own users projects own projects and only roles map from one to the other | 14:35 |
| ayoung | the decision was made back before we split Identity and Assignment | 14:35 |
| ayoung | yeah, that is the cleaner language | 14:35 |
| jamielennox | yea - also i'm not doing any work in that space to actually get in and influence it | 14:35 |
| ayoung | I'm just looking for a transition plan | 14:35 |
| lbragstad | jamielennox: it's a thing | 14:36 |
| jamielennox | same with some of my federation concerns that i found a week before RC | 14:36 |
| ayoung | So for now, we say one-to-one Idp to domain, and IdP/domains (not ones backed by keystone) can't own projects? | 14:36 |
| gabriel-bezerra | would a project own an IdP? | 14:36 |
| jamielennox | lbragstad: is it as ayoung suggested an accrued thing? or can your manager just award you time off for doing something? | 14:36 |
| ayoung | nope | 14:36 |
| ayoung | gabriel-bezerra, projects don't own IdPs | 14:37 |
| lbragstad | ETO is usually accrued | 14:37 |
| ayoung | IdPs are top of the tree | 14:37 |
| gabriel-bezerra | I liked jamielennox's suggestion, my question is in that context | 14:37 |
| lbragstad | jamielennox: so you get ETO over time | 14:38 |
| rodrigods | lbragstad, I'd enjoy some ETO ;) | 14:38 |
| jamielennox | lbragstad: ok - just never heard the term and though 'earned' was a weird way to phrase it | 14:38 |
| lbragstad | jamielennox: it's a type of 'time off' policy offered by employers | 14:39 |
| gabriel-bezerra | I'm asking about the case of a customer of a public cloud being able to configure his/her idp as a way for his/her employees to sign in | 14:40 |
| marekd | lbragstad: jamielennox i thought 'earned' was used by Lance here to indicate, that joe was working supre hard so he took a day off and he really deserves it :P | 14:40 |
| gabriel-bezerra | ayoung jamielennox ^ | 14:40 |
| lbragstad | marekd: well.. that *could* be the case, I'm just the proxy :) | 14:40 |
| ayoung | gabriel-bezerra, ability to manage an IdP should be based on a role assigned to a user | 14:40 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 14:41 |
| ayoung | OK...so the hierarchy needs to have a root: we've typically called that the Default domains | 14:41 |
| openstackgerrit | A change was merged to openstack/keystone: Add fileutils module https://review.openstack.org/130666 | 14:41 |
| marekd | lbragstad: btw, how many paid days off (or day offs?) do you have in USA? | 14:41 |
| ayoung | er default domain | 14:41 |
| gabriel-bezerra | ayoung: you mean the project hierarchy, right? | 14:41 |
| ayoung | yeah....all this stuff | 14:41 |
| ayoung | really, we are just reinventing a hierarchical database here | 14:42 |
| ayoung | these are all collections | 14:42 |
| jamielennox | yea, i think you would make idp management a role based check | 14:42 |
| lbragstad | marekd: it depends on a lot of different things (i.e. experience and employer) | 14:42 |
| ayoung | So at the root of the tree you have the keystone server itself | 14:42 |
| marekd | lbragstad: say, somebody with 2-5 years of experience | 14:42 |
| marekd | so probably somebody like you or me. | 14:42 |
| ayoung | under that you have IdPs on the identity side. jamielennox 's suggestion is that domains are on the assignment side | 14:42 |
| jamielennox | i don't think it's worth complicating it more than that, and you can always use groups if you want to pick up multiple useres | 14:42 |
| rodrigods | marekd, thinking of moving to US? | 14:43 |
| rodrigods | =) | 14:43 |
| marekd | rodrigods: | 14:43 |
| marekd | no | 14:43 |
| marekd | just curious | 14:43 |
| ayoung | so, first layer down is "modules" with identity, assignemnt, and service catalog in them | 14:43 |
| ayoung | under identity we have IdPs | 14:43 |
| ayoung | under assignement we have projects | 14:43 |
| ayoung | and under service catalog we have services | 14:43 |
| rodrigods | marekd, I now that for Microsoft, (with such experience) you have 15 days off | 14:43 |
| ayoung | next level down should be clear, but to be explicit | 14:43 |
| jamielennox | ayoung: my concern is that we should never re-use a term, we can't transition domain from one thing to another, and i've always considered domains more about multitenancy rather than user grouping | 14:43 |
| ayoung | unser Idps we have users and groups | 14:43 |
| lbragstad | marekd: that's a tough one, it depend a lot on employer.. I think when I graduated college most of the people I graduated with ended up with around 14 days at their first job? | 14:44 |
| ayoung | under domains we have projects (or tenants in oldspeak) | 14:44 |
| lbragstad | marekd: depending on their start date | 14:44 |
| gabriel-bezerra | ayoung: I guess jamielennox's suggestion doesn't involve domains. | 14:44 |
| lbragstad | wrt the first of the year | 14:44 |
| marekd | aha | 14:44 |
| ayoung | under services we have endpoints...crud, service catalog has regions | 14:44 |
| ayoung | and endpoints are kindof under both | 14:44 |
| jamielennox | marekd: i assume this is real simple and legally mandated for you too? | 14:44 |
| ayoung | ok, endpoints are under services | 14:44 |
| ayoung | the relationship between endpoints and regions is an assignment one | 14:45 |
| ayoung | symlink: an endpoint can be in more than one region | 14:45 |
| marekd | jamielennox: is it for you? | 14:45 |
| jamielennox | marekd: yea, 20days per year is law, and i really don't know any employers that offer more - it's just not something people mess with | 14:45 |
| ayoung | EPO/PTO terms came out of merging vacation and sick days | 14:45 |
| marekd | jamielennox: i work for cern so it's a different story, but for the normal company - in Europe, at least in European Union it's rather decided by law | 14:46 |
| marekd | jamielennox: exactly | 14:46 |
| ayoung | I used to get 10 vacation and 5 sick days a year. Somehow that got collapsed into 10 days PTO | 14:46 |
| ayoung | Europe closes down for August | 14:46 |
| jamielennox | yea, i think our 20 is supposed to be split 10/10 | 14:46 |
| ayoung | we also get like 3 floating hoidays or something | 14:47 |
| marekd | jamielennox: and our's 20 is 20 for vacation. If you get sick, you go to the doctor, get a paper and you get paid 80% of your salary. for that time. | 14:47 |
| ayoung | cuz not everyone celebrates the Feast of the Assumption or Tu B'Shvat | 14:47 |
| bknudson | I'd be in pretty bad shape if I was sick 10 days a year. | 14:47 |
| ayoung | Kids | 14:47 |
| bknudson | at least, too sick to sit at a computer. | 14:48 |
| ayoung | bknudson, if your kids get sick, they don't go to school or daycare | 14:48 |
| ayoung | and someone needs to stay home with them | 14:48 |
| ayoung | and that is more and more a reason for PTO, in two-income families | 14:48 |
| jamielennox | bknudson: it's not sick - they call it personal, can be used for sick, kids, things like family funerals | 14:48 |
| ayoung | job interviews | 14:48 |
| marekd | ++ | 14:48 |
| jamielennox | heh | 14:48 |
| bknudson | I thought that's what the summit was for? | 14:49 |
| *** radez is now known as radez_g0n3 | 14:51 | |
| marekd | bknudson: heh | 14:52 |
| openstackgerrit | A change was merged to openstack/keystone: test_utils use jsonutils from oslo.serialization https://review.openstack.org/130674 | 14:52 |
| *** thedodd has joined #openstack-keystone | 14:52 | |
| nkinder | mhu: I'm seeing problems with the OSC code from git that might be related to the auth plugin stuff | 14:53 |
| gabriel-bezerra | ayoung: I cannot delete a domain that is backed by a populated read-only LDAP database. It is a bug, right? (just asking before filing) | 14:53 |
| nkinder | ayoung: you might be interested too since I was talking with you about this problem... | 14:53 |
| nkinder | mhu, ayoung: http://paste.openstack.org/show/124105/ | 14:53 |
| mhu | nkinder, I'll have a look | 14:54 |
| nkinder | That's the same OSC user-list command with the released OSC (that works) and the new one. | 14:54 |
| nkinder | the domain info is missing, which results in a 400 from keystone | 14:54 |
| ayoung | Name versus ID | 14:54 |
| ayoung | so git one is broken? | 14:55 |
| nkinder | ayoung: no, it's a missing domain | 14:55 |
| nkinder | ayoung: yes, the git one is broken | 14:55 |
| ayoung | git blame? | 14:55 |
| nkinder | ayoung: about to file a bug and start tracing that down | 14:55 |
| ayoung | cool | 14:55 |
| ayoung | gabriel-bezerra, multi-backend? | 14:56 |
| *** topol has joined #openstack-keystone | 14:56 | |
| gabriel-bezerra | ayoung: yes, domain-specific | 14:56 |
| mhu | nkinder, what's the context ? how is osc user-list called ? | 14:56 |
| *** comstud is now known as bearhands | 14:57 | |
| ayoung | gabriel-bezerra, what error do you get? I'm not certain its a bug or not. Suspect a foreign key constraint | 14:57 |
| nkinder | mhu: openstack --debug --os-identity-api-version 3 --os-auth-url http://rhos.rhosdom.test:35357/v3 --os-username admin --os-password XXXXXXXX --os-project-name admin user list | 14:57 |
| ayoung | but you need to disable a domain before deleting no matter what | 14:57 |
| vsilva | pretty late at the discussion, marekd, but at Facebook you get 21 days PTO a year | 14:57 |
| nkinder | mhu: This is from some automation that I've been using for about a month, but breaks if I install OSC from git | 14:57 |
| marekd | vsilva: so it's not regulated by law. | 14:58 |
| gabriel-bezerra | ayoung: {"error": {"message": "You are not authorized to perform the requested action: LDAP group delete (Disable debug mode to suppress these details.)", "code": 403, "title": "Forbidden"} | 14:58 |
| nkinder | mhu: 0.4.0 works fine | 14:58 |
| ayoung | gabriel-bezerra, cuz deleting the domain trys to delete all of the objects inside it | 14:58 |
| vsilva | I don´t believe it is, marekd, but I´d say it´s somewhere between 10-20 for most companies | 14:58 |
| gabriel-bezerra | ayoung: it is being disabled | 14:58 |
| ayoung | You'd have to unmap the domain specific backend part first | 14:59 |
| nkinder | mhu: I don't mean to blame your patch, it could be something else. :) | 14:59 |
| mhu | nkinder, no offense taken, don't worry :) | 14:59 |
| nkinder | mhu: just seems in a similar area and wanted to give a heads up | 14:59 |
| ayoung | so remove the file, restart the server,and I bet it works...and I think that is as it should be under current ways of thinking | 14:59 |
| mhu | nkinder, it's probably because os_domain_id must be set to default by default in 0.4.0 | 14:59 |
| gabriel-bezerra | ayoung: ok. no bug then. thank you. | 15:00 |
| ayoung | yeah...but maybe something to document | 15:00 |
| nkinder | mhu: yeah, let me explicitly add the option | 15:00 |
| ayoung | gabriel-bezerra, until we make the configuration something that can be done on the fly and without restarting the server, I'd say it "works as designed" | 15:00 |
| mhu | nkinder, in the meantime I'll have a quick look at the code on master and 0.4.0 | 15:01 |
| nkinder | mhu: related to this most likely https://bugs.launchpad.net/python-keystoneclient/+bug/1272451 | 15:01 |
| uvirtbot | Launchpad bug 1272451 in python-keystoneclient "hardcoded references to 'default' domain id" [Undecided,Opinion] | 15:01 |
| nkinder | mhu: ...or similar at least | 15:02 |
| *** cjellick has joined #openstack-keystone | 15:05 | |
| openstackgerrit | A change was merged to openstack/keystone: Sync modules from oslo-incubator https://review.openstack.org/130672 | 15:06 |
| *** cjellick has quit IRC | 15:06 | |
| *** cjellick has joined #openstack-keystone | 15:07 | |
| gabriel-bezerra | ayoung: I'll file the bug then, just to keep track of the issue. | 15:07 |
| ayoung | ++ | 15:07 |
| ayoung | nkinder, I'm kindof stumped about what to do with the policy thing for Horizon in the short term | 15:08 |
| ayoung | I mean, dropping the domain requirement would be pretty bad. | 15:08 |
| ayoung | but Horizon won't work with it. And I don't think I can fix in time for the summit | 15:08 |
| *** joesavak has joined #openstack-keystone | 15:09 | |
| *** andreaf_ has quit IRC | 15:10 | |
| ayoung | "list projects" in the abstract doesn't make sense in any sort of nested arraingment anyway: it should be list_projects under X where X is the parent | 15:11 |
| *** andreaf_ has joined #openstack-keystone | 15:11 | |
| ayoung | keystone admin operations should not require a scoped token | 15:11 |
| *** thedodd has quit IRC | 15:12 | |
| nkinder | ayoung: it would have to be aware of domain scoped tokens I think | 15:12 |
| *** jsavak has joined #openstack-keystone | 15:13 | |
| *** thedodd has joined #openstack-keystone | 15:14 | |
| thiagop | ayoung: what kind of error are you seeing in horizon? | 15:14 |
| *** __TheDodd__ has joined #openstack-keystone | 15:15 | |
| ayoung | thiagop, https://twitter.com/admiyoung/status/525462365597601792 | 15:15 |
| ayoung | heh | 15:15 |
| ayoung | thiagop, OK, so we are using the cloudsample policy file, and with that, to list projects you need a domain scoped token | 15:15 |
| ayoung | doesn't matter what privs the user has, Horizon only knows about project scoped tokens | 15:16 |
| *** dims is now known as dimsum_ | 15:16 | |
| thiagop | ayoung: I believe the problem there is that Horizon doesn't give you access if you're not in a project | 15:16 |
| *** joesavak has quit IRC | 15:18 | |
| thiagop | ayoung: e.g.: https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/identity/projects/views.py#L79 | 15:18 |
| *** david-lyle has joined #openstack-keystone | 15:18 | |
| ayoung | thiagop, yea, that too | 15:18 |
| thiagop | here we have an operation using domain scope when you do have access to list_projects | 15:18 |
| ayoung | and the solution is to redefine the problem: everything is a projects! | 15:18 |
| *** thedodd has quit IRC | 15:19 | |
| ayoung | thiagop, domain_scope? Meaning requesting a domains scoped token? How? | 15:19 |
| nkinder | thiagop: the v3 cloud policy sample also only allows listing projects for domain scoped tokens | 15:19 |
| nkinder | thiagop: ...which makes sense, as it's something that the domain admin is responsible for managing (not a project admin) | 15:20 |
| ayoung | and there is no way that Horizon today knows how to request a domain scoped token | 15:20 |
| thiagop | L84 | 15:20 |
| thiagop | I didn't test it on my setup though | 15:21 |
| david-lyle | ayoung, not with the code checked in | 15:21 |
| nkinder | dtroyer: fyi, I've noticed a regression in the current OSC code that may or may not be important - https://bugs.launchpad.net/python-openstackclient/+bug/1385338 | 15:21 |
| uvirtbot | Launchpad bug 1385338 in python-openstackclient "Keystone v3 authentication request is malformed with latest OSC code" [Undecided,New] | 15:21 |
| nkinder | dtroyer: I'm not sure if it was an intentional change or not, but commands that worked in 0.4.0 will no longer work without adding additional options to specify the domain | 15:22 |
| david-lyle | it's a trivial modification really to get a domain scoped token, the problem is that the rest of horizon is expecting a project scoped token | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use connection retrying from keystoneclient https://review.openstack.org/129868 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Add versions to requests https://review.openstack.org/130531 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use an adapter in IdentityServer https://review.openstack.org/130530 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use Discovery fixtures for auth token tests https://review.openstack.org/130247 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Convert authentication into a plugin https://review.openstack.org/115857 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Additional discovery changes https://review.openstack.org/130533 | 15:22 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use real discovery object in auth_token middleware. https://review.openstack.org/130532 | 15:22 |
| *** tellesnobrega_ has joined #openstack-keystone | 15:22 | |
| *** marekd is now known as marekd|away | 15:23 | |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 15:24 |
| *** afazekas_ has quit IRC | 15:24 | |
| nkinder | dolphm: I'm interested in getting your take on the above OSC bug too, as you had some conversations around a similar issue with KSC earlier in the year. | 15:25 |
| david-lyle | ayoung the other consideration is how the user determines if they want a domain scoped token or a project scoped token | 15:25 |
| ayoung | david-lyle, users don't really make that decision. All they can do is select a project | 15:26 |
| ayoung | can they even select a domain? | 15:26 |
| david-lyle | yes | 15:26 |
| nkinder | david-lyle: it's almost like the domain should be listed in the project list | 15:26 |
| david-lyle | they have to enter it | 15:26 |
| ayoung | we just show the set of projects for which the user has roles | 15:26 |
| dtroyer | nkinder: that isn't intentional, but we did strip the auth option handling down to rely on the plugins for checking, setting the default probably went away with that | 15:26 |
| nkinder | ...but we don't know if the user has a role on their domain | 15:26 |
| jamielennox | bknudson and anyone else interested: with those ^ and https://github.com/jamielennox/devstack/tree/v3auth devstack deploys with v3 auth | 15:26 |
| ayoung | No, that is the namespace for the user themsef, not as the target of their operations | 15:27 |
| david-lyle | breaking out the domain administration actions into a separate token type seems wrong to me | 15:27 |
| david-lyle | but i missed the argument on that one originally | 15:27 |
| ayoung | david-lyle, that is what we were discussing before: unifying projects, IdPs, and domains into a single coherent structure | 15:27 |
| david-lyle | ayoung: that would be much better | 15:27 |
| david-lyle | not just from a GUI perspective | 15:27 |
| ayoung | david-lyle, domains are really an unnecessary abstraction | 15:27 |
| david-lyle | the CLI handling is confusing as well | 15:27 |
| ayoung | with HTM, everything could be project on the assignment side | 15:28 |
| ayoung | and on the user side, users would be owned by IdPs | 15:28 |
| david-lyle | HTM? HMT? | 15:28 |
| ayoung | heh | 15:29 |
| ayoung | hierarchical multi tenancy | 15:29 |
| david-lyle | making sure | 15:29 |
| david-lyle | I'm easily confused | 15:29 |
| ayoung | not to be confused with hierarchical temporal memory | 15:29 |
| bknudson | jamielennox: I had updated devstack to use the change that was reverted... so can also revert that change | 15:29 |
| jamielennox | oh, was that one submitted to devstack? | 15:30 |
| jamielennox | anyway, that one uses the straight password plugin, which will use v3 | 15:30 |
| bknudson | jamielennox: yes, I wanted to test it. | 15:30 |
| jamielennox | it should be replacable with any plugin | 15:30 |
| bknudson | (locally, not in tempest) | 15:30 |
| jamielennox | keeping backwards compatability there is a nightmare, so most of the changes are as small as possible - sometimes stupidly so | 15:31 |
| david-lyle | nkinder: the problem with adding it to the project list is it doesn't behave like a project | 15:31 |
| bknudson | jamielennox: ah, it didn't merge yet: https://review.openstack.org/#/c/123012/ | 15:32 |
| nkinder | david-lyle: yeah, I know. I can't think of an easy answer. | 15:32 |
| david-lyle | we've made recent changes to show the domain, in the context information, perhaps we could let the user rescope their token there, but that requires some fairly advanced understanding of the identity model in OpenStack by general users | 15:32 |
| jamielennox | ok, with that i'm out for the night - have a good weekend everybody | 15:33 |
| nkinder | jamielennox: later | 15:33 |
| david-lyle | the other idea was to just grab a domain scoped token and project scoped token (if a project role exists) and have Horizon hide the internal decisions as to which token to use | 15:33 |
| *** lsmola has quit IRC | 15:34 | |
| david-lyle | we need more session space to do that, hence the ML thread | 15:34 |
| david-lyle | regarding session stores in horizon | 15:34 |
| *** lsmola has joined #openstack-keystone | 15:35 | |
| ayoung | david-lyle, I want to go the other direction for Keystone: if you have an unscoped token, you should be able to perform operations inside of Keystone. | 15:36 |
| ayoung | Getting a scoped token buys us nothing. | 15:36 |
| ayoung | Now, honoring a scoped token is something different | 15:36 |
| ayoung | but for Horizon -> keystone those operations should be performed unscoped, and the RBAC should be dynamic | 15:37 |
| david-lyle | that's how HP did it actually | 15:37 |
| bknudson | you don't have any roles in an unscoped token | 15:38 |
| *** cjellick has quit IRC | 15:39 | |
| david-lyle | really keystone should be telling me what actions I can do, regardless of token scope | 15:40 |
| david-lyle | I don't it requires passing back the roles to me the user | 15:40 |
| david-lyle | but that gets very complicated quickly | 15:41 |
| david-lyle | *I don't think | 15:41 |
| *** jsavak has quit IRC | 15:47 | |
| *** vejdmn has quit IRC | 15:53 | |
| *** amerine has quit IRC | 15:57 | |
| *** miqui has quit IRC | 15:59 | |
| *** palendae has quit IRC | 15:59 | |
| *** miqui has joined #openstack-keystone | 15:59 | |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 16:00 |
| *** nkinder has quit IRC | 16:00 | |
| *** jimbaker has quit IRC | 16:01 | |
| ayoung | bknudson, you don't need roles in an unscoped token if the operations i performed against Keystone itself. Keystone can look up the roles itself | 16:01 |
| *** palendae has joined #openstack-keystone | 16:01 | |
| bknudson | ayoung: the roles on the project? | 16:02 |
| ayoung | david-lyle, keystone doensn't know the complete set of operations on other services yet. We need to work on the policy interface a little better | 16:02 |
| *** vhoward has joined #openstack-keystone | 16:02 | |
| ayoung | bknudson, If a user does list_projects, what should happen? | 16:02 |
| david-lyle | ayoung: I fully agree | 16:02 |
| *** amerine has joined #openstack-keystone | 16:02 | |
| bknudson | ayoung: if the user doesn't have authority to list_projects then they should get a 403. | 16:02 |
| ayoung | bknudson, right now, it is implied that either they can globally list projects or get nothing | 16:02 |
| ayoung | instead, it should be list_projects_for_scope | 16:03 |
| ayoung | and then...keystone should looks to see if the user has access to enumerate projects in that scope | 16:03 |
| ayoung | its a tough question how, though | 16:03 |
| *** jimbaker has joined #openstack-keystone | 16:03 | |
| *** jimbaker has quit IRC | 16:03 | |
| *** jimbaker has joined #openstack-keystone | 16:03 | |
| ayoung | we don't tend to make it easy to work backwards from operations to roles | 16:03 |
| ayoung | today we assume that the user will pass in a token with the scope pre-populated | 16:04 |
| *** nkinder has joined #openstack-keystone | 16:04 | |
| ayoung | I'd argue that if I do list_projects_for_scope keystone should attempt to make a temporary-project-scoped token for me...just for the span of this request | 16:04 |
| *** chrisshattuck has joined #openstack-keystone | 16:05 | |
| ayoung | unless an explicit token comes in, let keystone make a best effort based on the scope of the request to list roles for scope | 16:05 |
| *** chrisshattuck has left #openstack-keystone | 16:05 | |
| ayoung | what did I do for the basic-auth patch? | 16:05 |
| ayoung | https://review.openstack.org/#/c/92137/9/keystone/middleware/basic_auth.py,cm | 16:06 |
| *** vejdmn has joined #openstack-keystone | 16:06 | |
| *** tellesnobrega_ has quit IRC | 16:06 | |
| ayoung | I punted | 16:10 |
| ayoung | you'd bascially get an unscoped token's data in the context | 16:10 |
| *** thiagop has quit IRC | 16:11 | |
| ayoung | actually just set REMOTE_USER... | 16:11 |
| ayoung | I had something more in the HTML patch | 16:11 |
| ayoung | lost in history now...maybe an earlier review | 16:13 |
| *** _cjones_ has joined #openstack-keystone | 16:15 | |
| *** _cjones_ has quit IRC | 16:16 | |
| *** _cjones_ has joined #openstack-keystone | 16:16 | |
| ayoung | david-lyle, this is the problem with us not having thought about this from both the CLI and WebUI at the same time. Discoverability is broken | 16:18 |
| ayoung | If I log in to Horizon, the first thing Horizon should do is go to Keystone and say "what should Adam see" | 16:18 |
| ayoung | this is "unscoped" so I should see a list of top level things that I can do with my token | 16:19 |
| ayoung | none of them scoped....so "select scope" | 16:19 |
| ayoung | now..."something" could remember the scope and jump directly to that level on second and subsequent visits | 16:20 |
| ayoung | lets just call it a cookie for now, and say that it is the users' clients responsibility for storing and handing it over | 16:21 |
| ayoung | so if I do "list projects" that should be done as a link with some starting point, and I should be put at that starting point by the cookie | 16:21 |
| ayoung | not just have it magically assumed into existence | 16:22 |
| david-lyle | ayoung: we essentially do that now, but pick the first project to scope to | 16:22 |
| david-lyle | we're planning on storing the last project scope in a cookie and reference that on subsequent log ins | 16:23 |
| ayoung | nope | 16:23 |
| ayoung | david-lyle, only if it is an uscoped token | 16:23 |
| ayoung | otherwise, we have magic | 16:23 |
| ayoung | "default project" | 16:23 |
| ayoung | which the user can';t even set themselves | 16:23 |
| david-lyle | we get the project_list with an unscoped token then rescope | 16:24 |
| david-lyle | we're creating our own default project implementation | 16:24 |
| david-lyle | more of a sticky project implementation | 16:24 |
| david-lyle | last one scoped to is what you're scoped to on next login | 16:25 |
| ayoung | david-lyle, so I have a spec that might interest you | 16:27 |
| ayoung | https://github.com/openstack/keystone-specs/blob/master/specs/kilo/explicit-unscoped.rst david-lyle | 16:27 |
| ayoung | we need to implement that in Keystone, and then make Horizon use it | 16:27 |
| ayoung | the follow up is to force unscoped->scoped rescoping only | 16:27 |
| ayoung | david-lyle, and...based on a conversation with jamielennox what we are going to persist in the users session is the auth plugin | 16:28 |
| ayoung | so rescoping means: start with a password auth plugin, get a token, use that token to create another auth plugin. | 16:28 |
| ayoung | THe httpsession object should actually be global to Horizon, | 16:28 |
| ayoung | which is counter intuitive of course | 16:29 |
| ayoung | I was thinking that I want to make the request be something like: | 16:29 |
| ayoung | scope : "unscoped" | 16:29 |
| david-lyle | ayoung, what do you mean by global | 16:31 |
| *** lhcheng has joined #openstack-keystone | 16:33 | |
| *** vhoward has left #openstack-keystone | 16:37 | |
| ayoung | david-lyle, heh | 16:38 |
| ayoung | david-lyle, global as in one per process | 16:38 |
| ayoung | the session object will not maintain a relationship with the auth plugin | 16:38 |
| ayoung | the keystoneclient, and other clients, will maintain that | 16:39 |
| *** aix has quit IRC | 16:41 | |
| david-lyle | the only difficulty there is horizon and openstack_auth make separate use of keystoneclient | 16:41 |
| ayoung | that is OK, as horizon gets its client from openstack_auth, right? | 16:42 |
| ayoung | so the session should be maintained by openstack_auth | 16:42 |
| *** andreaf_ has quit IRC | 16:42 | |
| david-lyle | horizon gets the session from openstack_auth | 16:42 |
| *** andreaf_ has joined #openstack-keystone | 16:43 | |
| david-lyle | if the client is attached to the session somehow we could, but right now the handling of keystoneclient is separated | 16:43 |
| ayoung | nah, I think we're good | 16:51 |
| ayoung | david-lyle, so the session would be global to openstack-auth. | 16:51 |
| david-lyle | just for token scoping operations | 16:53 |
| david-lyle | then horizon would use another instance of the client to interact with keystone for other operations | 16:53 |
| *** rwsu_ has quit IRC | 16:53 | |
| ayoung | david-lyle, yep | 16:54 |
| david-lyle | ayoung: that works | 16:54 |
| ayoung | david-lyle, of course, if we do the whole "Keystone don't need no stinken tokens" approach, it simplifies horizon | 16:55 |
| *** rwsu has joined #openstack-keystone | 16:56 | |
| david-lyle | ayoung: true, simplifies but requires some significant code removal/rework | 16:56 |
| david-lyle | long term simpler | 16:56 |
| ayoung | david-lyle, yeah | 16:57 |
| ayoung | we need to iron this out at the summit, and it is Keystone-Horizon specific discussions | 16:57 |
| david-lyle | won't eliminating tokens affect everyone? i.e. all services? | 16:58 |
| *** jistr has quit IRC | 16:58 | |
| ayoung | nope | 16:59 |
| ayoung | david-lyle, this is just for Keystone-specific operations | 16:59 |
| ayoung | why go to Keystone, get a token, just to hand it back to keystone? | 17:00 |
| ayoung | and most servcies don't do thjat | 17:00 |
| ayoung | that | 17:00 |
| david-lyle | ah, ok | 17:00 |
| ayoung | david-lyle, for something like executing a trust, sure, no token should be required for that, but that should be the extent of most keystone operations from services | 17:01 |
| ayoung | actually, If I made it that you could only create a trust when authenticated as the original user, it would probably break Heat, but it would be more secure | 17:01 |
| *** _cjones_ has quit IRC | 17:05 | |
| *** _cjones_ has joined #openstack-keystone | 17:06 | |
| *** cjellick has joined #openstack-keystone | 17:08 | |
| *** cjellick has quit IRC | 17:09 | |
| *** cjellick has joined #openstack-keystone | 17:09 | |
| *** _cjones_ has quit IRC | 17:11 | |
| *** _cjones_ has joined #openstack-keystone | 17:11 | |
| rodrigods | hey, we really need reviews in the HM API changes: https://review.openstack.org/#/c/130103/ | 17:18 |
| raildo | ++ | 17:31 |
| openstackgerrit | Abhishek Kekane proposed a change to openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 17:39 |
| *** __TheDodd__ has quit IRC | 17:41 | |
| morganfainberg | ... | 17:54 |
| *** harlowja_away is now known as harlowja | 17:55 | |
| *** harlowja is now known as harlowja_away | 17:56 | |
| *** harlowja_away is now known as harlowja | 17:58 | |
| *** alee has quit IRC | 18:02 | |
| ayoung | morganfainberg, so...thinking about access control, delegation, and capabilities. Lets say you have a rule where you need to be cleared Top Secret to access a particular piece of data. That Data is in an encrypted volume in Cinder. When creating a trust, you would want to make sure that the trustee was already cleared top secret. Or, more correctly, when checking the trust scoped token, you would want to make sure that | 18:04 |
| ayoung | the users clearance was still active. | 18:04 |
| ayoung | not everything can be delegated | 18:05 |
| morganfainberg | Right. Makes sense | 18:05 |
| ayoung | morganfainberg, I thought we had code in Keystone that said "fetch the object, and then evaluate the policy based on both the request context and the actual object" but I can't find it | 18:06 |
| ayoung | I thought it was one of the decorators that did that | 18:07 |
| morganfainberg | We do. It's done via the callback in the @protected decorator | 18:07 |
| morganfainberg | Or filter protected. | 18:07 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/controller.py#n114 | 18:08 |
| morganfainberg | You can do a lot with the callback | 18:08 |
| ayoung | .get_member_from_driver | 18:09 |
| ayoung | that is on the controll object? | 18:09 |
| morganfainberg | I believe so. It is an attribute that points to the method that should be called | 18:10 |
| morganfainberg | Iirc | 18:10 |
| ayoung | morganfainberg, that means it would have to execute that call for every policy check, not just on some. And it could only fetch one type of object | 18:11 |
| ayoung | for example role_v3 has self.get_member_from_driver = self.assignment_api.get_role | 18:12 |
| *** gyee_ has joined #openstack-keystone | 18:12 | |
| morganfainberg | That's the standard filter stuff right. ? | 18:13 |
| ayoung | hmmm | 18:13 |
| morganfainberg | Sorry walking to internet. | 18:13 |
| morganfainberg | On phone. | 18:13 |
| morganfainberg | Hard to look at code. | 18:13 |
| ayoung | No problem | 18:14 |
| morganfainberg | Will be at the coffee shop in 5or so | 18:14 |
| morganfainberg | Just ordered new internet today. So should be installed tomorrow. Just in time to go to Paris :P | 18:15 |
| *** tellesnobrega_ has joined #openstack-keystone | 18:15 | |
| *** thedodd has joined #openstack-keystone | 18:20 | |
| *** raildo_ has joined #openstack-keystone | 18:24 | |
| *** lihkin has joined #openstack-keystone | 18:25 | |
| *** lihkin_ has joined #openstack-keystone | 18:26 | |
| morganfainberg | ok | 18:27 |
| morganfainberg | ayoung, yeah i think we need smarter policy enforcement then | 18:27 |
| morganfainberg | for special usecases we could use the callback which supplants the normal enforcement, but that is not generic - it's specific for each call | 18:27 |
| *** mitz_ has quit IRC | 18:28 | |
| *** lihkin_ has quit IRC | 18:28 | |
| ayoung | morganfainberg, yeah. If you don't enforce it right down at the database level, you can always do an end run around enforcement | 18:28 |
| ayoung | its one of the reasons that LDAP and hiererachical database survived the fallout of their battle with Relational Databases | 18:28 |
| morganfainberg | yeah. | 18:29 |
| morganfainberg | i've long been a fan of LDAP for the right scenarios | 18:30 |
| *** saipandi_ has joined #openstack-keystone | 18:30 | |
| morganfainberg | example: what we used it for at blizzard. | 18:30 |
| *** marcoemorais has joined #openstack-keystone | 18:32 | |
| *** ks-untriaged-bot has joined #openstack-keystone | 18:34 | |
| ks-untriaged-bot | Untriaged bugs for project keystone: | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384789 | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384112 | 18:34 |
| uvirtbot | Launchpad bug 1384789 in keystone "XmlBodyMiddleware driver is deprecated, probably shouldn't still be the default" [Undecided,New] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384775 | 18:34 |
| uvirtbot | Launchpad bug 1384112 in keystone "endpoint, service, region can not be updated when using kvs driver" [Undecided,In progress] | 18:34 |
| uvirtbot | Launchpad bug 1384775 in keystone "revoke driver default should be the non-deprecated driver" [Undecided,New] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1361360 | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384382 | 18:34 |
| uvirtbot | Launchpad bug 1361360 in cinder "Eventlet green threads not released back to the pool leading to choking of new requests" [High,In progress] | 18:34 |
| uvirtbot | Launchpad bug 1384382 in keystone "GET /OS-FEDERATION/saml2/metadata does not work" [Undecided,In progress] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1381365 | 18:34 |
| uvirtbot | Launchpad bug 1381365 in ossa "SSL Version and cipher selection not possible" [Undecided,Won't fix] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1385405 | 18:34 |
| uvirtbot | Launchpad bug 1385405 in keystone "Domain backed by a populated read-only domain-specific LDAP identity backend cannot be deleted" [Undecided,New] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384457 | 18:34 |
| uvirtbot | Launchpad bug 1384457 in keystone "Self value in Link is wrong in GET /OS-REVOKE/events" [Undecided,In progress] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384377 | 18:34 |
| uvirtbot | Launchpad bug 1384377 in keystone "Policy rule position errors" [Undecided,New] | 18:34 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystone/+bug/1384365 | 18:34 |
| uvirtbot | Launchpad bug 1384365 in keystone "Domain admin should be allowed to show their domain" [Undecided,In progress] | 18:35 |
| ks-untriaged-bot | Untriaged bugs for project python-keystoneclient: | 18:35 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1377080 | 18:35 |
| uvirtbot | Launchpad bug 1377080 in python-keystoneclient "Stale endpoint selection logic in keystone client" [Undecided,In progress] | 18:35 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1372710 | 18:35 |
| uvirtbot | Launchpad bug 1372710 in python-keystoneclient "cfn-push-stats fails to authenticate" [Undecided,Incomplete] | 18:35 |
| ks-untriaged-bot | https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 18:35 |
| ks-untriaged-bot | Untriaged bugs for project keystonemiddleware: | 18:35 |
| uvirtbot | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,New] | 18:35 |
| ks-untriaged-bot | https://bugs.launchpad.net/keystonemiddleware/+bug/1384898 | 18:35 |
| uvirtbot | Launchpad bug 1384898 in keystonemiddleware "auth_token middleware should not require OS-SIMPLE-CERT extension for v3" [Undecided,Confirmed] | 18:35 |
| *** ks-untriaged-bot has quit IRC | 18:35 | |
| *** saipandi has quit IRC | 18:36 | |
| ayoung | morganfainberg, you used LDAP for untriaged Keystone bugs? You have been holding out on us. | 18:38 |
| lbragstad | hi ks-untriaged-bot! | 18:38 |
| morganfainberg | ayoung, hah, no. | 18:39 |
| morganfainberg | ayoung, but i did use LDAP extensively at Blizzard, even supported global replication | 18:39 |
| morganfainberg | a lot of C/C++ and Python integration | 18:39 |
| morganfainberg | i just keep my head down most of time time when people talk about LDAP. | 18:39 |
| lhcheng | rodrigods: ping | 18:39 |
| ayoung | morganfainberg, the thing is, even LDAP in a hierarchical database doesn't really support the type of ABAC we are discussing here | 18:40 |
| ayoung | it really would be something at the SQLAlchemy level anyway | 18:40 |
| morganfainberg | ayoung, are we keeping revoke? https://bugs.launchpad.net/keystone/+bug/1384775 KVS | 18:41 |
| uvirtbot | Launchpad bug 1384775 in keystone "revoke driver default should be the non-deprecated driver" [Undecided,New] | 18:41 |
| rodrigods | lhcheng, pong | 18:42 |
| *** gyee_ has quit IRC | 18:43 | |
| lhcheng | rodrigos: Question about HM, when it is implemented on keystone. Are there more work needed to allow admin from top-level project to administer quota for sub-level projects? Or would the inherited roles in HM take care of that? | 18:44 |
| *** tellesnobrega_ has quit IRC | 18:45 | |
| morganfainberg | rodrigods, ping: https://bugs.launchpad.net/keystone/+bug/1384382 | 18:45 |
| uvirtbot | Launchpad bug 1384382 in keystone "GET /OS-FEDERATION/saml2/metadata does not work" [Undecided,In progress] | 18:45 |
| morganfainberg | rodrigods, so, your patch is needed or a fixed config solved it? | 18:46 |
| morganfainberg | rodrigods, not clear by the comments in the bug | 18:46 |
| *** raildo_ has quit IRC | 18:47 | |
| morganfainberg | bknudson, so for https://bugs.launchpad.net/keystone/+bug/1381365 are we providing a fix as described in the bug? just to eliminate sslv3 ? | 18:47 |
| uvirtbot | Launchpad bug 1381365 in ossa "SSL Version and cipher selection not possible" [Undecided,Won't fix] | 18:47 |
| bknudson | morganfainberg: the fix that I proposed is to allow picking the ssl version and cipher selection... | 18:48 |
| bknudson | but note that it's incorrect. | 18:48 |
| morganfainberg | bknudson, ok | 18:48 |
| bknudson | it allows you to select TLS1 but not to pick SSLv23 - SSLv3 - SSLv2. | 18:48 |
| bknudson | so it needs to be updated. | 18:49 |
| bknudson | I didn't understand how it worked. It's pretty goofy. | 18:49 |
| rodrigods | morganfainberg, the lbragstad patch fixed it | 18:49 |
| morganfainberg | bknudson, right ok, will classify this as medium then, based on the exposure (and that please please please don't use eventlet to run SSL) it's not super crazy critical | 18:49 |
| bknudson | I agree. It's not really a bug. | 18:50 |
| morganfainberg | actually then, wishlist? | 18:50 |
| bknudson | wishlist makes more sense | 18:50 |
| morganfainberg | done | 18:50 |
| morganfainberg | ty | 18:50 |
| bknudson | think we should move the eventlet server options into their own section of the config? | 18:51 |
| morganfainberg | bknudson, thats a damn goot idea | 18:51 |
| morganfainberg | good* | 18:52 |
| bknudson | it might confuse someone to think they disabled sslv3 when they're running in httpd | 18:52 |
| morganfainberg | ++ | 18:52 |
| bknudson | gut* | 18:52 |
| morganfainberg | lol | 18:52 |
| dolphm | morganfainberg: why is there not a backend_argument option in [kvs]? | 18:55 |
| morganfainberg | dolphm, hm. sec. i think this relates to "morganfainberg forgot important options" | 18:56 |
| morganfainberg | but let me 2x check that before i take all the blame | 18:56 |
| dolphm | morganfainberg: (or, how else do you configure the dogpile backend?) | 19:01 |
| dolphm | morganfainberg: does it share config with [cache] or something? :-/ | 19:01 |
| morganfainberg | there is a way | 19:01 |
| morganfainberg | but..... | 19:01 |
| dolphm | always | 19:01 |
| dolphm | morganfainberg: we're not testing that config in devstack or anything, right? | 19:01 |
| morganfainberg | not directly | 19:02 |
| morganfainberg | we have unit tests for most of that, but it's not functionally tested | 19:02 |
| morganfainberg | there is no direct way to set that value atm | 19:04 |
| dolphm | morganfainberg: then how do configure | 19:05 |
| morganfainberg | the way we do it for memcached is the class sets it for you | 19:05 |
| dolphm | morganfainberg: so for non-memcached we need a custom class? | 19:05 |
| morganfainberg | it's passed through to the constructor for the KVS region (common) class. | 19:05 |
| morganfainberg | basically yes, there is no "generic" way to configure the token KVS backend to use something | 19:06 |
| morganfainberg | each one would need a custom class. | 19:06 |
| dolphm | morganfainberg: so do we want to support other kvs backends out of the box, in tree? | 19:07 |
| morganfainberg | i thought i had a way to make it work. | 19:07 |
| * morganfainberg looks again | 19:07 | |
| ayoung | I want to be able to git clone http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/ | 19:07 |
| morganfainberg | lol | 19:07 |
| *** amakarov is now known as amakarov_away | 19:07 | |
| morganfainberg | i'd be happy with an HTML version that let me link to a specific timestamp | 19:07 |
| morganfainberg | dolphm, oooh | 19:08 |
| *** lhcheng_ has joined #openstack-keystone | 19:08 | |
| morganfainberg | i think i found a bug looking into this | 19:08 |
| morganfainberg | oh nvm | 19:08 |
| *** lhcheng_ has quit IRC | 19:08 | |
| morganfainberg | dolphm, i think we should move to making the KVS backend "generically" configurable | 19:08 |
| morganfainberg | dolphm, if we're keeping it (we have memcache, we have a dogpile mongo driver we could support mongo [excluding license questions]) | 19:09 |
| morganfainberg | moving to a single "KVS" backend would make a lot of sense instead of needing mongo, memcache, redis, etc all specificaly called out - unless we want deployer experience better whichc ase each of those could have a clearer set of options | 19:10 |
| * morganfainberg needs to revisit oslo.cache | 19:10 | |
| morganfainberg | i think we can make this *way* better if we make a generic lib like that and convert over to it | 19:11 |
| dolphm | morganfainberg: we were looking at backing to redis at the moment | 19:11 |
| morganfainberg | i like redis a lot | 19:11 |
| morganfainberg | it has issues with clustering (or did last i looked) | 19:11 |
| morganfainberg | i think it is a MUCH better target than memcached, and should be the recommendation for persisting tokens tbh | 19:11 |
| morganfainberg | unless you *need* the SQL backend. | 19:12 |
| dolphm | morganfainberg: so for juno, we have to extend token.persistence.backends.kvs.Token with a redis.Token -- worth upstreaming that for kilo? or would you rather pursue improving the configuration flexibility of the base kvs.Token class? | 19:12 |
| morganfainberg | dolphm, so, lets take a look at deployer experience. | 19:12 |
| * morganfainberg takes off developer hat | 19:12 | |
| dolphm | morganfainberg: i am having the deployer experience right now | 19:13 |
| * morganfainberg dusts off deployer hat | 19:13 | |
| morganfainberg | right | 19:13 |
| morganfainberg | does configuring [kvs]/backend=redis (+ all the specific options) | 19:13 |
| morganfainberg | make life better? or would it make sense to make a token driver that worked like | 19:13 |
| morganfainberg | [redis_token_persistence]<options> | 19:14 |
| morganfainberg | or make "smart" choices in [token] based on driver=token.persistence.backend.redis.Token (omg we're fixing this with stevedore this cycle) | 19:14 |
| morganfainberg | i lean towards just assigning [token]/driver= and having redis "smart" options rather than saying [token]driver=kvs + needing to no arcane ways to getting redis and redis options selected | 19:16 |
| morganfainberg | the problem is it is more to maintain in-tree. | 19:16 |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Remove XML support https://review.openstack.org/125738 | 19:16 |
| dolphm | morganfainberg: do we really need anything more than backend_arguments (key/value pairs?) | 19:16 |
| dolphm | to support like http://dogpilecache.readthedocs.org/en/latest/api.html#redis-backends | 19:16 |
| morganfainberg | dolphm, sadly a lot of the arguments aren't straight key/string_Value | 19:16 |
| morganfainberg | in redis i think they are all string values | 19:17 |
| morganfainberg | wow. redis has grown some neat features. | 19:18 |
| lbragstad | bknudson: I had to update the commit message here: https://review.openstack.org/#/c/125738/ | 19:18 |
| morganfainberg | too bad dogpile has to cater to lowest common feature set (read: memcached) | 19:18 |
| bknudson | lbragstad: how's the tempest change going? | 19:19 |
| lbragstad | fwiw, mtreinish has +2'd both of the devstack changes for XML removal | 19:19 |
| morganfainberg | dolphm, the only concern i really have *wearing deployer hat* is that with kvs + key-value configs, we don't explciitly document the options, it's a bit arcane to know what to pass to the backend to make redis behave | 19:19 |
| lbragstad | so, we're going to merge the devstack changes first | 19:19 |
| bknudson | devstack? | 19:19 |
| lbragstad | https://review.openstack.org/#/c/130874/ | 19:19 |
| lbragstad | https://review.openstack.org/#/c/127641/ | 19:19 |
| lbragstad | we still need to test XML support for icehouse and juno releases | 19:19 |
| lbragstad | once those two merge, we will merge the tempest change | 19:20 |
| lbragstad | https://review.openstack.org/#/c/126564/ | 19:20 |
| morganfainberg | dolphm, i think the reason KVS doesn't have these options is because the original idea was those options would be per-subsystem (e.g. Identity would have it's own KVS options, so it didn't need to share a backend with token) | 19:20 |
| bknudson | complicated. | 19:21 |
| ayoung | morganfainberg, lets use that as an example for http://kilodesignsummit.sched.org/event/a2ad39a14ba7eeaa9fc9bd25f34d9741 | 19:21 |
| lbragstad | bknudson: after that, we can merge the Keystone change | 19:21 |
| lbragstad | lot of moving parts | 19:21 |
| bknudson | there should be a git repo for tracking. | 19:21 |
| ayoung | ++ | 19:21 |
| morganfainberg | ayoung, ++ that is a good example, similar to "SQL backends might differ between Identity and Assignment" or "LDap <same as previous statement>" | 19:21 |
| morganfainberg | bknudson, i want cross-project depenedencies in Zuul | 19:22 |
| *** _cjones_ has quit IRC | 19:22 | |
| ayoung | yeah, #1 issue for using IofC/DI is naming of remote resources | 19:22 |
| bknudson | that would do it. | 19:22 |
| morganfainberg | DependsOn: XXXX | 19:22 |
| morganfainberg | bknudson, iirc there has been some work on it | 19:22 |
| morganfainberg | just not sure where it stands | 19:22 |
| *** _cjones_ has joined #openstack-keystone | 19:22 | |
| lbragstad | yeah, that would be cool | 19:22 |
| ayoung | so I fetched all of evesdrop logs for this channel | 19:22 |
| ayoung | grep ayoung *.log | wc -l | 19:23 |
| ayoung | 29601 | 19:23 |
| morganfainberg | lol | 19:23 |
| ayoung | wget -r -l 1 -w 1 -t 1 -T 5 -nd -k -e "robots=off" http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/ | 19:23 |
| bknudson | how many lines in keystone? | 19:23 |
| ayoung | I need a way to do that incrementally | 19:23 |
| ayoung | 181978 total | 19:23 |
| morganfainberg | ayoung, i bet you could make infra changes to make it a git repo. | 19:23 |
| morganfainberg | and have it commit changes once a <interval> | 19:23 |
| morganfainberg | ayoung, you could also use RSYNC | 19:24 |
| morganfainberg | for incremental | 19:24 |
| bknudson | I don't want to have to review all those logs. | 19:24 |
| ayoung | rsync and wget? | 19:24 |
| morganfainberg | bknudson, LOL | 19:24 |
| ayoung | Ha@! | 19:24 |
| morganfainberg | i kinda want all the IRC logs in elasticsearch | 19:25 |
| ayoung | I know that you are making a joke, but what really has me laughing is knowing that, for one fraction of an instant, you actually had that thought for real | 19:25 |
| *** _cjones_ has quit IRC | 19:25 | |
| * morganfainberg ponders what volume of nodes would be needed for that. | 19:25 | |
| morganfainberg | it really isn't *that* much data. | 19:25 |
| ayoung | 17 M | 19:26 |
| morganfainberg | the question is how do you group conversations... | 19:26 |
| morganfainberg | i don't think elsaticsearch does that well | 19:27 |
| *** vejdmn has quit IRC | 19:27 | |
| ayoung | morganfainberg, It discounts all of the openstack-dev discussions from before we moved to our own channel. THat used to be defacto #openstack-keystone | 19:27 |
| morganfainberg | ayoung, gthats fine | 19:27 |
| morganfainberg | ayoung, i ignore those dark days now >.> | 19:27 |
| morganfainberg | <.< | 19:27 |
| morganfainberg | dolphm, so i think short term, i'd upstream the dedicated Redis driver. | 19:29 |
| morganfainberg | dolphm, mostly so we can say "stop using memcached, here is a good alternative" | 19:29 |
| morganfainberg | dolphm, long term we should make KVS backend waaaaaaay more capable so the "smart" choices we make as sane defaults can be mucked with if someone really has a need. (doing really crazy dogpile things) | 19:30 |
| morganfainberg | ayoung, *random thought* wonder if we could come up with a fusion-drive (hard disk concept) like construct in python that used in-memory data structures, auto cleanup and kept hot data localized (read faster than even memcached) creating a smart tiered caching system. | 19:32 |
| ayoung | isn't that what you are writing with dogpile? | 19:32 |
| morganfainberg | ayoung, e.g. <hot content> | dogpile/Kvs/Memcached | Stable Slow Storage | 19:32 |
| morganfainberg | not exactly, dogpile is pretty limited memoization | 19:32 |
| ayoung | well, what makes sense depends on the threading model of the web server | 19:33 |
| morganfainberg | i mean, really build in for openstack the async runners that dogpile uses and layer dogpile via a proxy to keep common content really really fresh | 19:33 |
| morganfainberg | and in local process mem | 19:33 |
| morganfainberg | dogpile supports the concept of using an async runner for refreshing content/data. | 19:33 |
| morganfainberg | in eventlet it's easy to figure that bit out, in apache more difficult. | 19:34 |
| * morganfainberg goes back to things we can actually accomplish before the summit :) | 19:34 | |
| morganfainberg | ayoung, http://kilodesignsummit.sched.org/event/98dc4255384e340682137c8a7ee7e60d and http://kilodesignsummit.sched.org/event/e82e30d5f2c961a4f9d8641833b1715d | 19:38 |
| ayoung | morganfainberg, sounds good | 19:39 |
| ayoung | morganfainberg, I would not have labeled either of those sessions that way... | 19:39 |
| * ayoung needs to read up on congress | 19:40 | |
| * ayoung needs to refrain from using that term in conjunction with unlawful | 19:40 | |
| morganfainberg | lol | 19:41 |
| *** gyee_ has joined #openstack-keystone | 19:48 | |
| ayoung | morganfainberg, so just saw this in #freeipa: | 19:55 |
| ayoung | <tjaalton> now the first milestone is accomplished | 19:55 |
| ayoung | <tjaalton> as in, first ipa release with both server and client working on debian | 19:55 |
| *** pc-m has quit IRC | 19:56 | |
| morganfainberg | woohoo! | 19:57 |
| morganfainberg | i'm .. i'm really stoked | 19:57 |
| ayoung | morganfainberg, Timo is on my "I owe a beer" list | 20:00 |
| dstanek | morganfainberg: i'd love to talk about your in memory cache ideas at the summit | 20:00 |
| morganfainberg | ayoung, s/owe beer/owe a case of beer or whiskey/ | 20:00 |
| morganfainberg | dstanek, ++ | 20:00 |
| *** lhcheng has quit IRC | 20:00 | |
| *** marcoemorais has quit IRC | 20:01 | |
| *** lhcheng has joined #openstack-keystone | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** lihkin has quit IRC | 20:05 | |
| lbragstad | ayoung: are we doing beer floats in Paris? | 20:06 |
| ayoung | lbragstad, Nope...Something with Wine | 20:06 |
| nkinder | wine floats? Not sure how well that would work out... | 20:07 |
| ayoung | I'm more thinking Jam session | 20:08 |
| *** _cjones_ has joined #openstack-keystone | 20:09 | |
| ayoung | Nkinder pair the FreeIPA thing with https://www.dragonsreach.it/2014/10/24/kerberos-over-http-on-a-firewalled-network/ | 20:11 |
| * morganfainberg kicks internet | 20:12 | |
| nkinder | ayoung: yeah, I saw that | 20:12 |
| *** vejdmn has joined #openstack-keystone | 20:12 | |
| ayoung | nkinder, sometimes you need to lead the target by a couple years | 20:13 |
| *** _cjones_ has quit IRC | 20:13 | |
| ayoung | Now we need to get launchpad ported over to FreeIPA | 20:13 |
| ayoung | suspect that will require Ipsilon thogh | 20:14 |
| ayoung | need to support openid etc. | 20:15 |
| dstanek | I'll bring my IV bag for all the beer | 20:16 |
| *** marcoemorais has quit IRC | 20:16 | |
| ayoung | nkinder, does 389 have any way to plugin in an external policy check for ACL enforcement? | 20:16 |
| nkinder | ayoung: not trivially. What are you trying to do? | 20:17 |
| ayoung | nkinder, ABAC | 20:17 |
| ayoung | nkinder, specificially... | 20:17 |
| dstanek | i'm super paranoid about bring my Macbook to Paris and was thinking about buying a Chromebook to tote along. am i too paranoid? | 20:18 |
| ayoung | there was a request to be able to provide access control all the way down to individula attributes | 20:18 |
| rodrigods | dstanek, super | 20:18 |
| rodrigods | ahha | 20:18 |
| ayoung | nkinder, and I was wondering if the answer to the ultra paranoid was to use 389 ACLs for that kind of thing | 20:19 |
| ayoung | nkinder, something like applying RBAC ontop of the 389 ACLs | 20:19 |
| ayoung | with the roles come from Keystone | 20:19 |
| ayoung | I know that row level access control in SQL is messy, was wondering if maybe for the super sensitive stuff 389 might make more sense | 20:20 |
| ayoung | trying to avoid reinventing things | 20:20 |
| nkinder | ayoung: not sure. The 389 ACLs are powerful, but pretty hairy | 20:21 |
| ayoung | nkinder, I wrote this a while ago: http://adam.younglogic.com/2012/02/dns-managers-in-freeipa/ | 20:21 |
| ayoung | so it would work for Designate | 20:21 |
| ayoung | users and groups too, so we could cover the Identity side of Keystone. | 20:21 |
| ayoung | If we put assignment in LDAP, it would work for that too. | 20:22 |
| *** andreaf_ has quit IRC | 20:22 | |
| ayoung | nkinder, it would be hideously inapproriate use of the technology, but what if.... | 20:22 |
| ayoung | we used the FreeIPA role management for Keystone roles? | 20:23 |
| *** marcoemorais has joined #openstack-keystone | 20:23 | |
| ayoung | 2012. Prehistory | 20:24 |
| *** r1chardj0n3s_afk is now known as r1chardj0n3s | 20:24 | |
| *** raildo has quit IRC | 20:25 | |
| ayoung | r1chardj0n3s, do you have a public demo of angboard? | 20:26 |
| r1chardj0n3s | ayoung: no public demo, but I did put to gether a little demo vid | 20:26 |
| ayoung | r1chardj0n3s, I have a keystone server up on the dreamhost demo machine | 20:27 |
| ayoung | what do I need: keystone, nova? | 20:27 |
| ayoung | r1chardj0n3s, OK if I share that? | 20:27 |
| nkinder | ayoung: using setup.py to install OSC is not at all happy with the auth plugin stuff. Guess I'll have to go back to pip install -e | 20:27 |
| ayoung | nkinder, too bad | 20:28 |
| r1chardj0n3s | ayoung: sure | 20:28 |
| ayoung | https://www.youtube.com/watch?v=3ko8N_A4jkY | 20:28 |
| ayoung | nkinder, ^^ is the Horizon replacement in Javascript. | 20:29 |
| nkinder | ayoung: yeah, I get "'Namespace' object has no attribute 'os_auth_type'" when it loops through the available plugins | 20:29 |
| ayoung | nkinder, that sounds like a mismatch oin the CLI param | 20:29 |
| ayoung | os_auth_type vs os-auth-plugin | 20:30 |
| ayoung | r1chardj0n3s, you going to Paris? | 20:30 |
| nkinder | ayoung: it might be some weirdness between the RPMs on the system and the OSC install from git | 20:30 |
| nkinder | ayoung: just not sure why it would work when doing an editable install via pip | 20:31 |
| r1chardj0n3s | ayoung: yes, I am | 20:31 |
| ayoung | you sure you don't have the old OSC again? | 20:31 |
| ayoung | r1chardj0n3s, Awesome | 20:31 |
| *** jorge_munoz has quit IRC | 20:31 | |
| r1chardj0n3s | ayoung: I assume you'll be there? :) | 20:32 |
| ayoung | r1chardj0n3s, yes | 20:32 |
| r1chardj0n3s | ayoung: cool | 20:32 |
| ayoung | and lots of people interested in this | 20:32 |
| ayoung | r1chardj0n3s, need you involved on the "how do web apps interact with keystone" type discussions | 20:32 |
| ayoung | r1chardj0n3s, like SAML | 20:33 |
| r1chardj0n3s | ayoung: that sounds scary :) | 20:33 |
| ayoung | Don't fear the Penguin | 20:33 |
| r1chardj0n3s | ayoung: but yes, I think that's one of many discussions I'm going to be having | 20:33 |
| ayoung | of corse | 20:33 |
| ayoung | course | 20:33 |
| r1chardj0n3s | ayoung: my primary goal is to try to promote angboard ;) | 20:33 |
| r1chardj0n3s | ayoung: or if not it, then something very much like it | 20:33 |
| ayoung | r1chardj0n3s, "You've got my sword!" | 20:33 |
| r1chardj0n3s | \o/ | 20:33 |
| ayoung | now give it back | 20:34 |
| ayoung | :) | 20:34 |
| ayoung | r1chardj0n3s, I assume everything there is working through the service catalog that you get back from Keystone? | 20:35 |
| ayoung | Like, determining which Nova server to call and so on? | 20:35 |
| r1chardj0n3s | ayoung: yes | 20:36 |
| ayoung | r1chardj0n3s, OK, I have a server that I can put this up on internally. Let me check it out there, and I might do a devstack on the dreamhost demo site to make it publically available. Unless you want to do that? | 20:36 |
| r1chardj0n3s | please, go for it | 20:37 |
| ayoung | r1chardj0n3s, I was hoping you would say "nah I've got it covered" | 20:37 |
| *** _cjones_ has joined #openstack-keystone | 20:37 | |
| ayoung | a demo is worth a 1000 meetings | 20:37 |
| ayoung | a prototype that is | 20:37 |
| r1chardj0n3s | ayoung: hahah, yeah, I should try to get it up and running, yeah | 20:38 |
| r1chardj0n3s | ayoung: I'll put it on my TODO. shouldn't be difficult | 20:38 |
| ayoung | r1chardj0n3s, I'd offer to provide space, but it looks like your employer should make that available | 20:38 |
| ayoung | nkinder, I think I need to go rework the horizon patches to be in line with jamielennox 's latest change | 20:39 |
| r1chardj0n3s | ayoung: indeed :) | 20:39 |
| ayoung | r1chardj0n3s, what I would like to have is angboard working with a kerberized web server. | 20:40 |
| ayoung | You are using something for dev, but I assume it would work in Apache HTTPD? | 20:40 |
| nkinder | ayoung: ok, so installing via setup.py ends up leaving some of the older OSC .py files form the RPM in site-packages | 20:41 |
| ayoung | figured | 20:41 |
| nkinder | ayoung: so it's some frankenstein setup | 20:41 |
| ayoung | we'll get there | 20:41 |
| ayoung | nkinder, I had hacked out the PBR stuff in an earlier version of my patch, I think jamie replaced it (or maybe I did ) but I wonder if that would solve the problem | 20:42 |
| nkinder | ayoung: ok, if I uninstall the OSC RPM, it works | 20:42 |
| r1chardj0n3s | ayoung: I know very little about kerberos :/ | 20:42 |
| ayoung | r1chardj0n3s, its OK, I know Kerberos | 20:43 |
| nkinder | ayoung: I think setup.py assumes some of it is already installed and leaves old files in place | 20:43 |
| ayoung | nkinder, ah, probably | 20:43 |
| nkinder | ayoung: let me try a new setup that doesn't use the RPM at all... | 20:43 |
| ayoung | nkinder, and I take it packstack installs OSC, so probably rpm -e and then git | 20:43 |
| nkinder | ayoung: nope, I do it explicitly | 20:43 |
| nkinder | ayoung: I may still want to install, then remove it to satisfy deps | 20:43 |
| ayoung | yeah | 20:44 |
| ayoung | so, like I said, rpm -e and then git | 20:44 |
| *** vejdmn has quit IRC | 20:44 | |
| r1chardj0n3s | ayoung: I would like to help you get kerberos PR against angboard :) | 20:45 |
| nkinder | ayoung: I WILL have a fully-automated kerberized keystone today. I'm determined. :) | 20:46 |
| ayoung | r1chardj0n3s, I have a public Kerberos setup we can use | 20:46 |
| morganfainberg | nkinder, ^_^ | 20:46 |
| morganfainberg | nkinder, if i can help at all, let me know. | 20:46 |
| ayoung | morganfainberg, he already has it. Its just the OSC bit that is taking tweaking | 20:46 |
| morganfainberg | even if it's just "hey look how cool this is" | 20:46 |
| ayoung | morganfainberg, the issue is PBR and entrypoints | 20:46 |
| r1chardj0n3s | ayoung: cool | 20:46 |
| ayoung | morganfainberg, if you review https://review.openstack.org/#/c/123614/ | 20:47 |
| ayoung | try using epi (entry point inspector) | 20:47 |
| ayoung | and ... well, see for yourself | 20:47 |
| ayoung | r1chardj0n3s, let me see what my current setup looks like | 20:47 |
| nkinder | morganfainberg: I can mannually get it working, but it's just automation hassles since I'm installing patches from gerrit and cobbling it all together | 20:48 |
| ayoung | nkinder, how hard would it be for your script to run against an existing FreeIPA server? | 20:48 |
| nkinder | ayoung: not too hard | 20:48 |
| nkinder | ayoung: you'd just need to pass in some details about the IPA server | 20:48 |
| ayoung | nkinder, once we get this working, I'd like to try to have it up for younglogic.net | 20:48 |
| nkinder | ayoung: we should be able to extract what you need | 20:49 |
| nkinder | ayoung: my scripts actually create VMs from scratch and set up everything | 20:49 |
| nkinder | ayoung: I think you probably just want the configuration part of it | 20:49 |
| ayoung | nkinder, yeah, not VMs, | 20:50 |
| ayoung | I could probably start with just packstack | 20:50 |
| nkinder | ayoung: I also avoided using curl for anything, so it's entirely using OSC for the operations against keystone | 20:50 |
| ayoung | actually, I have a kerberized Keystone already, I need nova and glance | 20:50 |
| nkinder | good testing of OSC with domains that way | 20:50 |
| ayoung | ++ | 20:50 |
| ayoung | r1chardj0n3s, we can work on the rest next week. I'll work with nkinder in getting the rest of the OpenStack stuff up and running. I might be able to get as far as angboard. | 20:52 |
| r1chardj0n3s | ayoung: \o/ | 20:53 |
| *** gyee_ has quit IRC | 21:00 | |
| *** NM has quit IRC | 21:01 | |
| *** gyee_ has joined #openstack-keystone | 21:05 | |
| *** gyee_ has left #openstack-keystone | 21:07 | |
| *** topol has quit IRC | 21:10 | |
| *** marcoemorais has quit IRC | 21:23 | |
| richm | Would updating a user to change the tenant cause any updates in the identity backend? | 21:24 |
| *** marcoemorais has joined #openstack-keystone | 21:24 | |
| richm | I'm trying to setup keystone with puppet to use an ldap identity backend with users already created in ldap | 21:24 |
| *** lhcheng has quit IRC | 21:24 | |
| *** fifieldt_ has joined #openstack-keystone | 21:26 | |
| *** nellysmitt has quit IRC | 21:28 | |
| *** nellysmitt has joined #openstack-keystone | 21:29 | |
| *** marcoemorais has quit IRC | 21:29 | |
| *** lhcheng has joined #openstack-keystone | 21:29 | |
| *** marcoemorais has joined #openstack-keystone | 21:29 | |
| *** fifieldt has quit IRC | 21:30 | |
| ayoung | richm, ? | 21:32 |
| ayoung | updating a user to change the tenant? | 21:32 |
| ayoung | you mean default tenant? | 21:32 |
| ayoung | what call | 21:32 |
| *** nellysmitt has quit IRC | 21:33 | |
| *** lhcheng has quit IRC | 21:35 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 21:36 | |
| *** lhcheng has joined #openstack-keystone | 21:38 | |
| *** marcoemorais has quit IRC | 21:40 | |
| *** thedodd has quit IRC | 21:40 | |
| nkinder | ayoung, morganfainberg: http://paste.openstack.org/show/124272/ | 21:43 |
| morganfainberg | hm.. | 21:43 |
| morganfainberg | anyone know how to define named anchors in markdown that is more friendly than <a name="THING"> </a> ? | 21:43 |
| ayoung | Yay! | 21:43 |
| ayoung | morganfainberg, not it | 21:43 |
| ayoung | morganfainberg, don't you get them with <h> tags? | 21:44 |
| morganfainberg | ayoung, trying to get anchors to work in that blog post | 21:44 |
| ayoung | morganfainberg, one sec | 21:44 |
| morganfainberg | markdown, the goal is to be able to do <url>#Policy | 21:44 |
| ayoung | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#whats-new-in-version-33 | 21:44 |
| ayoung | we get them in the markdown for identity-api | 21:44 |
| nkinder | ayoung: Those are the only commands I ran after 'setup.sh' that built all of the VMs from scratch. | 21:44 |
| morganfainberg | hmm. | 21:45 |
| ayoung | nkinder, So, I changed my mind: I do want to create the virtual machines | 21:45 |
| nkinder | ayoung: ok, I'll check my automation in somewhere you can get at it. | 21:45 |
| nkinder | ayoung: I just need to switch it over to use centos repos so it can be useful to everyone | 21:45 |
| ayoung | nkinder, I can do a complete packstack install, but want to use an existing IPA server | 21:46 |
| nkinder | ayoung: I use some internal repos for RHEL out of convenience right now | 21:46 |
| ayoung | Fmily just invaded | 21:46 |
| morganfainberg | ayoung, nope, doesn't work with jeykll | 21:46 |
| *** marcoemorais has joined #openstack-keystone | 21:48 | |
| *** mrmoje has joined #openstack-keystone | 21:48 | |
| *** ayoung has quit IRC | 21:51 | |
| *** nellysmitt has joined #openstack-keystone | 21:55 | |
| *** nellysmitt has quit IRC | 21:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:58 | |
| *** saipandi_ has quit IRC | 22:02 | |
| *** saipandi has joined #openstack-keystone | 22:03 | |
| *** dims_ has joined #openstack-keystone | 22:03 | |
| openstackgerrit | gordon chung proposed a change to openstack/keystonemiddleware: documentation for audit middleware https://review.openstack.org/130344 | 22:03 |
| *** marcoemorais has quit IRC | 22:03 | |
| *** marcoemorais has joined #openstack-keystone | 22:04 | |
| *** dims__ has joined #openstack-keystone | 22:05 | |
| *** dimsum_ has quit IRC | 22:06 | |
| *** marcoemorais has quit IRC | 22:06 | |
| *** marcoemorais has joined #openstack-keystone | 22:07 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:07 | |
| *** dims_ has quit IRC | 22:08 | |
| *** marcoemorais1 has quit IRC | 22:08 | |
| *** david-lyle has quit IRC | 22:08 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:08 | |
| *** marcoemorais1 has quit IRC | 22:08 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:09 | |
| *** marcoemorais has quit IRC | 22:11 | |
| *** rwsu has quit IRC | 22:14 | |
| *** david-lyle has joined #openstack-keystone | 22:17 | |
| morganfainberg | dstanek, dolphm, lbragstad, nkinder, how does this read: https://gist.githubusercontent.com/morganfainberg/b9d7da291188836ab558/raw/e928c148225b4f0a45f523fa2cb3789e51ca046e/gistfile1.txt | 22:17 |
| *** gordc has quit IRC | 22:18 | |
| morganfainberg | dolphm, dolphm, lbragstad, nkinder. I'm adding it to my blog post, and i'm going to link each of the summit design sessions to these sub sections as a way to help provide more detail [e.g. "pre-session reading"] on the topics. hopefully it'll help cut down on the "lets spend the first XXXX minute syncing up with the state of the world" | 22:19 |
| morganfainberg | this is an idea based on Nova's "required reading" per session.. but since we don't have a ton of specs; that is to say we have summit sessions to help define the specs, we can't link to a specific spec. | 22:20 |
| *** amcrn has joined #openstack-keystone | 22:22 | |
| *** gyee has joined #openstack-keystone | 22:29 | |
| *** marcoemorais1 has quit IRC | 22:31 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/130897 | 22:35 |
| nkinder | morganfainberg: looks good aside form the fact that you misspelled 'truly' :P | 22:37 |
| *** bknudson has quit IRC | 22:37 | |
| morganfainberg | hehe | 22:37 |
| morganfainberg | thanks | 22:37 |
| nkinder | bah, and I misspelled/typod 'from' | 22:37 |
| morganfainberg | nkinder, so i added it to the session: http://kilodesignsummit.sched.org/event/a2ad39a14ba7eeaa9fc9bd25f34d9741 | 22:38 |
| morganfainberg | "pre-session reading" or should a change that to "recommended pre-session reading"? | 22:38 |
| morganfainberg | i don't think i can make it a link though :( | 22:39 |
| morganfainberg | or should i not put it in the schedule like that? | 22:39 |
| morganfainberg | i guess i could just put it in the etherpad(s) | 22:40 |
| *** arunkant has quit IRC | 22:43 | |
| *** htruta has quit IRC | 22:43 | |
| *** wpf has quit IRC | 22:43 | |
| *** gsilvis has quit IRC | 22:43 | |
| *** gsilvis has joined #openstack-keystone | 22:43 | |
| *** htruta has joined #openstack-keystone | 22:44 | |
| *** arunkant has joined #openstack-keystone | 22:44 | |
| *** wpf has joined #openstack-keystone | 22:44 | |
| *** marcoemorais has joined #openstack-keystone | 22:45 | |
| morganfainberg | oh crud... | 22:57 |
| *** harlowja is now known as harlowja_away | 23:00 | |
| *** marcoemorais has quit IRC | 23:04 | |
| *** joesavak has joined #openstack-keystone | 23:10 | |
| *** raildo has joined #openstack-keystone | 23:11 | |
| nkinder | morganfainberg: bummer it won't let you create a link in the sched page :( | 23:12 |
| morganfainberg | I might put it there anyway. | 23:13 |
| *** jsavak has joined #openstack-keystone | 23:15 | |
| *** alex_xu has joined #openstack-keystone | 23:17 | |
| raildo | morganfainberg, what do you think? https://etherpad.openstack.org/p/hierarchical-multitenancy-kilo-summit | 23:18 |
| *** joesavak has quit IRC | 23:19 | |
| *** harlowja_away is now known as harlowja | 23:24 | |
| *** jsavak has quit IRC | 23:25 | |
| *** packet has joined #openstack-keystone | 23:33 | |
| *** david-lyle has quit IRC | 23:34 | |
| morganfainberg | raildo, we definitely need to look at the reseller use case | 23:36 |
| morganfainberg | as well | 23:36 |
| raildo | i agree | 23:36 |
| raildo | the other alternative that I can see is project come to be the container of users | 23:38 |
| raildo | but I believe we have much to discuss about it | 23:38 |
| morganfainberg | ok | 23:38 |
| morganfainberg | i added / fixed a couple of lines on the etherpad | 23:38 |
| morganfainberg | also added the link https://www.morganfainberg.com/blog/2014/10/21/openstack-kilo-summit-pre-summit-thoughts/#HM | 23:39 |
| raildo | ok, thanks | 23:39 |
| morganfainberg | that link sums up what I think the HM session should be covering / sets the stage for where we currently are | 23:40 |
| raildo | Do you agree that the policy v3 needs to be the default? | 23:41 |
| *** chrisshattuck has joined #openstack-keystone | 23:41 | |
| raildo | I will complement the document with the issues of your link. | 23:42 |
| morganfainberg | i think the v3cloud policy needs to be the default regardless of HM support | 23:42 |
| *** david-lyle has joined #openstack-keystone | 23:44 | |
| raildo | absoluty, HM is just another use case for v3cloud policy | 23:44 |
| morganfainberg | yep | 23:44 |
| raildo | Do you have seen something about the implementation of hierarchical quotas in Nova? | 23:46 |
| morganfainberg | yeah | 23:46 |
| morganfainberg | talked with jogo on that topic actually not too long ago | 23:46 |
| raildo | great :) | 23:47 |
| raildo | its a good solution for expand HM for Nova and to improve the HM concept for other services. | 23:48 |
| morganfainberg | yeah | 23:48 |
| *** david-lyle has quit IRC | 23:49 | |
| raildo | I have some concern about a possible removal of domains, it would not be a big impact on other features as Federation, domain-specific backend? | 23:53 |
| morganfainberg | domains would stay in | 23:58 |
| morganfainberg | the difference would be what we "call a domain" | 23:58 |
| morganfainberg | basically a domain would be a top-level project (no parent) | 23:58 |
| morganfainberg | but projects would accquire all other domain capabilities | 23:59 |
| morganfainberg | we can't "remove" domains without breaking API compatibility, but we can make projects way way more featureful | 23:59 |
| raildo | ++ | 23:59 |
| gyee | morganfainberg, raildo, I'll add the rule ownership & visibility stuff later, stilling thinking it through | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!