| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Remove endpoint_substitution_whitelist config option https://review.openstack.org/131007 | 00:03 |
|---|---|---|
| *** david-lyle has joined #openstack-keystone | 00:03 | |
| *** lhcheng has joined #openstack-keystone | 00:04 | |
| *** lhcheng_ has joined #openstack-keystone | 00:05 | |
| *** david-lyle has quit IRC | 00:08 | |
| *** arif-ali has quit IRC | 00:09 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Prevent AttributeError if no authorization https://review.openstack.org/100714 | 00:20 |
| *** mitz_ has joined #openstack-keystone | 00:40 | |
| *** HenryG has quit IRC | 00:41 | |
| *** jacer_huawei has quit IRC | 00:45 | |
| *** cjellick has joined #openstack-keystone | 00:45 | |
| *** HenryG has joined #openstack-keystone | 00:46 | |
| *** cjellick has quit IRC | 00:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 00:51 |
| *** jacer_huawei has joined #openstack-keystone | 00:57 | |
| *** diegows has quit IRC | 01:05 | |
| *** diegows has joined #openstack-keystone | 01:10 | |
| *** shikui_ has joined #openstack-keystone | 01:12 | |
| *** Kui has quit IRC | 01:15 | |
| openstackgerrit | wanghong proposed a change to openstack/keystone: remove implemented TODO in catalog/backends/sql.py https://review.openstack.org/129830 | 01:18 |
| *** BAKfr has quit IRC | 01:18 | |
| *** HenryG has quit IRC | 01:24 | |
| *** BAKfr has joined #openstack-keystone | 01:27 | |
| *** HenryG has joined #openstack-keystone | 01:32 | |
| *** ncoghlan is now known as ncoghlan_afk | 01:39 | |
| *** lihkin has joined #openstack-keystone | 01:41 | |
| *** ncoghlan_afk is now known as ncoghlan | 01:44 | |
| *** cjellick has joined #openstack-keystone | 01:46 | |
| *** cjellick has quit IRC | 01:51 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:16 | |
| *** david-lyle has joined #openstack-keystone | 02:19 | |
| *** ncoghlan is now known as ncoghlan_afk | 02:20 | |
| *** david-lyle has quit IRC | 02:24 | |
| *** dimsum_ has quit IRC | 02:31 | |
| *** dimsum_ has joined #openstack-keystone | 02:33 | |
| *** dimsum_ has quit IRC | 02:33 | |
| *** chrisshattuck has joined #openstack-keystone | 02:37 | |
| *** dimsum_ has joined #openstack-keystone | 02:41 | |
| *** cjellick has joined #openstack-keystone | 02:47 | |
| *** alex_xu has joined #openstack-keystone | 02:49 | |
| *** dimsum_ has quit IRC | 02:51 | |
| *** cjellick has quit IRC | 02:52 | |
| *** KanagarajM has joined #openstack-keystone | 02:58 | |
| *** KanagarajM has quit IRC | 03:03 | |
| *** KanagarajM has joined #openstack-keystone | 03:05 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:10 | |
| *** tellesnobrega_ has quit IRC | 03:14 | |
| *** lihkin has quit IRC | 03:15 | |
| *** alex_xu has quit IRC | 03:18 | |
| *** alex_xu has joined #openstack-keystone | 03:19 | |
| *** david-lyle has joined #openstack-keystone | 03:21 | |
| *** david-lyle has quit IRC | 03:25 | |
| *** jeffrey4l has joined #openstack-keystone | 03:30 | |
| *** cjellick has joined #openstack-keystone | 03:48 | |
| *** dimsum_ has joined #openstack-keystone | 03:51 | |
| *** cjellick has quit IRC | 03:53 | |
| *** dimsum_ has quit IRC | 03:57 | |
| *** lhcheng has quit IRC | 04:01 | |
| *** lhcheng_ is now known as lhcheng | 04:01 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:01 | |
| *** lhcheng_ has joined #openstack-keystone | 04:02 | |
| *** david-lyle has joined #openstack-keystone | 04:19 | |
| *** david-lyle has quit IRC | 04:24 | |
| *** lhcheng_ has quit IRC | 04:27 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:37 | |
| *** ncoghlan is now known as ncoghlan_afk | 04:48 | |
| *** cjellick has joined #openstack-keystone | 04:49 | |
| *** cjellick has quit IRC | 04:53 | |
| *** lhcheng has quit IRC | 05:01 | |
| *** bknudson has quit IRC | 05:13 | |
| *** david-lyle has joined #openstack-keystone | 05:20 | |
| *** chrisshattuck has quit IRC | 05:23 | |
| *** david-lyle has quit IRC | 05:25 | |
| *** diegows has quit IRC | 05:35 | |
| *** cjellick has joined #openstack-keystone | 05:49 | |
| *** bknudson has joined #openstack-keystone | 05:53 | |
| *** cjellick has quit IRC | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Imported Translations from Transifex https://review.openstack.org/130929 | 06:06 |
| *** arif-ali has joined #openstack-keystone | 06:14 | |
| *** k4n0 has joined #openstack-keystone | 06:18 | |
| *** afazekas is now known as _afazekas | 06:20 | |
| *** arif-ali has quit IRC | 06:31 | |
| *** arif-ali has joined #openstack-keystone | 06:36 | |
| *** dimsum_ has joined #openstack-keystone | 06:44 | |
| *** dimsum_ has quit IRC | 06:49 | |
| *** cjellick has joined #openstack-keystone | 06:50 | |
| *** cjellick has quit IRC | 06:55 | |
| *** KanagarajM has quit IRC | 06:59 | |
| *** ukalifon1 has joined #openstack-keystone | 07:01 | |
| *** bknudson has quit IRC | 07:12 | |
| *** bknudson has joined #openstack-keystone | 07:18 | |
| openstackgerrit | wanghong proposed a change to openstack/keystonemiddleware: fallback to online validation if offline validation fails https://review.openstack.org/131036 | 07:19 |
| *** cjellick has joined #openstack-keystone | 07:51 | |
| *** cjellick has quit IRC | 07:56 | |
| *** marekd|away is now known as marekd | 08:00 | |
| *** jeffrey4l has left #openstack-keystone | 08:07 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use new ksc features in User Token Plugin https://review.openstack.org/131048 | 08:35 |
| *** ncoghlan_afk is now known as ncoghlan | 08:38 | |
| *** jistr has joined #openstack-keystone | 08:49 | |
| *** cjellick has joined #openstack-keystone | 08:52 | |
| *** cjellick has quit IRC | 08:56 | |
| *** bknudson has quit IRC | 08:56 | |
| *** bknudson has joined #openstack-keystone | 09:05 | |
| *** ncoghlan has quit IRC | 09:07 | |
| *** alex_xu has quit IRC | 09:24 | |
| *** andreaf has joined #openstack-keystone | 09:44 | |
| *** cjellick has joined #openstack-keystone | 09:53 | |
| *** cjellick has quit IRC | 09:58 | |
| *** jaosorior has joined #openstack-keystone | 10:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:16 | |
| *** dimsum_ has joined #openstack-keystone | 10:19 | |
| *** dimsum_ has quit IRC | 10:23 | |
| *** jacer_huawei has quit IRC | 10:30 | |
| *** Guest31651 is now known as amakarov | 10:37 | |
| *** tellesnobrega_ has quit IRC | 10:41 | |
| *** jacer_huawei has joined #openstack-keystone | 10:45 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:51 | |
| *** cjellick has joined #openstack-keystone | 10:54 | |
| *** tellesnobrega_ has quit IRC | 10:57 | |
| *** cjellick has quit IRC | 10:59 | |
| *** dimsum_ has joined #openstack-keystone | 10:59 | |
| *** afaranha has quit IRC | 11:04 | |
| *** diegows has joined #openstack-keystone | 11:36 | |
| *** topol has joined #openstack-keystone | 11:45 | |
| *** afazekas has joined #openstack-keystone | 11:51 | |
| *** cjellick has joined #openstack-keystone | 11:55 | |
| *** cjellick has quit IRC | 12:00 | |
| *** pc-m has joined #openstack-keystone | 12:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/keystone: Updated from global requirements https://review.openstack.org/130897 | 12:16 |
| *** openstackgerrit has quit IRC | 12:19 | |
| *** openstackgerrit has joined #openstack-keystone | 12:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/131122 | 12:21 |
| *** shikui_ has quit IRC | 12:25 | |
| *** vhoward has joined #openstack-keystone | 12:32 | |
| *** miqui has joined #openstack-keystone | 12:34 | |
| *** openstackgerrit has quit IRC | 12:34 | |
| *** openstackgerrit has joined #openstack-keystone | 12:34 | |
| *** vejdmn has joined #openstack-keystone | 12:41 | |
| *** aix has joined #openstack-keystone | 12:50 | |
| *** topol has quit IRC | 12:51 | |
| *** diegows has quit IRC | 12:54 | |
| *** radez_g0n3 is now known as radez | 12:55 | |
| *** cjellick has joined #openstack-keystone | 12:56 | |
| *** cjellick has quit IRC | 13:00 | |
| *** bknudson has quit IRC | 13:02 | |
| *** gordc has joined #openstack-keystone | 13:03 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Split up assignments, making role-assignments pluggable. https://review.openstack.org/129397 | 13:04 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split up assignments and make the assignments piece pluggable https://review.openstack.org/130954 | 13:06 |
| *** raildo has joined #openstack-keystone | 13:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:09 | |
| jamielennox | anyone home? I'm just looking at https://review.openstack.org/#/c/102958 which is to bring audit over to keystonemiddleware repo. Change looks fine - but was there a decision that we wanted to do this rather than keep it's own repo? | 13:11 |
| *** nkinder has quit IRC | 13:11 | |
| *** thiagop has joined #openstack-keystone | 13:16 | |
| *** ayoung has joined #openstack-keystone | 13:18 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split up assignments and make the assignments piece pluggable https://review.openstack.org/130954 | 13:19 |
| *** bknudson has joined #openstack-keystone | 13:23 | |
| *** dimsum_ has quit IRC | 13:25 | |
| *** dimsum_ has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use correct name of oslo debugger script https://review.openstack.org/130046 | 13:27 |
| *** joesavak has joined #openstack-keystone | 13:38 | |
| gordc | jamielennox: i added this spec a few months back: http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/audit-middleware.html | 13:41 |
| gordc | jamielennox: i can't speak for whether or not the plan has changed since... just working on it since no one has told me otherwise | 13:42 |
| *** k4n0 has quit IRC | 13:51 | |
| *** cjellick has joined #openstack-keystone | 13:56 | |
| *** richm has joined #openstack-keystone | 13:57 | |
| lbragstad | morganfainberg: that snippet looks good | 14:00 |
| *** afaranha has joined #openstack-keystone | 14:01 | |
| *** radez is now known as radez_g0n3 | 14:01 | |
| *** cjellick has quit IRC | 14:01 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Use oslo_debug_helper and remove our own version https://review.openstack.org/120104 | 14:01 |
| *** lihkin has joined #openstack-keystone | 14:05 | |
| *** joesavak has quit IRC | 14:06 | |
| jamielennox | gordc: ok - i don't see why things would have changed i was just wondering | 14:06 |
| *** nkinder has joined #openstack-keystone | 14:09 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed a change to openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/116682 | 14:10 |
| *** topol has joined #openstack-keystone | 14:10 | |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Doc cleanup, make concepts links https://review.openstack.org/127690 | 14:10 |
| openstackgerrit | A change was merged to openstack/python-keystoneclient: Correct typos in using-sessions https://review.openstack.org/127686 | 14:10 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: BaseAuthTokenMiddlewareTest.setUp call super normally https://review.openstack.org/122279 | 14:10 |
| *** radez_g0n3 is now known as radez | 14:17 | |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Improve help strings https://review.openstack.org/118048 | 14:19 |
| *** russellb is now known as drumkilla | 14:20 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct Session docstring https://review.openstack.org/127805 | 14:20 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct documenting constructor parameters https://review.openstack.org/127812 | 14:20 |
| *** drumkilla is now known as russellb | 14:20 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct Session docstring https://review.openstack.org/127805 | 14:25 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct documenting constructor parameters https://review.openstack.org/127812 | 14:25 |
| samuelms | dstanek, ping | 14:27 |
| dstanek | samuelms: pong | 14:27 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct documenting constructor parameters https://review.openstack.org/127812 | 14:28 |
| samuelms | dstanek, regardind your comment on review #116682 (Improve list role assignments performance) | 14:29 |
| samuelms | dstanek, s/regardind/regarding :) | 14:29 |
| nkinder | ayoung: I was able to get automation for setting up a few keystone scenarios using 100% freely available bits - https://github.com/nkinder/rdo-vm-factory | 14:29 |
| samuelms | dstanek, I agree with you on the point of splitting controller/manager roles .. | 14:29 |
| nkinder | ayoung: There's keystone+FreeIPA with it all set up for kerberos | 14:30 |
| samuelms | dstanek, but I'd prefer to address that in a second patch .. | 14:30 |
| nkinder | ayoung: also keystone+AD for LDAP identity | 14:30 |
| ayoung | nkinder, nice | 14:30 |
| ayoung | very nice | 14:30 |
| nkinder | ayoung: I changed the way we configured kerberos a bit | 14:30 |
| nkinder | ayoung: I avoided using hte deprecated LegacyDomain plug-in and switched to KerberosDomain | 14:30 |
| ayoung | nkinder, so if I want to do a setup against a pre-existing IPA server, but let it do all the other provisioning, what do I do? | 14:30 |
| nkinder | ayoung: that required setting REMOTE_DOMAIN in the httpd config and using the local user mapping | 14:31 |
| nkinder | ayoung: look at https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-kerberos-setup/vm-post-cloud-init-rdo.sh | 14:31 |
| dstanek | samuelms: this would be a good things for others to chime in on because it does add quite a bit of code | 14:31 |
| *** vejdmn has quit IRC | 14:31 | |
| nkinder | ayoung: that's all post cloud-init, so it's packstack and everything after for the RDO system | 14:31 |
| *** chrisshattuck has joined #openstack-keystone | 14:31 | |
| nkinder | ayoung: that assumes that IPA already exists on another system | 14:31 |
| *** vejdmn has joined #openstack-keystone | 14:32 | |
| bknudson | dstanek: samuelms: this was the point of the search hints, so that the backend can implement the search more efficiently | 14:33 |
| samuelms | bknudson, in this case, passing hints as arguments to manager, right? | 14:35 |
| bknudson | like list_users: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py#n607 | 14:36 |
| samuelms | bknudson, to apply 'effective' option, in this case (cannot be applied by the driver) | 14:36 |
| dstanek | samuelms: my point was that none of the filtering or helpers should be in the controller | 14:37 |
| samuelms | dstanek, ++ I agree .. for me the only thing the controller should do is to check options/filters and the combination of them .. | 14:38 |
| ayoung | nkinder, so it runs on the local machine? | 14:38 |
| samuelms | dstanek, business logic, like 'effective' should always be applied at manager level | 14:38 |
| nkinder | ayoung: if you run setup.sh, it creates two VMs on the local system (one for FreeIPA, one for RDO) | 14:39 |
| nkinder | ayoung: the vm-post-cloud-init-* scripts are what get copied to the VMs to do post-installation config | 14:39 |
| ayoung | nkinder, I want to set something up on the dreamhost public demo, which is Openstack | 14:39 |
| nkinder | ayoung: so you could take that and run the pieces you want on a local system | 14:39 |
| ayoung | I assume I create the two VMs by hand then? | 14:39 |
| ayoung | OK, let me give it a try. | 14:40 |
| ayoung | nkinder, did you try Horizon yet? | 14:40 |
| nkinder | ayoung: I haven't kerberized horizon yet | 14:40 |
| ayoung | nkinder, lets focus on that now. I want to make sure we iron out any issues before we fly | 14:41 |
| ayoung | I've been working on the damned thing all release. Would be a pity not to show it next week. | 14:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 14:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 14:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 14:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 14:42 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Change occurrences of keystone to identity server https://review.openstack.org/127062 | 14:42 |
| *** joesavak has joined #openstack-keystone | 14:43 | |
| jamielennox | ayoung: have you tried the changes i made to keystoneclient-kerberos? | 14:43 |
| ayoung | jamielennox, yep. No problem | 14:43 |
| jamielennox | ayoung: cool, didn't think i changed anything important | 14:43 |
| ayoung | jamielennox, from D-Openstack-auth it is just a slightly different string used to create the plugin | 14:44 |
| ayoung | jamielennox, https://review.openstack.org/#/c/123614/ | 14:45 |
| ayoung | jamielennox, that needs much work over time to use the session/auth plugin stuff the way we discussed, but it should work for now | 14:45 |
| ayoung | sorry, wrong link | 14:46 |
| ayoung | https://review.openstack.org/#/c/115463/ | 14:46 |
| openstackgerrit | Thiago Paiva Brito proposed a change to openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 14:46 |
| jamielennox | ayoung: not sure what you're directing me to there | 14:48 |
| ayoung | jamielennox, that was the updated patch. You can diff to the previous version to see | 14:48 |
| ayoung | although it did require a rebase | 14:48 |
| jamielennox | other that why are you using stevedore directly? | 14:48 |
| *** chrisshattuck has quit IRC | 14:49 | |
| jamielennox | ayoung: ^ is there some reason not to use the helpers in ksc?> | 14:51 |
| *** lihkin has quit IRC | 14:51 | |
| ayoung | jamielennox, what helpers? | 14:51 |
| jamielennox | ayoung: actually i guess it's mostly just ksc.auth.get_plugin_class if you're not using the config or CLI stuff | 14:52 |
| *** radez is now known as radez_g0n3 | 14:53 | |
| ayoung | jamielennox, so the Kerberos plugin might not be installed | 14:53 |
| jamielennox | get_plugin_class('v3kerberos') | 14:53 |
| ayoung | ah | 14:53 |
| jamielennox | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/base.py#L44 | 14:53 |
| ayoung | jamielennox, so...I'm less concerned with this, than somehow figuring out that the AUTH_URL is supposed to be the Kerberized one. We really have no way of advertising auth mechanisms | 14:54 |
| jamielennox | ayoung: yep - known issue, will come up at summit i think | 14:54 |
| jamielennox | however when initializing a v3plugin you should give it the correct URL | 14:55 |
| ayoung | the tie in between DOA and the config object from Horizon is going to make it annoying to do "build auth plugin from conf file" | 14:55 |
| jamielennox | so '.../v3/kerb/ or whatever | 14:55 |
| jamielennox | ayoung: yea, but that shouldn't matter because that would only work for when your auth is stored in a file somewhere - that's not the case for horizon | 14:56 |
| jamielennox | horizon could iterate through the available plugins - but it's going to have to know how to construct the appropriate boxes and stuff so i think it's best that it handles that manually | 14:56 |
| *** lihkin has joined #openstack-keystone | 14:57 | |
| ayoung | true. | 14:57 |
| jamielennox | i don't think just by installing a library on the server you should instantly get horizon auth via that method | 14:57 |
| ayoung | and that is how it is done now. It looks to see if the Kerberos specific variable is set | 14:57 |
| ayoung | CCACHE | 14:57 |
| jamielennox | yep, that works for horizon, how it wants to manage all it's auth mechanisms is completely up to horizon and they can just back onto the appropriate keystone plugin | 14:58 |
| ayoung | jamielennox, I was trying to keep from having to modify Horizon as well as everything else...too many moving pieces | 14:58 |
| ayoung | So if the admin wants to Kerberize horizon, but not run the S4U2Proxy stuff, they could drop the kerber plugin to KC and then it would just do Kerb on top of UserID Password | 14:58 |
| ayoung | don;t know why you would want to, but it is possible | 14:59 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 15:00 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Auth token tests create temp cert directory https://review.openstack.org/122280 | 15:00 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 15:00 |
| *** jorge_munoz has joined #openstack-keystone | 15:03 | |
| jamielennox | oh yes nova tests, i'm sure everything will work just fine if we don't have a service catalog.... | 15:04 |
| *** david-lyle has joined #openstack-keystone | 15:05 | |
| richm | Is there a way to add an existing user to a tenant? Or perhaps that should be the other way around - is there a way to add a tenant to an existing user? Not sure about the terminology. | 15:13 |
| richm | This is the problem - I have an existing LDAP server that I want to use with a new keystone deployment | 15:13 |
| richm | puppet-keystone wants to use user-create to add the user and set the tenant | 15:14 |
| richm | then, wants to add the new user to a role | 15:14 |
| richm | but if the user already exists, user-create won't be called, so the tenant operation will be skipped | 15:14 |
| jamielennox | richm a user is in a project if it has a role on the project | 15:15 |
| jamielennox | so you just need to define a role relationship | 15:15 |
| richm | tenant == project? | 15:15 |
| jamielennox | richm: yes, we're trying to bring people to use project | 15:15 |
| richm | ok - puppet uses tenant everywhere | 15:15 |
| richm | jamielennox: so, user-role-add? | 15:15 |
| jamielennox | richm: that sounds right | 15:16 |
| richm | puppet uses that, but it does that only to add the user to the role - it assumes the user has already been assigned to a project/tenant | 15:17 |
| richm | I could probably do that, but then I would have to rewrite every single puppet module everywhere :-( | 15:17 |
| richm | What I'm looking for is a way to "fake out" the puppet keystone_user create call, to just assign the existing user to a project/tenant | 15:18 |
| morganfainberg | mornin | 15:18 |
| richm | because that's the point at which I know what project/tenant is associated with the user | 15:19 |
| jamielennox | richm: so i think your terminology is kind of wrong there | 15:19 |
| richm | ok | 15:19 |
| *** cjellick has joined #openstack-keystone | 15:19 | |
| richm | I'm sure it is | 15:19 |
| jamielennox | having the role is what makes a user part of a tenant | 15:19 |
| jamielennox | you have users, you have tenants, roles is the M:M relationship | 15:19 |
| *** thedodd has joined #openstack-keystone | 15:20 | |
| richm | keystone user-create --name $name --tenant $tenant --pass $pass --email $email --enabled true | 15:20 |
| jamielennox | yep, it gives the __member__ role or something like that | 15:20 |
| richm | ah, so it assigns a default role | 15:20 |
| *** chrisshattuck has joined #openstack-keystone | 15:21 | |
| jamielennox | yes | 15:22 |
| morganfainberg | jamielennox, i'm going to be sweeping through the keystoneclient blueprints today trying to cleanup/deprioritize ones that have been lingering | 15:23 |
| morganfainberg | might bug you if i have anyquestions | 15:23 |
| jamielennox | morganfainberg: np - there's a lot of crap in there | 15:23 |
| *** cjellick has quit IRC | 15:24 | |
| jamielennox | richm: so if i do user-role-list on my devstack i can see the _member_ role | 15:24 |
| richm | so to duplicate what user-create does, without the actual user creation part, I need to do something like keystone user-role-add --user cinder --role $default_role --tenant services | 15:24 |
| jamielennox | yep | 15:24 |
| morganfainberg | jamielennox, are we going to do i18n stuff in keystoneclient? | 15:25 |
| morganfainberg | (ever) | 15:25 |
| *** ukalifon1 has quit IRC | 15:25 | |
| jamielennox | richm: i can't remember but i think _member_ is a devstack defined thing, i don't know if you can always assume it's there - you just need to add some role relationship | 15:26 |
| jamielennox | morganfainberg: i don't know how python i18n works in libraries | 15:26 |
| morganfainberg | jamielennox, and i think https://blueprints.launchpad.net/python-keystoneclient/+spec/uber-plugin is the wrong direction. | 15:26 |
| jamielennox | morganfainberg: it's fine for servers because you have an obvious entrypoint where it can set things up - but i've not seen any of the other OS libraries do i18n and i haven't really looked into generally how it's done | 15:27 |
| morganfainberg | ok i'm going to just leave the i18n bp as is | 15:27 |
| jamielennox | yea, looked at that one today - i misread his patch thinking he wanted a plugin for the CLI, but i don't know what the point of that plugin would be | 15:28 |
| jamielennox | i don't know why you would submit both | 15:28 |
| jamielennox | i left some comments on the code, otherwise i thought i'd talk to him at summit | 15:28 |
| richm | jamielennox: ok - is the intention with keystone that there should always be some sort of default role that all users have? | 15:29 |
| richm | I see in the default packstack install that there is a _member_ role | 15:29 |
| *** dimsum_ has quit IRC | 15:29 | |
| *** andreaf has quit IRC | 15:30 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor extract class for signing directory https://review.openstack.org/122281 | 15:30 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: Refactor auth_token revocation list members to new class https://review.openstack.org/102403 | 15:30 |
| jamielennox | richm: it's not defined by keystone at all, I expect you will need to have some role like that to link users/tenants but what you call it and what permissions you attach could be deployment specific | 15:31 |
| *** dimsum_ has joined #openstack-keystone | 15:31 | |
| jamielennox | richm: more i think i would expect that any deployment mechanism would have a role set up like that, devstack/packstack/ i would expect even the raw puppet modules would have to define something like that | 15:31 |
| richm | jamielennox: ok - I need to figure how where packstack creates the _member_ role - it's not in the puppet-keystone keystone specific puppet modules | 15:32 |
| richm | will keystone user-role-add --user $user --role _member_ --tenant $tenant ADD the role _member_ if it does not exist? | 15:36 |
| morganfainberg | jamielennox, didnt https://blueprints.launchpad.net/python-keystoneclient/+spec/keystoneclient-from-config merge with the session changes recently? | 15:37 |
| jamielennox | morganfainberg: wow, that's a year and i'm still working on almost exactly that :( | 15:37 |
| jamielennox | yea, it can probably be marked off as part of the auth plugins and session stuff | 15:37 |
| *** diegows has joined #openstack-keystone | 15:38 | |
| morganfainberg | and https://blueprints.launchpad.net/python-keystoneclient/+spec/plugin-params | 15:38 |
| jamielennox | from the ksc side it's done | 15:38 |
| jamielennox | richm: no idea, i would think now | 15:38 |
| jamielennox | morganfainberg: yep, done | 15:39 |
| jamielennox | released 0.11 maybe 0.10 | 15:39 |
| bknudson | morganfainberg: I think we can do i18n in keystoneclient and keystonemiddleware now | 15:40 |
| morganfainberg | bknudson, we should then ^_^ | 15:40 |
| morganfainberg | jamielennox, https://blueprints.launchpad.net/python-keystoneclient/+spec/session-propagation | 15:41 |
| morganfainberg | jamielennox, and https://blueprints.launchpad.net/python-keystoneclient/+spec/session-retries | 15:41 |
| morganfainberg | (sorry just trying to do the quick cleanup here) | 15:42 |
| jamielennox | morganfainberg: wow, that's generic | 15:42 |
| morganfainberg | jamielennox, yeah | 15:42 |
| jamielennox | retries done, released 0.11 | 15:42 |
| ayoung | nkinder is this for F20 as well: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-kerberos-setup/vm-post-cloud-init-rdo.sh | 15:43 |
| jamielennox | morganfainberg: you can probably close out propagation. I can mark it as the adapter stuff so 0.10 | 15:43 |
| ayoung | nkinder, specifically: # RDO requires EPEL | 15:43 |
| ayoung | yum install -y http://download.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-2.noarch.rpm | 15:43 |
| ayoung | yum-config-manager --enable epel | 15:43 |
| ayoung | richm, _member_ was a porting thing when we went from users being owned by tenants to users being assigned roles in projects | 15:44 |
| *** lihkin has quit IRC | 15:44 | |
| ayoung | since there might have been a Member role already assigned by Horizon, but we could not be certain | 15:44 |
| morganfainberg | jamielennox and https://blueprints.launchpad.net/python-keystoneclient/+spec/version-independant-plugins | 15:44 |
| nkinder | ayoung: what are you trying to run on F20? RDO? | 15:44 |
| ayoung | and we need to make something that worked in upgrade and downgrade | 15:44 |
| *** lihkin has joined #openstack-keystone | 15:44 | |
| ayoung | nkinder, F20 | 15:44 |
| ayoung | nkinder, dreamhost doesn't have Centos7 yet, | 15:45 |
| nkinder | ayoung: I haven't tried RDO on F20 | 15:45 |
| ayoung | I could probably upload an image ,but going to start with F20 | 15:45 |
| jamielennox | morganfainberg: release 0.11 | 15:45 |
| nkinder | ayoung: so you can try, but I don't know how it works there. You can disable the EPEL part since it doesn't apply. | 15:45 |
| ayoung | k | 15:45 |
| ayoung | starting with yum install -y https://rdo.fedorapeople.org/openstack-juno/rdo-release-juno.rpm | 15:45 |
| *** gyee has joined #openstack-keystone | 15:46 | |
| morganfainberg | jamielennox, https://blueprints.launchpad.net/python-keystoneclient looking better | 15:48 |
| jamielennox | morganfainberg: https://blueprints.launchpad.net/python-keystoneclient/+spec/endpoint-version-query pretty much done as well | 15:49 |
| morganfainberg | k will mark as implemented | 15:49 |
| richm | ayoung: ok | 15:50 |
| richm | ayoung: so where is the _member_ role defined/added? | 15:51 |
| morganfainberg | jamielennox, we have 6 BPs to classify / mark for needing spec in client | 15:51 |
| ayoung | richm, the _member_ role is no longer needed, and it might not even be something we create in a migration anymore | 15:51 |
| morganfainberg | that is quite reasonable. | 15:51 |
| ayoung | richm, we might have dropped it when we collapsed the migrations for.. Icehouse? | 15:51 |
| richm | "create in a migration" - do you mean the database migrations? | 15:51 |
| richm | I'm using the latest juno code from rdo | 15:51 |
| ayoung | richm, yep | 15:51 |
| richm | and _member_ is just automagically there | 15:52 |
| ayoung | richm, if keystone-manage db_sync puts it there | 15:52 |
| ayoung | look in keystone/common/sql.... | 15:52 |
| morganfainberg | jamielennox, and middleware https://blueprints.launchpad.net/keystonemiddleware | 15:52 |
| ayoung | something version something | 15:52 |
| *** cjellick has joined #openstack-keystone | 15:54 | |
| jamielennox | morganfainberg: pluggable-auth strongly under way | 15:54 |
| jamielennox | i looked at gordc review to include audit | 15:55 |
| morganfainberg | jamielennox, right. | 15:55 |
| richm | ayoung: grep _member_ /usr/lib/python2.7/site-packages/keystone/common/sql/migrate_repo/versions/*.py | 15:55 |
| jamielennox | that's still a go as far as i know? | 15:55 |
| richm | ayoung: that gives nothing - no matches | 15:55 |
| ayoung | richm, probably read out of the config file | 15:55 |
| richm | ayoung: /etc/keystone/keystone.conf? | 15:56 |
| ayoung | richm, _member_ is defaulted in common/config.py | 15:56 |
| *** david-lyle has quit IRC | 15:56 | |
| richm | ok | 15:56 |
| ayoung | richm, yes you should see the defualt in that, commented out | 15:56 |
| ayoung | nkinder, $mv /usr/lib/python2.7/site-packages/packstack/puppet/modules/packstack/manifests/apache_common.pp /usr/share/openstack-puppet/modules/packstack/manifests | 15:58 |
| ayoung | mv: cannot stat ‘/usr/lib/python2.7/site-packages/packstack/puppet/modules/packstack/manifests/apache_common.pp’: No such file or directory | 15:58 |
| ayoung | is the apache_common supposed to be part of openstack_packstack | 15:58 |
| richm | ayoung: not yet | 15:58 |
| richm | ayoung: the change was just merged | 15:58 |
| richm | so I doubt it has made it into a rpm yet | 15:58 |
| nkinder | ayoung: the patch file included in my repo would add it | 15:59 |
| ayoung | nkinder, I applied that... | 15:59 |
| ayoung | oh, wait, | 15:59 |
| nkinder | ayoung: it should have created that file | 15:59 |
| ayoung | heh, patch binary wasn't installed | 15:59 |
| nkinder | ayoung: look in rdo.conf to see what packages are expected on the system | 15:59 |
| ayoung | OK got it | 15:59 |
| ayoung | nkinder, yum groupinstall "Development Tools" seems to work for me | 16:00 |
| ayoung | I already enrolled the machine as an IPA client, though | 16:00 |
| ayoung | lemme see if I have the ldap cli | 16:01 |
| ayoung | nkinder, can we please change the RH package name to FreeIPA? This is annoying | 16:02 |
| morganfainberg | whoa. that is a weird one: http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/audit-middleware.html | 16:02 |
| morganfainberg | wem | 16:04 |
| morganfainberg | erm | 16:04 |
| jamielennox | morganfainberg: yea, that's the one i meant - are we doing that? | 16:04 |
| jamielennox | must have been discussed whilst i was away | 16:04 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1384377 | 16:04 |
| uvirtbot | Launchpad bug 1384377 in keystone "Policy rule position errors" [Undecided,New] | 16:04 |
| morganfainberg | that one | 16:04 |
| morganfainberg | that is what i meant. | 16:04 |
| morganfainberg | copy/paste error | 16:04 |
| ayoung | nkinder, packstack away! Runs much better once I realized I needed to set RDO_PASSWORD before running sed -i "s/CONFIG_\(.*\)_PW=.*/CONFIG_\1_PW=$RDO_PASSWORD/g" /root/answerfile.txt | 16:06 |
| *** marcoemorais has joined #openstack-keystone | 16:06 | |
| nkinder | ayoung: yeah, that would help... :) | 16:06 |
| *** jimbaker has joined #openstack-keystone | 16:08 | |
| *** marcoemorais has quit IRC | 16:09 | |
| ayoung | ERROR : Failed to run remote script, stdout: Device em2 does not exist | 16:09 |
| ayoung | nkinder, eth0. how quaint | 16:09 |
| *** radez_g0n3 is now known as radez | 16:11 | |
| *** dimsum_ is now known as dims | 16:13 | |
| *** diegows has quit IRC | 16:13 | |
| *** dims is now known as Guest9798 | 16:14 | |
| *** diegows has joined #openstack-keystone | 16:15 | |
| morganfainberg | jamielennox, https://bugs.launchpad.net/keystone/+bug/1377080 so.. | 16:16 |
| uvirtbot | Launchpad bug 1377080 in python-keystoneclient "Stale endpoint selection logic in keystone client" [Wishlist,Opinion] | 16:16 |
| morganfainberg | this looks like a duplicate of vish's request. | 16:16 |
| jamielennox | morganfainberg: i'd like to close it out as opinion - i think it's an error to have multiple values of the same service_type in a catalog | 16:16 |
| jamielennox | ideally we'd enforce that uniqueness in keystone | 16:17 |
| morganfainberg | this is similar to https://bugs.launchpad.net/keystone/+bug/1376937 | 16:17 |
| uvirtbot | Launchpad bug 1376937 in keystone "No way to prevent duplicates in endpoints" [Medium,Confirmed] | 16:17 |
| morganfainberg | but it's service vs. endpoint | 16:18 |
| jamielennox | however given that it's currently and always has been broken it's a feature request and not something that i think we should do in client | 16:18 |
| *** david-lyle has joined #openstack-keystone | 16:18 | |
| morganfainberg | and yes the keystoneclient one can be closed out as "wont fix"/"invalid" not even opinion | 16:18 |
| morganfainberg | it's not something the client should care abouty | 16:18 |
| jamielennox | sure | 16:19 |
| jamielennox | so i don't know from service, you could have service_types distinguished by service_ name i guess | 16:19 |
| jamielennox | which i assume is why the uniqueness constraint isn't there already | 16:19 |
| morganfainberg | hm. | 16:19 |
| *** afazekas has quit IRC | 16:19 | |
| morganfainberg | this *sounds* like abug | 16:19 |
| morganfainberg | honestly | 16:20 |
| morganfainberg | kinda smells like one too | 16:20 |
| jamielennox | i can tell you that you'd have a rough time trying to do that in practice | 16:20 |
| morganfainberg | lets mark this as a real bug then. | 16:20 |
| morganfainberg | there is some research that needs to be done to see if anyone is doing this in practice | 16:21 |
| morganfainberg | i highly doubt it | 16:21 |
| morganfainberg | i think this is just the other side of the coin for the but ^ that vishy opened | 16:21 |
| *** marcoemorais has joined #openstack-keystone | 16:22 | |
| *** marcoemorais has left #openstack-keystone | 16:22 | |
| *** lhcheng has joined #openstack-keystone | 16:22 | |
| *** marcoemorais has joined #openstack-keystone | 16:22 | |
| jamielennox | morganfainberg: i don't think openstack/us has ever properly defined what constraints we put on the service catalog/how we expect it to be populated so there's just a lot of cruft there | 16:23 |
| morganfainberg | jamielennox, yeah :( | 16:23 |
| morganfainberg | jamielennox, and we need to fix that from a UX perspective | 16:23 |
| morganfainberg | this one is just wierd | 16:24 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1384377 | 16:24 |
| uvirtbot | Launchpad bug 1384377 in keystone "Policy rule position errors" [Undecided,New] | 16:24 |
| jamielennox | morganfainberg: that and for sanity | 16:24 |
| morganfainberg | anyone have an active keystone running we can validate that rule order is... wonky? | 16:24 |
| morganfainberg | cause that sounds like a bug in oslo-policy | 16:24 |
| jamielennox | morganfainberg: and particularly for region handling, the MOC and others are doing some crazy stuff with regions that we don't support in any way i think | 16:24 |
| morganfainberg | jamielennox, https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 16:25 |
| uvirtbot | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,New] | 16:25 |
| jamielennox | morganfainberg: ugh - keyring | 16:25 |
| morganfainberg | can we make it die | 16:25 |
| morganfainberg | please | 16:25 |
| morganfainberg | :( | 16:25 |
| morganfainberg | "go use openstackclient" :P | 16:25 |
| jamielennox | it's in completely the wrong spot so i've just ignored it as much as possible | 16:26 |
| morganfainberg | well i think it's time to make a call | 16:26 |
| jamielennox | oo, generic shell as well - this guy's way out on a limb | 16:26 |
| morganfainberg | ^ based on that bug | 16:26 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 16:28 |
| jamielennox | oo, generic shell as well - this guy's way out on a limb | 16:28 |
| jamielennox | damnit, alt+tab up+enter | 16:29 |
| *** _cjones_ has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/python-keystoneclient: Improves feedback message in SSL error https://review.openstack.org/129769 | 16:31 |
| *** diegows has quit IRC | 16:35 | |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use connection retrying from keystoneclient https://review.openstack.org/129868 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Add versions to requests https://review.openstack.org/130531 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use an adapter in IdentityServer https://review.openstack.org/130530 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use Discovery fixtures for auth token tests https://review.openstack.org/130247 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Convert authentication into a plugin https://review.openstack.org/115857 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Additional discovery changes https://review.openstack.org/130533 | 16:41 |
| openstackgerrit | Jamie Lennox proposed a change to openstack/keystonemiddleware: Use real discovery object in auth_token middleware. https://review.openstack.org/130532 | 16:41 |
| morganfainberg | jamielennox, OMG! ;) | 16:41 |
| *** mikedillion has joined #openstack-keystone | 16:41 | |
| *** mikedillion has quit IRC | 16:41 | |
| jamielennox | morganfainberg: that's been up for a few days - i just had to rebase it for a full stop added to a doc string beneath the first one | 16:41 |
| jamielennox | morganfainberg: i had bknudson +2 on the first 3 if you want to chime in | 16:42 |
| morganfainberg | jamielennox, i am going to go get breakfast here shortly | 16:43 |
| morganfainberg | but today i plan on doing a bunch of code review / spec reviews | 16:43 |
| jamielennox | no problem - it's not even that old, however if you pass all those you get devstack with any auth plugin you like | 16:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Kilo version of non-persistent token specification https://review.openstack.org/129736 | 16:44 |
| morganfainberg | jamielennox, also need to start my next blog post ;) got a 3-parter to write up. | 16:44 |
| jamielennox | i have one i want to do and it's just not quite there | 16:45 |
| jamielennox | so close | 16:45 |
| * morganfainberg still needs to fix the favicon and add a banner at the top of the blog. | 16:45 | |
| morganfainberg | jamielennox, i moved to octostrap3 from whitespace | 16:45 |
| morganfainberg | i it felt a bit cleaner (though i miss using the css mask-trick I was using for the twitter icons) | 16:45 |
| jamielennox | morganfainberg: i spent about 10 minutes on that decision - it looked ok so i grabbed it | 16:45 |
| rodrigods | morganfainberg, we need reviews in the HM API patch =( | 16:46 |
| jamielennox | i hate css | 16:46 |
| morganfainberg | rodrigods, yes we need the spec reviews | 16:46 |
| jamielennox | also i haven't linked it to any of the social stuff i'm supposed to | 16:46 |
| morganfainberg | jamielennox, bootstrap is nice cause it makes that decision silly easy | 16:46 |
| morganfainberg | https://www.morganfainberg.com | 16:46 |
| rodrigods | morganfainberg, was hoping to have it merged until the summit... seems the case? | 16:46 |
| morganfainberg | jamielennox, also - cloudflare = free SSL | 16:46 |
| morganfainberg | rodrigods, i still hope so, it's not far off really | 16:46 |
| morganfainberg | rodrigods, if not we can get it done either @ summit or just post. | 16:47 |
| jamielennox | hmm - i considered going for SSL, but it's a static site with source on github, there really isn't anything to protect | 16:47 |
| rodrigods | morganfainberg, could be the case to add a topic to tomorrow's meeting? | 16:47 |
| morganfainberg | rodrigods, please add it to the agenda! | 16:47 |
| openstackgerrit | A change was merged to openstack/keystonemiddleware: Remove netaddr package requirement https://review.openstack.org/130664 | 16:47 |
| rodrigods | morganfainberg, ++ | 16:47 |
| morganfainberg | jamielennox, i figure it's sane to just be nice to people who like SSL-ing everything | 16:47 |
| *** edmondsw has joined #openstack-keystone | 16:48 | |
| jamielennox | yea, but part of my rationale for using github pages was never having to worry about things like load balancing, then put cloudflare in front | 16:48 |
| morganfainberg | jamielennox, i now need to make the in-line anchors have a little link-y icon. | 16:48 |
| morganfainberg | jamielennox, cloudflare also handles my google analytics, helps with caching (github's pages can be bad) among a few other things | 16:49 |
| morganfainberg | jamielennox, i turn off all the "site protection" stuff. | 16:49 |
| jamielennox | fair enough, i figure the people who read my stuff see it via planet anyway | 16:49 |
| jamielennox | although i wrote like 5 lines on what some error meant in auth_token and how to fix it, apparently that drives about half my traffic | 16:50 |
| morganfainberg | lol | 16:52 |
| *** Guest9798 is now known as dims__ | 16:55 | |
| *** jistr has quit IRC | 16:55 | |
| *** toddnni has joined #openstack-keystone | 16:56 | |
| *** marcoemorais has quit IRC | 16:58 | |
| *** marcoemorais has joined #openstack-keystone | 16:59 | |
| *** marcoemorais has quit IRC | 16:59 | |
| *** marcoemorais has joined #openstack-keystone | 17:00 | |
| jamielennox | bknudson: https://review.openstack.org/131098 - nova->cinder via session | 17:02 |
| *** marcoemorais has quit IRC | 17:02 | |
| jamielennox | gyee: ^^ | 17:02 |
| jamielennox | will have a look at neutron tomorrow | 17:02 |
| *** marcoemorais has joined #openstack-keystone | 17:02 | |
| ayoung | morganfainberg, https://blueprints.launchpad.net/ubuntu/+spec/foundations-t-freeipa | 17:04 |
| *** _cjones_ has quit IRC | 17:04 | |
| *** toddnni has quit IRC | 17:10 | |
| jamielennox | ayoung: so packaged? | 17:11 |
| *** _cjones_ has joined #openstack-keystone | 17:11 | |
| gyee | jamielennox, thanks! I am looking at nova-neutron too | 17:11 |
| gyee | seem like we need quite a bit of request-mock | 17:11 |
| ayoung | jamielennox, ? | 17:11 |
| jamielennox | ayoung: FreeIPA on debian | 17:11 |
| ayoung | jamielennox, looks like it | 17:11 |
| jamielennox | gyee: bugger - i was hoping not to stub at that level in nova | 17:11 |
| jamielennox | gyee: i know you have the review up and that you copied some stuff out of that github branch of mine so i won't start from scratch | 17:12 |
| jamielennox | just need to give it a proper try out and see what's holding us up | 17:12 |
| gyee | jamielennox, I am trying to fix the tests right now, hopefully I have a new patch for you to look at sometime today | 17:12 |
| gyee | I think I've pulled in all your changes, but can you please double check? | 17:13 |
| morganfainberg | ayoung, did you ping me? | 17:14 |
| jamielennox | gyee: yea, i'll spin up a devstack with it all tomorrow | 17:14 |
| ayoung | morganfainberg, maybe like hours ago | 17:15 |
| jamielennox | done for today but | 17:15 |
| morganfainberg | ayoung, ok. | 17:15 |
| ayoung | morganfainberg, ah, the FreeIPA debian thing | 17:15 |
| jamielennox | gyee: if you start https://review.openstack.org/115857 and work your way through, there are a couple of +2 already. The end of that chain is auth plugins in auth_token middleware | 17:15 |
| ayoung | morganfainberg, its now in Debian Unstable | 17:15 |
| morganfainberg | ayoung, yeah we talked abgout that one :) | 17:15 |
| * morganfainberg is very happy about that | 17:16 | |
| ayoung | morganfainberg, Timo is doing good work | 17:16 |
| ayoung | http://anonscm.debian.org/cgit/?q=pkg-freeipa | 17:16 |
| gyee | jamielennox, yes, code review, code review, and code review :) | 17:16 |
| jamielennox | gyee: np - i think i'm going to have to rebase it again against some of those doc changes | 17:17 |
| jamielennox | although, ayoung rampage on the middleware +2 s | 17:18 |
| ayoung | jamielennox, looked at all of those before | 17:18 |
| ayoung | Its a bulk rebase... | 17:18 |
| ayoung | with a bunch of +2s from others | 17:19 |
| *** harlowja has joined #openstack-keystone | 17:19 | |
| *** wolsen|away is now known as wolsen | 17:20 | |
| jamielennox | ayoung: do you know how you'd go about doing kerberos in auth_token? | 17:20 |
| ayoung | jamielennox, hmmm | 17:20 |
| ayoung | jamielennox, well, we'd start with your plugin patch | 17:20 |
| jamielennox | i think all the pieces should be there if you want to give it a shot, but i'm not sure how the user mapping would work | 17:20 |
| ayoung | the server would have to have a keytab | 17:20 |
| ayoung | and...for an eventlet based one, we'd have to be comfortable using requests-kerberos | 17:20 |
| ayoung | but that should be OK | 17:21 |
| jamielennox | hmm, ok | 17:21 |
| gyee | kerberoize it! | 17:21 |
| ayoung | jamielennox, the Kerberos Principal from the Keytab would be identified as the user | 17:21 |
| jamielennox | well once all that auth_token stuff merges i want to do a blog post with a mathcing server side and client side auth plugin and using it via auth_token, then we can do an SSL or something post | 17:21 |
| jamielennox | ayoung: yea, but how do you deploy that on devstack when everythings on one machine? | 17:22 |
| ayoung | jamielennox, why should it make a difference? | 17:22 |
| ayoung | IPA would need a service user | 17:22 |
| ayoung | so you create Nova, and then do ipa-getkeytab | 17:23 |
| jamielennox | ayoung: well there are no parameters to the kerberos plugin, it pulls everything from the environment | 17:23 |
| jamielennox | so you would need like a wrapper around every service that sets up the env before loading the service | 17:23 |
| ayoung | jamielennox, in Horizon I pass the credentials cache from HTTPD | 17:23 |
| ayoung | but we can get away with that there because of the S4U2... | 17:23 |
| ayoung | jamielennox, with GSSAPI, there is a directory that, if you put the Keytab in there, the service is able to get a service ticket on demand | 17:24 |
| ayoung | nkinder, ^^ | 17:24 |
| jamielennox | i think you mentioned this once before like an F21 feature being able to have a service refresh a ticket | 17:25 |
| ayoung | jamielennox, http://k5wiki.kerberos.org/wiki/Projects/Keytab_initiation | 17:25 |
| ayoung | I think that is it | 17:25 |
| jamielennox | i don't think requests-kerberos or the python kerberos stuff is good enough that we could give it a keytab/ticket anyway | 17:26 |
| ayoung | FILE:${localstatedir}/krb5/user/%{euid}/client.keytab. | 17:26 |
| ayoung | jamielennox, we could always cron a kinit -k bt yuck | 17:26 |
| jamielennox | ayoung: is it implemented? | 17:26 |
| ayoung | yes, has been for a while | 17:26 |
| jamielennox | will it work with python-kerberos ? | 17:27 |
| amakarov | ayoung, greetings! I've done with tests for https://review.openstack.org/#/c/126897/ Do you have any suggestions who else can provide valuable feedback on this issue? | 17:27 |
| *** amcrn has joined #openstack-keystone | 17:27 | |
| ayoung | amakarov, you are in the right vicinity | 17:27 |
| ayoung | dolphm, morganfainberg bknudson care to review a fairly significant change the trust api? nkinder you too? | 17:28 |
| ayoung | gyee, | 17:28 |
| jamielennox | alright - i'm out, cya everyone | 17:28 |
| ayoung | amakarov, just added keystone-core to that review | 17:28 |
| amakarov | ayoung, cool ) | 17:29 |
| ayoung | amakarov, BTW, talked with shardy in #openstack-dev. He's OK with disabled by default for now, so long as he gets it enabled by default at release | 17:29 |
| amakarov | ayoung, I agree this feature may end as a default behavior but now now | 17:30 |
| amakarov | s/now/not/ | 17:30 |
| gyee | ayoung, which review, the django one? | 17:34 |
| ayoung | gyee, trust re-delegation | 17:34 |
| ayoung | gyee, https://review.openstack.org/#/c/126897/ | 17:35 |
| morganfainberg | ayoung, yes i care to review it :) | 17:35 |
| gyee | oh k, code review day today | 17:35 |
| gyee | morganfainberg, course you do :) | 17:35 |
| morganfainberg | ayoung, hehe | 17:35 |
| morganfainberg | erm gyee , hehe | 17:35 |
| gyee | morganfainberg, ya right, keystone test are not happy after Yosemite upgrade | 17:36 |
| morganfainberg | gyee, "brew install python" | 17:36 |
| gyee | ah | 17:36 |
| morganfainberg | and you'll need openssl too | 17:36 |
| morganfainberg | i just solved it [but it was some work because i had to make sure python was only installed for *my* user, not globally] | 17:37 |
| morganfainberg | brew gets wonky when you do that | 17:37 |
| gyee | I have both python and openssl installed | 17:37 |
| amakarov | ayoung, I recall you said about redelegating oauth - direct me please: should I start it with a blueprint? | 17:37 |
| morganfainberg | oh | 17:37 |
| morganfainberg | also | 17:37 |
| gyee | now I got some ValueError in ldap | 17:38 |
| morganfainberg | gyee, set ARCHFLAGS=-Wno-error=unused-command-line-argument | 17:38 |
| ayoung | amakarov, I think I was suggesting you start with looking at unifying oauth and trusts at the backend | 17:38 |
| ayoung | and there is no spec for that yet amakarov | 17:38 |
| morganfainberg | gyee in your env, it mighyt not build python-ldap otherwise | 17:38 |
| ayoung | amakarov, so...oauth has the consumer table | 17:38 |
| gyee | morganfainberg, that's what I am going to try next | 17:38 |
| gyee | thanks for the tip! | 17:38 |
| ayoung | amakarov, a consumer should be a user | 17:38 |
| morganfainberg | gyee, this is my brew list: autoconfautomakegdbmlibgpg-errorlibksbalibtoollibyamlmakedependopensslpkg-configpythonreadlinesqlite | 17:39 |
| *** marcoemorais has quit IRC | 17:39 | |
| morganfainberg | most comes from python | 17:39 |
| *** marcoemorais has joined #openstack-keystone | 17:39 | |
| *** marcoemorais has quit IRC | 17:42 | |
| *** marcoemorais has joined #openstack-keystone | 17:42 | |
| amakarov | ayoung, thank you for the point! | 17:44 |
| *** henrynash has joined #openstack-keystone | 17:47 | |
| morganfainberg | ayoung, that change needs an API change before it can merge | 17:49 |
| morganfainberg | gyee, ^ | 17:50 |
| morganfainberg | ayoung, formerly identity-api repo | 17:50 |
| ayoung | morganfainberg, the trust delegation one? | 17:50 |
| morganfainberg | ayoung, yes | 17:50 |
| gyee | did shardy introduced a spec awhile back? | 17:50 |
| morganfainberg | we have a spec | 17:50 |
| morganfainberg | just no API doc change | 17:51 |
| gyee | ahh yes indeed | 17:51 |
| ayoung | amakarov, ^^ | 17:52 |
| ayoung | amakarov, so we need an update to http://git.openstack.org/cgit/openstack/identity-api/tree/v3/src/markdown/identity-api-v3-os-trust-ext.md refelcting the new behavior | 17:52 |
| morganfainberg | ayoung, amakarov, http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/identity-api-v3-os-trust-ext.rst | 17:53 |
| morganfainberg | not identity-api repo anymore | 17:53 |
| morganfainberg | identity-api repo is no longer used. | 17:53 |
| morganfainberg | ayoung, you'll like this, it means you can make 1 change and include the spec *and* the API doc change at once. | 17:54 |
| morganfainberg | ayoung, no more needing to do it in two places. | 17:54 |
| lbragstad | morganfainberg: summit question: do we know what session we want to talk about the Keystone functional tests in? Or is that going to be a Friday (hackathon) thing? | 17:54 |
| gyee | morganfainberg, wonder if we can automate this like javadoc | 17:54 |
| morganfainberg | lbragstad, pod/hallway-track/meetup-day | 17:55 |
| lbragstad | morganfainberg: cool, thanks | 17:55 |
| morganfainberg | gyee, i'd be worried about doing that | 17:55 |
| morganfainberg | gyee, 1st off, the code is in a separate repo, 2nd changing the code could = spec change then. | 17:55 |
| ayoung | morganfainberg, my kneejerk reaction was "not another change" and then...slow realization...this is how it should have been from the get go | 17:55 |
| morganfainberg | i'd rather keep the separattion. | 17:55 |
| morganfainberg | ayoung, ++ yes! | 17:55 |
| amakarov | morganfainberg, understood, I'm off to write docs | 17:55 |
| morganfainberg | ayoung, we'll get the v2 spec in there too (i think) not too far off. annegentle is workign on thart | 17:56 |
| morganfainberg | ayoung, the other projects are going to be encouraged to do the same | 17:56 |
| morganfainberg | ayoung, also... | 17:56 |
| morganfainberg | ayoung, http://specs.openstack.org/openstack/keystone-specs/api/identity-api-v3-os-trust-ext.html | 17:56 |
| morganfainberg | ayoung, we now also officially publish it - you don't have to link to github! | 17:56 |
| gyee | morganfainberg, seem like much easier to just generate the spec from the code, 100% accurate :) | 17:56 |
| ayoung | morganfainberg, does this mean we are bleeding keystoneisms in the purity of the identity-api? | 17:56 |
| gyee | the truth is in the code, did somebody said that? | 17:57 |
| *** ukalifon1 has joined #openstack-keystone | 17:57 | |
| morganfainberg | gyee, sure, i'd rather *new* code be written to the spec vs the spec to the code though | 17:57 |
| morganfainberg | gyee, stuff that exists we can't fix. | 17:57 |
| morganfainberg | ayoung, bleeding keystoneisms? | 17:58 |
| gyee | haha | 17:58 |
| ayoung | morganfainberg, I mean the specs are going to have implementation specific stuff in them | 17:58 |
| morganfainberg | ayoung, only API documentation, which was a requirement for REST API changes anyway | 17:58 |
| ayoung | having the keystone specs in the same repo as the identity api specs... | 17:58 |
| morganfainberg | nah, API docs are in /api | 17:58 |
| morganfainberg | and we *did* use identity-api as a specification... that just wasn't published anywhere really... and people could find but didn't match docs. | 17:59 |
| openstackgerrit | A change was merged to openstack/keystone: Remove nonexistant param from docstring https://review.openstack.org/130660 | 17:59 |
| *** ukalifon1 has quit IRC | 17:59 | |
| morganfainberg | basically we keep the spec + REST change coupled this way, easy to tie them together. but we shouldn't need to get into impl details on the rest docs. | 18:00 |
| morganfainberg | nothing on that front changes. | 18:00 |
| morganfainberg | amakarov, i've also commented on the patch. | 18:01 |
| *** lihkin has quit IRC | 18:02 | |
| amakarov | morganfainberg, thank you for the feedback! | 18:03 |
| *** harlowja has quit IRC | 18:03 | |
| henrynash | morganfainberg: so are we again requiring api specs as part of the kilo/specs before they can be approved (I thought we decided against that….but maybe I missed something :-) ) | 18:09 |
| morganfainberg | henrynash, largely that was because identity-api was a separate repo | 18:10 |
| *** marcoemorais has quit IRC | 18:10 | |
| morganfainberg | henrynash, now you can bundle the change into a single review | 18:10 |
| *** marcoemorais has joined #openstack-keystone | 18:10 | |
| ayoung | henrynash, are you pursuing the endpoint side of "fetch policy for endpoint" yet? | 18:10 |
| morganfainberg | henrynash, it makes sense to tie REST doc changes with the spec. | 18:10 |
| henrynash | morganfainberg: …so conceptually like teh singel spec…it was just there was storng desire to get approval of teh overall idea before we get into bikeshedding the api | 18:11 |
| morganfainberg | henrynash, i think that was a limitation of needing to submit 2 separate reviews | 18:11 |
| henrynash | morganfainberg: …at least I thought that’s what folks wanted... | 18:11 |
| morganfainberg | henrynash, having the -spec block on identity-api review and vice-versa | 18:11 |
| morganfainberg | henrynash we can still defer the API spec, no hard-and-fast rule | 18:12 |
| ayoung | henrynash, I see no problem with having both the spec and the api in the same repo | 18:12 |
| henrynash | ayoung: nor do I…. | 18:12 |
| ayoung | I think that we should be comfortable with multiple submissions for a given change | 18:12 |
| ayoung | 1. Float the idea | 18:12 |
| ayoung | 2. Flesh it out | 18:12 |
| ayoung | 3. API docs | 18:12 |
| morganfainberg | henrynash, if it's something we want to allow, it's acceptible, but i'd push for getting the API spec in the same review *if* possible. | 18:12 |
| ayoung | iterate | 18:12 |
| * ayoung would love a backlog section first | 18:13 | |
| henrynash | and do people approve 1 (or 2) before 3? | 18:13 |
| morganfainberg | but it still stands that a spec can be changed even after merged... until it's "completed" that is ;) | 18:13 |
| ayoung | you shouldn't *have* to do a backlog first, but if the idea is contraversial...start there | 18:13 |
| ayoung | maybe have a change that goes in to indicate it is completed. | 18:13 |
| morganfainberg | ayoung, for middleware/keystoneclient we have that | 18:14 |
| ayoung | ++ | 18:14 |
| morganfainberg | you move it to the "implemented" page | 18:14 |
| henrynash | ayoung, morganfainberg: and are we saying we put the api change sin that actual current spec doc…or in a searpate doc | 18:14 |
| morganfainberg | for keystone, it's based on the release cycles. | 18:14 |
| morganfainberg | henrynash, identity-api was moved to keystone-specs/api | 18:14 |
| morganfainberg | so you make changes to the *new* location of the identity-api docs | 18:14 |
| *** toddnni has joined #openstack-keystone | 18:15 | |
| morganfainberg | also, it was changed from markdown to rst | 18:15 |
| henrynash | morganfainberg: oh, so all you are saying is put it in there…oh, ok | 18:15 |
| morganfainberg | henrynash, yep :) | 18:15 |
| henrynash | morganfainberg : ok, phew | 18:15 |
| morganfainberg | henrynash, don't put REST API docs/etc *in* the spec doc, but it in the API reference :) | 18:15 |
| henrynash | morganfainberg: still a bit concerned that this is a recipe for slowing us down (me, I love specs!…..but I thought lots of peopel complained that their boss needed to see some mark of approval before they really got into the details of APIs & code) | 18:17 |
| morganfainberg | henrynash, like i said i'd push for the API docs to go into the spec. | 18:17 |
| morganfainberg | but we can defer it. | 18:17 |
| henrynash | morganfainberg: Ok…. | 18:17 |
| morganfainberg | the API docs tend to be easier to justify - as it's part of the specification | 18:18 |
| *** carlosmarin has joined #openstack-keystone | 18:18 | |
| morganfainberg | henrynash, i think it's going to just depend on the spec, some specs we wont know if we like them w/o the API docs. | 18:18 |
| morganfainberg | henrynash, some of them we'll like / not like regardless | 18:19 |
| henrynash | morganfainberg: ok, let’s run with it….! | 18:19 |
| *** diegows has joined #openstack-keystone | 18:20 | |
| *** harlowja has joined #openstack-keystone | 18:22 | |
| *** david-lyle has quit IRC | 18:22 | |
| *** amakarov is now known as amakarov_away | 18:22 | |
| *** jaosorior has quit IRC | 18:23 | |
| morganfainberg | henrynash, for https://review.openstack.org/#/c/123238/5/specs/kilo/domain-config-ext.rst i am tempted to see how dstanek's session goes / hallway talks | 18:23 |
| morganfainberg | before we approve | 18:23 |
| henrynash | morganfainbgerg: I’m fine with that | 18:23 |
| morganfainberg | henrynash, it should help answer the "extension" or not. | 18:23 |
| henrynash | morganfainberg: sounds good | 18:24 |
| morganfainberg | henrynash, i think what we decide around "optional dependencies" will change our general direction on extensions | 18:25 |
| *** carlosmarin has left #openstack-keystone | 18:25 | |
| henrynash | morganfainberg: yes….getting some clarity here would be good | 18:25 |
| morganfainberg | i'm going to go get a late breakfast now. | 18:27 |
| openstackgerrit | A change was merged to openstack/keystone: Fixes aggressive use of translation hints https://review.openstack.org/125233 | 18:27 |
| *** david-lyle has joined #openstack-keystone | 18:28 | |
| *** thedodd has quit IRC | 18:28 | |
| morganfainberg | henrynash, gyee, dolphm, nkinder, lbragstad, anteaya, dstanek, dhellmann, ayoung , stevemar, topol: quick question, do you want me to put links (to the sections of https://www.morganfainberg.com/blog/2014/10/21/openstack-kilo-summit-pre-summit-thoughts/ ) in each sched.org session or just in the etherpads. | 18:29 |
| morganfainberg | i'm trying to give people an opportunity to get up to speed with where we are *before* we walk into the design session | 18:30 |
| ayoung | morganfainberg, etherpads | 18:30 |
| ayoung | well...your call | 18:30 |
| anteaya | morganfainberg: did you want my opinion, really? | 18:30 |
| morganfainberg | ayoung, i could go either way, thats why i'm asking for opinions :) | 18:30 |
| morganfainberg | anteaya, yes | 18:30 |
| morganfainberg | anteaya, i trust your view on lots of things :) | 18:30 |
| gyee | morganfainberg, nice, the policy stuff is intriguing | 18:30 |
| anteaya | I link to the etherpad and the wikipage in http://kilodesignsummit.sched.org/event/9902dac01525691e60ac94bf236569c6# because I know my audience | 18:31 |
| anteaya | I give them no opportunity to tell me they couldn't find the link | 18:31 |
| ayoung | I almost think the etherpads should be linked from the sched.org page, and it all be there | 18:31 |
| anteaya | so it is up to you and your audience | 18:31 |
| morganfainberg | ok... how the heck do you get html links in sched.org | 18:31 |
| anteaya | they won't read it anyway | 18:31 |
| anteaya | nor with they prepare | 18:31 |
| anteaya | but I did tell them | 18:31 |
| morganfainberg | anteaya, ++ | 18:32 |
| morganfainberg | i'm *hoping* some people prepare | 18:32 |
| morganfainberg | if it saves us 5 minutes it's a win | 18:32 |
| anteaya | agreed | 18:32 |
| morganfainberg | so, definitely etherpad links. | 18:32 |
| anteaya | and I envy you working with people who actually read documentation and prepare | 18:33 |
| morganfainberg | and post sections definitely in the etherpads. | 18:33 |
| morganfainberg | the only question is should i double-up and puth the post link in sched.org as well? | 18:33 |
| morganfainberg | example for the Hierarchical Multitenancy, the link would be https://www.morganfainberg.com/blog/2014/10/21/openstack-kilo-summit-pre-summit-thoughts/#HM | 18:33 |
| morganfainberg | (yay anchors) | 18:33 |
| morganfainberg | anteaya, and seriously, how did you get the HTML link in the sched.org description? | 18:34 |
| anteaya | I gave my description to ttx and he did it | 18:35 |
| anteaya | ttx is magic | 18:35 |
| morganfainberg | haha | 18:35 |
| anteaya | since I only had one to do, he did it for me | 18:35 |
| anteaya | I never asked how and he never told me | 18:36 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 18:45 |
| *** toddnni has quit IRC | 18:49 | |
| *** toddnni has joined #openstack-keystone | 18:53 | |
| *** joesavak has quit IRC | 19:00 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: revise error message for keystone.token.persistence pkg https://review.openstack.org/131244 | 19:02 |
| *** marcoemorais has quit IRC | 19:03 | |
| *** vejdmn has quit IRC | 19:03 | |
| *** joesavak has joined #openstack-keystone | 19:03 | |
| *** marcoemorais has joined #openstack-keystone | 19:03 | |
| *** jdennis has quit IRC | 19:03 | |
| *** vejdmn has joined #openstack-keystone | 19:03 | |
| *** afazekas has joined #openstack-keystone | 19:05 | |
| *** thedodd has joined #openstack-keystone | 19:06 | |
| morganfainberg | dolphm, you don't happen to know if it's possible to embed HTML in the summit session descriptions, do you? | 19:08 |
| morganfainberg | dolphm, specifically HTML-clicky links | 19:08 |
| dstanek | morganfainberg: not sure if you went ahead and added the links, but it's always good to reference related material | 19:10 |
| morganfainberg | aha it worked this time *weird* | 19:11 |
| *** aix has quit IRC | 19:13 | |
| *** afazekas is now known as afazekas_pub | 19:14 | |
| *** nellysmitt has joined #openstack-keystone | 19:16 | |
| morganfainberg | dolphm, so | 19:17 |
| morganfainberg | dstanek* | 19:17 |
| morganfainberg | dstanek, so | 19:17 |
| morganfainberg | what should i call the link to the blurb I wrote? | 19:17 |
| morganfainberg | "Pre session reading" ? | 19:17 |
| *** harlowja has quit IRC | 19:19 | |
| lbragstad | jamielennox: o/ do you have any input here? https://review.openstack.org/#/c/125738/13/keystone/token/controllers.py | 19:20 |
| *** harlowja has joined #openstack-keystone | 19:22 | |
| *** amcrn has quit IRC | 19:23 | |
| dstanek | morganfainberg: that sounds fine to me | 19:23 |
| *** diegows has quit IRC | 19:32 | |
| *** thedodd has quit IRC | 19:39 | |
| openstackgerrit | Dolph Mathews proposed a change to openstack/keystone: improve error message when tenant ID does not exist https://review.openstack.org/131255 | 19:46 |
| *** lufix has joined #openstack-keystone | 19:51 | |
| *** thedodd has joined #openstack-keystone | 19:51 | |
| *** nellysmitt has quit IRC | 19:51 | |
| *** nkinder has quit IRC | 19:53 | |
| *** toddnni has quit IRC | 19:54 | |
| *** nkinder has joined #openstack-keystone | 19:56 | |
| morganfainberg | ok I've added links and everything to the schedule. | 19:58 |
| morganfainberg | I'm calling the schedule done | 19:58 |
| *** ChanServ sets mode: +o morganfainberg | 19:58 | |
| *** morganfainberg changes topic to "Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | See everyone at the summit! Schedule: http://kilodesignsummit.sched.org/overview/type/keystone" | 19:59 | |
| *** nellysmitt has joined #openstack-keystone | 19:59 | |
| *** shikui_ has joined #openstack-keystone | 20:01 | |
| *** thiagop has quit IRC | 20:01 | |
| *** htruta has quit IRC | 20:02 | |
| *** afaranha has quit IRC | 20:02 | |
| *** samuelms has quit IRC | 20:02 | |
| *** raildo has quit IRC | 20:02 | |
| *** gabriel-bezerra has quit IRC | 20:02 | |
| *** marcoemorais has quit IRC | 20:05 | |
| morganfainberg | david-lyle, for the horizon/keystone x-session, we can use the same etherpad: https://etherpad.openstack.org/p/kilo-keystone-horizon-cli-federation-sso | 20:05 |
| morganfainberg | david-lyle, so all the info ends up in one place | 20:06 |
| david-lyle | morganfainberg: sounds good. If we have enough time in the horizon session, we may cover more keystone related topics as well | 20:09 |
| morganfainberg | david-lyle, works for me. | 20:10 |
| morganfainberg | david-lyle, https://etherpad.openstack.org/p/kilo-keystone-horizon-cli-federation-sso added the information to the etherpad, will update the wiki for therpads for horizon as well | 20:11 |
| dhellmann | morganfainberg: I added links to the etherpads to the oslo sessions, and then filled the etherpads with relevant info and links | 20:21 |
| morganfainberg | dhellmann, nice | 20:21 |
| morganfainberg | dhellmann, i added the "summary" from my post to both the etherpad adn the sched.org entries | 20:21 |
| dhellmann | morganfainberg: yeah, I had a summary in the sched content, too | 20:22 |
| *** fifieldt_ has quit IRC | 20:22 | |
| *** fifieldt__ has joined #openstack-keystone | 20:22 | |
| morganfainberg | dhellmann, if you use the <a href .... syntax you can make the sched.org items clicky-links | 20:22 |
| dhellmann | morganfainberg: oh, I wish I had known that | 20:22 |
| * dhellmann weighs whether or not to go the extra mile on this one | 20:23 | |
| bknudson | david-lyle: what's the horizon session? | 20:23 |
| *** topol has quit IRC | 20:24 | |
| morganfainberg | bknudson, it's so we have 2 sessions to cover horizon/keystone cross project chatter | 20:24 |
| morganfainberg | bknudson, it's in the same room even, right after eachother so it works out well. | 20:24 |
| morganfainberg | horizon is just the first of the two sessions | 20:25 |
| dhellmann | morganfainberg: it looks like I'll have to unschedule all of them to edit them, so I'm going to rely on devs' ability to copy and paste this time | 20:25 |
| *** afazekas_pub has quit IRC | 20:25 | |
| morganfainberg | dhellmann, thats what i just did :( | 20:25 |
| *** jsavak has joined #openstack-keystone | 20:25 | |
| morganfainberg | dhellmann, was a real PITA | 20:25 |
| dhellmann | morganfainberg: yeah, if we're going to use etherpads again for planning next cycle maybe we can help ttx change this other tool so editing the entries is easier | 20:26 |
| morganfainberg | but i had to do it anyway to add all the etherpad links | 20:26 |
| morganfainberg | dhellmann, ++ | 20:26 |
| *** ctracey has quit IRC | 20:26 | |
| *** joesavak has quit IRC | 20:26 | |
| bknudson | http://kilodesignsummit.sched.org/event/634fefa71bd89ef4c999b4a56c404c2d#.VE6qjUSHM88 | 20:26 |
| dhellmann | morganfainberg: last time we also just had a wiki page with the etherpad links | 20:27 |
| morganfainberg | dhellmann, https://wiki.openstack.org/wiki/Summit/Kilo/Etherpads | 20:27 |
| *** ctracey has joined #openstack-keystone | 20:27 | |
| morganfainberg | we have that too | 20:27 |
| dhellmann | so much for DRY | 20:27 |
| morganfainberg | dhellmann, in the case of the sched.org stuff i think the links are useful | 20:28 |
| morganfainberg | it means if someone is looking at their schedule they don't need to flop back to the wiki too | 20:28 |
| bknudson | we need to make sure that our summit topics are esoterically named so we don't get random people coming in thinking it sounds interesting. | 20:29 |
| morganfainberg | maybe we can get some yaml doc that generates both the wiki and the links in the sched.org | 20:29 |
| morganfainberg | bknudson, i can rename ours. that is easy | 20:29 |
| bknudson | morganfainberg: talk to lbragstad... I think he was working on something like that. | 20:30 |
| morganfainberg | i don't think i've added too much naming detail (the policy one being the exception) | 20:30 |
| morganfainberg | http://kilodesignsummit.sched.org/type/keystone | 20:30 |
| morganfainberg | the rest are pretty generic | 20:31 |
| *** andreaf has joined #openstack-keystone | 20:31 | |
| r1chardj0n3s | morning | 20:35 |
| r1chardj0n3s | ayoung: I looked into the kerberos stuff yesterday, but it looks entirely server-side to me, based on a couple of blog posts I found about setting it up | 20:36 |
| *** vejdmn has quit IRC | 20:37 | |
| *** vejdmn has joined #openstack-keystone | 20:38 | |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Use oslo.concurrency instead of sync'ed version https://review.openstack.org/131268 | 20:39 |
| *** lufix has quit IRC | 20:39 | |
| ayoung | r1chardj0n3s, OK, so think of it this way: | 20:47 |
| ayoung | I'm a user., and I need to get atoken from keystone | 20:47 |
| *** edmondsw has quit IRC | 20:47 | |
| ayoung | Kerberos is a tool that my openstack setup has available | 20:47 |
| ayoung | I use it as a way to authenticate instead of userid and password | 20:48 |
| ayoung | so, CLI based, the first thing I do is talk to the kerberos key distro center (KDC) and get a service ticket for Keystone, then go to Keystone and get a token using that service ticket | 20:48 |
| *** _cjones_ has quit IRC | 20:48 | |
| ayoung | r1chardj0n3s, that is what we have working today, and I've been working on extending that to Horizon | 20:49 |
| r1chardj0n3s | ayoung: hm, ok | 20:49 |
| *** _cjones_ has joined #openstack-keystone | 20:49 | |
| r1chardj0n3s | ayoung: the problem I have is that I can't find any information on how to do that :) | 20:49 |
| ayoung | so in Horizon, the user goes to horizon with a kerberos service ticket instead of to Keystone | 20:49 |
| ayoung | and they need to proxy | 20:49 |
| r1chardj0n3s | ayoung: "keystone kerberos" in google turns up very little information | 20:49 |
| ayoung | r1chardj0n3s, I have some write ups on my setup | 20:49 |
| ayoung | http://adam.younglogic.com/category/software/kerberos/ | 20:50 |
| ayoung | r1chardj0n3s, the cool thing is, for angboard, you have it easy | 20:50 |
| ayoung | assuming angboard can run in Apache HTTPD, you have to do pretty much nothing | 20:51 |
| ayoung | the biggest change is that you can drop the thing where you ask the user for their password | 20:51 |
| ayoung | the keystone server will have enough information to request the token | 20:51 |
| *** drjones has joined #openstack-keystone | 20:52 | |
| ayoung | Now, by going through a proxy, we might have to deal with some of the Kerberos issues designed to protect against a man-in-the-middle attack | 20:52 |
| *** drjones has quit IRC | 20:52 | |
| ayoung | r1chardj0n3s, and that is what I've been working on this past release. | 20:52 |
| *** drjones has joined #openstack-keystone | 20:52 | |
| r1chardj0n3s | ayoung: I'll have another read through all those posts and see if it makes more sense today :) | 20:53 |
| ayoung | r1chardj0n3s, I can't put it better than Alexander has written here http://vda.li/en/posts/2013/07/29/Setting-up-S4U2Proxy-with-FreeIPA/ | 20:53 |
| *** _cjones_ has quit IRC | 20:53 | |
| ayoung | r1chardj0n3s, go to https://ipa.younglogic.net | 20:53 |
| ayoung | PMed you with the password for your account | 20:54 |
| r1chardj0n3s | ayoung: that URL is busted :/ | 20:54 |
| ayoung | ? | 20:54 |
| *** _cjones_ has joined #openstack-keystone | 20:54 | |
| ayoung | let me see | 20:54 |
| * ayoung was on it earlier today | 20:55 | |
| ayoung | let me see | 20:55 |
| *** radez is now known as radez_g0n3 | 20:55 | |
| ayoung | r1chardj0n3s, nslookup ipa.younglogic.net gives you what? | 20:56 |
| r1chardj0n3s | ayoung: sorry, that works, but http://vda.li/en/posts/2013/07/29/Setting-up-S4U2Proxy-with-FreeIPA/ responds with "The requested URL /en/posts/2013/07/29/Setting-up-S4U2Proxy-with-FreeIPA/ was not found on this server." | 20:57 |
| *** _cjones__ has joined #openstack-keystone | 20:57 | |
| ayoung | r1chardj0n3s, interesting. OK, I'll email you a cached version | 20:57 |
| *** drjones has quit IRC | 20:57 | |
| *** ttw has joined #openstack-keystone | 20:59 | |
| *** _cjones_ has quit IRC | 20:59 | |
| ayoung | r1chardj0n3s, once you log in to ipa.younglogic.net, and have changed your password, I can show you how to set up Kerberos to do the same thing. If you have Something like Firebug, you can look at the actual traffic | 20:59 |
| *** _cjones_ has joined #openstack-keystone | 21:01 | |
| r1chardj0n3s | ayoung: ok, password done. I'm just gonna grab some breakfast and then I'll have a poke :) | 21:03 |
| ayoung | just make one change to a config file first | 21:04 |
| ayoung | you should have a file named | 21:04 |
| ayoung | /etc/krb5.conf | 21:04 |
| ayoung | add the following line at the top | 21:04 |
| ayoung | dns_lookup_realm = true | 21:04 |
| ayoung | It may be there already and set to false | 21:05 |
| ayoung | once you have that, try | 21:05 |
| *** _cjones__ has quit IRC | 21:05 | |
| ayoung | kinit rjones@YOUNGLOGIC.NET | 21:05 |
| ayoung | you can do that when you get back from breakfast, and tell me how it went. | 21:05 |
| ayoung | I need to run and go be Dad for a while | 21:05 |
| ttw | Hi, did anybody had database issues when upgrading from icehouse to juno ? | 21:06 |
| ttw | something is making a query from colum endpoint.region_id but the actual name is juste 'region' | 21:06 |
| ttw | *query on | 21:06 |
| *** jsavak has quit IRC | 21:07 | |
| *** ayoung is now known as ayoung-dadmode | 21:09 | |
| *** nellysmitt has quit IRC | 21:10 | |
| dstanek | ttw: do you have a tracebace to share? | 21:10 |
| ttw | yep | 21:10 |
| dstanek | ttw: it's probably worth creating a bug it definitely sounds like there is something we need to look into | 21:10 |
| ttw | https://gist.github.com/anonymous/895feaf05b1844130741 | 21:12 |
| *** nkinder has quit IRC | 21:15 | |
| *** _cjones_ has quit IRC | 21:17 | |
| *** _cjones_ has joined #openstack-keystone | 21:17 | |
| *** vejdmn has quit IRC | 21:18 | |
| *** vejdmn has joined #openstack-keystone | 21:18 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 21:18 |
| *** drjones has joined #openstack-keystone | 21:18 | |
| *** _cjones_ has quit IRC | 21:20 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 21:23 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct noqa for exceptions.py https://review.openstack.org/131274 | 21:23 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split up assignments and make the assignments piece pluggable https://review.openstack.org/130954 | 21:37 |
| *** dims_ has joined #openstack-keystone | 21:38 | |
| *** henrynash has quit IRC | 21:40 | |
| *** dims_ has quit IRC | 21:41 | |
| dstanek | lbragstad: yeah, deciding on warn vs. warning is probably a good idea | 21:41 |
| *** dims_ has joined #openstack-keystone | 21:41 | |
| *** dims__ has quit IRC | 21:41 | |
| *** andreaf has quit IRC | 21:43 | |
| *** andreaf has joined #openstack-keystone | 21:43 | |
| *** toddnni has joined #openstack-keystone | 21:50 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystonemiddleware: I18n https://review.openstack.org/131287 | 21:51 |
| openstackgerrit | werner mendizabal proposed a change to openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 21:55 |
| *** andreaf has quit IRC | 21:55 | |
| *** andreaf has joined #openstack-keystone | 21:56 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Correct use of noqa https://review.openstack.org/131274 | 21:56 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: I18n https://review.openstack.org/131199 | 21:56 |
| *** gordc has quit IRC | 22:04 | |
| *** nkinder has joined #openstack-keystone | 22:06 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Correct use noqa https://review.openstack.org/131291 | 22:08 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Remove useless log message https://review.openstack.org/131294 | 22:14 |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Cleanup exception logging https://review.openstack.org/131295 | 22:18 |
| *** andreaf has quit IRC | 22:20 | |
| *** andreaf has joined #openstack-keystone | 22:21 | |
| *** bknudson has quit IRC | 22:23 | |
| *** thedodd has quit IRC | 22:29 | |
| *** gyee has quit IRC | 22:31 | |
| *** amcrn has joined #openstack-keystone | 22:33 | |
| morganfainberg | marekd, email sent w/ all the folks i talked to about CERN CC'd | 22:42 |
| *** _afazekas is now known as afazekas_drunk | 22:50 | |
| *** lhcheng_ has joined #openstack-keystone | 22:50 | |
| *** lhcheng has quit IRC | 22:50 | |
| *** shikui__ has joined #openstack-keystone | 22:52 | |
| *** chrisshattuck has quit IRC | 22:52 | |
| *** shikui_ has quit IRC | 22:55 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone: Remove token persistence proxy https://review.openstack.org/124809 | 22:56 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 23:01 |
| *** andreaf has quit IRC | 23:03 | |
| morganfainberg | hm. stevemar is hiding | 23:05 |
| *** vejdmn has quit IRC | 23:07 | |
| *** topol has joined #openstack-keystone | 23:09 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Prep to add Identity API v2.0 files https://review.openstack.org/130577 | 23:10 |
| *** david-lyle has quit IRC | 23:14 | |
| *** jorge_munoz has quit IRC | 23:16 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Prep to add Identity API v2.0 files https://review.openstack.org/130577 | 23:16 |
| *** topol has quit IRC | 23:20 | |
| *** tellesnobrega has joined #openstack-keystone | 23:23 | |
| *** tellesnobrega has quit IRC | 23:32 | |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 23:35 | |
| *** tellesnobrega has joined #openstack-keystone | 23:38 | |
| *** david-lyle has joined #openstack-keystone | 23:45 | |
| *** bknudson has joined #openstack-keystone | 23:45 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: API documentation for Hierarchical Multitenancy https://review.openstack.org/130103 | 23:46 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: API documentation for Inherited Roles to Projects https://review.openstack.org/130277 | 23:47 |
| *** david-lyle has quit IRC | 23:49 | |
| openstackgerrit | Brant Knudson proposed a change to openstack/python-keystoneclient: Cleanup exception logging https://review.openstack.org/131295 | 23:51 |
| openstackgerrit | Brant Knudson proposed a change to openstack/keystone: Correct use of noqa https://review.openstack.org/131291 | 23:54 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!