| *** kobtea has quit IRC | 00:02 | |
| *** marcoemorais1 has joined #openstack-keystone | 00:02 | |
| *** marcoemorais1 has quit IRC | 00:02 | |
| *** marcoemorais1 has joined #openstack-keystone | 00:03 | |
| *** david-lyle is now known as david-lyle_afk | 00:03 | |
| *** marcoemorais has quit IRC | 00:05 | |
| jamielennox | turns out i don't have a straight usb keyboard anywhere in my house... i'd slmost be proud of that if i didn't need one right now.... | 00:05 |
|---|---|---|
| *** nkinder has joined #openstack-keystone | 00:09 | |
| *** marcoemorais1 has quit IRC | 00:15 | |
| *** marcoemorais has joined #openstack-keystone | 00:15 | |
| *** dims has quit IRC | 00:16 | |
| *** boris-42 has quit IRC | 00:17 | |
| *** diegows has quit IRC | 00:29 | |
| *** dstanek has quit IRC | 00:31 | |
| *** dstanek has joined #openstack-keystone | 00:35 | |
| *** marcoemorais has quit IRC | 00:35 | |
| *** marcoemorais has joined #openstack-keystone | 00:36 | |
| *** marcoemorais has quit IRC | 00:36 | |
| *** marcoemorais has joined #openstack-keystone | 00:36 | |
| *** marcoemorais has quit IRC | 00:37 | |
| *** marcoemorais has joined #openstack-keystone | 00:37 | |
| *** marcoemorais has quit IRC | 00:50 | |
| *** marcoemorais has joined #openstack-keystone | 00:50 | |
| stevemar | jamielennox, what kind of keyboards did you have?!? the old style? (ps2 or something?) | 00:51 |
| *** zzzeek has quit IRC | 00:51 | |
| stevemar | dtroyer, around? | 00:54 |
| *** dims has joined #openstack-keystone | 00:59 | |
| *** jaosorior has quit IRC | 01:03 | |
| *** zzzeek has joined #openstack-keystone | 01:05 | |
| *** esp has joined #openstack-keystone | 01:05 | |
| *** zzzeek has quit IRC | 01:06 | |
| dtroyer | stevemar: in and out | 01:08 |
| stevemar | dtroyer, same. was wondering if you had a theory on why this was failing devstack: https://review.openstack.org/#/c/67029/ | 01:09 |
| stevemar | the log message is very weird... considering a bunch of other commands had worked until sahara | 01:10 |
| *** dims has quit IRC | 01:14 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:18 | |
| *** amerine has quit IRC | 01:21 | |
| *** Guest47013 has joined #openstack-keystone | 01:29 | |
| *** boris-42 has joined #openstack-keystone | 01:44 | |
| *** ctracey has quit IRC | 01:56 | |
| *** ctracey has joined #openstack-keystone | 01:56 | |
| *** gsilvis_ has joined #openstack-keystone | 01:58 | |
| *** fifieldt has joined #openstack-keystone | 01:59 | |
| *** gsilvis has quit IRC | 02:00 | |
| *** radez_g0` has joined #openstack-keystone | 02:10 | |
| *** jdennis1 has joined #openstack-keystone | 02:10 | |
| *** radez_g0n3 has quit IRC | 02:10 | |
| *** jdennis has quit IRC | 02:10 | |
| *** junhongl has quit IRC | 02:10 | |
| *** gyee has quit IRC | 02:14 | |
| *** mitz_ has joined #openstack-keystone | 02:14 | |
| *** jdennis1 has quit IRC | 02:14 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Move functional tests to keystone/tests/functional https://review.openstack.org/133556 | 02:16 |
| jamielennox | stevemar: yea, made a grub screw up and need to modify boot, went looking for my old debugging keyboard and found it was ps2q | 02:17 |
| jamielennox | ps2 | 02:17 |
| *** junhongl has joined #openstack-keystone | 02:17 | |
| stevemar | jamielennox, did it have the old spring loaded keys?! | 02:18 |
| jamielennox | stevemar: no - it wasn't a good old keyboard - just ol d | 02:19 |
| jamielennox | just bought a crappy $10 one | 02:20 |
| jamielennox | all i needed to do was ESC at grub and change the default value | 02:20 |
| lbragstad | stevemar: nice catch on the docs for functional testing | 02:20 |
| *** Guest47013 has quit IRC | 02:20 | |
| *** zzzeek has joined #openstack-keystone | 02:20 | |
| stevemar | lbragstad, np bob | 02:22 |
| *** Viswanath has joined #openstack-keystone | 02:23 | |
| *** marcoemorais has quit IRC | 02:26 | |
| *** Viswanath has quit IRC | 02:26 | |
| *** jdennis has joined #openstack-keystone | 02:32 | |
| *** jdennis has quit IRC | 02:40 | |
| *** gsilvis_ is now known as gsilvis | 03:07 | |
| *** thedodd has joined #openstack-keystone | 03:19 | |
| *** richm has quit IRC | 03:29 | |
| *** dims has joined #openstack-keystone | 03:45 | |
| *** zzzeek has quit IRC | 03:46 | |
| *** shakamunyi has joined #openstack-keystone | 04:04 | |
| *** shakamun_ has joined #openstack-keystone | 04:45 | |
| *** shakamunyi has quit IRC | 04:49 | |
| *** saipandi has quit IRC | 04:51 | |
| *** nikunj2512 has joined #openstack-keystone | 04:57 | |
| *** Dafna has quit IRC | 04:58 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 05:04 | |
| *** stevemar2 has joined #openstack-keystone | 05:09 | |
| *** amerine has joined #openstack-keystone | 05:12 | |
| *** stevemar has quit IRC | 05:13 | |
| *** thedodd has quit IRC | 05:14 | |
| *** marcoemorais has joined #openstack-keystone | 05:36 | |
| *** boris-42 has quit IRC | 05:37 | |
| *** marcoemorais1 has joined #openstack-keystone | 05:38 | |
| *** k4n0 has joined #openstack-keystone | 05:39 | |
| *** marcoemorais has quit IRC | 05:41 | |
| *** amerine has quit IRC | 05:49 | |
| *** amerine has joined #openstack-keystone | 06:02 | |
| *** ukalifon1 has joined #openstack-keystone | 06:18 | |
| *** junhongl has quit IRC | 06:29 | |
| *** junhongl has joined #openstack-keystone | 06:30 | |
| *** ajayaa has joined #openstack-keystone | 06:40 | |
| *** amerine has quit IRC | 06:57 | |
| stevemar2 | jamielennox, ping | 07:25 |
| *** nellysmitt has joined #openstack-keystone | 07:26 | |
| *** adam_g` has joined #openstack-keystone | 07:33 | |
| *** adam_g has quit IRC | 07:38 | |
| *** afazekas has joined #openstack-keystone | 07:45 | |
| *** amcrn has quit IRC | 07:45 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Add unexcepted entity checking logic https://review.openstack.org/133625 | 07:48 |
| *** stevemar2 has quit IRC | 07:59 | |
| *** stevemar has joined #openstack-keystone | 07:59 | |
| *** ukalifon1 has quit IRC | 08:03 | |
| *** jaosorior has joined #openstack-keystone | 08:07 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Add new "RoleAssignment" exception https://review.openstack.org/133628 | 08:35 |
| jamielennox | stevemar: kind of - tomorrow is better | 08:35 |
| *** ukalifon1 has joined #openstack-keystone | 08:45 | |
| *** ajayaa has quit IRC | 08:54 | |
| *** jistr has joined #openstack-keystone | 08:59 | |
| *** Dafna has joined #openstack-keystone | 09:19 | |
| *** aix has quit IRC | 09:25 | |
| *** henrynash has joined #openstack-keystone | 09:26 | |
| rodrigods | henrynash, ping | 09:28 |
| henrynash | rodigods: hi | 09:28 |
| *** nikunj2512 has left #openstack-keystone | 09:28 | |
| rodrigods | henrynash, need your eyes at some reviews, whenever you have a moment | 09:28 |
| henrynash | rodigods: sure | 09:29 |
| henrynash | rodigods: I’ll get on them this morning | 09:29 |
| rodrigods | henrynash, https://review.openstack.org/#/c/132143/ and https://review.openstack.org/#/c/130103/ | 09:29 |
| henrynash | rodigods: ok | 09:29 |
| rodrigods | henrynash, thanks! | 09:29 |
| *** junhongl has quit IRC | 09:29 | |
| *** junhongl has joined #openstack-keystone | 09:30 | |
| *** aix has joined #openstack-keystone | 09:51 | |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone: Doc about specifying domains in domains specific backends https://review.openstack.org/132143 | 10:04 |
| *** aix has quit IRC | 10:04 | |
| *** boris-42 has joined #openstack-keystone | 10:11 | |
| *** aix has joined #openstack-keystone | 10:18 | |
| *** josecastroleon has quit IRC | 10:21 | |
| *** josecastroleon has joined #openstack-keystone | 10:23 | |
| *** amirosh has joined #openstack-keystone | 10:34 | |
| *** amirosh has quit IRC | 10:35 | |
| *** marcoemorais1 has quit IRC | 10:42 | |
| *** diegows has joined #openstack-keystone | 11:36 | |
| *** ajayaa has joined #openstack-keystone | 11:42 | |
| *** amirosh has joined #openstack-keystone | 11:53 | |
| *** amirosh has quit IRC | 11:53 | |
| *** amirosh has joined #openstack-keystone | 11:53 | |
| *** samuelms has joined #openstack-keystone | 11:54 | |
| *** dims has quit IRC | 12:13 | |
| *** dims has joined #openstack-keystone | 12:13 | |
| *** amakarov_away is now known as amakarov | 12:16 | |
| rodrigods | henrynash, will ping you later about the domain-specific error | 12:17 |
| *** amirosh_ has joined #openstack-keystone | 12:21 | |
| *** amirosh has quit IRC | 12:21 | |
| *** jistr is now known as jistr|english | 12:23 | |
| *** amirosh_ has quit IRC | 12:23 | |
| *** amirosh has joined #openstack-keystone | 12:24 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Allow for REMOTE_USER name in federation mapping https://review.openstack.org/133037 | 12:25 |
| *** amirosh_ has joined #openstack-keystone | 12:26 | |
| *** amirosh has quit IRC | 12:26 | |
| *** amirosh_ has quit IRC | 12:28 | |
| *** afaranha has joined #openstack-keystone | 12:28 | |
| *** amirosh has joined #openstack-keystone | 12:28 | |
| marekd | mflobo: hey, can we abandon it? I think it is already on cernops github repository, right? | 12:34 |
| marekd | mflobo: https://review.openstack.org/#/c/106096/ | 12:34 |
| *** raildo_away is now known as raildo | 12:35 | |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Add unexcepted entity checking logic https://review.openstack.org/133625 | 12:42 |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add REMOTE_USER mapping info in federation docs. https://review.openstack.org/133671 | 12:54 |
| openstackgerrit | Marek Denis proposed a change to openstack/identity-api: Add REMOTE_USER mapping info in federation docs. https://review.openstack.org/133671 | 12:55 |
| openstackgerrit | Dave Chen proposed a change to openstack/keystone: Add new "RoleAssignment" exception https://review.openstack.org/133628 | 12:56 |
| *** pc-m has quit IRC | 12:59 | |
| *** pc-m1 has joined #openstack-keystone | 13:00 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone-specs: Add REMOTE_USER mapping info in federation docs. https://review.openstack.org/133674 | 13:03 |
| *** amirosh has quit IRC | 13:14 | |
| *** amirosh has joined #openstack-keystone | 13:14 | |
| *** nellysmitt has quit IRC | 13:15 | |
| mflobo | marekd, yes, we can | 13:18 |
| mflobo | marekd, do you have a better solution for this? | 13:19 |
| marekd | mflobo: not yet, but i'd rather start with a new patch... | 13:19 |
| marekd | mflobo: https://review.openstack.org/#/c/133529/1/specs/kilo/websso-portal.rst | 13:20 |
| mflobo | marekd, ok, go for it! ;) | 13:20 |
| *** bearhands is now known as comstud | 13:22 | |
| *** amirosh has quit IRC | 13:26 | |
| *** amirosh has joined #openstack-keystone | 13:27 | |
| *** topol has joined #openstack-keystone | 13:32 | |
| openstackgerrit | Marek Denis proposed a change to openstack/keystone: Allow for REMOTE_USER name in federation mapping https://review.openstack.org/133037 | 13:41 |
| rodrigods | henrynash, ping | 13:42 |
| henrynash | rodigods: hi | 13:43 |
| rodrigods | henrynash, ++ to use a clear param like subtree_as_list | 13:43 |
| raildo | ++ too | 13:43 |
| rodrigods | are you ok with having the pure ?subtree in a following spec/patches? | 13:43 |
| henrynash | rodigods: yes, that was my thought….let’s not “use up” the pure ?subtree option….we can keep that for a follow on patch | 13:44 |
| rodrigods | henrynash, ++ | 13:44 |
| *** topol has quit IRC | 13:44 | |
| rodrigods | henrynash, will update the API and the code patch | 13:44 |
| rodrigods | thanks | 13:44 |
| raildo | henrynash, i'll describe this in the new spec for HM | 13:45 |
| henrynash | rodigods: ok, with that change, I’m fine to +2 the api doc | 13:45 |
| *** ajayaa has quit IRC | 13:45 | |
| *** richm has joined #openstack-keystone | 13:47 | |
| openstackgerrit | Andre Aranha proposed a change to openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 13:50 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: API documentation for Hierarchical Multitenancy https://review.openstack.org/130103 | 13:50 |
| openstackgerrit | Rodrigo Duarte proposed a change to openstack/keystone-specs: API documentation for Inherited Roles to Projects https://review.openstack.org/130277 | 13:50 |
| rodrigods | henrynash, ayoung-dadmode, morganfainberg ^ | 13:51 |
| *** ayoung-dadmode has quit IRC | 13:59 | |
| henrynash | rodigods: question…how are you going to atually merge in the hierarchy code? it’s in its own tree, I believe…do you know what the process is to merge that into master? | 14:01 |
| *** samuelms has quit IRC | 14:01 | |
| *** Dafna has quit IRC | 14:02 | |
| *** samuelms has joined #openstack-keystone | 14:02 | |
| *** jistr|english is now known as jistr | 14:02 | |
| henrynash | rodigods: it would be nice if we merged it on top of: https://review.openstack.org/#/c/133525/ but I don’t know how easy that would be? | 14:03 |
| *** jdennis has joined #openstack-keystone | 14:04 | |
| *** Dafna has joined #openstack-keystone | 14:04 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:12 | |
| *** dims has quit IRC | 14:13 | |
| *** dims has joined #openstack-keystone | 14:14 | |
| *** nkinder has quit IRC | 14:16 | |
| *** pc-m1 is now known as pc-m | 14:16 | |
| *** vejdmn has joined #openstack-keystone | 14:19 | |
| *** sergey_ has quit IRC | 14:24 | |
| *** gokrokve has joined #openstack-keystone | 14:29 | |
| *** joesavak has joined #openstack-keystone | 14:34 | |
| *** ayoung has joined #openstack-keystone | 14:49 | |
| *** stevemar has quit IRC | 14:51 | |
| *** openstackgerrit has quit IRC | 14:55 | |
| *** ukalifon2 has joined #openstack-keystone | 14:57 | |
| *** topol has joined #openstack-keystone | 14:57 | |
| *** ukalifon5 has joined #openstack-keystone | 14:58 | |
| *** ukalifon1 has quit IRC | 14:58 | |
| *** nkinder has joined #openstack-keystone | 15:00 | |
| *** ukalifon2 has quit IRC | 15:01 | |
| *** amirosh has quit IRC | 15:07 | |
| *** zzzeek has joined #openstack-keystone | 15:17 | |
| *** tellesnobrega_ has joined #openstack-keystone | 15:18 | |
| *** marcoemorais has joined #openstack-keystone | 15:19 | |
| *** tellesnobrega_ has quit IRC | 15:20 | |
| *** marcoemorais1 has joined #openstack-keystone | 15:23 | |
| *** marcoemorais has quit IRC | 15:26 | |
| *** k4n0 has quit IRC | 15:27 | |
| *** ukalifon5 has quit IRC | 15:31 | |
| *** vejdmn has quit IRC | 15:36 | |
| *** gokrokve_ has joined #openstack-keystone | 15:44 | |
| *** gokrokve has quit IRC | 15:47 | |
| *** stevemar has joined #openstack-keystone | 15:51 | |
| *** afazekas has quit IRC | 15:57 | |
| *** thedodd has joined #openstack-keystone | 15:57 | |
| *** stevemar has quit IRC | 16:00 | |
| *** stevemar has joined #openstack-keystone | 16:00 | |
| *** wwriverrat has joined #openstack-keystone | 16:01 | |
| *** thedodd has quit IRC | 16:05 | |
| *** david-lyle_afk is now known as david-lyle | 16:06 | |
| *** bdossant has joined #openstack-keystone | 16:17 | |
| *** nellysmitt has joined #openstack-keystone | 16:21 | |
| *** david-lyle is now known as david-lyle_afk | 16:21 | |
| rodrigods | henrynash, the merge process is not clear for us too... | 16:21 |
| rodrigods | henrynash, to put that review as dependency, we would need to create an additional review for the branch | 16:22 |
| *** wwriverrat has left #openstack-keystone | 16:22 | |
| *** david-lyle_afk is now known as david-lyle | 16:25 | |
| ayoung | stevemar, marekd on https://review.openstack.org/#/c/133037/6 the question is: if REMOTE_USER is set, what does it map to in the Keystone view of things. I can see it being one of three things...at least: | 16:27 |
| ayoung | 1. User name, 2 UserId, 3....something with one or both of thsoe embedded and also something to select domain | 16:28 |
| ayoung | rodrigods, did my last message make it up? | 16:28 |
| ayoung | rodrigods, at the summit we discussed renaming "Inherited Roles to Projects" to "Inherited Role Assignments" | 16:29 |
| *** david-lyle is now known as david-lyle_afk | 16:30 | |
| *** david-lyle_afk is now known as david-lyle | 16:30 | |
| rodrigods | ayoung, ++ will update it | 16:33 |
| *** pc-m has quit IRC | 16:33 | |
| ayoung | rodrigods, BTW, take a look at the hierarchical roles spec, as I think it will give us project-specific-roles | 16:33 |
| *** marcoemorais1 has quit IRC | 16:34 | |
| ayoung | I think we need to go in the following order: | 16:34 |
| ayoung | 1. enforce policy from a library (keystoneclient or comparable)\ | 16:34 |
| ayoung | 2. Fetch policy from Keystone based on endpoint | 16:34 |
| ayoung | 3. Unified policy file for default | 16:34 |
| ayoung | 4. Generate policy from a DB schema | 16:35 |
| ayoung | 5. hierarchical roles | 16:35 |
| *** pc-m has joined #openstack-keystone | 16:36 | |
| *** david-lyle is now known as david-lyle_afk | 16:37 | |
| *** david-lyle_afk is now known as david-lyle | 16:37 | |
| rodrigods | ayoung, looks like a good plan | 16:37 |
| ayoung | rodrigods, thanks. Care to implement it for me? | 16:38 |
| rodrigods | ayoung, haha I can absolutely help with a couple of them | 16:38 |
| ayoung | sounds good. | 16:38 |
| *** amerine has joined #openstack-keystone | 16:39 | |
| ayoung | rodrigods, once we have hierarchircal (and the gneeration of the policy file) we can implicitly convert private/namespaced roles to public ones | 16:39 |
| * rodrigods pretends that is following ayoung | 16:40 | |
| *** stevemar2 has joined #openstack-keystone | 16:41 | |
| ayoung | rodrigods, so all roles need to resolve down to something....the API where policy is enforced. A Role can be seen as a collection of those | 16:41 |
| rodrigods | ayoung, ... | 16:42 |
| ayoung | rodrigods, ok, let me pull up the nova policy file for an example | 16:42 |
| rodrigods | rodrigods, ok | 16:43 |
| rodrigods | ayoung, * | 16:43 |
| *** gokrokve has joined #openstack-keystone | 16:43 | |
| ayoung | https://github.com/openstack/nova/blob/master/etc/nova/policy.json | 16:43 |
| rodrigods | ok | 16:43 |
| ayoung | rodrigods, a huge number of those are: admin_ap[i or admin_or_owner, right? | 16:43 |
| rodrigods | right | 16:44 |
| *** stevemar has quit IRC | 16:44 | |
| ayoung | rodrigods, so lets start wtih "admin_or_owner" | 16:44 |
| rodrigods | ... | 16:44 |
| ayoung | owner means "user_has_role_on_project" I think | 16:44 |
| ayoung | "admin_or_owner": "is_admin:True or project_id:%(project_id)s", | 16:45 |
| ayoung | so any role is viable. lets call that the member role. | 16:45 |
| ayoung | Now, if admin inherits member, that could be written like this: | 16:45 |
| ayoung | admin implies member. member implies [compute:v3:servers:start, compute:v3:servers:stop ....] | 16:46 |
| rodrigods | ayoung, hmmm | 16:46 |
| rodrigods | right | 16:46 |
| ayoung | lets say we want to make a more fine grained set of roles: one for people that can affect change, and one for people that can only read values | 16:46 |
| ayoung | call em reader and writer for now | 16:46 |
| *** gokrokve_ has quit IRC | 16:46 | |
| ayoung | so reader could do soemthing like: | 16:46 |
| marekd | ayoung: stevemar2: REMOTE_USER is simply use ridentifier value later mapped to user_id | 16:46 |
| marekd | some module set this shib by default too) | 16:47 |
| ayoung | "compute_extension:v3:os-aggregates:show": "rule:admin_api", | 16:47 |
| rodrigods | ayoung, yep, you can jump to the interesting part | 16:47 |
| ayoung | marekd, hold on...let me finish this one first.... | 16:47 |
| ayoung | rodrigods, and writer can do something like | 16:47 |
| ayoung | "compute_extension:v3:os-aggregates:update": "rule:admin_api", | 16:47 |
| marekd | ayoung: ok | 16:47 |
| ayoung | but writer implies reader, | 16:47 |
| *** gokrokve has quit IRC | 16:48 | |
| ayoung | so at the loweset level, we define the operations that a role can perform, and build up a hierarchy. | 16:48 |
| ayoung | rodrigods, with me so far? | 16:48 |
| rodrigods | ayoung, yep | 16:48 |
| *** tellesnobrega_ has joined #openstack-keystone | 16:48 | |
| *** tellesnobrega_ has quit IRC | 16:49 | |
| ayoung | rodrigods, Ok, so we could generate this policy file if we had all of the roles in a database | 16:49 |
| ayoung | it would have to be restructured somewhat, but all of the "this role inherits from that role" could be rules at the top of the file | 16:50 |
| rodrigods | ayoung, yes | 16:50 |
| rodrigods | now I understand what you meant with "implicitly convert private/namespaced roles to public ones" | 16:51 |
| ayoung | So then a token would have the top level role, like Writer, and the policy engine would be responsible for translating that to to indivdual APIs | 16:51 |
| *** gokrokve has joined #openstack-keystone | 16:51 | |
| ayoung | rodrigods, so private/namespaced roles probably should not be published in the policy file, but instead implicitly converted to something on the Keystone side | 16:51 |
| ayoung | so lets say the private role name is "supreme_dicatator" that gets translated to "writer plus auditor" the token would show, instead, the writer and auditor roles | 16:52 |
| *** tellesnobrega_ has joined #openstack-keystone | 16:52 | |
| *** Viswanath has joined #openstack-keystone | 16:53 | |
| rodrigods | ayoung, hmm | 16:53 |
| ayoung | rodrigods, so davidchadwick has a researcher working for him named Ioram...I met him briefly at the summit. He is going to be working on some of the Database side of this, but for analysis purposes | 16:53 |
| ayoung | I'd like to make his effort and this policy work into a coherent whole | 16:54 |
| *** gokrokve has quit IRC | 16:54 | |
| *** gokrokve has joined #openstack-keystone | 16:55 | |
| *** jistr has quit IRC | 16:55 | |
| rodrigods | ayoung, all right, let me know how I can help | 16:56 |
| *** Viswanath has quit IRC | 16:56 | |
| ayoung | rodrigods, I started by posting an initial set of specs. They need to grow | 16:56 |
| ayoung | https://review.openstack.org/#/c/133480/ needs to be split | 16:57 |
| ayoung | https://review.openstack.org/#/c/125704/ needs to be updated to reflect the policy generation | 16:57 |
| ayoung | rodrigods, does this tie in with your interests and responsibilities? | 16:58 |
| rodrigods | ayoung, I'm always interested in contributing, can negotiate here some tasks, but if I not succeed... There is also some free time (hacking time) =) | 16:59 |
| ayoung | rodrigods, so, the very first task is to get policy enforcement into a library. | 16:59 |
| rodrigods | ayoung, remove it from oslo? | 16:59 |
| ayoung | oslo policy.py is getting graduated to a library, and I think this stuff might live there | 16:59 |
| rodrigods | hmm | 17:00 |
| *** rharwood has quit IRC | 17:00 | |
| ayoung | not remove, but rather it is going to graduate, but be managed under the AAA (Keystone) program | 17:00 |
| *** david-lyle is now known as david-lyle_afk | 17:00 | |
| *** david-lyle_afk is now known as david-lyle | 17:00 | |
| rodrigods | you mean under keystone team responsibility ? | 17:00 |
| ayoung | yeah | 17:00 |
| ayoung | morganfainberg has some ideas on it. Something like: it will be under our program, but you need to opt in in order to review it | 17:01 |
| ayoung | I've been the policy point-of-contact for Keystone in osl for a while | 17:01 |
| morganfainberg | Basically what ayoung said | 17:01 |
| rodrigods | morganfainberg, ayoung, I'm in =) | 17:02 |
| ayoung | sounds good. First off is the process to make it its own library | 17:02 |
| morganfainberg | The policy lib will have a separate core team such as pycadf. So it is possible to add people without them needing to know all of keystone. | 17:03 |
| ayoung | https://wiki.openstack.org/wiki/Oslo/CreatingANewLibrary#Graduating_a_Library_from_the_Incubator | 17:03 |
| morganfainberg | The process to become core will be the same as for any other project. | 17:03 |
| morganfainberg | ayoung: there are two blockers from graduating today I need to check with dhellmann on. | 17:04 |
| ayoung | morganfainberg, I'll let you manage that. Let me know when you need me/others to engage | 17:04 |
| morganfainberg | Fileutils and oslo.config (possibly on config) | 17:04 |
| rodrigods | morganfainberg, ayoung, cool... So the graduating part is with morganfainberg ? | 17:04 |
| rodrigods | morganfainberg, ayoung, from my side... what is needed right now? | 17:06 |
| ayoung | morganfainberg, I'll start working on a spec for generating the policy file from a database schema | 17:06 |
| ayoung | rodrigods, keep on HMT for now, as that is as important, and closer to impl | 17:06 |
| ayoung | stay in the spec review process, and when we have something that needs implementing, you or others on your team can jump in and claim responsibility | 17:06 |
| raildo | ayoung, ++ | 17:07 |
| ayoung | rodrigods, my focus on implementation is going to be WebSSO for Federation, so I can't do this now | 17:07 |
| ayoung | so I need to be Tom Sawyer here | 17:07 |
| ayoung | and get other people to whitewash this particular fence | 17:07 |
| rodrigods | ayoung, that is another topic that me/the team has knowledge too | 17:07 |
| *** tellesnobrega_ has quit IRC | 17:08 | |
| henrynash | morganfainberg, dstanek, lbragstad, (plus any others): really want to move ahead with: https://review.openstack.org/#/c/129397/ the code also up for review at https://review.openstack.org/#/c/130954/12 …and want to try and get it in before we start landing too much into assignment…. | 17:08 |
| ayoung | rodrigods, so, I'm going to follow the lead of the CERN folks, and make a lnading page in Keystone to allow selecting the IdP | 17:08 |
| ayoung | it requires some clean up of Keystone code that I have wanted to do for a while | 17:08 |
| lbragstad | henrynash: I added to my queue to review yesterday but ran out of time. I'll get to it today for sure | 17:09 |
| ayoung | marekd, OK...so REMOTE_USER. Did you see jdennis 's proposal? I think he covers a lot of the ugliness of mapping from Remote user to Keystone in his doc | 17:09 |
| henrynash | lbragstad: thx | 17:09 |
| samuelms | henrynash, tonight I am going to start the integration of the refactored list role assignment as dependency of your patch .. as we've discussed last week | 17:09 |
| henrynash | samuelms: cool! | 17:09 |
| ayoung | henrynash, BTW read up on my conversation with rodrigods . I think I laid out the steps we need to get to the private roles.... | 17:10 |
| henrynash | ayoung: was doing so… | 17:10 |
| ayoung | cool | 17:10 |
| rodrigods | ayoung, ++ | 17:11 |
| morganfainberg | henrynash: I'm getting breakfast and then I'm on code review for the rest of the morning. | 17:11 |
| ayoung | I think we need a database schema that will be used to generate the policy file. It will start with the current Role table, but need to map all the way down to the policy-enforcement-points. | 17:11 |
| rodrigods | morganfainberg, you know that we have a great patch for you to review =) | 17:11 |
| henrynash | morganfainberg: I’d suggest making it a good breakfast! | 17:12 |
| morganfainberg | Croissant, eggs, coffee, and some cheese. | 17:12 |
| raildo | morganfainberg, paris feelings... | 17:12 |
| *** marcoemorais has joined #openstack-keystone | 17:13 | |
| morganfainberg | raildo: it's my normal breakfast in California ;) | 17:13 |
| rodrigods | ayoung, speaking of reviews... don't you want to check https://review.openstack.org/#/c/130103/ | 17:13 |
| raildo | morganfainberg, great breakfast :) | 17:13 |
| morganfainberg | Yesterday was avocado too | 17:13 |
| ayoung | rodrigods, I'd given it a once read-through already | 17:13 |
| ayoung | I think it is ok....had to think about parent-id vs domain id.... | 17:14 |
| rodrigods | ayoung, it has super powers now (a +2 from henrynash ) | 17:14 |
| *** bdossant has quit IRC | 17:14 | |
| raildo | ayoung, and if you can review this too: https://review.openstack.org/#/c/117300/ | 17:14 |
| ayoung | rodrigods, which makes me more cautious | 17:14 |
| rodrigods | haha | 17:14 |
| henrynash | samuelms: I think this is the one that you need to base off: https://review.openstack.org/#/c/132634/ | 17:15 |
| ayoung | OK...I'll +2. I think that we might need to go further, but nothing here ties us in to a bad idea. | 17:15 |
| henrynash | samuelms: unless you have changed anything in the one that is dependant on it: https://review.openstack.org/#/c/133525/ , but I doubt you have | 17:15 |
| rodrigods | ayoung, yay | 17:15 |
| ayoung | rodrigods, did you see my comments in there? Domains are "cut points' in the hierarchy traversal | 17:16 |
| ayoung | potential cut points | 17:16 |
| ayoung | only travers down to a domain....unless you explicitly have permissions to go further. Only traverse up to the next level domain unless....etc | 17:17 |
| rodrigods | morganfainberg, it means that https://review.openstack.org/#/c/117786/ is free | 17:17 |
| rodrigods | ayoung, yep, we had a discussion about this topic today, BTW | 17:17 |
| rodrigods | we'll tie roles to domains, right? | 17:17 |
| morganfainberg | rodrigods: nice | 17:18 |
| ayoung | Yeah, tie roles to domains. | 17:21 |
| *** lhcheng has joined #openstack-keystone | 17:21 | |
| *** thedodd has joined #openstack-keystone | 17:21 | |
| samuelms | henrynash, no I haven't .. | 17:21 |
| samuelms | henrynash, it's ok to being based off on #132634 :) | 17:22 |
| stevemar2 | henrynash, heads up https://bugs.launchpad.net/keystone/+bug/1391592 | 17:23 |
| uvirtbot | Launchpad bug 1391592 in keystone "multiple backend mapping generator fails with non-string ids" [Undecided,New] | 17:23 |
| morganfainberg | Omg Pasadena might get rain in a week! ;) | 17:27 |
| rodrigods | ayoung, I think this part is in the followon HM spec that raildo is starting to write | 17:27 |
| *** gyee has joined #openstack-keystone | 17:28 | |
| raildo | rodrigods, yes | 17:29 |
| raildo | gyee, ping | 17:29 |
| rodrigods | ayoung, BTW, the inherited_to_roles vs inherited_to_role_assignments has a bug already? | 17:29 |
| rodrigods | or henrynash | 17:29 |
| marekd | ayoung: i did see the thread, i didn't see the whole paper. | 17:30 |
| *** lhcheng_ has joined #openstack-keystone | 17:31 | |
| *** lhcheng has quit IRC | 17:34 | |
| morganfainberg | marekd: btw I hear the cern trip made people's day. Thanks for helping set that up!! | 17:34 |
| morganfainberg | marekd, stevemar2, rodrigods: so what fixes if any are immediately needed to make k2k work? Anything we have code for, does it work as is (no outstanding fixes)? | 17:35 |
| morganfainberg | jamielennox: let me know when you're awake. Want to know how that sdk discussion (re: 1.0/2.0 of keystoneclient) | 17:37 |
| stevemar2 | morganfainberg, i think there is still some mix up with with the SP region - the auth info doesn't appear in the service catalog, so when rodrigods was playing around with it, he just saved the value of it locally | 17:37 |
| morganfainberg | stevemar2: ok. Anything I can do to help get that fixed? I'd like to see k2k be fully working by k1 if possible / do we have a bug on that? | 17:38 |
| gyee | raildo, yes | 17:39 |
| rodrigods | morganfainberg, stevemar2, marekd for it to appear in the catalog, don't we need a service as well? | 17:44 |
| raildo | gyee, do you have time do review a patch for HM? :D https://review.openstack.org/#/c/117300/ | 17:44 |
| rodrigods | besides the region | 17:44 |
| *** tellesnobrega_ has joined #openstack-keystone | 17:45 | |
| *** openstackgerrit has joined #openstack-keystone | 17:47 | |
| stevemar2 | morganfainberg, i think we just need a way to slot in other region data into the catalog | 17:48 |
| stevemar2 | but i'm not sure we want to do that | 17:48 |
| rodrigods | stevemar2, I assumed the catalog is built by iterating in the services | 17:51 |
| rodrigods | (just because of how it looks =) ) | 17:51 |
| raildo | morganfainberg, ayoung we have a slot for HM meetings, do you have intention to participate? https://wiki.openstack.org/wiki/Meetings#Hierarchical_Multitenancy_Meeting | 17:51 |
| raildo | gyee, henrynash ^ | 17:52 |
| marekd | morganfainberg: stevemar2 rodrigods: i don't know exactly what was missing while doing the blogpost, but I feel we should have two values added to KeystoneIdP - Service Provider where a assertion should be sent (already there), but also a proteced url (not there) | 17:55 |
| jamielennox | morganfainberg: awake | 17:56 |
| marekd | also...is there any filtering applied on those 'extra' regions? | 17:56 |
| marekd | morganfainberg: stevemar2: and how does user know which region is a k2k region? | 17:56 |
| marekd | morganfainberg: stevemar2 and what protocol should be used | 17:56 |
| rodrigods | marekd, by having an URL I think | 17:56 |
| morganfainberg | jamielennox: ack. | 17:57 |
| marekd | rodrigods: ? | 17:57 |
| rodrigods | yeah, that extra parts are out of band | 17:57 |
| rodrigods | marekd, k2k region = the ones with URL | 17:57 |
| stevemar2 | marekd, that's the disconnect | 17:57 |
| jamielennox | morganfainberg: essentially the SDK will consume the session if we break it out | 17:57 |
| jamielennox | morganfainberg: i convinced them on only writing auth plugins once for everything | 17:57 |
| marekd | rodrigods: very loose assumption. One day somebody will need it for something new and then what? | 17:57 |
| morganfainberg | jamielennox: we talked about that already. Let's plan that for this cycle then. | 17:58 |
| gyee | raildo, k | 17:58 |
| marekd | stevemar2: that's what? | 17:58 |
| jamielennox | morganfainberg: there is a couple of tweaks they wanted which i don't think will be a problem | 17:58 |
| morganfainberg | jamielennox: great. Need help splitting the repo? Or can you (I want to maintain history). Ksc can dep on the new lib. | 17:58 |
| morganfainberg | Keystonecommon? Put cms in there too? | 17:59 |
| marekd | morganfainberg: unless somebody else works on that i will need to setup k2k with proper crypto | 18:01 |
| jamielennox | morganfainberg: i'd prefer not to call it anything after keystone | 18:01 |
| jamielennox | it's a base lib for all types of clients | 18:01 |
| marekd | morganfainberg: and fix what's is wrong. | 18:01 |
| morganfainberg | jamielennox: ok. | 18:01 |
| jamielennox | i was thinking i'd try and catch dhellmann before end of summit and ask about an oslo.client | 18:01 |
| jamielennox | missed him | 18:01 |
| morganfainberg | jamielennox: oslo? | 18:01 |
| morganfainberg | Ah ok yeah oslo. Makes sense. | 18:01 |
| jamielennox | right - i think the V3 auth etc would continue to live in keystoneclient, however session is common | 18:02 |
| jamielennox | my problem with oslo.client is the workflow because i expect users to construct a session | 18:02 |
| jamielennox | are we having a meeting this morning ? | 18:03 |
| jamielennox | /today | 18:03 |
| *** tellesnobrega_ has quit IRC | 18:03 | |
| jamielennox | i'm a little unsure at the moment how compatibility is going to work, with setuptools and that sort of thing | 18:03 |
| ayoung | raildo, added it to my calendar. Feel free to ping me when it happens, too | 18:06 |
| raildo | ayoung, sure | 18:06 |
| jamielennox | morganfainberg: no meeting? | 18:07 |
| gyee | which meeting HM or Keystone? | 18:07 |
| jamielennox | keystone | 18:07 |
| jamielennox | HM? | 18:07 |
| ayoung | jamielennox, no. morganfainberg called it off for this week | 18:07 |
| jamielennox | damn | 18:07 |
| raildo | HM meeting is on friday :) | 18:07 |
| gyee | yes, got that one | 18:08 |
| raildo | https://wiki.openstack.org/wiki/Meetings/HierarchicalMultitenancyMeeting | 18:08 |
| ayoung | go back to bed | 18:08 |
| morganfainberg | marekd, i'm ok with the k2k stuff being side-band intially for setup | 18:08 |
| morganfainberg | jamielennox, sorry, yeah go back to sleep. | 18:08 |
| jamielennox | wasn't too bad, my jetlag is all over the place | 18:08 |
| ayoung | morganfainberg, so, I think I might need to hack on Paste | 18:08 |
| ayoung | right now, we duplicate the set of filters used for each pipeline | 18:09 |
| morganfainberg | ayoung, and the token "pipeline" if there are any optional filters shouldn't be in paste like that | 18:09 |
| ayoung | morganfainberg, so I think I want to add a filter-list filter. I tried doing it outside of paste, but you lose all of the configuration | 18:09 |
| morganfainberg | ayoung, just let me say that upfront. | 18:09 |
| ayoung | morganfainberg, I think the auth plugin needs to be specified in paste | 18:09 |
| ayoung | but, even if we don't, doesn't change the issue | 18:10 |
| ayoung | so liets table the token pipeline discussion so as not to distract | 18:10 |
| morganfainberg | ayoung, ok that much i wanted to in either case | 18:10 |
| morganfainberg | ayoung, lets focus on what you're trying to accomplish with paste in this case. | 18:11 |
| ayoung | right now, we lump all of the routes into a set of pipeliens, and then expose them via composite | 18:11 |
| morganfainberg | assuming things that are already "common-ish" we can keep that way | 18:11 |
| ayoung | I just want to conver this: | 18:11 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini#n91 | 18:11 |
| ayoung | into this: | 18:11 |
| ayoung | pipeline = standard_filters service_v3 | 18:12 |
| *** tellesnobrega_ has joined #openstack-keystone | 18:12 | |
| ayoung | and pull out all of the extensions so they are in their own pipeliens. So we would change, for example revoke_extension to | 18:12 |
| ayoung | [pipeline:revoke] | 18:12 |
| morganfainberg | ayoung, stop. | 18:13 |
| ayoung | pipeline = standard_filters revoke_etension | 18:13 |
| morganfainberg | ayoung, so, back to this, paste doesn't support this construct? | 18:13 |
| morganfainberg | ayoung, and you're saying we need to fix that first? | 18:13 |
| ayoung | no the reusable-set-of-filters construct | 18:13 |
| ayoung | yes | 18:13 |
| marekd | morganfainberg: what do you mean side-band? | 18:13 |
| ayoung | "not the reusable-set-of-filters construct" | 18:13 |
| morganfainberg | marekd, oh nvm mis-read | 18:14 |
| morganfainberg | marekd, sorry. was on my phone :P | 18:14 |
| morganfainberg | marekd, strike that comment. | 18:14 |
| ayoung | morganfainberg, so my first attempt was to do this completely in Keystone: | 18:15 |
| morganfainberg | ayoung, while i'm fine with you working on paste to make it better (yay), i would hope that you don't block all of the work on a project we don't controll. | 18:15 |
| ayoung | https://github.com/admiyo/keystone/commit/319aae44d0c32ff735e94dfcd629f6162330bdef | 18:15 |
| morganfainberg | ayoung, i mean.. i'm not your boss ;), but since we (openstack) don't control paste, it might be something we need to handle the way we're doing it now. | 18:15 |
| ayoung | I think it is more of a "it is not manageble due to cut and paste" issue, not a blocker | 18:15 |
| *** marekd is now known as marekd|away | 18:15 | |
| ayoung | we can always duplicate the filter list all over the place, it just is going to be a mess | 18:15 |
| morganfainberg | ayoung, making paste better is fine - assume we have to go with "copy-paste" [sucky] for now. | 18:16 |
| morganfainberg | and if paste accepts and we increment global reqs we can make it way better | 18:16 |
| morganfainberg | ayoung, also remember, you scale about as well as I do :P so.... | 18:16 |
| openstackgerrit | Alexander Makarov proposed a change to openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 18:16 |
| ayoung | morganfainberg, if we are stuck with paste at its present state, we may want to take all of our current filters and make python code that calls the filters instead...it just takes control out of the hands of the oeprators, and I'd rather not do that | 18:17 |
| morganfainberg | ayoung, while you're at it, want to make paste py3k friendly? :P last i saw it wasn't | 18:17 |
| ayoung | I'm willing to entertain options. Sounds like Pecan/WSME doesn't solve this for us, though | 18:18 |
| *** amcrn has joined #openstack-keystone | 18:19 | |
| morganfainberg | ayoung, well operators shouldn't be configuring non-optional filters anyway | 18:20 |
| ayoung | morganfainberg, I'm thinkging of the admin_token filter | 18:20 |
| ayoung | we explicitly say "remove that after setup" | 18:20 |
| ayoung | would like to have them do that in exactly one place | 18:20 |
| morganfainberg | ayoung, hmm... | 18:21 |
| ayoung | morganfainberg, and I would like to be able to make paste routes for anything that has to be in sync with Apache. So if I need mod_auth_kerb,mod_sam and mod_nsss/client cert routes, I can do it in a config file | 18:22 |
| *** edmondsw has joined #openstack-keystone | 18:22 | |
| ayoung | ideally, I would specify something like this | 18:22 |
| morganfainberg | ayoung, well like i said, not really something i can say "yes lets do" barring paste accepting this new construct | 18:23 |
| ayoung | pipeline = standard_filters mapped_auth token_pipeline | 18:23 |
| morganfainberg | ayoung, if we get paste there and it goes in, and is released, great! if not, we need a backup plan (and yes one option is "do what we do today" | 18:23 |
| ayoung | morganfainberg, worst case is we get the past thing working, they say no, and we have to do it in a subclass of the paste-deploy config parser | 18:24 |
| morganfainberg | ayoung, so, i mean, i don't have a lot more to say besides "yes that would be better". | 18:24 |
| morganfainberg | ayoung, there are many ways to skin this cat, - yes your proposal is better, but honestly i don't have anything to say to it. i am not a person who can accept code into paste | 18:25 |
| *** amakarov is now known as amakarov_away | 18:25 | |
| morganfainberg | ayoung, so i think this conversation is relatively pointless besides "yep it would be nicer to have that construct". ;) seriously, it's sortof way outside the scope of OpenStack atm besides it would be nice to have. | 18:26 |
| ayoung | morganfainberg, I know jamielennox looked in to this a way back. I can't see a better alternative at the moment | 18:26 |
| morganfainberg | ayoung, so - don't block up your direction in keystone on this fix landing, but yeah i'm all for a cleaner paste config. | 18:27 |
| ayoung | morganfainberg, I won't. I think I can make paste file that does what I want, just ugly, without any of this. | 18:28 |
| morganfainberg | ayoung, if you need someone to argue^wmake a case for this with paste devs, i'm happy to help there :) | 18:28 |
| ayoung | Do you know Ian Bicking? | 18:28 |
| morganfainberg | ayoung, and for updating global reqs. but we've spent a chunk of time agreeing here :P | 18:28 |
| morganfainberg | nope. | 18:28 |
| ayoung | I'm sending him an email now. Maybe I'll get a better way to do it | 18:28 |
| morganfainberg | sounds good, feel free to CC me if you want. no need to if you got it. | 18:29 |
| *** nellysmitt has quit IRC | 18:33 | |
| ayoung | Already sent | 18:35 |
| *** nellysmitt has joined #openstack-keystone | 18:38 | |
| *** tellesnobrega_ has quit IRC | 18:39 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 18:42 |
| ayoung | raildo, rodrigods here is the general class model for RBAC http://adam.younglogic.com/presentations/RBAC.svg | 18:43 |
| *** tellesnobrega_ has joined #openstack-keystone | 18:43 | |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add small comment for partially implemented specs in backlog https://review.openstack.org/133783 | 18:44 |
| ayoung | morganfainberg, the backlog spec still refers to lost-and-found. Is that deliberate? | 18:45 |
| morganfainberg | ayoung, does it? | 18:45 |
| morganfainberg | ayoung, hm.. | 18:45 |
| ayoung | morganfainberg, under client... | 18:45 |
| ayoung | https://review.openstack.org/#/c/126647/8/README.rst,cm | 18:45 |
| morganfainberg | crud. let me fix that | 18:46 |
| ayoung | thanks | 18:46 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 18:47 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add small comment for partially implemented specs in backlog https://review.openstack.org/133783 | 18:48 |
| stevemar2 | dtroyer, i think https://review.openstack.org/#/c/131804/ warrants another look | 18:49 |
| *** aix has quit IRC | 18:49 | |
| *** vejdmn has joined #openstack-keystone | 18:49 | |
| raildo | ayoung, maybe do you have to explain about the inherited roles assignments in this diagram? | 18:49 |
| stevemar2 | dtroyer, that + default domains + or-show for a bunch more identity stuff = 1.0 ? | 18:50 |
| raildo | or this is other discussion | 18:50 |
| ayoung | raildo, heh...sure | 18:50 |
| ayoung | this diagram does not show inherited roles...I should add it | 18:50 |
| raildo | ok | 18:50 |
| ayoung | raildo, I made it before the summit. Based on how Keystone works now | 18:50 |
| ayoung | just a starting point for a model, but I think it captures the basics | 18:51 |
| raildo | hum, nice :) this is a great explanation how this works today | 18:51 |
| ayoung | raildo, thanks. I try to cut to the essentials | 18:51 |
| rodrigods | ayoung, didn't get the Responsibility vs Resource_Type relationship =) | 18:53 |
| rodrigods | (it's a great diagram, btw) | 18:53 |
| ayoung | rodrigods, so...responsibility is kindof like an inherited role | 18:53 |
| ayoung | there have been many iterations of this diagram. I started with the party-pattern from Martin Fowler. Can't take full credit | 18:54 |
| rodrigods | ayoung, example of how a responsibility is different based on the resource type? | 18:55 |
| ayoung | rodrigods, other way around: you are role means you are responsible for a class of resources | 18:55 |
| ayoung | a network admin is responsible for objects in Neutron, a storage admin for things in cinder, etc | 18:55 |
| rodrigods | ayoung, hmm | 18:55 |
| rodrigods | right | 18:55 |
| rodrigods | now I remember | 18:56 |
| rodrigods | =) | 18:56 |
| htruta | ayoung: I didn't understand why the Responsibility is attached to the ResourceType while the AssignedResponsibility is attached to the Resource | 18:56 |
| rodrigods | Hierarchical Roles spec =P | 18:56 |
| ayoung | htruta, good question, let me try to make it clear | 18:56 |
| *** vejdmn has quit IRC | 18:57 | |
| ayoung | htruta, the idea is that certain objects are mine, and only I can manage them. Other types of resources are group resources, and anyone with the roel-assignment can manage them | 18:57 |
| *** marcoemorais has quit IRC | 18:58 | |
| ayoung | So an assigned responsibility is on an actual resource instance. This was trying to get the whole ACL issue from Swift and Barbican represented the same way. Maybe it is the wrong representation | 18:58 |
| *** marcoemorais has joined #openstack-keystone | 18:58 | |
| *** marcoemorais has quit IRC | 18:59 | |
| *** marcoemorais has joined #openstack-keystone | 18:59 | |
| *** Dafna has quit IRC | 18:59 | |
| rodrigods | ayoung, it sounds more like ownership than assignment | 19:01 |
| rodrigods | for those cases | 19:01 |
| *** gokrokve has quit IRC | 19:01 | |
| htruta | ayoung: nice. Got it | 19:01 |
| htruta | rodrigods: +1 | 19:01 |
| ayoung | rodrigods, I was going for the more general term. Maybe you are right | 19:01 |
| ayoung | But also, you could assign the same object to multiple people...ACL means anyone in the list can access it | 19:02 |
| ayoung | And even ACL might be based on group membership, not just on individual identity, so...lets just say that part of the diagram might be adjusted... | 19:02 |
| rodrigods | ayoung, ++ | 19:03 |
| *** amirosh has joined #openstack-keystone | 19:03 | |
| *** gokrokve has joined #openstack-keystone | 19:04 | |
| *** rharwood has joined #openstack-keystone | 19:07 | |
| htruta | ayoung: cool. I think I'll be working with raildo and rodrigods ont his | 19:07 |
| ayoung | htruta, excellent | 19:07 |
| ayoung | htruta, I'm working on a spec for the database scheme right now. I'll add to the huge policy review, and then we can split them out. | 19:07 |
| raildo | ayoung, ++ | 19:08 |
| htruta | ayoung: ++ | 19:08 |
| *** gokrokve has quit IRC | 19:09 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 19:11 |
| morganfainberg | henrynash, yay!^ | 19:11 |
| ekarlso | jamielennox: you around ? | 19:12 |
| henrynash | morganfainberg: so I have included a bucnh of question in this first version…since there is quite a lot to consider…I guess I’m not entoredly convinced yet myself of the trade-offs | 19:12 |
| morganfainberg | henrynash, sure thing. | 19:12 |
| henrynash | morganfainberg: wanted to get it out there for discussion | 19:12 |
| *** gyee has quit IRC | 19:13 | |
| morganfainberg | henrynash, the #1 thing is "extensions" that are optional (meaning optional APIs) are an awful design | 19:13 |
| henrynash | morganfainberg: agreed | 19:13 |
| morganfainberg | and the #2 thing: we treat our extensions as stable APIs | 19:13 |
| morganfainberg | expirimental means we *could* if needed change the API | 19:13 |
| morganfainberg | not that we should assume we will. | 19:13 |
| morganfainberg | other than that, it's largely the same. but i really don't want "optional" parts of the API. | 19:14 |
| morganfainberg | and we need to have it clearly documented. | 19:14 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add small comment for partially implemented specs in backlog https://review.openstack.org/133783 | 19:14 |
| ekarlso | jamielennox: I'll have to nag you again on https://review.openstack.org/#/c/133676/ where to add tests ? | 19:14 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 19:15 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add project documentation links to index https://review.openstack.org/133810 | 19:20 |
| *** tellesnobrega_ has quit IRC | 19:20 | |
| *** esp has left #openstack-keystone | 19:21 | |
| *** marcoemorais has quit IRC | 19:21 | |
| *** marcoemorais has joined #openstack-keystone | 19:22 | |
| *** tellesnobrega_ has joined #openstack-keystone | 19:23 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 19:28 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add warning about milestone 2 deadline https://review.openstack.org/133813 | 19:29 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: policy https://review.openstack.org/133480 | 19:29 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 19:29 |
| ayoung | htruta, raildo rodrigods ^^ | 19:30 |
| raildo | ayoung, nice, I'll read the spec today :) | 19:31 |
| ayoung | raildo, thanks | 19:31 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 19:33 |
| raildo | ayoung, i'm writing the spec about HM, maybe i can finish this today , so i send to you | 19:33 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Split up assignments, making role-assignments pluggable. https://review.openstack.org/129397 | 19:35 |
| morganfainberg | henrynash, ^ +2 LGTM, fixed typos | 19:36 |
| henrynash | morganfainberg: thx | 19:36 |
| *** gokrokve has joined #openstack-keystone | 19:37 | |
| morganfainberg | ayoung, i think you got the wrong bits untabbed in your last push to backlog | 19:38 |
| morganfainberg | ayoung, it doesn't look right. | 19:38 |
| morganfainberg | v2 api? | 19:38 |
| ayoung | morganfainberg, I was trying to address stevemar2 's commnets. I think you are right. | 19:38 |
| stevemar2 | yeah, i meant the backlog section | 19:38 |
| stevemar2 | specs/backlog/* should have a few less spaces before it | 19:39 |
| ayoung | one more try coming up | 19:40 |
| morganfainberg | ayoung, hehe. | 19:40 |
| morganfainberg | going to see if we can get the v2 API merged here soon. | 19:40 |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 19:40 |
| ayoung | https://review.openstack.org/#/c/126647/11/doc/source/index.rst,cm stevemar2 look better? | 19:41 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add small comment for partially implemented specs in backlog https://review.openstack.org/133783 | 19:41 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add project documentation links to index https://review.openstack.org/133810 | 19:41 |
| stevemar2 | ayoung, i think that should work | 19:41 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Add warning about milestone 2 deadline https://review.openstack.org/133813 | 19:41 |
| morganfainberg | ayoung, yeah that looks better. | 19:41 |
| ayoung | all +2s still apply? | 19:41 |
| *** gokrokve has quit IRC | 19:41 | |
| rodrigods | morganfainberg, yay | 19:43 |
| morganfainberg | ayoung, waiting for jenkins but was going to re-+2 it | 19:43 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone: Adjust for integer only user ids from ldap https://review.openstack.org/133815 | 19:43 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 19:48 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Update headers slightly for API specification(s) https://review.openstack.org/133816 | 19:48 |
| morganfainberg | stevemar2, ok so i think we're pretty close on the V2 specs landing. | 19:49 |
| *** gokrokve has joined #openstack-keystone | 19:49 | |
| stevemar2 | morganfainberg, v2 api :P | 19:49 |
| morganfainberg | stevemar2, yeah that | 19:49 |
| *** shakamun_ has quit IRC | 19:52 | |
| *** marcoemorais has quit IRC | 19:53 | |
| *** marcoemorais has joined #openstack-keystone | 19:53 | |
| ekarlso | anyone here with a clue on the discovery stuff / session that can help me write tests for my change ? I just need some hints on how :) | 19:53 |
| ekarlso | my ksclient foo is off | 19:54 |
| morganfainberg | stevemar2, ugh we need to go put code-type identifiers into the rst. | 19:55 |
| morganfainberg | stevemar2, it's missing them. (e.g. XML) | 19:55 |
| morganfainberg | stevemar2, we can do that as a followup i guess | 19:55 |
| *** shakamunyi has joined #openstack-keystone | 19:57 | |
| openstackgerrit | ayoung proposed a change to openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 19:57 |
| morganfainberg | henrynash, stevemar2, pagination doesn't work in v2 does it | 20:03 |
| morganfainberg | ? | 20:03 |
| morganfainberg | specifically... https://review.openstack.org/#/c/131315/6/api/v2.0/identity-api-v2.0-paginated_collections.rst we should just remove that file | 20:03 |
| henrynash | morganfainberg: there is some funky weird support in one or two apis I believe | 20:04 |
| morganfainberg | henrynash, it is inconsistent and not well supported and/or broken? | 20:04 |
| morganfainberg | henrynash, right? | 20:04 |
| morganfainberg | because i keep getting asked about pagination... :P | 20:04 |
| henrynash | morganfainberg: that’s an understatment | 20:04 |
| morganfainberg | so.. i want to vote that file off the island :P | 20:05 |
| henrynash | morganfainberg: the v2 admin router of /tenants has marker/limit support in it | 20:06 |
| morganfainberg | heh | 20:06 |
| henrynash | morganfainberg: that’s the only case I know if | 20:07 |
| henrynash | of | 20:07 |
| david-lyle | hey when do we get pagination? | 20:07 |
| * david-lyle ducks | 20:07 | |
| stevemar2 | hehe | 20:11 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 20:11 |
| *** stevemar2 is now known as stevemar | 20:11 | |
| morganfainberg | stevemar, ^ that should add all the code-type identifiers | 20:11 |
| morganfainberg | otherwise i think it looks good | 20:11 |
| stevemar | morganfainberg, thanks, let me check | 20:11 |
| morganfainberg | XML doesn't actually render differently | 20:12 |
| morganfainberg | but meh, might as well add them | 20:12 |
| raildo | david-lyle, for something specific? | 20:12 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Update headers slightly for API specification(s) https://review.openstack.org/133816 | 20:12 |
| *** afaranha has quit IRC | 20:23 | |
| *** tellesnobrega_ has quit IRC | 20:26 | |
| *** vhoward has left #openstack-keystone | 20:28 | |
| openstackgerrit | Endre Karlson proposed a change to openstack/python-keystoneclient: Allow to allow for other then STABLE api version https://review.openstack.org/130159 | 20:28 |
| *** gyee has joined #openstack-keystone | 20:41 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Add positive test case for content types https://review.openstack.org/130591 | 20:45 |
| morganfainberg | henrynash, aww really: https://bugs.launchpad.net/keystone/+bug/1390125 ? | 20:47 |
| uvirtbot | Launchpad bug 1390125 in keystone "Federation tokens can't be handled if assignment backend is LDAP " [Undecided,New] | 20:47 |
| stevemar | morganfainberg, there are some weird characters in that spec patch | 20:48 |
| stevemar | like  | 20:48 |
| morganfainberg | stevemar, which one? the V2 one? | 20:48 |
| stevemar | yeah | 20:48 |
| morganfainberg | which files? | 20:49 |
| *** stevemar has quit IRC | 20:50 | |
| *** stevemar has joined #openstack-keystone | 20:50 | |
| morganfainberg | stevemar which files? | 20:50 |
| morganfainberg | stevemar, i'm not seeing them | 20:51 |
| stevemar | morganfainberg, almost all of them - but i'm not seeing them in gerrit | 20:51 |
| stevemar | morganfainberg, give me a sec, i'm uploading a new version | 20:51 |
| stevemar | and fixing the code blocks | 20:51 |
| morganfainberg | oh i wonder... | 20:51 |
| morganfainberg | did something do autocorrect rough-shot over the entire bloody thing | 20:52 |
| morganfainberg | stevemar, what line and what file let me look at my local copy | 20:52 |
| morganfainberg | and what is wrong with the code blocks? | 20:52 |
| morganfainberg | XML doesn't AFAICT render differently regardless | 20:52 |
| stevemar | morganfainberg, paginated collections: **Example:Â Tenant collection, last page: JSON response** | 20:53 |
| stevemar | it should be code-block::xml | 20:53 |
| stevemar | i'm 99% done | 20:53 |
| stevemar | just checking | 20:53 |
| morganfainberg | stevemar, both forms work iirc. | 20:53 |
| *** amirosh has quit IRC | 20:54 | |
| morganfainberg | stevemar, uhm. | 20:54 |
| morganfainberg | stevemar, local copy doesn't have the :Â | 20:54 |
| morganfainberg | i think you have something wonky in your checked out version | 20:54 |
| stevemar | morganfainberg, hehe, let me fiddle for a few more minutes... | 20:58 |
| openstackgerrit | Steve Martinelli proposed a change to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 21:02 |
| stevemar | morganfainberg, new patch up, if you disagree let me know and i'll pull it out | 21:02 |
| stevemar | morganfainberg, for instance here: https://review.openstack.org/#/c/131315/7..8/api/v2.0/identity-api-v2.0-paginated_collections.rst | 21:03 |
| stevemar | there was something screwy about the "-" used on line 20, and the space used on line 33 | 21:04 |
| morganfainberg | stevemar, meeting for me, but after will look | 21:04 |
| stevemar | okay | 21:04 |
| ayoung | morganfainberg, I'm a +A the backlog, since it had enough eyes. | 21:05 |
| morganfainberg | ayoung, ack | 21:07 |
| openstackgerrit | A change was merged to openstack/keystone-specs: Backlog https://review.openstack.org/126647 | 21:08 |
| *** Viswanath has joined #openstack-keystone | 21:09 | |
| *** Viswanath has quit IRC | 21:12 | |
| *** zzzeek has quit IRC | 21:15 | |
| *** zzzeek has joined #openstack-keystone | 21:17 | |
| *** nellysmitt has quit IRC | 21:18 | |
| *** nellysmitt has joined #openstack-keystone | 21:18 | |
| *** shakamunyi has quit IRC | 21:18 | |
| stevemar | ayoung, theres a few more from morganfainberg that were relying on the backlog patch | 21:21 |
| stevemar | i've already +2'ed and they are looking for another +2/+A :) they are all pretty minor | 21:22 |
| ayoung | looking | 21:22 |
| *** nellysmitt has quit IRC | 21:23 | |
| *** jacorob has joined #openstack-keystone | 21:25 | |
| morganfainberg | stevemar, i still don't see how you got the weird characters in there. i can't see them. *shrug* | 21:27 |
| morganfainberg | on any interface / way | 21:27 |
| stevemar | morganfainberg, but the xml stuff looks prettier :) | 21:29 |
| morganfainberg | l | 21:29 |
| morganfainberg | yeha | 21:29 |
| morganfainberg | can we get line numbers? | 21:30 |
| morganfainberg | or no. | 21:30 |
| morganfainberg | cause that would be super duper awesome | 21:30 |
| morganfainberg | otherwise this looks good to me. going to merge it. | 21:30 |
| openstackgerrit | Morgan Fainberg proposed a change to openstack/keystone-specs: Update headers slightly for API specification(s) https://review.openstack.org/133816 | 21:31 |
| ekarlso | anyone wanna look at https://review.openstack.org/#/c/130159/ ? | 21:31 |
| *** shakamunyi has joined #openstack-keystone | 21:34 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Adds v2.0 files for api spec https://review.openstack.org/131315 | 21:34 |
| *** shakamunyi has quit IRC | 21:39 | |
| openstackgerrit | A change was merged to openstack/keystone-specs: Split up assignments, making role-assignments pluggable. https://review.openstack.org/129397 | 21:41 |
| openstackgerrit | A change was merged to openstack/keystone: Tests raise exception if logging problem https://review.openstack.org/119946 | 21:44 |
| *** zzzeek has quit IRC | 21:47 | |
| morganfainberg | stevemar, https://review.openstack.org/#/c/126180/ i don't like the truncation to just the initiator section | 21:47 |
| *** fifieldt has quit IRC | 21:47 | |
| morganfainberg | stevemar, i'd rather be explicit and show the whole cadf notification in the docs (consistent and less confusing w/o needing to be *sure* to carefully read the "only the initiator in this section") | 21:48 |
| stevemar | morganfainberg, i might just abandon that, with the new cadf everywhere spec it'll be time for new docs | 21:49 |
| morganfainberg | stevemar, ++ | 21:49 |
| openstackgerrit | A change was merged to openstack/keystone: Prevent infinite loop in token_flush https://review.openstack.org/131899 | 21:52 |
| *** marcoemorais has quit IRC | 21:52 | |
| lbragstad | dstanek: around? | 21:52 |
| *** marcoemorais has joined #openstack-keystone | 21:53 | |
| dstanek | lbragstad: kinda sorta yeah | 21:53 |
| dstanek | lbragstad: what's up | 21:53 |
| lbragstad | dstanek: just curious if you have a criteria for the moving of tests? | 21:53 |
| *** unstable has joined #openstack-keystone | 21:53 | |
| openstackgerrit | Lance Bragstad proposed a change to openstack/keystone: Move notification unit tests to unit test dir https://review.openstack.org/133834 | 21:53 |
| unstable | http://docs.openstack.org/admin-guide-cloud/content/configuring-keystone-for-ldap-backend.html ; With keystone can I have two user_tree_dn s? So We have ou=Users and ou=Services, I want to add both of them. Is this possible? | 21:53 |
| dstanek | lbragstad: mostly that the tests really are unit tests and have limited dependencies | 21:54 |
| unstable | I looked for a bug in launchpad, and I tried to check the specs stuff (which is confusing). | 21:54 |
| lbragstad | dstanek: so whatever falls into that category can be moved to keystone/tests/unit/* ? | 21:54 |
| dstanek | lbragstad: yeah i think so | 21:54 |
| dstanek | lbragstad: i was trying to keep the naming similar so you can programatically find the tests for a module | 21:55 |
| lbragstad | dstanek: I tried doing the opposite of that with the functional tests patch | 21:55 |
| lbragstad | dstanek: I saw that, it looks good | 21:55 |
| dstanek | lbragstad: opposite of naming? | 21:55 |
| lbragstad | opposite of dependencies kinda thing | 21:55 |
| openstackgerrit | A change was merged to openstack/keystone: Enable hacking rule H904 https://review.openstack.org/133066 | 21:55 |
| dstanek | lbragstad: ah yeah sure - the v3 tests need to be ripped apart | 21:56 |
| *** jacorob has quit IRC | 21:56 | |
| *** jacorob has joined #openstack-keystone | 21:57 | |
| lbragstad | dstanek: I started by moving them into keystone/tests/functional for now | 21:57 |
| lbragstad | dstanek: how would you go about splitting them further? | 21:57 |
| dstanek | lbragstad: along functional lines - not really sure yet - i think i may make a commit on top of yours to monkey with it | 21:58 |
| lbragstad | dstanek: sure thing, | 22:00 |
| *** fifieldt has joined #openstack-keystone | 22:01 | |
| lbragstad | dstanek: as far as moving test modules over to keystone/tests/unit/ or keystone/tests/functional/, do you mind if they are in one big commit or move them over in bit-sized commits/ | 22:02 |
| dstanek | lbragstad: i'm technically on vaca this week, but i'm planning on doing some reviews - i'll do your first since i am biased | 22:02 |
| *** amcrn has quit IRC | 22:02 | |
| lbragstad | dstanek: no worries, you don't have to go out of your way to do it, just wanted to sync with you on the process since I have time to work on it | 22:03 |
| dstanek | lbragstad: i don't mind either way - probably good to split it up a little though | 22:03 |
| lbragstad | dstanek: agreed, I'll start proposing them as smaller commits. | 22:03 |
| *** topol has quit IRC | 22:03 | |
| lbragstad | dstanek: easier to review | 22:03 |
| *** amirosh has joined #openstack-keystone | 22:05 | |
| *** marzif has joined #openstack-keystone | 22:05 | |
| *** amirosh has quit IRC | 22:09 | |
| *** unstable has left #openstack-keystone | 22:13 | |
| *** joesavak has quit IRC | 22:34 | |
| *** henrynash has quit IRC | 22:39 | |
| *** amerine has quit IRC | 22:41 | |
| *** amerine has joined #openstack-keystone | 22:43 | |
| *** marzif has quit IRC | 22:46 | |
| *** edmondsw has quit IRC | 22:48 | |
| *** shakamunyi has joined #openstack-keystone | 22:59 | |
| *** zzzeek has joined #openstack-keystone | 23:00 | |
| *** shakamun_ has joined #openstack-keystone | 23:00 | |
| *** toddnni has quit IRC | 23:03 | |
| *** henrynash has joined #openstack-keystone | 23:03 | |
| *** toddnni has joined #openstack-keystone | 23:03 | |
| *** shakamunyi has quit IRC | 23:04 | |
| *** shakamunyi has joined #openstack-keystone | 23:07 | |
| *** shakamun_ has quit IRC | 23:11 | |
| *** jaosorior has quit IRC | 23:13 | |
| *** jacorob has quit IRC | 23:16 | |
| *** thedodd has quit IRC | 23:21 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:21 | |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 23:27 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 23:29 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 23:31 |
| ekarlso | jamielennox: the cli plugin thing, did that die ? | 23:41 |
| *** ayoung has quit IRC | 23:41 | |
| jamielennox | ekarlso: not so much die - i just haven't figured out what i would want in it beyond generic.Password | 23:41 |
| *** htruta_ has joined #openstack-keystone | 23:42 | |
| jamielennox | some clis support --os-token and --os-endpoint, some dont | 23:42 |
| jamielennox | i'm not sure if it's something we should support | 23:42 |
| ekarlso | :/ | 23:42 |
| ekarlso | jamielennox: good morning to you also I guess :) | 23:43 |
| jamielennox | off the top of my head i guess we do support it | 23:43 |
| jamielennox | ekarlso: :) | 23:43 |
| jamielennox | but i haven't worked on it | 23:43 |
| ekarlso | jamielennox: would be nice to get it in soon :P | 23:43 |
| jamielennox | ekarlso: ok - well i know OSC is essentially using that same thing so it's probably worth moving it to keystoneclient | 23:44 |
| jamielennox | ekarlso: it'll probably happen faster if you propose it | 23:44 |
| ekarlso | jamielennox: I already proposed a cliplugin :p | 23:44 |
| jamielennox | hmm, let me have a look | 23:44 |
| jamielennox | ekarlso: i don't see it | 23:45 |
| *** zzzeek has quit IRC | 23:45 | |
| jamielennox | also for designate you really should just use OSC | 23:45 |
| jamielennox | IMO | 23:45 |
| ekarlso | jamielennox: is OSC going anywhere atm ? | 23:46 |
| openstackgerrit | henry-nash proposed a change to openstack/keystone-specs: Add support for groups of roles. https://review.openstack.org/133855 | 23:46 |
| jamielennox | ekarlso: stronger and stronger | 23:46 |
| jamielennox | they're looking at a final stable version soon | 23:46 |
| jamielennox | OSC is the CLI project - not the SDK which is the library | 23:46 |
| *** dims_ has joined #openstack-keystone | 23:47 | |
| ekarlso | jamielennox: is that using sessions ? :) | 23:49 |
| jamielennox | to various degrees | 23:49 |
| jamielennox | there are a lot of existing projects that it supports that don't use sessions yet | 23:49 |
| ekarlso | :/ | 23:49 |
| ekarlso | ah | 23:49 |
| jamielennox | for those that do it will use sessions | 23:49 |
| ekarlso | is experimental api's allowed there ? | 23:50 |
| ekarlso | we've got V2 in designate going stable in K I hope | 23:50 |
| jamielennox | ekarlso: it works via entrypoints | 23:50 |
| *** dims has quit IRC | 23:50 | |
| jamielennox | so you can specify your CLI in your own client library and then it will load if it available | 23:50 |
| ekarlso | will check with my team tmrw then :) | 23:51 |
| ekarlso | they are all vast asleep | 23:51 |
| gyee | henrynash, how's does role groups different from hierarchical roles? | 23:52 |
| henrynash | gyee: so I tried to keep teh concepts separate | 23:53 |
| *** shakamunyi has quit IRC | 23:53 | |
| gyee | but they are the same, conceptually | 23:53 |
| mfisch | nkinder: I'm trying to manually cherry-pick your PAGING_OID fix, whats the etiquette on maintaining original author in the commit message? | 23:53 |
| henrynash | gyee: we want a) teh ability to have some kind of way for domains to create their own roles and then have these mapped to teh global roles (so that we don’t haev to keep changing the policy file) | 23:54 |
| *** dims_ has quit IRC | 23:54 | |
| henrynash | gyee: b) when you apply hierarchical MT to a), then you end up with hierarcical roles (although in fact it is hierarcical role groups…but that’s ok) | 23:55 |
| *** nkinder has quit IRC | 23:55 | |
| gyee | yes, two different ways to describe the same thing :) | 23:55 |
| *** dims has joined #openstack-keystone | 23:55 | |
| gyee | we need the featuer, just that you and ayoung need to figure out the English words :D | 23:56 |
| henrynash | gyee: I kept them seperate since I think even with HMT, role goups are very usefull…since it allows domains to have their own roles | 23:56 |
| gyee | I am all for role groups | 23:57 |
| henrynash | gyee: yes, I thikn ayoung is making a leap for teh endgame, I’m a bit more pedestrian and taking it one step at a time…sicne I think that’s all we can achieve! | 23:57 |
| gyee | henrynash, ++ | 23:57 |
| henrynash | gyee: correcting my comment above: I kept them seperate since I think even WITHOUT HMT, role goups are very usefull…since it allows domains to have their own roles | 23:58 |
| gyee | henrynash, I agree, not just role groups, resource groups in general are immensely helpful | 23:59 |
| henrynash | gyee: yep…. | 23:59 |
| gyee | you want to go as far as nested groups or just one level for now? | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
