| *** dgonzalez has joined #openstack-keystone | 00:01 | |
| *** alex_xu has joined #openstack-keystone | 00:02 | |
| *** soulxu_ has joined #openstack-keystone | 00:04 | |
| *** alex_xu has quit IRC | 00:07 | |
| *** soulxu_ is now known as alex_xu | 00:08 | |
| *** chrisshattuck has quit IRC | 00:09 | |
| *** dgonzalez has quit IRC | 00:12 | |
| *** packet has quit IRC | 00:12 | |
| *** RichardRaseley has joined #openstack-keystone | 00:29 | |
| *** david-lyle is now known as david-lyle_afk | 00:31 | |
| *** tellesnobrega_ has quit IRC | 00:31 | |
| *** patrickeast has quit IRC | 00:34 | |
| RichardRaseley | I'm having a strange issue after installing Keystone 2014.1.2.1-1.el7 (RDO) via Puppet (stackforge/puppet-keystone module). I am seeing an 'invalid option' error when trying to act against the API. Output from /var/log/keystone.log is https://gist.github.com/richardraseley/ce83920227cdb012f4d5. | 00:36 |
|---|---|---|
| RichardRaseley | Looks like there is an 'i3' opt being passed somewhere, but I am unable to locate it. Where should I be looking based on this output? | 00:37 |
| *** alex_xu has quit IRC | 00:49 | |
| *** RichardRaseley has quit IRC | 00:58 | |
| jamielennox | ekarlso: still here? (public holiday here but looking in anyway) | 01:06 |
| *** david-lyle_afk has quit IRC | 01:08 | |
| *** Viswanath has joined #openstack-keystone | 01:09 | |
| *** Viswanath has quit IRC | 01:12 | |
| *** jacorob has joined #openstack-keystone | 01:14 | |
| *** dims_ has joined #openstack-keystone | 01:14 | |
| *** tellesnobrega_ has joined #openstack-keystone | 01:14 | |
| *** dims has quit IRC | 01:17 | |
| *** rwsu has quit IRC | 01:18 | |
| telemonster | Does anyone have icehouse working with Active Directory authentication? | 01:19 |
| *** tellesnobrega_ has quit IRC | 01:19 | |
| *** zzzeek has quit IRC | 01:19 | |
| *** dims_ has quit IRC | 01:21 | |
| *** RichardRaseley has joined #openstack-keystone | 01:21 | |
| *** dims has joined #openstack-keystone | 01:22 | |
| *** tellesnobrega_ has joined #openstack-keystone | 01:28 | |
| *** lhcheng_ has quit IRC | 01:33 | |
| *** marcoemorais has quit IRC | 01:37 | |
| *** marcoemorais has joined #openstack-keystone | 01:37 | |
| *** gyee has quit IRC | 01:43 | |
| *** stevemar has joined #openstack-keystone | 01:50 | |
| morganfainberg | jamielennox, oooh i see you! | 01:50 |
| * morganfainberg goes back to typing up summit summary | 01:51 | |
| morganfainberg | *phe* | 01:51 |
| jamielennox | morganfainberg: no you dont | 01:51 |
| morganfainberg | jamielennox, lies! | 01:51 |
| jamielennox | morganfainberg: these are not the jamielennox's you are looking for | 01:51 |
| morganfainberg | These are not the jamielennox you are loo..Hey wait a minute! | 01:51 |
| jamielennox | morganfainberg: we are spending to much time together | 01:52 |
| morganfainberg | haha | 01:52 |
| jamielennox | alright, going to enjoy the sunshine | 01:53 |
| morganfainberg | oh right... spring / summer there | 01:53 |
| morganfainberg | :P | 01:54 |
| jamielennox | yea, and after a few weeks of europe it feels hot | 01:55 |
| *** amcrn has quit IRC | 02:08 | |
| *** tellesnobrega_ has quit IRC | 02:13 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:16 | |
| *** marcoemorais has quit IRC | 02:16 | |
| *** _cjones_ has quit IRC | 02:23 | |
| *** alex_xu has joined #openstack-keystone | 02:23 | |
| *** RichardRaseley has quit IRC | 02:26 | |
| *** tellesnobrega_ has quit IRC | 02:28 | |
| *** chrisshattuck has joined #openstack-keystone | 02:37 | |
| ayoung | telemonster, was that you that posted to the list about the AD issues? | 03:06 |
| *** david-lyle has joined #openstack-keystone | 03:07 | |
| morganfainberg | ayoung, when did Dolph become PTL? | 03:09 |
| morganfainberg | essex? | 03:09 |
| morganfainberg | folsom? | 03:10 |
| ayoung | It wasn't essex | 03:10 |
| david-lyle | morganfainberg: havana | 03:10 |
| david-lyle | IIRC | 03:10 |
| david-lyle | portland | 03:10 |
| *** dims has quit IRC | 03:11 | |
| morganfainberg | david-lyle, thanks. | 03:11 |
| ayoung | Let's see. I joined 3 years ago, Joe Heck became PTL...was it for a bout a year...gave it up In december 2 years ago | 03:11 |
| david-lyle | dolph was 3 cycles I believe | 03:11 |
| *** dims has joined #openstack-keystone | 03:11 | |
| david-lyle | H, I, J | 03:11 |
| ayoung | Sounds right | 03:12 |
| *** RichardRaseley has joined #openstack-keystone | 03:12 | |
| morganfainberg | kk | 03:12 |
| *** edmondsw has quit IRC | 03:18 | |
| *** david-lyle is now known as david-lyle_afk | 03:18 | |
| *** wwriverrat has joined #openstack-keystone | 03:21 | |
| *** kobtea has joined #openstack-keystone | 03:23 | |
| *** kobtea has quit IRC | 03:28 | |
| *** wwriverrat has quit IRC | 03:29 | |
| *** chrisshattuck has quit IRC | 03:31 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:34 | |
| *** richm has quit IRC | 03:42 | |
| *** wwriverrat has joined #openstack-keystone | 03:45 | |
| *** d0ugal has quit IRC | 03:45 | |
| *** anteaya has quit IRC | 03:46 | |
| *** dvorak has quit IRC | 03:46 | |
| *** cyeoh has quit IRC | 03:47 | |
| *** dvorak has joined #openstack-keystone | 03:47 | |
| *** cyeoh has joined #openstack-keystone | 03:48 | |
| *** d0ugal has joined #openstack-keystone | 03:48 | |
| *** d0ugal is now known as Guest32556 | 03:48 | |
| *** anteaya has joined #openstack-keystone | 03:50 | |
| openstackgerrit | Merged openstack/keystone: Fix project federation tokens for inherited roles. https://review.openstack.org/133299 | 03:58 |
| *** tellesnobrega_ has quit IRC | 04:02 | |
| openstackgerrit | Merged openstack/keystone: Improve testing of exclusion of inherited roles. https://review.openstack.org/133332 | 04:05 |
| openstackgerrit | Merged openstack/keystone: Exclude domains with inherited roles from user domain list. https://review.openstack.org/133333 | 04:07 |
| telemonster | ayoung - yes, thanks for the reply :-) | 04:09 |
| ayoung | telemonster, so, I'm guessing that the service user was the same. OK, ready for the big guns? | 04:18 |
| ayoung | rpdb | 04:19 |
| ayoung | I'm headed to bed now, but the rough steps are: | 04:19 |
| ayoung | pip install rpdb | 04:19 |
| ayoung | go to the point in the code where the authentication happens: the password plugin under keystone/auth/plugins for V3, or the controller in keystone/token/controllers for v2 | 04:20 |
| ayoung | insert | 04:20 |
| ayoung | import rpdb; rpdb.set_trace() | 04:20 |
| ayoung | hit the keystone server with a token request | 04:20 |
| ayoung | telnet to port 4444 and you are in a debugger session | 04:21 |
| telemonster | sweet | 04:23 |
| telemonster | There was some discussion/questioning weather there was something else that was supposed to be happening with tokens that isnt, but I assume the token is granted upon successful authentication similar to web sessions | 04:24 |
| telemonster | I'll try to get that working tomorrow. I tried strace including threads against the root but it didn't yield much. My coworkers went to redhat training for this stuff its not my main thing but Im helping due to the severity | 04:26 |
| telemonster | much thanks for your help! | 04:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WSGIPassAuthorization to OAuth docs https://review.openstack.org/134388 | 04:57 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: OAuth headers are missing https://review.openstack.org/134364 | 04:58 |
| *** jacorob has quit IRC | 05:03 | |
| *** gokrokve has joined #openstack-keystone | 05:09 | |
| *** kobtea has joined #openstack-keystone | 05:09 | |
| *** RichardRaseley has quit IRC | 05:10 | |
| *** zzzeek has joined #openstack-keystone | 05:11 | |
| *** zzzeek has quit IRC | 05:12 | |
| stevemar | morganfainberg, your blog post needs more federation mentions :) | 05:13 |
| stevemar | err nvm, just read "SSO, Web Portals, and Federation Next Steps will be covered in my next post" | 05:13 |
| *** kobtea has quit IRC | 05:14 | |
| *** chrisshattuck has joined #openstack-keystone | 05:14 | |
| morganfainberg | stevemar: figured that needed its own post. | 05:17 |
| morganfainberg | And the current post was already too much. | 05:18 |
| morganfainberg | A blog post with a table of contents :P | 05:18 |
| stevemar | yeah, it was definitely meaty | 05:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WSGIPassAuthorization to OAuth docs https://review.openstack.org/134388 | 05:23 |
| *** _cjones_ has joined #openstack-keystone | 05:24 | |
| stevemar | morganfainberg, also https://review.openstack.org/#/c/133037/ if you'd be so kind :) | 05:25 |
| *** _cjones_ has quit IRC | 05:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: OAuth headers are missing https://review.openstack.org/134364 | 05:31 |
| *** amerine has quit IRC | 05:41 | |
| *** amerine has joined #openstack-keystone | 05:42 | |
| *** gokrokve has quit IRC | 05:49 | |
| *** gokrokve has joined #openstack-keystone | 05:49 | |
| *** gokrokve has quit IRC | 05:54 | |
| *** marcoemorais has joined #openstack-keystone | 06:04 | |
| *** marcoemorais1 has joined #openstack-keystone | 06:05 | |
| *** marcoemorais has quit IRC | 06:08 | |
| *** gokrokve has joined #openstack-keystone | 06:15 | |
| *** gokrokve has quit IRC | 06:17 | |
| *** gokrokve has joined #openstack-keystone | 06:17 | |
| *** gokrokve has quit IRC | 06:22 | |
| *** jacorob has joined #openstack-keystone | 06:37 | |
| stevemar | nkinder, still have that setup with users in other domains, for testing osc? | 06:45 |
| *** amirosh has joined #openstack-keystone | 07:06 | |
| *** k4n0 has joined #openstack-keystone | 07:08 | |
| *** amirosh_ has joined #openstack-keystone | 07:12 | |
| *** amirosh has quit IRC | 07:12 | |
| *** amirosh has joined #openstack-keystone | 07:13 | |
| *** amirosh_ has quit IRC | 07:13 | |
| *** amirosh has quit IRC | 07:16 | |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: Does not accept blank password for updation https://review.openstack.org/134454 | 07:17 |
| *** gokrokve has joined #openstack-keystone | 07:17 | |
| *** amirosh has joined #openstack-keystone | 07:19 | |
| *** gokrokve has quit IRC | 07:22 | |
| *** ajayaa has joined #openstack-keystone | 07:23 | |
| *** wwriverrat has quit IRC | 07:29 | |
| *** wwriverrat has joined #openstack-keystone | 07:30 | |
| *** amirosh has quit IRC | 07:32 | |
| *** amirosh has joined #openstack-keystone | 07:32 | |
| *** ajayaa has quit IRC | 07:33 | |
| *** ajayaa has joined #openstack-keystone | 07:38 | |
| *** wwriverrat has quit IRC | 08:11 | |
| *** amirosh_ has joined #openstack-keystone | 08:12 | |
| *** amirosh has quit IRC | 08:12 | |
| *** amirosh has joined #openstack-keystone | 08:15 | |
| *** amirosh_ has quit IRC | 08:15 | |
| *** gokrokve has joined #openstack-keystone | 08:17 | |
| *** gokrokve has quit IRC | 08:18 | |
| *** gokrokve has joined #openstack-keystone | 08:19 | |
| *** amirosh_ has joined #openstack-keystone | 08:20 | |
| *** amirosh has quit IRC | 08:20 | |
| *** gokrokve has quit IRC | 08:23 | |
| *** ajayaa has quit IRC | 08:28 | |
| *** amirosh_ has quit IRC | 08:37 | |
| *** links has joined #openstack-keystone | 08:38 | |
| *** amirosh has joined #openstack-keystone | 08:38 | |
| *** amirosh has quit IRC | 08:38 | |
| *** amirosh has joined #openstack-keystone | 08:39 | |
| *** amirosh has quit IRC | 08:39 | |
| *** amirosh has joined #openstack-keystone | 08:40 | |
| *** ajayaa has joined #openstack-keystone | 08:41 | |
| *** amirosh_ has joined #openstack-keystone | 08:42 | |
| *** amirosh has quit IRC | 08:42 | |
| marekd|away | what is the difference between PKI and PKIZ tokens? | 08:42 |
| *** marekd|away is now known as marekd | 08:43 | |
| *** amirosh_ has quit IRC | 08:45 | |
| ajayaa | marekd, PKIZ is compressed version of PKI tokens, I guess! | 08:45 |
| *** amirosh has joined #openstack-keystone | 08:45 | |
| stevemar | ajayaa, you are right | 08:46 |
| stevemar | marekd, so long! | 08:46 |
| *** kobtea has joined #openstack-keystone | 08:47 | |
| *** amirosh_ has joined #openstack-keystone | 08:49 | |
| *** amirosh has quit IRC | 08:49 | |
| *** amirosh has joined #openstack-keystone | 08:50 | |
| *** amirosh_ has quit IRC | 08:50 | |
| *** amirosh has quit IRC | 08:51 | |
| *** kobtea has quit IRC | 08:52 | |
| *** stevemar has quit IRC | 08:52 | |
| *** henrynash has joined #openstack-keystone | 08:52 | |
| *** amirosh has joined #openstack-keystone | 08:53 | |
| *** amirosh_ has joined #openstack-keystone | 08:54 | |
| *** amirosh_ has quit IRC | 08:54 | |
| *** amirosh has quit IRC | 08:55 | |
| *** gordc has joined #openstack-keystone | 08:55 | |
| *** amirosh has joined #openstack-keystone | 08:55 | |
| *** amirosh has quit IRC | 08:56 | |
| *** amirosh has joined #openstack-keystone | 08:56 | |
| *** amirosh has quit IRC | 08:59 | |
| *** amirosh has joined #openstack-keystone | 08:59 | |
| *** alex_xu has quit IRC | 09:00 | |
| marekd | stevemar what long? | 09:02 |
| *** lhcheng has joined #openstack-keystone | 09:04 | |
| *** amirosh has quit IRC | 09:05 | |
| *** henrynash_ has joined #openstack-keystone | 09:06 | |
| *** henrynash has quit IRC | 09:06 | |
| *** henrynash_ is now known as henrynash | 09:06 | |
| *** amirosh has joined #openstack-keystone | 09:07 | |
| *** amirosh has quit IRC | 09:08 | |
| *** amirosh has joined #openstack-keystone | 09:09 | |
| *** gokrokve has joined #openstack-keystone | 09:17 | |
| *** jistr has joined #openstack-keystone | 09:19 | |
| *** gokrokve has quit IRC | 09:22 | |
| *** amirosh_ has joined #openstack-keystone | 09:49 | |
| *** amirosh has quit IRC | 09:49 | |
| *** amirosh_ has quit IRC | 09:52 | |
| *** amirosh has joined #openstack-keystone | 09:53 | |
| *** nellysmitt has joined #openstack-keystone | 09:54 | |
| *** aix has joined #openstack-keystone | 09:56 | |
| *** amirosh has quit IRC | 09:57 | |
| *** jacorob has quit IRC | 09:57 | |
| *** amirosh has joined #openstack-keystone | 09:57 | |
| *** nellysmitt has quit IRC | 09:59 | |
| *** diegows has joined #openstack-keystone | 09:59 | |
| *** amirosh_ has joined #openstack-keystone | 10:01 | |
| *** amirosh has quit IRC | 10:01 | |
| *** amirosh has joined #openstack-keystone | 10:04 | |
| *** amirosh_ has quit IRC | 10:04 | |
| *** amirosh_ has joined #openstack-keystone | 10:07 | |
| *** amirosh has quit IRC | 10:07 | |
| *** amirosh_ has quit IRC | 10:09 | |
| *** amirosh has joined #openstack-keystone | 10:10 | |
| *** amirosh has quit IRC | 10:12 | |
| *** amirosh has joined #openstack-keystone | 10:13 | |
| *** amirosh has quit IRC | 10:13 | |
| *** amirosh has joined #openstack-keystone | 10:13 | |
| *** Guest32556 is now known as d0ugal | 10:14 | |
| *** d0ugal is now known as Guest92455 | 10:14 | |
| *** amirosh has quit IRC | 10:14 | |
| *** Guest92455 is now known as d0ugal | 10:16 | |
| *** d0ugal has quit IRC | 10:16 | |
| *** d0ugal has joined #openstack-keystone | 10:16 | |
| *** gokrokve has joined #openstack-keystone | 10:17 | |
| *** amirosh has joined #openstack-keystone | 10:18 | |
| *** bjornar has quit IRC | 10:19 | |
| *** amirosh_ has joined #openstack-keystone | 10:21 | |
| *** amirosh has quit IRC | 10:21 | |
| *** gokrokve has quit IRC | 10:21 | |
| *** bjornar has joined #openstack-keystone | 10:22 | |
| *** amirosh_ has quit IRC | 10:23 | |
| *** amirosh has joined #openstack-keystone | 10:24 | |
| *** amirosh has quit IRC | 10:24 | |
| *** amirosh has joined #openstack-keystone | 10:24 | |
| *** amirosh_ has joined #openstack-keystone | 10:26 | |
| *** amirosh has quit IRC | 10:26 | |
| *** amirosh has joined #openstack-keystone | 10:30 | |
| *** amirosh_ has quit IRC | 10:30 | |
| *** diegows has quit IRC | 10:30 | |
| *** amirosh_ has joined #openstack-keystone | 10:33 | |
| *** amirosh has quit IRC | 10:33 | |
| *** amirosh has joined #openstack-keystone | 10:34 | |
| *** amirosh_ has quit IRC | 10:34 | |
| *** amirosh has quit IRC | 10:34 | |
| *** amirosh has joined #openstack-keystone | 10:35 | |
| *** amirosh has quit IRC | 10:35 | |
| *** amirosh has joined #openstack-keystone | 10:35 | |
| *** amirosh_ has joined #openstack-keystone | 10:37 | |
| *** amirosh has quit IRC | 10:37 | |
| *** amirosh has joined #openstack-keystone | 10:40 | |
| *** amirosh_ has quit IRC | 10:40 | |
| *** amirosh has quit IRC | 10:40 | |
| *** amirosh has joined #openstack-keystone | 10:41 | |
| *** amirosh has quit IRC | 10:45 | |
| *** amirosh has joined #openstack-keystone | 10:46 | |
| *** amirosh has quit IRC | 10:46 | |
| *** amirosh has joined #openstack-keystone | 10:47 | |
| *** amirosh_ has joined #openstack-keystone | 10:48 | |
| *** amirosh has quit IRC | 10:48 | |
| *** marcoemorais1 has quit IRC | 11:01 | |
| *** dims has quit IRC | 11:06 | |
| *** dims has joined #openstack-keystone | 11:06 | |
| *** amirosh_ has quit IRC | 11:13 | |
| *** amirosh has joined #openstack-keystone | 11:13 | |
| *** amirosh_ has joined #openstack-keystone | 11:16 | |
| *** amirosh has quit IRC | 11:17 | |
| *** amirosh_ has quit IRC | 11:17 | |
| *** gokrokve has joined #openstack-keystone | 11:17 | |
| *** amirosh has joined #openstack-keystone | 11:17 | |
| *** amirosh has quit IRC | 11:21 | |
| *** amirosh has joined #openstack-keystone | 11:21 | |
| *** gokrokve has quit IRC | 11:22 | |
| *** dims has quit IRC | 11:25 | |
| *** nellysmitt has joined #openstack-keystone | 11:26 | |
| *** amirosh has quit IRC | 11:29 | |
| *** amirosh has joined #openstack-keystone | 11:29 | |
| *** amirosh has quit IRC | 11:30 | |
| *** amirosh has joined #openstack-keystone | 11:30 | |
| *** nellysmitt has quit IRC | 11:31 | |
| *** ajayaa has quit IRC | 11:34 | |
| *** amirosh_ has joined #openstack-keystone | 11:37 | |
| *** amirosh has quit IRC | 11:37 | |
| *** amirosh_ has quit IRC | 11:38 | |
| *** amirosh has joined #openstack-keystone | 11:38 | |
| *** amirosh_ has joined #openstack-keystone | 11:41 | |
| *** amirosh has quit IRC | 11:41 | |
| rodrigods | marekd, thanks for adding mapping enhancements to the meeting agenda | 11:46 |
| *** amirosh_ has quit IRC | 11:49 | |
| *** amirosh has joined #openstack-keystone | 11:49 | |
| rodrigods | ayoung, there? | 11:51 |
| *** ajayaa has joined #openstack-keystone | 11:52 | |
| *** amirosh_ has joined #openstack-keystone | 12:01 | |
| *** amirosh has quit IRC | 12:01 | |
| samuelms | henrynash, just left a couple of comments on the 'Split the assignments manager/driver' patch | 12:01 |
| henrynash | samuelms: just saw them, thx | 12:01 |
| samuelms | henrynash, you did nice work up there :-) | 12:02 |
| henrynash | samuelms: thx | 12:02 |
| *** amirosh_ has quit IRC | 12:03 | |
| *** raildo has quit IRC | 12:03 | |
| *** amirosh has joined #openstack-keystone | 12:04 | |
| *** amirosh has quit IRC | 12:04 | |
| *** amirosh has joined #openstack-keystone | 12:05 | |
| *** amirosh has quit IRC | 12:07 | |
| *** amirosh has joined #openstack-keystone | 12:07 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| samuelms | henrynash, replied your comment on the etherpad I created for assignment backend language (role-assignment-backend-language) | 12:15 |
| *** gokrokve has joined #openstack-keystone | 12:17 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 12:19 |
| *** gokrokve has quit IRC | 12:21 | |
| *** kobtea has joined #openstack-keystone | 12:24 | |
| *** amirosh_ has joined #openstack-keystone | 12:26 | |
| *** amirosh has quit IRC | 12:26 | |
| *** kobtea has quit IRC | 12:29 | |
| *** tellesnobrega_ has joined #openstack-keystone | 12:39 | |
| *** ajayaa has quit IRC | 12:40 | |
| *** amirosh has joined #openstack-keystone | 12:41 | |
| *** amirosh_ has quit IRC | 12:41 | |
| *** raildo has quit IRC | 12:41 | |
| *** raildo has joined #openstack-keystone | 12:43 | |
| *** amirosh has quit IRC | 12:46 | |
| *** amirosh has joined #openstack-keystone | 12:46 | |
| *** amirosh has quit IRC | 12:47 | |
| *** amirosh has joined #openstack-keystone | 12:48 | |
| *** amirosh has quit IRC | 12:48 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 12:48 |
| *** amirosh has joined #openstack-keystone | 12:49 | |
| *** amirosh has quit IRC | 12:49 | |
| *** amirosh has joined #openstack-keystone | 12:50 | |
| *** amirosh_ has joined #openstack-keystone | 12:51 | |
| *** amirosh has quit IRC | 12:51 | |
| *** amirosh_ has quit IRC | 12:51 | |
| *** amirosh has joined #openstack-keystone | 12:52 | |
| *** russellb is now known as rustlebee | 13:02 | |
| *** gokrokve has joined #openstack-keystone | 13:17 | |
| marekd | rodrigods: np | 13:21 |
| *** gokrokve has quit IRC | 13:22 | |
| *** tellesnobrega_ has quit IRC | 13:28 | |
| *** arunkant has joined #openstack-keystone | 13:28 | |
| ayoung | rodrigods, I'm here | 13:37 |
| marekd | morganfainberg: ping ping ping | 13:41 |
| ayoung | marekd, don't send Naked pings....just post your question and he'll respond when he can. russleb had a good post on this... | 13:44 |
| marekd | ayoung: i know i know i know | 13:45 |
| ayoung | http://blogs.gnome.org/markmc/2014/02/20/naked-pings/ | 13:45 |
| ayoung | marekd, also, he's in California. It is not even 6 AM where he lives. He's dedicated, but even morganfainberg needs to sleep sometimes | 13:45 |
| ayoung | even if it is in a Coffin... | 13:45 |
| marekd | ayoung: you are right. | 13:48 |
| *** radez_g0n3 is now known as radez | 13:56 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:01 | |
| *** amirosh has quit IRC | 14:08 | |
| *** amirosh has joined #openstack-keystone | 14:08 | |
| *** amirosh has quit IRC | 14:11 | |
| *** nkinder has quit IRC | 14:11 | |
| *** amirosh_ has joined #openstack-keystone | 14:11 | |
| *** amirosh has joined #openstack-keystone | 14:14 | |
| *** amirosh has quit IRC | 14:14 | |
| *** amirosh_ has quit IRC | 14:14 | |
| *** amirosh has joined #openstack-keystone | 14:15 | |
| *** amirosh has quit IRC | 14:15 | |
| henrynash | ayoung: you’re comment about ‘resource’….have a look at my response on the patch: https://review.openstack.org/#/c/130954/ | 14:15 |
| ayoung | You are accusing me ogf Bike shedding! | 14:16 |
| ayoung | Heh | 14:17 |
| ayoung | henrynash, yeah, I debated with the -1 on that, just wanted to make sure we had the conversation | 14:17 |
| henrynash | ayoung: understand.... | 14:17 |
| *** gokrokve has joined #openstack-keystone | 14:17 | |
| *** amirosh has joined #openstack-keystone | 14:18 | |
| ayoung | henrynash, language is important. If resource is the right name, we should go with it. I think that you agree it is not the right name, but that maybe there is no right name | 14:18 |
| *** amirosh has quit IRC | 14:18 | |
| ayoung | and.... | 14:18 |
| ayoung | I'd probably agree with you | 14:18 |
| *** amirosh has joined #openstack-keystone | 14:18 | |
| henrynash | ayoung: resoruce was the best we could agree on…. | 14:19 |
| ayoung | The thing is ... everything is a resource. It would be like naming it "objects" | 14:19 |
| ayoung | and...it isn't. It is the namespace for containers that we provide to other services to put their resources inside | 14:19 |
| henrynash | ayoung: well, and roles too | 14:19 |
| ayoung | directory? | 14:20 |
| ayoung | I'm not going to hold this up | 14:20 |
| ayoung | just...hmmm | 14:20 |
| ayoung | I like assignment. Its clear. | 14:21 |
| ayoung | domains and projects are the directory...roles are labels | 14:21 |
| ayoung | but then, all these are labels | 14:21 |
| *** amirosh has quit IRC | 14:21 | |
| *** gokrokve has quit IRC | 14:21 | |
| *** marg7175 has joined #openstack-keystone | 14:21 | |
| rodrigods | ayoung, https://bugs.launchpad.net/keystone/+bug/1392685 related to tying an IdP to a domain, right? | 14:21 |
| uvirtbot | Launchpad bug 1392685 in keystone "With OS-Federation users can get the wrong mapping" [Undecided,New] | 14:21 |
| *** amirosh has joined #openstack-keystone | 14:22 | |
| *** amirosh has quit IRC | 14:22 | |
| ayoung | henrynash, OK...I'm sure I'll regret this, but I'll let it go. I know that, in about a week, I will wake up at 2 AM with the "right" name...or, more likely, a week after code freeze | 14:22 |
| henrynash | ayoung: yep, I know….although having already done one massive rename from ‘base ’ (my first, albeit, poor idea)…to ‘resource’ across the 3 dependant patches…now that the spec is agreed with ‘resrouce’, I’m kinds of trying to avoid another crunchthrough renaming unless others really obkect | 14:22 |
| ayoung | I hear yah | 14:22 |
| ayoung | too much churn | 14:22 |
| henrynash | ayoung: and if you do…and we all agree….(for a small beer)…I’ll do a rename… | 14:23 |
| ayoung | is that the size of the vessel containing the beer or a beer type? | 14:23 |
| *** amirosh has joined #openstack-keystone | 14:23 | |
| *** richm has joined #openstack-keystone | 14:24 | |
| henrynash | ayoung: :-) | 14:24 |
| *** amirosh has quit IRC | 14:24 | |
| ayoung | henrynash, think you probably deserve something better than a small vessel of small beer | 14:24 |
| *** amirosh has joined #openstack-keystone | 14:24 | |
| ayoung | http://en.wikipedia.org/wiki/Small_beer | 14:25 |
| henrynash | ayoung: ha, had not heard of that use to describe low alc beer! | 14:25 |
| ayoung | rodrigods, looking | 14:26 |
| ayoung | rodrigods, I want to say "yes, that is related to tying an IdP to a domain" but I think it is more problematic than that. I think that he is actually saying a user can get the wrong mapping, which is regardless of domain. | 14:30 |
| ayoung | henrynash, I know we have "assign policy for an endpoint" but what happens if an endpoint request its policy file and there is no policy explicitly linked to it? | 14:32 |
| *** amirosh has quit IRC | 14:32 | |
| ayoung | do we have a way of specifying "return this default policy file" | 14:32 |
| *** amirosh has joined #openstack-keystone | 14:33 | |
| henrynash | ayoung: if there’s nothing for that endpoint, we look for the service type | 14:33 |
| *** amirosh has quit IRC | 14:34 | |
| *** amirosh has joined #openstack-keystone | 14:34 | |
| *** amirosh has quit IRC | 14:34 | |
| ayoung | henrynash, and if there is nothing for the service type? | 14:34 |
| henrynash | ayoung: and maybe the service type in the that region first, I’l have to check | 14:34 |
| henrynash | ayoung: then we return an error | 14:35 |
| ayoung | Its ok, I can look | 14:35 |
| *** amirosh has joined #openstack-keystone | 14:35 | |
| ayoung | henrynash, OK, so I'm going to add a spec that allows for a single default policy file | 14:35 |
| henrynash | ayoung: yep, taht sounds good | 14:36 |
| *** amirosh has quit IRC | 14:37 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Enable support for IETF ABFAB as a federation protocol. https://review.openstack.org/134549 | 14:37 |
| *** amirosh has joined #openstack-keystone | 14:37 | |
| *** edmondsw has joined #openstack-keystone | 14:37 | |
| *** amirosh_ has joined #openstack-keystone | 14:38 | |
| *** amirosh has quit IRC | 14:38 | |
| *** amirosh_ has quit IRC | 14:39 | |
| *** amirosh has joined #openstack-keystone | 14:39 | |
| *** zzzeek has joined #openstack-keystone | 14:42 | |
| *** gokrokve has joined #openstack-keystone | 14:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 14:48 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 14:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 14:50 |
| henrynash | ayounng: thx for dropping the -1, could also do that on: https://review.openstack.org/#/c/132634/ | 14:51 |
| *** elynn_ has joined #openstack-keystone | 14:54 | |
| telemonster | ayoung - coworker noticed that there is no dash database on the new install, while the old install had one. So he is implementing that | 14:56 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134549 | 14:57 |
| telemonster | I pulled both debug dumps (console output) from havana (works) and icehouse (doesnt work) into Apple Opendiff and looked through it all. There is this sequence that happens in the ldap process where it does a get value len, get next attrib in a loop over and over. Failing one fails right after that, working one finishes then moves on to do another ldap query (my guess is to start narrowing down groups and such) | 14:57 |
| *** richm has quit IRC | 14:57 | |
| telemonster | I bet the loop of get/length is password comparison or something | 14:57 |
| *** dnalezyt has quit IRC | 14:58 | |
| *** nkinder has joined #openstack-keystone | 14:58 | |
| rodrigods | ayoung, hmm... requires stevemar and marekd eyes too, I guess | 15:07 |
| *** amirosh has quit IRC | 15:07 | |
| *** amirosh has joined #openstack-keystone | 15:07 | |
| ayoung | telemonster, ? | 15:07 |
| ayoung | telemonster, dash? | 15:07 |
| *** richm has joined #openstack-keystone | 15:09 | |
| lbragstad | henrynash: nice write up on the extensions blueprint | 15:09 |
| ayoung | henrynash, am I wrong to want to call the new backend the Tenant backend? | 15:09 |
| henrynash | ayoung: aahhhhh….where’s that cliff... | 15:09 |
| ayoung | Heh | 15:10 |
| ayoung | Dover, I think. | 15:10 |
| henrynash | lbragstad: thx | 15:10 |
| henrynash | ayoung: too far, damnit | 15:10 |
| *** thiagop has joined #openstack-keystone | 15:10 | |
| ayoung | Moher, actually | 15:10 |
| ayoung | http://en.wikipedia.org/wiki/Cliffs_of_Moher | 15:10 |
| *** thiagop has quit IRC | 15:10 | |
| telemonster | ayoung - Dashboard I suppose. Coworker is trying one more thing then I think they're moving to rebuild havana over icehouse | 15:11 |
| ayoung | Shouldn't be horizon. | 15:11 |
| ayoung | telemonster, I wonder if it has to do with a change we made to avoid fetching all of the attributes, | 15:12 |
| ayoung | it was breaking if there were binary attributes being fetched | 15:12 |
| ayoung | I thought that change was in Juno, but maybe it got backported. Let me check | 15:12 |
| ayoung | telemonster, https://review.openstack.org/#/c/91883/ | 15:14 |
| telemonster | cehcking | 15:14 |
| ayoung | telemonster, did you see my comment last night about rpdb? | 15:14 |
| telemonster | HMMMM | 15:15 |
| telemonster | yea I have it in place, I figured out (c)ontinue to run but past that not sure what to do, Im pretty sure you can set a point to stop then look at the values of variables but past that? | 15:15 |
| telemonster | is there a way to make it print tons of debugging real time? | 15:16 |
| telemonster | this bug/fix sounds exactly like the thing that could be causing the issue :-) | 15:17 |
| telemonster | I'm going to figure out how to get the pre-changes version and see if it is easy to sub | 15:19 |
| ayoung | telemonster, you can do break filename:line | 15:19 |
| ayoung | telemonster, it is basically pdb...let me see if I can find a tutorial link | 15:20 |
| *** henrynash has quit IRC | 15:23 | |
| morganfainberg | Morning. | 15:23 |
| *** chrisshattuck has quit IRC | 15:26 | |
| *** thedodd has joined #openstack-keystone | 15:28 | |
| *** chrisshattuck has joined #openstack-keystone | 15:29 | |
| *** stevemar has joined #openstack-keystone | 15:29 | |
| marekd | rodrigods: what's up? | 15:29 |
| *** sigmavirus24 has left #openstack-keystone | 15:31 | |
| *** amirosh has quit IRC | 15:35 | |
| *** Lupul has joined #openstack-keystone | 15:36 | |
| *** jacorob has joined #openstack-keystone | 15:36 | |
| morganfainberg | marekd: got your email. Will address shortly. | 15:38 |
| marekd | morganfainberg: sure. | 15:39 |
| Lupul | hello, how long should a POST to /v2.0/tokens take ? (idle, baremetal node) | 15:42 |
| rodrigods | marekd, this bug https://bugs.launchpad.net/keystone/+bug/1392685 | 15:43 |
| uvirtbot | Launchpad bug 1392685 in keystone "With OS-Federation users can get the wrong mapping" [Undecided,New] | 15:43 |
| *** kobtea has joined #openstack-keystone | 15:44 | |
| *** gokrokve has quit IRC | 15:45 | |
| *** gokrokve has joined #openstack-keystone | 15:45 | |
| Lupul | is 200ms - 400ms a normal response time ? | 15:46 |
| *** kobtea has quit IRC | 15:48 | |
| gordc | stevemar: how do i fix this: http://lists.openstack.org/pipermail/openstack-dev/2014-November/050350.html | 15:49 |
| stevemar | gordc, i've been looking at that since it was announced, but i'm confused since openstack CI works | 15:50 |
| stevemar | gordc, i think it might be installing from pypi instead of pulling master branch? | 15:51 |
| stevemar | gordc, like this post says: http://lists.openstack.org/pipermail/openstack-dev/2014-November/050357.html | 15:51 |
| gordc | stevemar: no idea. first time i've been running stuff since before summit. | 15:51 |
| gordc | i just did a git pull of everything and now it's all broke. | 15:51 |
| stevemar | gordc, reclone | 15:51 |
| stevemar | hmm | 15:51 |
| gordc | stevemar: does it work for you locally? | 15:52 |
| stevemar | yep | 15:52 |
| stevemar | it's what the openstack CI uses | 15:52 |
| gordc | stevemar: did you pull in all the latest? | 15:52 |
| gordc | python-openstackclient==0.4.1.78.gfa9cdef | 15:54 |
| telemonster | ayoung - I think I got past the auth issue by cramming in a core.py that is much older | 15:56 |
| ayoung | telemonster, that is horrible | 15:56 |
| stevemar | gordc, sec, let me check | 15:57 |
| *** lhcheng_ has joined #openstack-keystone | 15:58 | |
| *** nkinder is now known as nkinder_afk | 16:01 | |
| *** lhcheng has quit IRC | 16:01 | |
| lbragstad | morganfainberg: when we were talking about the ae-token stuff at the summit, you'd mentioned some clean up for the token api. Did you want that proposed as a spec? | 16:01 |
| morganfainberg | lbragstad: I proposed it. | 16:02 |
| *** chrisshattuck has quit IRC | 16:02 | |
| lbragstad | morganfainberg: ah, gotcha | 16:02 |
| lbragstad | this guy? | 16:02 |
| lbragstad | https://review.openstack.org/#/c/134314/ | 16:02 |
| morganfainberg | Yep | 16:03 |
| lbragstad | morganfainberg: awesome, thanks! | 16:03 |
| lbragstad | I'll review | 16:03 |
| *** packet has joined #openstack-keystone | 16:03 | |
| stevemar | gordc, what is your localrc? | 16:04 |
| telemonster | ayoung - is juno the same keystone code as this icehouse version? | 16:04 |
| gordc | stevemar: i think it works now. i just pip uninstalled all the clients | 16:04 |
| telemonster | or same functionality (I'm trying to think if Juno would also have issues with our AD servers) | 16:04 |
| gordc | stevemar: still want to see my localrc | 16:04 |
| stevemar | gordc, okay, reply back to the thread if you can, i'll dig into this a bit more | 16:05 |
| *** marg7175 has quit IRC | 16:05 | |
| *** marg7175 has joined #openstack-keystone | 16:06 | |
| ayoung | telemonster, so, if you ran Juno, yes, your Icehouse servers could work with it...if that is what you are asking | 16:07 |
| gordc | sudo pip freeze | 16:07 |
| gordc | f | 16:07 |
| ayoung | can we not do ae tokens. Please? | 16:07 |
| telemonster | ayoung - no, if we were using juno would the codebase for keystone be similar to icehouse current and thus not work with our AD server | 16:07 |
| ayoung | telemonster, I suspect we could make this work with your AD server in Juno or Icehouse | 16:08 |
| ayoung | we don't know yet what the problem is. It might be something new, or something already fixed | 16:08 |
| *** chrisshattuck has joined #openstack-keystone | 16:08 | |
| telemonster | do you think it's a utf-8 issue or something? we're runnign 0.9.0 keystone | 16:08 |
| *** jacorob has quit IRC | 16:08 | |
| telemonster | I think | 16:08 |
| telemonster | let me diff the zero day keystone core.py ldap module against our latest | 16:09 |
| telemonster | ooo | 16:11 |
| stevemar | gordc, wrong window dude! | 16:11 |
| telemonster | ooo latest works | 16:12 |
| telemonster | now it's issues of users being authorized for projects (cloudadmin not authorized for any projects). | 16:13 |
| marekd | survey: the best way to cache my tokens between cli calls? some super simplified memcache-like mechanism? | 16:14 |
| marekd | keyring seems to keep asking for a password everytime I trie to get data from it. | 16:15 |
| *** henrynash has joined #openstack-keystone | 16:16 | |
| gordc | stevemar: someone needs to implement proper eyetracking window switching ASAP. | 16:16 |
| gordc | stevemar: the tech has existed for years. | 16:16 |
| stevemar | marekd, export my_password=blahblah - done, totally secure | 16:18 |
| marekd | stevemar: ?? | 16:18 |
| stevemar | marekd, (was a bad joke, sorry) | 16:18 |
| marekd | aaaaa, you are referring to my question, right? | 16:18 |
| stevemar | yes | 16:18 |
| marekd | sorry, didnt' get it at first | 16:19 |
| marekd | :-) | 16:19 |
| marekd | i can store it in files | 16:21 |
| marekd | but that's well...prehistoric? | 16:21 |
| ayoung | telemonster, "latest works" meaning Juno? Master? | 16:24 |
| ayoung | marekd, well, not always | 16:24 |
| ayoung | marekd, for example, passing passwords on command lines means that passwords are recoverable from /proc | 16:24 |
| ayoung | putting it in a file and passing the file name might be better. | 16:25 |
| telemonster | sorry, I used this: https://github.com/openstack/keystone/blob/9c15b73f8361ce8606a531b5765c94b3927d99c4/keystone/common/ldap/core.py | 16:25 |
| *** agireud has joined #openstack-keystone | 16:25 | |
| telemonster | Now battling this: User OpenStack Admin is unauthorized for tenant c559b2ddf24d4ebc8 | 16:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update federation docs to point to specs.o.org https://review.openstack.org/134590 | 16:26 |
| henrynash | stevemar, lbragstad: looking for two brave soles to push the button and get the split rolling: https://review.openstack.org/#/c/130954/ | 16:26 |
| henrynash | stevemar: only change from last patch is doc change and removal of one out of date copyright notice | 16:27 |
| stevemar | henrynash, ohhhh boy | 16:28 |
| lbragstad | :) | 16:28 |
| rodrigods | henrynash, just gave my +1 =) | 16:29 |
| henrynash | rodigods: thank ya kindly | 16:29 |
| stevemar | henrynash, i'll give it another once over | 16:30 |
| *** dtturner has quit IRC | 16:30 | |
| stevemar | this is a huge amount of code, but mostly moving things around | 16:30 |
| stevemar | s/mostly/completely | 16:30 |
| marekd | ayoung: storing them in env means the same. | 16:30 |
| henrynash | stevemar: just about….with a bit more pulled up to the manager where you need to speak to both types of backend | 16:31 |
| *** wwriverrat has joined #openstack-keystone | 16:31 | |
| *** wwriverrat has left #openstack-keystone | 16:31 | |
| ayoung | marekd, yes | 16:32 |
| ayoung | marekd, there are really no failsafe options | 16:32 |
| henrynash | lbragstad: just making sure I get the right one….you comment is about the tenant name being cleared, yes? | 16:33 |
| lbragstad | yeah, just the validation step that we have there. | 16:34 |
| lbragstad | I think that validation stuff from keystone/clean.py was from V2.0 stuff? | 16:34 |
| henrynash | lbragstad: ok, I’ll add a comment for that…..yeah, that was all copied unmodified | 16:34 |
| lbragstad | just wanting to make sure we don't lose the fix for that later on since it has been determined to do the validation stuff in the manager/controllers | 16:35 |
| *** _cjones_ has joined #openstack-keystone | 16:36 | |
| lbragstad | henrynash: thanks for adding that | 16:36 |
| henrynash | lbragstad: I’ll add it to the ldap driver as well | 16:36 |
| lbragstad | henrynash: perfect | 16:37 |
| ayoung | henrynash, lbragstad works for me | 16:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update keystone readme to point to specs.o.org https://review.openstack.org/134595 | 16:39 |
| stevemar | nooo ayoung - i wanted to +A it :( | 16:39 |
| ayoung | stevemar, Heh | 16:39 |
| stevemar | henrynash, i was too slow | 16:39 |
| stevemar | apologies sir | 16:39 |
| ayoung | stevemar, the +A rush is mine | 16:39 |
| marekd | ayoung: and you aware ofsome super simple key value store that could be used for the keystoneclient ? | 16:40 |
| ayoung | marekd, heh...so if you look at the direction Kerberos went, the credentials ended up in the Kernel keyring | 16:40 |
| ayoung | marekd, one reason to move toward Kerberos and/or X509 certificate authentication is to avoid these issues | 16:41 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 16:41 |
| ayoung | if someone cares enough about security to worry about these, they will have more secure mechanisms in place. We just need to support them | 16:41 |
| ayoung | we need an X509 story | 16:41 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 16:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 16:42 |
| *** gyee has joined #openstack-keystone | 16:42 | |
| henrynash | lbragstad: done | 16:44 |
| *** dims has joined #openstack-keystone | 16:47 | |
| *** dims has quit IRC | 16:49 | |
| *** ayoung_ has joined #openstack-keystone | 16:50 | |
| marekd | ayoung: kernel keyring has some affiliation with gnome-keyring (and hence python-keyring) ? | 16:51 |
| ayoung_ | ah, henrynash are we going to break people using the LDAP assignments by splitting the resource backend off of it? The default needs to match the assignment backend | 16:51 |
| ayoung_ | marekd, I think all three are separate | 16:51 |
| ayoung_ | but probably the devs know about each other | 16:51 |
| marekd | ok | 16:52 |
| marekd | i will google | 16:52 |
| henrynash | ayoung: so I did speak to Joe Savek about this….and I pointed him at the change…he seemed not too concerend….but it IS a change | 16:53 |
| *** ayoung_ has quit IRC | 16:54 | |
| *** ayoung_ has joined #openstack-keystone | 16:54 | |
| *** marcoemorais has joined #openstack-keystone | 16:55 | |
| ayoung_ | henrynash, it is cern that I would be concerned about. ... marekd ? | 16:57 |
| henrynash | ayoung: ah, ok…. | 16:57 |
| henrynash | marekd: see: https://review.openstack.org/#/c/130954 | 16:59 |
| *** comstud is now known as bearhands | 16:59 | |
| ayoung_ | henrynash, so to avoid breaking things last time around, we had a nasty hack: | 17:00 |
| ayoung_ | if the driver for the identity backend was LDAP, and no assignment driver was set, assume assignment should use LDAP | 17:01 |
| ayoung_ | need the same logic here | 17:01 |
| henrynash | ayoung_: I have included that! | 17:01 |
| ayoung_ | ah...that is what you mean by the identity driver chooses | 17:02 |
| ayoung_ | but it should be the assignment driver now | 17:02 |
| henrynash | ayoung_: …so if you just have identity set to LDAP, both resource and assignment will pick that up | 17:02 |
| ayoung_ | I thought we dropped the hack in recent versions | 17:02 |
| ayoung_ | henrynash, it is unfortunate we have no analoge for the sql migrations in the LDAP case. | 17:03 |
| henrynash | ayoung_: …no, it’s still there, if resource has no bacend set, it calls identity…and if assignment as no bacend set, it calls resource | 17:03 |
| ayoung_ | ah, ok... | 17:03 |
| *** gokrokve has quit IRC | 17:06 | |
| ayoung_ | henrynash, OK, I think that covers my concern | 17:07 |
| *** david-lyle_afk is now known as david-lyle | 17:07 | |
| ayoung_ | conCERN. Ugh. | 17:07 |
| henrynash | ayoung_: ha ha | 17:08 |
| ayoung_ | henrynash, I keep seeing that termie suggestion: # TODO(termie): turn this into a data object and move logic to driver | 17:10 |
| ayoung_ | I wanna do that, too | 17:11 |
| henrynash | ayoung_: does he mean driver or manager? | 17:11 |
| ayoung_ | driver...it is LDAP specific | 17:11 |
| *** elynn_ has quit IRC | 17:12 | |
| openstackgerrit | Merged openstack/keystone: Move test_pemutils.py to unit test directory https://review.openstack.org/134233 | 17:27 |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134549 | 17:28 |
| *** _cjones_ has quit IRC | 17:29 | |
| *** _cjones_ has joined #openstack-keystone | 17:29 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Cache unscoped SAML tokens locally https://review.openstack.org/134606 | 17:32 |
| *** harlowja has joined #openstack-keystone | 17:35 | |
| *** henrynash has quit IRC | 17:35 | |
| *** harlowja has quit IRC | 17:37 | |
| *** harlowja has joined #openstack-keystone | 17:37 | |
| *** links has quit IRC | 17:37 | |
| *** rharwood has quit IRC | 17:38 | |
| *** rwsu has joined #openstack-keystone | 17:38 | |
| *** gokrokve has joined #openstack-keystone | 17:45 | |
| *** thedodd has quit IRC | 17:45 | |
| *** dims has joined #openstack-keystone | 17:47 | |
| *** _cjones_ has quit IRC | 17:52 | |
| *** dims is now known as dimsum__ | 17:52 | |
| *** _cjones_ has joined #openstack-keystone | 17:55 | |
| *** patrickeast has joined #openstack-keystone | 18:02 | |
| rodrigods | morganfainberg, addressed your concerns at https://review.openstack.org/#/c/117786/ | 18:04 |
| *** marcoemorais has quit IRC | 18:04 | |
| morganfainberg | rodrigods: thanks! Will look it over post coffee. | 18:04 |
| *** marcoemorais has joined #openstack-keystone | 18:05 | |
| rodrigods | morganfainberg, regarding parents/subtree visibility we will need to discuss the correct approach to it =) | 18:05 |
| morganfainberg | Right. | 18:05 |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134612 | 18:05 |
| *** marcoemorais has quit IRC | 18:05 | |
| *** marcoemorais has joined #openstack-keystone | 18:06 | |
| *** jistr has quit IRC | 18:07 | |
| *** dimsum__ has quit IRC | 18:12 | |
| *** marcoemorais has quit IRC | 18:14 | |
| *** marg7175 has quit IRC | 18:21 | |
| *** dimsum__ has joined #openstack-keystone | 18:22 | |
| *** dimsum__ has quit IRC | 18:31 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Enable support for IETF ABFAB as a federation protocol. https://review.openstack.org/134549 | 18:33 |
| *** gordc has quit IRC | 18:34 | |
| *** Lupul has quit IRC | 18:34 | |
| *** marcoemorais has joined #openstack-keystone | 18:35 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134549 | 18:39 |
| *** topol has joined #openstack-keystone | 18:40 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134549 | 18:40 |
| *** amcrn has joined #openstack-keystone | 18:40 | |
| *** topol has quit IRC | 18:43 | |
| *** saipandi has joined #openstack-keystone | 18:44 | |
| *** Lupul has joined #openstack-keystone | 18:54 | |
| *** harlowja is now known as harlowja_away | 18:58 | |
| *** gokrokve has quit IRC | 18:59 | |
| *** gokrokve has joined #openstack-keystone | 18:59 | |
| david-lyle | if I have a role on a project in a domain, I don't automatically have a role on the domain, correct? That is to say, if I can obtain a project scoped token, does that mean I can also obtain a domain scoped token on that domain just based on that project role? | 19:02 |
| *** marcoemorais has quit IRC | 19:02 | |
| *** marcoemorais has joined #openstack-keystone | 19:02 | |
| david-lyle | or do both have to be explicitly granted | 19:02 |
| *** marcoemorais has quit IRC | 19:03 | |
| *** marcoemorais has joined #openstack-keystone | 19:04 | |
| *** lhcheng_ has quit IRC | 19:06 | |
| *** marcoemorais has quit IRC | 19:06 | |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| ayoung_ | david-lyle, your initial statement is correct | 19:07 |
| *** marcoemorais has quit IRC | 19:07 | |
| *** marcoemorais has joined #openstack-keystone | 19:07 | |
| david-lyle | ayoung_: so I can obtain a project scoped token, but be unable to obtain a domain scoped token on that domain based on whether I have a role on the domain | 19:07 |
| ayoung_ | do you mean | 19:08 |
| ayoung_ | "I can obtain a project scoped token, but be unable to obtain a domain scoped token on that domain based on whether I have a role on a project in the domain" | 19:08 |
| ayoung_ | david-lyle, so, yeah, this is confusing | 19:08 |
| ayoung_ | with Hierarchical projects, it is going to get mildly more so, but I think it will eventually shake out | 19:09 |
| *** amirosh has joined #openstack-keystone | 19:09 | |
| ayoung_ | so since project is under domain, getting a role on a project does not give you a role (implicit or explicit) on the domain | 19:09 |
| david-lyle | ok that makes sense | 19:09 |
| ayoung_ | david-lyle, with hierarchical multi-tenancy, that pattern is going to be expanded | 19:09 |
| *** nellysmitt has joined #openstack-keystone | 19:10 | |
| ayoung_ | role assignments will be (possibly) inherited down the tree, but not up | 19:10 |
| david-lyle | so I need a role on any entity that I want to get a scoped token to | 19:10 |
| raildo | ayoung, ++ | 19:10 |
| david-lyle | in both directions | 19:10 |
| david-lyle | for now | 19:10 |
| ayoung_ | yes | 19:10 |
| david-lyle | I understand inherited roles could change that | 19:10 |
| raildo | david-lyle, in hierarchical project, you have to grant a inherited role, to get a token for all the projects in the hierarchy | 19:11 |
| david-lyle | trying to write up the bp to start the horizon work to at least support what's there now | 19:11 |
| *** harlowja_away is now known as harlowja | 19:11 | |
| david-lyle | we'll cover the hierarchical tenants once that's solidified | 19:11 |
| *** nellysmitt has quit IRC | 19:14 | |
| david-lyle | ayoung_, raildo: thanks! | 19:14 |
| raildo | np :) | 19:15 |
| *** thedodd has joined #openstack-keystone | 19:15 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Fix enable/disable projects behaviour for HM https://review.openstack.org/134629 | 19:19 |
| rodrigods | morganfainberg, ayoung, ^^ | 19:20 |
| rodrigods | noticed that have described the wrong behavior there | 19:20 |
| *** kobtea has joined #openstack-keystone | 19:21 | |
| *** marg7175 has joined #openstack-keystone | 19:22 | |
| *** kobtea has quit IRC | 19:26 | |
| *** jacorob has joined #openstack-keystone | 19:30 | |
| *** lhcheng has joined #openstack-keystone | 19:53 | |
| ayoung_ | +2 | 19:57 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Token Provider Cleanup Spec https://review.openstack.org/134314 | 20:03 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Kilo version of non-persistent token specification https://review.openstack.org/129736 | 20:03 |
| morganfainberg | rodrigods, +3 | 20:04 |
| *** topol has joined #openstack-keystone | 20:05 | |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/133783/ I responded to your comment | 20:05 |
| openstackgerrit | Merged openstack/keystone-specs: Fix enable/disable projects behaviour for HM https://review.openstack.org/134629 | 20:05 |
| lbragstad | morganfainberg: awesome, thanks | 20:06 |
| morganfainberg | lbragstad, but basicaly not specified for a reason. | 20:06 |
| lbragstad | morganfainberg: fair enough | 20:06 |
| *** packet has quit IRC | 20:09 | |
| openstackgerrit | Merged openstack/keystone-specs: Add small comment for partially implemented specs in backlog https://review.openstack.org/133783 | 20:10 |
| *** jacorob has quit IRC | 20:11 | |
| *** nellysmitt has joined #openstack-keystone | 20:12 | |
| *** _cjones_ has quit IRC | 20:15 | |
| *** thedodd has quit IRC | 20:18 | |
| morganfainberg | lbragstad, any reason i shouldn't +A the changes following that comment (the spec repo comments / project info / etc) | 20:22 |
| morganfainberg | lbragstad, i noticed you +2'd some of them, but before I go through and +A just making sure it wasn't a reason you held back | 20:22 |
| lbragstad | morganfainberg: I just waited for your response to the question I had on the first patch, I'll kick them through | 20:23 |
| morganfainberg | k | 20:23 |
| morganfainberg | thanks | 20:23 |
| lbragstad | morganfainberg: no problem, | 20:23 |
| openstackgerrit | Merged openstack/keystone-specs: Add project documentation links to index https://review.openstack.org/133810 | 20:25 |
| openstackgerrit | Merged openstack/keystone-specs: Add warning about milestone 2 deadline https://review.openstack.org/133813 | 20:26 |
| *** jacorob has joined #openstack-keystone | 20:29 | |
| *** sigmavirus24 has joined #openstack-keystone | 20:30 | |
| *** marcoemorais has quit IRC | 20:33 | |
| *** marcoemorais has joined #openstack-keystone | 20:33 | |
| stevemar | morganfainberg, re: you last comment about the assignment split | 20:44 |
| morganfainberg | i saw it | 20:44 |
| stevemar | do we really support 3rd party code? as in we need a proxy / function for deprecation? | 20:44 |
| stevemar | that seems ... outside the scope, it's something we only expose internally | 20:44 |
| morganfainberg | we do. | 20:45 |
| morganfainberg | i've had operators come and say "OMG WHERE DID THIS ALL MOVE TO!?" | 20:45 |
| stevemar | hmph, okay | 20:45 |
| morganfainberg | because they wrote an extension that relies on 'identity_api' | 20:45 |
| stevemar | i suppose | 20:45 |
| stevemar | good to know for next time i guess | 20:46 |
| morganfainberg | henry did put the scafolding in for that proxy | 20:46 |
| morganfainberg | now... he didn't mark them as @deprecated though :P | 20:46 |
| * morganfainberg is still reading the code. but it's a beastly patch. | 20:47 | |
| morganfainberg | the bigest concern i have is options moving and not doing the same thing they used to | 20:47 |
| morganfainberg | and not having deprecated options. | 20:47 |
| rodrigods | just -1d a patch where I'm author, am I crazy? (just waiting for more eyes on it before sending another patch) | 20:50 |
| morganfainberg | hehe | 20:51 |
| morganfainberg | you'll see us do that every now and again | 20:51 |
| *** henrynash has joined #openstack-keystone | 20:52 | |
| rodrigods | phew... had the feeling that without the -1, I'd forget to fix the issue | 20:52 |
| raildo | rodrigods, i work with you, so yes, I think you are a little crazy hahaha | 20:53 |
| rodrigods | raildo, =( | 20:53 |
| *** jacorob has quit IRC | 20:54 | |
| ayoung_ | morganfainberg, I think I want to change the spec. We should make bullet points for a lot of the stuff in paragraphs: CI impact, configuriation options , upgrade, | 20:58 |
| *** _cjones_ has joined #openstack-keystone | 21:00 | |
| ayoung_ | I want to change the spec *template* that is | 21:02 |
| *** amirosh has quit IRC | 21:02 | |
| *** rustlebee is now known as russellb | 21:03 | |
| *** amirosh has joined #openstack-keystone | 21:03 | |
| morganfainberg | sure | 21:06 |
| morganfainberg | do it | 21:06 |
| morganfainberg | :) | 21:06 |
| *** amirosh has quit IRC | 21:07 | |
| *** nkinder_afk is now known as nkinder | 21:08 | |
| stevemar | ayoung, i'm down for bullet points | 21:09 |
| ayoung_ | will do | 21:09 |
| stevemar | i struggle to make complete sentences, let alone paragraphs. | 21:09 |
| ayoung_ | straightening out all my policy specs first | 21:09 |
| *** fifieldt has quit IRC | 21:10 | |
| *** jacorob has joined #openstack-keystone | 21:10 | |
| *** raildo has quit IRC | 21:11 | |
| *** radez is now known as radez_g0n3 | 21:22 | |
| *** fifieldt has joined #openstack-keystone | 21:23 | |
| *** dimsum__ has joined #openstack-keystone | 21:32 | |
| *** marcoemorais has quit IRC | 21:34 | |
| *** dims_ has joined #openstack-keystone | 21:35 | |
| *** dimsum__ has quit IRC | 21:37 | |
| *** klrmn has joined #openstack-keystone | 21:41 | |
| klrmn | after teaching keystone to run as a service with the —debug flag, i discover that *something* is sending keystone a SIGINT almost right after it starts. is this something it might be doing to itself, or do i need to look for an external cause? | 21:42 |
| morganfainberg | klrmn, i would hope we're not sending keystone a SIGINT internally | 21:43 |
| morganfainberg | klrmn, and you're running keystone as a service under eventlet? | 21:43 |
| morganfainberg | klrmn, i strongly recommend using mod_wsgi instead. | 21:43 |
| klrmn | morganfainberg: this is for a test server to prove interoperability rather than a production server, so if this is a scalability issue…. | 21:46 |
| *** marcoemorais has joined #openstack-keystone | 21:46 | |
| morganfainberg | klrmn, in general mod_wsgi is *always* a better deployment method. but eventlet is fine for very very basic testing | 21:47 |
| klrmn | morganfainberg: *nod* the person who set this up for me originally is on the other side of the planet, and presumably sleeping. i figured i'd ask rather than put it on a back-burner til monday | 21:47 |
| *** topol has quit IRC | 21:52 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Hierarchical Roles https://review.openstack.org/125704 | 21:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 21:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Enforce policy from keystoneclient https://review.openstack.org/133480 | 21:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Fetch policy.json from server https://review.openstack.org/134655 | 21:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: unified policy file https://review.openstack.org/134656 | 21:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Default Policy https://review.openstack.org/134657 | 21:55 |
| *** htruta_ has joined #openstack-keystone | 21:57 | |
| stevemar | ayoung, morganfainberg question for y'all | 22:02 |
| stevemar | i think we all agree that we need a publicly available endpoint to list public idps | 22:03 |
| stevemar | should that be available on the client side? or are we just going to tell someone to do a requests.GET call? | 22:03 |
| rodrigods | ayoung_, already working in the oslo.policy spec (following this template: https://github.com/openstack/oslo-specs/blob/master/specs/graduation-template.rst) plan to send it to review this weekend or monday | 22:03 |
| morganfainberg | stevemar, it likely should be available on client side. | 22:04 |
| stevemar | morganfainberg, okay the how do we create a client with no credentials :) | 22:04 |
| ayoung_ | stevemar, we don't | 22:04 |
| ayoung_ | stevemar, its going to be like discovery | 22:05 |
| morganfainberg | ayoung_, ++ | 22:05 |
| *** marcoemorais has quit IRC | 22:05 | |
| *** marcoemorais1 has joined #openstack-keystone | 22:05 | |
| ayoung_ | now that I said that, I have to think what it means | 22:05 |
| *** marcoemorais1 has quit IRC | 22:06 | |
| *** marcoemorais has joined #openstack-keystone | 22:06 | |
| ayoung_ | damnit, why won't my alternate nickname time out | 22:06 |
| stevemar | ayoung, elaborate? | 22:07 |
| *** marg7175 has quit IRC | 22:07 | |
| morganfainberg | ayoung_, ghost it? | 22:07 |
| morganfainberg | ayoung_, or is it a you need to issue a ... uh .. release on it? | 22:08 |
| *** marg7175 has joined #openstack-keystone | 22:11 | |
| ayoung_ | morganfainberg, I managed to torque up the password on it. I sent in a reset, and the password should have been reset, but the ghost command is not working | 22:14 |
| morganfainberg | ayoung_, use "release" | 22:14 |
| *** ayoung is now known as Guest32088 | 22:15 | |
| ayoung_ | morganfainberg, ok...so far so good. | 22:15 |
| *** marg7175_ has joined #openstack-keystone | 22:21 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: IETF ABFAB federation protocol. https://review.openstack.org/134549 | 22:23 |
| *** ayoung_ is now known as ayoung | 22:23 | |
| *** marg7175 has quit IRC | 22:24 | |
| *** dgonzalez has joined #openstack-keystone | 22:27 | |
| *** Viswanath has joined #openstack-keystone | 22:42 | |
| ayoung | morganfainberg, release followed by regain.... | 22:44 |
| *** edmondsw has quit IRC | 22:44 | |
| morganfainberg | ayoung, ah | 22:44 |
| morganfainberg | ayoung, there ya go | 22:45 |
| *** Viswanath has quit IRC | 22:45 | |
| stevemar | morganfainberg, so whats going to happen with uuid tokens when non-persistent goes int | 22:46 |
| stevemar | dies in n+2 releases ? (or stays alive by popular demand) | 22:46 |
| morganfainberg | stays alive until we don't want to support it anymore +2 | 22:47 |
| morganfainberg | i don't expect it to go away unless something like AE-Token takes it's spot | 22:47 |
| *** marcoemorais1 has joined #openstack-keystone | 22:47 | |
| morganfainberg | UUID is a nice *easy* to understand provider | 22:47 |
| stevemar | cool | 22:48 |
| morganfainberg | PKI wont need to persist, (will definitly go non-persistent) and other providers ??? | 22:48 |
| *** aix has quit IRC | 22:48 | |
| stevemar | morganfainberg, i'm really happy that we all learned how to create better specs | 22:49 |
| stevemar | removing the cruft from the template help | 22:49 |
| stevemar | and it seems like the growing pains are over | 22:49 |
| stevemar | IIRC, we were meeting in SAT (mid cycle) to finalize specs last time :( so late to the game | 22:50 |
| *** klrmn has left #openstack-keystone | 22:50 | |
| *** marcoemorais has quit IRC | 22:51 | |
| *** dgonzalez has quit IRC | 22:51 | |
| *** jacorob has quit IRC | 22:52 | |
| *** kobtea has joined #openstack-keystone | 22:59 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:59 | |
| *** kobtea has quit IRC | 23:03 | |
| *** marg7175_ has quit IRC | 23:05 | |
| *** agireud has quit IRC | 23:08 | |
| *** zzzeek has quit IRC | 23:09 | |
| *** _cjones_ has quit IRC | 23:09 | |
| *** _cjones_ has joined #openstack-keystone | 23:09 | |
| *** saipandi has quit IRC | 23:10 | |
| *** htruta_ has quit IRC | 23:13 | |
| *** stevemar has quit IRC | 23:16 | |
| *** gyee has quit IRC | 23:36 | |
| *** marcoemorais1 has quit IRC | 23:38 | |
| *** marcoemorais has joined #openstack-keystone | 23:38 | |
| *** nkinder has quit IRC | 23:40 | |
| *** lhcheng has quit IRC | 23:47 | |
| *** henrynash has quit IRC | 23:49 | |
| *** marcoemorais has quit IRC | 23:57 | |
| *** marcoemorais has joined #openstack-keystone | 23:57 | |
| *** marg7175 has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!