| richm | stevemar2: ++ | 00:02 |
|---|---|---|
| stevemar2 | yay | 00:02 |
| stevemar2 | ayoung, you were right about the federated token stuff :) | 00:03 |
| stevemar2 | lets just look at the auth_context and call it there | 00:03 |
| stevemar2 | err and call it based on that, the other auth plugins should never provide that sort of info | 00:04 |
| *** Viswanath has joined #openstack-keystone | 00:04 | |
| *** tellesnobrega has joined #openstack-keystone | 00:05 | |
| *** Viswanath has quit IRC | 00:09 | |
| *** chrisshattuck has quit IRC | 00:09 | |
| morganfainberg | stevemar2 cause stevemar and stevemar1 are shady people | 00:09 |
| stevemar2 | morganfainberg, so shady | 00:10 |
| stevemar2 | do not trust those guys | 00:10 |
| morganfainberg | right?! | 00:10 |
| stevemar2 | bunch a jerks | 00:11 |
| *** morganfainberg changes topic to "Blocking reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Keystone Midcycle Details: https://www.morganfainberg.com/blog/2014/11/18/keystone-hackathon-kilo/" | 00:12 | |
| *** richm has quit IRC | 00:15 | |
| *** lhcheng_ is now known as lhcheng | 00:18 | |
| *** r-daneel has quit IRC | 00:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Update requests-mock syntax https://review.openstack.org/131380 | 00:25 |
| *** radez is now known as radez_g0n3 | 00:27 | |
| *** NM has quit IRC | 00:28 | |
| *** david-lyle is now known as david-lyle_afk | 00:33 | |
| morganfainberg | stevemar2, ping | 00:44 |
| morganfainberg | stevemar2, re split assignment from resource | 00:44 |
| stevemar2 | morganfainberg, pong2 | 00:44 |
| morganfainberg | trying to get my head wrapped around the significant benenfit of isolating role from roleassignment | 00:44 |
| morganfainberg | i talked to henrynash about it earlier, but looking for more insight | 00:44 |
| morganfainberg | is there a real benefit to splitting the role id/name and keeping that as a resource? | 00:45 |
| morganfainberg | i'm just having a hard time seeing the implementation that follows for a custom assignment backend | 00:45 |
| stevemar2 | morganfainberg, i think it's architecturally better | 00:45 |
| morganfainberg | stevemar2, i am *for* the split. | 00:46 |
| stevemar2 | and yeah, it allows for a pluggable assignments | 00:46 |
| stevemar2 | in case someone doesn't like ours | 00:46 |
| morganfainberg | lets be clear, i'm just trying to ensure we're not backing ourselves into a different corner | 00:46 |
| morganfainberg | if they don't like our assignment backend, wouldn't Roles typeically be managed there as well? | 00:46 |
| stevemar2 | ah i see what you mean | 00:47 |
| morganfainberg | henry was using the concept of ABAC - but then if the role is managed outside of role-assignment... you now need glue to make it happen. | 00:47 |
| morganfainberg | since his example was "use another interface to manage the ABAC assignment" | 00:47 |
| morganfainberg | great, i think i can handle the construct of project.domain being independant | 00:47 |
| morganfainberg | but roles? | 00:48 |
| morganfainberg | roles *could* be a resource | 00:48 |
| stevemar2 | morganfainberg, you bring up a good point | 00:48 |
| morganfainberg | or role could be part of role-assignment | 00:48 |
| morganfainberg | and i don't want to play the flip-flop game and shuffle all this around all over the place | 00:49 |
| stevemar2 | i agree that shuffling it bad | 00:49 |
| stevemar2 | but this one seems like a good shuffle :) | 00:49 |
| morganfainberg | the way I see it, roles tie directly to role assignment, role assignment is acting on the Roles with a resource | 00:50 |
| morganfainberg | you have Actor, Resource, Role | 00:50 |
| morganfainberg | not Actor, Resource(project|domain), Resource(Role), Mapping | 00:50 |
| stevemar2 | and role assignments link all three up | 00:50 |
| morganfainberg | right but they are directly tied to the Role. | 00:51 |
| morganfainberg | in an ABAC system, I'd expect the "role" definition to be something more like "user-has_x and user_has_y but not Z" | 00:51 |
| morganfainberg | but if you now need an explicit link of Role(resource) and Project(resource) and actor | 00:52 |
| morganfainberg | i think you're in the same place we are today, just with a weird pluggable thing mixed in | 00:52 |
| morganfainberg | you'll still need our assignment logic to know what a "role" is, since it's not part of the assignment backend | 00:52 |
| * morganfainberg might be over-thinking it | 00:53 | |
| morganfainberg | but somehow i am getting a "this doesn't look right" vibe from roles being a resource | 00:53 |
| openstackgerrit | guang-yee proposed openstack/keystone: make sample_data.sh account for the default options in keystone.conf https://review.openstack.org/136199 | 00:54 |
| *** edmondsw has joined #openstack-keystone | 00:56 | |
| *** ncoghlan has joined #openstack-keystone | 01:02 | |
| *** afaranha has quit IRC | 01:02 | |
| *** tellesnobrega_ has quit IRC | 01:04 | |
| *** samuelms-away has quit IRC | 01:05 | |
| *** htruta has quit IRC | 01:05 | |
| *** raildo has quit IRC | 01:05 | |
| *** edmondsw has quit IRC | 01:07 | |
| *** zzzeek has quit IRC | 01:09 | |
| *** diegows has quit IRC | 01:14 | |
| *** chrisshattuck has joined #openstack-keystone | 01:16 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Expanded mutable hacking checks https://review.openstack.org/136208 | 01:41 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a bit of WSGI code converts unicode to str https://review.openstack.org/136209 | 01:41 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of inspect.getcallargs https://review.openstack.org/136210 | 01:41 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes a Py2.6 version of assertSetEqual https://review.openstack.org/136211 | 01:41 |
| gyee | jamielennox, you have time for this? https://review.openstack.org/#/c/113735/ | 01:44 |
| jamielennox | gyee: yep it's on my list for next to fix in nova, i remember last time i tried though i ended up making a bunch of changes in neutron client | 01:44 |
| gyee | want me to work on it? | 01:45 |
| jamielennox | gyee: https://review.openstack.org/#/c/131098/ merged :) | 01:45 |
| gyee | weeee! | 01:45 |
| jamielennox | so i should be able to take the auth_plugin bits from there for neutron | 01:45 |
| gyee | yeah, similar change I think | 01:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use newer requests-mock syntax https://review.openstack.org/135468 | 01:48 |
| *** htruta_ has quit IRC | 02:05 | |
| *** jorge_munoz has quit IRC | 02:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: test some websso stuff https://review.openstack.org/136177 | 02:11 |
| *** dims has joined #openstack-keystone | 02:14 | |
| *** stevemar has joined #openstack-keystone | 02:18 | |
| *** ChanServ sets mode: +v stevemar | 02:18 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Always return the service name in the catalog https://review.openstack.org/135808 | 02:18 |
| *** stevemar2 has quit IRC | 02:21 | |
| *** stevemar has quit IRC | 02:23 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Always return the service name in the catalog https://review.openstack.org/135808 | 02:27 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:34 | |
| *** erkules_ has joined #openstack-keystone | 02:35 | |
| *** raildo has joined #openstack-keystone | 02:36 | |
| *** erkules has quit IRC | 02:37 | |
| *** htruta has joined #openstack-keystone | 02:37 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:38 | |
| *** samuelms-away has joined #openstack-keystone | 02:39 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:39 | |
| *** afaranha has joined #openstack-keystone | 02:39 | |
| *** designate has quit IRC | 02:42 | |
| *** afaranha has quit IRC | 02:44 | |
| *** NM has joined #openstack-keystone | 02:45 | |
| *** _cjones_ has quit IRC | 02:46 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 03:05 |
| *** stevemar has joined #openstack-keystone | 03:06 | |
| *** ChanServ sets mode: +v stevemar | 03:06 | |
| *** dims has quit IRC | 03:11 | |
| *** dims has joined #openstack-keystone | 03:13 | |
| *** lhcheng has quit IRC | 03:17 | |
| *** amcrn has quit IRC | 03:17 | |
| *** chrisshattuck has quit IRC | 03:20 | |
| *** NM has quit IRC | 03:21 | |
| *** harlowja is now known as harlowja_away | 03:39 | |
| *** dims has quit IRC | 03:48 | |
| *** jdennis has quit IRC | 03:51 | |
| stevemar | morganfainberg, i hate SSO | 03:51 |
| morganfainberg | stevemar, really? | 03:51 |
| stevemar | morganfainberg, yes, sort of, i don't know | 03:52 |
| *** abelity has joined #openstack-keystone | 03:52 | |
| stevemar | i have it sort of working, but the token i get back is unscoped, so listing projects (which horizon does) doesn't work | 03:52 |
| *** ncoghlan is now known as ncoghlan_afk | 03:56 | |
| *** afaranha has joined #openstack-keystone | 03:57 | |
| *** jdennis has joined #openstack-keystone | 04:07 | |
| abelity | i have tried to setup the mod_auth_cas with CAS as the identity provider, but when I do browser call to /v2.0/tenants after the authentication with CAS I see this "status expected to be of type int"... fails at the wsgi's start_response line no 1021 of the webob's response.py | 04:08 |
| abelity | is this a chunked encoding issue | 04:08 |
| *** Viswanath has joined #openstack-keystone | 04:09 | |
| *** topol has joined #openstack-keystone | 04:10 | |
| *** ChanServ sets mode: +v topol | 04:10 | |
| *** Viswanath has quit IRC | 04:13 | |
| *** chrisshattuck has joined #openstack-keystone | 04:25 | |
| *** oomichi_ has joined #openstack-keystone | 04:27 | |
| openstackgerrit | Merged openstack/keystone: Adds dynamic checking for mapped tokens https://review.openstack.org/133130 | 04:35 |
| *** david-ly_ has joined #openstack-keystone | 04:43 | |
| *** david-lyle_afk has quit IRC | 04:43 | |
| *** dims has joined #openstack-keystone | 04:49 | |
| *** tellesnobrega has quit IRC | 04:50 | |
| *** stevemar has quit IRC | 04:51 | |
| *** stevemar has joined #openstack-keystone | 04:52 | |
| *** ChanServ sets mode: +v stevemar | 04:52 | |
| *** oomichi_ has quit IRC | 04:52 | |
| *** dims has quit IRC | 04:55 | |
| *** abelity has quit IRC | 04:56 | |
| *** chrisshattuck has quit IRC | 05:00 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:03 | |
| *** jacorob has quit IRC | 05:09 | |
| *** afaranha has quit IRC | 05:15 | |
| *** htruta has quit IRC | 05:17 | |
| *** tellesnobrega_ has quit IRC | 05:17 | |
| *** htruta has joined #openstack-keystone | 05:17 | |
| *** tellesnobrega_ has joined #openstack-keystone | 05:18 | |
| *** afaranha has joined #openstack-keystone | 05:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 05:23 | |
| *** erkules_ is now known as erkules | 05:25 | |
| *** jdennis has quit IRC | 05:33 | |
| *** abelity has joined #openstack-keystone | 05:35 | |
| *** afaranha has quit IRC | 05:48 | |
| *** samuelms-away has quit IRC | 05:49 | |
| *** htruta has quit IRC | 05:49 | |
| *** samuelms-away has joined #openstack-keystone | 05:49 | |
| *** htruta has joined #openstack-keystone | 05:50 | |
| *** afaranha has joined #openstack-keystone | 05:50 | |
| *** ajayaa has joined #openstack-keystone | 06:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:05 |
| *** k4n0 has joined #openstack-keystone | 06:17 | |
| *** henrynash has joined #openstack-keystone | 06:32 | |
| *** ChanServ sets mode: +v henrynash | 06:32 | |
| *** afazekas has joined #openstack-keystone | 06:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: test some websso stuff https://review.openstack.org/136177 | 06:59 |
| *** topol has quit IRC | 07:04 | |
| *** MasterPiece has joined #openstack-keystone | 07:08 | |
| *** henrynash has quit IRC | 07:11 | |
| *** stevemar has quit IRC | 07:16 | |
| *** henrynash has joined #openstack-keystone | 07:17 | |
| *** ChanServ sets mode: +v henrynash | 07:17 | |
| marekd|away | abelity: Identity API 3 only | 07:22 |
| *** marekd|away is now known as marekd | 07:22 | |
| marekd | abelity: there is no local user in Keystone backend, right? | 07:35 |
| marekd | if you simply want to use saml authentication but with CAS you are advised to read some federation docs. | 07:35 |
| marekd | abelity: http://docs.openstack.org/developer/keystone/configure_federation.html | 07:36 |
| *** henrynash has quit IRC | 07:37 | |
| marekd | rodrigods: good change. Could add some tests Henry was asking for but...what the heck. | 07:41 |
| *** MasterPiece has quit IRC | 07:46 | |
| *** jaosorior has joined #openstack-keystone | 07:58 | |
| *** jamiec has quit IRC | 08:06 | |
| *** jamiec has joined #openstack-keystone | 08:08 | |
| *** ajayaa has quit IRC | 08:21 | |
| *** NM has joined #openstack-keystone | 08:25 | |
| *** ncoghlan has quit IRC | 08:28 | |
| *** ajayaa has joined #openstack-keystone | 08:33 | |
| *** jamiec has quit IRC | 08:39 | |
| *** links has joined #openstack-keystone | 08:39 | |
| *** jamiec has joined #openstack-keystone | 08:41 | |
| *** MasterPiece has joined #openstack-keystone | 08:47 | |
| *** ukalifon has joined #openstack-keystone | 09:09 | |
| marekd | lbragstad: ping me when you are online - wanted to ask few questions about AE tokens. | 09:41 |
| *** eglynn-nick is now known as eglynn | 09:45 | |
| *** lhcheng has joined #openstack-keystone | 09:53 | |
| *** k4n0 has quit IRC | 09:53 | |
| *** sluo_laptop has quit IRC | 10:02 | |
| *** aix has joined #openstack-keystone | 10:03 | |
| *** MasterPiece has quit IRC | 10:04 | |
| *** Shohei has joined #openstack-keystone | 10:07 | |
| *** mflobo has joined #openstack-keystone | 10:09 | |
| *** nellysmitt has joined #openstack-keystone | 10:19 | |
| *** kashyap has left #openstack-keystone | 10:26 | |
| *** tellesnobrega has joined #openstack-keystone | 10:28 | |
| *** NM has quit IRC | 10:36 | |
| *** tellesnobrega has quit IRC | 10:42 | |
| *** jaosorior has quit IRC | 10:43 | |
| zhiyan | ayoung: hey, updated testcases for my change on oslo-inc policy module at https://review.openstack.org/#/c/128881/3/tests/unit/test_policy.py as we talked yday, pls let me know your idea when/if you ok. thanks! | 10:48 |
| zhiyan | rodrigods: ^^ | 10:48 |
| *** amakarov_away is now known as amakarov | 10:55 | |
| *** ukalifon has quit IRC | 10:57 | |
| *** NM has joined #openstack-keystone | 10:58 | |
| *** diegows has joined #openstack-keystone | 11:04 | |
| *** diegows has quit IRC | 11:09 | |
| *** dims has joined #openstack-keystone | 11:11 | |
| *** ajayaa has quit IRC | 11:14 | |
| *** nellysmitt has quit IRC | 11:15 | |
| *** nellysmi_ has joined #openstack-keystone | 11:15 | |
| *** afaranha has quit IRC | 11:19 | |
| *** ajayaa has joined #openstack-keystone | 11:25 | |
| rodrigods | zhiyan, hey... was thinking about Julien comments | 11:46 |
| rodrigods | zhiyan, what do you think of having overwrite/force_reload in the __init__ | 11:47 |
| zhiyan | rodrigods: hm, i think oslo module needs support adoption requirements ..tbh | 11:47 |
| rodrigods | zhiyan, yes, that's true | 11:48 |
| zhiyan | rodrigods: technically it could work, but it's ugly, in such function context, we need to 'merge' both param and self.* one | 11:48 |
| zhiyan | and most case, there's no sense | 11:48 |
| rodrigods | zhiyan, yeah... if we could remove the force_reload from load_rules() :P | 11:49 |
| rodrigods | and use the class attribute | 11:50 |
| rodrigods | but I guess we don't want to break anything | 11:50 |
| rodrigods | zhiyan, will take a look in the tests | 11:50 |
| zhiyan | rodrigods: btw, i think current idea to make the interface be common | 11:50 |
| zhiyan | rodrigods: yes, that's a worth point as well! | 11:50 |
| *** tellesnobrega_ is now known as tellesnobrega | 11:54 | |
| *** uvirtbot has quit IRC | 12:09 | |
| *** MasterPiece has joined #openstack-keystone | 12:16 | |
| zhiyan | hi rodrigods, thanks for input, one question on your comments. | 12:25 |
| *** eglynn is now known as eglynn-lunch | 12:25 | |
| *** NM has quit IRC | 12:26 | |
| *** ajayaa has quit IRC | 12:26 | |
| zhiyan | rodrigods: you mean testing the combination of force_reload=False + overwrite=True/False? | 12:28 |
| rodrigods | zhiyan, yes | 12:31 |
| rodrigods | makes sense? | 12:31 |
| zhiyan | rodrigods: humm, i think the handling of whether to overwrite rules with (re)loaded polices is only happened when force_reload=True | 12:33 |
| rodrigods | zhiyan, you mean, the overwrite is only considered when force_reload=True? | 12:34 |
| zhiyan | rodrigods: yes, am i miss anything? | 12:34 |
| *** afaranha has joined #openstack-keystone | 12:35 | |
| rodrigods | zhiyan, yes, you are right :) | 12:38 |
| zhiyan | rodrigods: good to know | 12:38 |
| zhiyan | rodrigods: i will update the code according to your inline comment | 12:39 |
| rodrigods | zhiyan, great! :) | 12:39 |
| zhiyan | rodrigods: thanks man :) | 12:39 |
| rodrigods | zhiyan, np | 12:40 |
| *** ajayaa has joined #openstack-keystone | 12:46 | |
| openstackgerrit | Sridhar Gaddam proposed openstack/python-keystoneclient: Curl statements to include globoff for IPv6 URLs https://review.openstack.org/136327 | 13:01 |
| *** topol has joined #openstack-keystone | 13:03 | |
| *** ChanServ sets mode: +v topol | 13:03 | |
| *** samuelms-away is now known as samuelms | 13:04 | |
| *** edmondsw has joined #openstack-keystone | 13:07 | |
| rodrigods | dstanek, have a review that might need your opinion: https://review.openstack.org/#/c/132894/ | 13:08 |
| dstanek | rodrigods: we were using _ without importing it? | 13:10 |
| rodrigods | dstanek, exactly | 13:10 |
| dstanek | rodrigods: i thought we removed all of that magic :-( | 13:10 |
| dstanek | rodrigods: or maybe we did and the tests don't hit that error condition | 13:11 |
| rodrigods | dstanek, hmm true, maybe we should add this test, right? | 13:11 |
| *** diegows has joined #openstack-keystone | 13:13 | |
| dstanek | rodrigods: yes, actually try adding a test without that change and see if it fails | 13:14 |
| rodrigods | dstanek, I added an extra _() in a place without a conditional branch and it failed, will try to write a test to cover the else: case there | 13:15 |
| *** jdennis has joined #openstack-keystone | 13:17 | |
| *** jamielennox is now known as jamielennox|away | 13:20 | |
| marekd | dstanek: you wanted to talk yesterdat | 13:20 |
| dstanek | marekd: i answered my own question :-) | 13:21 |
| marekd | dstanek: cool | 13:21 |
| *** bknudson has quit IRC | 13:23 | |
| marekd | rodrigods: what coverage tests show? | 13:27 |
| *** topol has quit IRC | 13:27 | |
| rodrigods | marekd, you may ask dstanek | 13:27 |
| rodrigods | a line from federation/controllers is using _() without importing _ | 13:28 |
| dstanek | for federation? | 13:28 |
| dstanek | marekd: rodrigods: only look at the federation files because i only ran the federation tests in the last run: http://162.242.175.31:9966/cover/ | 13:32 |
| dstanek | federation has very, very good coverage | 13:33 |
| lhcheng | dstanek: ping | 13:34 |
| dstanek | lhcheng: pong | 13:36 |
| lhcheng | dstanek: thanks for the review | 13:36 |
| lhcheng | dstanek: I added my response on the comments, would appreciate your response before I move forward applying the comments. https://review.openstack.org/#/c/135808/5/keystone/tests/test_catalog.py | 13:37 |
| dstanek | lhcheng: just responded | 13:38 |
| lhcheng | dstanek: thanks! | 13:39 |
| dstanek | lhcheng: i think it needs to be separate because it may indicate a bigger problem | 13:39 |
| lhcheng | for fixing tests, does it require a launchpad too? | 13:40 |
| dstanek | lhcheng: if it is truly required then the tests shouldn't pass | 13:40 |
| lhcheng | dstanek: agree | 13:40 |
| lhcheng | *launchpad bug | 13:40 |
| dstanek | lhcheng: probably need a bug describing what is broken; because that line isn't required to make the tests pass | 13:41 |
| dstanek | lhcheng: so that mean to me that's it's not actually required or we are not testing the thing that validates | 13:41 |
| lhcheng | dstanek: yup! I can open the bug to track it. | 13:42 |
| *** tellesnobrega_ has joined #openstack-keystone | 13:45 | |
| dstanek | lhcheng: thx | 13:47 |
| dstanek | lhcheng: paste a link here once you do | 13:48 |
| *** gordc has joined #openstack-keystone | 13:48 | |
| *** dims is now known as dimsum__ | 13:49 | |
| *** bknudson has joined #openstack-keystone | 13:51 | |
| *** ChanServ sets mode: +v bknudson | 13:51 | |
| *** MasterPiece has left #openstack-keystone | 13:51 | |
| lhcheng | https://bugs.launchpad.net/keystone/+bug/1394995 | 13:51 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add import i18n to federation/controllers.py https://review.openstack.org/132894 | 13:53 |
| marekd | what is the purpose of the 'target' in the policies ? | 13:54 |
| rodrigods | marekd, the object is being "targeted" | 13:55 |
| *** radez_g0n3 is now known as radez | 13:55 | |
| rodrigods | dstanek, added the test =) | 13:55 |
| marekd | so, for instance i might add a rule that certain role can be granted on domain X ? | 13:55 |
| marekd | and domainX will be this target.domain.name? | 13:56 |
| marekd | well, certain role can be granted to domainX *only* | 13:56 |
| rodrigods | marekd, in theory yes, not sure if it will work | 13:56 |
| rodrigods | right now we are trying to avoid a domain_admin to give a cloud_admin | 13:56 |
| rodrigods | in projects that doesn't understand domains | 13:57 |
| marekd | ok, domain was an example | 13:57 |
| marekd | could also be project | 13:57 |
| marekd | rodrigods: or...i don't know...a role can be granted only to user 'marek' | 13:58 |
| marekd | and then i will have two targets : target.role.name and target.user.name | 13:58 |
| rodrigods | marekd, yep, I think it could work | 13:59 |
| marekd | rodrigods: ok | 14:00 |
| marekd | thanks. | 14:00 |
| *** diegows has quit IRC | 14:00 | |
| marekd | “identity:get_project”: [["rule:admin_required", | 14:02 |
| marekd | "domain_id:%(target.project.domain_id)s"]], | 14:02 |
| marekd | “identity:list_projects”: [["rule:admin_required", "domain_id:%(domain_id)s"]], | 14:02 |
| marekd | so the difference here between list and get calls is probably you need target in list cause you don't specify domain_id in the url? | 14:03 |
| *** jistr has joined #openstack-keystone | 14:03 | |
| *** jistr is now known as jistr|mtg | 14:04 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 14:05 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 14:05 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Fix paste config option conversion for auth options https://review.openstack.org/131914 | 14:05 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 14:05 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 14:05 |
| *** mflobo_ has joined #openstack-keystone | 14:06 | |
| *** eglynn-lunch is now known as eglynn | 14:07 | |
| *** mflobo has quit IRC | 14:08 | |
| zhiyan | ayoung: hey, one question added in that change. not sure if you think force_reload flag could stay there as a param of enforc() ? | 14:09 |
| ayoung | zhiyan, cuz I am not sure myself.... | 14:09 |
| zhiyan | ayoung: mh | 14:10 |
| zhiyan | ayoung: any help i can do for it? | 14:10 |
| *** tellesnobrega_ has quit IRC | 14:11 | |
| rodrigods | ayoung, thought about putting the force_reload in __init__ as well, but it can break currently usage, right? | 14:12 |
| *** mflobo has joined #openstack-keystone | 14:14 | |
| *** ctracey has quit IRC | 14:15 | |
| *** mflobo_ has quit IRC | 14:16 | |
| ayoung | rodrigods, not sure... | 14:16 |
| ayoung | zhiyan, why do we need force reload on a specific enforce call? | 14:16 |
| *** rm_work has quit IRC | 14:16 | |
| *** rm_work has joined #openstack-keystone | 14:17 | |
| ayoung | I mean....we could always have it as a deliberate separate call or whatever....why have it on enforce? | 14:17 |
| *** rm_work has quit IRC | 14:17 | |
| *** rm_work has joined #openstack-keystone | 14:17 | |
| *** ctracey has joined #openstack-keystone | 14:17 | |
| zhiyan | ayoung: if i read you correct, i explained it in my first comment in https://review.openstack.org/#/c/128881/2/openstack/common/policy.py | 14:19 |
| *** tellesnobrega_ has joined #openstack-keystone | 14:20 | |
| *** joesavak has joined #openstack-keystone | 14:21 | |
| ayoung | zhiyan, I think reload is different than force_overwrite | 14:21 |
| zhiyan | ayoung: yes | 14:21 |
| ayoung | reload in enforce is putting two calls together | 14:21 |
| ayoung | if we already had a reload call, it would not be necessary to have on enforce | 14:22 |
| lbragstad | marekd: | 14:22 |
| lbragstad | marekd: ping | 14:22 |
| ayoung | the question is should we even have one | 14:22 |
| ayoung | if you don;t need it for this use case, though, remove it. We can add it when we do need it | 14:22 |
| zhiyan | ayoung: without force_reload=True, reloaded flag fileutils.read_cached_file retruned will all be False | 14:22 |
| zhiyan | ayoung: i think i need it | 14:23 |
| ayoung | zhiyan, when are the ProtectProperty rules generated? are they ever regenerated? | 14:24 |
| zhiyan | ayoung: due to at L266, if reloaded=False, and self.rules contain in memory rules, then policy files will be skipped | 14:24 |
| zhiyan | 1 sec | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change tenant to project https://review.openstack.org/127066 | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Correct tests to use strings in conf https://review.openstack.org/128655 | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Fix paste config option conversion for auth options https://review.openstack.org/131914 | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change admin user to service user. https://review.openstack.org/127075 | 14:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change occurrences of keystone to identity server https://review.openstack.org/127062 | 14:24 |
| zhiyan | ayoung: yes, the are | 14:26 |
| ayoung | zhiyan, what does one of these rules look like? | 14:27 |
| *** mkoderer has joined #openstack-keystone | 14:27 | |
| *** xiaozhi has joined #openstack-keystone | 14:27 | |
| zhiyan | "prop_a:create": "rule:glance_creator" | 14:27 |
| zhiyan | "glance:creator": "role:admin or role:glance_create_user" | 14:27 |
| ayoung | "prop_a:create" is that generated on the fly? | 14:29 |
| zhiyan | this is a rule policy, operator could config to use role policy if needed | 14:29 |
| zhiyan | yes | 14:29 |
| ayoung | what is prop_a | 14:29 |
| zhiyan | ayoung: see there's a config in glance https://github.com/openstack/glance/blob/master/etc/property-protections-policies.conf.sample | 14:30 |
| *** uvirtbot has joined #openstack-keystone | 14:30 | |
| ayoung | zhiyan, these are per object policies? | 14:31 |
| zhiyan | that means if a image property meet that regx, then CRUD operations will be checked on the particular properties. | 14:31 |
| zhiyan | ayoung: "per object" means? | 14:31 |
| ayoung | as opposed to API wide policies...each of these policies could vary depending on which object it is called on? | 14:32 |
| zhiyan | ayoung: yes | 14:33 |
| zhiyan | depends on end user requested image obj | 14:33 |
| ayoung | zhiyan, then each object should probably have their own enforcer | 14:33 |
| ayoung | you will have race conditions all over the place | 14:34 |
| zhiyan | no, probably i confused you | 14:34 |
| ayoung | say two calls come in at the same time, both using a global enforcer | 14:34 |
| zhiyan | nono | 14:34 |
| *** vhoward has joined #openstack-keystone | 14:34 | |
| zhiyan | each api call will create different enforcer obj | 14:34 |
| marekd | lbragstad: brb, need to answer one e-mail. | 14:34 |
| *** chrisshattuck has joined #openstack-keystone | 14:35 | |
| marekd | lbragstad: actually, i asked few questios in your AR spec | 14:35 |
| lbragstad | marekd: I'm addressing your comments in the review now | 14:35 |
| marekd | lbragstad: cool | 14:35 |
| marekd | thanks. | 14:35 |
| ayoung | zhiyan, that is not how it works in Eventlet based code today | 14:35 |
| zhiyan | each enforcer will contains same policies while laded from policy files, but different parts are related with which image the api involved | 14:35 |
| lbragstad | marekd: no problem, thanks for the review | 14:35 |
| *** nellysmi_ has quit IRC | 14:35 | |
| zhiyan | s/while laded/which loaded/ | 14:36 |
| zhiyan | ayoung: so there's no global enforcer object, i don't think there's a protential race condition issue.. | 14:38 |
| ayoung | then why reload? | 14:39 |
| ayoung | That would be doubling the work on every call | 14:39 |
| zhiyan | ayoung: because current only reload flag could make policy files be loaded up when self.rules contains some in memory rules | 14:40 |
| vsilva | hey marekd, I remember you were also interested in better testing for keystone and maybe some functional tests for federation. Did you have any interesting discussions about this on the summit? | 14:40 |
| ayoung | zhiyan, something is not right here | 14:40 |
| vsilva | I was trying to gather interested people and figure out how we could move in that direction | 14:40 |
| zhiyan | ayoung: am I confused you :) | 14:41 |
| marekd | vsilva: i was an i am :-) I didn't talk about that to anybody, but I know dstanek and lbragstad are gatekeepers in terms of funtional testing. | 14:41 |
| *** tellesnobrega_ has quit IRC | 14:41 | |
| marekd | vishy: i only shot a short e-mail to those gentlemen few days ago asking on their opinions. | 14:41 |
| marekd | vishy: sorry, wrong nickname | 14:42 |
| marekd | vsilva: i meant you ^^ | 14:42 |
| vsilva | cool, marekd | 14:42 |
| marekd | vsilva: i can forward you the e-mail | 14:42 |
| marekd | but it's nothing really special | 14:42 |
| vsilva | that would be good anyway, marekd. what do you think of setting that as a topic for the next keystone meeting? | 14:43 |
| marekd | great idea | 14:43 |
| marekd | do you want to modify the agenda? | 14:43 |
| dstanek | vsilva: marekd: you are talking about testing against a real federation setup right? | 14:43 |
| marekd | dstanek: kind of | 14:43 |
| *** tellesnobrega_ has joined #openstack-keystone | 14:44 | |
| marekd | dstanek: having one big IdP for *all* jenkins VM doesn't scale | 14:44 |
| marekd | but having a small instance of pysaml2 IdP on every VM | 14:44 |
| vsilva | could you do it marekd? I bet you have a lot more to say, so having me as 'the guy' for that topic doesn't make a lot of sense... | 14:44 |
| marekd | could work. | 14:44 |
| vsilva | if I understand the meeting correctly, uh | 14:44 |
| ayoung | zhiyan, OK here is what I understand to be happening. And it varies from server to server based on their specific code | 14:44 |
| ayoung | when you call policy, from, say keystone or nova | 14:44 |
| ayoung | it does a bunch of stuff to get the web request into the right form | 14:45 |
| ayoung | then....well, lets start with the code | 14:45 |
| marekd | dstanek: i want to avoid situations where: we code, we add unittests that mock 80% of everything with some contants, we test it by hand and add comments 'worked on my test env' | 14:45 |
| ayoung | http://git.openstack.org/cgit/openstack/nova/tree/nova/policy.py#n44 | 14:45 |
| marekd | vsilva, stevemar and other do want it too. | 14:46 |
| marekd | AFAIK | 14:46 |
| ayoung | you can see it does have a global ENFORCER object. Glance may not do that | 14:46 |
| ayoung | enforce(context, action, target, do_raise=True, exc=None): calls init, to make sure that object is loaded then | 14:46 |
| dstanek | vsilva: marekd: i'll try to get some more information on this topic; it's a much bigger issue than just keystone | 14:46 |
| ayoung | _ENFORCER.enforce ... | 14:46 |
| ayoung | ok, lets look at what glance does | 14:46 |
| zhiyan | ayoung: https://github.com/openstack/glance/blob/master/glance/gateway.py#L37 | 14:47 |
| marekd | dstanek: did you read my email? I am not sure I should ask you... | 14:47 |
| ayoung | zhiyan, what is the lifespan of the gateway object | 14:47 |
| zhiyan | ayoung: let's talk about v2 api stuff, v1 is going to be outdate | 14:47 |
| ayoung | ? | 14:47 |
| marekd | dstanek: it's more like adding another testsuite to the jenkins tests | 14:47 |
| marekd | dstanek: i don't know how to do this. | 14:47 |
| marekd | (yet) | 14:47 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 14:47 |
| marekd | dstanek: however, morganfainberg pointed functional tests would let us have real federation tests | 14:48 |
| zhiyan | from api begin to handle in controller, and release after api return | 14:48 |
| zhiyan | ayoung: ^ | 14:48 |
| ayoung | zhiyan, so one per request? | 14:48 |
| dstanek | marekd: if we are to expect a real apache/ldap/idp during our tests we'll need help | 14:48 |
| zhiyan | ayoung: yes | 14:48 |
| zhiyan | ayoung: e.g. https://github.com/openstack/glance/blob/master/glance/api/v2/image_data.py#L43 | 14:48 |
| dstanek | marekd: i assume that is what you are asking for | 14:49 |
| marekd | dstanek: yes,keystone runningg on top of apache w/ mod_Shib cofigured. | 14:49 |
| marekd | dstanek: correct | 14:49 |
| marekd | dstanek: we, keystone project, we == you ? | 14:49 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Always return the service name in the catalog https://review.openstack.org/135808 | 14:49 |
| *** lhcheng_ has joined #openstack-keystone | 14:49 | |
| ayoung | zhiyan, you sure? In keystone under eventlet, controllers are created once and maintained for the life of the application | 14:49 |
| dstanek | marekd: keystone | 14:49 |
| zhiyan | ayoung: sorry, i mean it belong to controller obj | 14:50 |
| ayoung | zhiyan, so there is one global enforcer. | 14:50 |
| ayoung | zhiyan, do some tracing of a running server and I suspect you will find that it is global | 14:51 |
| zhiyan | ayoung: i was checking the code https://github.com/openstack/glance/blob/master/glance/api/v2/router.py#L33 | 14:51 |
| ayoung | which means changin the policy per object is not going to work. Instead, have a second enforcer object | 14:51 |
| zhiyan | ayoung: hm | 14:51 |
| ayoung | yeah, routers are application scoped too | 14:51 |
| zhiyan | ayoung: yes | 14:52 |
| zhiyan | ayoung: have second enforcer obj for what, sorry i'm confused | 14:52 |
| ayoung | zhiyan, this is a lot like SELinux. When you get the actual object out of the datastore, you look at it to see what its specific security context is | 14:52 |
| *** lhcheng has quit IRC | 14:52 | |
| ayoung | zhiyan, one enforce for global, a second one per object from the database | 14:53 |
| ayoung | what glance is trying to do is tricky, and it is awesome that you guys are trying to make this happen | 14:53 |
| ayoung | but getting it right is a huge task | 14:53 |
| *** r-daneel has joined #openstack-keystone | 14:54 | |
| zhiyan | ayoung: so, back to thetopic, currently i just want to make a way to syncup latest policy module to glance | 14:54 |
| ayoung | zhiyan, I have to head to a dentist appointment. I'm going to think about what you are trying to do here and give some feedback afterwards | 14:54 |
| zhiyan | ayoung: and i'm sure currently PropertyProtect feature is runing will with existing model | 14:54 |
| ayoung | I'll make sureI have an updated version of the glance code to understand what is going on | 14:54 |
| *** richm has joined #openstack-keystone | 14:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:57 | |
| zhiyan | ayoung: ok. glance domain model has a responsibility-chain structure, one layer of it is work for PP | 14:57 |
| zhiyan | it constructs proper in memory rules and update them into enforcer obj. | 14:57 |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 14:57 |
| samuelms | I'd like to know what's the correct way to do a rebase when we have dependent patches .. | 14:57 |
| samuelms | dstanek, lbragstad ^ | 14:57 |
| zhiyan | then a under layer take the responsibility to check these rules in particular handling code context | 14:58 |
| dstanek | samuelms: 'git review -d [last one]' and then rebase | 14:58 |
| *** lhcheng_ is now known as lhcheng | 14:58 | |
| dstanek | samuelms: is that what you mean? | 14:58 |
| marekd | lbragstad: shall i assume new version automatically answers all my questions? :-) | 14:59 |
| marekd | lbragstad: AE tokens | 14:59 |
| samuelms | dstanek, hm .. kind of .. | 14:59 |
| lbragstad | marekd: just published my general responses | 14:59 |
| samuelms | dstanek, let's take an example | 14:59 |
| marekd | lbragstad: yeah | 14:59 |
| lbragstad | to your questions | 14:59 |
| marekd | just noticed e-mail | 14:59 |
| lbragstad | marekd: hopefully that helps | 14:59 |
| samuelms | dstanek, https://review.openstack.org/#/c/130954/ | 14:59 |
| samuelms | dstanek, to start a patch that depends on this .. I do : git review -d 130954 | 15:00 |
| samuelms | dstanek, this give me a new branch review/../henrynash .. something like that, right? | 15:00 |
| lbragstad | samuelms: correct | 15:00 |
| dstanek | samuelms: yes | 15:00 |
| bknudson | cherry-pick your changes onto that branch | 15:00 |
| samuelms | dstanek, then I do: 'git checkout -b bug/<number>' where I'll work | 15:01 |
| dstanek | samuelms: so you want rebase on top of someone else's work? | 15:01 |
| samuelms | dstanek, yes .. in fact .. that first patch was rebased to master .. then we have a neew patch set | 15:02 |
| lbragstad | samuelms: I don't think you need to put yourself on a new branch before you do the 'git review -d [number | 15:02 |
| lbragstad | ] | 15:02 |
| lbragstad | because it will do that for you | 15:02 |
| samuelms | lbragstad, I do 'git checkout -b ..' after 'git review -d' | 15:02 |
| dstanek | samuelms: if the patchset (in this case henry's) changes under you - you would have to pull the most recent version and rebase your changes on top of that | 15:03 |
| samuelms | dstanek, correct | 15:03 |
| *** dtturner has quit IRC | 15:03 | |
| marekd | lbragstad: maybe i am misunderstanding the whole concept, but it looks to me that you want to make a whole token super short, with just few fields. But i don't get a clear information where the rest of the information for that token will be kept. Do you want to compute it dynamically everytime it's actually needed instead of doing a db lookup? Say, I want to use federated authn. All my data, especially my groups will be computed dynamically | 15:03 |
| *** rharwood has quit IRC | 15:03 | |
| samuelms | dstanek, how should I pull the changes from https://review.openstack.org/#/c/130954/<patchset> to my local 'review/../henrynash' branch? | 15:04 |
| bknudson | marekd: it goes to the server to fetch the whole token | 15:04 |
| bknudson | marekd: like with uuid tokens | 15:04 |
| marekd | bknudson: ah-ha, i was imagining that but i think this was not clearly stated in the spec | 15:04 |
| bknudson | marekd: so yes, it's computed dynamically every time | 15:04 |
| samuelms | dstanek, if I go to my untouched 'review/../henrynash' branch and run 'git pull https://review.openstack.org/openstack/keystone refs/changes/54/130954/22' | 15:05 |
| lbragstad | the Keystone server would then dynamically do it | 15:05 |
| dstanek | samuelms: you can you git the fetch command listed on the review to bring in his changes | 15:05 |
| samuelms | dstanek, I get merge conflicts | 15:05 |
| marekd | bknudson: lbragstad: so its not like uuid tokens. | 15:05 |
| marekd | bknudson: cause uuid was just id and everything was in the DB | 15:05 |
| dstanek | samuelms: you'll probably have to specify just your commits to rebase too. otherwise git will use all commits up to the common ancestor | 15:06 |
| bknudson | marekd: well, there's no reason that uuid tokens can't be changed to work like AE tokens. | 15:06 |
| lbragstad | marekd: from a workflow perspective it is | 15:06 |
| bknudson | marekd: and I would prefer it if they were... if it works for AE then it should work for UUID | 15:06 |
| lbragstad | both AE tokens and UUID tokens need to return to the server to be validated | 15:06 |
| lbragstad | versus the PKI|z implementation that can be validated on the service side | 15:06 |
| samuelms | dstanek, right .. so as I left that branch untouched.. I can run : 'git pull -X theirs https://review.openstack.org/openstack/keystone refs/changes/54/130954/22' | 15:06 |
| samuelms | dstanek, and then after go back to my 'bug/<bugnumber>' and then run 'git rebase -i review/../henrynash' | 15:07 |
| marekd | lbragstad: bknudson: so the added value is that first validation can be done at the service level, but actually the service must always hit Keystone to get full set of roles, my groups or wahatever | 15:08 |
| marekd | lbragstad: bknudson seriously, is it really an advantage to give up IO in favor of bigger CPU work? | 15:08 |
| bknudson | marekd: the token doesn't have to be persisted because all the info needed to recreate it is in the token | 15:08 |
| bknudson | marekd: and it's smaller than a PKI token | 15:08 |
| dstanek | samuelms: is that failing? | 15:08 |
| samuelms | dstanek, no .. :p | 15:08 |
| samuelms | dstanek, was just wondering if people do like that | 15:09 |
| dstanek | samuelms: are the conflicts lines you have changed? | 15:09 |
| bknudson | marekd: I think it depends on the size of your cloud... if you have servers on the other side of the world you don't want to do IO | 15:09 |
| lbragstad | marekd: if you think about it at scale, it can be argued that it's easier to scale CPU operations versus replication of I/O bound tokens | 15:09 |
| samuelms | dstanek, can you enter https://etherpad.openstack.org/p/rebasing-dependent-patch ? | 15:10 |
| lbragstad | in the case bknudson makes, scaling would mean standing up another API node versus replicating your entire backend store | 15:10 |
| lbragstad | marekd: this is the token schema (for the sql backend) http://pasteraw.com/j5o8nkohs97pplkftafg4k53v8ko49x | 15:11 |
| lbragstad | so every time we POST to /auth/token we write the entire catalog to 'extra' | 15:11 |
| *** tellesnobrega_ has quit IRC | 15:11 | |
| marekd | lbragstad: you are talking about current tokens | 15:12 |
| lbragstad | marekd: yes | 15:12 |
| bknudson | with AE tokens every time a token is validated you'll have to rebuild the catalog | 15:12 |
| bknudson | which is not pretty either | 15:12 |
| marekd | bknudson: lbragstad and backend like token will not be required | 15:12 |
| marekd | in theory.. | 15:13 |
| lbragstad | marekd: your 'backend' would be an AE token implementation that understand the format of the token and knows how to validate and authenticate tokens based on that format | 15:13 |
| bknudson | btw - is keystone going to support AE, UUID, and PKI tokens at the same time? | 15:13 |
| marekd | lbragstad: i mean, no tokens or extra information would be stored in the DB | 15:14 |
| lbragstad | marekd: correct | 15:14 |
| *** xiaozhi has quit IRC | 15:14 | |
| samuelms | dstanek, you understand what's the problem? | 15:14 |
| bknudson | we also have a spec for non-persistent tokens so PKI tokens wouldn't be stored either. | 15:14 |
| marekd | lbragstad: bknudson ok, so let's talk about federation tokens.... | 15:14 |
| lbragstad | marekd: this would change to an ae token driver implementation https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1524 | 15:14 |
| dstanek | samuelms: yeah, once my tests are done i'll try it out | 15:15 |
| samuelms | dstanek, ok | 15:15 |
| marekd | lbragstad: bknudson: having a user_id doesn't really help me as such user doesn't exist and i can only build my data (group_ids) from input data which is very likely no longer available. | 15:16 |
| marekd | as i build it from env variables pushed there by mod_shib | 15:16 |
| bknudson | if you can't rebuilt it later it needs to be in the token | 15:16 |
| marekd | and i do this accessint /v3/OS-FEDERATION/.../auth URL | 15:16 |
| bknudson | so the AE token would have to contain the group IDs | 15:17 |
| lbragstad | marekd: so the group id would be in place of a user id | 15:17 |
| lbragstad | marekd: correct? | 15:17 |
| marekd | lbragstad: no, cause you get a list of groups | 15:17 |
| bknudson | lbragstad: that sounds like the way to do it | 15:17 |
| lbragstad | marekd: why a list of groups? | 15:18 |
| marekd | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-an-unscoped-os-federation-token-getpost-os-federationidentity_providersidentity_providerprotocolsprotocolauth | 15:18 |
| marekd | lbragstad: bknudson ^^ | 15:18 |
| marekd | lbragstad: cause you have SAML assertion -> list of groups you are a member of | 15:18 |
| bknudson | it's going to need all that stuff from the token | 15:18 |
| marekd | bknudson: yes :( | 15:19 |
| lbragstad | marekd: the group ids are always in the format of uuid.uuid4().hex right? | 15:19 |
| bknudson | all the OS-FEDERATION stuff | 15:19 |
| marekd | lbragstad: no, you could have names too...i think | 15:19 |
| bknudson | it just means it's a bigger token :( | 15:19 |
| marekd | bknudson: exactly... | 15:19 |
| lbragstad | well.. | 15:19 |
| lbragstad | some of that could be serialized... | 15:19 |
| lbragstad | like the protocol | 15:19 |
| marekd | bknudson: and i think this is just a first use case :( | 15:19 |
| marekd | others may say 'what about trusts? what about this and that?' | 15:20 |
| bknudson | trusts need to be supported... I think the idea was to put the trust as the scope (i.e., rather than project or domain) | 15:21 |
| marekd | bknudson: aha | 15:21 |
| lbragstad | right | 15:21 |
| marekd | lbragstad: bknudson : unscoped tokens? | 15:21 |
| lbragstad | we also have ``auth_type`` | 15:21 |
| marekd | lbragstad: bknudson how about mixing stuff? | 15:22 |
| lbragstad | mixing stuff? | 15:22 |
| marekd | lbragstad: say, we agree to have long and json tokens at first, but we end up with your AE tokens, always scoped to something | 15:23 |
| *** jacorob has joined #openstack-keystone | 15:23 | |
| marekd | say in our federation example: | 15:23 |
| marekd | users get unscoped, token, with OS-federation stuff inside | 15:23 |
| marekd | but eventually he wants to scope to domain/project | 15:23 |
| marekd | and his scoped project (something he is actually going to use) could be small AE token. | 15:24 |
| marekd | https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens | 15:24 |
| marekd | this is what i get once i scope my federated token | 15:24 |
| marekd | and this is actually normal token, and looks like AE would be enough. | 15:24 |
| marekd | oh shit... | 15:25 |
| marekd | it won't work :( | 15:25 |
| marekd | keystone will not be able to check the roles | 15:25 |
| marekd | OS-FEDERATION is in scoped tokens too. | 15:25 |
| bknudson | the token also has "methods" in it, so not sure how that's going to be rebuilt from an AE token | 15:26 |
| *** ayoung is now known as ayoung-dentist | 15:28 | |
| dstanek | samuelms: what review is yours? | 15:28 |
| *** ayoung-dentist has quit IRC | 15:28 | |
| samuelms | dstanek, in fact I didnt submit it yet .. | 15:28 |
| samuelms | dstanek, actually I just got it working .. | 15:28 |
| samuelms | dstanek, probably I had messed something up | 15:29 |
| dstanek | samuelms: perfect! | 15:29 |
| lbragstad | marekd: one sec, | 15:30 |
| samuelms | dstanek, thanks | 15:30 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds missing log hints for level E/I/W https://review.openstack.org/118883 | 15:30 |
| openstackgerrit | David Stanek proposed openstack/keystone: Extends hacking check for logging to verify i18n hints https://review.openstack.org/118884 | 15:30 |
| *** NM has joined #openstack-keystone | 15:31 | |
| *** NM has quit IRC | 15:38 | |
| marekd | bknudson: is AE a standardized concept? | 15:39 |
| marekd | bknudson: any other example of big scale use? | 15:39 |
| bknudson | marekd: my understanding is that rackspace has an impl already | 15:39 |
| *** wpf has quit IRC | 15:41 | |
| *** junhongl has quit IRC | 15:41 | |
| *** richm1 has joined #openstack-keystone | 15:42 | |
| joesavak | yes - we are working on one - it's java right now. We'll start contributing the python version when the spec goes through | 15:42 |
| bknudson | joesavak: does it support federation? | 15:42 |
| *** richm has quit IRC | 15:42 | |
| marekd | joesavak: i added some concerns to the spec | 15:43 |
| marekd | joesavak: and with lbragstad and bknudson we are discussing them now | 15:43 |
| joesavak | bknudson - in the case of juno - where token is returned in exchange for a SAML construct, yes | 15:43 |
| joesavak | marekd - awesome | 15:43 |
| lbragstad | marekd: I'm getting the guy who did the java version of it in here now | 15:44 |
| *** dimsum__ has quit IRC | 15:45 | |
| marekd | sure :-) | 15:45 |
| *** dimsum__ has joined #openstack-keystone | 15:45 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct use of config fixture in test_v3_federation https://review.openstack.org/136399 | 15:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - test some websso stuff https://review.openstack.org/136177 | 15:46 |
| lbragstad | marekd: jacorob did a lot of the work in the Java implementation | 15:46 |
| *** stevemar has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v stevemar | 15:47 | |
| bknudson | I bet there's a lot of interfaces and factories | 15:47 |
| marekd | lbragstad: that's what joesavak just said. | 15:47 |
| dstanek | morganfainberg: are we still looking to get https://review.openstack.org/#/c/113586 in? | 15:48 |
| dstanek | Java makes me sad | 15:49 |
| jacorob | a tea drinker? | 15:49 |
| joesavak | a snake charmer. | 15:49 |
| lbragstad | jacorob: \o/ welcome to #openstack-keystone! | 15:49 |
| marekd | dstanek: why ? | 15:49 |
| bknudson | lack of multiple inheritance | 15:49 |
| *** wpf has joined #openstack-keystone | 15:50 | |
| *** junhongl has joined #openstack-keystone | 15:50 | |
| dstanek | marekd: all sorts of reasons - had to use it for too long - culture of huge tools and code generation doesn't help | 15:50 |
| marekd | bknudson: so i guess you hate ANSI C | 15:51 |
| dstanek | lack of properties, meta programming and no duck typing hurts too | 15:51 |
| bknudson | marekd: I also hate ANSI C | 15:51 |
| marekd | bknudson: it's not even OOP | 15:51 |
| marekd | bknudson: and what do you like? Apart from Python ? | 15:51 |
| lbragstad | jacorob: marekd and stevemar did a bunch of the federation stuff and they are wondering about how AE tokens will work in the federated case | 15:51 |
| bknudson | marekd: C++ ... I also like JavaScript | 15:51 |
| * lbragstad thinks we should start using lambda moo | 15:52 | |
| * marekd reference ? | 15:52 | |
| dstanek | i also have objective-c | 15:52 |
| dstanek | s/have/hate/ | 15:52 |
| marekd | golang? | 15:52 |
| marekd | seems to be a nice bridge | 15:52 |
| lbragstad | marekd: http://en.wikipedia.org/wiki/LambdaMOO | 15:52 |
| marekd | ah no..doesn't have multiple inheritance | 15:52 |
| morganfainberg | dstanek: it makes sense to get that one in. | 15:53 |
| lbragstad | marekd: it's legit, array indexing starts at 1 | 15:53 |
| jacorob | lbragstad: from my perspective fed shouldn’t be different. we don’t store any different info in the token from regular tokens. that said, i’m not necessarily that familiar with the keystone fed | 15:53 |
| morganfainberg | lbragstad: no no lambdamoo :P | 15:54 |
| lbragstad | morganfainberg: :P | 15:54 |
| dstanek | morganfainberg: did you have time to address the comments? if not i can do it today | 15:54 |
| dstanek | i just have to revisit what you were doing | 15:55 |
| morganfainberg | dstanek: I hope I have time. | 15:55 |
| dstanek | morganfainberg: ok, i'll ignore it for now | 15:55 |
| marekd | jacorob: we do | 15:55 |
| lbragstad | jacorob: this is what marekd is sending in the token to get an unscoped token: https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-an-unscoped-os-federation-token-getpost-os-federationidentity_providersidentity_providerprotocolsprotocolauth | 15:55 |
| marekd | jacorob: OS-FEDERATION | 15:55 |
| marekd | is created once and there is no way to recreate it later. | 15:56 |
| lbragstad | so the validate case, right marekd | 15:56 |
| morganfainberg | stevemar: any thoughts more on the convo about the split? | 15:56 |
| stevemar | morganfainberg, not really, i'll still +1 for split, but -1 because as you say, i can't think of a scenario where roles are handled in keystone, and role-assignments are not | 15:57 |
| jacorob | marekd: so for federated the token is completely self contained - in that no ephemeral user or whatnot is stored on the local system? Ultimately I think AE tokens will need to be flexible in order to allow different data to be included for different use cases. We’re doing that for other scenarios outside of federation. | 15:58 |
| morganfainberg | stevemar: ok, I added the same comment with a-1. | 15:58 |
| morganfainberg | stevemar: thanks for being a sounding board. | 15:58 |
| marekd | jacorob: no user content stored in the backend | 15:58 |
| marekd | actually, you are what you have in the token (today) | 15:59 |
| marekd | jacorob: i was just reviewing lbragstad's spec for AE tokens in OpenStack | 15:59 |
| marekd | jacorob: and wanted to clear out those corner-cases | 15:59 |
| marekd | i have a strage feeling that such constrained token structure may be some troublesome for future features :( | 16:00 |
| marekd | today we need OS-FEDERATION in the token, tomorrow OS-SOMETHING | 16:00 |
| marekd | :( | 16:00 |
| jacorob | marekd: makes sense. ultimatley it’s just a tradeoff, more data == longer token. | 16:00 |
| marekd | jacorob: yes yes | 16:00 |
| jacorob | i don’t think the structure has to be so constrained though | 16:00 |
| marekd | lbragstad: they only thing i am suggesting is to keep in mind such corner cases | 16:01 |
| marekd | lbragstad: and hopefully mention federated tokens, since we alredy have this feature in Keystone | 16:01 |
| marekd | jacorob: ok, thanks :-) | 16:01 |
| jacorob | ultimatley ae tokens is just a wrapper around some constructs. I think the key is just the methods used to generate the token - e.g. encrypt then mac approach, some bytes for versioning, etc | 16:01 |
| marekd | jacorob: it's not always possible. | 16:02 |
| marekd | e.g. in case of federated tokens, once you create one you are not able to re-generate it | 16:02 |
| *** chrisshattuck has quit IRC | 16:02 | |
| stevemar | dstanek, replied to some of your comments | 16:02 |
| jacorob | not sure i follow. | 16:02 |
| marekd | jacorob: well, OS-FEDERATION object https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-an-unscoped-os-federation-token-getpost-os-federationidentity_providersidentity_providerprotocolsprotocolauth | 16:03 |
| marekd | is generated from input which is deleted after this operation. | 16:03 |
| *** chrisshattuck has joined #openstack-keystone | 16:04 | |
| marekd | it's federation internall stuff | 16:04 |
| jacorob | understand. guess what i’m not understanding is what you’re referring to by “it's not always possible.” | 16:04 |
| lbragstad | marekd: would it be helpful to build an ae token format around federation specifically? | 16:04 |
| dstanek | stevemar: on which review? | 16:04 |
| dstanek | stevemar: oh wip'ed on? | 16:05 |
| marekd | lbragstad: very likely, but do you want to fill all the possible hole with a custom format, token? :( | 16:05 |
| stevemar | dstanek, correct | 16:05 |
| marekd | jacorob: if you don't store extra data like OS-FEDERATION in the token, you will not be able to re generate the token basing on currently proposed fields, so user_id, project_id , ... | 16:06 |
| stevemar | marekd, did you and jose code most of the cernops websso stuff, or did just he? | 16:06 |
| lbragstad | marekd: wouldn't a token just need to add those fields in? | 16:07 |
| lbragstad | marekd: it could extend the ae token implementation to include that extra information | 16:07 |
| lbragstad | ? | 16:07 |
| marekd | stevemar: i did keystone part | 16:07 |
| marekd | stevemar: mostly, he then tweaked it a little bi later as he needed something else in horizon. | 16:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a type check to make it work in Python 3 https://review.openstack.org/125410 | 16:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updates Python3 requirements https://review.openstack.org/130579 | 16:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: Mocks out the memcache library for tests https://review.openstack.org/125409 | 16:08 |
| marekd | lbragstad: yes, it could. | 16:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 16:08 |
| jacorob | marekd: agreed. i don’t see an issue storing additional data based on the needs of the token. basically, the ae wrapper just takes in some construct - a list of fields, a json structure, whatever, and does the encryption/mac to form a token. | 16:08 |
| *** topol has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v topol | 16:08 | |
| marekd | lbragstad: jacorob i got impression that the list is fixed... | 16:09 |
| lbragstad | marekd: it doesn't have to be fixed if the validator understand the format | 16:10 |
| jacorob | i don’t think in can be. It needs to extensible, IMO. | 16:10 |
| *** jacorob_ has joined #openstack-keystone | 16:11 | |
| *** Viswanath has joined #openstack-keystone | 16:11 | |
| *** jacorob_ has quit IRC | 16:12 | |
| marekd | lbragstad: ok | 16:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 16:14 |
| *** Viswanath has quit IRC | 16:14 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - test some websso stuff https://review.openstack.org/136177 | 16:16 |
| * marekd short and self-validated tokens seem to be a Holy Grail | 16:16 | |
| jacorob | hehe | 16:17 |
| bknudson | if the token is unscoped, then the auth_token middleware really doesn't have to go to the server to validate | 16:17 |
| bknudson | if the AE token has got everything | 16:18 |
| marekd | bknudson: but then we are again growing ang growing and we may endup actually with PKI token without SC | 16:18 |
| bknudson | or if it turns out you don't need the catalog then no need to go to the server | 16:19 |
| bknudson | marekd: y, I was just remarking that AE tokens are different in that sometimes you don't have to go to the server (unlike UUID tokens) | 16:20 |
| marekd | bknudson: understand. | 16:21 |
| marekd | bknudson: well, what i need to understand is that there is no golder rule | 16:21 |
| marekd | for the tokens. | 16:21 |
| marekd | lbragstad: anyway, i liked the discussion. Put some light on the whole concept..at least I did educate myself in your plans. | 16:22 |
| lbragstad | marekd: no problem, hopefully it helped, it was nice to get that perspective on federation with ae too | 16:23 |
| *** dimsum__ has quit IRC | 16:25 | |
| *** dimsum__ has joined #openstack-keystone | 16:26 | |
| marekd | sure | 16:27 |
| marekd | ok, i am out of here | 16:27 |
| *** marekd is now known as marekd|away | 16:27 | |
| * marekd|away is going to open his ski season | 16:28 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 16:28 |
| *** richm1 has quit IRC | 16:29 | |
| lbragstad | marekd|away: have fun! | 16:29 |
| *** dimsum__ has quit IRC | 16:30 | |
| *** jacorob_ has joined #openstack-keystone | 16:31 | |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Middleware tests now run under Python3 https://review.openstack.org/99669 | 16:31 |
| *** diegows has joined #openstack-keystone | 16:32 | |
| *** nellysmitt has joined #openstack-keystone | 16:36 | |
| *** jacorob has quit IRC | 16:40 | |
| *** jacorob_ is now known as jacorob | 16:40 | |
| *** nellysmitt has quit IRC | 16:41 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - test some websso stuff https://review.openstack.org/136177 | 16:44 |
| *** Ctina has joined #openstack-keystone | 16:45 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone-specs: Modify the policy file https://review.openstack.org/135408 | 16:46 |
| openstackgerrit | Andre Aranha proposed openstack/keystone-specs: Modify the policy file https://review.openstack.org/135408 | 16:47 |
| *** nellysmitt has joined #openstack-keystone | 16:52 | |
| *** ajayaa has quit IRC | 16:52 | |
| *** david-ly_ is now known as david-lyle | 16:56 | |
| *** jsavak has joined #openstack-keystone | 16:58 | |
| *** joesavak has quit IRC | 17:01 | |
| *** _cjones_ has joined #openstack-keystone | 17:03 | |
| *** NM has joined #openstack-keystone | 17:03 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 17:03 |
| *** NM has quit IRC | 17:07 | |
| dolphm | why do we attempt two ldap binds during auth? the only difference i see between the first and second is the first includes a limited list of attributes, and the second has attrs=None | 17:15 |
| *** thiagop has joined #openstack-keystone | 17:16 | |
| bknudson | bind doesn't have a list of attributes | 17:16 |
| dolphm | sorry, there's two binds followed by two nearly identical queries | 17:17 |
| dolphm | bknudson: fwiw i'm just looking at this snippet http://pasteraw.com/ibnukyxvfl7n1kz850ik04k1askovjs | 17:17 |
| bknudson | usually you do a bind as the user to validate the password | 17:18 |
| bknudson | but you don't have to do a search afterwards. | 17:18 |
| *** Ctina_ has joined #openstack-keystone | 17:20 | |
| *** Ctina has quit IRC | 17:20 | |
| dolphm | bknudson: but that's not what this is doing, as i read it? it looks like it's just validating the user ID using the ldap service account | 17:22 |
| bknudson | I assume "dn=CN=phx1-svc,OU=Service Accounts,OU=Org West,DC=hq,DC=corp,DC=org,DC=com simple_bind_s" is validating the password | 17:23 |
| *** nellysmitt has quit IRC | 17:24 | |
| bknudson | it would have to do a search to get the user DN, which is probably this one: dn=OU=Accounts,DC=hq,DC=corp,DC=org,DC=com, scope=2, query=(&(cn=790eaf8185b14ea28331871c87815a3a)(obj ectClass=person)) | 17:24 |
| bknudson | oh, it binds as the same user twice | 17:24 |
| dolphm | bknudson: but that's binding as the service account, not as the authenticating http api user | 17:24 |
| *** zzzeek has joined #openstack-keystone | 17:25 | |
| dolphm | the [ldap] user + password | 17:25 |
| dolphm | is the only simple_bind_s in the log, which occurs twice | 17:25 |
| *** dimsum__ has joined #openstack-keystone | 17:26 | |
| openstackgerrit | Andre Aranha proposed openstack/keystone: Creating a policy sample https://review.openstack.org/123509 | 17:29 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 17:33 |
| *** links has quit IRC | 17:43 | |
| *** RichardRaseley has joined #openstack-keystone | 17:48 | |
| *** ajayaa has joined #openstack-keystone | 17:50 | |
| *** amakarov is now known as amakarov_away | 17:51 | |
| *** harlowja_away is now known as harlowja | 17:52 | |
| rodrigods | bknudson, regarding https://review.openstack.org/#/c/132894/2, are you suggesting to leave the 500 error as it is and create a bug about it? | 17:54 |
| *** ayoung has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v ayoung | 17:59 | |
| ayoung | stevemar, marekd|away lets say I use SAML to Horizon, and then Horizon fetches a token from Keystone. Is there anything in the SAML assertion that Horizon could pass to Keystone to prove that a user actually attempted to connect? | 18:00 |
| RichardRaseley | Is there any pre-Juno way to have Keystone use its local store for service accounts (e.g. neutron, nova, etc.) and LDAP strictly for user accounts? | 18:04 |
| stevemar | RichardRaseley, not really, it was intended for pre-Juno, but very important bugs were fixed in Juno | 18:05 |
| RichardRaseley | stevemar: OK, thank you. So for any pre-Juno environment the prescribed approach is to pick one or the other before you start provisioning your service accounts. | 18:06 |
| RichardRaseley | ?* | 18:06 |
| ayoung | RichardRaseley, yep | 18:06 |
| RichardRaseley | Great, thanks all for your help. | 18:07 |
| afaranha | Do someone knows from where the tests read the admin_app ( https://github.com/openstack/keystone/blob/master/keystone/tests/rest.py#L72 )? | 18:07 |
| stevemar | RichardRaseley, yeah, it's probably best to create a few service accounts in your ldap... i think, ayoung ? | 18:07 |
| ayoung | yep | 18:07 |
| stevemar | its either that or store all your users in sql *yuck!* | 18:07 |
| ayoung | stevemar, there is a compelling reason to move to Juno | 18:08 |
| RichardRaseley | stevemar: Yeah, my thoughts exactly. | 18:08 |
| RichardRaseley | It will work for this small pilot environment, but I will add that to my list of compelling reasons to deploy to Juno in production. =] | 18:08 |
| ayoung | RichardRaseley, you can use a Juno Keystone and Icehouse everything else | 18:08 |
| ayoung | stevemar, have you thought about how we should be doing SAML in Horizon? There more I think about it, the more depressed I get | 18:13 |
| *** _cjones_ has quit IRC | 18:13 | |
| ayoung | its like, only Horizon has enough data to confirm that the user actually attempted to log in | 18:13 |
| ayoung | but only keystone can sign a token | 18:13 |
| *** _cjones_ has joined #openstack-keystone | 18:13 | |
| RichardRaseley | ayoung: Good to know, thanks. | 18:14 |
| ayoung | if Horizon passed the entire SAML assertion to Keystone, and included its own service username and password...say in a basic-auth style submission, and we did a policy check on the username to say "this user needs to be able to get a token issued for the real user" | 18:15 |
| ayoung | It would defend against two classes of attacks. | 18:15 |
| ayoung | 1. RIght now, if an attacker evesdrops on the Horizon conversations, they can harvest users passwords | 18:16 |
| ayoung | 2. If we instead said that Horizon could issue tokens for any user, the horizon password becomes a huge liabilityu | 18:16 |
| *** eglynn is now known as eglynn-officeafk | 18:16 | |
| ayoung | we really want to combine service user credentials with a confirmation that the user has an exteranally granted valid assertion of identity | 18:17 |
| *** _cjones_ has quit IRC | 18:22 | |
| *** amcrn has joined #openstack-keystone | 18:25 | |
| *** gyee_ has joined #openstack-keystone | 18:25 | |
| *** NM has joined #openstack-keystone | 18:31 | |
| *** _cjones_ has joined #openstack-keystone | 18:32 | |
| *** htruta has quit IRC | 18:33 | |
| *** htruta has joined #openstack-keystone | 18:36 | |
| *** _cjones_ has quit IRC | 18:45 | |
| bknudson | rodrigods: yes, you can leave the 500 error as is since that's what it does, but file a bug and put a note with the bug # | 18:51 |
| rodrigods | bknudson, ++ | 18:52 |
| *** jistr|mtg has quit IRC | 19:04 | |
| *** saipandi has joined #openstack-keystone | 19:04 | |
| *** _cjones_ has joined #openstack-keystone | 19:05 | |
| *** _cjones_ has quit IRC | 19:06 | |
| *** _cjones_ has joined #openstack-keystone | 19:06 | |
| rodrigods | bknudson, https://bugs.launchpad.net/keystone/+bug/1395117 | 19:08 |
| uvirtbot | Launchpad bug 1395117 in keystone "Create SAML assertion using domain scoped tokens returns 500 (Internal Server Error)" [Undecided,New] | 19:08 |
| *** _cjones_ has quit IRC | 19:08 | |
| *** _cjones_ has joined #openstack-keystone | 19:08 | |
| stevemar | rodrigods, thats for k2k | 19:09 |
| rodrigods | stevemar, ++ already handling it in https://review.openstack.org/#/c/132894/2/keystone/tests/test_v3_federation.py | 19:10 |
| rodrigods | stevemar, can work in a fix for it as well | 19:10 |
| stevemar | rodrigods, split that change up :) | 19:11 |
| rodrigods | stevemar, any objections to leave the import _ review as it is and fix the bug in a follow on patch? | 19:12 |
| stevemar | rodrigods, none at all | 19:12 |
| rodrigods | stevemar, ++ thx | 19:13 |
| *** amcrn has quit IRC | 19:13 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add import i18n to federation/controllers.py https://review.openstack.org/132894 | 19:13 |
| topol | dolphm, you there? | 19:19 |
| *** radez is now known as radez_g0n3 | 19:21 | |
| morganfainberg | dolphm, dstanek, lbragstad, bknudson, can re remove the "git checkout of ksc" test yet? | 19:26 |
| morganfainberg | i *think* it's not super useful anymore | 19:27 |
| bknudson | morganfainberg: If we do then we lose coverage | 19:27 |
| morganfainberg | bknudson, do we? even with the changes to how clients are tested? | 19:27 |
| bknudson | morganfainberg: try removing it and check the coverage diff... I think there will be v2 code that's not tested. | 19:27 |
| morganfainberg | oh we're using it for that? | 19:27 |
| * morganfainberg grumbles. | 19:27 | |
| bknudson | morganfainberg: yes, it's not just testing the client. | 19:27 |
| morganfainberg | we need to fix that then. | 19:28 |
| *** dimsum__ has quit IRC | 19:29 | |
| *** NM has quit IRC | 19:32 | |
| dstanek | morganfainberg: yeah, what bknudson said | 19:32 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct use of config fixture https://review.openstack.org/136399 | 19:33 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Add import i18n to federation/controllers.py https://review.openstack.org/132894 | 19:35 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fixes create_saml_assertion() return https://review.openstack.org/136471 | 19:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fixes create_saml_assertion() return https://review.openstack.org/136471 | 19:38 |
| morganfainberg | didn't we fix this: http://paste.openstack.org/show/136063/ ? | 19:41 |
| afaranha | Hello, I submitted a spec proposing to change the policy, could you read and give comments? https://review.openstack.org/#/c/135408/ | 19:42 |
| rodrigods | morganfainberg, having this errors here on mac as well | 19:42 |
| morganfainberg | rodrigods, fantastic... :( | 19:42 |
| * morganfainberg wonders where that started from. | 19:42 | |
| morganfainberg | s/when. | 19:42 |
| rodrigods | morganfainberg, :( last sartuday it was already happening, thought it was some issue in my machine | 19:43 |
| *** NM has joined #openstack-keystone | 19:43 | |
| morganfainberg | clearly it doesn't happen on linux | 19:44 |
| morganfainberg | so .. someone really broken something in LDAP. | 19:44 |
| morganfainberg | not us likely | 19:44 |
| afaranha | Haneef, bknudson, ayoung, morganfainberg could you review? | 19:44 |
| *** NM has quit IRC | 19:48 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 19:56 |
| morganfainberg | dstanek, ^ | 19:57 |
| *** topol has quit IRC | 19:59 | |
| bknudson | morganfainberg: fancy! | 19:59 |
| morganfainberg | bknudson, i *think* that addresses the bulk of the code comments you had. | 20:00 |
| morganfainberg | it also makes it much easier to read. | 20:00 |
| morganfainberg | the hard part was the mocking :P | 20:00 |
| *** tellesnobrega has quit IRC | 20:01 | |
| dstanek | morganfainberg: excellent | 20:02 |
| morganfainberg | whoopse missed removing a line | 20:02 |
| morganfainberg | next patch incoming | 20:02 |
| morganfainberg | bknudson, ^ | 20:02 |
| morganfainberg | ugh... wtf... it just passed pep8 now it fails... | 20:03 |
| morganfainberg | hm. this might still be broken. please don't review yet. | 20:04 |
| dstanek | morganfainberg: bknudson: what do you guys think about https://review.openstack.org/#/c/80630 | 20:05 |
| morganfainberg | dstanek, hm. i do like the idea of comparing models to the actual results of the migrations | 20:06 |
| bknudson | dstanek: I've been thinking about it for a while and am still thinking about it. | 20:06 |
| dstanek | morganfainberg: but do you like the impl? see my last comment | 20:08 |
| *** junhongl has quit IRC | 20:08 | |
| * morganfainberg looks. | 20:09 | |
| morganfainberg | dstanek, i tend to agree... metaclasses usually imply you're doing it wrong. | 20:09 |
| morganfainberg | *usually* | 20:09 |
| morganfainberg | mostly because they can do very crazy things... like even change your parent objects out from under you | 20:10 |
| dstanek | in this case it's an implicit factory for test classes; while clever i think it will confuse more than half the people that look at it | 20:11 |
| morganfainberg | yeah | 20:11 |
| morganfainberg | i think doing explicit walk + create is more explicit at least | 20:11 |
| *** junhongl has joined #openstack-keystone | 20:11 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 20:15 |
| morganfainberg | dstanek, bknudson, ^ ok that should fix the issues with the last patchset *and* fixes commit message. | 20:15 |
| bknudson | morganfainberg: probably should have a bug or DocImpact if the config is changing. | 20:16 |
| morganfainberg | hm. | 20:16 |
| morganfainberg | is the config actually changing? | 20:16 |
| * morganfainberg checks | 20:16 | |
| morganfainberg | it's been a while since i've looked at this tbh | 20:16 |
| bknudson | it just moved something from one place to another | 20:17 |
| morganfainberg | ah. | 20:17 |
| bknudson | I like to see bugs for those so it's easy to find. | 20:17 |
| morganfainberg | yeah. | 20:17 |
| *** r-daneel has quit IRC | 20:17 | |
| morganfainberg | DocImpact makes a bug? | 20:17 |
| bknudson | morganfainberg: yes, I think I read somewhere that config changes should have a DocImpact | 20:18 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 20:19 |
| morganfainberg | bknudson, i wasn't aware of that magic | 20:19 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 20:20 |
| bknudson | morganfainberg: https://wiki.openstack.org/wiki/GitCommitMessages#Including_external_references | 20:20 |
| morganfainberg | interesting | 20:21 |
| morganfainberg | ok | 20:21 |
| *** tellesnobrega has joined #openstack-keystone | 20:22 | |
| *** pc-m has quit IRC | 20:27 | |
| morganfainberg | rodrigods, ping re: https://review.openstack.org/#/c/117786/34/keystone/assignment/controllers.py | 20:29 |
| morganfainberg | rodrigods, did we decide the status of "expand or not expand the refs" | 20:29 |
| morganfainberg | as in was it a security thing to expand the ref or not? | 20:29 |
| rodrigods | morganfainberg, yes... we decided to show only the projects the user has access to | 20:31 |
| morganfainberg | ah ok | 20:31 |
| rodrigods | morganfainberg, for subtree_as_list and parents_as_list | 20:31 |
| rodrigods | we are proposing new queries subtree_ids and parents_ids which will return only the ids in a structured fashion | 20:32 |
| *** dimsum__ has joined #openstack-keystone | 20:34 | |
| *** packet has joined #openstack-keystone | 20:34 | |
| boris-42 | morganfainberg: around? | 20:37 |
| boris-42 | morganfainberg: hi | 20:37 |
| dstanek | morganfainberg: you co-authored your own commit! i knew there was two of you\ | 20:38 |
| morganfainberg | dstanek, huh? | 20:38 |
| morganfainberg | dstanek, no you owned the change didn't you? | 20:38 |
| morganfainberg | oh it broke your sumbission | 20:39 |
| morganfainberg | let me fix that | 20:39 |
| dstanek | morganfainberg: lol | 20:39 |
| morganfainberg | i'll set you co-author? or you want to be primary? i don't care | 20:39 |
| dstanek | co-author is fine | 20:39 |
| dstanek | boris-42: hi | 20:39 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 20:40 |
| morganfainberg | fixed | 20:40 |
| rodrigods | morganfainberg, thanks for your review! | 20:40 |
| morganfainberg | rodrigods, comments on https://review.openstack.org/#/c/117786/ | 20:40 |
| morganfainberg | it's closew | 20:40 |
| morganfainberg | it really is | 20:40 |
| boris-42 | dstanek: hi =) | 20:40 |
| morganfainberg | boris-42, hi i'm here as well, in the middle of a bunch of stuff, but might be able to chat some. | 20:41 |
| boris-42 | ьmorganfainberg so I found some issue with authenticate functionallity | 20:41 |
| boris-42 | morganfainberg: during that testing of zaqar | 20:41 |
| morganfainberg | sure. | 20:41 |
| boris-42 | morganfainberg: take a look here http://logs.openstack.org/34/135134/1/check/gate-rally-dsvm-zaqar-zaqar/a806702/rally-plot/results.html.gz#/ZaqarBasic.create_queue | 20:41 |
| boris-42 | morganfainberg: on "failure" tab | 20:42 |
| boris-42 | morganfainberg: keystone just died.. | 20:42 |
| boris-42 | morganfainberg: i can repeat this in keystone gates if you would like* | 20:42 |
| morganfainberg | boris-42, i'd like to know *what* caused keystone to tip over vs "a list of it tipped over" | 20:42 |
| morganfainberg | if that makes sense? | 20:42 |
| boris-42 | morganfainberg: logs enough? | 20:43 |
| morganfainberg | i mean, perhaps. | 20:43 |
| morganfainberg | depends on what the logs are showing | 20:43 |
| morganfainberg | ;) | 20:43 |
| morganfainberg | hopefully | 20:43 |
| boris-42 | morganfainberg: http://logs.openstack.org/34/135134/1/check/gate-rally-dsvm-zaqar-zaqar/a806702/logs/ ? | 20:43 |
| boris-42 | morganfainberg: just standard dsvm logs | 20:43 |
| boris-42 | morganfainberg: we were running about 50 per/second authentication | 20:43 |
| boris-42 | morganfainberg: 2k times | 20:43 |
| *** NM has joined #openstack-keystone | 20:43 | |
| boris-42 | morganfainberg: it means 50 new per second | 20:44 |
| morganfainberg | ok where the hell is the keystone log | 20:44 |
| morganfainberg | boris-42, i don't see a keystone log there | 20:44 |
| morganfainberg | am i ... crazy? | 20:44 |
| bknudson | I think we lost the keystone logs at some point | 20:44 |
| bknudson | when switching to http | 20:44 |
| boris-42 | morganfainberg: I can't see it | 20:44 |
| boris-42 | bknudson: eh | 20:45 |
| morganfainberg | bknudson, we had them for a while | 20:45 |
| morganfainberg | i know | 20:45 |
| boris-42 | bknudson: morganfainberg lemme make patch | 20:45 |
| boris-42 | in keystone | 20:45 |
| dstanek | boris-42: died, meaning the process just went away? | 20:45 |
| bknudson | I tried to put a fix in for it but it doesn't seem to have taken | 20:45 |
| boris-42 | dstanek: I don't know not a big guru of keystone | 20:45 |
| boris-42 | AuthorizationFailure: Authorization Failed: Unable to establish connection to http://127.0.0.1:5000/v2.0/tokens | 20:45 |
| morganfainberg | bknudson, ok lets see about getting that resolved asap. | 20:46 |
| boris-42 | morganfainberg: just a second | 20:47 |
| bknudson | Looking for related changes... | 20:47 |
| bknudson | https://review.openstack.org/#/c/116133/ | 20:47 |
| bknudson | https://review.openstack.org/#/c/116134/ | 20:47 |
| bknudson | https://review.openstack.org/#/c/116132/ | 20:47 |
| bknudson | https://review.openstack.org/#/c/116135/ | 20:48 |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: Test authenticate (DO NOT MERGE) https://review.openstack.org/136485 | 20:49 |
| boris-42 | bknudson: morganfainberg ^ this should reproduce it in keystone gates | 20:50 |
| morganfainberg | boris-42, ty. | 20:50 |
| morganfainberg | boris-42, we need to chase down our logs first though :P | 20:50 |
| boris-42 | morganfainberg: I hope now we will gate keystone logs as well | 20:50 |
| boris-42 | morganfainberg: actually you can use that task to repeat it locally * | 20:50 |
| bknudson | here's one that was abandoned: https://review.openstack.org/#/c/116404/ | 20:52 |
| morganfainberg | bknudson, my guess is we're just missing the infra "grab the log" | 20:53 |
| morganfainberg | config line | 20:53 |
| *** afazekas has quit IRC | 20:54 | |
| *** ajayaa has quit IRC | 20:56 | |
| *** tsufiev has quit IRC | 20:56 | |
| *** topol has joined #openstack-keystone | 20:58 | |
| *** ChanServ sets mode: +v topol | 20:58 | |
| *** tsufiev has joined #openstack-keystone | 20:59 | |
| openstackgerrit | Merged openstack/keystone: Adds missing log hints for level E/I/W https://review.openstack.org/118883 | 21:02 |
| *** packet has quit IRC | 21:03 | |
| *** Ctina_ has quit IRC | 21:05 | |
| morganfainberg | bknudson, ok yeah that looks like we need that, the "screen" isn't actually logging *i guess* | 21:07 |
| morganfainberg | weird. | 21:07 |
| *** NM has quit IRC | 21:07 | |
| bknudson | morganfainberg: I've been running locally with eventlet so I can debug, so am not sure what it looks like when run in httpd. | 21:07 |
| morganfainberg | yeah i'll go poke at this a bit more unless infra has a quick answer | 21:08 |
| bknudson | morganfainberg: I can restore that one if you want, then see if has a keystone log | 21:09 |
| morganfainberg | might be good. | 21:09 |
| *** NM has joined #openstack-keystone | 21:10 | |
| *** NM has quit IRC | 21:15 | |
| bknudson | morganfainberg: it prints out the config file a billion times. | 21:17 |
| morganfainberg | bknudson, welcome to each worker starting up | 21:18 |
| morganfainberg | bknudson, each tiem a worker is started it dumps the config, debug mode | 21:18 |
| bknudson | morganfainberg: there's a way to have some parts "cached"... | 21:18 |
| bknudson | I think I had a change for it at one point. | 21:18 |
| morganfainberg | what does that mean? | 21:18 |
| morganfainberg | some parts cached? | 21:19 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/71642/ | 21:20 |
| morganfainberg | ah | 21:20 |
| morganfainberg | we could make a pre-loader script that isn't keystone.application | 21:21 |
| morganfainberg | similar to what we have in httpd/keystone.py | 21:21 |
| morganfainberg | but specifically for pre-load | 21:21 |
| bknudson | does it actually re-read the config file when it starts a worker? | 21:22 |
| morganfainberg | likely | 21:22 |
| bknudson | that would be confusing for someone who makes a change not expecting it to take effect | 21:23 |
| morganfainberg | it is a complete applciation spin-up. | 21:23 |
| morganfainberg | hm. well maybe not... | 21:23 |
| morganfainberg | it *might* just start the runtime which does the debug | 21:23 |
| morganfainberg | my guess is it reloads configs. | 21:23 |
| morganfainberg | yeah. it looks like it reloads the configs | 21:24 |
| bknudson | new feature, dynamic config | 21:24 |
| morganfainberg | welllllll sortof | 21:24 |
| morganfainberg | >.> | 21:24 |
| morganfainberg | ;) | 21:24 |
| bknudson | "KVS lock acquired for: os-revoke-events acquire" -- sure does acquire this lock a lot | 21:25 |
| bknudson | is it doing an update? | 21:25 |
| bknudson | and according to the log it acquires the lock twice anyways: http://logs.openstack.org/81/133881/6/check/check-tempest-dsvm-full/72e1059/logs/apache/keystone.txt.gz#_2014-11-19_07_33_19_454 | 21:26 |
| bknudson | that's an odd kind of lock | 21:26 |
| bknudson | debug log considered useless. | 21:29 |
| bknudson | even the warnings are useless: 2014-11-19 07:49:19.767491 24840 WARNING keystone.common.wsgi [-] Could not find project: 6144a75d98d9442baa519096cd076a59 | 21:30 |
| bknudson | weird: 2014-11-19 07:45:23.188878 24838 WARNING keystone.common.wsgi [-] Invalid input for field 'enabled'. The value is 'False'. | 21:32 |
| bknudson | is it just ignored? | 21:32 |
| -openstackstatus- NOTICE: gating is going offline while we deal with a broken block device, eta unknown | 21:44 | |
| *** ChanServ changes topic to "gating is going offline while we deal with a broken block device, eta unknown" | 21:44 | |
| openstackgerrit | Abhishek Kekane proposed openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 21:50 |
| dolphm | morganfainberg: meeting next week? | 21:51 |
| bknudson | those who don't use apache are doomed to reimplement it | 21:51 |
| dolphm | bknudson: tshirt that | 21:51 |
| morganfainberg | dolphm, uhm. | 21:51 |
| morganfainberg | dolphm, oh. | 21:51 |
| morganfainberg | it's that eat too much food holiday | 21:52 |
| morganfainberg | I was thinking we could still meet - but i wont hold it against anyone who is on vacation | 21:52 |
| dolphm | morganfainberg: THE BEST ONE | 21:52 |
| bknudson | stevemar and others will be here. | 21:52 |
| dolphm | morganfainberg: well i'll be around, but figure there might be a bunch of slackers | 21:52 |
| morganfainberg | dolphm, so we'll have a "ok everyone go eat food" | 21:52 |
| morganfainberg | ;) | 21:53 |
| stevemar | bknudson, i'm gonna what now? | 21:53 |
| bknudson | stevemar: you already had your turkey | 21:53 |
| bknudson | 2nd monday in october | 21:54 |
| dolphm | stevemar: celebrate your americanism by working next week | 21:54 |
| stevemar | bknudson, you are correct | 21:54 |
| dolphm | morganfainberg: marekd|away: OH totally got a moka pot today | 21:54 |
| stevemar | dolphm, i have no choice, i am forced to hold down the fort | 21:54 |
| bknudson | they're smarter in that they don't pile all their holidays together | 21:54 |
| dolphm | stevemar: that's because you don't live in a free country | 21:54 |
| morganfainberg | dolphm, damn it. I kinda want one today... | 21:54 |
| stevemar | bknudson you know too much about us, just convert over | 21:55 |
| morganfainberg | stevemar, you *could* just move. | 21:55 |
| dolphm | morganfainberg: i got the 3 "cup" one (6oz) | 21:55 |
| morganfainberg | nice | 21:55 |
| bknudson | move to buffalo | 21:55 |
| dolphm | it's just like canada except with freedom | 21:55 |
| morganfainberg | dolphm, oh so, Austin Dec, 8, 9, 10. supposed to be meeting with bunch of RAX folks on the 10th afternoon | 21:55 |
| morganfainberg | in the austin office | 21:55 |
| dolphm | morganfainberg: yeah, i'm on the invite :) | 21:55 |
| morganfainberg | i think you were on that list | 21:55 |
| morganfainberg | haha | 21:56 |
| morganfainberg | ;) | 21:56 |
| morganfainberg | just realized it | 21:56 |
| *** tellesnobrega_ has joined #openstack-keystone | 21:57 | |
| dolphm | morganfainberg: i'll be there | 21:58 |
| dstanek | i'll be here next week too :-( | 22:02 |
| dstanek | i had some functional testing stuff to talk about next week. should i just hold on to it until 12/2? | 22:04 |
| dstanek | morganfainberg: to spec or not to spec https://blueprints.launchpad.net/keystone/+spec/remove-py26-hacks | 22:05 |
| *** topol has quit IRC | 22:05 | |
| morganfainberg | i think that is one we toss on the list to say "no spec needed" | 22:06 |
| rodrigods | morganfainberg, ping re: https://review.openstack.org/#/c/117786/34/keystone/tests/test_backend_ldap.py . In a previous patch, we made the HM calls from LDAP to return "default" values instead of raising NotImplemented: https://github.com/openstack/keystone/blob/feature/hierarchical-multitenancy/keystone/assignment/backends/ldap.py#L77 | 22:07 |
| morganfainberg | rodrigods, if its a default value *or* a notimplemented doesn't matter to me | 22:08 |
| morganfainberg | as long as we *test* for that response | 22:08 |
| morganfainberg | means someone wont wedge something in and change behavior | 22:08 |
| morganfainberg | rather than skipping the test | 22:08 |
| rodrigods | morganfainberg, cool... thanks | 22:08 |
| morganfainberg | dolphm, i might ask you to cover the 1:1 Release meeting on Tuesday the 9th. depends on how busy i am that day. | 22:13 |
| morganfainberg | dolphm, if you're open to it. | 22:13 |
| dolphm | morganfainberg: happy to | 22:13 |
| morganfainberg | dolphm, cool. yeah not sure how impacted my time will be that day. hopefully not too bad, but we'll see | 22:13 |
| bknudson | I'm going to start buying up RAX stock now. | 22:14 |
| dolphm | morganfainberg: actually, when is your new timeslot? | 22:14 |
| morganfainberg | dolphm, uhm sec | 22:14 |
| dolphm | bknudson: =) | 22:14 |
| morganfainberg | dolphm, 1700 UTC (9am Pacific) - 1710 | 22:16 |
| dolphm | morganfainberg: k | 22:16 |
| * dolphm recently bought a digital wall clock for my office and set it to UTC | 22:17 | |
| morganfainberg | i actually defaulted back to using Outlook because exchange *can* to UTC meetings | 22:19 |
| morganfainberg | dolphm, i also have in the new notification center on the mac a UTC clock ;) | 22:19 |
| morganfainberg | yay widgets! | 22:20 |
| dstanek | i wish google would do that :-( makes things so much harder | 22:20 |
| morganfainberg | dstanek, i *hear* you can make a custom timezone. | 22:20 |
| morganfainberg | i haven't successfully done it though | 22:21 |
| dolphm | morganfainberg: that might be a useful widget! | 22:21 |
| dolphm | never heard of such a thing | 22:21 |
| morganfainberg | dolphm, yeah i have West Coast, UTC, Central, Eastern, and Brisbane | 22:21 |
| dstanek | morganfainberg: i started to use iceland's timezone because it's UTC with no DST | 22:21 |
| dolphm | can you set timezones in owa? | 22:22 |
| morganfainberg | dstanek, I see a GMT +0 NO DST | 22:23 |
| morganfainberg | dolphm, no :( | 22:23 |
| morganfainberg | dolphm, or at least i wasn't able to figure out how. | 22:23 |
| morganfainberg | dstanek, in google now. let me try setting a meeting there (I can create a calendar in that timezone) | 22:23 |
| morganfainberg | dstanek, yeah the only way I think it works is you make a whole calendar that is in GMT +0 No DST | 22:25 |
| morganfainberg | dstanek, then assign things to that calendar | 22:25 |
| morganfainberg | dstanek, lame. why can't i just set the timezone of a meeting. | 22:25 |
| dstanek | morganfainberg: hmm, maybe i'll give that a try | 22:25 |
| dstanek | if i set the timezone of a meeting it auto converts :-( | 22:25 |
| *** dims_ has joined #openstack-keystone | 22:26 | |
| morganfainberg | dolphm, OWA doesn't seem to know how to do timezones. | 22:27 |
| morganfainberg | dolphm, but Outlook (ugh) does. | 22:27 |
| morganfainberg | yes i'm using the mac version | 22:27 |
| *** richm1 has joined #openstack-keystone | 22:29 | |
| dolphm | morganfainberg: i'm so sorry | 22:29 |
| morganfainberg | dolphm, i acutally only use it to schedule things in UTC | 22:29 |
| morganfainberg | on my calendar | 22:29 |
| morganfainberg | :P | 22:29 |
| *** dimsum__ has quit IRC | 22:29 | |
| morganfainberg | >.> | 22:29 |
| dolphm | morganfainberg: my condolences | 22:30 |
| morganfainberg | haha | 22:30 |
| *** NM has joined #openstack-keystone | 22:46 | |
| *** tellesnobrega_ has quit IRC | 22:47 | |
| *** jsavak has quit IRC | 22:50 | |
| *** tellesnobrega_ has joined #openstack-keystone | 22:56 | |
| *** packet has joined #openstack-keystone | 22:56 | |
| *** gordc has quit IRC | 22:56 | |
| *** bknudson has quit IRC | 22:58 | |
| *** htruta_ has joined #openstack-keystone | 23:08 | |
| *** chrisshattuck has quit IRC | 23:16 | |
| *** chrisshattuck has joined #openstack-keystone | 23:16 | |
| *** dims_ has quit IRC | 23:16 | |
| *** edmondsw has quit IRC | 23:17 | |
| *** dimsum__ has joined #openstack-keystone | 23:19 | |
| *** packet has quit IRC | 23:25 | |
| *** RichardRaseley has quit IRC | 23:44 | |
| *** dimsum__ has quit IRC | 23:55 | |
| *** dimsum__ has joined #openstack-keystone | 23:55 | |
| *** dimsum__ has quit IRC | 23:56 | |
| *** dimsum__ has joined #openstack-keystone | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!