| *** kobtea has quit IRC | 00:00 | |
| *** dims has quit IRC | 00:03 | |
| *** sigmavirus24 has left #openstack-keystone | 00:03 | |
| *** dims has joined #openstack-keystone | 00:03 | |
| *** nkinder has joined #openstack-keystone | 00:05 | |
| *** gordc has quit IRC | 00:05 | |
| *** dims has quit IRC | 00:08 | |
| bknudson | what if rather than remove the keystoneclient tests we changed it so that it runs the tests with a keystoneclient in the venv (instead of checkout)? | 00:12 |
|---|---|---|
| bknudson | would that be an improvement? | 00:12 |
| bknudson | removing the keystoneclient tests makes a lot of code uncovered | 00:13 |
| bknudson | and it's going to take a lot of work to get the coverage back up | 00:13 |
| morganfainberg | bknudson, since we're not using it as a master ksc vs <vintage of keystone> really anymore | 00:14 |
| morganfainberg | that seems like a good choice, just use the ksc in the venv, we *do* require it | 00:14 |
| bknudson | I'll try making that change... should be pretty easy | 00:14 |
| *** david-lyle is now known as david-lyle_afk | 00:17 | |
| *** chrisshattuck has quit IRC | 00:18 | |
| *** _cjones_ has quit IRC | 00:18 | |
| *** dims has joined #openstack-keystone | 00:21 | |
| *** _cjones_ has joined #openstack-keystone | 00:23 | |
| jamielennox | lbragstad: so one of the people in the audience of the session in paris asked to please not encrypt data that isn't necessarily private. do we consider the information within the AE token private? | 00:24 |
| jamielennox | is it a security risk to expose those parameters to anyone who can grab the token anyway? | 00:25 |
| *** ncoghlan is now known as ncoghlan_afk | 00:26 | |
| morganfainberg | jamielennox, afaik no | 00:26 |
| jamielennox | morganfainberg: i can't think of a reason it is - so is there a reason to encrypt the payload? | 00:27 |
| morganfainberg | nah, but an HMAC is required. | 00:27 |
| morganfainberg | at the very least | 00:27 |
| morganfainberg | something keystonec an use to validate | 00:27 |
| jamielennox | sure | 00:27 |
| *** ncoghlan_afk is now known as ncoghlan | 00:28 | |
| jamielennox | not questioning that at all | 00:28 |
| *** dims has quit IRC | 00:31 | |
| *** dims has joined #openstack-keystone | 00:31 | |
| *** dims has quit IRC | 00:36 | |
| *** david-lyle_afk has quit IRC | 00:45 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:51 | |
| jamielennox | bknudson: posted https://review.openstack.org/#/c/136931/ for nova->neutron | 00:54 |
| *** Mario_ has joined #openstack-keystone | 00:54 | |
| bknudson | jamielennox: cool! | 00:55 |
| bknudson | jamielennox: so it can use v3 auth now? | 00:55 |
| bknudson | seems like every use of session needs a custom auth plugin... | 00:56 |
| bknudson | not sure that's how it was supposed to work | 00:56 |
| jamielennox | hmm, that's the idea, i had it configured to run with v2.Password in devstack - i should test v3 | 00:56 |
| jamielennox | bknudson: yea, it's getting annoying, essentially it's just creating a default plugin which replicates the existing config structure | 00:57 |
| bknudson | it would be nice if some old behavior that requires it could at least be deprecated | 00:57 |
| jamielennox | bknudson: in this case i could probably just have the options always defined and create a v2.Password or token_endpoint.Token and use that but i wanted to get the old options out of the list | 00:58 |
| jamielennox | the idea would be to deprecate that whole plugin | 00:59 |
| jamielennox | also that PluginProxy can go away when neutronclient starts accepting my patches | 00:59 |
| jamielennox | got sick of waiting for them | 01:00 |
| *** tellesnobrega_ has quit IRC | 01:01 | |
| openstackgerrit | wanghong proposed openstack/python-keystoneclient: remove the value convert that no logger needed https://review.openstack.org/132500 | 01:03 |
| *** tellesnobrega_ has joined #openstack-keystone | 01:04 | |
| *** r-daneel has quit IRC | 01:07 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Keystoneclient tests from venv-installed client https://review.openstack.org/136636 | 01:09 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup test-requirements for keystoneclient https://review.openstack.org/136939 | 01:09 |
| jamielennox | bknudson: v3 works fine with tyhat patch | 01:11 |
| *** diegows has quit IRC | 01:12 | |
| *** david-lyle_afk has joined #openstack-keystone | 01:14 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove unused testscenarios requirement https://review.openstack.org/136940 | 01:21 |
| bknudson | jamielennox: you can set the domain? | 01:21 |
| jamielennox | bknudson: yes | 01:22 |
| bknudson | sweet | 01:22 |
| jamielennox | bknudson: relevant config file section in nova.conf http://paste.openstack.org/show/137809/ | 01:22 |
| jamielennox | can set v3password and add /v3 to auth url if you want to check - bug the password plugin will always go to v3 if domains are present | 01:23 |
| jamielennox | s/bug/but | 01:23 |
| bknudson | can you regenerate the config file and post it? | 01:24 |
| bknudson | (the sample config) | 01:24 |
| jamielennox | bknudson: won't change much from generated i think because it will have the old config options | 01:24 |
| jamielennox | by dfeualt | 01:24 |
| bknudson | I don't think project_name was used before... wasn't it tenant_name? | 01:25 |
| jamielennox | yes | 01:25 |
| jamielennox | project_name is a value from the password plugin | 01:26 |
| bknudson | jamielennox: you going to change devstack to set it to use v3 auth? | 01:26 |
| jamielennox | bknudson: yes, i had a POC a while ago to do that, it wasn't a hard change | 01:26 |
| jamielennox | the cinder one is merged now so i guess i can start on that | 01:27 |
| *** tellesnobrega_ has quit IRC | 01:28 | |
| jamielennox | so nova sample config generator doesn't work with the cmd given in the readme | 01:28 |
| bknudson | jamielennox: your pasted config has "username" but the option in the review is "admin_username" | 01:28 |
| *** tellesnobrega_ has joined #openstack-keystone | 01:28 | |
| bknudson | jamielennox: nova tox.ini calls it genconfig | 01:29 |
| jamielennox | bknudson: so what is happening is when you specify auth_plugin=username instead of using the (i think i called it) DefaultAuthPlugin which contains all the admin_username etc options it loads the options for the username plugin | 01:29 |
| jamielennox | the username plugin specifies the username, project_id, project_domain_id etc options | 01:29 |
| bknudson | oh, you set the plugin | 01:29 |
| jamielennox | if you don't specify an auth_plugin = then you get the default one which will load up all the old values | 01:30 |
| jamielennox | s/username plugin/password plugin | 01:30 |
| bknudson | and the sample config file has all these options? | 01:30 |
| jamielennox | bknudson: still generating the tox env - however it won't by default | 01:31 |
| bknudson | how is anybody going to know that they can use these other options with a different value for auth_plugin? | 01:31 |
| jamielennox | auth_plugin will always be there, but the additional options are going to be dependant on the value of auth_plugin= | 01:31 |
| jamielennox | right - good unsolved question | 01:32 |
| jamielennox | so loading from plugin lets you do auth_section | 01:32 |
| jamielennox | so you can say [neutron] auth_section = neutronpassword [neutronpassword] auth_plugin = password .... | 01:33 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove requirements not needed by oslo-incubator modules anymore https://review.openstack.org/136941 | 01:33 |
| jamielennox | so 1 idea is to just generate a couple of 'sections' that would contain like the password default values (as that is the plugin i expect everyone to use) | 01:34 |
| jamielennox | but a driving force here is to allow someone to do like client cert auth from neutron, possibly kerberos and we can't just add everything to the config | 01:35 |
| bknudson | jamielennox: sample sections for configurations that are recommended seems like it would be adequate. | 01:36 |
| bknudson | e.g., the old config options and password for v3 auth. | 01:36 |
| *** dims has joined #openstack-keystone | 01:42 | |
| *** htruta_ has quit IRC | 01:44 | |
| *** tellesnobrega_ has quit IRC | 01:45 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Keystoneclient tests from venv-installed client https://review.openstack.org/136636 | 01:50 |
| *** gyee_ has quit IRC | 01:55 | |
| *** _cjones_ has quit IRC | 01:58 | |
| *** dims has quit IRC | 02:00 | |
| *** dims has joined #openstack-keystone | 02:00 | |
| *** dims has quit IRC | 02:05 | |
| *** ncoghlan is now known as ncoghlan_afk | 02:06 | |
| *** erkules_ has joined #openstack-keystone | 02:29 | |
| *** erkules has quit IRC | 02:31 | |
| openstackgerrit | Will Foster proposed openstack/keystone: LP: #1395959: skip assignment table inserts when migrating schema from H to I if duplicate entries exist https://review.openstack.org/136946 | 02:32 |
| *** amcrn has quit IRC | 02:37 | |
| openstackgerrit | Will Foster proposed openstack/keystone: LP #1395959: skip assignment table inserts when duplicate entries are present or else keystone-manage db_sync fails, also fixing whitespace. https://review.openstack.org/136948 | 02:39 |
| uvirtbot | Launchpad bug 1395959 in keystone "assignment table migration fails for keystone-manage db_sync if duplicate entry exists" [Undecided,New] https://launchpad.net/bugs/1395959 | 02:39 |
| *** esp has quit IRC | 02:43 | |
| *** esmute has quit IRC | 02:44 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:49 | |
| openstackgerrit | Merged openstack/keystone: Add WSGIPassAuthorization to OAuth docs https://review.openstack.org/134388 | 02:53 |
| *** KanagarajM has joined #openstack-keystone | 02:54 | |
| openstackgerrit | Merged openstack/keystone: Speed up memcache lock https://review.openstack.org/136749 | 02:57 |
| openstackgerrit | Will Foster proposed openstack/keystone: LP #1395959: Skip assignment table inserts during db_sync if duplicate entries present. Change-Id: I394a0391ee074c3ee79bdb06391fc4d5fb9067a9 https://review.openstack.org/136946 | 03:08 |
| uvirtbot | Launchpad bug 1395959 in keystone "assignment table migration fails for keystone-manage db_sync if duplicate entry exists" [Undecided,New] https://launchpad.net/bugs/1395959 | 03:08 |
| *** dnalezyt has quit IRC | 03:11 | |
| *** ncoghlan_afk is now known as ncoghlan | 03:21 | |
| *** richm has quit IRC | 03:25 | |
| *** kobtea has joined #openstack-keystone | 03:33 | |
| *** KanagarajM has quit IRC | 03:36 | |
| *** kobtea has quit IRC | 03:38 | |
| *** erkules_ is now known as erkules | 04:15 | |
| *** esp has joined #openstack-keystone | 04:27 | |
| *** stevemar has quit IRC | 04:36 | |
| *** oomichi has quit IRC | 04:38 | |
| *** _cjones_ has joined #openstack-keystone | 04:59 | |
| *** _cjones_ has quit IRC | 05:03 | |
| *** esmute has joined #openstack-keystone | 05:04 | |
| *** chrisshattuck has joined #openstack-keystone | 05:06 | |
| *** mikedillion has quit IRC | 05:09 | |
| *** jamielennox has quit IRC | 05:11 | |
| *** jamielennox has joined #openstack-keystone | 05:11 | |
| *** ChanServ sets mode: +v jamielennox | 05:11 | |
| *** chrissha_ has joined #openstack-keystone | 05:16 | |
| *** chrisshattuck has quit IRC | 05:17 | |
| *** ncoghlan is now known as ncoghlan_afk | 05:22 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Handle SSL termination proxies for version list https://review.openstack.org/132235 | 05:26 |
| *** amerine has quit IRC | 05:27 | |
| *** ncoghlan_afk is now known as ncoghlan | 05:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add --os-user-id to generic password plugin https://review.openstack.org/136968 | 05:29 |
| *** oomichi has joined #openstack-keystone | 05:32 | |
| *** ajayaa has joined #openstack-keystone | 05:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:05 |
| *** renlt has joined #openstack-keystone | 06:06 | |
| *** zzzeek has quit IRC | 06:16 | |
| *** k4n0 has joined #openstack-keystone | 06:24 | |
| *** xiaozhi has joined #openstack-keystone | 06:26 | |
| *** _cjones_ has joined #openstack-keystone | 06:33 | |
| *** ajayaa has quit IRC | 06:35 | |
| *** _cjones_ has quit IRC | 06:39 | |
| *** _cjones_ has joined #openstack-keystone | 06:39 | |
| *** ukalifon has joined #openstack-keystone | 06:46 | |
| *** lhcheng has joined #openstack-keystone | 06:52 | |
| *** ajayaa has joined #openstack-keystone | 06:54 | |
| zhiyan | ayoung: there regular expressions are applied on image's properties but oslo config. btw, sorry for delay response, due to timezone issue. | 06:55 |
| *** harlowja is now known as harlowja_away | 07:01 | |
| *** lhcheng has quit IRC | 07:08 | |
| *** kobtea has joined #openstack-keystone | 07:10 | |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 07:12 |
| *** chrissha_ has quit IRC | 07:13 | |
| *** lhcheng has joined #openstack-keystone | 07:14 | |
| *** ncoghlan has quit IRC | 07:14 | |
| *** kobtea has quit IRC | 07:15 | |
| *** ajayaa has quit IRC | 07:47 | |
| *** jamielennox is now known as jamielennox|away | 07:49 | |
| *** drjones has joined #openstack-keystone | 08:03 | |
| *** _cjones_ has quit IRC | 08:06 | |
| *** ajayaa has joined #openstack-keystone | 08:10 | |
| *** lhcheng has quit IRC | 08:15 | |
| *** lhcheng has joined #openstack-keystone | 08:15 | |
| *** jistr has joined #openstack-keystone | 08:18 | |
| *** drjones has quit IRC | 08:18 | |
| *** ukalifon has quit IRC | 08:27 | |
| *** afazekas has joined #openstack-keystone | 08:34 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Handle SSL termination proxies for version list https://review.openstack.org/132235 | 08:41 |
| *** ajayaa has quit IRC | 08:45 | |
| *** ajayaa has joined #openstack-keystone | 08:46 | |
| *** bdossant has joined #openstack-keystone | 08:56 | |
| *** ajayaa has quit IRC | 09:00 | |
| *** ukalifon has joined #openstack-keystone | 09:05 | |
| *** ajayaa has joined #openstack-keystone | 09:10 | |
| *** svasheka has quit IRC | 09:11 | |
| openstackgerrit | wanghong proposed openstack/python-keystoneclient: remove the value convert that no logger needed https://review.openstack.org/132500 | 09:22 |
| *** renlt has quit IRC | 09:25 | |
| *** oomichi has quit IRC | 09:33 | |
| *** jistr has quit IRC | 09:33 | |
| *** nellysmitt has joined #openstack-keystone | 09:39 | |
| *** aix has quit IRC | 09:51 | |
| *** jistr has joined #openstack-keystone | 10:03 | |
| *** aix has joined #openstack-keystone | 10:17 | |
| *** xiaozhi has quit IRC | 10:28 | |
| *** xiaozhi_ has joined #openstack-keystone | 10:35 | |
| *** xiaozhi_ has quit IRC | 10:40 | |
| *** NM has joined #openstack-keystone | 10:43 | |
| *** kobtea has joined #openstack-keystone | 10:48 | |
| *** diegows has joined #openstack-keystone | 10:52 | |
| *** kobtea has quit IRC | 10:52 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 10:52 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Scope federated tokens with ``token`` auth method. https://review.openstack.org/137020 | 11:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improves List Role Assignment Tests https://review.openstack.org/137021 | 11:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 11:13 |
| breton | hi | 11:15 |
| breton | can /tokens/revoked be called when uuid is used as token provider? | 11:15 |
| *** lhcheng has quit IRC | 11:16 | |
| *** aix has quit IRC | 11:18 | |
| *** _cjones_ has joined #openstack-keystone | 11:19 | |
| *** k4n0 has quit IRC | 11:20 | |
| *** dims has joined #openstack-keystone | 11:20 | |
| *** _cjones_ has quit IRC | 11:24 | |
| *** henrynash has joined #openstack-keystone | 11:24 | |
| *** ChanServ sets mode: +v henrynash | 11:24 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Create a framework for federation plugins https://review.openstack.org/130564 | 11:25 |
| *** aix has joined #openstack-keystone | 11:31 | |
| openstackgerrit | Christian Berendt proposed openstack/keystone: Log the username when using an invalid username or password https://review.openstack.org/128860 | 11:40 |
| *** lhcheng has joined #openstack-keystone | 11:54 | |
| *** lhcheng has quit IRC | 11:59 | |
| *** lhcheng has joined #openstack-keystone | 12:10 | |
| *** NM has quit IRC | 12:15 | |
| *** NM has joined #openstack-keystone | 12:17 | |
| *** lhcheng_ has joined #openstack-keystone | 12:21 | |
| *** diegows has quit IRC | 12:23 | |
| *** lhcheng has quit IRC | 12:24 | |
| *** tellesnobrega_ has quit IRC | 12:25 | |
| *** NM has quit IRC | 12:29 | |
| *** bdossant_ has joined #openstack-keystone | 12:31 | |
| *** bdossan__ has joined #openstack-keystone | 12:32 | |
| *** jistr is now known as jistr|english | 12:32 | |
| *** bdossant has quit IRC | 12:34 | |
| *** bdossant_ has quit IRC | 12:35 | |
| *** bdossant has joined #openstack-keystone | 12:44 | |
| *** bdossan__ has quit IRC | 12:45 | |
| *** viktors|afk has left #openstack-keystone | 12:45 | |
| *** bdossant_ has joined #openstack-keystone | 12:47 | |
| *** bdossant has quit IRC | 12:49 | |
| *** NM has joined #openstack-keystone | 12:51 | |
| *** amakarov_away is now known as amakarov | 12:58 | |
| *** NM has quit IRC | 13:07 | |
| *** NM has joined #openstack-keystone | 13:07 | |
| *** NM has quit IRC | 13:08 | |
| samuelms | henrynash, morning | 13:11 |
| henrynash | samulems: morning | 13:11 |
| samuelms | henrynash, once we have your patch for splitting out the actual assignment backend .. we'll need to split out the tests, right? | 13:11 |
| henrynash | samulems: yes | 13:11 |
| samuelms | henrynash, can I grab this? | 13:11 |
| henrynash | samulems: sure!!!! | 13:11 |
| samuelms | henrynash, :) | 13:11 |
| henrynash | samulems: and in the resource piece, teh code should call resoruce where requied etc. | 13:12 |
| samuelms | henrynash, sure | 13:12 |
| samuelms | henrynash, I saw morgan's thoughts about the role placement .. | 13:12 |
| samuelms | henrynash, he's for placing the role on assignment instead of on resource, right? | 13:13 |
| henrynash | samulems: I sent something to the dev list earlier today on this….and have it on the agenda for tonights calll | 13:13 |
| samuelms | henrynash, perfect ! will follow and share my opinion .. thanks | 13:13 |
| henrynash | samulems: yes, he is making the argument for leaving role definition in the “assignment” piece | 13:13 |
| samuelms | henrynash, for me that makes sense (if you wanna discuss a bit about this) | 13:14 |
| henrynash | samulems: I’m open to people’s arguments either way | 13:14 |
| henrynash | samulems: please comment on the list, really want to get people’s views... | 13:15 |
| samuelms | henrynash, ok :) | 13:15 |
| *** NM has joined #openstack-keystone | 13:15 | |
| *** NM has quit IRC | 13:22 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 13:30 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 13:33 |
| *** NM has joined #openstack-keystone | 13:34 | |
| *** NM has quit IRC | 13:34 | |
| *** kobtea has joined #openstack-keystone | 13:37 | |
| *** gordc has joined #openstack-keystone | 13:40 | |
| *** kobtea has quit IRC | 13:42 | |
| openstackgerrit | Christian Berendt proposed openstack/keystone: Log the username when using an invalid username or password https://review.openstack.org/128860 | 13:52 |
| *** bdossant_ has quit IRC | 13:56 | |
| *** bdossant_ has joined #openstack-keystone | 13:56 | |
| *** dims has quit IRC | 13:57 | |
| *** dims has joined #openstack-keystone | 13:58 | |
| *** NM has joined #openstack-keystone | 13:59 | |
| *** bdossant_ has quit IRC | 13:59 | |
| *** bdossant has joined #openstack-keystone | 14:01 | |
| *** diegows has joined #openstack-keystone | 14:05 | |
| *** NM has quit IRC | 14:06 | |
| *** richm has joined #openstack-keystone | 14:08 | |
| *** jistr|english is now known as jistr | 14:13 | |
| *** nkinder has quit IRC | 14:14 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 14:21 |
| *** joesavak has joined #openstack-keystone | 14:23 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 14:24 |
| openstackgerrit | henry-nash proposed openstack/keystone: Ensure controllers and managers reference new resource manager. https://review.openstack.org/133525 | 14:26 |
| *** raildo has quit IRC | 14:27 | |
| lbragstad | morganfainberg: jamielennox|away re: service['name'] | 14:32 |
| lbragstad | morganfainberg: jamielennox|away are we still going to require that a user supplies it? | 14:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move functional tests to keystone/tests/functional https://review.openstack.org/133556 | 14:35 |
| mkoderer | hi folks, one question to keystone with ldap backend.. where does the initial admin user come from? I didn't find a ldif for that.. | 14:49 |
| *** r-daneel has joined #openstack-keystone | 14:51 | |
| *** bdossant has quit IRC | 15:01 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Migration script for adding name to service table https://review.openstack.org/136917 | 15:01 |
| *** josecastroleon has joined #openstack-keystone | 15:03 | |
| *** bdossant has joined #openstack-keystone | 15:03 | |
| *** nkinder has joined #openstack-keystone | 15:06 | |
| *** afazekas has quit IRC | 15:11 | |
| *** david-lyle has joined #openstack-keystone | 15:30 | |
| *** ayoung has quit IRC | 15:33 | |
| *** ayoung has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v ayoung | 15:33 | |
| *** henrynash has quit IRC | 15:38 | |
| *** david-lyle has quit IRC | 15:43 | |
| bknudson | btw, if you're getting NOT_REGISTERED from gate-tempest-dsvm-src-keystonemiddleware-icehouse or client reviews, seems like it's been fixed so should just recheck | 15:51 |
| *** ukalifon has quit IRC | 16:02 | |
| *** bdossant has quit IRC | 16:02 | |
| rodrigods | bknudson, ++ thx! | 16:03 |
| openstackgerrit | Julien Danjou proposed openstack/keystone: Remove Python 2.6 classifier https://review.openstack.org/137120 | 16:03 |
| *** david-lyle_afk is now known as david-lyle | 16:07 | |
| *** bdossant has joined #openstack-keystone | 16:08 | |
| *** chrisshattuck has joined #openstack-keystone | 16:10 | |
| *** NM has joined #openstack-keystone | 16:12 | |
| *** bdossant has quit IRC | 16:15 | |
| *** raildo has joined #openstack-keystone | 16:15 | |
| *** bdossant has joined #openstack-keystone | 16:16 | |
| *** radez is now known as radez_g0n3 | 16:17 | |
| *** bdossant has quit IRC | 16:17 | |
| *** bdossant has joined #openstack-keystone | 16:18 | |
| morganfainberg | morning | 16:19 |
| *** mflobo has quit IRC | 16:19 | |
| *** mflobo has joined #openstack-keystone | 16:21 | |
| *** bdossant has quit IRC | 16:22 | |
| *** bdossant_ has joined #openstack-keystone | 16:23 | |
| dstanek | morning | 16:23 |
| ayoung | dolphm, link at the end of http://dolphm.com/openstack-kilo-design-summit-outcomes/ for HTM is a 404 should be http://dolphm.com/hierarchical-multitenancy/ but is http://dolphm.com/hierarchial-multitenancy/ .... I se no difference between those urls, but empirically I know they differ | 16:25 |
| *** zzzeek has joined #openstack-keystone | 16:25 | |
| ayoung | ah...missing a c in the latter url "hierarchial" | 16:25 |
| ayoung | mkoderer, it doesn't | 16:25 |
| ayoung | mkoderer, if you do an LDAP backend, you need to assign the admin role to a user using the admin_token | 16:26 |
| *** bdossant_ has quit IRC | 16:27 | |
| ayoung | "Hierarchical Multitenancy" sounds best in 9/4 time. | 16:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 16:32 |
| raildo | ayoung, about HM, I include 2 topics in the keystone meeting :) | 16:33 |
| raildo | https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 16:33 |
| ayoung | raildo, yeah, but did you try singing the words in 9/4/ time? | 16:33 |
| ayoung | remember to stress rar, mul and ten.... | 16:34 |
| raildo | ayoung, no hahaha | 16:34 |
| raildo | I'm a terrible singer | 16:34 |
| ayoung | hie-RAR-chi-cal MUL-ti-TEN-an-cy | 16:34 |
| ayoung | You're Brazilian, no? That means you automatically have like 5 times more rhythm than the rest of us, or so I've been told. | 16:35 |
| raildo | yes, i'm brazilian hahahaha | 16:36 |
| * ayoung goes to put on some Jobim.... | 16:36 | |
| raildo | ayoung, ++ | 16:37 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 16:37 |
| *** NM has quit IRC | 16:37 | |
| *** ajayaa has quit IRC | 16:39 | |
| *** NM has joined #openstack-keystone | 16:43 | |
| *** _cjones_ has joined #openstack-keystone | 16:44 | |
| *** NM has quit IRC | 16:44 | |
| *** fifieldt has quit IRC | 16:45 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 16:46 |
| htruta | ayoung: you should listen to some frevo! remember? | 16:46 |
| ayoung | htruta, oooh...good idea. | 16:47 |
| *** NM has joined #openstack-keystone | 16:47 | |
| ayoung | htruta, finding good things at random...but any suggestions? | 16:49 |
| htruta | ayoung: you can search for Frevo Mulher from Ze Ramalho and Morena Tropicana from Alceu Valença | 16:51 |
| ayoung | thaks | 16:51 |
| ayoung | thanks | 16:51 |
| *** thedodd has joined #openstack-keystone | 16:52 | |
| morganfainberg | dolphm, also your link to "Morgan Fainberg to cover" | 16:54 |
| morganfainberg | dolphm, links to your current page ;) | 16:54 |
| dolphm | morganfainberg: wtf lol | 16:54 |
| dolphm | morganfainberg: yes it does | 16:54 |
| morganfainberg | dolphm, hehe | 16:54 |
| dolphm | morganfainberg: fixed | 16:54 |
| morganfainberg | aha yep | 16:55 |
| morganfainberg | better | 16:55 |
| ayoung | htruta, its all over the place...accordian, punk...reggae... | 16:55 |
| *** agireud has joined #openstack-keystone | 16:56 | |
| ayoung | dolphm, still need to get the link at the bottom of the page for HTM | 16:56 |
| *** radez_g0n3 is now known as radez | 16:56 | |
| htruta | ayoung: haha... yeah... there are lots of kinds of this style... this one is kinda mixed with forró, that's why the accordian | 16:57 |
| *** NM has quit IRC | 16:57 | |
| ayoung | htruta, Guess I need to get me a Black Fedora. | 16:58 |
| htruta | ayoung: hahaha | 16:59 |
| *** NM has joined #openstack-keystone | 16:59 | |
| *** NM has quit IRC | 16:59 | |
| ayoung | htruta, actully , I really want a black Pork Pie Hat. Closer to what Alceu Valença is wearing, and goes with my last name, too. | 17:01 |
| gabriel-bezerra | ayoung: listen to this: http://grooveshark.com/s/Vassourinhas/6Nz6rk?src=5 while you see this: https://www.google.com.br/search?q=carnaval+olinda&espv=2&biw=1855&bih=993&source=lnms&tbm=isch&sa=X&ei=F7V0VKXsK9aQsQS_0IGACQ&ved=0CAYQ_AUoAQ | 17:01 |
| gabriel-bezerra | that's frevo :) | 17:02 |
| gabriel-bezerra | or this may sound more like being there in the crowd http://grooveshark.com/s/Abertura+Z+Pereira+Vassourinhas/4h1sib?src=5 | 17:02 |
| htruta | gabriel-bezerra: I showed vassourinha to him in Paris... He also learned how to dance frevo hahaha | 17:03 |
| htruta | but I think it was the bourbon's fault | 17:03 |
| gabriel-bezerra | ayoung: and this as well http://grooveshark.com/s/Voltei+Recife+Silv+rio+Pessoa/51vs9r?src=5 | 17:04 |
| gabriel-bezerra | htruta: Nice! | 17:05 |
| gabriel-bezerra | :) | 17:05 |
| morganfainberg | zzzeek, https://bugs.launchpad.net/oslo.db/+bug/1374497 | 17:05 |
| uvirtbot | Launchpad bug 1374497 in oslo.db/juno "change in oslo.db "ping" handling is causing issues in projects that are not using transactions" [High,Fix released] | 17:05 |
| zzzeek | yeah…didnt we have fixes in for that? | 17:05 |
| morganfainberg | zzzeek, we did in oslo.db, but i keep hearing people having issues with SQL backends dropping out | 17:06 |
| morganfainberg | zzzeek, not sure if it's something else or related. | 17:06 |
| morganfainberg | zzzeek, so trying to figure out if i need to find someone to take this on before K1 | 17:06 |
| zzzeek | morganfainberg: well current oslo.db should be doing things in this area the same way as before | 17:06 |
| morganfainberg | to fix the keystone side. | 17:07 |
| morganfainberg | that is. | 17:07 |
| morganfainberg | or can i punt this to when EngineFacade is fixed? | 17:07 |
| zzzeek | morganfainberg: how can i get people to pull me in when they observe database issues? I’m finding i have to go searching to find them, then to see people doing the wrong solution | 17:07 |
| morganfainberg | zzzeek, you've been in here for some of the convos i think | 17:08 |
| zzzeek | morganfainberg: um if this is less stable beahvior than we had before w oslo.db it has to be fixed as is first, enginefacade is longer term as that requires projects to migrate to it | 17:08 |
| zzzeek | morganfainberg: just found sahara doing it wrong with an alembic regression, for example | 17:08 |
| morganfainberg | zzzeek, well i haven't had a solid duplication of the complaints so far | 17:08 |
| zzzeek | i totally announced about alembic on the ML the other day, please contact me, etc., why dont they contact me? | 17:09 |
| *** dims has quit IRC | 17:09 | |
| zzzeek | morganfainberg: ok these are all keystone? | 17:09 |
| morganfainberg | "my dployment see XXX", me: how do we duplicate, "uhhh... my deployment" | 17:09 |
| morganfainberg | yeah it's all been keystone focused. | 17:09 |
| zzzeek | morganfainberg: and what oslo.db are they using? | 17:09 |
| morganfainberg | zzzeek, i'll start asking. that might be it | 17:09 |
| morganfainberg | hopefully the fixed one or later ;) | 17:09 |
| zzzeek | morganfainberg: b.c the issue with this one was, i thought ping at tranascvtion boundary was good enoguh but then it turns out it wasnt | 17:10 |
| morganfainberg | right | 17:10 |
| morganfainberg | i remember | 17:10 |
| zzzeek | so i reverted it back to on every connect | 17:10 |
| morganfainberg | ok for now i'm going to punt this out of K1 and say we'll catch this when EngineFacade is fixed and we migrate. | 17:10 |
| morganfainberg | i wont close the bug as it's tracking that we shouldn't be using session like this...but that'll go away | 17:10 |
| zzzeek | morganfainberg: Ok but if someone has thsi now lets capture their environemnt | 17:10 |
| morganfainberg | yeah | 17:10 |
| morganfainberg | will do. | 17:11 |
| zzzeek | b.c. need to make sure we get this right | 17:11 |
| morganfainberg | yep. | 17:11 |
| bknudson | zzzeek: I tried the fix for https://bugs.launchpad.net/oslo.db/+bug/1374497 on my dev system and it seemed to work as expected. | 17:11 |
| uvirtbot | Launchpad bug 1374497 in oslo.db/juno "change in oslo.db "ping" handling is causing issues in projects that are not using transactions" [High,Fix released] | 17:11 |
| morganfainberg | zzzeek, thanks :) | 17:11 |
| morganfainberg | bknudson, same. | 17:11 |
| bknudson | so not sure what else has to happen in keystone | 17:11 |
| zzzeek | my irc client is b0rking, one moment | 17:12 |
| *** zzzeek has left #openstack-keystone | 17:12 | |
| bknudson | when I've seen complaints is because they've got an older oslo.db | 17:12 |
| *** zzzeek has joined #openstack-keystone | 17:12 | |
| bknudson | (without the fix) | 17:12 |
| morganfainberg | bknudson, thats good enough for me. | 17:12 |
| morganfainberg | bknudson, i'm just looking to punt stuff off the milestone that we don' | 17:13 |
| morganfainberg | t need | 17:13 |
| morganfainberg | and we don't need that one | 17:13 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 17:13 |
| morganfainberg | but we shouldn't be using session in autocommit. We'll fix that moving to enginefacade | 17:13 |
| morganfainberg | when it's fixed/redesigned | 17:13 |
| zzzeek | which I still have to write :) | 17:13 |
| morganfainberg | zzzeek, yep. so it's not K1 for us ;) | 17:13 |
| bknudson | if there's a bp for it already then I don't think we need another bug. | 17:14 |
| morganfainberg | bknudson, its a bp in oslo? | 17:14 |
| morganfainberg | bknudson, i'm happy to close the bug if you think thats warranted in this case. | 17:15 |
| *** kobtea has joined #openstack-keystone | 17:15 | |
| bknudson | y, there's a spec in oslo for the enginefacade. | 17:15 |
| bknudson | and the keystone bug isn't assigned to anyone. | 17:16 |
| bknudson | my opinion is close it. | 17:16 |
| morganfainberg | bknudson, ok sounds good, feel free to smush the bug closed ;) | 17:16 |
| morganfainberg | i'll circle back on it later if i see it next trip through the bug tracker. /me continues to try and triage the new bugs. | 17:17 |
| *** kobtea has quit IRC | 17:19 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 17:24 |
| *** edmondsw has joined #openstack-keystone | 17:30 | |
| amakarov | morganfainberg, hi! I've stated in the spec that modification not allowed, review it again please - that one was a rebase before modification :) | 17:33 |
| morganfainberg | amakarov, sounds good | 17:33 |
| amakarov | morganfainberg, btw found & fixed related issue in trust manager - was not covered by tests and allowed to do nasty things with redelegation count | 17:35 |
| *** zzzeek has quit IRC | 17:36 | |
| samuelms | morganfainberg, few minutes to discuss about assignment backend split? | 17:38 |
| *** zzzeek has joined #openstack-keystone | 17:38 | |
| *** ajayaa has joined #openstack-keystone | 17:38 | |
| morganfainberg | samuelms, sure. | 17:38 |
| samuelms | morganfainberg, currently, we use 1) a role (connector) to link 2) an actor on 3) a target, right? | 17:39 |
| rodrigods | ayoung, thinking about policy enforcement + keystonclient... can't see a way to have two specs instead of just one (means that we would need to expand https://review.openstack.org/#/c/133480/4/specs/keystoneclient/policy-enforce.rst) | 17:39 |
| morganfainberg | samuelms, yes | 17:39 |
| samuelms | samuelms, why not to have 4 separate backends: (wait me list before saying no :p) | 17:40 |
| samuelms | ops | 17:40 |
| samuelms | morganfainberg, ^ | 17:40 |
| samuelms | morganfainberg, 1) identity: actors | 17:40 |
| samuelms | morganfainberg, 2) resource : targets | 17:40 |
| ayoung | rodrigods, I mentioned Nova and Keystone cuz they had the most advanced bindings...but Now that I've seen what glance is doing, probably need to take that into account, too | 17:41 |
| samuelms | morganfainberg, 3) 'connector': to the links, like the actual roles | 17:41 |
| samuelms | morganfainberg, 4) assignment : the mapper itself | 17:41 |
| amakarov | bknudson, greetings, I've rewritten you test had concern about: https://review.openstack.org/#/c/118590 | 17:42 |
| samuelms | morganfainberg, so that one assignment is a mapping to an actor on a target through one or more connectors (you can add one if you need, like an attribute for abac) | 17:42 |
| morganfainberg | so, i'm just not buying the usecase that we need separate assignment backends per domain, and without that i don't see a win for splitting roles from assignment | 17:42 |
| morganfainberg | samuelms, this is adding massive complexity to the system | 17:42 |
| amakarov | bknudson, s/you test/test you/ | 17:42 |
| morganfainberg | samuelms, and i'm architecturally fine with moveing assignment out of resource - but... the more i think about it the more i'm inclined to say we're not going to get to a consensus on this | 17:43 |
| rodrigods | ayoung, ++ so we can change its title to "policy enforcement library" and have it encapsulated in keystoneclient be in the content. Also adding the oslo.policy graduation bits | 17:43 |
| rodrigods | ayoung, makes sense? | 17:43 |
| morganfainberg | samuelms, in fact... the more i think about it, the more i'm inclined to say we're just going to make keystone *less* usable with this split. | 17:44 |
| gabriel-bezerra | morganfainberg, samuelms: if we keep roles, won't it still be rbac? | 17:44 |
| bknudson | amakarov: it still can break existing installations (it's not backwards compatible) | 17:44 |
| morganfainberg | gabriel-bezerra, RBAC is not something we're getting away from. | 17:44 |
| samuelms | morganfainberg, that way I think we should have more backend (wow maybe more complex) .. but we have more easier to understand ones .. | 17:44 |
| morganfainberg | samuelms, i don't think it'll be easier to understand | 17:45 |
| morganfainberg | samuelms, i think you're going down the same path a lot of openstack has | 17:45 |
| morganfainberg | loose federation of <things> that are really tightly coupled | 17:45 |
| morganfainberg | gabriel-bezerra, we can't eliminate it because the other endpoints need it (for now) | 17:45 |
| morganfainberg | gabriel-bezerra, e.g. middleware | 17:45 |
| gabriel-bezerra | morganfainberg: samuelms: in the e-mail, herynash said each domain would be able to use something different from rbac if they wanted | 17:46 |
| samuelms | morganfainberg, so we always have to use roles to connect actors on targets? | 17:46 |
| morganfainberg | gabriel-bezerra, i am *not* convinced that is a good idea at all | 17:46 |
| morganfainberg | gabriel-bezerra, i responded to the email | 17:46 |
| ayoung | rodrigods, I'm trying to get something done before the meeting...more later | 17:46 |
| morganfainberg | samuelms, we still need to present roles / something the other services can enforce on | 17:46 |
| gabriel-bezerra | I saw, but what I mean is: even if roles go to a resource backend, the authorization would still be based on them | 17:47 |
| morganfainberg | gabriel-bezerra, it would need to be. | 17:47 |
| gabriel-bezerra | thus, rbac | 17:47 |
| morganfainberg | gabriel-bezerra, and my response that yes, we're not getting rid of RBAC | 17:47 |
| samuelms | morganfainberg, do we plan to have a centralized enforcement? | 17:47 |
| morganfainberg | samuelms, we can't centralize enforcement | 17:48 |
| morganfainberg | samuelms, it doesn't scale | 17:48 |
| *** NM has joined #openstack-keystone | 17:48 | |
| gabriel-bezerra | samuelms: i don't think it would be right | 17:48 |
| morganfainberg | samuelms, so lets remove the "each domain has it's own assignment backend" [this is setting off all sorts of red flags as a terrible idea] | 17:48 |
| morganfainberg | from the conversation | 17:48 |
| samuelms | morganfainberg, ++ | 17:48 |
| morganfainberg | lets look at the architecture of resource and assignment | 17:49 |
| *** harlowja_away is now known as harlowja | 17:49 | |
| samuelms | morganfainberg, I'm for allowing other access control (like rbac) for the whole system (not per domain) | 17:49 |
| morganfainberg | if assignment is doing things (lets say ABAC) to figure out what roles are passed into the token | 17:49 |
| morganfainberg | whether a role is a simple permission or a bundle of permissions (what we have today) | 17:49 |
| morganfainberg | *if* you need yet-another backend to map the resource role to waht the assignment backend spits out, what benefit have we added? | 17:50 |
| morganfainberg | i'd say zero, we've just added a useless abstraction | 17:50 |
| morganfainberg | the argument roles go into resource and are connected to assignment separately is a *very* SQL view. | 17:50 |
| *** dimsum__ has joined #openstack-keystone | 17:51 | |
| morganfainberg | i'd argue that assignment backend doesn't care what the "role" is in resource, it knows what it's going to spit out. if you say: rule XXX is scoped to project Y, now we need to connect a role to that somehow? | 17:51 |
| samuelms | morganfainberg, ok .. so you're for putting roles on the assignment backend .. that should contains the links (roles) and the mappings (assignments itself) | 17:52 |
| morganfainberg | or should rule XXX say "give role on scope" | 17:52 |
| *** jistr has quit IRC | 17:52 | |
| morganfainberg | samuelms, my view is the assignment backend after the split controls roles *and* the role assignments | 17:52 |
| morganfainberg | since roleassignment is tightly coupled to role | 17:53 |
| gabriel-bezerra | I see two points that wouldn't change here: 1 - a repository of roles, 2 - a repository of assignments. | 17:53 |
| morganfainberg | ok back in a couple minutes for the meeting | 17:53 |
| *** NM has quit IRC | 17:53 | |
| gabriel-bezerra | the discussion now is whether they should be in different backends | 17:53 |
| gabriel-bezerra | am I right? | 17:53 |
| samuelms | morganfainberg, ok | 17:53 |
| *** ajayaa has quit IRC | 17:54 | |
| samuelms | gabriel-bezerra, kind of .. | 17:54 |
| gabriel-bezerra | samuelms: what would be different? | 17:55 |
| samuelms | gabriel-bezerra, put it with resource (domain, project) or with assignment (the mappings themselves) | 17:55 |
| samuelms | gabriel-bezerra, we'll discuss more about in the meeting in 4 minutes | 17:55 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Trust redelegation https://review.openstack.org/126897 | 17:55 |
| *** gyee_ has joined #openstack-keystone | 17:56 | |
| gabriel-bezerra | samuelms: what channel is it going to be? | 17:57 |
| gabriel-bezerra | #openstack-meeting? | 17:57 |
| *** kkowmoth has joined #openstack-keystone | 17:57 | |
| *** NM has joined #openstack-keystone | 17:57 | |
| samuelms | gabriel-bezerra, y | 17:57 |
| *** jacorob_ has joined #openstack-keystone | 18:05 | |
| *** jacorob_ has left #openstack-keystone | 18:06 | |
| *** diegows has quit IRC | 18:06 | |
| *** henrynash has joined #openstack-keystone | 18:10 | |
| *** ChanServ sets mode: +v henrynash | 18:10 | |
| *** jamielennox|away is now known as jamielennox | 18:11 | |
| *** russellb has quit IRC | 18:11 | |
| *** kkowmoth has quit IRC | 18:11 | |
| *** russellb has joined #openstack-keystone | 18:12 | |
| openstackgerrit | James Carey proposed openstack/keystone: Use _ definition from keystone.i18n https://review.openstack.org/132116 | 18:22 |
| *** diegows has joined #openstack-keystone | 18:23 | |
| *** aix has quit IRC | 18:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - test some websso stuff https://review.openstack.org/136177 | 18:27 |
| *** NM has quit IRC | 18:33 | |
| *** NM has joined #openstack-keystone | 18:33 | |
| *** ajayaa has joined #openstack-keystone | 18:36 | |
| *** nellysmitt has quit IRC | 18:37 | |
| *** NM has quit IRC | 18:42 | |
| *** NM has joined #openstack-keystone | 18:42 | |
| *** stevemar has joined #openstack-keystone | 18:50 | |
| *** ChanServ sets mode: +v stevemar | 18:50 | |
| *** gokrokve has joined #openstack-keystone | 18:54 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 18:56 |
| *** NM has quit IRC | 18:57 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment table migrate of duplicate entry exists. Closes-bug: #1395959 Change-Id: I394a0391ee074c3ee79bdb06391fc4d5fb9067a9 https://review.openstack.org/136946 | 18:58 |
| *** harlowja is now known as harlowja_away | 18:58 | |
| *** gokrokve has quit IRC | 19:00 | |
| *** gokrokve has joined #openstack-keystone | 19:00 | |
| samuelms | o/ | 19:00 |
| *** Ioram7 has joined #openstack-keystone | 19:00 | |
| ayoung | going to recap, so it is all in one evesdrop | 19:01 |
| ayoung | <ayoung> lets say we have a single sign on system that allows us to manage hosts | 19:01 |
| ayoung | <ayoung> think something like an IDP, but for machines | 19:01 |
| ayoung | maybe something that does secure DNS, etc | 19:01 |
| ayoung | now, Keystone is going to map users from an idp to host access | 19:01 |
| morganfainberg | ayoung, ++ thanks for the recap | 19:01 |
| ayoung | the hosts are inside of groups that we could use as projects | 19:01 |
| morganfainberg | easier than switching windows a lot | 19:01 |
| *** NM has joined #openstack-keystone | 19:01 | |
| ayoung | so we pull in the projects from this system as a domain, but here it is providing the projects, not the users | 19:02 |
| ayoung | keystone then provides a management layer to map users to those projects...users from multiple IdP | 19:02 |
| ayoung | So keystone needs to keep the definition of Roles separate from the projects themselves | 19:02 |
| *** ajayaa has quit IRC | 19:02 | |
| morganfainberg | so, let me make sure i understand | 19:02 |
| morganfainberg | the resource backend is -- something not keystone SQL in this case? | 19:03 |
| ayoung | OK...so we have here a case for splitting the project listings off from the rest of domains...which was one thing I was asked at the start of the discussion | 19:03 |
| morganfainberg | e.g. DNS? | 19:03 |
| ayoung | Yeah, lets say DNS | 19:03 |
| morganfainberg | great | 19:03 |
| morganfainberg | just making sure i wasn't misunderstanding | 19:03 |
| ayoung | So we use DNS to server out the projects here...each project is a subzone | 19:04 |
| ayoung | this is syncronized with Designate and Nova...etc etc | 19:04 |
| morganfainberg | sure, makes sense. | 19:04 |
| ayoung | OK, so now, thge roles are what Keystone and the other services use to communicate capabilites...they are shorthand | 19:04 |
| samuelms | ayoung, ++ | 19:05 |
| ayoung | so this is OpenStack specific data, separate from the Projects data from DNS | 19:05 |
| *** ajayaa has joined #openstack-keystone | 19:05 | |
| ayoung | so it needs to be in an OpenStack specific backend. We have two of those remaining; either we store them with domains, or with policy | 19:05 |
| ayoung | right now, they are coupled with domains, since both are in the assignment backend | 19:05 |
| morganfainberg | ayoung, so in henrynash's current proposed implementation | 19:05 |
| morganfainberg | roles would come from the same place projects / domains do | 19:06 |
| morganfainberg | ayoung, but the role assigments would be in something else | 19:06 |
| morganfainberg | role assignments are the current actor-role-scope SQL table thing | 19:06 |
| morganfainberg | ayoung, i think your use-case here places role assignments and roles together. | 19:07 |
| morganfainberg | logically | 19:07 |
| *** harlowja_away is now known as harlowja | 19:07 | |
| morganfainberg | and the projects/domains are the resources from [in this case] dns | 19:07 |
| raildo | morganfainberg, ayoung a quickly question... If I create a user in a sub-domain, can I grant a role assignment to a parent domain? I need to explain this in the Reseller Spec or the henrynash spec about group role will explain this? | 19:08 |
| morganfainberg | raildo, you would need to be able to grant a role assignment to a *user* from a parent domain | 19:08 |
| raildo | to a *user*, sorry =P | 19:09 |
| morganfainberg | raildo, this is the concept of allowing my parent domain access (limited) to into my reseller block for support. | 19:09 |
| raildo | morganfainberg, ok, thanks :) | 19:09 |
| henrynash | so I can see the argument for having projects sourced externally | 19:09 |
| samuelms | morganfainberg, ++ | 19:09 |
| *** jistr has joined #openstack-keystone | 19:09 | |
| henrynash | I can also see the cases that domain attributes might be an Openstack augmentation of certain projects | 19:10 |
| *** amakarov is now known as amakarov_away | 19:10 | |
| henrynash | probably not come from the external source | 19:10 |
| morganfainberg | henrynash, the way i see it is both of those statements lend to the assignment backend owning the roles [in the context of the split] | 19:10 |
| henrynash | i don’t think any of that follows that roles go with assignments.. | 19:10 |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment table migrate if duplicate entry exists. Closes-bug: #1395959 Change-Id: I394a0391ee074c3ee79bdb06391fc4d5fb9067a9 https://review.openstack.org/136946 | 19:10 |
| ayoung | raildo, I have an answer for you | 19:10 |
| raildo | ayoung, that is... | 19:11 |
| ayoung | raildo, but it involves understanding hierarchical roles definitions | 19:11 |
| henrynash | morganfainberg: :-) we clearly have an interesting difference of views on this!! | 19:11 |
| morganfainberg | henrynash, if anything you have samuelms's [resource]|[role]|assignment construct | 19:11 |
| morganfainberg | henrynash, haha right? | 19:11 |
| samuelms | morganfainberg, o/ | 19:11 |
| rodrigods | samuelms, almost fell out his chair here | 19:12 |
| morganfainberg | henrynash, since resource suddenly became externally sourcable | 19:12 |
| ayoung | raildo, I want to start with two suppositions: 1, a role can always be broken down further until you get to distinct capabilities. 2. A user can only delegate roles that they have themselves, or a fragment of those roles | 19:12 |
| morganfainberg | rodrigods, i gotta work harder so he *actually* falls out of his chair next | 19:12 |
| samuelms | morganfainberg, haha | 19:12 |
| rodrigods | morganfainberg, not too hard | 19:12 |
| raildo | ayoung, right... | 19:13 |
| ayoung | raildo, now, lets assume we have a separate role for people that can create role-assignments. | 19:13 |
| morganfainberg | henrynash, so the way i see it resources become equally hard to write a backend for by only moving assignments out | 19:13 |
| morganfainberg | henrynash, if we are assuming SQL-like, most of my arguments are gone, but we just need to be ok that we're really prescribing sql here | 19:13 |
| ayoung | in order to delegate something to someone permananently, you need the "assingners" role on the thing that you are assigning to | 19:13 |
| ayoung | so.... | 19:13 |
| samuelms | morganfainberg, ok .. so if we have roles in assignments backend .. we could have two parts in it : the mapper and the connectors (roles, etc) | 19:14 |
| henrynash | morgainfainberg: i guess the bit I don’t get is why not having roles included makes it harder… | 19:14 |
| samuelms | morganfainberg, makes sense ? | 19:14 |
| morganfainberg | henrynash, and projects/domains are managed by keystone not *someexternalsource* | 19:14 |
| morganfainberg | samuelms, yes, i was simplifying ;) | 19:14 |
| samuelms | lol | 19:14 |
| ayoung | if I have the assingners role and the member role on Dom1, and dom2 is under it, and userX is in Dom2, I have the power to assign the members role to userX on Dom1. | 19:14 |
| morganfainberg | henrynash, it is because you have unrelated data-types meshed into a single backend | 19:15 |
| morganfainberg | henrynash, which i think is the *reason* we're looking to split this | 19:15 |
| morganfainberg | henrynash, i mean, getting down to brasstacks | 19:15 |
| ayoung | henrynash, are you going to be putting domains and projects into the same backend? | 19:15 |
| henrynash | morganfainberg: agreed | 19:15 |
| morganfainberg | henrynash, roles are not the same data-types as domains or projects | 19:15 |
| henrynash | ayoung: well that’s as it stands today… | 19:16 |
| samuelms | henrynash, I kind of agree with morganfainberg now .. it makes sense to keep on assignment the mapper + the connectors (what we use to map an actor (identity) to a target (resource)) | 19:16 |
| ayoung | henrynash, lets split them now | 19:16 |
| samuelms | henrynash, makes sense? | 19:16 |
| raildo | ayoung, ok,I get it, but this part of the group role / hierarchical role discussion right? | 19:16 |
| morganfainberg | henrynash, roles are a related datatype to role-assignment, but aslo...not exactly the same datatype | 19:16 |
| ayoung | henrynash, lets assume that domains are something that Keystone needs to manage, a layer of abstraction added over projects | 19:16 |
| morganfainberg | henrynash, but the assignment backend could be *smart* enough [not saying it is] to circumvent the need for the extra datatype | 19:16 |
| samuelms | henrynash, if you want to replace just the mapper you can by replacing assignment.mapper .. and if you want to add other attributes you can by adding them to assignment.connector (where roles live) | 19:17 |
| raildo | what I mean is, this is not part of HM discussion... this is most related to the henrynash's propose...right? | 19:17 |
| ayoung | so if we were to pullin projects from an LDAP source for one Domain, we could do that without requiring all domains to be backed by LDAP | 19:17 |
| morganfainberg | raildo, yeah the convos are a bit mixed up atm | 19:17 |
| morganfainberg | raildo, this is the split not HM specific. | 19:17 |
| morganfainberg | ^ | 19:17 |
| samuelms | henrynash, makes sense? | 19:17 |
| henrynash | so one problem I have is that if I have a system with our current mapper…and I swap out to a new mapper…all teh roles disssapear | 19:17 |
| ayoung | HM brings all of these issues to the forefront | 19:17 |
| *** gokrokve has quit IRC | 19:17 | |
| raildo | morganfainberg, ok :) | 19:17 |
| samuelms | henrynash, no .. | 19:18 |
| henrynash | teh roles shouldn’t be stored by the mapper.... | 19:18 |
| *** gokrokve has joined #openstack-keystone | 19:18 | |
| morganfainberg | ayoung, ++ | 19:18 |
| henrynash | the roles are really definitions of service capabilties | 19:18 |
| morganfainberg | ayoung, HM makes this super important, but this affects more than HM | 19:18 |
| samuelms | henrynash, you plug a new assignment.mapper .. but assignment.connectors (where roles live) can stay | 19:18 |
| henrynash | why would a mapper store them? | 19:18 |
| samuelms | henrynash, the actual assignments in your implementation | 19:19 |
| samuelms | henrynash, it's like creating a fourth backend called 'connectors' now | 19:19 |
| henrynash | samulems: ahh, so is assignment.connectors are another backend…or just part of assignment? | 19:19 |
| samuelms | henrynash, but we're putting it in assignment.connectors | 19:19 |
| henrynash | samuelms: ahh, ok… | 19:19 |
| morganfainberg | henrynash, samuelms is advocating 4 backends. | 19:19 |
| morganfainberg | henrynash, identity, resource, assignment.mapper, assignment.connector | 19:19 |
| samuelms | morganfainberg, but having 2 inside assignment namespace if you prefer | 19:19 |
| henrynash | ok, so that’s certainly another way of doing it | 19:19 |
| samuelms | morganfainberg, ++ | 19:20 |
| henrynash | I’m kind of OK with that | 19:20 |
| samuelms | morganfainberg, also ok ? | 19:20 |
| morganfainberg | henrynash, my view is the assignment backend could be smart enough to circumvent the need to *store* roles | 19:20 |
| henrynash | although I suspect ayoung still is agains projects and domains in the same backend | 19:21 |
| morganfainberg | henrynash, why do i need to store a role if i make it do rules( attribute x, y, z = role Q) | 19:21 |
| morganfainberg | henrynash, sure it means if i change the backend out roles disappear... but lets be fair... | 19:21 |
| ayoung | henrynash, it would make the DNS backed project hierarchy I just described impossible | 19:21 |
| henrynash | morgainfaingberg: so I agree we could imagine a role just being named as service.role_name | 19:21 |
| morganfainberg | henrynash, if we change the identity backend out, your users need to be migrated | 19:21 |
| morganfainberg | henrynash, or they just disappear (leaving out the multi-tree ldap story) | 19:22 |
| ayoung | I thnk domains are fundamentally Keystone constructs, Projects have be thus far, but are not fundamental in the same way | 19:22 |
| morganfainberg | same with the resource backend. | 19:22 |
| morganfainberg | ayoung, i disagree, but it's semantics | 19:22 |
| *** gokrokve has quit IRC | 19:22 | |
| morganfainberg | ayoung, it would be easy to move the needle either way on projects. | 19:23 |
| samuelms | we'll have domains everywhere from KIlo, right? | 19:23 |
| samuelms | morganfainberg, I remember something like allocating keystone people to help other projects to migrate v2 -> v3 | 19:23 |
| *** NM has quit IRC | 19:23 | |
| morganfainberg | samuelms, yeah we need to do something like that | 19:23 |
| ayoung | morganfainberg, I think it was this use case that lead me to wanting to have domains only under domains | 19:23 |
| *** amcrn has joined #openstack-keystone | 19:23 | |
| henrynash | so how about we keep things separate within the assignment backends as samuelms is suggesting….and then we work to see how roles evolve (e.g. to really be capabilities etc.) | 19:23 |
| samuelms | henrynash, +2 | 19:24 |
| samuelms | henrynash, oops ++ :p | 19:24 |
| rodrigods | ok, now samuelms is on the floor | 19:24 |
| morganfainberg | henrynash, ok, lets go with this: roles are part of assignment, but the implementation is logically split in a way that it would be easy to take it further as samuelms is describing | 19:24 |
| samuelms | morganfainberg, ++ | 19:25 |
| morganfainberg | henrynash, so we may not make it explicitly some kind of backend, but something that can be isolated out and worked with. | 19:25 |
| morganfainberg | henrynash, ? | 19:25 |
| henrynash | yep, I’ll give it a +1 while I go mull it over and see if anything bad rears it;s head…if not, I’m good with that | 19:25 |
| morganfainberg | henrynash, and if resource needs more work domain, project, tenant (yes lets call things tenants) | 19:25 |
| morganfainberg | henrynash, we can look at that. | 19:26 |
| henrynash | agreed | 19:26 |
| samuelms | agreed | 19:26 |
| morganfainberg | ooh totally should rename projects and domains to tenants | 19:26 |
| morganfainberg | >.> | 19:26 |
| morganfainberg | <.< | 19:26 |
| henrynash | cliff…jump…splat | 19:26 |
| morganfainberg | bknudson, i know you're on board with that! ^ | 19:26 |
| morganfainberg | stevemar, where is topol... | 19:27 |
| henrynash | ok, I’ll be offline for while…back on later | 19:27 |
| morganfainberg | stevemar, when i need someone who will actually fall out of their chair | 19:27 |
| *** henrynash has quit IRC | 19:27 | |
| ayoung | that will work | 19:28 |
| ayoung | roles can stay with assignment | 19:28 |
| samuelms | ayoung, o/ | 19:28 |
| stevemar | morganfainberg, you know topol is getting ready for thanksgiving mode | 19:29 |
| morganfainberg | stevemar, look at the tweet i just sent to him... | 19:29 |
| morganfainberg | stevemar, https://twitter.com/MdrnStm/status/537327176597516288 | 19:30 |
| gabriel-bezerra | so there should also be a resource.domain and resource.projects? | 19:30 |
| *** ajayaa has quit IRC | 19:30 | |
| morganfainberg | gabriel-bezerra, i'd rather not have that split | 19:31 |
| stevemar | hehe | 19:31 |
| *** ayoung has quit IRC | 19:31 | |
| morganfainberg | gabriel-bezerra, i'd rather domains be special projects rather than something separate | 19:31 |
| morganfainberg | gabriel-bezerra, but... i will defer to whichever implemenrtation makes the most sense. | 19:31 |
| rodrigods | ayoung, bp/policy-enforcement-library for https://review.openstack.org/#/c/133480/ ? | 19:31 |
| *** NM has joined #openstack-keystone | 19:31 | |
| gabriel-bezerra | ok. how about the hierarchical roles? | 19:32 |
| gabriel-bezerra | and domain-specific roles | 19:32 |
| *** samuelms has quit IRC | 19:33 | |
| gabriel-bezerra | should roles have a parent and a domain attributes? | 19:33 |
| gabriel-bezerra | in order to implement these? | 19:33 |
| gabriel-bezerra | if so, roles aren't that simple to circumvent the storage need | 19:36 |
| *** samuelms has joined #openstack-keystone | 19:39 | |
| *** jimhoagland has joined #openstack-keystone | 19:40 | |
| *** Ioram7 has left #openstack-keystone | 19:41 | |
| openstackgerrit | Christian Berendt proposed openstack/keystone: Log the user id when using an invalid username or password https://review.openstack.org/128860 | 19:46 |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 19:56 |
| *** gokrokve has joined #openstack-keystone | 19:59 | |
| *** henrynash has joined #openstack-keystone | 20:11 | |
| *** ChanServ sets mode: +v henrynash | 20:11 | |
| morganfainberg | dolphm: which moka did you get? | 20:11 |
| morganfainberg | I'm getting one today. | 20:11 |
| *** ayoung has joined #openstack-keystone | 20:11 | |
| *** ChanServ sets mode: +v ayoung | 20:11 | |
| dolphm | morganfainberg: the 3 cup one | 20:12 |
| dolphm | morganfainberg: i read that smaller ones make better coffee *shrug* | 20:12 |
| morganfainberg | Brand? Link? | 20:12 |
| dolphm | morganfainberg: http://www.amazon.com/gp/product/B0000CF3Q6/ | 20:12 |
| dolphm | morganfainberg: i've made about 6 servings so far (one serving per brew with the 3 "cup" one) | 20:12 |
| morganfainberg | Cool. That one was he one I was looking for. | 20:13 |
| afaranha | Do anyone knows what happens to other services' context when I use a domain scoped token to access them? | 20:13 |
| dolphm | morganfainberg: the 3-cup one takes just under 20 grams of coffee | 20:13 |
| morganfainberg | For/at | 20:13 |
| afaranha | Do their context will have the domain_id variable? | 20:13 |
| morganfainberg | Nice. I am going to get a good grinder / scale as well. | 20:13 |
| dolphm | afaranha: auth_token will provide it, yes, but the service's policy engine will probably balk at the lack of tenancy, since no other service cares about domain-level authorization | 20:14 |
| morganfainberg | afaranha: most of them fail because they don't know what to do with domain auth. ... What Dolph said. | 20:14 |
| dolphm | morganfainberg: i'd recommend my grinder http://www.amazon.com/gp/product/B003AM7KIK/ but not my scale | 20:14 |
| bknudson | I don't think domain-scoped tokens are anything that another service should accept. | 20:14 |
| morganfainberg | It might make sense for limited cases. But I would agree in most cases. | 20:15 |
| bknudson | I assume there's no catalog with a domain-scoped token? | 20:15 |
| bknudson | or if there is a catalog it's not going to contain a valid compute URL | 20:15 |
| morganfainberg | bknudson: think reseller wanting to see all vms for their domain? | 20:15 |
| dolphm | morganfainberg: the "pull out" screen on this looks awesome http://www.amazon.com/dp/B0020L6T7K/ | 20:15 |
| morganfainberg | Maybe-- maybe that is a bad idea (the domain scoped) | 20:16 |
| dolphm | but i also weigh large things like buckets and whatnot in my kitchen | 20:16 |
| morganfainberg | Hehe | 20:16 |
| afaranha | dolphm, morganfainberg: hey put project_id as none on the context on Nova, but I thing they do create a context | 20:16 |
| morganfainberg | dolphm: more French press today though. | 20:17 |
| afaranha | I would like to see the context, I tried to get the Hypervisors in Nova, bu they require the user to have the tenant_id in the URL the same as the project_id in the context, but it's none =/ | 20:17 |
| morganfainberg | Huh. IRC cloud has a photo icon. I didn't think IRC did photos. :p | 20:18 |
| dolphm | morganfainberg: gravatar? | 20:18 |
| dolphm | afaranha: does it 4xx? | 20:18 |
| afaranha | dolphm: Yep | 20:18 |
| afaranha | code 400 | 20:18 |
| afaranha | message: "Malformed request URL: URL's project_id '47a745322f374fac9243cfd4632b9fb5' doesn't match Context's project_id 'None'", | 20:19 |
| morganfainberg | Imgur | 20:19 |
| dolphm | well that should be 401 | 20:19 |
| dolphm | but close enough | 20:19 |
| morganfainberg | dolphm: well it *is* a 4xx class so it's close enough. | 20:19 |
| afaranha | Don't know if I got this error because they require all operations to pass the project_id | 20:19 |
| dolphm | afaranha: they do, and should | 20:19 |
| morganfainberg | afaranha: because you don't have a project and they expect one. | 20:19 |
| rodrigods | ayoung, there you are :P ... Created https://blueprints.launchpad.net/keystone/+spec/policy-enforcement-library and will link https://review.openstack.org/#/c/135604/6/specs/kilo/k2k-service-providers.rst to it. Also, I'm making some changes in the spec content/commit message | 20:20 |
| lbragstad | morganfainberg: qq on the service['name'] discussion we had yesterday, are we still going to require that? | 20:21 |
| afaranha | morganfainberg: yes, but what if I perform get /v2/images in Glance, that doesn't require an project? | 20:21 |
| afaranha | let me try this | 20:21 |
| morganfainberg | lbragstad: nope. Name should be be required as per jamielennox 's comments. Type needs to be unique. | 20:21 |
| dolphm | afaranha: that call might only require authentication, but not any specific authorization (IIRC) | 20:22 |
| lbragstad | so, we *won't* be making service name required by default | 20:22 |
| morganfainberg | dolphm: ++ | 20:22 |
| jamielennox | morganfainberg: given type is unique i honestly don't care if we have name required or not, it just felt easier to add it to everything than have it sometimes present | 20:22 |
| morganfainberg | lbragstad: no. We're not. | 20:22 |
| lbragstad | morganfainberg: I'll abandon those patches with an explaination | 20:22 |
| morganfainberg | lbragstad: or well we don't need to | 20:22 |
| lbragstad | explanation* | 20:22 |
| morganfainberg | But type is not unique constrained so we still need that. | 20:23 |
| morganfainberg | Only unique constraint we have is id atm. | 20:23 |
| morganfainberg | lbragstad: is UX better or worse requiring name? If it is better, require it. | 20:23 |
| lbragstad | morganfainberg: I'm not sure, doesn't matter to me. Does anyone else feel strongly about it? | 20:24 |
| afaranha | dolphm: Yes, I could get the images. The point I was trying to get is, even the service not recognizing domain, if their context will have the variable domain_id on it, because of the contxt of Keystone | 20:25 |
| morganfainberg | It should have the domain id in the context | 20:26 |
| morganfainberg | Middleware does that. | 20:27 |
| *** topol has joined #openstack-keystone | 20:27 | |
| *** ChanServ sets mode: +v topol | 20:27 | |
| morganfainberg | topol: you're on vacation aren't you? ;) | 20:27 |
| dolphm | afaranha: that's correct | 20:27 |
| dolphm | morganfainberg: he claims to be | 20:28 |
| morganfainberg | dolphm: lies. Deceit. | 20:28 |
| afaranha | morganfainberg, dolphm: Thank you :) | 20:28 |
| *** NM1 has joined #openstack-keystone | 20:30 | |
| *** NM has quit IRC | 20:30 | |
| ayoung | rodrigods, thank you | 20:31 |
| ayoung | rodrigods, I set the url to the KC spec....maybe this BP maps to multiples, but this is the second one, and the Keystone owned one as well. | 20:32 |
| *** nellysmitt has joined #openstack-keystone | 20:32 | |
| *** chrisshattuck has quit IRC | 20:32 | |
| rodrigods | ayoung, ++ | 20:33 |
| *** nellysmitt has quit IRC | 20:33 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Policy enforcement library https://review.openstack.org/133480 | 20:38 |
| rodrigods | ayoung, ^ | 20:38 |
| ayoung | Rock on! | 20:38 |
| rodrigods | morganfainberg, ^ oslo.policy graduation + keystoneclient bits | 20:38 |
| morganfainberg | rodrigods: thanks! | 20:39 |
| morganfainberg | Anyone have some friends at Microsoft that like openstack? I'm trying to figure out the best way to get some 3rd party CI for adfs and keystone. | 20:41 |
| *** jistr has quit IRC | 20:41 | |
| morganfainberg | Obviously the ms licenses are the one of the hurdles. | 20:41 |
| *** topol has quit IRC | 20:41 | |
| lbragstad | morganfainberg: I did some checking, and I don't think making service['name'] required is a big deal. | 20:42 |
| morganfainberg | lbragstad: I'm good with it either way as long as we solve the type issue(s) | 20:42 |
| jamielennox | morganfainberg: there is microsoft involvement in openstack, i don't know who but it would be the same person who maintains the hyper-v CI for nova right | 20:42 |
| morganfainberg | Hmm. Ok. | 20:42 |
| lbragstad | morganfainberg: primeministerp? | 20:42 |
| * morganfainberg will go poke at the -nova folks. | 20:43 | |
| lbragstad | apilotti is responsible for the hyper-v stuff, he might have a lead you could talk to as well | 20:43 |
| morganfainberg | lbragstad: thanks. | 20:43 |
| lbragstad | morganfainberg: np | 20:43 |
| lbragstad | morganfainberg: I'll update my patches and abandon, I'll see if I can get another one up to make service['type'] unique | 20:43 |
| morganfainberg | If I can get the license hurdle solved I can probably get hp or rax to kick in CI check resources. (If ms won't) | 20:44 |
| morganfainberg | lbragstad: ++ | 20:44 |
| *** NM1 has quit IRC | 20:44 | |
| morganfainberg | Don't forget the sql migrate. ;) | 20:44 |
| lbragstad | morganfainberg: sql-what? ;) | 20:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/137202 | 20:46 |
| *** jimhoagland has quit IRC | 20:46 | |
| *** thedodd has quit IRC | 20:47 | |
| morganfainberg | lbragstad: I hear mongodb is webscale. We should use that. | 20:47 |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment table migrate if duplicate entry exists. Closes-bug: #1395959 Change-Id: I394a0391ee074c3ee79bdb06391fc4d5fb9067a9 https://review.openstack.org/136946 | 20:48 |
| lbragstad | morganfainberg: didn't we hit a weird case with unique constraints a few migrations back? | 20:48 |
| morganfainberg | Maaaybe? | 20:49 |
| ayoung | I was not able to reproduce morganfainberg | 20:50 |
| morganfainberg | I only remember one about FK constraints not matching. | 20:50 |
| ayoung | I have their sql dump... | 20:50 |
| ayoung | and went through the migrations by hand...did not see the problem | 20:50 |
| morganfainberg | Is this the folks with assignment duplication bug open? | 20:50 |
| morganfainberg | Or something else? | 20:51 |
| ayoung | morganfainberg, yeah, it was in inhouse Openstack deployment here | 20:51 |
| morganfainberg | Huh. Yeah I didn't see how they got there. It looks a little weird. | 20:51 |
| ayoung | morganfainberg, I suspect shenanigans on their part | 20:51 |
| morganfainberg | Haha | 20:51 |
| ayoung | but, if it is possible to have bad data, the failure mode was still a disaster | 20:51 |
| ayoung | the migration failed, but we continued on, and the next migration purged the old metadata tables | 20:52 |
| ayoung | they ended up with no assignments, and no old data | 20:52 |
| ayoung | a better failure mode would have been to stop the migrations right there | 20:52 |
| *** kobtea has joined #openstack-keystone | 20:52 | |
| ayoung | I haven't gotten back to it today | 20:53 |
| morganfainberg | ayoung: migrations should always fail-safe and fast | 20:53 |
| ayoung | yeah | 20:53 |
| morganfainberg | Reminds me. Time to collapse migrations again. | 20:53 |
| morganfainberg | Now that grenade is sane. | 20:53 |
| ayoung | You keep using that word. I do not think it means what you think it means/ | 20:54 |
| morganfainberg | Certain values of sane? | 20:54 |
| morganfainberg | Sane™ | 20:54 |
| rodrigods | morganfainberg, ayoung, dolphm, https://etherpad.openstack.org/p/policy-library-name | 20:54 |
| morganfainberg | Sane® ? | 20:55 |
| *** kobtea has quit IRC | 20:57 | |
| morganfainberg | rodrigods: is it wrong I want to call it something coffee related? :P | 20:59 |
| *** thedodd has joined #openstack-keystone | 21:00 | |
| rodrigods | morganfainberg, haha coffee + beer related ftw | 21:02 |
| *** Haneef has joined #openstack-keystone | 21:10 | |
| dolphm | rodrigods: added more dumb name | 21:12 |
| dolphm | s | 21:12 |
| rodrigods | dolphm, ++ honesty :) | 21:14 |
| samuelms | henrynash, are you already working on 'Remove the old-style role grant metadata in assignments' ? | 21:15 |
| samuelms | https://blueprints.launchpad.net/keystone/+spec/remove-role-metadata | 21:15 |
| *** jdennis has quit IRC | 21:20 | |
| *** jdennis has joined #openstack-keystone | 21:21 | |
| *** jamielennox is now known as jamielennox|away | 21:23 | |
| *** jamielennox|away is now known as jamielennox | 21:28 | |
| henrynash | samulems: no…I was going to layer that on top of the new split | 21:29 |
| henrynash | morganfainberg: regarding the roles as part of assignments…would you object if it were it’s own backend under the umbrella of assignments? I think that helps with the plugging in of a new assignments model without needing to migrate the roles. | 21:31 |
| *** thedodd has quit IRC | 21:33 | |
| *** agireud has quit IRC | 21:36 | |
| *** agireud has joined #openstack-keystone | 21:36 | |
| openstackgerrit | Merged openstack/keystone: Remove Python 2.6 classifier https://review.openstack.org/137120 | 21:43 |
| *** raildo_ has joined #openstack-keystone | 21:46 | |
| *** lhcheng_ is now known as lhcheng | 21:46 | |
| *** samuelms_ has joined #openstack-keystone | 21:54 | |
| *** raildo_ has quit IRC | 21:58 | |
| bknudson | goodbye python 2.6 | 22:05 |
| *** joesavak has quit IRC | 22:07 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 22:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 22:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve list role assignments filters performance https://review.openstack.org/137202 | 22:11 |
| *** joesavak has joined #openstack-keystone | 22:15 | |
| *** dimsum__ has quit IRC | 22:16 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Multifactor Authentication https://review.openstack.org/130376 | 22:16 |
| *** dimsum__ has joined #openstack-keystone | 22:17 | |
| *** dimsum__ has quit IRC | 22:21 | |
| morganfainberg | henrynash: hmm. Let me ponder for a few what it really means for us. | 22:21 |
| *** joesavak has quit IRC | 22:22 | |
| morganfainberg | henrynash: would that mean it's own set of routers etc? Or just a separate driver config? | 22:22 |
| morganfainberg | And what would the defaults be? A unified backend? | 22:22 |
| samuelms_ | morganfainberg, I'd be glad to have your opinion on this https://etherpad.openstack.org/p/role-capabilities-policy | 22:26 |
| *** NM has joined #openstack-keystone | 22:26 | |
| samuelms_ | morganfainberg, henry and I share some ideas described there :) | 22:26 |
| *** agireud has quit IRC | 22:31 | |
| *** gokrokve has quit IRC | 22:36 | |
| openstackgerrit | ayoung proposed openstack/keystone: Access Info https://review.openstack.org/137231 | 22:37 |
| ayoung | samuelms_, one goal of ^^ is to have something consistent to be used in all the places where we enforce policy | 22:39 |
| *** NM has quit IRC | 22:40 | |
| *** gokrokve has joined #openstack-keystone | 22:40 | |
| *** dims_ has joined #openstack-keystone | 22:49 | |
| samuelms_ | ayoung, so the services use this to get info from the policy enforcer? | 22:54 |
| henrynash | morganfainberg: in terms or routers, it would just point to a different manager in the assignment/core.py | 22:54 |
| morganfainberg | henrynash, so just a separate driver directive then? | 22:55 |
| morganfainberg | in the config | 22:55 |
| henrynash | morganfainberg: yep | 22:55 |
| samuelms_ | :) | 22:55 |
| henrynash | a bit lke teh way identity has a mapping backend that is separte from the user/group ones | 22:55 |
| morganfainberg | hm. yeah | 22:56 |
| ayoung | samuelms_, we'll get it to work and then move it into the client | 22:56 |
| *** ayoung is now known as ayoung-dad-mode | 22:56 | |
| morganfainberg | i'm trying to figure out if this is too modular (so much so it'll be confusing/difficult) | 22:56 |
| samuelms_ | morganfainberg, henrynash glad to see we've converged to a solution :-) | 22:56 |
| morganfainberg | stevemar ping - have a sec? | 22:56 |
| henrynash | morganfainberg: mull it over…I’ll try and pull a patch together that shows it | 22:57 |
| morganfainberg | henrynash, /me is trying to stay engaged considering turkey is on the horizon. | 22:57 |
| morganfainberg | :) | 22:57 |
| morganfainberg | well specifically turkey *AND* Ham | 22:58 |
| henrynash | ah, yes…of course…. | 22:58 |
| henrynash | we just kind of save it all up for xmas | 22:58 |
| henrynash | without the trial run | 22:58 |
| samuelms_ | ayoung-dad-mode, will this be put on the oslo.policy? or we'll have just the common enforcement there? | 22:58 |
| *** stevemar has quit IRC | 23:00 | |
| *** stevemar has joined #openstack-keystone | 23:01 | |
| *** ChanServ sets mode: +v stevemar | 23:01 | |
| morganfainberg | henrynash, lol | 23:01 |
| morganfainberg | oh i guess stevemar is idle. | 23:01 |
| morganfainberg | samuelms_, oslo.policy is *mostly* about enforcement. | 23:04 |
| morganfainberg | samuelms_, it may grow some extra superpowers, not sure how much of that stuff ends up in the new policy lib. | 23:04 |
| samuelms_ | morganfainberg, hmm .. cool :-) | 23:05 |
| samuelms_ | morganfainberg, haha extra superpowers | 23:05 |
| samuelms_ | morganfainberg, it will still be graduated, right? | 23:05 |
| morganfainberg | yes | 23:06 |
| samuelms_ | morganfainberg, for kilo? | 23:06 |
| morganfainberg | yes | 23:06 |
| morganfainberg | as soon as we can graduate it | 23:06 |
| morganfainberg | as in.. spec approved and making it happen | 23:06 |
| morganfainberg | no delay short of needing a name for it | 23:06 |
| samuelms_ | morganfainberg, cool .. so we have lots of place for working on it | 23:06 |
| morganfainberg | wow, apple mail has gotten terribad at handling mail threads. | 23:07 |
| morganfainberg | :( | 23:07 |
| samuelms_ | haha | 23:07 |
| *** gordc has quit IRC | 23:09 | |
| *** edmondsw has quit IRC | 23:12 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment table migrate if duplicate entry exists. Closes-bug: #1395959 Change-Id: I394a0391ee074c3ee79bdb06391fc4d5fb9067a9 https://review.openstack.org/136946 | 23:13 |
| *** chrisshattuck has joined #openstack-keystone | 23:13 | |
| *** samuelms_ has quit IRC | 23:13 | |
| *** gokrokve has quit IRC | 23:16 | |
| *** samuelms_ has joined #openstack-keystone | 23:16 | |
| *** nkinder has quit IRC | 23:18 | |
| *** gokrokve has joined #openstack-keystone | 23:30 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Improves feedback message in SSL error https://review.openstack.org/129769 | 23:41 |
| *** oomichi has joined #openstack-keystone | 23:46 | |
| *** gyee_ has quit IRC | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!