| *** stevemar has quit IRC | 00:02 | |
| *** diegows has joined #openstack-keystone | 00:11 | |
| *** rdo has joined #openstack-keystone | 00:13 | |
| *** oomichi has joined #openstack-keystone | 00:16 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Removes confusing _uuid property https://review.openstack.org/137253 | 00:28 |
|---|---|---|
| *** rdo has quit IRC | 00:34 | |
| *** rdo has joined #openstack-keystone | 00:36 | |
| openstackgerrit | Merged openstack/keystone: Update keystone readme to point to specs.o.org https://review.openstack.org/134595 | 00:36 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fixes docstring at eventlet_server https://review.openstack.org/128496 | 00:44 |
| *** lhcheng has quit IRC | 01:00 | |
| *** nellysmitt has joined #openstack-keystone | 01:04 | |
| *** nellysmitt has quit IRC | 01:09 | |
| *** dims has joined #openstack-keystone | 01:12 | |
| *** ncoghlan has joined #openstack-keystone | 01:21 | |
| *** stevemar has joined #openstack-keystone | 01:37 | |
| *** ChanServ sets mode: +v stevemar | 01:37 | |
| *** stevemar has quit IRC | 01:47 | |
| *** stevemar has joined #openstack-keystone | 01:51 | |
| *** ChanServ sets mode: +v stevemar | 01:51 | |
| jamielennox | i'd love to see a IRC bot similar to openstackgerrit that would message the channel when an email was sent to the ML with [keystone] in the title | 01:56 |
| morganfainberg | jamielennox. so write one? | 01:56 |
| morganfainberg | though i think it'd be too spammy | 01:57 |
| jamielennox | morganfainberg: yea, one of those i'd like to see someone else have done it :) | 01:57 |
| jamielennox | morganfainberg: it'd be no where near as spammy as gerrit | 01:57 |
| morganfainberg | jamielennox, maybe maybe not | 01:57 |
| morganfainberg | at the very least *some* projects would be overwhelmed by it | 01:57 |
| jamielennox | sure, but i think for keystone at least it would result in people answering faster | 01:58 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: WIP - Improve list role assignments filters performance https://review.openstack.org/137202 | 02:00 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use ConfigFilter for auth_token options https://review.openstack.org/115830 | 02:11 |
| *** diegows has quit IRC | 02:12 | |
| *** ncoghlan is now known as ncoghlan_afk | 02:13 | |
| *** yasu_ has joined #openstack-keystone | 02:14 | |
| *** erkules_ has joined #openstack-keystone | 02:27 | |
| *** sluo_laptop has joined #openstack-keystone | 02:27 | |
| *** erkules has quit IRC | 02:29 | |
| *** arif-ali has joined #openstack-keystone | 02:29 | |
| *** dims has quit IRC | 02:37 | |
| *** samuelms has quit IRC | 02:52 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:59 | |
| *** nellysmitt has joined #openstack-keystone | 03:05 | |
| *** nellysmitt has quit IRC | 03:10 | |
| *** dims has joined #openstack-keystone | 03:12 | |
| *** dims has quit IRC | 03:17 | |
| *** tellesnobrega_ has quit IRC | 04:05 | |
| *** dims has joined #openstack-keystone | 04:17 | |
| *** dims has quit IRC | 04:23 | |
| *** ncoghlan_afk is now known as ncoghlan | 04:40 | |
| *** nellysmitt has joined #openstack-keystone | 05:06 | |
| *** nellysmitt has quit IRC | 05:11 | |
| *** oomichi has quit IRC | 05:16 | |
| *** ajayaa has joined #openstack-keystone | 05:29 | |
| *** yasu_ has quit IRC | 05:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:03 |
| *** erkules_ is now known as erkules | 06:16 | |
| *** ajayaa has quit IRC | 06:20 | |
| *** yasu_ has joined #openstack-keystone | 06:32 | |
| *** ukalifon1 has joined #openstack-keystone | 06:33 | |
| *** stevemar has quit IRC | 06:37 | |
| *** ajayaa has joined #openstack-keystone | 06:54 | |
| *** jamielennox is now known as jamielennox|away | 06:59 | |
| *** nellysmitt has joined #openstack-keystone | 07:07 | |
| *** nellysmitt has quit IRC | 07:11 | |
| *** afazekas has joined #openstack-keystone | 07:24 | |
| *** k4n0 has joined #openstack-keystone | 07:24 | |
| *** marekd|away is now known as marekd | 07:33 | |
| *** ncoghlan has quit IRC | 07:41 | |
| *** ukalifon1 has quit IRC | 07:59 | |
| *** afazekas has quit IRC | 08:17 | |
| *** afazekas has joined #openstack-keystone | 08:27 | |
| *** ukalifon has joined #openstack-keystone | 08:40 | |
| *** ekarlso- has quit IRC | 08:52 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Handle SSL termination proxies for version list https://review.openstack.org/132235 | 08:58 |
| *** jistr has joined #openstack-keystone | 09:00 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: More efficient way to build the SQL clauses https://review.openstack.org/133135 | 09:01 |
| *** Dafna has joined #openstack-keystone | 09:07 | |
| *** nellysmitt has joined #openstack-keystone | 09:08 | |
| *** ekarlso- has joined #openstack-keystone | 09:08 | |
| *** nellysmitt has quit IRC | 09:12 | |
| *** nellysmitt has joined #openstack-keystone | 09:28 | |
| *** tellesnobrega_ has joined #openstack-keystone | 09:31 | |
| *** bjornar has joined #openstack-keystone | 09:37 | |
| *** tellesnobrega_ has quit IRC | 09:42 | |
| *** dims has joined #openstack-keystone | 09:45 | |
| *** dims has quit IRC | 09:49 | |
| *** openstackgerrit has quit IRC | 09:50 | |
| *** openstackgerrit has joined #openstack-keystone | 09:50 | |
| *** henrynash has quit IRC | 09:57 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:05 | |
| *** nkinder has quit IRC | 10:21 | |
| *** tellesnobrega_ has quit IRC | 10:35 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:51 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 10:59 |
| *** tellesnobrega_ has quit IRC | 11:02 | |
| *** diegows has joined #openstack-keystone | 11:28 | |
| *** dims has joined #openstack-keystone | 11:39 | |
| *** andreaf has joined #openstack-keystone | 11:52 | |
| *** aix has joined #openstack-keystone | 11:55 | |
| *** andreaf_ has joined #openstack-keystone | 11:59 | |
| *** henrynash has joined #openstack-keystone | 12:01 | |
| *** ChanServ sets mode: +v henrynash | 12:01 | |
| *** henrynash has quit IRC | 12:05 | |
| *** andreaf_ has quit IRC | 12:06 | |
| *** NM has joined #openstack-keystone | 12:08 | |
| *** raildo has joined #openstack-keystone | 12:14 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: WIP - Improve list role assignments filters performance https://review.openstack.org/137202 | 12:17 |
| *** mzbik has joined #openstack-keystone | 12:20 | |
| mzbik | My user is member of group that have _member_ role in project | 12:21 |
| mzbik | but when I list /v3/users/my_id/projects I see empty list | 12:22 |
| *** andreaf_ has joined #openstack-keystone | 12:22 | |
| rodrigods | mzbik, you need to check if your user has authorization to perform such query | 12:24 |
| mzbik | I would get auth requerd error I think | 12:25 |
| rodrigods | mzbik, https://github.com/openstack/keystone/blob/master/etc/policy.json#L36 hmm true | 12:25 |
| mzbik | btw policy.json is sooo broken when using domains | 12:26 |
| mzbik | anyways I have empty list of projects | 12:26 |
| mzbik | perhaps I missunderstand groups idea | 12:26 |
| mzbik | but I thought that I only need to grant access to group and people in group will inherit roles | 12:27 |
| rodrigods | mzbik, you thought is correct | 12:27 |
| rodrigods | what happens if you use the role_assignments endpoint with the "effective" query? | 12:28 |
| mzbik | 204 No Content | 12:28 |
| *** andreaf has quit IRC | 12:28 | |
| mzbik | I used: /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} | 12:29 |
| mzbik | and PUT on it | 12:29 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 12:29 |
| marekd | rodrigods: ^^ | 12:29 |
| *** andreaf has joined #openstack-keystone | 12:29 | |
| rodrigods | mzbik, GET /v3/role_assignments?user.id=<your_user>&effective | 12:29 |
| rodrigods | ? | 12:29 |
| *** andreaf_ has quit IRC | 12:29 | |
| rodrigods | marekd, nice! | 12:29 |
| mzbik | rodrigods, give me a sec | 12:29 |
| marekd | rodrigods: thanks for the review. | 12:29 |
| marekd | very helpful | 12:30 |
| rodrigods | marekd, np :) | 12:30 |
| mzbik | rodrigods, empty list "role_assignments":[ ] | 12:31 |
| rodrigods | mzbik, hmm i'd check the group grant then, if it is active (if it is there or if the target project is enabled) | 12:32 |
| rodrigods | mzbik, you can try to pass just "effective" to check the returned list too | 12:32 |
| mzbik | project is enabled | 12:32 |
| rodrigods | mzbik, I remember henrynash found some bugs related to effective/inherited role assignments | 12:33 |
| marekd | yes. | 12:33 |
| mzbik | rodrigods, wklej.org/hash/4a9212d55a8/ | 12:34 |
| rodrigods | mzbik, yeah, looks like a bug to me. Just need to check if it was already reported | 12:43 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add support for domain specific roles. https://review.openstack.org/133855 | 12:49 |
| rodrigods | mzbik, https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L246 it includes the groups in the call... | 12:52 |
| rodrigods | mzbik, did you check the user is really in the group? | 12:53 |
| mzbik | yes it is | 12:53 |
| mzbik | i did: /v3/users/user_id/groups | 12:53 |
| mzbik | and groups is listed | 12:53 |
| rodrigods | mzbik, strange... :( | 12:54 |
| mzbik | it is LDAP backend | 12:54 |
| mzbik | and maybe why is this | 12:55 |
| *** ayoung has joined #openstack-keystone | 12:59 | |
| *** ChanServ sets mode: +v ayoung | 12:59 | |
| rodrigods | mzbik, https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/ldap.py#L446 yeah, looks like a bug (but since is common case, should be a known one) | 13:00 |
| *** aix has quit IRC | 13:00 | |
| *** dims has quit IRC | 13:15 | |
| *** dims has joined #openstack-keystone | 13:15 | |
| mzbik | rodrigods, I will try to investigate it | 13:21 |
| *** bknudson has quit IRC | 13:34 | |
| *** aix has joined #openstack-keystone | 13:35 | |
| *** gordc has joined #openstack-keystone | 13:37 | |
| dstanek | marekd: heya | 13:52 |
| marekd | hey | 13:52 |
| marekd | back to work after the vacation? | 13:52 |
| dstanek | marekd: :-) unfortunately | 13:52 |
| marekd | shhh, claco may be online :P | 13:53 |
| dstanek | marekd: is there some instructions on setting up shib properly? | 13:53 |
| marekd | dstanek: what IdP you want to use? | 13:53 |
| dstanek | marekd: that's a good question. i was planning on using Keystone as the IdP to kill two birds with one stone | 13:54 |
| dstanek | but maybe that's not a good idea for functional tests | 13:54 |
| marekd | dstanek: apart from that I'd say what we have on Keystone docs should be good enough. | 13:54 |
| marekd | dstanek: for the functional tests's i'd for with Icehouse federation first. | 13:54 |
| marekd | if you don't have a IdP, I'd simply go with testshib.org | 13:54 |
| marekd | good enough to have 'something'. | 13:55 |
| *** jdennis has quit IRC | 13:55 | |
| marekd | dstanek: do you need some help with setting up a functional tests suite? | 13:55 |
| rodrigods | dstanek, marekd, the SP config part, shouldn't be too different from the "Keystone as a SP" described here http://rodrigods.com/playing-with-keystone-to-keystone-federation/ | 13:56 |
| marekd | rodrigods: dstanek by design SP part is simply Icehouse federation. | 13:56 |
| rodrigods | marekd, ++ | 13:56 |
| marekd | apart from security checks turned off :-) | 13:57 |
| *** bknudson has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +v bknudson | 13:58 | |
| dstanek | marekd: i'll probably need help with some of the finer configuration - i need to have federation setup and working today :-) | 13:58 |
| marekd | why? | 13:58 |
| marekd | dstanek: i mean, why today? | 13:58 |
| marekd | dstanek: but yeah, no problem. | 13:58 |
| dstanek | marekd: that's my goal - artificial, but i need something to shoot for | 13:59 |
| marekd | dstanek: ah, yes. | 13:59 |
| *** jimbaker has joined #openstack-keystone | 14:00 | |
| marekd | dstanek: enable federation extension, configure apache, configure mod_shib, read testshib.org docs and configure shibboleth add idp, mapping, protocol and play with keystoneclient. | 14:00 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 14:04 |
| marekd | dstanek: since we are around federation topic ^^ :-) | 14:06 |
| *** jdennis has joined #openstack-keystone | 14:12 | |
| *** jaosorior has joined #openstack-keystone | 14:12 | |
| *** lhcheng has joined #openstack-keystone | 14:13 | |
| *** NM has quit IRC | 14:14 | |
| *** NM has joined #openstack-keystone | 14:14 | |
| mzbik | rodrigods, I found an issue | 14:16 |
| mzbik | rodrigods, or rather what was an issue - group ID was too shord, I ate one letter at the end | 14:16 |
| rodrigods | mzbik, hmm in which step? | 14:19 |
| mzbik | /v3/groups/{id} | 14:19 |
| mzbik | my id was 940bbfbb6a889ee2631277b04117913748e5bab676ea820b284a951b1819d0dd | 14:19 |
| mzbik | and I mistaken did 940bbfbb6a889ee2631277b04117913748e5bab676ea820b284a951b1819d0d | 14:20 |
| mzbik | so one d at the end less | 14:20 |
| mzbik | after this everytings works better ;) | 14:20 |
| rodrigods | mzbik, great! :) | 14:20 |
| dstanek | marekd: i'll take a look | 14:22 |
| marekd | dstanek: ty | 14:22 |
| *** mzbik has quit IRC | 14:31 | |
| *** jasondotstar has joined #openstack-keystone | 14:39 | |
| *** yasu_ has quit IRC | 14:51 | |
| *** topol has joined #openstack-keystone | 14:58 | |
| *** ChanServ sets mode: +v topol | 14:58 | |
| *** jdennis has quit IRC | 14:59 | |
| *** andreaf has quit IRC | 15:16 | |
| *** andreaf has joined #openstack-keystone | 15:16 | |
| *** k4n0 has quit IRC | 15:16 | |
| *** jdennis1 has joined #openstack-keystone | 15:16 | |
| *** kobtea has joined #openstack-keystone | 15:19 | |
| *** lhcheng has quit IRC | 15:25 | |
| *** andreaf has quit IRC | 15:28 | |
| *** andreaf has joined #openstack-keystone | 15:29 | |
| *** ukalifon has quit IRC | 15:31 | |
| *** amakarov_away is now known as amakarov | 15:35 | |
| *** thedodd has joined #openstack-keystone | 15:35 | |
| amakarov | ayoung, good day! Do you know how to find David Chadwick? I've double-checked my precious redelegation for him and eager to continue gathering +'es :) | 15:41 |
| ayoung | amakarov, only via email, but he is fairly responsive | 15:42 |
| amakarov | ayoung, thanks, I thought he might be somewhere here | 15:43 |
| *** jorge_munoz has joined #openstack-keystone | 15:45 | |
| *** nellysmitt has quit IRC | 15:48 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Multiple IdPs problem https://review.openstack.org/138104 | 15:54 |
| *** zzzeek has joined #openstack-keystone | 16:00 | |
| *** joesavak has joined #openstack-keystone | 16:04 | |
| *** david-lyle_afk is now known as david-lyle | 16:06 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Multiple IdPs problem https://review.openstack.org/138104 | 16:07 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Multiple IdPs problem https://review.openstack.org/138104 | 16:08 |
| amakarov | bknudson, hello! Please review this one: https://review.openstack.org/#/c/118590/ I've returned API back to original state | 16:08 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Multiple IdPs problem https://review.openstack.org/138104 | 16:09 |
| *** mzbik has joined #openstack-keystone | 16:11 | |
| *** thedodd has quit IRC | 16:15 | |
| *** nellysmitt has joined #openstack-keystone | 16:19 | |
| *** henrynash has joined #openstack-keystone | 16:20 | |
| *** ChanServ sets mode: +v henrynash | 16:20 | |
| henrynash | ayoung: ping | 16:20 |
| ayoung | Hey henrynash ! | 16:20 |
| ayoung | I take it you saw my email? | 16:20 |
| henrynash | ayoung: so…domains and projects | 16:20 |
| ayoung | henrynash, yeah...I see domains as like "bridge projects" | 16:20 |
| henrynash | ayoung: so i assume what you want is separate backends for domains and projects | 16:21 |
| ayoung | henrynash, yeah, I was thinking like DNS backed Projects or something LDAP ish | 16:21 |
| henrynash | ayoung: so if we got agreemet quickly…this is pretty easy for me to do as part of teh current split | 16:21 |
| ayoung | treat the project database as read-only for a specific domain | 16:21 |
| *** stevemar has joined #openstack-keystone | 16:22 | |
| *** ChanServ sets mode: +v stevemar | 16:22 | |
| ayoung | yeah, we don't need the 100% solution for "domain specific backend for assignment" | 16:22 |
| openstackgerrit | Bogun Dmitriy proposed openstack/keystone: FIX multiple SQL backend usage validation https://review.openstack.org/138113 | 16:22 |
| henrynash | ayoung: I just did this for assignments…roles had their own backend to the actual assignment model | 16:22 |
| ayoung | or for "project" | 16:22 |
| ayoung | so resource would become the project backend, and domains would go into the domains backend? | 16:22 |
| henrynash | yes | 16:22 |
| henrynash | ayoung: we’d have domain_backends/ or something like that | 16:23 |
| henrynash | so one controller, but two backends (each with its own manager( | 16:23 |
| henrynash | manager) | 16:23 |
| ayoung | the big thing would be to keep the databases separatable, so no foreign key constraints | 16:24 |
| henrynash | agreed | 16:24 |
| mzbik | Can anyone confirm (Adam?) that when I issue: /v3/users?domain_id={id_domeny}&name={nazwa_usera} with LDAP backend Keystone will query all and then filter? | 16:24 |
| ayoung | just like identity, the default for projects would be SQL, but you could pull in an LDAP source for a specific domain. | 16:25 |
| ayoung | mzbik, not without looking at the code | 16:25 |
| ayoung | mzbik, plus, I tend to lie a lot. | 16:25 |
| henrynash | if morgan and otehrs are OK with that, it will onlt take me a few hours…can’t do it tonight, but by the time you wake up tomorrow, the patch would be up | 16:25 |
| mzbik | ayoung, :P | 16:26 |
| ayoung | mzbik, in fact, I'm lying right now. | 16:26 |
| mzbik | same thing with groups btw | 16:26 |
| ayoung | henrynash, well, you have my vote for it. | 16:26 |
| *** jasondotstar has quit IRC | 16:31 | |
| mzbik | Hmmm... I cant find it in code, will try on launchpad | 16:34 |
| rodrigods | mzbik, https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L216 | 16:35 |
| *** henrynash has quit IRC | 16:36 | |
| *** radez_g0n3 is now known as radez | 16:36 | |
| mzbik | it tells me nothing ;/ Im not good coder :( | 16:37 |
| *** afaranha has quit IRC | 16:38 | |
| *** afaranha has joined #openstack-keystone | 16:38 | |
| rodrigods | mzbik, for the SQL beckend, it retrieves already filtered. For LDAP, there is some code that I'm not familiar with. Not sure what happens in the internals :( | 16:40 |
| *** afaranha has quit IRC | 16:40 | |
| rodrigods | mzbik, but I know that LDAP doesn't support different domains for assignment | 16:41 |
| mzbik | rodrigods, thank you. Adam is lying so I cant ask him :P | 16:41 |
| *** _cjones_ has joined #openstack-keystone | 16:42 | |
| ayoung | you can ask, you just can't trust the response. Or maybe you can | 16:43 |
| rodrigods | mzbik, Adam always helped me :) | 16:44 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L81 | 16:44 |
| rodrigods | ayoung, ^ | 16:44 |
| rodrigods | ayoung, mzbik, btw... if the driver doesn't support domains, the filter is removed from the query | 16:44 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1451 | 16:45 |
| rodrigods | https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L617 | 16:45 |
| ayoung | https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L262 | 16:45 |
| ayoung | So that last one is the smoking guy. Not a typo. I mean the dude from Xfiles. | 16:46 |
| ayoung | self.get_all() gets executed first | 16:46 |
| *** henrynash has joined #openstack-keystone | 16:46 | |
| *** ChanServ sets mode: +v henrynash | 16:46 | |
| ayoung | and then it filters | 16:46 |
| rodrigods | ayoung, ++ | 16:46 |
| rodrigods | nice | 16:46 |
| lbragstad | morganfainberg: when migrating services, if there are two with the same type, how do you want to resolve the conflict in the migration? | 16:46 |
| ayoung | lbragstad, cage match | 16:46 |
| *** _cjones_ has quit IRC | 16:47 | |
| ayoung | two service enter, one servce leave! | 16:47 |
| marekd | henrynash: unfortunately, your comment about roles api is valid :( | 16:47 |
| lbragstad | one type to rule them all | 16:47 |
| henrynash | marekd: :-( | 16:47 |
| *** NM1 has joined #openstack-keystone | 16:47 | |
| marekd | henrynash: i am not sure if extending role assignment api with some requests with a body is doable? | 16:48 |
| marekd | and acceptable? | 16:48 |
| ayoung | and in the darkness bind them | 16:49 |
| *** NM has quit IRC | 16:49 | |
| henrynash | marekd: so that has been discussed a few times (in fact the original proposal for role-assignments (as opposed to the extsing grants) was exactly that, e.g. PUT /role-assignment with a bodey that had scope etc. | 16:51 |
| marekd | henrynash: exactly this was my first thought. And what was the conclusion? | 16:52 |
| henrynash | marekd: although (apparantly) the original grant apis did this…and the goal was to move away from that and do it “all in the URL”….. | 16:52 |
| henrynash | marekd: although I don’t think we really had a good debate about it | 16:52 |
| henrynash | I guess you could propose... | 16:53 |
| marekd | henrynash: but this means not 'extending' but rather converging to PUT role assignments, right? | 16:53 |
| *** jasondotstar has joined #openstack-keystone | 16:53 | |
| rodrigods | marekd, henrynash, I'd vote for extending the grants | 16:53 |
| rodrigods | think that having two APIs for granting, would be confusing | 16:53 |
| henrynash | PUT /user/<user id>/project/<projectid>/role_name/<role name> | 16:53 |
| *** _cjones_ has joined #openstack-keystone | 16:54 | |
| rodrigods | henrynash, ++ | 16:54 |
| marekd | rodrigods: if you extend then you will confuse. | 16:54 |
| henrynash | …although are all textual role names URL friendly? | 16:55 |
| marekd | henrynash: role names...i think so? | 16:55 |
| henrynash | I assume we would handle spaces ok? | 16:56 |
| marekd | henrynash: yeah, we could also try to allow users to assign a role to a group identified by name and domain. | 16:56 |
| rodrigods | marekd, disagree... having two ways to do the same thing, and being completely different from each other looks confusing to me | 16:56 |
| marekd | rodrigods: so what are you now talking? | 16:56 |
| henrynash | marekd: right, sorry I keep getting confused | 16:56 |
| henrynash | marekd: PUT /group-name/< group name>/project/<proj ID>/ role/<role ID> | 16:57 |
| rodrigods | marekd, like that ^ | 16:57 |
| marekd | i never said it'd go this way. | 16:58 |
| *** afaranha has joined #openstack-keystone | 16:58 | |
| henrynash | marekd: now we do have a problem with domain….we could assume it is teh current domain? | 16:58 |
| rodrigods | marekd, is better than PUT /role_assignments IMO | 16:58 |
| *** richm has joined #openstack-keystone | 16:58 | |
| henrynash | marekd: which I am a bit worried about | 16:58 |
| marekd | rodrigods: yes. but i call i don't call it extending but converging to new way of handling and managing role assignments. | 16:58 |
| henrynash | marekd: let me see if I can find the original proposal i made…. | 16:59 |
| marekd | henrynash: ok | 16:59 |
| marekd | rodrigods: extending to me means some operations with URL parameters and some via PUT/POST and sending data in a request body. | 17:00 |
| marekd | which i think you find confusing, me probably too. | 17:00 |
| ayoung | why do we still have keystone.tests.test_v3_auth.TestAuthXML if we did in the XML code? | 17:01 |
| bknudson | the XML code isn't gone yet... | 17:01 |
| bknudson | https://review.openstack.org/#/c/125738/ | 17:02 |
| *** kobtea has quit IRC | 17:04 | |
| ayoung | thanks | 17:05 |
| lbragstad | ayoung: more on that here too http://lists.openstack.org/pipermail/openstack-dev/2014-November/051619.html | 17:05 |
| ayoung | bknudson, so, I was working on trying to split auth from the rest of the controllers, and so had a separate paste pipelinefor it. And JSON home when Kablooie on me. Is the json home code somehow scraping things out of the controllers? | 17:06 |
| ayoung | lbragstad, yeah, I was discussing with David Kranz, too. In real life, no less. | 17:06 |
| bknudson | ayoung: yes, the extensions are essentially scraping the output to update the JSON-Home response. | 17:07 |
| ayoung | He has this funny notion that the Tempest code should still test older, stable branches of the XML code.... | 17:07 |
| bknudson | ayoung: I thought mtrienish and others decided to just drop it. | 17:07 |
| ayoung | bknudson, scraping the output of what? | 17:07 |
| ayoung | bknudson, they did, but kranz disagrees with that approach | 17:07 |
| bknudson | ayoung: the extension in the pipeline looks for the JSON-Home response and updates it with its own JSON-Home info. | 17:08 |
| *** DavidHu has joined #openstack-keystone | 17:08 | |
| ayoung | bknudson, so it makes a local call, gets the JSON home for each module, and then makes a composite of all of them? | 17:09 |
| *** jimhoagland has joined #openstack-keystone | 17:09 | |
| bknudson | ayoung: no, as the response travels through the pipeline it gets updated. | 17:09 |
| ayoung | response to what? | 17:09 |
| ayoung | what pipeline? THe Paste pipeline? | 17:09 |
| bknudson | ayoung: the response for the request... yes, the paste pipeline | 17:10 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/controllers.py#n200 | 17:10 |
| ayoung | for router in routers.... | 17:10 |
| ayoung | so we've just even more tighly coupled all of the services together | 17:10 |
| henrynash | marekd: so the essential part of the API is contained in thisi thread (I think actually Guang proposed it): http://lists.openstack.org/pipermail/openstack-dev/2013-June/010337.html | 17:10 |
| ayoung | we should drop paste | 17:11 |
| bknudson | ayoung: that's where the original response is generated. | 17:11 |
| bknudson | the extensions update the original response. | 17:11 |
| ayoung | if we can't really use it, all we are doing is making overhead for ourselves | 17:11 |
| ayoung | bknudson, ugh | 17:11 |
| ayoung | bknudson, I understand why you did that. But, ugh | 17:11 |
| ayoung | OK, here is what I am trying to do: | 17:12 |
| ayoung | I want to be able to specify the /auth url in paste as a separate thing, maybe multiple times for different auth mechanisms | 17:12 |
| bknudson | ayoung: in the pipeline? | 17:12 |
| bknudson | separate middleware? | 17:13 |
| ayoung | I want to be able to say, something like /kerb/auth does kerberos and only kerberos, /x509/auth does client cert and so forth | 17:13 |
| ayoung | bknudson, in Keystone server. | 17:13 |
| henrynash | marekd: and there actuallu stubs teh GET/PUT/DELETE in the assignments controller…but there was not concensus (back in Havana?) as to whether we should go ahead with a more comprehensive API. | 17:13 |
| ayoung | I wanted auth to be its own pipeline; | 17:13 |
| bknudson | the difficult thing is talking between pipelines. | 17:14 |
| bknudson | if you have to do that. | 17:14 |
| ayoung | bknudson, if we were actually making use of paste we would not lump /user, /token , /assignement etc all into one pipeline | 17:14 |
| bknudson | that's where the version oddity comes from, its got its own pipeline | 17:14 |
| ayoung | paste is somewhat bit rotted | 17:14 |
| ayoung | yeah, and we really should be able to define a filter set as opposed to saying you have to list all of the separate filters each time...but that is a different story | 17:15 |
| bknudson | y, we've got "/ = public_version_api" | 17:15 |
| ayoung | right | 17:15 |
| ayoung | and yet that pipeline still needs sizelimit url_normalize xml_body | 17:16 |
| ayoung | ideally we'd do something like | 17:16 |
| bknudson | so you wanted something like "/v3/auth = auth_api" ? | 17:16 |
| ayoung | bknudson, exactly | 17:16 |
| ayoung | bknudson, I have it working,but not tests running | 17:16 |
| ayoung | well, I have it coded but broken, and was working through the issues | 17:17 |
| *** kobtea has joined #openstack-keystone | 17:17 | |
| *** mzbik has quit IRC | 17:17 | |
| *** henrynash has quit IRC | 17:18 | |
| ayoung | bknudson, I had this idea that Keystone could actually be set up to be self testing for middleware etc. That to do a call to /v3/user, you went to /v3/auth and got a token, and then /v3/user would use auth_token middleware....just as a test case | 17:18 |
| ayoung | but it means that you can't run auth_token in front of /v3/auth | 17:19 |
| *** henrynash has joined #openstack-keystone | 17:19 | |
| *** ChanServ sets mode: +v henrynash | 17:19 | |
| ayoung | cuz validate token would trigger a call to keystone, and you'd have infinite recursion | 17:20 |
| *** kobtea has quit IRC | 17:22 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add migration to make service type unique https://review.openstack.org/138130 | 17:26 |
| marekd | henrynash: thanks. all in all we can end up with having admins configure groups and add a feature where groups are being mapped automatically | 17:27 |
| marekd | henrynash: if i start this PUT role assignments thread again we may spend full cycle discussing it and end up with nothing. | 17:28 |
| *** marcoemorais has joined #openstack-keystone | 17:28 | |
| henrynash | marekd: although I’d say that have teh groups in existance makes more sense of a cloud provider understanding what he is letting federated uses have access to… | 17:29 |
| marekd | henrynash: he would whitelist allowed groups either way | 17:29 |
| marekd | henrynash: ok, for now i will put curent proposal to ''alternatives'' section and change it so it's more doable. | 17:30 |
| *** tellesnobrega_ has joined #openstack-keystone | 17:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Authenticated Encryption Tokens https://review.openstack.org/130050 | 17:37 |
| *** jistr has quit IRC | 17:38 | |
| ajayaa | Hi guys. I am running into some issue in neutron with devstack. I think there is some problem with auth. Keystone logs show "ERROR keystone.common.wsgi [-] object of type 'NoneType' has no len()" | 17:41 |
| ajayaa | Any idea what might be wrong? I have verified keystone username and password is good for neutron user. | 17:42 |
| *** jimhoagland has left #openstack-keystone | 17:42 | |
| ajayaa | same goes for nova as well. | 17:42 |
| *** lhcheng has joined #openstack-keystone | 17:43 | |
| *** lhcheng has quit IRC | 17:43 | |
| *** lhcheng has joined #openstack-keystone | 17:43 | |
| ajayaa | ayoung, gyee, ^^ | 17:46 |
| breton | ajayaa: post full log on http://paste.openstack.org/ | 17:47 |
| *** lhcheng has quit IRC | 17:47 | |
| ajayaa | breton, http://paste.openstack.org/show/142761/ | 17:48 |
| *** henrynash has quit IRC | 17:49 | |
| *** harlowja_away is now known as harlowja_ | 17:49 | |
| *** lhcheng has joined #openstack-keystone | 17:50 | |
| *** jaosorior has quit IRC | 17:53 | |
| *** henrynash has joined #openstack-keystone | 17:56 | |
| *** ChanServ sets mode: +v henrynash | 17:56 | |
| ayoung | ajayaa, that looks suspect. The error there is in SQL Alchemy code | 17:56 |
| ayoung | (user_id) must be none | 17:57 |
| ayoung | I'm guessing user_id is populated at this step "/home/aj/stack/keystone/keystone/identity/core.py", line 529, | 17:58 |
| ajayaa | ayoung, I think devstack does not fetch the latest code if the folder is already there. I just now checked the git log and last commit was on aug 31. So pulling the new code. | 17:58 |
| ajayaa | :) | 17:58 |
| ayoung | yeah. | 17:58 |
| ajayaa | Thanks for the reply. | 17:58 |
| *** marcoemorais has quit IRC | 18:01 | |
| *** nellysmitt has quit IRC | 18:01 | |
| *** marcoemorais has joined #openstack-keystone | 18:02 | |
| *** henrynash has quit IRC | 18:11 | |
| *** gyee_ has joined #openstack-keystone | 18:17 | |
| *** joesavak has quit IRC | 18:20 | |
| *** r-daneel has joined #openstack-keystone | 18:24 | |
| *** marcoemorais has quit IRC | 18:27 | |
| *** marcoemorais has joined #openstack-keystone | 18:27 | |
| *** jimhoagland has joined #openstack-keystone | 18:34 | |
| *** gyee_ has quit IRC | 18:39 | |
| *** gyee_ has joined #openstack-keystone | 18:42 | |
| *** joesavak has joined #openstack-keystone | 18:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move test_utils to keystone/tests/unit/ https://review.openstack.org/133989 | 18:52 |
| *** tellesnobrega_ has quit IRC | 18:53 | |
| *** tellesnobrega_ has joined #openstack-keystone | 18:55 | |
| *** f13o has joined #openstack-keystone | 18:58 | |
| *** marcoemorais has quit IRC | 19:04 | |
| *** marcoemorais has joined #openstack-keystone | 19:04 | |
| stevemar | can a non-ibm'er +A this one: https://review.openstack.org/#/c/137729/ ayoung lbragstad | 19:06 |
| lbragstad | stevemar: testing it quick | 19:07 |
| stevemar | lbragstad, cool, it should work, just changes to help text | 19:07 |
| lbragstad | I didn't know that's how that worked... | 19:08 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Example Initialization scripts https://review.openstack.org/82687 | 19:10 |
| stevemar | lbragstad, *the more you know* | 19:15 |
| lbragstad | stevemar: looks good to me | 19:15 |
| *** amakarov is now known as amakarov_away | 19:19 | |
| *** packet has joined #openstack-keystone | 19:22 | |
| *** aix has quit IRC | 19:22 | |
| *** andreaf has quit IRC | 19:28 | |
| *** andreaf has joined #openstack-keystone | 19:28 | |
| *** NM1 has quit IRC | 19:28 | |
| *** NM has joined #openstack-keystone | 19:33 | |
| *** nellysmitt has joined #openstack-keystone | 19:38 | |
| *** dims_ has joined #openstack-keystone | 19:39 | |
| *** dims has quit IRC | 19:43 | |
| *** marcoemorais has quit IRC | 19:46 | |
| *** marcoemorais has joined #openstack-keystone | 19:46 | |
| *** packet has quit IRC | 19:47 | |
| *** dims_ has quit IRC | 19:47 | |
| *** dims has joined #openstack-keystone | 19:48 | |
| *** marcoemorais has quit IRC | 19:48 | |
| *** marcoemorais has joined #openstack-keystone | 19:48 | |
| *** marcoemorais has quit IRC | 19:49 | |
| *** marcoemorais has joined #openstack-keystone | 19:50 | |
| *** ajayaa has quit IRC | 19:54 | |
| *** jaosorior has joined #openstack-keystone | 19:59 | |
| *** marcoemorais has quit IRC | 19:59 | |
| *** marcoemorais1 has joined #openstack-keystone | 19:59 | |
| *** marcoemorais1 has quit IRC | 20:01 | |
| *** marcoemorais has joined #openstack-keystone | 20:01 | |
| *** jimhoagland has quit IRC | 20:03 | |
| *** packet has joined #openstack-keystone | 20:11 | |
| *** henrynash has joined #openstack-keystone | 20:14 | |
| *** ChanServ sets mode: +v henrynash | 20:14 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/136946 | 20:14 |
| *** wpf has quit IRC | 20:14 | |
| *** afazekas has quit IRC | 20:16 | |
| *** wpf has joined #openstack-keystone | 20:16 | |
| rodrigods | ayoung, morganfainberg, henrynash: code review request :D https://review.openstack.org/#/c/117786/ | 20:16 |
| henrynash | rodigods: ok | 20:17 |
| openstackgerrit | Merged openstack/keystone: Multiple IdPs problem https://review.openstack.org/138104 | 20:17 |
| henrynash | morganfainberg: ping | 20:17 |
| openstackgerrit | Merged openstack/keystone: Fixes docstring at eventlet_server https://review.openstack.org/128496 | 20:17 |
| openstackgerrit | Merged openstack/keystone: Fix the copy-pasted help info for db_version https://review.openstack.org/137729 | 20:17 |
| ayoung | rodrigods, test_v3_identity really needs to be split. Maybe after this and henrynash 's patch gets in. | 20:19 |
| rodrigods | ayoung, yep, samuelms-away fault :( | 20:20 |
| rodrigods | he managed to ship this split before the HM code | 20:20 |
| rodrigods | we already accepted the defeat in the rebase race against henrynash as well :( | 20:21 |
| *** _cjones_ has quit IRC | 20:22 | |
| henrynash | rodigods: so graceful, too :-) | 20:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: region.description is optional and can be null https://review.openstack.org/117611 | 20:24 |
| *** amcrn has joined #openstack-keystone | 20:25 | |
| *** marcoemorais has quit IRC | 20:25 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Move test_utils to keystone/tests/unit/ https://review.openstack.org/133989 | 20:31 |
| *** raildo_ has joined #openstack-keystone | 20:35 | |
| morganfainberg | ayoung, lets let the test split happen as we refactor tests ( lbragstad and dstanek are doing a lot of that work ) | 20:39 |
| morganfainberg | ayoung, splitting it now doesn't make sense until we know where / how it's landing. | 20:39 |
| ayoung | morganfainberg, are you OK with what I suggested to henrynash this morning: splitting domains from projects? | 20:40 |
| morganfainberg | unless the test split occurs before HM. | 20:40 |
| ayoung | yeah, agreed on the test stuff | 20:40 |
| dstanek | morganfainberg: i agree...i've have some help today from marekd in getting an example federation functional test | 20:40 |
| morganfainberg | ayoung, nope. i am against splitting things further - i'd rather be very conservative about splitting things up. | 20:40 |
| ayoung | morganfainberg, I think this one should have happened already | 20:40 |
| ayoung | I would argue it is more important than splitting off roles from assignment | 20:41 |
| ayoung | er | 20:41 |
| ayoung | projects from assignment | 20:41 |
| morganfainberg | ayoung, i'd rather split assignment from resource, then evaluate if we *need* to split roles from assignment or projects from domain | 20:41 |
| dstanek | morganfainberg: i've also done some work to split out the v3 tests that we have in keystone.tests to run against a real keystone instance instead of an in-process one | 20:41 |
| ayoung | morganfainberg, resource is a horrible name, and that reflects that we have something wrong here | 20:41 |
| lbragstad | dstanek: sweet! | 20:41 |
| morganfainberg | but it's a grey enough area, i'm willing to let it go either way provided there is enough reviewer/deployer support | 20:41 |
| morganfainberg | ayoung, then fix the name. | 20:41 |
| ayoung | that something is that domains and projects should be separate | 20:42 |
| morganfainberg | ayoung, adding another split is *not* the answer to fixing this. | 20:42 |
| ayoung | so domains go into the domain backend, and projects into domain specific storage | 20:42 |
| ayoung | yes, the point is that domain is like a mountpoint | 20:42 |
| *** jimhoagland has joined #openstack-keystone | 20:42 | |
| morganfainberg | ayoung, i am almost catagorically against that. | 20:42 |
| ayoung | morganfainberg, I sense much fear in you | 20:42 |
| raildo_ | morganfainberg, so, we have some patches about HM merged on our branch, so to merge to the master, we have to create a dependence to this change? | 20:42 |
| morganfainberg | ayoung, until we see a more conservative split *if* we're doing it. | 20:42 |
| morganfainberg | raildo_, yeah. | 20:43 |
| morganfainberg | raildo, lets stop piling things on that branch and get it merged to master sooner vs later. | 20:43 |
| ayoung | morganfainberg, I say we pay the price now, and pay it once | 20:43 |
| morganfainberg | ayoung, so the only thing i'm adding is - if we split it we can't collapse it. | 20:43 |
| ayoung | that is fine. It will be like domains and sql: | 20:44 |
| morganfainberg | i don't see domains and projects being separate. - i see them becoming closer | 20:44 |
| raildo_ | morganfainberg, ++ | 20:44 |
| morganfainberg | and i am almost 100% sure we're going to find that the split is just awful deployer experience | 20:44 |
| ayoung | domains are a keystone namespace for other things | 20:44 |
| ayoung | in identity, it is the IdPs. In Assignment, it is the project databases | 20:44 |
| morganfainberg | ayoung, domains and projects are *both* keystone things | 20:44 |
| ayoung | so are users | 20:44 |
| ayoung | except where they come from somewhere else | 20:44 |
| ayoung | same should be true for projects | 20:45 |
| morganfainberg | ayoung, so i'll be frank, i will -2 a split on domain and project until i see a clear use case that is a separate patch from what henry is working on | 20:45 |
| raildo_ | My fear is this will delay the merge our code to the master to kilo-2... and this can impact the rest of the implementation | 20:45 |
| ayoung | morganfainberg, that is just being stubborn | 20:45 |
| ayoung | raildo_, that is legit | 20:45 |
| morganfainberg | ayoung, did you read the second part of that statement | 20:45 |
| morganfainberg | ayoung, *separate patch* | 20:45 |
| ayoung | morganfainberg, I laid it out for you before. | 20:45 |
| ayoung | DNS and LDAP based project Databases | 20:46 |
| morganfainberg | ayoung, and i'm unconvinced. | 20:46 |
| morganfainberg | ayoung, so it needs to be separate from henry's work. | 20:46 |
| ayoung | morganfainberg, I understand the HTM concern | 20:46 |
| morganfainberg | ayoung, in fact i'd argue it's a separate spec. | 20:46 |
| morganfainberg | ayoung, it also drastically changes everything we agreed upon with domains == projects | 20:47 |
| ayoung | I should have done it back when I split identity | 20:47 |
| morganfainberg | ayoung, so separate spec. | 20:47 |
| ayoung | I was tempted to... | 20:47 |
| ayoung | nah | 20:47 |
| morganfainberg | ayoung, make the case there. | 20:47 |
| ayoung | it is a trivial extension | 20:47 |
| morganfainberg | ayoung, then it's a -2 from me. | 20:47 |
| ayoung | not a radical departure | 20:47 |
| morganfainberg | i *don | 20:47 |
| morganfainberg | 't* see it as trivial | 20:47 |
| raildo_ | I have to agree with morganfainberg... | 20:47 |
| ayoung | morganfainberg, I think it would still take more work to do the domain specific backends for projects, just that we are muddying the namespace by calling things resource | 20:48 |
| morganfainberg | i'm willing to entertain it, but it's *not* what henry proposed and it is tangentially related. | 20:48 |
| raildo_ | although we can not take a -2 hahaha | 20:48 |
| ayoung | raildo_, you are not objective...you are trying to get a feature in. I sympathized. | 20:48 |
| raildo_ | I can* | 20:48 |
| ayoung | Sympathize even | 20:48 |
| *** nellysmitt has quit IRC | 20:49 | |
| morganfainberg | ayoung, so - i've laid out what it takes for me to consider it. am willing to be stubborn about it needing to be a spec and needs a clear use-case laid out in the spec / problem space | 20:49 |
| ayoung | morganfainberg, it was what I originally understood his rationale to be for splitting things in the first place, and it shows why we are so convoluted in naming things | 20:49 |
| morganfainberg | ayoung, i also am against splitting roles from assignment (see my comment on henry's patch) | 20:49 |
| ayoung | then we should cancel henrynash 's split at all, as it is a half measure | 20:49 |
| morganfainberg | i'm *not* blocking it. | 20:49 |
| ayoung | if your concern is just schedule, I understand | 20:50 |
| morganfainberg | ayoung, so - write a spec, lay out the problem space, lay out the use-case | 20:50 |
| bknudson | seems like we accepted that we were going to do HMT before any discussion of splitting backends... | 20:50 |
| morganfainberg | ayoung, i'm not willing to entertain this as an irc conversation meaning approval. | 20:50 |
| bknudson | so HMT shouldn't depend on a split now | 20:50 |
| morganfainberg | HMT is also more important than splitting project/domain | 20:50 |
| ayoung | bknudson, does that mean HMT goes in before henrynash 's split of assignment? | 20:51 |
| ayoung | I thought we were going to opposite... | 20:51 |
| ayoung | morganfainberg, agreed | 20:51 |
| morganfainberg | so, at this point i'd like to, if henrynash is opke with it. resolve the current HMT branch | 20:51 |
| bknudson | I would have preferred it for HMT goes in before the split | 20:51 |
| morganfainberg | and get that merged | 20:51 |
| ayoung | deal. | 20:51 |
| morganfainberg | it's goign to take i think either dolphm's time or mine to resolve that anyway | 20:51 |
| morganfainberg | raildo_, if you don't mind helping out and rebasing your patches against master | 20:52 |
| morganfainberg | once we merge the branch away | 20:52 |
| raildo_ | I agree that we need the domains roles stuffs to coverage the Reseller use case, in HM implementation. | 20:52 |
| morganfainberg | then have henrynash's land. | 20:52 |
| henrynash | so I’ll admit that part of the rationale for splitting assignments was to give a nice landing place for HM | 20:52 |
| *** NM has quit IRC | 20:52 | |
| ayoung | morganfainberg, ah, it is a topic branch, isn't it. So we are going to do the whole "merge a branch" thing there, not rebase? | 20:52 |
| rodrigods | morganfainberg, so we need a ff in HM branch | 20:52 |
| morganfainberg | ayoung, yes | 20:52 |
| rodrigods | than we can rebase it | 20:52 |
| morganfainberg | ayoung, thats why it's going to be unfun. | 20:53 |
| morganfainberg | rodrigods, yes. | 20:53 |
| raildo_ | rodrigods, morganfainberg ++ | 20:53 |
| henrynash | so I’d have prefered the split first….but, if we want to do the other way round, I don’t mind doing the work on mine | 20:53 |
| rodrigods | henrynash, we can help with your rebase as well | 20:53 |
| rodrigods | if you don't mind having partial patchsets | 20:54 |
| *** jimhoagland has left #openstack-keystone | 20:54 | |
| ayoung | morganfainberg, ok, yeah, let's clear that up, and then loop back around on the domain/project split. I think it should not be a stand alone spec, but should instead be an update to the existing assignemnt split spec | 20:54 |
| *** marcoemorais has joined #openstack-keystone | 20:54 | |
| ayoung | but I'll try to lay it out clearly | 20:54 |
| morganfainberg | ayoung, and then we can work on henry's patch and i'm not unwilling to see project/domain split, but i want a spec for it. just like henry's spec is splitting assignment. if the project/domain split is *needed* we can place it in line before/after henry's | 20:54 |
| morganfainberg | ayoung, my -2 is "this is not an IRC conversation approval" point. not a "nope never". | 20:55 |
| ayoung | morganfainberg, that is my point: it should be *part* of henry's split or it muddies the water. I can work with henrynash on that. | 20:55 |
| morganfainberg | ayoung, ok then it can exetend his spec (I wasn't clear how you got it into specs) | 20:55 |
| morganfainberg | ayoung, but it needs to be outlined, problem space, use-case, etc | 20:55 |
| morganfainberg | ayoung, that work for you? [and realize this cycle is already *very* full] | 20:56 |
| ayoung | morganfainberg and I guess what I was asking is if you understand the rationale for it, and in general supported it, not that we were going to bypass the spec process | 20:56 |
| morganfainberg | ayoung, so - outline it clearly. we've had ~4 different conversations on it, and i'm still unclear what it wins us. | 20:56 |
| morganfainberg | and getting it in a spec makes it easier to hammer out details rather than trolling eavesdrop logs ;) | 20:57 |
| morganfainberg | rodrigods, raildo_, let me see how hard the FF on the feature branch is going to be. | 20:57 |
| raildo_ | morganfainberg, ok. thanks | 20:57 |
| morganfainberg | rodrigods, raildo, hopefully clean - then we can FF that, then merge to master | 20:57 |
| ayoung | morganfainberg, I felt the same way about the split of the assignment from projects. | 20:58 |
| ayoung | And, might I add, a few other specs, too.... | 20:58 |
| morganfainberg | ayoung, we can revisit the whole spec. if we want. | 20:58 |
| morganfainberg | ayoung, and recind if it doesn't make sense. | 20:58 |
| morganfainberg | ayoung, specs are *not* written in stone. | 20:58 |
| raildo_ | morganfainberg, for rodrigods and me, we can start do that tomorrow. | 20:58 |
| ayoung | morganfainberg, I think the split makes sense if the goal is to let two things vary independently | 20:58 |
| *** tellesnobrega_ has quit IRC | 20:59 | |
| ayoung | fair enough. I'll work with henrynash on this one | 20:59 |
| morganfainberg | ayoung, so - lets get HMT in. lets look at either separate spec or addendum to henry's for your case. i'm leaning towards a dependent spec, but thats my preference. - i'd rather see less splits done in a single fell swoop, [make them separate work items at least?] | 21:00 |
| morganfainberg | i wont say no to adding it to henry's spec, but i want it to be clear what we're aiming for and how we're getting there. | 21:01 |
| morganfainberg | and the problemspace/use-cases | 21:01 |
| *** _cjones_ has joined #openstack-keystone | 21:05 | |
| *** chrisshattuck has joined #openstack-keystone | 21:07 | |
| *** raildo_ has quit IRC | 21:08 | |
| *** henrynash has quit IRC | 21:09 | |
| * ayoung slowly turning into termie? | 21:12 | |
| morganfainberg | https://review.openstack.org/#/c/138182/ | 21:15 |
| morganfainberg | ayoung, nah. | 21:15 |
| morganfainberg | ayoung, you [or if you're referencing me, same thing applies] don't -2 and leave / refuse to revisit | 21:16 |
| ayoung | Valerie: Think it'll work? MAX:It'll take a miracle. Both :Buh Bye! | 21:16 |
| ayoung | morganfainberg, nah, just my desire to rewrite everything in a vacuum | 21:17 |
| *** zzzeek has quit IRC | 21:17 | |
| morganfainberg | ayoung, keystone extra-lite? | 21:17 |
| ayoung | I prefer the review process, but hate the status quo of so much of our code | 21:17 |
| morganfainberg | ayoung, and sadly, a lot of our code has to be fixed incrementally. | 21:17 |
| morganfainberg | ayoung, we're waaaaaay ahead of a few cycles ago. take it as a win, but we have to be slow moving :( | 21:17 |
| ayoung | morganfainberg, OTOH more people have run code I've written in Keystone than the rest of my career combined | 21:18 |
| *** zzzeek has joined #openstack-keystone | 21:18 | |
| morganfainberg | ayoung, ++ | 21:18 |
| ayoung | and more people have learned to curse my name. Win-win as I see it | 21:18 |
| ayoung | morganfainberg, OK, on to another thing you and I have argued about... | 21:18 |
| morganfainberg | ayoung, just don't turn into linus and the mail threads | 21:18 |
| ayoung | I was trying to split out just /auth from the rest of the services | 21:19 |
| morganfainberg | ayoung, i'm limited in my capacity to work on this today - i have a ton of $those_people_who_pay_my_paycheck$ work to follow up on | 21:19 |
| ayoung | NP | 21:19 |
| morganfainberg | ayoung, so hopefully back at full focus tomorrow for meetings / continued convos. | 21:20 |
| morganfainberg | :) | 21:20 |
| ayoung | I just meant that I was switching gears myself to something you and I will spar about at a future date...Thursday maybe? | 21:20 |
| morganfainberg | yeah - thursday is better. | 21:20 |
| *** alexiz has joined #openstack-keystone | 21:20 | |
| morganfainberg | :) | 21:21 |
| ayoung | this one shouldn't be too bad, as it will likely be primarily a code clean up | 21:21 |
| morganfainberg | raildo, rodrigods, https://review.openstack.org/#/c/138182/ i *think* this is going to be easy. | 21:21 |
| ayoung | looks like I need to do some work around the other extensions that do things under /auth before I can get tests to pass, though | 21:21 |
| morganfainberg | which case we can possibly get the HM branch merged in today. | 21:21 |
| *** mzbik has joined #openstack-keystone | 21:21 | |
| ayoung | morganfainberg likes to tempt fate | 21:22 |
| morganfainberg | ayoung, damn straight. | 21:22 |
| morganfainberg | at the very least there were *no* conflicts. | 21:22 |
| * morganfainberg might be able to do the merge the otherway actually... | 21:22 | |
| *** gordc_ has joined #openstack-keystone | 21:24 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Merge remote-tracking branch 'remotes/origin/feature/hierarchical-multitenancy' into HEAD https://review.openstack.org/138186 | 21:24 |
| mzbik | ayoung, can you try to not lie this time ;) and tell me if LDAP queries are or are not filtered? I mean if I want v3/users?name=myUserName LDAP will query all and then filter or it will be filtered on LDAP query lvl? | 21:26 |
| *** amcrn_ has joined #openstack-keystone | 21:26 | |
| *** tellesnobrega_ has joined #openstack-keystone | 21:27 | |
| *** svasheka_ has joined #openstack-keystone | 21:27 | |
| *** wpf1 has joined #openstack-keystone | 21:27 | |
| *** bknudson1 has joined #openstack-keystone | 21:29 | |
| morganfainberg | raildo, rodrigods, ^ working with -infra to verify, but that might be the change needed. | 21:29 |
| ayoung | mzbik, how would you know if I were to lie or not? | 21:29 |
| morganfainberg | rodrigods, rodrigods, once it passes check we'll push it through and then remove the feature branch. | 21:29 |
| morganfainberg | raildo, ^ | 21:29 |
| ayoung | mzbik, but look at the code I linked to earlier | 21:29 |
| ayoung | it looks pretty clear to me that the filtering happens afterwards, like you feared | 21:30 |
| bknudson1 | topic branches don't seem to work all that great | 21:30 |
| mzbik | damn it :/ | 21:30 |
| morganfainberg | bknudson1, they are .. bizzare | 21:30 |
| mzbik | too bad | 21:30 |
| morganfainberg | bknudson1, well topic branches in gerrit | 21:30 |
| morganfainberg | mzbik, there is / was some effort to push that filtering down the ldap driver - it isn't complete though | 21:31 |
| mzbik | I think it might be very usefull when querying huge LDAP databases without privilgles to paging (like I have) | 21:33 |
| ayoung | mzbik, you can do filtering, you need to do it in the config file | 21:34 |
| morganfainberg | mzbik, ayoung is correct you can add some extra filtering in config | 21:34 |
| ayoung | like for groups you can specify a filter etc | 21:34 |
| mzbik | I know | 21:34 |
| rodrigods | morganfainberg, great! thanks | 21:35 |
| *** amcrn has quit IRC | 21:35 | |
| *** wpf has quit IRC | 21:35 | |
| *** bknudson has quit IRC | 21:35 | |
| *** gordc has quit IRC | 21:35 | |
| *** shakayumi has quit IRC | 21:35 | |
| *** svasheka has quit IRC | 21:35 | |
| *** russellb has quit IRC | 21:35 | |
| *** tellesnobrega has quit IRC | 21:35 | |
| mzbik | perhaps my use case is shitty | 21:35 |
| morganfainberg | rodrigods, this means you could rebase your changes directly on henrynash's once his rebase on master | 21:36 |
| morganfainberg | rodrigods, get the same "nice landing place" so to speak. | 21:36 |
| morganfainberg | or... race him to the rebase ;) | 21:36 |
| rodrigods | morganfainberg, heh cool | 21:36 |
| ayoung | mzbik, if you keep using those technical terms none of us will be able to follow the conversation | 21:36 |
| mzbik | uh ok... | 21:37 |
| mzbik | sorry :( | 21:37 |
| ayoung | morganfainberg, or we could collapse all of the changes in the feature branch into a single patch and force it onto the stack at the front | 21:37 |
| *** lhcheng has quit IRC | 21:38 | |
| morganfainberg | ayoung, the merge commit does that | 21:38 |
| morganfainberg | ayoung, except without breaking the history | 21:38 |
| morganfainberg | ayoung, i meant the *next* patches | 21:38 |
| *** lhcheng has joined #openstack-keystone | 21:38 | |
| morganfainberg | that haven't been approved on the topic branch yet | 21:38 |
| ayoung | why'd you -1 workflow the merge commit? | 21:38 |
| morganfainberg | ayoung. wanted infra to look it over 1st | 21:38 |
| morganfainberg | going to un -1 it. | 21:38 |
| morganfainberg | -infra says "looks good as long as jenkins doesn't complain" | 21:39 |
| mzbik | thanks for help | 21:39 |
| * morganfainberg is *very* leery of merge commits. | 21:39 | |
| morganfainberg | they can break things in awful terrible no-good ways | 21:40 |
| ayoung | morganfainberg, yeah...it really should be an explicit rebase and single patch | 21:40 |
| *** mzbik has quit IRC | 21:40 | |
| morganfainberg | ayoung, except losing the history | 21:40 |
| morganfainberg | ayoung, we *don't* want to lose the HM history. | 21:40 |
| ayoung | morganfainberg, meh | 21:40 |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/136946 | 21:40 |
| morganfainberg | ayoung, ok i don't want to. | 21:40 |
| ayoung | I should have pushed for hierarchical back when gyee was pushing for domains. The rest is commentary | 21:41 |
| morganfainberg | ayoung, sure. but that ship sailed. | 21:41 |
| ayoung | actually, it floated out of the harbor, got stuck on a sandbar, and has been sitting there for us all to look at, but its the same | 21:41 |
| morganfainberg | ayoung, and yes it would have been a lot easier back then ;) | 21:41 |
| *** packet has quit IRC | 21:41 | |
| ayoung | and by that I mean that we still have people avoiding using domains due to auth tokenb middlewars support | 21:42 |
| * ayoung goes to look at client reviews | 21:42 | |
| *** henrynash has joined #openstack-keystone | 21:49 | |
| *** ChanServ sets mode: +v henrynash | 21:49 | |
| *** packet has joined #openstack-keystone | 21:50 | |
| *** samuelms has joined #openstack-keystone | 21:55 | |
| *** kobtea has joined #openstack-keystone | 21:56 | |
| *** kobtea has quit IRC | 22:01 | |
| *** packet has quit IRC | 22:02 | |
| *** aix has joined #openstack-keystone | 22:08 | |
| samuelms | henrynash, ping .. do you agree that the operations the assignment (mapper) backend has to provide are like: list_<actor>_capabilities_on_<target> ? | 22:11 |
| samuelms | henrynash, that's needed when issuing a token .. | 22:12 |
| samuelms | henrynash, or list_<actor>_global_roles_on_<target> .. as they're represented today | 22:15 |
| henrynash | samuelms: so you’re asking just about naming? If so, I’d probably go with the roles one…since that’s what we really support today….and whether a role is really a capability is up to how the policy file is written | 22:23 |
| samuelms | henrynash, ok .. so let's take list_<actor>_global_roles_on_<target> .. that's what the assignment controller should provide .. | 22:24 |
| samuelms | henrynash, independently on how we evaluate that (using roles, attributes, etc) .. | 22:25 |
| samuelms | henrynash, right? | 22:25 |
| henrynash | samuels: yes…which is pretty much whatwe have today, e.g. get_roles_for_user_and_project() | 22:26 |
| samuelms | henrynash, so my point on your review was to create an interface (a contract) to be implemented by the managers .. | 22:26 |
| henrynash | so the manager would stay, but the driver would do someting totally different than it does today | 22:26 |
| samuelms | henrynash, so our manager impl is according that interface .. and if you'd like to plug another manager ... just make it accordingly that interface | 22:26 |
| henrynash | …to satisfy those reuestes | 22:27 |
| *** henrynash has quit IRC | 22:29 | |
| *** henrynash has joined #openstack-keystone | 22:30 | |
| *** ChanServ sets mode: +v henrynash | 22:30 | |
| henrynash | …then that controller would have its own manager…but that would call the same driver as used by the assignement manager…. | 22:30 |
| henrynash | so a new assignment engine would supply: | 22:30 |
| henrynash | 1) a new controller (in addition to the assignment one) that supported whatever new APIs it wanted | 22:30 |
| henrynash | 2) A new manager that supported that conrtoller | 22:30 |
| henrynash | 3) a new driver that replaced the existing assignment driver, but also supported the api calls of the new manager | 22:31 |
| henrynash | and the roles manager/driver would not be touched | 22:31 |
| henrynash | that roles stay defined in whataver backend you had before swapping in a new assignment engine | 22:32 |
| *** jamielennox|away is now known as jamielennox | 22:32 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/136946 | 22:33 |
| samuelms | henrynash, this is what I think http://paste.openstack.org/show/142963/ | 22:33 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 22:33 |
| samuelms | henrynash, so your point 1 is the controller for the 'connectors' (such as roles) | 22:37 |
| samuelms | henrynash, and 2 the manager for that controller, obviously | 22:37 |
| *** topol has quit IRC | 22:39 | |
| henrynash | samulems: so not sure I understand your example | 22:44 |
| henrynash | samuelms: what is the use case you are tyring to show? | 22:45 |
| samuelms | henrynash, did you take a look at the paste? http://paste.openstack.org/show/142963/ | 22:45 |
| samuelms | henrynash, I'm trying to figure out how a complete plug of a new assignment mapper would be .. | 22:45 |
| *** joesavak has quit IRC | 22:45 | |
| henrynash | samuelms: yes, and that didn’t help make me feel any better :-) | 22:45 |
| samuelms | henrynash, haha | 22:46 |
| samuelms | henrynash, I'll try to plug my own dummy assignment mapper .. | 22:46 |
| samuelms | henrynash, to show the things we're doing makes easier to plug a custom assignment backend | 22:47 |
| henrynash | samuelms: so part of the spec was that I would provide an example :-) | 22:47 |
| samuelms | henrynash, and we don't have one, right? :p | 22:48 |
| *** palendae has quit IRC | 22:48 | |
| henrynash | samuelms: although I’m not sure where to put, now that we don;t have extensions…. | 22:48 |
| henrynash | samulems: haven’t written it yet | 22:48 |
| henrynash | samuelms: but I think it is not as complicated as you thinking…. | 22:49 |
| *** nellysmitt has joined #openstack-keystone | 22:49 | |
| samuelms | henrynash, I hope so :p | 22:50 |
| samuelms | henrynash, what I was thinking is that we maintain assignment.mapper.controller and replace assignment.mapper.manager/driver | 22:50 |
| henrynash | samuelms: for your new assignment mapper, you will write a controller, manager and driver | 22:51 |
| samuelms | henrynash, as well as the entire assignment.connector part | 22:51 |
| henrynash | samuelms: so I’m not quite on board with your terminology | 22:51 |
| henrynash | don’t let’s use new names for things, let’s use the existing names | 22:52 |
| henrynash | in my patch we have: | 22:52 |
| henrynash | assignment.controller | 22:52 |
| henrynash | sorry..need to drop off…be back in a bit | 22:52 |
| samuelms | henrynash, ok | 22:52 |
| openstackgerrit | Merged openstack/keystone: Use true() rather than variable/singleton https://review.openstack.org/132368 | 22:52 |
| *** gordc_ has quit IRC | 22:53 | |
| *** nellysmitt has quit IRC | 22:54 | |
| *** radez is now known as radez_afk | 22:56 | |
| jamielennox | here are a list of things in keystoneclient that already have one +2 | 22:56 |
| jamielennox | https://review.openstack.org/#/q/project:openstack/python-keystoneclient+is:open+label:Code-Review%253E%253D%252B2+-CodeReview-1+-CodeReview-2+Verified%253D1,n,z | 22:56 |
| jamielennox | and middleware: https://review.openstack.org/#/q/project:openstack/keystonemiddleware+is:open+label:Code-Review%253E%253D%252B2+-CodeReview-1+-CodeReview-2+Verified%253D1,n,z | 22:56 |
| jamielennox | can someone please clean a few of these up | 22:56 |
| *** palendae has joined #openstack-keystone | 22:57 | |
| ayoung | jamielennox, I'll take a look after kids are in bed | 22:59 |
| *** andreaf has quit IRC | 22:59 | |
| jamielennox | ayoung: slightly screwed up the url - the syntax seems to have changed | 23:00 |
| *** andreaf has joined #openstack-keystone | 23:00 | |
| jamielennox | https://review.openstack.org/#/q/project:openstack/python-keystoneclient+is:open+label:Code-Review%253E%253D%252B2+-label:Code-Review-1+Verified%253D1,n,z | 23:02 |
| jamielennox | https://review.openstack.org/#/q/project:openstack/keystonemiddleware+is:open+label:Code-Review%253E%253D%252B2+-label:Code-Review%253D-1+Verified%253D1,n,z | 23:02 |
| *** _cjones_ has quit IRC | 23:10 | |
| *** _cjones_ has joined #openstack-keystone | 23:12 | |
| *** arif-ali has quit IRC | 23:12 | |
| *** jaosorior has quit IRC | 23:13 | |
| *** arif-ali has joined #openstack-keystone | 23:19 | |
| *** tellesnobrega__ has joined #openstack-keystone | 23:20 | |
| *** jasondotstar has quit IRC | 23:21 | |
| morganfainberg | jamielennox, went through most of those and hit the really quick ones through into gate | 23:24 |
| morganfainberg | jamielennox, you might need to babysit them now. | 23:24 |
| jamielennox | morganfainberg: thanks, there weren't as many as it felt like when i was looking yesterday | 23:24 |
| morganfainberg | jamielennox, if there was a -1 i skipped because i need to get back to some internal $place_that_signs_my_paycheck$ things. | 23:25 |
| bknudson1 | morganfainberg is like a laxative unblocking reviews! | 23:25 |
| morganfainberg | bknudson1, lol ;) | 23:25 |
| morganfainberg | bknudson1, i had a question on one of your docstring fixes, looks like you missed a :py:class: | 23:25 |
| bknudson1 | morganfainberg: I'll take a look at it... need to generate the docs and see what it looks like | 23:26 |
| morganfainberg | bknudson1, ++ | 23:26 |
| *** arif-ali has quit IRC | 23:26 | |
| morganfainberg | bknudson1, you did it for the next 2 :type: bits, just not that one, so it stood out as "hmm, maybe this is wrong" | 23:26 |
| morganfainberg | bknudson1, jamielennox, henrynash, ayoung, dstanek, lbragstad, https://review.openstack.org/#/c/138186/ | 23:27 |
| morganfainberg | i could use a couple +2 and a +A on that | 23:27 |
| morganfainberg | we can close down the topic branch then. | 23:27 |
| morganfainberg | gyee, dolphm, ^ cc | 23:27 |
| bknudson1 | morganfainberg: it might be a difference between how :type: and :rtype: are handled. | 23:27 |
| dstanek | morganfainberg: that's just a merge? | 23:28 |
| morganfainberg | bknudson1, if it's a non-issue i'll reverse my -1 and push it through. | 23:28 |
| samuelms | morganfainberg, ++ | 23:28 |
| morganfainberg | dstanek, yep. it's the collapse of HMT code to master, so we can kill the topic branch | 23:28 |
| morganfainberg | dstanek, was a clean merge too. | 23:28 |
| morganfainberg | dstanek, the outstanding reviews on the topic branch will be moved to master. | 23:29 |
| dolphm | morganfainberg: gerrit doesn't show you a final diff? | 23:29 |
| rodrigods | morganfainberg, is this finally happening? \o/ | 23:29 |
| morganfainberg | dstanek, not on a merge commit. | 23:29 |
| bknudson1 | not sure how to review it? | 23:29 |
| morganfainberg | dolphm, ^ | 23:29 |
| dstanek | i assume it's just a FF since there is no diff... | 23:29 |
| bknudson1 | check the spelling in the commit message? | 23:29 |
| morganfainberg | dstanek, it was a merge, but it was a clean merge. | 23:29 |
| morganfainberg | bknudson1, hehe pretty much. | 23:30 |
| morganfainberg | bknudson1, you can try the same thing i did: take the parent and git merge remotes/origin/feature/hierarchical-multitenancy | 23:30 |
| morganfainberg | bknudson1, see if you come up with the same result | 23:30 |
| bknudson1 | could check it out and do a diff? | 23:30 |
| dolphm | bknudson1: git diff master..feature/hierarchical-multitenancy | 23:31 |
| morganfainberg | bknudson1, i think i want to avoid topic branches if at all possible in the future. | 23:31 |
| morganfainberg | bknudson1, though in this case i think it worked out fairly well. | 23:31 |
| *** zzzeek has quit IRC | 23:32 | |
| *** yasu_ has joined #openstack-keystone | 23:32 | |
| morganfainberg | bknudson1, here was the merge: http://paste.openstack.org/show/142991/ | 23:32 |
| dstanek | morganfainberg: is ayoung's related to what you were discussing earlier? | 23:33 |
| morganfainberg | dstanek, hm? | 23:33 |
| dstanek | morganfainberg: about functional testing | 23:33 |
| morganfainberg | dstanek, oh uh... the ML topic | 23:34 |
| morganfainberg | haven't read it yet | 23:34 |
| *** arif-ali has joined #openstack-keystone | 23:34 | |
| morganfainberg | dstanek, yeah i told him i'd chat on thursday about it | 23:34 |
| morganfainberg | ML works as well. | 23:34 |
| morganfainberg | it's related to auth split out stuff. | 23:35 |
| *** zzzeek has joined #openstack-keystone | 23:35 | |
| bknudson1 | oh, it's got a migration... scary | 23:36 |
| bknudson1 | at least it's the only new one. | 23:36 |
| bknudson1 | morganfainberg: the reviews couldn't be moved from topic branch to master? | 23:41 |
| *** jimhoagland has joined #openstack-keystone | 23:41 | |
| morganfainberg | bknudson1, not the merged ones. | 23:42 |
| morganfainberg | bknudson1, and the old reviews will need to be reproposed, since gerrit tracks per-branch iirc | 23:42 |
| morganfainberg | bknudson1, =/ it's crummy. | 23:42 |
| morganfainberg | hence why i think we should avoid topic branches unless we really need them. | 23:43 |
| *** palendae has quit IRC | 23:44 | |
| morganfainberg | jamielennox, bknudson1, when should we release the nest KSC and Middleware? | 23:44 |
| morganfainberg | jamielennox, bknudson1, any thoughts? | 23:44 |
| morganfainberg | i'm leaning towards next week if nothing major is still outstanding. | 23:45 |
| jamielennox | morganfainberg: i want the any auth plugin thing in first | 23:45 |
| jamielennox | for middleware | 23:45 |
| morganfainberg | jamielennox, ++ ok | 23:45 |
| jamielennox | that's a good time to release that | 23:45 |
| morganfainberg | jamielennox, lets try and target end of next week or early the following. | 23:45 |
| * morganfainberg plans a release on friday... at 10pm... pacific... -- oh wait no *not* releaseing at 10pm pacific on friday. | 23:46 | |
| morganfainberg | jamielennox, i should be back in LA/available on thursday so i'll check in w/ you then. [barring we get everything done this week[ | 23:46 |
| morganfainberg | jamielennox, next week that is. | 23:47 |
| openstackgerrit | Merged openstack/keystonemiddleware: Adding audit middleware to keystonemiddleware https://review.openstack.org/102958 | 23:47 |
| jamielennox | ok, there's one of two things i want to propose to ksc still as well | 23:47 |
| morganfainberg | jamielennox, i'll plan to do the releases at the same general time. | 23:47 |
| *** bknudson1 has quit IRC | 23:48 | |
| *** palendae has joined #openstack-keystone | 23:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Curl statements to include globoff for IPv6 URLs https://review.openstack.org/136327 | 23:55 |
| openstackgerrit | Merged openstack/keystonemiddleware: Auth token supports deprecated names for paste conf options https://review.openstack.org/128656 | 23:58 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix paste config option conversion for auth options https://review.openstack.org/131914 | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!