| *** jimhoagland has quit IRC | 00:07 | |
| *** david-lyle is now known as david-lyle_afk | 00:08 | |
| openstackgerrit | Merged openstack/keystone: Ignore H302 - bug 1398472 https://review.openstack.org/138491 | 00:19 |
|---|---|---|
| uvirtbot | Launchpad bug 1398472 in hacking "H302 isn't handling oslo_concurrency namespace change" [Undecided,Fix released] https://launchpad.net/bugs/1398472 | 00:19 |
| *** stevemar has quit IRC | 00:28 | |
| *** dims_ has joined #openstack-keystone | 00:31 | |
| *** dims has quit IRC | 00:34 | |
| *** htruta has quit IRC | 00:37 | |
| *** gabriel-bezerra has quit IRC | 00:37 | |
| *** raildo has quit IRC | 00:37 | |
| *** tellesnobrega has quit IRC | 00:37 | |
| *** samuelms-away has quit IRC | 00:37 | |
| *** raildo has joined #openstack-keystone | 00:44 | |
| *** tellesnobrega has joined #openstack-keystone | 00:44 | |
| *** samuelms has joined #openstack-keystone | 00:44 | |
| *** tellesnobrega_ has quit IRC | 00:46 | |
| *** gugl has joined #openstack-keystone | 00:46 | |
| *** raildo_ has quit IRC | 00:47 | |
| gugl | Hi keystone guru, using devstack, I started from scrach ..tried to run ./stack.sh, but I constantly run into issues with keystone today, please see the errors http://paste.openstack.org/show/143876/ any idea? | 00:49 |
| *** gabriel-bezerra has joined #openstack-keystone | 00:50 | |
| gugl | I have blowed away /opt/stack before I stack.sh | 00:50 |
| gugl | before I run stack.sh...I also did "sudo pip uninstall six" | 00:51 |
| *** htruta has joined #openstack-keystone | 00:53 | |
| *** jorge_munoz has joined #openstack-keystone | 00:54 | |
| gugl | after it failed..I checked six.py which got installed during stacking.... | 00:55 |
| gugl | well even I have six installed...it still has the issue | 00:56 |
| dstanek | gugl: do you have a module six.py in your current directory? | 00:57 |
| gugl | dstanek, current directory in /opt/stack? | 00:57 |
| dstanek | gugl: or anywhere in your Python path... | 00:58 |
| gugl | dstanek, let me check | 00:58 |
| dstanek | gugl: wherever you have devstack checked out | 00:58 |
| gugl | dstanek, ic...let me check | 00:58 |
| *** afaranha has joined #openstack-keystone | 00:59 | |
| gugl | it is not in devstack | 00:59 |
| dstanek | i'm betting there is one somewhere....run python and import six | 01:00 |
| dstanek | then see if that has wraps | 01:00 |
| gugl | dstanek, k | 01:01 |
| gugl | dstanek, it is there | 01:03 |
| gugl | just doesn't like six.wrap | 01:03 |
| *** jorge_munoz has quit IRC | 01:03 | |
| dstanek | gugl: it wouldn't because that shouldn't exist | 01:04 |
| gugl | dstanek, ? | 01:04 |
| gugl | dstanek, six should not be there? | 01:04 |
| dstanek | gugl: the only thing i can think of is to brute force debug by adding 'print(six.__file__)' at the top of versionutils after six is imported | 01:05 |
| dstanek | gugl: no six.wrap won't exist because it's six.wraps | 01:05 |
| gugl | ic | 01:05 |
| gugl | dstanek, it doesn't like wraps either... | 01:06 |
| dstanek | gugl: when you ran python? or when you started the stack? | 01:06 |
| gugl | both | 01:07 |
| gugl | I was trying to restacking and run into | 01:07 |
| gugl | issue | 01:07 |
| dstanek | gugl: good. in the interactive interpreter run 'print six.__file__' | 01:07 |
| gugl | dstanek, k | 01:07 |
| dstanek | what does it print out? | 01:08 |
| gugl | dstanek, did see my path | 01:09 |
| gugl | " /usr/lib/python2.7/dist-packages/six.pyc" | 01:09 |
| dstanek | gugl: maybe your six is our of date | 01:11 |
| dstanek | sudo pip install -U six | 01:11 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use real discovery object in auth_token middleware. https://review.openstack.org/130532 | 01:11 |
| gugl | dstanek, let me try | 01:11 |
| *** jorge_munoz has joined #openstack-keystone | 01:12 | |
| gugl | pip installed in six in /usr/local/lib/python2.7/dist-packages | 01:12 |
| gugl | dstanek, will that be a problem? | 01:13 |
| dstanek | gugl: not if it gets imported first :-) | 01:13 |
| dstanek | dist-packages must be installed by the package manager | 01:13 |
| dstanek | that needs to be removed or updated ... i think | 01:13 |
| gugl | dstanek, ok, will do some clean up and try again. thanks very much for the help! | 01:14 |
| *** jorge_munoz has quit IRC | 01:14 | |
| dstanek | gugl: hopefully it helps | 01:14 |
| gugl | dstanek, thanks again, you have a nice evening! | 01:15 |
| dstanek | gugl: you too | 01:17 |
| *** marg7175 has quit IRC | 01:18 | |
| lbragstad | morganfainberg: sounds good, I'm rechecking stuff on that patch anyway :/ | 01:19 |
| *** jorge_munoz has joined #openstack-keystone | 01:23 | |
| *** samuelms_ has joined #openstack-keystone | 01:27 | |
| *** nellysmitt has joined #openstack-keystone | 01:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 01:33 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 01:33 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use real discovery object in auth_token middleware. https://review.openstack.org/130532 | 01:33 |
| *** nellysmitt has quit IRC | 01:36 | |
| *** _cjones_ has quit IRC | 01:36 | |
| *** lhcheng_ has joined #openstack-keystone | 01:40 | |
| *** stevemar has joined #openstack-keystone | 01:42 | |
| *** ChanServ sets mode: +v stevemar | 01:42 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 01:42 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Split identity server into v2 and v3 https://review.openstack.org/130534 | 01:42 |
| *** lhcheng has quit IRC | 01:43 | |
| openstackgerrit | Nathan Kinder proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 01:43 |
| stevemar | nkinder, thanks for the cleanup! | 01:51 |
| stevemar | nkinder, hope you are feelin better | 01:52 |
| nkinder | stevemar: sure. I hate adding nitpicks to a review when it's just easy to go in and fix them yourself. | 01:52 |
| nkinder | stevemar: and thanks! Feeling much better now, but just trying to catch up on everything after the long weekend | 01:52 |
| stevemar | nkinder, yeah, especially when i'm happy with the actual content | 01:52 |
| stevemar | welcome to the fray :) | 01:53 |
| *** yasu_ has joined #openstack-keystone | 01:53 | |
| *** samuelms_ has quit IRC | 01:56 | |
| *** jorge_munoz has quit IRC | 02:01 | |
| *** zzzeek has quit IRC | 02:02 | |
| *** r-daneel has quit IRC | 02:03 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:04 | |
| *** DaveChen has quit IRC | 02:08 | |
| *** marg7175 has joined #openstack-keystone | 02:10 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Expose version matching functions to the public https://review.openstack.org/129935 | 02:13 |
| *** ayoung has joined #openstack-keystone | 02:17 | |
| *** ChanServ sets mode: +v ayoung | 02:17 | |
| *** afaranha has quit IRC | 02:23 | |
| *** erkules_ has joined #openstack-keystone | 02:23 | |
| *** marcoemorais has quit IRC | 02:24 | |
| *** erkules has quit IRC | 02:25 | |
| *** afaranha has joined #openstack-keystone | 02:30 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading other auth methods in auth_token https://review.openstack.org/129552 | 02:31 |
| *** Shohei has quit IRC | 02:35 | |
| *** dims_ has quit IRC | 02:36 | |
| *** Shohei has joined #openstack-keystone | 02:38 | |
| *** erkules_ has quit IRC | 02:49 | |
| *** gabriel-bezerra has quit IRC | 02:49 | |
| *** erkules_ has joined #openstack-keystone | 02:50 | |
| *** gabriel-bezerra has joined #openstack-keystone | 02:51 | |
| *** marg7175 has quit IRC | 02:54 | |
| *** marg7175_ has joined #openstack-keystone | 02:58 | |
| *** marg7175_ has quit IRC | 03:04 | |
| *** Shohei has quit IRC | 03:04 | |
| *** Shohei has joined #openstack-keystone | 03:05 | |
| *** kobtea has joined #openstack-keystone | 03:06 | |
| *** Shohei has quit IRC | 03:10 | |
| *** kobtea has quit IRC | 03:10 | |
| *** jdennis has quit IRC | 03:11 | |
| *** Shohei has joined #openstack-keystone | 03:21 | |
| *** jdennis has joined #openstack-keystone | 03:29 | |
| *** afaranha has quit IRC | 03:31 | |
| *** david-ly_ has joined #openstack-keystone | 03:32 | |
| *** nellysmitt has joined #openstack-keystone | 03:32 | |
| *** david-lyle_afk has quit IRC | 03:33 | |
| *** dims has joined #openstack-keystone | 03:36 | |
| *** nellysmitt has quit IRC | 03:37 | |
| *** dims has quit IRC | 03:42 | |
| *** jamielennox is now known as jamielennox|away | 03:44 | |
| *** harlowja_ is now known as harlowja_away | 03:47 | |
| *** jdennis has quit IRC | 04:04 | |
| *** richm has quit IRC | 04:04 | |
| *** jamielennox|away is now known as jamielennox | 04:20 | |
| *** thedodd has joined #openstack-keystone | 04:26 | |
| *** Shohei has quit IRC | 04:32 | |
| *** Shohei has joined #openstack-keystone | 04:33 | |
| *** Shohei has joined #openstack-keystone | 04:33 | |
| *** lhcheng_ has quit IRC | 04:46 | |
| *** david-ly_ has quit IRC | 04:48 | |
| *** david-lyle_afk has joined #openstack-keystone | 04:49 | |
| *** chrisshattuck has joined #openstack-keystone | 04:58 | |
| *** chrisshattuck has quit IRC | 04:58 | |
| *** davechen has joined #openstack-keystone | 05:01 | |
| *** lhcheng has joined #openstack-keystone | 05:02 | |
| *** alexiz has quit IRC | 05:15 | |
| *** jimbaker has quit IRC | 05:22 | |
| *** tellesnobrega_ has quit IRC | 05:28 | |
| *** ajayaa has joined #openstack-keystone | 05:31 | |
| *** nellysmitt has joined #openstack-keystone | 05:33 | |
| *** stevemar has quit IRC | 05:36 | |
| *** thedodd has quit IRC | 05:38 | |
| *** nellysmitt has quit IRC | 05:38 | |
| *** ncoghlan has joined #openstack-keystone | 05:42 | |
| *** chrisshattuck has joined #openstack-keystone | 05:45 | |
| *** chrisshattuck has quit IRC | 05:49 | |
| *** Shohei has quit IRC | 05:58 | |
| *** Shohei has joined #openstack-keystone | 05:59 | |
| *** Shohei_ has joined #openstack-keystone | 06:01 | |
| *** Shohei has quit IRC | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:02 |
| *** yasu_ has quit IRC | 06:05 | |
| *** k4n0 has joined #openstack-keystone | 06:20 | |
| *** saipandi has quit IRC | 06:22 | |
| *** henrynash has joined #openstack-keystone | 06:28 | |
| *** ChanServ sets mode: +v henrynash | 06:28 | |
| *** saipandi has joined #openstack-keystone | 06:35 | |
| *** gyee_ has quit IRC | 06:36 | |
| *** ncoghlan has quit IRC | 06:41 | |
| *** ncoghlan has joined #openstack-keystone | 06:41 | |
| *** ajayaa has quit IRC | 06:48 | |
| *** saipandi has quit IRC | 06:57 | |
| *** david-ly_ has joined #openstack-keystone | 07:15 | |
| *** david-lyle_afk has quit IRC | 07:16 | |
| *** svasheka has quit IRC | 07:16 | |
| *** svasheka has joined #openstack-keystone | 07:16 | |
| *** lhcheng has quit IRC | 07:17 | |
| *** ajayaa has joined #openstack-keystone | 07:19 | |
| *** nellysmitt has joined #openstack-keystone | 07:34 | |
| *** nellysmitt has quit IRC | 07:39 | |
| *** afazekas has joined #openstack-keystone | 07:39 | |
| *** ajayaa has quit IRC | 07:42 | |
| *** openstackgerrit has quit IRC | 07:50 | |
| *** openstackgerrit has joined #openstack-keystone | 07:50 | |
| *** ajayaa has joined #openstack-keystone | 08:01 | |
| openstackgerrit | Merged openstack/keystone: drop developer support for OS X https://review.openstack.org/138496 | 08:14 |
| openstackgerrit | Christian Berendt proposed openstack/keystone: Log the user id when using an invalid username or password https://review.openstack.org/128860 | 08:37 |
| *** marekd|away is now known as marekd | 08:40 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Mapping enhancements - direct groups mapping. https://review.openstack.org/138035 | 08:41 |
| marekd | henrynash: last polishes for https://review.openstack.org/#/c/138035/ . Should make you happy :-) | 08:48 |
| henrynash | marekd: ok! | 08:48 |
| henrynash | will take a look in a while | 08:48 |
| marekd | henrynash: whenever you can. | 08:48 |
| *** henrynash has quit IRC | 08:55 | |
| *** erkules_ is now known as erkules | 09:00 | |
| *** dims has joined #openstack-keystone | 09:03 | |
| *** dims has quit IRC | 09:08 | |
| *** ncoghlan has quit IRC | 09:13 | |
| *** nellysmitt has joined #openstack-keystone | 09:23 | |
| *** henrynash has joined #openstack-keystone | 09:34 | |
| *** ChanServ sets mode: +v henrynash | 09:34 | |
| rodrigods | is the gate already fixed? I mean, ready to recheck reviews (still seeing lots of -1 from jenkins) | 09:52 |
| *** samuelms_ has joined #openstack-keystone | 09:53 | |
| marekd | rodrigods: so, what time is in Brasil now? | 10:00 |
| rodrigods | marekd, 7 AM heh | 10:00 |
| marekd | hm, only 4hours of difference. | 10:00 |
| marekd | i though it was more. | 10:00 |
| rodrigods | marekd, my region is not at summer time, for those that are is 8 AM | 10:01 |
| rodrigods | marekd, yep, usually the difference is 4/5 hours | 10:01 |
| samuelms_ | hey, morning :) | 10:17 |
| *** tellesnobrega_ has joined #openstack-keystone | 10:18 | |
| marekd | samuelms_: hey | 10:24 |
| samuelms_ | marekd, :) | 10:29 |
| *** jistr has joined #openstack-keystone | 10:37 | |
| *** jistr is now known as jistr|trng | 10:38 | |
| *** bdossant has joined #openstack-keystone | 10:44 | |
| *** samuelms_ has quit IRC | 10:53 | |
| *** tellesnobrega_ has quit IRC | 11:02 | |
| *** diegows has joined #openstack-keystone | 11:14 | |
| *** bdossant has quit IRC | 11:16 | |
| svasheka | hi guys | 11:16 |
| svasheka | how can I get token, using python bindings? | 11:16 |
| svasheka | I mean get token id | 11:16 |
| *** andreaf has joined #openstack-keystone | 11:22 | |
| *** aix has joined #openstack-keystone | 11:22 | |
| *** k4n0 has quit IRC | 11:23 | |
| *** dims has joined #openstack-keystone | 11:30 | |
| *** samuelms_ has joined #openstack-keystone | 11:37 | |
| rodrigods | svasheka, think this can help http://www.jamielennox.net/blog/2014/02/24/client-session-objects/ | 11:40 |
| *** jdennis has joined #openstack-keystone | 11:45 | |
| *** ajayaa has quit IRC | 11:50 | |
| *** samuelms_ has quit IRC | 12:03 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Trust redelegation documentation https://review.openstack.org/131541 | 12:13 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 12:15 |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Trusted Attributes Policy for External Identity Providers https://review.openstack.org/138693 | 12:16 |
| *** bdossant has joined #openstack-keystone | 12:17 | |
| *** bdossant has quit IRC | 12:21 | |
| *** samuelms_ has joined #openstack-keystone | 12:24 | |
| *** jistr|trng has quit IRC | 12:28 | |
| *** jistr has joined #openstack-keystone | 12:34 | |
| *** jistr is now known as jistr|trng | 12:35 | |
| *** raildo has quit IRC | 12:36 | |
| *** samuelms_ has quit IRC | 12:37 | |
| *** aix has quit IRC | 12:38 | |
| *** henrynash has quit IRC | 12:38 | |
| *** raildo has joined #openstack-keystone | 12:39 | |
| *** bdossant has joined #openstack-keystone | 12:41 | |
| *** htruta has quit IRC | 12:44 | |
| *** bdossant has quit IRC | 12:45 | |
| *** bdossant has joined #openstack-keystone | 12:45 | |
| *** afaranha has joined #openstack-keystone | 12:47 | |
| *** htruta has joined #openstack-keystone | 12:47 | |
| *** ajayaa has joined #openstack-keystone | 12:51 | |
| *** afaranha has quit IRC | 12:52 | |
| *** afaranha has joined #openstack-keystone | 12:53 | |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add primary key to the endpoint_group id column. https://review.openstack.org/137638 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Explicit MySQL engine designation. https://review.openstack.org/138712 | 12:59 |
| openstackgerrit | Ilya Pekelny proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 13:00 |
| *** radez_g0n3 is now known as radez | 13:16 | |
| *** nellysmitt has quit IRC | 13:17 | |
| *** aix has joined #openstack-keystone | 13:19 | |
| *** bknudson1 has quit IRC | 13:21 | |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 13:30 |
| *** oomichi has quit IRC | 13:40 | |
| *** bknudson has joined #openstack-keystone | 13:40 | |
| *** ChanServ sets mode: +v bknudson | 13:40 | |
| *** nellysmitt has joined #openstack-keystone | 13:49 | |
| marekd | bknudson: dstanek: jamielennox: can I ask for a review https://review.openstack.org/#/c/130593/ ? | 13:56 |
| *** joesavak has joined #openstack-keystone | 13:56 | |
| *** richm has joined #openstack-keystone | 13:58 | |
| openstackgerrit | David Chadwick proposed openstack/keystone-specs: Self Management of Domain Scoped (DS) Roles =========================================== https://review.openstack.org/138728 | 14:01 |
| *** bdossant_ has joined #openstack-keystone | 14:02 | |
| *** bdossant has quit IRC | 14:03 | |
| *** henrynash has joined #openstack-keystone | 14:04 | |
| *** ChanServ sets mode: +v henrynash | 14:04 | |
| openstackgerrit | Sergey Skripnick proposed openstack/python-keystoneclient: Add ConnectionError exception https://review.openstack.org/138734 | 14:07 |
| openstackgerrit | Sergey Skripnick proposed openstack/python-keystoneclient: Raise proper exception in case of connection error https://review.openstack.org/137422 | 14:08 |
| *** sriram has joined #openstack-keystone | 14:10 | |
| openstackgerrit | Sergey Skripnick proposed openstack/python-keystoneclient: Raise proper exception in case of connection error https://review.openstack.org/137422 | 14:11 |
| samuelms | henrynash, hi :) when are you planning to rebase the assignment split stuff under hm patches ? | 14:12 |
| henrynash | samuelms: underway as we speak | 14:12 |
| henrynash | samuelms: it’s complicated | 14:12 |
| samuelms | henrynash, haha great | 14:12 |
| rodrigods | henrynash, working in your reviews right now as well :) | 14:13 |
| samuelms | henrynash, pls do not rebase my list role assingment patches | 14:13 |
| samuelms | henrynash, I'll reorganize the code and then I rebase after .. (still this week) | 14:13 |
| henrynash | samulems: I won’t! | 14:14 |
| samuelms | henrynash, so we won't need to fight :p | 14:16 |
| * samuelms is just kidding :) | 14:16 | |
| henrynash | samuelms: :-) | 14:16 |
| *** henrynash has quit IRC | 14:20 | |
| lbragstad | is anyone here real familiar with grenade? | 14:29 |
| bknudson | lbragstad: they're probably in -qa | 14:29 |
| lbragstad | bknudson: yeah, I left a message there for them | 14:30 |
| bknudson | lbragstad: my suggestion was to leave XMLBodyMiddleware in the code and have it not do anything other than log a warning to remove it | 14:30 |
| bknudson | grenade is doing what a customer would do so they'll run into this same problem. | 14:31 |
| lbragstad | yeah, that makes sense | 14:32 |
| lbragstad | I can get a patch up and see what people say about it | 14:32 |
| bknudson | we should be able to remove it entirely next release | 14:33 |
| lbragstad | bknudson: it's like an extremely long deprecation cycle | 14:33 |
| lbragstad | I guess | 14:33 |
| *** chrisshattuck has joined #openstack-keystone | 14:33 | |
| *** jimhoagland has joined #openstack-keystone | 14:39 | |
| *** diegows has quit IRC | 14:40 | |
| *** chrisshattuck has quit IRC | 14:40 | |
| *** jogo has left #openstack-keystone | 14:41 | |
| *** topol has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v topol | 14:42 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 14:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 14:45 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds correct checks in LDAP backend tests https://review.openstack.org/138551 | 14:45 |
| *** thedodd has joined #openstack-keystone | 14:46 | |
| *** bdossant_ has quit IRC | 14:47 | |
| *** bdossant has joined #openstack-keystone | 14:48 | |
| *** david-ly_ is now known as david-lyle | 15:00 | |
| *** bdossant has quit IRC | 15:00 | |
| *** ayoung has quit IRC | 15:00 | |
| *** henrynash has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v henrynash | 15:02 | |
| *** samuelms is now known as samuelms-away | 15:04 | |
| *** dims has quit IRC | 15:04 | |
| *** dims has joined #openstack-keystone | 15:04 | |
| *** uschreiber has joined #openstack-keystone | 15:05 | |
| *** bdossant has joined #openstack-keystone | 15:06 | |
| *** tellesnobrega_ has joined #openstack-keystone | 15:12 | |
| *** ajayaa has quit IRC | 15:14 | |
| *** thedodd has quit IRC | 15:18 | |
| *** jsavak has joined #openstack-keystone | 15:20 | |
| *** r-daneel has joined #openstack-keystone | 15:21 | |
| *** joesavak has quit IRC | 15:22 | |
| *** jimbaker has joined #openstack-keystone | 15:29 | |
| *** jimbaker has quit IRC | 15:29 | |
| *** jimbaker has joined #openstack-keystone | 15:29 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove XML support https://review.openstack.org/125738 | 15:35 |
| *** f13o has quit IRC | 15:36 | |
| *** uschreiber has quit IRC | 15:37 | |
| *** kobtea has joined #openstack-keystone | 15:42 | |
| *** jorge_munoz has joined #openstack-keystone | 15:42 | |
| *** jimhoagland has quit IRC | 15:45 | |
| *** kobtea has quit IRC | 15:47 | |
| *** henrynash has quit IRC | 15:50 | |
| *** gordc has joined #openstack-keystone | 15:53 | |
| *** stevemar has joined #openstack-keystone | 15:55 | |
| *** ChanServ sets mode: +v stevemar | 15:55 | |
| *** jorge_munoz has quit IRC | 16:05 | |
| *** jorge_munoz has joined #openstack-keystone | 16:08 | |
| *** jorge_munoz has quit IRC | 16:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Bump hacking to be at least 0.9.4 https://review.openstack.org/138497 | 16:19 |
| *** jorge_munoz has joined #openstack-keystone | 16:20 | |
| *** tellesnobrega_ has quit IRC | 16:28 | |
| *** andreaf has quit IRC | 16:29 | |
| *** jimbaker has quit IRC | 16:36 | |
| *** sriram has quit IRC | 16:36 | |
| *** amakarov_away is now known as amakarov | 16:38 | |
| *** sriram has joined #openstack-keystone | 16:40 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: improve error message when tenant ID does not exist https://review.openstack.org/131255 | 16:46 |
| *** henrynash has joined #openstack-keystone | 16:47 | |
| *** ChanServ sets mode: +v henrynash | 16:47 | |
| dolphm | a two line change for the sake of user experience, and 45 lines of new testing ^^ | 16:47 |
| Qlawy | How can I find method in code which is responsible for /v3/users?name=blabla | 16:49 |
| rodrigods | Qlawy, keystone/identity/controllers.py (get_user()) | 16:51 |
| bknudson | Qlawy: set a breakpoint and make the rest call. | 16:51 |
| dolphm | Qlawy: that's list_users() with a filter | 16:53 |
| Qlawy | tnx | 16:54 |
| *** _cjones_ has joined #openstack-keystone | 16:55 | |
| rodrigods | dolphm, list_user()* :) | 16:56 |
| Qlawy | rodrigods: no such function :P But list_users() exists ;) | 16:58 |
| Qlawy | However I am too poor programmer to do changes by myself :/ | 16:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: update sample conf using oslo-config-generator https://review.openstack.org/138508 | 16:59 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 16:59 |
| *** joesavak has joined #openstack-keystone | 16:59 | |
| rodrigods | Qlawy, what changes are you willing to make? | 16:59 |
| *** jsavak has quit IRC | 17:00 | |
| *** jsavak has joined #openstack-keystone | 17:01 | |
| Qlawy | rodrigods: I though maybe I will be able to find out how to fix issue I reported: https://bugs.launchpad.net/keystone/+bug/1398347 | 17:01 |
| uvirtbot | Launchpad bug 1398347 in keystone "LDAP backend should do filtered query instead of getting all data and then filtering" [Undecided,New] | 17:01 |
| *** lhcheng has joined #openstack-keystone | 17:01 | |
| rodrigods | Qlawy, hmm this filtering is done the common/ldap.py file | 17:02 |
| rodrigods | it's a general filtering method used by all ldap backends | 17:02 |
| Qlawy | rodrigods: yeah but (at least in juno) when I want to find my users ID using /v3/users?name=myUser keystone will query LDAP for all users and then filter | 17:03 |
| Qlawy | rodrigods: it does not work well with huge LDAP database :( | 17:03 |
| Qlawy | rodrigods: And I have nice: limit size exceeded, and yes... I cant use paging (lack of rights) | 17:04 |
| *** joesavak has quit IRC | 17:04 | |
| rodrigods | Qlawy, yes, what I mean was that the list_users() calls this filtering method from common/ldap.py | 17:04 |
| dolphm | Qlawy: the driver is being given "hints" that contain the desired filtering, but the current LDAP driver does nothing with them, so the manager layer has to step in and apply the filtering as a sort of backup plan | 17:05 |
| dolphm | Qlawy: so i'd start by looking at this: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L80-L81 | 17:06 |
| dolphm | Qlawy: you can see hints being passed in, but ignored. and the implementation just gets everything instead | 17:06 |
| Qlawy | thanks | 17:06 |
| *** afaranha_ has joined #openstack-keystone | 17:07 | |
| *** _cjones_ has quit IRC | 17:07 | |
| rodrigods | Qlawy, you better listen to dolphm (/me lied twice heh) | 17:08 |
| *** samuelms-away is now known as samuelms | 17:10 | |
| *** _cjones_ has joined #openstack-keystone | 17:11 | |
| *** jistr|trng has quit IRC | 17:11 | |
| *** gyee_ has joined #openstack-keystone | 17:12 | |
| *** marcoemorais has joined #openstack-keystone | 17:13 | |
| Qlawy | rodrigods: :P | 17:13 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: update sample conf using oslo-config-generator https://review.openstack.org/138508 | 17:15 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 17:15 |
| *** marcoemorais1 has joined #openstack-keystone | 17:15 | |
| *** marcoemorais1 has quit IRC | 17:16 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:17 | |
| *** marcoemorais has quit IRC | 17:17 | |
| Qlawy | comparing it to sql backend it needs a lot of love :( | 17:18 |
| *** jimbaker has joined #openstack-keystone | 17:24 | |
| *** lhcheng has quit IRC | 17:24 | |
| *** jimbaker has quit IRC | 17:24 | |
| *** jimbaker has joined #openstack-keystone | 17:24 | |
| *** lhcheng has joined #openstack-keystone | 17:30 | |
| stevemar | dolphm, sample config guy is still not working :( | 17:30 |
| dolphm | stevemar: yeah... i'm wondering if it's my fault or not | 17:31 |
| dolphm | stevemar: you're referring to missing options, right? | 17:31 |
| stevemar | dolphm, correctamundo | 17:31 |
| dolphm | stevemar: i'm wondering if i'm missing namespaces https://review.openstack.org/#/c/113905/9/config-generator/keystone.conf | 17:32 |
| stevemar | yeah, but you added them there.. | 17:32 |
| stevemar | and those are the ones that are missing | 17:32 |
| dolphm | stevemar: i mean others that should be included | 17:32 |
| stevemar | log/notifications/eventlet | 17:32 |
| stevemar | like what? | 17:32 |
| dolphm | stevemar: well, like [trust] is an interesting section. why is IT missing? | 17:33 |
| stevemar | dolphm, i didn't think it was, let me check | 17:33 |
| dolphm | stevemar: is it only including the [DEFAULT] section of keystone? | 17:35 |
| stevemar | dolphm, also, fwiw we should add oslo.concurrency too https://review.openstack.org/#/c/137270/1 | 17:35 |
| *** _cjones_ has quit IRC | 17:35 | |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: update sample conf using oslo-config-generator https://review.openstack.org/138508 | 17:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: sync to oslo commit b19af08 https://review.openstack.org/138253 | 17:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch from sample_config.sh to oslo-config-generator https://review.openstack.org/113905 | 17:36 |
| dolphm | ooh, what'd you change.. | 17:36 |
| stevemar | uh oh... i only meant to change the last one | 17:37 |
| dolphm | stevemar: lol --no-rebase | 17:37 |
| dolphm | stevemar: are you using https://review.openstack.org/#/c/136482/ too? | 17:37 |
| stevemar | ... no | 17:37 |
| dolphm | stevemar: how did you get the missing sections back? | 17:38 |
| stevemar | let me double check | 17:38 |
| lbragstad | so... if patches could share emotion to express themselves, https://review.openstack.org/#/c/125738/ would probably be saying something like https://www.youtube.com/watch?v=YH4xz2j82kg&feature=youtu.be&t=12s | 17:40 |
| stevemar | hey it's all there | 17:40 |
| dolphm | lbragstad: ++ | 17:40 |
| stevemar | dolphm, i have no idea what weird magic is working | 17:40 |
| stevemar | i think i had to nuke sample_config | 17:41 |
| dolphm | stevemar: maybe it's because you're not using https://review.openstack.org/#/c/136482/ lol | 17:41 |
| stevemar | dolphm, maybe, | 17:41 |
| stevemar | if you can verify that... we can push this one through | 17:42 |
| dolphm | stevemar: unpatched oslo-config-generator http://pasteraw.com/6j5n73vbkiedn917a8wwh5xthitjc1v | 17:42 |
| dolphm | stevemar: oslo-config-generator master and then patched http://pasteraw.com/lttajkr1c8bx3itx2cssx20m4f9095j | 17:43 |
| stevemar | dolphm, seems like the patch is the problem | 17:43 |
| dolphm | nope | 17:44 |
| dolphm | here's oslo-config-generator, unpatched http://pasteraw.com/bx45k7t8d1a0l2t53q9rysrbf946jbr | 17:44 |
| dolphm | just master | 17:44 |
| dolphm | so master is broken | 17:44 |
| stevemar | i'm not sure at this point | 17:45 |
| dolphm | stevemar: i'm filing a bug | 17:45 |
| *** ayoung has joined #openstack-keystone | 17:46 | |
| *** ChanServ sets mode: +v ayoung | 17:46 | |
| amakarov | stevemar, hello! There is a place in the spec https://review.openstack.org/#/c/131541/ demonstrating described behavior, but from your comment there I see, this is quite well hidden. Can you please give me any hint how to make it more visible? | 17:47 |
| *** browne has joined #openstack-keystone | 17:47 | |
| *** thiagop has joined #openstack-keystone | 17:48 | |
| *** aix has quit IRC | 17:48 | |
| *** afaranha_ has quit IRC | 17:48 | |
| stevemar | amakarov, hmm... for which parameter are you referring to? | 17:50 |
| stevemar | dolphm, so... i think the patch is good? | 17:50 |
| dolphm | stevemar: the sort fix? | 17:51 |
| stevemar | dolphm, nah, the one i just proposed to keystone | 17:52 |
| *** marg7175 has joined #openstack-keystone | 17:52 | |
| dolphm | stevemar: oh sort of. i don't want it until oslo-config-generator works | 17:53 |
| stevemar | dolphm, the oslo-sync -> use oslo.config -> regenerate .conf chain | 17:54 |
| stevemar | you mean the master branch of it? | 17:54 |
| dolphm | stevemar: yeah, the master branch is broken | 17:57 |
| *** jsavak has quit IRC | 17:57 | |
| dolphm | stevemar: and i don't want to merge a dep on oslo-config-generator until it works like we want it to | 17:57 |
| amakarov | stevemar, redelegation_count | 17:57 |
| stevemar | dolphm, okay, fair enough, but the oslo sync is still good :) | 18:01 |
| stevemar | amakarov, what is max_redelegation_count by default? | 18:04 |
| *** joesavak has joined #openstack-keystone | 18:04 | |
| *** harlowja_away is now known as harlowja_ | 18:04 | |
| dolphm | stevemar: that part is, yes | 18:06 |
| dolphm | stevemar: null | 18:07 |
| dolphm | (no limit) | 18:07 |
| stevemar | dolphm, are you answering the redelegation count question? | 18:08 |
| dolphm | stevemar: yes | 18:09 |
| stevemar | so it redelegation_count is optional, and becomes max_redelegation_count, which is null, that doesn't sound right | 18:09 |
| amakarov | stevemar, max_redelegation_count is a configuration parameter | 18:10 |
| *** nellysmitt has quit IRC | 18:13 | |
| *** RichardRaseley has joined #openstack-keystone | 18:13 | |
| stevemar | amakarov, the API changes seem good to me | 18:13 |
| *** diegows has joined #openstack-keystone | 18:14 | |
| *** zzzeek has joined #openstack-keystone | 18:20 | |
| *** _cjones_ has quit IRC | 18:22 | |
| morganfainberg | morning-ish | 18:22 |
| *** marg7175 has quit IRC | 18:24 | |
| openstackgerrit | Merged openstack/keystone: Merge remote-tracking branch 'remotes/origin/feature/hierarchical-multitenancy' into HEAD https://review.openstack.org/138186 | 18:26 |
| morganfainberg | rodrigods, raildo, ^ | 18:26 |
| *** _cjones_ has joined #openstack-keystone | 18:26 | |
| dolphm | morganfainberg: afternoon-ish | 18:28 |
| bknudson | I'm not a fan of the git merge commit message... doesn't say what the commit was. | 18:29 |
| bknudson | just your local branch name. | 18:29 |
| *** jsavak has joined #openstack-keystone | 18:31 | |
| morganfainberg | bknudson, well, we'll use less topic branches in the future. | 18:31 |
| rodrigods | morganfainberg, \o/ | 18:31 |
| morganfainberg | bknudson, i also made it a point to use the full remotes/<blah> path for that reason. | 18:31 |
| bknudson | topic branches need to be easier to use... shouldn't have to talk to infra to create /delete | 18:31 |
| morganfainberg | bknudson, typically you don't need topic branches in gerrit. | 18:32 |
| morganfainberg | bknudson, most of the time multiple people can collaborate more in isolation and just push changes to master for review. this was a special case due to timing i think | 18:32 |
| morganfainberg | bknudson, isolation = locally. | 18:33 |
| bknudson | working in isolation sounds scary | 18:33 |
| morganfainberg | bknudson, the code would be reviewed the same, just not pushed to gerrit to a topic branch | 18:33 |
| *** joesavak has quit IRC | 18:33 | |
| *** aix has joined #openstack-keystone | 18:33 | |
| morganfainberg | it would be worked on against master, then pushed to gerrit against master. | 18:33 |
| dolphm | yeah, i haven't created a topic branch in openstack in a couple years | 18:34 |
| morganfainberg | the topic branch would be "local" | 18:34 |
| morganfainberg | dolphm, can i nuke the "key distribution" topic branch from gerrit too? | 18:34 |
| dolphm | morganfainberg: i think so | 18:35 |
| bknudson | we still have kite api in our specs repo | 18:35 |
| dolphm | we should nuke that too | 18:35 |
| morganfainberg | oh might be dead actually already | 18:35 |
| amakarov | morganfainberg, can you please take a look to my spec? https://review.openstack.org/#/c/131541/ | 18:35 |
| dolphm | especially because it describes itself as an 'identity' api, and if anything, we determined that it should certainly not be that | 18:35 |
| bknudson | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-kds-ext.html | 18:36 |
| *** afazekas has quit IRC | 18:36 | |
| morganfainberg | bknudson, dolphm, yeah we shold nuke that | 18:36 |
| morganfainberg | amakarov, i'm going to need to jump off irc and code review to deal with some HP stuff today. hopefully tonight. :( sorry i can't review it now. | 18:37 |
| morganfainberg | s/jump off irc/put irc client in the background | 18:37 |
| amakarov | morganfainberg, np, just eager to see I satisfied everybody )) | 18:38 |
| morganfainberg | amakarov, ++ totally understand | 18:38 |
| * morganfainberg goes looking for VPN token... | 18:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: User ids that begin with 0 cannot authenticate through ldap https://review.openstack.org/137449 | 18:38 |
| stevemar | dolphm, morganfainberg can y'all take a look at ^ | 18:39 |
| *** nellysmitt has joined #openstack-keystone | 18:39 | |
| *** bknudson has quit IRC | 18:50 | |
| *** Haneef_ has joined #openstack-keystone | 18:50 | |
| *** chrisshattuck has joined #openstack-keystone | 18:52 | |
| *** amakarov is now known as amakarov_away | 18:53 | |
| Haneef_ | ayoung: What is the difference between create_region ( POST) & create_region_with_id (PUT)? Is there any difference? | 18:53 |
| ayoung | Haneef_, no clue | 18:53 |
| *** arif-ali has quit IRC | 18:54 | |
| ayoung | Haneef_, other than what I can deduce from first principals....the second knows the ID ahead of time | 18:54 |
| morganfainberg | stevemar, see comment to amakarov_away, maybe tonight. need to jump on $employer$ things. | 18:54 |
| ayoung | why do we have both? Have to ask the regions folks like jaypipes | 18:54 |
| morganfainberg | ayoung, likely one generates id programatically and one allows specification? [honestly, i dunno either] | 18:54 |
| *** arif-ali has joined #openstack-keystone | 18:56 | |
| *** chrisshattuck has quit IRC | 18:57 | |
| Haneef_ | morganfainberg: yes that's how it is written in code, but not sure which api shoud user use? Basically I can do POST regions with empty regions body which doesn't make any sense | 18:58 |
| morganfainberg | Haneef_, i think from a consistency standpoint (other APIs we have) POST with an ID included should function like the put implementation | 18:59 |
| raildo | morganfainberg, i saw the patch now! thanks a lot! | 18:59 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 18:59 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 18:59 |
| morganfainberg | raildo, rodrigods, topic branch is dead - and removed from gerrit as well | 19:00 |
| rodrigods | morganfainberg, great | 19:00 |
| raildo | ok :) | 19:00 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds correct checks in LDAP backend tests https://review.openstack.org/138551 | 19:00 |
| *** chrisshattuck has joined #openstack-keystone | 19:00 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 19:01 |
| *** jsavak has quit IRC | 19:02 | |
| morganfainberg | gyee, message sent to you. | 19:02 |
| *** xxj has quit IRC | 19:03 | |
| *** xxj has joined #openstack-keystone | 19:03 | |
| openstackgerrit | Thiago Paiva Brito proposed openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 19:06 |
| rodrigods | ayoung, https://review.openstack.org/#/c/138551/ lost the +A after the rebase :( | 19:08 |
| *** joesavak has joined #openstack-keystone | 19:10 | |
| ayoung | rodrigods, OK | 19:12 |
| rodrigods | ayoung, will lose it again until we don't stop to update the previous patch | 19:13 |
| ayoung | workflow.... | 19:13 |
| ayoung | rodrigods, not a huge deal...we'll push it through once the previous patch is in | 19:14 |
| rodrigods | ayoung, thx | 19:14 |
| ayoung | rodrigods, need another +2 on this first https://review.openstack.org/#/c/138468/2 | 19:14 |
| henrynash | rodigods: made a view comments on Patch3 of https://review.openstack.org/#/c/138550/3 | 19:14 |
| rodrigods | henrynash, thanks! will address them | 19:15 |
| henrynash | rodigids: you’ll put out 2 more vesions by the time I git to finsing the review! | 19:15 |
| dolphm | stevemar: it doesn't look like the issue is when user ID's begin with '0', but when entire user IDs also happen to be valid integers? | 19:18 |
| rodrigods | henrynash, was just the commit message heh | 19:19 |
| henrynash | rodigods: no…4 commnents (well 3 really) to : https://review.openstack.org/#/c/138550/3/keystone/assignment/core.py | 19:19 |
| rodrigods | henrynash, I mean, what I`ve updated :) | 19:20 |
| henrynash | rodigods: sorry, I’m confused | 19:20 |
| *** _cjones_ has quit IRC | 19:20 | |
| *** _cjones_ has joined #openstack-keystone | 19:21 | |
| henrynash | rodigods: i’m just testing the rebase of the split….although it will already be out of date…it’s a tough rebase - I have to pull apart some of the changes you are making for project inherited assignments | 19:22 |
| stevemar | dolphm, yes | 19:22 |
| rodrigods | henrynash, hmm do you think could be better to rebase with the CRUD and we add the inherited stuff on top of the split? | 19:23 |
| stevemar | dolphm, it's when the user id can be translated to an int, it's worse when it's a 0, cause then there is actual data loss | 19:23 |
| dolphm | stevemar: i suppose that should be clarified in the test case | 19:23 |
| henrynash | rodigods: well, one of us has to rework a lot of stuff…and since I’ve now done it once, probaly easier for me to do it again…let’s just hope we don’t have to go round the loop too many times! | 19:23 |
| henrynash | rodigods: as soon as the split passes the tests, I’ll post it (even though it will be already outdated)…so you get to see what I’m doing | 19:25 |
| stevemar | dolphm, i thought i did that | 19:26 |
| rodrigods | henrynash, ++ | 19:27 |
| rodrigods | henrynash, replied your comments | 19:31 |
| henrynash | rodigods: ok | 19:31 |
| henrynash | rodigods: replied | 19:36 |
| marekd | dstanek: i responded in https://review.openstack.org/#/c/130593/5 | 19:39 |
| marekd | dstanek: i don't think controller is a right place to check token type. | 19:39 |
| *** zzzeek has quit IRC | 19:41 | |
| dstanek | marekd: i would agree | 19:41 |
| *** bknudson has joined #openstack-keystone | 19:41 | |
| *** ChanServ sets mode: +v bknudson | 19:41 | |
| rodrigods | henrynash, if you are ok with the create_project() part, will submit a new patch :) | 19:41 |
| dstanek | marekd: it seems like there should be some sort of token factory (for lack of naming skills) that figures out which one to use | 19:41 |
| dstanek | marekd: it seems weird to have one AuthMethodHandler decide that another AuthMethodHandler really need to do this work | 19:42 |
| henrynash | rodigods: yep, got it now…added a further comment…but agreeing wth you! | 19:43 |
| marekd | dstanek: i can make a wrapper for that | 19:44 |
| marekd | but all in all it will be split into token.py and mapped.py | 19:44 |
| rodrigods | henrynash, great! | 19:44 |
| marekd | nkinder, stevemar: did you see DWChadwick's comments on enhanced mapping specs? | 19:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments manager/driver. https://review.openstack.org/130954 | 19:45 |
| dstanek | marekd: the wrapper would be in both of those modules? | 19:48 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Inherited role assignments to projects https://review.openstack.org/138552 | 19:48 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create, update and delete hierarchical projects https://review.openstack.org/138550 | 19:48 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Adds correct checks in LDAP backend tests https://review.openstack.org/138551 | 19:48 |
| henrynash | rodigods: here’s the split rebase: https://review.openstack.org/130954 | 19:49 |
| henrynash | rodigods: I had to pull up some eof the logic for ingerited assignments for projects into the assignmetn/manager | 19:50 |
| *** diegows has quit IRC | 19:50 | |
| marekd | dstanek: We want a change, but need to keep the structure as it is today for a backward compatilibity. | 19:50 |
| marekd | dstanek: that's why i need to keeep token.py and maped.py plugins | 19:51 |
| marekd | like today, right? | 19:51 |
| marekd | dstanek: that's why whole structure is kind of screwy | 19:51 |
| dstanek | marekd: can't you change the thing that creates a Token plugin to call the factory? | 19:51 |
| *** aix has quit IRC | 19:51 | |
| rodrigods | henrynash, looking | 19:51 |
| marekd | dstanek: i guess i can. | 19:52 |
| marekd | but it will still be Token class | 19:52 |
| dstanek | marekd: you can always wait a bit and see if any other core cares about it | 19:52 |
| nkinder | marekd: yes, I'm replying (though I need to read some of the things that he referenced) | 19:52 |
| dstanek | marekd: the factory has to be in the token class? | 19:53 |
| marekd | dstanek: i think so, as controller has generic way to call auth plugins. | 19:53 |
| marekd | it reads auth_method value, fetches an object identified by a name (here 'token') and calls plugin.authenticate() | 19:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove XML support https://review.openstack.org/125738 | 19:54 |
| marekd | nkinder: some fresh eyes or support would be appreciated. | 19:54 |
| marekd | dstanek: i don't want to merge changes by changing core reviewers :-) | 19:55 |
| dstanek | marekd: the way i would do it is have token resolve to the factory and have the factory create a Token or Mapping | 19:55 |
| dstanek | unless that isn't backward compat | 19:55 |
| *** markvoelker has joined #openstack-keystone | 19:55 | |
| dstanek | marekd: no, but if others think there is no issue then i may change my vote :-) | 19:56 |
| *** thedodd has joined #openstack-keystone | 19:59 | |
| dstanek | marekd: you have been super helpful with all of this federation stuff. i owe you a few beers. | 19:59 |
| *** _cjones_ has quit IRC | 20:02 | |
| marekd | dstanek: i will never reject any :-) On the other hand you are superhelpful so i simply pay my debts :-) | 20:02 |
| marekd | dstanek: anyway, did you manage to configure it? | 20:04 |
| bknudson | so we marked K2K federation as experimental in J... what does it take to make it stable in K? | 20:05 |
| *** aix has joined #openstack-keystone | 20:05 | |
| bknudson | and is the plan to do what it takes and have K2K stable in K? | 20:05 |
| bknudson | maybe by K2? | 20:05 |
| rodrigods | bknudson, think the SP part will definitely help to remove the experimental flag | 20:06 |
| rodrigods | bknudson, need also to verify some certificates problems we had (the last bullet point in http://rodrigods.com/playing-with-keystone-to-keystone-federation/) | 20:07 |
| *** nellysmitt has quit IRC | 20:07 | |
| dstanek | marekd: i thought i did, but when i trashed the VM and recreated with the scripts not so much | 20:07 |
| dstanek | marekd: i was doing other stuff yesterday so that i could take a break from federation | 20:08 |
| bknudson | rodrigods: hopefully we'll also have tempest test for it. | 20:08 |
| marekd | dstanek: bknudson i am hoping to spend next week trying to fix k2k | 20:09 |
| nkinder | marekd: I added some comments. I think David's use-case is just different from the use-case that I have in mind | 20:09 |
| bknudson | marekd: what's wrong with it? | 20:09 |
| nkinder | marekd: Your proposal doesn't change or block any of what David wants, but it does add flexibility that would be very welcome for cases where the IdP is trusted (internal SSO for example). | 20:10 |
| marekd | bknudson: SP cannot correctly validate assertion. | 20:11 |
| marekd | nkinder: i think he wants something else, yet i simply need some comments from the community | 20:11 |
| marekd | nkinder: i don't want it to be him vs. me | 20:12 |
| nkinder | marekd: Sure. I think some of what he wants doesn't conflict with what you've proposed. It's just different (like the trusted attributes). | 20:12 |
| bknudson | that sounds bad | 20:13 |
| marekd | bknudson: ++ | 20:14 |
| marekd | dstanek: i will get back soon. Wanted to talk through this token factory. | 20:16 |
| *** diegows has joined #openstack-keystone | 20:18 | |
| marekd | nkinder: actually i don't see how trusted attributes are going to be a cleaner solution for our proposal. especially since we are talking about direct mapping single attribute which is a concatenated list of subattributes (like groups). | 20:19 |
| dstanek | k | 20:19 |
| dstanek | marekd: ^ | 20:20 |
| nkinder | marekd: really, if you set up a mapping for an attribute, you trust it IMHO | 20:20 |
| nkinder | If you don't trust an attribute, you don't map it. | 20:20 |
| marekd | nkinder: exactly. | 20:20 |
| marekd | mapping rules are somewhat kind of a whitelist. | 20:21 |
| nkinder | marekd: I think your proposal is a clean solution that isn't a deparature from the current implementation | 20:21 |
| nkinder | marekd: ...though I'd still like the addition of being able to have ephemeral groups :) | 20:22 |
| *** _cjones_ has joined #openstack-keystone | 20:22 | |
| marekd | nkinder: that was in a initial proposal (and later in the alternatives, so people are aware of it). yet, after some discussion with henrynash i think it would take us at least one cycle to change role assignments api so we can have RA pointing to ephemeral groups. | 20:23 |
| marekd | nkinder: so i decided to propose this and hope to have it by K. | 20:23 |
| marekd | as a parallel track we can discuss again changing role assignments API | 20:23 |
| nkinder | marekd: oh, no problem with separating them from me | 20:24 |
| nkinder | marekd: The need to create groups does give control of what values we trust | 20:24 |
| nkinder | marekd: combined with the blacklist/whitelist, that seems like all of the control you need to lock down the exact values you trust. | 20:24 |
| marekd | nkinder: i know ephemeral groups are better, but it's better to have something and go step by steprather than wait for one big change...one day in the future...maybe in L or M or later. | 20:24 |
| *** nellysmitt has joined #openstack-keystone | 20:26 | |
| *** nellysmitt has quit IRC | 20:28 | |
| *** _cjones_ has quit IRC | 20:30 | |
| *** zzzeek has joined #openstack-keystone | 20:41 | |
| *** _cjones_ has joined #openstack-keystone | 20:44 | |
| *** jorge_munoz has quit IRC | 20:45 | |
| *** jorge_munoz has joined #openstack-keystone | 20:47 | |
| *** afaranha_ has joined #openstack-keystone | 20:50 | |
| morganfainberg | bknudson, i'd really like K2K stable by K2 at the latest | 21:01 |
| morganfainberg | bknudson, earlier is better. | 21:01 |
| *** kobtea has joined #openstack-keystone | 21:08 | |
| stevemar | dstanek, ping | 21:09 |
| dstanek | stevemar: pong | 21:09 |
| stevemar | dstanek, just wanted to make sure you can see the presentation on google docs | 21:10 |
| dstanek | stevemar: let me check | 21:10 |
| stevemar | i see your pic! | 21:10 |
| dstanek | i'm in! | 21:10 |
| *** arif-ali has quit IRC | 21:11 | |
| marekd | morganfainberg: maybe you can give your PTL 0.3$ on https://review.openstack.org/#/c/138035/ and https://review.openstack.org/#/c/137020/ . | 21:13 |
| marekd | i am especially worried about the spec. | 21:13 |
| *** arif-ali has joined #openstack-keystone | 21:13 | |
| *** kobtea has quit IRC | 21:13 | |
| marekd | dstanek: getting back to the factory discussion. Here is the controller piece that loads plugins after reading auth method. https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L490-L492 Since it should now be 'token' in federated and non federated case we would need to change this logic. | 21:15 |
| marekd | dstanek: or add some weird monster in Token.authenticate() which, unlike other plugins would be a factory. | 21:15 |
| stevemar | dstanek, it's currently a mish mash of presentations | 21:16 |
| marekd | stevemar: may i ask on what presentation are you working on? | 21:16 |
| stevemar | marekd, general authentication one | 21:16 |
| *** jimhoagland has joined #openstack-keystone | 21:22 | |
| morganfainberg | marekd, they are working on bootstrapping one for friday | 21:24 |
| * morganfainberg is unable to do it :( -- too much going on | 21:24 | |
| morganfainberg | dstanek, and stevemar are awesome and doing the presentation instead | 21:24 |
| *** jorge_munoz has quit IRC | 21:24 | |
| morganfainberg | i owe them at least a beer at the midcycle ;) | 21:24 |
| morganfainberg | we have a venue, hotel discount still in the works. will send an update post lunch today | 21:25 |
| marekd | morganfainberg: what is on friday? | 21:26 |
| stevemar | morganfainberg, i'll share the presentation with you | 21:26 |
| morganfainberg | marekd, OPenStack community has a bootstrapping hour webcast thing | 21:26 |
| morganfainberg | this week is Keystone and Authentication Workflows | 21:26 |
| marekd | morganfainberg: oh, i see. | 21:26 |
| marekd | didn't know that :( | 21:26 |
| *** jorge_munoz has joined #openstack-keystone | 21:33 | |
| *** topol has quit IRC | 21:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/134794 | 21:41 |
| *** jamielennox is now known as jamielennox|away | 21:42 | |
| dstanek | marekd: ugg...among other things i lost the DB records I created for the IdP | 21:44 |
| marekd | dstanek: oups... | 21:49 |
| marekd | dstanek: wil l talk to you tomorrow about functional tests, ok? | 21:49 |
| marekd | i want to learn how to do this. | 21:49 |
| dstanek | marekd: know how to do what? | 21:50 |
| marekd | dstanek: how to proceed with a functional tests so we can have a real IdP. | 21:51 |
| marekd | and one day gate tests. | 21:51 |
| dstanek | marekd: k, we can talk tomorrow | 21:52 |
| marekd | dstanek: thanks. | 21:52 |
| marekd | I am logging out now, cheers. | 21:52 |
| dstanek | the tests themselves will be largely the same as what we have now | 21:52 |
| marekd | dstanek: except we need Keystone running on top of Apache | 21:53 |
| dstanek | marekd: you'll just use a known port for the tests and that will run against devstack | 21:54 |
| dstanek | marekd: tomorrow you can help me wrap up the configuration stuff if you have time | 21:54 |
| marekd | dstanek: i will. | 21:54 |
| dstanek | marekd: i'll even get on early for you | 21:55 |
| marekd | dstanek: if we start your normal day of work with that we should be good :-) | 21:55 |
| marekd | what time do you have now? | 21:55 |
| dstanek | 5pm | 21:55 |
| marekd | ok, so it's 6h of difference. i have 11pm. | 21:56 |
| marekd | ok, gnight! | 21:57 |
| *** marekd is now known as marekd|away | 21:57 | |
| dstanek | marekd|away: night! | 21:57 |
| *** jimhoagland has quit IRC | 21:59 | |
| stevemar | dstanek, lemme know if you think anything is missing from the pres | 22:00 |
| *** tellesnobrega_ has joined #openstack-keystone | 22:05 | |
| *** jimhoagland has joined #openstack-keystone | 22:06 | |
| *** joesavak has quit IRC | 22:15 | |
| dstanek | stevemar: will do | 22:21 |
| dstanek | stevemar: do you have (or does there exist) a canned script that generates the records for group/role/idp/mapping needed for federation? | 22:22 |
| stevemar | dstanek, i have a few things written down that i just copy/paste | 22:23 |
| stevemar | dstanek, https://gist.github.com/stevemart/e1c07cf4df50f621282f#file-oidc_steps-L57-L58 | 22:23 |
| stevemar | and lines 85-87 | 22:23 |
| dstanek | stevemar: nice, thx | 22:24 |
| *** nellysmitt has joined #openstack-keystone | 22:28 | |
| *** sriram has quit IRC | 22:31 | |
| *** nellysmitt has quit IRC | 22:33 | |
| *** jorge_munoz has quit IRC | 22:37 | |
| *** afaranha_ has quit IRC | 22:41 | |
| *** henrynash has quit IRC | 22:41 | |
| morganfainberg | yay more rain in SoCal :) | 22:52 |
| bknudson | It's not going to rain here. | 22:53 |
| stevemar | bknudson, it'll snow | 22:54 |
| bknudson | morganfainberg probably doesn't even own a snow shovel | 22:55 |
| *** afaranha_ has joined #openstack-keystone | 22:55 | |
| morganfainberg | bknudson, i used to. grew up in the mountains shovelling snow all winter, and ~95-100degree (that's F for those who use that other weird method of temperature, stevemar ) summers | 22:56 |
| stevemar | bknudson, shovels are backup anyway, need a blower | 22:59 |
| morganfainberg | stevemar, i would have killed for a snow blower when i was a kid... | 23:00 |
| morganfainberg | shovelling 6-8ft of snow... just to have a plow shove 4-7ft of now ICE back onto the driveway/entryway was awful | 23:01 |
| morganfainberg | stevemar, our neighbors at one point had a snowblower and an ATV + blade on the front | 23:01 |
| morganfainberg | and yes i grew up in SoCal :P just at elevation | 23:01 |
| bknudson | Imagines morganfainberg as some sort of mountain man | 23:02 |
| stevemar | bknudson, he needs more beard | 23:03 |
| morganfainberg | bknudson, i grew up in the national forest :P told "go outside, don't come back till dinner" over the summers. | 23:03 |
| morganfainberg | and played ice hockey. | 23:04 |
| bknudson | raised by wolves | 23:04 |
| morganfainberg | :P | 23:04 |
| morganfainberg | bknudson, nah, we only have coyotes and they aren't loving enough to raise a kid | 23:04 |
| morganfainberg | they'd have eaten me instead :P | 23:04 |
| morganfainberg | now the bears.... | 23:04 |
| bknudson | we always hear about the bears | 23:04 |
| morganfainberg | they're more lovable.... | 23:04 |
| morganfainberg | (or disgusting if you're cleaning up after the mess they make of the trashcans) | 23:05 |
| bknudson | someone probably found you swimming in their pool and took you in | 23:05 |
| morganfainberg | lol | 23:05 |
| *** jamielennox|away is now known as jamielennox | 23:09 | |
| morganfainberg | jamielennox, ping. | 23:09 |
| morganfainberg | jamielennox, re: SDK and incompat ksc | 23:09 |
| jamielennox | morganfainberg: the re: is good form - it has the disadvantage that i'm not sure i want to talk about that :) | 23:10 |
| bknudson | I'm not sure we totally got closure on that discussion | 23:10 |
| bknudson | wouldn't be the first time | 23:10 |
| jamielennox | so what's up? | 23:10 |
| morganfainberg | jamielennox, so meeting happened and *generally* speaking we're leaning towards saying incompat changes are going to look at SDK before we make say python-keystoneclient2 | 23:10 |
| bknudson | there were some todos. | 23:10 |
| morganfainberg | but as bknudson said there wasn't clear closure. | 23:11 |
| morganfainberg | so, explore if SDK is the right place, and help make sure they have the standards for code they want | 23:11 |
| jamielennox | morganfainberg: that's fair - and i mostly agree | 23:11 |
| bknudson | I don't think anyone was too excited about *client2. | 23:11 |
| *** jimhoagland has quit IRC | 23:11 | |
| morganfainberg | bknudson, mordred was less worried about which way, just as long as we can make it cleaner/easier to work with | 23:11 |
| morganfainberg | bknudson, and that is where i'm at. | 23:11 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 23:12 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 23:12 |
| morganfainberg | if we can drop the cruft, and clean it up - I'm happy. | 23:12 |
| bknudson | morganfainberg: I think that's a different discussion... you make a high-level api from a low level api | 23:12 |
| morganfainberg | SDK or client2 | 23:12 |
| morganfainberg | then we make the high-level stuff on the less-crufty impl | 23:12 |
| jamielennox | morganfainberg: ++ - i don't really care, it annoys me i've had to mess with this for so long i just want something that works | 23:12 |
| bknudson | we need the low-level api and we also need a high-level api | 23:12 |
| *** jimhoagland has joined #openstack-keystone | 23:12 | |
| morganfainberg | part of the complaint is the current stuff is crufty and not easy to make that high-level stuff on ... without a lot of other cruft in the high-level stuff | 23:13 |
| morganfainberg | at least that was what made me thingk about ksc2 or non-compat changes | 23:13 |
| jamielennox | so sdk will provide high and low levels, i'm not up on it as much as i was | 23:14 |
| jamielennox | but i've never really been concerned with the CRUD - it's a mess but it's usable | 23:14 |
| bknudson | one of the concerns was that project teams don't seem to contribute outside their projects | 23:14 |
| bknudson | and tempest was the example given. | 23:14 |
| bknudson | it's going to be hard for anyone to be effective in an sdk project that they haven't worked on before. | 23:15 |
| jamielennox | so this chain is what i want in middleware before release: https://review.openstack.org/#/c/130532/9 | 23:17 |
| *** diegows has quit IRC | 23:18 | |
| morganfainberg | jamielennox, /me looks | 23:18 |
| *** bknudson has quit IRC | 23:19 | |
| morganfainberg | jamielennox, ok i see three things. i'll put that on my list to start reviewing | 23:19 |
| * morganfainberg is a little mired up with other stuff atm | 23:19 | |
| morganfainberg | jamielennox, anything for KSC ? | 23:19 |
| morganfainberg | i'd like to release both around the same time | 23:19 |
| jamielennox | https://review.openstack.org/#/c/133866/ | 23:21 |
| jamielennox | https://review.openstack.org/#/c/132652/ | 23:22 |
| jamielennox | i'll add the test to ^ | 23:22 |
| morganfainberg | jamielennox, ++ cool. | 23:22 |
| jamielennox | https://review.openstack.org/#/c/138228/ | 23:23 |
| jamielennox | that should do | 23:23 |
| morganfainberg | ok i added those to the gist ^ | 23:23 |
| morganfainberg | [give it a few to sync] | 23:23 |
| morganfainberg | ok should all be there. | 23:24 |
| morganfainberg | jamielennox, my goal is end of next week to do a release. but obv. tied to these getting in | 23:24 |
| jamielennox | https://review.openstack.org/#/c/132626 should probably go as well, it's a bug but probably not a huge problem | 23:25 |
| morganfainberg | jamielennox, hmm. if it lands great, but i wont hold things up for it | 23:26 |
| jamielennox | i would also like to do the 'make everything private' to the audit middleware that got added | 23:27 |
| *** afaranha_ has quit IRC | 23:27 | |
| *** afaranha_ has joined #openstack-keystone | 23:27 | |
| jamielennox | from keystonemiddleware.openstack.common import context <- makes me a little sad | 23:27 |
| morganfainberg | jamielennox, that is reasonable. | 23:28 |
| morganfainberg | the make it all private | 23:28 |
| morganfainberg | jamielennox, =/ | 23:28 |
| stevemar | nkinder, hope you don't mind i used some pics/words from your paris presentation | 23:34 |
| *** diegows has joined #openstack-keystone | 23:34 | |
| nkinder | stevemar: nope, that's fine | 23:35 |
| nkinder | stevemar: what'd you use them for? | 23:35 |
| stevemar | nkinder, bootstrapping hour on friday | 23:35 |
| nkinder | stevemar: ah, cool | 23:36 |
| *** Haneef_ has quit IRC | 23:37 | |
| *** RichardRaseley has quit IRC | 23:37 | |
| *** afaranha_ has quit IRC | 23:37 | |
| *** jimhoagland has quit IRC | 23:39 | |
| stevemar | nkinder, PM me your gmail address so i can share the presentation :) | 23:40 |
| nkinder | stevemar: it's a google docs preso? If so, my RH address is signed up | 23:40 |
| stevemar | ah that'll do | 23:40 |
| stevemar | done | 23:41 |
| *** afaranha_ has joined #openstack-keystone | 23:45 | |
| *** gordc has quit IRC | 23:47 | |
| *** drArtemis has joined #openstack-keystone | 23:52 | |
| morganfainberg | dolphm, published the details on the WIKI and my post about venue and possible hotels with a note that i'll finalize the discounts/best choices by monday-ish | 23:53 |
| morganfainberg | dolphm, so if we don't have a discount code by monday/tue/wed/some time next week (i'm guessing soon is really soon™ in the blizzard/valvetime sense in that case) | 23:53 |
| morganfainberg | dolphm, i'll expect people to pick the best hotel for budget etc (so travel can be setup for obv. reasons) | 23:54 |
| morganfainberg | nkinder, welcome back btw | 23:54 |
| *** drArtemis has left #openstack-keystone | 23:54 | |
| nkinder | morganfainberg: thanks! | 23:54 |
| morganfainberg | nkinder, i assume you wont make it to the midcycle in SA | 23:54 |
| nkinder | morganfainberg: unfortunately not. I'm travelling just after that to the Czech Republic, so it's just too much travel too close together | 23:55 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make everything in audit middleware private https://review.openstack.org/138907 | 23:55 |
| morganfainberg | ah | 23:55 |
| morganfainberg | jamielennox, we have a confirmed venue... if you're going to try and showup: https://www.morganfainberg.com/blog/2014/11/18/keystone-hackathon-kilo/ | 23:56 |
| morganfainberg | jamielennox, hotel info still pending (discount codes that is) | 23:56 |
| *** xxj has quit IRC | 23:57 | |
| jamielennox | morganfainberg: would love to, but not pushing it | 23:57 |
| morganfainberg | jamielennox, works for me. i'll see if we can figure out a hangout or something for when you're awake | 23:57 |
| jamielennox | morganfainberg: that would be great | 23:58 |
| morganfainberg | and maybe to get nkinder there. | 23:58 |
| morganfainberg | but no guarantees. | 23:58 |
| jamielennox | morganfainberg: is it just me or are there other remotees? | 23:58 |
| morganfainberg | jamielennox, nkinder maybe ;) | 23:58 |
| morganfainberg | for L cycle i think i want to try and do it much more "remote friendly" [if we even need it] | 23:59 |
| morganfainberg | pre-plan to set it all up w/ remote access etc. | 23:59 |
| morganfainberg | or do it as a virtual mid-cycle | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!