| *** marcoemorais has joined #openstack-keystone | 00:01 | |
| *** _cjones_ has joined #openstack-keystone | 00:04 | |
| *** andreaf has quit IRC | 00:05 | |
| *** lufix has quit IRC | 00:05 | |
| *** andreaf has joined #openstack-keystone | 00:22 | |
| *** dims has quit IRC | 00:27 | |
| *** dims has joined #openstack-keystone | 00:28 | |
| *** _cjones_ has quit IRC | 00:30 | |
| *** dims has quit IRC | 00:32 | |
| *** _cjones_ has joined #openstack-keystone | 00:39 | |
| *** lhcheng_ is now known as lhcheng | 00:50 | |
| *** _cjones_ has quit IRC | 00:51 | |
| *** _cjones_ has joined #openstack-keystone | 00:55 | |
| *** timcline has joined #openstack-keystone | 00:57 | |
| *** Tahmina has quit IRC | 00:58 | |
| *** dims has joined #openstack-keystone | 00:59 | |
| *** rm_work is now known as rm_work|away | 01:05 | |
| *** nellysmitt has joined #openstack-keystone | 01:13 | |
| *** nellysmitt has quit IRC | 01:18 | |
| *** _cjones_ has quit IRC | 01:20 | |
| *** _cjones_ has joined #openstack-keystone | 01:29 | |
| *** _cjones_ has quit IRC | 01:38 | |
| *** timcline has quit IRC | 01:40 | |
| *** marcoemorais has quit IRC | 01:41 | |
| openstackgerrit | Merged openstack/keystone: Check and delete for policy_association_for_region_and_service https://review.openstack.org/140122 | 01:43 |
|---|---|---|
| openstackgerrit | wanghong proposed openstack/keystone: set endpoint enabled default to True if not specified(kvs) https://review.openstack.org/139958 | 01:45 |
| *** gordc has joined #openstack-keystone | 01:46 | |
| *** mitz has quit IRC | 01:47 | |
| wanghong | @bknudson, still here? | 01:47 |
| *** mitz has joined #openstack-keystone | 01:52 | |
| *** dims has quit IRC | 01:55 | |
| *** dims has joined #openstack-keystone | 01:56 | |
| *** gyee has quit IRC | 01:57 | |
| openstackgerrit | wanghong proposed openstack/keystone: don't allow user to add role on disabled project or domain https://review.openstack.org/141746 | 01:58 |
| *** _cjones_ has joined #openstack-keystone | 01:58 | |
| *** dims has quit IRC | 02:00 | |
| *** _cjones_ has quit IRC | 02:03 | |
| *** erkules_ has joined #openstack-keystone | 02:05 | |
| *** erkules has quit IRC | 02:07 | |
| *** diegows has quit IRC | 02:09 | |
| openstackgerrit | wanghong proposed openstack/keystone: invalidate cache when updating catalog objects https://review.openstack.org/142079 | 02:11 |
| openstackgerrit | wanghong proposed openstack/keystone: remove assignments for foreign actors when deleting domain https://review.openstack.org/127433 | 02:18 |
| *** gordc has quit IRC | 02:21 | |
| *** gokrokve has joined #openstack-keystone | 02:24 | |
| *** LinstatSDR has joined #openstack-keystone | 02:27 | |
| *** mitz has quit IRC | 02:37 | |
| *** mitz has joined #openstack-keystone | 02:37 | |
| *** hdd has quit IRC | 02:56 | |
| *** arif-ali has quit IRC | 02:58 | |
| *** zzzeek has quit IRC | 03:00 | |
| *** arif-ali has joined #openstack-keystone | 03:01 | |
| *** timcline has joined #openstack-keystone | 03:04 | |
| *** timcline has quit IRC | 03:04 | |
| *** timcline has joined #openstack-keystone | 03:04 | |
| openstackgerrit | wanghong proposed openstack/keystone: Can't update catalog objects when using kvs driver https://review.openstack.org/130180 | 03:05 |
| *** timcline has quit IRC | 03:08 | |
| *** timcline has joined #openstack-keystone | 03:10 | |
| openstackgerrit | wanghong proposed openstack/keystone: set endpoint enabled default to True if not specified(kvs) https://review.openstack.org/142316 | 03:12 |
| *** Krast has quit IRC | 03:13 | |
| *** LinstatSDR has quit IRC | 03:14 | |
| *** nellysmitt has joined #openstack-keystone | 03:14 | |
| *** timcline has quit IRC | 03:14 | |
| *** timcline has joined #openstack-keystone | 03:15 | |
| *** Shohei has quit IRC | 03:16 | |
| *** timcline has quit IRC | 03:17 | |
| *** Shohei has joined #openstack-keystone | 03:17 | |
| *** timcline has joined #openstack-keystone | 03:17 | |
| *** nellysmitt has quit IRC | 03:19 | |
| *** Shohei has quit IRC | 03:21 | |
| *** lhcheng has quit IRC | 03:22 | |
| *** harlowja is now known as harlowja_away | 03:25 | |
| *** richm1 has quit IRC | 03:27 | |
| *** timcline has quit IRC | 03:28 | |
| openstackgerrit | wanghong proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 03:30 |
| openstackgerrit | wanghong proposed openstack/keystone: add circular check when updating region https://review.openstack.org/130474 | 03:32 |
| *** Shohei has joined #openstack-keystone | 03:33 | |
| openstackgerrit | Merged openstack/keystone: Fix update role without name using LDAP https://review.openstack.org/141186 | 03:34 |
| openstackgerrit | Merged openstack/keystone: Add tests for enabled attribute ignored https://review.openstack.org/140895 | 03:35 |
| openstackgerrit | Merged openstack/keystone: Fix disabling entities when enabled is ignored https://review.openstack.org/141101 | 03:35 |
| openstackgerrit | Merged openstack/keystone: Add a test for modifying a role to set the name the same https://review.openstack.org/141234 | 03:35 |
| openstackgerrit | Merged openstack/keystone: Fix modifying a role with same name using LDAP https://review.openstack.org/141235 | 03:35 |
| *** timcline has joined #openstack-keystone | 03:37 | |
| *** timcline has quit IRC | 03:38 | |
| openstackgerrit | Merged openstack/keystone: Remove XML support https://review.openstack.org/125738 | 03:43 |
| *** chrisshattuck has joined #openstack-keystone | 03:46 | |
| *** gokrokve has quit IRC | 03:50 | |
| *** mitz has quit IRC | 03:50 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update docs to no longer show XML support https://review.openstack.org/125753 | 03:51 |
| stevemar | lbragstad, your patch just -1'ed everyone's stuff | 03:53 |
| stevemar | hehe | 03:53 |
| stevemar | merge conflicts for all! | 03:53 |
| lbragstad | stevemar: muahahah | 03:53 |
| stevemar | lbragstad, so that was your plan all along | 03:53 |
| * lbragstad has been planning that for *months* | 03:54 | |
| stevemar | !!!! | 03:54 |
| openstack | stevemar: Error: "!!!" is not a valid command. | 03:54 |
| stevemar | screw you openstack | 03:54 |
| lbragstad | lol | 03:54 |
| stevemar | lbragstad, now review https://review.openstack.org/125753 :P | 03:54 |
| lbragstad | stevemar: if patches lived in trees, and branches were failures, 125738 hit every single one on the way down | 03:55 |
| stevemar | oh yeah | 03:55 |
| stevemar | lbragstad, oh this one is super easy too | 03:56 |
| stevemar | https://review.openstack.org/#/c/142192/ | 03:56 |
| *** _cjones_ has joined #openstack-keystone | 03:57 | |
| lbragstad | stevemar: looks good | 03:58 |
| stevemar | yee haw | 03:58 |
| lbragstad | .. weird... | 03:59 |
| lbragstad | we no longer have XML | 03:59 |
| *** mitz has joined #openstack-keystone | 03:59 | |
| stevemar | lbragstad, that's a good thing | 04:01 |
| *** Shohei_ has joined #openstack-keystone | 04:05 | |
| *** Shohei has quit IRC | 04:07 | |
| *** mitz has quit IRC | 04:15 | |
| *** mitz has joined #openstack-keystone | 04:16 | |
| *** _cjones_ has quit IRC | 04:23 | |
| *** _cjones_ has joined #openstack-keystone | 04:24 | |
| *** stevemar has quit IRC | 04:30 | |
| *** hdd has joined #openstack-keystone | 04:34 | |
| *** mitz has quit IRC | 04:42 | |
| *** hdd_ has joined #openstack-keystone | 04:42 | |
| *** hdd has quit IRC | 04:43 | |
| *** mitz has joined #openstack-keystone | 04:45 | |
| *** andreaf has quit IRC | 04:45 | |
| *** andreaf has joined #openstack-keystone | 04:46 | |
| morganfainberg | !!!! | 04:50 |
| openstack | morganfainberg: Error: "!!!" is not a valid command. | 04:50 |
| morganfainberg | !! | 04:50 |
| openstack | morganfainberg: Error: "!" is not a valid command. | 04:50 |
| morganfainberg | !omg | 04:50 |
| openstack | morganfainberg: Error: "omg" is not a valid command. | 04:50 |
| *** lvh has quit IRC | 04:55 | |
| *** gabriel-bezerra has quit IRC | 04:57 | |
| *** jamiec has quit IRC | 04:57 | |
| *** lvh has joined #openstack-keystone | 04:58 | |
| *** gabriel-bezerra has joined #openstack-keystone | 04:58 | |
| *** jbonjean has quit IRC | 04:58 | |
| *** jbonjean has joined #openstack-keystone | 04:58 | |
| *** jamiec has joined #openstack-keystone | 05:02 | |
| *** tellesnobrega has quit IRC | 05:03 | |
| *** tellesnobrega has joined #openstack-keystone | 05:04 | |
| *** wpf1 has quit IRC | 05:07 | |
| *** _cjones_ has quit IRC | 05:10 | |
| *** mitz has quit IRC | 05:12 | |
| *** mitz has joined #openstack-keystone | 05:13 | |
| *** mitz has quit IRC | 05:14 | |
| *** nellysmitt has joined #openstack-keystone | 05:15 | |
| *** lhcheng has joined #openstack-keystone | 05:15 | |
| *** mitz has joined #openstack-keystone | 05:16 | |
| *** hdd_ has quit IRC | 05:19 | |
| *** nellysmitt has quit IRC | 05:19 | |
| *** mitz has quit IRC | 05:20 | |
| *** mitz has joined #openstack-keystone | 05:21 | |
| *** sluo_wfh has joined #openstack-keystone | 05:23 | |
| *** lhcheng has quit IRC | 05:23 | |
| *** lhcheng has joined #openstack-keystone | 05:23 | |
| *** mitz has quit IRC | 05:31 | |
| *** _cjones_ has joined #openstack-keystone | 05:32 | |
| *** mitz has joined #openstack-keystone | 05:34 | |
| *** jaosorior has quit IRC | 05:43 | |
| *** rushiagr_away is now known as rushiagr | 05:47 | |
| *** mitz has quit IRC | 05:51 | |
| *** mitz has joined #openstack-keystone | 05:52 | |
| *** ajayaa has joined #openstack-keystone | 05:53 | |
| *** mitz has quit IRC | 06:00 | |
| *** mitz has joined #openstack-keystone | 06:00 | |
| *** mitz has quit IRC | 06:03 | |
| *** hdd has joined #openstack-keystone | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/136243 | 06:06 |
| *** wanghong has quit IRC | 06:16 | |
| *** chrisshattuck has quit IRC | 06:17 | |
| *** ajayaa has quit IRC | 06:30 | |
| *** avozza is now known as zz_avozza | 06:32 | |
| *** wanghong has joined #openstack-keystone | 06:34 | |
| *** dims has joined #openstack-keystone | 06:34 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Cleanup exceptions https://review.openstack.org/142243 | 06:37 |
| *** dims has quit IRC | 06:39 | |
| *** hdd has quit IRC | 06:41 | |
| *** rm_work|away is now known as rm_work | 06:43 | |
| *** _cjones_ has quit IRC | 06:48 | |
| *** _cjones_ has joined #openstack-keystone | 06:49 | |
| *** marcoemorais has joined #openstack-keystone | 06:52 | |
| *** _cjones_ has quit IRC | 06:53 | |
| *** marcoemorais1 has joined #openstack-keystone | 06:54 | |
| *** marcoemorais has quit IRC | 06:56 | |
| *** ajayaa has joined #openstack-keystone | 06:57 | |
| *** nellysmitt has joined #openstack-keystone | 07:16 | |
| *** pcaruana has joined #openstack-keystone | 07:16 | |
| *** ncoghlan has joined #openstack-keystone | 07:17 | |
| *** abhirc has quit IRC | 07:20 | |
| *** rm_work is now known as rm_work|away | 07:20 | |
| *** nellysmitt has quit IRC | 07:21 | |
| *** lhcheng has quit IRC | 07:25 | |
| *** lhcheng has joined #openstack-keystone | 07:26 | |
| *** lhcheng has quit IRC | 07:30 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Standardize token scoping workflow. https://review.openstack.org/142376 | 08:00 |
| *** Shohei_ has quit IRC | 08:01 | |
| *** Shohei has joined #openstack-keystone | 08:02 | |
| *** Shohei_ has joined #openstack-keystone | 08:03 | |
| *** Shohei has quit IRC | 08:04 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: support micro version if sent https://review.openstack.org/130916 | 08:07 |
| rushiagr | !time | 08:08 |
| openstack | rushiagr: Error: "time" is not a valid command. | 08:08 |
| *** erkules_ is now known as erkules | 08:11 | |
| *** wanghong has quit IRC | 08:17 | |
| *** rushiagr is now known as rushiagr_away | 08:20 | |
| *** nellysmitt has joined #openstack-keystone | 08:23 | |
| *** wanghong has joined #openstack-keystone | 08:31 | |
| *** lhcheng has joined #openstack-keystone | 08:34 | |
| *** lhcheng has quit IRC | 08:38 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: fallback to online validation if offline validation fails https://review.openstack.org/131036 | 08:39 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Cleanup exceptions https://review.openstack.org/142243 | 08:45 |
| *** Shohei_ has quit IRC | 08:57 | |
| *** ncoghlan has quit IRC | 08:59 | |
| *** lhcheng has joined #openstack-keystone | 09:08 | |
| *** marcoemorais1 has quit IRC | 09:16 | |
| *** zz_avozza is now known as avozza | 09:23 | |
| *** rushiagr_away is now known as rushiagr | 09:27 | |
| *** f13o has quit IRC | 09:47 | |
| *** lhcheng has quit IRC | 09:53 | |
| *** avozza is now known as zz_avozza | 09:59 | |
| *** jamielennox is now known as jamielennox|away | 10:04 | |
| *** sluo_wfh has quit IRC | 10:07 | |
| *** zz_avozza is now known as avozza | 10:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Reference with the correct region id in `Region` table {WIP} https://review.openstack.org/142411 | 10:14 |
| *** aix has joined #openstack-keystone | 10:21 | |
| *** jamielennox|away is now known as jamielennox | 10:21 | |
| *** diegows has joined #openstack-keystone | 10:26 | |
| *** f13o has joined #openstack-keystone | 10:34 | |
| *** jamielennox is now known as jamielennox|away | 10:51 | |
| breton | how do I get my bp approved? | 11:37 |
| samuelms | breton, hi | 11:53 |
| samuelms | breton, so you have to submit a spec to keystone-specs | 11:53 |
| samuelms | breton, and then you will get reviews on that | 11:54 |
| samuelms | breton, as we do for code | 11:54 |
| samuelms | breton, an example is https://review.openstack.org/#/c/133855/ | 11:54 |
| *** dims has joined #openstack-keystone | 11:55 | |
| breton | samuelms: so, when spec gets merged, bp is automatically accepted? | 12:08 |
| breton | I'm also not sure that a spec is needed | 12:09 |
| breton | too bad I wrote it today, not before yesterday's meeting :( | 12:09 |
| samuelms | breton, well, once a spec is accepted, we still need to define the bp milestone | 12:13 |
| samuelms | breton, and then get it accepted | 12:13 |
| samuelms | breton, but spec merged is a prerequisite | 12:13 |
| *** afazekas has joined #openstack-keystone | 12:21 | |
| *** jorge_munoz has quit IRC | 12:29 | |
| *** jorge_munoz has joined #openstack-keystone | 12:30 | |
| *** jasondotstar has quit IRC | 12:31 | |
| *** aix has quit IRC | 12:42 | |
| *** lhcheng has joined #openstack-keystone | 12:54 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 12:55 |
| *** lhcheng has quit IRC | 12:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add positive test case for content types https://review.openstack.org/130591 | 13:16 |
| *** rushiagr is now known as rushiagr_away | 13:19 | |
| *** rushiagr_away is now known as rushiagr | 13:19 | |
| *** afazekas has quit IRC | 13:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Tests assert 200 on POST operations instead of 201 https://review.openstack.org/142440 | 13:23 |
| lbragstad | bknudson: I did some checking in test_content_types.py and there are several POST operations that assert 200 instead of 201. | 13:24 |
| lbragstad | bknudson: is that something about the v2.0 that I just don't know about? | 13:25 |
| *** afazekas has joined #openstack-keystone | 13:26 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Tests assert 200 on POST operations instead of 201 https://review.openstack.org/142440 | 13:33 |
| *** aix has joined #openstack-keystone | 13:35 | |
| *** jbonjean has quit IRC | 13:35 | |
| *** rushiagr is now known as rushiagr_away | 13:39 | |
| *** rushiagr_away is now known as rushiagr | 13:40 | |
| samuelms | breton, but spec merged is a prerequisite | 13:44 |
| *** rushiagr is now known as rushiagr_away | 13:44 | |
| samuelms | breton, well.. sorry, just repeated last message :p | 13:44 |
| *** rushiagr_away is now known as rushiagr | 13:46 | |
| *** hdd has joined #openstack-keystone | 13:50 | |
| *** radez_g0n3 is now known as radez | 14:11 | |
| morganfainberg | so we have a K1 tag | 14:14 |
| raildo | morganfainberg, great :) | 14:15 |
| morganfainberg | raildo thanks to everyone working so hard on the HMT stuff | 14:15 |
| rodrigods | morganfainberg, raildo \o/ | 14:16 |
| raildo | morganfainberg, no problem :) Thank you for the help all this time! | 14:16 |
| raildo | rodrigods, \o/ | 14:16 |
| rodrigods | morganfainberg, heard that we are close to a client release? Can be this considered: https://review.openstack.org/#/c/115770/12 ? | 14:23 |
| thiagop | morganfainberg: Our team also have this urge to bring HMT stuff to the end user on Horizon ASAP. Maybe you can take a look on this^ to help speed things up | 14:24 |
| *** richm1 has joined #openstack-keystone | 14:26 | |
| *** richm1 has left #openstack-keystone | 14:27 | |
| *** richm1 has joined #openstack-keystone | 14:28 | |
| *** hdd has quit IRC | 14:36 | |
| *** ajayaa has quit IRC | 14:41 | |
| *** gordc has joined #openstack-keystone | 14:41 | |
| *** pcaruana has quit IRC | 14:51 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix tests using extension drivers https://review.openstack.org/124603 | 14:51 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 14:51 |
| raildo | dstanek, I answered your questions in the reseller spec, and I asked a few questions to you in the spec. https://review.openstack.org/#/c/139824/8/specs/kilo/reseller.rst | 14:53 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 14:55 |
| marekd | dstanek: gabriel-bezerra can you please look into /var/log/shibboleth/signature.log files and tell me if you have anything there? | 14:56 |
| marekd | dstanek: gabriel-bezerra provifing you have used pysaml2 as idp only. | 14:56 |
| morganfainberg | thiagop: hi. I am planning on reviewing that today. | 14:56 |
| dstanek | marekd: i'll all good now - i just never got the mapping completed - assuming that there are attributes in the assertion | 14:56 |
| dstanek | raildo: looking now | 14:56 |
| thiagop | morganfainberg: glad to hear it. Thanks | 14:56 |
| raildo | dstanek, thanks | 14:57 |
| morganfainberg | rodrigods: I am going to start the process of the client release in a few minutes. Basically If it hasn't merged in an hour or so, I don't think it'll be in there. | 14:57 |
| marekd | dstanek: but still without validating assertion signature, right? | 14:57 |
| rodrigods | morganfainberg, ok... will ask for reviews :) | 14:57 |
| dstanek | marekd: no, i'm validating OK | 14:57 |
| morganfainberg | I'm looking at it now. | 14:58 |
| rodrigods | dstanek, bknudson, have a moment to take a look the client HMT part? https://review.openstack.org/#/c/115770/12 | 14:58 |
| marekd | morganfainberg: do you think Service Providers spec will also land in K1 ? | 14:59 |
| marekd | morganfainberg: it's https://review.openstack.org/#/c/135604/ | 15:00 |
| morganfainberg | Not in k1 | 15:00 |
| marekd | deadline is not tmrw? | 15:00 |
| morganfainberg | K1 is tomorrow officially. We have a tag already. | 15:00 |
| dstanek | raildo: i don't understand you comment about two tables? can a project with domainness hold resources like any other project or does it just act like a domain? | 15:00 |
| *** stevemar has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +v stevemar | 15:00 | |
| morganfainberg | marekd: well if it's gating yes. But spec approval in k1 or shortly after is no big deal. | 15:00 |
| morganfainberg | K2 is our spec proposal deadline. | 15:01 |
| marekd | morganfainberg: ok then. | 15:01 |
| morganfainberg | marekd: so I'm not rushed to squeeze a spec in last minute just for it to be in k1 :) | 15:01 |
| morganfainberg | Not that I would say it can't be in k1 | 15:01 |
| raildo | dstanek, project with domainess will working like a "normal' project but can working like a domain too | 15:01 |
| marekd | morganfainberg: SPs are already lots of +1 and two +2s so it's a matte of +A i guess | 15:01 |
| marekd | but its up to you | 15:02 |
| morganfainberg | Oh. Hm. Let me 2x check then | 15:02 |
| morganfainberg | When I get to the coffee shop I'm camping at today, I'll take a look. Might press +a before doing client release then. | 15:02 |
| dstanek | raildo: hmmm, i thought that it didn't - do a project can have users, vms and other projects that contains vms? | 15:03 |
| raildo | dstanek, yes :) | 15:03 |
| morganfainberg | marekd: the only question I have is your answer to the question to ecp vs SSO. | 15:04 |
| raildo | a project with the domainess flag enabled can do that | 15:04 |
| morganfainberg | I think it's fine as is, but I'd like a response to that comment before I +a | 15:04 |
| dstanek | raildo: :-( confusing | 15:05 |
| samuelms | morganfainberg, I've found a bug on inherited functionality | 15:05 |
| samuelms | morganfainberg, bug #1403539 | 15:05 |
| uvirtbot | Launchpad bug 1403539 in keystone "Can't create both inherited and direct role assignment on same entities" [Undecided,New] https://launchpad.net/bugs/1403539 | 15:05 |
| raildo | dstanek, hahaha maybe I can explain better | 15:05 |
| samuelms | morganfainberg, it affects inherited functionality on both domains and (now) projects | 15:05 |
| samuelms | dstanek, please also take a look at this bug ^ | 15:06 |
| samuelms | rodrigods, ^ | 15:06 |
| rodrigods | samuelms, ++ | 15:07 |
| dstanek | raildo: i don't think you need to explain it anymore - it feels weird form a consumer standpoint because you are reselling something to me that doesn't act like a domain or a project. so blogs/docs/etc will be confusing for me | 15:07 |
| dstanek | samuelms: do you really need to grant it twice? would it be better to have the inherited value of the existing assignment? | 15:08 |
| dstanek | samuelms: i'm just thinking from an admin's point of view looking at horizon | 15:09 |
| samuelms | dstanek, inherited flag just applies to subtree/projects under domain | 15:09 |
| samuelms | dstanek, it doesnt apply to the target itself | 15:09 |
| *** timcline has joined #openstack-keystone | 15:09 | |
| raildo | dstanek, I'm reselling for you a project/domain, So you can use this to user management(create user, groups and roles) and for control your resources. Is this weird? | 15:09 |
| *** ayoung has joined #openstack-keystone | 15:11 | |
| *** ChanServ sets mode: +v ayoung | 15:11 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove test PYTHONHASHSEED setting https://review.openstack.org/136593 | 15:12 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct version tests for result ordering https://review.openstack.org/138923 | 15:12 |
| stevemar | rodrigods, marekd, confirmed that the k2k user name issue was a bad mapping | 15:12 |
| stevemar | i'll send an email with a good mapping | 15:13 |
| rodrigods | stevemar, ++ | 15:14 |
| rodrigods | thanks | 15:14 |
| stevemar | np | 15:14 |
| dstanek | samuelms: then it's probably a valid bug - i'm interested to see how horizon shows it to the user because having a role on a thing that doesn't apply to the thing feels like it will be hard for users | 15:14 |
| dstanek | raildo: in that it can act like both yes | 15:14 |
| rodrigods | dstanek, about the horizon part, you may refer to thiagop | 15:15 |
| marekd | stevemar: can you be more specific? | 15:15 |
| rodrigods | dstanek, we are working in a design to better handle those cases (currently I *think* Horizon doesn't support inherited roles) | 15:15 |
| thiagop | rodrigods dstanek no, it doesn't. | 15:16 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: LDAP additional attribute mappings description https://review.openstack.org/118590 | 15:16 |
| stevemar | marekd, the mapping should look like this: http://paste.openstack.org/show/152289/ | 15:16 |
| dstanek | stevemar: my plan today was to finish up what i have completed on federation so i can push it (still work to be done) and then move the automating a k2k setup so that i can help debug the assertion signature issue | 15:16 |
| samuelms | dstanek, I guess horizon will show a tree, where a user should be able to select a project but the root one (except if he has an explicit role assignment there) | 15:17 |
| samuelms | dstanek, but yes, that sounds strange | 15:17 |
| stevemar | marekd, instead of: http://paste.openstack.org/show/152290/ | 15:17 |
| thiagop | we are working on a way to do that in way that it clarify for the users more than confuses them | 15:18 |
| stevemar | dstanek, nice, i had a guy internally try it all out, i was surprised he did it so quickly | 15:18 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 15:18 |
| dstanek | stevemar: would it be OK if they ran on the same some and shared everything except keystone.conf? | 15:19 |
| dstanek | stevemar: same certs, etc... | 15:19 |
| dstanek | stevemar: different DBs, of course | 15:19 |
| amakarov | ayoung, hi! I hope we can continue with trusts :) Can you please take a look at the spec? https://review.openstack.org/#/c/131541/ | 15:19 |
| stevemar | dstanek, oh good question, i'm not sure, we used two VMs | 15:20 |
| dstanek | stevemar: ok, well i guess i'll let you know then :-) | 15:20 |
| marekd | stevemar: yeah, that's why i opened this bug: https://bugs.launchpad.net/keystone/+bug/1401057 | 15:23 |
| uvirtbot | Launchpad bug 1401057 in keystone "Direct mapping in mapping rules don't work with keywords" [Undecided,New] | 15:23 |
| stevemar | marekd, good description ++ | 15:27 |
| *** jbonjean has joined #openstack-keystone | 15:30 | |
| *** hdd has joined #openstack-keystone | 15:32 | |
| stevemar | there seems to be a bug in a bunch of the python-*clients | 15:35 |
| stevemar | http://logs.openstack.org/79/142379/1/check//gate-python-openstackclient-python33/9de9d8a/console.html unable to build py33, related to docutils | 15:36 |
| *** tellesnobrega has quit IRC | 15:38 | |
| *** topol has joined #openstack-keystone | 15:41 | |
| *** ChanServ sets mode: +v topol | 15:41 | |
| morganfainberg | ok i'm about to release python-keystoneclient | 15:42 |
| morganfainberg | is there *anything* we're waiting on here? | 15:42 |
| lbragstad | what about https://review.openstack.org/#/c/130159/ | 15:42 |
| morganfainberg | ayoung, dolphm, dstanek, jamielennox|away, bknudson, topol, stevemar, rodrigods, marekd, lbragstad, ^ | 15:42 |
| morganfainberg | lbragstad, no bug/no bp and it's not clear to me why it's needed | 15:43 |
| lbragstad | morganfainberg: it's on dolphm's gist https://gist.github.com/dolph/651c6a1748f69637abd0 | 15:43 |
| morganfainberg | we can release again once we get it. | 15:43 |
| lbragstad | ok | 15:43 |
| lbragstad | curious | 15:43 |
| stevemar | morganfainberg, things aren't exactly building at the moment | 15:43 |
| morganfainberg | stevemar, gate? | 15:43 |
| morganfainberg | stevemar, or broken ksc? | 15:44 |
| topol | morganfainberg, 130159? It has two -1's on it. | 15:44 |
| stevemar | morganfainberg, no, something is hitting all clients, py33 jobs | 15:44 |
| stevemar | https://review.openstack.org/#/q/project:openstack/python-keystoneclient,n,z | 15:44 |
| stevemar | morganfainberg, it doesn't stop you from releasing, but it'll be a PITA if theres something wrong, and we are still stuck here | 15:45 |
| morganfainberg | stevemar, http://logs.openstack.org/44/141944/1/check//gate-tempest-dsvm-neutron-src-python-keystoneclient/c3b4bb9/console.html#_2014-12-16_21_05_56_450 | 15:45 |
| morganfainberg | stevemar, i can wait to push the tag. nbd | 15:45 |
| bknudson | https://review.openstack.org/#/c/132240/ | 15:45 |
| morganfainberg | i've already staged everything for the release so it's now just tag + release. | 15:45 |
| marekd | morganfainberg: i don't wait with anything close-to-be-merged to hold the release | 15:46 |
| morganfainberg | marekd, well sometimes there is something critical that is gating | 15:46 |
| morganfainberg | so worth checking :) | 15:46 |
| marekd | morganfainberg: i will need to drag some attention to few aspects in keystoneclient but not now. | 15:46 |
| marekd | morganfainberg: sure, i am just not shouting STOP | 15:46 |
| morganfainberg | bknudson, that one would be worth grabbing. | 15:46 |
| morganfainberg | marekd, ack | 15:46 |
| dstanek | marekd: try that link again | 15:46 |
| bknudson | https://review.openstack.org/#/c/118383/ | 15:46 |
| marekd | dstanek: sure | 15:46 |
| dstanek | marekd: that should be my current working config | 15:47 |
| morganfainberg | bknudson, ++ ok reviewing those two now. | 15:47 |
| dstanek | marekd: i've changed so much all over the place that i'm trying to gather everything together so i can reproduce this on another node using only the automation | 15:47 |
| *** LinstatSDR has joined #openstack-keystone | 15:47 | |
| bknudson | https://review.openstack.org/#/c/131408/ maybe | 15:47 |
| morganfainberg | bknudson, both look like they're worth seeing if we can land before the release. | 15:48 |
| marekd | dstanek: thanks a lot | 15:48 |
| marekd | i am going to check it now. | 15:48 |
| *** diegows has quit IRC | 15:48 | |
| morganfainberg | bknudson, hmm | 15:48 |
| LinstatSDR | Good morning guys. | 15:48 |
| dstanek | marekd: let me know :-) | 15:48 |
| marekd | dstanek: sure. | 15:48 |
| morganfainberg | bknudson, if we can land the last one i'll wait for it. if we can't i'm ok with another release in early jan to inclue it. | 15:49 |
| morganfainberg | bknudson, same with the HMT client code | 15:49 |
| bknudson | y, no reason we can't have another release tomorrow. | 15:49 |
| morganfainberg | we can | 15:49 |
| morganfainberg | :) | 15:49 |
| morganfainberg | but the first two you linked i think are worth really trying to land before this release | 15:50 |
| dstanek | morganfainberg: i have nothing specific that i'd like in the release | 15:51 |
| morganfainberg | dstanek, thanks. | 15:51 |
| marekd | dstanek: i owe you a beer | 15:52 |
| marekd | whenever we meet next time :-) | 15:53 |
| morganfainberg | stevemar, on,y +1 on https://review.openstack.org/#/c/118383/18 ? | 15:53 |
| dstanek | marekd: i love it when a plan comes together | 15:53 |
| marekd | :D | 15:53 |
| * marekd stupid | 15:53 | |
| stevemar | morganfainberg, because i like it but need to look at it more | 15:54 |
| morganfainberg | ah. | 15:54 |
| stevemar | morganfainberg, meh, i'll send an email out to the list about the client failures, i can't seem to get any traction on the channels | 15:57 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Adds inherited column to RoleAssignment PK https://review.openstack.org/142472 | 15:58 |
| samuelms | morganfainberg, ^ | 15:58 |
| morganfainberg | samuelms, oh boy | 15:58 |
| dstanek | bknudson: looking at the new test in https://review.openstack.org/#/c/118383/18/keystoneclient/tests/v3/test_service_catalog.py and i have no idea what cases are being tested | 15:59 |
| samuelms | morganfainberg, catch that when working on tests improvement for list role assignments | 16:00 |
| bknudson | dstanek: the monkey-patching is weird! | 16:00 |
| samuelms | morganfainberg, looks like we always had this bug, since Jul 5, 2013 when inherited role assignments to domains were introduced | 16:02 |
| marekd | stevemar: https://bugs.launchpad.net/keystone/+bug/1401057 do you think my comment (and the proposition for the solution at the same time) is valid? | 16:02 |
| uvirtbot | Launchpad bug 1401057 in keystone "Direct mapping in mapping rules don't work with keywords" [Undecided,New] | 16:03 |
| morganfainberg | bknudson, i've been staring at the monkeypatching | 16:03 |
| stevemar | marekd, i think so, when i first saw the mapping i thought it was invalid, so i was expecting a 40X error | 16:04 |
| morganfainberg | marekd, stevemar, just responded to the email as well. | 16:05 |
| morganfainberg | dstanek, yeah i am unsure about those tests | 16:06 |
| lbragstad | in case anyone's looking for an easy review https://review.openstack.org/#/c/125753/ | 16:10 |
| morganfainberg | ooh boy | 16:11 |
| morganfainberg | looks like zuul is backed up | 16:12 |
| morganfainberg | not sure why though | 16:12 |
| lbragstad | lol http://gatewatch.dolphm.com/ | 16:14 |
| lbragstad | well that escalated quickly | 16:14 |
| dstanek | raildo: so are you saying that any project with domain-ness will have a corresponding domain of the same name? | 16:19 |
| *** gordc has quit IRC | 16:23 | |
| ayoung | morganfainberg, sorry, was in a meeting...as far as I am concerned, there is nothing we are waiting on for a new release. The Client has the most important changes to support V3 everywhere: non-default-domains for service users. I'd like to get that out there ,as there is going to be deployment work that needs to be done based on it | 16:24 |
| morganfainberg | ayoung, no worries | 16:24 |
| ayoung | there will always be more client work to be done, so lets not hold up this bus; the next bus is coming | 16:24 |
| morganfainberg | ayoung, just was asking before doing the release. i'm giving a couple of patches chances to merge before tagging (and waiting for the gate to get below "wedged" looking) | 16:25 |
| ayoung | sounds good to me | 16:25 |
| morganfainberg | ayoung, if something is already gateing it sometimes is worth waiting. | 16:25 |
| ayoung | morganfainberg, jamielennox|away and I explicitly discussed this yesterday. The things we need are in the client already. | 16:25 |
| morganfainberg | ayoung, so that was more of a "do we have something that you're pushing into gate now and we should wait for" | 16:25 |
| morganfainberg | worst case i release it tonight | 16:25 |
| morganfainberg | ayoung, great | 16:25 |
| morganfainberg | ayoung, i've staged client and middleware milestones | 16:25 |
| ayoung | very good | 16:26 |
| morganfainberg | ayoung, i'm bumping ksc to 1.0.0 as a procedural thing | 16:26 |
| ayoung | ++ | 16:26 |
| morganfainberg | ayoung, i'll put 2.0.0 as a new release for future "if we're breaking compat" things and SDK doesn't end up being the place we go | 16:26 |
| ayoung | yep | 16:26 |
| marekd | stevemar: https://review.openstack.org/#/c/130564 please :-) | 16:27 |
| morganfainberg | nkinder, i really want to get no-rescope tokens in kilo | 16:27 |
| morganfainberg | nkinder, (re: the scoped token provides no benefit) | 16:27 |
| stevemar | classic nkinder, affected versions: ALL THE VERSIONS | 16:31 |
| nkinder | stevemar: :) | 16:31 |
| ayoung | morganfainberg, you mean "explicitl request unscoped tokens"? | 16:32 |
| nkinder | morganfainberg: I really want that too | 16:32 |
| morganfainberg | ayoung, no the "you can't rescope a scoped token" | 16:32 |
| nkinder | ayoung: restricting scope changes | 16:32 |
| ayoung | morganfainberg, we need the other first | 16:32 |
| nkinder | yes, they are hand-in-hand | 16:32 |
| morganfainberg | ayoung, the explicit unscoped token fix may be needed as well, but the one i am more interested in seeing (from a security perspective) is restricted rescoping | 16:32 |
| ayoung | morganfainberg, the horizon code needs to know that it is getting an unscoped token, and not revoke that when switching projects | 16:33 |
| morganfainberg | dolphm, ping - I can't change the active development series in ksc | 16:33 |
| morganfainberg | dolphm, in LP | 16:33 |
| morganfainberg | dolphm, any thing you can do? | 16:33 |
| morganfainberg | ayoung, i realize it ;) i think we're in vehement agreement here :P | 16:33 |
| ayoung | The thing we needed to nail down was how to specify that we were requesting an unscoped token. I think it is important that the Scope portion of the request be there, so that an older Keystone server that doesn't support can report the error | 16:33 |
| ayoung | OK...I can focus on that for a bit. | 16:34 |
| morganfainberg | ayoung, don't let that take you away from something you're elbow deep in. We can work on the scoped/unscoped stuff over k2, it's not a drop everything to get it done thing :) | 16:35 |
| morganfainberg | ayoung, i know sometimes jumping around makes it harder to get things landed (even when the gate isn't... wonky) | 16:35 |
| ayoung | morganfainberg, nah, its on my list, and important for our teams priorities | 16:35 |
| morganfainberg | ayoung, ack | 16:36 |
| ayoung | I have a bunch of the policy work under way, and so can continue to revise as I get this going. | 16:36 |
| morganfainberg | ayoung, just tyring to lookout for both your bandwidth as well as what is needed - you scale about as well as I do :P | 16:36 |
| ayoung | Fewer demands on me | 16:36 |
| morganfainberg | i think the priority over the next couple weeks is to land the specs. | 16:36 |
| morganfainberg | so midcycle is addressing the contentious specs, working through roadblocks on the current specs, etc | 16:37 |
| morganfainberg | and figuring if we have any SPD exceptions | 16:37 |
| ayoung | morganfainberg, what did you suggest again? "scope":"unscoped" doesn't quite ring true | 16:40 |
| morganfainberg | ayoung, there were two specs^w^wthree specs | 16:40 |
| morganfainberg | ayoung, explicit unscoped, you can't rescope a scoped token, session token (unscoped token extensions) | 16:41 |
| ayoung | morganfainberg, just for the request body | 16:41 |
| morganfainberg | ayoung, oh | 16:41 |
| morganfainberg | uh | 16:41 |
| ayoung | explicit unscoped | 16:41 |
| ayoung | it got approved | 16:41 |
| morganfainberg | i think we actually said scope: nil | 16:41 |
| morganfainberg | or whatever the json equiv, None? is | 16:41 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/kilo/explicit-unscoped.rst | 16:41 |
| morganfainberg | i don't think we said "unscoped" . but tbh, it wouldn't matter which one (i do prefer using None and Nil type constructs where possible vs. arbitrary strings, but this is pure personal taste) | 16:42 |
| ayoung | morganfainberg, so I don't want to make it None for fear of confusing things on the Python side; None vs "None" is nasty. It needs to be an explicit value, not "nothing specified in scope" as that will break things | 16:45 |
| ayoung | I'll start with "unscoped" for now | 16:46 |
| morganfainberg | ayoung, it depends on how Keystone handles that - but sure. | 16:46 |
| morganfainberg | ayoung, like i said, i'd be fine with either, slight personal preference isn't a huge factor | 16:46 |
| topol | morganfainberg is there a priority list of what keystone-specs need to be reviewed? | 16:47 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/controllers.py#n224 | 16:47 |
| * topol please dont say all of them.. please dont say all of them... :-) | 16:48 | |
| morganfainberg | topol, i'd say there are three on my short list and then the ones that we discussed at the summit | 16:48 |
| topol | morganfainberg, K, whats the short list? | 16:49 |
| morganfainberg | topol, short list: LDAP r/w (rax proposal, and they are very comitted to making that a reality) - no it wont break/change the current r/w model. | 16:49 |
| morganfainberg | topol, AE Tokens (anything besides ayoung's concerns, we'll circle up on those), the SP / K2K ones (from marek), | 16:49 |
| morganfainberg | and the HMT next steps (reseller) | 16:50 |
| topol | morganfainberg, OK, got it | 16:50 |
| morganfainberg | topol, we have plenty that should be doable in K | 16:50 |
| topol | morganfainberg, Yeah there is a lot there | 16:50 |
| morganfainberg | but those are the big-work ones, i left policy stuff ayoung is working on off the list because i know it's on the radar but i want him to drive the reviews on it - i knwo they've been a WIP on and off | 16:51 |
| morganfainberg | and the policy ones will likely split between kilo and L | 16:51 |
| morganfainberg | there is just so much in them | 16:51 |
| ayoung | policy is a long slog. We'll get something into K, but keep moving in L. I suspect the full thing will be there in L | 16:52 |
| morganfainberg | scafolding and basics in K, build on and improve in L | 16:52 |
| ayoung | Heh | 16:52 |
| morganfainberg | ayoung, ++ exactly | 16:52 |
| morganfainberg | ayoung, haha see we are on the same page about that stuff ;) | 16:52 |
| topol | morganfainberg, on https://review.openstack.org/#/c/140175/9/specs/kilo/read-write-ldap-drivers.rst I was just waiting for the spec author to push a patch that confirms what you said in your comment, viz. that downgrades will be supported | 16:54 |
| morganfainberg | topol, yeah you asked for the short list | 16:54 |
| morganfainberg | topol, i talked with them yesterday | 16:54 |
| morganfainberg | gave them feedback and asked them to look for RFC on ldap schema to reference for this stuff | 16:55 |
| morganfainberg | my understanding w/o hunting for an RFC (i'll do that this weekend) is that once defined the schema definitions shouldn't be changed, oids are effectively free | 16:55 |
| morganfainberg | make a new oid if you need to change things that would be incompatible (new MAYs are ok) | 16:56 |
| *** packet has joined #openstack-keystone | 16:56 | |
| topol | morganfainberg, makes sense! I'll wait for them to push a patch that addresses those aspects and then I think I'm good. | 16:57 |
| * topol Did anyone notice my cool use of "viz." in a sentence? I decided to try and sound sophisticated today | 16:57 | |
| bknudson | nobody's going to be able to use something that requires new schema. | 16:58 |
| amakarov | stevemar, hello! I've noticed, you are the author of notification logic for role_assignment operations. I want to change it a little and curios, why so special treatment for role_assignment? https://review.openstack.org/#/c/141854/ | 16:59 |
| morganfainberg | bknudson, for a pure read-write case, yes they will. if they're doing AD/LDAP read-only they can keep doing as they do now. | 17:00 |
| morganfainberg | bknudson, but it makes sense that if keystone is managing everything in the tree, it shouldn't be shoehorned around the default schema, we're within our rights to say "here is our schema that is full featured" | 17:01 |
| bknudson | I guess for read-write we don't want anybody to do it anyways, so might as well require schema changes. | 17:01 |
| *** harlowja_away is now known as harlowja | 17:01 | |
| morganfainberg | bknudson, there are people who do read-write, adn this would also be for assignment | 17:01 |
| morganfainberg | bknudson, if we are supporting read-write we might as well make it not an afterthought | 17:01 |
| *** cretz has quit IRC | 17:01 | |
| morganfainberg | which is what it feels like now. | 17:01 |
| bknudson | I think it's going to be too much work to treat it in the same class as sql. | 17:02 |
| bknudson | or it's going to really limit what we can do even with sql | 17:02 |
| stevemar | topol, you trying to be fancy with your words?! | 17:02 |
| bknudson | LDAP support is already way behind SQL. | 17:03 |
| morganfainberg | please comment on the spec, since it's not approved | 17:03 |
| lbragstad | so my question on this is how to make it so that the ldap schema just doesn't grow and grow | 17:03 |
| morganfainberg | if you want direction they're going with that, please ask. | 17:04 |
| morganfainberg | these are the kinds of things we need to answer before accepting the spec. | 17:04 |
| morganfainberg | lbragstad, the SQL schema mostly just grows and grows. | 17:04 |
| lbragstad | but with SQL we have the ability to provide migrations to change the representation of the data, if we have to | 17:05 |
| morganfainberg | lbragstad, and that was why i asked them to go look for the RFC on that. | 17:05 |
| morganfainberg | lbragstad, and migration framework might be a pre-req for this to be fully supported / non-expirimental | 17:05 |
| topol | lbragstad, Great question! | 17:05 |
| morganfainberg | lbragstad, so ask the question on the spec :) | 17:05 |
| *** rm_work|away is now known as rm_work | 17:06 | |
| topol | stevemar, I plan on trying to be sophisticated at lunch and get a drink with a small umbrella in it. It is getting close to the holidays | 17:06 |
| bknudson | this is what I was hinting at -- we'll have to do migrations for LDAP just like we do migrations for SQL | 17:06 |
| topol | bknudson, I posted similar comments on the spec | 17:07 |
| stevemar | topol, hopefully that lunch happens after our meeting :) | 17:07 |
| morganfainberg | the main reason this is on the short list is a) we generally agreed that it would be good to make ldap better and not this wierd mish-mash of read-only/read-write, b) we have a couple big players that use ldap-read-write, c) we have one that is willing to dedicate engineering resources to make it full-featured with full CI and address these challenges | 17:07 |
| morganfainberg | so, it's worth considering | 17:07 |
| bknudson | topol: btw - I did try escargot and steak tartar while in paris. | 17:08 |
| lbragstad | morganfainberg: I agree that it's worth considering, but from an LDAP perspective, how do the migrations work? | 17:08 |
| topol | bknudson, wow! and yet when you were here in Ralaigh you cringed when we suggested Indian food for lunch :-) | 17:08 |
| morganfainberg | lbragstad, that is part of what was asked of the proposers | 17:09 |
| bknudson | topol: I've had indian food... I like it but it doesn't like me. | 17:09 |
| morganfainberg | lbragstad, it is a work item to figure out | 17:09 |
| bknudson | went to an Indian place in paris with dims and others and did find something that I could agree with. | 17:10 |
| lbragstad | morganfainberg: I'm automatically hardcoded to think of migrations in terms of SQL :) | 17:10 |
| dstanek | ugg...back to the tcp4 vs. tcp6 thing on ubuntu | 17:10 |
| lbragstad | I'll leave some comments on the spec | 17:11 |
| morganfainberg | lbragstad, yeah this case the way i've handled that before is "new oid with script to move data from one object to another, if the object is incompat [chanigng/removing/adding MUSTs] | 17:11 |
| topol | morganfainberg++. The read write is important cuz folks are asking for it and are willing to work on it. I think they just need to declare how they will tackle some issues. I just remember the first time we tried this and made some mistakes (not enough stakeholder input) and I got torched by some folks at the Portland summit | 17:11 |
| morganfainberg | lbragstad, new MAYs can be added [but not removed] easily | 17:11 |
| morganfainberg | topol, exactly, people want ldap for $reasons$ | 17:12 |
| morganfainberg | topol, and i can come up with a ton of usecases (and where they tip over scale wise) | 17:12 |
| lbragstad | morganfainberg: so, does this mean that the schema defined for R/W LDAP is *absolutely* minimal and everything that needs to be tweaked, is tweaked as a MAY? | 17:13 |
| lbragstad | I'll ask that on the spec too ^ | 17:13 |
| *** hdd has quit IRC | 17:13 | |
| morganfainberg | topol, but most people wont hit those limits and will benefit from ldap - it also pushes us towards being able to (potentially) drop SQL identity on the floor and continue towards federated identity solutions out of the box | 17:13 |
| topol | thinking through versioning and downgrading are good topics that I was nudging folks to address so they don't get torched like I did. I still hear folks bitching about what we tried as an initial schema | 17:13 |
| morganfainberg | lbragstad, i don't have an answer to that, i think that is part of the spec/design process we're doing now: determine those answers | 17:13 |
| topol | morganfainberg, Yeah I am on board with this as well. | 17:14 |
| lbragstad | ok | 17:14 |
| *** jdennis1 has joined #openstack-keystone | 17:15 | |
| *** jdennis has quit IRC | 17:17 | |
| *** LinstatSDR has quit IRC | 17:17 | |
| topol | morganfainberg, stevemar, lbragstad, the feedback on the first time we tried this is well characterized by the following simpsons clip: https://www.youtube.com/watch?v=IRm7utSYpwk | 17:17 |
| *** LinstatSDR has joined #openstack-keystone | 17:18 | |
| * morganfainberg will need to wathc that later | 17:18 | |
| topol | Its 20 seconds of screaming "what were you thinking" Which is what we heard a lot in Portland :-) | 17:18 |
| topol | stevemar my lunch is after our 12:30 meeting | 17:19 |
| morganfainberg | haha | 17:20 |
| morganfainberg | well i think that we can solve this nice and cleanly | 17:20 |
| stevemar | topol, excellent, then we will watch billy and the cloneasaurus | 17:20 |
| topol | stevemar did you figure that out with out looking at the clip? | 17:20 |
| morganfainberg | and i think if we look at it as a way to leverage the ldap implementations that make better IDPs (for the identity side at least) as our baseline, so we don't need to implement all the crazy idp-workflows, it'll be an easier sell | 17:21 |
| morganfainberg | topol, i also think that the identity/assignment split will work in our favor this time, less trying to wedge everyhting into ldap if people don't want it | 17:21 |
| topol | morganfainberg. I absolutely agree. My comments on the sec I think are easily addressed given how things are today as opposed to back then | 17:22 |
| topol | err on the spec | 17:22 |
| dims | bknudson: glad to have your company :) | 17:22 |
| *** gyee has joined #openstack-keystone | 17:23 | |
| *** ChanServ sets mode: +v gyee | 17:23 | |
| *** gyee has quit IRC | 17:24 | |
| *** gyee has joined #openstack-keystone | 17:25 | |
| *** ChanServ sets mode: +v gyee | 17:25 | |
| rodrigods | morganfainberg, was afk (lunch time), did you trigger the client releaes? | 17:25 |
| morganfainberg | nope, waiting on some gate stuff | 17:25 |
| rodrigods | morganfainberg, ok the HMT patch didn't receive reviews =( | 17:26 |
| *** _cjones_ has joined #openstack-keystone | 17:34 | |
| *** _cjones_ has quit IRC | 17:34 | |
| *** _cjones_ has joined #openstack-keystone | 17:34 | |
| morganfainberg | rodrigods, we will at worst do another release in early january | 17:37 |
| morganfainberg | rodrigods, it still has time to get into the gate - i am definitely releasing tonight provided gate is happy [in case we have emergencies to fix it] | 17:37 |
| rodrigods | ok, thanks morganfainberg | 17:38 |
| morganfainberg | rodrigods, we could release another client tomorrow if we really wanted to | 17:39 |
| *** marcoemorais has joined #openstack-keystone | 17:39 | |
| *** zzzeek has joined #openstack-keystone | 17:42 | |
| *** avozza is now known as zz_avozza | 17:42 | |
| rodrigods | ayoung, bknudson, dolphm, stevemar, henrynash, gyee sorry for being asking for this, but since Keystone has the K1 tag and HMT is in it, we'd appreciate if this https://review.openstack.org/#/c/115770/ enter the next release from keystoneclient. We have some work in Horizon that directly depends on it. We are available for immediate fixes, if necessary. | 17:42 |
| *** marcoemorais has quit IRC | 17:44 | |
| *** marcoemorais has joined #openstack-keystone | 17:44 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:45 | |
| *** amakarov is now known as amakarov_away | 17:45 | |
| *** marcoemorais2 has joined #openstack-keystone | 17:45 | |
| *** marcoemorais1 has quit IRC | 17:46 | |
| *** marcoemorais2 has joined #openstack-keystone | 17:46 | |
| *** marcoemorais2 has quit IRC | 17:46 | |
| *** marcoemorais1 has joined #openstack-keystone | 17:46 | |
| *** marcoemorais has quit IRC | 17:49 | |
| gyee | rodrigods, looking ... | 17:49 |
| morganfainberg | gyee oh hi! | 17:50 |
| morganfainberg | gyee, please weigh in on the LDAP read/write spec when you have a moment. | 17:50 |
| morganfainberg | questions / concerns etc would be helpful. | 17:50 |
| morganfainberg | samuelms, i'll need to look at that bug when i get a plug for my laptop | 17:50 |
| openstackgerrit | ayoung proposed openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 17:50 |
| morganfainberg | rodrigods, raildo, had a great caipirinha on sunday night | 17:52 |
| morganfainberg | rodrigods, raildo, figured you'd apreciate it. | 17:52 |
| *** diegows has joined #openstack-keystone | 17:52 | |
| rodrigods | morganfainberg, yes! cachaça (the drink which caipirinha is made of) is really common in our region :) | 17:53 |
| morganfainberg | rodrigods, i know! | 17:53 |
| morganfainberg | rodrigods, i need to visit brazil! | 17:53 |
| morganfainberg | :) | 17:53 |
| gabriel-bezerra | marekd: that file is empty here. | 17:53 |
| *** thedodd has joined #openstack-keystone | 17:54 | |
| rodrigods | morganfainberg, we have an one month party in our city (in June), which cachaça is the typical drinking | 17:54 |
| morganfainberg | hehe | 17:54 |
| rodrigods | morganfainberg, feel invited to come here to have some cachaça with us | 17:55 |
| morganfainberg | will do. esp. if there is a business reason to be in brazil. | 17:55 |
| morganfainberg | :) | 17:55 |
| morganfainberg | ok heading back to the hotel so that i can get my laptop plugged in... | 17:55 |
| rodrigods | gyee, thanks, any comments we are ready here to fix them | 17:56 |
| morganfainberg | Going to check on gate status and such when j get back and see about the releases. | 17:56 |
| *** lhcheng has joined #openstack-keystone | 17:57 | |
| *** lhcheng_ has joined #openstack-keystone | 18:00 | |
| gyee | morganfainberg, sure, on it | 18:01 |
| *** thedodd has quit IRC | 18:01 | |
| *** lhcheng has quit IRC | 18:03 | |
| gyee | rodrigods, I presume you have another patch for openstackclient? | 18:09 |
| rodrigods | gyee, yes | 18:09 |
| gyee | awesome | 18:09 |
| rodrigods | gyee, currently marked as WIP, just waiting for the keystoneclient part to land :) | 18:10 |
| gabriel-bezerra | marekd, dstanek: have you got the attributes passed in the aassertion from the pysaml2 example IdP? I was having a look at its code to try to discover why it is not being passed | 18:11 |
| gyee | rodrigods, I see. I am kinda curious how you render the tree from CLI | 18:11 |
| dstanek | gabriel-bezerra: is it not being passed? i haven't gotten back to that yet | 18:12 |
| rodrigods | gyee, I think we display a column with the ids | 18:12 |
| rodrigods | gyee, If I remember correctly | 18:12 |
| gyee | rodrigods, no christmas tree?!! :) | 18:12 |
| rodrigods | gyee, heh | 18:12 |
| *** aix has quit IRC | 18:15 | |
| *** thedodd has joined #openstack-keystone | 18:15 | |
| dstanek | gabriel-bezerra: did you verify that they are not being sent? | 18:18 |
| *** lhcheng_ is now known as lhcheng | 18:18 | |
| gabriel-bezerra | dstanek: the haho0032 user, which has more info than any other, has only an attribute in the assertion: edupersontargetedid -> one!for!all | 18:19 |
| dstanek | gabriel-bezerra: there may be a config value that controls putting the attributes in there | 18:20 |
| gabriel-bezerra | dstanek: I'm wondering if there is anything in the metadata of the sp about that as well | 18:21 |
| dstanek | gabriel-bezerra: i don't think the SP will control what the IdP sends - it will limit what shows up in the env though | 18:22 |
| gabriel-bezerra | dstanek: I'd look for something like "types of data that this SP recognizes" in the metadata | 18:22 |
| gabriel-bezerra | dstanek: btw, it is possible to configure "remote" sources of metadata in the idp configuration -- recall that I suggested putting the metadata in a file and referencing that file in the idp_conf | 18:24 |
| dstanek | gabriel-bezerra: right now i am only using the urls to the metadata. no more local file stuff | 18:25 |
| gabriel-bezerra | dstanek: https://pythonhosted.org/pysaml2/howto/config.html#metadata | 18:26 |
| gabriel-bezerra | dstanek: like the "remote" list in the code sample of that link? | 18:27 |
| rushiagr | ayoung: Hi | 18:28 |
| rushiagr | ayoung: Please have a look at my comments on https://review.openstack.org/#/c/136980/ when you have time. Let me know if you have concerns, and I'll address them | 18:28 |
| gabriel-bezerra | dstanek: sequence of (url: _, cert: _) maps | 18:28 |
| rushiagr | ayoung: thanks :) | 18:28 |
| dstanek | gabriel-bezerra: i'll post the most recent version of my config in a few | 18:29 |
| *** marcoemorais1 has quit IRC | 18:30 | |
| dstanek | gabriel-bezerra: i'm actively pushing bits and pieces to https://github.com/dstanek/keystone/tree/functonal-testing so i can push stuff around onto new nodes | 18:30 |
| *** marcoemorais has joined #openstack-keystone | 18:30 | |
| dstanek | gabriel-bezerra: please don't clone though because i am force pushing | 18:30 |
| *** marcoemorais has quit IRC | 18:31 | |
| *** marcoemorais has joined #openstack-keystone | 18:31 | |
| gabriel-bezerra | dstanek: sure. | 18:31 |
| *** marcoemorais has quit IRC | 18:32 | |
| *** marcoemorais has joined #openstack-keystone | 18:32 | |
| gabriel-bezerra | dstanek: It's a nice set of changes, btw. | 18:34 |
| gabriel-bezerra | dstanek: I'm wondering about the meaning of this command line argument: | 18:40 |
| gabriel-bezerra | 1005 parser.add_argument('-s', dest='sign', action='store_true', | 18:40 |
| gabriel-bezerra | 1006 help="sign the metadata") | 18:40 |
| gabriel-bezerra | dstanek: in idp.py | 18:41 |
| gabriel-bezerra | dstanek: if it can help in the "Unable do establish security of incoming assertion" | 18:41 |
| dstanek | gabriel-bezerra: i already have that fixed by adding config values | 18:42 |
| dstanek | gabriel-bezerra: search for sign_ in http://23.253.156.66/media/idp_conf.py | 18:42 |
| *** thiagop has quit IRC | 18:45 | |
| dstanek | gabriel-bezerra: although that may be a shortcut so i don't have to change the config file | 18:45 |
| gabriel-bezerra | dstanek: it worked here. It's better than using the NullSecurity policy as me and marekd have done | 18:47 |
| morganfainberg | nkinder, ALARMING VERBIAGE!! | 18:48 |
| nkinder | morganfainberg: that just means that the security note has done it's job (raise awareness) :) | 18:48 |
| morganfainberg | nkinder, yep | 18:48 |
| morganfainberg | nkinder, i also just responded | 18:48 |
| *** afaranha has quit IRC | 18:49 | |
| morganfainberg | nkinder, i thought your write up was quite nice - explained things well | 18:49 |
| dstanek | gabriel-bezerra: yeah, i got around it by fixing the config files | 18:49 |
| lbragstad | jorge_munoz: fyi, here is the RFC for ldap https://tools.ietf.org/html/rfc4512 | 18:58 |
| lbragstad | jorge_munoz: or one of them | 18:58 |
| jorge_munoz | lbragstad: thanks | 18:59 |
| *** gyee has quit IRC | 19:00 | |
| *** afazekas has quit IRC | 19:02 | |
| *** marcoemorais has quit IRC | 19:05 | |
| *** gyee has joined #openstack-keystone | 19:06 | |
| *** ChanServ sets mode: +v gyee | 19:06 | |
| *** raildo_ has joined #openstack-keystone | 19:07 | |
| *** hdd has joined #openstack-keystone | 19:10 | |
| *** ajayaa has joined #openstack-keystone | 19:15 | |
| *** chrisshattuck has joined #openstack-keystone | 19:16 | |
| *** rushiagr is now known as rushiagr_away | 19:18 | |
| *** raildo_ has quit IRC | 19:22 | |
| *** ajayaa has quit IRC | 19:23 | |
| *** ajayaa has joined #openstack-keystone | 19:25 | |
| *** nellysmitt has quit IRC | 19:26 | |
| stevemar | dstanek, what trickery are you up to? | 19:26 |
| dstanek | stevemar: trying to get the automation to work :-) i did so much hacking all over the place to setup keystone federation that i can't find all the places! | 19:27 |
| samuelms | haha | 19:27 |
| samuelms | :-) | 19:27 |
| morganfainberg | so, i'm hesitant to push a tag with the gate in the state it is. | 19:28 |
| dstanek | i have no idea how a deployer can do this for real | 19:28 |
| morganfainberg | soooo i'm going to wait until it wont be $unknown_time_until_something_something before we can push a fix if something is going on | 19:28 |
| morganfainberg | this may mean the tag is pushed tomorrow instead of today | 19:29 |
| morganfainberg | jamielennox|away, ^ re: client and middleware | 19:29 |
| ayoung | rushiagr_away, have you seen all the policy work that is in flight? Take a look at this summary when you get a chance: https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/ | 19:29 |
| *** fifieldt_ has quit IRC | 19:30 | |
| *** rushiagr_away is now known as rushiagr | 19:32 | |
| *** 21WAAOJ1V has joined #openstack-keystone | 19:34 | |
| stevemar | dstanek, update your WIP patch and i'll review it :) | 19:35 |
| stevemar | your hacking is all over the place | 19:35 |
| *** dims has quit IRC | 19:35 | |
| dstanek | stevemar: yes, yes it is | 19:35 |
| *** dims has joined #openstack-keystone | 19:36 | |
| dstanek | stevemar: trying to get it updated now by adding the hacking as additional automation or config changes | 19:36 |
| dstanek | stevemar: i've been pushing stuff here for now https://github.com/dstanek/keystone/tree/functonal-testing | 19:36 |
| stevemar | ah okay | 19:36 |
| *** 21WAAOJ1V has quit IRC | 19:36 | |
| *** afaranha has joined #openstack-keystone | 19:37 | |
| *** gordc has joined #openstack-keystone | 19:40 | |
| *** dims has quit IRC | 19:40 | |
| *** raildo_ has joined #openstack-keystone | 19:44 | |
| *** fifieldt_ has joined #openstack-keystone | 19:46 | |
| dstanek | stevemar: like this crap - i forgot how i made mod_shib sign it's metadata | 19:47 |
| stevemar | did you use the keystone-manage utility we added in juno? | 19:49 |
| dstanek | stevemar: to do what? | 19:49 |
| stevemar | dstanek, get the metadata | 19:49 |
| dstanek | stevemar: that's for k2k right? | 19:50 |
| *** aix has joined #openstack-keystone | 19:52 | |
| *** Tahmina has joined #openstack-keystone | 19:56 | |
| *** rushiagr is now known as rushiagr_away | 19:58 | |
| stevemar | dstanek, yesh, i see your problem now :) by you can use the same pysaml2 function to create it | 19:59 |
| gyee | morganfainberg, I am not convinced about R/W LDAP driver, seem like a lot of work for very little benefit | 19:59 |
| dstanek | stevemar: i'm looking to get the metadata from the SP signed | 19:59 |
| gyee | I'd be OK with it being out-of-tree | 20:00 |
| morganfainberg | gyee, please comment on the spec. we have a couple large players that actually use r/w ldap, one that is willing to put a lot of engineering resources behind this - and I see it as a path to leverage ldap to do the stuff that SQL identity does very badly | 20:00 |
| morganfainberg | gyee, i'd like to dump sql identity, and we will need some form of internal identity - i don't want to move sql idenitty forward and need to implement all the things that slapd, etc can do for us. | 20:00 |
| morganfainberg | gyee, so - please comment on the spec :) if it's not worth accepting it isn't. but i'd like comments and the like recorded because that is the basis we're going to use to determine the value | 20:01 |
| dstanek | stevemar: ah wait, maybe i never got this working without a "fix" to pysaml2 | 20:01 |
| gyee | morganfainberg, I would like to see separating out IdP work done first | 20:01 |
| morganfainberg | gyee, because it also allows the proposer to reply to the comment. | 20:01 |
| gyee | I do understand the motivation | 20:02 |
| morganfainberg | gyee, this is a big job to do, it has a lot of peices, we may be able to get that as part of this spec. | 20:02 |
| morganfainberg | gyee, we *may* need to invert that priority, but we may not. | 20:02 |
| gyee | LDAP is made for static data such as identity | 20:02 |
| morganfainberg | gyee, my goal here is to get the clear feedback to the proposers and get the conversation going so we have a clear set of goals / ideas on if we want this in-tree | 20:03 |
| morganfainberg | gyee, assignment is fairly static data as well fwiw. tokens are not | 20:03 |
| gyee | if we separate out IdP, and backing it with LDAP that would make sense | 20:03 |
| morganfainberg | gyee, keystone's data set as a whole is fairly static even at the SP level. | 20:03 |
| dstanek | stevemar: yes this is result of me fixing https://github.com/rohe/pysaml2/blob/master/src/saml2/mdstore.py#L635 to have an optional cert since https://github.com/rohe/pysaml2/blob/master/src/saml2/mdstore.py#L655 implies that it's optional | 20:04 |
| morganfainberg | gyee, like i said, not saying we have to accept this but i really want whatever feedback available logged in the spec - | 20:04 |
| gyee | k, I'll comment on it | 20:05 |
| *** nellysmitt has joined #openstack-keystone | 20:05 | |
| stevemar | dstanek, ahh time for a PR | 20:09 |
| *** LinstatSDR has quit IRC | 20:10 | |
| dstanek | stevemar: exactly | 20:13 |
| *** raildo_ has quit IRC | 20:14 | |
| *** thiagop has joined #openstack-keystone | 20:19 | |
| raildo | dstanek, I answered your questions in the Reseller spec: https://review.openstack.org/#/c/139824/ | 20:27 |
| raildo | dstanek, and if you have same free time, please review the spec about the HMT improvements :) https://review.openstack.org/#/c/135309/ | 20:27 |
| *** drjones has joined #openstack-keystone | 20:29 | |
| *** _cjones_ has quit IRC | 20:29 | |
| openstackgerrit | Victor Silva proposed openstack/keystone: Identify groups by name/domain in mapping rules. https://review.openstack.org/139013 | 20:32 |
| openstackgerrit | Victor Silva proposed openstack/keystone: Implements whitelist and blacklist mapping rules https://review.openstack.org/142573 | 20:32 |
| rodrigods | marekd, ^ | 20:32 |
| rodrigods | nkinder, ^ | 20:33 |
| *** LinstatSDR has joined #openstack-keystone | 20:34 | |
| dstanek | gabriel-bezerra: the -s didn't seem to work...i still needed my config values | 20:38 |
| bknudson | looks like keystoneclient py33 jobs are not working | 20:42 |
| morganfainberg | bknudson, yep. something with PBR or sphinx... | 20:43 |
| bknudson | NameError: name 'StandardError' is not defined | 20:43 |
| bknudson | seems like StandardError should be defined | 20:43 |
| morganfainberg | bknudson, there is a bug (not attached to ksc) and a ML topic | 20:43 |
| * morganfainberg looks for it | 20:43 | |
| *** gordc has quit IRC | 20:43 | |
| bknudson | I blame stevemar | 20:43 |
| morganfainberg | but yes, it's known issue and dstufft has been working on it | 20:43 |
| morganfainberg | bknudson, good person to blame | 20:44 |
| dstanek | StandardError should *always* be there unless magic is breaking | 20:44 |
| dstanek | send the unicorns to aid infra! | 20:44 |
| stevemar | bknudson, blame me because i mentioned it at 10am? | 20:47 |
| bknudson | stevemar: who smelt it dealt it. | 20:47 |
| bknudson | at 10am | 20:47 |
| stevemar | gah! that rule bites me again | 20:47 |
| *** r-daneel has joined #openstack-keystone | 20:49 | |
| *** drjones has quit IRC | 20:51 | |
| *** ajayaa has quit IRC | 20:53 | |
| stevemar | can i get another core on https://review.openstack.org/#/c/142192/1 it's super easy | 20:54 |
| gyee | stevemar, indeed | 20:55 |
| stevemar | ty gyee ! | 20:55 |
| *** dims has joined #openstack-keystone | 20:58 | |
| *** thedodd has quit IRC | 20:58 | |
| *** mancdaz has quit IRC | 21:02 | |
| *** mancdaz has joined #openstack-keystone | 21:03 | |
| *** thedodd has joined #openstack-keystone | 21:03 | |
| *** __TheDodd__ has joined #openstack-keystone | 21:07 | |
| *** thedodd has quit IRC | 21:09 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix RST formatting issues https://review.openstack.org/141930 | 21:10 |
| *** Tahmina has quit IRC | 21:10 | |
| *** nellysmitt has quit IRC | 21:11 | |
| openstackgerrit | Thiago Paiva Brito proposed openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 21:13 |
| richm1 | stevemar: ping - re: openstack endpoint create vs. keystone endpoint-create | 21:14 |
| richm1 | with keystone endpoint-create I can use --publicurl --adminurl and --internalurl to create the endpoint with all 3 urls | 21:17 |
| stevemar | richm1, oye the endpoint commands are a pain, so are the catalog/service ones, but whats up | 21:17 |
| richm1 | so if I want to do the same thing with openstack, I need to make 3 calls, one for each interface? | 21:17 |
| stevemar | richm1, let me look at the command | 21:18 |
| stevemar | richm1, we talking v2 or v3 | 21:18 |
| *** raildo has quit IRC | 21:18 | |
| richm1 | hmm - it is different | 21:19 |
| *** mancdaz has quit IRC | 21:19 | |
| richm1 | ok - another item for the v2/v3 upgrade list | 21:19 |
| *** mancdaz has joined #openstack-keystone | 21:19 | |
| ayoung | morganfainberg, when looking for LDAP input, ask nkinder as he's a long time LDAP hacker | 21:20 |
| stevemar | richm1, yeah, looks like the v3 one was changed to account for the v3 API | 21:20 |
| stevemar | richm1, http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#create-endpoint | 21:20 |
| richm1 | ok | 21:20 |
| morganfainberg | ayoung, always try to | 21:20 |
| ayoung | so do you really think we can dump SQL Identity? | 21:20 |
| morganfainberg | ayoung, if we have a really good r/w (with migration path) ldap story - yes | 21:21 |
| stevemar | richm1, i suppose we could take in those three parameters and call it three times under the covers... | 21:21 |
| ayoung | morganfainberg, cool | 21:21 |
| richm1 | stevemar: no, no worries | 21:21 |
| richm1 | stevemar: will just have to wrap it in the puppet-keystone code | 21:22 |
| morganfainberg | ayoung, but it's a long play - and it doesn't mean we're out of the identity management side, we just shift it to something we don't need to write the whole story for. | 21:22 |
| ayoung | morganfainberg, that would mean that we could potentially use the Keystone database for the Virtual Machines.... | 21:22 |
| ayoung | I like this | 21:22 |
| morganfainberg | ayoung, i'm not willing to jump *that* far ahead - want to see us reach some form of consensus on the direction before getting too optimistic | 21:22 |
| ayoung | morganfainberg, actually, there is no reason we couldn't do it now with LDAP as is, just that it could become the norm | 21:23 |
| morganfainberg | ayoung, i also want to use this to solve the PII problem / split identity and try and make our default story "federated" | 21:23 |
| morganfainberg | ayoung, well i don't think we can do it now. the ldap r/w story is bad in keystone | 21:23 |
| morganfainberg | it's mostly an after thought | 21:23 |
| morganfainberg | well.. feels like at at least | 21:23 |
| ayoung | morganfainberg, well, LDAP is pretty sloppy code, but the R/W aspect of it is no worse, I think, than the core LDAP code | 21:24 |
| morganfainberg | ayoung, the r/w aspect was bolted onto the core - which made us compromise more on the core | 21:25 |
| ayoung | not really. It was w/r from the get go | 21:25 |
| morganfainberg | ayoung, so we didn't optimise for r/o, and we wedged r/w into the same model | 21:25 |
| ayoung | even before I inherited it | 21:25 |
| morganfainberg | ayoung, well over time - it has moved more and more r/w feels just kindof bolted on the side of the r/o | 21:25 |
| bknudson | there's all sorts of things that don't work with LDAP | 21:26 |
| ayoung | just less common code path. But I think we are in sync in vision | 21:26 |
| morganfainberg | bknudson, agree, tons of features that are sub-par on both sides | 21:26 |
| ayoung | its more because we've put in much more work to dealing with AD and the other R/O use cases | 21:26 |
| ayoung | I'd love to be able to use the FreeIPA API for writing LDAP | 21:27 |
| ayoung | but that would not work for CERN | 21:27 |
| morganfainberg | so anyway | 21:27 |
| ayoung | They need explicitly Active Directory | 21:28 |
| bknudson | I think deployers would be better doing their own writes to LDAP... just write a little script to add roles and stuff | 21:28 |
| ayoung | morganfainberg, I've got a POC of unscoped to scoped only. Only made it work on v3 so far | 21:28 |
| ayoung | its pretty trivial. Want me to post it WIP, or wait till I get V2 working too? | 21:28 |
| morganfainberg | ayoung, i saw you propose it. | 21:28 |
| morganfainberg | ayoung, or was that something else? | 21:28 |
| ayoung | no, I mean the second part | 21:28 |
| morganfainberg | ayoung, oh sure WIP it. | 21:29 |
| ayoung | I got the "explicit uncoped" working already | 21:29 |
| morganfainberg | ayoung, up to you | 21:29 |
| ayoung | let me get v2... | 21:29 |
| morganfainberg | bknudson, i don't think it's reasonable to ask deployers to write something that caters to *our* definition like that. | 21:29 |
| ayoung | issue is testing. v2 to v2 v3 to 3 v3 to v2 and v2 to v3 | 21:29 |
| bknudson | morganfainberg: it's not ours, it's their LDAP. | 21:29 |
| ayoung | R/W ldap is much more opinionated than Read Only | 21:30 |
| morganfainberg | ayoung, ++ | 21:30 |
| morganfainberg | r/o yes, it's on them | 21:30 |
| stevemar | r/w ldaps are headachey | 21:31 |
| morganfainberg | r/w if we're supporting and maintaining it, should be opinionated and really a first-class backend not "well, sortof" | 21:31 |
| ayoung | you should have seen the custom schema in the LDAP impl before mine | 21:31 |
| bknudson | there should be a section in the spec that requires LDAP consideration then. | 21:31 |
| morganfainberg | and we do have an engineering team willing to push on this and make it a reality, so we should comment on the spec. | 21:31 |
| morganfainberg | bknudson, if we accept this r/w spec we should probably do that | 21:31 |
| morganfainberg | bknudson, or when we make an effort to make ldap better than "sortof working for limited cases" we should. | 21:32 |
| morganfainberg | bknudson, this is all stuff i'd like to see commented on that spec. | 21:32 |
| morganfainberg | bknudson, it will help us get a feel of where the proposers want to go, how far they're willing to, and if we like the direction. | 21:33 |
| openstackgerrit | Thiago Paiva Brito proposed openstack/python-keystoneclient: Implementing hierarchical calls on keystoneclient v3 (python only) https://review.openstack.org/115770 | 21:33 |
| *** __TheDodd__ has quit IRC | 21:39 | |
| *** topol has quit IRC | 21:40 | |
| ayoung | bknudson, any idea where the old V2 API examples are? We seem to have only the V3 ones now | 21:50 |
| *** _cjones_ has joined #openstack-keystone | 21:51 | |
| bknudson | ayoung: curl examples? | 21:51 |
| *** _cjones_ has quit IRC | 21:53 | |
| *** _cjones_ has joined #openstack-keystone | 21:53 | |
| ayoung | bknudson, yeah...although I think I have it | 21:53 |
| ayoung | from looking at the code, anyway. | 21:53 |
| bknudson | ayoung: these are v2: http://docs.openstack.org/developer/keystone/api_curl_examples.html#admin-api-examples-using-curl | 21:54 |
| bknudson | http://docs.openstack.org/developer/keystone/api_curl_examples.html#service-api-examples-using-curl | 21:54 |
| bknudson | for some reason it's called "service" api. | 21:54 |
| ayoung | bknudson, oik, didn't see the v2 stuff in there...but still doesn;t show token for token...still, think I have it | 21:56 |
| *** dims has quit IRC | 22:04 | |
| openstackgerrit | ayoung proposed openstack/keystone: Unscoped to Scoped only https://review.openstack.org/142591 | 22:17 |
| *** ayoung is now known as ayoung_dreidl | 22:18 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Support for running functional federation tests https://review.openstack.org/139137 | 22:18 |
| dstanek | stevemar: gabriel-bezerra: ^ the latest and greatest | 22:18 |
| stevemar | dstanek, already have it open | 22:18 |
| dstanek | not i have to figure out the attribute issue | 22:19 |
| dstanek | s/not/now/ | 22:19 |
| dstanek | stevemar: i need to write up a readme, but that will standup a pysaml idp, configure keystone to use federation and run a test to make sure things are properly wired together | 22:20 |
| stevemar | dstanek, that is freaking awesome | 22:21 |
| stevemar | dstanek, use the rules i sent out over the email :) https://review.openstack.org/#/c/139137/2/functional_tests/federation/devstack/files/key-federation-setup.py | 22:21 |
| dstanek | stevemar: not yet - once the attributes and mapping are there and working then i'll be happy | 22:21 |
| dstanek | stevemar: yes, i was planning on it - just have to find out why no attributes are getting into the assertion | 22:22 |
| stevemar | yep | 22:22 |
| stevemar | thats lookin pretty solid | 22:23 |
| dstanek | i probably need to convert that to bash using some of the devstack functions, but since it didn't have all of them using Python was quicker to start | 22:23 |
| stevemar | dstanek, fwiw, there is pretty decent support from OSC for federation stuff, like creating mappings/idps/protocols | 22:24 |
| morganfainberg | dstanek, /me goes and runs that in an existing devstack :P | 22:24 |
| stevemar | morganfainberg, gad! it says right there! | 22:25 |
| stevemar | :P | 22:25 |
| morganfainberg | but... | 22:25 |
| morganfainberg | ;) | 22:25 |
| *** thedodd has joined #openstack-keystone | 22:27 | |
| *** zz_avozza is now known as avozza | 22:28 | |
| *** LinstatSDR has quit IRC | 22:28 | |
| *** dims__ has joined #openstack-keystone | 22:29 | |
| dstanek | morganfainberg: poof - no warranty | 22:30 |
| dstanek | also only works in Ubuntu right now because i haven't tried Fedora at all yet | 22:31 |
| morganfainberg | ehe | 22:32 |
| dstanek | i found out that Apache is stupid this morning | 22:35 |
| dstanek | mod_shib failed because i messed up some XML and Apache started find, but all client requests hung forever | 22:35 |
| dstanek | took me a half hour before i decided to look at the error log because Apache told me it started and was running fine | 22:36 |
| *** marcoemorais has joined #openstack-keystone | 22:40 | |
| *** diegows has quit IRC | 22:40 | |
| *** jamielennox|away is now known as jamielennox | 22:52 | |
| *** stevemar has quit IRC | 22:55 | |
| *** stevemar has joined #openstack-keystone | 22:56 | |
| *** ChanServ sets mode: +v stevemar | 22:56 | |
| dstanek | morganfainberg: stevemar: you guys still around? | 22:57 |
| stevemar | dstanek, kinda sorta | 22:59 |
| stevemar | dolphm, i don't understand what you mean by 'is it too soon?' https://review.openstack.org/#/c/133529/ ? | 23:00 |
| stevemar | oh wait... i can't read | 23:00 |
| dolphm | stevemar: nope | 23:00 |
| stevemar | dolphm, welp, don't remember agreeing to that | 23:01 |
| stevemar | dolphm, looks like i got some work to do tonight | 23:01 |
| dstanek | oh dolphm's here too | 23:03 |
| dolphm | dstanek: what did i do wrong? | 23:03 |
| *** timcline has quit IRC | 23:03 | |
| dstanek | in https://review.openstack.org/#/c/139137/2/ i use a directory named functional tests; in an updated patch i called it dsvm because i wanted to have standard functional, federation and k2k functional tests and maybe other devstack vm things in there | 23:04 |
| dstanek | dolphm: morganfainberg: stevemar: thoughts on naming before i redo that patch? ^ | 23:04 |
| dolphm | dstanek: what would be in there besides tests? | 23:07 |
| *** gordc has joined #openstack-keystone | 23:09 | |
| dstanek | dolphm: i was actually thinking of splitting dsvm setup from the tests more like this: https://etherpad.openstack.org/p/keystone-functional-tests | 23:10 |
| *** timcline has joined #openstack-keystone | 23:11 | |
| *** nellysmitt has joined #openstack-keystone | 23:12 | |
| openstackgerrit | Merged openstack/keystone-specs: rescope tokens unscoped to scoped only https://review.openstack.org/123760 | 23:12 |
| *** jaosorior has joined #openstack-keystone | 23:13 | |
| *** marcoemorais has quit IRC | 23:13 | |
| *** marcoemorais has joined #openstack-keystone | 23:13 | |
| jamielennox | stevemar: has that py33 bug been fixed? i see https://review.openstack.org/#/c/131408/ is supposed to fix it but have they released pbr again? | 23:14 |
| *** nellysmitt has quit IRC | 23:16 | |
| esp | hey folks I have noobie question regarding keystone v3 and domains. *should* we be able to disable the default domain? I’m trying to figure out what the use cases for that might be. thx! | 23:17 |
| ayoung_dreidl | esp, you could, but I wouldn't recomend it. right now, there is no support for service users in non-default domains. Keystone client and middleware support it as of very recently, but I wouldn't expect it from the rest of the tooling for a while | 23:20 |
| esp | thx ayoung_dreidl, I’m wondering if we should not allow this in horizon | 23:21 |
| esp | it basically locks you out until it’s re-enabled :) | 23:22 |
| dstanek | ayoung_dreidl: also v2 only uses the default domain right? | 23:23 |
| *** ayoung_dreidl is now known as ayoung | 23:23 | |
| ayoung | esp, disabling the default domain? I would not make special precautions for it right now...we are going to be doing a lot with Keystone policy, and I would think that dealing with domains in general will be part of that. I don't think Horizon should be enforcing that kind of business logic, it is too ad-hoc | 23:25 |
| ayoung | dstanek, right, v2 only default domain | 23:25 |
| esp | ayoung: k, makes sense | 23:26 |
| esp | we’ll just keep track of the behavior for now | 23:26 |
| esp | thx! | 23:26 |
| *** avozza is now known as zz_avozza | 23:39 | |
| *** andreaf has quit IRC | 23:50 | |
| *** timcline has quit IRC | 23:53 | |
| *** thedodd has quit IRC | 23:56 | |
| *** hdd has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!