| *** chlong has quit IRC | 00:01 | |
| *** chlong has joined #openstack-keystone | 00:02 | |
| *** richm has quit IRC | 00:02 | |
| *** thedodd has quit IRC | 00:03 | |
| *** jaosorior has quit IRC | 00:03 | |
| *** chlong has quit IRC | 00:06 | |
| stevemar | bknudson, what should i see if i use 145607? | 00:06 |
|---|---|---|
| *** rdo has quit IRC | 00:14 | |
| *** avozza is now known as zz_avozza | 00:17 | |
| *** joesavak has quit IRC | 00:18 | |
| *** jungleboyj has joined #openstack-keystone | 00:18 | |
| *** zz_avozza is now known as avozza | 00:19 | |
| *** rdo has joined #openstack-keystone | 00:22 | |
| *** radez is now known as radez_g0n3 | 00:22 | |
| bknudson | stevemar: should look the same as running tests in nova. | 00:25 |
| *** chlong has joined #openstack-keystone | 00:29 | |
| gyee | nkinder, ayoung, does 389 support turst similar to AD trust? | 00:32 |
| *** raildo has quit IRC | 00:35 | |
| *** dougwig is now known as dougwig_the_rude | 00:41 | |
| *** dougwig_the_rude is now known as dougwig | 00:42 | |
| *** arunkant has quit IRC | 00:53 | |
| *** samueldmq has joined #openstack-keystone | 00:56 | |
| nkinder | gyee: IPA does (not 389) | 00:57 |
| nkinder | gyee: "trust" is really a cross-realm kerberos trust, so you need a KDC | 00:58 |
| nkinder | 389 is just an LDAP server, but FreeIPA is a KDC on top of 389 (plus lots of other stuff) | 00:58 |
| gyee | nkinder, thanks, someone mentioned authenticating against AD trust so I thought it was an LDAP thing | 01:04 |
| *** dank has quit IRC | 01:04 | |
| gyee | I have not tested that setup myself | 01:05 |
| *** samueldmq has quit IRC | 01:07 | |
| *** jungleboyj has quit IRC | 01:15 | |
| stevemar | bknudson, oh, it only works when i run tox -e py27, not tox -e debug :( | 01:23 |
| bknudson | stevemar: debug needs to do its own thing. | 01:24 |
| *** htruta has quit IRC | 01:30 | |
| *** htruta has joined #openstack-keystone | 01:33 | |
| *** avozza is now known as zz_avozza | 01:34 | |
| *** gyee has quit IRC | 01:36 | |
| *** dims__ has joined #openstack-keystone | 01:37 | |
| ayoung | morganfainberg, jamielennox OK, read through your discussion. I think jamielennox 's points summarize to "client already has an access info, so why do we need another" and "immutable is unpythonic" neither of which I interpret as him having any real problem with a drop in replacement for AccessInfo. | 01:40 |
| ayoung | There are some issues with heat using the existing AccessInfo directly | 01:40 |
| ayoung | So, let me state that "immutable is optional but encouraged" | 01:40 |
| ayoung | and I can bend even on that if its a deal breaker | 01:41 |
| ayoung | so, really, I think we are all close enough that we can go with the accessinfo I wrote, if I do some follow on reviews replacing the old AccessInfo with mine and showing everything still works? | 01:41 |
| jamielennox | ayoung: if the interface matches the old AccessInfo (which it will have to do be used by plugins and passed down from middleware) why not fix the old one than start from scratch/ | 01:42 |
| ayoung | jamielennox, that is really what I did. If you remove the dictionary aspect and the decorators from the clients AccessInfo, you get something like mine. But the real answer is that I wrote it in the server and then moved it to the client. | 01:44 |
| ayoung | jamielennox, but if it is a drop in replacement, are you OK with my approach? | 01:45 |
| jamielennox | i'll need to look at it again - but if you can use that in replacement for what we have then sure | 01:45 |
| jamielennox | i just don't want to run two implemenations side by side | 01:45 |
| ayoung | jamielennox, agreed. I'll make sure it works as a replacement. | 01:48 |
| *** zz_avozza is now known as avozza | 01:55 | |
| *** Zemeio has quit IRC | 02:10 | |
| *** Zemeio has joined #openstack-keystone | 02:10 | |
| *** _cjones_ has quit IRC | 02:11 | |
| *** chlong has quit IRC | 02:11 | |
| *** avozza is now known as zz_avozza | 02:12 | |
| *** samueldmq has joined #openstack-keystone | 02:20 | |
| *** samueldmq has quit IRC | 02:20 | |
| *** samueldmq has joined #openstack-keystone | 02:20 | |
| *** samueldmq has quit IRC | 02:20 | |
| *** samueldmq has joined #openstack-keystone | 02:21 | |
| openstackgerrit | Merged openstack/keystone: let endpoint_filter sql backend return dict data https://review.openstack.org/144084 | 02:24 |
| *** topol has joined #openstack-keystone | 02:25 | |
| *** ChanServ sets mode: +v topol | 02:25 | |
| *** stevemar has quit IRC | 02:26 | |
| *** samueldmq has joined #openstack-keystone | 02:28 | |
| *** samueldmq has quit IRC | 02:29 | |
| *** samueldmq has joined #openstack-keystone | 02:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/145666 | 02:29 |
| *** samueldmq has quit IRC | 02:29 | |
| *** Zemeio has quit IRC | 02:39 | |
| *** Zemeio has joined #openstack-keystone | 02:39 | |
| *** samueldmq has joined #openstack-keystone | 02:47 | |
| *** gordc has quit IRC | 02:52 | |
| *** htruta has quit IRC | 02:52 | |
| *** erkules has quit IRC | 02:52 | |
| *** htruta has joined #openstack-keystone | 02:55 | |
| openstackgerrit | Merged openstack/keystone: Remove requirements not needed by oslo-incubator modules anymore https://review.openstack.org/136941 | 03:00 |
| *** samueldmq has quit IRC | 03:03 | |
| *** gordc has joined #openstack-keystone | 03:09 | |
| *** htruta has quit IRC | 03:11 | |
| *** zz_avozza is now known as avozza | 03:20 | |
| *** avozza is now known as zz_avozza | 03:30 | |
| *** lhcheng has quit IRC | 03:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 03:35 |
| *** lihkin has joined #openstack-keystone | 03:45 | |
| *** _cjones_ has joined #openstack-keystone | 03:54 | |
| *** _cjones_ has quit IRC | 03:54 | |
| *** _cjones_ has joined #openstack-keystone | 03:54 | |
| *** chlong has joined #openstack-keystone | 03:57 | |
| *** erkules has joined #openstack-keystone | 04:01 | |
| *** chlong has quit IRC | 04:02 | |
| *** dims__ has quit IRC | 04:06 | |
| *** dims__ has joined #openstack-keystone | 04:08 | |
| *** tsufiev has quit IRC | 04:09 | |
| *** jungleboyj has joined #openstack-keystone | 04:09 | |
| *** tsufiev has joined #openstack-keystone | 04:09 | |
| *** dims__ has quit IRC | 04:11 | |
| *** chlong has joined #openstack-keystone | 04:18 | |
| *** _cjones_ has quit IRC | 04:20 | |
| *** chrisshattuck has quit IRC | 04:25 | |
| *** chrisshattuck has joined #openstack-keystone | 04:27 | |
| *** david-lyle has quit IRC | 04:50 | |
| *** lhcheng has joined #openstack-keystone | 04:53 | |
| *** zz_avozza is now known as avozza | 05:09 | |
| *** _cjones_ has joined #openstack-keystone | 05:12 | |
| *** gordc has quit IRC | 05:14 | |
| *** marg7175 has quit IRC | 05:14 | |
| *** LinstatSDR has quit IRC | 05:16 | |
| *** _cjones_ has quit IRC | 05:17 | |
| *** avozza is now known as zz_avozza | 05:18 | |
| *** chrisshattuck has quit IRC | 05:22 | |
| *** stevemar has joined #openstack-keystone | 05:22 | |
| *** ChanServ sets mode: +v stevemar | 05:22 | |
| *** LinstatSDR has joined #openstack-keystone | 05:26 | |
| *** lhcheng has quit IRC | 05:37 | |
| *** lhcheng has joined #openstack-keystone | 05:51 | |
| *** lihkin has quit IRC | 05:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/145135 | 06:02 |
| *** ajayaa has joined #openstack-keystone | 06:05 | |
| *** zz_avozza is now known as avozza | 06:10 | |
| *** avozza is now known as zz_avozza | 06:20 | |
| *** lihkin has joined #openstack-keystone | 06:22 | |
| *** topol has quit IRC | 06:22 | |
| *** lhcheng has quit IRC | 06:23 | |
| *** yasu_ has joined #openstack-keystone | 06:24 | |
| *** lihkin has quit IRC | 06:29 | |
| *** jamielennox is now known as jamielennox|away | 06:33 | |
| *** wanghong has quit IRC | 06:33 | |
| *** LinstatSDR has quit IRC | 06:36 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Do not depend on pysaml2 if using federation https://review.openstack.org/145697 | 06:50 |
| *** mogami has joined #openstack-keystone | 06:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check project id before creating request token https://review.openstack.org/145701 | 06:57 |
| *** mogami has quit IRC | 06:59 | |
| *** afazekas is now known as __afazekas | 07:04 | |
| *** lhcheng has joined #openstack-keystone | 07:11 | |
| *** k4n0 has joined #openstack-keystone | 07:38 | |
| *** zz_avozza is now known as avozza | 07:41 | |
| *** lhcheng has quit IRC | 07:42 | |
| *** k4n0 has quit IRC | 07:42 | |
| *** afazekas_ has joined #openstack-keystone | 07:46 | |
| *** chlong has quit IRC | 07:47 | |
| *** avozza is now known as zz_avozza | 07:51 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move projects and domains to their own backend. https://review.openstack.org/144824 | 07:55 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused pointer to assignment in identity driver. https://review.openstack.org/145022 | 07:58 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make controllers and managers reference new resource manager. https://review.openstack.org/133525 | 07:58 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make unit tests call the new reource manager. https://review.openstack.org/130954 | 07:59 |
| *** stevemar has quit IRC | 08:02 | |
| *** henrynash has quit IRC | 08:03 | |
| *** henrynash has joined #openstack-keystone | 08:04 | |
| *** ChanServ sets mode: +v henrynash | 08:04 | |
| *** henrynash has quit IRC | 08:06 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Standardize federated scoping process. https://review.openstack.org/145204 | 08:24 |
| *** zz_avozza is now known as avozza | 08:26 | |
| *** jacer_huawei has joined #openstack-keystone | 08:34 | |
| *** jacer_huawei is now known as wanghong | 08:41 | |
| *** avozza is now known as zz_avozza | 08:48 | |
| *** jistr has joined #openstack-keystone | 09:10 | |
| *** andreaf has joined #openstack-keystone | 09:37 | |
| *** fmarco76 has joined #openstack-keystone | 09:42 | |
| *** nellysmitt has joined #openstack-keystone | 09:45 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Multiple IdP authentication URL https://review.openstack.org/142743 | 09:54 |
| *** yasu_ has quit IRC | 10:03 | |
| openstackgerrit | Alistair Coles proposed openstack/keystonemiddleware: Fix environ keys missing HTTP_ prefix https://review.openstack.org/145505 | 10:16 |
| *** rushiagr_away is now known as rushiagr | 10:32 | |
| *** rushiagr is now known as rushiagr_away | 10:33 | |
| *** dims__ has joined #openstack-keystone | 10:34 | |
| *** dgonzalez has joined #openstack-keystone | 10:37 | |
| *** dims__ has quit IRC | 10:38 | |
| *** lhcheng has joined #openstack-keystone | 10:41 | |
| *** lhcheng has quit IRC | 10:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Service Provider for K2K https://review.openstack.org/135604 | 10:49 |
| *** bdossant has joined #openstack-keystone | 11:14 | |
| *** dgonzalez has quit IRC | 11:24 | |
| *** marg7175 has joined #openstack-keystone | 11:27 | |
| *** dgonzalez has joined #openstack-keystone | 11:31 | |
| *** chlong has joined #openstack-keystone | 11:43 | |
| *** marg7175 has quit IRC | 11:52 | |
| *** marg7175 has joined #openstack-keystone | 11:52 | |
| *** ajayaa has quit IRC | 12:00 | |
| *** dims__ has joined #openstack-keystone | 12:05 | |
| *** ajayaa has joined #openstack-keystone | 12:14 | |
| *** dims__ has quit IRC | 12:25 | |
| *** dims__ has joined #openstack-keystone | 12:49 | |
| *** bdossant has quit IRC | 13:03 | |
| *** bdossant has joined #openstack-keystone | 13:10 | |
| *** zz_avozza is now known as avozza | 13:21 | |
| *** bdossant has quit IRC | 13:27 | |
| *** bdossant has joined #openstack-keystone | 13:35 | |
| *** bdossant has quit IRC | 13:37 | |
| *** gordc has joined #openstack-keystone | 13:39 | |
| *** bdossant has joined #openstack-keystone | 13:40 | |
| *** bdossant has quit IRC | 13:41 | |
| *** bdossant has joined #openstack-keystone | 13:43 | |
| *** avozza is now known as zz_avozza | 13:54 | |
| *** jungleboyj has quit IRC | 13:56 | |
| *** dgonzalez has quit IRC | 13:57 | |
| ayoung | bknudson, "domain is-a project" is in the critical path for doing anything sane with policy. I was creating a new project entry for the domain object, but I think that is the wrong approach now. | 14:03 |
| ayoung | bknudson, if you list projects under another project in HMT you don't get the parent project | 14:03 |
| ayoung | listing projects for a domain....should you get the root project or not? | 14:03 |
| ayoung | Or should you get all projects *under* the domain? | 14:04 |
| bknudson | ayoung: did we have this discussion at the summit? I think it was mentioned. | 14:04 |
| bknudson | I don't remember what the result was | 14:04 |
| bknudson | I think if you list projects for a domain you shouldn't get the root project, since it's not the same as the child projects. | 14:05 |
| bknudson | I was wondering if this mysql command works for anyone: alter table region convert to character set utf8 collate utf8_bin; | 14:06 |
| bknudson | ERROR 1025 (HY000): Error on rename of './keystone/#sql-3ffc_32' to './keystone/region' (errno: 150) | 14:06 |
| bknudson | I think it's because it's a foreign key. | 14:14 |
| *** bdossant has quit IRC | 14:15 | |
| *** nkinder has quit IRC | 14:16 | |
| *** bdossant has joined #openstack-keystone | 14:17 | |
| *** sriram has joined #openstack-keystone | 14:21 | |
| *** links has joined #openstack-keystone | 14:27 | |
| bknudson | Looks like the 61 downgrade doesn't work with mysql -- AttributeError: 'MetaData' object has no attribute 'c' | 14:28 |
| *** richm has joined #openstack-keystone | 14:29 | |
| *** bdossant_ has joined #openstack-keystone | 14:30 | |
| *** bdossant has quit IRC | 14:31 | |
| bknudson | easy fix. | 14:34 |
| *** joesavak has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix downgrade from migration 61 on non-sqlite https://review.openstack.org/145795 | 14:38 |
| *** lihkin has joined #openstack-keystone | 14:39 | |
| *** mattfarina has joined #openstack-keystone | 14:44 | |
| *** dgonzalez has joined #openstack-keystone | 14:54 | |
| *** mattfarina has quit IRC | 14:57 | |
| *** mattfarina has joined #openstack-keystone | 14:57 | |
| *** bdossant_ has quit IRC | 15:04 | |
| *** nkinder has joined #openstack-keystone | 15:04 | |
| *** dgonzalez has quit IRC | 15:08 | |
| *** esp has left #openstack-keystone | 15:19 | |
| *** timcline has joined #openstack-keystone | 15:23 | |
| *** fmarco76 has left #openstack-keystone | 15:26 | |
| *** topol has joined #openstack-keystone | 15:28 | |
| *** ChanServ sets mode: +v topol | 15:28 | |
| *** stevemar has joined #openstack-keystone | 15:29 | |
| *** ChanServ sets mode: +v stevemar | 15:29 | |
| *** lihkin has quit IRC | 15:32 | |
| *** bdossant has joined #openstack-keystone | 15:33 | |
| *** bdossant has quit IRC | 15:37 | |
| *** bdossant has joined #openstack-keystone | 15:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Standardize federated scoping process. https://review.openstack.org/145204 | 15:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check project id before creating request token https://review.openstack.org/145701 | 15:42 |
| *** bdossant_ has joined #openstack-keystone | 15:43 | |
| *** bdossant has quit IRC | 15:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check project id before creating request token https://review.openstack.org/145701 | 15:44 |
| *** bdossant_ has quit IRC | 15:47 | |
| marekd | stevemar: looks like gyee's patch for k2k really works :-) | 15:51 |
| stevemar | marekd, yep! | 15:52 |
| *** lufix has quit IRC | 15:54 | |
| *** LinstatSDR has joined #openstack-keystone | 15:56 | |
| *** raildo has joined #openstack-keystone | 16:00 | |
| stevemar | marekd, i see your bump! | 16:17 |
| stevemar | i won't let you down | 16:17 |
| *** bdossant has joined #openstack-keystone | 16:17 | |
| *** chrisshattuck has joined #openstack-keystone | 16:17 | |
| marekd | you never do. | 16:17 |
| *** bdossant has quit IRC | 16:17 | |
| *** afazekas_ has quit IRC | 16:18 | |
| *** henrynash has joined #openstack-keystone | 16:18 | |
| *** ChanServ sets mode: +v henrynash | 16:18 | |
| stevemar | dawwww | 16:19 |
| *** nkinder has quit IRC | 16:24 | |
| *** dgonzalez has joined #openstack-keystone | 16:25 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 16:25 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 16:26 |
| *** Zemeio has quit IRC | 16:26 | |
| *** bdossant has joined #openstack-keystone | 16:27 | |
| *** andreaf has quit IRC | 16:28 | |
| ayoung | marekd, why does'n _authenticate accept the token ref as a parameter? | 16:28 |
| *** andreaf has joined #openstack-keystone | 16:28 | |
| ayoung | https://review.openstack.org/#/c/130593/7/keystone/auth/plugins/token.py,cm | 16:28 |
| marekd | ayoung: heh, if I had a good reason for that i cannot recall what was that and after reading this this look like my bug. | 16:31 |
| marekd | ayoung: comment, and i will fix that. | 16:31 |
| ayoung | marekd, I also don't like a call to an underscored function | 16:32 |
| ayoung | those are supposed to be internal only | 16:32 |
| marekd | ayoung: i was propossing changin the object class in the runtime depending on the token type, but it was rejected. | 16:32 |
| marekd | ayoung: i need to run and do some business now, i shall be back slightly later. | 16:33 |
| ayoung | marekd, ok...grab me before you do any rewriting | 16:33 |
| ayoung | this logic looks wrong | 16:33 |
| ayoung | I'll see if I can think it through | 16:33 |
| *** chlong has quit IRC | 16:34 | |
| * ayoung going to have to use his brain | 16:34 | |
| *** chrisshattuck has quit IRC | 16:35 | |
| *** henrynash has quit IRC | 16:36 | |
| *** henrynash has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +v henrynash | 16:36 | |
| *** zzzeek has joined #openstack-keystone | 16:37 | |
| *** nkinder has joined #openstack-keystone | 16:38 | |
| *** gyee has joined #openstack-keystone | 16:39 | |
| *** ChanServ sets mode: +v gyee | 16:39 | |
| *** henrynash has quit IRC | 16:39 | |
| openstackgerrit | Merged openstack/keystone-specs: Standardize federated scoping process. https://review.openstack.org/145204 | 16:40 |
| ayoung | marekd, I think you were on the right path with revision one. It should be a single plugin with multiple cases for the type of token, not calling the mapped plugin | 16:42 |
| *** nellysmitt has quit IRC | 16:44 | |
| *** Zemeio has joined #openstack-keystone | 16:45 | |
| *** raildo has quit IRC | 16:46 | |
| *** henrynash has joined #openstack-keystone | 16:52 | |
| *** ChanServ sets mode: +v henrynash | 16:52 | |
| *** bdossant has quit IRC | 16:58 | |
| *** _cjones_ has joined #openstack-keystone | 17:00 | |
| *** chrisshattuck has joined #openstack-keystone | 17:06 | |
| *** dgonzalez has quit IRC | 17:08 | |
| *** gordc has quit IRC | 17:08 | |
| *** chrisshattuck has quit IRC | 17:11 | |
| *** chrisshattuck has joined #openstack-keystone | 17:14 | |
| *** EmilienM is now known as EmilienM|afk | 17:15 | |
| *** thedodd has joined #openstack-keystone | 17:17 | |
| *** links has quit IRC | 17:18 | |
| *** lhcheng has joined #openstack-keystone | 17:32 | |
| *** thedodd has quit IRC | 17:41 | |
| *** jistr has quit IRC | 17:43 | |
| openstackgerrit | ayoung proposed openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 17:45 |
| ayoung | gyee, do you really care: https://review.openstack.org/#/c/142521/ | 17:46 |
| ayoung | I think having the scoping info in the same portion of the request as everything else is least surprising and also best documentation | 17:46 |
| gyee | ayoung, yeah, very much | 17:46 |
| ayoung | why? what am i missing? | 17:46 |
| gyee | having unscoped inside scope seem wrong | 17:47 |
| ayoung | ?no_default_scope means a change to a whole lot of code, both inside the server and the client | 17:47 |
| *** gordc has joined #openstack-keystone | 17:47 | |
| ayoung | gyee, it just makes it explicit. I would say it should be | 17:47 |
| gyee | it should be the same as no_catalog | 17:47 |
| ayoung | scope: None | 17:47 |
| ayoung | but that could be tricky in JSON | 17:47 |
| gyee | no JSON if you do this with a param | 17:48 |
| nkinder | gyee: the way I see it is that the "scope" section indicates the requested scope of the token. "unscoped" is an actual explicit scope if you think about it | 17:48 |
| *** rushiagr_away is now known as rushiagr | 17:48 | |
| gyee | nkinder, I thought it was kinda confusing to have unscoped inside scope | 17:49 |
| ayoung | gyee, I might be more prone to agree with you if we did not have an actual scope section. Otherwise we could have a contradiction like ?no_default_scope specified on the URL and scope = proejct in the token request body | 17:49 |
| gyee | anyway, I don't have a strong objection either way, just thought that param is more natural | 17:49 |
| *** thedodd has joined #openstack-keystone | 17:50 | |
| ayoung | gyee, I would almost have preferred the no_catalog option to be inside the request body as well | 17:50 |
| *** stevemar2 has joined #openstack-keystone | 17:50 | |
| *** ChanServ sets mode: +v stevemar2 | 17:50 | |
| bknudson | gyee: it's not that the token doesn't have a catalog, right... it's that the response doesn't include the catalog. | 17:50 |
| gyee | right | 17:50 |
| *** stevemar has quit IRC | 17:50 | |
| ayoung | bknudson, welll...PKIZ has the catalog in to body of the token | 17:50 |
| bknudson | so in this case the token doesn't have a scope | 17:50 |
| nkinder | gyee: what happens if I reuqest a scope in the JSON and also use ?unscoped ? | 17:51 |
| ayoung | but...lets say that is an artefact | 17:51 |
| ayoung | and not intention | 17:51 |
| gyee | default scope is an implicit behavior | 17:51 |
| nkinder | gyee: that case seems more confusing to me than putting "unscoped" in JSON | 17:51 |
| gyee | this is overriding it | 17:51 |
| gyee | nkinder, to be honest, I never like the idea of default scope :) | 17:52 |
| nkinder | gyee: +1 | 17:52 |
| ayoung | gyee yeah, me too | 17:52 |
| nkinder | but we have to live with thay | 17:52 |
| nkinder | that | 17:52 |
| gyee | yeah | 17:52 |
| ayoung | Programming is like sex | 17:52 |
| gyee | hahaha | 17:52 |
| gyee | lmao | 17:52 |
| ayoung | gyee, so you good with the code as is? | 17:52 |
| gyee | ayoung, sure, lemme change the review | 17:53 |
| ayoung | gyee, thanks | 17:53 |
| ayoung | gyee, If we make this work, and have it around for long enough, we can probably then throw in a config option that does the same thing, and eventually have unscoped by default be the default behavior | 17:54 |
| ayoung | long term, of course | 17:54 |
| ayoung | like in the S-T releases... | 17:54 |
| ayoung | how long until we run out of letters? | 17:54 |
| gyee | ayoung, ++ | 17:54 |
| ayoung | I guess openstack only plans on doing releases for 13 years | 17:55 |
| nkinder | ayoung: 7 years | 17:55 |
| gyee | my understanding is the default scope was specifically designed for Horizon to enhance usability | 17:55 |
| gyee | but with the session token, it is no longer useful | 17:55 |
| *** stevemar2 has quit IRC | 17:56 | |
| *** stevemar2 has joined #openstack-keystone | 17:57 | |
| *** ChanServ sets mode: +v stevemar2 | 17:57 | |
| rharwood | clearly openstack should go rolling release when we run out of letters | 17:59 |
| gyee | we identity a release by name anyway, next time around we'll call it Kilimanjaro and have our summit there :) | 18:01 |
| gyee | it would be interest to see how many can attend though | 18:02 |
| *** zz_avozza is now known as avozza | 18:03 | |
| ayoung | gyee, Denali.... | 18:05 |
| ayoung | gyee, default scope was from the get go when the assumption was that each user would only be in a single project | 18:05 |
| *** rushiagr is now known as rushiagr_away | 18:06 | |
| ayoung | rharwood, I want to release Keystone on its own schedule anyway. The synced release doesn't do much for us | 18:06 |
| *** gyee has quit IRC | 18:08 | |
| *** EmilienM|afk is now known as EmilienM | 18:14 | |
| *** timcline has quit IRC | 18:17 | |
| *** dgonzalez has joined #openstack-keystone | 18:22 | |
| *** LinstatSDR has quit IRC | 18:23 | |
| stevemar2 | looking for a +3 for bknudson https://review.openstack.org/#/c/124603/ | 18:25 |
| *** dgonzalez has quit IRC | 18:27 | |
| *** dgonzalez has joined #openstack-keystone | 18:32 | |
| *** LinstatSDR has joined #openstack-keystone | 18:32 | |
| *** thedodd has quit IRC | 18:34 | |
| *** LinstatSDR has quit IRC | 18:35 | |
| *** vhoward- has left #openstack-keystone | 18:37 | |
| *** junhongl has quit IRC | 18:38 | |
| *** junhongl has joined #openstack-keystone | 18:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/145666 | 18:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/145886 | 18:44 |
| *** nellysmitt has joined #openstack-keystone | 18:45 | |
| *** _cjones_ has quit IRC | 18:48 | |
| *** _cjones_ has joined #openstack-keystone | 18:49 | |
| *** stevemar2 has quit IRC | 18:50 | |
| *** nellysmitt has quit IRC | 18:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/145896 | 18:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/145897 | 18:51 |
| *** thedodd has joined #openstack-keystone | 18:51 | |
| *** jorge_munoz has quit IRC | 18:55 | |
| *** stevemar has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v stevemar | 19:07 | |
| *** jorge_munoz has joined #openstack-keystone | 19:08 | |
| *** jorge_munoz has quit IRC | 19:09 | |
| openstackgerrit | ayoung proposed openstack/keystone: Unscoped to Scoped only https://review.openstack.org/142591 | 19:10 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/142813/ seems ready to go. What next? | 19:11 |
| ayoung | "Promote policy to a top level library." | 19:12 |
| morganfainberg | Need to wait for the next tc meeting. Next week. | 19:13 |
| morganfainberg | This weeks meeting was not on. | 19:13 |
| *** LinstatSDR has joined #openstack-keystone | 19:23 | |
| *** packet has joined #openstack-keystone | 19:27 | |
| *** atiwari has joined #openstack-keystone | 19:28 | |
| *** atiwari1 has joined #openstack-keystone | 19:29 | |
| *** _cjones_ has quit IRC | 19:33 | |
| *** _cjones_ has joined #openstack-keystone | 19:34 | |
| *** LinstatSDR has quit IRC | 19:36 | |
| *** ajayaa has quit IRC | 19:36 | |
| *** ajayaa has joined #openstack-keystone | 19:37 | |
| *** stevemar has quit IRC | 19:37 | |
| *** stevemar has joined #openstack-keystone | 19:38 | |
| *** ChanServ sets mode: +v stevemar | 19:38 | |
| morganfainberg | ayoung: then I think we just need to get the policy stuff imported into the new repo (infra) and do a release. | 19:39 |
| ayoung | morganfainberg, cool. I am starting to get to stuff that needs changes to policy, would rather do in the new library than in incubator | 19:40 |
| morganfainberg | Yes. Tha tis where it should go. | 19:41 |
| *** ajayaa has quit IRC | 19:46 | |
| *** atiwari1 has quit IRC | 19:51 | |
| *** atiwari has quit IRC | 19:51 | |
| *** atiwari has joined #openstack-keystone | 19:52 | |
| *** atiwari1 has joined #openstack-keystone | 19:52 | |
| *** _cjones_ has quit IRC | 19:53 | |
| *** atiwari1 has quit IRC | 19:54 | |
| *** atiwari has quit IRC | 19:54 | |
| *** atiwari has joined #openstack-keystone | 19:54 | |
| *** atiwari has quit IRC | 19:54 | |
| *** atiwari has joined #openstack-keystone | 19:55 | |
| morganfainberg | Hmm | 20:01 |
| *** packet has quit IRC | 20:05 | |
| *** packet has joined #openstack-keystone | 20:08 | |
| *** raildo has joined #openstack-keystone | 20:12 | |
| *** atiwari has quit IRC | 20:13 | |
| *** jorge_munoz has joined #openstack-keystone | 20:29 | |
| *** jorge_munoz has quit IRC | 20:29 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Revocation event API https://review.openstack.org/81166 | 20:29 |
| *** fifieldt_ has quit IRC | 20:32 | |
| *** fifieldt_ has joined #openstack-keystone | 20:33 | |
| *** jorge_munoz has joined #openstack-keystone | 20:35 | |
| *** Zemeio has quit IRC | 20:35 | |
| gordc | morganfainberg: stevemar: any thoughts on making a release of pycadf lib with deprecated audit middleware? or stevemar did you want to fix that bug we talked about first? | 20:35 |
| stevemar | gordc, we should fix that bug i think | 20:37 |
| gordc | stevemar: kk. works for me. | 20:37 |
| stevemar | and update the requirements (minor but theres a patch in flight for that) | 20:37 |
| *** harlowja_away is now known as harlowja | 20:37 | |
| gordc | i feel like there will be a lot with ongoing oslo changes. | 20:38 |
| gordc | stevemar: any timeframe in regards to fix? | 20:39 |
| stevemar | gordc, haven't even begun it yet, our side convo didn't have a conclusion, what are you thinking ... just don't emit the event or have config options for swift? | 20:42 |
| morganfainberg | gordc: let's fix the bug. Happy to do a release at anytime you want (except Friday nights and weekends) | 20:42 |
| gordc | morganfainberg: cool cool. that's why i asked now. wasn't going to do it until next week if not. | 20:43 |
| morganfainberg | But we can do the release pre-bug fix if that is important. Basically release is totally open to when you want it :) | 20:43 |
| morganfainberg | Sounds good! | 20:43 |
| gordc | morganfainberg: ok. i'll give you a heads up if i ever decide | 20:43 |
| morganfainberg | Great. At the very least I'll plan to release next week (even if we delay it some no big deal) | 20:44 |
| gordc | stevemar: um... probably doesn't make sense to have it do processing in pipeline but never emit anything. | 20:44 |
| *** jorge_munoz has quit IRC | 20:44 | |
| morganfainberg | Just so I have my time planned out (releas is easy but I need to remember I planned to do it) | 20:44 |
| stevemar | gordc, but if they change swift to allow for the service catalog retrieval, then it'll be no changes for pycadf | 20:45 |
| gordc | stevemar: actually do we plan to fix this in pycadf as well or just in keystonemiddlewrae? | 20:45 |
| gordc | or wait... the logic is in pycadf. | 20:45 |
| gordc | ignore | 20:45 |
| stevemar | yeah | 20:45 |
| stevemar | gordc, i just don't know what the best solution should be =\ | 20:45 |
| morganfainberg | jamielennox|away: let's plan the next ksc/middleware release for early feb - keep the cadence up so we aren't hanging back on new features. We can always delay. (Barring critical bug fixes) | 20:45 |
| gordc | stevemar: i'll think about it a bit more. caught between two convo right now. :| | 20:46 |
| *** nellysmitt has joined #openstack-keystone | 20:46 | |
| morganfainberg | gordc: any logic that is in the middleware should only be fixed in middleware package unless it is a major security issue. Treat audit middleware in pycadf as frozen. | 20:46 |
| morganfainberg | Just in case the question comes up in the future. | 20:47 |
| morganfainberg | If the logic is in pycadf, easy choice to fix. | 20:47 |
| stevemar | morganfainberg, definitely in pycadf | 20:47 |
| stevemar | gordc, yeah take your time | 20:47 |
| gordc | morganfainberg: sounds good to me. | 20:47 |
| stevemar | gordc, but i think we should get this one sorted out before releasing | 20:48 |
| morganfainberg | stevemar: yeah. Was just pointing out how to determine where to fix re middleware. | 20:48 |
| ayoung | nkinder, morganfainberg so...policy. I've been working on the V3 cloudsample update, and I think we have at least 3 domains we might need to reflect in there; default (no big deal), admin, service. | 20:48 |
| ayoung | admin domain should probably be considered a separate domain from service domain. | 20:48 |
| morganfainberg | ayoung: sure that makes logical sense. | 20:48 |
| morganfainberg | Though, I could see some orgs lumping them together, I like the separation of concerns. | 20:48 |
| ayoung | morganfainberg, right | 20:48 |
| nkinder | ayoung: I don't even think default needs to be there (we just do a domain match for those rules) | 20:49 |
| ayoung | morganfainberg, they should be seperate*able* | 20:49 |
| nkinder | admin and service are special (and ideally separate) | 20:49 |
| morganfainberg | nkinder: we can't remove default and need to represent it for compat. | 20:49 |
| ayoung | or however you spell that dang word | 20:49 |
| morganfainberg | nkinder: but in principle I agree with you. | 20:49 |
| nkinder | morganfainberg: I just mean we don't need it to be specially defined in the policy | 20:49 |
| ayoung | nkinder, yeah, default is more "make sure things work for V2" than anything else | 20:49 |
| nkinder | morganfainberg: ...not that it must go away | 20:49 |
| ayoung | and, as we know, v2 should die | 20:50 |
| morganfainberg | nkinder: we might for v2 compat since lots of people are v2 vs v3. | 20:50 |
| morganfainberg | erm in v2 domain but using v3 api in the future | 20:50 |
| ayoung | but is it like an zombie | 20:50 |
| morganfainberg | ayoung: braaaaaaaaaaaiiiiinnnsssss | 20:50 |
| ayoung | morganfainberg, you in the bay area today? | 20:51 |
| gordc | stevemar: ok. | 20:51 |
| *** nellysmitt has quit IRC | 20:51 | |
| ayoung | http://www.meetup.com/Cloud-Builders/events/218844510/ | 20:51 |
| morganfainberg | ayoung: on the 15th and 22/23 | 20:51 |
| ayoung | that goes for gyee ... too, but he's gone | 20:51 |
| morganfainberg | Not this week. :(. Otherwise I'd go | 20:51 |
| ayoung | be interested in having someone with a Keystone voice there | 20:51 |
| morganfainberg | Gyee or nkinder would be the best bets I think then. | 20:52 |
| ayoung | morganfainberg, guess who I asked first? | 20:52 |
| morganfainberg | Haha. | 20:52 |
| morganfainberg | If I wasn't booked up with so much travel the next 2 weeks id hop a flight just for it. | 20:53 |
| *** _cjones_ has joined #openstack-keystone | 20:53 | |
| raildo | hey, ayoung later, I want to talk with you about HMT, ok? :) | 20:54 |
| *** david-lyle has joined #openstack-keystone | 20:54 | |
| ayoung | raildo, when you are ready | 20:54 |
| raildo | just to update the specs | 20:54 |
| raildo | https://review.openstack.org/#/c/135309/ | 20:55 |
| morganfainberg | So ayoung need to chat about some v2 token isms that predate my working on keystone. I *think* we can rip some stuff out of the provider/issuance. You might know. I'll bug you later on / tomorrow about it. | 20:55 |
| openstackgerrit | Merged openstack/keystone: Fix downgrade from migration 61 on non-sqlite https://review.openstack.org/145795 | 20:55 |
| ayoung | raildo, ok...so, domain-is-a-project | 20:55 |
| raildo | I jsut think that we need to define better the relation domain as a project | 20:55 |
| ayoung | raildo, should "list projects for domain" return the domain? | 20:55 |
| ayoung | my gut says no, but then I don't know how to represent it | 20:56 |
| ayoung | unless it is something like merge the domain and project tables, provide a flag | 20:56 |
| raildo | a project domainess? yes... just a domain( created using the domain API) no | 20:56 |
| morganfainberg | ayoung, so i can see why your gut says no, but let me quickly present the other side | 20:57 |
| raildo | ayoung, yeah, I implemented a POC to represent a project as a flag to represent a domain. | 20:57 |
| morganfainberg | ayoung, the domain (since it is a project) is also managed by itself. | 20:57 |
| ayoung | morganfainberg, yeah, I see that POV too | 20:57 |
| morganfainberg | *technically* that should be included then right? | 20:57 |
| morganfainberg | just playing devils advocate here | 20:58 |
| ayoung | morganfainberg, the issue is LDAP | 20:58 |
| ayoung | which also should die | 20:58 |
| morganfainberg | i don't have a strong opinion that it needs to be that way | 20:58 |
| ayoung | there is no nesting in LDAP, and thus it means there needs to be a magic project for the domain | 20:58 |
| morganfainberg | ayoung, LDAP does a lot of magic already :( | 20:58 |
| raildo | ayoung, ++ | 20:58 |
| *** _cjones_ has quit IRC | 20:59 | |
| morganfainberg | does it hurt if we do more (oh god no please no, lets not) | 20:59 |
| ayoung | raildo, in HMT list projects for domain won't be a tree, right, it will be a flat list of all projects? | 20:59 |
| *** _cjones_ has joined #openstack-keystone | 20:59 | |
| ayoung | morganfainberg, we still talking software? | 20:59 |
| ayoung | or do I need to call 911? | 20:59 |
| morganfainberg | ayoung, haha | 20:59 |
| ayoung | with the LDAP backend, we can't even have domain scoped roles now, can we? | 21:00 |
| raildo | ayoung, we have two option, we can get the projects as a list, so its just a subtree list. or we can use other way, to return as a dictionary | 21:00 |
| ayoung | raildo, let me post my POC. | 21:01 |
| raildo | in this second option, we return just the project_ids as a hierarchy | 21:01 |
| raildo | ayoung, I see this patch https://review.openstack.org/#/c/143763/ | 21:01 |
| ayoung | raildo, yeah. I've done some more work, but still don't have the tests passing | 21:02 |
| raildo | ayoung, ok | 21:02 |
| ayoung | raildo, mainly due to the LDAP tests breaking | 21:02 |
| raildo | ayoung, I have some problems with this too :P | 21:02 |
| ayoung | since it needs to be rebased on henrynash 's work anyway, and we are discussing deprecating LDAP assignments, I might just recommend we skip all of those tests | 21:03 |
| *** markvoelker has joined #openstack-keystone | 21:03 | |
| morganfainberg | hmm. | 21:03 |
| morganfainberg | i wonder if i qualify for the OpenStack pycharm license... | 21:04 |
| raildo | ayoung, for HMT we create some tests just to show that we can't create a hierarchy, or get a subproject... | 21:04 |
| raildo | https://github.com/openstack/keystone/blob/master/keystone/tests/test_backend_ldap.py#L1609 | 21:04 |
| ayoung | morganfainberg, I don't think so | 21:05 |
| ayoung | raildo, yes, but my change will be breaking some older tests | 21:05 |
| morganfainberg | ayoung, there is an odd in-between qualification if you work only on upstream even if employed by $corpwhosellsopenstack$ | 21:05 |
| ayoung | the ones that count the number of projects returned in difference circumstances. The numbers are different fro SQL and LDAP right now | 21:05 |
| morganfainberg | ayoung, meh, whatever, it's not expensive. | 21:05 |
| ayoung | morganfainberg, I've reverted to emacs | 21:06 |
| raildo | ayoung, right | 21:06 |
| morganfainberg | ayoung, great operating system there... if only it had an editor | 21:06 |
| morganfainberg | ayoung, ;) | 21:06 |
| ayoung | morganfainberg, I was using it mostly for debugging, but found import rpdb; rpdb.set_trace() to be the universal debugger | 21:06 |
| ayoung | pycharm that is | 21:06 |
| ayoung | so emacs as an editor (and OS) works fine for me | 21:06 |
| morganfainberg | ayoung, i'd need ot use the vi plugin for emacs to get a usable editor :P | 21:07 |
| stevemar | morganfainberg, bknudson if y'all know of a better way to get around this, let me know https://review.openstack.org/#/c/145697/ | 21:07 |
| ayoung | I am also conversant in vi | 21:07 |
| stevemar | I should probably file a bug :( | 21:07 |
| morganfainberg | stevemar, out-of-tree magic? :( | 21:07 |
| morganfainberg | [no no no] | 21:08 |
| morganfainberg | uhm | 21:08 |
| morganfainberg | what ugly deps does pysaml2 have? | 21:08 |
| ayoung | stevemar, if that extension is not included, why would they need it? | 21:08 |
| ayoung | I mean, why would you need an optional include? | 21:08 |
| ayoung | it seems to me that k2k should be a separate module that is dependant on federation, not a part of it | 21:09 |
| *** thedodd has quit IRC | 21:09 | |
| ayoung | federation should be promoted to a non-extension, IMNSHO | 21:10 |
| morganfainberg | ayoung, extensions are going away. | 21:10 |
| ayoung | morganfainberg, that, too | 21:10 |
| morganfainberg | are we getting complaints about pysaml2? | 21:10 |
| morganfainberg | or is this pre-emptive "make it optional"? | 21:10 |
| ayoung | morganfainberg, packaging is a nightmare, lets not make it harder. | 21:10 |
| ayoung | if this is really needed for a niche, lets keep it optional | 21:10 |
| morganfainberg | ayoung, hold on. | 21:11 |
| raildo | It remains a little more than one week, for the midcycle, I really wanted to go :( | 21:11 |
| stevemar | so for k2k, pysaml2 is needed; but for old fashioned federation it's not | 21:11 |
| ayoung | looking to see if it is already packaged | 21:11 |
| morganfainberg | ayoung, yeah that would be the first question | 21:11 |
| stevemar | ideally we should have k2k and regular federation separated, but it wasn't built that way | 21:11 |
| morganfainberg | stevemar, so are people complaining about pysaml2 - or is this pre-emptive? | 21:11 |
| stevemar | morganfainberg, sry, just saw your pings now | 21:12 |
| ayoung | I don't see it in an entirely too cursory look | 21:12 |
| stevemar | morganfainberg, no one is complaining, i was just trying to use OIDC only, and noticed that it wasn't working cause i didn't have pysaml2 installed | 21:12 |
| morganfainberg | ok lets look at it from a deployer perspective | 21:14 |
| morganfainberg | having a bunch of "if you want X go and also install all this extra stuff over here" is bad | 21:14 |
| morganfainberg | not saying we need it as a hard dep, just keep in mind our deployer experience is ugly as is | 21:15 |
| bknudson | stevemar: https://review.openstack.org/#/c/145697/1/keystone/contrib/federation/idp.py isn't a bad way to do it. I'd expect that the code below there would check for "if not saml2: fail" | 21:15 |
| *** marg7175 has quit IRC | 21:15 | |
| morganfainberg | it's early enough that if we say this is a real dep, most packagers shouldn't complain too much | 21:15 |
| morganfainberg | if it was post milestone-2 i'd be more leery | 21:15 |
| stevemar | bknudson, good call | 21:16 |
| morganfainberg | since it isn't a separate module - i *tend* to err on the side of include it to make the deployer experience not suck more for <feature X> [regardless of feature] | 21:16 |
| stevemar | morganfainberg, so right now pysaml2 is in test-req anyway right now | 21:16 |
| stevemar | so it's still a shitty UX | 21:17 |
| morganfainberg | stevemar, yes. i know | 21:17 |
| stevemar | this is making it less shitty if you want to just play with openidc | 21:17 |
| morganfainberg | we can work to make it better - the question is the value. | 21:17 |
| stevemar | but i know what you're saying | 21:17 |
| stevemar | if you want to enable federation, you have to install all of these things | 21:17 |
| morganfainberg | so - if we move to seprate packaging for the backends [waaaay different discussion] we could isolate this stuff. | 21:17 |
| stevemar | rather than piecemeal stuff | 21:17 |
| morganfainberg | in fact it would be good to make it where if you want memcache token, you get memcache dep - but we're not there at the moment | 21:18 |
| stevemar | right | 21:18 |
| morganfainberg | apt-get install keystone-token-memcached (example) | 21:18 |
| morganfainberg | or pip, or whatever | 21:18 |
| stevemar | OK, so similar discussion for this then | 21:18 |
| morganfainberg | like i said i tend to err to the side of include it to make deployment experience less icky. but I'm fine with making it optional (we have prior art for this) | 21:19 |
| stevemar | i'll leave the CR open for now and open a bug, feel free to mark it as won't fix, but i want it for the record in case someone else sees it | 21:19 |
| bknudson | how terrible is pysaml? it's not packaged? | 21:19 |
| stevemar | pysaml2 has weird dependencies | 21:19 |
| morganfainberg | bknudson, that is my question. i hope it's not terrible - just lacking current packaging because no one pushed it | 21:20 |
| bknudson | http://www.rpmfind.net/linux/RPM/opensuse/factory/armv7hl/noarch/python-pysaml2-1.0.3-1.1.noarch.html | 21:20 |
| stevemar | https://github.com/rohe/pysaml2/blob/master/setup.py#L23-L35 | 21:20 |
| bknudson | http://copr-be.cloud.fedoraproject.org/results/olea/OpenMOOC/fedora-rawhide-i386/python-pysaml2-0.4.3-1.el6/ | 21:20 |
| morganfainberg | god. zope | 21:20 |
| morganfainberg | *sigh* | 21:20 |
| stevemar | those are both pretty old | 21:21 |
| stevemar | 1.x and 0.x, when the author is at >2.0 | 21:21 |
| morganfainberg | ok so, the only really ugly dep (or two) are zope and pyopenssl | 21:21 |
| morganfainberg | oh interesting and repoze | 21:21 |
| morganfainberg | but that shouldn't be too bad | 21:21 |
| gordc | stevemar: added comment to bug, let me know if it works for you: https://bugs.launchpad.net/pycadf/+bug/1397938 | 21:22 |
| uvirtbot | Launchpad bug 1397938 in pycadf "pycadf doesn't work when service catalog is not set" [Undecided,New] | 21:22 |
| morganfainberg | doesn't require lxml, nice. | 21:22 |
| morganfainberg | stevemar, so - i think pysaml2 could safely be made a hard-dep. zope.interface bleh, but somehow i bet that makes it in somewhere else in OpenStack as well | 21:22 |
| stevemar | pretty sure it does | 21:23 |
| stevemar | thanks gordc looking in a minute | 21:23 |
| morganfainberg | this one is likely going to raise less ire than lxml does | 21:23 |
| *** jamielennox|away is now known as jamielennox | 21:24 | |
| morganfainberg | eventually we probably should be working to split things up for keystone by module - but that is a much much bigger disscussion that we can't hit anytime soon. | 21:24 |
| morganfainberg | and we're early in the cycle | 21:24 |
| morganfainberg | stevemar, so i'll support either - just make sure to keep the deployer experience in mind when making the choice. | 21:25 |
| *** gyee has joined #openstack-keystone | 21:28 | |
| *** ChanServ sets mode: +v gyee | 21:28 | |
| stevemar | morganfainberg, i'm too slow, marekd saw this months ago, https://bugs.launchpad.net/keystone/+bug/1369986 | 21:29 |
| uvirtbot | Launchpad bug 1369986 in keystone "Federaton extension fails due to missing pysaml2 library" [Medium,Invalid] | 21:29 |
| morganfainberg | stevemar, sure. like i said, i'll support either | 21:30 |
| morganfainberg | just keep in mind deployer experience | 21:30 |
| ayoung | morganfainberg, can we not? We don't make LDAP a hard dep even | 21:30 |
| stevemar | ayoung, i think it's past due that we made that a requirement | 21:31 |
| morganfainberg | ayoung, ^ i'm leaving this to stevemar's discretion here, i would prefer to work on making our deployer experience less crummy. if i need to know to install XXX and XXX and XXX and XXX and XXX to turn on features it's a really really bad experience | 21:31 |
| morganfainberg | ayoung, or we start splitting these things out so keystone is the framework and if you want ldap, you install keystone-ldap-identity | 21:32 |
| ayoung | stevemar, I see no K2K as niche. Would like to defer Adding a package to RDO for it | 21:32 |
| ayoung | morganfainberg, ++ | 21:32 |
| stevemar | i' leaning toward your line of thinking morganfainberg, i was originally OK with handling import errors, but yeah, it's just shitt UX to have to install x, y and z to actually use things | 21:32 |
| morganfainberg | ayoung, so i think even k2k should be in the same boat here | 21:32 |
| morganfainberg | ayoung, now, there is nothing saying we can't make it a goal of L-cycle to fix all this and make things more modular. | 21:33 |
| *** jorge_munoz has joined #openstack-keystone | 21:34 | |
| morganfainberg | ayoung, i am not going to force the issue here though. we have prior art on "document this and if you want it do X" with ldap and memcache | 21:34 |
| ayoung | morganfainberg, until I can break RDO of the anitpattern of the All in One deployment (far more common than we like) I'd rather be very adverse to any new hard deps | 21:34 |
| morganfainberg | ayoung, well if we split the modules out - you are getting hard deps on those modules regardless | 21:35 |
| morganfainberg | ayoung, it will happen within the next cycle or so anyway | 21:35 |
| morganfainberg | ayoung, just keep it in mind. | 21:35 |
| ayoung | morganfainberg, sure | 21:35 |
| morganfainberg | ayoung, and frankly the choices redhat makes on how they package things for RDO is not a sole reason i'm willing to exclude something from reqs. | 21:36 |
| *** henrynash has quit IRC | 21:37 | |
| morganfainberg | ayoung, my only requirement is we look at deployer expeirence - it's bad now. we can keep it as is, or work to fix now. we have prior art on both sides, but lets make good choices here. | 21:37 |
| ayoung | morganfainberg, its not just Red Hat THat is just where I sit. The issue is with the requirement of packaging up something for an optional feature | 21:38 |
| morganfainberg | ayoung, it is something we'll need to fix soon™, but this could be just another memcache/ldap. i'll let stevemar and other cores comment on this - and i'll support both methodologies until we decide how we fix the deployer experience | 21:38 |
| ayoung | making the based footprint larger | 21:38 |
| morganfainberg | ayoung, but we just need to make sure we're not making the deployer experience worse. | 21:39 |
| ayoung | How hard did yoiu have to look to fine the ™ anyway? | 21:39 |
| morganfainberg | ayoung, not at all, i know how to type it ;) | 21:39 |
| morganfainberg | i used to work at blizzard, that is like a requirement | 21:39 |
| stevemar | haha, they do slap it on a lot of things | 21:39 |
| * morganfainberg also cheats, OS X can type lots of those things more easily than Windows or Linux. | 21:40 | |
| jamielennox | off the top of my head i'm not even sure how i'd go about finding that symbol | 21:41 |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/145896 | 21:41 |
| morganfainberg | *maybe* we need to package some lightweight dep-only packaged for keystone? | 21:43 |
| *** nkinder has quit IRC | 21:43 | |
| ayoung | anyway, I would say the K2K is different from base Federation, and should be separate code, regardless of all other issues | 21:43 |
| morganfainberg | install keystone-memcache, keystone-federation-k2k just provides the deps | 21:44 |
| morganfainberg | makes it easier for deployers? | 21:44 |
| morganfainberg | keystone-ldap | 21:44 |
| morganfainberg | long term we could move real code into those. | 21:44 |
| ayoung | I'd be OK with that | 21:44 |
| morganfainberg | it also give packagers clear deliniation on what to package for what | 21:44 |
| * morganfainberg should go chat w/ TC/infra on that | 21:44 | |
| ayoung | do we need to split git repos to make that happen? That always annoyed me | 21:45 |
| morganfainberg | we would need to split repos to put the code elsewhere | 21:45 |
| morganfainberg | we would need separeate repos for the requirements.txt in either case | 21:45 |
| morganfainberg | we can't make two packages from 1 repo atm | 21:45 |
| ayoung | that is so dumb | 21:45 |
| morganfainberg | pbr and pypi don't like it [both are issues] | 21:45 |
| ayoung | the feeling is mutual. I don't like either of them | 21:46 |
| morganfainberg | s/pypi/setuptools | 21:46 |
| * ayoung grumpy | 21:46 | |
| marekd | stevemar: morganfainberg: regarding the pysaml2 as dependency - maybe splitting k2k and icehouse federation is a good idea. Why stevemar would need pysaml2 for his oidc Keystone | 21:46 |
| morganfainberg | pbr is fine. but it inherits ick from setuptools | 21:46 |
| ayoung | pbr is ick | 21:46 |
| ayoung | anything that needs to tell you it is reasonable obviously is no such thing | 21:46 |
| morganfainberg | ayoung, nah. it's really making the setuptools experience is bearable | 21:47 |
| morganfainberg | and we need that. | 21:47 |
| stevemar | marekd, why do i need libvirt if i'm using xen only? (from a nova perspective) | 21:47 |
| ayoung | it makes the packaging experience less so. Its like bundling Make with an binary | 21:47 |
| marekd | stevemar: ask nova guys :P | 21:47 |
| stevemar | and if i want to switch from oidc to k2k ? | 21:48 |
| morganfainberg | marekd, it's the same argument. if i'm not using libvirt why should i need it. well at the moment iirc you do need it. | 21:48 |
| stevemar | i shouldn't have to re-install a lib | 21:48 |
| stevemar | i just want *keystone*, not have to install all this other crap | 21:48 |
| marekd | stevemar: well, then you are changing your usecase - from oidc SP to Keystone-idp. | 21:48 |
| morganfainberg | if we commit to splitting out modules into repos it's an easy sell. you want federation install keystone-federation | 21:48 |
| morganfainberg | if you want k2k you install keystone-federation-k2k | 21:49 |
| morganfainberg | etc etc | 21:49 |
| marekd | morganfainberg: ++ | 21:49 |
| morganfainberg | but that is *not* happening in kilo | 21:49 |
| marekd | well, at first i was even proposing to put pysaml into requirements.txt but it was rejected as federation was optional. | 21:49 |
| morganfainberg | so, lets focus on kilo - i'll plan to propose that for L (regardless of being PTL or not) | 21:49 |
| morganfainberg | marekd, that changes with https://review.openstack.org/#/c/133809/ | 21:50 |
| morganfainberg | marekd, if extensions go away (please) | 21:50 |
| ayoung | libvirt is slightly more central to nova than k2k is to Keystone. I've yet to get any demand for it, much as I like the concept | 21:50 |
| marekd | morganfainberg: ++ | 21:50 |
| morganfainberg | ayoung, there has been documented demand, both at HP and RAX and it is being used. | 21:50 |
| morganfainberg | ayoung, and cisco. | 21:50 |
| ayoung | morganfainberg, Oh, I am sure it is being used. Just that we have not had demand for it on our side | 21:51 |
| ayoung | our customers are slow on the uptake | 21:51 |
| morganfainberg | ayoung, ok fair enough, no demand at RH yet :) | 21:51 |
| morganfainberg | i'm sure there will be | 21:51 |
| ayoung | morganfainberg, I predicted it....2 years ago? | 21:51 |
| morganfainberg | (shameless plug) stevemar ^ review that spec. | 21:51 |
| morganfainberg | ayoung, yah - about the time i started on working on keystone and I saw this as the direction i wanted to see (didn't say anything back then) :) | 21:52 |
| morganfainberg | ayoungy, 2.5-3 yrs ago. | 21:52 |
| * ayoung refuses to believe it has been that long....deny deny | 21:53 | |
| morganfainberg | hahah | 21:53 |
| morganfainberg | deny all you want | 21:53 |
| ayoung | https://wiki.openstack.org/wiki/Keystone/Delegation | 21:53 |
| morganfainberg | ayoung, yep. | 21:54 |
| ayoung | when'd I first write that? | 21:54 |
| stevemar | it has been a fun 2 years :P | 21:55 |
| stevemar | morganfainberg, link me, i don't see the spec | 21:55 |
| *** raildo has quit IRC | 21:55 | |
| morganfainberg | stevemar. https://review.openstack.org/#/c/133809/ | 21:55 |
| stevemar | gotcha | 21:55 |
| ayoung | No. Fun is hanging by your fingertips off a cliff face or having a 1 AM Jam session | 21:55 |
| ayoung | this has been decent work | 21:55 |
| stevemar | ohh all the +'s | 21:56 |
| morganfainberg | ayoung, what about doing both? hanging off a cliff WHILE having a jam session at 1am | 21:56 |
| marekd | ayoung: have a minute to talk about https://review.openstack.org/#/c/130593 ? | 21:56 |
| morganfainberg | hm. that might be a bit cold where i usually climb | 21:56 |
| ayoung | morganfainberg, don't want to risk dropping the Sax | 21:56 |
| ayoung | marekd, sure. | 21:56 |
| ayoung | marekd, so...couple ways we could do it | 21:57 |
| morganfainberg | ayoung, ah, see my brother always had a $200 guitar he took with him... so worst case was the crappy camping guitar was broken | 21:57 |
| morganfainberg | those usually lasted a couple years or so | 21:57 |
| ayoung | one is to lump everything into the token plugin | 21:57 |
| ayoung | the other is to make a second plugin that only gets added if you are doing federation | 21:57 |
| marekd | ayoung: i think the exact plugin to handle the authN should be resolved at...the plugin level. not in the controller | 21:57 |
| * morganfainberg needs to get back to rock climbing :( | 21:57 | |
| morganfainberg | it's been... years. | 21:58 |
| morganfainberg | and years | 21:58 |
| ayoung | morganfainberg, climbing gym in SA? | 21:58 |
| marekd | ayoung: and it will be token.py, as this is where controllers.py will point to. | 21:58 |
| morganfainberg | ayoung, probably not this time - i'm on a whirlwind trip to the bay right after the midcycle | 21:58 |
| morganfainberg | if i wasn't leaving wed @ 6pm flight i would. | 21:59 |
| ayoung | marekd, so lets go with the approach you had in revision 1 | 21:59 |
| marekd | ayoung: yep. | 21:59 |
| ayoung | marekd, the fact that we already have a config option means that it is the right solution | 21:59 |
| morganfainberg | but i'm likely to be moving to the east coast - and i'll be up outside of boston (NH) by ~1h visiting friends fairly regularly if i do. so i can swing over your direction and check out that work-space w/ the gym in it when up that way | 22:00 |
| ayoung | otherwise, we *could* register an alternative token plugin that handles bothj | 22:00 |
| ayoung | morganfainberg, where in the East Coast? | 22:00 |
| marekd | morganfainberg: so you basically work remotely? | 22:00 |
| morganfainberg | well i'll be moving to NYC. but 2 of my best friends are moving somewhere close to boston in NH in a few months | 22:00 |
| ayoung | very cool. I have family (in laws) in NYC. Was just down there | 22:01 |
| morganfainberg | so if i'm in NYC i'll def be up by boston at least monthly or so. | 22:01 |
| marekd | ayoung: which config option? | 22:01 |
| * ayoung happy with this news | 22:01 | |
| * morganfainberg wants out of Los Angeles | 22:01 | |
| ayoung | marekd, um.. | 22:01 |
| bknudson | sounds expensive | 22:01 |
| morganfainberg | marekd, yeah i work from wherever i have an internet connection. coffee shops are a frequent place for me. | 22:02 |
| ayoung | marekd, I lied | 22:02 |
| morganfainberg | bknudson, not much more than pasadena :( | 22:02 |
| marekd | morganfainberg: do you like working remotely? | 22:02 |
| morganfainberg | bknudson, if you factor in i wont need to keep my car to get everywhere | 22:02 |
| morganfainberg | marekd, some days. some days i really miss hanging out in the office w/ people. | 22:02 |
| marekd | ayoung: :-) | 22:03 |
| morganfainberg | the OpenStack crowd in LA is pretty spread out - and on monty's team there is only one other guy here (SpamapS) - we get lunch monthly or so, but still hard since everyone travels a lot | 22:03 |
| morganfainberg | marekd, portland OR has a large OpenStack contingent | 22:03 |
| morganfainberg | as well | 22:03 |
| bknudson | you should move to vancouver and then to tokyo in a few months | 22:03 |
| morganfainberg | bknudson, haha | 22:04 |
| morganfainberg | bknudson, i am not looking forward to the flight to tokyo tbh | 22:04 |
| morganfainberg | i *think* one of the guys on Monty's team does go to <place of the summit> for as long as the visa lasts each cycle. | 22:04 |
| ayoung | morganfainberg, when are you moving? And, do you have a target Burrough? | 22:04 |
| morganfainberg | ayoung, probably march (late) - and target Burrough is either Manhattan (west villiage/soho/tribeca/les) or some of the areas of brooklyn | 22:05 |
| marekd | ayoung: so, do you have any hint how to make this change right? | 22:05 |
| morganfainberg | ayoung, it depends on some travel for work if i can make march happen, it might need to wait till post vancouver. | 22:06 |
| ayoung | marekd, I think you were closest with patch 1. Go back to that, drop the mapping plugin, and mix in any of the logic that is needed from later reviews to keep things "stateless" | 22:06 |
| ayoung | marekd, so none of the self,token_ref stuff you fixed in later reviews, | 22:07 |
| morganfainberg | bknudson, we removed the need for the vendor download of ksc right? | 22:08 |
| ayoung | marekd, I would think it would be like: | 22:08 |
| marekd | ayoung: wait, you want me to move logic from plugins/mapped.py and mix it with token.py ? | 22:08 |
| ayoung | yes | 22:08 |
| ayoung | marekd, call if from there | 22:09 |
| ayoung | treat the plugin as an adapter, but the logic should be a helper function that can be called from either | 22:09 |
| bknudson | morganfainberg: we made it optional some time ago use an env var... I've got a change proposed to never download. | 22:09 |
| morganfainberg | bknudson, ++ let me go find that | 22:09 |
| morganfainberg | i want to push that through if possible before k2 | 22:09 |
| ayoung | marekd, is the idea that you still want to be able to use the mapped plugin stand alone? | 22:09 |
| marekd | ayoung: it's not super easy, as mapped.py is also used for getting and handling requests for unscoped tokens. | 22:09 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/136636/ -- looks like I need to rebase. | 22:09 |
| *** joesavak has quit IRC | 22:10 | |
| ayoung | marekd, the logic there is small, no?> | 22:10 |
| marekd | ayoung: and we will need to handle scoping tokens with authN methods 'mapped', 'saml2' for some time. | 22:10 |
| marekd | ayoung: rather small. | 22:11 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Keystoneclient tests from venv-installed client https://review.openstack.org/136636 | 22:11 |
| ayoung | ah...bigger than I thought | 22:11 |
| morganfainberg | bknudson, cool, reviewing now | 22:12 |
| marekd | ayoung: well, I was thinking about having some kind of factory, but...it will still remaing token.py and class called Token. | 22:12 |
| stevemar | morganfainberg, yay you'll be in the same time zone as the rest of us | 22:12 |
| ayoung | marekd, I wonder if the guts of _handle_scoped_token and _handle_unscoped_token should move to federation/core.py | 22:12 |
| ayoung | marekd, you could make them helper functions inside the mapped plugin and just call them from token.py, though. I think that would be the right approach here | 22:13 |
| bknudson | -244 ! | 22:14 |
| bknudson | and can finally get rid of those weird "from keystoneclient import exceptions as client_exceptions" | 22:14 |
| marekd | ayoung: let me see. | 22:14 |
| ayoung | marekd, you can drop the self paramter and pass in the API objects you need to those functions | 22:14 |
| marekd | ayoung: yeah, i am looking if we can make it 'stateless' | 22:15 |
| ayoung | most of the "self" params we have are for linking to API objects | 22:15 |
| morganfainberg | stevemar, another shameless plug: https://review.openstack.org/#/c/136939/2 needs to go through (cc ayoung, dolphm, gyee, lbragstad, jamielennox, dstanek) | 22:15 |
| ayoung | code removal? | 22:15 |
| ayoung | always! | 22:15 |
| ayoung | +A | 22:16 |
| stevemar | double +A'ed! | 22:16 |
| stevemar | dammit | 22:16 |
| ayoung | bknudson, you are the cleaner | 22:16 |
| ayoung | "I never minded much about the little things." | 22:16 |
| gyee | does stackanalysis subject LOC for code removal? :) | 22:17 |
| gyee | subtract | 22:17 |
| ayoung | gyee, it must. IBM leads in Keystone, and guess why | 22:17 |
| *** EmilienM is now known as EmilienM|afk | 22:17 | |
| morganfainberg | haha | 22:17 |
| ayoung | if we left him alone for a month, we'd come back to find the Keystone repo empty | 22:18 |
| marekd | lol | 22:18 |
| gyee | lmao | 22:18 |
| ayoung | which is my way of saying "thank you" bknudson in case it was not clear | 22:18 |
| ayoung | morganfainberg, if I can get a tentative "that looks good" on https://review.openstack.org/#/c/142521/ I'll write the spec change that accounts for it...if I have not already.... | 22:19 |
| morganfainberg | ayoung, looking | 22:20 |
| ayoung | https://review.openstack.org/#/c/143515/ is the spec change | 22:20 |
| stevemar | bknudson, one day it'll empty, one day | 22:20 |
| ayoung | gyee, morganfainberg start with that one | 22:20 |
| stevemar | ayoung, ^ the repo that is | 22:20 |
| morganfainberg | ayoung, give me a moment - i'm actually looking at the changes. | 22:20 |
| ayoung | ++ | 22:20 |
| stevemar | morganfainberg, since there are no owners here, this should go to the parking lot / backlog https://review.openstack.org/#/c/133809/8/specs/kilo/replace_extensions.rst | 22:21 |
| morganfainberg | stevemar, we need to find an owner and get ti in this cycle | 22:21 |
| morganfainberg | stevemar, most of the work is doc work | 22:21 |
| stevemar | all of us then! | 22:21 |
| stevemar | yay | 22:21 |
| morganfainberg | stevemar, i'd actually be ok with that one being assigned to keystone-cores | 22:22 |
| morganfainberg | ;) | 22:22 |
| marekd | ayoung: so, once again: move _handle_scoped(), _handle_unscoped() to federation/core and make them classless. Use _handle_scoped() directly from auth/plugins/token.py to handle scoping federated token, and in the end keep mapped.py as a baes class for obtaining unscoped tokens (that may vary per protocol and/or plugin). also keep _handle_scoped_token() in mapped with some deprecation warning. | 22:22 |
| marekd | ayoung: morganfainberg stevemar: makes sense? | 22:22 |
| morganfainberg | stevemar, there is some json-home work to be done. | 22:22 |
| morganfainberg | stevemar, so maaaaaybe we could bribe bknudson to help us :) | 22:22 |
| ayoung | marekd, keep them in the plugin, just make them helper functions | 22:22 |
| ayoung | and token.py can import mapping.py | 22:23 |
| morganfainberg | marekd, i'll need top go look at the review i'm between 2 reviews right now. | 22:23 |
| ayoung | if they really are helper code for the plugins, leave them where we will need them | 22:23 |
| marekd | ayoung: to be more specific - by calling helper function you mean def _helper_function() (starting with '_') ? | 22:23 |
| ayoung | marekd, drop the _ | 22:24 |
| stevemar | morganfainberg, he's easy to bribe | 22:24 |
| ayoung | they are meant to be used by plugins, but they are not private | 22:24 |
| morganfainberg | stevemar, hehe | 22:24 |
| ayoung | they are helper functions, meant to be used by multiple plugins | 22:24 |
| marekd | ayoung: ok | 22:24 |
| ayoung | just don't have one plugin call functions on another plugin object | 22:25 |
| ayoung | the plugin objects are meant to be adapters. They should have very little logic embedded in them directly | 22:25 |
| morganfainberg | ayoung, ++ | 22:25 |
| ayoung | mapping.py is likely going to be more used by other plugins than as a standalone plugin itslef | 22:25 |
| morganfainberg | ayoung, so.. unscoped is an explicit flag in this review it looks like, right? | 22:26 |
| ayoung | yes | 22:26 |
| marekd | ayoung: ahh, you suggest moving those functions out of the class definition. Got it. | 22:26 |
| ayoung | marekd, ++ | 22:26 |
| ayoung | morganfainberg, the question was always "how do we indicate that I want unscoped and always unscoped" | 22:27 |
| ayoung | morganfainberg, Jilly Scarlilly is in NYC now, as I am sure you are aware | 22:27 |
| openstackgerrit | Merged openstack/keystone-specs: Replace the concept of extensions in Keystone. https://review.openstack.org/133809 | 22:28 |
| *** david-lyle has quit IRC | 22:28 | |
| morganfainberg | ayoung, yeah was supposed to grab drinks w/ Jill when i was out in NYC in december | 22:28 |
| morganfainberg | didn't happen, scehduling conflict | 22:28 |
| ayoung | gyee, one thing I realized. The way I did it, it has to be "scope" : "unscoped" then you can';t also have "scope":"project" | 22:29 |
| ayoung | it makes it impossible to request an invalid combination | 22:29 |
| *** topol has quit IRC | 22:29 | |
| *** sriram has quit IRC | 22:30 | |
| marekd | ayoung: i am gonna work on that tomorrow. | 22:30 |
| marekd | ayoung: thanks for the consultation. | 22:30 |
| ayoung | marekd, thanks. And good work | 22:30 |
| jamielennox | ahh. the soothing sounds of the Keystone PTL overview in the background ... | 22:30 |
| morganfainberg | jamielennox, lol | 22:31 |
| morganfainberg | ayoung, ok no score on the unscoped token, but comment. it looks reasonable | 22:31 |
| jamielennox | ayoung: you had a previous +2 on https://review.openstack.org/#/c/118520/ | 22:31 |
| jamielennox | care to revisit? | 22:32 |
| ayoung | jamielennox, doing so | 22:32 |
| bknudson | https://review.openstack.org/#/c/145897/ ?? | 22:32 |
| ayoung | GAh, diff against the version I +2ed asploded | 22:33 |
| morganfainberg | bknudson, +2 on the no-more-keystoneclient download, once verified feel free to +A if someone else doesn't get to it. | 22:33 |
| bknudson | morganfainberg: this is going to be great. | 22:34 |
| morganfainberg | bknudson, makes me happy to be done with that git-checkout stuff. | 22:34 |
| gyee | ayoung, that's good, one scope at a time | 22:34 |
| ayoung | ++ | 22:35 |
| ayoung | jamielennox, +A | 22:35 |
| morganfainberg | stevemar, going to propose an update to the extensions spec to add a couple people to help drive it. | 22:36 |
| morganfainberg | stevemar, but otherwise very happy to see that merged. | 22:36 |
| *** gordc has quit IRC | 22:36 | |
| stevemar | morganfainberg, figured ya would :) | 22:36 |
| *** dims__ has quit IRC | 22:36 | |
| *** dims__ has joined #openstack-keystone | 22:37 | |
| *** nkinder has joined #openstack-keystone | 22:37 | |
| ayoung | jamielennox, can you -1 https://review.openstack.org/#/c/138519/ with the comments you had regarding code duplication? | 22:37 |
| * ayoung makes sure that is not a dupe | 22:38 | |
| marekd | nonameentername: hi. | 22:39 |
| nonameentername | marekd: hello | 22:39 |
| marekd | nonameentername: i am reding your comments in https://review.openstack.org/#/c/130376/19/specs/kilo/multi-factor-auth.rst | 22:40 |
| nonameentername | did you have questions on my comments? | 22:40 |
| marekd | nonameentername: i was asking for a API spec, as I wanted to check how you want to pass the secretes/seeds for synchronizing client and Keystone. | 22:40 |
| *** dims__ has quit IRC | 22:41 | |
| marekd | nonameentername: just from the user perspective. my admin wants me to use MFA. I have my Google Authenticator installed and usually i need to enter some code generated by the server. | 22:42 |
| marekd | nonameentername: did you plan to add some APIs in Keystone for that? | 22:42 |
| nonameentername | I haven't designed the admin API yet. I was thinking that would be done during the implementation. | 22:43 |
| marekd | nonameentername: in fact it's not the admin api, as user would call it. | 22:43 |
| marekd | nonameentername: ok, as long as you have it somewhere in the back of your head it's good. | 22:43 |
| *** avozza is now known as zz_avozza | 22:44 | |
| marekd | nonameentername: maybe some exta sentence how this 'syncho' step likes would be useful. | 22:44 |
| *** zz_avozza is now known as avozza | 22:44 | |
| marekd | s/syncho/synchro/ | 22:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Update work items and assignees for no-more-extensions spec https://review.openstack.org/145954 | 22:45 |
| morganfainberg | stevemar, ^ | 22:45 |
| morganfainberg | stevemar, that should be pretty straight forward. | 22:45 |
| nonameentername | I think you could add it as an extension to the user as an additional attribute. Then it would be available for create and update user | 22:45 |
| morganfainberg | stevemar and this work can all be done between k2 and k3 | 22:46 |
| marekd | nonameentername: not sure if we are on the same page. | 22:46 |
| nonameentername | what are you talking about? | 22:46 |
| bknudson | well, keystoneclient is broken... not sure what it was. | 22:46 |
| *** nellysmitt has joined #openstack-keystone | 22:47 | |
| bknudson | it's the auth_token tests so maybe it's time to just get rid of them? | 22:47 |
| morganfainberg | bknudson, in gate? or in general? | 22:47 |
| bknudson | in gate | 22:47 |
| morganfainberg | bknudson, oh ugh | 22:47 |
| morganfainberg | bknudson, hm... | 22:47 |
| bknudson | http://logs.openstack.org/97/145897/1/check/gate-python-keystoneclient-python26/0c1d00b/console.html#_2015-01-08_19_01_36_231 | 22:48 |
| marekd | nonameentername: i am about to use MFA. I sit down, and need to configure my Google Authenticator to work with my Keystone. How do I do with your proposed solution? | 22:48 |
| morganfainberg | you know.. if we move cms out of ksc we could remove the auth_token in ksc and make ksc import middleware | 22:48 |
| nonameentername | oh ok, I see what you are asking | 22:48 |
| bknudson | test_swift_memcache_set_expired | 22:48 |
| morganfainberg | and just use the new middleware (maybe session needs to move too) | 22:48 |
| morganfainberg | oh | 22:48 |
| morganfainberg | blah... | 22:48 |
| morganfainberg | hm. | 22:49 |
| stevemar | morganfainberg, pfft, adding my name without consent! | 22:49 |
| stevemar | that's grounds for -2 | 22:49 |
| morganfainberg | stevemar, haha | 22:49 |
| nonameentername | keystone api would only provide a mechanism to store the MFA seed. | 22:49 |
| jamielennox | session ideally would move, but clietn can't import middleware | 22:49 |
| stevemar | clear enough :) | 22:49 |
| jamielennox | bknudson: haven't seen that before | 22:49 |
| morganfainberg | jamielennox, it could if session and cms and other common stuff moved out | 22:49 |
| nonameentername | the qr code could be generated by horizon | 22:49 |
| bknudson | I'm wondering if someone has a tox venv where it still works? | 22:50 |
| marekd | nonameentername: it should be restful first. | 22:50 |
| bknudson | I blew mine away | 22:50 |
| morganfainberg | jamielennox, what release did we do the splt? J? or was it I? | 22:50 |
| * morganfainberg is trying to figure out when-if-ever we can just rip out the old auth_token from ksc | 22:50 | |
| marekd | nonameentername: that's why i asked for the api - to see if this would be covered or not. | 22:50 |
| marekd | nonameentername: my suggestion is to think about this workflow. | 22:51 |
| jamielennox | morganfainberg: it all blurs together | 22:51 |
| *** nellysmitt has quit IRC | 22:51 | |
| nonameentername | marekd: ok, what do the other Keystone devs thing? qr code is very specific to the implementation. How would this be handled for other implementations? | 22:51 |
| marekd | nonameentername: new API call, where user asks for the seed | 22:52 |
| marekd | the seed is a string, right? | 22:52 |
| nonameentername | yes | 22:52 |
| marekd | nonameentername: so simply new API call. | 22:53 |
| morganfainberg | jamielennox, was juno | 22:53 |
| morganfainberg | jamielennox, nova icehouse still imports from ksc. | 22:53 |
| jamielennox | morganfainberg: i just don't think we can ever remove functionality from the library | 22:53 |
| jamielennox | with new pip and the pep440 stuff we can probably start changing requirements to pin to major versions | 22:54 |
| jamielennox | then maybe we can do a v2 | 22:54 |
| nonameentername | marekd: do you think it would be sufficient to get and store MFA seed? | 22:55 |
| *** stevemar has quit IRC | 22:55 | |
| morganfainberg | jamielennox, i am thinking we should probably look at doing a v2 of ksc and just use that as the hard break for cleaning up all the kruft (not incompatible, but the deprecated but around for ancient versions of openstack) stuff | 22:55 |
| morganfainberg | jamielennox, as decided we wont do total breakage - that goes into SDK or whatever. | 22:56 |
| jamielennox | what do you consider deprecated - i consider everything that doesn't use a session deprecated | 22:56 |
| marekd | nonameentername: store? I thought TOTP was generating it. | 22:56 |
| nonameentername | you specify what you want the seed to be. | 22:56 |
| bknudson | keystonemiddleware is broken in the same way | 22:57 |
| jamielennox | bknudson: are you investigating? otherwise i will, as it was working for me yesterday | 22:57 |
| *** avozza is now known as zz_avozza | 22:57 | |
| marekd | nonameentername: a string value used once, when I 'connect' my GA with Keystone, so the TOTP codes are right and synchronized with Keystone side. | 22:57 |
| bknudson | jamielennox: I'm going to look into it for a little while here. | 22:57 |
| bknudson | I don't know how far I'll get. | 22:57 |
| bknudson | at least I got the pip freeze from before and after in keystonemiddleware | 22:57 |
| morganfainberg | bknudson, ++ | 22:58 |
| bknudson | it's only oslo modules that are different | 22:58 |
| morganfainberg | i'm working out how we're going to handle it from a infra/project leadership perspective going forward. | 22:58 |
| *** arif-ali has quit IRC | 22:58 | |
| morganfainberg | but we can't make that change immidiately anyway so yeah fixing it is important | 22:59 |
| morganfainberg | (or dropping that test) | 22:59 |
| nonameentername | marekd: yes, you would provide a string 'seed' value for GA and Keystone. For GA would would need to generate the qr code. | 23:00 |
| nonameentername | import qrcode; img = qrcode.make('otpauth://totp/keystone:username?secret=secret&issuer=keystone'); img.save("totp.png") | 23:01 |
| bknudson | oslo.utils==1.1.0 worked and oslo.utils==1.2.1 fails | 23:01 |
| bknudson | Maybe it's the rename of the package and the timeutils mock. | 23:01 |
| marekd | nonameentername: you means who? | 23:02 |
| marekd | nonameentername: a user? | 23:02 |
| nonameentername | the client setting up MFA | 23:03 |
| nonameentername | this could be a service, horizon or end user | 23:03 |
| marekd | ok, my opinoin is that we should not rely on QR codes only | 23:07 |
| nonameentername | yeah, this will be outside of keystone | 23:07 |
| morganfainberg | marekd, agreed. QR code suck. | 23:07 |
| morganfainberg | QR code should be *a* form not *the* form [if anything] | 23:08 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Switch from oslo.utils to oslo_utils https://review.openstack.org/145962 | 23:08 |
| marekd | morganfainberg: suck or not, it's not RESTfull and implies deps on horizon and so on. | 23:08 |
| morganfainberg | marekd, ++ | 23:08 |
| morganfainberg | marekd, it's horizon's business to render a QR if that is the form they want | 23:08 |
| morganfainberg | not keystone's | 23:08 |
| nonameentername | ok, I just checked GA and you can also enter secret without QR | 23:08 |
| morganfainberg | nonameentername, most you can | 23:09 |
| marekd | nonameentername: yes! | 23:09 |
| marekd | and i am asking how you want users to get this secret | 23:09 |
| nonameentername | There is a manaual account entry | 23:09 |
| marekd | nonameentername: did you plan to add an extra API for that? | 23:09 |
| * morganfainberg votes storing things in barbican. | 23:09 | |
| * morganfainberg votes not seeing things in keystone to hold more secrets. | 23:09 | |
| morganfainberg | >> | 23:09 |
| nonameentername | I think this should be provided by the user | 23:10 |
| bknudson | barbican needs to graduate | 23:10 |
| nonameentername | similar to password | 23:10 |
| morganfainberg | bknudson, yes | 23:10 |
| nonameentername | and you should not be able to retrieve it | 23:10 |
| rm_work | bknudson: hopefully soon... but I think it was decided we could use it even if it hasn't yet? | 23:10 |
| morganfainberg | bknudson, but that may be a non-issue post election | 23:10 |
| marekd | nonameentername: point 2c | 23:10 |
| morganfainberg | bknudson, if the bylaws change + big-tent stuff | 23:10 |
| marekd | in the link i had sent | 23:10 |
| morganfainberg | graduation becomes a non-issue | 23:10 |
| marekd | https://support.google.com/accounts/answer/1066447?hl=en | 23:10 |
| marekd | is 2c user or server generated? | 23:11 |
| morganfainberg | bknudson, jamielennox, re: ksc.middleware - going to be on the TC agenda for next week | 23:11 |
| nonameentername | what is 2c? | 23:11 |
| marekd | nonameentername: label 2c | 23:11 |
| marekd | if you open desc for android | 23:11 |
| morganfainberg | we will either announce the removal when icehouse is EOLd *or* will work to fix it in icehouse pre-eol and then remove it when EOL'd (second option is likely to be move to keystonemiddleware, but just so we can tell people "no really don't ever use this") | 23:11 |
| marekd | ctrl+f for 'label 2c' | 23:12 |
| morganfainberg | s/announce when/announce that it will be removed when/ | 23:12 |
| nonameentername | marekd: you would enter a secret you choose, and then make an api call to give the same secret to keystone | 23:12 |
| jamielennox | morganfainberg: i'm not sure about breaking interfaces in a library - but honestly i want something done and if the TC signs off so be it | 23:12 |
| marekd | nonameentername: aha. | 23:12 |
| morganfainberg | jamielennox, just chatted w/ jelblair and clarkb, will get the TC to agree so we can put this to bed somehow | 23:13 |
| morganfainberg | jamielennox, we can't maintain it forever | 23:13 |
| morganfainberg | jamielennox, and we wont break the library we're removing a long-dead section people shouldn't be using. | 23:13 |
| jamielennox | morganfainberg: same thing happens for client in general - at some point we're going to need to know how to deprecate things from a library | 23:13 |
| morganfainberg | jamielennox, SDK /snarkyresponse | 23:13 |
| *** zz_avozza is now known as avozza | 23:13 | |
| morganfainberg | jamielennox, i think major versions will be the answer | 23:13 |
| morganfainberg | get global reqs to cap at <current.999.999 | 23:14 |
| jamielennox | i want SDK sure, but there's a lot of stuff that happens in these libraries that isn't REST in these libraries | 23:14 |
| jamielennox | meh repeat | 23:14 |
| marekd | nonameentername: i just checked. my GA has two options: scan QR code and 'insert returned key' which to me means it's the server that generates the key. | 23:14 |
| morganfainberg | then the flip from 1.xx.xx to 2.xx.xx is where things can break | 23:14 |
| jamielennox | morganfainberg: pep440 says ~=1.0 is >1.0 <2 | 23:14 |
| morganfainberg | jamielennox, same thing different phrasing | 23:15 |
| marekd | ok, time to go to bed. good night. | 23:15 |
| morganfainberg | jamielennox, but i think that is the real answer | 23:15 |
| morganfainberg | ~=1.0 and then break things in ~=2.x.x | 23:15 |
| nonameentername | marekd: Keystone could generate the value and then allow the user to retrieve it. I prever specifying it, since once created no one could access it. | 23:16 |
| jamielennox | yep, i was going to say that in infra that we could have some projects on ~1.0 and some on ~2.0 however those two things can't be installed in parallel | 23:16 |
| morganfainberg | jamielennox, well we have a bit of time to work it out. | 23:16 |
| morganfainberg | i guess | 23:16 |
| * morganfainberg shrugs | 23:16 | |
| morganfainberg | jamielennox, come to the TC meeting next week if you can | 23:16 |
| morganfainberg | jamielennox, https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee dunno if it's too crazy early/late for you | 23:17 |
| jamielennox | i think it's really late | 23:17 |
| bknudson | rm_work: we can use barbican but if it's not graduated we shouldn't require it. | 23:17 |
| morganfainberg | 20:00 UTC | 23:17 |
| bknudson | so it will be easier if it's graduated | 23:17 |
| jamielennox | oh 6am isn't so bad | 23:17 |
| jamielennox | oh - does that mean there was one a few hours ago? | 23:18 |
| morganfainberg | on tuesday | 23:18 |
| morganfainberg | and it was skipped this week | 23:18 |
| bknudson | morganfainberg: how much do we need to do for ksc.middleware? We could just remove the tests from ksc and let it live there | 23:18 |
| morganfainberg | bknudson, well, we need to make sure it doesn't break at least through icehouse | 23:19 |
| morganfainberg | bknudson, i'll know more once i talk w/ the tC next week | 23:19 |
| jamielennox | morganfainberg: oh, yea c&p-ed the time and google gave me a date | 23:19 |
| bknudson | I'm not sure that we actually validate that. | 23:19 |
| jamielennox | ok so after the keystone meetings is good | 23:19 |
| bknudson | as it is | 23:19 |
| *** LinstatSDR has joined #openstack-keystone | 23:19 | |
| morganfainberg | bknudson, well ... i'd say our unit tests should continue to function till we remove it | 23:19 |
| morganfainberg | bknudson, at the very least, most people wont be using crazy new keystone with icehouse and before | 23:20 |
| morganfainberg | bknudson, i'm hoping we can find a way to remove it from ksc prior to icehouse EOL. | 23:20 |
| morganfainberg | bknudson, and convince everyone to move over to keystonemiddleware | 23:20 |
| *** mattfarina has quit IRC | 23:22 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Switch from oslo.utils to oslo_utils https://review.openstack.org/145968 | 23:30 |
| *** LinstatSDR has quit IRC | 23:33 | |
| *** avozza is now known as zz_avozza | 23:33 | |
| bknudson | ^ this one should get keystoneclient going again. | 23:33 |
| morganfainberg | bknudson, thanks! | 23:34 |
| jamielennox | bknudson: what version of oslo.utils is requird for that? | 23:34 |
| bknudson | jamielennox: the one that was just released: 1.2.1 | 23:35 |
| morganfainberg | bknudson, i'll plan to do a minor release of ksc to incorporate that change once it passes. will be good to not have the namespaced pacakges required at all | 23:36 |
| morganfainberg | or another point release if needed. | 23:36 |
| morganfainberg | depending on what's landed | 23:36 |
| jamielennox | so we'll need to update the oslo.utils in requirements | 23:36 |
| bknudson | morganfainberg: I've got some other changes for oslo.config | 23:36 |
| morganfainberg | yeah | 23:36 |
| morganfainberg | bknudson, ++ ok will wait for those | 23:36 |
| bknudson | jamielennox: https://review.openstack.org/#/c/145790/ | 23:36 |
| jamielennox | which will fail unless we have this patch but it should happen before release | 23:36 |
| jamielennox | bknudson: excellent - do you know what they broke in 1.2.1? | 23:37 |
| bknudson | jamielennox: the parts were moved from oslo.utils to oslo_utils ... so the mock didn't work right anymore for some reason. | 23:38 |
| bknudson | I'd have to think about it more to know what the problem is. | 23:38 |
| dhellmann | bknudson: the mock replaces the name in the old module location, which is then not called by the new code | 23:38 |
| dhellmann | mocking out those time functions has been the source of a lot of pain over the last year. I wonder if we could come up with some fixtures to replace the need to mock | 23:40 |
| *** packet has quit IRC | 23:42 | |
| bknudson | dhellmann: I hope you're not going to rename/move the library again. | 23:44 |
| bknudson | rename it to stockholm | 23:45 |
| *** lhcheng_ has joined #openstack-keystone | 23:47 | |
| *** lhcheng has quit IRC | 23:49 | |
| *** dgonzalez has quit IRC | 23:50 | |
| *** dgonzalez has joined #openstack-keystone | 23:50 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Update work items and assignees for no-more-extensions spec https://review.openstack.org/145954 | 23:52 |
| morganfainberg | ^ fixed line length issues | 23:52 |
| morganfainberg | ayoung, stevemar, ^ | 23:52 |
| *** arif-ali has joined #openstack-keystone | 23:53 | |
| *** dgonzalez has quit IRC | 23:55 | |
| jamielennox | bknudson: that oslo.utils patch, it seems to me the problem is that we are doing our own mock rather than using the set_override_time function that it provides | 23:57 |
| jamielennox | should we just do that as a patch first? | 23:57 |
| bknudson | jamielennox: set_time_override | 23:58 |
| bknudson | we'd still want a fixture to unset it. | 23:58 |
| jamielennox | i'm a little surprised oslo.utils doesn't provide one | 23:59 |
| jamielennox | oslo.config and some others have started to provide fixtures with the libraryt | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!