| jamielennox | however we could just put a clear_time_override in the base teardown | 00:00 |
|---|---|---|
| jamielennox | it won't cause any problems to call it unnecessarily | 00:00 |
| *** serverascode____ is now known as serverascode | 00:01 | |
| *** chrisshattuck has quit IRC | 00:01 | |
| bknudson | jamielennox: I don't think I could get that change done today. There were quite a few places where the change needs to be made. | 00:01 |
| bknudson | and then it would probably be worth it to create the fixture or a decorator (can fixtures be used as decorators? | 00:02 |
| jamielennox | bknudson: if you think it's worth it i'll do it | 00:02 |
| bknudson | jamielennox: I think it's worth switching from the mock, but at the same time it seems like the time would be better spent creating a fixture. | 00:03 |
| jamielennox | ok - i can whip that up | 00:04 |
| openstackgerrit | Merged openstack/keystone: explicit namespace prefixes for SAML2 assertion https://review.openstack.org/145159 | 00:06 |
| bknudson | jamielennox: creating a fixture in oslo.utils? | 00:07 |
| jamielennox | i'll put it in keystoneclient initially to pass the bug, then we can move it to oslo.utils | 00:08 |
| bknudson | keystonemiddleware also needs it. | 00:08 |
| *** arif-ali has quit IRC | 00:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/145666 | 00:12 |
| *** markvoelker has quit IRC | 00:14 | |
| *** arif-ali has joined #openstack-keystone | 00:16 | |
| *** lhcheng_ is now known as lhcheng | 00:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Use a test fixutre for mocking time https://review.openstack.org/145981 | 00:32 |
| jamielennox | bknudson: ^ | 00:32 |
| bknudson | that was easy | 00:32 |
| morganfainberg | jamielennox, fwiw, i thought the whole time_override thing was meant to be deprecated | 00:34 |
| morganfainberg | jamielennox, in favor of using a direct mock. | 00:35 |
| jamielennox | morganfainberg: it's not marked that way - and everyone that is doing the direct mock will get caught by this | 00:35 |
| morganfainberg | jamielennox, i mean, the fixture could do the mock | 00:35 |
| morganfainberg | but the time_override stuff i was told not to use ages ago | 00:35 |
| jamielennox | morganfainberg: right - but the point is the path has changed so if you're doing a mock on the function it will fail | 00:36 |
| morganfainberg | because it is further reaching than changing the call | 00:36 |
| * morganfainberg shrugs | 00:36 | |
| jamielennox | it would work if the fixture was in oslo.utils | 00:36 |
| morganfainberg | which would be what i'd advocate | 00:36 |
| jamielennox | but the last thing i submitted to oslo.utils has been unreviewed since.... | 00:36 |
| morganfainberg | vs. using time override | 00:37 |
| morganfainberg | dhellmann, ^^ ;) | 00:37 |
| jamielennox | oh no, only the start of dec | 00:37 |
| morganfainberg | jamielennox, and thats fair, just time_override is icky-ish. | 00:37 |
| morganfainberg | eh, i can't fault people for early dec -> now limited review time | 00:37 |
| morganfainberg | due to holidays | 00:37 |
| morganfainberg | if it was say mid november i'd be more worried | 00:38 |
| jamielennox | right - i've got a few of those old ones, thought it was going to be more dramatic :) | 00:38 |
| *** _cjones_ has quit IRC | 00:40 | |
| *** _cjones_ has joined #openstack-keystone | 00:46 | |
| *** nellysmitt has joined #openstack-keystone | 00:48 | |
| *** dgonzalez has joined #openstack-keystone | 00:51 | |
| *** nellysmitt has quit IRC | 00:53 | |
| *** _cjones_ has quit IRC | 00:55 | |
| *** dgonzalez has quit IRC | 00:56 | |
| *** LinstatSDR has joined #openstack-keystone | 00:56 | |
| *** zzzeek has quit IRC | 00:59 | |
| *** dgonzalez has joined #openstack-keystone | 01:00 | |
| *** dgonzalez has joined #openstack-keystone | 01:01 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Use a test fixture for mocking time https://review.openstack.org/145981 | 01:02 |
| *** dgonzalez has quit IRC | 01:05 | |
| *** gyee has quit IRC | 01:08 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use a test fixture for mocking time https://review.openstack.org/145989 | 01:09 |
| jamielennox | bknudson: both updated ^ | 01:09 |
| *** samueldmq has joined #openstack-keystone | 01:15 | |
| ayoung | dstanek, what is this code testing for, and do we need it? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_policy.py#n215 | 01:54 |
| ayoung | Mock Time, Mock! 1 2 3 4.... | 01:54 |
| *** dims__ has joined #openstack-keystone | 01:55 | |
| *** dims__ has quit IRC | 01:55 | |
| *** dims__ has joined #openstack-keystone | 01:55 | |
| *** xianghuihui has joined #openstack-keystone | 01:59 | |
| *** dgonzalez has joined #openstack-keystone | 02:01 | |
| *** xianghuihui has quit IRC | 02:05 | |
| *** dgonzalez has quit IRC | 02:06 | |
| jamielennox | ayoung, morganfainberg: anyone here? | 02:08 |
| morganfainberg | jamielennox, maybe :P | 02:08 |
| jamielennox | can we approve https://review.openstack.org/#/c/145981/2 and https://review.openstack.org/#/c/145989/ | 02:08 |
| jamielennox | s/we/you | 02:08 |
| morganfainberg | no >.> | 02:09 |
| morganfainberg | <.< | 02:09 |
| jamielennox | unblocks client and middleware oslo.utils problem | 02:09 |
| morganfainberg | but i dunt wanna /s | 02:09 |
| jamielennox | morganfainberg: lol - thanks | 02:11 |
| morganfainberg | :) | 02:12 |
| openstackgerrit | ayoung proposed openstack/keystone: common cloud policy logic https://review.openstack.org/123509 | 02:18 |
| ayoung | jamielennox, I'm 'ere | 02:18 |
| jamielennox | ayoung: morgan beat you to it | 02:18 |
| ayoung | jamielennox, good. I shouldn't be the one +Aing everything | 02:18 |
| *** oomichi has joined #openstack-keystone | 02:18 | |
| *** chrisshattuck has joined #openstack-keystone | 02:19 | |
| openstackgerrit | ayoung proposed openstack/keystone: common cloud policy logic https://review.openstack.org/123509 | 02:26 |
| ayoung | if that commit comment gets any longer, people are going to think John Dennis wrote it. | 02:26 |
| openstackgerrit | ayoung proposed openstack/keystone: common cloud policy logic https://review.openstack.org/123509 | 02:27 |
| *** chrisshattuck has quit IRC | 02:28 | |
| *** jamielennox is now known as jamielennox|away | 02:30 | |
| *** chrisshattuck has joined #openstack-keystone | 02:31 | |
| *** pcaruana is now known as pcaruana|afk| | 02:34 | |
| *** jamielennox|away is now known as jamielennox | 02:37 | |
| *** chrisshattuck has quit IRC | 02:43 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Use a test fixture for mocking time https://review.openstack.org/145989 | 02:48 |
| *** nellysmitt has joined #openstack-keystone | 02:49 | |
| *** erkules_ has joined #openstack-keystone | 02:49 | |
| *** chlong has joined #openstack-keystone | 02:49 | |
| *** erkules has quit IRC | 02:50 | |
| *** jamielennox is now known as jamielennox|away | 02:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use a test fixture for mocking time https://review.openstack.org/145981 | 02:52 |
| *** nellysmitt has quit IRC | 02:53 | |
| *** jamielennox|away is now known as jamielennox | 03:01 | |
| *** dgonzalez has joined #openstack-keystone | 03:02 | |
| *** andreaf has quit IRC | 03:04 | |
| *** andreaf has joined #openstack-keystone | 03:04 | |
| *** dgonzalez has quit IRC | 03:06 | |
| *** richm has quit IRC | 03:21 | |
| *** david-lyle has joined #openstack-keystone | 03:29 | |
| *** lhcheng has quit IRC | 03:35 | |
| *** lhcheng has joined #openstack-keystone | 03:35 | |
| *** harlowja is now known as harlowja_away | 03:38 | |
| *** lhcheng has quit IRC | 03:40 | |
| *** dims__ has quit IRC | 03:40 | |
| *** dims__ has joined #openstack-keystone | 03:41 | |
| *** dims__ has quit IRC | 03:45 | |
| *** rwsu has quit IRC | 03:53 | |
| openstackgerrit | wanghong proposed openstack/keystone: clean up type filter definition of policy list https://review.openstack.org/146007 | 04:01 |
| *** oomichi has quit IRC | 04:01 | |
| *** dgonzalez has joined #openstack-keystone | 04:03 | |
| *** links has joined #openstack-keystone | 04:07 | |
| *** dgonzalez has quit IRC | 04:07 | |
| *** oomichi has joined #openstack-keystone | 04:14 | |
| openstackgerrit | wanghong proposed openstack/keystone-specs: fix the doc of policy list API https://review.openstack.org/146010 | 04:16 |
| *** david-lyle has quit IRC | 04:17 | |
| *** stevemar has joined #openstack-keystone | 04:23 | |
| *** ChanServ sets mode: +v stevemar | 04:23 | |
| *** erkules_ is now known as erkules | 04:34 | |
| *** nellysmitt has joined #openstack-keystone | 04:50 | |
| *** nellysmitt has quit IRC | 04:55 | |
| *** dgonzalez has joined #openstack-keystone | 05:04 | |
| *** lhcheng has joined #openstack-keystone | 05:05 | |
| *** dgonzalez has quit IRC | 05:08 | |
| *** ajayaa has joined #openstack-keystone | 05:18 | |
| *** samueldmq has quit IRC | 05:20 | |
| *** _cjones_ has joined #openstack-keystone | 05:23 | |
| *** _cjones_ has quit IRC | 05:32 | |
| *** _cjones_ has joined #openstack-keystone | 05:32 | |
| *** _cjones_ has quit IRC | 05:40 | |
| *** jimbaker has quit IRC | 05:51 | |
| *** dgonzalez has joined #openstack-keystone | 06:04 | |
| *** junhongl has quit IRC | 06:05 | |
| *** junhongl has joined #openstack-keystone | 06:05 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/145135 | 06:06 |
| *** dgonzalez has quit IRC | 06:09 | |
| *** zz_avozza is now known as avozza | 06:21 | |
| *** nellysmitt has joined #openstack-keystone | 06:51 | |
| *** nellysmitt has quit IRC | 06:54 | |
| *** jimbaker has joined #openstack-keystone | 07:00 | |
| *** jimbaker has quit IRC | 07:00 | |
| *** jimbaker has joined #openstack-keystone | 07:00 | |
| *** dims__ has joined #openstack-keystone | 07:00 | |
| *** dgonzalez has joined #openstack-keystone | 07:05 | |
| *** dims__ has quit IRC | 07:06 | |
| *** lhcheng has quit IRC | 07:09 | |
| *** dgonzalez has quit IRC | 07:10 | |
| *** jamielennox is now known as jamielennox|away | 07:15 | |
| *** mflobo has joined #openstack-keystone | 07:35 | |
| *** dgonzalez has joined #openstack-keystone | 08:06 | |
| *** dgonzalez has quit IRC | 08:11 | |
| *** afazekas_ has joined #openstack-keystone | 08:18 | |
| *** ajayaa has quit IRC | 08:30 | |
| *** ajayaa has joined #openstack-keystone | 08:31 | |
| *** _cjones_ has joined #openstack-keystone | 08:41 | |
| *** oomichi has quit IRC | 08:41 | |
| *** _cjones_ has quit IRC | 08:46 | |
| *** nellysmitt has joined #openstack-keystone | 08:55 | |
| *** nellysmitt has quit IRC | 08:59 | |
| *** jistr has joined #openstack-keystone | 09:05 | |
| *** dgonzalez has joined #openstack-keystone | 09:07 | |
| *** dgonzalez has quit IRC | 09:11 | |
| *** nellysmitt has joined #openstack-keystone | 09:12 | |
| *** boris-42 has quit IRC | 09:13 | |
| openstackgerrit | wanghong proposed openstack/keystone: do parameter check before updating endpoint_group https://review.openstack.org/146040 | 09:25 |
| *** fmarco76 has joined #openstack-keystone | 09:42 | |
| *** bdossant has joined #openstack-keystone | 09:42 | |
| *** stevemar has quit IRC | 09:44 | |
| *** andreaf has quit IRC | 09:44 | |
| *** andreaf has joined #openstack-keystone | 09:47 | |
| *** henrynash has joined #openstack-keystone | 09:47 | |
| *** ChanServ sets mode: +v henrynash | 09:47 | |
| *** henrynash has quit IRC | 09:48 | |
| *** andreaf has quit IRC | 09:49 | |
| *** andreaf has joined #openstack-keystone | 09:49 | |
| *** henrynash has joined #openstack-keystone | 09:50 | |
| *** ChanServ sets mode: +v henrynash | 09:50 | |
| *** henrynash has quit IRC | 09:50 | |
| *** rushiagr_away is now known as rushiagr | 09:52 | |
| *** bdossant_ has joined #openstack-keystone | 09:54 | |
| *** bdossant has quit IRC | 09:54 | |
| *** dgonzale_ has joined #openstack-keystone | 10:02 | |
| *** dgonzale_ has quit IRC | 10:02 | |
| *** KanagarajM has joined #openstack-keystone | 10:07 | |
| *** fmarco76 has left #openstack-keystone | 10:09 | |
| *** rushiagr is now known as rushiagr_away | 10:11 | |
| *** afazekas_ is now known as afazekas | 10:11 | |
| *** avozza is now known as zz_avozza | 10:16 | |
| *** rushiagr_away is now known as rushiagr | 10:18 | |
| *** zz_avozza is now known as avozza | 10:28 | |
| *** rushiagr is now known as rushiagr_away | 10:30 | |
| *** bdossant_ has quit IRC | 10:53 | |
| *** KanagarajM has quit IRC | 11:12 | |
| *** links has quit IRC | 11:13 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 11:17 |
| *** avozza is now known as zz_avozza | 11:49 | |
| *** jaosorior has joined #openstack-keystone | 11:50 | |
| *** fmarco76 has joined #openstack-keystone | 11:59 | |
| *** EmilienM|afk is now known as EmilienM | 12:07 | |
| *** boris-42 has joined #openstack-keystone | 12:15 | |
| *** fmarco76 has left #openstack-keystone | 12:19 | |
| *** chlong has quit IRC | 12:32 | |
| *** bdossant has joined #openstack-keystone | 12:38 | |
| *** EmilienM is now known as EmilienM|afk | 12:52 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Scope federated token with 'token' identity method https://review.openstack.org/130593 | 12:57 |
| *** EmilienM|afk is now known as EmilienM | 13:09 | |
| *** bdossant has quit IRC | 13:15 | |
| *** radez_g0n3 is now known as radez | 13:19 | |
| *** bdossant has joined #openstack-keystone | 13:19 | |
| *** dims__ has joined #openstack-keystone | 13:28 | |
| *** samueldmq has joined #openstack-keystone | 13:28 | |
| marekd | morganfainberg: ayoung any links with revocation events patches to be reviewed? | 13:32 |
| *** dims_ has joined #openstack-keystone | 13:33 | |
| *** dims__ has quit IRC | 13:35 | |
| *** dims_ has quit IRC | 13:37 | |
| *** dims__ has joined #openstack-keystone | 13:41 | |
| *** pcaruana|afk| has quit IRC | 13:53 | |
| *** rushiagr_away is now known as rushiagr | 14:06 | |
| *** mattfarina has joined #openstack-keystone | 14:07 | |
| *** rushiagr is now known as rushiagr_away | 14:10 | |
| *** sriram has joined #openstack-keystone | 14:16 | |
| *** richm has joined #openstack-keystone | 14:19 | |
| *** joesavak has joined #openstack-keystone | 14:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/145886 | 14:28 |
| *** ajayaa has quit IRC | 14:28 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/145897 | 14:35 |
| *** jungleboyj has joined #openstack-keystone | 14:51 | |
| *** topol has joined #openstack-keystone | 14:52 | |
| *** ChanServ sets mode: +v topol | 14:52 | |
| *** pcaruana|afk| has joined #openstack-keystone | 14:52 | |
| *** jbonjean has quit IRC | 14:54 | |
| jaosorior | Is there a reason why the 'auth_version' in the auth_token in keystonemiddleware is | 15:02 |
| jaosorior | coded to use 'v3.0' instead of 'v3'? | 15:02 |
| jaosorior | That's pretty confusing, as 'v3' is used all around the documentation, not 'v3.0' | 15:02 |
| jaosorior | And I was thinking of adding the usage of 'v3' as an option | 15:03 |
| *** packet has joined #openstack-keystone | 15:03 | |
| bknudson | jaosorior: that change is already proposed: https://review.openstack.org/#/c/130916/ | 15:04 |
| jaosorior | bknudson: Thanks | 15:05 |
| *** jbonjean has joined #openstack-keystone | 15:20 | |
| ayoung | marekd, https://review.openstack.org/#/c/81166/ | 15:24 |
| marekd | ayoung: thanks. | 15:24 |
| *** LinstatSDR has quit IRC | 15:25 | |
| *** LinstatSDR has joined #openstack-keystone | 15:25 | |
| marekd | ayoung: https://review.openstack.org/#/c/130593/ | 15:29 |
| ayoung | marekd, looking | 15:29 |
| *** gordc has joined #openstack-keystone | 15:31 | |
| marekd | ayoung: thanks for the review. | 15:32 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystone: Use dict comprehensions instead of dict constructor https://review.openstack.org/143842 | 15:33 |
| *** andreaf has quit IRC | 15:34 | |
| *** jbonjean has quit IRC | 15:36 | |
| *** vhoward has joined #openstack-keystone | 15:36 | |
| *** samueldmq has quit IRC | 15:39 | |
| *** jbonjean has joined #openstack-keystone | 15:44 | |
| *** jbonjean has quit IRC | 15:44 | |
| *** jbonjean has joined #openstack-keystone | 15:44 | |
| marekd | ayoung: regarding this: https://github.com/openstack/python-keystoneclient-federation . The goal is to move keystoneclient/contrib/auth/v3/{saml2, federation}.py and keystoneclient/v3/contrib/federation to that repo? | 15:48 |
| *** chrisshattuck has joined #openstack-keystone | 15:48 | |
| ayoung | marekd, that is my understanding, yes | 15:48 |
| ayoung | marekd, I wasn';t really driving it, but its what we had to do for Kerberos | 15:49 |
| ayoung | makes sense from a dependency standpoint | 15:49 |
| * ayoung grumbles about setuptools and multiple repos again | 15:49 | |
| marekd | and ksc would simply import module like: from keystoneclient_federation import auth.saml2 | 15:49 |
| ayoung | marekd, use stevedore to get the auth plugins | 15:49 |
| marekd | ok, and CRUD operations, for like IDPs ? | 15:50 |
| *** afazekas has quit IRC | 15:50 | |
| ayoung | marekd, see https://review.openstack.org/#/c/115463/7/openstack_auth/utils.py,cm for the general approach | 15:50 |
| ayoung | although that needs to be rebased....jamie posted an update of the previous patch | 15:51 |
| ayoung | https://review.openstack.org/#/c/121281/7 | 15:51 |
| marekd | allright | 15:51 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/145897 | 16:00 |
| *** ajayaa has joined #openstack-keystone | 16:00 | |
| *** openstackgerrit has quit IRC | 16:05 | |
| *** openstackgerrit has joined #openstack-keystone | 16:05 | |
| *** chrisshattuck has quit IRC | 16:06 | |
| *** zzzeek has joined #openstack-keystone | 16:06 | |
| *** jorge_munoz has quit IRC | 16:15 | |
| *** henrynash has joined #openstack-keystone | 16:18 | |
| *** ChanServ sets mode: +v henrynash | 16:18 | |
| *** _cjones_ has joined #openstack-keystone | 16:21 | |
| *** jorge_munoz has joined #openstack-keystone | 16:21 | |
| ayoung | bknudson, lbragstad dolphm could I get this one through? There is a chain of work based on the "explicit unscoped" and this is a fairly simple step | 16:21 |
| *** chrisshattuck has joined #openstack-keystone | 16:28 | |
| *** zz_avozza is now known as avozza | 16:36 | |
| *** stevemar has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +v stevemar | 16:36 | |
| openstackgerrit | ayoung proposed openstack/keystone: default policy https://review.openstack.org/140113 | 16:43 |
| *** rwsu has joined #openstack-keystone | 16:53 | |
| *** avozza is now known as zz_avozza | 16:56 | |
| *** bdossant_ has joined #openstack-keystone | 17:01 | |
| *** EmilienM is now known as EmilienM|afk | 17:04 | |
| *** bdossant has quit IRC | 17:04 | |
| *** spligak has quit IRC | 17:05 | |
| *** bdossant_ has quit IRC | 17:05 | |
| *** jorge_munoz has quit IRC | 17:06 | |
| *** jorge_munoz has joined #openstack-keystone | 17:09 | |
| *** dims__ has quit IRC | 17:22 | |
| *** dims__ has joined #openstack-keystone | 17:22 | |
| *** dims__ has quit IRC | 17:27 | |
| *** gyee has joined #openstack-keystone | 17:30 | |
| *** ChanServ sets mode: +v gyee | 17:30 | |
| *** jistr_ has joined #openstack-keystone | 17:31 | |
| *** lsmola_ has joined #openstack-keystone | 17:31 | |
| *** lhcheng has joined #openstack-keystone | 17:31 | |
| *** lsmola has quit IRC | 17:35 | |
| *** jistr has quit IRC | 17:35 | |
| *** lsmola_ has quit IRC | 17:37 | |
| *** jistr_ has quit IRC | 17:37 | |
| *** dims__ has joined #openstack-keystone | 17:49 | |
| *** lsmola_ has joined #openstack-keystone | 17:51 | |
| *** dims__ is now known as dimsum__ | 17:53 | |
| *** jorge_munoz has quit IRC | 18:02 | |
| *** jorge_munoz has joined #openstack-keystone | 18:09 | |
| *** samueldmq has joined #openstack-keystone | 18:18 | |
| *** jorge_munoz has quit IRC | 18:20 | |
| *** samueldmq has quit IRC | 18:22 | |
| *** raildo has joined #openstack-keystone | 18:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/145666 | 18:28 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/145886 | 18:28 |
| *** samueldmq has joined #openstack-keystone | 18:35 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/146166 | 18:35 |
| *** samueldmq has quit IRC | 18:36 | |
| *** raildo has quit IRC | 18:41 | |
| openstackgerrit | Merged openstack/keystone: Fix tests using extension drivers https://review.openstack.org/124603 | 18:49 |
| *** harlowja_away is now known as harlowja | 18:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/145666 | 18:52 |
| openstackgerrit | Merged openstack/keystone: Cleanup test-requirements for keystoneclient https://review.openstack.org/136939 | 18:52 |
| -openstackstatus- NOTICE: paste.openstack.org is going offline for a database migration (duration: ~2 minutes) | 18:58 | |
| ayoung | bknudson, in keystoneclient/fixtures/v3 the sample data does not have 'id' fields nor necessarily names in them. This is not what the spec shows; those fields are required. Adding them is the right thing to do, right? Otherwise, my AccessInfo objects are blowing up with invalid data. | 19:05 |
| bknudson | ayoung: yes, we want the fixtures to be whatever keystone would generate. | 19:05 |
| ayoung | bknudson, thanks, just checking | 19:07 |
| bknudson | if the fixtures are wrong then there's danger that the tests aren't validating what we want them to. | 19:08 |
| *** ajayaa has quit IRC | 19:12 | |
| *** jorge_munoz has joined #openstack-keystone | 19:17 | |
| *** EmilienM|afk is now known as EmilienM | 19:24 | |
| *** _cjones_ has quit IRC | 19:36 | |
| *** _cjones_ has joined #openstack-keystone | 19:41 | |
| ayoung | bknudson, stevemar "# NOTE(stevemar): Federated tokens do not have a domain for the user" why not? | 19:44 |
| bknudson | ayoung: the user doesn't exist in keystone, only the idp | 19:45 |
| ayoung | bknudson, we don't even put them in a federated domain? Seems wrong. | 19:46 |
| ayoung | Like, broken abstraction levels of wrong | 19:46 |
| stevemar | all they really care about is the role, the user can have a role on any domain or assignment, so the user doesn't have to live in a domain | 19:47 |
| stevemar | we already hashed this out before? i think we didn't want yet another dummy domain | 19:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor keystone-all and http/keystone https://review.openstack.org/62275 | 19:48 |
| *** zzzeek has quit IRC | 19:49 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use RequestBodySizeLimiter from oslo.middleware https://review.openstack.org/144697 | 19:52 |
| *** bdossant has joined #openstack-keystone | 19:53 | |
| *** samueldmq has joined #openstack-keystone | 19:56 | |
| ayoung | stevemar, yeah, yeah. It is still a mistake. We took away the only way we had to distinguish the grouping of users. Since Federated users don't have domains, none of the code can assume that the Domain is there on users, and the abstration goes from asset to liability | 19:57 |
| samueldmq | henrynash, ping - need to talk about the current representation of OS-INHERIT in role assignments | 19:57 |
| ayoung | and regular users don't have an IdP | 19:57 |
| ayoung | we basically split the user set | 19:58 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Switch from oslo.utils to oslo_utils https://review.openstack.org/145962 | 19:58 |
| *** bdossant has quit IRC | 19:59 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/145886 | 20:00 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Switch from oslo.utils to oslo_utils https://review.openstack.org/145962 | 20:02 |
| *** bdossant has joined #openstack-keystone | 20:03 | |
| samueldmq | bknudson, still working on the chain that starts at https://review.openstack.org/#/c/142545/ ? | 20:03 |
| ayoung | We need to stop doing this to people. When we mess with the basic language of the abstractions, it gets really confusing. We can't even answer the question "does a user have a domain" with a simple yes/no. | 20:03 |
| samueldmq | bknudson, just got confused because they're on stable/juno instead of on master | 20:03 |
| ayoung | I blame gyee | 20:03 |
| ayoung | he's the one that railroaded through domains years ago | 20:04 |
| bknudson | samueldmq: these are backports from master. | 20:04 |
| * ayoung ready to go all second system syndrome on Keystone | 20:04 | |
| samueldmq | bknudson, ok | 20:05 |
| samueldmq | bknudson, what happens to the juno vX when we backport some changes ? | 20:06 |
| samueldmq | bknudson, we then release juno vX.1 ? | 20:06 |
| samueldmq | bknudson, dumb question; but I don't know how is this workflow | 20:06 |
| bknudson | samueldmq: yes, we get a new release of juno every once in a while, 2014.2.2 or whatever. | 20:07 |
| samueldmq | bknudson, ok thanks.. will review that chain | 20:07 |
| bknudson | samueldmq: for the backports, just a) make sure it's acceptable to backport, and b) make sure the change in stable/juno is the same as the change in master. | 20:08 |
| bknudson | if there's any problems in the code, the fixes need to be made to master and then backported. | 20:08 |
| samueldmq | bknudson, hmm .. I thought we needed to merge the changes in the older version and then rebase master | 20:09 |
| samueldmq | bknudson, but in fact we apply changes in both .. | 20:09 |
| bknudson | samueldmq: changes go in master first and then are backported. | 20:09 |
| samueldmq | bknudson, nice | 20:09 |
| samueldmq | bknudson, so that chain is already merged in master? | 20:09 |
| bknudson | otherwise you might have a fix in juno that's not in kilo. | 20:09 |
| morganfainberg | bknudson: ++ | 20:10 |
| bknudson | samueldmq: all those changes are already merged in master... it wasn't a chain in master. | 20:10 |
| morganfainberg | ayoung: bknudson I thought we pushed for federated users / Idps to be tied to a domain but there was dissent that it was even needed. | 20:11 |
| samueldmq | bknudson, so no need to review them since they're already merged in master ? | 20:11 |
| bknudson | samueldmq: the review in the stable branches are to make sure it's an ok change to go in stable and also to make sure the backport was done correctly... so they still need to be reviewed it's just a different kind of review. | 20:12 |
| bknudson | samueldmq: if somebody's already reviewed it for those things then your time is probably better spent reviewing something else. | 20:13 |
| bknudson | samueldmq: and if you do review it for those 2 things then make sure you mention that in your review comments. | 20:14 |
| *** zzzeek has joined #openstack-keystone | 20:14 | |
| samueldmq | bknudson, ack | 20:15 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Switch from oslo.utils to oslo_utils https://review.openstack.org/145968 | 20:15 |
| *** bdossant has quit IRC | 20:17 | |
| *** LinstatSDR has quit IRC | 20:18 | |
| *** andreaf has joined #openstack-keystone | 20:18 | |
| stevemar | hey bknudson what was the reason for oslo to drop namespace packages? | 20:23 |
| *** bdossant has joined #openstack-keystone | 20:23 | |
| bknudson | stevemar: I guess it caused to many problems with installing packages? | 20:24 |
| * stevemar shrugs, i was just curious | 20:24 | |
| *** bdossant has quit IRC | 20:29 | |
| morganfainberg | bknudson, it's an issue with develop mode installs | 20:29 |
| morganfainberg | stevemar, ^ | 20:29 |
| morganfainberg | if you install a non-develop mode and then a develop mode (or vice versa) the packages end up all sorts of broken. | 20:30 |
| morganfainberg | you end up missing like oslo.db but oslo.config is installed | 20:30 |
| morganfainberg | it gets even wonkier in other cases. but that was the really big issue - made devstack and other development much harder - it also makes packaging wierd because you need a stub package to own "oslo" then packages for .db and .config etc | 20:31 |
| morganfainberg | python packaging is lacking in a number of ways | 20:31 |
| *** pack3t has joined #openstack-keystone | 20:31 | |
| bknudson | <insert system here> packaging is lacking in a number of ways | 20:32 |
| *** nellysmitt has quit IRC | 20:36 | |
| stevemar | i never realized how much trouble packaging was :( | 20:37 |
| stevemar | is the oslo team going to move all oslo.* libraries to oslo_* | 20:38 |
| stevemar | ? | 20:38 |
| bknudson | stevemar: that's my understanding. | 20:39 |
| ayoung | GAH! Roles are by name (only) in the use section, and by ID (only) in the metadata. What the actual? V2 tokens must die! | 20:46 |
| ayoung | morganfainberg, So in parsing a V2 tokens, I can get the name. I can get the id. I have no correlation between these two pieces of data. I have two choices: make ID optional, or fake it out using the name. | 20:49 |
| ayoung | I think I am just going to fake it. Why do roles even have IDs anyway? We never use them | 20:50 |
| samueldmq | ayoung, why do users have IDs anyway, since (name, domain) could be used as pk? :p | 20:52 |
| ayoung | samueldmq, cuz someone wanted to be able to anonymize them? | 20:52 |
| samueldmq | ayoung, couldnt be the same case as roles? | 20:52 |
| ayoung | because there is no good way to split the user/domain if it is in a single string | 20:52 |
| *** zz_avozza is now known as avozza | 20:52 | |
| ayoung | samueldmq, nope. Roles are purelu internal. We never user the role Ids | 20:53 |
| ayoung | and the role definitions have to be public. | 20:53 |
| ayoung | No info hiding possible | 20:53 |
| ayoung | besides, we only define 3 or so roles by default | 20:53 |
| ayoung | the ID part of roles is only there for hobgoblin purposes | 20:53 |
| *** avozza is now known as zz_avozza | 20:54 | |
| samueldmq | or to be in accordance with *all* the other entities on OS | 20:54 |
| samueldmq | ? | 20:54 |
| samueldmq | ayoung, well, what's the problem you're facing? would be glad to help if I can | 20:55 |
| ayoung | samueldmq, I'm trying to do the AccessInfo thing. | 20:55 |
| ayoung | and I need to parse v2 tokens | 20:56 |
| ayoung | I want the "role" object to be a valid object, and that means it has id and name, IAW the spec | 20:56 |
| ayoung | but | 20:56 |
| samueldmq | ayoung, what a v2 token looks like? any link? | 20:56 |
| ayoung | Roles are by name (only) in the use section, and by ID (only) in the metadata. | 20:56 |
| ayoung | samueldmq, yeah, 1 sec | 20:56 |
| ayoung | samueldmq, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/examples/pki/cms/auth_token_scoped.json | 20:57 |
| samueldmq | ayoung, so roles_links contains ids? | 20:58 |
| ayoung | samueldmq, actually,that one has no metadata.... | 20:58 |
| ayoung | let me see if I can find another | 20:58 |
| samueldmq | ayoung, and roles: [] just the entities with names ? | 20:58 |
| samueldmq | ayoung, k | 20:58 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/test_token_provider.py#n33 | 21:00 |
| ayoung | samueldmq, so, that one has no metadata either | 21:01 |
| ayoung | I know that they are there in actual tokens. | 21:01 |
| ayoung | But...if we can't count on it, we have no role id to get anyway | 21:01 |
| ayoung | samueldmq, in V3 we have: | 21:01 |
| ayoung | both id and name...it is just for V2 that it is an issue. | 21:02 |
| ayoung | So maybe I just drop the id when parsing aV2 token? Yuck | 21:02 |
| samueldmq | hmm | 21:02 |
| samueldmq | token validation is at service side, right? | 21:02 |
| samueldmq | and they need to ensure that's a valid role ? (if so, they need to query keystone, right)? | 21:03 |
| *** bdossant has joined #openstack-keystone | 21:03 | |
| *** bdossant has quit IRC | 21:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check consumer and project id before creating request token https://review.openstack.org/145701 | 21:09 |
| morganfainberg | ayoung, ooh i need to send out the LDAP identity survey. | 21:10 |
| ayoung | morganfainberg, who created the oslo-policy repo? | 21:11 |
| morganfainberg | ayoung, hm. uh rodrigods ? | 21:12 |
| morganfainberg | ayoung, i think? | 21:12 |
| morganfainberg | the one in github right? | 21:12 |
| rodrigods | morganfainberg, ayoung, yes... me | 21:12 |
| morganfainberg | or has it been merged to git.openstack. | 21:12 |
| rodrigods | not yet | 21:12 |
| ayoung | https://github.com/rodrigods/oslo.policy | 21:12 |
| samueldmq | morganfainberg, ayoung https://github.com/rodrigods/oslo.policy | 21:12 |
| rodrigods | ayoung, that's right | 21:13 |
| samueldmq | ayoung, yep that one | 21:13 |
| *** raildo has joined #openstack-keystone | 21:13 | |
| *** jdennis has quit IRC | 21:14 | |
| morganfainberg | wow... #googlefail | 21:15 |
| morganfainberg | they broke the google drive ui | 21:15 |
| morganfainberg | badly | 21:15 |
| samueldmq | checking in 3, 2 ,1 .. | 21:15 |
| morganfainberg | now it only tells me "you can upload things" on the main page. | 21:15 |
| morganfainberg | nothing loads but that. greaaaaat | 21:15 |
| morganfainberg | or some new ui i can't go back to classic | 21:16 |
| ayoung | rodrigods, http://docs.openstack.org/infra/manual/creators.html | 21:16 |
| samueldmq | morganfainberg, you can go back :p | 21:17 |
| samueldmq | morganfainberg, go in settings -> Leave the new Drive | 21:17 |
| morganfainberg | samueldmq, hm. | 21:17 |
| morganfainberg | samueldmq, nope option isn't there for me. | 21:18 |
| samueldmq | morganfainberg, well I just did it | 21:18 |
| morganfainberg | samueldmq, more and more i want to stop using all google products except search - it's about the only thing they seem to do right. | 21:18 |
| samueldmq | morganfainberg, they chose you to test the new ui | 21:18 |
| samueldmq | morganfainberg, that's why you cant leave | 21:18 |
| morganfainberg | i can't leave because too many people use their products - it's currently easier to stay with them (but not by much). | 21:19 |
| morganfainberg | dropbox is looking better and better for ~90% of what i use google (non-email, non-search) for | 21:19 |
| * samueldmq needs to try more dropbox | 21:20 | |
| gyee | ayoung, multi-tenancy is about resource isolation | 21:23 |
| ayoung | gyee, I still blame you | 21:23 |
| gyee | right now, with the way federation is implement, we can't isolate an IdP with a project or domain | 21:23 |
| gyee | IdP is global | 21:23 |
| gyee | for a private cloud this may be fine | 21:24 |
| gyee | for a co-tenant model, it may not be | 21:24 |
| gyee | multi-tenancy is really about resource isolation | 21:25 |
| nkinder | gyee: you sort of can associate an IdP with a domain/project through the group mapping | 21:26 |
| nkinder | gyee: users from an IdP can only map to the groups that you put in the mapping, and projects are controlled by role assignment at the group level | 21:27 |
| gyee | nkinder, sure, but you still expose IdP globally | 21:28 |
| nkinder | gyee: you mean the IdP specific URIs being accessible by anyone? | 21:30 |
| gyee | right | 21:30 |
| nkinder | gyee: I wonder if you could just lock it down in the httpd config | 21:32 |
| gyee | with virtualhost, yeah maybe | 21:32 |
| *** jdennis has joined #openstack-keystone | 21:32 | |
| nkinder | gyee: well, each IdP could be specified as a <Location> (that's how I've set it up) | 21:33 |
| *** jaosorior has quit IRC | 21:33 | |
| nkinder | gyee: so you could just do "Deny from all", then allow access to it from whatever network(s)/ip(s)/host(s) you want | 21:34 |
| gyee | nkinder, yeah, I am heading down that path :) | 21:34 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 21:34 |
| nkinder | gyee: seems like the best way to go | 21:35 |
| ayoung | samueldmq, rodrigods morganfainberg https://launchpad.net/oslo/oslo.policy | 21:35 |
| ayoung | should I create a new group for it? | 21:35 |
| gyee | nkinder, for now yes, ideally if we can do this dynamically that would be awesome | 21:35 |
| rodrigods | ayoung, ++ nice | 21:35 |
| gyee | nkinder, like the way we do domain-specific backends | 21:36 |
| gyee | dynamically configure IdPs, without having to touch config files and restart services | 21:36 |
| ayoung | gyee, why would we not say that each IdP is-a domain? | 21:36 |
| nkinder | gyee: you can't do that though (dynamically configure IdPs) | 21:37 |
| gyee | ayoung, ideally we should | 21:37 |
| gyee | nkinder, that's why I said ideally | 21:37 |
| samueldmq | raildo, thanks for addressing my comments on reseller spec | 21:37 |
| ayoung | gyee, so does anyone actually disagree with that, then? | 21:37 |
| nkinder | gyee: how would you set up the apache module, generate SP metadata (for SAML), and tell the IdP about your SP? | 21:37 |
| samueldmq | raildo, I will re-review it soon :) | 21:37 |
| raildo | samueldmq, :) thanks | 21:37 |
| ayoung | can we make that a reality? create IdP creates a new domain entry? | 21:37 |
| gyee | nkinder, for k2k, we sign the saml2 assertion with xmlsec1 | 21:38 |
| gyee | we should be able to do the same with it, bypass shibd | 21:38 |
| gyee | bypassing | 21:38 |
| gyee | like xmlsec1 --verify | 21:39 |
| nkinder | I really think this logic should all stay outside of keystone as much as possible (k2k is a bit of an exception since we're acting as an IdP) | 21:39 |
| gyee | nkinder, for us, having to do a deployment to add IdP is a PITA | 21:39 |
| gyee | we have to touch so many things, chef, QA, etc | 21:40 |
| nkinder | An external IdP needs to trust our SP metadata. Keystone can't do anything there. | 21:40 |
| ayoung | rodrigods, would you like to take care of the PyPi side of things? | 21:40 |
| nkinder | So you want to duplicate what mod_shib or mod_auth_mellon does in keystone itself? | 21:40 |
| morganfainberg | couldn't we just tie the IDP to a domain? | 21:40 |
| gyee | I would like to avoid write new chef recipe for a new IdP | 21:40 |
| nkinder | and not rely on httpd for that? | 21:40 |
| morganfainberg | i mean doesn't that solve *all* the issues with users being dumped in? | 21:40 |
| rodrigods | ayoung, yeah, I can do that | 21:41 |
| ayoung | ++ | 21:41 |
| gyee | nkinder, for us, new IdP means new deployment | 21:41 |
| nkinder | define "new IdP"... | 21:41 |
| gyee | we have to bake the IdP meta xml file into chef recipe | 21:41 |
| nkinder | do you mean you are setting up a new SAML IdP, or configuring keystone as an SP for an existing IdP? | 21:41 |
| ayoung | rodrigods, keep track of the state on https://blueprints.launchpad.net/oslo-incubator/+spec/graduate-policy | 21:41 |
| morganfainberg | nkinder, i think it affects both | 21:42 |
| rodrigods | ayoung, ok | 21:42 |
| gyee | nkinder, configure shibd to trust a new signer | 21:42 |
| morganfainberg | nkinder, k2k *and* strict shibd configuration fo any provider | 21:42 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Fixes 'OS-INHERIT:inherited_to' info in tests https://review.openstack.org/144542 | 21:42 |
| nkinder | well, the IdP also needs to trust your SP metadata | 21:43 |
| gyee | right, they'll have to do the same | 21:43 |
| gyee | is the CI/CD part that is PITA | 21:43 |
| morganfainberg | from a strict deployment standpoint - it would be nice to not need massive redeployment to get a new federated identity source (either k2k or ADFS[forexample]) to a keystone | 21:43 |
| gyee | morganfainberg, ++ | 21:44 |
| morganfainberg | i'm not sure if that is logistically possible. | 21:44 |
| nkinder | I don't get why it's a massive redeployment though | 21:44 |
| morganfainberg | since we're relying on something outside of keystone | 21:44 |
| morganfainberg | nkinder, most stuff in keystone [some limited config values] are APIs we can make these changes via | 21:44 |
| morganfainberg | nkinder, this is a case where we don't have a nice API to work with - it requires CMS changes to get a new idp trusted | 21:45 |
| nkinder | it's updating apache config and triggering it to reload it's config. I would expect this to be in the realm of puppet, etc. | 21:45 |
| morganfainberg | nkinder, exactly - CMS vs REST API in keystone - i don't think we can solve this in keystone | 21:45 |
| gyee | right puppet or chef | 21:45 |
| morganfainberg | this is likely going to always be a CMS thing | 21:45 |
| nkinder | yeah, understood. I'm thinking that we'll want puppet-keystone support for federation (and for whatever else people are using) | 21:45 |
| morganfainberg | unless keystone gets way smarter | 21:45 |
| nkinder | way smarter == way more complex | 21:46 |
| morganfainberg | and we chose to use mod_shib and not make keystone smarter for a reason | 21:46 |
| nkinder | +1 | 21:46 |
| nkinder | the CMS problem can be solved | 21:46 |
| morganfainberg | in a public cloud - CMS problems are big problems, in smaller private deployments they are still a problem, but not as massive | 21:46 |
| morganfainberg | since we want federated identity for all scales of deployment - this is something we need to look at closely and make the best recommendations we can | 21:47 |
| *** zz_avozza is now known as avozza | 21:47 | |
| morganfainberg | i don't have a good answer for this, but just summing up the issues gyee was pointing out | 21:47 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove unused fields in base TestCase https://review.openstack.org/146206 | 21:47 |
| morganfainberg | this comes back to making our deployer experience as good as possible. | 21:48 |
| *** sriram has quit IRC | 21:48 | |
| gyee | morganfainberg, I think this will be an interesting argument for awhile, keystone versus apache | 21:49 |
| nkinder | gyee, morganfainberg: yeah. I think the benefits outweigh the costs to be honest | 21:51 |
| nkinder | otherwise keystone needs to reimplement the world for things like x509 client auth, kerberos, openid, saml, etc. | 21:51 |
| gyee | nkinder, I think its case by case | 21:51 |
| nkinder | So making httpd as easy on deployers as possible is something we need to think about | 21:52 |
| gyee | and deployment model | 21:52 |
| morganfainberg | nkinder, defnitely not arguing to move the logic to keystone, but making a smart recommendation on how to handle deployment and updates as painless as possible is important | 21:52 |
| gyee | not disagreeing either | 21:52 |
| nkinder | morganfainberg: +1, understood. I'm not disagreeing either. :) | 21:53 |
| morganfainberg | now if shib could source it's information from somewhere other than an xml file this would be easier | 21:54 |
| gyee | nkinder, by CMS, you mean PKI/Z tokens right? | 21:54 |
| nkinder | CMS = config management | 21:54 |
| gyee | oh :) | 21:54 |
| morganfainberg | cms = configu.. yeagh | 21:55 |
| gyee | damn acronyms | 21:55 |
| morganfainberg | right? | 21:55 |
| morganfainberg | :P | 21:55 |
| nkinder | sorry, acronyms are overloaded. I blame morganfainberg for using it first :P | 21:55 |
| morganfainberg | HEY! | 21:55 |
| *** samueldmq has quit IRC | 21:55 | |
| openstackgerrit | Merged openstack/keystone: Keystoneclient tests from venv-installed client https://review.openstack.org/136636 | 21:55 |
| morganfainberg | openssl should have stuck with ASN1 | 21:55 |
| morganfainberg | not calling it cms :P | 21:55 |
| morganfainberg | i blame them | 21:55 |
| nkinder | I'm also without one typing finger due to an injury, so +1 for acronyms :) | 21:55 |
| gyee | lmao | 21:56 |
| morganfainberg | hm | 21:59 |
| morganfainberg | gyee, what version of shib are we using? | 21:59 |
| morganfainberg | because this looks to be in line with what we're looking at for *more* friendly setup: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider#NativeSPMetadataProvider-FolderMetadataProvider(Version2.5andAbove) | 22:00 |
| morganfainberg | still needs a reload it looks like to pickup new files | 22:01 |
| * morganfainberg grumbles. | 22:01 | |
| gyee | morganfainberg, libapache2-mod-shib2 2.5.2+dfsg-2 | 22:03 |
| morganfainberg | it *might* help | 22:03 |
| bknudson | looks like gyee doesn't want to have control over his environment | 22:03 |
| morganfainberg | at the very least each metadata could be isolated to a file. | 22:03 |
| gyee | bknudson, I love writing chef recipes | 22:04 |
| morganfainberg | gyee, i don't think there is a good way around needing chef/puppet for this | 22:05 |
| nkinder | morganfainberg: looking at mod_auth_mellon, it has a MellonIdPMetadataGlob directive | 22:05 |
| nkinder | so you can glob the metadata files in httpd config | 22:05 |
| morganfainberg | maybe mod_mellon is better at it? | 22:05 |
| bknudson | we should use chef/puppet to distribute the signing PKI certs. | 22:05 |
| morganfainberg | bknudson, likely you should. | 22:05 |
| nkinder | so you still need to get the XML onto the system, but httpd config may not need changes | 22:05 |
| *** jamielennox|away has quit IRC | 22:05 | |
| morganfainberg | nkinder, sure. | 22:05 |
| morganfainberg | nkinder, and probably need a graceful reload of apache | 22:05 |
| morganfainberg | nkinder, at the very least | 22:06 |
| nkinder | maybe, maybe not... | 22:06 |
| morganfainberg | nkinder,. with shib you do. wonder if mellon is better | 22:06 |
| nkinder | would need to test | 22:06 |
| gyee | I have to restart shibd everytime I make a change | 22:06 |
| morganfainberg | gyee, well with that metadata directive you can at least look for changes to current files | 22:07 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove unused fields in base TestCase https://review.openstack.org/146206 | 22:07 |
| nkinder | mellon doesn't have a daemon | 22:07 |
| gyee | bknudson, yes, we have a databag for SSL certs as well | 22:07 |
| morganfainberg | gyee, additions/removals would require shibd restarts | 22:07 |
| nkinder | so it's different from shib in thay way | 22:07 |
| morganfainberg | nkinder, still likely requires graceful. | 22:07 |
| morganfainberg | nkinder, but graceful is less impactful | 22:07 |
| gyee | nkinder, interesting, I haven't try mellon yet | 22:07 |
| gyee | maybe I'll give it a shot | 22:08 |
| nkinder | So I could see having a keystone API thay allows metadata to be uploaded, and a config directive can identify where to dump them | 22:08 |
| bknudson | more code removal: https://review.openstack.org/146206 -- getting closer to k0 (0 lines of code in keystone) | 22:08 |
| morganfainberg | nkinder, yeah. | 22:08 |
| morganfainberg | bknudson, lol | 22:08 |
| gyee | ha nice | 22:08 |
| nkinder | then some sort of graceful reload could be figured out (cron, a smarter trigger, etc.) | 22:08 |
| *** jamielennox|away has joined #openstack-keystone | 22:09 | |
| morganfainberg | nkinder, wonder what happens when apache cycles the children.. maybe it does something cool there and reloads. | 22:09 |
| *** jamielennox|away is now known as jamielennox | 22:09 | |
| morganfainberg | nkinder, even w/o the graceful | 22:09 |
| *** ChanServ sets mode: +v jamielennox | 22:09 | |
| *** joesavak has quit IRC | 22:09 | |
| morganfainberg | gyee, if mellon makes this better we should get setup w/ mellon documented | 22:10 |
| gyee | morganfainberg, sure | 22:10 |
| nkinder | morganfainberg: I have mellon config for keystone on my github | 22:10 |
| morganfainberg | gyee, i can see both shib and mellon being good options for setup - let the deployer choose the right option, especially if they are roughly equivalent | 22:10 |
| morganfainberg | nkinder, cool | 22:10 |
| gyee | sure | 22:10 |
| nkinder | morganfainberg, gyee: https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-federation-setup/vm-post-cloud-init-rdo.sh#L98 | 22:11 |
| nkinder | the lines up above it show how to generate SP metadata too | 22:11 |
| nkinder | I'm not using the glob setting I mentioned though | 22:11 |
| nkinder | So use MellonIdPMetadataGlob instead of MellonIdPMetadataFile | 22:12 |
| morganfainberg | nkinder, i wouldn't put an API into keystone to dump XML on disk for apache tbh. but it opens doors to being more interesting / better if we can isolate metadata info to a file-per-idp | 22:12 |
| *** gordc has quit IRC | 22:12 | |
| gyee | morganfainberg, the Keystone IdP meta xml file is generated with keystone-manage CLI rigth now | 22:14 |
| gyee | so we're good | 22:14 |
| morganfainberg | gyee, right. | 22:14 |
| morganfainberg | gyee, ok | 22:14 |
| gyee | nkinder, why do we need this? MellonSPPrivateKeyFile | 22:15 |
| nkinder | the SP (keystone) needs to be able to sign things it sends to the IdP | 22:15 |
| stevemar | ah bknudson ever aiming for the empty repo | 22:15 |
| gyee | for K2K its a one way thing I think | 22:16 |
| gyee | I don't see anything send from SP Keystone | 22:16 |
| morganfainberg | in most cases of federation, it is SP-initiated | 22:16 |
| morganfainberg | user -> SP -> redirect -> IDP -> SP | 22:17 |
| gyee | yes | 22:17 |
| morganfainberg | k2k is idp initiated | 22:17 |
| gyee | right | 22:17 |
| morganfainberg | so user -> idp -> user -> sp | 22:17 |
| nkinder | correct | 22:17 |
| nkinder | it's using ECP | 22:17 |
| morganfainberg | simplified for text but change that to ECP | 22:17 |
| morganfainberg | anyway | 22:17 |
| morganfainberg | so in some cases SP [keystone] does need to sign things to the IDP | 22:18 |
| *** dimsum__ has quit IRC | 22:19 | |
| nkinder | gyee: more details on mellon config are in comments here - https://raw.githubusercontent.com/UNINETT/mod_auth_mellon/master/README | 22:20 |
| *** dimsum__ has joined #openstack-keystone | 22:20 | |
| gyee | nkinder, thanks! | 22:21 |
| * gyee GTFBTW now | 22:21 | |
| nkinder | gyee: sure. If you have questions on it later, let me know. | 22:22 |
| *** dimsum__ has quit IRC | 22:24 | |
| *** mattfarina has quit IRC | 22:29 | |
| *** packet has quit IRC | 22:35 | |
| *** pack3t is now known as packet | 22:35 | |
| *** nellysmitt has joined #openstack-keystone | 22:37 | |
| *** packet has quit IRC | 22:37 | |
| *** raildo has quit IRC | 22:40 | |
| *** nellysmitt has quit IRC | 22:42 | |
| *** lhcheng_ has joined #openstack-keystone | 22:48 | |
| *** lhcheng has quit IRC | 22:48 | |
| *** andreaf has quit IRC | 22:52 | |
| *** EmilienM is now known as EmilienM|afk | 23:01 | |
| *** lhcheng has joined #openstack-keystone | 23:04 | |
| *** topol has quit IRC | 23:07 | |
| *** lhcheng_ has quit IRC | 23:08 | |
| *** _cjones_ has quit IRC | 23:09 | |
| *** _cjones_ has joined #openstack-keystone | 23:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Check consumer and project id before creating request token https://review.openstack.org/145701 | 23:12 |
| *** atiwari has joined #openstack-keystone | 23:19 | |
| *** dgonzalez has joined #openstack-keystone | 23:19 | |
| atiwari | all, I am trying to setup dev env on mac and getting "Symbol not found: _BIO_new_CMS" while running tox. | 23:20 |
| atiwari | any idea | 23:20 |
| atiwari | ? | 23:20 |
| atiwari | look at http://paste.openstack.org/show/156160/ for details | 23:22 |
| *** bdossant has joined #openstack-keystone | 23:30 | |
| *** atiwari has quit IRC | 23:34 | |
| *** bdossant has quit IRC | 23:34 | |
| morganfainberg | ah missed atiwari | 23:38 |
| morganfainberg | was going to say that keystone / keystone testing is no longer supported on os x | 23:38 |
| *** atiwari has joined #openstack-keystone | 23:39 | |
| *** dimsum__ has joined #openstack-keystone | 23:40 | |
| *** dimsum__ has quit IRC | 23:41 | |
| *** dimsum__ has joined #openstack-keystone | 23:42 | |
| *** chrisshattuck has quit IRC | 23:43 | |
| openstackgerrit | Sean Dague proposed openstack/python-keystoneclient: don't log service catalog in every token response https://review.openstack.org/145532 | 23:45 |
| *** pcaruana|afk| has quit IRC | 23:46 | |
| *** chrisshattuck has joined #openstack-keystone | 23:50 | |
| *** chrisshattuck has quit IRC | 23:51 | |
| openstackgerrit | Merged openstack/keystone: Remove unused fields in base TestCase https://review.openstack.org/146206 | 23:52 |
| *** _cjones_ has quit IRC | 23:57 | |
| *** dimsum__ has quit IRC | 23:58 | |
| *** dimsum__ has joined #openstack-keystone | 23:58 | |
| *** LinstatSDR has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!