| *** drjones has joined #openstack-keystone | 00:00 | |
| *** gordc has quit IRC | 00:01 | |
| *** _cjones_ has quit IRC | 00:01 | |
| *** _cjones_ has joined #openstack-keystone | 00:05 | |
| *** drjones has quit IRC | 00:05 | |
| *** rwsu has quit IRC | 00:10 | |
| *** abhirc has quit IRC | 00:12 | |
| *** rwsu has joined #openstack-keystone | 00:21 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:31 | |
| *** radez is now known as radez_g0n3 | 00:32 | |
| *** henrynash_ has joined #openstack-keystone | 00:32 | |
| *** ChanServ sets mode: +v henrynash_ | 00:32 | |
| *** henrynash has quit IRC | 00:33 | |
| *** henrynash_ is now known as henrynash | 00:33 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Surface the user_id and project_id beyond the plugin https://review.openstack.org/132030 | 00:49 |
|---|---|---|
| *** marg7175 has quit IRC | 00:51 | |
| *** avozza is now known as zz_avozza | 00:51 | |
| samueldmq | henrynash, did you talk about domain-roles during midcycle? | 01:01 |
| henrynash | sameldmq: so we didn’t get enough time…other than it’s for me to drive the spec a bit - and teh general idea is agreed | 01:01 |
| *** Drago has quit IRC | 01:03 | |
| samueldmq | henrynash, k , I think we will have time for it once we get splits/refactoring merged | 01:04 |
| *** Drago has joined #openstack-keystone | 01:04 | |
| henrynash | agreed | 01:04 |
| samueldmq | henrynash, would be great to have it in addition to reseller | 01:05 |
| henrynash | yes | 01:05 |
| *** jasondotstar has joined #openstack-keystone | 01:07 | |
| *** rushiagr_away has quit IRC | 01:13 | |
| *** rushiagr_away has joined #openstack-keystone | 01:14 | |
| henrynash | samueldmq: as an aside, I am experimenting with a data driven test approach for assignment testing….to see if that is any better than what we do now | 01:25 |
| *** packet has quit IRC | 01:26 | |
| *** henrynash has quit IRC | 01:26 | |
| *** tellesnobrega_ has quit IRC | 01:29 | |
| *** dims__ has joined #openstack-keystone | 01:38 | |
| *** dims__ has quit IRC | 01:39 | |
| *** dims__ has joined #openstack-keystone | 01:40 | |
| *** dims__ has quit IRC | 01:48 | |
| *** dims__ has joined #openstack-keystone | 01:48 | |
| *** dims__ has quit IRC | 01:54 | |
| *** drjones has joined #openstack-keystone | 01:55 | |
| *** _cjones_ has quit IRC | 01:55 | |
| *** d0ugal has quit IRC | 01:55 | |
| *** d0ugal has joined #openstack-keystone | 01:55 | |
| *** d0ugal is now known as Guest85104 | 01:56 | |
| *** drjones has quit IRC | 01:56 | |
| *** _cjones_ has joined #openstack-keystone | 01:56 | |
| *** tristanC_ has joined #openstack-keystone | 01:58 | |
| *** kragniz_ has joined #openstack-keystone | 01:59 | |
| *** drjones has joined #openstack-keystone | 01:59 | |
| *** _cjones_ has quit IRC | 02:00 | |
| *** arif-ali_ has joined #openstack-keystone | 02:01 | |
| *** drjones has quit IRC | 02:01 | |
| *** _cjones_ has joined #openstack-keystone | 02:02 | |
| *** amauryme` has joined #openstack-keystone | 02:05 | |
| *** tristanC has quit IRC | 02:06 | |
| *** arif-ali has quit IRC | 02:06 | |
| *** amaurymedeiros has quit IRC | 02:06 | |
| *** kragniz has quit IRC | 02:06 | |
| *** arif-ali_ is now known as arif-ali | 02:06 | |
| *** _cjones_ has quit IRC | 02:07 | |
| *** drjones has joined #openstack-keystone | 02:07 | |
| *** dims__ has joined #openstack-keystone | 02:09 | |
| *** _cjones_ has joined #openstack-keystone | 02:09 | |
| *** drjones has quit IRC | 02:10 | |
| *** zzzeek has quit IRC | 02:10 | |
| *** dims__ has quit IRC | 02:12 | |
| *** drjones has joined #openstack-keystone | 02:12 | |
| *** dims__ has joined #openstack-keystone | 02:12 | |
| *** _cjones_ has quit IRC | 02:12 | |
| *** drjones has quit IRC | 02:15 | |
| *** _cjones_ has joined #openstack-keystone | 02:15 | |
| *** _cjones_ has quit IRC | 02:17 | |
| *** _cjones_ has joined #openstack-keystone | 02:17 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:20 | |
| *** drjones has joined #openstack-keystone | 02:20 | |
| *** drjones has quit IRC | 02:20 | |
| *** _cjones_ has quit IRC | 02:20 | |
| *** _cjones_ has joined #openstack-keystone | 02:20 | |
| *** dims__ has quit IRC | 02:20 | |
| *** _cjones_ has quit IRC | 02:25 | |
| *** dims__ has joined #openstack-keystone | 02:28 | |
| *** erkules_ has joined #openstack-keystone | 02:30 | |
| *** abhirc has joined #openstack-keystone | 02:31 | |
| *** erkules has quit IRC | 02:33 | |
| *** Drago has quit IRC | 02:55 | |
| *** radez_g0n3 is now known as radez | 02:59 | |
| *** rwsu has quit IRC | 03:10 | |
| *** david-lyle has joined #openstack-keystone | 03:29 | |
| *** david-lyle has quit IRC | 03:35 | |
| *** david-lyle_ has joined #openstack-keystone | 03:35 | |
| *** jasondotstar has quit IRC | 03:47 | |
| *** zhiyan has quit IRC | 03:48 | |
| *** radez is now known as radez_g0n3 | 03:48 | |
| *** marg7175 has joined #openstack-keystone | 03:48 | |
| *** zhiyan has joined #openstack-keystone | 03:49 | |
| *** marg7175 has quit IRC | 03:49 | |
| *** marg7175 has joined #openstack-keystone | 03:50 | |
| *** samueldmq has quit IRC | 03:52 | |
| *** henrynash has joined #openstack-keystone | 03:53 | |
| *** ChanServ sets mode: +v henrynash | 03:53 | |
| *** Drago has joined #openstack-keystone | 03:57 | |
| *** Drago has joined #openstack-keystone | 03:57 | |
| *** tellesnobrega_ has quit IRC | 04:01 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule E122 and H304 https://review.openstack.org/134101 | 04:02 |
| *** dims__ has quit IRC | 04:04 | |
| *** david-lyle_ has quit IRC | 04:04 | |
| *** KanagarajM has joined #openstack-keystone | 04:09 | |
| *** KanagarajM has quit IRC | 04:14 | |
| *** chrisshattuck has joined #openstack-keystone | 04:16 | |
| *** vhoward has left #openstack-keystone | 04:16 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix test_ec2_list_credentials https://review.openstack.org/149134 | 04:17 |
| *** henrynash has quit IRC | 04:29 | |
| *** henrynash has joined #openstack-keystone | 04:30 | |
| *** ChanServ sets mode: +v henrynash | 04:30 | |
| *** ajayaa has joined #openstack-keystone | 04:32 | |
| *** harlowja is now known as harlowja_away | 04:51 | |
| *** Drago has quit IRC | 05:10 | |
| *** _cjones_ has joined #openstack-keystone | 05:20 | |
| *** _cjones_ has quit IRC | 05:25 | |
| *** richm has quit IRC | 05:35 | |
| *** chrisshattuck has quit IRC | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/149158 | 06:08 |
| *** KanagarajM2 has joined #openstack-keystone | 06:20 | |
| *** ajayaa has quit IRC | 06:47 | |
| *** dims__ has joined #openstack-keystone | 07:04 | |
| *** stevemar has joined #openstack-keystone | 07:05 | |
| *** ChanServ sets mode: +v stevemar | 07:05 | |
| *** dims__ has quit IRC | 07:09 | |
| *** mzbik has joined #openstack-keystone | 07:24 | |
| *** chlong has quit IRC | 07:38 | |
| *** mflobo has joined #openstack-keystone | 07:41 | |
| *** Guest85104 is now known as d0ugal | 07:42 | |
| *** d0ugal is now known as Guest79195 | 07:42 | |
| *** stevemar has quit IRC | 07:44 | |
| *** stevemar has joined #openstack-keystone | 07:44 | |
| *** ChanServ sets mode: +v stevemar | 07:44 | |
| *** Guest79195 is now known as d0ugal | 07:48 | |
| *** d0ugal has joined #openstack-keystone | 07:48 | |
| *** lhcheng has joined #openstack-keystone | 07:55 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow saving and caching the plugin auth state https://review.openstack.org/149175 | 07:55 |
| *** jamielennox is now known as jamielennox|away | 08:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Experimental data-driver assignment testing https://review.openstack.org/149178 | 08:13 |
| *** henrynash has quit IRC | 08:16 | |
| openstackgerrit | wanghong proposed openstack/keystone: add missing API in docstring of EndpointFilterExtension https://review.openstack.org/149180 | 08:16 |
| *** ajayaa has joined #openstack-keystone | 08:17 | |
| *** mzbik has quit IRC | 08:24 | |
| *** lhcheng has quit IRC | 08:25 | |
| *** lhcheng has joined #openstack-keystone | 08:26 | |
| *** zz_avozza is now known as avozza | 08:28 | |
| *** lhcheng has quit IRC | 08:30 | |
| *** oomichi_ has quit IRC | 08:40 | |
| *** jraim has quit IRC | 08:50 | |
| *** ctracey has quit IRC | 08:51 | |
| *** zhiyan has quit IRC | 08:55 | |
| *** ctracey has joined #openstack-keystone | 08:58 | |
| *** krykowski has joined #openstack-keystone | 09:01 | |
| *** jraim has joined #openstack-keystone | 09:01 | |
| *** zhiyan has joined #openstack-keystone | 09:01 | |
| *** kodokuu has joined #openstack-keystone | 09:03 | |
| kodokuu | Hi, Maybe someone can help me, I have issue with keystonemoddleware with designate (last version). => keystonemiddleware.auth_token [-] Invalid user token - rejecting request | 09:04 |
| *** jistr has joined #openstack-keystone | 09:24 | |
| *** krykowski has quit IRC | 09:31 | |
| *** krykowski has joined #openstack-keystone | 09:32 | |
| *** erkules_ is now known as erkules | 09:32 | |
| *** ajayaa has quit IRC | 09:34 | |
| *** ajayaa has joined #openstack-keystone | 09:38 | |
| *** ajayaa has quit IRC | 09:43 | |
| *** afazekas has joined #openstack-keystone | 09:47 | |
| *** krykowski has quit IRC | 09:49 | |
| *** nellysmitt has joined #openstack-keystone | 09:50 | |
| *** kodokuu has left #openstack-keystone | 09:53 | |
| *** krykowski has joined #openstack-keystone | 09:57 | |
| *** chlong has joined #openstack-keystone | 10:15 | |
| *** mzbik has joined #openstack-keystone | 10:16 | |
| *** aix has joined #openstack-keystone | 10:20 | |
| *** chlong has quit IRC | 10:20 | |
| *** krykowski has quit IRC | 10:24 | |
| *** krykowski has joined #openstack-keystone | 10:29 | |
| *** jasondotstar has joined #openstack-keystone | 10:30 | |
| *** jasondotstar has quit IRC | 10:30 | |
| *** chlong has joined #openstack-keystone | 10:33 | |
| *** krykowski has quit IRC | 10:34 | |
| *** chlong has quit IRC | 10:37 | |
| *** jaosorior has joined #openstack-keystone | 10:39 | |
| *** chlong has joined #openstack-keystone | 10:50 | |
| mzbik | amakarov_away, Perfect! It is working now :D Thank you! | 10:51 |
| *** dims__ has joined #openstack-keystone | 10:51 | |
| *** lhcheng has joined #openstack-keystone | 10:55 | |
| *** krykowski has joined #openstack-keystone | 10:59 | |
| *** lhcheng has quit IRC | 10:59 | |
| *** KanagarajM2 has quit IRC | 11:05 | |
| *** marg7175 has quit IRC | 11:12 | |
| *** krykowski has quit IRC | 11:26 | |
| *** wpf1 has quit IRC | 11:31 | |
| *** samueldmq-away is now known as samueldmq | 11:37 | |
| *** aix has quit IRC | 11:38 | |
| *** wpf1 has joined #openstack-keystone | 11:44 | |
| *** kragniz_ is now known as kragniz | 11:45 | |
| *** wolsen_ has quit IRC | 12:00 | |
| *** xianghui has quit IRC | 12:02 | |
| *** stevemar has quit IRC | 12:03 | |
| *** xianghui has joined #openstack-keystone | 12:04 | |
| *** wolsen has joined #openstack-keystone | 12:05 | |
| *** gabriel-bezerra has quit IRC | 12:17 | |
| *** gabriel-bezerra has joined #openstack-keystone | 12:17 | |
| *** samueldmq has quit IRC | 12:18 | |
| *** samueldmq has joined #openstack-keystone | 12:18 | |
| *** radez_g0n3 is now known as radez | 12:30 | |
| *** afaranha has joined #openstack-keystone | 12:35 | |
| *** chlong has quit IRC | 12:44 | |
| *** dims__ has quit IRC | 12:53 | |
| *** amakarov_away is now known as amakarov | 12:54 | |
| *** dims__ has joined #openstack-keystone | 12:55 | |
| *** richm has joined #openstack-keystone | 13:08 | |
| *** marg7175 has joined #openstack-keystone | 13:13 | |
| *** dims__ has quit IRC | 13:16 | |
| *** dims__ has joined #openstack-keystone | 13:16 | |
| *** marg7175 has quit IRC | 13:18 | |
| *** markvoelker has joined #openstack-keystone | 13:19 | |
| *** topol has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v topol | 13:27 | |
| *** henrynash has joined #openstack-keystone | 13:30 | |
| *** ChanServ sets mode: +v henrynash | 13:30 | |
| *** topol has quit IRC | 13:32 | |
| *** flwang has quit IRC | 13:35 | |
| *** rushiagr_away is now known as rushiagr | 13:40 | |
| *** aix has joined #openstack-keystone | 13:40 | |
| raildo | henrynash, sorry about yesterday, I thought that I had sent the responde but was still as "draft", https://review.openstack.org/#/c/139824/17/specs/kilo/reseller.rst | 13:41 |
| henrynash | raildo; np :-) | 13:44 |
| *** adam_g is now known as adam_g_out | 13:46 | |
| *** tristanC_ is now known as tristanC | 13:47 | |
| *** gordc has joined #openstack-keystone | 13:48 | |
| *** flwang has joined #openstack-keystone | 13:48 | |
| *** marg7175 has joined #openstack-keystone | 13:57 | |
| samueldmq | henrynash, ping | 13:59 |
| henrynash | samueldmq: hi | 14:00 |
| samueldmq | henrynash, hi, started look at your data-drvien tests experiment | 14:00 |
| samueldmq | henrynash, so you think the tests I created for role assignments are too complex ... | 14:00 |
| henrynash | samueldmq: sorry, a bit rough at the moment…and still an experiment | 14:00 |
| samueldmq | henrynash, np :) | 14:00 |
| samueldmq | henrynash, I'd like to get your view on that .. | 14:01 |
| henrynash | samueldmq: the problem is that I can’t easily see exactly what the tests are doing | 14:01 |
| henrynash | samueldmq:…I want to be able to see at a galnce..without undertstanding any algorithms or complex python, what we are tetsing and what the expeted out is…so I can say “ yes I agree with the expected results, or no, I don’t" | 14:02 |
| henrynash | samueldmq: and while your tests are as compact as I can imagine a code-based test being….I can’t do the above | 14:03 |
| henrynash | samueldmq: to be honest, other cores may not agree with my concerns (or my potential approach for data-driver tests) | 14:03 |
| samueldmq | henrynash, yes I agree | 14:03 |
| samueldmq | henrynash, at the same time, we can have 40+ tests in 300 lines .. | 14:03 |
| samueldmq | henrynash, but I agree we have to find a good tradeoff there between readability, etc | 14:03 |
| henrynash | sameuldmq: so I’m travelling back from the USA to the UK (so lots of time on planes)…so give me today to carry on experimenting… :-) | 14:04 |
| samueldmq | henrynash, sure, that's why it's experimental :) | 14:04 |
| samueldmq | henrynash, sure ! | 14:05 |
| henrynash | samueldmq: I’ll probably put all teh helper methids into a test_helper_class, which you initialise with the test plam | 14:05 |
| samueldmq | henrynash, today I'm a little busy as well, new sprint starting etc | 14:05 |
| henrynash | clean it up a bit , then we can both have a proper look at it | 14:06 |
| samueldmq | henrynash, ++ | 14:06 |
| henrynash | (ans ome comments would be good too, henry :-) ) | 14:06 |
| samueldmq | henrynash, :-) | 14:06 |
| samueldmq | henrynash, when creating data to be testes, why don't we have a model (classes)? isntead of just dicts | 14:07 |
| samueldmq | henrynash, why dont we have a model in keystone ? like objects, etc | 14:07 |
| samueldmq | henrynash, maybe this is python .. dont really know | 14:07 |
| henrynash | samueldmq: hey, I’m a PASCAL guy, so what would I Know… | 14:08 |
| *** ljfisher has joined #openstack-keystone | 14:08 | |
| samueldmq | henrynash, haha , maybe need to ask someone else :) | 14:09 |
| samueldmq | henrynash, another point I noticed, why dont you like having a predefined scenario and then tests use it? | 14:09 |
| henrynash | sure we could use class/models etc…..that’s teh sort ofthing we could experiemyt with | 14:09 |
| samueldmq | henrynash, I think I had a comment of yours somewhere saying you like to create data for each tests | 14:09 |
| henrynash | that’s what happens | 14:10 |
| samueldmq | henrynash, I was wondering why :-) | 14:10 |
| henrynash | you mean why do I like that? | 14:10 |
| henrynash | I guess it’s a context thing…OK what’s teh best data structure for this test….create that, run the test, then dump it | 14:11 |
| henrynash | i can see everything i need right there for deciding if I agree this is a good test…not go look in other places to find our what test data has been created | 14:11 |
| *** sriram has joined #openstack-keystone | 14:13 | |
| henrynash | samueldmq: oh, actually, I do have a separate question for you | 14:13 |
| samueldmq | henrynash, sure | 14:14 |
| henrynash | samueldmq: when the new manager list_role_assignment() returns assignments, if we are in effective mode and there was, say, an inherited role on a domain | 14:14 |
| samueldmq | henrynash, maybe this is because we dont have a consistent but robust scenario that's used everywhere | 14:15 |
| samueldmq | henrynash, k, reading your example | 14:15 |
| henrynash | samueldmq: ….we expand that inherited role and place it on the project…but in the assignment dict we pass back, we include the project and domain ID? | 14:15 |
| samueldmq | henrynash, the domain id from where the role was inehrited from just goes in the assignment link | 14:16 |
| raildo | henrynash, about the name clashing, I think that we don't need to change the domain or project name, because we always have a way to distinguish them, but if we really need to change a name, I prefer change the domain name in the migration, but as you explained we can't do this due the domain-specific config files... | 14:16 |
| samueldmq | henrynash, OS-INHERIT/domain/<domain_id>/users/<user_id>/roles/<role_id> | 14:16 |
| *** bknudson has joined #openstack-keystone | 14:17 | |
| *** ChanServ sets mode: +v bknudson | 14:17 | |
| samueldmq | henrynash, + /inherited_to_projects | 14:17 |
| henrynash | samueldmq:….ah, right, so we include the place the inherited role came form, so the controller can construct the link? | 14:17 |
| raildo | henrynash, so I don't know what I have to do :P | 14:17 |
| samueldmq | henrynash, ah sorry | 14:17 |
| henrynash | raildo: you mean you don’t understand my comment or you don’t know how to solve it? | 14:18 |
| samueldmq | henrynash, yes, it includes both domain_id AND project_id, so the controller can deduce it was inherited | 14:18 |
| samueldmq | henrynash, for project inherited assignment, it includes both PARENT_ID and PROJECT_ID | 14:18 |
| henrynash | samueldmq: ah, that’s why my test fails….I hadn’t included domain in the expected result data | 14:19 |
| *** mzbik has quit IRC | 14:19 | |
| *** marg7175 has quit IRC | 14:19 | |
| raildo | henrynash, I do't know how to solve it, since we can't change the domain name, and we can't keep with the clashing name.. | 14:19 |
| samueldmq | henrynash, look at the first two methods in https://review.openstack.org/#/c/137202/12/keystone/assignment/core.py | 14:19 |
| *** marg7175 has joined #openstack-keystone | 14:19 | |
| samueldmq | henrynash, nice debug :) | 14:20 |
| henrynash | samueldmq: that’s kind of what I mean….by looking just at data input and output, i can see if the code under test is wroung, or….(as is often the case), my concept of what the code does is wrong! | 14:22 |
| henrynash | raildo: so two options: | 14:22 |
| henrynash | raildo: 1) Change the project name if there’s a clash | 14:23 |
| samueldmq | henrynash, I agree, and if we had a scenario **really** used everywhere, it would save code and be in accordance with this approach | 14:23 |
| henrynash | raildo: 2) If we are not using domain-specific drivers, then change the domain name, else we change the project name | 14:23 |
| henrynash | raildo: 2) would effect the least number of installations, but is kind of harder to explain | 14:24 |
| samueldmq | henrynash, maybe always change the project name, so we'd be consistent in both conflicts | 14:25 |
| *** krykowski has joined #openstack-keystone | 14:25 | |
| raildo | henrynash, I prefer this second option... because I don't like to change a object, that in my view, is not part of the process. | 14:25 |
| henrynash | samueldmq: that’sa valid view…better for it to be easyto explain and obvious, rather than obscure | 14:26 |
| henrynash | raildo: we have to change something….. | 14:26 |
| raildo | henrynash, I'm migrate the domain, and not the projects, right? | 14:26 |
| raildo | henrynash, yes... I know =/ | 14:27 |
| henrynash | raildo: yes, but from a customer perspective, they don’t know that | 14:27 |
| henrynash | raildo: there’s not good answer here, just a least worst answer | 14:27 |
| raildo | henrynash, i agree | 14:28 |
| henrynash | raildo: so I guess there is a 3rd option | 14:28 |
| henrynash | raildo: we make them chaneg the name of the domain-config file if there is a clash…we just can’t do it for them | 14:29 |
| henrynash | (I gotta go off line for a bit, back on later) | 14:30 |
| samueldmq | henrynash, k | 14:30 |
| raildo | I think tht, for now, we can change the project name when we have domain-config file problems, but as you say that we will change this for the SQL, we will change just the domain name | 14:31 |
| raildo | henrynash, I'll explain better this in the spec | 14:31 |
| raildo | henrynash, thanks | 14:31 |
| *** mattfarina has joined #openstack-keystone | 14:34 | |
| *** radez is now known as radez_g0n3 | 14:34 | |
| henrynash | raildo:just had an idea so came back!…..actually there is a 4th one for you to think about….(and maybe this was your thought all along?), maybe we allow the naems to clash, and chaneg teh SQL unique constraint. Maybe name+domain_id+domain-ness must be unique… | 14:35 |
| samueldmq | henrynash, ++ | 14:35 |
| raildo | henrynash, ++ I prefer this option :) | 14:35 |
| henrynash | raidlo: we’d have to be careful that we honored this correctly in all these ways we access teh table…and I haven’t quite thought it through….but maybe… | 14:36 |
| *** joesavak has joined #openstack-keystone | 14:36 | |
| raildo | henrynash, that was my original solution | 14:36 |
| raildo | :) | 14:36 |
| henrynash | raildo: if so, then you’re a smarter man than me! | 14:36 |
| raildo | henrynash, hahahaha I dont think so | 14:37 |
| henrynash | raildo: now domain_id is nul for projects with domain_ness, so we’d have to be careful | 14:38 |
| henrynash | raildo: (crazy idea): does the lack of domain_id mean domain-ness? | 14:38 |
| samueldmq | henrynash, no, you're a wild duck | 14:38 |
| henrynash | raildo: and you don’t need a flag at all? | 14:39 |
| samueldmq | henrynash, :-) | 14:39 |
| henrynash | samueldmq : haha | 14:39 |
| raildo | henrynash, no, for project domain-ness the project id is equal to the domain _id | 14:39 |
| henrynash | raildo: but there is only one ID now! | 14:39 |
| henrynash | raildo: isn’t it that there is only one table (the projects table), and some of those projects are also domains? | 14:40 |
| samueldmq | henrynash, yep, we need to delte domain_id from projects | 14:41 |
| samueldmq | henrynash, no need to keep FK for a tabl that doesnt exist anymore | 14:41 |
| henrynash | raildo: onlythose that are domains | 14:41 |
| raildo | henrynash, i get it your point, but I'm little concern if we can change this column | 14:41 |
| henrynash | raildo: no - projects still have a domain_Id (but it’s to an ID in the project table_ | 14:42 |
| *** vhoward has joined #openstack-keystone | 14:42 | |
| henrynash | raildo: and those projects that are domains, don’t have a domain_id….which tells us they are a domain | 14:42 |
| raildo | henrynash, ok | 14:43 |
| henrynash | raildo: just an idea….i do need to go now….I’ll let you mull it over…if you think it’s wroung, feel free to junk the idea…Im not entirely convinced myslef :-) | 14:43 |
| raildo | henrynash, no, I like the idea :) I'll think about it and we can talk more later | 14:44 |
| henrynash | raildo: i.e. can you (in SQL) list me all the rows for which teh domain_id is null (i.e. to list all doamins)? | 14:44 |
| *** my_openstack_use has joined #openstack-keystone | 14:45 | |
| my_openstack_use | hello | 14:46 |
| raildo | henrynash, I believe that I can. | 14:46 |
| my_openstack_use | does keystone REST API have a method that accepts username and password and returns the user's tenant ID? | 14:46 |
| raildo | henrynash, ok, thanks a lot, I'll define better this today :) | 14:46 |
| samueldmq | my_openstack_use, hi, with username and password you should be able to get a token | 14:48 |
| samueldmq | my_openstack_use, with that token, you can query list role assignments API in order to get all projects (tenant) a user has a role on | 14:49 |
| samueldmq | my_openstack_use, to see the operations available on the v3 (current) api, take a look at http://developer.openstack.org/api-ref-identity-v3.html | 14:50 |
| samueldmq | my_openstack_use, /v3/auth/tokens to get a token | 14:50 |
| samueldmq | my_openstack_use, /v3/role_assignments to list role assignmetns | 14:50 |
| *** zzzeek has joined #openstack-keystone | 14:51 | |
| *** nkinder has joined #openstack-keystone | 14:51 | |
| my_openstack_use | samueldmq: we are currently using v2 do you know what is that method's analogue in it? | 14:53 |
| dims__ | hi all, anyone familiar with ec2 tokens? (hmac-v4) | 14:54 |
| *** Drago has joined #openstack-keystone | 14:55 | |
| samueldmq | my_openstack_use, let me check | 14:55 |
| *** krykowski has quit IRC | 14:55 | |
| *** rwsu has joined #openstack-keystone | 14:56 | |
| *** Drago has quit IRC | 14:56 | |
| *** Drago has joined #openstack-keystone | 14:56 | |
| samueldmq | my_openstack_use, http://developer.openstack.org/api-ref-identity-v2.html | 14:56 |
| samueldmq | my_openstack_use, so /v2.0/tokens to get a token | 14:56 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: make audit event scoped to request session and not middleware https://review.openstack.org/149300 | 14:57 |
| samueldmq | my_openstack_use, I dont think we support such operation in v2 | 14:58 |
| samueldmq | bknudson, hi - is there a way to get all user's tenants in v2? | 14:59 |
| dims__ | we have a "signature check failed" http://logs.openstack.org/01/147601/3/check/check-tempest-dsvm-full/96bb05e/logs/apache/keystone.txt.gz#_2015-01-15_22_00_27_046 with latest boto (EC2 client) | 14:59 |
| bknudson | samueldmq: I think it's /v2.0/tenants but you have to use the public api | 15:00 |
| my_openstack_use | samueldmq: but I was under impression that horizon takes username and password from token and uses them to provide tenant ID from keysone. Is that wrong? | 15:00 |
| *** krykowski has joined #openstack-keystone | 15:00 | |
| bknudson | why would anyone use the v2.0 api? | 15:00 |
| my_openstack_use | doesn't Juno use v2? | 15:01 |
| bknudson | samueldmq: Here's the v2 reference: http://developer.openstack.org/api-ref-identity-v2.html | 15:01 |
| *** nellysmitt has quit IRC | 15:05 | |
| samueldmq | my_openstack_use, I dont know about how horizon uses it, sorry | 15:11 |
| samueldmq | bknudson, looks like my_openstack_use is using it | 15:11 |
| bknudson | samueldmq: I've never heard of my_openstack_user. | 15:13 |
| bknudson | use | 15:13 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 15:14 |
| my_openstack_use | a person on my team is trying to call v2's tenants with username and password and receives back token. But when he tries to call it with the returned token to get the tenant ID he gets 401. | 15:14 |
| my_openstack_use | is he doing something wrong? | 15:15 |
| Drago | That actually sounds like the problem I'm having | 15:15 |
| Drago | I can't get keystonemiddleware/keystoneclient to quit doing endpoint discover no matter what settings I use | 15:15 |
| samueldmq | bknudson, me neither, but he/she is now here in the channel :-) | 15:16 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: incorrect reference in enabling audit middleware https://review.openstack.org/149307 | 15:17 |
| my_openstack_use | samueldmq: are you talking about me? | 15:17 |
| Drago | When the keystoneclient tries to do discovery, our identity api doesn't return back json for the endpoints it expects so it dies and returns 401 "Token Authorization Failed" | 15:17 |
| samueldmq | my_openstack_use, yep, see conversation above | 15:18 |
| bknudson | my_openstack_use: Here's the v2 reference: http://developer.openstack.org/api-ref-identity-v2.html | 15:18 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 15:18 |
| my_openstack_use | bknudson: Yeah, like I'm saying, tokens doesn't seem to work | 15:19 |
| *** samueldmq is now known as samueldmq-away | 15:19 | |
| samueldmq-away | my_openstack_use, sorry need to go afk for a bit | 15:19 |
| *** topol has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v topol | 15:19 | |
| my_openstack_use | https://www.irccloud.com/pastebin/3wYp0QMy | 15:25 |
| my_openstack_use | passing username and password yields token | 15:25 |
| my_openstack_use | https://www.irccloud.com/pastebin/Q92thgu7 | 15:26 |
| my_openstack_use | as you can see, somethign seems to be broken in keystone | 15:26 |
| my_openstack_use | I'm a guy by the way | 15:29 |
| *** carlosmarin has joined #openstack-keystone | 15:35 | |
| *** briancurtin has quit IRC | 15:57 | |
| *** ayoung has joined #openstack-keystone | 16:02 | |
| *** ChanServ sets mode: +v ayoung | 16:02 | |
| *** briancurtin has joined #openstack-keystone | 16:02 | |
| ayoung | raildo, you pinged me yesterday-ish and I didn't get to respond until now. You still working on the migration? | 16:03 |
| *** thedodd has joined #openstack-keystone | 16:03 | |
| *** krykowski has quit IRC | 16:09 | |
| *** abhirc has quit IRC | 16:13 | |
| *** henrynash has quit IRC | 16:14 | |
| *** krykowski has joined #openstack-keystone | 16:14 | |
| *** chrisshattuck has joined #openstack-keystone | 16:15 | |
| *** samueldmq-away is now known as samueldmq | 16:29 | |
| samueldmq | ayoung, I'll get him on his chair in a bit :-) | 16:30 |
| ayoung | samueldmq, THANKS | 16:30 |
| raildo | ayoung, yes, I finished the script but I discuss with henry, what we have to do , when we find some name and id clashing.... | 16:32 |
| ayoung | raildo, more than that | 16:32 |
| ayoung | I hjave some work to do | 16:32 |
| ayoung | raildo, there were two decsions, contradictory, beyond what I submitted in my patch | 16:32 |
| ayoung | first: drop the domain table | 16:32 |
| ayoung | second: keep hte domain table but make the id a foreign key to the project table | 16:33 |
| ayoung | the second was so we could have an "idp_id" field for the domain for Federation | 16:33 |
| ayoung | so I don't really know what the migration should look like | 16:34 |
| raildo | ayoung, actually I'm thinking in work in this solution "<henrynash> raildo:just had an idea so came back!…..actually there is a 4th one for you to think about….(and maybe this was your thought all along?), maybe we allow the naems to clash, and chaneg teh SQL unique constraint. Maybe name+domain_id+domain-ness must be unique…" | 16:34 |
| ayoung | I think henry might be right | 16:34 |
| raildo | ayoung, so I think that we can drop the domain table and just change the way to Keystone see a domain | 16:35 |
| ayoung | raildo, we need an Idp to own the domain | 16:35 |
| ayoung | we could do that on every record, but it would be wasteful | 16:35 |
| ayoung | I wonder if we can unify the Idp and domain concepts at the same time. | 16:36 |
| raildo | ayoung, hum... this change is bigger than I imagined :P | 16:37 |
| *** _cjones_ has joined #openstack-keystone | 16:37 | |
| raildo | ayoung, so we can use the domain_id in the project table to related to this Idp, right? | 16:39 |
| ayoung | raildo, OK, so this is my take how it should have been done origianlly: | 16:40 |
| ayoung | everything we have is a namespace: | 16:40 |
| ayoung | domains, Idp, and projects are just variations | 16:40 |
| raildo | ayoung, ok | 16:41 |
| ayoung | in all cases, the things that they store are outside the 'assignement ' services | 16:41 |
| ayoung | Keystone's Identiyt backend included | 16:41 |
| ayoung | identity has many sources, assignment pulls them together | 16:41 |
| ayoung | namespaces are nested: | 16:42 |
| ayoung | idps own domains | 16:42 |
| ayoung | domains own projects | 16:42 |
| ayoung | now...we could drop domains as a concept, they really are covered by Idps on the Identity side | 16:42 |
| ayoung | and on the project side, we don't need them. | 16:42 |
| ayoung | I don't think that any of the other services even make use of domains, they are merely a Keystone concept | 16:43 |
| raildo | ayoung, right... | 16:43 |
| ayoung | now...that is the purist perspective...the question is what do we do from here? | 16:44 |
| ayoung | we state that the names of projects are unique within a domain, and I think Henry's take, while counterintuitive, is the right one | 16:44 |
| ayoung | only because it is an acceptance of what we do now: | 16:45 |
| ayoung | execpt that it will break what we need to have happend for Horizon: | 16:45 |
| ayoung | hmmmm...but that, now thjat I think of it, might be broken already | 16:46 |
| ayoung | raildo, heh...bet I just found a bug. Wann hear it? | 16:46 |
| raildo | ayoung, yes :P | 16:47 |
| ayoung | On Horizon, they do a keystone list-projects-for user to populate the project drop down. But since a user can get an assignment across domains, they can get an assignement to two projects with the same name, one in each domain | 16:47 |
| ayoung | I haven't tested, but I bet that is the case... | 16:47 |
| raildo | but this list project for user will filter by domain, right? | 16:48 |
| raildo | because today I can create two projects with the same name in different domains... (and I believe that a user can have a role assignment in this two projects) | 16:50 |
| *** sriram has quit IRC | 16:51 | |
| raildo | so... what I want to say is, this list project should be in a domain scope, so I can't have two projects with the same name | 16:52 |
| ayoung | raildo, except that there is no call to do list project for user by domain | 16:53 |
| raildo | ayoung, so, this is a bug :P | 16:54 |
| raildo | ayoung, in fact, a long time ago, I'm worked in a patch to filter user by project https://review.openstack.org/#/c/84136/ | 16:54 |
| raildo | but the federation implementation blocked this patch. | 16:56 |
| ayoung | probably | 16:56 |
| *** dims__ has quit IRC | 16:57 | |
| ayoung | raildo, that needs to go away: with federation we will never know all of the users for a project | 16:57 |
| ayoung | raildo, that is the opposite: list projects for user means we know who the user is and what groups they are in | 16:58 |
| raildo | ayoung, right,this is the reason to i abandoned this patch | 16:58 |
| raildo | ayoung, this method right? https://github.com/raildo/keystone-1/blob/domain-as-project/keystone/assignment/core.py#L375 | 17:01 |
| *** krykowski has quit IRC | 17:01 | |
| ayoung | raildo, yes | 17:01 |
| *** dims__ has joined #openstack-keystone | 17:02 | |
| *** packet has joined #openstack-keystone | 17:05 | |
| raildo | ayoung, sorry, this is a old repo.. here its the current implementation https://github.com/openstack/keystone/blob/master/keystone/assignment/core.py#L431 | 17:07 |
| ayoung | raildo, the short of it is, put the migration on hold for a bit until we figure out what the implementation is | 17:07 |
| raildo | ayoung, i agree. I'll just send the code to you take a look :) | 17:08 |
| ayoung | ++ | 17:09 |
| raildo | and regarding the namespaces, I think that we can do something like Idp - project domain-ness - just a project | 17:09 |
| raildo | ayoung, since the project domain-ness wil be in the top level of the hierarchy | 17:10 |
| ayoung | raildo, not sure if the other devs agree: that was just my take on it. | 17:10 |
| raildo | ayoung, right... we can talk later about this, when morgan, henry, dolph and the other guys :) | 17:12 |
| *** abhirc has joined #openstack-keystone | 17:14 | |
| *** sriram has joined #openstack-keystone | 17:24 | |
| richm | dtroyer: ping - how does one access the keystone v3 trust extension using the openstack client? https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-trust-ext.md | 17:27 |
| *** aix has quit IRC | 17:27 | |
| *** abhirc has quit IRC | 17:30 | |
| *** abhirc has joined #openstack-keystone | 17:31 | |
| dtroyer | stevemar: ^^^ richm, not sure I know. steve has done the vast majority of the Identity v3 work. I don't see anything other than —os-trust-id in the current source tree. | 17:32 |
| richm | dtroyer: ok - I'll wait for stevemar | 17:35 |
| *** packet has quit IRC | 17:42 | |
| *** packet has joined #openstack-keystone | 17:42 | |
| *** xxj has quit IRC | 17:46 | |
| *** avozza is now known as zz_avozza | 17:49 | |
| *** david-lyle has joined #openstack-keystone | 17:50 | |
| *** xxj has joined #openstack-keystone | 17:51 | |
| *** ajayaa has joined #openstack-keystone | 17:58 | |
| *** nellysmitt has joined #openstack-keystone | 18:00 | |
| *** nellysmitt has quit IRC | 18:04 | |
| *** lhcheng has joined #openstack-keystone | 18:07 | |
| *** stevemar has joined #openstack-keystone | 18:09 | |
| *** ChanServ sets mode: +v stevemar | 18:09 | |
| *** rushiagr is now known as rushiagr_away | 18:13 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 18:16 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 18:16 |
| *** nellysmitt has joined #openstack-keystone | 18:17 | |
| *** zz_avozza is now known as avozza | 18:17 | |
| openstackgerrit | Merged openstack/keystone-specs: API changes for subtree_as_ids and parents_as_ids https://review.openstack.org/147871 | 18:23 |
| *** harlowja_away is now known as harlowja | 18:24 | |
| *** radez_g0n3 is now known as radez | 18:24 | |
| rodrigods | ayoung, ping re: dynamic policies. anything agreed in midcycle? | 18:26 |
| *** amakarov is now known as amakarov_away | 18:27 | |
| ayoung | rodrigods on the phone. | 18:27 |
| *** ljfisher has quit IRC | 18:30 | |
| *** ajayaa has quit IRC | 18:32 | |
| morganfainberg | jamielennox|away, ping re: unscoped token catalog | 18:43 |
| morganfainberg | jamielennox|away, will comment on the review when i have a fww minutes so we can get that merged asap as a spec | 18:44 |
| morganfainberg | jamielennox|away, ayoung, stevemar, dstanek, ksc/middleware releases, where are we / anything we need to get in before a release? I'm ready to do one if we need it. cc: bknudson, topol, dolphm | 18:45 |
| ayoung | morganfainberg, guh...no clue ATM | 18:46 |
| rodrigods | morganfainberg, HMT features? :( | 18:46 |
| rodrigods | kc | 18:47 |
| ayoung | morganfainberg, I don't think I have anything incipient myself | 18:47 |
| morganfainberg | ayoung, right so checking before we do anything - if you don't know, i'd say we don't have anything you need atm | 18:47 |
| morganfainberg | rodrigods, do we have code up for review for it? | 18:47 |
| *** nellysmitt has quit IRC | 18:47 | |
| rodrigods | morganfainberg, yes, just need some follow up in the reviews | 18:47 |
| rodrigods | morganfainberg, I can do that | 18:47 |
| morganfainberg | rodrigods, k | 18:47 |
| bknudson | morganfainberg: I don't see anything that can't wait for the next release. | 18:48 |
| morganfainberg | bknudson, ++ k | 18:48 |
| *** Drago has left #openstack-keystone | 18:49 | |
| topol | morganfainberg, what bknudson said | 18:50 |
| morganfainberg | topol, thanks. | 18:50 |
| *** gyee has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v gyee | 18:54 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 18:54 |
| rodrigods | morganfainberg, bknudson ^ | 18:54 |
| bknudson | rodrigods: we can do a release tomorrow or whenever that gets merged. | 18:56 |
| bknudson | even if we do a release today | 18:57 |
| *** jistr has quit IRC | 18:58 | |
| rodrigods | bknudson, fair enough, just receiving some demands to it :) | 18:58 |
| *** lsmola has quit IRC | 18:59 | |
| bknudson | rodrigods: then they should review the change. | 18:59 |
| rodrigods | bknudson, they already did :) | 18:59 |
| rodrigods | unfortunately, not cores | 18:59 |
| *** atiwari has joined #openstack-keystone | 19:04 | |
| *** lsmola has joined #openstack-keystone | 19:11 | |
| *** jaosorior has quit IRC | 19:14 | |
| lbragstad | dstanek: so the consensus for the token api clean was to start with a spec, right? | 19:15 |
| lbragstad | s/clean/clean up/ | 19:15 |
| *** packet has quit IRC | 19:23 | |
| richm | stevemar: ping - I don't know if you saw the previous discussion about how to use the keystone v3 trust extension with the openstack client - I'm looking for documentation or examples | 19:28 |
| stevemar | richm, simple answer - no support for that as no one asked for it :) | 19:28 |
| lbragstad | morganfainberg: I'm doing some digging on https://github.com/openstack/keystone-specs/blob/master/specs/kilo/token-provider-cleanup.rst | 19:35 |
| morganfainberg | lbragstad, that is the spec to do the cleanup | 19:36 |
| lbragstad | morganfainberg: and wondering if there were any patches pushed for that already. I'm not seeing any but wanted to check with you first. | 19:36 |
| morganfainberg | on the provider | 19:36 |
| morganfainberg | only 1: | 19:36 |
| morganfainberg | and it's the prototype one | 19:36 |
| lbragstad | morganfainberg: can I build off of it? | 19:36 |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/148354/ | 19:36 |
| morganfainberg | lbragstad, the strictABC is the only thing i've pushed, but i was just looking at the cleanup of v2 issue pipeline | 19:37 |
| morganfainberg | but please build on that functionality, i need to fix the pep8 and document that new functionality | 19:37 |
| lbragstad | the strictABC stuff is the first work item listed | 19:37 |
| morganfainberg | yep | 19:37 |
| lbragstad | ok | 19:37 |
| lbragstad | morganfainberg: was there any other reasons this was a WIP patch? | 19:38 |
| morganfainberg | lbragstad, because i wrote it at the summit :P and hadn't even tried running the tests yet | 19:38 |
| morganfainberg | >.> | 19:38 |
| lbragstad | morganfainberg: ok | 19:38 |
| morganfainberg | s/summit/midcycle | 19:38 |
| morganfainberg | fixing the commit and fix pep8 + minor documentation changes = ready to be un wip'd | 19:39 |
| morganfainberg | i'm just in ameeting at the moment and can't push that. | 19:39 |
| lbragstad | morganfainberg: ok | 19:39 |
| lbragstad | morganfainberg: I'll work on it | 19:39 |
| morganfainberg | sure, let me un-2 it | 19:39 |
| morganfainberg | lbragstad, done | 19:40 |
| lbragstad | thanks | 19:40 |
| *** nellysmitt has joined #openstack-keystone | 19:42 | |
| *** _cjones_ has quit IRC | 19:43 | |
| *** andreaf has quit IRC | 19:47 | |
| *** thedodd has quit IRC | 19:48 | |
| richm | stevemar: EmilienM: https://bugs.launchpad.net/python-openstackclient/+bug/1413718 | 19:52 |
| stevemar | richm, hmm okay... we're probably support create/lits/delete/get | 19:54 |
| stevemar | since, that is whats supported here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/contrib/trusts.py | 19:55 |
| EmilienM | richm: thanks | 19:55 |
| stevemar | richm, also, i think you will be able to authenticate with trusts as a freebie, since we use keystone authN plugins | 19:55 |
| richm | stevemar: ok | 19:56 |
| *** _cjones_ has joined #openstack-keystone | 20:14 | |
| *** Ephur has quit IRC | 20:16 | |
| *** henrynash has joined #openstack-keystone | 20:17 | |
| *** ChanServ sets mode: +v henrynash | 20:17 | |
| *** thedodd has joined #openstack-keystone | 20:24 | |
| openstackgerrit | ayoung proposed openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 20:30 |
| openstackgerrit | ayoung proposed openstack/keystone: Explicit Unscoped https://review.openstack.org/142521 | 20:31 |
| rodrigods | bknudson, doubt about :type in docstrings, how can I specify that an argument can be from two types? (for example, :py:class:`keystoneclient.v3.domains.Domain` and str) | 20:31 |
| rodrigods | (googled without success) | 20:32 |
| *** vhoward has left #openstack-keystone | 20:32 | |
| morganfainberg | lbragstad, just talked with dhellmann, we're going to make strictabc it's own library [but it'll land in keystone first] | 20:35 |
| *** junhongl has quit IRC | 20:35 | |
| lbragstad | morganfainberg: ok, | 20:35 |
| morganfainberg | lbragstad, have some enchancements for this down the line | 20:36 |
| lbragstad | do you have an eta on that timeline? | 20:36 |
| morganfainberg | land it in keystone first | 20:36 |
| lbragstad | ok | 20:36 |
| morganfainberg | we'll worry about separate lib stuff soon™ | 20:36 |
| lbragstad | morganfainberg: it will be a part of the oslo libraries I assume? | 20:36 |
| morganfainberg | wont be oslo namespace/named but oslo will own it | 20:36 |
| lbragstad | ok | 20:36 |
| morganfainberg | it'll be proposed as openstack/strictabc | 20:36 |
| lbragstad | fair enough | 20:36 |
| morganfainberg | or similar | 20:37 |
| *** junhongl has joined #openstack-keystone | 20:37 | |
| *** drjones has joined #openstack-keystone | 20:42 | |
| *** _cjones_ has quit IRC | 20:42 | |
| *** nkinder has quit IRC | 20:43 | |
| *** _cjones_ has joined #openstack-keystone | 20:51 | |
| *** drjones has quit IRC | 20:54 | |
| *** _cjones_ has quit IRC | 20:58 | |
| *** _cjones_ has joined #openstack-keystone | 20:58 | |
| *** flwang2 has joined #openstack-keystone | 20:59 | |
| flwang2 | greetings, when I install openstack with devstack, recently I got this error 'Could not find user: admin (Disable debug mode to suppress these details.) (HTTP 401)'? | 21:00 |
| flwang2 | as a result, the other service can't get token from keystone | 21:00 |
| flwang2 | any idea? thanks a lot | 21:00 |
| *** _cjones_ has quit IRC | 21:00 | |
| *** _cjones_ has joined #openstack-keystone | 21:01 | |
| lbragstad | flwang2: can you verify the user was created? | 21:01 |
| flwang2 | lbragstad: hey man | 21:01 |
| flwang2 | how are you | 21:01 |
| lbragstad | flwang2: doing well! | 21:02 |
| flwang2 | checking the user in db... | 21:02 |
| flwang2 | lbragstad: nope, the table is empty | 21:03 |
| *** ayoung has quit IRC | 21:04 | |
| flwang2 | lbragstad: any suggestion? | 21:06 |
| lbragstad | did devstack execute correctly? | 21:08 |
| *** raildo has quit IRC | 21:08 | |
| *** _cjones_ has quit IRC | 21:08 | |
| flwang2 | nope, devstack failed since glance can't get token from keystone | 21:09 |
| flwang2 | but before that, there is no failure | 21:09 |
| *** _cjones_ has joined #openstack-keystone | 21:10 | |
| lbragstad | interesting | 21:10 |
| flwang2 | yep, i have tried to remove/clean everything, no lucky | 21:10 |
| lbragstad | flwang2: are you pulling the latest devstack? | 21:11 |
| lbragstad | cc stevemar ^ | 21:11 |
| *** carlosmarin has left #openstack-keystone | 21:12 | |
| *** topol has quit IRC | 21:13 | |
| flwang2 | lbragstad: yes | 21:13 |
| flwang2 | lbragstad: i even tried icehouse and juno | 21:13 |
| flwang2 | lbragstad: i think it's a devstack issue, but I just can't find a way to work around it | 21:16 |
| lbragstad | flwang2: interesting, I'll see if I can recreate in a bit, | 21:22 |
| lbragstad | flwang2: but the keystone service is up and running? | 21:22 |
| flwang2 | lbragstad: yes | 21:22 |
| flwang2 | so I don't think it's a keystone issue | 21:22 |
| lbragstad | so can you create a user against it? | 21:23 |
| flwang2 | good point, let me try | 21:23 |
| flwang2 | feilong@feilong-ThinkPad-X1-Carbon-2nd:~$ keystone user-create --name a | 21:24 |
| flwang2 | Could not find user: admin (Disable debug mode to suppress these details.) (HTTP 401) | 21:24 |
| *** tellesnobrega_ has joined #openstack-keystone | 21:24 | |
| flwang2 | seems I need to fix the admin issue firstly :) | 21:24 |
| flwang2 | never mind, I will go though all the devstack log to see if i can find something | 21:25 |
| lbragstad | flwang2: you could try going directly to keystone with cURL | 21:25 |
| flwang2 | lbragstad: ok, thanks a lot | 21:25 |
| lbragstad | flwang2: http://pasteraw.com/1tinbqh6eo9h0unmip8w4y6jhbzmq28 | 21:26 |
| lbragstad | flwang2: or something similar, you don't need all those parameters | 21:26 |
| lbragstad | and that's using v3 | 21:27 |
| flwang2 | lbragstad: awesome, cheers man | 21:27 |
| lbragstad | flwang2: you too, hope it helps! | 21:27 |
| *** ayoung has joined #openstack-keystone | 21:36 | |
| *** ChanServ sets mode: +v ayoung | 21:36 | |
| *** fifieldt__ has quit IRC | 21:37 | |
| *** fifieldt__ has joined #openstack-keystone | 21:38 | |
| *** raildo has joined #openstack-keystone | 21:40 | |
| lbragstad | morganfainberg: where do you want the StrictABC stuff documented? | 21:42 |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: make audit event scoped to request session and not middleware https://review.openstack.org/149300 | 21:44 |
| *** pnavarro has quit IRC | 21:47 | |
| *** flwang2 has quit IRC | 21:51 | |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: move add event creation logic to keystonemiddleware https://review.openstack.org/149405 | 21:54 |
| *** Tahmina has joined #openstack-keystone | 21:58 | |
| *** raildo has quit IRC | 22:01 | |
| ayoung | dstanek, I like the idea of the scripts that I am proposing being run via a functional test. | 22:13 |
| *** flwang1 has joined #openstack-keystone | 22:14 | |
| ayoung | Coupld things: the client will need a way to do a devstack run | 22:14 |
| *** sriram has quit IRC | 22:15 | |
| ayoung | and the initialization script actually assumes a blank database, whereas devstack puts some sample data in there | 22:15 |
| *** joesavak has quit IRC | 22:21 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: StrictABC Prototype https://review.openstack.org/148354 | 22:23 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch the token provider to use strict_abc https://review.openstack.org/149411 | 22:23 |
| *** mattfarina has quit IRC | 22:26 | |
| *** ayoung has quit IRC | 22:26 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Switch the token provider to use strict_abc https://review.openstack.org/149411 | 22:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: StrictABC Prototype https://review.openstack.org/148354 | 22:27 |
| *** henrynash has quit IRC | 22:30 | |
| *** vhoward has joined #openstack-keystone | 22:30 | |
| flwang1 | lbragstad: still around? | 22:39 |
| flwang1 | now i'm running into the six.wraps issue, http://paste.openstack.org/show/160492/ | 22:39 |
| *** packet has joined #openstack-keystone | 22:47 | |
| *** abhirc has quit IRC | 22:50 | |
| *** ayoung has joined #openstack-keystone | 23:01 | |
| *** ChanServ sets mode: +v ayoung | 23:01 | |
| *** jamielennox|away is now known as jamielennox | 23:01 | |
| jamielennox | morganfainberg: i was hoping for a release around the first | 23:02 |
| jamielennox | the gist has gone from the irc title but that had things marked | 23:03 |
| jamielennox | there weren't exactly a lot of reviews happening though | 23:03 |
| *** nkinder has joined #openstack-keystone | 23:09 | |
| *** dims__ has quit IRC | 23:10 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Surface the user_id and project_id beyond the plugin https://review.openstack.org/132030 | 23:22 |
| *** bknudson has quit IRC | 23:25 | |
| *** tellesnobrega_ has quit IRC | 23:31 | |
| *** jasondotstar has joined #openstack-keystone | 23:34 | |
| *** zzzeek has quit IRC | 23:38 | |
| *** briancurtin has quit IRC | 23:41 | |
| *** briancurtin has joined #openstack-keystone | 23:41 | |
| *** thedodd has quit IRC | 23:42 | |
| *** briancurtin has quit IRC | 23:49 | |
| *** gordc has quit IRC | 23:50 | |
| *** david-lyle is now known as david-lyle_afk | 23:56 | |
| *** radez is now known as radez_g0n3 | 23:58 | |
| *** chlong has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!