| *** abhirc has joined #openstack-keystone | 00:00 | |
| *** jasondotstar has quit IRC | 00:03 | |
| *** chrisshattuck has quit IRC | 00:09 | |
| *** nellysmitt has quit IRC | 00:10 | |
| morganfainberg | dhellmann: https://review.openstack.org/#/c/148354/7 strictabc | 00:11 |
|---|---|---|
| *** dims__ has joined #openstack-keystone | 00:11 | |
| morganfainberg | jamielennox, yeah i need to chase down that url... or bug dolphm to fix it | 00:11 |
| jamielennox | morganfainberg: would like to see some client reviews, it's been kind of quiet and there's things i'm starting to need | 00:12 |
| morganfainberg | jamielennox, yeah - should be doable. | 00:12 |
| *** dims__ has quit IRC | 00:16 | |
| *** markvoelker has quit IRC | 00:18 | |
| *** oomichi has joined #openstack-keystone | 00:22 | |
| *** Tahmina has quit IRC | 00:27 | |
| *** zzzeek has joined #openstack-keystone | 00:35 | |
| *** zzzeek has quit IRC | 00:37 | |
| *** jasondotstar has joined #openstack-keystone | 00:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Surface the user_id and project_id beyond the plugin https://review.openstack.org/132030 | 00:41 |
| *** packet has quit IRC | 00:57 | |
| *** jasondotstar has quit IRC | 00:58 | |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: move add event creation logic to keystonemiddleware https://review.openstack.org/149405 | 00:59 |
| *** dims__ has joined #openstack-keystone | 00:59 | |
| *** gyee has quit IRC | 01:07 | |
| *** flwang1 has quit IRC | 01:11 | |
| *** rwsu is now known as rwsu-afk | 01:15 | |
| *** avozza is now known as zz_avozza | 01:20 | |
| *** lhcheng has quit IRC | 01:29 | |
| morganfainberg | dolphm, ping | 01:32 |
| morganfainberg | dolphm, you're set as the release manager for 1.x.x of keystoneclient | 01:33 |
| morganfainberg | i can't actually do anything with it | 01:33 |
| morganfainberg | dolphm, aha got it resolved since jeblair is sitting at the table here, nvm | 01:38 |
| morganfainberg | jamielennox, ok looking at the python-keystoneclient-kerberos and federation. will be looking at doing the release(s) at the same time as the next keystoneclient | 01:39 |
| jamielennox | don't worry about federation for now | 01:39 |
| morganfainberg | jamielennox, eh ok | 01:41 |
| morganfainberg | figured i'd do both at the same time | 01:42 |
| morganfainberg | it's not a lot of work to do | 01:42 |
| jamielennox | there's nothing in federation afaik | 01:42 |
| morganfainberg | jamielennox, ah ok | 01:42 |
| jamielennox | like from a launchpad perspective set it up - but there's no code to release | 01:42 |
| morganfainberg | got it | 01:43 |
| morganfainberg | yeah | 01:43 |
| *** tellesnobrega_ has joined #openstack-keystone | 01:47 | |
| wanghong | morganfainberg, dolphm, ayoung, we are close to K2 now and these two patch are marked as K2. Do you have a time to look, I think they are OK already:) | 02:02 |
| wanghong | https://review.openstack.org/#/c/130180/ | 02:02 |
| wanghong | https://review.openstack.org/#/c/130474/ | 02:02 |
| *** abhirc has quit IRC | 02:03 | |
| *** abhirc has joined #openstack-keystone | 02:04 | |
| *** _cjones_ has quit IRC | 02:04 | |
| *** jasondotstar has joined #openstack-keystone | 02:05 | |
| *** jasondotstar has quit IRC | 02:05 | |
| *** _cjones_ has joined #openstack-keystone | 02:06 | |
| *** atiwari has quit IRC | 02:09 | |
| *** ayoung has quit IRC | 02:22 | |
| *** _cjones_ has quit IRC | 02:24 | |
| *** erkules_ has joined #openstack-keystone | 02:29 | |
| *** erkules has quit IRC | 02:32 | |
| *** stevemar has quit IRC | 02:39 | |
| *** stevemar2 has joined #openstack-keystone | 02:39 | |
| *** ChanServ sets mode: +v stevemar2 | 02:39 | |
| *** atiwari has joined #openstack-keystone | 02:39 | |
| *** atiwari has quit IRC | 02:44 | |
| stevemar2 | morganfainberg, jamielennox im not even sure if the -federation one builds | 02:50 |
| *** stevemar2 is now known as stevemar | 02:50 | |
| *** rushiagr_away is now known as rushiagr | 02:56 | |
| *** tellesnobrega_ has quit IRC | 02:58 | |
| *** harlowja is now known as harlowja_away | 02:59 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:04 | |
| *** marg7175 has quit IRC | 03:05 | |
| *** samueldmq_ has joined #openstack-keystone | 03:06 | |
| *** tellesnobrega_ has quit IRC | 03:09 | |
| *** jjulien has joined #openstack-keystone | 03:18 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:18 | |
| *** hichtakk has joined #openstack-keystone | 03:29 | |
| *** richm has quit IRC | 03:30 | |
| *** rushiagr is now known as rushiagr_away | 03:30 | |
| *** dims__ has quit IRC | 03:34 | |
| *** samueldmq_ has quit IRC | 03:44 | |
| *** zzzeek has joined #openstack-keystone | 03:45 | |
| *** zzzeek has quit IRC | 03:58 | |
| *** samueldmq_ has joined #openstack-keystone | 04:05 | |
| *** zzzeek has joined #openstack-keystone | 04:33 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/149481 | 04:37 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/149485 | 04:38 |
| *** zzzeek has quit IRC | 04:41 | |
| *** rushiagr_away is now known as rushiagr | 04:49 | |
| *** chrisshattuck has joined #openstack-keystone | 04:52 | |
| *** lhcheng has joined #openstack-keystone | 04:53 | |
| *** samueldmq_ has quit IRC | 04:56 | |
| *** abhirc has quit IRC | 05:03 | |
| *** abhirc has joined #openstack-keystone | 05:05 | |
| *** marg7175 has joined #openstack-keystone | 05:06 | |
| *** zz_avozza is now known as avozza | 05:09 | |
| *** marg7175 has quit IRC | 05:11 | |
| *** stevemar has quit IRC | 05:30 | |
| *** stevemar has joined #openstack-keystone | 05:31 | |
| *** ChanServ sets mode: +v stevemar | 05:31 | |
| *** chrisshattuck has quit IRC | 05:34 | |
| *** hichtakk has quit IRC | 05:38 | |
| *** lhcheng_ has joined #openstack-keystone | 05:41 | |
| *** lhcheng has quit IRC | 05:44 | |
| *** abhirc has quit IRC | 05:46 | |
| *** chlong has quit IRC | 05:54 | |
| *** jamielennox is now known as jamielennox|away | 06:00 | |
| *** chlong has joined #openstack-keystone | 06:01 | |
| *** jamielennox|away is now known as jamielennox | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/149158 | 06:04 |
| *** jamielennox is now known as jamielennox|away | 06:04 | |
| *** ajayaa has joined #openstack-keystone | 06:27 | |
| *** dims__ has joined #openstack-keystone | 06:35 | |
| *** dims__ has quit IRC | 06:39 | |
| *** ajayaa has quit IRC | 06:39 | |
| *** mzbik has joined #openstack-keystone | 06:42 | |
| *** ajayaa has joined #openstack-keystone | 06:51 | |
| *** tellesnobrega_ has quit IRC | 07:00 | |
| *** marg7175 has joined #openstack-keystone | 07:07 | |
| *** lhcheng_ is now known as lhcheng | 07:11 | |
| *** marg7175 has quit IRC | 07:12 | |
| *** KanagarajM2 has joined #openstack-keystone | 07:14 | |
| *** afazekas has quit IRC | 07:15 | |
| *** lhcheng_ has joined #openstack-keystone | 07:21 | |
| *** lhcheng has quit IRC | 07:23 | |
| *** avozza is now known as zz_avozza | 07:25 | |
| openstackgerrit | wanghong proposed openstack/keystonemiddleware: iso expires should be returned in one place https://review.openstack.org/140984 | 07:29 |
| *** wanghong is now known as wanghong_away | 07:36 | |
| *** stevemar has quit IRC | 07:44 | |
| *** erkules_ is now known as erkules | 07:44 | |
| *** stevemar has joined #openstack-keystone | 07:46 | |
| *** ChanServ sets mode: +v stevemar | 07:46 | |
| *** pnavarro has joined #openstack-keystone | 07:52 | |
| *** stevemar has quit IRC | 07:57 | |
| *** afazekas has joined #openstack-keystone | 07:59 | |
| *** chlong has quit IRC | 08:14 | |
| *** zz_avozza is now known as avozza | 08:20 | |
| *** lhcheng_ has quit IRC | 08:43 | |
| *** lhcheng has joined #openstack-keystone | 08:44 | |
| *** ajayaa has quit IRC | 08:47 | |
| *** lhcheng has quit IRC | 08:48 | |
| *** josecastroleon_ has joined #openstack-keystone | 08:50 | |
| *** josecastroleon__ has joined #openstack-keystone | 08:51 | |
| *** josecastroleon has quit IRC | 08:54 | |
| *** josecastroleon_ has quit IRC | 08:55 | |
| *** nellysmitt has joined #openstack-keystone | 08:57 | |
| *** marg7175 has joined #openstack-keystone | 09:08 | |
| *** marg7175 has quit IRC | 09:13 | |
| *** jistr has joined #openstack-keystone | 09:15 | |
| *** avozza is now known as zz_avozza | 09:22 | |
| *** zz_avozza is now known as avozza | 09:25 | |
| *** yuzhg has joined #openstack-keystone | 09:26 | |
| yuzhg | Hello, is there anyone available for help? | 09:28 |
| mzbik | depends what you need ;) | 09:31 |
| yuzhg | hmmm,,,I'm trying to configure my keystone to sendout notifications, I've set the notification_driver to notification_driver = keystone.openstack.common.notifier.rpc_notifier and notification_driver = keystone.openstack.common.notifier.log_notifier, but seems it's not work | 09:32 |
| mzbik | uh | 09:34 |
| yuzhg | I tried to debug the keystone code, it tried to send out the notifications when I create a tenant, but it breaked at https://github.com/openstack/oslo.messaging/blob/master/oslo_messaging/notify/notifier.py. | 09:34 |
| mzbik | never used this | 09:34 |
| yuzhg | oh, still thanks :) | 09:34 |
| mzbik | but try to whait | 09:35 |
| mzbik | somebody might know | 09:35 |
| mzbik | or try at #openstack | 09:35 |
| yuzhg | sure, I'll wait for a while. | 09:35 |
| yuzhg | ah, will try that later :) | 09:35 |
| yuzhg | thx | 09:35 |
| *** KanagarajM2 has quit IRC | 09:39 | |
| *** lhcheng has joined #openstack-keystone | 09:45 | |
| *** lhcheng has quit IRC | 09:49 | |
| openstackgerrit | wanghong proposed openstack/keystone: make trust manager raise formatted message exception https://review.openstack.org/149550 | 09:56 |
| *** henrynash has joined #openstack-keystone | 10:02 | |
| *** ChanServ sets mode: +v henrynash | 10:02 | |
| *** andreaf_ is now known as andreaf | 10:04 | |
| *** dhague has joined #openstack-keystone | 10:05 | |
| *** jaosorior has joined #openstack-keystone | 10:14 | |
| *** ajayaa has joined #openstack-keystone | 10:18 | |
| *** bdossant has joined #openstack-keystone | 10:23 | |
| *** aix has joined #openstack-keystone | 10:29 | |
| *** tellesnobrega_ has joined #openstack-keystone | 10:36 | |
| *** nellysmitt has quit IRC | 10:43 | |
| *** dims__ has joined #openstack-keystone | 10:58 | |
| *** dims__ has quit IRC | 11:02 | |
| *** tellesnobrega_ has quit IRC | 11:05 | |
| *** marg7175 has joined #openstack-keystone | 11:09 | |
| *** dims__ has joined #openstack-keystone | 11:11 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Experimental data-driver assignment testing https://review.openstack.org/149178 | 11:12 |
| *** henrynash has quit IRC | 11:13 | |
| *** avozza is now known as zz_avozza | 11:13 | |
| *** zz_avozza is now known as avozza | 11:13 | |
| *** marg7175 has quit IRC | 11:14 | |
| *** yuzhg has quit IRC | 11:20 | |
| openstackgerrit | Yuriy Taraday proposed openstack/keystone: Add a module to work with LDAP filters and DNs https://review.openstack.org/117484 | 11:45 |
| *** chlong has joined #openstack-keystone | 11:50 | |
| *** nellysmitt has joined #openstack-keystone | 12:10 | |
| *** tellesnobrega_ has joined #openstack-keystone | 12:20 | |
| *** my_openstack_use has quit IRC | 12:21 | |
| *** raildo has joined #openstack-keystone | 12:31 | |
| *** lhcheng has joined #openstack-keystone | 12:34 | |
| *** tellesnobrega_ has quit IRC | 12:35 | |
| *** josecastroleon__ has quit IRC | 12:36 | |
| *** mflobo has quit IRC | 12:36 | |
| *** josecastroleon__ has joined #openstack-keystone | 12:36 | |
| *** mflobo has joined #openstack-keystone | 12:38 | |
| *** lhcheng has quit IRC | 12:39 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/149485 | 12:40 |
| *** tellesnobrega_ has joined #openstack-keystone | 12:43 | |
| *** marg7175 has joined #openstack-keystone | 13:10 | |
| *** rushiagr is now known as rushiagr_away | 13:10 | |
| *** dims__ has quit IRC | 13:11 | |
| *** dims__ has joined #openstack-keystone | 13:11 | |
| *** marg7175 has quit IRC | 13:15 | |
| *** bknudson has joined #openstack-keystone | 13:16 | |
| *** ChanServ sets mode: +v bknudson | 13:16 | |
| *** mzbik has quit IRC | 13:20 | |
| *** Samolo has joined #openstack-keystone | 13:24 | |
| Samolo | hi all | 13:24 |
| Samolo | i have a question about tenant from keystone | 13:24 |
| Samolo | what is the best way of creating a Vm | 13:25 |
| Samolo | we are a hosting company and want to allow customer to create VM througth openstack | 13:25 |
| Samolo | what is the best practice : | 13:25 |
| Samolo | 1 - create a tenant for the customer and create a vm with the tenantId of the customer | 13:26 |
| Samolo | or | 13:26 |
| Samolo | 2 - create a VM with admin enant and link it to the customer tenant plz ? | 13:26 |
| *** markvoelker has joined #openstack-keystone | 13:29 | |
| raildo | Samolo, IMO its depend what do you want to do. A tenant is a container of resources, so if you have some users that will use the same resources (VMs), so the best solution is put this users in one tenant, | 13:30 |
| raildo | Samolo, so I say the 1 option :) | 13:31 |
| Samolo | Ok good, thanks a lot to you :) | 13:31 |
| raildo | Samolo, in the Openstack glossary we have this definition "project = A logical grouping of users within Compute; defines quotas and access to VM images." | 13:33 |
| raildo | http://docs.openstack.org/glossary/content/glossary.html | 13:33 |
| Samolo | thanks for pointing this :) | 13:34 |
| Samolo | bookmarked ;) | 13:34 |
| raildo | Samolo, :) | 13:34 |
| *** bdossant has quit IRC | 13:41 | |
| *** gordc has joined #openstack-keystone | 13:46 | |
| *** rushiagr_away is now known as rushiagr | 13:46 | |
| *** htruta has quit IRC | 13:54 | |
| *** richm has joined #openstack-keystone | 14:02 | |
| *** htruta has joined #openstack-keystone | 14:04 | |
| samueldmq | bknudson, ping - have you a minute to talk about tests? | 14:07 |
| *** sriram has joined #openstack-keystone | 14:09 | |
| *** mattfarina has joined #openstack-keystone | 14:09 | |
| bknudson | samueldmq: sure | 14:09 |
| samueldmq | bknudson, in order to have a great suite of tests, besides of functional ones | 14:12 |
| samueldmq | bknudson, should we have unit tests for each level in (controller, manager, drivers) using mocks? | 14:13 |
| samueldmq | bknudson, is that necessary (all levels), in your opinion .. | 14:13 |
| bknudson | samueldmq: that's considered best practice. | 14:13 |
| bknudson | I doubt that we could get contributors to meet that standard. | 14:14 |
| samueldmq | bknudson, don't know how much effort it could require, but I could try to examine it | 14:15 |
| samueldmq | bknudson, and then see if it's feasible | 14:15 |
| samueldmq | bknudson, i) backend (driver) level is quite complete already | 14:16 |
| *** abhirc has joined #openstack-keystone | 14:16 | |
| samueldmq | bknudson, ii) manager would be tested on how additional business logic is treated (that what managers stand for), for example inherited role assignment expansion | 14:16 |
| samueldmq | bknudson, iii) controllers would be tested in order to check validation of received params | 14:17 |
| samueldmq | I think this work would help us to keep the levels consistent with what they stand for | 14:18 |
| samueldmq | for example inehrited role assingment expansion was at controller level, but it should be at manager (because it's additional business logic) | 14:18 |
| *** henrynash has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v henrynash | 14:23 | |
| *** tellesnobrega_ has quit IRC | 14:27 | |
| *** tellesnobrega_ has joined #openstack-keystone | 14:27 | |
| *** joesavak has joined #openstack-keystone | 14:40 | |
| *** mflobo has quit IRC | 14:40 | |
| *** topol has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v topol | 14:42 | |
| samueldmq | henrynash, ping - replied your comment on assignments refactoring | 14:44 |
| *** packet has joined #openstack-keystone | 14:45 | |
| *** ayoung has joined #openstack-keystone | 14:45 | |
| *** ChanServ sets mode: +v ayoung | 14:45 | |
| samueldmq | henrynash, once we agree that , I am able to send new patchsets on that chain complaining both: i) allow effective + domain (as discussed earlier); ii) that new representation between manager/controller | 14:46 |
| henrynash | yes, agreed. just responding - yes, with group_id in indirect, it could be applying to a domain as well… | 14:47 |
| henrynash | did you see my other comment about effective? | 14:47 |
| henrynash | line 624 | 14:47 |
| henrynash | I know it’s a bit of a corner case this new one….but it depeds what we think happens if you turn off os-inherit | 14:48 |
| henrynash | I wrote a test for it (with my experimental stuff) and found it | 14:49 |
| henrynash | I updated my experimental patch with it in | 14:49 |
| henrynash | (it’s the last test i added) | 14:49 |
| *** avozza is now known as zz_avozza | 14:51 | |
| *** tellesnobrega_ has quit IRC | 14:52 | |
| *** chlong has quit IRC | 14:54 | |
| *** samueldmq_ has joined #openstack-keystone | 14:58 | |
| *** abhirc has quit IRC | 15:01 | |
| *** jasondotstar has joined #openstack-keystone | 15:10 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/149481 | 15:10 |
| *** abhirc has joined #openstack-keystone | 15:14 | |
| *** rwsu-afk is now known as rwsu | 15:24 | |
| Samolo | I have a question relative to openstack interaction | 15:26 |
| Samolo | as a hosting company, we have a tenant per customer | 15:26 |
| Samolo | what is the best way to intercat with openstack while making action : | 15:27 |
| Samolo | 1 - use a general admin token to make all the request (like creating vm etc...) | 15:27 |
| Samolo | or | 15:27 |
| Samolo | 2 - get a token from the current tenant and make the request ? | 15:28 |
| *** henrynash has quit IRC | 15:31 | |
| Samolo | plz | 15:31 |
| *** henrynash has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v henrynash | 15:33 | |
| *** henrynash_ has joined #openstack-keystone | 15:38 | |
| *** ChanServ sets mode: +v henrynash_ | 15:38 | |
| *** henrynash has quit IRC | 15:39 | |
| *** carlosmarin has joined #openstack-keystone | 15:40 | |
| *** henrynash_ has quit IRC | 15:42 | |
| *** abhirc has quit IRC | 15:45 | |
| *** marg7175 has joined #openstack-keystone | 15:45 | |
| *** ajayaa has quit IRC | 15:46 | |
| *** ajayaa has joined #openstack-keystone | 15:47 | |
| *** afazekas has quit IRC | 15:47 | |
| *** jsavak has joined #openstack-keystone | 15:54 | |
| *** abhirc has joined #openstack-keystone | 15:55 | |
| *** zzzeek has joined #openstack-keystone | 15:56 | |
| *** joesavak has quit IRC | 15:58 | |
| Samolo | what is the best way to intercat with openstack while making action : | 16:00 |
| Samolo | 1 - use a general admin token to make all the request for all customer tenant (like creating vm etc...) | 16:00 |
| Samolo | or | 16:00 |
| Samolo | 2 - get a token from the current tenant and make the request ? | 16:00 |
| Samolo | waht is the best practice plz ? | 16:00 |
| *** abhirc has quit IRC | 16:03 | |
| *** booly-yam-4259 has joined #openstack-keystone | 16:05 | |
| *** booly-yam-4259 has quit IRC | 16:06 | |
| *** dhague has quit IRC | 16:06 | |
| *** booly-yam-4912 has joined #openstack-keystone | 16:06 | |
| *** MasterPieceF has joined #openstack-keystone | 16:14 | |
| *** arunkant has joined #openstack-keystone | 16:23 | |
| larsks | Samolo: creating things with an admin token might result in then being inaccessible to non-admin users. So probably (2) is a better choice. Also, #openstack is your best channel for support questions. | 16:24 |
| *** thedodd has joined #openstack-keystone | 16:26 | |
| *** tellesnobrega_ has joined #openstack-keystone | 16:28 | |
| Samolo | larsks, Thanks for your response | 16:34 |
| *** david-lyle_afk is now known as david-lyle | 16:35 | |
| *** nkinder has quit IRC | 16:35 | |
| *** marg7175 has quit IRC | 16:43 | |
| *** marg7175 has joined #openstack-keystone | 16:44 | |
| *** _cjones_ has joined #openstack-keystone | 16:45 | |
| Samolo | how can i activate keystone extension OS-KSEC2 plz ? | 16:48 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 16:51 |
| *** afazekas has joined #openstack-keystone | 16:51 | |
| *** lhcheng has joined #openstack-keystone | 16:55 | |
| *** marg7175 has quit IRC | 16:57 | |
| *** marg7175 has joined #openstack-keystone | 16:57 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 16:59 |
| *** abhirc has joined #openstack-keystone | 17:02 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use migration_cli for db migrations https://review.openstack.org/147548 | 17:03 |
| *** dims__ has quit IRC | 17:04 | |
| *** dims__ has joined #openstack-keystone | 17:14 | |
| *** dims__ is now known as dimsum__ | 17:16 | |
| *** jistr has quit IRC | 17:16 | |
| *** marg7175 has quit IRC | 17:20 | |
| *** MasterPieceF has quit IRC | 17:21 | |
| *** bknudson has quit IRC | 17:29 | |
| *** zzzeek_ has joined #openstack-keystone | 17:31 | |
| *** zzzeek has quit IRC | 17:32 | |
| *** zzzeek_ is now known as zzzeek | 17:32 | |
| *** zzzeek_ has joined #openstack-keystone | 17:35 | |
| *** zzzeek has quit IRC | 17:37 | |
| *** zzzeek_ is now known as zzzeek | 17:37 | |
| *** chrisshattuck has joined #openstack-keystone | 17:44 | |
| *** jaosorior has quit IRC | 17:44 | |
| *** booly-yam-4912_ has joined #openstack-keystone | 17:46 | |
| *** booly-yam-4912 has quit IRC | 17:46 | |
| morganfainberg | be scared, topol has +2 on specs core! ;) | 17:51 |
| * morganfainberg goes back to meeting(s). | 17:51 | |
| *** jasondotstar has quit IRC | 17:52 | |
| *** samueldmq_ has quit IRC | 17:54 | |
| *** drjones has joined #openstack-keystone | 17:56 | |
| dstanek | who is this topol character you speak of? | 17:57 |
| *** kfox1111 has joined #openstack-keystone | 17:57 | |
| kfox1111 | is there any way to do roles via groups yet? | 17:57 |
| kfox1111 | I'd like to have an admin group that we have multiple admins in, that we assign to tenants. | 17:58 |
| *** _cjones_ has quit IRC | 17:59 | |
| *** adam_g_out is now known as adam_g | 18:02 | |
| *** drjones has quit IRC | 18:06 | |
| *** jasondotstar has joined #openstack-keystone | 18:08 | |
| *** harlowja_away is now known as harlowja | 18:14 | |
| *** _cjones_ has joined #openstack-keystone | 18:19 | |
| *** rushiagr is now known as rushiagr_away | 18:19 | |
| *** thedodd has quit IRC | 18:21 | |
| *** atiwari has joined #openstack-keystone | 18:41 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: add helper module https://review.openstack.org/149706 | 18:41 |
| *** ajayaa has quit IRC | 18:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/149708 | 18:42 |
| *** ajayaa has joined #openstack-keystone | 18:44 | |
| *** david-lyle has quit IRC | 18:46 | |
| *** marg7175 has joined #openstack-keystone | 18:51 | |
| rodrigods | ayoung, ping... available to chat about dynamic policies? | 18:52 |
| *** marg7175 has quit IRC | 18:55 | |
| *** marg7175 has joined #openstack-keystone | 18:55 | |
| *** thedodd has joined #openstack-keystone | 19:08 | |
| rodrigods | morganfainberg, topol nice! | 19:12 |
| *** jasondotstar has quit IRC | 19:15 | |
| samueldmq | topol, congratulations o/ | 19:17 |
| *** jasondotstar has joined #openstack-keystone | 19:18 | |
| topol | samueldmq. Thanks! | 19:19 |
| *** marg7175 has quit IRC | 19:28 | |
| *** booly-yam-4912_ has quit IRC | 19:36 | |
| *** marg7175 has joined #openstack-keystone | 19:37 | |
| *** MasterPieceF has joined #openstack-keystone | 19:39 | |
| MasterPieceF | Hi, I have a problem with authorization | 19:39 |
| MasterPieceF | $ keystone --os-tenant-name admin --os-username admin --os-password 45eb508575c19091b9a1 --os-auth-url http://controller:35357/v2.0 token-get | 19:39 |
| MasterPieceF | The request you have made requires authentication. (HTTP 401) | 19:39 |
| MasterPieceF | Can anyone help me please? | 19:40 |
| *** tellesnobrega_ has quit IRC | 19:44 | |
| *** vhoward has left #openstack-keystone | 19:47 | |
| raildo | morganfainberg, hey, about the reseller spec, yesterday I talked with henrynash about the clashing name in the domains sql migration to Project table, and we're thinking that we can allow the names to clash and change the SQL unique constrains. something like project = name +project_id+ domain-ness flag | 19:57 |
| raildo | and domain = name + domain_id + domain-ness flag | 19:57 |
| raildo | morganfainberg, what do you think? | 19:57 |
| morganfainberg | raildo, the issue is that if a domain == project | 20:01 |
| morganfainberg | raildo, project name is nolonger unique in the constraint of a domain | 20:02 |
| morganfainberg | unless domain is not part of itself? | 20:02 |
| raildo | morganfainberg, I think the question is what can happens wrong if I have a project and a domain with the same name in just one table. IMO domain != project even in the same table. | 20:07 |
| morganfainberg | it's not within one table | 20:08 |
| morganfainberg | the within one table isn't the issue | 20:08 |
| morganfainberg | within the API, is the domain owned by itself? | 20:08 |
| raildo | morganfainberg, I don't think so | 20:09 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 20:10 |
| morganfainberg | and is the domain-project namespace unique to the domain | 20:10 |
| morganfainberg | thats the concern | 20:10 |
| morganfainberg | the SQL side is an easy fix | 20:10 |
| *** MasterPieceF has quit IRC | 20:10 | |
| raildo | morganfainberg, correct | 20:10 |
| morganfainberg | it's just a question of when asking "all projects in domain X" is the project that represents domain X in that list | 20:10 |
| morganfainberg | if so, you run into unique naming constraints | 20:10 |
| morganfainberg | if not, then who cares. | 20:11 |
| rodrigods | morganfainberg, don't think so | 20:11 |
| rodrigods | they would be treated differently | 20:11 |
| rodrigods | so... they might have the same name if are being different concepts? | 20:11 |
| morganfainberg | now, [Domain X] which has project Y under it, cannot have a new domain named "y" added under it, because project == domain in the new world order | 20:11 |
| morganfainberg | rodrigods, domains are projects | 20:12 |
| morganfainberg | they are not separate concepts going forward | 20:12 |
| morganfainberg | domain is a "feature" of a project | 20:12 |
| rodrigods | morganfainberg, ok... | 20:12 |
| morganfainberg | not domains exist and projects also exist | 20:12 |
| rodrigods | nice description | 20:12 |
| rodrigods | "<morganfainberg> domain is a "feature" of a project" is the sentence that defines everything :) | 20:13 |
| morganfainberg | rodrigods, yeah that is largely what we've discussed | 20:13 |
| morganfainberg | and the discussion we had at the midcycle, the domain table is likely going to become a FK to the project table. | 20:13 |
| *** aslaen has quit IRC | 20:14 | |
| raildo | morganfainberg, so, we will not drop the domain table anymore? | 20:15 |
| raildo | morganfainberg, so the other proposal is change the project name... | 20:27 |
| raildo | since we can't change the domain name due the domain specific config files | 20:27 |
| morganfainberg | raildo, we are changing what the domain table is | 20:27 |
| *** pnavarro has quit IRC | 20:36 | |
| *** henrynash has joined #openstack-keystone | 20:37 | |
| *** ChanServ sets mode: +v henrynash | 20:37 | |
| raildo | henrynash, hey, I was discussed about the name clashing a few minutes ago and he define domains like 'domain is a "feature" of a project', so we can't allow the name clash even changing the unique constraint... | 20:40 |
| raildo | he = morganfainberg :P | 20:41 |
| henrynash | raildo: but remember name is not unique in the project table…it only has to be unique within projects within a domain (I.e. UNIQUE = (projectname,project.domain_id) | 20:42 |
| henrynash | raidlo: so what value will project.domain_id have for projects which are a domain? | 20:43 |
| henrynash | raildo: answer: null (I think?) | 20:43 |
| rodrigods | henrynash, raildo, yes... but the project which has the domain feature is still a project of that domain | 20:44 |
| rodrigods | or not? | 20:44 |
| raildo | henrynash, we thinking and repeat the project_id | 20:44 |
| henrynash | so won’t UNIQUE = (project.name, project.domain_id) still be unque even if a domain name clashes with project name | 20:44 |
| raildo | s/and/in | 20:44 |
| henrynash | ahh, ok… I was assuming it would be null….hence that would (I think) make the uniquess constraint still work | 20:45 |
| rodrigods | henrynash, can't I get a domain scoped token by passing the domain_name? | 20:46 |
| henrynash | raildo: hmm, ok, I see what you mean…althouh we can distinuish between the two, it would still break the API…damn | 20:46 |
| henrynash | rodigods: yes | 20:46 |
| henrynash | rodigods: or domain_id, either will work | 20:46 |
| rodrigods | henrynash, so having a project (not domain) and another project (domain) with the same name | 20:46 |
| rodrigods | in the same domain | 20:47 |
| rodrigods | would open security breaches | 20:47 |
| raildo | henrynash, so, i'm thinking and stay with the other proposal to change the project name, when we find some clash name... | 20:49 |
| henrynash | rodigods: no, that wouldn’t since we would know whether we were lookig for a domain or not - and (in henry’s naive model) projects that were domains would have project.domain_id = null, so you could distinquish | 20:49 |
| henrynash | the problem, however, is that I had forgotten that if you list projects in a domain…you want to return the project that represents the domain as well as all the pojects therein…and THAT would might show up the project name | 20:51 |
| henrynash | (issue) | 20:51 |
| rodrigods | henrynash, yep... | 20:51 |
| henrynash | I had been thinking that if you listed all projects in a domain you wouldn;t return teh project that represented the domain…but that kind of spoils the while idea that a domain is a project | 20:51 |
| henrynash | :-) | 20:52 |
| henrynash | if you weren’t going to do that, then we’d be OK | 20:52 |
| rodrigods | henrynash, so change the project name anyways? giving a nice warning to operators? :) | 20:53 |
| *** marg7175 has quit IRC | 20:53 | |
| henrynash | rodigods: that’s certainly the simplest…even though it is likely to have most impact.... | 20:54 |
| henrynash | i’ll think about it a little more over the next hour, then come back to you | 20:54 |
| *** henrynash has quit IRC | 20:54 | |
| raildo | henrynash, I think that we need to return this project represented the domain... since we are implementing "domain is a project" (or domain is a feature of project) | 20:55 |
| *** raildo has quit IRC | 20:56 | |
| *** samueldmq has quit IRC | 21:01 | |
| morganfainberg | hm. | 21:05 |
| *** marg7175 has joined #openstack-keystone | 21:10 | |
| *** booly-yam-6140 has joined #openstack-keystone | 21:12 | |
| *** topol has quit IRC | 21:13 | |
| *** hichtakk has joined #openstack-keystone | 21:16 | |
| *** Samolo has quit IRC | 21:24 | |
| *** ajayaa has quit IRC | 21:24 | |
| *** ajayaa has joined #openstack-keystone | 21:26 | |
| *** booly-yam-6140 has quit IRC | 21:27 | |
| atiwari | all any one can help me on tox related issue? | 21:29 |
| *** ajayaa has quit IRC | 21:33 | |
| morganfainberg | atiwari, what is the issue? | 21:35 |
| *** stevemar has joined #openstack-keystone | 21:35 | |
| *** ChanServ sets mode: +v stevemar | 21:35 | |
| *** amerine has quit IRC | 21:36 | |
| *** abhirc has quit IRC | 21:36 | |
| *** abhirc has joined #openstack-keystone | 21:36 | |
| atiwari | morganfainberg, I am running fox -e py27 and it kind of hang at "" | 21:37 |
| atiwari | {PYTHON:-python} -m subunit.run discover -t ./ ./keystone/tests | 21:37 |
| atiwari | no error | 21:37 |
| atiwari | any idea? | 21:37 |
| atiwari | sorry fox | 21:37 |
| atiwari | tox | 21:37 |
| atiwari | my bad | 21:37 |
| *** amerine has joined #openstack-keystone | 21:38 | |
| *** kfox1111 has quit IRC | 21:38 | |
| *** jasondotstar has quit IRC | 21:38 | |
| morganfainberg | atiwari, uhm. not sure. | 21:39 |
| atiwari | np, sorry I think I should replace my keyboard :) | 21:42 |
| *** abhirc_ has joined #openstack-keystone | 21:44 | |
| *** abhirc has quit IRC | 21:47 | |
| morganfainberg | atiwari, i'm also in a meeting so hard to context switch | 21:47 |
| dstanek | atiwari: are you still having problems? | 21:48 |
| atiwari | dstanek, yes | 21:48 |
| dstanek | atiwari: what happens exactly? | 21:48 |
| morganfainberg | ayoung, dstanek, stevemar, jamielennox|away, ayoung, dolphm, I have a proposal for something we need (in Keystone) i'll bug you when i'm out of this meeting, but this is regarding some clear drawings of our complete architecture | 21:48 |
| dstanek | morganfainberg: bug away | 21:49 |
| morganfainberg | dstanek, yeah. i have some information we can pull in, but i need this meeting to end before i can spend real time on proposing what i'd like to see (and likely something i'll be doing a bunch of) | 21:49 |
| atiwari | dstanek, I am setting up new dev env on ubuntu (on MAC) and running the tox first time. | 21:50 |
| atiwari | it is hanging on ${PYTHON:-python} -m subunit.run discover -t ./ ./keystone/tests | 21:50 |
| atiwari | no error no thing | 21:50 |
| dstanek | atiwari: what happens when you run 'testr list-tests' | 21:51 |
| dstanek | atiwari: or it may be 'PYTHON=.tox/py27/bin/python .tox/py27/bin/testr list-tests' for your env | 21:51 |
| atiwari | let me see | 21:51 |
| atiwari | testr list-tests is listing all the tests | 21:52 |
| dstanek | atiwari: when it prints the command being run is it the same as the one that is failing? | 21:53 |
| atiwari | yes | 21:54 |
| dstanek | what happens if you run that command manually? | 21:55 |
| atiwari | Sorry dstanek it is not printing any thing after "${PYTHON:-python} -m subunit.run discover -t ./ ./keystone/tests | 21:57 |
| atiwari | " | 21:57 |
| atiwari | when I run fox -e py27 | 21:57 |
| morganfainberg | makes me wonder if your venv is healthy | 21:57 |
| atiwari | hm | 21:58 |
| atiwari | let me clean it | 21:58 |
| dstanek | atiwari: don't run the tox command - i want to know what happens when you run the subunit command manually | 21:58 |
| morganfainberg | atiwari, yeah that feels like a venv thingish issue first. | 21:58 |
| morganfainberg | atiwari, but do what dstanek is asking first | 21:58 |
| dstanek | or it could be a busted tox install | 21:59 |
| atiwari | ok | 21:59 |
| morganfainberg | atiwari, dstanek, don't forget to activate the venv | 21:59 |
| atiwari | dstanek, can you provide me a manual command? | 22:00 |
| morganfainberg | atiwari, ^ activate the venv and run that command | 22:00 |
| atiwari | ok | 22:00 |
| morganfainberg | atiwari: "${PYTHON:-python} -m subunit.run discover -t ./ ./keystone/tests | 22:00 |
| morganfainberg | might be a missing quote or such | 22:00 |
| *** mattfarina has quit IRC | 22:01 | |
| *** jsavak has quit IRC | 22:05 | |
| *** gyee has joined #openstack-keystone | 22:07 | |
| *** ChanServ sets mode: +v gyee | 22:07 | |
| atiwari | seems the manual command is running the tests. but not sure why it is printing binary characters too in the console :) | 22:15 |
| *** sriram has quit IRC | 22:16 | |
| dstanek | atiwari: that command isn't actually running any tests - that just lists them - does it complete? | 22:20 |
| atiwari | not yet | 22:21 |
| atiwari | binary is expected? | 22:22 |
| dstanek | do you have something strange in your directory structure? a cyclic link or anything like that? | 22:22 |
| dstanek | yes, it print subunit format which is binary | 22:23 |
| atiwari | ok | 22:24 |
| *** chlong has joined #openstack-keystone | 22:24 | |
| atiwari | not sure about cyclic link. I have one link for JDK but should not be cyclic | 22:25 |
| atiwari | may be I should recreate pyenv and venv? | 22:26 |
| dstanek | you have a jdk link in your keystone checkout? | 22:26 |
| morganfainberg | jdk?! | 22:27 |
| atiwari | its is Java but not in keystone checkout | 22:29 |
| atiwari | it is way above keystone | 22:29 |
| dstanek | atiwari: sounds like you have something borked, but i'm not sure what that could be | 22:32 |
| dstanek | atiwari: if recreating you env doesn't work you will probably have to debug subunit | 22:32 |
| atiwari | dstanek, let me recreate first and then I will try to debug subunit. | 22:33 |
| atiwari | thanks for your time dstanek morganfainberg | 22:33 |
| dstanek | what OS are you running? | 22:33 |
| *** topol has joined #openstack-keystone | 22:57 | |
| *** ChanServ sets mode: +v topol | 22:58 | |
| *** carlosmarin has quit IRC | 22:59 | |
| richm | so we seem to have found a strange problem with using the ldap identity backend with user_id_attribute=uidNumber | 23:04 |
| richm | this causes the json returned from keystone to be "id": 1000 instead of "id": "1000" | 23:05 |
| richm | in ldap uidNumber has Integer syntax, as opposed to DirectoryString used by cn, sn, uid, etc. | 23:05 |
| richm | the problem is with requests to change the project e.g. | 23:06 |
| *** david-ly_ has joined #openstack-keystone | 23:07 | |
| richm | PUT /v2.0/users/1000/OS-KSADM/tenant -d '{"user": {"id": 1000, "tenantId": "887e3dfaba27444e87f260b6bdad9bd7"}}' | 23:07 |
| richm | note that the "id": 1000 is a json/python integer, not a string | 23:07 |
| richm | this returns the error: Cannot change user ID (HTTP 400) | 23:07 |
| richm | however, using "id": "1000" works | 23:07 |
| richm | question: in keystone requests, is "id" always supposed to be a json string? | 23:08 |
| *** abhirc_ has quit IRC | 23:08 | |
| *** david-ly_ is now known as david-lyle | 23:11 | |
| *** raildo has joined #openstack-keystone | 23:11 | |
| *** raildo has quit IRC | 23:27 | |
| *** gyee has quit IRC | 23:32 | |
| *** marg7175 has quit IRC | 23:32 | |
| *** dimsum__ has quit IRC | 23:34 | |
| *** marg7175 has joined #openstack-keystone | 23:44 | |
| *** thedodd has quit IRC | 23:48 | |
| *** abhirc has joined #openstack-keystone | 23:55 | |
| *** packet has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!