| *** chrisshattuck has quit IRC | 00:00 | |
| *** markvoelker has joined #openstack-keystone | 00:05 | |
| *** david_hu__ has quit IRC | 00:06 | |
| *** kfox1111 has quit IRC | 00:09 | |
| *** zzzeek has quit IRC | 00:11 | |
| *** zzzeek has joined #openstack-keystone | 00:14 | |
| gyee | morganfainberg, should I backport this one to juno? https://review.openstack.org/#/c/145159/ | 00:16 |
|---|---|---|
| morganfainberg | gyee yes please | 00:16 |
| gyee | since I am in the backporting/cherrypicking mode today :) | 00:16 |
| *** hichtakk has quit IRC | 00:19 | |
| *** hichtakk has joined #openstack-keystone | 00:20 | |
| *** hichtakk has quit IRC | 00:20 | |
| *** hichtakk has joined #openstack-keystone | 00:21 | |
| *** hichtakk has quit IRC | 00:21 | |
| *** hichtakk has joined #openstack-keystone | 00:22 | |
| *** zzzeek has quit IRC | 00:22 | |
| *** zzzeek has joined #openstack-keystone | 00:23 | |
| gyee | morganfainberg, for generic mapping enhancement, I presume backward compatibility is non-negotiable? | 00:32 |
| morganfainberg | yeah | 00:32 |
| morganfainberg | we can't break backwards compat | 00:32 |
| gyee | yeah, those {1} are making me headache right now | 00:32 |
| *** gokrokve has quit IRC | 00:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add name parameter to NoMatchingPlugin exception https://review.openstack.org/139898 | 00:35 |
| *** dims has quit IRC | 00:38 | |
| *** dims has joined #openstack-keystone | 00:39 | |
| *** fifieldt has joined #openstack-keystone | 00:39 | |
| *** dims has quit IRC | 00:39 | |
| *** gabriel-bezerra has quit IRC | 00:41 | |
| *** tellesnobrega has quit IRC | 00:41 | |
| *** htruta has quit IRC | 00:41 | |
| *** thedodd has joined #openstack-keystone | 00:42 | |
| *** gabriel-bezerra has joined #openstack-keystone | 00:42 | |
| *** tellesnobrega has joined #openstack-keystone | 00:43 | |
| *** htruta has joined #openstack-keystone | 00:43 | |
| *** atiwari has quit IRC | 00:44 | |
| *** atiwari has joined #openstack-keystone | 00:44 | |
| *** atiwari has quit IRC | 00:44 | |
| *** r-daneel has quit IRC | 00:44 | |
| *** dims has joined #openstack-keystone | 00:45 | |
| *** dims has quit IRC | 00:50 | |
| *** harlowja has quit IRC | 00:54 | |
| *** stevemar has joined #openstack-keystone | 00:54 | |
| *** ChanServ sets mode: +v stevemar | 00:54 | |
| *** gokrokve has joined #openstack-keystone | 00:56 | |
| *** topol has joined #openstack-keystone | 00:57 | |
| *** ChanServ sets mode: +v topol | 00:57 | |
| *** gokrokve has quit IRC | 01:01 | |
| *** mriedem has left #openstack-keystone | 01:05 | |
| *** markvoelker has quit IRC | 01:05 | |
| *** markvoelker has joined #openstack-keystone | 01:06 | |
| *** oomichi has joined #openstack-keystone | 01:08 | |
| *** markvoelker has quit IRC | 01:10 | |
| *** zzzeek has quit IRC | 01:13 | |
| *** gabriel-bezerra has quit IRC | 01:13 | |
| *** gabriel-bezerra has joined #openstack-keystone | 01:13 | |
| *** gyee has quit IRC | 01:15 | |
| *** gokrokve has joined #openstack-keystone | 01:16 | |
| *** kfox1111 has joined #openstack-keystone | 01:30 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove duplicated check https://review.openstack.org/150022 | 01:32 |
| *** htruta has quit IRC | 01:33 | |
| *** tellesnobrega has quit IRC | 01:33 | |
| *** gabriel-bezerra has quit IRC | 01:33 | |
| *** harlowja has joined #openstack-keystone | 01:35 | |
| *** tellesnobrega has joined #openstack-keystone | 01:35 | |
| *** htruta has joined #openstack-keystone | 01:39 | |
| *** hichtakk has quit IRC | 01:41 | |
| *** gabriel-bezerra has joined #openstack-keystone | 01:42 | |
| *** kfox1111 has quit IRC | 01:47 | |
| *** gokrokve has quit IRC | 01:51 | |
| *** thedodd has quit IRC | 01:51 | |
| *** dims has joined #openstack-keystone | 01:59 | |
| *** rwsu is now known as rwsu-afk | 02:05 | |
| *** avozza is now known as zz_avozza | 02:08 | |
| *** tqtran has quit IRC | 02:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/150208 | 02:17 |
| *** erkules_ has joined #openstack-keystone | 02:23 | |
| jamielennox | ayoung: googling around after problems setting up packstack and found the keystone channel log with you and I talking | 02:24 |
| jamielennox | ayoung: do you remember how you got past 'Invalid command 'NSSPassPhraseDialog', perhaps misspelled or defined by a module not included in the server configuration' | 02:24 |
| *** dims has quit IRC | 02:24 | |
| *** erkules has quit IRC | 02:26 | |
| jamielennox | packstack is stupidly broken | 02:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/identity-api: Updated from global requirements https://review.openstack.org/150221 | 02:27 |
| ayoung | jamielennox, what stage gives you that problem? | 02:27 |
| jamielennox | i'm trying to setup kerberized keystone | 02:28 |
| jamielennox | thought i'd go via packstack as nkinder has those scripts | 02:28 |
| jamielennox | set packstack to use httpd for deployment, install mod_nss | 02:29 |
| ayoung | i RAN pACKSTACK AGAINST AN f21 vm LAST fRIDAY AND IT ERRORED OUT and I just realized I had caps lock on but am to lazy toretype | 02:29 |
| ayoung | jamielennox, so is that in the HTTPD setup? | 02:30 |
| jamielennox | ipa on f21 failed | 02:31 |
| jamielennox | centos vm on cloud didn't work | 02:31 |
| jamielennox | i've currently got an f20 ipa | 02:31 |
| jamielennox | and an f21 packstack | 02:31 |
| jamielennox | i've already had to fix just some stupid problems with how it installs keystone | 02:31 |
| ayoung | its tought to get motivated to tilt at the particular windmill again. Pretty sure it is not a giant now. | 02:31 |
| jamielennox | i wanted a real life test of that horizon kerberos patch | 02:32 |
| ayoung | jamielennox, are you sure it is using NSS to set up SSL, and not mod_ssl? | 02:32 |
| jamielennox | i got onto lhcheng in -horizon and we've got one +2 | 02:32 |
| ayoung | are the other directived NSS_ or SSL_ ? | 02:32 |
| ayoung | jamielennox, my guess is that error is coming from mod_nss not being enabled. | 02:34 |
| jamielennox | ayoung: that's what i was thinking | 02:34 |
| jamielennox | it's loading the conf but not the module | 02:35 |
| jamielennox | i'm just tryting to figure out how f21 handles that | 02:35 |
| lhcheng | ayoung: any recommended tutorial/page to jumpstart on setting up freeipa? I have to test out the kerberos patch too later when I review the changes. | 02:35 |
| ayoung | lhcheng, OK, so just went through this last week. | 02:36 |
| jamielennox | lhcheng: lol - i've been messing with it for two days | 02:36 |
| jamielennox | these scripts are pretty good: https://github.com/nkinder/rdo-vm-factory/tree/master/rdo-kerberos-setup | 02:36 |
| ayoung | lhcheng, start with this: get a new VM running F21 up and running, ym updated, and install the freeipa-server RPM | 02:37 |
| jamielennox | but i don't want to run it on my local machine | 02:37 |
| lhcheng | ayoung: yeah, you were working with someone in the midcycle to set it up | 02:37 |
| ayoung | the biggest gotcha I've seen has to do with host names. I've been using a hack where I set the hostname in /etc/hosts and in /etc/hostname | 02:37 |
| ayoung | the one in /etc/hosts should use the IP address for the machine. If you are doing an OpenStack type install, it can be the internal ip address. | 02:38 |
| lhcheng | jamielennox: can you script that please. lol | 02:38 |
| ayoung | in /etc/hostname, just set the long FQDN | 02:38 |
| ayoung | then I usually do | 02:38 |
| ayoung | sudo hostname=`cat /etc/hostname` | 02:38 |
| * lhcheng thinking which public cloud to use | 02:38 | |
| jamielennox | lhcheng: my thought was i would do the steps manually first and verify - but it's all falling down around me | 02:39 |
| ayoung | lhcheng, I had one working on dreamhost, but managed to mess it up. I was using an Alpha of FreeIPA and it didn't upgradea cleanly | 02:39 |
| *** gokrokve has joined #openstack-keystone | 02:40 | |
| ayoung | lhcheng, anyway, once you get the hostname setup, run ipa-server-install and it should prompt you for the values to use. Take the defaults for things like REALM and Hostname. Setup DNS is, now, I think something that is prompted | 02:41 |
| lhcheng | ayoung: ah yes, I remember you mentioned that last week. I like to learn how to set it up eventually. Just been pulled into some anvil work past couple of days. | 02:41 |
| ayoung | you might want to pre-install the ldap module: | 02:41 |
| ayoung | bind-dyndb-ldap | 02:41 |
| ayoung | I had it as a one liner at one point for unattended installs, but better for you to go through the Q&A the first time. | 02:42 |
| ayoung | ah, ne other gotcha | 02:42 |
| ayoung | make sure you know the dns forwarders setup in /etc/resolv.conf | 02:42 |
| ayoung | it will prompt you at the DNS setup for what forwarders to use, and you almost always want to use the existing nameservers | 02:43 |
| ayoung | I often need to either kill the install script or open another terminal to find them | 02:43 |
| ayoung | lhcheng, go ahead and plow through it. It really is nothing to be afraid of. You can do it on a local VM if you want; I did most of my development on one that way | 02:45 |
| lhcheng | ayoung: so use the nameserver already used by my VM? | 02:45 |
| ayoung | yes | 02:46 |
| lhcheng | I'll probably try to install it on a public cloud, at least I can show you the config later (if needed) | 02:46 |
| ayoung | it is a forwarder, meaning it will be used to answer queries that the bind instance associated with FreeIPA ca't answer itslef | 02:46 |
| ayoung | that works too | 02:46 |
| lhcheng | cool | 02:47 |
| lhcheng | alright, will start off with this stuff for now | 02:47 |
| ayoung | treat it like a devstack setup: setup to be hacked on and trashed | 02:47 |
| lhcheng | gotcha | 02:48 |
| lhcheng | thanks | 02:48 |
| lhcheng | will bug you again in a couple of days :D | 02:48 |
| ayoung | You better! | 02:48 |
| ayoung | lhcheng, btw, thanks for the +2 on https://review.openstack.org/#/c/121281/ we really needto get that in before it needs a rebase | 02:49 |
| ayoung | jamielennox, the kerberos patch is going to need some help to catch up with what you did with auth plugins. Is that what you are looking to test? Have you been fixing that? | 02:51 |
| jamielennox | ayoung: yes, it appears the auth plugin stuff will get into DOA, so i want to bring the kerberos patch up to date | 02:52 |
| lhcheng | ayoung: sure. Thanks for the refactor! Having the auth plugin would come in handy. | 02:52 |
| jamielennox | figured i should try setting up my own environment again | 02:52 |
| nkinder | jamielennox: did you get your mod_nss thing figured out? | 02:52 |
| jamielennox | nkinder: no | 02:52 |
| nkinder | jamielennox: it just sounds like the module isn't loaded | 02:52 |
| jamielennox | nkinder: i was going to look at how hard it would be to replace your factory scripts that use libvirt to use neutron/openstack instead | 02:53 |
| *** thedodd has joined #openstack-keystone | 02:53 | |
| *** thedodd has quit IRC | 02:53 | |
| jamielennox | appears OSC doesn't have much neutron support, looking at the neutron CLI app is making my head hurt | 02:53 |
| ayoung | nkinder, we have a snow day coming tomorrow. Westford office is probably already officially closed. | 02:54 |
| jamielennox | nkinder: from memory fedora you didn't have to do anything special to load a module right? it's controlled by the conf file conf.d/ | 02:55 |
| nkinder | ayoung: I noticed everyone I spoke with from westford today looking to the side to see how bad it was snowing and trying to hurry home | 02:55 |
| ayoung | its light so far, little more than a dusting, but not really supposed to kick in until midnight | 02:55 |
| nkinder | jamielennox: it would be pulled in via an include from conf.modules.d | 02:55 |
| nkinder | jamielennox: I don't have F21 installed on a VM right now | 02:56 |
| nkinder | jamielennox: ...but I feel like they started using .load files in /etc/httpd IIRC | 02:56 |
| jamielennox | nkinder: yea, i'm thinking i should scrap this and try again on f20 | 02:56 |
| ayoung | nkinder, I have one...I tried to packstack it on Friday and it failed. Also just got an IPA instance on one | 02:56 |
| ayoung | internal cloud...let me look | 02:56 |
| nkinder | jamielennox: actually, I have a f21 docker container. Let me check it | 02:57 |
| jamielennox | ipa failed for me in F21 | 02:57 |
| jamielennox | so /etc/httpd/conf/httpd.conf on F21 says: | 02:57 |
| nkinder | jamielennox: for packstack, I've honestly been using centos/rhel | 02:57 |
| jamielennox | Include "/etc/httpd/conf.d/*.load" | 02:57 |
| jamielennox | IncludeOptional "/etc/httpd/conf.d/*.conf" | 02:57 |
| nkinder | ok, and mod_nss doesn't have a .load file | 02:57 |
| nkinder | you can create one though. I think it just contains LoadModule. Take a look at one of the other ones. | 02:58 |
| ayoung | $ cat /etc/httpd/conf.modules.d/10-nss.conf | 02:58 |
| ayoung | LoadModule nss_module modules/libmodnss.so | 02:58 |
| nkinder | ayoung: is that F21? | 02:58 |
| ayoung | yea | 02:58 |
| nkinder | ayoung: and does anything else include it? | 02:58 |
| nkinder | I think mod_nss probably needs to have a .load file added | 02:59 |
| ayoung | jamielennox, on RHEL It might be in the /etc/httpd/conf.d directory | 02:59 |
| nkinder | ayoung: RHEL7 is conf.modules.d | 02:59 |
| nkinder | I think it's just f21+ that changed it | 02:59 |
| jamielennox | nothing in the default conf.modules.d has a .load | 03:00 |
| jamielennox | only in conf.d | 03:00 |
| ayoung | jamielennox, this is RHEL6 or RHEL 7? | 03:00 |
| jamielennox | f21 | 03:00 |
| ayoung | jamielennox, and you have the file I listed above? | 03:00 |
| nkinder | jamielennox: yes, add a mod_nss.load to conf.d | 03:00 |
| jamielennox | i was going to do centos 7 but the VM wasn't working | 03:00 |
| nkinder | jamielennox: it should only need to contain "LoadModule nss_module modules/libmodnss.so" | 03:01 |
| ayoung | I have an IPA setup without any load files | 03:01 |
| nkinder | ayoung: again, .load files are new as of F21 IIRC | 03:01 |
| ayoung | nkinder, this is IPA server on F21 | 03:01 |
| ayoung | $ cat /etc/issue | 03:02 |
| ayoung | Fedora release 21 (Twenty One) | 03:02 |
| nkinder | ayoung: none under /etc/httpd/conf.d? | 03:02 |
| ayoung | find /etc/httpd/ -name \*load | 03:02 |
| ayoung | bupkis | 03:02 |
| jamielennox | ok | 03:02 |
| jamielennox | so # ln -s ../conf.modules.d/10-nss.conf nss.load | 03:03 |
| jamielennox | that seems dumb | 03:03 |
| *** tellesnobrega_ has quit IRC | 03:03 | |
| ayoung | jamielennox, I think if you crank up logging and restart the server it will tell you what modules get loaded | 03:04 |
| jamielennox | ayoung: moved onto error: AH00015: Unable to open logs - so not sure we're even at that point | 03:05 |
| jamielennox | this i'm figuring out from journalctl -xe, nothing being sent to /var/log/httpd/error_log | 03:05 |
| ayoung | SELinux? | 03:05 |
| nkinder | I know I've seen .load files before (f21 I thought), but I don't see any in my docker container when I install httpd | 03:06 |
| *** bjornar has quit IRC | 03:07 | |
| nkinder | jamielennox: what version of httpd do you have? | 03:08 |
| nkinder | jamielennox: with httpd-2.4.10-9.fc21.x86_64, I don't see any include for *.load in /etc/httpd/conf/httpd.conf | 03:09 |
| jamielennox | yes, that | 03:09 |
| nkinder | jamielennox: are you looking at a system post-packstack? | 03:10 |
| jamielennox | nkinder: yes | 03:11 |
| nkinder | I wonder if the apache puppet module is setting it to include *.load | 03:11 |
| jamielennox | ok got it | 03:11 |
| nkinder | I'm just looking on a fresh container (no packstack) | 03:11 |
| jamielennox | for some reason root owned /var/log/httpd | 03:11 |
| *** bjornar has joined #openstack-keystone | 03:11 | |
| jamielennox | will re-run packstack | 03:12 |
| nkinder | jamielennox: I bet it's the puppet modules. Let me see what happens with packstack and keystone httpd deployment on rhel7 | 03:12 |
| jamielennox | nkinder: i tried to do it via scripts as you did https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-kerberos-setup/vm-post-cloud-init-rdo.sh#L47 failed badly | 03:13 |
| nkinder | jamielennox: were you letting my scripts create the VMs? | 03:13 |
| jamielennox | however i eventually got an --allinone to work and could then edit the answer file it produced | 03:13 |
| ayoung | nkinder, did they...I'm almost afraid to ask...did...did they...kill | 03:13 |
| ayoung | /var/log/messages in F21? | 03:13 |
| jamielennox | nkinder: no, i don't know if my laptop would handle 2 4gb vms on libvirt | 03:14 |
| jamielennox | nkinder: this is what we use openstack for :) | 03:14 |
| nkinder | :) | 03:14 |
| ayoung | wait....so I have /var/log/messages on my laptop | 03:15 |
| ayoung | -rw-------. 1 root root 14792347 Jan 26 22:15 /var/log/messages | 03:15 |
| ayoung | and nonw o neither the IPA nor the Packstack machines I set up | 03:15 |
| ayoung | double you tee eff? | 03:15 |
| jamielennox | ayoung: maybe the cloud image? | 03:15 |
| ayoung | jamielennox, almost certainly | 03:16 |
| ayoung | but... | 03:16 |
| ayoung | how? | 03:16 |
| jamielennox | /var/log/messages is some sort of output pipe of journalctl | 03:16 |
| jamielennox | i don't know how you opt into that | 03:16 |
| ayoung | LENNNART! | 03:16 |
| jamielennox | but i know they kept it for workstations etc, they probably just didn't turn it on for cloud image | 03:16 |
| ayoung | LEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEENNNART! | 03:16 |
| ayoung | My Washing Machine is slightly unbalanced right now, and generating an admirable backbeat | 03:17 |
| jamielennox | in general i approve because i hate touching /etc/init.d scripts, i do need to figure out journalctl | 03:17 |
| ayoung | Its like techno | 03:17 |
| ayoung | ok journactl it is....so how do I do the equivalent of tail -f... | 03:19 |
| * jamielennox shrugs | 03:19 | |
| ayoung | -f, --follow | 03:19 |
| nkinder | ayoung: journalctl -f | 03:19 |
| * ayoung faster | 03:19 | |
| nkinder | ayoung: I still have a finger that I can't use for typing. Makes me nice and slow (and full of typos). | 03:21 |
| ayoung | Can you still play bass? | 03:21 |
| *** _cjones_ has joined #openstack-keystone | 03:21 | |
| nkinder | ayoung: no :( | 03:21 |
| ayoung | how long until it is healed? | 03:22 |
| *** lhcheng has quit IRC | 03:22 | |
| nkinder | well, as long as my fret-hand index finger isn't needed | 03:22 |
| ayoung | Ugh | 03:22 |
| nkinder | well, it's been 25 days so far | 03:22 |
| ayoung | oooh...what did you do? | 03:22 |
| nkinder | only the top is black/purple now instead of the whole thing | 03:22 |
| nkinder | 4lb deadblow mallet | 03:22 |
| jamielennox | ouch | 03:23 |
| nkinder | I'd guess another 2-3 weeks before it's in decent shape again (minus a nail) | 03:23 |
| ayoung | Just glad you didn' | 03:23 |
| ayoung | t pull a Tommy Caldwell | 03:23 |
| nkinder | ouch. No saws involved. | 03:24 |
| ayoung | Process: 25785 ExecStart=/usr/bin/keystone-all (code=exited, status=1/FAILURE) | 03:24 |
| ayoung | OK, time to update Packstack to know about HTTPD... | 03:25 |
| nkinder | ewww.... keystone-all :P | 03:25 |
| ayoung | Hai! | 03:25 |
| openstackgerrit | wanghong proposed openstack/keystone: remove unnecessary checks in assignment/controllers.py https://review.openstack.org/130722 | 03:25 |
| ayoung | waiting on rich's work on Puppet I'm guessing? | 03:25 |
| nkinder | CONFIG_KEYSTONE_SERVICE_NAME=httpd | 03:26 |
| nkinder | wait for nothing. It's done | 03:26 |
| ayoung | ACHA! | 03:26 |
| jamielennox | you can set that as env or you need to do a packstack answers file>? | 03:26 |
| *** _cjones_ has quit IRC | 03:27 | |
| ayoung | jamielennox, I'm trying it in the answer file right now | 03:27 |
| nkinder | answers file | 03:27 |
| nkinder | I've never tried it via ENV | 03:27 |
| ayoung | wasn't a generated KEY | 03:27 |
| nkinder | ayoung: what version of packstack are you using? | 03:27 |
| ayoung | whatever the default is wit h F21 | 03:27 |
| nkinder | it's been in RDO Juno for quite a while now | 03:27 |
| *** samueldmq has quit IRC | 03:28 | |
| ayoung | $ rpmquery openstack-packstack | 03:28 |
| ayoung | openstack-packstack-2014.1.1-0.31.1.dev1266.fc21.noarch | 03:28 |
| nkinder | ayoung: fedora might include an older release | 03:28 |
| ayoung | Of course... | 03:28 |
| nkinder | I would use RDO | 03:28 |
| ayoung | Fedora 21 is still in development and running RDO Juno on Fedora 21 is not recommended at this time. A separate announcement will be made on the rdo-list mailing list when RDO Juno on Fedora 21 is ready. | 03:29 |
| ayoung | Can I regen an answers file? | 03:29 |
| ayoung | gah...OK, I need to do a bit more to pre for using that | 03:30 |
| nkinder | ayoung: yeah, I use centos or rhel7 | 03:30 |
| nkinder | it's what RDO targetted first, so it'll be more stable | 03:30 |
| * ayoung Contrasts this with FreeIPA, which did it the right way.... | 03:31 | |
| ayoung | Ah well...I can deal with that later.... | 03:31 |
| ayoung | Gonna wrap things up and head to bed | 03:32 |
| *** wanghong_away is now known as wanghong | 03:33 | |
| *** rushiagr_away is now known as rushiagr | 03:36 | |
| nkinder | jamielennox: so packstack creates all of the .load files | 03:43 |
| nkinder | jamielennox: ...and it's really likely it's the puppet-apache module | 03:44 |
| stevemar | nkinder is alive! | 03:47 |
| stevemar | haven't seen you on in a while | 03:48 |
| nkinder | stevemar: yeah, lots of travel and just generally swamped by meetings lately | 03:48 |
| stevemar | this channel gets very RED at this time of day, tHATs just my opinion | 03:48 |
| *** ayoung is now known as ayoung_ZZzz__ | 03:49 | |
| openstackgerrit | wanghong proposed openstack/keystone: add missing classmethod decorater for get_auth_context https://review.openstack.org/150251 | 03:57 |
| *** rushiagr is now known as rushiagr_away | 04:01 | |
| *** gokrokve has quit IRC | 04:03 | |
| *** markvoelker has joined #openstack-keystone | 04:17 | |
| *** gokrokve has joined #openstack-keystone | 04:20 | |
| *** richm has quit IRC | 04:31 | |
| *** lhcheng has joined #openstack-keystone | 04:39 | |
| *** packet has quit IRC | 04:39 | |
| *** rushiagr_away is now known as rushiagr | 04:54 | |
| *** markvoelker has quit IRC | 05:09 | |
| *** markvoelker has joined #openstack-keystone | 05:10 | |
| *** harlowja is now known as harlowja_away | 05:10 | |
| *** markvoelker has quit IRC | 05:14 | |
| jamielennox | nkinder: i don't expect you're still here, but how do i add the cert for the ipa ldap server to the keystone server? | 05:30 |
| *** pheadron2 has joined #openstack-keystone | 05:33 | |
| *** pheadron2 has quit IRC | 05:34 | |
| *** markvoelker has joined #openstack-keystone | 05:37 | |
| *** markvoelker has quit IRC | 05:38 | |
| *** henrynash has joined #openstack-keystone | 05:38 | |
| *** ChanServ sets mode: +v henrynash | 05:38 | |
| *** markvoelker has joined #openstack-keystone | 05:38 | |
| stevemar | can a trust cross domains? | 05:38 |
| stevemar | like user on domain A give a role on a project (must be in domain A), delegate to a user in domain B? | 05:39 |
| stevemar | now i'm not even sure if a user can have a role on a project thats not in his own domain.... | 05:41 |
| stevemar | ayoung_ZZzz__, morganfainberg ^ ? | 05:41 |
| morganfainberg | stevemar, i can only thing so much on glass of wine #3 | 05:41 |
| morganfainberg | stevemar, think* | 05:41 |
| morganfainberg | so give me a sec ;) | 05:41 |
| stevemar | morganfainberg, dammit ! | 05:41 |
| *** dims has joined #openstack-keystone | 05:41 | |
| morganfainberg | dude, had a spare bottle on my desk >.> | 05:42 |
| morganfainberg | today, yes a trust can cross domains | 05:42 |
| morganfainberg | though that is probably a bad idea | 05:42 |
| morganfainberg | \ | 05:42 |
| morganfainberg | simply a user can have a role on a domain not his own, therefore a trust would do the same. | 05:42 |
| stevemar | and a user can have a role on a project not in his domain? | 05:43 |
| morganfainberg | yep | 05:43 |
| stevemar | but... | 05:43 |
| stevemar | then whats the point of a domain | 05:43 |
| morganfainberg | ownership of the user | 05:43 |
| stevemar | *grumble grumble* | 05:43 |
| stevemar | AND projects | 05:43 |
| morganfainberg | i think this is a gap in security | 05:43 |
| morganfainberg | dude. | 05:43 |
| stevemar | at least, it was | 05:43 |
| *** markvoelker has quit IRC | 05:43 | |
| *** ajayaa has joined #openstack-keystone | 05:47 | |
| *** dims has quit IRC | 05:49 | |
| *** dims has joined #openstack-keystone | 05:50 | |
| *** dims has quit IRC | 05:52 | |
| openstackgerrit | Kenjiro Kosaka proposed openstack/keystone: Sample Identity endpoints changed to unversioned https://review.openstack.org/130669 | 05:52 |
| *** dims has joined #openstack-keystone | 05:52 | |
| nkinder | jamielennox: There are a few ways. Easiest is configuring it at the system level for the entire ldap C library. Let me dig up a link to a writeup on it. | 05:53 |
| jamielennox | nkinder: found it | 05:54 |
| nkinder | jamielennox: ok, cool. | 05:54 |
| jamielennox | sorry, should have mentioned | 05:54 |
| nkinder | jamielennox: no worries | 05:54 |
| jamielennox | nkinder: https://github.com/nkinder/rdo-vm-factory/pull/1 | 05:54 |
| nkinder | jamielennox: is your keystone system an IPA client? | 05:55 |
| jamielennox | nkinder: yes | 05:55 |
| nkinder | jamielennox: if so, it should already trust the IPA CA system-wide | 05:55 |
| jamielennox | hmm, not sure | 05:55 |
| nkinder | jamielennox: ...which is why it's not doing anything extra in my script | 05:56 |
| jamielennox | nkinder: i probably missed something | 05:56 |
| jamielennox | still trying to learn this by hand | 05:56 |
| jamielennox | weird though - /etc/ipa/ca.crt wouldn't exist if i wasn't an ipa client | 05:57 |
| nkinder | jamielennox: yeah. Perhaps there was something not set up right in the NSS shared database that libldap uses. | 05:59 |
| nkinder | jamielennox: does ldapsearch work from the keystone system using ldaps or starttls? | 05:59 |
| jamielennox | nkinder: it always takes me so long to figure out a real query to test that | 06:00 |
| nkinder | use -b "" -s base | 06:00 |
| nkinder | that just searches the root DSE entry | 06:00 |
| nkinder | so 'ldapsearch -x -H <url> -b "" -s base' | 06:01 |
| nkinder | url can just be 'ldaps://ipafqdn:636' | 06:01 |
| nkinder | jamielennox: if you want to use starttls, use '-Z -h ipafqdn -p 389' instead of -H | 06:02 |
| jamielennox | fails, but simply: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) | 06:02 |
| jamielennox | ldaps is configured in keystone | 06:03 |
| nkinder | it sounds like trust for libldap wasn't set up properly then for some reason (ipa-client-install should have done it) | 06:03 |
| jamielennox | i had various issues with ipa and these vms - so that's possible | 06:03 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/149158 | 06:04 |
| nkinder | does '-v' give any more info? | 06:04 |
| jamielennox | only; ldap_initialize( ldaps://ipa.jamielennox-freeipa.org:636/??base ) | 06:04 |
| *** gokrokve_ has joined #openstack-keystone | 06:05 | |
| jamielennox | nkinder: doesn't really matter for this - but i agree, i didn't think i would need to do anything special to contact that ldap server | 06:05 |
| jamielennox | ugh - IPA ui not coming up now... | 06:06 |
| nkinder | jamielennox: yeah, what you did is fine. You shouldn't need to do anything extra though | 06:06 |
| nkinder | I think the system-wide cert trust is not set up properly | 06:06 |
| nkinder | cert issues with that too? | 06:06 |
| jamielennox | nkinder: ok - well i can kill that request | 06:06 |
| jamielennox | nkinder: i haven't really used anything else against this ipa | 06:06 |
| jamielennox | from this vm | 06:07 |
| jamielennox | oh | 06:07 |
| jamielennox | no, just blank screen | 06:07 |
| nkinder | jamielennox: you can try 'ipa-client-install --uninstall', then reinstall it. | 06:07 |
| nkinder | jamielennox: but it sounds like the server may not be healthy | 06:08 |
| *** gokrokve has quit IRC | 06:08 | |
| jamielennox | no - it appears IPA has a javascript error | 06:08 |
| jamielennox | in something that is compressed | 06:08 |
| nkinder | F21? | 06:08 |
| jamielennox | nkinder: it has not been a reassuring experience | 06:08 |
| jamielennox | no F20 - wouldn't install at all under F21 | 06:09 |
| jamielennox | f21 client | 06:09 |
| nkinder | is this the first time accessing IPA from that browser? | 06:10 |
| *** gokrokve_ has quit IRC | 06:10 | |
| jamielennox | nkinder: no, was working on friday | 06:10 |
| nkinder | jamielennox: Strange. I'd check out the webserver logs on the IPA VM. Not sure what it would be. | 06:11 |
| jamielennox | nkinder: at this point i'm hoping i can limp this environment through far enough to test the horizon patch, then i'll worry about making a clean one | 06:12 |
| jamielennox | i'll try another centos 7 image next time | 06:12 |
| nkinder | jamielennox: yeah, centos and rhel testing has been solid for me | 06:13 |
| nkinder | jamielennox: we can check with some of the IPA folks to see if there are known issues on F21, though I hadn't heard anything | 06:13 |
| *** oomichi has quit IRC | 06:13 | |
| *** abhirc has quit IRC | 06:14 | |
| jamielennox | i stuck fraser onto the f21 issue - i don't know how far he got | 06:15 |
| nkinder | jamielennox: I'll try it out too and see if anything jumps out | 06:18 |
| nkinder | jamielennox: going to go catch some sleep now | 06:19 |
| jamielennox | nkinder: thanks for your help, talk tomorrow | 06:20 |
| *** dims has quit IRC | 06:23 | |
| *** dims has joined #openstack-keystone | 06:26 | |
| *** _cjones_ has joined #openstack-keystone | 06:28 | |
| marekd | jamielennox: hi, i am here. | 06:30 |
| marekd | jamielennox: i guess you are leaving soon. | 06:30 |
| jamielennox | soon - not yet | 06:30 |
| *** dims has quit IRC | 06:30 | |
| jamielennox | i was looking at https://review.openstack.org/#/c/130564/13/keystoneclient/contrib/auth/v3/saml2.py | 06:31 |
| jamielennox | did you move the username and password variables up to _BaseSAMLPlugin on purpose? | 06:31 |
| jamielennox | i though the intent was to allow other forms of creds on that | 06:31 |
| *** markvoelker has joined #openstack-keystone | 06:31 | |
| marekd | topol: Hi Brad. Thanks. | 06:32 |
| *** _cjones_ has quit IRC | 06:33 | |
| topol | marekd, NP | 06:33 |
| stevemar | marekd, you are alive | 06:33 |
| marekd | jamielennox: yes, i basically moved it to _BaseSAMLPlugin, as I concluded that it should be there as those parameters are defined in get_options there. | 06:33 |
| marekd | stevemar: you are STILL alive?! | 06:33 |
| stevemar | marekd, somehow, the assassins you sent are not very good | 06:33 |
| stevemar | correction... were* not | 06:34 |
| marekd | i should rather attack your laptop, not yourself. | 06:34 |
| stevemar | no not my precious! | 06:34 |
| marekd | the effect would be you sleeping :-) | 06:34 |
| stevemar | marekd, time to talk websso ? i don't want to bug you and jamie | 06:34 |
| marekd | stevemar: i am good. | 06:35 |
| marekd | stevemar: or, maybe i will take advantage of jamie being here? | 06:35 |
| stevemar | marekd, go for it | 06:35 |
| stevemar | i have time | 06:35 |
| marekd | LOL | 06:35 |
| *** markvoelker has quit IRC | 06:36 | |
| marekd | jamielennox: so, do you think it's fine to actually inherit from _BaseSamlPlugin and create another plugin just because of different authN way? | 06:36 |
| marekd | authN with IdP | 06:36 |
| jamielennox | marekd: it's a private class - i really don't mind | 06:37 |
| jamielennox | i just don't want to lock something up for if we try and do cert based saml in future | 06:37 |
| *** gokrokve has joined #openstack-keystone | 06:37 | |
| marekd | jamielennox: ah, ok i will revert it and squeeze username/password into ADFS and ECP plugins. | 06:39 |
| *** gokrokve has quit IRC | 06:39 | |
| *** gokrokve has joined #openstack-keystone | 06:39 | |
| marekd | I am tempted to add some abstractmethod to _BaseSAMLPlugin called _authenticate_with_idp but i am fearing one day with some strange protocol this may be not enough. | 06:39 |
| jamielennox | marekd: that is my big concern with all this | 06:41 |
| jamielennox | marekd: i'd be happy enough to pass it as is | 06:41 |
| marekd | jamielennox: OK | 06:41 |
| *** zz_avozza is now known as avozza | 06:41 | |
| jamielennox | _BaseSaml is a private class so we can always push those options down to the plugins later | 06:42 |
| jamielennox | i'm just not wanting to back us into a corner for later | 06:42 |
| jamielennox | marekd: oh - morganfainberg mentioned that the blueprint you assigned doesn't exit | 06:42 |
| jamielennox | s/exit/exist | 06:42 |
| jamielennox | i was going to do it but got distracted | 06:42 |
| marekd | jamielennox: ok, so let me spend 15 minutes reverting this user/pass moving to inheriting classes. I will move attributes as well as define them to get_options(). | 06:42 |
| marekd | jamielennox: i will check and create if needed. | 06:43 |
| jamielennox | marekd: ok - thats the only thing i've seen for that review | 06:43 |
| marekd | jamielennox: backwards compatibility? | 06:43 |
| jamielennox | i want to do a client release soon, we can look at pushing federation out to its own repo after that | 06:43 |
| jamielennox | the entrypoint names... | 06:43 |
| marekd | jamielennox: ayoung_ZZzz__ has been pinging me about that a lot, but wanted first to actually have new plugins structure merged and only then smoothly move it out ksc repo. | 06:44 |
| *** gokrokve has quit IRC | 06:44 | |
| jamielennox | marekd: so maybe this is a good point to do the break? | 06:45 |
| marekd | jamielennox: yes, please. | 06:45 |
| jamielennox | if we are going to have to change entrypoint names | 06:45 |
| marekd | jamielennox: yes yes yes. | 06:45 |
| marekd | if you are good with that, it's fine. | 06:45 |
| jamielennox | ok - copy that whole review, propose it against keystoneclient-federation | 06:45 |
| marekd | already? | 06:45 |
| marekd | ok | 06:45 |
| jamielennox | mark all the existing federation plugins deprecated | 06:45 |
| jamielennox | well that way we can leave the old entrypoint names the way they are | 06:46 |
| jamielennox | just put a warning on them | 06:46 |
| marekd | in docstring or there is some fancy decorator for that? | 06:46 |
| marekd | what's the deprecation period ? | 06:46 |
| jamielennox | marekd: forever at this point | 06:46 |
| marekd | :D | 06:46 |
| jamielennox | we haven't been allowed to do a keystoneclient v2 | 06:46 |
| jamielennox | or 2.0 | 06:46 |
| marekd | jamielennox: depr. warning in docstring is enough, right? | 06:47 |
| jamielennox | yep | 06:47 |
| jamielennox | i had a review that added a warning prompt to ksc | 06:47 |
| marekd | jamielennox: and the structure of the patchset against keystoneclient-federation will be the same? | 06:48 |
| jamielennox | but these are going to be reviews against seperate projects so there's no need to mark the old stuff deprecated until we have a release of ksc-federation ready to go | 06:48 |
| jamielennox | marekd: pretty similar, but you can move everything up to the root | 06:48 |
| jamielennox | federation/saml.py | 06:48 |
| jamielennox | actually we probably still want to do federation/v3/saml.py just in case | 06:48 |
| marekd | https://github.com/openstack/python-keystoneclient-federation/tree/master/keystoneclient_federation <--- to this destination. | 06:49 |
| jamielennox | that way we can do generic plugins (version independent) at the root | 06:49 |
| marekd | allrigt | 06:49 |
| jamielennox | yep | 06:49 |
| jamielennox | marekd: change mind | 06:49 |
| jamielennox | marekd: as first patch do a straight copy and paste of the existing code | 06:50 |
| jamielennox | then propose this refactor on top | 06:50 |
| jamielennox | will make reviewing easier | 06:50 |
| marekd | jamielennox: eeeee, straight copy means coping whole dir/files structure starting from /contrib/auth/v3/ ? | 06:52 |
| jamielennox | marekd: you don't want most of that? | 06:52 |
| marekd | i do | 06:52 |
| jamielennox | oh - yea, you can change the path | 06:52 |
| marekd | jamielennox: ok, i am gonna put federation.py and saml2.py files into keystoneclient_federation/auth/v3/{federation,saml}.py | 06:54 |
| marekd | is that what you meant? | 06:54 |
| jamielennox | yep | 06:54 |
| marekd | ok | 06:54 |
| marekd | makes sense. | 06:54 |
| marekd | i will do this today | 06:54 |
| jamielennox | cool - that one will be a fairly easy review | 06:54 |
| marekd | jamielennox: yep | 06:54 |
| marekd | thanks. | 06:54 |
| jamielennox | then we can merge this refactor finally | 06:54 |
| marekd | jamielennox: oh yes. | 06:54 |
| jamielennox | marekd: we get until first release to mess with the APIs as well, so if you have found anything funny about the existing plugins this will be our chance to fix it | 06:55 |
| marekd | ok | 06:55 |
| marekd | jamielennox: i think that's all for now, right? | 06:57 |
| jamielennox | marekd: think so | 06:58 |
| marekd | jamielennox: ok, thanks! :-) | 06:58 |
| *** avozza is now known as zz_avozza | 06:58 | |
| marekd | stevemar: what's up boss? | 06:58 |
| jamielennox | i'll be up early for the meeting tomorrow - we can get it through then | 06:58 |
| marekd | jamielennox: OK | 06:58 |
| *** markvoelker has joined #openstack-keystone | 06:58 | |
| stevemar | marekd, just wanted your opinion on the websso spec :) | 07:01 |
| marekd | stevemar: i am reading your comments now | 07:02 |
| marekd | thanks for answering | 07:02 |
| *** MasterPiece has joined #openstack-keystone | 07:04 | |
| *** markvoelker has quit IRC | 07:04 | |
| marekd | stevemar: it looks good in my opinion. | 07:04 |
| stevemar | what about marco's stuff | 07:04 |
| marekd | ah, shit forgot. | 07:04 |
| marekd | how do we define trusted horizons? | 07:04 |
| marekd | stevemar: i will bug ayoung_ZZzz__ today about that | 07:05 |
| marekd | i already know adding new set of APIs is a bunch of work as it's also keystoneclient and openstackclient. | 07:05 |
| marekd | and we end up with lots of code. | 07:06 |
| stevemar | is it normally more than one trusted horizon? | 07:07 |
| stevemar | if not, then we could put it in keystone.conf, heck even if there are many we could enumerate them somehow | 07:07 |
| marekd | stevemar: i'd imagine yes..but we need to ask other cloud deployers | 07:07 |
| marekd | stevemar: ok, looks like this is the last thing to figure out. | 07:08 |
| stevemar | are you planning to push a new patch for it? | 07:09 |
| stevemar | or shall i? | 07:09 |
| marekd | stevemar: i was also thinking we could actually make a static file with JS code and put its path in the keystone.conf. We would not hardcode JS code in Keystone code. | 07:09 |
| marekd | i can push. | 07:09 |
| marekd | you are probably already tired. | 07:09 |
| stevemar | marekd, yeah but you are swamped and this is fast :P | 07:10 |
| *** topol has quit IRC | 07:10 | |
| marekd | stevemar: ok, so push :-) | 07:10 |
| stevemar | yay! | 07:10 |
| * marekd looking what 'swamped' means :P | 07:11 | |
| stevemar | damn topol did one last comment and ran off! | 07:11 |
| stevemar | swamped == busy with lots of work | 07:11 |
| marekd | stevemar: LOL, not as swamped as you are I guess. | 07:11 |
| stevemar | marekd, i'm not too bad | 07:11 |
| stevemar | you have sp API to do | 07:12 |
| stevemar | and client | 07:12 |
| stevemar | and ... theres something else | 07:12 |
| marekd | stevemar: yes. | 07:12 |
| stevemar | mapping stuff | 07:12 |
| *** zz_avozza is now known as avozza | 07:17 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add schema for endpoint group https://review.openstack.org/150292 | 07:23 |
| *** nellysmitt has joined #openstack-keystone | 07:26 | |
| *** dims has joined #openstack-keystone | 07:27 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Visual Page for WebSSO https://review.openstack.org/133529 | 07:29 |
| stevemar | marekd, ^ | 07:29 |
| *** jamielennox is now known as jamielennox|away | 07:29 | |
| *** dims has quit IRC | 07:31 | |
| *** MasterPiece has quit IRC | 07:32 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make unit tests call the new resource manager https://review.openstack.org/130954 | 07:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 07:35 |
| *** stevemar has quit IRC | 07:35 | |
| *** gokrokve has joined #openstack-keystone | 07:37 | |
| *** pnavarro has joined #openstack-keystone | 07:40 | |
| *** gokrokve has quit IRC | 07:42 | |
| *** avozza is now known as zz_avozza | 07:49 | |
| *** berendt has joined #openstack-keystone | 07:52 | |
| *** tomoiaga has joined #openstack-keystone | 07:57 | |
| *** markvoelker has joined #openstack-keystone | 08:00 | |
| *** markvoelker has quit IRC | 08:04 | |
| *** harlowja_away has quit IRC | 08:08 | |
| *** josecastroleon__ has quit IRC | 08:19 | |
| *** josecastroleon__ has joined #openstack-keystone | 08:19 | |
| *** oomichi has joined #openstack-keystone | 08:20 | |
| *** josecastroleon__ is now known as josecastroleo | 08:20 | |
| *** josecastroleo is now known as josecastroleon | 08:21 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-federation: Create a framework for federation plugins https://review.openstack.org/150305 | 08:21 |
| *** dims has joined #openstack-keystone | 08:28 | |
| *** dims has quit IRC | 08:32 | |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 08:37 |
| *** gokrokve has joined #openstack-keystone | 08:37 | |
| berendt | hello. we recently had issues to allow the access to specific api methods using the policy.json file (I posted at http://lists.openstack.org/pipermail/openstack-operators/2015-January/006014.html). For example "identity:list_services": "@" does not allow us to access the list_services method with every user, it is still necessary to assign the admin role (HTTP error 403 ('admin_required')). Can anybody p | 08:38 |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 08:38 |
| *** gokrokve has quit IRC | 08:42 | |
| *** lhcheng has quit IRC | 08:43 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-federation: Create a framework for federation plugins https://review.openstack.org/150305 | 08:48 |
| *** markvoelker has joined #openstack-keystone | 09:00 | |
| *** markvoelker has quit IRC | 09:05 | |
| *** jistr has joined #openstack-keystone | 09:08 | |
| *** zz_avozza is now known as avozza | 09:15 | |
| *** jaosorior has joined #openstack-keystone | 09:25 | |
| *** erkules_ is now known as erkules | 09:29 | |
| *** gokrokve has joined #openstack-keystone | 09:37 | |
| *** gokrokve_ has joined #openstack-keystone | 09:39 | |
| *** gokrokve has quit IRC | 09:41 | |
| *** gokrokve_ has quit IRC | 09:44 | |
| *** avozza is now known as zz_avozza | 09:57 | |
| *** zz_avozza is now known as avozza | 09:57 | |
| rodrigods | henrynash, thanks for the review! will address them as soon as I arrive in the university :) | 10:01 |
| *** markvoelker has joined #openstack-keystone | 10:01 | |
| *** markvoelker has quit IRC | 10:07 | |
| *** samueldmq has joined #openstack-keystone | 10:12 | |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 10:16 |
| *** dims has joined #openstack-keystone | 10:16 | |
| *** samueldmq has quit IRC | 10:18 | |
| *** dims has quit IRC | 10:21 | |
| *** gokrokve has joined #openstack-keystone | 10:37 | |
| *** gokrokve has quit IRC | 10:42 | |
| *** samueldmq has joined #openstack-keystone | 10:47 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes 'OS-INHERIT:inherited_to' info in tests https://review.openstack.org/144542 | 10:49 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor role assignment assertions https://review.openstack.org/144543 | 10:49 |
| samueldmq | morning | 10:50 |
| samueldmq | henrynash, hi | 10:50 |
| *** marg7175 has quit IRC | 10:52 | |
| *** avozza is now known as zz_avozza | 11:05 | |
| *** zz_avozza is now known as avozza | 11:05 | |
| *** amakarov_away is now known as amakarov | 11:06 | |
| *** marg7175 has joined #openstack-keystone | 11:07 | |
| *** marg7175 has quit IRC | 11:07 | |
| *** marg7175 has joined #openstack-keystone | 11:08 | |
| *** tellesnobrega_ has joined #openstack-keystone | 11:11 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 11:13 |
| *** gokrokve has joined #openstack-keystone | 11:37 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 11:43 |
| *** gokrokve has quit IRC | 11:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 11:43 |
| rodrigods | henrynash, ^ addressed your comments | 11:43 |
| *** tellesnobrega_ has quit IRC | 11:53 | |
| marekd | rodrigods: thanks for the review | 11:55 |
| rodrigods | marekd, ++ | 11:55 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 12:00 |
| *** markvoelker has joined #openstack-keystone | 12:04 | |
| *** markvoelker has quit IRC | 12:09 | |
| henrynash | rodigods: thx, will check | 12:18 |
| *** diegows has joined #openstack-keystone | 12:27 | |
| *** tellesnobrega has quit IRC | 12:30 | |
| *** tellesnobrega has joined #openstack-keystone | 12:31 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix docstring of get hierarchy methods https://review.openstack.org/150391 | 12:32 |
| *** ajayaa has quit IRC | 12:32 | |
| *** MasterPiece has joined #openstack-keystone | 12:36 | |
| *** gokrokve has joined #openstack-keystone | 12:37 | |
| *** afaranha has joined #openstack-keystone | 12:41 | |
| *** gokrokve has quit IRC | 12:42 | |
| samueldmq | henrynash, - ping, should we add a point to today's meeting regarding role inheritance changes ? other to domain roles api changes? | 12:47 |
| *** aix has joined #openstack-keystone | 12:48 | |
| henrynash | we certainly want to discuss domain roels api | 12:48 |
| henrynash | if you think worth a dsicussion on role inheritance, then please do add to agenda | 12:49 |
| samueldmq | henrynash, cool, will add a point for both ... domain roles api with higher priority, role inheritance if we have time | 12:50 |
| samueldmq | henrynash, I think I know the reason why your metadata removal patch is failing - have you a minut ? | 12:56 |
| *** markvoelker has joined #openstack-keystone | 13:05 | |
| *** markvoelker has quit IRC | 13:10 | |
| *** ajayaa has joined #openstack-keystone | 13:20 | |
| *** markvoelker has joined #openstack-keystone | 13:25 | |
| *** diegows has quit IRC | 13:31 | |
| *** rushiagr is now known as rushiagr_away | 13:35 | |
| *** gokrokve has joined #openstack-keystone | 13:37 | |
| *** oomichi has quit IRC | 13:40 | |
| *** gokrokve has quit IRC | 13:42 | |
| *** bknudson has joined #openstack-keystone | 13:42 | |
| *** ChanServ sets mode: +v bknudson | 13:42 | |
| *** gokrokve has joined #openstack-keystone | 13:47 | |
| *** gokrokve has quit IRC | 13:51 | |
| *** markvoelker has quit IRC | 13:54 | |
| *** gordc has joined #openstack-keystone | 13:55 | |
| *** rushiagr_away is now known as rushiagr | 13:58 | |
| *** radez_g0n3 is now known as radez | 13:59 | |
| openstackgerrit | Merged openstack/identity-api: Updated from global requirements https://review.openstack.org/150221 | 14:03 |
| *** sriram has joined #openstack-keystone | 14:05 | |
| *** mattfarina has joined #openstack-keystone | 14:13 | |
| *** richm has joined #openstack-keystone | 14:13 | |
| *** nkinder has quit IRC | 14:22 | |
| *** joesavak has joined #openstack-keystone | 14:28 | |
| *** dims has joined #openstack-keystone | 14:33 | |
| *** Ctina has joined #openstack-keystone | 14:34 | |
| *** markvoelker has joined #openstack-keystone | 14:36 | |
| *** gokrokve has joined #openstack-keystone | 14:37 | |
| openstackgerrit | Merged openstack/python-keystoneclient: fix enabled parameter of update doesn't default to None https://review.openstack.org/144422 | 14:41 |
| *** gokrokve has quit IRC | 14:42 | |
| *** topol has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v topol | 14:42 | |
| *** gokrokve has joined #openstack-keystone | 14:48 | |
| *** david-lyle_afk is now known as david-lyle | 14:49 | |
| *** gokrokve_ has joined #openstack-keystone | 14:51 | |
| *** r-daneel has joined #openstack-keystone | 14:52 | |
| *** gokrokve has quit IRC | 14:53 | |
| *** abhirc has joined #openstack-keystone | 14:54 | |
| *** Ctina has quit IRC | 14:59 | |
| *** Ctina has joined #openstack-keystone | 14:59 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/150208 | 15:00 |
| *** gordc has quit IRC | 15:02 | |
| *** markvoelker has quit IRC | 15:03 | |
| *** gordc has joined #openstack-keystone | 15:03 | |
| *** markvoelker has joined #openstack-keystone | 15:03 | |
| *** rwsu-afk has quit IRC | 15:04 | |
| *** berendt has left #openstack-keystone | 15:04 | |
| *** ayoung_ZZzz__ is now known as ayoung_snowedin | 15:07 | |
| *** markvoelker has quit IRC | 15:09 | |
| *** jsavak has joined #openstack-keystone | 15:11 | |
| *** abhirc has quit IRC | 15:12 | |
| *** joesavak has quit IRC | 15:13 | |
| *** zzzeek has joined #openstack-keystone | 15:14 | |
| samueldmq | bknudson, replied your comment on 'Move projects and domains to their own backend', thanks | 15:15 |
| *** abhirc has joined #openstack-keystone | 15:17 | |
| *** avozza is now known as zz_avozza | 15:17 | |
| *** zz_avozza is now known as avozza | 15:17 | |
| *** nkinder has joined #openstack-keystone | 15:19 | |
| *** dims has quit IRC | 15:20 | |
| *** tsufiev is now known as tsufiev_ | 15:20 | |
| *** dims has joined #openstack-keystone | 15:20 | |
| *** abhirc has quit IRC | 15:22 | |
| *** dims has quit IRC | 15:25 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 15:38 |
| *** henrynash has quit IRC | 15:39 | |
| *** rwsu has joined #openstack-keystone | 15:42 | |
| *** henrynash has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v henrynash | 15:43 | |
| *** markvoelker has joined #openstack-keystone | 15:46 | |
| *** stevemar has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v stevemar | 15:47 | |
| *** carlosmarin has joined #openstack-keystone | 15:48 | |
| *** abhirc has joined #openstack-keystone | 15:49 | |
| *** nellysmitt has quit IRC | 15:49 | |
| *** andreaf_ has quit IRC | 15:53 | |
| *** andreaf_ has joined #openstack-keystone | 15:53 | |
| *** nellysmitt has joined #openstack-keystone | 15:54 | |
| rodrigods | stevemar, have two changes for you to check whenever you have a moment: two lines https://review.openstack.org/#/c/130081/ and the whitelist/blacklist https://review.openstack.org/#/c/142573/ | 16:01 |
| stevemar | rodrigods, cool cool | 16:05 |
| *** packet has joined #openstack-keystone | 16:07 | |
| *** joesavak has joined #openstack-keystone | 16:07 | |
| *** jsavak has quit IRC | 16:09 | |
| *** henrynash_ has joined #openstack-keystone | 16:11 | |
| *** ChanServ sets mode: +v henrynash_ | 16:11 | |
| mfisch | hey keystoners, there's some operators ML questions about whether policy.json works in keystone, are there any issues with it? | 16:13 |
| lbragstad | mfisch: link? | 16:13 |
| mfisch | http://lists.openstack.org/pipermail/openstack-operators/2015-January/006014.html | 16:13 |
| mfisch | from what I saw what he did looked ok, well most of it did | 16:14 |
| *** arif-ali_ has joined #openstack-keystone | 16:16 | |
| *** henrynash has quit IRC | 16:17 | |
| *** henrynash_ is now known as henrynash | 16:17 | |
| *** arif-ali has quit IRC | 16:18 | |
| *** svasheka has quit IRC | 16:18 | |
| *** arif-ali_ is now known as arif-ali | 16:18 | |
| *** tomoiaga has left #openstack-keystone | 16:18 | |
| lbragstad | mfisch: thanks, I'll dig through it and see if I can recreate it | 16:18 |
| rodrigods | lbragstad, mfisch, we do have some hardcoded checks, remember a change from nkinder where they were being documented | 16:19 |
| stevemar | mfisch, i want to say using _member_ for anything is bad | 16:20 |
| lbragstad | rodrigods: mfisch I think those checks live in the common controller code? | 16:20 |
| rodrigods | lbragstad, mfisch, https://review.openstack.org/#/c/123862/ | 16:21 |
| rodrigods | last point of the commit message | 16:21 |
| *** svasheka has joined #openstack-keystone | 16:21 | |
| lbragstad | rodrigods: nice catch | 16:22 |
| *** henrynash has quit IRC | 16:23 | |
| *** henrynash_ has joined #openstack-keystone | 16:23 | |
| *** ChanServ sets mode: +v henrynash_ | 16:23 | |
| stevemar | mfisch, also, is the user on the ML restarting keystone? | 16:23 |
| stevemar | it's not mentioned explicitly | 16:23 |
| mfisch | stevemar: I asked him, he wasnt at first but he did try it | 16:23 |
| stevemar | i'd try it without _member_ | 16:24 |
| mfisch | here's what he said about restarts | 16:24 |
| mfisch | Is this necessary? According to the logs the policy.json file is | 16:24 |
| mfisch | automatically be reloaded after each change (and each touch as well). | 16:24 |
| mfisch | 2015-01-26 16:40:23.388 24240 DEBUG keystone.openstack.common.fileutils | 16:24 |
| mfisch | [-] Reloading cached file /etc/keystone/policy.json read_cached_file | 16:24 |
| lbragstad | stevemar: ++ yeah, I was just going to suggest that | 16:24 |
| mfisch | he said he tried "@" which I've not used, is that open to everyone? | 16:25 |
| mfisch | I'm not familiar with "@" | 16:25 |
| lbragstad | https://github.com/openstack/keystone/blob/b3e969c065f991b8de180330f8f69d94012c6915/keystone/common/controller.py#L169 | 16:26 |
| lbragstad | which is applied to list_services() | 16:26 |
| lbragstad | https://github.com/openstack/keystone/blob/b3e969c065f991b8de180330f8f69d94012c6915/keystone/catalog/controllers.py#L226 | 16:26 |
| *** 17WAA14VW has joined #openstack-keystone | 16:27 | |
| mfisch | so you have to be admin regardless as to the policy.json | 16:28 |
| mfisch | based on that first link | 16:28 |
| *** chrisshattuck has joined #openstack-keystone | 16:28 | |
| lbragstad | mfisch: those first two links are for the V3 api | 16:30 |
| lbragstad | this is for the V2 api | 16:30 |
| lbragstad | https://github.com/openstack/keystone/blob/a2667edde6e91bda0ff2c9ba6abe1015f9a7e66a/keystone/common/wsgi.py#L274 | 16:30 |
| stevemar | i don't think so, that's the same as the regular projected call, but accounting for filters on a list | 16:30 |
| lbragstad | which calls assert_admin in v2 get_services https://github.com/openstack/keystone/blob/b3e969c065f991b8de180330f8f69d94012c6915/keystone/catalog/controllers.py#L36-L39 | 16:30 |
| mfisch | that would be it | 16:31 |
| mfisch | sounds like a documentation opportunity | 16:31 |
| lbragstad | and that looks like it hard codes 'admin_required' here | 16:31 |
| lbragstad | https://github.com/openstack/keystone/blob/a2667edde6e91bda0ff2c9ba6abe1015f9a7e66a/keystone/common/wsgi.py#L301 | 16:31 |
| mfisch | doesnt this defeat the purpose of policy.json somewhat? | 16:32 |
| *** 17WAA14VW is now known as dims | 16:33 | |
| stevemar | lbragstad, yeah, now i think you've got the right line in the code | 16:33 |
| lbragstad | stevemar: ++ | 16:33 |
| lbragstad | I can respond to the ML thread | 16:34 |
| rodrigods | stevemar, lbragstad, ++ | 16:34 |
| mfisch | thanks guys | 16:35 |
| lbragstad | mfisch: no problem, thanks for letting us know | 16:35 |
| stevemar | theres another note on the -dev ML about about removing expiring tokens | 16:36 |
| stevemar | is there a reason we don't do it automatically | 16:36 |
| lbragstad | stevemar: yeah I saw that, | 16:36 |
| *** avozza is now known as zz_avozza | 16:36 | |
| mfisch | there was a bug that was fixed about locking the table during the cleanup | 16:37 |
| mfisch | I thought one reason not to do it automatically was when you had a galera cluster | 16:37 |
| lbragstad | side note that I found about Galera documentation: | 16:38 |
| lbragstad | http://galeracluster.com/documentation-webpages/performance.html#dealing-with-large-transactions | 16:38 |
| * lbragstad waits for it | 16:38 | |
| mfisch | we only run the token clean up on node 1 | 16:40 |
| lbragstad | mfisch: so you have something that applies clean up on one galera node and the writes propagate through the rest of the cluster, right? | 16:41 |
| mfisch | yeah, its just a cron job on node1 | 16:42 |
| mfisch | IIRC | 16:42 |
| lbragstad | mfisch: yeah, that makes sense | 16:42 |
| mfisch | we have a cluster that spans regions so it runs even hours in East and odd hours in west | 16:42 |
| lbragstad | I think the performance tuning referenced in the Galera docs is just for larger transactions | 16:43 |
| lbragstad | so when that massive cleanup runs, galera handles it better? | 16:43 |
| lbragstad | I haven't tried that but I thought it was funny how they explicitly use Keystone tokens as their example | 16:44 |
| lbragstad | of a large transaction | 16:44 |
| mfisch | the fix that a colleague made was so just allow range deletions to avoid locking the table for a long time | 16:45 |
| *** _cjones_ has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Remove URL field from regions https://review.openstack.org/150109 | 16:48 |
| rodrigods | stevemar, ^ thanks for the review | 16:48 |
| stevemar | np! | 16:48 |
| stevemar | thanks for a quick fix :) | 16:48 |
| rodrigods | :) | 16:48 |
| *** nellysmitt has quit IRC | 16:52 | |
| *** rwsu_ has joined #openstack-keystone | 16:53 | |
| *** rwsu has quit IRC | 16:53 | |
| marekd | rodrigods what were your concerns about revocation in https://review.openstack.org/#/c/149071/ ? Tokens for normal users? | 16:54 |
| *** abhirc has quit IRC | 16:54 | |
| *** abhirc has joined #openstack-keystone | 16:54 | |
| mfisch | lbragstad: here's the bug I was mentioning about token flush; https://bugs.launchpad.net/keystone/+bug/1188378 | 16:55 |
| mfisch | sorry for the delay I'm in a meeting | 16:55 |
| rodrigods | marekd, federated tokens that still valid even after delete an IdP | 16:55 |
| rodrigods | marekd, assumed that both topics (the spec) and token revoking for that use case were discussed :) | 16:56 |
| lbragstad | mfisch: no worries, thanks! | 16:56 |
| *** afaranha has quit IRC | 16:57 | |
| *** notmyname has quit IRC | 17:00 | |
| *** zz_avozza is now known as avozza | 17:01 | |
| lbragstad | mfisch: would you be able to respond to http://lists.openstack.org/pipermail/openstack-operators/2015-January/006019.html just to bounce it off the mailing list? I just subscribed so I can reply | 17:01 |
| *** notmyname has joined #openstack-keystone | 17:02 | |
| *** rwsu_ is now known as rwsu | 17:04 | |
| mfisch | yeah | 17:07 |
| marekd | rodrigods: but token revocation in general is a broad topic and i think there is a bug related to federated tokens and IdP deletion. | 17:07 |
| marekd | (still not resolved AFAIR) | 17:07 |
| marekd | and to be honest, this spec doesn't change anything in the matters you are concerned. | 17:08 |
| marekd | it just allows for authenticating users who actually exist in the backend. | 17:08 |
| mfisch | lbragstad: done | 17:08 |
| lbragstad | mfisch: thank you sir! | 17:08 |
| * mfisch cringes at all the TWC corporate legal BS that gets added to his emails :( | 17:08 | |
| marekd | so, let's authn with 1st class IdP instead using auth methods like password in Keystone. | 17:08 |
| *** rm_work is now known as rm_work|away | 17:10 | |
| marekd | rodrigods: your concerns raised some flag, as how should we behave if the user was authenticated and the IdP got deregistered, but I think as long as the user himself is active and was not blocker, nor deleted, we shouldn't revoke his tokens. | 17:10 |
| marekd | ayoung_snowedin: ^^ makes sense? | 17:10 |
| marekd | ayoung_snowedin: talking https://review.openstack.org/#/c/149071/ now. | 17:10 |
| *** MasterPiece has quit IRC | 17:10 | |
| stevemar | mfisch, its like glitter at the end of a letter | 17:10 |
| mfisch | yeah about as terrible as glitter too | 17:10 |
| mfisch | lawyer glitter | 17:10 |
| stevemar | marekd, that was always the case, even back in havana/icehouse | 17:11 |
| henrynash_ | bknuson: hi | 17:11 |
| henrynash_ | bknudson: hi | 17:11 |
| marekd | stevemar: you mean? | 17:11 |
| marekd | stevemar: i dared to change your kickass code. Hope you will not kill me: https://review.openstack.org/#/c/110858/ | 17:12 |
| stevemar | marekd, please dare away | 17:13 |
| stevemar | you know i don't care :) | 17:13 |
| rodrigods | marekd, makes sense, although I'm curious to know how we going to finally solve this | 17:14 |
| marekd | rodrigods: revocation events and federation? | 17:14 |
| rodrigods | marekd, yes | 17:15 |
| marekd | rodrigods: so, recaling some discussions back somewhere in early Icehouse cycle the only 'matching' point was Identity Provider from the token. | 17:16 |
| marekd | rodrigods: to be honest i am not super update what's te current state of revocation events :-) | 17:16 |
| marekd | are they merged, working etc? | 17:16 |
| marekd | i remember there was some problems with them. | 17:17 |
| marekd | they also seem to be crucial for PKI(Z) tokens, am I right? | 17:17 |
| rodrigods | marekd, exactly | 17:17 |
| rodrigods | not sure why they had some problems though, the revoking tree is "up and running" | 17:17 |
| marekd | rodrigods: exactly crucial for PKIs ? | 17:17 |
| rodrigods | marekd, yes | 17:18 |
| rodrigods | questions that ayoung_snowedin can easily answer, although he seems to be afk or just ignoring IRC pings | 17:18 |
| marekd | or working with his snowshovel | 17:19 |
| * rodrigods needs to get a big picture of the token revoking status | 17:19 | |
| marekd | where PKI tree code lays in Keystone? | 17:19 |
| rodrigods | marekd, hmm just a sec | 17:19 |
| marekd | contrib/revoke | 17:19 |
| marekd | i tihnk | 17:19 |
| *** lhcheng has joined #openstack-keystone | 17:20 | |
| rodrigods | marekd, https://github.com/openstack/keystone/blob/master/keystone/contrib/revoke/model.py#L117 | 17:21 |
| rodrigods | the RevokeTree, to understand the code: http://adam.younglogic.com/2014/02/compressed-tokens/ | 17:22 |
| rodrigods | marekd, assumed we need to add an IdP key somewhere in it | 17:22 |
| rodrigods | morganfainberg, in the mood to do some code review between meetings today? | 17:23 |
| marekd | rodrigods: yes. | 17:24 |
| morganfainberg | rodrigods, i'm going to go get some coffee ;) but this whole week needs code review and lots of it | 17:24 |
| marekd | morganfainberg: yes sir, it does! | 17:24 |
| *** _cjones_ has quit IRC | 17:24 | |
| rodrigods | morganfainberg, so we have two changes that might help nested quota drivers in Nova a lot: https://review.openstack.org/#/c/148567/ and https://review.openstack.org/#/c/148618/ | 17:25 |
| marekd | do revocation evens are being now used also for UUID tokens? | 17:25 |
| rodrigods | marekd, don't think so | 17:25 |
| rodrigods | think we have the old "is this token valid" request | 17:25 |
| marekd | HEAD /auth/tokens or sth like that, right? | 17:25 |
| *** _cjones_ has joined #openstack-keystone | 17:25 | |
| rodrigods | marekd, yeag | 17:26 |
| rodrigods | yeah* | 17:26 |
| *** atiwari has joined #openstack-keystone | 17:27 | |
| *** gokrokve_ has quit IRC | 17:28 | |
| morganfainberg | marekd,revocation events work for uuid and you can turn off the revocation list | 17:28 |
| *** thedodd has joined #openstack-keystone | 17:28 | |
| morganfainberg | marekd, but auth_token middleware cannot consume revocation events, only works inside keystone | 17:28 |
| rodrigods | morganfainberg, hmm thanks for the explanation | 17:28 |
| rodrigods | so right now all openstack services need to validate via HEAD /auth/tokens? | 17:29 |
| *** rushiagr is now known as rushiagr_away | 17:40 | |
| *** gokrokve has joined #openstack-keystone | 17:44 | |
| morganfainberg | rodrigods, or GET if you use revocation events. | 17:45 |
| morganfainberg | rodrigods, meaning PKI tokens wont work with it | 17:46 |
| morganfainberg | ayoung_snowedin, is this something like your house? http://i.imgur.com/ILX0gmv.gifv | 17:46 |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone: Bumping up the testr and subunit versions https://review.openstack.org/150515 | 17:47 |
| *** krykowski has joined #openstack-keystone | 17:48 | |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone: Bumping up the testr and subunit versions https://review.openstack.org/150515 | 17:49 |
| morganfainberg | atiwari, ^ shouldn't the proposal bot be handling that? | 17:49 |
| stevemar | ++ | 17:49 |
| atiwari | morganfainberg, I sorry not idea | 17:50 |
| atiwari | may be I can abandon it | 17:51 |
| morganfainberg | atiwari, and that can't merge it doesn't match requirements from openstack/requirements repo | 17:51 |
| atiwari | hmm | 17:51 |
| *** krykowski has quit IRC | 17:51 | |
| morganfainberg | atiwari, propose the change against global reqirements repo | 17:51 |
| atiwari | ok | 17:51 |
| *** krykowski has joined #openstack-keystone | 17:51 | |
| *** ajayaa is now known as ajayaa_ | 17:52 | |
| *** ajayaa_ has quit IRC | 17:53 | |
| -openstackstatus- NOTICE: Gerrit and Zuul will be offline for a few minutes for a security update | 17:53 | |
| *** ajayaa has joined #openstack-keystone | 17:53 | |
| stevemar | i imagine theres gotta be some projects doing something backwards incompatible with those libs | 17:54 |
| ayoung_snowedin | morganfainberg, that looks about right. Somewhere just over 2 feet on the sidewalk | 17:54 |
| * ayoung_snowedin was out shoveling | 17:54 | |
| morganfainberg | send some snow over to SoCal... so you can laugh at people | 17:54 |
| ayoung_snowedin | marekd, rodrigods when in doubt: revoke | 17:55 |
| *** ayoung_snowedin is now known as ayoung | 17:55 | |
| *** ajayaa has quit IRC | 17:56 | |
| ayoung | morganfainberg, moving snow takes a lot of energy. I moved it roughly 2 feet lateraly | 17:56 |
| ayoung | moving it so SoCal ... whew | 17:56 |
| *** ajayaa_ has joined #openstack-keystone | 17:57 | |
| *** ajayaa_ has quit IRC | 17:58 | |
| ayoung | marekd, rodrigods looks correct upon first glance | 17:58 |
| *** ajayaa has joined #openstack-keystone | 17:59 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated service name to be optional in CLI https://review.openstack.org/143223 | 17:59 |
| rodrigods | ayoung, in the mood for some code review today? :) | 18:00 |
| rodrigods | have two awesome HMT patches | 18:00 |
| rodrigods | needing core reviews | 18:00 |
| *** openstack` has joined #openstack-keystone | 18:03 | |
| -sendak.freenode.net- [freenode-info] help freenode weed out clonebots -- please register your IRC nick and auto-identify: http://freenode.net/faq.shtml#nicksetup | 18:03 | |
| *** openstack has quit IRC | 18:03 | |
| *** ajayaa has quit IRC | 18:04 | |
| *** openstack has joined #openstack-keystone | 18:04 | |
| *** openstack has quit IRC | 18:04 | |
| *** openstack has joined #openstack-keystone | 18:05 | |
| *** tqtran has joined #openstack-keystone | 18:05 | |
| *** openstack has quit IRC | 18:05 | |
| *** openstack has joined #openstack-keystone | 18:06 | |
| *** openstack is now known as angelamolock | 18:06 | |
| *** openstack` is now known as openstack | 18:06 | |
| *** harlowja has joined #openstack-keystone | 18:06 | |
| openstackgerrit | David Stanek proposed openstack/keystone: exclude functional tests from unit test runs https://review.openstack.org/150527 | 18:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: adds a tox target for functional tests https://review.openstack.org/150528 | 18:08 |
| *** krykowski has quit IRC | 18:09 | |
| *** krykowski has joined #openstack-keystone | 18:09 | |
| openstackgerrit | Merged openstack/keystone-specs: Visual Page for WebSSO https://review.openstack.org/133529 | 18:10 |
| *** kfox1111 has joined #openstack-keystone | 18:12 | |
| *** kfox1111 has quit IRC | 18:16 | |
| *** timcline has joined #openstack-keystone | 18:19 | |
| *** gyee has joined #openstack-keystone | 18:20 | |
| *** ChanServ sets mode: +v gyee | 18:20 | |
| *** krykowski has quit IRC | 18:20 | |
| *** markvoelker has quit IRC | 18:22 | |
| *** markvoelker has joined #openstack-keystone | 18:24 | |
| *** krykowski has joined #openstack-keystone | 18:25 | |
| *** jorge_munoz has joined #openstack-keystone | 18:28 | |
| *** gokrokve_ has joined #openstack-keystone | 18:28 | |
| *** openstackgerrit has quit IRC | 18:30 | |
| *** gokrokve has quit IRC | 18:31 | |
| *** openstackgerrit has joined #openstack-keystone | 18:32 | |
| *** gokrokve_ has quit IRC | 18:33 | |
| *** jaosorior has quit IRC | 18:34 | |
| rodrigods | gyee, available to do a couple reviews in some awesome HMT patches? https://review.openstack.org/#/c/148567/ and https://review.openstack.org/#/c/148618/ | 18:39 |
| gyee | rodrigods, yes, after the meeting | 18:39 |
| dolphm | "2^64 * 16 is 256 exabytes. As in, you would need to store 256 exabytes worth of IDs before you had a 50% chance of an ID collision in a single application space." | 18:40 |
| rodrigods | dolphm, wow | 18:40 |
| rodrigods | gyee, thx! | 18:40 |
| *** ChanServ changes topic to "Release Blockers: https://gist.github.com/dolph/651c6a1748f69637abd0 << please review for client release on Feb 1st | http://opensax.com/ | Reviews Guarantee Citizenship </starship troopers>" | 18:46 | |
| rodrigods | dolphm, can we add https://review.openstack.org/#/c/115770/ to that list? | 18:47 |
| rodrigods | also https://review.openstack.org/#/c/150078/ if we have the server changes merged in time | 18:47 |
| morganfainberg | FYI, since most cores are here - you all can change the topic of the channel: /msg chanserv topic[append] #openstack-keystone <topic> | 18:47 |
| morganfainberg | look at chanserv docs on how topic and topicappend work if you care | 18:47 |
| rodrigods | there is a patch in Nova (nested quota drivers using hierarchical projects) | 18:48 |
| rodrigods | that needs those changes | 18:48 |
| rodrigods | morganfainberg, ^asking you too, once the meeting is over you can check if it is possible :) | 18:49 |
| *** gokrokve has joined #openstack-keystone | 18:50 | |
| *** harlowja has quit IRC | 18:52 | |
| *** nellysmitt has joined #openstack-keystone | 18:53 | |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Pull out some CADF taxonomy to be constants https://review.openstack.org/149011 | 18:53 |
| *** krykowski has quit IRC | 18:53 | |
| *** gokrokve has quit IRC | 18:56 | |
| *** gokrokve has joined #openstack-keystone | 18:56 | |
| jamielennox | gyee: you need https://review.openstack.org/#/c/141267/ | 18:58 |
| gyee | jamielennox, awesome!!!!!!!!!!!!! | 18:58 |
| gyee | jamielennox, btw, are we going to wait for a new neutronclient release and then fix this one? https://review.openstack.org/#/c/141267/ | 18:59 |
| jamielennox | not the patch i think you meant - but i know the one | 19:00 |
| jamielennox | yea - i didn't see i had much option | 19:00 |
| *** rushiagr_away is now known as rushiagr | 19:00 | |
| jamielennox | i've got the fix landed in neutronclient i just need them to release | 19:00 |
| gyee | jamielennox, cool, thanks, just want to make sure | 19:01 |
| morganfainberg | henrynash_, samueldmq, which specs under no-spec discussions on the meeting list still need to be reviewed? | 19:01 |
| morganfainberg | all three? | 19:01 |
| gyee | domain roles spec, or the HMT ones? | 19:01 |
| breton | there was also "Review un-approved specs for Feb 5th Spec Proposal Deadline" in agenda | 19:02 |
| samueldmq | morganfainberg, mine's merged, sorry for not removing from there (Improve list role assignments filtering performance) | 19:02 |
| raildo | gyee, if you want review, i appreciate :) https://review.openstack.org/#/c/139824/17/specs/kilo/reseller.rst | 19:02 |
| morganfainberg | samueldmq, please remove it from that list then | 19:02 |
| henrynash_ | morganfainberg: and the lsit filtering one was Approved at the midcyce | 19:02 |
| samueldmq | morganfainberg, well, in fact it needed a spec that is already merged now | 19:02 |
| raildo | gyee, and this https://review.openstack.org/#/c/148730/ | 19:03 |
| morganfainberg | ok please remove ones we talked about from that list if you don't mind. | 19:03 |
| samueldmq | morganfainberg, done | 19:03 |
| morganfainberg | henrynash_, ^ | 19:03 |
| breton | and I wanted to throw in Alembic spec there | 19:03 |
| morganfainberg | thanks | 19:03 |
| raildo | gyee, it's related to HMT and reseller | 19:03 |
| *** rm_work|away is now known as rm_work | 19:03 | |
| morganfainberg | breton, that is more of a "hey everyone review these" | 19:03 |
| henrynash_ | done | 19:03 |
| morganfainberg | breton, which is why i skipped. | 19:03 |
| morganfainberg | too cramped for time there | 19:03 |
| samueldmq | morganfainberg, henrynash_ so we decided to push domain roles ? | 19:03 |
| morganfainberg | samueldmq, i think so. they are nice to have but really provide minimal benefit without some dynamic policy (cc ayoung ) | 19:04 |
| henrynash_ | samueldmq: I’m getting that feeling…and we see how far we get with ayoung’s stuff and then see what we need to bring together | 19:04 |
| *** saikrishna has joined #openstack-keystone | 19:04 | |
| morganfainberg | henrynash_, ++ exactly | 19:04 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Pull out some CADF taxonomy to be constants https://review.openstack.org/149011 | 19:05 |
| ayoung | dagnabit...I thought the meeting was at 2 my time | 19:05 |
| samueldmq | morganfainberg, henrynash_ ok .. don't know exactly how far we will get ... but let's see, as you just said | 19:05 |
| * ayoung reads up | 19:05 | |
| henrynash_ | morganfainbeg, samueldmq: We definitely need to give a domain administrator teh ability to create roley-things that are private and meaningfu to just their domain…it’s just how we do it | 19:05 |
| samueldmq | henrynash_, ++ | 19:06 |
| gyee | henrynash_, absolutely no argument there | 19:06 |
| raildo | henrynash_, morganfainberg and about the name clash, we can create a constraint to represent a domain (as henrynash_ suggested) this and move on with the spec? | 19:06 |
| gyee | just the way we go about it to make it intuitive and user friendly | 19:06 |
| henrynash_ | gyee”++ | 19:07 |
| henrynash_ | gyee:++ | 19:07 |
| *** ksavich_ has joined #openstack-keystone | 19:07 | |
| ayoung | Argh...so sorry I missed that discussion.... | 19:07 |
| samueldmq | henrynash_, I will check all the dynamic policy stuff and try to get an idea on how we'll get this in there | 19:08 |
| ayoung | morganfainberg, Projects don't really *need* to be in domains, do they? Domains are are really only useful for User and group management | 19:08 |
| samueldmq | ayoung, and projects in domains mean that only users/groups managed in that domain use them | 19:09 |
| morganfainberg | ayoung, are you telling me there is no reason to now merge projects and domains (i feel like each time we talk you're on a different side of this conversation?) | 19:09 |
| morganfainberg | or am i mis-reading that? | 19:09 |
| * morganfainberg might be misreading that statement. | 19:09 | |
| ayoung | morganfainberg, no...I am telling you that I am continuing to think about this probelm and my understanding is evolving | 19:10 |
| ayoung | with the name clash issue...we make things worse on the Horizon front | 19:10 |
| samueldmq | ayoung, we don't have name clash anymore | 19:10 |
| ayoung | if there is both a domain named "RedHat" and a preexisint project named RedHat | 19:10 |
| ayoung | the user is going to be confused if they are both presented as the same thing | 19:10 |
| gyee | just gimme a duck, damn it! | 19:11 |
| samueldmq | ayoung, project names are domain scope, so we solve that ... we discussed that in meeting (raildo correct me if I'm wrong) | 19:11 |
| ayoung | hey gyee ? | 19:11 |
| ayoung | DUCK! | 19:11 |
| samueldmq | s/scope/scoped | 19:11 |
| morganfainberg | gyee, stop bringing ducks to the table, we already have enough ducks :P | 19:11 |
| ayoung | samueldmq, nope, you didn't | 19:11 |
| ayoung | and I am really sorry I missed that discussion | 19:11 |
| ayoung | the real issue is presenting data to Horizon, or other ways that users need to select | 19:11 |
| raildo | ayoung, but this data is presenting in different views, right? | 19:12 |
| gyee | I just need a way to isolate resources, I don't care we call it project or domain or whatever | 19:12 |
| *** markvoelker has quit IRC | 19:12 | |
| *** henrynash_ has quit IRC | 19:12 | |
| bknudson | call them resources | 19:12 |
| *** henrynash has joined #openstack-keystone | 19:12 | |
| *** ChanServ sets mode: +v henrynash | 19:12 | |
| raildo | when I use the domain view, I'll see the domain "Redhat" and when I use the project redhat... | 19:12 |
| gyee | bknudson, doh! | 19:12 |
| ayoung | I think the right solution is to use a nested namespace, much like what we do in URLs. so RedHat domain could have RedHat proehjct and we would present it like RedHat:RedHat | 19:13 |
| ayoung | and if they have a...management project it would be | 19:13 |
| ayoung | RedHat:Management | 19:13 |
| ayoung | nested proejcts thne would be like: | 19:13 |
| ayoung | RedHat:Management/web/ha | 19:13 |
| morganfainberg | ayoung, sure. i think that really doesn't change the argument of "are domains useful as a separate entity from projects". they're really all containers. | 19:13 |
| morganfainberg | ayoung, and we've already said domains can be nested | 19:14 |
| ayoung | morganfainberg, nested domains are a good idea, but there are some tricky aspects | 19:14 |
| *** markvoelker has joined #openstack-keystone | 19:14 | |
| ayoung | are domain names globally unique? | 19:14 |
| morganfainberg | ayoung, no. only top-level domains | 19:14 |
| ayoung | or only within the scope of a degree of nesting | 19:14 |
| morganfainberg | ayoung, but are unique within a namespace | 19:15 |
| ayoung | so they are namespaced by their parent domain? Does this support the reseller info hiding needs? | 19:15 |
| morganfainberg | same as projects (in fact they shouldn't collide with project names in the same namespace for the same reason) | 19:15 |
| morganfainberg | ayoung, i think we will need some work on the info hiding bits. | 19:15 |
| morganfainberg | ayoung, but largely, yes that is the idea. so you can have RedHat:Management:<project> | 19:16 |
| ayoung | morganfainberg, I think the right approach is something like: things are unique only within a namespace | 19:16 |
| morganfainberg | and IBM:Management:<project> | 19:16 |
| samueldmq | ayoung, ++ | 19:16 |
| ayoung | nested projects shouldn';t have to be globally unique, even within a domain | 19:16 |
| raildo | morganfainberg, young, so, what you want to say is: Yes, we can have name clash but not in the same hierarchy? | 19:16 |
| ayoung | but more like the rules for two files in the same directory | 19:16 |
| morganfainberg | ayoung, that is current design proposed. | 19:16 |
| ayoung | so how do we present that in Horizon? | 19:16 |
| morganfainberg | ayoung, project names are unique in a namespace | 19:16 |
| samueldmq | morganfainberg, yes, ayoung got the idea | 19:17 |
| samueldmq | his concern is about horizon | 19:17 |
| morganfainberg | the only thing that is also happening is domains and projects *also* cannot collide in a namespace | 19:17 |
| morganfainberg | to help limit confusion getting worse | 19:17 |
| david-lyle | I'm not worried about duplicate names, really, we work off id's anyway | 19:17 |
| samueldmq | david-lyle, but the ux ? | 19:18 |
| morganfainberg | david-lyle, he's asking how do you know it's Domain RedHat at the top or Project RedHat in domain RedHat | 19:18 |
| *** david8hu has joined #openstack-keystone | 19:18 | |
| samueldmq | morganfainberg, ++ | 19:18 |
| morganfainberg | samueldmq, this is where a ux designer needs to step in. if we aren't breaking v3 compatibility we present the data in as sane a way as possible - we're already on that path. uniqueness of names is guaranteed within a namespace | 19:19 |
| david-lyle | we will likely show in some sort of tree | 19:19 |
| morganfainberg | let the guys who are good at ux help suss out presentation of that data | 19:19 |
| david-lyle | we have many designs in progress looking at hierarchies | 19:19 |
| raildo | I believe that david-lyle remember the design that I show in the summit. We don't have this problem in that design | 19:19 |
| samueldmq | morganfainberg, yes, we dont break v3, but we added hierarchies ... | 19:19 |
| samueldmq | morganfainberg, yes I agree, that's where ux designers come in | 19:20 |
| samueldmq | ++ | 19:20 |
| david-lyle | Piet in the ux or horizon rooms is working on those | 19:20 |
| morganfainberg | samueldmq, that is the point, we present data clearly <namspace>:<sub namespace> .... | 19:20 |
| morganfainberg | etc | 19:20 |
| morganfainberg | this doesn't change our direction really | 19:20 |
| raildo | david-lyle, yes, I was in a meeting with him today, discuss this :) | 19:20 |
| samueldmq | morganfainberg, completely agree :) | 19:20 |
| morganfainberg | nor any conversations from the meeting | 19:20 |
| openstackgerrit | David Stanek proposed openstack/keystone: exclude functional tests from unit test runs https://review.openstack.org/150527 | 19:20 |
| openstackgerrit | David Stanek proposed openstack/keystone: adds a tox target for functional tests https://review.openstack.org/150528 | 19:20 |
| morganfainberg | i think for sanity reasons, it makes sense to still collapse domains -> projects | 19:21 |
| david-lyle | but if we're just giving users a flat list with domains and projects with name only and no context, we've already failed on the UX front | 19:21 |
| morganfainberg | otherwise the namespace restrictions start getting all sorts of heavy handed | 19:21 |
| morganfainberg | and open to edge cases. | 19:21 |
| morganfainberg | so i think we're all on the right path still. | 19:21 |
| morganfainberg | david-lyle, thanks! | 19:21 |
| samueldmq | david-lyle, ++ I agree, we are moving in the right path :) | 19:21 |
| samueldmq | great! | 19:21 |
| ayoung | morganfainberg, I think, then,that domains are projects that are owned by parents, and do not own them self | 19:22 |
| ayoung | but they are going to be "cut points" in visibility | 19:22 |
| morganfainberg | ayoung, exactly what we discussed in the meeting. | 19:22 |
| samueldmq | ++ | 19:22 |
| morganfainberg | :) | 19:22 |
| samueldmq | morganfainberg, can we have resources (vms) in a domain-ness porject ? | 19:22 |
| morganfainberg | ayoung, the only exception is top-level which is "owned" by no one [well keystone service but you know] | 19:22 |
| ayoung | morganfainberg, project names should not be unique within domains | 19:22 |
| ayoung | only within nesting | 19:22 |
| morganfainberg | ayoung, within a specific namespace | 19:23 |
| raildo | samueldmq, yes | 19:23 |
| gyee | david-lyle, but you can use different fonts for special projects :) | 19:23 |
| samueldmq | morganfainberg, raildo don't that break v3 domain concept (which is a container for users/projects)? | 19:23 |
| gyee | or maybe different color? | 19:23 |
| morganfainberg | you cannot have RedHat:<Management <with idX>> and RedHat:<Management <with idY>> | 19:23 |
| *** jistr has quit IRC | 19:23 | |
| morganfainberg | samueldmq, nope | 19:23 |
| ayoung | so long as we have a path to let horizon work on operations that are protected by domain scoped policy, we are good | 19:24 |
| raildo | samueldmq, no, because the other services don't know about domains | 19:24 |
| raildo | samueldmq, so, for the nova, its is just a project | 19:24 |
| morganfainberg | ayoung, actually within a domain project names do need to be unique still - v3 compat | 19:24 |
| morganfainberg | ayoung, sorry | 19:24 |
| *** thedodd has quit IRC | 19:24 | |
| samueldmq | raildo, I know it's possible to easily do it, my concern is about conssitency | 19:24 |
| ayoung | morganfainberg, not if we say that nested project names inherit their parents | 19:24 |
| ayoung | so instead of | 19:24 |
| morganfainberg | if you need duplicate names you'll need either to reference by full namespace ^^ [what you said] oooor | 19:24 |
| morganfainberg | create a secondary domain | 19:25 |
| morganfainberg | [easy] | 19:25 |
| ayoung | management we say it is is redhat/management | 19:25 |
| morganfainberg | both work | 19:25 |
| gyee | we could do it LDAP style, everything's is uniquely identity by DN | 19:25 |
| ayoung | morganfainberg, list projects for domain would return the FQPN | 19:25 |
| *** saikrishna has quit IRC | 19:27 | |
| *** radez is now known as radez_g0n3 | 19:27 | |
| *** harlowja has joined #openstack-keystone | 19:28 | |
| *** dims has quit IRC | 19:29 | |
| *** nkinder has quit IRC | 19:30 | |
| *** keystonelpbug has joined #openstack-keystone | 19:30 | |
| morganfainberg | bug 1240625 | 19:31 |
| keystonelpbug | bug 1240625 in Keystone "User cannot set their own default project" [Wishlist,In progress] https://launchpad.net/bugs/1240625 | 19:31 |
| morganfainberg | ^ temporary bot until my change gets added to -infra | 19:31 |
| morganfainberg | to make openstack bot smarter | 19:31 |
| samueldmq | morganfainberg, ++ | 19:31 |
| morganfainberg | bug 1 | 19:31 |
| keystonelpbug | bug 1 in Ubuntu Malaysia LoCo Team "Microsoft has a majority market share" [Critical,In progress] https://launchpad.net/bugs/1 | 19:31 |
| samueldmq | o/ | 19:31 |
| samueldmq | morganfainberg, just to make sure you understood my previous question: can domain-ness projects have vms? | 19:32 |
| morganfainberg | samueldmq, no reason they can't. | 19:32 |
| samueldmq | morganfainberg, we don't get it as projects if we list projects, dont we? | 19:32 |
| morganfainberg | samueldmq, that is a deployer choice / nova choice. | 19:33 |
| morganfainberg | samueldmq, you don't get it as a project if you list it's projects | 19:33 |
| morganfainberg | you would get it as a project if you listed the projects of it's parent | 19:33 |
| rodrigods | morganfainberg, how can they control quotas then? | 19:33 |
| *** dims has joined #openstack-keystone | 19:34 | |
| rodrigods | if the domainess project is root, for example | 19:34 |
| samueldmq | so subdomains will be treated as projects in this case?? | 19:34 |
| morganfainberg | rodrigods, step back | 19:34 |
| morganfainberg | how do you expect to enforce this? | 19:34 |
| morganfainberg | if a domain is a project, how can keystone stop people from doing this? | 19:34 |
| morganfainberg | this is a question out of scope for keystone | 19:35 |
| rodrigods | morganfainberg, ok... | 19:35 |
| morganfainberg | how the quota is consumed becomes a question for nova | 19:35 |
| rodrigods | we just need to provide a clear and consistent API | 19:35 |
| morganfainberg | or cinder | 19:35 |
| rodrigods | morganfainberg, ++ | 19:35 |
| morganfainberg | and it makes sense, what if you tie your glance images to the domain project | 19:35 |
| morganfainberg | and share those resources down | 19:36 |
| rodrigods | makes sense | 19:36 |
| samueldmq | morganfainberg, hm... so if you ask for list_projects on a parent domain, *both* subdomains and projects will be seen in *project shell* | 19:36 |
| morganfainberg | nova may not let vms happen on a "domain" but other services may. | 19:36 |
| samueldmq | morganfainberg, because a domain is a project | 19:36 |
| samueldmq | makes sense to me | 19:36 |
| morganfainberg | samueldmq, correct | 19:36 |
| samueldmq | morganfainberg, ++ | 19:36 |
| rodrigods | so we need to agree on how to represent domain-ness projects and also what will be the constraint in the project table since name clashing isn't an issue | 19:37 |
| rodrigods | raildo, ayoung, henrynash ^ | 19:37 |
| raildo | rodrigods, ++ | 19:38 |
| *** afazekas has quit IRC | 19:38 | |
| *** rushiagr is now known as rushiagr_away | 19:40 | |
| morganfainberg | stevemar i punted cadf everywhere to k3 | 19:42 |
| morganfainberg | stevemar, since it had no reviews open | 19:43 |
| *** nkinder has joined #openstack-keystone | 19:44 | |
| jamielennox | morganfainberg: can you register keystoneclient-federation as a launchpad project? | 19:45 |
| morganfainberg | jamielennox, sure. give me a few | 19:46 |
| morganfainberg | i thought i did that already | 19:46 |
| jamielennox | morganfainberg: there's no bug tracker or blueprints apparently | 19:46 |
| stevemar | morganfainberg, gah, i am in the process of doing the code now, but thats fine, early k3 | 19:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move projects and domains to their own backend https://review.openstack.org/144824 | 19:49 |
| morganfainberg | jamielennox, fixed | 19:50 |
| openstackgerrit | Merged openstack/keystone: Change /POST to /ECP at federation config https://review.openstack.org/130081 | 19:50 |
| *** rushiagr_away is now known as rushiagr | 19:50 | |
| morganfainberg | jamielennox, https://launchpad.net/python-keystoneclient-federation | 19:51 |
| *** ljfisher has joined #openstack-keystone | 19:54 | |
| *** nellysmitt has quit IRC | 19:55 | |
| *** joesavak has quit IRC | 19:55 | |
| *** joesavak has joined #openstack-keystone | 19:56 | |
| *** aix has quit IRC | 19:56 | |
| raildo | morganfainberg, henrynash, ayoung, rodrigods I have a proposal to resolve our problem about the name clashing, and domains as project.. | 19:56 |
| raildo | so, we need to define 3 things... | 19:56 |
| raildo | 1- domain in a top level of the hierarchy: a project that project_id and domain_id are the same, and parent_id is null | 19:57 |
| raildo | 2- domains as a subdomain: a project that project_id and domain_id are the same, and parent_id is not null (points to a parent domain - we won't allow a domain to be under a "project") | 19:57 |
| raildo | 3- project that is not a domain: a project that project_id is different from its domain_id and its domain_id is your first project domain-ness above him, and your parent_id is not null (points to a "project") | 19:57 |
| raildo | So, we don't need a flag domain-ness to represent a domain in the project table and we can create a constrain like: | 19:58 |
| raildo | project: name + (project_id != domain_id) and domain: name + (project_id == domain_id) | 19:58 |
| raildo | and also assert that a project always have a parent_id different of null, and we don't have any problem anymore. what do you think? | 19:59 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Add new CADF taxonomy types https://review.openstack.org/149013 | 20:00 |
| morganfainberg | stevemar, if the code lands before the end of the week we can move it back to k2 | 20:01 |
| morganfainberg | stevemar, fyi | 20:01 |
| morganfainberg | stevemar, or is in flight by end of week | 20:01 |
| stevemar | morganfainberg, hoping to have it in flight by tomorrow | 20:01 |
| stevemar | but i keep getting distracted | 20:01 |
| morganfainberg | sounds good | 20:01 |
| stevemar | spec reviews and other reviews and other stuff | 20:02 |
| openstackgerrit | Merged openstack/keystone: Assignment sql backend create_grant refactoring https://review.openstack.org/141352 | 20:02 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 20:05 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 20:05 |
| *** atiwari1 has joined #openstack-keystone | 20:07 | |
| *** stevemar has quit IRC | 20:08 | |
| *** stevemar has joined #openstack-keystone | 20:08 | |
| *** ChanServ sets mode: +v stevemar | 20:08 | |
| *** atiwari has quit IRC | 20:10 | |
| samueldmq | morganfainberg, bknudson bug 1415190 | 20:12 |
| keystonelpbug | bug 1415190 in Keystone "list_user_projects method at assignment manager needs to be removed" [Undecided,New] https://launchpad.net/bugs/1415190 | 20:12 |
| samueldmq | rodrigods, ^ | 20:12 |
| *** thedodd has joined #openstack-keystone | 20:13 | |
| marekd | jamielennox: morganfainberg looks like we can now register bp for python-keystoneclient-federation, right? | 20:14 |
| jamielennox | marekd: yep - morganfainberg just created the project | 20:15 |
| marekd | jamielennox: not sure how the tests should look like in https://review.openstack.org/#/c/150305/ | 20:16 |
| marekd | shall we do the raw copy from ksc repo (ofc only those that tests plugins) | 20:17 |
| jamielennox | marekd: yea, i thought we were going to make the first patch just a copy across | 20:17 |
| jamielennox | do you want me to do that one? | 20:17 |
| marekd | jamielennox: go ahead. | 20:19 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Remove custom string truth handling https://review.openstack.org/138220 | 20:20 |
| *** timcline has quit IRC | 20:21 | |
| *** timcline has joined #openstack-keystone | 20:21 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove list_user_projects method from assignment https://review.openstack.org/150574 | 20:21 |
| *** openstack has joined #openstack-keystone | 20:37 | |
| ayoung | raildo, I think we have some wiggle room, as V3 came without HMT | 20:37 |
| ayoung | we are already saying HMT means "only global within namespace" | 20:38 |
| *** dims has quit IRC | 20:38 | |
| *** david8hu has quit IRC | 20:38 | |
| *** openstackgerrit has quit IRC | 20:38 | |
| *** rwsu has quit IRC | 20:38 | |
| *** jasondotstar has quit IRC | 20:38 | |
| *** joesavak has quit IRC | 20:38 | |
| *** cyeoh has quit IRC | 20:38 | |
| *** mgagne_ has quit IRC | 20:38 | |
| *** dtroyer_zz has quit IRC | 20:38 | |
| *** _d34dh0r53_ has quit IRC | 20:38 | |
| *** dutsmoc has quit IRC | 20:38 | |
| *** ksavich_ has quit IRC | 20:38 | |
| *** lhcheng has quit IRC | 20:38 | |
| *** aslaen has quit IRC | 20:38 | |
| *** abhirc has quit IRC | 20:38 | |
| *** marg7175 has quit IRC | 20:38 | |
| *** grantbow has quit IRC | 20:38 | |
| *** ChanServ has quit IRC | 20:38 | |
| *** _cjones_ has quit IRC | 20:38 | |
| *** chrisshattuck has quit IRC | 20:38 | |
| *** svasheka has quit IRC | 20:38 | |
| *** bknudson has quit IRC | 20:38 | |
| *** nkinder has quit IRC | 20:38 | |
| *** keystonelpbug has quit IRC | 20:38 | |
| *** tqtran has quit IRC | 20:38 | |
| *** fifieldt has quit IRC | 20:38 | |
| *** larsks has quit IRC | 20:38 | |
| *** saltsa has quit IRC | 20:38 | |
| *** timcline has quit IRC | 20:38 | |
| *** EmilienM has quit IRC | 20:38 | |
| *** rm_work has quit IRC | 20:38 | |
| *** jamielennox has quit IRC | 20:38 | |
| *** markvoelker has quit IRC | 20:38 | |
| *** r-daneel has quit IRC | 20:38 | |
| *** tellesnobrega has quit IRC | 20:38 | |
| *** zhiyan has quit IRC | 20:38 | |
| *** f13o has quit IRC | 20:38 | |
| *** g2` has quit IRC | 20:38 | |
| *** ayoung has quit IRC | 20:38 | |
| *** andreaf has quit IRC | 20:38 | |
| *** x58 has quit IRC | 20:38 | |
| *** david-lyle has quit IRC | 20:38 | |
| *** zigo has quit IRC | 20:38 | |
| *** Nakato has quit IRC | 20:38 | |
| *** hogepodge has quit IRC | 20:38 | |
| *** gus has quit IRC | 20:38 | |
| *** dougwig has quit IRC | 20:38 | |
| *** jamiec has quit IRC | 20:38 | |
| *** sudorandom has quit IRC | 20:38 | |
| *** henrynash has quit IRC | 20:38 | |
| *** atiwari1 has quit IRC | 20:38 | |
| *** richm has quit IRC | 20:38 | |
| *** pnavarro has quit IRC | 20:38 | |
| *** bjornar has quit IRC | 20:38 | |
| *** gabriel-bezerra has quit IRC | 20:38 | |
| *** htruta has quit IRC | 20:38 | |
| *** breton has quit IRC | 20:38 | |
| *** lsmola has quit IRC | 20:38 | |
| *** xianghui has quit IRC | 20:38 | |
| *** gothicmindfood has quit IRC | 20:38 | |
| *** wanghong has quit IRC | 20:38 | |
| *** therve has quit IRC | 20:38 | |
| *** stevemar has quit IRC | 20:38 | |
| *** notmyname has quit IRC | 20:38 | |
| *** chlong has quit IRC | 20:38 | |
| *** rharwood has quit IRC | 20:38 | |
| *** swartulv has quit IRC | 20:38 | |
| *** xxj has quit IRC | 20:38 | |
| *** trey has quit IRC | 20:38 | |
| *** dguerri has quit IRC | 20:38 | |
| *** harlowja has quit IRC | 20:38 | |
| *** gokrokve has quit IRC | 20:38 | |
| *** packet has quit IRC | 20:38 | |
| *** Ctina has quit IRC | 20:38 | |
| *** topol has quit IRC | 20:38 | |
| *** samueldmq has quit IRC | 20:38 | |
| *** alex_xu has quit IRC | 20:38 | |
| *** mkoderer has quit IRC | 20:38 | |
| *** dobson has quit IRC | 20:38 | |
| *** amakarov has quit IRC | 20:38 | |
| *** jimbaker has quit IRC | 20:38 | |
| *** Qlawy has quit IRC | 20:38 | |
| *** thedodd has quit IRC | 20:38 | |
| *** mattfarina has quit IRC | 20:38 | |
| *** mitz has quit IRC | 20:38 | |
| *** tsufiev_ has quit IRC | 20:38 | |
| *** jjulien has quit IRC | 20:38 | |
| *** kragniz has quit IRC | 20:38 | |
| *** ekarlso has quit IRC | 20:38 | |
| *** radez_g0n3 has quit IRC | 20:38 | |
| *** telemonster has quit IRC | 20:38 | |
| *** chmouel has quit IRC | 20:38 | |
| *** wpf has quit IRC | 20:38 | |
| *** dhellmann has quit IRC | 20:38 | |
| *** a2hill has quit IRC | 20:38 | |
| *** rodrigods has quit IRC | 20:38 | |
| *** jorge_munoz has quit IRC | 20:38 | |
| *** gyee has quit IRC | 20:38 | |
| *** carlosmarin has quit IRC | 20:38 | |
| *** gordc has quit IRC | 20:38 | |
| *** josecastroleon has quit IRC | 20:38 | |
| *** serverascode has quit IRC | 20:38 | |
| *** jraim has quit IRC | 20:38 | |
| *** mhu has quit IRC | 20:38 | |
| *** d0ugal has quit IRC | 20:38 | |
| *** lbragstad has quit IRC | 20:38 | |
| *** crinkle has quit IRC | 20:38 | |
| *** amaurymedeiros has quit IRC | 20:38 | |
| *** evilrob has quit IRC | 20:38 | |
| *** rdo_ has quit IRC | 20:38 | |
| *** jell has quit IRC | 20:38 | |
| *** esp has quit IRC | 20:38 | |
| *** csd has quit IRC | 20:38 | |
| *** quack_quack_ has quit IRC | 20:38 | |
| *** hugokuo has quit IRC | 20:38 | |
| *** jacorob has quit IRC | 20:38 | |
| *** dolphm has quit IRC | 20:38 | |
| *** mancdaz has quit IRC | 20:38 | |
| *** adam_g has quit IRC | 20:38 | |
| *** hockeynut has quit IRC | 20:38 | |
| *** arif-ali has quit IRC | 20:38 | |
| *** andreaf_ has quit IRC | 20:38 | |
| *** zzzeek has quit IRC | 20:38 | |
| *** jdennis has quit IRC | 20:38 | |
| *** toddnni has quit IRC | 20:38 | |
| *** anteaya has quit IRC | 20:38 | |
| *** lvh has quit IRC | 20:38 | |
| *** esmute has quit IRC | 20:38 | |
| *** arunkant has quit IRC | 20:38 | |
| *** baffle_ has quit IRC | 20:38 | |
| *** davechen_ has quit IRC | 20:38 | |
| *** jbonjean has quit IRC | 20:38 | |
| *** HenryG has quit IRC | 20:38 | |
| *** navid_ has quit IRC | 20:38 | |
| *** vhoward has quit IRC | 20:38 | |
| *** avozza has quit IRC | 20:38 | |
| *** charz has quit IRC | 20:38 | |
| *** mfisch has quit IRC | 20:38 | |
| *** marekd has quit IRC | 20:38 | |
| *** angelamolock has quit IRC | 20:38 | |
| *** sriram has quit IRC | 20:38 | |
| *** raildo has quit IRC | 20:38 | |
| *** ctracey has quit IRC | 20:38 | |
| *** vishy has quit IRC | 20:38 | |
| *** redrobot has quit IRC | 20:38 | |
| *** wolsen_ has quit IRC | 20:38 | |
| *** tristanC has quit IRC | 20:38 | |
| *** rushiagr has quit IRC | 20:38 | |
| *** boris-42 has quit IRC | 20:38 | |
| *** morganfainberg has quit IRC | 20:38 | |
| *** nonameentername has quit IRC | 20:38 | |
| *** BAKfr has quit IRC | 20:38 | |
| *** gsilvis has quit IRC | 20:38 | |
| *** erkules has quit IRC | 20:38 | |
| *** achudnovets_ has quit IRC | 20:38 | |
| *** dstanek has quit IRC | 20:38 | |
| *** henrynash has joined #openstack-keystone | 20:44 | |
| *** joesavak has joined #openstack-keystone | 20:44 | |
| *** cyeoh has joined #openstack-keystone | 20:44 | |
| *** timcline has joined #openstack-keystone | 20:44 | |
| *** mgagne_ has joined #openstack-keystone | 20:44 | |
| *** EmilienM has joined #openstack-keystone | 20:44 | |
| *** dtroyer_zz has joined #openstack-keystone | 20:44 | |
| *** rm_work has joined #openstack-keystone | 20:44 | |
| *** jamielennox has joined #openstack-keystone | 20:44 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 20:44 | |
| *** dutsmoc has joined #openstack-keystone | 20:44 | |
| *** thedodd has joined #openstack-keystone | 20:44 | |
| *** stevemar has joined #openstack-keystone | 20:44 | |
| *** atiwari1 has joined #openstack-keystone | 20:44 | |
| *** nkinder has joined #openstack-keystone | 20:44 | |
| *** dims has joined #openstack-keystone | 20:44 | |
| *** keystonelpbug has joined #openstack-keystone | 20:44 | |
| *** harlowja has joined #openstack-keystone | 20:44 | |
| *** david8hu has joined #openstack-keystone | 20:44 | |
| *** markvoelker has joined #openstack-keystone | 20:44 | |
| *** ksavich_ has joined #openstack-keystone | 20:44 | |
| *** gokrokve has joined #openstack-keystone | 20:44 | |
| *** openstackgerrit has joined #openstack-keystone | 20:44 | |
| *** jorge_munoz has joined #openstack-keystone | 20:44 | |
| *** gyee has joined #openstack-keystone | 20:44 | |
| *** sendak.freenode.net sets mode: +vvvv henrynash jamielennox stevemar gyee | 20:44 | |
| *** angelamolock has joined #openstack-keystone | 20:44 | |
| *** tqtran has joined #openstack-keystone | 20:44 | |
| *** _cjones_ has joined #openstack-keystone | 20:44 | |
| *** lhcheng has joined #openstack-keystone | 20:44 | |
| *** notmyname has joined #openstack-keystone | 20:44 | |
| *** abhirc has joined #openstack-keystone | 20:44 | |
| *** rwsu has joined #openstack-keystone | 20:44 | |
| *** chrisshattuck has joined #openstack-keystone | 20:44 | |
| *** svasheka has joined #openstack-keystone | 20:44 | |
| *** arif-ali has joined #openstack-keystone | 20:44 | |
| *** packet has joined #openstack-keystone | 20:44 | |
| *** andreaf_ has joined #openstack-keystone | 20:44 | |
| *** carlosmarin has joined #openstack-keystone | 20:44 | |
| *** zzzeek has joined #openstack-keystone | 20:44 | |
| *** gordc has joined #openstack-keystone | 20:44 | |
| *** Ctina has joined #openstack-keystone | 20:44 | |
| *** r-daneel has joined #openstack-keystone | 20:44 | |
| *** topol has joined #openstack-keystone | 20:44 | |
| *** richm has joined #openstack-keystone | 20:44 | |
| *** mattfarina has joined #openstack-keystone | 20:44 | |
| *** sendak.freenode.net sets mode: +v topol | 20:44 | |
| *** sriram has joined #openstack-keystone | 20:44 | |
| *** bknudson has joined #openstack-keystone | 20:44 | |
| *** tellesnobrega has joined #openstack-keystone | 20:44 | |
| *** marg7175 has joined #openstack-keystone | 20:44 | |
| *** samueldmq has joined #openstack-keystone | 20:44 | |
| *** josecastroleon has joined #openstack-keystone | 20:44 | |
| *** pnavarro has joined #openstack-keystone | 20:44 | |
| *** bjornar has joined #openstack-keystone | 20:44 | |
| *** erkules has joined #openstack-keystone | 20:44 | |
| *** gabriel-bezerra has joined #openstack-keystone | 20:44 | |
| *** htruta has joined #openstack-keystone | 20:44 | |
| *** fifieldt has joined #openstack-keystone | 20:44 | |
| *** chlong has joined #openstack-keystone | 20:44 | |
| *** jasondotstar has joined #openstack-keystone | 20:44 | |
| *** raildo has joined #openstack-keystone | 20:44 | |
| *** evilrob has joined #openstack-keystone | 20:44 | |
| *** zhiyan has joined #openstack-keystone | 20:44 | |
| *** serverascode has joined #openstack-keystone | 20:44 | |
| *** jdennis has joined #openstack-keystone | 20:44 | |
| *** ctracey has joined #openstack-keystone | 20:44 | |
| *** vishy has joined #openstack-keystone | 20:44 | |
| *** aslaen has joined #openstack-keystone | 20:44 | |
| *** vhoward has joined #openstack-keystone | 20:44 | |
| *** jraim has joined #openstack-keystone | 20:44 | |
| *** redrobot has joined #openstack-keystone | 20:44 | |
| *** f13o has joined #openstack-keystone | 20:44 | |
| *** mitz has joined #openstack-keystone | 20:44 | |
| *** g2` has joined #openstack-keystone | 20:44 | |
| *** ayoung has joined #openstack-keystone | 20:44 | |
| *** andreaf has joined #openstack-keystone | 20:44 | |
| *** wpf has joined #openstack-keystone | 20:44 | |
| *** toddnni has joined #openstack-keystone | 20:44 | |
| *** grantbow has joined #openstack-keystone | 20:44 | |
| *** larsks has joined #openstack-keystone | 20:44 | |
| *** tsufiev_ has joined #openstack-keystone | 20:44 | |
| *** saltsa has joined #openstack-keystone | 20:44 | |
| *** anteaya has joined #openstack-keystone | 20:44 | |
| *** mhu has joined #openstack-keystone | 20:44 | |
| *** d0ugal has joined #openstack-keystone | 20:44 | |
| *** rharwood has joined #openstack-keystone | 20:44 | |
| *** dhellmann has joined #openstack-keystone | 20:44 | |
| *** lbragstad has joined #openstack-keystone | 20:44 | |
| *** a2hill has joined #openstack-keystone | 20:44 | |
| *** lvh has joined #openstack-keystone | 20:44 | |
| *** esmute has joined #openstack-keystone | 20:44 | |
| *** sendak.freenode.net sets mode: +vv bknudson ayoung | 20:44 | |
| *** crinkle has joined #openstack-keystone | 20:44 | |
| *** swartulv has joined #openstack-keystone | 20:44 | |
| *** xxj has joined #openstack-keystone | 20:44 | |
| *** amaurymedeiros has joined #openstack-keystone | 20:44 | |
| *** x58 has joined #openstack-keystone | 20:44 | |
| *** arunkant has joined #openstack-keystone | 20:44 | |
| *** baffle_ has joined #openstack-keystone | 20:44 | |
| *** davechen_ has joined #openstack-keystone | 20:44 | |
| *** breton has joined #openstack-keystone | 20:44 | |
| *** wolsen_ has joined #openstack-keystone | 20:44 | |
| *** rodrigods has joined #openstack-keystone | 20:44 | |
| *** david-lyle has joined #openstack-keystone | 20:44 | |
| *** rdo_ has joined #openstack-keystone | 20:44 | |
| *** jjulien has joined #openstack-keystone | 20:44 | |
| *** lsmola has joined #openstack-keystone | 20:44 | |
| *** xianghui has joined #openstack-keystone | 20:44 | |
| *** kragniz has joined #openstack-keystone | 20:44 | |
| *** tristanC has joined #openstack-keystone | 20:44 | |
| *** rushiagr has joined #openstack-keystone | 20:44 | |
| *** gothicmindfood has joined #openstack-keystone | 20:44 | |
| *** boris-42 has joined #openstack-keystone | 20:44 | |
| *** zigo has joined #openstack-keystone | 20:44 | |
| *** gsilvis has joined #openstack-keystone | 20:44 | |
| *** Nakato has joined #openstack-keystone | 20:44 | |
| *** jbonjean has joined #openstack-keystone | 20:44 | |
| *** alex_xu has joined #openstack-keystone | 20:44 | |
| *** HenryG has joined #openstack-keystone | 20:44 | |
| *** hogepodge has joined #openstack-keystone | 20:44 | |
| *** ChanServ has joined #openstack-keystone | 20:44 | |
| *** gus has joined #openstack-keystone | 20:44 | |
| *** trey has joined #openstack-keystone | 20:44 | |
| *** jell has joined #openstack-keystone | 20:44 | |
| *** morganfainberg has joined #openstack-keystone | 20:44 | |
| *** dougwig has joined #openstack-keystone | 20:44 | |
| *** sudorandom has joined #openstack-keystone | 20:44 | |
| *** jamiec has joined #openstack-keystone | 20:44 | |
| *** mkoderer has joined #openstack-keystone | 20:44 | |
| *** dobson has joined #openstack-keystone | 20:44 | |
| *** amakarov has joined #openstack-keystone | 20:44 | |
| *** jimbaker has joined #openstack-keystone | 20:44 | |
| *** Qlawy has joined #openstack-keystone | 20:44 | |
| *** dguerri has joined #openstack-keystone | 20:44 | |
| *** wanghong has joined #openstack-keystone | 20:44 | |
| *** therve has joined #openstack-keystone | 20:44 | |
| *** navid_ has joined #openstack-keystone | 20:44 | |
| *** sendak.freenode.net sets mode: +ov ChanServ morganfainberg | 20:44 | |
| *** nonameentername has joined #openstack-keystone | 20:44 | |
| *** esp has joined #openstack-keystone | 20:44 | |
| *** avozza has joined #openstack-keystone | 20:44 | |
| *** csd has joined #openstack-keystone | 20:44 | |
| *** ekarlso has joined #openstack-keystone | 20:44 | |
| *** BAKfr has joined #openstack-keystone | 20:44 | |
| *** achudnovets_ has joined #openstack-keystone | 20:44 | |
| *** charz has joined #openstack-keystone | 20:44 | |
| *** mfisch has joined #openstack-keystone | 20:44 | |
| *** radez_g0n3 has joined #openstack-keystone | 20:44 | |
| *** dstanek has joined #openstack-keystone | 20:44 | |
| *** hockeynut has joined #openstack-keystone | 20:44 | |
| *** adam_g has joined #openstack-keystone | 20:44 | |
| *** mancdaz has joined #openstack-keystone | 20:44 | |
| *** dolphm has joined #openstack-keystone | 20:44 | |
| *** jacorob has joined #openstack-keystone | 20:44 | |
| *** hugokuo has joined #openstack-keystone | 20:44 | |
| *** quack_quack_ has joined #openstack-keystone | 20:44 | |
| *** marekd has joined #openstack-keystone | 20:44 | |
| *** telemonster has joined #openstack-keystone | 20:44 | |
| *** chmouel has joined #openstack-keystone | 20:44 | |
| *** sendak.freenode.net sets mode: +vo dstanek dolphm | 20:44 | |
| ayoung | or we could keep an IdP to domain mapping in a separate table | 20:44 |
| morganfainberg | user/group should be pretty easy as is | 20:44 |
| ayoung | that would be the most flexible, allowing many-to-many should we need to embrace that madness | 20:44 |
| morganfainberg | and idp -> domain looks to be a separate table since in the future you likely will have many-to-many | 20:44 |
| morganfainberg | yeah | 20:44 |
| ayoung | so, if lets say we have an idP_domain mapping table, and then domainess could be determined by any entry in there | 20:45 |
| morganfainberg | ayoung, i'd rather not use soft logic like that | 20:45 |
| morganfainberg | ayoung, i'd rather only allow IDPs to be mapped to projects that are domains | 20:45 |
| ayoung | a falg is more explicit, and allows us to have domains not backed by any Idp | 20:45 |
| morganfainberg | and i think that is a more flexible usecase | 20:45 |
| ayoung | So, is there really any call for a domain table then? | 20:45 |
| morganfainberg | nah | 20:46 |
| ayoung | Or is flag sufficient for all known issues? | 20:46 |
| morganfainberg | and it simplifies the schema | 20:46 |
| rodrigods | stevemar, yes... I guess all the steps were taken | 20:46 |
| morganfainberg | probably cheaper to have IS_DOMAIN: True | 20:46 |
| *** Farhan has joined #openstack-keystone | 20:46 | |
| rodrigods | stevemar, we just need to be added in the gerrit group :) | 20:46 |
| morganfainberg | than relationship(domain).load | 20:46 |
| *** Amy_ has joined #openstack-keystone | 20:46 | |
| morganfainberg | and a bit more straightforward | 20:46 |
| ayoung | OK, so domains will have the domain flag set. What other migration logic do we need | 20:46 |
| ayoung | does a domain have a domain_id value set? If so, what does it mean? | 20:47 |
| morganfainberg | domain_id is set on a domain only in the case it is subdomain | 20:47 |
| ayoung | OK | 20:47 |
| morganfainberg | as it belongs to it's parent | 20:47 |
| ayoung | but I would have thought we would use parent_id for that | 20:47 |
| morganfainberg | from the project angle | 20:47 |
| morganfainberg | if it is a project it should act like one | 20:48 |
| ayoung | keeping both domain and parent id will confuse people, although I think we must do so | 20:48 |
| *** angelamolock has quit IRC | 20:48 | |
| morganfainberg | projects are tied to domains, so simply domain_id is consistency | 20:48 |
| ayoung | its like if every directory entry in the OS had a link to root | 20:49 |
| raildo | ayoung, but a project have a domain_id and a parent_id (other project) | 20:49 |
| ayoung | domain_id should probably be calculated, not recorded | 20:49 |
| morganfainberg | ayoung, that would probably be too expensive for times we need domain_id | 20:49 |
| morganfainberg | having to recurse the hierarchy to find the domain id is ... potentially bad | 20:50 |
| ayoung | hierarchical queries? Yeah, that is expensive | 20:50 |
| ayoung | although dogpile would probably mitigate | 20:50 |
| morganfainberg | caching helps, but we can't assume people will enable it | 20:50 |
| ayoung | CRUD!. School just got cancelled for tomorrow, too | 20:51 |
| morganfainberg | snooooow | 20:51 |
| morganfainberg | SNOW! | 20:51 |
| ayoung | It is really nice snow, too | 20:51 |
| ayoung | light, like Utah powder | 20:51 |
| ayoung | it was cold, not the heavy wet stuff we usually get | 20:51 |
| raildo | i don't know what is thishahaha | 20:51 |
| raildo | is this* | 20:51 |
| morganfainberg | i want snow :( | 20:51 |
| ayoung | I got out there early to shovel to move it while it was easier | 20:52 |
| * morganfainberg needs to escape SoCal. | 20:52 | |
| ayoung | I think we have another 1-3 inches inboud, but the majority of it has landed | 20:52 |
| *** rushiagr is now known as rushiagr_away | 20:53 | |
| ayoung | morganfainberg, OK, so domain is the "owning domain" and a domain does not own itself. Is that our story? | 20:53 |
| morganfainberg | correct | 20:53 |
| *** radez_g0n3 is now known as radez | 20:53 | |
| bknudson | better than heavy snow, like a clam chowder. | 20:53 |
| ayoung | So the migration then: | 20:53 |
| ayoung | for each entry in the domain table, create an entry in the project table | 20:53 |
| ayoung | domainid becomes project id | 20:53 |
| ayoung | and...the domain flag gets set | 20:54 |
| ayoung | is that it? | 20:54 |
| morganfainberg | sounds about right | 20:54 |
| morganfainberg | drop domain_table | 20:54 |
| ayoung | oh...and then for every project in the domain that has no parent_id, set it to the domain id? | 20:54 |
| morganfainberg | yep | 20:55 |
| raildo | omg, we have a solution *-* | 20:55 |
| ayoung | Yeah. | 20:55 |
| ayoung | would love to make parent_id a required field | 20:55 |
| morganfainberg | ayoung, you can, but it needs to be nullable in the root case | 20:55 |
| ayoung | could we somehow make a root-of-all-evil-domain | 20:55 |
| stevemar | rodrigods, hmmm | 20:55 |
| raildo | I'll drink a beer today, to celebrate. | 20:55 |
| morganfainberg | *or* we need a special magic string for the root-case | 20:55 |
| ayoung | morganfainberg, what if we create a root domain that is the parent, and it owns itself? | 20:56 |
| morganfainberg | "_YOU_CANT_NAME_YOUR_DOMAIN_THIS_CAUSE_IT_IS_OUR_SPECIAL_THING_" | 20:56 |
| ayoung | "I'm my own grandpa" | 20:56 |
| rodrigods | ayoung, heheheh | 20:56 |
| stevemar | rodrigods, pip install oslo.policy doesn't work though :( | 20:56 |
| rodrigods | lol | 20:56 |
| morganfainberg | ayoung, i was advocating for a long time we should have a "openstack" or "keystone" top-level root | 20:56 |
| rodrigods | stevemar, isn't released yet :( | 20:56 |
| ayoung | Let's do it | 20:56 |
| morganfainberg | that we can treat kinda specail like we do "default" | 20:56 |
| rodrigods | stevemar, think the only person in the release group is dhellmann | 20:56 |
| stevemar | oh | 20:57 |
| morganfainberg | rodrigods, oslo-release can as well | 20:57 |
| morganfainberg | which also may only be dhellmann | 20:57 |
| raildo | ok, I'll update the spec and update the sql migration script :) | 20:57 |
| rodrigods | morganfainberg, yes | 20:57 |
| stevemar | :) | 20:57 |
| stevemar | alright then | 20:57 |
| morganfainberg | ayoung, lets just rename project back to tenant while we're at it | 20:57 |
| morganfainberg | ayoung, then we'll have gone full circle | 20:58 |
| ayoung | morganfainberg, OK | 20:58 |
| morganfainberg | bknudson, ^ cc :) | 20:58 |
| ayoung | morganfainberg, domains and projects are types of tenants | 20:58 |
| morganfainberg | ayoung, /doesn't feel like being lynched by the operators | 20:58 |
| *** Amy_ has quit IRC | 20:58 | |
| bknudson | most haven't changed to project yet, so they wouldn't notice. | 20:59 |
| ayoung | morganfainberg, the thing is, I don't know if we could pull it off. I think we actually could. "look guys, we realize you like tenants, so we concede the point." | 20:59 |
| morganfainberg | ayoung, i think we'd be shot | 20:59 |
| *** rushiagr_away is now known as rushiagr | 20:59 | |
| rodrigods | ++ | 20:59 |
| rodrigods | +100 | 20:59 |
| morganfainberg | but it would be better overall (unfortunately) | 20:59 |
| morganfainberg | tenant is a less overloaded term | 20:59 |
| ayoung | morganfainberg, I think rodrigods is giving range estimates to the snipers | 20:59 |
| rodrigods | stevemar, seems like there are 3 people in the world that could do a release for oslo.policy https://review.openstack.org/#/admin/groups/148,members | 21:00 |
| morganfainberg | ayoung, thankfully the snipers can't hit me from brazil yet.. | 21:00 |
| ayoung | rodrigods, I might be able to add more people to that group | 21:00 |
| rodrigods | heh | 21:00 |
| ayoung | Oooh, no | 21:00 |
| rodrigods | ayoung, and the core ones? so I could give a +2? :O | 21:00 |
| ayoung | Meeting time | 21:00 |
| raildo | morganfainberg, ayoung so, i have to go now, but I'll send a new patch today, thanks a lot for the help :) | 21:02 |
| ayoung | raildo, thanks | 21:02 |
| *** _cjones_ has quit IRC | 21:02 | |
| raildo | ayoung, :D | 21:03 |
| *** raildo is now known as raildo_away | 21:04 | |
| *** joesavak has quit IRC | 21:07 | |
| *** g2` has quit IRC | 21:08 | |
| *** abhirc has quit IRC | 21:13 | |
| *** rushiagr is now known as rushiagr_away | 21:15 | |
| *** atiwari1 has quit IRC | 21:17 | |
| *** atiwari1 has joined #openstack-keystone | 21:18 | |
| *** gokrokve has quit IRC | 21:21 | |
| *** abhirc has joined #openstack-keystone | 21:22 | |
| *** nellysmitt has joined #openstack-keystone | 21:22 | |
| *** stevemar has quit IRC | 21:28 | |
| *** stevemar has joined #openstack-keystone | 21:28 | |
| *** ChanServ sets mode: +v stevemar | 21:28 | |
| *** nellysmitt has quit IRC | 21:29 | |
| *** harlowja has quit IRC | 21:35 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move projects and domains to their own backend https://review.openstack.org/144824 | 21:36 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a wip decorator for tests https://review.openstack.org/131516 | 21:43 |
| *** nkinder has quit IRC | 21:43 | |
| *** gokrokve has joined #openstack-keystone | 21:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused pointer to assignment in identity driver https://review.openstack.org/145022 | 21:48 |
| *** g2` has joined #openstack-keystone | 21:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make controllers and managers reference new resource manager https://review.openstack.org/133525 | 21:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make unit tests call the new resource manager https://review.openstack.org/130954 | 21:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 21:51 |
| *** _cjones_ has joined #openstack-keystone | 21:55 | |
| *** nkinder has joined #openstack-keystone | 21:56 | |
| *** tellesnobrega_ has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Merged openstack/pycadf: Pull out some CADF taxonomy to be constants https://review.openstack.org/149011 | 22:00 |
| *** mattfarina has quit IRC | 22:07 | |
| *** radez is now known as radez_g0n3 | 22:17 | |
| *** joesavak has joined #openstack-keystone | 22:17 | |
| *** sriram has quit IRC | 22:31 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 22:35 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 22:35 |
| *** gordc has quit IRC | 22:37 | |
| *** _d34dh0r53_ is now known as d34dh0r53 | 22:38 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use RequestBodySizeLimiter from oslo.middleware https://review.openstack.org/144697 | 22:38 |
| *** atiwari2 has joined #openstack-keystone | 22:39 | |
| *** topol has quit IRC | 22:41 | |
| *** atiwari1 has quit IRC | 22:42 | |
| *** angelamolock has joined #openstack-keystone | 22:44 | |
| *** harlowja has joined #openstack-keystone | 22:44 | |
| *** nkinder has quit IRC | 22:45 | |
| *** pnavarro has quit IRC | 22:47 | |
| *** andreaf_ has quit IRC | 22:49 | |
| *** harlowja_ has joined #openstack-keystone | 22:49 | |
| *** harlowja has quit IRC | 22:50 | |
| *** dhellmann has quit IRC | 22:54 | |
| *** angelamolock has quit IRC | 22:55 | |
| *** dhellmann has joined #openstack-keystone | 22:55 | |
| *** angelamolock has joined #openstack-keystone | 22:56 | |
| *** tellesnobrega_ has quit IRC | 22:59 | |
| *** timcline has quit IRC | 22:59 | |
| *** joesavak has quit IRC | 23:01 | |
| stevemar | q for anyone | 23:01 |
| *** henrynash has quit IRC | 23:01 | |
| stevemar | is 'user_enabled_attribute' supposed to actually be used? | 23:02 |
| stevemar | there are no instances of it in the code | 23:02 |
| stevemar | just in tests and config.py | 23:02 |
| *** harlowja_ has quit IRC | 23:03 | |
| richm | stevemar: yes, I'm using it | 23:04 |
| stevemar | richm, what do you set it to? | 23:06 |
| stevemar | richm, i'm not actually seeing it used anywhere | 23:06 |
| bknudson | stevemar: it's set up here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/ldap/core.py#n1177 | 23:06 |
| bknudson | stevemar: see http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap.py#n200 | 23:07 |
| stevemar | ah thanks bknudson | 23:07 |
| richm | stevemar: for MS AD you probably want to use userAccountControl - for 389/IPA you probably want to use nsAccountLock (with the invert thing) | 23:07 |
| bknudson | richm: it would be good to have that info in the help text. | 23:08 |
| stevemar | the userAccountControl one is there | 23:08 |
| richm | that's probably the most common for folks who use AD | 23:09 |
| *** bknudson has quit IRC | 23:12 | |
| *** carlosmarin has quit IRC | 23:13 | |
| *** angelamolock has quit IRC | 23:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Register token_endpoint as a loadable plugin https://review.openstack.org/150615 | 23:17 |
| *** evilrob has quit IRC | 23:20 | |
| *** ljfisher has joined #openstack-keystone | 23:22 | |
| *** ljfisher has quit IRC | 23:22 | |
| stevemar | bah no more bknudson | 23:27 |
| stevemar | richm, trying to figure out where this guy actually gets called https://github.com/openstack/keystone/blob/7541fda1db8290f639e19420b7ac3f683aab27a5/keystone/identity/backends/ldap.py#L217-L235 | 23:27 |
| stevemar | i'm supplying an attribute for user_enabled_attribute, and setting the invert flag to true, but it's not flipping it | 23:28 |
| *** mgagne_ is now known as mgagne | 23:29 | |
| *** nellysmitt has joined #openstack-keystone | 23:29 | |
| *** nellysmitt has quit IRC | 23:34 | |
| *** markvoelker has quit IRC | 23:35 | |
| *** harlowja has joined #openstack-keystone | 23:36 | |
| *** Ctina_ has joined #openstack-keystone | 23:36 | |
| *** Ctina has quit IRC | 23:40 | |
| *** Ctina_ has quit IRC | 23:41 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add schema for endpoint group https://review.openstack.org/150292 | 23:42 |
| richm | stevemar: hmm - not sure - I haven't tried the invert thing yet | 23:49 |
| jamielennox | morganfainberg: for the federation plugins should i be attempting to keep the history or just copy? | 23:50 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 23:52 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 23:54 |
| *** markvoelker has joined #openstack-keystone | 23:55 | |
| *** greghaynes has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!