| *** henrynash has joined #openstack-keystone | 00:00 | |
| *** ChanServ sets mode: +v henrynash | 00:00 | |
| *** chrisshattuck has quit IRC | 00:00 | |
| morganfainberg | jamielennox, hm | 00:06 |
|---|---|---|
| morganfainberg | i'd like to keep history if possible | 00:06 |
| morganfainberg | but i don't mind either way | 00:06 |
| jamielennox | morganfainberg: it wont work through gerrit i think | 00:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use lower() correctly in _ldap_res_to_model https://review.openstack.org/150631 | 00:07 |
| morganfainberg | no you need to do it as an import | 00:07 |
| morganfainberg | if we already made the repo in gerrit | 00:07 |
| morganfainberg | don't worry about saving histyory | 00:07 |
| morganfainberg | it's not *that* important imo | 00:07 |
| jamielennox | agreed | 00:07 |
| jamielennox | morganfainberg: https://review.openstack.org/150627 | 00:07 |
| morganfainberg | loooks good at a glance minus pep8 issues | 00:08 |
| morganfainberg | we also need to get an integration test spun up for both plugins | 00:08 |
| morganfainberg | need to know it'll even load into ksc | 00:08 |
| jamielennox | morganfainberg: so i should put the tests into /unit/ right off the bat? | 00:10 |
| morganfainberg | those probably need to be hm | 00:18 |
| morganfainberg | unless ksc is loaded into environment it might nee a special test | 00:18 |
| morganfainberg | not sure | 00:18 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use proper string checking https://review.openstack.org/150634 | 00:21 |
| stevemar | dear ldap, you stink | 00:21 |
| stevemar | bye! | 00:21 |
| *** raildo has joined #openstack-keystone | 00:22 | |
| *** drjones has joined #openstack-keystone | 00:26 | |
| *** _cjones_ has quit IRC | 00:26 | |
| *** drjones has quit IRC | 00:29 | |
| *** _cjones_ has joined #openstack-keystone | 00:30 | |
| *** raildo has quit IRC | 00:31 | |
| *** thedodd has quit IRC | 00:32 | |
| jamielennox | does anyone know if oslosphinx figured out the autodoc thing | 00:32 |
| *** david-lyle is now known as david-lyle_afk | 00:33 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add schema for endpoint group https://review.openstack.org/150292 | 00:34 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 00:38 |
| *** gokrokve has quit IRC | 00:41 | |
| *** nkinder has joined #openstack-keystone | 00:46 | |
| *** atiwari2 has quit IRC | 00:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 00:48 |
| *** atiwari2 has joined #openstack-keystone | 00:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 00:50 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 00:51 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 00:53 |
| *** henrynash has quit IRC | 00:53 | |
| *** ncoghlan has joined #openstack-keystone | 01:02 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 01:05 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix up _ldap_res_to_model for ldap identity backend https://review.openstack.org/150631 | 01:08 |
| stevemar | gyee, thanks for reviewing, i combined them into 1 patch, for easier reviewing | 01:09 |
| stevemar | trying to think of a test for this... | 01:10 |
| lhcheng | hi folks, quick question on where to write the tests.. | 01:10 |
| lhcheng | planning to add some tests for endpoint group schema | 01:10 |
| lhcheng | not sure if this is the right place: https://github.com/openstack/keystone/blob/master/keystone/tests/test_validation.py | 01:11 |
| stevemar | lhcheng, i think it is | 01:11 |
| lhcheng | because endpoint group is an extension and not core | 01:11 |
| lhcheng | stevemar: okay, thanks for confirming! | 01:12 |
| *** tqtran has quit IRC | 01:13 | |
| stevemar | meh, everything is core now :P | 01:13 |
| stevemar | its 'stable' vs 'experimental' now | 01:13 |
| lhcheng | lol | 01:13 |
| lhcheng | makes life easier :P | 01:14 |
| stevemar | yes it does :P | 01:15 |
| *** Farhan has quit IRC | 01:16 | |
| *** lhcheng has quit IRC | 01:16 | |
| *** r-daneel has quit IRC | 01:19 | |
| *** dtroyer_zz has quit IRC | 01:20 | |
| *** packet has quit IRC | 01:20 | |
| *** arif-ali has quit IRC | 01:20 | |
| *** arif-ali has joined #openstack-keystone | 01:20 | |
| *** dtroyer has joined #openstack-keystone | 01:21 | |
| *** arif-ali has quit IRC | 01:27 | |
| *** arif-ali has joined #openstack-keystone | 01:27 | |
| *** dims has quit IRC | 01:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 01:30 |
| *** nellysmitt has joined #openstack-keystone | 01:30 | |
| *** gokrokve has joined #openstack-keystone | 01:32 | |
| jamielennox | here's a relatively easy review with one +2 already: https://review.openstack.org/#/c/131380/ | 01:33 |
| *** rwsu is now known as rwsu-afk | 01:33 | |
| jamielennox | longish but not hard | 01:33 |
| jamielennox | here's an almost trivial one with a +2 https://review.openstack.org/#/c/140871/ | 01:34 |
| *** nellysmitt has quit IRC | 01:35 | |
| *** arif-ali has quit IRC | 01:38 | |
| *** arif-ali has joined #openstack-keystone | 01:39 | |
| *** gokrokve has quit IRC | 01:40 | |
| *** gokrokve has joined #openstack-keystone | 01:40 | |
| *** timcline has joined #openstack-keystone | 01:44 | |
| *** timcline has quit IRC | 01:45 | |
| *** timcline has joined #openstack-keystone | 01:46 | |
| *** abhirc has quit IRC | 01:49 | |
| *** arif-ali has quit IRC | 01:50 | |
| *** gokrokve has quit IRC | 01:50 | |
| *** arif-ali has joined #openstack-keystone | 01:51 | |
| *** gokrokve has joined #openstack-keystone | 01:51 | |
| gyee | stevemar, cool | 01:55 |
| *** gokrokve has quit IRC | 01:55 | |
| *** gyee has quit IRC | 01:57 | |
| *** atiwari2 has quit IRC | 01:57 | |
| *** marg7175 has quit IRC | 02:06 | |
| *** marg7175 has joined #openstack-keystone | 02:08 | |
| *** _cjones_ has quit IRC | 02:08 | |
| *** abhirc has joined #openstack-keystone | 02:09 | |
| stevemar | got your back jamielennox | 02:17 |
| jamielennox | stevemar: ah reviews ? | 02:17 |
| stevemar | +2s | 02:18 |
| jamielennox | stevemar: sweet, thanks | 02:19 |
| jamielennox | stevemar: hey did you see we're going to start using the ksc-federation repo rather than ksc | 02:19 |
| jamielennox | i posted the first copy over review | 02:19 |
| *** hugokuo has quit IRC | 02:21 | |
| *** charz has quit IRC | 02:21 | |
| *** erkules_ has joined #openstack-keystone | 02:21 | |
| *** erkules has quit IRC | 02:24 | |
| *** charz has joined #openstack-keystone | 02:25 | |
| *** saikrishna has joined #openstack-keystone | 02:26 | |
| stevemar | i saw that, neat | 02:27 |
| stevemar | did the refactor go through? | 02:28 |
| stevemar | ah it's against ksc-fed now | 02:28 |
| *** hugokuo has joined #openstack-keystone | 02:29 | |
| stevemar | just one comment | 02:31 |
| jamielennox | stevemar: was going to add them in the refactor | 02:33 |
| jamielennox | the refactor renamed them anyay | 02:33 |
| stevemar | ah okay | 02:34 |
| *** saikrishna has quit IRC | 02:37 | |
| *** saikrishna has joined #openstack-keystone | 02:43 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:47 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix passing parameters to log message https://review.openstack.org/140871 | 02:49 |
| *** saikrishna has quit IRC | 02:52 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update requests-mock syntax https://review.openstack.org/131380 | 02:54 |
| *** junhongl has joined #openstack-keystone | 02:54 | |
| *** harlowja is now known as harlowja_away | 02:57 | |
| *** richm has quit IRC | 03:09 | |
| *** marg7175 has quit IRC | 03:14 | |
| *** kfox1111 has joined #openstack-keystone | 03:18 | |
| *** timcline has quit IRC | 03:19 | |
| *** timcline has joined #openstack-keystone | 03:19 | |
| *** oomichi_ has joined #openstack-keystone | 03:21 | |
| *** timcline has quit IRC | 03:24 | |
| *** kfox1111 has quit IRC | 03:27 | |
| *** marg7175 has joined #openstack-keystone | 03:28 | |
| *** nellysmitt has joined #openstack-keystone | 03:31 | |
| *** nellysmitt has quit IRC | 03:36 | |
| *** marg7175 has quit IRC | 03:39 | |
| *** chrisshattuck has joined #openstack-keystone | 03:50 | |
| *** markvoelker has quit IRC | 03:57 | |
| *** markvoelker has joined #openstack-keystone | 03:57 | |
| *** markvoelker has quit IRC | 04:02 | |
| *** rdo_ has quit IRC | 04:04 | |
| *** rdo has joined #openstack-keystone | 04:05 | |
| *** oomichi_ has quit IRC | 04:07 | |
| *** gordc has joined #openstack-keystone | 04:22 | |
| *** abhirc has quit IRC | 04:24 | |
| *** dims has joined #openstack-keystone | 04:29 | |
| *** gordc has quit IRC | 04:32 | |
| *** dims has quit IRC | 04:33 | |
| jamielennox | is there a developer access to one of the public clouds? my 2 factor auth tokens keep getting revoked and i get cut off from running tests.. | 04:36 |
| *** tellesnobrega_ has quit IRC | 04:37 | |
| *** lhcheng has joined #openstack-keystone | 04:46 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 04:51 |
| *** ajayaa has joined #openstack-keystone | 04:58 | |
| stevemar | hey jamielennox - any chance you could look @ my question here: https://review.openstack.org/#/c/142147/3/keystoneclient/tests/v3/test_tokens.py | 05:10 |
| stevemar | it's not like blk-u to make a mistake | 05:10 |
| stevemar | i'm trying to earn my citizenship | 05:12 |
| *** markvoelker has joined #openstack-keystone | 05:13 | |
| stevemar | apparently reviewing is the only way to earn it :( | 05:13 |
| *** wolsen_ is now known as wolsen | 05:15 | |
| *** dims has joined #openstack-keystone | 05:30 | |
| *** nellysmitt has joined #openstack-keystone | 05:32 | |
| *** markvoelker has quit IRC | 05:34 | |
| *** markvoelker has joined #openstack-keystone | 05:34 | |
| *** nellysmitt has quit IRC | 05:36 | |
| *** markvoelker has quit IRC | 05:39 | |
| *** chrisshattuck has quit IRC | 05:39 | |
| *** zzzeek has quit IRC | 05:43 | |
| *** oomichi_ has joined #openstack-keystone | 05:50 | |
| *** rushiagr_away is now known as rushiagr | 05:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/149158 | 06:04 |
| *** dims has quit IRC | 06:07 | |
| *** gokrokve has joined #openstack-keystone | 06:12 | |
| jamielennox | stevemar: i think that the mock will get picked up regardless of the query string | 06:15 |
| jamielennox | then later he asserts assertQueryStringContains(nocatalog=None) | 06:15 |
| jamielennox | which i'm not sure exactly, i assume that means just ?nocatalog rather than like /nocatalog=1 or something | 06:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix up _ldap_res_to_model for ldap identity backend https://review.openstack.org/150631 | 06:35 |
| *** markvoelker has joined #openstack-keystone | 06:35 | |
| *** zhiyuan has joined #openstack-keystone | 06:36 | |
| *** KanagarajM2 has joined #openstack-keystone | 06:36 | |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 06:38 |
| *** MasterPiece has joined #openstack-keystone | 06:41 | |
| *** markvoelker has quit IRC | 06:41 | |
| openstackgerrit | Merged openstack/pycadf: Add new CADF taxonomy types https://review.openstack.org/149013 | 06:48 |
| openstackgerrit | Mehdi Abaakouk proposed openstack/keystone-specs: tokens swift persistent backend https://review.openstack.org/131515 | 06:50 |
| *** gokrokve_ has joined #openstack-keystone | 06:52 | |
| *** gokrokve_ has quit IRC | 06:53 | |
| *** gokrokve_ has joined #openstack-keystone | 06:53 | |
| *** gokrokve has quit IRC | 06:56 | |
| *** gokrokve_ has quit IRC | 06:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 07:06 |
| *** afazekas has joined #openstack-keystone | 07:07 | |
| *** mzbik has joined #openstack-keystone | 07:12 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add schema for endpoint group https://review.openstack.org/150292 | 07:13 |
| *** avozza is now known as zz_avozza | 07:20 | |
| openstackgerrit | wanghong proposed openstack/python-keystoneclient: make req_ref doesn't require id https://review.openstack.org/148499 | 07:24 |
| stevemar | marekd, o/ | 07:26 |
| stevemar | marekd, i rebased and re-submitted a patch for the websso stuff for keystone | 07:28 |
| stevemar | try to take a look :) | 07:28 |
| openstackgerrit | guang-yee proposed openstack/keystone-specs: Tokenless authorization with X.509 SSL client certificate https://review.openstack.org/105913 | 07:28 |
| *** nellysmitt has joined #openstack-keystone | 07:33 | |
| *** stevemar has quit IRC | 07:33 | |
| *** jaosorior has joined #openstack-keystone | 07:35 | |
| *** markvoelker has joined #openstack-keystone | 07:38 | |
| *** nellysmitt has quit IRC | 07:38 | |
| *** zz_avozza is now known as avozza | 07:40 | |
| *** markvoelker has quit IRC | 07:43 | |
| *** erkules_ is now known as erkules | 07:45 | |
| *** avozza is now known as zz_avozza | 07:50 | |
| *** zz_avozza is now known as avozza | 07:54 | |
| mzbik | #neutron | 07:55 |
| mzbik | ups | 07:55 |
| *** mzbik has left #openstack-keystone | 07:56 | |
| *** mzbik has joined #openstack-keystone | 07:56 | |
| *** aix has joined #openstack-keystone | 07:58 | |
| *** avozza is now known as zz_avozza | 08:05 | |
| *** oomichi_ has quit IRC | 08:05 | |
| *** jamielennox is now known as jamielennox|away | 08:09 | |
| *** nellysmitt has joined #openstack-keystone | 08:12 | |
| *** markvoelker has joined #openstack-keystone | 08:13 | |
| *** markvoelker has quit IRC | 08:17 | |
| *** krykowski has joined #openstack-keystone | 08:25 | |
| *** zz_avozza is now known as avozza | 08:35 | |
| *** lhcheng has quit IRC | 08:41 | |
| *** lhcheng has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134125 | 08:45 |
| *** krykowski has quit IRC | 08:46 | |
| *** lhcheng has quit IRC | 08:46 | |
| *** ncoghlan has quit IRC | 08:47 | |
| *** krykowski has joined #openstack-keystone | 08:51 | |
| *** dims has joined #openstack-keystone | 09:08 | |
| *** pnavarro has joined #openstack-keystone | 09:09 | |
| *** dims has quit IRC | 09:13 | |
| *** markvoelker has joined #openstack-keystone | 09:14 | |
| *** markvoelker has quit IRC | 09:19 | |
| *** jistr has joined #openstack-keystone | 09:23 | |
| *** henrynash has joined #openstack-keystone | 09:35 | |
| *** ChanServ sets mode: +v henrynash | 09:35 | |
| *** rushiagr is now known as rushiagr_away | 09:47 | |
| *** henrynash has quit IRC | 09:47 | |
| *** krykowski has quit IRC | 09:49 | |
| *** rushiagr_away is now known as rushiagr | 09:52 | |
| *** krykowski has joined #openstack-keystone | 10:00 | |
| *** MasterPiece has quit IRC | 10:03 | |
| *** krykowski has quit IRC | 10:08 | |
| openstackgerrit | wanghong proposed openstack/python-keystoneclient: make req_ref doesn't require id https://review.openstack.org/148499 | 10:09 |
| *** krykowski has joined #openstack-keystone | 10:10 | |
| *** henrynash has joined #openstack-keystone | 10:13 | |
| *** ChanServ sets mode: +v henrynash | 10:13 | |
| *** markvoelker has joined #openstack-keystone | 10:15 | |
| openstackgerrit | Merged openstack/keystone: remove invalid note https://review.openstack.org/144566 | 10:16 |
| *** markvoelker has quit IRC | 10:22 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 10:23 |
| marekd | rodrigods: *^^ you can take a look now. | 10:24 |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 10:24 |
| *** tellesnobrega_ has joined #openstack-keystone | 10:36 | |
| *** tellesnobrega_ has quit IRC | 10:43 | |
| *** henrynash has quit IRC | 10:47 | |
| *** openstackgerrit has quit IRC | 10:50 | |
| *** openstackgerrit has joined #openstack-keystone | 10:50 | |
| *** tellesnobrega has quit IRC | 10:58 | |
| *** gabriel-bezerra has quit IRC | 10:58 | |
| *** tellesnobrega has joined #openstack-keystone | 10:59 | |
| *** gabriel-bezerra has joined #openstack-keystone | 10:59 | |
| *** htruta has quit IRC | 10:59 | |
| *** htruta has joined #openstack-keystone | 10:59 | |
| *** mflobo1 has joined #openstack-keystone | 11:00 | |
| *** mflobo1 has left #openstack-keystone | 11:01 | |
| *** krykowski has quit IRC | 11:01 | |
| *** mflobo1 has joined #openstack-keystone | 11:02 | |
| *** mflobo1 has left #openstack-keystone | 11:02 | |
| *** mflobo1 has joined #openstack-keystone | 11:02 | |
| *** aix has quit IRC | 11:06 | |
| *** avozza is now known as zz_avozza | 11:07 | |
| *** marg7175 has joined #openstack-keystone | 11:08 | |
| *** zz_avozza is now known as avozza | 11:08 | |
| *** aix has joined #openstack-keystone | 11:18 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Allow for direct mapping in federated authN. https://review.openstack.org/149071 | 11:20 |
| *** henrynash has joined #openstack-keystone | 11:24 | |
| *** ChanServ sets mode: +v henrynash | 11:24 | |
| *** krykowski has joined #openstack-keystone | 11:24 | |
| *** xxj has quit IRC | 11:26 | |
| *** wpf has quit IRC | 11:26 | |
| samueldmq | henrynash, hi | 11:26 |
| henrynash | samueldmq: hi | 11:26 |
| samueldmq | henrynash, saw your comments on the refactoring of expected entities on test_v3_assignment, where I introduced regex | 11:27 |
| samueldmq | henrynash, well, that makes sense to me (your comment) | 11:27 |
| samueldmq | henrynash, otherwise we'll need to have tests for those tests, and at some point we have to stop being simple enough to ensure we didnt do any mistakes | 11:28 |
| henrynash | samueldmq: it’s just hard to understand whether the test is correct from looking at it…. | 11:28 |
| samueldmq | henrynash, and it's better to stop that at usual tests, instead of adding additional layers of testing | 11:28 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 11:29 |
| henrynash | samueldmq: I guess I’m OK with regex if it really is the best way of doing things, but we’d need to make it really clear from reviewers what is going on…..and right now, we don’t… | 11:30 |
| henrynash | samueldmq: so…either we need to a but more simple…or explain what we are doing better | 11:30 |
| samueldmq | henrynash, agree | 11:30 |
| samueldmq | henrynash, in fact that help a lot for new tests I created | 11:30 |
| *** MasterPiece has joined #openstack-keystone | 11:30 | |
| samueldmq | henrynash, because if I only filter by users, I assert the user I filtered is in the entity, doesnt matter other info | 11:31 |
| samueldmq | henrynash, I just don't care | 11:31 |
| samueldmq | henrynash, and then I assert the assignment link matches with user as well ... (saying this just to let you know the reason I did that) | 11:32 |
| henrynash | sammueldmq: yes, I got the gist that this was to stop having to create teh link as a separate item and carry that around for test checking... | 11:33 |
| henrynash | samueldmq: so it maybe that if you explain that clearly then we’re OK here….. | 11:34 |
| henrynash | samueldmq: now, my data-driven-tests could be said to suffer the same problem…but I would argue (and I would, ‘cause I wrote them) that in teh data-driven tests it is VERY obvious what scenarios I’m trying to test, but you have to still believe the support code works correctly | 11:34 |
| henrynash | samueldmq: …oh, and btw, more of those pass now with your latest patch of pushing down the filters into list_role_assignments…but not all, so I think we still have something wrong in your patcj | 11:35 |
| *** marg7175 has quit IRC | 11:37 | |
| *** marg7175 has joined #openstack-keystone | 11:38 | |
| *** krykowski has quit IRC | 11:38 | |
| *** KanagarajM2 has quit IRC | 11:42 | |
| *** xxj has joined #openstack-keystone | 11:42 | |
| *** wpf has joined #openstack-keystone | 11:43 | |
| samueldmq | henrynash, oh .. :/ | 11:44 |
| samueldmq | henrynash, I'll do some scrum process now at morning, after this I will take it and fix what is wrong once for all | 11:45 |
| henrynash | samueldmq: see: http://paste.openstack.org/show/163162/ | 11:45 |
| samueldmq | henrynash, looking | 11:45 |
| samueldmq | henrynash, strange, domain and project assignments have not the same role id | 11:46 |
| openstackgerrit | Wu Wenxiang proposed openstack/python-keystoneclient: Add python-memcached in test-requirements.txt https://review.openstack.org/150759 | 11:46 |
| samueldmq | henrynash, firstly I suspected I could had expanded and forget to remove original entity, but no | 11:47 |
| henrynash | samueldq: and here is teh test plan:http://paste.openstack.org/show/163164/ | 11:47 |
| henrynash | smaueldmq: http://paste.openstack.org/show/163164/ | 11:47 |
| samueldmq | henrynash, lookin | 11:47 |
| henrynash | samueldmq: it is the last test that fails, we get back the inherited role as well in non-effective, non-inherited mode | 11:48 |
| samueldmq | henrynash, nice ... thinking about this case | 11:49 |
| samueldmq | henrynash, need to see your code, just a minute | 11:50 |
| samueldmq | henrynash, running tests .. :-) | 11:51 |
| henrynash | samueldmq: you downloaded my data-driven-test patch? | 11:52 |
| samueldmq | yep | 11:52 |
| samueldmq | henrynash, looks like it isnt updated : | 11:53 |
| samueldmq | :/ | 11:53 |
| rodrigods | marekd, looking :) | 11:55 |
| marekd | rodrigods: thanks. | 12:02 |
| *** krykowski has joined #openstack-keystone | 12:08 | |
| henrynash | samueldmq: ah, sorry, realised I didn’t skp the tests for ldap, you can run teh offending test with: test_backend_sql.SqlInheritance.test_inherited_role_grants_for_user | 12:08 |
| henrynash | samueldmq: i.e. tox — test_backend_sql.SqlInheritance.test_inherited_role_grants_for_user | 12:08 |
| *** krykowski has quit IRC | 12:16 | |
| *** MasterPiece has quit IRC | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:19 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 12:19 |
| *** krykowski has joined #openstack-keystone | 12:22 | |
| *** markvoelker has quit IRC | 12:24 | |
| samueldmq | henrynash, well, the project data is not in your eexpected entities | 12:24 |
| samueldmq | henrynash, but they should be | 12:24 |
| samueldmq | henrynash, let me recheck | 12:25 |
| henrynash | samueldmq: teh search filter is for teh domain, not project | 12:27 |
| henrynash | samueldmq: 'params': {'user': 0, 'domain': 0} | 12:27 |
| samueldmq | henrynash, yes | 12:28 |
| samueldmq | henrynash, but it has 2 roles on domain | 12:28 |
| samueldmq | henrynash, lines 7 and 8 of your paste http://paste.openstack.org/show/163164/ | 12:28 |
| henrynash | samueldmq: so shouldn;t we just get back the role on the domain that is not inherited? | 12:28 |
| samueldmq | henrynash, the default is to get both ... if extension is enabled | 12:29 |
| henrynash | samueldmq: ahhh…so at the list_role_assignment level, ‘inherited’ doesn’t defaut to False? | 12:30 |
| samueldmq | henrynash, no, it defaults to None, that means get both | 12:31 |
| samueldmq | henrynash, makes sense? | 12:31 |
| samueldmq | henrynash, like: otherwise you tell me specifically what you want, I will consider both for you | 12:31 |
| henrynash | samueldmq: so that explains teh results (thanks!)….just mull on whetehr that dfault makes sense… | 12:31 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 12:32 |
| samueldmq | henrynash, np, ok let me know if you disagree with this default | 12:32 |
| *** krykowski has quit IRC | 12:32 | |
| henrynash | samueldmq: meanwhile I’ll update the test, which means they should all pass now | 12:33 |
| marekd | rodrigods: thanks. | 12:37 |
| marekd | apparently my local time and gerrit's one are not compatible: "Updated in the future" | 12:41 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 12:44 |
| henrynash | samueldmq: hi, if you have a moment, I’m still have an issue..maybe still my misunderstanding… | 12:45 |
| henrynash | samueldmq: here’s the udpated test plan: http://paste.openstack.org/show/163187/ | 12:46 |
| *** krykowski has joined #openstack-keystone | 12:48 | |
| samueldmq | henrynash, sure I have ... looking | 12:50 |
| henrynash | samueldq: so the last test works fine, but 2nd last test fails | 12:51 |
| henrynash | samueldmq: the one with filter: {'params': {'user': 0, 'domain': 0, 'effective': True} | 12:51 |
| henrynash | samueldmq: I was expecting that NOT to return the inherited role, but it does | 12:52 |
| samueldmq | henrynash, you're right, will fix and submit in a couple of seconds :-) | 12:53 |
| henrynash | samueldmqL blimey, no need to be taht quick! | 12:53 |
| henrynash | samueldmq: btw, did you also see my comment on whether it makes sense to still include ‘inherited_to_projects’ in teh main body of teh response from list_role_assignments…now that we have the ‘indirect’ key? | 12:54 |
| *** raildo_away is now known as raildo | 12:55 | |
| marekd | henrynash: samueldmq: https://review.openstack.org/#/c/104623/ feel free to torture this patch whenever you have time :-) | 12:58 |
| samueldmq | henrynash, L732 https://review.openstack.org/#/c/137202/15/keystone/assignment/core.py | 12:59 |
| samueldmq | henrynash, I was already checking that ... but that check should be at the beginning of that method ... | 12:59 |
| samueldmq | henrynash, just rerunning tests | 12:59 |
| samueldmq | marekd, torture .... nah :p | 13:00 |
| samueldmq | marekd, will review it soon, thanks :-) | 13:00 |
| marekd | samueldmq: sure, whenever you can. | 13:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 13:05 |
| samueldmq | henrynash, ^ now I think we'll be both happy with its soundness :D | 13:05 |
| samueldmq | henrynash, please let me know if it worked or not | 13:06 |
| henrynash | samueldmq: thx! I’ll rebase and re-run as well | 13:06 |
| *** ajayaa has quit IRC | 13:10 | |
| samueldmq | np | 13:13 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 13:16 |
| raildo | henrynash, ayoung, morganfainberg ^ :) | 13:16 |
| henrynash | samueldmq: did you think about my question about ‘inherited_to_projects’ ? | 13:17 |
| samueldmq | henrynash, what question, sorry but dont have it in my cache :/ | 13:17 |
| *** krykowski has quit IRC | 13:20 | |
| henrynash | samuledmq: ah, it feels odd now that ‘inherited_to_projects’ appears in the main body of the response from list_role_assignments, now that we have the ‘indirect’ key added….is ‘inherited_to_projects’ adding anything? | 13:20 |
| *** markvoelker has joined #openstack-keystone | 13:20 | |
| openstackgerrit | Rakesh H S proposed openstack/python-keystoneclient: handles keyboard interrupt https://review.openstack.org/121046 | 13:22 |
| samueldmq | henrynash, it should be kept anyway for inherited assignments that are not expanded, right? | 13:24 |
| henrynash | samueldq: but we also include the ‘indirect’ for those, no? | 13:25 |
| samueldmq | henrynash, so I decided to keep it for inherited expanded as well, so it is simpler to the controller to see whether it's inherited just checking 'inherited_to_projects' | 13:25 |
| *** markvoelker has quit IRC | 13:25 | |
| *** krykowski has joined #openstack-keystone | 13:25 | |
| samueldmq | henrynash, for inherited that are not expanded (not effective mode) we dont, no need to have indirect in this case, since it should have none insisde it | 13:26 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 13:26 |
| henrynash | samueldmq: so it probably feels right that it gets returned in non-effective mode, on those assignmnets that were marked as inherited | 13:27 |
| henrynash | samueldmq: I’m not sure it feels right for effective mdoe…I’ll have to think on that some more | 13:28 |
| samueldmq | henrynash, in fact we dont need it | 13:28 |
| samueldmq | henrynash, in this second case, I do agree with you | 13:28 |
| samueldmq | henrynash, but when formatting, the controller needs to know if it was inherited or not | 13:28 |
| samueldmq | henrynash, i) by just checkking inherited_to_projects on every case of ii) checking inherited_to_projects OR 'indirect' in the body | 13:29 |
| henrynash | samueldmq: well it needs how to generate the links for all combinations of what is in ‘indirect’ | 13:29 |
| henrynash | samueldmq: e.g. group, domain, project etc. | 13:30 |
| samueldmq | henrynash, yes... look at line 696 https://review.openstack.org/#/c/137202/16/keystone/assignment/controllers.py | 13:31 |
| samueldmq | henrynash, it should just become if entity.get('inherited_to_projects') OR entity.get('indirect'): | 13:32 |
| samueldmq | henrynash, well, that would be simple as well, I am ok with changing it | 13:32 |
| henrynash | sameuldmq: I think that makes more sense…it is duplicative otherwise in effective mode | 13:33 |
| *** bknudson has joined #openstack-keystone | 13:35 | |
| *** ChanServ sets mode: +v bknudson | 13:35 | |
| *** markvoelker has joined #openstack-keystone | 13:36 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 13:45 |
| samueldmq | henrynash, ^^ done | 13:45 |
| *** stevemar has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v stevemar | 13:46 | |
| *** krykowski has quit IRC | 13:48 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 13:48 |
| henrynash | samueldmq: great! I’ll modify the tests and re-run… | 13:54 |
| henrynash | samueldmq: did you fix up the fact that pep was failing due to “overly complex” method in your patch? | 13:54 |
| samueldmq | henrynash, oh, need to talk with you | 13:55 |
| henrynash | samueldmq: ok :-) | 13:55 |
| samueldmq | henrynash, so that comes with putting all methods inside list_role_assignments scope | 13:55 |
| henrynash | samueldmq: hmm, ok…yes I feared as much! | 13:56 |
| samueldmq | henrynash, can I leave them at 'normal' scope and then add a _ at the beginning (as I were doing before) | 13:56 |
| samueldmq | ? | 13:56 |
| samueldmq | great! will do | 13:56 |
| samueldmq | well, you agree right? | 13:57 |
| henrynash | samueldmq: yes, sounds fine…mayge add a NOTE before the first of those methods just to explain why we’ve done it hat way | 13:57 |
| samueldmq | henrynash, great! just a few seconds more :-) | 13:59 |
| henrynash | samueldmq: :-) | 14:00 |
| *** gordc has joined #openstack-keystone | 14:01 | |
| *** krykowski has joined #openstack-keystone | 14:03 | |
| *** Ctina_ has joined #openstack-keystone | 14:04 | |
| *** markvoelker has quit IRC | 14:11 | |
| stevemar | marekd, o/ | 14:14 |
| *** sriram has joined #openstack-keystone | 14:14 | |
| *** richm has joined #openstack-keystone | 14:15 | |
| openstackgerrit | Rakesh H S proposed openstack/python-keystoneclient: handles keyboard interrupt https://review.openstack.org/121046 | 14:15 |
| *** mzbik has quit IRC | 14:19 | |
| *** marg7175 has quit IRC | 14:20 | |
| *** mattfarina has joined #openstack-keystone | 14:21 | |
| *** krykowski has quit IRC | 14:21 | |
| *** krykowski has joined #openstack-keystone | 14:24 | |
| *** ajayaa has joined #openstack-keystone | 14:24 | |
| *** topol has joined #openstack-keystone | 14:37 | |
| *** ChanServ sets mode: +v topol | 14:37 | |
| *** dims has joined #openstack-keystone | 14:43 | |
| *** joesavak has joined #openstack-keystone | 14:45 | |
| *** r-daneel has joined #openstack-keystone | 14:48 | |
| *** r-daneel has quit IRC | 14:48 | |
| *** r-daneel has joined #openstack-keystone | 14:48 | |
| *** krykowski has quit IRC | 14:53 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move projects and domains to their own backend https://review.openstack.org/144824 | 14:54 |
| *** EmilienM is now known as EmilienM|afk | 14:55 | |
| *** krykowski has joined #openstack-keystone | 14:59 | |
| *** abhirc has joined #openstack-keystone | 15:03 | |
| openstackgerrit | Merged openstack/keystone: Move test_utils to keystone/tests/unit/ https://review.openstack.org/133989 | 15:10 |
| *** pnavarro has quit IRC | 15:11 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused pointer to assignment in identity driver https://review.openstack.org/145022 | 15:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make controllers and managers reference new resource manager https://review.openstack.org/133525 | 15:16 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make unit tests call the new resource manager https://review.openstack.org/130954 | 15:18 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 15:18 |
| *** timcline has joined #openstack-keystone | 15:25 | |
| *** timcline has quit IRC | 15:25 | |
| *** timcline has joined #openstack-keystone | 15:26 | |
| *** bknudson has quit IRC | 15:27 | |
| *** krykowski has quit IRC | 15:28 | |
| *** zzzeek has joined #openstack-keystone | 15:29 | |
| *** abhirc has quit IRC | 15:32 | |
| *** krykowski has joined #openstack-keystone | 15:32 | |
| *** andreaf is now known as andreaf_ | 15:35 | |
| *** abhirc has joined #openstack-keystone | 15:39 | |
| *** carlosmarin has joined #openstack-keystone | 15:41 | |
| *** angelamolock has joined #openstack-keystone | 15:42 | |
| *** angelamolock has quit IRC | 15:43 | |
| *** angelamolock has joined #openstack-keystone | 15:43 | |
| *** bknudson has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v bknudson | 15:47 | |
| *** markvoelker has joined #openstack-keystone | 15:47 | |
| ayoung | rodrigods, what about Dynamic Polices do you want to discuss? Its not getting into Kilo. I figure we'll beat through the rest of the design in Vancouver | 15:48 |
| *** harlowja_away has quit IRC | 15:49 | |
| *** krykowski has quit IRC | 15:50 | |
| *** radez_g0n3 is now known as radez | 15:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 15:51 |
| samueldmq | henrynash, ^took some time, I was doing something else :) | 15:51 |
| henrynash | samueldmq: no problem…I’ll rebase…. | 15:52 |
| *** gokrokve has joined #openstack-keystone | 15:54 | |
| *** dims has quit IRC | 15:55 | |
| samueldmq | henrynash, in fact I need to rebase on yours as well (Make unit tests call the new resource manager) | 15:55 |
| samueldmq | will do now | 15:55 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes 'OS-INHERIT:inherited_to' info in tests https://review.openstack.org/144542 | 15:55 |
| henrynash | samueldmq: np | 15:56 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor role assignment assertions https://review.openstack.org/144543 | 15:56 |
| *** krykowski has joined #openstack-keystone | 15:56 | |
| morganfainberg | mornin | 15:57 |
| samueldmq | morning :) | 15:57 |
| *** EmilienM|afk is now known as EmilienM | 15:58 | |
| samueldmq | henrynash, how do you use to work with a chain of patches ? | 15:59 |
| samueldmq | henrynash, I prefer renaming branchs as assignments/1, assignments/2, ... so its better to know what comes next when I am rebasing | 15:59 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use RequestBodySizeLimiter from oslo.middleware https://review.openstack.org/144697 | 15:59 |
| samueldmq | henrynash, but it looks like that is messing with the patch topic on gerrit :/ | 16:00 |
| henrynash | samueldmq: that’s one way…I just keep a list for myself of the order! | 16:00 |
| samueldmq | henrynash, might work better, thx | 16:01 |
| *** david-lyle_afk is now known as david-lyle | 16:01 | |
| *** tqtran has joined #openstack-keystone | 16:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix up _ldap_res_to_model for ldap identity backend https://review.openstack.org/150631 | 16:07 |
| samueldmq | henrynash, and how to you deal with two patches with same topic ? :-) | 16:09 |
| samueldmq | Branch already exists - reusing | 16:09 |
| *** jistr has quit IRC | 16:11 | |
| *** jistr has joined #openstack-keystone | 16:12 | |
| *** afazekas has quit IRC | 16:16 | |
| rodrigods | ayoung, ok, that was what I wanted to know | 16:16 |
| rodrigods | ayoung, even the keystonemiddleware or client bits? | 16:16 |
| ayoung | rodrigods, there are a couple of policy based reviews published | 16:17 |
| ayoung | and at least on that I need to move to the new policy repo that is currently against Keystone | 16:17 |
| morganfainberg | topol, stevemar, https://review.openstack.org/#/c/150109/ lets not speculate about V4 | 16:17 |
| morganfainberg | we're using v3 here | 16:17 |
| ayoung | In Keystone, we have the default policy, the unified policy file already posted as WIP | 16:18 |
| ayoung | not unified, but the cleaned up one | 16:18 |
| openstackgerrit | Merged openstack/keystone-specs: Tokenless authorization with X.509 SSL client certificate https://review.openstack.org/105913 | 16:18 |
| rodrigods | ayoung, ok, I'm aware of it, just wanted to know where to put efforts next | 16:18 |
| ayoung | rodrigods, I need to modify the one for fetching the file from the server. dolphm wants it in middleware, and I can't really argue with him; it certainly needs to be callable from there | 16:22 |
| ayoung | that is just a spec, though | 16:22 |
| ayoung | if you want to do the code for that...it would be great | 16:23 |
| morganfainberg | rodrigods, ^ re that one, API changes should be included (the one i linked) | 16:23 |
| ayoung | it needs at least one implementation to make use of it, but dolphm 's sample service might be the perfect target for that | 16:23 |
| rodrigods | morganfainberg, I saw the comments, will upload a new patchset with it in the next couple of hours :) | 16:24 |
| rodrigods | ayoung, which sample service? | 16:24 |
| henrynash | bknudson, ayoung: Updated https://review.openstack.org/#/c/144824/ to fix up suggested changes….be great if you could cast an eye and +2/A if looks OK now. | 16:25 |
| ayoung | rodrigods, he has a service...something like an echo service | 16:25 |
| morganfainberg | rodrigods, yeah otherwise i think you're good on that front. | 16:25 |
| ayoung | henrynash, looks fine | 16:27 |
| *** avozza is now known as zz_avozza | 16:28 | |
| openstackgerrit | Merged openstack/keystone-specs: Add a catalog to an unscoped token https://review.openstack.org/107333 | 16:28 |
| rodrigods | ayoung, hmm | 16:28 |
| rodrigods | ayoung, ok... so first will take a look in the default policy | 16:28 |
| ayoung | rodrigods, sure | 16:29 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Remove URL field from regions https://review.openstack.org/150109 | 16:33 |
| rodrigods | stevemar, morganfainberg, topol ^ | 16:33 |
| morganfainberg | rodrigods, sorry wasn't clear enough in how detailed i wanted this. | 16:35 |
| morganfainberg | rodrigods, added another comment | 16:35 |
| morganfainberg | rodrigods, this is a CYA deal so more details are better | 16:36 |
| rodrigods | morganfainberg, you are right, fixing... | 16:37 |
| morganfainberg | stevemar, ping | 16:37 |
| stevemar | morganfainberg, pongish | 16:38 |
| morganfainberg | https://review.openstack.org/#/c/150631/4/keystone/tests/test_backend_ldap.py | 16:38 |
| morganfainberg | how do the skiped test fail when enabled? | 16:38 |
| stevemar | morganfainberg, because of https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L223 | 16:39 |
| morganfainberg | ok then my comments i add stand | 16:39 |
| samueldmq | morganfainberg, +++ (assert the correct behavior, even if failing, instead of skipping) | 16:39 |
| morganfainberg | please don't add more "blind skips" | 16:39 |
| morganfainberg | assert the expected failure occurs | 16:39 |
| samueldmq | exactly :) | 16:39 |
| stevemar | morganfainberg, ah okay | 16:39 |
| morganfainberg | :) | 16:40 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Remove URL field from regions https://review.openstack.org/150109 | 16:40 |
| morganfainberg | means that if the behavior changes we know. | 16:40 |
| samueldmq | morganfainberg, I think we still need to fix this for existing skips | 16:40 |
| morganfainberg | samueldmq, we do | 16:40 |
| morganfainberg | samueldmq, that does not need a bug/bp and can be done as someone has timue | 16:40 |
| morganfainberg | time* | 16:40 |
| morganfainberg | samueldmq, feel free to help on that front :) | 16:40 |
| samueldmq | morganfainberg, k, will do once a get some time :) (working o nthe list role assignments performance chain) | 16:41 |
| morganfainberg | of course | 16:41 |
| morganfainberg | no rush | 16:41 |
| samueldmq | k :-) | 16:41 |
| morganfainberg | just as we get time we should fix it for other tests | 16:41 |
| *** bknudson has quit IRC | 16:41 | |
| samueldmq | ++ | 16:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/147367 | 16:42 |
| samueldmq | morganfainberg, also, I think we should recheck the classes structure we have for ldap classes | 16:42 |
| samueldmq | morganfainberg, I did a test and they were taking like 40% of testing time (something like this) | 16:42 |
| morganfainberg | reminds me... let me send a scary email that i'm sure will result in freakout from the community | 16:43 |
| morganfainberg | deprecation of ldap assignment | 16:43 |
| morganfainberg | samueldmq, sure i think we should circle back on that with the functional testing dstanek is working on | 16:43 |
| samueldmq | morganfainberg, yes, I intend to help him as well ... | 16:44 |
| *** packet has joined #openstack-keystone | 16:44 | |
| morganfainberg | samueldmq, rather than try to fix that before we can run against a real backend. once we have the scenario tests for functional, it'll be much easier to drop bad-in-process keystone tests and focus on "against a real system" tests | 16:44 |
| samueldmq | looks like I need to work 20/24 to work on everything I'm saying I intend to work on :/ | 16:44 |
| *** andreaf has joined #openstack-keystone | 16:44 | |
| morganfainberg | samueldmq, and no one expects that! | 16:44 |
| henrynash | ayoung: thx | 16:45 |
| samueldmq | morganfainberg, sure ... just need to work constantly ;) | 16:45 |
| samueldmq | morganfainberg, regarding tests .... | 16:45 |
| samueldmq | morganfainberg, I was thinking if we could get a standard for keystone: i) functional tests (WIP); iii) unit tests for each controller/manager/driver using mocks | 16:46 |
| samueldmq | morganfainberg, talked to bknudson and he said he's not sure we can have enough people to meet that standard | 16:46 |
| samueldmq | morganfainberg, I was planning to look deeper and estimate how hard would be to meet that | 16:46 |
| samueldmq | morganfainberg, do you think it's worth it? | 16:47 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 16:49 |
| *** krykowski has quit IRC | 16:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 16:49 |
| stevemar | samueldmq, i expect 20/24 hrs :P | 16:50 |
| stevemar | just kidding :) | 16:50 |
| stevemar | morganfainberg rules keystone with an iron first | 16:50 |
| samueldmq | stevemar, "there's a little truth behind every just kidding" | 16:52 |
| samueldmq | stevemar, haha, I am kidding too :-) | 16:52 |
| samueldmq | stevemar, I thought it was just a Brazilian expression, but it looks like we use it in English as well | 16:53 |
| rodrigods | ayoung, ping ... can you review a couple of HMT patches? | 16:53 |
| ayoung | rodrigods, debuggin a devstack failure at the moment | 16:54 |
| topol | morganfainberg let me park a bus on stevemar. It was he, not I who mentioned V4 :-) | 16:55 |
| *** dims has joined #openstack-keystone | 16:55 | |
| stevemar | topol, :O you totally did | 16:55 |
| stevemar | maybe you meant 3.4? | 16:56 |
| rodrigods | ayoung, ok... once you finish it, don't miss to review that wonderful piece of code :P | 16:56 |
| topol | stevemar, I changed my vote to +1. Your answer that it was experimental is very fair. I left mine as a +1 assuming you are a +2 to allow others to review | 16:56 |
| *** krykowski has joined #openstack-keystone | 16:57 | |
| topol | stevemar, I meant 3.4. My bad. I should fall on my sword now :-) | 16:57 |
| stevemar | victory! | 16:57 |
| topol | morganfainberg please back the bus up onto me | 16:57 |
| stevemar | i was wondering why you mentioned it! | 16:57 |
| morganfainberg | +2 rodrigods, stevemar, topol, but holding on +a for a short bit for other core feedback | 16:59 |
| morganfainberg | stevemar, this should go in today barring other feedback saying why it shouldn't | 16:59 |
| rodrigods | morganfainberg, thx! | 16:59 |
| *** zz_avozza is now known as avozza | 17:01 | |
| *** andreaf has quit IRC | 17:02 | |
| samueldmq | morganfainberg, dstanek could you please give me your opinion on the test standard I just described (like 20 lines above) ? | 17:03 |
| samueldmq | stevemar, ^ you too :-) | 17:03 |
| samueldmq | well, everyone's opinion would be appreciated | 17:03 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 17:04 |
| *** rwsu-afk is now known as rwsu | 17:05 | |
| dolphm | stevemar: marekd: i'm looking at a backport in https://review.openstack.org/#/c/150190/2/keystone/contrib/federation/idp.py | 17:06 |
| dstanek | samueldmq: what do you mean by standard? | 17:06 |
| dolphm | stevemar: marekd: you call check_output() there which doesn't exist in py26 -- are there any other reasons why federation wouldn't be able to support py26? | 17:06 |
| dolphm | stevemar: marekd: check_output() can be trivially replaced with a call to Popen to re-introduce 26 compat | 17:06 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support data-driven backend assignment testing https://review.openstack.org/149178 | 17:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Recursive deletion and project disabling https://review.openstack.org/148730 | 17:07 |
| *** avozza is now known as zz_avozza | 17:08 | |
| henrynash | samueldmq: sadly it looks like list_role_assignment may still need a bit of tweaking….I still don’t think it is working for user+domain+effective mode - see comment and I can provide results from my data-driven-assignemtn tests if you need them | 17:08 |
| morganfainberg | really utopic unicorn and now vivid vervet | 17:09 |
| * morganfainberg sighs | 17:09 | |
| morganfainberg | i might need to skip 2 releases of ubuntu now... | 17:09 |
| morganfainberg | :P | 17:09 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 17:10 |
| *** jistr has quit IRC | 17:10 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 17:10 |
| rodrigods | morganfainberg, fun code to review ^ :) | 17:10 |
| dolphm | morganfainberg: 14.04 for life | 17:11 |
| dstanek | samueldmq: I'm at lunch now. I'll ping you when I get back | 17:11 |
| morganfainberg | dolphm, i am sad they didn't name it tiger tiger though | 17:11 |
| morganfainberg | dolphm, that was the best option. | 17:12 |
| dolphm | morganfainberg: i... actually thought that was the name for awhile after release | 17:12 |
| morganfainberg | dolphm, ;) | 17:12 |
| morganfainberg | dolphm, it was an AWESOME name | 17:12 |
| morganfainberg | not that trusty tahr is bad | 17:12 |
| *** ajayaa has quit IRC | 17:12 | |
| dolphm | people had been referring to it as such so i didn't question | 17:12 |
| *** gyee has joined #openstack-keystone | 17:13 | |
| *** ChanServ sets mode: +v gyee | 17:13 | |
| morganfainberg | gyee, re: your email about credential api | 17:13 |
| morganfainberg | gyee, the public API would need to be changed or the private? | 17:13 |
| morganfainberg | s/private/internal | 17:13 |
| morganfainberg | public = REST | 17:13 |
| morganfainberg | unrelated: anyone have a oneplus and invites? | 17:14 |
| * morganfainberg has had it with bugs / crashes / etc in ios8 | 17:14 | |
| gyee | morganfainberg, just the interface | 17:15 |
| gyee | public API stay the same | 17:15 |
| morganfainberg | gyee ok. | 17:15 |
| morganfainberg | gyee, don't scare me ;) | 17:15 |
| gyee | we need to pass the token to the backend | 17:16 |
| samueldmq | dstanek, k | 17:16 |
| samueldmq | dstanek, bon apetit :) | 17:16 |
| morganfainberg | gyee, i think this is a sign barbican isn't *really* ready for our consumption on this front | 17:16 |
| *** andreaf has joined #openstack-keystone | 17:16 | |
| samueldmq | henrynash, will look at your comment | 17:16 |
| gyee | morganfainberg, they need the user token, service container won't scale | 17:16 |
| * morganfainberg is still grumpy about bearer tokens | 17:16 | |
| morganfainberg | ayoung, i think you're right Krb5 is the answer. | 17:17 |
| morganfainberg | ayoung, with redelegation | 17:17 |
| morganfainberg | tgt is a nice model. | 17:17 |
| ayoung | I'm not used to hearing that. Could you say it again? | 17:17 |
| gyee | I am totally cool with kerberos, just that we need to balance security versus usability | 17:17 |
| morganfainberg | nope | 17:17 |
| morganfainberg | :P | 17:17 |
| ayoung | Ah well. | 17:17 |
| morganfainberg | ayoung, ^_^ | 17:17 |
| ayoung | morganfainberg, I think there is a theoretical way to do the same thing with X509, but I don't have the time to develope it | 17:18 |
| morganfainberg | or at the very least our tokens need to be more tgt like [in the case of lacking a krb5 infrastrcture] | 17:18 |
| morganfainberg | or x509 or whatever | 17:18 |
| gyee | I am working on x509 | 17:18 |
| morganfainberg | but i think it's the only way out of the bearer token hole we're in | 17:18 |
| ayoung | all KRB/S4U2 can tell you, though, is that the users asked the service to do something, not what it asked | 17:18 |
| ayoung | morganfainberg, not necessarily... | 17:18 |
| ayoung | I think the real answer is better delegation | 17:18 |
| morganfainberg | ayoung, anyway - another topic another day | 17:18 |
| ayoung | morganfainberg, the unified delegation model | 17:19 |
| ayoung | it means that we take a lot of the logic that we are putting in the token and externalize it to auth token middleware: | 17:19 |
| ayoung | but...let's add that to the schedule for Vancouver | 17:20 |
| gyee | ++ | 17:20 |
| morganfainberg | ayoung, exactly | 17:20 |
| morganfainberg | another topic another conversation | 17:20 |
| morganfainberg | ;) | 17:20 |
| *** keystonelpbug has quit IRC | 17:20 | |
| *** lhcheng has joined #openstack-keystone | 17:21 | |
| gyee | morganfainberg, passing the token to Barbican's not that bad, we just need to pass the context to the backend | 17:21 |
| *** EmilienM is now known as EmilienM|afk | 17:22 | |
| morganfainberg | bug 1 | 17:22 |
| *** TempLPBugBot has joined #openstack-keystone | 17:23 | |
| morganfainberg | bug 1 | 17:23 |
| TempLPBugBot | bug 1 in Ubuntu Malaysia LoCo Team "Microsoft has a majority market share" [Critical,In progress] https://launchpad.net/bugs/1 | 17:23 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 17:23 |
| morganfainberg | bug 1111 | 17:24 |
| TempLPBugBot | bug 1111 in gst-plugins0.8 (Ubuntu) "doesn't extract last track" [Medium,Fix released] https://launchpad.net/bugs/1111 | 17:24 |
| morganfainberg | hah | 17:24 |
| morganfainberg | ok | 17:24 |
| morganfainberg | anyway | 17:24 |
| morganfainberg | i'm going to go get breakfast and coffee | 17:25 |
| morganfainberg | back in a bit | 17:25 |
| dolphm | looking at diffs of diffs makes my head hurt | 17:25 |
| *** ajayaa has joined #openstack-keystone | 17:25 | |
| morganfainberg | dolphm, but what about diffs of diffs of diffs with a penchant for adding in a diff | 17:25 |
| samueldmq | henrynash, that's valid ... I'm fixing it, sorry | 17:25 |
| henrynash | samueldmq: np! | 17:25 |
| dolphm | morganfainberg: http://pasteraw.com/p6peq0k2z7dpdif1brpfp4tpmw8bare | 17:26 |
| dolphm | morganfainberg: diff of a master patch vs the backport | 17:26 |
| morganfainberg | dolphm, there are not nearly enough +'s or -'s in that | 17:26 |
| *** pnavarro has joined #openstack-keystone | 17:26 | |
| morganfainberg | i'd probably use opendif | 17:27 |
| morganfainberg | tbh | 17:27 |
| *** jasondot_ has joined #openstack-keystone | 17:27 | |
| *** atiwari has joined #openstack-keystone | 17:29 | |
| gyee | dolphm, thanks for the review https://review.openstack.org/#/c/150190/ | 17:29 |
| gyee | dolphm, the existing code uses subprocess.check_output() which is not support in python 2.6 | 17:30 |
| dolphm | gyee: i asked stevemar and marekd about that above, but no response yet | 17:30 |
| gyee | I can make another patch to fix the existing code first, or leave the existing on as is, I am fine either way | 17:30 |
| dolphm | morganfainberg: do you know if/why we opted to not support federation in py26? | 17:31 |
| gyee | did we drop python2.6 in Kilo? otherwise, that test won't work | 17:32 |
| morganfainberg | dolphm, uhm | 17:32 |
| morganfainberg | dolphm, no i don't remember why. | 17:32 |
| gyee | yep looks like py26 is gone in Kilo | 17:33 |
| morganfainberg | dolphm, maybe py26 was missing some key lib? | 17:33 |
| morganfainberg | and yes py26 is dead in kilo | 17:33 |
| gyee | w00t! | 17:33 |
| dolphm | morganfainberg: this is for stable/juno though | 17:33 |
| * gyee do a moment of silence for py26 | 17:33 | |
| gyee | amen | 17:33 |
| morganfainberg | dolphm, so no reason it shouldn't work for 26 in juno | 17:34 |
| morganfainberg | that i know of | 17:34 |
| morganfainberg | besides a gap in code | 17:34 |
| dolphm | morganfainberg: if it's just a single call to check_output that's breaking compat with 2.6, i feel like we should fix that before applying gyee's patch | 17:34 |
| dolphm | morganfainberg: so gyee's patch doesn't have to skip testing 26 | 17:35 |
| morganfainberg | dolphm, ++ | 17:35 |
| morganfainberg | dolphm, lets fix it | 17:35 |
| gyee | alrighty then | 17:35 |
| * gyee back to coding | 17:35 | |
| dolphm | gyee: are you going to fix the underlying code or shall i? | 17:37 |
| dolphm | gyee: (considering it's going into stable/* i'd rather be a reviewer) | 17:37 |
| *** henrynash has quit IRC | 17:37 | |
| gyee | dolphm, I can fix the code | 17:37 |
| dolphm | gyee: i'd be happy to file a bug | 17:37 |
| gyee | dolphm, please, let me work on the code, just assign the bug to me | 17:37 |
| stevemar | gyee, dolphm we dropped py26 in kilo, whats the issue? | 17:40 |
| gyee | stevemar, this is for backporting to juno | 17:40 |
| stevemar | ahhh | 17:40 |
| dolphm | stevemar: is there any real reason we wouldn't support federation in stable/juno on python 2.6? | 17:41 |
| *** henrynash has joined #openstack-keystone | 17:41 | |
| *** ChanServ sets mode: +v henrynash | 17:41 | |
| dolphm | stevemar: the only blocker i saw looks simple to fix | 17:41 |
| stevemar | dolphm, aside from any code blockers, im fine with federation being py26 compat in juno | 17:42 |
| stevemar | dolphm, gyee someone internally reported a py26 issue probably the same one, let me look | 17:42 |
| dolphm | stevemar: just wanted to make sure there wasn't a bigger issue with 26 | 17:42 |
| stevemar | dolphm, dont think so | 17:42 |
| samueldmq | henrynash, http://paste.openstack.org/show/163290/ should fix that bug | 17:43 |
| samueldmq | henrynash, I'm rebasing and applying your feedbacks in the chain to submit everything together | 17:43 |
| stevemar | gyee, dolphm this was an issue we saw: http://paste.openstack.org/show/163291/ | 17:44 |
| stevemar | where subprocess.check_output(command_list) wasn't py26 | 17:44 |
| gyee | yep | 17:45 |
| gyee | I am fixing it | 17:45 |
| stevemar | gyee, THANKS :) commented! | 17:46 |
| *** krykowski has quit IRC | 17:49 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 17:51 |
| *** r-daneel has quit IRC | 17:52 | |
| *** marg7175 has joined #openstack-keystone | 17:53 | |
| *** marg7175 has quit IRC | 17:58 | |
| *** marg7175 has joined #openstack-keystone | 17:58 | |
| *** Ctina_ has quit IRC | 17:59 | |
| *** Ctina__ has joined #openstack-keystone | 17:59 | |
| *** lhcheng has left #openstack-keystone | 18:06 | |
| *** lhcheng has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix up _ldap_res_to_model for ldap identity backend https://review.openstack.org/150631 | 18:12 |
| openstackgerrit | Arun Kant proposed openstack/keystone-specs: Spec for adding Barbican service as Keystone credential backend. https://review.openstack.org/148672 | 18:12 |
| *** openstackgerrit has quit IRC | 18:14 | |
| *** openstackgerrit has joined #openstack-keystone | 18:14 | |
| *** gokrokve has quit IRC | 18:16 | |
| dstanek | samueldmq: i am back | 18:16 |
| *** vhoward has left #openstack-keystone | 18:22 | |
| morganfainberg | dstanek, LGTM: https://review.openstack.org/#/c/131516/ +2 | 18:26 |
| *** nellysmitt has quit IRC | 18:27 | |
| *** harlowja has joined #openstack-keystone | 18:28 | |
| *** bknudson has joined #openstack-keystone | 18:30 | |
| *** ChanServ sets mode: +v bknudson | 18:30 | |
| dstanek | morganfainberg: great, thx | 18:32 |
| nkinder | stevemar: ping, re - https://review.openstack.org/#/c/124638/ | 18:32 |
| nkinder | stevemar: how are we handling the transition of policy.py from oslo-incubator to oslo.policy? | 18:33 |
| stevemar | nkinder, well oslo.policy is already up, so i think just make the change there | 18:35 |
| stevemar | and projects should be imported that instead of using the incubator | 18:35 |
| nkinder | stevemar: ok, so we'll just let it die in incubator (and eventually remove it)? | 18:35 |
| stevemar | nkinder, yeah, eventually it'll be removed (like how some the utils are removed), so don't bother posting the change there | 18:36 |
| nkinder | stevemar: ok. What about getting oslo.policy docs here? http://docs.openstack.org/developer/openstack-projects.html | 18:37 |
| *** EmilienM|afk is now known as EmilienM | 18:38 | |
| stevemar | nkinder, it already exists, http://docs.openstack.org/developer/openstack-projects.html just missing from that index.html | 18:39 |
| stevemar | i'll see where it's maintained, probably somewhere in infra | 18:39 |
| morganfainberg | dolphm, FYI just unblocked a bunch of juno backports | 18:39 |
| morganfainberg | dolphm, they should all be gating now. | 18:39 |
| morganfainberg | dolphm, trying to get them through if the look good before we freeze | 18:40 |
| morganfainberg | (tomorrow i think) | 18:40 |
| morganfainberg | gyee, ^ the fixes for juno and saml would be good to have in-flight today | 18:40 |
| gyee | morganfainberg, sure, I should have a new patch up in the afternoon | 18:41 |
| nkinder | stevemar: ok, great. I'll get a new patch proposed against the right repo for my doc changes. | 18:51 |
| *** marg7175_ has joined #openstack-keystone | 18:53 | |
| bknudson | since we haven't done a release of oslo.policy, I don't think there's any docs to point to. | 18:53 |
| *** TempLPBugBot has quit IRC | 18:54 | |
| *** TempLPBugBot has joined #openstack-keystone | 18:55 | |
| morganfainberg | bug 1396763 | 18:55 |
| TempLPBugBot | bug 1396763 in Keystone juno "user id beginning with 0 cannot authenticate through ldap" [Undecided,In progress] https://launchpad.net/bugs/1396763 - Assigned to Richard Megginson (rmeggins) | 18:55 |
| *** TempLPBugBot has quit IRC | 18:56 | |
| *** markvoelker has quit IRC | 18:56 | |
| *** TempLPBugBot has joined #openstack-keystone | 18:56 | |
| morganfainberg | bug 1396763 | 18:56 |
| TempLPBugBot | bug 1396763 in Keystone juno "user id beginning with 0 cannot authenticate through ldap" (affected: 1, heat: 14) [Undecided,In progress] https://launchpad.net/bugs/1396763 - Assigned to Richard Megginson (rmeggins) | 18:56 |
| *** markvoelker has joined #openstack-keystone | 18:56 | |
| *** marg7175 has quit IRC | 18:57 | |
| stevemar | nkinder, fyi https://review.openstack.org/150907 | 18:57 |
| *** raildo has quit IRC | 18:57 | |
| stevemar | bknudson, it'll have docs eventually | 18:58 |
| *** jsavak has joined #openstack-keystone | 18:59 | |
| *** angelamo_ has joined #openstack-keystone | 18:59 | |
| bknudson | stevemar: looks like there are already docs... and it's apparently really easy to use. | 18:59 |
| bknudson | just import it! http://docs.openstack.org/developer/oslo.policy/usage.html | 19:00 |
| bknudson | this must be one of the steps in the graduation process | 19:00 |
| marekd | dolphm: reading question for py26 - i think it's already resolved, right? | 19:00 |
| marekd | dolphm: i had no special reason for not supporting federation in py26 except for the fact that it was already (or almos) deprecated in whole OpenStack. | 19:01 |
| *** markvoelker has quit IRC | 19:01 | |
| stevemar | bknudson, well, those steps aren't wrong for most projects! just import! | 19:02 |
| stevemar | now using the actual enforcement... thats another story | 19:02 |
| *** joesavak has quit IRC | 19:02 | |
| *** angelamolock has quit IRC | 19:03 | |
| *** angelamo_ has quit IRC | 19:03 | |
| *** angelamolock has joined #openstack-keystone | 19:03 | |
| *** rushiagr is now known as rushiagr_away | 19:03 | |
| *** angelamolock has quit IRC | 19:04 | |
| lhcheng | hi folks, does User in v3 support 'description' attribute? | 19:04 |
| lhcheng | It is documented here: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#users-v3-users | 19:04 |
| lhcheng | But I don't see it in the user table. | 19:04 |
| *** angelamolock has joined #openstack-keystone | 19:04 | |
| lhcheng | Should that be removed in the docs? | 19:04 |
| bknudson | lhcheng: it's probably stored in the extras column. | 19:05 |
| morganfainberg | lhcheng, what bknudson said. description is not a first-class attribute in the storage backend. it gets stored in the icky json blob | 19:06 |
| lhcheng | yeah, it would probably be. But wondering if we should include that in the docs since it is an "official" column | 19:06 |
| lhcheng | *not | 19:06 |
| morganfainberg | lhcheng, long term i want extra attrs to die. | 19:06 |
| morganfainberg | lhcheng, but we should not remove it from the docs. | 19:06 |
| bknudson | lhcheng: I don't think we can change the docs now since that wouldn't be backwards compatible. | 19:06 |
| lhcheng | ah, and keep the description? | 19:06 |
| samueldmq | dstanek, ping - sorry for the delay, I was in a meeting | 19:06 |
| morganfainberg | it's been supported for a loooooong time and people expect it there | 19:06 |
| samueldmq | dstanek, you still around? | 19:06 |
| morganfainberg | removing from the docs implies we don't need it/support it. | 19:07 |
| lhcheng | bkundson: okay.. kinda weird to have a description on a user :P | 19:07 |
| bknudson | lhcheng: pretty much every system that stores users supports a description. | 19:07 |
| bknudson | lhcheng: have you used systems that have users that don't support a description? | 19:08 |
| lhcheng | morganfainberg: okay. working on adding the user schema at the moment, just found it weird that there is a description attribute but it is not in the table. | 19:08 |
| morganfainberg | lhcheng, think of it like "who the heck is this... what if it's a service account' - similar: what is the gecos field in a unix user used for? - "description data" | 19:08 |
| morganfainberg | we just left it a little more free-form rather than comma delimited | 19:09 |
| stevemar | its definitely needed i think | 19:09 |
| morganfainberg | bknudson, lets hope your slew of backports all pass gate :) | 19:09 |
| lhcheng | bknudson: I don't see a description field on both hpcloud and rackspace signup page :P | 19:09 |
| morganfainberg | bknudson, those all look nice and important. | 19:10 |
| morganfainberg | lhcheng, the deployer may not expose it to the end user | 19:10 |
| morganfainberg | lhcheng, but it's there. | 19:10 |
| morganfainberg | lhcheng, well RAX i dunno, they don't use keystone | 19:10 |
| *** thedodd has joined #openstack-keystone | 19:10 | |
| morganfainberg | lhcheng, [or didn't yet] | 19:10 |
| morganfainberg | for public cloud | 19:10 |
| morganfainberg | HP uses some form of keystone with some extras. | 19:10 |
| morganfainberg | so i'm sure the data is there just hiding - but i also know they don't use SQL as the store. | 19:11 |
| lhcheng | morganfainberg: I wrote some of it, don't recall it having a description :P | 19:12 |
| morganfainberg | lhcheng, if it has the extra support | 19:12 |
| morganfainberg | description is wedged in there | 19:12 |
| morganfainberg | just hiding | 19:12 |
| morganfainberg | [and yes extra attributes is part of our API :( ] | 19:12 |
| lhcheng | morganfainberg: not saying having description is wrong, just confirming if the keystone doc is correct :) | 19:13 |
| morganfainberg | lhcheng, yeah in this case it's correct :) | 19:13 |
| morganfainberg | stevemar, http://status.openstack.org/zuul/ look at all that keystone in the gate! | 19:13 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:14 | |
| bknudson | gate hogs! | 19:14 |
| morganfainberg | bknudson, who does that keystone team think they are!? | 19:14 |
| lhcheng | morganfainberg: because in other entities, we have an explicit "description" column. so wondered if the doc is accurate. | 19:14 |
| morganfainberg | sadly i think everything in there might fail because library cap issues. | 19:15 |
| stevemar | marekd, lhcheng is this better or worse for the javascript post back? http://paste.openstack.org/show/163333/ | 19:16 |
| lhcheng | morganfainberg: okay, I'll add the "description" in the user schema then. | 19:16 |
| *** raildo has joined #openstack-keystone | 19:17 | |
| *** marg7175_ has quit IRC | 19:20 | |
| *** aix has quit IRC | 19:21 | |
| *** marg7175 has joined #openstack-keystone | 19:21 | |
| lhcheng | stevemar: Instead of hard-coding the html, thinking if having a html template file be better. If the user want to have a different postback mechanism they can override the html template. | 19:21 |
| stevemar | lhcheng, not a bad idea | 19:23 |
| stevemar | morganfainberg, looks like we earned our citizenship | 19:25 |
| morganfainberg | LOL | 19:26 |
| henrynash | bknudson: if you get a chance, if you could see you are happy with the changes I made in response to your comments on: https://review.openstack.org/#/c/144824/19 | 19:27 |
| morganfainberg | henrynash i'm still slogging through the split change | 19:28 |
| morganfainberg | henrynash, i think i need to take another break. it's a beast. | 19:29 |
| *** tellesnobrega_ has quit IRC | 19:29 | |
| morganfainberg | jamielennox|away, https://review.openstack.org/#/c/141944/ is going to merge conflict (cc stevemar since you also +2'd) if the current in-flight ksc changes merge | 19:29 |
| *** ajayaa has quit IRC | 19:29 | |
| henrynash | morganfainberg: I’ll owe you….you can extract payment in terms of your choice in Vancouver | 19:30 |
| henrynash | (hmm, probably a dangerous offer to make) | 19:30 |
| morganfainberg | henrynash, promise me you'll not do 1400+ lines of change again, i'll be happy with that as the payment | 19:30 |
| gyee | morganfainberg, dolphm, stevemar, https://review.openstack.org/#/c/150190/ | 19:30 |
| gyee | I roll everything into one | 19:30 |
| henrynash | morganfainberg: ok, it’s a fair exchange! | 19:30 |
| marekd | stevemar: let me see. | 19:30 |
| *** marg7175 has quit IRC | 19:31 | |
| gyee | marekd, u 2 | 19:31 |
| morganfainberg | henrynash, then the next massive change i get to -2? ;) | 19:31 |
| marekd | stevemar: i'd put this JS into some static file | 19:31 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:32 | |
| *** marg7175 has joined #openstack-keystone | 19:32 | |
| morganfainberg | henrynash, also i wont approve that change in either case until the gate is a bit less cranky | 19:33 |
| morganfainberg | stevemar, can i ask you a huge favor if you have a little bandwidth | 19:34 |
| morganfainberg | stevemar, can you look at: https://review.openstack.org/#/c/141944/ | 19:34 |
| morganfainberg | erm | 19:34 |
| morganfainberg | sorry | 19:34 |
| marekd | gyee: morganfainberg stevemar dolphm btw i'd really like to be able NOT to call external process. | 19:34 |
| morganfainberg | stevemar, https://bugs.launchpad.net/keystone/+bug/1410622 | 19:34 |
| TempLPBugBot | Launchpad bug 1410622 in OpenStack Compute (nova) "nova is still broken with boto==2.35*" (affected: 1, heat: 6) [High,Triaged] | 19:34 |
| dolphm | marekd: ++ | 19:34 |
| gyee | marekd, me 2! | 19:34 |
| dolphm | but, .. | 19:34 |
| *** tellesnobrega_ has quit IRC | 19:34 | |
| morganfainberg | hey! that bot makes that so much better again. | 19:34 |
| gyee | do we have a python lib for xml digsig? | 19:35 |
| marekd | digsig ? | 19:35 |
| morganfainberg | gyee in-python crypto tends to get reaaaaaaally ugly | 19:35 |
| gyee | digital signature | 19:35 |
| raildo | gyee, can you review the reseller spec? :) https://review.openstack.org/#/c/139824/ | 19:35 |
| marekd | morganfainberg: i am guessing C dependencies wrapped with some Python are a no-go? :( | 19:35 |
| gyee | raildo, on my todo list | 19:35 |
| raildo | gyee, great, thank you :) | 19:36 |
| morganfainberg | marekd, well it just falls into eventlet doesn't play nice. in keystone less of an issue if it goes elsewhere it becomes yeild-point issues | 19:36 |
| stevemar | morganfainberg, i'll try looking at it, but i'm short on time these days | 19:36 |
| gyee | m2crypto | 19:36 |
| * gyee dive under the table | 19:36 | |
| morganfainberg | gyee, no. | 19:36 |
| morganfainberg | gyee, stop it | 19:36 |
| *** tellesnobrega_ has joined #openstack-keystone | 19:36 | |
| morganfainberg | gyee, and m2 has the same issue as i just described | 19:36 |
| morganfainberg | gyee, :P | 19:37 |
| * gyee hide under the carpet | 19:37 | |
| morganfainberg | stevemar, i'm hoping to have all 20 bugs triaged today | 19:37 |
| morganfainberg | stevemar, but that one is the one that is going to take a bit more time, i'd rather delegate that over to someone to check if possible so i can hit the others | 19:37 |
| marekd | morganfainberg: what are yield point issues? | 19:38 |
| morganfainberg | marekd, eventlet does coroutine $stuff$ | 19:38 |
| marekd | morganfainberg: yes. | 19:38 |
| marekd | single threaded in generla. | 19:38 |
| morganfainberg | marekd, when you're hitting c-libs eventlet does a bad job of knowing when it can yield | 19:38 |
| morganfainberg | or at all | 19:38 |
| marekd | morganfainberg: so dropping eventlet would lead us into a lands where clibs are freely used? | 19:39 |
| morganfainberg | so you can bind things up. CPU intensive and/or c-backed stuff (mysqldb) all causes these issues. Crypto hits both - either CPU intensive [can't yeild] or c-lib [also can't] | 19:39 |
| *** gokrokve has joined #openstack-keystone | 19:39 | |
| morganfainberg | popen is nice because it's I/O, and i/o can yield. | 19:39 |
| morganfainberg | marekd, well it trades gil and other issues for the eventlet issues | 19:40 |
| morganfainberg | marekd, for us, droppiong eventlet would be an overall win | 19:40 |
| marekd | morganfainberg: in c libs you can release GIL and in fact have realy multi threaded app. | 19:40 |
| morganfainberg | a lot of our new functionality is all apache / webserver module driven anyway, and eventlet can't/wont support it | 19:40 |
| morganfainberg | marekd, assuming not a bad clib | 19:41 |
| morganfainberg | marekd, that is a BIG assumption | 19:41 |
| morganfainberg | but yes, it is possible | 19:41 |
| *** tellesnobrega__ has joined #openstack-keystone | 19:41 | |
| *** tellesnobrega_ has quit IRC | 19:41 | |
| marekd | morganfainberg: well, one can write wrapper as part of patches for Keystone. | 19:41 |
| marekd | c-wrapper | 19:41 |
| morganfainberg | also dropping eventlet eliminates threadlocal issues | 19:41 |
| morganfainberg | but in short - I want to deprecate eventlet support in keystone. | 19:42 |
| morganfainberg | to do that, i think we need to cleanup the deployment story w/ apache/nginx/whateveryouareusing | 19:42 |
| morganfainberg | i expect that to be a possibility next cycle fwiw | 19:42 |
| marekd | i'd like to see keystone + nginx | 19:43 |
| morganfainberg | marekd, i've deployed it | 19:43 |
| *** tellesnobrega__ has quit IRC | 19:43 | |
| morganfainberg | marekd, it works. the big issue is gunicorn [if you use it] tends to get it's config stomped on by oslo.config | 19:43 |
| morganfainberg | for some reason i haven't spent more than a couple minutes looking at [this was ~2yrs ago, might not be a problem anymore] | 19:43 |
| morganfainberg | i also would like to see uwsgi as an option | 19:43 |
| *** angelamolock has quit IRC | 19:44 | |
| marekd | let's rewrite Keystone in Go :-) | 19:44 |
| morganfainberg | most of it is documentation. then we can play scenario deployment - testing fun :) | 19:44 |
| morganfainberg | marekd, ha. ha. ha. ha. ha. | 19:44 |
| morganfainberg | marekd, i vote erlang | 19:44 |
| marekd | why? | 19:45 |
| morganfainberg | marekd, why not? | 19:45 |
| marekd | :-) | 19:45 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 19:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 19:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 19:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 19:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 19:46 |
| morganfainberg | though honestly, in keystone i *really* miss c and c++ isms | 19:46 |
| samueldmq | henrynash, ^ new chain ... I'd like to ensure the behavior is correct now (with your tests) and you are ok with my regex in tests .. | 19:46 |
| morganfainberg | we could bake keystone into a c++ lib, then link it into an apache / nginx module -- then place it in-front of all the openstack services [/me stops before someone things i'm serious] | 19:46 |
| samueldmq | henrynash, once I have that, I'll go to a detailed review on my chain looking for nits, documentation, etc | 19:47 |
| morganfainberg | even better. we could rewrite it in lua. | 19:47 |
| henrynash | samueldmq: I’ll take a look over it tonigt, run my tests etc. | 19:47 |
| rodrigods | morganfainberg, lol | 19:47 |
| morganfainberg | WAIT I KNOW, it can be one giant oracle stored proceedure! | 19:47 |
| * morganfainberg wonders who has tried to run keystone with oracle as the db backend. | 19:48 | |
| morganfainberg | someone must have. | 19:48 |
| rodrigods | yes, we must have some oracle db deployments | 19:49 |
| samueldmq | henrynash, great! thanks | 19:49 |
| morganfainberg | rodrigods, does it... work? | 19:49 |
| rodrigods | morganfainberg, I think with some hacks in the sqlalchemy part, why not? | 19:50 |
| *** chrisshattuck has joined #openstack-keystone | 19:51 | |
| *** tellesnobrega_ has joined #openstack-keystone | 19:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Surface the user_id and project_id beyond the plugin https://review.openstack.org/132030 | 19:53 |
| *** tellesnobrega_ has quit IRC | 19:54 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: create _member_ role as specified in CONF https://review.openstack.org/142897 | 19:55 |
| stevemar | morganfainberg, that bug is dirty | 19:57 |
| stevemar | i looked into it | 19:57 |
| stevemar | i'll ping mriedemann when hes out of his meeting | 19:57 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add fetch revocations for v2.0 https://review.openstack.org/141935 | 20:00 |
| samueldmq | easy review: could some other core take a look at and possible +2+workflow https://review.openstack.org/#/c/150574/ ? | 20:01 |
| *** jsavak has quit IRC | 20:01 | |
| *** joesavak has joined #openstack-keystone | 20:03 | |
| *** angelamolock has joined #openstack-keystone | 20:04 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add fetch revocations for v3 https://review.openstack.org/142128 | 20:04 |
| *** thedodd has quit IRC | 20:04 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Allow v3 plugins to opt out of service catalog https://review.openstack.org/142991 | 20:04 |
| *** angelamolock has quit IRC | 20:05 | |
| *** jsavak has joined #openstack-keystone | 20:09 | |
| *** SpamapS has joined #openstack-keystone | 20:10 | |
| *** r-daneel has joined #openstack-keystone | 20:11 | |
| morganfainberg | stevemar, thanks | 20:11 |
| morganfainberg | stevemar, topol: https://etherpad.openstack.org/p/adklfjdsfkj | 20:11 |
| morganfainberg | ayoung, henrynash, dolphm, dstanek, gyee, jamielennox|away, bknudson, ^ | 20:11 |
| *** joesavak has quit IRC | 20:11 | |
| ayoung | morganfainberg, ehterpad? | 20:12 |
| morganfainberg | ayoung, why not? | 20:12 |
| topol | morganfainberg... OMG WHAT ARE YOU DOING??? Oh wait let me reread it :-) | 20:12 |
| morganfainberg | before i send to the ML | 20:12 |
| ayoung | nah, there were a couple other links above, but I see they are merge messages...etherpad looks good | 20:12 |
| morganfainberg | and this will be cross-posted to operators and main ML as well | 20:13 |
| bknudson | morganfainberg: +2 on the etherpad contents | 20:13 |
| ayoung | morganfainberg, I'm going to try to sneak in an alternate intro....one sec | 20:13 |
| morganfainberg | ayoung, sure. i might veto, but ;) | 20:13 |
| ayoung | Feel free to. | 20:13 |
| morganfainberg | ayoung, but i wanted feedback before sending so please do add alternatives :) | 20:14 |
| *** jaosorior has quit IRC | 20:14 | |
| *** r-daneel has quit IRC | 20:16 | |
| morganfainberg | seriously, feel free to add stuff in-line like that | 20:16 |
| morganfainberg | i have the original copy saved | 20:16 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add auth plugin params to doc https://review.openstack.org/141681 | 20:17 |
| morganfainberg | topol, ^ | 20:17 |
| ayoung | morganfainberg, how's that? It is less alarmist, and more to the point. | 20:17 |
| morganfainberg | ayoung, sure. | 20:17 |
| morganfainberg | looks good. | 20:17 |
| morganfainberg | feel free to shuffle things around | 20:18 |
| morganfainberg | the only thing i ask is that we keep the basic structure, intro/background/problem/FAQ | 20:18 |
| *** thedodd has joined #openstack-keystone | 20:19 | |
| topol | morganfainberg its looks great to me. I made some very minor suggestions you can feel free to take or leave | 20:21 |
| morganfainberg | i like em | 20:21 |
| openstackgerrit | Nathan Kinder proposed openstack/oslo.policy: Improve policy documentation https://review.openstack.org/150953 | 20:22 |
| morganfainberg | ayoung, added your info stuff in where i think it fits | 20:24 |
| morganfainberg | topol, ^ | 20:24 |
| topol | morganfainberg. Still looks very good to me | 20:24 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add validate token for v2.0 https://review.openstack.org/141944 | 20:25 |
| topol | morganfainberg if the note was any longer you would risk folks not reading it. So I think we are good | 20:25 |
| morganfainberg | i don't know how many other times we can say "NOT REMOVING LDAP IDENTITY" | 20:26 |
| morganfainberg | how much you want to bet people will freak about ldap identity when this is sent? | 20:26 |
| topol | morganfainberg. I think its perfect. | 20:26 |
| ayoung | works for me | 20:26 |
| morganfainberg | subject is: [Keystone] Deprecation of LDAP Assignment (Only Affects Project/Tenant/Role/Assignment info in LDAP) | 20:27 |
| topol | If after reading this note you still have concerns Please contact dolphm | 20:27 |
| morganfainberg | lol | 20:27 |
| topol | (for the freak outs :-) ) | 20:27 |
| morganfainberg | Joe Heck* | 20:27 |
| morganfainberg | termie! | 20:27 |
| topol | noooo. He would be like, um yeah you are totally screwed. Sorry | 20:28 |
| morganfainberg | ok | 20:28 |
| morganfainberg | sending | 20:28 |
| *** nellysmitt has joined #openstack-keystone | 20:28 | |
| * morganfainberg dons flame-proof suit | 20:28 | |
| topol | ... can I crash at your place <insert foreign city residence here> when I goto <insertforeign country> | 20:29 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Add validate token for v3 https://review.openstack.org/142147 | 20:29 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 20:29 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Add API documentation https://review.openstack.org/150956 | 20:30 |
| morganfainberg | hmm ok one of these emails went to the wrong place already | 20:30 |
| morganfainberg | *doh* | 20:30 |
| topol | bknudson, whats the over under on a product guy misreading morganfainbergs note and you getting an urgent call? :-) I'm going with 2 | 20:32 |
| dstanek | morganfainberg: the top explicitly says only CERN is using LDAP assignment, but the FAQ makes it seem like there are others | 20:32 |
| morganfainberg | dstanek, cern is the only confirmed | 20:33 |
| morganfainberg | dstanek, the FAQ was meant to be more inclusive | 20:33 |
| *** nellysmitt has quit IRC | 20:33 | |
| morganfainberg | anyway lets see how many product people freak | 20:33 |
| mfisch | see subject of morganfainberg's email, commence panic! ;) | 20:34 |
| morganfainberg | mfisch, you too!? :P | 20:34 |
| * morganfainberg fwds to product person saying "OMG LOOK AT THE CRAZY PTL" | 20:34 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Fix project metadata https://review.openstack.org/150957 | 20:35 |
| mfisch | depreciation is the French word for "work required for mfisch" - true fact | 20:35 |
| mfisch | deprecation I mean! | 20:35 |
| mfisch | depreciation is bad too | 20:35 |
| morganfainberg | mfisch, depreciation? | 20:35 |
| morganfainberg | ;) | 20:35 |
| morganfainberg | i mean... | 20:35 |
| morganfainberg | sure! | 20:35 |
| mfisch | like glance changing the backend name from file to filesystem wow thats lots better! | 20:36 |
| morganfainberg | topol, i guarantee i'm going to get the same call from HP folks | 20:36 |
| topol | morganfainberg, you need to add the following video to the email. Kevin Bacon in Animal House... "All is Well" https://www.youtube.com/watch?v=zDAmPIq29ro | 20:36 |
| mfisch | good, kill LDAP assignment with fire morganfainberg (now that I've read more) | 20:37 |
| mfisch | I'm already using an out of tree driver for ident but basic sql for assignment | 20:37 |
| topol | mfisch did you watch me video clip | 20:39 |
| * topol wonders why no one appreicates my 50 year old movie references | 20:39 | |
| mfisch | topol: is this you in the toga? https://www.youtube.com/watch?v=NqpNQ9AJYgU | 20:40 |
| topol | mfisch that will cost you!!! :-) | 20:41 |
| mfisch | lol | 20:42 |
| stevemar | what the change we have to make to specify a config setting multiple times... | 20:43 |
| stevemar | like we do with the notification drive... | 20:43 |
| stevemar | ahh cfg.MultiStrOpt | 20:44 |
| stevemar | thanks stevemar | 20:44 |
| *** nellysmitt has joined #openstack-keystone | 20:45 | |
| *** jaosorior has joined #openstack-keystone | 20:53 | |
| morganfainberg | http://blogs.scientificamerican.com/oscillator/files/2013/07/feynman_algorithm.jpg | 20:54 |
| stevemar | haha | 21:00 |
| *** raildo has quit IRC | 21:01 | |
| marekd | simple! | 21:03 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Explicit configuration object https://review.openstack.org/150969 | 21:03 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Explicit configuration object https://review.openstack.org/150969 | 21:04 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate LDAP Assignment Backend https://review.openstack.org/150970 | 21:06 |
| stevemar | marekd, i'm assuming you are cool if i change that option for a trusted horizon to multiString | 21:07 |
| stevemar | so you can do trusted_horizon=x.com then next line, trusted_horizon=y.com | 21:08 |
| stevemar | and i will loop through | 21:08 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Implement Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 21:08 |
| marekd | stevemar: ^^ | 21:08 |
| stevemar | marekd, thank you | 21:08 |
| marekd | stevemar: re: multi string - yes, please. | 21:08 |
| marekd | stevemar: please see comments. | 21:09 |
| stevemar | ahhh cool | 21:09 |
| stevemar | i missed that | 21:09 |
| *** dims has quit IRC | 21:10 | |
| marekd | setUp you mean? | 21:12 |
| marekd | stevemar: thanks! | 21:13 |
| gyee | morganfainberg, sorry for being late to the party, the LDAP deprecation email looks good | 21:13 |
| gyee | just got back to my desk | 21:14 |
| marekd | morganfainberg: gyee ayoung: review for K2K: https://review.openstack.org/#/c/104623/ | 21:14 |
| *** breton has quit IRC | 21:14 | |
| gyee | marekd, yes sir | 21:14 |
| gyee | I'll review it after the reseller thingy | 21:14 |
| marekd | gyee: you have few hours as I will probably logout soon :-) | 21:15 |
| *** dims has joined #openstack-keystone | 21:16 | |
| gyee | allllrighty then | 21:17 |
| rodrigods | gyee, ++ Reseleer ;) | 21:18 |
| *** zz_avozza is now known as avozza | 21:20 | |
| marekd | a question. Is it possible to dynamically fetch attributes from CONF objects ? | 21:21 |
| marekd | something like getattr() in Python, where attribute name doesnt need to be known apriori. | 21:21 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: create _member_ role as specified in CONF https://review.openstack.org/142897 | 21:21 |
| gyee | marekd, I think you'll have to register the attribute first | 21:21 |
| *** nellysmitt has quit IRC | 21:22 | |
| nkinder | morganfainberg: have you received any hate mail yet about LDAP "going away"? ;) | 21:22 |
| morganfainberg | nkinder, not yet | 21:23 |
| gyee | nkinder, LDAP is not going away, it'll just get reincarnated | 21:25 |
| morganfainberg | nkinder, someone will freak i'm sure and i'll get forced to jump on some phone call with someone | 21:25 |
| morganfainberg | or gyee will :P | 21:26 |
| * gyee hide under the carpet again | 21:26 | |
| marekd | gyee: hm, i don't think so - look at keystone.conf [auth] section. You specify new authN method and later add parameter with the driver class. | 21:26 |
| gyee | marekd, right, but you'll still need to register them at some point | 21:26 |
| gyee | that's how oslo conf works I think | 21:27 |
| gyee | everything needs to be registered | 21:27 |
| marekd | gyee: adding a line "saml2= auth.plugins.mapped.Mapped" in keystone.conf/[auth] counts as registration? | 21:28 |
| marekd | gyee: maybe we are talking about sth different. | 21:28 |
| *** marg7175 has quit IRC | 21:29 | |
| marekd | anybody ^^ ? | 21:29 |
| gyee | marekd, oh, that part should work fine, everything in methods are registered | 21:30 |
| *** radez is now known as radez_g0n3 | 21:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 21:32 |
| stevemar | marekd, lhcheng ^^ | 21:32 |
| marekd | yes, but what i want to do is something like http://pasteraw.com/gyg0ze3ylqj4do945011t7onqv2qprf and ofc i don't want to pre register saml2 section in cfg. | 21:34 |
| marekd | morganfainberg: ^^ | 21:34 |
| stevemar | marekd, isn't remote_attribute_name the same as remote_attribute_id from marco's work? | 21:35 |
| marekd | stevemar: it's the same, whatever... | 21:36 |
| marekd | but we cannot make one global parameter. | 21:37 |
| marekd | think a crazy usecase when Keystone must support SAML and OIDC | 21:37 |
| marekd | we have two parameters. | 21:37 |
| dstanek | i hate the new 'related changes' section of the new gerrit interface | 21:37 |
| marekd | dstanek: ++ and lack of dependency tree. | 21:37 |
| *** markvoelker has joined #openstack-keystone | 21:38 | |
| morganfainberg | marekd, i really dislike the whole auth plugin config section | 21:38 |
| morganfainberg | marekd, but that aside | 21:38 |
| gyee | I knew it! | 21:38 |
| marekd | morganfainberg: what can i do....:-) | 21:38 |
| morganfainberg | marekd, you can [in theory] use the config options in the plugin itself | 21:38 |
| morganfainberg | when it's loaded it'll read the values from the config file | 21:39 |
| morganfainberg | if the opts aren't there they aren't presented | 21:39 |
| morganfainberg | basically you can register opts *after* config file read and use the values that were in the config file | 21:39 |
| morganfainberg | the only downside is the opts don't appear in the sample config that way based on how we generate | 21:39 |
| marekd | morganfainberg: so http://pasteraw.com/gyg0ze3ylqj4do945011t7onqv2qprf should work even if I don't register section named saml2 in the code. | 21:40 |
| marekd | cause today somebody uses name saml2, tomorrow saml_just_becase_i_can | 21:40 |
| morganfainberg | marekd, as long as you register the options *somehow* | 21:40 |
| morganfainberg | before you use conf | 21:40 |
| marekd | morganfainberg: shit... | 21:41 |
| morganfainberg | marekd, if the option data is in the config file, it becomes available as soon as you register the opt, you can register opts at run time | 21:41 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix up _ldap_res_to_model for ldap identity backend https://review.openstack.org/150631 | 21:41 |
| morganfainberg | but you still need to register the opt before referencing it | 21:41 |
| henrynash | morganfainberg, stevemar, gyee: talking of LDAP, at some point could I get a few eyes on https://review.openstack.org/#/c/147551/5 and its dependant patch…this pushes filtering down into teh LDAP driver (I guess we can argue whether we actually include this for projects as per teh deprecation plan - but really improtant for users/groups) | 21:41 |
| stevemar | thanks nkinder | 21:41 |
| marekd | morganfainberg: btw we cannot stuf that param in the Protocol object, as PRotocols are tied to IdP objects :-) | 21:41 |
| marekd | morganfainberg: thanks for explanation. | 21:42 |
| gyee | henrynash, sure | 21:43 |
| marekd | morganfainberg: things may get screwy, but either we get very limited (and then static), or we hardcode some names in auth plugins (differenct plugin for shib, different for mellon and new patchset if something new comes in) or we dynamically store it in cfg. | 21:43 |
| morganfainberg | yeah | 21:43 |
| morganfainberg | :( | 21:44 |
| marekd | morganfainberg: hm, i am thinking about dynamic cfg registering. | 21:45 |
| marekd | say i added something in keystone.conf which is not yet registered | 21:45 |
| marekd | section called saml2 | 21:45 |
| *** tqtran is now known as tqtran_afk | 21:46 | |
| marekd | now i execute some code and figure out that i need section saml2 and there parameter foo_bar | 21:46 |
| marekd | i can register it | 21:46 |
| morganfainberg | yep | 21:46 |
| marekd | but...how i am supposed to read the value from keystone.conf? | 21:46 |
| morganfainberg | it's automatically read when keystone.conf is read | 21:46 |
| morganfainberg | it just isn't presented in the CONF object until the opts are registered | 21:46 |
| marekd | ok, so after i register it, it will become present. | 21:47 |
| morganfainberg | yep | 21:47 |
| marekd | morganfainberg: ok | 21:47 |
| *** jsavak has quit IRC | 21:48 | |
| *** marg7175 has joined #openstack-keystone | 21:50 | |
| *** vhoward has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: IDP ID registration and validation https://review.openstack.org/148229 | 22:00 |
| marekd | stevemar: morganfainberg ^^ | 22:00 |
| marekd | hopefully this will be mergable now. | 22:00 |
| morganfainberg | marekd, we have to wait for grenade to be happy | 22:02 |
| morganfainberg | marekd, so probably not today :( | 22:02 |
| *** briancurtin has joined #openstack-keystone | 22:03 | |
| *** mattfarina has quit IRC | 22:03 | |
| *** topol has quit IRC | 22:03 | |
| marekd | morganfainberg: i meant mergable from meritorical point of view :-) | 22:06 |
| marekd | morganfainberg: so we are all happy and nobody has any issues. | 22:07 |
| stevemar | marekd, looking now | 22:09 |
| marekd | stevemar: thanks | 22:09 |
| stevemar | marekd, whaa, we haven't merged this one yet? | 22:10 |
| *** Ctina__ has quit IRC | 22:11 | |
| marekd | stevemar: no, there was this one thing i was not sure how to do right. | 22:15 |
| marekd | now i know, so tomorrow i am going to start implementing it. | 22:15 |
| marekd | ok, going to bed. good night. | 22:18 |
| stevemar | marekd, o/ gnite | 22:22 |
| *** jasondot_ has quit IRC | 22:23 | |
| *** marekd has left #openstack-keystone | 22:28 | |
| *** bknudson has quit IRC | 22:29 | |
| *** marekd has joined #openstack-keystone | 22:34 | |
| *** marekd has left #openstack-keystone | 22:34 | |
| *** marekd has joined #openstack-keystone | 22:34 | |
| openstackgerrit | Matt Riedemann proposed openstack/python-keystoneclient: Fix type in Ec2Signer class docstring https://review.openstack.org/151020 | 22:34 |
| openstackgerrit | Matt Riedemann proposed openstack/python-keystoneclient: Fix typo in Ec2Signer class docstring https://review.openstack.org/151020 | 22:35 |
| *** pnavarro has quit IRC | 22:43 | |
| stevemar | gordc, you think you can do a minor release of pycadf? | 22:45 |
| stevemar | so i can pull in those changes i made | 22:45 |
| openstackgerrit | gordon chung proposed openstack/pycadf: add helper module https://review.openstack.org/149706 | 22:48 |
| gordc | now? or tomorrow morning? | 22:49 |
| gordc | stevemar: ^ | 22:49 |
| stevemar | gordc, whenever | 22:49 |
| gordc | stevemar: i'll just do it now i guess... i'll be on for a bit (to see the world implode) | 22:49 |
| *** joesavak has joined #openstack-keystone | 22:50 | |
| *** bknudson has joined #openstack-keystone | 22:51 | |
| *** ChanServ sets mode: +v bknudson | 22:51 | |
| stevemar | gordc, mehhh should be harmless | 22:52 |
| stevemar | thats what we said about the last one | 22:52 |
| *** sriram has quit IRC | 22:53 | |
| *** henrynash has quit IRC | 22:59 | |
| *** jorge_munoz has left #openstack-keystone | 22:59 | |
| *** openstackgerrit has quit IRC | 23:06 | |
| *** openstackgerrit has joined #openstack-keystone | 23:06 | |
| *** EmilienM is now known as EmilienM|afk | 23:08 | |
| *** carlosmarin has quit IRC | 23:13 | |
| *** jodah has joined #openstack-keystone | 23:16 | |
| jodah | I'm experiencing sporadic auth failures via keystone middleware using a brand new token. For example, over a 10 second period I'll have auth requests alternate between succeeding and failing - same token. Any pointers? | 23:17 |
| jodah | ex output: http://paste.openstack.org/show/163400/ | 23:17 |
| *** carlosmarin has joined #openstack-keystone | 23:21 | |
| bknudson | jodah: what token backend are you using? | 23:21 |
| *** gordc has quit IRC | 23:22 | |
| jodah | bknudson: not sure if this is what you mean: driver = keystone.assignment.backends.sql.Assignment | 23:23 |
| *** carlosmarin has quit IRC | 23:24 | |
| *** tellesnobrega_ has joined #openstack-keystone | 23:24 | |
| *** jsavak has joined #openstack-keystone | 23:27 | |
| *** joesavak has quit IRC | 23:28 | |
| gyee | rodrigods, not trying to stall, I am trying to get some detail requirements from our product management before diving into reviewing reseller spec | 23:33 |
| *** thedodd has quit IRC | 23:33 | |
| gyee | hopefully I'll get some answers today | 23:33 |
| *** gokrokve has quit IRC | 23:33 | |
| rodrigods | gyee, nice, use cases are always good in this cases :) | 23:34 |
| gyee | yeah man, I want to see what their expectations are | 23:34 |
| rodrigods | gyee, you can review some code though: https://review.openstack.org/#/c/148567/ and https://review.openstack.org/#/c/148618/ | 23:35 |
| rodrigods | :) | 23:35 |
| *** timcline_ has joined #openstack-keystone | 23:38 | |
| *** timcline_ has quit IRC | 23:38 | |
| *** jsavak has quit IRC | 23:39 | |
| *** timcline has quit IRC | 23:42 | |
| jodah | bknudson: Seems to have been an issue related to system time. The keystone server's system clock was 2 hours behind where the middleware was deployed. Not sure if that matters. The behavior is certainly a corner case to consider though. | 23:43 |
| *** jell has quit IRC | 23:43 | |
| jodah | Getting the system time straight, the issue disappears. | 23:43 |
| morganfainberg | jodah, it could | 23:43 |
| bknudson | stevemar: don't we have rules against approving changes from all-IBM ? https://review.openstack.org/#/c/147639/ | 23:43 |
| jodah | I would expect if anything, the token would expire and stay expired. What I was seeing was success, fail, success, fail, etc. | 23:44 |
| morganfainberg | jodah, not sure tbh | 23:44 |
| stevemar | bknudson, d'oh! | 23:44 |
| morganfainberg | jodah, but i could see odd behavior | 23:44 |
| jodah | This happened previously on a new system that didn't have ntpd running | 23:44 |
| jodah | I had just forgotten the fix :) | 23:44 |
| morganfainberg | you might have significant jitter in the clock | 23:44 |
| bknudson | maybe we could have keystone / auth_token middleware protect themselves from clock skew. | 23:45 |
| jodah | yea, possible | 23:45 |
| morganfainberg | bknudson, ^ | 23:45 |
| morganfainberg | s/^/yes | 23:45 |
| stevemar | morganfainberg, https://review.openstack.org/#/c/147639/ | 23:45 |
| jodah | All I could point out - New ubuntu VM, devstack installed, start hitting nova and trove with requests via Curl and this is what I hit. | 23:45 |
| bknudson | all it would require is if one or the other knows the time on the other side -- which I think is in headers. | 23:45 |
| gyee | bknudson, how about just ask operators to run ntpd :) | 23:46 |
| jodah | gyee: I think that's a fair request to avoid unexpected auth failures, but not the flapping back and forth | 23:47 |
| bknudson | gyee: apparently not as easy as it sounds. | 23:47 |
| gyee | bknudson, really? what's not easy about it? | 23:47 |
| gyee | atomic clock baby! | 23:47 |
| bknudson | there's still problems with relativity and speed of light delays. | 23:48 |
| stevemar | hehe | 23:48 |
| bknudson | of course if they used a client cert they wouldn't need a token. | 23:48 |
| gyee | damn straight! | 23:48 |
| bknudson | SSL handshake would have problems with clock skew too since the cert would show up as expired. | 23:49 |
| jodah | Trying to reproduce this again now and I can't. The clock was off by 2 hours for my time zone. Installed and started ntp. Now even if I stop ntp and force the clock back I can't reproduce. | 23:49 |
| bknudson | jodah: the auth_token middleware has problems with caching the token in different threads... I've seen issues where the token works or not going against nova api. | 23:51 |
| gyee | bknudson, my favor SSL error, the certificate is not yet valid | 23:51 |
| bknudson | I think if you set up auth_token middleware to use memcache to cache tokens instead of the in-memory one it'll be more consistent. | 23:52 |
| *** tqtran_afk is now known as tqtran | 23:52 | |
| jodah | will try, tnx | 23:52 |
| gyee | bknudson, in theory, only way the token is not valid is there exist an entry in memcache which cached the token as invalid | 23:53 |
| jodah | in this case the middleware thought the tokens were expired | 23:53 |
| gyee | if token does not exist in memcache, it'll call back to keystone to validate | 23:53 |
| gyee | if it expired, it will disappear from memcache | 23:53 |
| gyee | at least in theory anyway | 23:54 |
| jodah | http://paste.openstack.org/raw/163418/ | 23:54 |
| bknudson | gyee: I don't think the memcache entry sets the cache line expiration time to the token expiration time... this was something I was going to look into. | 23:54 |
| *** jaosorior has quit IRC | 23:54 | |
| gyee | bknudson, no shit! really?!! | 23:54 |
| gyee | I thought we do that | 23:55 |
| jodah | still - if the memcache or in memory token cache had a diff initial time for an entry than was correct - it' could see the thing as expired | 23:55 |
| bknudson | gyee: http://git.openstack.org/cgit/openstack/keystonemiddleware/tree/keystonemiddleware/auth_token.py#n1893 -- it always uses self._cache_time, not the token expiration time. | 23:56 |
| gyee | bknudson, I thought we take the min(cache_time, expire) | 23:58 |
| bknudson | gyee: if the token expires and it's not in the cache then auth_token would have to go back to the server which would make more traffic. | 23:58 |
| bknudson | so maybe it's better to keep the token in the cache after the expiration time. | 23:59 |
| gyee | bknudson, k, make sense, I think that might explain what jodah's seeing | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
