| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 00:31 |
|---|---|---|
| *** ncoghlan has joined #openstack-keystone | 00:31 | |
| openstackgerrit | Merged openstack/python-keystoneclient-kerberos: Move to hacking 0.10 https://review.openstack.org/146362 | 00:31 |
| *** oomichi has joined #openstack-keystone | 00:32 | |
| openstackgerrit | Merged openstack/python-keystoneclient-federation: Move to hacking 0.10 https://review.openstack.org/146359 | 00:33 |
| openstackgerrit | Merged openstack/python-keystoneclient-federation: Correct failures for check W292 https://review.openstack.org/146360 | 00:34 |
| *** henrynash has quit IRC | 00:35 | |
| *** kfox1111 has quit IRC | 00:56 | |
| openstackgerrit | Merged openstack/python-keystoneclient: make req_ref doesn't require id https://review.openstack.org/148499 | 01:04 |
| openstackgerrit | Merged openstack/python-keystoneclient: Configure TCP Keep-Alive for certain Sessions https://review.openstack.org/147707 | 01:04 |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix typo in Ec2Signer class docstring https://review.openstack.org/151020 | 01:05 |
| openstackgerrit | Merged openstack/python-keystoneclient: handles keyboard interrupt https://review.openstack.org/121046 | 01:06 |
| *** nellysmitt has joined #openstack-keystone | 01:08 | |
| *** nellysmitt has quit IRC | 01:12 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Correct failures for check H238 https://review.openstack.org/146337 | 01:14 |
| *** avozza is now known as zz_avozza | 01:20 | |
| openstackgerrit | ZhiQiang Fan proposed openstack/python-keystoneclient: Enable hacking rule E122 and H304 https://review.openstack.org/134101 | 01:24 |
| *** davechen_ has joined #openstack-keystone | 01:47 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract the Loadable interface from a plugin https://review.openstack.org/138575 | 02:10 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make session use the Loadable interface https://review.openstack.org/138576 | 02:10 |
| *** joesavak has joined #openstack-keystone | 02:11 | |
| *** zz_avozza is now known as avozza | 02:11 | |
| *** erkules_ has joined #openstack-keystone | 02:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 02:15 |
| *** joesavak has quit IRC | 02:15 | |
| *** erkules has quit IRC | 02:17 | |
| *** avozza is now known as zz_avozza | 02:23 | |
| *** nellysmitt has joined #openstack-keystone | 03:08 | |
| *** nellysmitt has quit IRC | 03:13 | |
| *** stevemar has joined #openstack-keystone | 03:44 | |
| *** ChanServ sets mode: +v stevemar | 03:44 | |
| *** dims has joined #openstack-keystone | 03:49 | |
| *** dims_ has joined #openstack-keystone | 03:51 | |
| *** jacer_huawei has joined #openstack-keystone | 03:54 | |
| *** jacer_huawei is now known as wanghong | 03:54 | |
| *** dims has quit IRC | 03:55 | |
| *** tellesnobrega has joined #openstack-keystone | 04:05 | |
| *** dims_ has quit IRC | 04:12 | |
| openstackgerrit | takehirokaneko proposed openstack/keystone: Adds a validation param "max_username_size". https://review.openstack.org/128504 | 04:28 |
| *** spandhe has joined #openstack-keystone | 04:33 | |
| *** rushiagr_away is now known as rushiagr | 04:39 | |
| *** zz_avozza is now known as avozza | 04:43 | |
| *** avozza is now known as zz_avozza | 04:53 | |
| *** nellysmitt has joined #openstack-keystone | 05:09 | |
| *** pnavarro has quit IRC | 05:11 | |
| *** darrenc has joined #openstack-keystone | 05:12 | |
| *** dims has joined #openstack-keystone | 05:12 | |
| darrenc | hi | 05:12 |
| *** nellysmitt has quit IRC | 05:14 | |
| darrenc | I've got a question on configuring keystone for multiple LDAP servers. Any takers? | 05:14 |
| *** dims has quit IRC | 05:17 | |
| stevemar | darrenc, ask away, but worst case also ask on the mailing list | 05:26 |
| *** richm has quit IRC | 05:37 | |
| *** zz_avozza is now known as avozza | 05:44 | |
| *** oomichi has quit IRC | 05:47 | |
| *** ncoghlan has quit IRC | 05:50 | |
| *** ncoghlan has joined #openstack-keystone | 05:50 | |
| *** avozza is now known as zz_avozza | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/151856 | 06:03 |
| darrenc | St | 06:03 |
| darrenc | stevemar I'm updating http://docs.openstack.org/admin-guide-cloud/content/configuring-keystone-for-ldap-backend-assignments.html for configuring multiple LDAP servers. So wherever keystone.conf file is mentioned, should domain specific configuration files be mentioned for multiple LDAP servers? | 06:08 |
| stevemar | darrenc, ah i see you added henrynash on your patch too: https://review.openstack.org/#/c/151980/ | 06:10 |
| darrenc | Yes :) | 06:10 |
| stevemar | darrenc, the docs looks solid, all mentions to keystone.domain_name.conf | 06:12 |
| stevemar | darrenc, i think you want to use 'multiple backends' instead of 'multiple LDAP servers' | 06:13 |
| stevemar | cause you can have one domain use sql, and another use ldap | 06:13 |
| darrenc | Ok, thanks! | 06:15 |
| darrenc | stevemar so the identity assignment split for configuring keystone.Conf also applies for keystone.domain_name.conf files? | 06:18 |
| darrenc | Typing is hard on an android phone :) | 06:19 |
| stevemar | darrenc, haha, i bet - theres a weird set of requirements there, let me see if i can explain it | 06:20 |
| stevemar | darrenc, so if you are using ldap for assignment (projects, role, etc), then you must use ldap for identity (users, groups). | 06:20 |
| stevemar | darrenc, but if you are using sql for assignment, then you can use any combination of 0 or more ldap and sql backends for identity | 06:21 |
| stevemar | darrenc, i hope that is right, and henrynash doesn't throw things at me for giving false information | 06:21 |
| *** tellesnobrega_ has joined #openstack-keystone | 06:30 | |
| darrenc | stevemar I think it's making sense to me now. | 06:32 |
| *** tellesnobrega has quit IRC | 06:32 | |
| darrenc | Thanks so much for your help | 06:32 |
| darrenc | And kudos to Henry as well! | 06:34 |
| *** ajayaa has joined #openstack-keystone | 06:38 | |
| *** jaosorior has joined #openstack-keystone | 06:39 | |
| *** ajayaa has quit IRC | 06:44 | |
| *** zz_avozza is now known as avozza | 06:44 | |
| *** MasterPiece has joined #openstack-keystone | 07:02 | |
| *** nellysmitt has joined #openstack-keystone | 07:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 07:12 |
| *** ajayaa has joined #openstack-keystone | 07:13 | |
| *** nellysmitt has quit IRC | 07:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 07:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Publicize region/endpoint/policy/service events https://review.openstack.org/151774 | 07:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notification handling for policy/region/service/endpoint https://review.openstack.org/151786 | 07:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a test for create_domain in notifications https://review.openstack.org/151791 | 07:15 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 07:16 |
| *** avozza is now known as zz_avozza | 07:16 | |
| *** afazekas has joined #openstack-keystone | 07:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add context to manager classes that send notifications https://review.openstack.org/151866 | 07:18 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - Add CADF notifications for trusts https://review.openstack.org/151867 | 07:18 |
| *** zz_avozza is now known as avozza | 07:49 | |
| *** davechen_ has quit IRC | 07:52 | |
| *** mflobo has joined #openstack-keystone | 07:58 | |
| *** MasterPiece has quit IRC | 07:59 | |
| *** chlong has quit IRC | 08:00 | |
| *** spandhe has quit IRC | 08:06 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fix typo in Patch #142743 https://review.openstack.org/152016 | 08:07 |
| marekd | stevemar: wow, you are fast! | 08:08 |
| stevemar | marekd, :D | 08:08 |
| marekd | why are you still working? | 08:08 |
| marekd | are you ever sleeping? :-) | 08:08 |
| *** ajayaa has quit IRC | 08:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documetation for key types and basic authenticating https://review.openstack.org/152018 | 08:10 |
| stevemar | marekd, i drank tea too late | 08:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documetation for key terms and basic authenticating https://review.openstack.org/152018 | 08:11 |
| stevemar | marekd, anyway, heading to sleep now | 08:13 |
| stevemar | see - i'm human(ish) | 08:13 |
| marekd | stevemar: go ahead! | 08:13 |
| marekd | stevemar: your twitter handle (stevebot) is completely justified. | 08:13 |
| stevemar | marekd, hehe, all the other stevemar related ones were taken, i think some folks must think i'm a twitter bot | 08:14 |
| stevemar | marekd, i'm out, have a good day sir | 08:15 |
| marekd | good night, sir! | 08:15 |
| *** stevemar has quit IRC | 08:19 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: During authentication validate if IdP is enabled https://review.openstack.org/151683 | 08:25 |
| *** ajayaa has joined #openstack-keystone | 08:27 | |
| *** henrynash has joined #openstack-keystone | 08:29 | |
| *** ChanServ sets mode: +v henrynash | 08:29 | |
| *** nellysmitt has joined #openstack-keystone | 08:36 | |
| *** bdossant has joined #openstack-keystone | 08:37 | |
| *** mzbik has joined #openstack-keystone | 08:41 | |
| *** bjornar has joined #openstack-keystone | 08:44 | |
| *** jaosorior has quit IRC | 08:46 | |
| *** nkinder has joined #openstack-keystone | 08:48 | |
| *** rwsu has joined #openstack-keystone | 08:49 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from service provider. https://review.openstack.org/152046 | 08:49 |
| *** rwsu is now known as rwsu-afk | 08:50 | |
| *** jistr has joined #openstack-keystone | 08:58 | |
| *** erkules_ is now known as erkules | 09:00 | |
| *** ncoghlan has quit IRC | 09:02 | |
| *** mflobo has quit IRC | 09:12 | |
| *** mflobo has joined #openstack-keystone | 09:16 | |
| *** bdossant has quit IRC | 09:24 | |
| *** MasterPiece has joined #openstack-keystone | 09:33 | |
| *** obutenko has joined #openstack-keystone | 09:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Fixes 'OS-INHERIT:inherited_to' info in tests https://review.openstack.org/144542 | 09:59 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 10:00 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from service provider. https://review.openstack.org/152046 | 10:00 |
| *** henrynash has quit IRC | 10:02 | |
| *** henrynash has joined #openstack-keystone | 10:08 | |
| *** ChanServ sets mode: +v henrynash | 10:08 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor role assignment assertions https://review.openstack.org/144543 | 10:10 |
| *** therve` is now known as therve | 10:17 | |
| *** ajayaa has quit IRC | 10:18 | |
| *** henrynash has quit IRC | 10:22 | |
| *** rushiagr is now known as rushiagr_away | 10:24 | |
| *** tellesnobrega_ has quit IRC | 10:42 | |
| *** samueldmq has joined #openstack-keystone | 10:45 | |
| *** ajayaa has joined #openstack-keystone | 10:46 | |
| *** rushiagr_away is now known as rushiagr | 10:47 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from service provider https://review.openstack.org/152046 | 10:56 |
| *** andreaf_ is now known as andreaf | 10:58 | |
| *** samueldmq has quit IRC | 11:00 | |
| *** samueldmq has joined #openstack-keystone | 11:05 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Update doc for generating SAML2 assertion https://review.openstack.org/152083 | 11:09 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 11:12 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 11:15 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 11:15 |
| *** pnavarro has joined #openstack-keystone | 11:21 | |
| *** pnavarro has quit IRC | 11:27 | |
| *** anish has joined #openstack-keystone | 11:29 | |
| anish | Is keystone a hard requirement for running openstack ? I seem to be running into a bunch of oslo namespace issues when using devstack wrt keystone, can I just skip it ? | 11:33 |
| *** tellesnobrega has joined #openstack-keystone | 11:34 | |
| samueldmq | anish, Keystone is the a key stone for running openstack :) | 11:35 |
| samueldmq | anish, it provides authentication and authorization for other OS components.. yes, it a critical component I'd say :) | 11:36 |
| anish | I thought as much | 11:37 |
| anish | especially when disable_service is clearly ignored | 11:37 |
| samueldmq | anish, I think #openstack-sdks is the right place to talk about devstack issues :) | 11:38 |
| samueldmq | anish, maybe you hit bugs .. and we need you to tell us about them | 11:38 |
| anish | samueldmq: http://ix.io/g6u | 11:39 |
| anish | from what I understand, the namespace changes are ongoing in all projects | 11:39 |
| anish | keystone just seems a little behind ? | 11:39 |
| anish | but this is what I really am stuck on : ImportError: No module named keystoneclient.common | 11:39 |
| samueldmq | anish, are you just trying to run a regular devstack (downloaded and tried ./stack.sh) ? | 11:41 |
| anish | yes | 11:41 |
| samueldmq | anish, trying .... | 11:44 |
| anish | exact same issue with keystoneclient as well, oslo.utils -> oslo_utils | 11:45 |
| *** rushiagr is now known as rushiagr_away | 11:56 | |
| *** diegows has joined #openstack-keystone | 12:03 | |
| *** avozza is now known as zz_avozza | 12:05 | |
| *** htruta has joined #openstack-keystone | 12:09 | |
| *** raildo has joined #openstack-keystone | 12:10 | |
| anish | samueldmq: don't know if you hit it, but I was able to get past that with the patch I linked + some more changes | 12:10 |
| *** rushiagr_away is now known as rushiagr | 12:12 | |
| openstackgerrit | Anish Bhatt proposed openstack/keystone: Update as per oslo namespace changes. Devstack seems broken without these changes https://review.openstack.org/152095 | 12:17 |
| samueldmq | anish, sorry but I didnt hit it ... maybe someone else can confirm it later, when more people are active | 12:20 |
| anish | weird. I made a patch for review anyways, in case other ppl see this | 12:22 |
| anish | samueldmq: you were using a fresh devstack with RECLONE=yes ? | 12:22 |
| *** aix has joined #openstack-keystone | 12:31 | |
| *** nellysmitt has quit IRC | 12:38 | |
| *** nellysmi_ has joined #openstack-keystone | 12:38 | |
| *** nellysmi_ has quit IRC | 12:39 | |
| *** zz_avozza is now known as avozza | 12:41 | |
| marekd | nkinder: hi. I cannot remember - did you have a chance to test mod_mellon with ECP support? | 12:43 |
| nkinder | marekd: ECP is still being developed for mod_auth_mellon | 12:44 |
| marekd | nkinder: so I guess you will not support idea where Keystone issues ECP-formated assertion in K2K case? :-) | 12:45 |
| nkinder | marekd: well, I hope ECP is working in mellon very soon (we're actively working on it) | 12:46 |
| marekd | nkinder: you are using lasso underneath, right? | 12:46 |
| nkinder | marekd: yes, and lasso looks to have ECP | 12:46 |
| *** markvoelker has joined #openstack-keystone | 12:50 | |
| openstackgerrit | Anish Bhatt proposed openstack/keystone: Update as per oslo namespace changes. Devstack seems broken without these changes https://review.openstack.org/152095 | 12:51 |
| *** rushiagr is now known as rushiagr_away | 12:51 | |
| *** dims has joined #openstack-keystone | 12:52 | |
| *** dims_ has joined #openstack-keystone | 12:52 | |
| *** dims has quit IRC | 12:56 | |
| *** nellysmitt has joined #openstack-keystone | 12:58 | |
| *** markvoelker has quit IRC | 13:00 | |
| *** ajayaa has quit IRC | 13:05 | |
| *** richm has joined #openstack-keystone | 13:06 | |
| *** markvoelker has joined #openstack-keystone | 13:12 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 13:13 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 13:15 |
| marekd | morganfainberg: https://review.openstack.org/#/c/152046/6/keystone/contrib/federation/controllers.py,cm (line 294). I would like to return two extra parameters in HTTP headers, so the keystoneclient knows where to hit Service Providers. | 13:16 |
| marekd | rodrigods: hello boss | 13:16 |
| *** joesavak has joined #openstack-keystone | 13:17 | |
| marekd | rodrigods: do you think you will be able to work on service catalog soon ? Not rushing, just checking :-) | 13:17 |
| *** samueldmq has quit IRC | 13:23 | |
| *** jsavak has joined #openstack-keystone | 13:24 | |
| rodrigods | marekd, hi... yes, I can. Will let you know if something appears | 13:25 |
| marekd | rodrigods: well, i can work on it | 13:25 |
| marekd | i just thought you wanted to. | 13:26 |
| rodrigods | marekd, yep... but you can take it over, np :) | 13:26 |
| *** joesavak has quit IRC | 13:27 | |
| marekd | rodrigods: OK. YOu are probably busy. | 13:27 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Update doc for generating SAML2 assertion https://review.openstack.org/152083 | 13:28 |
| *** jaosorior has joined #openstack-keystone | 13:29 | |
| *** amakarov has quit IRC | 13:31 | |
| *** bjornar has quit IRC | 13:40 | |
| *** avozza is now known as zz_avozza | 13:49 | |
| *** gordc has joined #openstack-keystone | 13:50 | |
| *** gordc_ has joined #openstack-keystone | 13:52 | |
| *** samueldmq has joined #openstack-keystone | 13:53 | |
| *** bjornar has joined #openstack-keystone | 13:54 | |
| *** richm has quit IRC | 14:02 | |
| *** rushiagr_away is now known as rushiagr | 14:03 | |
| *** MasterPiece has quit IRC | 14:03 | |
| *** dims_ has quit IRC | 14:03 | |
| *** mzbik has quit IRC | 14:19 | |
| *** amakarov has joined #openstack-keystone | 14:29 | |
| *** zigo has quit IRC | 14:31 | |
| *** junhongl__ has quit IRC | 14:32 | |
| *** dims has joined #openstack-keystone | 14:33 | |
| *** xxj has quit IRC | 14:34 | |
| *** wpf1 has quit IRC | 14:34 | |
| *** dims_ has joined #openstack-keystone | 14:34 | |
| *** zigo has joined #openstack-keystone | 14:35 | |
| *** esp has quit IRC | 14:38 | |
| *** dims has quit IRC | 14:38 | |
| *** esp has joined #openstack-keystone | 14:41 | |
| *** chuckcarmack has joined #openstack-keystone | 14:44 | |
| *** jasondot_ has joined #openstack-keystone | 14:45 | |
| *** xxj has joined #openstack-keystone | 14:45 | |
| *** wpf1 has joined #openstack-keystone | 14:46 | |
| *** junhongl__ has joined #openstack-keystone | 14:46 | |
| *** rm_work is now known as rm_work|away | 14:47 | |
| *** zz_avozza is now known as avozza | 14:49 | |
| *** openstackgerrit has quit IRC | 14:52 | |
| *** openstackgerrit has joined #openstack-keystone | 14:52 | |
| openstackgerrit | Merged openstack/pycadf: Add a new CADF type for keystone trusts https://review.openstack.org/151536 | 14:52 |
| *** ayoung has joined #openstack-keystone | 14:58 | |
| *** ChanServ sets mode: +v ayoung | 14:58 | |
| *** jsavak has quit IRC | 15:03 | |
| *** joesavak has joined #openstack-keystone | 15:03 | |
| *** rm_work|away is now known as rm_work | 15:04 | |
| *** marg7175 has joined #openstack-keystone | 15:06 | |
| *** jsavak has joined #openstack-keystone | 15:10 | |
| *** carlosmarin has joined #openstack-keystone | 15:11 | |
| *** dims_ has quit IRC | 15:13 | |
| *** joesavak has quit IRC | 15:13 | |
| *** dims has joined #openstack-keystone | 15:14 | |
| *** richm has joined #openstack-keystone | 15:14 | |
| *** timcline has joined #openstack-keystone | 15:24 | |
| *** timcline has quit IRC | 15:25 | |
| *** timcline has joined #openstack-keystone | 15:25 | |
| rodrigods | bknudson, ping re: your comment regarding the utils.positional decorator here https://review.openstack.org/#/c/115770/18/keystoneclient/v3/projects.py | 15:28 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 15:28 |
| rodrigods | bknudson, what did you meant by error? | 15:28 |
| *** ajayaa has joined #openstack-keystone | 15:31 | |
| bknudson | rodrigods: should be utils.positional.EXCEPT | 15:32 |
| bknudson | rodrigods: see http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/utils.py#n274 | 15:32 |
| bknudson | also, there's lots of documentation for that class. | 15:32 |
| rodrigods | bknudson, thanks | 15:36 |
| bknudson | rodrigods: there ought to be a test where projects.create is called with parent=a project object , rather than parent=a string | 15:38 |
| bknudson | since that's supported | 15:38 |
| *** henrynash has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v henrynash | 15:39 | |
| rodrigods | bknudson, ok, thanks | 15:39 |
| bknudson | should be able to call get() to get a Project object and then pass it to create() | 15:39 |
| bknudson | maybe create() returns a Project object? Then could call create() to create the parent and then create() again to create the sub-project. | 15:40 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Fix rst markup in docstring https://review.openstack.org/152160 | 15:40 |
| *** nkinder has quit IRC | 15:43 | |
| *** henrynash has quit IRC | 15:46 | |
| *** andreaf is now known as andreaf_ | 15:47 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 15:52 |
| rodrigods | bknudson, tried to address all your comments ^ | 15:53 |
| rodrigods | bknudson, thanks for the review | 15:53 |
| bknudson | rodrigods: is there some reason that test_create_with_parent_project needs to copy so much code from test_create? why not just use test_create? | 15:56 |
| bknudson | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/v3/utils.py#n196 | 15:56 |
| *** henrynash has joined #openstack-keystone | 15:59 | |
| *** ChanServ sets mode: +v henrynash | 15:59 | |
| rodrigods | bknudson, there was a patchset in which we were reusing test_create | 15:59 |
| rodrigods | bknudson, not sure why I reverted that | 15:59 |
| bknudson | rodrigods: that seems like the best way to go if it can do the testing we need. | 16:00 |
| bknudson | or, it might be better to fix test_create() so that it can do what's needed. | 16:00 |
| bknudson | since other tests will probably want to do the same thing. | 16:00 |
| rodrigods | bknudson, gotcha | 16:00 |
| rodrigods | henrynash, can you take a look in https://review.openstack.org/#/c/148567/ ? addressed your comments after the rebase | 16:01 |
| *** zzzeek has joined #openstack-keystone | 16:03 | |
| *** rodrigods has left #openstack-keystone | 16:07 | |
| *** rodrigods has joined #openstack-keystone | 16:07 | |
| openstackgerrit | Merged openstack/oslo.policy: Correct docstring references https://review.openstack.org/151813 | 16:07 |
| *** bjornar has quit IRC | 16:07 | |
| *** stevemar has joined #openstack-keystone | 16:07 | |
| *** ChanServ sets mode: +v stevemar | 16:07 | |
| *** thedodd has joined #openstack-keystone | 16:09 | |
| rodrigods | bknudson, there are no tests where it passes an entity instead of the ID (for several objects, like users and projects (with domains)), think we can improve test_create() to check this cases but in a different patch, what do you think? | 16:10 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Hierarchical multitenancy basic calls https://review.openstack.org/115770 | 16:10 |
| *** chuckcarmack has left #openstack-keystone | 16:10 | |
| bknudson | rodrigods: what happens if an object is passed? | 16:11 |
| rodrigods | bknudson, the parameter goes through this method: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L34 | 16:11 |
| rodrigods | bknudson, now I see it accepts only dicts and strings, not the object itself | 16:12 |
| rodrigods | bknudson, oops, its the contrary :) | 16:12 |
| bknudson | rodrigods: getid will return obj.id. | 16:12 |
| bknudson | if it's got one. | 16:12 |
| rodrigods | bknudson, yes... | 16:13 |
| henrynash | rodigods: done | 16:16 |
| *** abhirc has joined #openstack-keystone | 16:16 | |
| raildo | stevemar, ping, I'm creating the API spec for reseller and I need to mark this new API calls to expiremntal. morganfainberg spoke to me that you know what I have to do. Can you help me with this? | 16:17 |
| *** david-lyle_afk is now known as david-lyle | 16:19 | |
| openstackgerrit | Merged openstack/oslo.policy: Add docstrings for check classes https://review.openstack.org/151822 | 16:21 |
| openstackgerrit | Merged openstack/oslo.policy: Remove use of graduated modules https://review.openstack.org/151829 | 16:21 |
| stevemar | raildo, i'll ping you back in a bit about the details for that | 16:23 |
| raildo | stevemar, great. thanks! | 16:24 |
| raildo | morganfainberg, I commit the API spec with the reseller spec or is it better commit in a separate patch? | 16:31 |
| rodrigods | henrynash, not sure if I follow your suggestion here https://review.openstack.org/#/c/148618/15/keystone/tests/test_v3_assignment.py | 16:31 |
| rodrigods | henrynash, thanks for the review, btw | 16:31 |
| henrynash | rodigods: so _build_subtree_as_ids_dict() takes list of caches subtrees (if I am understanding the code right)….I’d just like a more complex tree to ensure this is working correctly…i.e. multiliple children of A, of which at least 2 have sub projects | 16:34 |
| *** rwsu-afk is now known as rwsu | 16:40 | |
| *** hogepodge has quit IRC | 16:40 | |
| *** gyee has joined #openstack-keystone | 16:50 | |
| *** ChanServ sets mode: +v gyee | 16:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 16:57 |
| stevemar | gordc, damn, i was hoping you could definitively give me an answer if re-using `resource_info` was a bad idea or not | 16:57 |
| gordc | stevemar: you can probably tack on resource_info to the same location... it'd be better if you had it in 'target' | 17:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 17:00 |
| gordc | stevemar: i think for me, it's more should you be using same event_type if it's a noticeably different message | 17:00 |
| *** abhirc_ has joined #openstack-keystone | 17:01 | |
| *** timcline has quit IRC | 17:01 | |
| rodrigods | henrynash, gotcha | 17:01 |
| *** timcline has joined #openstack-keystone | 17:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 17:02 |
| morganfainberg | raildo, either | 17:03 |
| *** abhirc has quit IRC | 17:03 | |
| *** tqtran has joined #openstack-keystone | 17:04 | |
| raildo | morganfainberg, ok :) | 17:04 |
| samueldmq | henrynash, ping | 17:05 |
| *** hogepodge has joined #openstack-keystone | 17:05 | |
| henrynash | samueldmq: hi.... | 17:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 17:05 |
| rodrigods | henrynash, are you ok with a hierarchy like http://paste.openstack.org/raw/165680/ ? | 17:06 |
| samueldmq | henrynash, thanks for rebasing that chain, I'm working now on fixing some nits , etc | 17:06 |
| *** timcline has quit IRC | 17:06 | |
| henrynash | samueldmq: I’m just rebasing them all | 17:06 |
| *** timcline has joined #openstack-keystone | 17:06 | |
| samueldmq | henrynash, yes I saw :) | 17:06 |
| henrynash | samueldmq: since all the following on ones suffer | 17:06 |
| samueldmq | henrynash, ++ | 17:06 |
| stevemar | gordc, i figured we could save on a lot of ceilometer code changes this way :) | 17:07 |
| *** hogepodge has quit IRC | 17:07 | |
| gordc | stevemar: lol. | 17:07 |
| rodrigods | morganfainberg, https://review.openstack.org/#/c/148567/ was already approved but I had to rebase =/ | 17:08 |
| gordc | i mean it's not the end of the world... you definitely shouldn't send it twice like your current code does though. | 17:08 |
| breton | so, was the client released? | 17:08 |
| morganfainberg | breton: no, that was one of my plans for today. | 17:08 |
| *** hogepodge has joined #openstack-keystone | 17:09 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 17:09 |
| morganfainberg | Though, we maaaaaay want to wait till after this week. So accidental breakage doesn't clog the gate. | 17:09 |
| morganfainberg | Ttx might appreciate that. | 17:09 |
| morganfainberg | jamielennox: ^ still would be early feb. Just right post k2 | 17:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 17:10 |
| stevemar | gordc, the config option should keep it to either one or the other, not both being emitted btw | 17:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 17:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 17:11 |
| *** henrynash has quit IRC | 17:12 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 17:18 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Implements subtree_as_ids query param https://review.openstack.org/148618 | 17:18 |
| *** EmilienM is now known as EmilienM|afk | 17:18 | |
| gordc | stevemar: ... oh. right. the logic was split in two different places... i'll take a look again after lunch | 17:21 |
| dstanek | ayoung: can you confirm that this has been implemented: https://review.openstack.org/#/c/148053/ | 17:21 |
| *** _cjones_ has joined #openstack-keystone | 17:22 | |
| gyee | morganfainberg, https://bugs.launchpad.net/python-keystoneclient/+bug/1417189 | 17:26 |
| TempLPBugBot` | Launchpad bug 1417189 in python-keystoneclient "Keystone v2 list users by name should be supported to avoid potential performance problem" (affected: 1, heat: 6) [Undecided,New] | 17:26 |
| morganfainberg | gyee: is that a cli request or a lib request? | 17:26 |
| morganfainberg | If it's cli- the answer is very simple. If it's lib, as long as keystone supports it in its api that is fine to add. | 17:27 |
| gyee | morganfainberg, lib fix is essential | 17:27 |
| gyee | morganfainberg, I'll trying to fix lib first, then the CLI part if needed | 17:28 |
| morganfainberg | Cli is not going to happen in keystoneclient. | 17:29 |
| morganfainberg | Also listing users is insane. | 17:30 |
| gyee | :) | 17:30 |
| morganfainberg | But that is a different topic. | 17:30 |
| stevemar | gyee, i don't see how you can fix that? | 17:30 |
| gyee | yeah, fetch all then do linear search | 17:30 |
| stevemar | gyee, unless you try .get(id) first | 17:30 |
| morganfainberg | gyee: uh isn't there a get user by name? | 17:30 |
| gyee | stevemar, marganfainberg, right, get user by name is supported | 17:31 |
| morganfainberg | Rest api that is? | 17:31 |
| gyee | we just need to pass the param from keystoneclient | 17:31 |
| morganfainberg | Oh god. No wait. Is that an api? | 17:31 |
| gyee | si amigo | 17:31 |
| morganfainberg | Ugh. | 17:31 |
| stevemar | gyee, oh just pass --name to the list() function | 17:31 |
| morganfainberg | No it's list + filter | 17:31 |
| gyee | yes | 17:31 |
| morganfainberg | It isn't "get user by name" | 17:31 |
| stevemar | list + filter won't work i think | 17:32 |
| morganfainberg | Why do we need to support this in client? | 17:32 |
| gyee | because API supports it | 17:32 |
| morganfainberg | That isn't going to solve the performance issue. | 17:32 |
| morganfainberg | Fwiw, client or server will still be doing the insane question. | 17:33 |
| morganfainberg | With 400.000 records you are asking an insane question. | 17:33 |
| stevemar | i needs to call .get with the exact user name | 17:33 |
| stevemar | it* | 17:33 |
| gyee | morganfainberg, if we pass the param, LDAP filter will be constructed accordingly | 17:33 |
| morganfainberg | Expect insane behavior (not saying we can't fix but today it will be just as bad) | 17:33 |
| gyee | stevemar, user_id is not known ahead of time | 17:34 |
| gyee | just username | 17:34 |
| stevemar | gyee, i'd be happy to be wrong, try it out | 17:34 |
| morganfainberg | gyee: it might be less expensive to POST a new user and get a conflict than do a linear search. Out ldap backend doesn't filter well | 17:34 |
| gyee | stevemar, I got fart in the face last week because of this one | 17:34 |
| morganfainberg | Our* | 17:35 |
| gyee | morganfainberg, it does, get_user_by_name() does contrust the proper LDAP filter | 17:35 |
| gyee | construct | 17:35 |
| gyee | we just need to trigger it | 17:36 |
| morganfainberg | List != call get user by name. | 17:36 |
| morganfainberg | Don't expect it to | 17:36 |
| gyee | but that's now the API works right? GET /v2.0/users?name=foo | 17:36 |
| gyee | that's the same paradigm v3 is using I think | 17:37 |
| gyee | s/using/following/ | 17:37 |
| *** marg7175 has quit IRC | 17:37 | |
| morganfainberg | Check. I think it actually hits the list function. | 17:38 |
| *** marg7175 has joined #openstack-keystone | 17:38 | |
| gyee | yes, keystoneclient actually calls the list() function | 17:38 |
| gyee | if we pass that param, we can avoid cache all users | 17:39 |
| morganfainberg | Do not assume the server is doing something sane in this regard. | 17:39 |
| *** jistr has quit IRC | 17:39 | |
| gyee | no, not assuming anything, just do what the API said :) | 17:40 |
| morganfainberg | If you want a get user by name, it should be its own api. If the action is "list" don't trust the server to not be doing the same insane thing and getting 400,000 records back | 17:40 |
| gyee | oh | 17:40 |
| gyee | I am cool with a separate call | 17:40 |
| gyee | more obvious | 17:40 |
| morganfainberg | Now there is a bigger issue | 17:41 |
| morganfainberg | Usernames are not urlsafe | 17:41 |
| morganfainberg | Afaik | 17:41 |
| gyee | urlencode? | 17:41 |
| *** _cjones_ has quit IRC | 17:41 | |
| morganfainberg | Crappy ux to ask the client to do so, but probably required. Unless you implement a "find user" where you can use post | 17:42 |
| morganfainberg | S/client/user | 17:42 |
| gyee | morganfainberg, why ask the clients to do it, we can do urlencode before putting it onto the wire right? | 17:42 |
| morganfainberg | gyee: direct api requests. | 17:43 |
| gyee | but can't we do this in keystoneclient? | 17:43 |
| gyee | or you mean on the documentation side? | 17:43 |
| morganfainberg | We can, but again, crappy ux when not using ksc | 17:43 |
| gyee | heh | 17:43 |
| gyee | I see | 17:43 |
| morganfainberg | I really think this is a 2 fold problem: 1) God the directory server is horribly misconfigured. | 17:44 |
| morganfainberg | 2) I think the user is doing things very wrong and we could advise changing how things are done to mitigate the issue. This won't be fixed simply with a client fix | 17:45 |
| gyee | but they can't avoid it through, there are really that many users | 17:45 |
| morganfainberg | It likely requires keystone fixes as well, meaning performance issue doesn't go away. | 17:45 |
| *** atiwari1 has quit IRC | 17:46 | |
| gyee | I suppose they can configure it to limit the number of entries return, but that won't solve the problem | 17:46 |
| morganfainberg | Don't do a name-based search through 400,000 users | 17:46 |
| morganfainberg | Let's start there. | 17:46 |
| gyee | I don't see a really good alternative given that all they got is username to start with | 17:47 |
| gyee | but yes, we need a server side fix at some point | 17:47 |
| gyee | fetch all and then do linear search is bad | 17:47 |
| gyee | double bad | 17:47 |
| morganfainberg | A better solution in this case is try to make the user - fail when there is a conflict. | 17:48 |
| morganfainberg | In the os-config bit. Fail gracefully | 17:48 |
| morganfainberg | rather than look for the user before creating. | 17:48 |
| gyee | sure they can do that, but that would be like trying to dance around API limitations | 17:49 |
| morganfainberg | Same concept of how we handle it in code for a lot of things. Cheaper to get a failure than a look for things before we create it. | 17:49 |
| gyee | in theory, lookup by name should be efficient | 17:49 |
| morganfainberg | The API is limited. And you are always going to be dancing around it | 17:49 |
| morganfainberg | Except not all deployments are asking an insane question "list all my users". I'd argue .find() is a bad api on keystoneclient to support. | 17:50 |
| stevemar | gyee, it's not really an API limitation, it's an LDAP limitation | 17:51 |
| gyee | stevemar, people program to API, not implementation | 17:51 |
| morganfainberg | gyee: in this case they are programming to the implementation! | 17:51 |
| morganfainberg | The API does not support "get user by name" | 17:52 |
| gyee | no, they call find user by name and expect it to be happy | 17:52 |
| gyee | it does | 17:52 |
| *** _cjones_ has joined #openstack-keystone | 17:52 | |
| morganfainberg | Keystoneclient is the implementation. They are not programming to the API | 17:52 |
| morganfainberg | .find is a bad api to use with a lot of users | 17:53 |
| gyee | keystoneclient is API right? | 17:53 |
| morganfainberg | S/api/call | 17:53 |
| morganfainberg | gyee: it's an abstraction over the API. | 17:53 |
| morganfainberg | And in this case it provides a poor call to something the API doesn't support | 17:54 |
| gyee | short of asking them to write their own client, we'll need to fix the stuff | 17:54 |
| morganfainberg | We do not need to fix this. We could fix os-config | 17:54 |
| gyee | I don't understand, but what is 'GET /v2.0/users?name=foo'? | 17:55 |
| morganfainberg | That is telling the server to filter. That may or may not be a good call to make when you have 400,000 records. | 17:55 |
| stevemar | we need another +2/+A on this chain https://review.openstack.org/#/c/148019/ | 17:55 |
| morganfainberg | Filtering is at best partially implemented "correctly". Even in the best apps you might get crap performance with tons of records to search through. You *do* program to the known limitations | 17:57 |
| gyee | so keystoneclient will not support it even though API does? | 17:57 |
| morganfainberg | The point is the API doesn't really support it. | 17:57 |
| morganfainberg | It sortof does with a dodge. | 17:57 |
| morganfainberg | And likely shouldn't be used. Hell id prefer list users to go away if it was possible. | 17:58 |
| morganfainberg | It is not a sane question to ask when you have federation, multiple per-domain backends, etc | 17:59 |
| bknudson | morganfainberg: list users doesn't work if you have per-domain backends. | 17:59 |
| gyee | bknudson, this is v2 api | 17:59 |
| morganfainberg | bknudson: beat ya to it by a second. ;) | 17:59 |
| *** spandhe has joined #openstack-keystone | 17:59 | |
| gyee | this is not list users, more like find by name | 17:59 |
| morganfainberg | gyee: and v2 is rapidly headed towards deprecstion and obselecence. | 17:59 |
| bknudson | does v2 api only return the default domain users? | 17:59 |
| gyee | yes | 17:59 |
| bknudson | seems like v3 should be used if it supports what you want already | 18:00 |
| gyee | bknudson, v3 does the same thing with list users | 18:00 |
| *** EmilienM|afk is now known as EmilienM | 18:00 | |
| gyee | fetch all and do linear search | 18:00 |
| morganfainberg | bknudson: it sortof does but not well. This is another "hp has 400,000 users in something and we're searching through them" | 18:00 |
| morganfainberg | To save a conflict on create. | 18:01 |
| morganfainberg | Check if user exists, if not, create | 18:01 |
| bknudson | don't need keystone for that... do the LDAP query yourself. | 18:02 |
| gyee | hahaha | 18:02 |
| morganfainberg | The issue is triple o. | 18:02 |
| bknudson | either way I'd prefer it was implemented in v3 | 18:02 |
| morganfainberg | bknudson: I agree at the very least there. | 18:02 |
| morganfainberg | I don't want to add anything else to v2. | 18:02 |
| gyee | dude, here we are, v3 have the same problem with searches | 18:03 |
| morganfainberg | We could fix triple o here gyee | 18:03 |
| morganfainberg | It will also fix it for all keystone deploys. | 18:03 |
| gyee | sure, less work for me :) | 18:03 |
| morganfainberg | Not just kilo forward. | 18:03 |
| gyee | morganfainberg, can you reply to that email so it'll cover my ass? | 18:04 |
| openstackgerrit | Merged openstack/python-keystoneclient: Docstring usability improvements https://review.openstack.org/127856 | 18:04 |
| gyee | ask them to fix the shit in tripleO | 18:04 |
| *** _cjones_ has quit IRC | 18:06 | |
| morganfainberg | gyee: yes I'll get to it today. But the gist is going to be that fixig it in keystone is not solving the immediate problem and won't solve deployments not on kilo + because backport of a big change like this (or new apis) will not fly. | 18:06 |
| gyee | morganfainberg, thanks, that should do it | 18:07 |
| morganfainberg | If we do a get user by name api, we should at it to v3 keystone. | 18:07 |
| morganfainberg | And it will need to be classified under a specific domain | 18:07 |
| gyee | ++ | 18:08 |
| *** _cjones_ has joined #openstack-keystone | 18:08 | |
| morganfainberg | E.g. /domain/{id}/user_by_name | 18:08 |
| morganfainberg | But less crappy | 18:08 |
| morganfainberg | ;) | 18:08 |
| *** atiwari has joined #openstack-keystone | 18:08 | |
| gyee | v3 ldap code have the same problem, https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap.py#L82 | 18:10 |
| gyee | we'll need to fix that as well | 18:10 |
| stevemar | also this one is generating a lot of questions during other reviews: https://review.openstack.org/#/c/151505/ | 18:10 |
| *** thedodd has quit IRC | 18:11 | |
| morganfainberg | gyee: more to the point. Tripleo should work with a readonly ldap backend and not try to creat users. | 18:11 |
| gyee | ++, that code is crappy | 18:11 |
| morganfainberg | I assume tripleo does not have access to create users in the hp corp directory | 18:11 |
| gyee | no, it does not | 18:11 |
| morganfainberg | So why are we letting it even Ty. | 18:11 |
| morganfainberg | Try* | 18:11 |
| *** harlowja has joined #openstack-keystone | 18:11 | |
| gyee | yeah, that code is voodoo | 18:12 |
| morganfainberg | yeah this looks like an even easier fix: don't lookup the user if you aren't going to even try to add the user because it would fail anyway. | 18:12 |
| gyee | they should be able to opt-out user creation with a param or env var or something | 18:13 |
| *** rushiagr is now known as rushiagr_away | 18:14 | |
| amakarov | morganfainberg, ayoung greetings! I have a bug fix for trusts https://review.openstack.org/#/c/148642/, can you please look at it? | 18:14 |
| morganfainberg | gyee: exactly. | 18:14 |
| gyee | stevemar, a lot of questions on this one? https://review.openstack.org/#/c/151505/ | 18:16 |
| gyee | that was a joke right? | 18:16 |
| stevemar | gyee, i mean a lot of other reviews are changing the sample conf, and hitting the same changes, and reviewers are -1'ing because of it :) | 18:17 |
| gyee | isn't there a wonderful feature called "rebase" or something? | 18:17 |
| morganfainberg | Please, as core, do not minus one for sample config | 18:18 |
| gyee | yeah man, what the hell :) | 18:18 |
| morganfainberg | In fact, let's just go back to we generate he sample config every now and again | 18:18 |
| morganfainberg | If other people are -1 for not running a generate of sample config, please comment it can be done after the code lands. | 18:19 |
| morganfainberg | I'd rather have the core team run an update once a week than have the rebase hell we have now. | 18:19 |
| stevemar | morganfainberg, i'm fine with that | 18:19 |
| *** jasondot_ has quit IRC | 18:20 | |
| gyee | dude, have a bot do this! | 18:20 |
| morganfainberg | gyee: there is a lot of discussion on the ml about how openstack should handle it | 18:20 |
| morganfainberg | If I could remove the sample config until that discussion is solved, I would just to make the -1s go away | 18:20 |
| gyee | I would make the bot do it | 18:21 |
| morganfainberg | So, please don't block patches on running sample config updates. And encourage people to do those updates out of the patch chains if at all | 18:21 |
| morganfainberg | gyee: they are trying to figure out where to put sample config if at all | 18:21 |
| morganfainberg | But for now: just encourage people to run sample config updates outside of he patch chains. | 18:23 |
| gyee | personally I like sample config, saved me from digging into the code | 18:23 |
| morganfainberg | And don't block patches for it not being updated. Don't hesitate to override a -1 that is only because of sample config. | 18:23 |
| morganfainberg | (But comment to the effect) | 18:23 |
| morganfainberg | *only because they didn't update sample config | 18:24 |
| richm | hello keystone devs - looking for information about legal/illegal characters in names of users, projects, roles, and domains - are there any? I would think that "@" is not a valid character | 18:26 |
| *** ajayaa has quit IRC | 18:27 | |
| richm | the reason is puppet - we need to have unique names for resources such as users, etc. | 18:27 |
| richm | we'd like to be able to use "@" as a delimiter e.g. keystone_user { "username@domain" } | 18:27 |
| morganfainberg | richm: sadly @ has always been valid. | 18:29 |
| stevemar | richm, depends on the backend | 18:29 |
| morganfainberg | So we can't remove that. | 18:29 |
| morganfainberg | I know deployments that use email as usernames in default domain. | 18:29 |
| *** afazekas has quit IRC | 18:30 | |
| morganfainberg | Not sure how to unwind that. | 18:30 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Reseller https://review.openstack.org/139824 | 18:31 |
| openstackgerrit | Merged openstack/keystone: Fixes 'OS-INHERIT:inherited_to' info in tests https://review.openstack.org/144542 | 18:32 |
| *** anish has left #openstack-keystone | 18:38 | |
| richm | ok - so if "@" is not good, what other characters might be used? | 18:38 |
| morganfainberg | richm, i think ayoung had some ideas on how to handle that | 18:47 |
| morganfainberg | but i don't have a good answer | 18:47 |
| morganfainberg | stevemar, dstanek, dolphm, bknudson, jamielennox, ayoung, topol, http://lists.openstack.org/pipermail/openstack-dev/2015-February/055815.html | 18:48 |
| morganfainberg | quick email about sample config(s) | 18:48 |
| *** pnavarro has joined #openstack-keystone | 18:50 | |
| richm | ayoung: ping - ^^^ | 18:53 |
| samueldmq | morganfainberg, ++ on sample config regeneration :) | 18:55 |
| *** henrynash has joined #openstack-keystone | 18:55 | |
| *** ChanServ sets mode: +v henrynash | 18:55 | |
| breton | ack | 18:56 |
| *** lhcheng has joined #openstack-keystone | 18:58 | |
| *** aix has quit IRC | 18:59 | |
| *** timcline has quit IRC | 19:01 | |
| morganfainberg | breton: will sync with jamielennox today and either cut today or end of week post k2. Likely the latter. | 19:01 |
| *** jasondot_ has joined #openstack-keystone | 19:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 19:04 |
| *** timcline has joined #openstack-keystone | 19:04 | |
| morganfainberg | stevemar: +2 on a couple of specs. | 19:04 |
| *** timcline has quit IRC | 19:06 | |
| stevemar | morganfainberg, i'll take a look at the open specs | 19:06 |
| *** amakarov is now known as amakarov_away | 19:07 | |
| *** timcline has joined #openstack-keystone | 19:07 | |
| samueldmq | henrynash, I removed regex from my tests ... you convinced me that those tests should be simpler | 19:13 |
| samueldmq | henrynash, I'm working on doc improvement nw | 19:13 |
| samueldmq | s/nw/now | 19:13 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Drop URL field from region table https://review.openstack.org/150122 | 19:16 |
| henrynash | samueldmq: ol :-) | 19:18 |
| *** henrynash has quit IRC | 19:23 | |
| *** EmilienM is now known as EmilienM|afk | 19:25 | |
| openstackgerrit | Merged openstack/keystone: During authentication validate if IdP is enabled https://review.openstack.org/151683 | 19:31 |
| openstackgerrit | Merged openstack/keystone: Change oslo.utils to oslo_utils https://review.openstack.org/148019 | 19:32 |
| openstackgerrit | Merged openstack/keystone: Regenerate sample config file https://review.openstack.org/151505 | 19:32 |
| *** nellysmitt has quit IRC | 19:34 | |
| dstanek | morganfainberg: okay, dokay - i'll -1 anything that has a sample config modification | 19:36 |
| * dstanek pulls out a big red pen | 19:36 | |
| bknudson | I'm sure some of mine have sample config changes. | 19:39 |
| *** thedodd has joined #openstack-keystone | 19:41 | |
| gyee | fo sho | 19:41 |
| *** EmilienM|afk is now known as EmilienM | 19:50 | |
| *** topol has joined #openstack-keystone | 20:01 | |
| *** ChanServ sets mode: +v topol | 20:01 | |
| *** timcline has quit IRC | 20:02 | |
| *** jasondot_ has quit IRC | 20:02 | |
| *** timcline has joined #openstack-keystone | 20:02 | |
| *** timcline has quit IRC | 20:03 | |
| raildo | topol, ping, if you have some time, can you review the reseller spec? :) https://review.openstack.org/#/c/139824/ | 20:04 |
| topol | raildo, sure | 20:04 |
| *** timcline has joined #openstack-keystone | 20:04 | |
| raildo | topol, thanks! | 20:04 |
| morganfainberg | bknudson, if they have a config and merge great, if not lets push new changes over to the new email. | 20:04 |
| *** timcline_ has joined #openstack-keystone | 20:05 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 20:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 20:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Drop URL field from region table https://review.openstack.org/150122 | 20:07 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update federation config to use Service Providers https://review.openstack.org/152260 | 20:07 |
| openstackgerrit | Merged openstack/keystone: Multiple IDP authentication URL https://review.openstack.org/142743 | 20:08 |
| *** timcline has quit IRC | 20:08 | |
| rodrigods | marekd, stevemar ^ | 20:09 |
| marekd | yay | 20:09 |
| openstackgerrit | Merged openstack/keystone: Fix typo in Patch #142743 https://review.openstack.org/152016 | 20:09 |
| marekd | ^^ YAY | 20:10 |
| morganfainberg | marekd, your other spec has a +2 as well i think | 20:11 |
| morganfainberg | the map to direct users | 20:11 |
| marekd | morganfainberg: thanks! | 20:12 |
| marekd | morganfainberg: i was working on K2K and going to start implementing 'map to direct users' this week. | 20:12 |
| morganfainberg | awsome | 20:12 |
| marekd | morganfainberg: https://review.openstack.org/#/c/152046/8/keystone/contrib/federation/controllers.py,cm anyway, see here line 294. I am introducing two new params in header. If we don;t like it the sooner I know it the better :-) | 20:14 |
| morganfainberg | looking | 20:14 |
| *** Ephur has joined #openstack-keystone | 20:17 | |
| ayoung | richm, I think what we need to be able to do is use the @ to split in the mapping front end, but we can't do it as something that Keystone depends on | 20:18 |
| samueldmq | morganfainberg, do you know what is the right place to ask devstack related questions? | 20:19 |
| samueldmq | morganfainberg, is it #openstack-sdks ? | 20:19 |
| morganfainberg | samueldmq, #openstack-qa | 20:20 |
| morganfainberg | or #openstack-infra [depending on the nature of the question] | 20:20 |
| morganfainberg | if it's gate related -infra *might* get faster responses | 20:20 |
| morganfainberg | if it's devstack specific -qa is the right place | 20:21 |
| morganfainberg | as -qa owns devstack | 20:21 |
| morganfainberg | marekd, what would the alternatives to additional headers be? | 20:21 |
| morganfainberg | marekd, before i really weigh in | 20:21 |
| marekd | morganfainberg: so, this info is actually in the service catalog, but then ksc would need to store it locally for the time being where the token is traded for saml assertion, assertion is returned to the client, assertion is sent to SP_URL of the Service Provider, and later, an unscoped OS-FEDERATION token is retrieved from the Service Provider. | 20:26 |
| marekd | locally ~ somewhere in the session object. Somewhere where those parameters will persist between the HTTP calls. | 20:27 |
| morganfainberg | gyee, email reply sent | 20:32 |
| *** jasondot_ has joined #openstack-keystone | 20:33 | |
| gyee | morganfainberg, thanks! | 20:36 |
| morganfainberg | gyee, i think it'll make your job much easier | 20:37 |
| morganfainberg | proposed *just* what we talked about, triple-o able to install against read-only data store | 20:38 |
| morganfainberg | "don't even try making users" | 20:38 |
| gyee | hell yeah | 20:39 |
| gyee | you sum it up beautifully | 20:40 |
| morganfainberg | marekd, i think we could either extract from the SC and store it in session | 20:40 |
| morganfainberg | *or* use the headers | 20:40 |
| morganfainberg | this is a case i think the headers might be a better choice. | 20:40 |
| gyee | food time | 20:40 |
| morganfainberg | gyee, late today huh? | 20:41 |
| raildo | gyee, I see your comments in the reseller spec, I agree with you, I'll just wait for more comments, ok? | 20:41 |
| gyee | raildo, yeah, looks good mostly | 20:41 |
| samueldmq | morganfainberg, k thanks (#openstack-qa) | 20:41 |
| gyee | morganfainberg, yeah, good news is there's a food truck nearly where I live now :) | 20:42 |
| gyee | only vietnamese food for now | 20:42 |
| morganfainberg | marekd, i support using the headers in this case. | 20:44 |
| topol | morganfainberg, when is the deadline for specs to be merged? | 20:45 |
| *** jasondot_ has quit IRC | 20:45 | |
| marekd | morganfainberg: ++ | 20:45 |
| morganfainberg | Feb 5th | 20:45 |
| morganfainberg | topol, ^ | 20:45 |
| morganfainberg | topol, lets make it clear, Feb 5th, before 23:59 Pacific time :P | 20:45 |
| morganfainberg | after that i'll want a ML topic asking for an exception - but otherwise the specs all proposed against kilo will get a procedural -2 | 20:46 |
| morganfainberg | that haven't merged. | 20:46 |
| topol | morganfainberg, awesome. Is there a subset of ones to focus on (yes raildo, reseller :-) I know) | 20:46 |
| *** nellysmitt has joined #openstack-keystone | 20:47 | |
| raildo | topol, hahaha | 20:47 |
| morganfainberg | topol, the federation one(s) from marek | 20:47 |
| topol | morganfainberg OK. | 20:47 |
| morganfainberg | topol, and probably ayoung's ones | 20:47 |
| morganfainberg | topol, but check w/ ayoung about which ones | 20:48 |
| topol | ayoung, let me know which ones. morganfainberg said you had about 3 hot ones | 20:49 |
| ayoung | topol, morganfainberg I've given up on actually making forward progress. We don't start discussing specs until the summit, spent the first milestone squabbling, and the get to the 2nd milestone and freeze. I'm just going to keep writing code and it will get in eventually | 20:50 |
| ayoung | let's see... | 20:50 |
| marekd | topol: https://review.openstack.org/#/c/149071/ that one is mine not yet merged. | 20:51 |
| ayoung | https://review.openstack.org/#/q/status:open+project:openstack/keystone-specs+owner:ayoung,n,z thati s my list | 20:51 |
| ayoung | certmonger should get approved..that should be a no brainer | 20:51 |
| morganfainberg | ayoung, i have one comment on that one. | 20:51 |
| ayoung | yeah...I'll address shortly | 20:51 |
| openstackgerrit | Rodrigo Duarte proposed openstack/oslo.policy: Drop usage of namespaced packages https://review.openstack.org/151836 | 20:52 |
| morganfainberg | ayoung, otherwise yes that one looks fine | 20:52 |
| ayoung | morganfainberg, my view is: if certmonger is missing, then we do nothing | 20:52 |
| ayoung | the current ssl/pki setup is not really a production quality thing | 20:52 |
| ayoung | and, since we don;'t really need either, we can safely drop it | 20:52 |
| ayoung | we are defaulting to uuid tokens | 20:52 |
| ayoung | so no pkisetup needed | 20:52 |
| ayoung | and the ssl setup is done via puppe | 20:53 |
| ayoung | t | 20:53 |
| ayoung | morganfainberg, I wish we could just edit the specs online | 20:53 |
| morganfainberg | ayoung, can certmonger manage the CA directly? | 20:53 |
| morganfainberg | ayoung, or does it need something else e.g. certmaster/dogtag | 20:53 |
| ayoung | morganfainberg, question does not really make sense | 20:54 |
| ayoung | ah | 20:54 |
| ayoung | you mean for selfsigned? Yeah, it can do that | 20:54 |
| *** nellysmitt has quit IRC | 20:54 | |
| morganfainberg | ayoung, as long as it can do that - which is what i was looking for | 20:54 |
| morganfainberg | and certmonger is 1st class in ubuntu as well as fedora? | 20:54 |
| *** diegows has quit IRC | 20:54 | |
| ayoung | it needs a relatively new version of certmonger, but the packages are out for all distros | 20:54 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Creating parameter to list inherited role assignments https://review.openstack.org/117300 | 20:54 |
| morganfainberg | ayoung, thats fine then. - i'm good with using something better than pki_Setup | 20:55 |
| ayoung | yes, certmonger has been in Ubuntuy for a while, and we have a driver from Canonical for all things cryptolike | 20:55 |
| morganfainberg | i expect you'll provide infomration on how that should work as a transition from pki_setup | 20:55 |
| ayoung | hierarchical roles: punt to Lovelace | 20:55 |
| morganfainberg | e.g. "oh hi you tried to do X, do this instead" | 20:55 |
| ayoung | and yes, I hearby declare that the next release is called Lovelace | 20:56 |
| morganfainberg | or even a compat layer telling them pki_setup is going away go look ->> there for how to do it right | 20:56 |
| ayoung | yes | 20:56 |
| morganfainberg | ayoung, that is sufficient to answer my comment inline | 20:56 |
| ayoung | I had a bunch of the "test for things:" in the spec, but the reality will be in the code | 20:56 |
| morganfainberg | my concern was the need for dogtag or certmaster | 20:56 |
| ayoung | Unified Access Info: I'm actively coding that right now | 20:56 |
| morganfainberg | or something else that wasn't clear | 20:56 |
| ayoung | Enforce policy from keystoneclient needs to be cahnged to | 20:57 |
| ayoung | Enforce policy from keystonemiddleware | 20:57 |
| ayoung | unified policy file...should go ahead | 20:57 |
| morganfainberg | if certmonger can handle it all for our devstack needs, works for me. | 20:57 |
| richm | ayoung: we just need some way to unique-ify names of users, groups, and projects in puppet | 20:57 |
| ayoung | but that can be off cycle | 20:57 |
| morganfainberg | ksc and ksm specs are *not* on the feb 5 deadline | 20:57 |
| morganfainberg | only keystone server specs | 20:57 |
| morganfainberg | topol, ^ | 20:57 |
| ayoung | richm, we have a mechanism to do that thanks to Henrynash | 20:57 |
| ayoung | we do a sha256 of the userid/domainid | 20:58 |
| rodrigods | ayoung, morganfainberg, can count on me to help with those specs as well | 20:58 |
| morganfainberg | richm, henrynash did a great job on it | 20:58 |
| ayoung | morganfainberg, I know... | 20:58 |
| ayoung | but the query doesn't say which they are for...since all are in one repo | 20:58 |
| ayoung | token constraints punted to Lovelace | 20:58 |
| ayoung | (named for Ada, not Linda, incase you were wondering) | 20:58 |
| richm | ayoung: in puppet, an admin wants to be able to do keystone_user { "admin@domain1" }; keystone_user { "admin@domain2" } | 20:58 |
| ayoung | richm, I want that to. I was told I can't have that | 20:59 |
| richm | ayoung: because "@" is not usable? | 20:59 |
| ayoung | richm, best we can do is a json segment | 20:59 |
| ayoung | richm, because people might have usedf @ signs for usernames or, worse, userids | 20:59 |
| ayoung | API changes for explicit unscoped needs to be approved...its trivial | 21:00 |
| ayoung | Alembic for migrations...punt | 21:00 |
| morganfainberg | ayoung, lol | 21:00 |
| morganfainberg | i figured ada not linda | 21:00 |
| ayoung | Policy rules mangaged from a database: Punt | 21:00 |
| ayoung | morganfainberg, both ladies have programmiong languages named after them | 21:00 |
| richm | ayoung: so in puppet, something like this: keystone_user { "username": "admin", "domain": "domain1" } ? | 21:01 |
| richm | er keystone_user { '"username": "admin", "domain": "domain1"' } | 21:01 |
| ayoung | richm, yes | 21:02 |
| richm | ayoung: ok | 21:02 |
| ayoung | morganfainberg, so..back to spec: punt on multiple signing certificate | 21:03 |
| ayoung | and approve Default Policy | 21:03 |
| ayoung | morganfainberg, from now on, I think we should submit all specs to "next" | 21:04 |
| ayoung | nothing gets assigned to a release until it gets approved in the abstract...keep us from having to move things arounds | 21:05 |
| ayoung | I don't really see a reson to have the release in the spec repo, it belongs outside it in something like the bp manager or whatever we replace that with | 21:05 |
| *** marg7175 has quit IRC | 21:07 | |
| morganfainberg | ayoung, this is my complaiunt with using git for specs | 21:07 |
| morganfainberg | it is the wrong tool | 21:07 |
| morganfainberg | it's waaaaay better than launchpad | 21:07 |
| morganfainberg | still the wrong tool | 21:07 |
| ayoung | morganfainberg, http://xkcd.com/ | 21:08 |
| ayoung | that is the right tool. | 21:08 |
| *** raildo is now known as raildo_away | 21:08 | |
| morganfainberg | honestly i hope storyboard becomes the bug/bp/spec tracker | 21:08 |
| morganfainberg | like it should be | 21:08 |
| morganfainberg | then LP can die | 21:08 |
| topol | marekd, you there? | 21:10 |
| topol | marekd, re: https://review.openstack.org/#/c/149071/3/specs/kilo/federated-direct-user-mapping.rst | 21:10 |
| openstackgerrit | Merged openstack/keystone: Implements parents_as_ids query param https://review.openstack.org/148567 | 21:14 |
| *** krtaylor has joined #openstack-keystone | 21:15 | |
| stevemar | topol, i just approved it, whats up | 21:15 |
| topol | stevemar, I just wanted a little more detail that mentions the benefits of not treating the users as ephemeral. Or say what the disadvantages are when this is not done. This would really help to explain why this is needed. Folks may be confused since we spent so much time on the previous federation work saying this was not needed | 21:16 |
| morganfainberg | topol, in most cases it isn't needed. | 21:17 |
| marekd | topol: i am. | 21:17 |
| openstackgerrit | Merged openstack/keystone-specs: Allow for direct mapping in federated authN. https://review.openstack.org/149071 | 21:17 |
| morganfainberg | topol, i prefer the model where we don't need to direct map | 21:17 |
| *** diegows has joined #openstack-keystone | 21:17 | |
| morganfainberg | topol, but lets def. get some clarificaiton on that in the spec so we can point at it and show the use-case(s) | 21:18 |
| topol | morganfainberg. Agreed. so when marekd says some cloud providers want it but its not clear why. Im loking for 1-2 sentences here | 21:18 |
| marekd | topol: gyee was happy to have it. | 21:19 |
| morganfainberg | marekd, lol "Because Guang likes it" isn't a good justification | 21:19 |
| marekd | topol: I'd say thanks to that we can have authN step with a 1-st class IdP | 21:19 |
| marekd | morganfainberg: agreed. | 21:19 |
| morganfainberg | but i'd almost pay money to see topol try and explain that statement to someone trying to setup federated identity | 21:19 |
| marekd | :D | 21:20 |
| topol | marekd, um yeahhh stevemar just +A'd it :-). Perhaps we add this clarification in a subsequent patch | 21:20 |
| morganfainberg | topol, we should | 21:20 |
| marekd | "ya know..marekd says guang liked it so we implemented it" | 21:20 |
| morganfainberg | marekd, ++ | 21:20 |
| morganfainberg | marekd, +∞ | 21:20 |
| stevemar | we can definitely clarify things in another patch | 21:21 |
| topol | marekd, morganfainberg, stevemar, my only complaint is my fear is that folks will see this and go oh I should do this...But in reality probably only needed in rare circumstances A, B, C. | 21:21 |
| topol | marekd, morganfainberg, stevemar that was the only missing. But if we nail that in the docs we should be okay | 21:22 |
| topol | marekd so I need to know what "thanks to that we can have authN step with a 1-st class IdP" means for folks new to Keystone federation. Remember you live this everyday so its intuitively obvious to you. I need some tutoring :-) | 21:23 |
| topol | with ephemeral only we cant do x, y, z. Thats worth storing all these users. Make sense? | 21:24 |
| topol | marekd ^ | 21:24 |
| stevemar | marekd, fyi - i'm writing up the changes now | 21:25 |
| marekd | stevemar: ok, thanks. | 21:25 |
| marekd | topol: right. | 21:25 |
| atiwari | stevemar, yt? | 21:26 |
| stevemar | atiwari, physically yes | 21:28 |
| marekd | topol: i was probably not clear enough. The thing is, this could probably be the first step where federation becomes a core part of Keystone, and in this easy step we could increase security of authN process, where user needs to authenticate himself with an IdP (and can try only 3 times and later gets blocked, has some kckass 'reset password' procedures and probably more), whereas Keystone is responsible for authZ only, so something ayoung | 21:28 |
| atiwari | thanks, do you have any docs to setup K2K federation? | 21:29 |
| marekd | atiwari: http://rodrigods.com/playing-with-keystone-to-keystone-federation/ | 21:29 |
| *** thedodd has quit IRC | 21:29 | |
| atiwari | marekd, thanks | 21:29 |
| stevemar | thanks marekd, atiwari that's the best source | 21:29 |
| atiwari | stevemar, thanks | 21:30 |
| ayoung | marekd, passwordsda re stoopid. Lets use real technologies for secure sign in | 21:30 |
| *** chipmanc has joined #openstack-keystone | 21:30 | |
| marekd | ayoung: anything we don't need to implement in Keystone and can leave this work to IdP devs. | 21:30 |
| ayoung | and, yes, lets get Keystone out of the Identity business all-to-gether | 21:30 |
| ayoung | :) | 21:31 |
| marekd | ayoung: that's why https://review.openstack.org/149071 | 21:31 |
| topol | marekd, so make sure somewhere we capture when to use this and why and when not to use it. That will really help. | 21:31 |
| marekd | (and also because gyee liked it) | 21:31 |
| ayoung | marekd, lets go one step further and do that in auth token middleware! | 21:32 |
| marekd | ayoung: how?! | 21:32 |
| marekd | topol: right! | 21:32 |
| ayoung | marekd, http://adam.younglogic.com/2014/10/who-can-sign-for-what/ | 21:32 |
| morganfainberg | ayoung, lets just rewrite all of keystone to be auth_token middleware | 21:33 |
| morganfainberg | why have an API at all | 21:33 |
| ayoung | marekd, bascially, anything that we do as part of the token-creationg process we make an externizable process | 21:33 |
| ayoung | morganfainberg, I have an naswer to that: | 21:33 |
| ayoung | we have APIs to fetch the data necessary to do this | 21:33 |
| ayoung | morganfainberg, so, yes, all of the business logic inside Keystone moves to auth_token middleware | 21:33 |
| morganfainberg | ayoung, break people of the habit to make it so i do X on behalf the user to api Y | 21:34 |
| morganfainberg | and the security model we use there and we're a step closer | 21:34 |
| ayoung | morganfainberg, you really want signed requests, don't you? | 21:34 |
| ayoung | well, the mechanism I lay out there would actually support it | 21:34 |
| morganfainberg | ayoung, would work the same if you used x509 | 21:34 |
| morganfainberg | etc | 21:35 |
| morganfainberg | signed requests are just one form that doesn't work with the current model we use | 21:35 |
| morganfainberg | but lots of people get it because lots of people use AWS | 21:35 |
| ayoung | morganfainberg, it would if: nova generated the request, handed it to the user, user signed it, and handed i back to Keystone | 21:36 |
| ayoung | er Nova | 21:36 |
| ayoung | but going direct to glance first makes more sense, obviously | 21:36 |
| morganfainberg | ayoung, i am not advocating one fix or another. | 21:36 |
| ayoung | morganfainberg, I am. | 21:36 |
| morganfainberg | just saying where the problem currently lies. | 21:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Address federated domain comments from 149071 https://review.openstack.org/152281 | 21:37 |
| ayoung | morganfainberg, kinda sick of discussing this,. really just need to find funding to go skunkworks this and come back with a fait accompli | 21:37 |
| marekd | stevemar: Thanks, Steve(n) :-) | 21:39 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update federation config to use Service Providers https://review.openstack.org/152260 | 21:40 |
| stevemar | marekd, :O | 21:40 |
| stevemar | marekd, one last patch needed for full SP support, need a way to include it in the catalog | 21:41 |
| ayoung | bknudson, did I just trigger a curse word out of you on a review... | 21:42 |
| ayoung | https://review.openstack.org/#/c/117366/ | 21:42 |
| marekd | stevemar: started working on that today | 21:42 |
| marekd | simply didn't publish anything yet. | 21:42 |
| marekd | (had to look around where changes are required). | 21:43 |
| openstackgerrit | Samuel Merritt proposed openstack/keystonemiddleware: Make v3 auth work for Swift https://review.openstack.org/152283 | 21:43 |
| topol | stevemar, nice job. that justification helped a lot. re https://review.openstack.org/#/c/152281/ | 21:45 |
| marekd | topol: stevemar ++ | 21:47 |
| * topol back to reseller | 21:48 | |
| jamielennox | ayoung: so s4u2proxy.... | 21:52 |
| ayoung | yeah | 21:52 |
| krtaylor | morganfainberg, we will turn off commenting immediately | 21:53 |
| jamielennox | ayoung: is this still the way to do it: http://adam.younglogic.com/2014/05/s4u2proxy-horizon/ | 21:54 |
| jamielennox | there's no way i can do this without editting ldap schemas | 21:54 |
| ayoung | jamielennox, not yet | 21:55 |
| jamielennox | :( | 21:55 |
| *** thedodd has joined #openstack-keystone | 21:55 | |
| ayoung | jamielennox, I know the IPA team is working on it, but I don't think it is in the project yet | 21:55 |
| *** chipmanc has quit IRC | 21:56 | |
| morganfainberg | krtaylor, thanks | 21:56 |
| morganfainberg | krtaylor, yeah i want to know what you're looking at solving and the meeting is the best place | 21:57 |
| morganfainberg | krtaylor, as you can imagine we need to make sure the gate has good signal to noise | 21:57 |
| jamielennox | ayoung: this is a horrible story, i just want to click a few buttons | 21:57 |
| jamielennox | or 1 button | 21:57 |
| ayoung | jamielennox, no soup for you | 21:57 |
| morganfainberg | krtaylor, and to be clear, i'm not opposed to reporting just need to know some details :) thanks for the quick response | 21:57 |
| krtaylor | morganfainberg, I undertand completely, in a nutshell, we are just test on our platform, its a different non-x86 environment | 21:58 |
| krtaylor | we will be happy to come to a meeting and explain | 21:58 |
| morganfainberg | sure. but how does a change in keystone actually impact the hypervisor? thats what i'd like you to come and explain tomorrow if you have time | 21:58 |
| krtaylor | morganfainberg, can I add to then next agenda? | 21:58 |
| morganfainberg | krtaylor, please do! | 21:58 |
| krtaylor | morganfainberg, will do | 21:59 |
| morganfainberg | krtaylor, great! see you there :) | 21:59 |
| ayoung | jamielennox, the think is, I don't really like the S4U2 Appraoch anyway. It gives away too much, but it is a necessary evil for the existing Openstack delegation model. | 21:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 21:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Refactor check of targets and actors on RoleV3 https://review.openstack.org/144702 | 22:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 22:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 22:00 |
| *** samueldmq is now known as samueldmq-away | 22:00 | |
| jamielennox | ayoung: i feel like it shouldn't be necessary, but i don't know enough to figure out what i don't know | 22:01 |
| jamielennox | ayoung: really we should have named federation something else and made it the entry point for all external mechanisms | 22:03 |
| jamielennox | ayoung: when i get all this figured out i'll look into why we can't just run kerberos at | 22:03 |
| jamielennox | /OS-FEDERATION/REALM/idp/krb | 22:03 |
| jamielennox | (or whatever the proper url is now) | 22:03 |
| jamielennox | because i don't like / see why we should need to mount the whole keystone server again at /krb or whatever | 22:04 |
| *** pnavarro has quit IRC | 22:05 | |
| morganfainberg | jamielennox, ping | 22:05 |
| morganfainberg | jamielennox, re: ksc release | 22:05 |
| jamielennox | keystone v4 api will fix all tihs | 22:06 |
| morganfainberg | jamielennox, is it ok to plan for KSC release post m2 cut? | 22:06 |
| morganfainberg | jamielennox, so we don't accidently kill the gate | 22:06 |
| jamielennox | morganfainberg: when's m2 | 22:06 |
| morganfainberg | not that i expect it | 22:06 |
| morganfainberg | uh this week | 22:06 |
| morganfainberg | thursday | 22:06 |
| morganfainberg | officially | 22:06 |
| jamielennox | morganfainberg: ok - there are still a number of things unreviewe | 22:07 |
| jamielennox | d | 22:07 |
| morganfainberg | jamielennox, exactly | 22:07 |
| morganfainberg | jamielennox, we can get those landed and release ... as soon as m2 is done | 22:07 |
| jamielennox | sure, aim for monday next week | 22:08 |
| morganfainberg | jamielennox, sold. | 22:08 |
| jamielennox | i'd be really interested in people reviewing https://review.openstack.org/#/c/140894/ | 22:09 |
| jamielennox | it's kind of hard because it's usurping an existing interface that is quite heavily used | 22:09 |
| jamielennox | s/hard/tricky | 22:09 |
| *** Ephur has quit IRC | 22:13 | |
| jamielennox | bknudson: have you looked at upstreaming those hacking checks for oslo.* | 22:14 |
| bknudson | jamielennox: upstream to where? | 22:15 |
| jamielennox | bknudson: not sure - oslo.test? | 22:15 |
| jamielennox | maybe hacking itself? | 22:15 |
| jamielennox | i wasn't sure myself - was just thinking they would be generally useful | 22:16 |
| jamielennox | maybe oslo_utils | 22:16 |
| bknudson | jamielennox: there's multiple versions of the hacking check, but at the same time I'm not sure how long it's even going to last... eventually won't have to worry about it since the old names go away | 22:19 |
| bknudson | I'll ask in -oslo. | 22:19 |
| jamielennox | bknudson: that's fair, eventually i guess the warnings will get stronger from the oslo.X packages and it won't mater | 22:19 |
| jamielennox | bknudson, morganfainberg: do we approve in general of the approach in: https://review.openstack.org/#/c/131036/ | 22:21 |
| jamielennox | i'm kind of torn | 22:21 |
| bknudson | jamielennox: it's scary. | 22:21 |
| bknudson | jamielennox: actually, now I'm thinking it's not too bad... why not? | 22:22 |
| jamielennox | bknudson: i see why it might want to be allowed - at the same time if you're using PKI tokens i'd want to know if i was getting these errors | 22:22 |
| bknudson | as long as the error message is good... which it probably isn't since that's the general way things work. | 22:23 |
| *** david8hu has quit IRC | 22:23 | |
| *** david8hu has joined #openstack-keystone | 22:24 | |
| bknudson | jamielennox: there's a warning message logged. | 22:24 |
| morganfainberg | generally speaking | 22:25 |
| morganfainberg | as long as the provider can do online validation like that | 22:25 |
| morganfainberg | i like the fallback | 22:25 |
| jamielennox | ok | 22:27 |
| jamielennox | i really can't see any good reason to disallow, it just feels a little weird | 22:27 |
| *** wanghong has quit IRC | 22:38 | |
| *** wanghong has joined #openstack-keystone | 22:39 | |
| *** wanghong has quit IRC | 22:39 | |
| *** wanghong has joined #openstack-keystone | 22:40 | |
| ayoung | bknudson, didn't mean to catch you by surprise on the ssl setup thing | 22:41 |
| bknudson | ayoung: it was surprising... I guess since the change had been proposed a long time ago... | 22:41 |
| ayoung | bknudson, so I want to kill the pki/ssl setup thing altogether | 22:42 |
| ayoung | I should never have written it, I was pressured to make it happen for PKI tokens | 22:42 |
| ayoung | but..its not the right way to manage certs. So, while your change is the right solution if we keep it, I just don't want to have to keep it | 22:42 |
| ayoung | and your change kindof locks us in to supporting it it...if you think about it | 22:43 |
| bknudson | ayoung: yes, I agree it would be better if that tool didn't exist. (The tool even says that when used) | 22:43 |
| ayoung | bknudson, so... https://review.openstack.org/#/c/134099/ instead | 22:43 |
| bknudson | ayoung: our products use it. | 22:43 |
| ayoung | they really shouldn't | 22:44 |
| ayoung | bknudson, don't you guys have a real X509 solution you should be using instead? | 22:44 |
| *** thedodd has quit IRC | 22:45 | |
| bknudson | ayoung: if there is one I don't know about it. | 22:45 |
| bknudson | ayoung: I think the alternative would be that we just run the openssl commands that keystone-manage would have. | 22:46 |
| ayoung | bknudson, so is the certmonger approach OK with you? I think it does everything you need. It has a self signed approach, you would just do the configuration you want on cermonger itslef (I think) not in keystone | 22:46 |
| bknudson | ayoung: I don't see how having keystone-manage call certmonger is better? Why not just call certmonger directly? | 22:46 |
| ayoung | bknudson, agreed...I'd just keep it to avoid breaking all the automation out there.. but deprecate it | 22:47 |
| bknudson | making us switch to certmonger breaks all our automation. | 22:47 |
| ayoung | It shouldn't | 22:47 |
| ayoung | certmonger is there in the base OS | 22:47 |
| bknudson | does it work on POWER? | 22:48 |
| ayoung | bknudson, if you need the option for the short term, I think it is OK to go forward | 22:48 |
| ayoung | just with the understanding that it is short lived, and not to be honored once we move off of the openssl code | 22:48 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Drop usage of namespaced packages https://review.openstack.org/151836 | 22:48 |
| bknudson | ayoung: I'm fine with that. | 22:48 |
| *** dims has quit IRC | 22:49 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Enable hacking rule E122 and H304 https://review.openstack.org/134101 | 22:50 |
| ayoung | bknudson, I don't know. Does RHEL run on power? I'm pretty sure that it does, but we don't have the resources to check | 22:50 |
| bknudson | ayoung: if certmonger is on rhel and ubuntu that should be good enough for us. | 22:51 |
| ayoung | it is | 22:51 |
| bknudson | ayoung: I can't think of a good objection to certmonger... seems like it's better to just drop keystone-manage support than change it and then get rid of it later. | 22:54 |
| *** nellysmitt has joined #openstack-keystone | 22:55 | |
| ayoung | bknudson, look in to iot, and tell me it if suits your needs. I won't block your feature if you really need it to move ahead. | 22:55 |
| ayoung | An bknudson I would never shit you. You would be a spectacularly painful bowel movement. | 22:56 |
| bknudson | ayoung: we don't need it just like we don't need keystone-manage pki_setup since we can call openssl commands directly... it's a nice-to-have. | 22:57 |
| ayoung | OK. | 22:57 |
| *** alex_xu_ has quit IRC | 22:58 | |
| *** timcline_ has quit IRC | 22:59 | |
| *** nellysmitt has quit IRC | 23:00 | |
| *** topol has quit IRC | 23:00 | |
| *** alex_xu has joined #openstack-keystone | 23:01 | |
| *** raildo has joined #openstack-keystone | 23:01 | |
| *** Ephur has joined #openstack-keystone | 23:07 | |
| *** joesavak has joined #openstack-keystone | 23:07 | |
| *** raildo has quit IRC | 23:09 | |
| *** jsavak has quit IRC | 23:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Service Providers API for OS-FEDERATION https://review.openstack.org/104623 | 23:11 |
| *** chlong has joined #openstack-keystone | 23:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Create K2K SAML assertion from Service Provider https://review.openstack.org/152046 | 23:12 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Drop URL field from region table https://review.openstack.org/150122 | 23:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update federation config to use Service Providers https://review.openstack.org/152260 | 23:14 |
| *** andreaf has joined #openstack-keystone | 23:19 | |
| *** raildo has joined #openstack-keystone | 23:19 | |
| *** gordc has quit IRC | 23:25 | |
| *** henrynash has joined #openstack-keystone | 23:27 | |
| *** ChanServ sets mode: +v henrynash | 23:27 | |
| *** joesavak has quit IRC | 23:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 23:35 |
| *** henrynash has quit IRC | 23:36 | |
| *** samueldmq has joined #openstack-keystone | 23:41 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 23:43 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Publicize region/endpoint/policy/service events https://review.openstack.org/151774 | 23:45 |
| stevemar | sorry for the upcoming spam, doing a rebase | 23:45 |
| stevemar | if some of this stuff merges then we won't get bombarded with messages :D | 23:46 |
| morganfainberg | !ban stevemar, flooding | 23:46 |
| openstack | morganfainberg: Error: "ban" is not a valid command. | 23:46 |
| morganfainberg | >.> | 23:46 |
| stevemar | morganfainberg, oh you | 23:46 |
| *** jaosorior has quit IRC | 23:46 | |
| *** zzzeek has quit IRC | 23:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notification handling for policy/region/service/endpoint https://review.openstack.org/151786 | 23:51 |
| *** andreaf has quit IRC | 23:52 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a test for create_domain in notifications https://review.openstack.org/151791 | 23:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 23:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add context to manager classes that send notifications https://review.openstack.org/151866 | 23:52 |
| raildo | and he keeps flooding :P hahaha | 23:54 |
| stevemar | D: | 23:54 |
| stevemar | thats the last one | 23:54 |
| stevemar | raildo, the faster you review them, the sooner they won't show up here :) | 23:55 |
| raildo | stevemar: so, I'll review now :D | 23:55 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!