| *** kfox1111 has quit IRC | 00:12 | |
| *** nellysmitt has joined #openstack-keystone | 00:15 | |
| *** henrynash has quit IRC | 00:17 | |
| *** nellysmitt has quit IRC | 00:19 | |
| *** markvoelker has joined #openstack-keystone | 00:25 | |
| *** markvoelker has quit IRC | 00:30 | |
| *** dimsum__ has joined #openstack-keystone | 00:35 | |
| *** dims_ has joined #openstack-keystone | 00:36 | |
| *** jacer_huawei has joined #openstack-keystone | 00:39 | |
| *** jacer_huawei is now known as wnaghong | 00:39 | |
| *** dimsum__ has quit IRC | 00:39 | |
| *** wnaghong is now known as wanghong | 00:39 | |
| *** oomichi has joined #openstack-keystone | 00:41 | |
| *** take has joined #openstack-keystone | 00:45 | |
| *** samueldmq_ has quit IRC | 00:52 | |
| *** take has quit IRC | 01:14 | |
| *** markvoelker has joined #openstack-keystone | 01:26 | |
| *** markvoelker has quit IRC | 01:31 | |
| *** jorge_munoz has joined #openstack-keystone | 01:34 | |
| *** jorge_munoz has quit IRC | 01:37 | |
| *** serverascode has quit IRC | 01:38 | |
| *** jraim has quit IRC | 01:38 | |
| *** briancurtin has quit IRC | 01:40 | |
| *** ctracey has quit IRC | 01:40 | |
| *** zhiyan has quit IRC | 01:40 | |
| *** ctracey has joined #openstack-keystone | 01:45 | |
| *** jraim has joined #openstack-keystone | 01:45 | |
| *** briancurtin has joined #openstack-keystone | 01:46 | |
| *** zhiyan has joined #openstack-keystone | 01:46 | |
| *** amerine has joined #openstack-keystone | 01:48 | |
| *** amerine has quit IRC | 01:48 | |
| *** amerine has joined #openstack-keystone | 01:48 | |
| *** serverascode has joined #openstack-keystone | 01:52 | |
| *** erkules_ has joined #openstack-keystone | 02:06 | |
| openstackgerrit | Merged openstack/keystone: Improve testing of unicode id mapping https://review.openstack.org/153844 | 02:07 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: Make identity id mapping handle unicode https://review.openstack.org/153846 | 02:08 |
| *** erkules has quit IRC | 02:08 | |
| *** nellysmitt has joined #openstack-keystone | 02:16 | |
| *** nellysmitt has quit IRC | 02:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 02:23 |
| *** markvoelker has joined #openstack-keystone | 02:27 | |
| jamielennox | stevemar: did you have much to do with the horizon side of the SSO and federation patches? | 02:29 |
| stevemar | jamielennox, enough of it anyway, i just took what they did at CERN and swizzled it | 02:30 |
| jamielennox | stevemar: i have some changes i did to django openstack auth | 02:30 |
| jamielennox | to get kerberized login to wokr | 02:30 |
| stevemar | jamielennox, i noticed that, i had tqtran looking at DOA | 02:30 |
| jamielennox | ah ok - so you probably won't know if they'll conflict? | 02:31 |
| jamielennox | i mean they will conflict for sure - but unworkably? | 02:31 |
| stevemar | that part i'm not so sure about, he just need to create an unscoped token client instance | 02:32 |
| *** ctina has quit IRC | 02:32 | |
| *** markvoelker has quit IRC | 02:32 | |
| jamielennox | just popping it up (should have done this before messaging) | 02:33 |
| stevemar | i'll take a look at the DOA stuff in 20 minutes, just in the middle of something | 02:33 |
| jamielennox | stevemar: no worries - i was just looking through the mailing list and saw tim bell's comments about how you shouldn't see a login page at all | 02:34 |
| jamielennox | that's kind of what i was going for, if you just make sure whoever is working on that part of federation knows about this stuff | 02:35 |
| jamielennox | https://review.openstack.org/153910 - it's going to fail tests all over the place | 02:35 |
| jamielennox | however i think it is trivially expandable into what my understanding was missing for part of federation - how to make horizon just accept a token that is passed to it | 02:36 |
| stevemar | jamielennox, this is the patch that we had up for DOA | 02:50 |
| stevemar | https://review.openstack.org/#/c/136178/ | 02:50 |
| stevemar | not sure how much farther tqtran got | 02:50 |
| stevemar | i wish there was a way to change ownership of a patch | 02:50 |
| stevemar | lol # NOTE(jamielennox): HAAACCCCCKKKKKk..... | 02:51 |
| jamielennox | stevemar: it's a relatively big shift because it means that it will try to authenticate on first request to /auth/login - not just post form submission | 02:54 |
| *** radez_g0n3 is now known as radez | 03:01 | |
| *** richm has quit IRC | 03:07 | |
| *** markvoelker has joined #openstack-keystone | 03:28 | |
| stevemar | jamielennox, hmm, that sounds like the 'discovery service' stuff that cern does | 03:31 |
| stevemar | i think there should still be a way to decide if the user is going to go for SAML2 vs other protocol | 03:32 |
| *** markvoelker has quit IRC | 03:33 | |
| jamielennox | stevemar: there will always need to be a web login aspect | 03:36 |
| jamielennox | just saw the ML email and agree that a big part of SSO is not picking at all and that i probably need to have a chat with those guys | 03:37 |
| stevemar | jamielennox, so about https://review.openstack.org/#/c/153910/ why don't you include token? | 03:43 |
| stevemar | and it works by just trying all of AUTH_PLUGINS? | 03:43 |
| jamielennox | stevemar: i don't have a setup that uses it | 03:43 |
| stevemar | i think all that is needed for https://review.openstack.org/#/c/136178/ is to add tokens | 03:44 |
| jamielennox | stevemar: so there is an abstraction there, it goes through AUTH_PLUGINS and sees for which one there is enough information to try and process | 03:44 |
| stevemar | ah okay | 03:44 |
| *** rushiagr_away is now known as rushiagr | 03:53 | |
| *** lnxnut has quit IRC | 04:04 | |
| *** radez is now known as radez_g0n3 | 04:09 | |
| *** lnxnut has joined #openstack-keystone | 04:13 | |
| morganfainberg | stevemar, https://bugs.launchpad.net/keystone/+bug/1419114 | 04:15 |
| openstack | Launchpad bug 1419114 in Keystone "Nova api 'Authorization failed for token' with federated scoped token" [Undecided,New] | 04:15 |
| morganfainberg | stevemar, https://bugs.launchpad.net/keystone/+bug/1419114 | 04:16 |
| morganfainberg | erm | 04:16 |
| morganfainberg | stevemar, https://bugs.launchpad.net/keystone/+bug/1405726 | 04:16 |
| openstack | Launchpad bug 1405726 in Keystone "Federation, getting scoped token results in error. " [Undecided,New] | 04:16 |
| morganfainberg | cc marekd ^^ | 04:16 |
| *** nellysmitt has joined #openstack-keystone | 04:17 | |
| stevemar | morganfainberg, yeah someone internally pinged me about that | 04:17 |
| stevemar | it's weird because it's hitting v2 code | 04:17 |
| morganfainberg | the is probably nova + neutron | 04:17 |
| morganfainberg | which... is stuck on v2 right now | 04:18 |
| morganfainberg | or until jamielennox gets the fix in | 04:18 |
| morganfainberg | with the new neutronclient | 04:18 |
| morganfainberg | which poses an interesting issue for k2k federation + neutron. | 04:18 |
| morganfainberg | we might need to see if it's at all possible to backport the ugly fix to nova. | 04:18 |
| morganfainberg | jamielennox, ^^ | 04:19 |
| jamielennox | i saw it, i'm just not sure what fix to neutronclient will help federation | 04:19 |
| morganfainberg | for juno otherwise - federation is broken in a very real deployment mode | 04:19 |
| stevemar | the catalog in that defect shows it is using neutron | 04:19 |
| jamielennox | i talked to neutron guys, they said they'd do a release for me at the end of the week | 04:19 |
| morganfainberg | jamielennox, this is making nova not need to use v2 when talking to neiutron | 04:19 |
| jamielennox | oh, right | 04:20 |
| morganfainberg | jamielennox, so the ugly fix that got the -1's because it was "hacking" the client code in wierd ways may be needed for juno backport | 04:20 |
| jamielennox | yea i want that to happen in a hurry because i don't like leaving that one too late in the nova cycle | 04:20 |
| morganfainberg | jamielennox, but for K we can use the shiny new neutronclient that isn't busted | 04:20 |
| stevemar | morganfainberg, but the request that failed was for listing flavors | 04:20 |
| morganfainberg | stevemar, wonder if there is any other similar issues w/ glance | 04:21 |
| jamielennox | morganfainberg: someone was asking about that patch just the other day (may have been related) they said that the code in nova is a long way diverged from where it was in juno | 04:21 |
| morganfainberg | or if it's something related to the neutron things | 04:21 |
| morganfainberg | jamielennox, yeah it wont be an easy backport | 04:21 |
| *** nellysmitt has quit IRC | 04:21 | |
| morganfainberg | jamielennox, from what i've gathered | 04:21 |
| morganfainberg | stevemar, can you triage those two bugs for me? | 04:21 |
| jamielennox | it might not even be possible depending on what client versions are supported at juno release | 04:21 |
| morganfainberg | jamielennox, hence why we might need the dirty hacky-code | 04:22 |
| * morganfainberg needs to get people to *not* leave bugs in "new" state once priority is set. | 04:22 | |
| jamielennox | so is this trying to make it so that the nova service user uses a federated login? | 04:22 |
| stevemar | luckily for 1405726 the solution is written in the bug report | 04:23 |
| morganfainberg | jamielennox, i think this is any user that needs to touch neutron stuff via nova would break | 04:23 |
| morganfainberg | jamielennox, it's not just service user stuff. | 04:23 |
| morganfainberg | jamielennox, *i think* | 04:23 |
| *** dims_ has quit IRC | 04:23 | |
| jamielennox | so that patch is just enabling a v3 service user, i'm not sure why it would fix a federation bug | 04:23 |
| jamielennox | well not just - it enables a whole bunch of things | 04:24 |
| morganfainberg | well everything that goes through neutron hits v2 when proxied form nova [including things like get_resources] | 04:24 |
| morganfainberg | federation tokens are *only* v3 | 04:24 |
| *** rushiagr is now known as rushiagr_away | 04:24 | |
| stevemar | yep | 04:25 |
| morganfainberg | if you try and validate them via v2 it'll probably/does break | 04:25 |
| jamielennox | but neutron is dropping the actual user token by that point | 04:25 |
| jamielennox | it logs in via v2 and talks to nova that way | 04:26 |
| morganfainberg | jamielennox, sounds like we have more digging to do. | 04:26 |
| *** avozza is now known as zz_avozza | 04:26 | |
| morganfainberg | jamielennox, because we have things failing with invalid token when epople try and use domains + nova [not just service users iirc] | 04:26 |
| morganfainberg | when neutron is used | 04:26 |
| jamielennox | hmm | 04:27 |
| jamielennox | from memory there is some operations that neutron talks to nova that requires the admin privilege in v2 | 04:27 |
| jamielennox | (which is just a misconfiguration of policy IMO ) | 04:27 |
| jamielennox | so for some operations it uses the user token | 04:27 |
| jamielennox | and for some operations it uses an account that is specified in the config file - which is generally the same as the one neutron is configured with for auth_token | 04:28 |
| jamielennox | (again bad) | 04:28 |
| jamielennox | however unless you're trying to have that service user use federation itself then i'm not sure what is v3 specific there | 04:29 |
| morganfainberg | jamielennox, anyway so sounds like there is digging to be done before we can say it's definitely nova + neutron or if it's *something else* | 04:29 |
| *** markvoelker has joined #openstack-keystone | 04:29 | |
| jamielennox | sure, just letting you know | 04:31 |
| morganfainberg | bknudson: https://bugs.launchpad.net/keystone/+bug/1401664 this is LDAP assignment only | 04:31 |
| openstack | Launchpad bug 1401664 in Keystone "Update role using LDAP backend requires name" [Undecided,New] - Assigned to Brant Knudson (blk-u) | 04:31 |
| morganfainberg | bknudson, right? | 04:31 |
| *** rushiagr_away is now known as rushiagr | 04:31 | |
| morganfainberg | bknudson, because if that is the case, marking it as "won | 04:31 |
| morganfainberg | t fix" since ldap assignment is dead. | 04:31 |
| *** kfox1111 has joined #openstack-keystone | 04:32 | |
| morganfainberg | stevemar, cc ^ the convo i had w/ jamielennox | 04:33 |
| stevemar | morganfainberg, yeah, i'm seeing that now | 04:33 |
| stevemar | i'll ask the bug originator to try nova specific functions, not glance function... see if that helps | 04:34 |
| morganfainberg | thanks | 04:34 |
| stevemar | it was reported internally, so i'll be hearing about it | 04:34 |
| morganfainberg | blah | 04:35 |
| morganfainberg | https://bugs.launchpad.net/keystone/+bug/1404073 | 04:35 |
| openstack | Launchpad bug 1404073 in Keystone "type should be required for v2.0 service create" [Undecided,New] | 04:35 |
| morganfainberg | i don't want to fix v2 :( | 04:35 |
| stevemar | then don't | 04:35 |
| morganfainberg | yeah thinking that is the answer we're going wiht | 04:35 |
| *** markvoelker has quit IRC | 04:35 | |
| morganfainberg | i'm* | 04:35 |
| stevemar | i think i opened that one | 04:35 |
| morganfainberg | Lin did | 04:35 |
| stevemar | lin did, but we can enforce that at the client level | 04:36 |
| morganfainberg | already done afaict | 04:36 |
| *** kfox1111 has quit IRC | 04:36 | |
| *** jasondotstar has joined #openstack-keystone | 04:36 | |
| stevemar | yep | 04:36 |
| davechen__ | stevemar: hi steve, | 04:37 |
| stevemar | hey davechen__ | 04:37 |
| stevemar | talking about cascade on delete? | 04:37 |
| davechen__ | stevemar: thank for inviting core team to review that patch :) | 04:37 |
| stevemar | davechen__, feel free to do that yourself too, we are slow (or swamped) sometimes | 04:38 |
| davechen__ | stevemar: I saw your comment just now, really make sense indeed. | 04:38 |
| * morganfainberg is always swamped | 04:38 | |
| davechen__ | stevemar: I will check it shortly and update that patch sooner. | 04:39 |
| stevemar | davechen__, great! :) | 04:39 |
| davechen__ | stevemar: thanks steve. :) | 04:39 |
| jamielennox | morganfainberg: i'm not sure what to do about this release planned for tomorrow - i thought it would encourage people to do client reviews, it hasn't done that much | 04:40 |
| jamielennox | there's still stuff i think should go out, but i still hvae a few stars open | 04:40 |
| jamielennox | (some completely unreviewed) | 04:40 |
| morganfainberg | jamielennox, the last time i looked was before the extra work was done to solve the comments. | 04:41 |
| jamielennox | stevemar: can you kick off | 04:41 |
| jamielennox | https://review.openstack.org/#/c/139898/ | 04:41 |
| morganfainberg | notably https://review.openstack.org/#/c/130159/ is the one i'm looking at | 04:41 |
| jamielennox | morganfainberg: i've no idea what to do about that one | 04:42 |
| morganfainberg | jamielennox, https://review.openstack.org/#/c/139898/ approvedcx | 04:42 |
| stevemar | damn you morganfainberg - beat me to it | 04:42 |
| morganfainberg | jamielennox, that one actually scares me a little. | 04:42 |
| jamielennox | morganfainberg: sent it to stevemar to give you a break | 04:43 |
| jamielennox | the allow one? | 04:43 |
| morganfainberg | https://review.openstack.org/#/c/130159/ that is | 04:43 |
| morganfainberg | yeah | 04:43 |
| jamielennox | i agree | 04:43 |
| *** lnxnut has quit IRC | 04:43 | |
| jamielennox | feels wrong somehow | 04:43 |
| morganfainberg | can we punt until March release? | 04:43 |
| morganfainberg | i want that one to bake a little more | 04:43 |
| morganfainberg | if it becomes really imporant we can push a release sooner than march | 04:44 |
| morganfainberg | but i ... i just don't feel good about letting that one in [and thanks for confirming it's not just me] | 04:44 |
| jamielennox | morganfainberg: i've talked to him about it, and i suggested maybe a tuple was a better interface | 04:44 |
| morganfainberg | letting that one in at the last minute* | 04:44 |
| jamielennox | but it still feels off | 04:44 |
| morganfainberg | jamielennox, i would agree a tuple would be better | 04:44 |
| morganfainberg | ok i'm going to punt on that one | 04:45 |
| morganfainberg | and the whole chain: https://review.openstack.org/#/c/140894/ | 04:45 |
| morganfainberg | jamielennox, how deep are you trying to get in for tomorrow? | 04:45 |
| jamielennox | so https://review.openstack.org/#/c/137268/ has been unreviewed for a while - and i kind of want it | 04:45 |
| morganfainberg | oh it's only 2 | 04:45 |
| jamielennox | i'm hoping for that to be the base of dealing with context objects | 04:45 |
| morganfainberg | i thought that one had more. | 04:45 |
| morganfainberg | jamielennox, let me finish the ksc ones first | 04:46 |
| morganfainberg | then we talk middleware | 04:46 |
| jamielennox | if i can combine that with some plugin serialization that i'm still mulling over then it becomes the object that every server can sync around | 04:46 |
| jamielennox | ok | 04:46 |
| morganfainberg | ok this one: https://review.openstack.org/#/c/143338/ | 04:46 |
| morganfainberg | starting there | 04:46 |
| stevemar | thanks for bug 153922 morganfainberg :P | 04:47 |
| openstack | bug 153922 in nautilus (Ubuntu) "Nautilus hangs on mouse over icons of MP3s" [Medium,Fix released] https://launchpad.net/bugs/153922 - Assigned to Ubuntu Desktop Bugs (desktop-bugs) | 04:47 |
| stevemar | err... bug 1418384 :P | 04:47 |
| openstack | bug 1418384 in python-openstackclient "openstack client help shows domain can be changed for a project" [Undecided,New] https://launchpad.net/bugs/1418384 | 04:47 |
| morganfainberg | hahahahaha | 04:47 |
| morganfainberg | stevemar, NICE | 04:47 |
| stevemar | i tossed up https://review.openstack.org/153922 | 04:48 |
| stevemar | morganfainberg, i'm guessing we shouldn't allow users and groups to change domains either :P | 04:48 |
| morganfainberg | https://review.openstack.org/#/c/143338/3/keystoneclient/auth/identity/access.py looks silly simple | 04:48 |
| jamielennox | sure, that ones pretty simple it would replace: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token.py#L669 | 04:48 |
| morganfainberg | stevemar, i *think* we already have _require_matching_id(domain_id, domain) | 04:48 |
| jamielennox | and it would be useful in heat where they take the keystone.token_info env object to make a plugin from it rather than pull it apart | 04:49 |
| morganfainberg | stevemar in user/groups...and if we don't we *should* like... yesterday | 04:49 |
| *** lnxnut has joined #openstack-keystone | 04:49 | |
| stevemar | morganfainberg, i'll restrict it from the client side | 04:49 |
| morganfainberg | stevemar, i'd ask you prioritise server in that case if it's not already enforced | 04:49 |
| morganfainberg | stevemar, that is a security issue otherwise. | 04:50 |
| * morganfainberg checks | 04:50 | |
| morganfainberg | i uh... | 04:51 |
| morganfainberg | yeah we do: self._require_matching_domain_id( | 04:52 |
| morganfainberg | user_id, user, self.identity_api.get_user) | 04:52 |
| morganfainberg | and: self._require_matching_domain_id( | 04:52 |
| morganfainberg | group_id, group, self.identity_api.get_group) | 04:52 |
| morganfainberg | stevemar, we're good on the server side. client should be easy to fix then | 04:52 |
| morganfainberg | jamielennox, so for the AccessInfoPlugin, it's just a nice wrapper to accessinfo right? | 04:53 |
| morganfainberg | thats what it looks like | 04:53 |
| jamielennox | yep | 04:53 |
| morganfainberg | so middlewarecan do accessinfo -> plugin | 04:53 |
| morganfainberg | basically | 04:53 |
| jamielennox | people are used to the AccessInfo object, i found enough places people consume it that it was just easier to provide it in client | 04:53 |
| *** lnxnut has quit IRC | 04:53 | |
| morganfainberg | ok. | 04:53 |
| morganfainberg | i'd like to strongly encourage people to *not* do that | 04:54 |
| morganfainberg | but.. | 04:54 |
| morganfainberg | i can see the benefit of having it | 04:54 |
| morganfainberg | +2 | 04:54 |
| jamielennox | morganfainberg: well, that i have some ideas for on the middleware side.... | 04:54 |
| morganfainberg | stevemar, https://review.openstack.org/#/c/143338/ - pretty straightforward | 04:54 |
| jamielennox | *some* | 04:54 |
| darrenc | stevemar, if you have a spare second, can you +1 my patch again, I fixed a nit https://review.openstack.org/#/c/151980/4 Thanks! | 04:54 |
| stevemar | darrenc, done | 04:55 |
| darrenc | Thanks stevemar | 04:55 |
| morganfainberg | jamielennox, yeah https://review.openstack.org/#/c/140894/ looks good | 04:55 |
| morganfainberg | jamielennox, pretty straight forward | 04:55 |
| morganfainberg | just making the header get more explicit | 04:56 |
| stevemar | blah accessinfo | 04:56 |
| jamielennox | morganfainberg: it's actually kind of tricky, ideally i would like get_token to rely on get_headers - however that would break compat | 04:56 |
| morganfainberg | right | 04:57 |
| jamielennox | i was hoping it would be nicer than it turned out, but i think it's sound | 04:57 |
| morganfainberg | stevemar, you know when you get a song stuck in your head.... | 04:57 |
| *** spandhe has joined #openstack-keystone | 04:57 | |
| morganfainberg | and it wont go away | 04:57 |
| morganfainberg | .... | 04:57 |
| * morganfainberg sighs | 04:57 | |
| stevemar | mmhmm | 04:57 |
| morganfainberg | yeah | 04:57 |
| jamielennox | morganfainberg: good song though? | 04:58 |
| morganfainberg | jamielennox, well i like the artist *and* i did the mix of styles: Classical Strings and Electronic/Dance stuff | 04:58 |
| morganfainberg | jamielennox, so basically stupidly catchy *AND* interesting | 04:59 |
| jamielennox | morganfainberg: so could be worse | 04:59 |
| morganfainberg | yeah | 04:59 |
| jamielennox | morganfainberg: shake it off | 04:59 |
| morganfainberg | it's actually been a couple of song in similar style that have really stuck | 05:00 |
| morganfainberg | over the last ~week | 05:00 |
| morganfainberg | jamielennox, is this to support a plugin needs a definitive set of arguments (or can require it): https://review.openstack.org/#/c/141267/4/keystoneclient/session.py | 05:01 |
| morganfainberg | ? | 05:01 |
| morganfainberg | jamielennox, or is that to prevent non-expected params? | 05:01 |
| jamielennox | morganfainberg: yes, but i haven't actually done the implementation so i don't mind as much there | 05:01 |
| jamielennox | oh - the acceptable bit? | 05:01 |
| morganfainberg | yeah | 05:02 |
| jamielennox | that's because when you do requests.request() you mix connection params and request params up together | 05:02 |
| morganfainberg | ugh | 05:02 |
| jamielennox | i don't want a plugin given the ability to do that | 05:02 |
| morganfainberg | sure | 05:02 |
| jamielennox | well have someone do it then i break compat later | 05:02 |
| morganfainberg | ok the beasty of a patch: https://review.openstack.org/#/c/137268/7/keystonemiddleware/auth_token.py | 05:03 |
| morganfainberg | the ksc ones are +2 except the "expiermental/allow" one | 05:03 |
| jamielennox | there is an advanced part of requests that lets you build a message and then send to keep those params seperate, there was some stuff missing i had a patch in to fix in requests but it'll be a while before it's something we can rely on | 05:03 |
| jamielennox | the connection_params is essentially required for gyee's ssl cert auth plugin - at the moment you can only set those params on the session | 05:03 |
| morganfainberg | jamielennox, sure | 05:03 |
| morganfainberg | makes sense | 05:03 |
| jamielennox | that's why verify, cert and auth | 05:04 |
| morganfainberg | ugh i need to write an abstract for a presentation up tonight... crap totally spaced on that. | 05:04 |
| jamielennox | but i haven't written that plugin and i don't think he has either so meh | 05:04 |
| jamielennox | right - so that patch is fairly trivial in terms of work but it does open up a whole new area of public interfaces | 05:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix mysql issue with v001 of endpoint-filter https://review.openstack.org/153895 | 05:08 |
| jamielennox | morganfainberg: i can think of no reason that except exceptions.NoMatchingPlugin as e would need to be in that patch.... | 05:12 |
| *** wanghong has quit IRC | 05:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Turn our auth plugin into a token interface https://review.openstack.org/137268 | 05:15 |
| jamielennox | damn, looks like it was part of the old file, got removed and i screwed up a rebase around patch 5 | 05:15 |
| *** wanghong has joined #openstack-keystone | 05:15 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add name parameter to NoMatchingPlugin exception https://review.openstack.org/139898 | 05:17 |
| stevemar | jamielennox, for https://review.openstack.org/#/c/140894 what'll happen if i use .get_token() ? | 05:19 |
| stevemar | same as before / deprecation msg / ... | 05:19 |
| jamielennox | stevemar: essentially it'll have to be supported forever because the only abstract interface on that class is get_token | 05:19 |
| jamielennox | and lots of clients make use of it | 05:19 |
| stevemar | okay good, yes, lots of clients do | 05:20 |
| stevemar | just wanted to make sure | 05:20 |
| jamielennox | i tried to say in the comments that if you're writing a plugin you should support both | 05:20 |
| stevemar | i saw that | 05:20 |
| jamielennox | realistically there aren't that many plugins that aren't a subclass of identityplugin so it's not too big a deal | 05:21 |
| jamielennox | i don't think i want to bother with a deprecation warning, because it'd have to go on the base class and not the subclass | 05:22 |
| *** ajayaa has joined #openstack-keystone | 05:23 | |
| jamielennox | so it makes sense for all the identity plugins to implement get_token, it just shouldn't exist on the base class | 05:23 |
| jamielennox | i experimented with moving it, but then you can't use the get_token() in the default implementation of get_connection_params | 05:23 |
| *** dimsum__ has joined #openstack-keystone | 05:24 | |
| *** dimsum__ has quit IRC | 05:29 | |
| stevemar | i am off to sleep, see y'all in a few hours | 05:31 |
| *** markvoelker has joined #openstack-keystone | 05:31 | |
| jamielennox | stevemar: thanks for those | 05:31 |
| stevemar | np dude, happy to help | 05:32 |
| *** markvoelker has quit IRC | 05:36 | |
| *** stevemar has quit IRC | 05:41 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Basic AccessInfo plugin https://review.openstack.org/143338 | 05:48 |
| *** lnxnut has joined #openstack-keystone | 05:50 | |
| *** boris-42 has quit IRC | 05:52 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add get_headers interface to authentication plugins https://review.openstack.org/140894 | 05:54 |
| *** dflye has quit IRC | 05:57 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Extract the Loadable interface from a plugin https://review.openstack.org/138575 | 06:02 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make session use the Loadable interface https://review.openstack.org/138576 | 06:02 |
| *** nellysmitt has joined #openstack-keystone | 06:18 | |
| *** nellysmitt has quit IRC | 06:22 | |
| *** boris-42 has joined #openstack-keystone | 06:26 | |
| *** pcaruana has quit IRC | 06:28 | |
| marekd | morganfainberg: looking at the bug. | 06:32 |
| *** markvoelker has joined #openstack-keystone | 06:32 | |
| marekd | morganfainberg: about the temp - I will check it cause I don't know it now, but no matter how crazy numbers are I think it is possible here :-) | 06:34 |
| morganfainberg | aha | 06:35 |
| marekd | morganfainberg: ok, i was away for weekend, and now back in the bussiness. | 06:36 |
| * morganfainberg is about to sleep | 06:36 | |
| * marekd good night | 06:36 | |
| *** markvoelker has quit IRC | 06:37 | |
| marekd | morganfainberg: we dropped Py26 in Juno, right? | 06:40 |
| morganfainberg | kilo | 06:40 |
| marekd | uh | 06:40 |
| *** lnxnut has quit IRC | 06:41 | |
| *** spandhe has quit IRC | 06:44 | |
| *** josecastroleon has joined #openstack-keystone | 06:48 | |
| *** ncoghlan has quit IRC | 07:12 | |
| *** afazekas has joined #openstack-keystone | 07:20 | |
| *** mzbik has joined #openstack-keystone | 07:25 | |
| *** YorikSar has quit IRC | 07:30 | |
| *** markvoelker has joined #openstack-keystone | 07:33 | |
| *** jaosorior has joined #openstack-keystone | 07:35 | |
| *** stevemar has joined #openstack-keystone | 07:35 | |
| *** ChanServ sets mode: +v stevemar | 07:35 | |
| *** chlong has quit IRC | 07:37 | |
| *** markvoelker has quit IRC | 07:38 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the syntax issue on creating table `endpoint_group` https://review.openstack.org/151931 | 07:49 |
| *** YorikSar has joined #openstack-keystone | 07:59 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the syntax issue on creating table `endpoint_group` https://review.openstack.org/151931 | 08:00 |
| *** erkules_ is now known as erkules | 08:04 | |
| *** mzbik has quit IRC | 08:09 | |
| *** mzbik has joined #openstack-keystone | 08:09 | |
| *** pnavarro has joined #openstack-keystone | 08:13 | |
| *** Guest90369 has quit IRC | 08:14 | |
| *** wpf has joined #openstack-keystone | 08:16 | |
| *** mfisch has joined #openstack-keystone | 08:18 | |
| *** mfisch is now known as Guest22817 | 08:18 | |
| *** nellysmitt has joined #openstack-keystone | 08:18 | |
| *** stevemar has quit IRC | 08:20 | |
| *** nellysmitt has quit IRC | 08:23 | |
| *** nellysmitt has joined #openstack-keystone | 08:23 | |
| *** henrynash has joined #openstack-keystone | 08:34 | |
| *** ChanServ sets mode: +v henrynash | 08:34 | |
| *** markvoelker has joined #openstack-keystone | 08:34 | |
| *** markvoelker has quit IRC | 08:39 | |
| *** aix has joined #openstack-keystone | 08:40 | |
| *** oomichi has quit IRC | 08:42 | |
| *** karimb has joined #openstack-keystone | 08:47 | |
| *** jistr has joined #openstack-keystone | 08:49 | |
| *** afazekas has quit IRC | 08:49 | |
| *** YorikSar has quit IRC | 09:02 | |
| *** ajayaa has quit IRC | 09:04 | |
| *** zz_avozza is now known as avozza | 09:05 | |
| *** YorikSar has joined #openstack-keystone | 09:15 | |
| *** ajayaa has joined #openstack-keystone | 09:17 | |
| *** aix has quit IRC | 09:23 | |
| *** YorikSar has quit IRC | 09:33 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the syntax issue on creating table `endpoint_group` https://review.openstack.org/151931 | 09:33 |
| *** markvoelker has joined #openstack-keystone | 09:35 | |
| *** YorikSar has joined #openstack-keystone | 09:35 | |
| ajayaa | jamielennox, Is the enabled flag for a user used at all? | 09:39 |
| *** markvoelker has quit IRC | 09:39 | |
| jamielennox | ajayaa: it should be - it depends where you are using it from | 09:41 |
| jamielennox | (and not that i've tested it for a really long time) | 09:41 |
| jamielennox | it should prevent login, it will still show up in a user-list for example | 09:41 |
| ajayaa | jaimelennox, okay. It feels like one of those features which is not useful. | 09:41 |
| ajayaa | somthing like extra_attributes. | 09:41 |
| jamielennox | ajayaa: heh - i understand the sentiment | 09:42 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the syntax issue on creating table `endpoint_group` https://review.openstack.org/151931 | 09:42 |
| jamielennox | ajayaa: it's pretty useful from an LDAP perspective though where you often just disable the user rather than delete | 09:42 |
| jamielennox | and where you shouldn't user-list anyway | 09:42 |
| ajayaa | jamielennox, Thanks. That is helpful. | 09:45 |
| *** dlatt has joined #openstack-keystone | 09:52 | |
| *** dlatt has left #openstack-keystone | 09:56 | |
| ccard | I'm trying to get openstack-keystone to use LDAP for its identity data, and I have added what I believe to be configuration that should work to /etc/keystone/keystone.conf. By turning on debug logging in keystone and the ldap server, I can see that keystone is making several requests to the ldap server which work, but the final request it makes always returns LDAP error 49 (Invalid credentials). | 09:57 |
| ccard | I suspect this is because the final request is binding as the admin user, and I have no password defined in the LDAP entry - how can I see which user the LDAP requests are being done as? | 09:59 |
| *** henrynash has quit IRC | 09:59 | |
| ccard | I've added the userPassword to the admin user in the LDAP directory and checked that ldapsearch works binding as this user, but keystone is still getting err 49 for its last request. | 10:17 |
| *** andreaf_ is now known as andreaf | 10:21 | |
| jamielennox | ccard: not an expert here, yes the final bind is being done as the user that is trying to log in so that is a likely cause | 10:28 |
| jamielennox | i was under the impression that the LDAP logging is very verbose in debug mode - so that should let you see the user s | 10:30 |
| ccard | jamielennox: yes, LDAP logging is very verbose, but I couldn't see anything about the bind user. I'll take another look. | 10:33 |
| jamielennox | ccard: last time i had a problem like this i disabled multi threading and used ipdb to step through the ldap code | 10:34 |
| jamielennox | :( that's a poor answer - sorry | 10:34 |
| *** markvoelker has joined #openstack-keystone | 10:36 | |
| *** markvoelker has quit IRC | 10:41 | |
| ccard | jamielennox: actually the error 49 has gone now, the BIND is working, but "keystone user-list" is now giving the error "Could not find project: admin (Disable debug mode to suppress these details.) (HTTP 401) | 10:43 |
| ccard | " | 10:43 |
| jamielennox | ccard: ok, so are you using LDAP assignment or SQL? | 10:43 |
| jamielennox | if you don't pick one then by default you are using LDAP - and you don't want to be | 10:43 |
| ccard | jamielennox: SQL I believe, given that LDAP assignment is going to be deprecated, but maybe it's not explicitly specified | 10:44 |
| jamielennox | ccard: so you'll have: [assignment] | 10:44 |
| jamielennox | driver = keystone.assignment.backends.sql.Assignment | 10:44 |
| jamielennox | in config | 10:44 |
| ccard | jamielennox: yes, that was it, thanks. keystone user-list is now returning the users :) | 10:48 |
| jamielennox | ccard: cool - that always gets me too, unforunately it's one of those default options that is difficult to change | 10:48 |
| ccard | jamielennox: I suspect I still need to add passwords for the other internal users, but I don't know what they are - I set this openstack up before Christmas using packstack, and I don't think I had to supply any passwords, though I must have got the admin password from somewhere. Can I find out what the passwords are, or will it be simpler to change them? | 10:52 |
| *** jamiec has quit IRC | 10:55 | |
| jamielennox | ccard: heh, i'm currently writing up something very similar to what it sounds like you're doing | 10:56 |
| *** jamiec has joined #openstack-keystone | 10:56 | |
| jamielennox | if you still have the packstack answers file around then the service users passwords are all in there | 10:56 |
| jamielennox | CONFIG_XXXX_KS_PW | 10:57 |
| jamielennox | otherwise you'll have to change them | 10:57 |
| ccard | jamielennox: thank, I see them now. I also just noticed that keystone user-list is returning the users, but the Enabled flag is blank. I've put all the users in a group and set user_enabled_default to False and pointed user_enabled_emulation_dn to a group which has all the users as members. | 11:00 |
| *** dobson has quit IRC | 11:01 | |
| jamielennox | ccard: blank or reversed? | 11:02 |
| jamielennox | also is this an IPA deployment? | 11:02 |
| *** rm_work|away has quit IRC | 11:02 | |
| *** dobson has joined #openstack-keystone | 11:03 | |
| *** rm_work|away has joined #openstack-keystone | 11:04 | |
| *** rm_work|away is now known as rm_work | 11:04 | |
| *** rm_work has joined #openstack-keystone | 11:04 | |
| ccard | jamielennox: blank, I think. This isn't IPA at the moment, but at some point in the future it will be. | 11:06 |
| jamielennox | ok - just that i have an IPA config here | 11:06 |
| jamielennox | um, only thing i can guess is that the field is wrong but i'm not sure on that one | 11:07 |
| ccard | jamielennox: I've added the passwords to LDAP and the openstack gui is behaving better anyway. Let me double-check the Enabled stuff | 11:12 |
| ccard | jamielennox: I'd missed user_enabled_emulation = True :( Now working ok ... | 11:15 |
| jamielennox | ccard: so many ldap options... | 11:18 |
| *** afazekas has joined #openstack-keystone | 11:34 | |
| *** markvoelker has joined #openstack-keystone | 11:37 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 11:39 |
| *** afazekas has quit IRC | 11:39 | |
| *** markvoelker has quit IRC | 11:42 | |
| jamielennox | alright - night all | 11:47 |
| *** josecastroleon has quit IRC | 11:49 | |
| *** andreaf_ has joined #openstack-keystone | 11:54 | |
| *** jamielennox is now known as jamielennox|away | 11:56 | |
| *** andreaf_ has quit IRC | 11:58 | |
| *** andreaf_ has joined #openstack-keystone | 11:59 | |
| *** josecastroleon has joined #openstack-keystone | 12:06 | |
| *** afazekas has joined #openstack-keystone | 12:19 | |
| *** chlong has joined #openstack-keystone | 12:25 | |
| *** aix has joined #openstack-keystone | 12:29 | |
| *** rushiagr is now known as rushiagr_away | 12:35 | |
| *** chlong has quit IRC | 12:35 | |
| *** henrynash has joined #openstack-keystone | 12:35 | |
| *** ChanServ sets mode: +v henrynash | 12:35 | |
| *** chlong has joined #openstack-keystone | 12:35 | |
| *** raildo has joined #openstack-keystone | 12:36 | |
| *** markvoelker has joined #openstack-keystone | 12:38 | |
| samueldmq | morning | 12:40 |
| samueldmq | henrynash, hi - thanks for your review. Your comments were addressed and your tests are now passing | 12:40 |
| henrynash | samueldmq: ok, excellent! I’ll do another pass today of the patch | 12:41 |
| samueldmq | henrynash, great! I'm checking your last patch on tests (Test list_role_assignment in standard inheritance tests) to check if there is something else wrong with our refactoring :) | 12:42 |
| samueldmq | henrynash, some tests are failing there | 12:42 |
| samueldmq | s/some tests are/one test is | 12:43 |
| henrynash | samueldmq: oh, really? I thought the new ones I added were passing on my machine locally | 12:43 |
| *** markvoelker has quit IRC | 12:43 | |
| henrynash | samueldmq: the last patch I need to add is where we add support for testing project hierachies with list_role_assignments | 12:44 |
| henrynash | samueldmq: at the point, list_role_assignments will be at least as well tested (if not more) than the old methods we used to use | 12:44 |
| *** dimsum__ has joined #openstack-keystone | 12:44 | |
| henrynash | (at that point…) | 12:45 |
| *** dims_ has joined #openstack-keystone | 12:45 | |
| *** karimb has quit IRC | 12:46 | |
| *** dimsum__ has quit IRC | 12:49 | |
| samueldmq | henrynash, nice, makes sense to me. it will be more tested, for sure :) | 12:49 |
| samueldmq | henrynash, see my comments on patch 153897 | 12:49 |
| samueldmq | henrynash, something was wrong in the test | 12:49 |
| henrynash | samueldmq: could well be….:-) | 12:50 |
| henrynash | samueldmq: ah, sory, yes, I swapped the order of the defintions around, but didn’t change the results…oops | 12:51 |
| henrynash | samueldmq: I’ll repost | 12:52 |
| *** lnxnut has joined #openstack-keystone | 12:53 | |
| samueldmq | henrynash, great :) | 12:55 |
| *** lnxnut has quit IRC | 12:58 | |
| *** markvoelker has joined #openstack-keystone | 12:59 | |
| *** pnavarro is now known as NICK|afk | 13:06 | |
| *** NICK|afk is now known as pnavarro | 13:07 | |
| *** pnavarro is now known as pnavarro|afk | 13:07 | |
| *** krykowski has joined #openstack-keystone | 13:12 | |
| *** rushiagr_away is now known as rushiagr | 13:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split the assignments controller https://review.openstack.org/132634 | 13:19 |
| *** ctina has joined #openstack-keystone | 13:22 | |
| *** ctina has quit IRC | 13:22 | |
| *** htruta has joined #openstack-keystone | 13:31 | |
| *** henrynash has quit IRC | 13:36 | |
| *** chlong has quit IRC | 13:36 | |
| *** bknudson has quit IRC | 13:36 | |
| *** gordc has joined #openstack-keystone | 13:37 | |
| *** rushiagr is now known as rushiagr_away | 13:41 | |
| *** afazekas has quit IRC | 13:47 | |
| *** aix has quit IRC | 13:47 | |
| *** bknudson has joined #openstack-keystone | 13:59 | |
| *** ChanServ sets mode: +v bknudson | 13:59 | |
| *** ctina has joined #openstack-keystone | 14:00 | |
| *** david-lyle_afk is now known as david-lyle | 14:01 | |
| *** krtaylor has quit IRC | 14:03 | |
| *** krykowski has quit IRC | 14:03 | |
| *** r-daneel has joined #openstack-keystone | 14:04 | |
| *** rhbear has joined #openstack-keystone | 14:05 | |
| *** ljfisher has joined #openstack-keystone | 14:10 | |
| *** ajayaa has quit IRC | 14:11 | |
| *** krtaylor has joined #openstack-keystone | 14:16 | |
| *** lnxnut has joined #openstack-keystone | 14:17 | |
| *** krykowski has joined #openstack-keystone | 14:17 | |
| *** nellysmitt has quit IRC | 14:19 | |
| *** mzbik has quit IRC | 14:20 | |
| *** lnxnut has quit IRC | 14:21 | |
| marekd | bknudson: re: https://review.openstack.org/#/c/150627/ i don't know if the bp should be created in keystoneclient or keystoneclient-federation project? | 14:23 |
| bknudson | marekd: probably one for each? | 14:23 |
| marekd | bknudson: ack | 14:23 |
| bknudson | there's stuff to do in keystoneclient and stuff to do in keystoneclient-federation | 14:23 |
| *** ctina has quit IRC | 14:26 | |
| *** samueldmq_ has joined #openstack-keystone | 14:26 | |
| samueldmq_ | bknudson, dstanek, morganfainberg could you please take a look at backends-tests-restructuration blueprint ? | 14:28 |
| samueldmq_ | https://blueprints.launchpad.net/keystone/+spec/backends-tests-restructuration | 14:28 |
| *** rushiagr_away is now known as rushiagr | 14:29 | |
| *** henrynash has joined #openstack-keystone | 14:34 | |
| *** ChanServ sets mode: +v henrynash | 14:34 | |
| *** karimb has joined #openstack-keystone | 14:36 | |
| samueldmq_ | henrynash, https://blueprints.launchpad.net/keystone/+spec/backends-tests-restructuration | 14:37 |
| *** abhirc has joined #openstack-keystone | 14:38 | |
| *** ctina has joined #openstack-keystone | 14:39 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 14:39 |
| henrynash | samueldmq_: yes, we need to do that one, I think! | 14:40 |
| henrynash | samueldmq_: we should add it for approval with a spec for tomorrow’s meeting | 14:40 |
| *** rhbear has quit IRC | 14:42 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 14:43 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 14:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 14:48 |
| samueldmq_ | henrynash, with or without a spec? I'm not sure we need one .. | 14:52 |
| *** pnavarro|afk is now known as pnavarro | 14:52 | |
| henrynash | samueldmq_: I would agree - we should suggest we do this without a spec | 14:52 |
| samueldmq_ | henrynash, great! I will add it to tomorrow's meeting, thanks | 14:53 |
| henrynash | samueldmq_: excellent | 14:54 |
| *** afazekas has joined #openstack-keystone | 14:54 | |
| *** aix has joined #openstack-keystone | 14:56 | |
| *** richm1 has joined #openstack-keystone | 14:56 | |
| *** radez_g0n3 is now known as radez | 14:58 | |
| *** richm1 is now known as richm | 14:58 | |
| *** lnxnut has joined #openstack-keystone | 14:58 | |
| *** lnxnut_ has joined #openstack-keystone | 15:01 | |
| *** lnxnut has quit IRC | 15:02 | |
| *** ajayaa has joined #openstack-keystone | 15:04 | |
| *** topol has joined #openstack-keystone | 15:05 | |
| *** ChanServ sets mode: +v topol | 15:05 | |
| *** stevemar has joined #openstack-keystone | 15:08 | |
| *** ChanServ sets mode: +v stevemar | 15:08 | |
| *** samueldmq_ has quit IRC | 15:19 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Improves support for sample data script with ssl https://review.openstack.org/154074 | 15:20 |
| *** carlosmarin has joined #openstack-keystone | 15:22 | |
| *** timcline has joined #openstack-keystone | 15:22 | |
| *** henrynash has quit IRC | 15:23 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Extract test_v3_resource from test_v3_assignment https://review.openstack.org/154080 | 15:28 |
| *** ljfisher has quit IRC | 15:29 | |
| samueldmq | bknudson, could you please review this (https://review.openstack.org/#/c/142472/) | 15:31 |
| samueldmq | bknudson, the point is wheter we should or not support sqlite on the proposed migration | 15:31 |
| samueldmq | whether* | 15:31 |
| bknudson | samueldmq: there's several core reviewers on keystone ... you'll probably get a better response by not asking a specific person to review it. | 15:32 |
| *** afazekas has quit IRC | 15:32 | |
| samueldmq | bknudson, it's been there for days .. that's why I pinged you .. I understand your point, and will ping others as well, thanks | 15:33 |
| samueldmq | dstanek, ping - could you please take a look at https://review.openstack.org/#/c/142472/ ? | 15:34 |
| dstanek | samueldmq: sure | 15:34 |
| samueldmq | dstanek, there is a discussion on whether we should support sqlite on that migration | 15:34 |
| samueldmq | dstanek, ok thanks | 15:35 |
| *** ljfisher has joined #openstack-keystone | 15:35 | |
| *** afazekas has joined #openstack-keystone | 15:46 | |
| *** jorge_munoz has joined #openstack-keystone | 15:54 | |
| *** joesavak has joined #openstack-keystone | 15:55 | |
| *** Guest22817 is now known as mfisch | 15:56 | |
| *** mfisch has joined #openstack-keystone | 15:56 | |
| *** dims_ has quit IRC | 15:56 | |
| *** aix has quit IRC | 16:00 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Fix invalid super() usage in memcache pool https://review.openstack.org/154095 | 16:01 |
| *** dimsum__ has joined #openstack-keystone | 16:01 | |
| *** dimsum__ has quit IRC | 16:08 | |
| *** dimsum__ has joined #openstack-keystone | 16:10 | |
| *** dimsum__ has quit IRC | 16:11 | |
| *** dimsum__ has joined #openstack-keystone | 16:12 | |
| *** dimsum__ has quit IRC | 16:13 | |
| *** dimsum__ has joined #openstack-keystone | 16:13 | |
| *** dimsum__ has quit IRC | 16:14 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Change user identification in mapping engine https://review.openstack.org/154100 | 16:14 |
| *** dimsum__ has joined #openstack-keystone | 16:17 | |
| *** zzzeek has joined #openstack-keystone | 16:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Change user identification in mapping engine https://review.openstack.org/154100 | 16:17 |
| *** krykowski has quit IRC | 16:26 | |
| marekd | morganfainberg: stevemar: For this spec: https://github.com/openstack/keystone-specs/blob/master/specs/kilo/federated-direct-user-mapping.rst I specified that user can be identified by id AND domain, but looks like it should be more like that: http://pasteraw.com/aycyfn0e5ddb4ol7x25h76b80u1qg00 | 16:26 |
| *** aix has joined #openstack-keystone | 16:29 | |
| *** Farhan_ has quit IRC | 16:31 | |
| *** afazekas has quit IRC | 16:33 | |
| *** gyee has joined #openstack-keystone | 16:33 | |
| *** ChanServ sets mode: +v gyee | 16:33 | |
| lbragstad | david8hu: you're main objective here is to just get rid of the version specific methods here, right (https://review.openstack.org/#/c/150629/3) | 16:33 |
| *** ayoung has joined #openstack-keystone | 16:33 | |
| *** ChanServ sets mode: +v ayoung | 16:33 | |
| lbragstad | david8hu: I think this was the review from ayoung that morganfainberg was referencing? https://review.openstack.org/#/c/138519/ | 16:34 |
| stevemar | huh, db2 ci just gave me a merge failed warning | 16:44 |
| *** rwsu has joined #openstack-keystone | 16:44 | |
| *** ajayaa has quit IRC | 16:44 | |
| *** ajayaa has joined #openstack-keystone | 16:45 | |
| *** nicodemos has joined #openstack-keystone | 16:47 | |
| *** afazekas has joined #openstack-keystone | 16:50 | |
| *** timcline has quit IRC | 16:57 | |
| *** Guest69804 is now known as dan_ | 16:58 | |
| *** dan_ is now known as dank_ | 16:58 | |
| *** Ephur has joined #openstack-keystone | 16:58 | |
| *** tqtran has joined #openstack-keystone | 17:00 | |
| *** joesavak has quit IRC | 17:02 | |
| *** bjornar has quit IRC | 17:03 | |
| *** timcline has joined #openstack-keystone | 17:03 | |
| *** Ephur has quit IRC | 17:04 | |
| *** krykowski has joined #openstack-keystone | 17:06 | |
| *** jistr has quit IRC | 17:10 | |
| *** rwsu has quit IRC | 17:10 | |
| *** rwsu has joined #openstack-keystone | 17:11 | |
| *** EmilienM is now known as EmilienM|afk | 17:15 | |
| *** kfox1111 has joined #openstack-keystone | 17:16 | |
| *** henrynash has joined #openstack-keystone | 17:17 | |
| *** ChanServ sets mode: +v henrynash | 17:17 | |
| stevemar | bknudson, morganfainberg so whats up with the domain id not being used here: https://github.com/openstack/keystone/blob/ab627dae92c67475be5ea6f8dbdc986c72060bf1/keystone/resource/backends/sql.py#L173-L177 | 17:17 |
| kfox1111 | Odd problem. Just tried adding groups to the ldap config. got this: | 17:18 |
| kfox1111 | http://pastebin.com/bFsrXigi | 17:18 |
| kfox1111 | oh... my dn was wrong. still from the example. | 17:18 |
| stevemar | bknudson, morganfainberg oops, oh it's actually fine, since the id is part of the domain blob anyway | 17:18 |
| ayoung | lbragstad, I missed the context, but that is what I am currently working on | 17:19 |
| lbragstad | ayoung: david8hu is working on cleaning up the token provider pipeline and morganfainberg referenced that accessinfo commit you had | 17:19 |
| lbragstad | seeing if there was a way we could consolidate work | 17:19 |
| ayoung | lbragstad, looking at his review now | 17:20 |
| ayoung | lbragstad, yes, that is the kind of code I am trying to support | 17:21 |
| lbragstad | ayoung: cool | 17:21 |
| lbragstad | ayoung: I need to step through your review, working on david8hu patch a little right now too | 17:21 |
| *** amerine has quit IRC | 17:22 | |
| ayoung | lbragstad, cool. I have not yet gotten all the tests to run. RIght now I am triggering a circular dependency in the JSON parsing somehow. jamielennox|away wants to be able to replace the client side of the access_info in the first hack, so it is chewing up much time | 17:22 |
| lbragstad | ayoung: ok, makes sense | 17:23 |
| *** zigo has quit IRC | 17:29 | |
| kfox1111 | Is there a way to list what groups a user is a member of via the cli? | 17:35 |
| *** lhcheng has joined #openstack-keystone | 17:37 | |
| *** amerine has joined #openstack-keystone | 17:39 | |
| *** krtaylor has quit IRC | 17:41 | |
| *** marg7175 has joined #openstack-keystone | 17:51 | |
| *** spandhe has joined #openstack-keystone | 17:51 | |
| *** karimb has quit IRC | 17:52 | |
| *** krtaylor has joined #openstack-keystone | 17:54 | |
| *** ajayaa has quit IRC | 17:58 | |
| lbragstad | kfox1111: not sure about the cli (cc stevemar ?) but there is a rest call for it https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#list-groups-of-which-a-user-is-a-member | 17:58 |
| morganfainberg | lbragstad, kfox1111, for sure you can't get that information with keystoneclient | 17:59 |
| morganfainberg | cli | 17:59 |
| lbragstad | morganfainberg: kfox1111 checking osc | 17:59 |
| morganfainberg | openstackclient might be able to. | 17:59 |
| stevemar | morganfainberg, kfox1111 yeah it should be able to | 17:59 |
| *** timcline has quit IRC | 18:00 | |
| stevemar | http://docs.openstack.org/developer/python-openstackclient/command-objects/group.html#group-list | 18:00 |
| lbragstad | https://github.com/openstack/python-openstackclient/blob/master/openstackclient/identity/v3/group.py#L70 | 18:00 |
| stevemar | lbragstad, point to our pretty docs! | 18:00 |
| lbragstad | stevemar: you beat me to it! | 18:00 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: create _member_ role as specified in CONF https://review.openstack.org/142897 | 18:00 |
| lbragstad | stevemar: but the code is pretty too! | 18:00 |
| * morganfainberg is getting ready to release keystoneclient 1.1.0 | 18:02 | |
| morganfainberg | anyone have a reason i should avoid doing so? | 18:02 |
| stevemar | kfox1111, http://paste.openstack.org/show/170108/ | 18:02 |
| stevemar | lbragstad, for you too ^ | 18:02 |
| stevemar | morganfainberg, no reason not to! but ask jamie :P | 18:03 |
| lbragstad | stevemar: thanks | 18:03 |
| morganfainberg | stevemar, based upon last night, we should be good. | 18:03 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: refactor: use _get_project_endpoint_group_url() where applicable https://review.openstack.org/139080 | 18:03 |
| samueldmq | dolphm, ^just rebased | 18:03 |
| dolphm | samueldmq: thanks! | 18:04 |
| *** harlowja has joined #openstack-keystone | 18:04 | |
| samueldmq | :-) | 18:04 |
| samueldmq | dolphm, np | 18:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 18:06 |
| *** krykowski has quit IRC | 18:06 | |
| *** afazekas has quit IRC | 18:07 | |
| openstackgerrit | Merged openstack/oslo.policy: Make use of private modules https://review.openstack.org/153310 | 18:10 |
| morganfainberg | keystoneclient released | 18:10 |
| openstackgerrit | Merged openstack/oslo.policy: Do not use global enforcer for tests https://review.openstack.org/153321 | 18:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Use oslo.context instead of incubator code https://review.openstack.org/154166 | 18:11 |
| *** timcline has joined #openstack-keystone | 18:13 | |
| david8hu | lbragstad: https://review.openstack.org/#/c/138519/7 is the one Morgan is refering to. I am looking at I can leverage from 138519, so my patch is more focused and not duplicating the work. | 18:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Sync with oslo-incubator https://review.openstack.org/154168 | 18:14 |
| lbragstad | david8hu: ok | 18:14 |
| *** aix has quit IRC | 18:15 | |
| *** rushiagr is now known as rushiagr_away | 18:18 | |
| morganfainberg | ugh: https://bugs.launchpad.net/keystonemiddleware/+bug/1415184 | 18:19 |
| openstack | Launchpad bug 1415184 in Trove "Invalid argument in threadgroup.Thread.wait" [Medium,Triaged] | 18:19 |
| lbragstad | david8hu: so the keystonetoken class you have in https://review.openstack.org/#/c/150629/3/keystone/token/providers/common.py is pretty much the equivalent of the Token class here https://review.openstack.org/#/c/138519/7/keystoneclient/models/access_info.py | 18:19 |
| lbragstad | right? | 18:19 |
| openstackgerrit | Merged openstack/oslo.policy: Stop shouting test attribute names https://review.openstack.org/153322 | 18:20 |
| openstackgerrit | Merged openstack/oslo.policy: Remove oslo.concurrency from requirements https://review.openstack.org/153480 | 18:20 |
| openstackgerrit | Merged openstack/oslo.policy: Remove globals that were introduced for compatibility https://review.openstack.org/153714 | 18:20 |
| samueldmq | lbragstad, breton just left a comment on your discussion on review #139174 | 18:21 |
| stevemar | morganfainberg, we're nearing a first release of oslo.policy :O | 18:21 |
| morganfainberg | stevemar, cool! | 18:21 |
| david8hu | lbragstad: Yes, very similar except the internal data structure | 18:21 |
| lbragstad | david8hu: so is that the part we don't want to duplicate? | 18:22 |
| lbragstad | and if so, we'd be relying on keystoneclient for that structure? | 18:22 |
| *** atiwari has joined #openstack-keystone | 18:23 | |
| openstackgerrit | Merged openstack/oslo.policy: Upgrade hacking to >=0.10.0 https://review.openstack.org/153482 | 18:23 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/154177 | 18:24 |
| david8hu | lbragstad: The token obj itself if what I do not want to duplicate. The internal data struture if need to can be enhanced at a later time I hope. | 18:24 |
| morganfainberg | lbragstad, the idea is we'd us the same token object class everywehre | 18:24 |
| morganfainberg | rather than needing to have multiple different implementations | 18:24 |
| lbragstad | morganfainberg: david8hu ok, makes sense | 18:25 |
| lbragstad | morganfainberg: david8hu and that should live in the client | 18:25 |
| *** sld has joined #openstack-keystone | 18:25 | |
| lbragstad | so we'll have to review the access info stuff and release a version of keystoneclient before fixing the provider logic in keystone | 18:26 |
| *** krtaylor has quit IRC | 18:27 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystonemiddleware: iso expires should be returned in one place https://review.openstack.org/140984 | 18:27 |
| richm | ayoung: ping - re: http://adam.younglogic.com/2013/11/more-keystone-v3-api-examples/ | 18:33 |
| richm | ayoung: is admin_token authentication still valid in juno? | 18:34 |
| richm | ayoung: if it is, does it require policy in order to work? | 18:34 |
| richm | ayoung: because when I use it, I get "The request you have made requires authentication." 401 | 18:39 |
| kfox1111 | stevemar: thanks | 18:40 |
| stevemar | np | 18:41 |
| *** avozza is now known as zz_avozza | 18:42 | |
| larsks | richm: with juno, if I run 'keystone --os-token <token> --os-endpoint http://keystone:35357/v2.0 service-list" it works without error. | 18:45 |
| ayoung | richm, it depends on the call | 18:46 |
| ayoung | richm, you need to have it enabled in the config file too. | 18:47 |
| ayoung | richm, sorry for the slow reply, as I was out dealing with Elsa | 18:47 |
| * larsks notes that things seem to work with --os-identity-api-version=3, also, with a modified endpoint url. | 18:48 | |
| *** atiwari has quit IRC | 18:50 | |
| lbragstad | ayoung: I took a pass at https://review.openstack.org/#/q/status:open+project:openstack/python-keystoneclient+branch:master+topic:issued_at,n,z | 18:50 |
| lbragstad | ayoung: I can help respin them if needed | 18:50 |
| ayoung | lbragstad, thanks | 18:50 |
| ayoung | yes, please | 18:50 |
| lbragstad | ok | 18:51 |
| *** arunkant has joined #openstack-keystone | 18:59 | |
| *** zigo has joined #openstack-keystone | 19:03 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 19:08 |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient: Add data to example data https://review.openstack.org/151761 | 19:10 |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 19:10 |
| *** EmilienM|afk is now known as EmilienM | 19:12 | |
| lbragstad | stevemar: ayoung ^ attempted to address some comments | 19:12 |
| *** zz_avozza is now known as avozza | 19:17 | |
| *** joesavak has joined #openstack-keystone | 19:22 | |
| richm | larsks: I'm trying to use "openstack" instead of "keystone" (for puppet-keystone v3 support) | 19:23 |
| ayoung | lbragstad, thanks. will look | 19:24 |
| richm | ayoung: how do I enable it in the config file? Something other than DEFAULT/admin_token=...... ? | 19:24 |
| *** gokrokve has joined #openstack-keystone | 19:25 | |
| larsks | richm: using 'openstack --os-token <token> --os-url http://localhost:35357/v3 --os-identity-api-version=3 service list' works, too :) | 19:25 |
| *** atiwari has joined #openstack-keystone | 19:26 | |
| *** atiwari has joined #openstack-keystone | 19:28 | |
| ayoung | richm, I'm looking...there is a nother config option, too | 19:28 |
| ayoung | richm, ah, I think it is in the paste pipeline | 19:28 |
| richm | larsks: <token> is the DEFAULT/admin_token? | 19:28 |
| larsks | richm: right. | 19:29 |
| morganfainberg | Hrm. I wonder if we could improve the keystone bootstrap story. | 19:29 |
| larsks | (this is on a largely stock f21/rdo juno) | 19:29 |
| richm | larsks: ok - the thing is, that works fine until I enable the v3 policy and v3 multiple domains | 19:29 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini#n79 richm see admin_token_auth in there? | 19:29 |
| larsks | richm: interesting. I *do* have multiple domains (I have heat installed and using a 'heat' domain). | 19:29 |
| morganfainberg | The admin token story is ok but lacking (needing to do a restart of keystone and reconfigure it to bootstrap is not wonderful) | 19:29 |
| larsks | But I'm not sure about the v3 policy. | 19:29 |
| ayoung | richm, yes, the DEFAULT/admin_token is what you need to set | 19:30 |
| richm | ayoung: ok - admin_token is set | 19:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove unused test case https://review.openstack.org/154212 | 19:30 |
| ayoung | richm, and look in the paste file to make sure the admin_token_auth filter is in place | 19:30 |
| richm | ayoung: where is that? | 19:30 |
| morganfainberg | And that ^^ is why this is a less wonderful story for bootstrapping. | 19:30 |
| richm | ayoung: where is the paste ini file? | 19:31 |
| richm | there isn't one in /etc/keystone in my deployment | 19:31 |
| ayoung | richm, this an RDO install? | 19:31 |
| morganfainberg | richm: paste ini file. Usually in the keystone config dir (etc/keystone/paste-ini.conf ?) | 19:31 |
| richm | ayoung: yes | 19:31 |
| ayoung | THe paste file is probably under /usr/share | 19:31 |
| richm | morganfainberg: not there | 19:31 |
| ayoung | look in the config file for the pasteentry | 19:32 |
| richm | /usr/share/keystone/keystone-dist-paste.ini | 19:32 |
| morganfainberg | ayoung: oh RDO does /usr/share ? I ... *shakes head* but... Config-stuff... | 19:32 |
| ayoung | paste_deploy/config_file | 19:32 |
| stevemar | hmph, who knew it places it there | 19:32 |
| ayoung | stevemar, I did | 19:32 |
| larsks | morganfainberg: the stuff in /usr/share is default configs, meant to be overridden by stuff in /etc. | 19:32 |
| morganfainberg | stevemar: if it's a dist example file that's fine | 19:33 |
| ayoung | stevemar, there is a general trend to having the non editable versions of the files in places other than /etc, and putting overrides only in etc | 19:33 |
| stevemar | ahhh okay | 19:33 |
| ayoung | for example, firewalld puts all the defautls somewhere under lib | 19:33 |
| stevemar | hey morganfainberg can i get you to look at something thats bugging me for 1 sec | 19:33 |
| morganfainberg | larsks: ayoung I disagree with this being non-editable and overridden but that is personal taste. | 19:33 |
| morganfainberg | stevemar: dunno. What's in it for me ;). Yeah of course. | 19:34 |
| ayoung | morganfainberg, yeah, its the dist baseline, so to modify the paste we'd expect someone to copy to etc and edit the line...not a stellar experience | 19:34 |
| stevemar | why is it that this works for icehouse: https://review.openstack.org/#/c/154166/ but this one doesn't: https://review.openstack.org/#/c/152803/ | 19:34 |
| morganfainberg | ayoung: the "expect people to copy it" is what I disagree with. Again, personal taste. | 19:34 |
| ayoung | morganfainberg, its an RPM standard thing, and I avoided tilting at that particular windmill | 19:34 |
| morganfainberg | Haha | 19:35 |
| richm | . . . and fail - still not working | 19:35 |
| *** stevemar has quit IRC | 19:37 | |
| morganfainberg | stevemar: http://logs.openstack.org/03/152803/1/check/gate-tempest-dsvm-neutron-src-pycadf-icehouse/e0c12b7/logs/devstack-gate-setup-workspace-new.txt.gz#_2015-02-09_05_36_12_373 | 19:37 |
| morganfainberg | Oh he left. | 19:37 |
| *** stevemar has joined #openstack-keystone | 19:38 | |
| *** ChanServ sets mode: +v stevemar | 19:38 | |
| morganfainberg | *pokes stevemar's lifeless connection with a stick* yep, dead Jim | 19:38 |
| morganfainberg | stevemar: http://logs.openstack.org/03/152803/1/check/gate-tempest-dsvm-neutron-src-pycadf-icehouse/e0c12b7/logs/devstack-gate-setup-workspace-new.txt.gz#_2015-02-09_05_36_12_373 | 19:38 |
| morganfainberg | stevemar: a zuul get error it looks like. Not a oslo.context error. | 19:38 |
| stevemar | morganfainberg, oh it was a zuul error | 19:38 |
| stevemar | morganfainberg, every now and then my isp just died | 19:39 |
| stevemar | dies | 19:39 |
| morganfainberg | Looks like to me it's Zuul in this case | 19:39 |
| morganfainberg | At least it isn't a Vince Clortho error >.> | 19:39 |
| morganfainberg | bah. Not even a snicker for that one :( | 19:40 |
| stevemar | morganfainberg, neat... feel free to review those guys :D | 19:40 |
| *** afazekas has joined #openstack-keystone | 19:40 | |
| stevemar | sorry, that one went way over my head | 19:40 |
| morganfainberg | Not a ghostbusters fan? | 19:41 |
| *** openstackgerrit has quit IRC | 19:41 | |
| *** openstackgerrit has joined #openstack-keystone | 19:41 | |
| stevemar | ah, google is telling me stuff now | 19:41 |
| morganfainberg | Vince Clortho and Zuul. Summon gozer the gozarian. | 19:41 |
| morganfainberg | Wow.... | 19:41 |
| morganfainberg | You had to google that? | 19:41 |
| stevemar | maybe, shhhh | 19:42 |
| dank_ | We aren't all a mine of 80's trivia information sir :) | 19:42 |
| morganfainberg | dank_: but... Ghostbusters !! | 19:43 |
| morganfainberg | I didn't make a reference to a Sloar or anything else that was a one-off line in that movie. | 19:43 |
| morganfainberg | >.> | 19:43 |
| ayoung | morganfainberg, how many comedies do you remember from the 1960s. | 19:44 |
| ayoung | stevemar, when were you born? 1990 or later? | 19:44 |
| morganfainberg | ayoung: depends, do you mean comedy as in a Greek comedy? :P. | 19:44 |
| ayoung | Herbie goes to Monty Carlo? | 19:45 |
| morganfainberg | I am a bad example in most cases. I have a degree in theatre and film. I watched more crappy (and good) movies than I care to admit | 19:45 |
| morganfainberg | From all eras. | 19:46 |
| *** thedodd has joined #openstack-keystone | 19:46 | |
| morganfainberg | So to answer, I have a hard time remembering comedies from any decade, ghostbusters only being relevant due to the naming scheme used for our tools... Zuul is the gatekeeper. | 19:47 |
| morganfainberg | And if we were to redo kite, it should be called "Vince" as he is the key master. >.> | 19:47 |
| morganfainberg | Aaaannnnnnny way | 19:49 |
| *** abhirc has quit IRC | 19:52 | |
| *** afazekas has quit IRC | 19:56 | |
| *** afazekas has joined #openstack-keystone | 19:58 | |
| *** krtaylor has joined #openstack-keystone | 19:59 | |
| *** atiwari has quit IRC | 20:03 | |
| *** abhirc has joined #openstack-keystone | 20:05 | |
| *** afazekas has quit IRC | 20:07 | |
| *** abhirc has quit IRC | 20:07 | |
| *** afazekas has joined #openstack-keystone | 20:07 | |
| *** gyee has quit IRC | 20:07 | |
| morganfainberg | eventlet makes my head hurt | 20:10 |
| morganfainberg | http://paste.openstack.org/show/162889/ | 20:10 |
| bknudson | I noticed that keystone wasn't shutting down cleanly in devstack when using eventlet... similar error "Calling waitall() from within one of the GreenPool's greenthreads will never terminate" | 20:13 |
| bknudson | and I think some tests are dumping that too. | 20:14 |
| morganfainberg | bknudson, that isn't a shutodwn in that case | 20:14 |
| morganfainberg | bknudson, that is actually a runtime error aparantly, where Thread.wait() is being called somehow which is resulting in an exception | 20:14 |
| morganfainberg | i *think* this is strictly oslo.concurrency issue | 20:14 |
| stevemar | morganfainberg, are you thinking about a keystonemiddleware release soon? | 20:18 |
| morganfainberg | stevemar, yes, looking at bugs and open reviews before i push the release | 20:18 |
| morganfainberg | the plan is today unless i have a reason to hold off | 20:18 |
| stevemar | morganfainberg, i would really like gordc's stuff in the next release | 20:19 |
| stevemar | blah, it's in merge conflict now | 20:19 |
| *** bjornar has joined #openstack-keystone | 20:21 | |
| ayoung | Does it make sense that JSON utils would report a cycle if two keys pointed to the same string? Do I need to make a copy of the string to prevent that dstanek ? | 20:28 |
| *** bjornar has quit IRC | 20:29 | |
| *** timcline has quit IRC | 20:29 | |
| *** timcline has joined #openstack-keystone | 20:30 | |
| bknudson | when running devstack in eventlet, if I hit CTRL-C, it prints "AssertionError: Calling waitall() from within one of the GreenPool's greenthreads will never terminate." | 20:30 |
| bknudson | and then keystone eventually shuts down. | 20:30 |
| morganfainberg | bknudson, weird. | 20:31 |
| bknudson | for some reason it logs the config again. | 20:31 |
| bknudson | add it to the list of weird stuff. | 20:32 |
| *** timcline has quit IRC | 20:34 | |
| *** timcline has joined #openstack-keystone | 20:37 | |
| *** Ephur has joined #openstack-keystone | 20:39 | |
| *** bjornar has joined #openstack-keystone | 20:43 | |
| dolphm | lbragstad: is there an implementation of AE tokens in gerrit at all? | 20:43 |
| *** afazekas has quit IRC | 20:44 | |
| lbragstad | dolphm: yes, https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:ae-tokens,n,z | 20:44 |
| lbragstad | but that has been squashed and worked since those were proposed. | 20:44 |
| *** tqtran is now known as tqtran_afk | 20:44 | |
| dolphm | lbragstad: can you post something more recent? | 20:45 |
| lbragstad | yeah | 20:45 |
| *** radez is now known as radez_g0n3 | 20:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove unused test case https://review.openstack.org/154212 | 20:49 |
| *** afazekas has joined #openstack-keystone | 20:50 | |
| *** andreaf_ has quit IRC | 20:51 | |
| dolphm | lbragstad: there's got to still be some v2 code acknowledging that API and returning 501 in https://review.openstack.org/#/c/154212/2 | 20:54 |
| lbragstad | dolphm: yeah, I just saw that | 20:55 |
| lbragstad | its in the v2 controller | 20:55 |
| lbragstad | but we still return a list of roles for a user if the request has a tenant supplied | 20:55 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L202-L205 | 20:56 |
| stevemar | lbragstad, yeah seems like there is more to rip out? maybe? | 20:57 |
| lbragstad | stevemar: well, it looks like we support returning a users roles if a tenant or domain is supplied | 20:58 |
| stevemar | but thats a different API call | 20:58 |
| morganfainberg | stevemar, jamielennox|away, lbragstad, any idea what this bug report is trying to accomplish? https://bugs.launchpad.net/keystonemiddleware/+bug/1405717 | 21:00 |
| openstack | Launchpad bug 1405717 in keystonemiddleware "region_name is not in keystone client auth_token config" [Undecided,New] | 21:00 |
| dolphm | lbragstad: so just return the if block? | 21:01 |
| dolphm | lbragstad: we've made it from essex to juno without implementing that | 21:01 |
| stevemar | morganfainberg, looks like he wants a region option for middleware | 21:01 |
| dolphm | lbragstad: i think we can drop any acknoledgement that there was an API there at some point in diablo | 21:02 |
| lbragstad | dolphm: yeah, | 21:02 |
| morganfainberg | stevemar, uh... yes, but i'm not sure what benefit that is providing? | 21:02 |
| lbragstad | dolphm: I looked for anything that could possibly test get_user_roles(context, user_id, tenant_id=<some_tenant>) but nothing | 21:02 |
| lbragstad | so I'm not sure we test that either? | 21:02 |
| dolphm | lbragstad: i recall people using that in keystoneclient | 21:03 |
| lbragstad | ok | 21:03 |
| dolphm | lbragstad: there'd be a test_keystoneclient test for it if anything | 21:03 |
| richm | ayoung: still fails - this is the keystone.log output - http://paste.openstack.org/show/170200/ | 21:03 |
| ayoung | richm, if you are making an API call that needs RBAC then it should fail | 21:04 |
| ayoung | admin token is for setup only | 21:04 |
| lbragstad | dolphm: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/v2_0/test_roles.py#L91 | 21:04 |
| ayoung | richm, list what? | 21:04 |
| richm | ayoung: so curl -i -X GET -H "X-Auth-Token: $tok" http://localhost:35357/v3/users | 21:04 |
| dolphm | lbragstad: look at the test above that | 21:04 |
| lbragstad | yeah | 21:04 |
| lbragstad | I'm wondering how that is passing | 21:05 |
| dolphm | lbragstad: it's a unit test in the client | 21:05 |
| lbragstad | becuase that should get a 501 | 21:05 |
| lbragstad | oh | 21:05 |
| lbragstad | right | 21:05 |
| *** bjornar has quit IRC | 21:05 | |
| samueldmq | for someone interested on hierarchical projects and inherited roles implementation on horizon | 21:08 |
| dolphm | lbragstad: also, the only thing that's unbounded in AE tokens is group IDs, right? | 21:08 |
| lbragstad | dolphm: yes, I believe so | 21:09 |
| samueldmq | there is a new blueprint proposing those functionalities: https://blueprints.launchpad.net/horizon/+spec/hierarchical-projects-and-inherited-assignments | 21:09 |
| lbragstad | dolphm: let me find the call | 21:09 |
| samueldmq | morganfainberg, ^ just to let you know we are starting hmt support on horizon | 21:09 |
| dolphm | lbragstad: i was just wondering if we know the maximum number of group IDs we could support without going over 255 chars? | 21:09 |
| dolphm | lbragstad: and what the effect would be of shorter IDs | 21:10 |
| lbragstad | https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#request-an-unscoped-os-federation-token | 21:11 |
| lbragstad | dolphm: something like that ^ | 21:11 |
| *** andreaf_ has joined #openstack-keystone | 21:12 | |
| lbragstad | https://github.com/openstack-attic/identity-api/blob/master/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-an-unscoped-os-federation-token-getpost-os-federationidentity_providersidentity_providerprotocolsprotocolauth | 21:12 |
| *** andreaf has quit IRC | 21:12 | |
| *** andreaf_ is now known as andreaf | 21:12 | |
| lbragstad | ^ dolphm that's the one the marekd referenced in the spec proposal | 21:13 |
| *** andreaf_ has joined #openstack-keystone | 21:13 | |
| *** gyee has joined #openstack-keystone | 21:14 | |
| *** ChanServ sets mode: +v gyee | 21:14 | |
| *** afazekas has quit IRC | 21:14 | |
| *** atiwari has joined #openstack-keystone | 21:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient: Remove get user roles without tenant https://review.openstack.org/154238 | 21:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove unused test case https://review.openstack.org/154212 | 21:19 |
| *** tqtran_afk is now known as tqtran | 21:22 | |
| *** nicodemos has quit IRC | 21:27 | |
| morganfainberg | henrynash, ping - let me know when you have a few minutes | 21:30 |
| morganfainberg | henrynash, want to discuss something with ya | 21:30 |
| *** sld has quit IRC | 21:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove XMLEquals from tests https://review.openstack.org/154242 | 21:33 |
| stevemar | ^^ should be easy | 21:33 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: AE Tokens https://review.openstack.org/145317 | 21:37 |
| lbragstad | stevemar: none of that xml stuff is used by the federation tests? | 21:38 |
| lbragstad | hmm doesn't look like it | 21:40 |
| lbragstad | dolphm: ^ updated WIP that still needs lots of work | 21:40 |
| dolphm | lbragstad: cool | 21:40 |
| openstackgerrit | TAHMINA AHMED proposed openstack/keystone: ABAC based role computing https://review.openstack.org/154244 | 21:41 |
| stevemar | lbragstad, nope, we don't match, thats too fancy | 21:41 |
| *** afazekas has joined #openstack-keystone | 21:41 | |
| lbragstad | stevemar: gotcha | 21:41 |
| lbragstad | stevemar: looks good, thanks for catching that | 21:41 |
| ayoung | OK...jsonutils is detecting a circular reference in one of my simple Data transfer objects....very little to this object | 21:46 |
| ayoung | https://review.openstack.org/#/c/138519/8/keystoneclient/models/access_info.py,cm Endpoint | 21:46 |
| openstackgerrit | TAHMINA AHMED proposed openstack/keystone: Testing... https://review.openstack.org/154247 | 21:47 |
| *** afazekas has quit IRC | 21:53 | |
| stevemar | gordc, rebaseeee https://review.openstack.org/#/c/149405/ | 21:55 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: move add event creation logic to keystonemiddleware https://review.openstack.org/149405 | 21:56 |
| stevemar | gordc, did it for you | 21:57 |
| gordc | stevemar: .... | 21:58 |
| * gordc goes back to bed. | 21:58 | |
| stevemar | gordc, you took too long, i waited a whole minute | 21:58 |
| stevemar | gordc, not even going to ask | 21:59 |
| *** ctina has quit IRC | 22:01 | |
| gordc | i'm hoping to expense a bed for the office... doable? | 22:01 |
| *** arosen has joined #openstack-keystone | 22:02 | |
| ayoung | so...overriding iteritems to fake I can be a dictionary does it....ok....makes sense, I think | 22:03 |
| arosen | Hi, I noticed that keystone no longer includes a tenantId in the body of the response for user-list | 22:03 |
| arosen | is this intended? This actually broke the integration I had with keystone as I was expecting this value to be returned :/ | 22:03 |
| morganfainberg | arosen. why would user-list have a tenantid? | 22:03 |
| ayoung | arosen, you fell victem to one of the two classic blunders | 22:03 |
| arosen | morganfainberg: it did in havana | 22:03 |
| stevemar | arosen, maybe it has tenant_id now? | 22:03 |
| ayoung | the first is "never get involved in a land war in Asia" | 22:04 |
| morganfainberg | arosen, in v2? or v3? | 22:04 |
| *** afazekas has joined #openstack-keystone | 22:04 | |
| arosen | v2 | 22:04 |
| morganfainberg | arosen, oh v2 | 22:04 |
| morganfainberg | hm. | 22:04 |
| ayoung | but only slightly lesser known is "don't expect there to be a tenantid associated with a user object" | 22:04 |
| ayoung | HAHAHAHAH | 22:04 |
| * ayoung dies | 22:04 | |
| morganfainberg | again... besides "it was there in havana" why would user-list have a tenantid? | 22:04 |
| ayoung | arosen, LDAP? | 22:04 |
| morganfainberg | ayoung, yeah thats my confusion user object doesn't tie to a tenant | 22:05 |
| ayoung | morganfainberg, its the default tenant issue | 22:05 |
| morganfainberg | ayoung, oh gah | 22:05 |
| * morganfainberg glares menacingly at "default tenant" | 22:05 | |
| arosen | even in devstack | 22:06 |
| richm | default tenant is the fly in the ointment, the pain in the a$$, the monkey in the wrench | 22:06 |
| arosen | I noticed the congress test here started failing so I did this to fix it: | 22:06 |
| arosen | https://review.openstack.org/#/c/154196/ | 22:06 |
| *** oomichi has joined #openstack-keystone | 22:06 | |
| arosen | I'm pretty sure tenantId was being returned via the API before | 22:07 |
| ayoung | arosen, it depends, but there is no hard requirement that there be a tenant id for a user, so don't depend on it | 22:07 |
| arosen | anyways if it should be there i'm fine removing it just wanted to double check with you guys. | 22:07 |
| arosen | okay gotcha | 22:07 |
| arosen | thanks! | 22:07 |
| morganfainberg | it may or may not be there | 22:07 |
| ayoung | but, in devstack with SQL, I would expect there to be one, but it is not a hard requirement even there. | 22:07 |
| arosen | that's what i was looking for. | 22:07 |
| morganfainberg | arosen, what ayoung said | 22:08 |
| arosen | thanks! | 22:08 |
| ayoung | arosen, I just got tow pathces merged which should make this clearer | 22:08 |
| ayoung | they bascialyl amount to "always start with an unscoped token" and "only conver an unscoped token to a scoped tokne, never convert a scoped one | 22:08 |
| *** afazekas has quit IRC | 22:09 | |
| ayoung | jamielennox|away, is working on getting a default service catalog into unscoped tokens that will let us "list projects for user" uin a clean way | 22:09 |
| ayoung | so, while a user might be owned by a domain, the idea of default project is not something we are going to handle in the identity backend, since we are moving toward Identity being readonly | 22:10 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: StrictABC Implementation https://review.openstack.org/148354 | 22:13 |
| morganfainberg | ayoung, a quick +2 [easy] https://review.openstack.org/#/c/150970/ here | 22:13 |
| richm | stevemar: dtroyer: is there some flag or env. var. I can set to tell openstack "show me the full auth request and response and the token - don't redact anything" | 22:13 |
| morganfainberg | ayoung, LDAP assignment deprecation | 22:13 |
| stevemar | richm, --debug might help | 22:13 |
| morganfainberg | richm, the token data is likely sitll "redacted" | 22:14 |
| richm | stevemar: --debug shows everything except the auth request/response and the auth token | 22:14 |
| morganfainberg | for $reasons | 22:14 |
| richm | sure | 22:14 |
| stevemar | ohh the authN request, not the actual request | 22:14 |
| stevemar | blahh... i don't think we have anything for that | 22:14 |
| richm | the data that gets POSTed to /v3/auth/tokens, and the full response | 22:14 |
| *** abhirc has joined #openstack-keystone | 22:15 | |
| *** afazekas has joined #openstack-keystone | 22:15 | |
| ayoung | stevemar, so on the id/json reivew... | 22:15 |
| ayoung | the reason why the binaries need to be updated is they are generated from the JSON docs | 22:15 |
| ayoung | "not sure if you have to do anything to update .pem and .pkiz" | 22:16 |
| ayoung | he reran the example code generating script to incorporate the changes. stevemar lbragstad can I consider that as 2+2s from Core now? | 22:17 |
| stevemar | ayoung, oh okay, just wanted to make sure lbragstad re-ran the stuff he needed to | 22:17 |
| stevemar | ayoung, link me! i'll +2 again | 22:17 |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone-specs: HMAC signature based token https://review.openstack.org/153803 | 22:18 |
| ayoung | https://review.openstack.org/#/c/151761/ | 22:18 |
| ayoung | stevemar, just that I have a change that depends on that one, and it is easier if it is merged than having to keep rebasing | 22:19 |
| stevemar | ayoung, that's fine, did you get a chance to look at my other comment (re: abandoning a patch) | 22:19 |
| ayoung | stevemar, I need to refresh that one, and some other things, but not abandon | 22:20 |
| ayoung | since the current assumes it is PEM encoded, not DER, that other one might actually break things | 22:20 |
| ayoung | but...it really should be done that way | 22:20 |
| stevemar | okay, just saw that it was similar and wanted to call it out | 22:20 |
| *** afazekas has quit IRC | 22:23 | |
| ayoung | yeah...different issue. But...I think I want to drive on to getting rid of tokens all together. I think we can do it. | 22:23 |
| ayoung | I need to think through some corner cases | 22:23 |
| morganfainberg | atiwari, thanks for understanding my view on that spec. | 22:25 |
| atiwari | morganfainberg, thanks for raising that | 22:25 |
| atiwari | but now it is true non persistent | 22:25 |
| morganfainberg | atiwari, yeah it's not a bad idea, i just want to make sure we're not repeating the same issues we have today | 22:25 |
| morganfainberg | cool i'll take another look at it shortly. | 22:26 |
| atiwari | great thanks | 22:26 |
| atiwari | I am sure there are place to improve which I think we can do. | 22:28 |
| atiwari | ayoung, appreciate a review on HMAC signature based token please | 22:29 |
| *** gokrokve has quit IRC | 22:29 | |
| *** gokrokve has joined #openstack-keystone | 22:29 | |
| *** timcline has quit IRC | 22:34 | |
| *** timcline has joined #openstack-keystone | 22:35 | |
| *** thedodd has quit IRC | 22:36 | |
| *** timcline has quit IRC | 22:37 | |
| *** timcline has joined #openstack-keystone | 22:38 | |
| *** atiwari has quit IRC | 22:40 | |
| *** topol has quit IRC | 22:40 | |
| *** atiwari has joined #openstack-keystone | 22:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/154275 | 22:46 |
| *** atiwari has quit IRC | 22:46 | |
| *** marg7175_ has joined #openstack-keystone | 22:49 | |
| *** marg7175 has quit IRC | 22:49 | |
| *** gordc has quit IRC | 22:51 | |
| *** atiwari has joined #openstack-keystone | 22:52 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add data to example data https://review.openstack.org/151761 | 23:00 |
| *** jaosorior has quit IRC | 23:02 | |
| *** gordc has joined #openstack-keystone | 23:02 | |
| *** spandhe has quit IRC | 23:02 | |
| *** timcline has quit IRC | 23:03 | |
| *** jamielennox|away is now known as jamielennox | 23:05 | |
| *** diegows has joined #openstack-keystone | 23:10 | |
| jamielennox | morganfainberg: i can only guess with that middleware region_name bug that they must have multiple keystones in multiple regions and they want to do things like validate against one in a specific region | 23:10 |
| *** thedodd has joined #openstack-keystone | 23:10 | |
| morganfainberg | hm. | 23:10 |
| morganfainberg | ok | 23:10 |
| *** thedodd has quit IRC | 23:10 | |
| jamielennox | morganfainberg: interesting but maybe | 23:10 |
| openstackgerrit | Bob Thyne proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 23:11 |
| *** spandhe has joined #openstack-keystone | 23:11 | |
| dolphm | lbragstad: tried to deploy your AE tokens change directly from gerrit and discovered that you need ansible 1.9 to do that (or just use raw commands in 1.8) ... 1.9 is still in dev :( | 23:14 |
| *** joesavak has quit IRC | 23:14 | |
| ayoung | morganfainberg, OK, so while I am all for Kerberos and X509, I can accept that they are too much infrastructure for some people. And since we don't want people passing passwords to Nova, glance, etc.... I gues the only way we could kill tokens (ye kill tokens) and still do remote auth ourselves is with some sort of home-baked PKI? Signed requests? | 23:15 |
| jamielennox | hey, this one is not super important but a really easy client review - given release is soon: https://review.openstack.org/#/c/143339/ | 23:15 |
| * jamielennox goosebumps | 23:15 | |
| bknudson | wasn't there just a release of keystoneclient? | 23:16 |
| ayoung | jamielennox, home-baked PKI? Yeah, me too. | 23:16 |
| morganfainberg | yes | 23:16 |
| ayoung | I just can't think of a way around it | 23:17 |
| jamielennox | bknudson: oh? morganfainberg's done it? | 23:17 |
| openstackgerrit | Merged openstack/keystone: Change oslo.serialization to oslo_serialization https://review.openstack.org/148025 | 23:17 |
| dolphm | bknudson: 1.1.0 was released today | 23:17 |
| morganfainberg | bknudson, i haven't sent the announcmeent email | 23:17 |
| ayoung | it would have to be like SSH: copy the public key up to keystone | 23:17 |
| ayoung | jamielennox, any others on the short list | 23:17 |
| bknudson | https://pypi.python.org/pypi/python-keystoneclient | 23:17 |
| morganfainberg | bknudson, yep 1.1.0 | 23:18 |
| morganfainberg | jamielennox, sorry! | 23:18 |
| bknudson | of course, nothing stopping morganfainberg from releasing again tomorrow or later today. | 23:18 |
| jamielennox | ok - there's this one left with a star on middleware: https://review.openstack.org/#/c/137268/ | 23:18 |
| jamielennox | morganfainberg: nah - mentioned it wasn't an important one | 23:18 |
| bknudson | have we decided that bugs, blueprints, and docs aren't required for middleware or client? | 23:19 |
| morganfainberg | bknudson, most of the ones i've been puyshing through have bugs attached | 23:20 |
| morganfainberg | bknudson, and yes we need bugs and bps | 23:20 |
| morganfainberg | jamielennox, ^ | 23:20 |
| morganfainberg | makes it *really* hard to write up release notes without them | 23:20 |
| jamielennox | bknudson: that one is deserving of a blueprint that's a bit longer running | 23:20 |
| bknudson | where does the README stuff on pypi come from? https://pypi.python.org/pypi/python-keystoneclient | 23:22 |
| openstackgerrit | Merged openstack/keystone: Change oslo.messaging to oslo_messaging https://review.openstack.org/148028 | 23:22 |
| bknudson | would be nice to update it for v3. | 23:22 |
| morganfainberg | bknudson, sphinx | 23:23 |
| morganfainberg | iirc | 23:23 |
| morganfainberg | oh | 23:23 |
| morganfainberg | wait | 23:23 |
| morganfainberg | setup.cfg | 23:23 |
| morganfainberg | erm. | 23:23 |
| morganfainberg | i think | 23:23 |
| morganfainberg | i also want to ditch: This code is a fork of Rackspace’s python-novaclient which is in turn a fork of Jacobian’s python-cloudservers. python-keystoneclient is licensed under the Apache License like the rest of OpenStack. | 23:23 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/154177 | 23:24 |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove custom string truth handling https://review.openstack.org/138220 | 23:24 |
| bknudson | ah, it just uses http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/README.rst | 23:24 |
| morganfainberg | aha so it does | 23:24 |
| bknudson | I'll put it on my list. | 23:25 |
| morganfainberg | bknudson, https://review.openstack.org/#/c/148029/ | 23:25 |
| morganfainberg | bknudson, rebase issue | 23:26 |
| morganfainberg | bknudson, the whole chain should be easy rebase/reapprove though | 23:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Turn our auth plugin into a token interface https://review.openstack.org/137268 | 23:26 |
| bknudson | https://review.openstack.org/#/c/148029/ got the bird! | 23:26 |
| bknudson | I hate that thing. | 23:26 |
| bknudson | will work on it when I get home. | 23:26 |
| morganfainberg | yep | 23:26 |
| morganfainberg | :( | 23:26 |
| jamielennox | ayoung, stevemar: added a blueprint to https://review.openstack.org/137268 can you reaffirm? | 23:27 |
| ayoung | Patch in Merge Conflict jamielennox | 23:27 |
| jamielennox | ... | 23:27 |
| *** EmilienM is now known as EmilienM|afk | 23:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Turn our auth plugin into a token interface https://review.openstack.org/137268 | 23:29 |
| jamielennox | ayoung: i think it's been in merge conflict for a while... | 23:29 |
| openstackgerrit | Merged openstack/keystonemiddleware: fallback to online validation if offline validation fails https://review.openstack.org/131036 | 23:31 |
| *** bknudson has quit IRC | 23:31 | |
| jamielennox | going to go MIA for a couple of hours, thanks for the reviews - middleware is cleaning up nicely | 23:34 |
| morganfainberg | jamielennox, so how important is the plugin one for the release today? | 23:35 |
| morganfainberg | jamielennox, as in... would it be awful to wait until march? | 23:35 |
| jamielennox | morganfainberg: I kind of want to push the approach ASAP and look at the oslo.context integration particularly - however it's not completely useful till i figure out how to serialize all this stuff | 23:36 |
| jamielennox | did you have a look at the bp? | 23:36 |
| morganfainberg | jamielennox, i have glanced at it | 23:36 |
| morganfainberg | jamielennox, i'm going to push this release as soon as the last couple things merge | 23:37 |
| morganfainberg | jamielennox, we can get this rolling in 2 weeks or so when march rolls around | 23:37 |
| morganfainberg | should be early enough to meet the agenda. | 23:37 |
| jamielennox | morganfainberg: ok - let's aim for start of march | 23:37 |
| morganfainberg | jamielennox, cool | 23:37 |
| jamielennox | morganfainberg: i want to look at putting the service token into oslo.policy - and this is the first step | 23:37 |
| morganfainberg | sounds good. | 23:37 |
| jamielennox | alright - gotta run for a bit | 23:38 |
| jamielennox | thanks | 23:38 |
| *** henrynash has quit IRC | 23:38 | |
| *** gordc has quit IRC | 23:40 | |
| ayoung | jamielennox, in KC tests, when I do a token validate, where does it get the body to stick with the UUID/hash of the PKI token? | 23:44 |
| ayoung | I think the data from the validate call is missing something, but I can't seem to find where it is set. | 23:45 |
| ayoung | {u'access': {u'token': {u'issued_at': u'2010-01-01T00:00:10.000123Z', u'expires': u'2020-01-01T00:00:10.000123Z', u'id': u'ba6fcfb2f7db58d0b902d7457e5894c5'}, u'user': {u'id': u'user_id1', u'roles': [{u'name': u'role1'}, {u'name': u'role2'}], u'name': u'user_name1', u'tenantName': u'tenant_name1', u'tenantId': u'tenant_id1'}}} | 23:47 |
| ayoung | jamielennox, token_info looks like ^^ | 23:48 |
| ayoung | there should be a deliberate tenant section under the token | 23:48 |
| *** dimsum__ has quit IRC | 23:54 | |
| *** dimsum__ has joined #openstack-keystone | 23:55 | |
| *** dimsum__ is now known as dims | 23:57 | |
| *** dims is now known as Guest70247 | 23:58 | |
| *** Guest70247 has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!