| *** samueldmq__ has joined #openstack-keystone | 00:02 | |
| *** abhirc has joined #openstack-keystone | 00:02 | |
| *** markvoelker has quit IRC | 00:03 | |
| *** atiwari has joined #openstack-keystone | 00:04 | |
| *** dims__ has joined #openstack-keystone | 00:04 | |
| *** samueldmq_ has quit IRC | 00:05 | |
| *** atiwari has quit IRC | 00:06 | |
| *** gordc has quit IRC | 00:07 | |
| *** afazekas has quit IRC | 00:16 | |
| *** amerine has quit IRC | 00:19 | |
| *** amerine has joined #openstack-keystone | 00:20 | |
| tqtran | stevemar: ping! | 00:26 |
|---|---|---|
| *** samueldmq__ has quit IRC | 00:26 | |
| *** r-daneel has joined #openstack-keystone | 00:28 | |
| *** abhirc has quit IRC | 00:29 | |
| *** richm has quit IRC | 00:30 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Get service catalog should also support Service providers https://review.openstack.org/155126 | 00:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Get service catalog should also support Service providers https://review.openstack.org/155126 | 00:32 |
| bknudson | speaking of k2k ^ | 00:34 |
| *** joesavak has quit IRC | 00:35 | |
| *** avozza is now known as zz_avozza | 00:39 | |
| *** erkules has quit IRC | 00:46 | |
| morganfainberg | bknudson, thnx | 00:50 |
| *** abhirc has joined #openstack-keystone | 00:51 | |
| *** nellysmitt has joined #openstack-keystone | 00:52 | |
| *** markvoelker has joined #openstack-keystone | 00:52 | |
| *** erkules has joined #openstack-keystone | 00:53 | |
| bknudson | I think horizon might want to use it... | 00:54 |
| *** atiwari has joined #openstack-keystone | 00:56 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update policy doc to use new rule format https://review.openstack.org/155136 | 00:56 |
| openstackgerrit | Merged openstack/keystone-specs: Get service catalog should also support Service providers https://review.openstack.org/155126 | 00:57 |
| *** nellysmitt has quit IRC | 00:57 | |
| *** markvoelker has quit IRC | 00:57 | |
| *** dims__ has quit IRC | 00:58 | |
| bknudson | are there 2 marekd s? | 00:58 |
| *** markvoelker has joined #openstack-keystone | 00:59 | |
| stevemar | bknudson, there is one marekd | 01:00 |
| stevemar | the original | 01:00 |
| bknudson | gerrit was showing 2... one had gmail address | 01:00 |
| *** davechen has joined #openstack-keystone | 01:00 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Correct rst https://review.openstack.org/155144 | 01:03 |
| *** markvoelker has quit IRC | 01:04 | |
| *** lnxnut has joined #openstack-keystone | 01:06 | |
| stevemar | bknudson, use the cern one | 01:09 |
| stevemar | lbragstad, has the same thing, except none of his emails worked at one point, gerrit hated him | 01:09 |
| bknudson | I hope we don't promote the wrong one to core. | 01:09 |
| stevemar | bknudson, you never know, we might get the evil marek | 01:10 |
| bknudson | he's probably working on his goatee right now. | 01:11 |
| stevemar | bknudson, could you look at https://review.openstack.org/#/c/152699/ when you have a minute, i want your opinion on changing LOG.warning(e) instances | 01:11 |
| stevemar | apparently oslo.log doesn't like it when you use LOG.warning(e) or LOG.whatever(e) | 01:11 |
| bknudson | what??? never! | 01:11 |
| stevemar | :O | 01:12 |
| bknudson | ... I think that was mentioned somewhere else... | 01:12 |
| bknudson | oh, yeah, dhellmann had a fix. | 01:12 |
| stevemar | i think the fix was to just do LOG.warning(msg, e) | 01:12 |
| bknudson | it's right here: https://review.openstack.org/#/c/153029/ | 01:12 |
| bknudson | LOG.warning(msg, e) isn't going to work. | 01:13 |
| bknudson | I think you can do LOG.warning(msg, include_exception=True) or something... | 01:13 |
| stevemar | yeah, i incorporated those changes (for the most part) into the patch i linked, since it won't build without it | 01:13 |
| bknudson | I'd rather the change to fix the LOG.warnings was in a separate commit. | 01:14 |
| bknudson | should also work with the old code. | 01:14 |
| stevemar | fair enough | 01:14 |
| stevemar | yeah | 01:14 |
| stevemar | bknudson, so just get message_format from the exception? | 01:15 |
| lbragstad | stevemar: yeah, hats of to fungi for fixing that for me | 01:15 |
| lbragstad | off* | 01:15 |
| bknudson | stevemar: I think the message_format is going to get logged anyways, so it doesn't have to be in the message. | 01:15 |
| bknudson | stevemar: doesn't dhellmann's change work? https://review.openstack.org/#/c/153029/1/keystone/auth/controllers.py | 01:16 |
| bknudson | oh, we don't want the whole stacktrace when the exception is logged... | 01:17 |
| stevemar | bknudson, it does, but boris had comments in my patch set about the messages not matching up | 01:17 |
| stevemar | yes, there is also that aspect | 01:17 |
| bknudson | stevemar: well, the logs were crap before so I don't think you need to fix that in this commit. | 01:18 |
| bknudson | just try not to make it worse. | 01:18 |
| stevemar | bknudson, lol | 01:18 |
| bknudson | I think you should take over dhellmann's change and get that working. | 01:19 |
| bknudson | this one: https://review.openstack.org/#/c/153029/ | 01:19 |
| bknudson | that one failed pretty hard for some reason. | 01:20 |
| stevemar | bknudson, didn't take all those changes in? | 01:20 |
| bknudson | stevemar: I don't know what that means. | 01:26 |
| ayoung | jamielennox, do we allow arbitrary attributes on endpoints? | 01:27 |
| stevemar | bknudson, i pulled in dhellmann's changes into the patch that i linked you, so i'm not sure what else i can do there | 01:27 |
| stevemar | unless i put them in a separate patch | 01:27 |
| bknudson | stevemar: there's no shame in having separate patches. | 01:28 |
| jamielennox | ayoung: in general we don't enforce stuff on the client | 01:29 |
| jamielennox | if there are attributes there they will be ignored | 01:29 |
| *** jay-lau-513 has quit IRC | 01:29 | |
| ayoung | jamielennox, but we allow it. I see ugly tests. Hideous test that allow random attributes | 01:29 |
| jamielennox | but we won't blow up if we get extra data we didn't expect because it may make sense to some people | 01:29 |
| jamielennox | and rax puts a whole lot of extra crap in its catalog | 01:29 |
| ayoung | /opt/stack/python-keystoneclient/keystoneclient/tests/v2_0/test_service_catalog.py(31)test_building_a_service_catalog() | 01:30 |
| *** tqtran is now known as tqtran_afk | 01:30 | |
| ayoung | COWBOYS! | 01:30 |
| jamielennox | ayoung: you should check out the rax catalog at some point, they solved the /v2.0 problem - they just put everything in there | 01:31 |
| *** atiwari has quit IRC | 01:31 | |
| ayoung | They are probably stringing extra wire just to handle the network traffic from token validation | 01:31 |
| ayoung | I don't like this. | 01:33 |
| jamielennox | ayoung: noone does | 01:34 |
| ayoung | They can put Javascript in there and call it an object broker | 01:34 |
| ayoung | jamielennox, well, obvious RAX does.... | 01:37 |
| jamielennox | i understand there point, nearly 2 years later and we still haven't got a good solution to moving people away from the /v2.0 endpoints | 01:37 |
| ayoung | dstanek, http://adam.younglogic.com/2015/02/debugging-openstack-with-rpdb/ | 01:38 |
| ayoung | jamielennox, I was tilting at the window a year ago, as you might recall | 01:38 |
| jamielennox | ayoung: oh i have one i was hoping you'd have a quick read over | 01:38 |
| jamielennox | ayoung: i still am | 01:38 |
| ayoung | jamielennox, sure | 01:38 |
| jamielennox | ayoung: doesn't render so nicely on this markup | 01:39 |
| jamielennox | https://github.com/jamielennox/jamielennox.github.io/blob/kerberos/source/_posts/2015-02-09-step-by-step-kerberized-keystone.markdown | 01:39 |
| ayoung | oooh.... | 01:39 |
| *** markvoelker has joined #openstack-keystone | 01:40 | |
| jamielennox | was going to clean it up and post later today | 01:40 |
| ayoung | TEST.JAMIELENNOX.NET needs to resolve...stick it in /etc/hosts | 01:40 |
| jamielennox | TEST.JAMIELENNOX.NET is a realm, but i know what you mean | 01:41 |
| jamielennox | i said somewhere there i did freeipa with bind, so if you set /etc/resolv.conf it works | 01:41 |
| ayoung | its the #1 thing that messes people up when they do a new install....all the Kerberos stuff depends on it | 01:41 |
| jamielennox | but ok, will make that clear | 01:41 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documetation for key terms and basic authenticating https://review.openstack.org/152018 | 01:42 |
| ayoung | Gah, I hate the 5000/35357 thing | 01:42 |
| ayoung | can we skip the "convert Keystone to LDAP" and go right to multiple backends, or do we still have stuff that blocks it? | 01:43 |
| morganfainberg | hmm? | 01:43 |
| morganfainberg | what would block multiple backends? | 01:43 |
| jamielennox | i don't know, so my intention was to be as close to an original packstack deployment as possible | 01:43 |
| *** atiwari has joined #openstack-keystone | 01:43 | |
| morganfainberg | jamielennox, i'm expecting to release -kerberos on friday. | 01:44 |
| morganfainberg | jamielennox, sorry for the delay | 01:44 |
| jamielennox | i figured i'd write another one later with how to do multiple domains because i've been walking ccard through it a bit over the last few days | 01:44 |
| jamielennox | morganfainberg: great - that's fine | 01:44 |
| ayoung | jamielennox, you missed something in the thanks block, too... | 01:44 |
| jamielennox | ayoung: figured i'd try and explain just the kerberos changes here - but i understand dealing with the LDAP change over made a mess of what should have been easy | 01:44 |
| jamielennox | ayoung: i'll add you in | 01:44 |
| dstanek | ayoung: nice | 01:44 |
| ayoung | :) | 01:44 |
| ayoung | dstanek, what do you use for vim? | 01:45 |
| jamielennox | ayoung: by the time i got to the end i was pretty done and just throwing stuff at it | 01:45 |
| dstanek | ayoung: vimpdb sometimes, but i usually don't use a debugger - if i see and issue i'll write a test to debug | 01:45 |
| ayoung | jamielennox, I need to do the multi-dom setup myself. I hagve an internal server set up, but I dfidn't get that far...and got bogged down in this access_info thing | 01:46 |
| jamielennox | multi domain for this is easier than not, but i need to write up a bunch of stuff like service users domain before i get to that | 01:46 |
| ayoung | dstanek, that is probably why your code is so much better than mine | 01:46 |
| *** r-daneel has quit IRC | 01:46 | |
| morganfainberg | atiwari, some more comments in line - your spec and the AE Tokens spec are looking very similar, slightly different takes on it | 01:46 |
| morganfainberg | atiwari, i could see either one being a viable option provided we address the issues outstanding in them. | 01:47 |
| dstanek | ayoung: flattery will get you nowhere | 01:47 |
| jamielennox | ayoung: also i think i've cracked horizon/DOA | 01:47 |
| morganfainberg | dstanek, but beer will get us somewhere? | 01:47 |
| ayoung | dstanek, actually, I think that would be considered "Damned by faint praise" | 01:47 |
| ayoung | jamielennox, good cracked or bad cracked? | 01:47 |
| dstanek | morganfainberg: always | 01:47 |
| jamielennox | ayoung: figured out kerberos and receiving a token from somewhere else | 01:48 |
| ayoung | ++ | 01:48 |
| ayoung | jamielennox, oh, I had those cgi and wsgi apps for you to help you along...but you should be able to figure out how to hack those fairly easily | 01:48 |
| *** _cjones_ has quit IRC | 01:48 | |
| jamielennox | yea, i've got a litter of helper scripts to figure out s4u2 stuff | 01:48 |
| ayoung | I might have destroyed them, now that I think about it...it was on that internal cloud we had that go decomissioned | 01:49 |
| jamielennox | had to dust of the php skills | 01:49 |
| morganfainberg | jamielennox, no don't do that | 01:49 |
| ayoung | Um...you cando SGI in python | 01:49 |
| bknudson | yikes! | 01:49 |
| morganfainberg | jamielennox, you'll just be opening old wounds | 01:49 |
| bknudson | there's no such thing as php skills. | 01:49 |
| ayoung | CGI, too | 01:49 |
| morganfainberg | bknudson, ++ | 01:49 |
| stevemar | fact: bknudson lists php as his top skill in his resume | 01:50 |
| jamielennox | yea, but its hard to beat a <?php phpinfo(); ?> in an index.php for doing a confirmation that it worked and dumping env variables | 01:50 |
| ayoung | I thought php was illegal in Australia | 01:50 |
| bknudson | both wsgi and cgi are a mistake. | 01:50 |
| morganfainberg | ayoung, no thats NZ, in aus it's a grey area i hear | 01:50 |
| bknudson | why translate http? just forward it. | 01:50 |
| morganfainberg | :P | 01:50 |
| ayoung | bknudson, wsgi is a mistake? Why do you say that? | 01:50 |
| bknudson | there's no need to translate http since it can be forwarded. | 01:50 |
| ayoung | Um...I think, I'm missing something in your logic | 01:51 |
| morganfainberg | stevemar, but if you really want to make people cringe, use mod_php (cc jamielennox ) instead of the cgi/cgi-like modes | 01:52 |
| ayoung | jamielennox, I really just started with googleing Hello World WSGI and used that for the S4U2 test. | 01:52 |
| jamielennox | morganfainberg: i'd never deploy it... i'm not insane | 01:52 |
| morganfainberg | ayoung, i *think* he's saying wsgi is superfluous as an abstraction from HTTP since HTTP could just be read directly... i think. | 01:52 |
| ayoung | Actually, I did an Shell version that used CURL first | 01:52 |
| morganfainberg | ayoung, or he's being sarcastic... i can't tell atm | 01:52 |
| dstanek | so if oslo.log is being used we can still use stdlib logging from most modules right? | 01:53 |
| morganfainberg | bknudson ;) | 01:53 |
| jamielennox | ayoung: me to, i ended up with curl in a shell script that called the phpinfo() from the target | 01:53 |
| ayoung | jamielennox, anyway, I really like the article | 01:53 |
| morganfainberg | dstanek, afaik yes *except* if there is some wacky formatter thing that is abstracted out | 01:53 |
| bknudson | yes, wsgi is essentially just http, so why go through the work of converting one to the other? | 01:53 |
| jamielennox | am going to write that one up too | 01:53 |
| morganfainberg | dstanek, that isn't applied to the base / root logger itself | 01:53 |
| bknudson | just run a "web server" and if you need it in apache set up what it calls "reverse proxy" | 01:53 |
| bknudson | although it's really just passing http through. | 01:54 |
| ayoung | I think I did direct sql do do what you did more cleanly with the ipa user-add code...but I was hacking the DB to change the serfice catalog anyway | 01:54 |
| morganfainberg | bknudson, not sure which is lower overhead tbh, HTTP or HTTP <-> wsgi | 01:54 |
| dstanek | morganfainberg: that's what i thought. should we using logging in our code then as much as possible? | 01:54 |
| bknudson | is the problem overhead? | 01:54 |
| morganfainberg | bknudson, but i could see reverse proxy being a clear alternative | 01:54 |
| ayoung | bknudson, envvars | 01:54 |
| *** TheJulia has quit IRC | 01:54 | |
| bknudson | the nice thing is now you've got apache serving static pages which it's good at | 01:55 |
| morganfainberg | dstanek, i'd ping dhellmann, but if we could do that i'd be happier | 01:55 |
| bknudson | and your web server that's doing dynamic pages which it's good at. | 01:55 |
| jamielennox | ayoung: https://review.openstack.org/#/c/153910/ | 01:55 |
| morganfainberg | dstanek, if we really used oslo as *only* the way to configure the loggers | 01:55 |
| morganfainberg | dstanek, that'd be cool | 01:55 |
| ayoung | jamielennox, you just made me very very happy | 01:55 |
| morganfainberg | bknudson, pretty much the entire model nginx works on in principle | 01:56 |
| ayoung | jamielennox, you using stevedore in that? | 01:56 |
| jamielennox | ayoung: long way off done | 01:56 |
| jamielennox | ayoung: no, just catching ImportError | 01:56 |
| ayoung | I had the stevedore code in my patch. | 01:56 |
| jamielennox | i don't think stevedore is a win when you are writing actual code, you already know what you want | 01:57 |
| morganfainberg | dstanek, i want to say there is some more magic in oslo.log than that, but my brain feels fried | 01:57 |
| jamielennox | stevedore is good for getting names from config files and command line params | 01:57 |
| bknudson | I used this in a previous project (C++-based) , rather than try fastcgi (for example), I was like -- why not just write HTTP to begin with? | 01:57 |
| ayoung | jamielennox, I suspect, though, that we are headed that way, esp with federation | 01:57 |
| dstanek | morganfainberg: the only thing i can see is that using its getLogger you can use the keyword adapter to add extra context | 01:57 |
| morganfainberg | dstanek, ah. | 01:57 |
| morganfainberg | dstanek, interesting | 01:58 |
| *** samueldmq_ has joined #openstack-keystone | 01:58 | |
| jamielennox | ayoung: yea, i don't know - for horizon i think they are always going to keep a fairly tightly restricted set of protocols you can auth with | 01:58 |
| morganfainberg | dstanek, if we don't need that and there isn't a compelling reason to proxy the calls through oslo.log, i do like being tied to the core logger and use oslo as the config layer | 01:58 |
| jamielennox | ayoung: i think they'll accept more but it'll be a curated list somehow | 01:58 |
| jamielennox | though - it'd be cool if we could host the horizon kerberos requirements in keystoneclient-kerberos | 01:59 |
| dstanek | morganfainberg: i think that's ok to do and what i was hoping. i'll ask doug | 01:59 |
| ayoung | jamielennox, fair enough....this looks good, though...less intrusive than mine | 01:59 |
| dstanek | morganfainberg: http://docs.openstack.org/developer/oslo.log/usage.html | 01:59 |
| ayoung | if not request.is_ajax() ? | 01:59 |
| jamielennox | i have nfi | 01:59 |
| morganfainberg | dstanek, it looks sane, and it would def. be nicer (and easier in some regards) | 01:59 |
| morganfainberg | dstanek, though how will that work with the new .trace() level logging being proposed in the x-project spec | 02:00 |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Deprecate keystone CLI https://review.openstack.org/155159 | 02:00 |
| morganfainberg | dstanek, afaik adding a new log level doesn't automatically create the equiv .<level>() named method, just allows you to use .log(<level>, <msg>) | 02:00 |
| morganfainberg | dstanek, and i know that isn't actually how it's called, but it conveys the poinrt | 02:00 |
| ayoung | jamielennox, well, if it works at all, it means we have something once again we can demo, and that is a big win | 02:01 |
| ayoung | thank you very much | 02:01 |
| dstanek | morganfainberg: i think we would have to create a method, so that would suck | 02:01 |
| morganfainberg | dstanek, yeah | 02:01 |
| morganfainberg | dstanek, which case oslo.log would be a clear winner | 02:01 |
| morganfainberg | unless oslo.log did some wacky monkey-patching | 02:02 |
| jamielennox | ayoung: it's funny - because it's a really boring demo | 02:02 |
| ayoung | jamielennox, so...with the approach of putting the service catalog in the unscoped token, does it clean up that HACK message in your code? | 02:02 |
| *** samueldmq has quit IRC | 02:02 | |
| bknudson | oslo.log already adds log.deprecated(), I think. | 02:02 |
| *** samueldmq_ is now known as samueldmq | 02:02 | |
| ayoung | also...the unscoped->scoped only changes are now in Keystone server | 02:02 |
| morganfainberg | ayoung, which makes me happy to see | 02:02 |
| jamielennox | ayoung: i saw that | 02:03 |
| *** r-daneel has joined #openstack-keystone | 02:03 | |
| ayoung | jamielennox, it is a boring standalone demo, but together with setting up an IPA server and doing all the Kerberos stuff, it is pretty fun to show | 02:03 |
| jamielennox | ayoung: it cleans up the hack at line 172 | 02:03 |
| jamielennox | because you need to make the /projects request at a url that doesn't have /krb | 02:04 |
| jamielennox | i think the line 85 hack will have to be a config option | 02:04 |
| ayoung | Actually, I don't think you need that. You can kerberos protect only the /krb/auth/tokens | 02:05 |
| jamielennox | ayoung: right | 02:05 |
| jamielennox | that would work | 02:05 |
| ayoung | sub urk abnd leave all the projects ones etc as is | 02:05 |
| ayoung | but in general, I think what you have there makes sense | 02:05 |
| dstanek | bknudson: is there a such thing as log.deprecated()? | 02:05 |
| jamielennox | ayoung: i'm not sure how to get there yet- but i want to make kerberos a federation plugin | 02:06 |
| dstanek | morganfainberg: where is that spec documented? | 02:06 |
| jamielennox | ayoung: as in /OS-FEDERATION/provider/ipa/protocol/kerberos/auth/token | 02:06 |
| morganfainberg | dstanek, openstack/openstack-specs in gerrit | 02:06 |
| ayoung | yeah | 02:06 |
| morganfainberg | dstanek, sec | 02:06 |
| morganfainberg | https://review.openstack.org/#/c/145245/ | 02:07 |
| ayoung | But the CERN approach doesn't even need that.... | 02:07 |
| ayoung | still, it should be possible. | 02:07 |
| jamielennox | ayoung: it doesn't need it, but i think we should standize on just one way that we link in all these external auth mechanisms | 02:07 |
| *** zzzeek has quit IRC | 02:08 | |
| jamielennox | because if you kerberize /auth/token then you can't have non-kerberized login there | 02:08 |
| ayoung | jamielennox, that was the original thinking behind /auth/tokens....but we failed | 02:08 |
| ayoung | It really should be /auth/<protocol> | 02:08 |
| bknudson | dstanek: y, it's used in keystone ... http://git.openstack.org/cgit/openstack/keystone/tree/keystone/openstack/common/versionutils.py#n130 | 02:08 |
| ayoung | with the format being an HTTP accepts header value instead | 02:08 |
| jamielennox | yea, and i suggested /auth/projects which is now a pain if you kerberize /auth | 02:09 |
| jamielennox | but you're right i should change that to kerberize POST /auth/token | 02:09 |
| ayoung | service catalog in the unscoped token makes more sense anyway | 02:09 |
| ayoung | really splits auth url from the rest of Keystone, as it should | 02:09 |
| morganfainberg | ok i'm going to go get a drink with some openstack folks here in LA (whoa, they exist!) | 02:10 |
| jamielennox | did that get passed? i missed a cutoff but i don't think the spec was approved | 02:10 |
| ayoung | but...I want to remove tokens all together. Just Use Kerberos or X509 or SAML right to Nova | 02:10 |
| morganfainberg | catch you guys tomorrow / friday | 02:10 |
| ayoung | spec got approved at the mid cycle | 02:10 |
| jamielennox | morganfainberg: see ya | 02:10 |
| ayoung | morganfainberg, ^^ right? | 02:10 |
| dstanek | bknudson: hmm....as far as i know that's not in oslo.log | 02:10 |
| morganfainberg | ayoung huh which spec? | 02:10 |
| ayoung | morganfainberg, unscoped token has a sercvice catalog | 02:10 |
| morganfainberg | uhm.. i think we said yes but we needed to look at an API change | 02:11 |
| morganfainberg | something was off - like needing to explicitly say "give me a catalog" to not break people who use no-catalog as inference of unscoped tokens | 02:12 |
| morganfainberg | aka doing bad things | 02:12 |
| bknudson | dstanek: looks like they got rid of it... http://git.openstack.org/cgit/openstack/oslo-incubator/tree/openstack/common/versionutils.py | 02:12 |
| bknudson | the latest oslo-incubator versionutils doesn't use it. | 02:12 |
| bknudson | luckily stevemar did a sync... | 02:12 |
| bknudson | https://review.openstack.org/#/c/154780/ | 02:13 |
| stevemar | bknudson, thats why i'm here | 02:13 |
| ayoung | it must have passed cuz jamie has no spec reviews open at the moment | 02:13 |
| ayoung | jamielennox, https://review.openstack.org/#/c/107333/ | 02:14 |
| bknudson | stevemar: did you try regen the sample config file with that change? | 02:14 |
| jamielennox | ayoung: ok - will need to revive that patch | 02:15 |
| bknudson | I'm wondering if we lose "fatal_deprecations" ? | 02:15 |
| ayoung | Yeah, but its a step in the right direction | 02:15 |
| ayoung | Does github allow you to edit right in the browser? Could we really do collaborative editing in github? | 02:17 |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Deprecate keystone CLI https://review.openstack.org/155159 | 02:17 |
| *** MasterPiece has quit IRC | 02:19 | |
| ayoung | jamielennox, what would happen if I disallowed reading arbitrary values from the endpoints in the auth ref? | 02:23 |
| jamielennox | i don't know | 02:25 |
| stevemar | bknudson, oh you know what, i meant to try that today but i forgot | 02:25 |
| stevemar | i think need to add the the versionutils opts | 02:25 |
| *** atiwari has quit IRC | 02:26 | |
| *** atiwari has joined #openstack-keystone | 02:26 | |
| *** atiwari has quit IRC | 02:27 | |
| ayoung | jamielennox, I'm down to 20 failing tests...I'll punt on this one for now, but ugh | 02:27 |
| jamielennox | ayoung: i told you this one would be ugly :) | 02:27 |
| *** MasterPiece has joined #openstack-keystone | 02:28 | |
| ayoung | jamielennox, yes you did | 02:28 |
| ayoung | and I believed you | 02:28 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 02:29 |
| *** MasterPiece| has joined #openstack-keystone | 02:29 | |
| *** zzzeek has joined #openstack-keystone | 02:30 | |
| *** dims__ has joined #openstack-keystone | 02:32 | |
| *** MasterPiece has quit IRC | 02:33 | |
| *** erkules_ has joined #openstack-keystone | 02:36 | |
| *** davechen_ has joined #openstack-keystone | 02:37 | |
| *** erkules has quit IRC | 02:38 | |
| *** davechen has quit IRC | 02:40 | |
| *** zzzeek has quit IRC | 02:40 | |
| ayoung | failures=18 | 02:41 |
| *** jay-lau-513 has joined #openstack-keystone | 02:47 | |
| ayoung | jamielennox, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/v2_0/test_access.py#n185 does that test need to be carried over, or was it just debugging code? | 02:47 |
| jamielennox | ayoung: from memory it was an edge case that bit me when i was playing with this stuff | 02:48 |
| ayoung | Cuz that is basically reparsing data. | 02:48 |
| jamielennox | no, looks like if you set auth_token from the factory then it will be used instead of whatever comes from the token data | 02:49 |
| ayoung | its not terribly old | 02:49 |
| jamielennox | and if you delete the override it will fallback to the one from the body | 02:50 |
| ayoung | right, and that is what you want. Its just the delete part that is messing me up | 02:50 |
| stevemar | any takers on an oslo sync :D https://review.openstack.org/#/c/154780/ | 02:50 |
| jamielennox | this was dodgy because v3 doesn't have a token_id in the body so i had to be able to do the override | 02:50 |
| jamielennox | i can't remember why the del was important | 02:50 |
| ayoung | cuz I don't want to reparse it. Really, if you change the state of an existing auth_ref, what are you tryiung to do in the real world? | 02:50 |
| jamielennox | probably just meant that the old value wasn't lost | 02:50 |
| jamielennox | ayoung: i expect that was the point though | 02:51 |
| *** rodrigod` has joined #openstack-keystone | 02:51 | |
| ayoung | I'm going to comment that out. We can argue it out in the code review | 02:51 |
| jamielennox | if you'd done auth_ref['token']['id'] at that point you wouldn't get the overriden value | 02:51 |
| jamielennox | the override only exists via the property, it shouldn't be changing the token data | 02:51 |
| *** gyee has quit IRC | 02:52 | |
| *** bjornar has quit IRC | 02:52 | |
| *** rwsu has quit IRC | 02:52 | |
| *** rodrigods has quit IRC | 02:52 | |
| ayoung | failures=17 | 02:53 |
| *** nellysmitt has joined #openstack-keystone | 02:53 | |
| *** gyee has joined #openstack-keystone | 02:57 | |
| *** ChanServ sets mode: +v gyee | 02:57 | |
| *** rwsu has joined #openstack-keystone | 02:58 | |
| *** bjornar has joined #openstack-keystone | 02:58 | |
| *** david-lyle is now known as david-lyle_afk | 02:59 | |
| *** lhcheng has quit IRC | 03:00 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix error message on check on RoleV3 https://review.openstack.org/144702 | 03:01 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Check for invalid filtering on v3/role_assignments https://review.openstack.org/144703 | 03:01 |
| *** nellysmitt has quit IRC | 03:01 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignment Tests https://review.openstack.org/137021 | 03:02 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 03:02 |
| samueldmq | dstanek, gyee, henrynash, ^ thanks for your reviews, comments addressed | 03:02 |
| *** zzzeek has joined #openstack-keystone | 03:04 | |
| *** samueldmq has quit IRC | 03:16 | |
| *** zzzeek has quit IRC | 03:17 | |
| *** MasterPiece| has quit IRC | 03:21 | |
| *** richm has joined #openstack-keystone | 03:24 | |
| *** tqtran_afk has quit IRC | 03:28 | |
| *** EmilienM is now known as EmilienM|afk | 03:28 | |
| ayoung | failures=16 | 03:30 |
| *** dims__ has quit IRC | 03:37 | |
| ayoung | failures=15 | 03:37 |
| *** richm has quit IRC | 03:39 | |
| *** MasterPiece has joined #openstack-keystone | 03:51 | |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 03:54 |
| *** gyee has quit IRC | 04:00 | |
| ayoung | failures=14 | 04:03 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 04:05 |
| *** spandhe has quit IRC | 04:05 | |
| *** rushiagr_away is now known as rushiagr | 04:06 | |
| *** harlowja is now known as harlowja_away | 04:08 | |
| *** lhcheng has joined #openstack-keystone | 04:21 | |
| *** ayoung has quit IRC | 04:34 | |
| *** MasterPiece| has joined #openstack-keystone | 04:38 | |
| *** MasterPiece has quit IRC | 04:40 | |
| *** rushiagr is now known as rushiagr_away | 04:48 | |
| *** marg7175 has quit IRC | 04:52 | |
| *** r-daneel has quit IRC | 04:54 | |
| *** nellysmitt has joined #openstack-keystone | 04:58 | |
| *** abhirc has quit IRC | 04:59 | |
| *** nellysmitt has quit IRC | 05:03 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 05:03 |
| stevemar | anyone around? | 05:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 05:09 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 05:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubator version of log and local https://review.openstack.org/154783 | 05:14 |
| morganfainberg | stevemar maybe | 05:17 |
| stevemar | morganfainberg, maybe... eh | 05:17 |
| stevemar | morganfainberg, was hoping to get a +3 on my oslo sync patch :) | 05:18 |
| stevemar | i feel like i have to message people for reviews now | 05:18 |
| stevemar | like a poke | 05:18 |
| * stevemar doesn't like that he has to do that | 05:18 | |
| morganfainberg | stevemar, yeah been trying to get through as many reviews as possible | 05:19 |
| morganfainberg | but meeeeetings | 05:19 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documentation for key terms and basic authenticating https://review.openstack.org/152018 | 05:22 |
| *** henrynash has quit IRC | 05:23 | |
| *** henrynash has joined #openstack-keystone | 05:24 | |
| *** ChanServ sets mode: +v henrynash | 05:24 | |
| *** jdennis has quit IRC | 05:29 | |
| *** jay-lau-513 has quit IRC | 05:30 | |
| *** jdennis has joined #openstack-keystone | 05:32 | |
| jamielennox | is there a reason that the change_password rule on v3policy wouldn't have admin: | 05:44 |
| jamielennox | https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L101 | 05:44 |
| jamielennox | original policy does: https://github.com/openstack/keystone/blob/master/etc/policy.json#L46 | 05:45 |
| *** nellysmitt has joined #openstack-keystone | 05:50 | |
| *** MasterPiece| has quit IRC | 05:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: make federation part of keystone core https://review.openstack.org/153815 | 05:55 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Include other stable extensions in core https://review.openstack.org/153842 | 05:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 05:57 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Small cleanup of cloudsample policy https://review.openstack.org/155192 | 05:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/155194 | 06:04 |
| morganfainberg | jamielennox, how can a user change their own password if it requires admin? | 06:04 |
| jamielennox | morganfainberg: it's an or rule | 06:04 |
| jamielennox | it would allow an admin to change password on behalf of a user | 06:05 |
| morganfainberg | also typically an admin user would update_user not change_password | 06:05 |
| morganfainberg | since change_password requires the current password | 06:05 |
| morganfainberg | so unless admin knows the user password, change_password wont work for them | 06:05 |
| jamielennox | ah - so it does | 06:05 |
| jamielennox | hmm, ok so probably a tempest mistake | 06:06 |
| stevemar | there have definitely been fewer neutron failures in the gate lately | 06:16 |
| jamielennox | well - you went and jinxed that didn't you | 06:20 |
| stevemar | :D | 06:21 |
| stevemar | i just saw a failed job, and it came to mind | 06:22 |
| *** boris-42 has joined #openstack-keystone | 06:33 | |
| *** zz_avozza is now known as avozza | 06:34 | |
| *** dims__ has joined #openstack-keystone | 06:38 | |
| *** dims__ has quit IRC | 06:42 | |
| stevemar | morganfainberg, looks like https://jenkins02.openstack.org/ is ded | 06:43 |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 06:43 |
| morganfainberg | fun times! | 06:43 |
| stevemar | blah | 06:45 |
| stevemar | is there a time out? | 06:45 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 06:46 |
| morganfainberg | for a dead jenkins? | 06:46 |
| morganfainberg | probably not | 06:46 |
| stevemar | morganfainberg, just bumped my own change out of the gate queue | 06:46 |
| morganfainberg | yeah but otherthings (the heat change) is still throughy jenkins02 | 06:47 |
| morganfainberg | you're probably going to tneed to wait until tomorrow | 06:47 |
| morganfainberg | as is the #2 spot nova | 06:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 06:49 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 06:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubator version of log and local https://review.openstack.org/154783 | 06:51 |
| *** wanghong has quit IRC | 06:57 | |
| openstackgerrit | Merged openstack/keystone-specs: Correct rst https://review.openstack.org/155144 | 06:58 |
| *** nellysmitt has quit IRC | 07:04 | |
| *** afazekas has joined #openstack-keystone | 07:06 | |
| *** davechen_ has quit IRC | 07:07 | |
| *** davechen has joined #openstack-keystone | 07:08 | |
| *** swartulv has quit IRC | 07:12 | |
| *** swartulv has joined #openstack-keystone | 07:16 | |
| *** jacer_huawei has joined #openstack-keystone | 07:16 | |
| *** jacer_huawei is now known as wanghong | 07:16 | |
| *** nicodemos has quit IRC | 07:19 | |
| *** mathias__ has joined #openstack-keystone | 07:32 | |
| mathias__ | Am I getting it right: With PKI tokens I can prevent every service from talking back to keystone to verify the token? That would be nice in a globally distributed environment with a centralized keystone cluster. Am I seeing it correctly? | 07:33 |
| *** avozza is now known as zz_avozza | 07:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix a comment error in cms.py https://review.openstack.org/144867 | 07:36 |
| openstackgerrit | Merged openstack/python-keystoneclient: Move tests to the unit subdirectory https://review.openstack.org/154779 | 07:36 |
| wanghong | mathias__, I think you are wrong. With PKI tokens we also need talk to keystone to fetch revocation list. | 07:41 |
| mathias__ | wanghong: ah I lsee | 07:41 |
| openstackgerrit | wanghong proposed openstack/keystone: fix assertTableColumns https://review.openstack.org/155215 | 07:42 |
| mathias__ | so it is best to put Keystone into every region then | 07:42 |
| *** jaosorior has joined #openstack-keystone | 07:47 | |
| *** boris-42 has quit IRC | 07:49 | |
| *** boris-42 has joined #openstack-keystone | 07:49 | |
| *** afazekas has quit IRC | 07:49 | |
| *** afazekas has joined #openstack-keystone | 07:49 | |
| *** jaosorior has quit IRC | 07:49 | |
| *** jaosorior has joined #openstack-keystone | 07:49 | |
| marekd | bknudson: if you were asking about my lp account both are mine, but cern one is one i actually use. | 07:50 |
| breton | wanghong: that was a good one ;) | 07:59 |
| *** stevemar has quit IRC | 08:04 | |
| wanghong | breton, thanks | 08:12 |
| *** lsmola has joined #openstack-keystone | 08:12 | |
| jamielennox | mathias__: with PKI tokens you need to fetch a revocation list, but you fetch a reocation list maybe every 10 seconds per middleware so whilst you technically talk to keystone its very low impact | 08:13 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Enforce that some plugin options are required https://review.openstack.org/148784 | 08:16 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_communication_params interface to plugins https://review.openstack.org/141267 | 08:18 |
| *** karimb has joined #openstack-keystone | 08:18 | |
| *** lhcheng has quit IRC | 08:20 | |
| openstackgerrit | wanghong proposed openstack/keystone: fix assertTableColumns https://review.openstack.org/155215 | 08:20 |
| *** openstackgerrit has quit IRC | 08:21 | |
| *** openstackgerrit has joined #openstack-keystone | 08:21 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and session https://review.openstack.org/117089 | 08:31 |
| *** zz_avozza is now known as avozza | 08:41 | |
| *** chlong has quit IRC | 08:42 | |
| *** jistr|off is now known as jistr | 08:54 | |
| *** amerine has quit IRC | 08:58 | |
| *** wpf has quit IRC | 09:02 | |
| *** nellysmitt has joined #openstack-keystone | 09:05 | |
| *** mathias_1 has joined #openstack-keystone | 09:05 | |
| *** jistr has quit IRC | 09:08 | |
| *** mathias__ has quit IRC | 09:08 | |
| *** nellysmitt has quit IRC | 09:10 | |
| *** jistr has joined #openstack-keystone | 09:11 | |
| *** esmute has quit IRC | 09:14 | |
| *** esmute has joined #openstack-keystone | 09:16 | |
| *** mzbik has joined #openstack-keystone | 09:21 | |
| *** esmute has quit IRC | 09:23 | |
| *** esmute has joined #openstack-keystone | 09:24 | |
| *** mzbik_ has joined #openstack-keystone | 09:29 | |
| *** mzbik has quit IRC | 09:32 | |
| *** henrynash has quit IRC | 09:39 | |
| *** davechen_ has joined #openstack-keystone | 09:39 | |
| *** davechen has quit IRC | 09:41 | |
| openstackgerrit | Abhishek Talwar proposed openstack/python-keystoneclient: User-password-update accepts blank as password https://review.openstack.org/147399 | 09:41 |
| *** avozza is now known as zz_avozza | 10:02 | |
| *** henrynash has joined #openstack-keystone | 10:08 | |
| *** ChanServ sets mode: +v henrynash | 10:08 | |
| *** zz_avozza is now known as avozza | 10:21 | |
| *** samueldmq has joined #openstack-keystone | 10:29 | |
| samueldmq | morning | 10:29 |
| samueldmq | henrynash, ping - are we going to remove OS-INHERIT (extension mode) this cycle, right ? | 10:37 |
| henrynash | samueldmq: yes……that’s on my list to do | 10:37 |
| samueldmq | henrynash, nice! | 10:37 |
| henrynash | samueldmq: you will still be able to turn it off, via the config switch hwoever | 10:37 |
| henrynash | sameuldmq: but it will be part of core | 10:38 |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 10:38 |
| samueldmq | henrynash, so config.os_inherit will still exist? | 10:38 |
| samueldmq | henrynash, are we just moving the code around? | 10:38 |
| henrynash | samueldmq: yes, I think we’re just moving the code around for now.... | 10:39 |
| openstackgerrit | wanghong proposed openstack/keystone: remove the unused variables in indentity/core.py https://review.openstack.org/155247 | 10:47 |
| *** wanghong has quit IRC | 10:55 | |
| *** nellysmitt has joined #openstack-keystone | 11:06 | |
| *** nellysmitt has quit IRC | 11:10 | |
| *** dims__ has joined #openstack-keystone | 11:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Refactor filter and sensitivity tests in prepartion for LDAP support https://review.openstack.org/147551 | 11:16 |
| *** mathias__ has joined #openstack-keystone | 11:20 | |
| *** Tahmina has joined #openstack-keystone | 11:22 | |
| *** mathias_1 has quit IRC | 11:23 | |
| *** dobson has quit IRC | 11:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable filtering in LDAP backend for listing entities https://review.openstack.org/147612 | 11:27 |
| *** henrynash has quit IRC | 11:27 | |
| *** henrynash has joined #openstack-keystone | 11:28 | |
| *** ChanServ sets mode: +v henrynash | 11:28 | |
| *** henrynash has quit IRC | 11:29 | |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: No keystone Endpoint now gives a valid Error Message https://review.openstack.org/155260 | 11:34 |
| *** dobson has joined #openstack-keystone | 11:34 | |
| *** markvoelker has quit IRC | 11:34 | |
| openstackgerrit | Merged openstack/keystone: Sync with oslo-incubator https://review.openstack.org/154780 | 11:41 |
| ccard | david-lyle: I found this: https://ask.openstack.org/en/question/45872/icehouse-dashboard-problems-using-multi-domain-support/ | 11:42 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/155194 | 11:43 |
| ccard | david-lyle: I set auth_version=v3.0 instead of v3 and now I horizon is working for me when I login to a non-default domain | 11:43 |
| *** mathias_1 has joined #openstack-keystone | 11:46 | |
| *** rodrigod` is now known as rodrigods | 11:49 | |
| *** mathias__ has quit IRC | 11:49 | |
| *** mathias_1 has quit IRC | 11:50 | |
| *** mathias__ has joined #openstack-keystone | 11:51 | |
| *** mathias_1 has joined #openstack-keystone | 11:56 | |
| *** mathias__ has quit IRC | 11:57 | |
| *** aix has quit IRC | 12:01 | |
| *** MasterPiece has joined #openstack-keystone | 12:05 | |
| *** dmellado has joined #openstack-keystone | 12:07 | |
| *** MasterPiece has quit IRC | 12:12 | |
| *** pnavarro is now known as pnavarro|lunch | 12:20 | |
| *** karimb has quit IRC | 12:20 | |
| *** MasterPiece has joined #openstack-keystone | 12:22 | |
| openstackgerrit | Sergey Kraynev proposed openstack/python-keystoneclient: Using correct keyword for region in v3 https://review.openstack.org/118383 | 12:24 |
| *** henrynash has joined #openstack-keystone | 12:25 | |
| *** ChanServ sets mode: +v henrynash | 12:25 | |
| *** mathias__ has joined #openstack-keystone | 12:26 | |
| *** nellysmitt has joined #openstack-keystone | 12:27 | |
| *** mathias_1 has quit IRC | 12:30 | |
| *** markvoelker has joined #openstack-keystone | 12:35 | |
| *** tellesnobrega_ has joined #openstack-keystone | 12:36 | |
| *** dims_ has joined #openstack-keystone | 12:37 | |
| *** dims__ has quit IRC | 12:38 | |
| *** markvoelker has quit IRC | 12:40 | |
| *** amakarov_away is now known as amakarov | 12:46 | |
| *** Tahmina has quit IRC | 12:50 | |
| *** jacer_huawei has joined #openstack-keystone | 12:56 | |
| *** mzbik_ has quit IRC | 12:56 | |
| *** dims_ has quit IRC | 12:57 | |
| *** aix has joined #openstack-keystone | 12:57 | |
| *** tellesnobrega_ has quit IRC | 12:58 | |
| *** markvoelker has joined #openstack-keystone | 12:59 | |
| *** markvoelker has quit IRC | 13:05 | |
| *** dims__ has joined #openstack-keystone | 13:05 | |
| *** EmilienM|afk is now known as EmilienM | 13:11 | |
| *** samueldmq has quit IRC | 13:11 | |
| *** tellesnobrega has quit IRC | 13:11 | |
| *** htruta has quit IRC | 13:12 | |
| *** dims__ has quit IRC | 13:13 | |
| *** erkules_ is now known as erkules | 13:19 | |
| *** ljfisher has joined #openstack-keystone | 13:19 | |
| *** dims__ has joined #openstack-keystone | 13:19 | |
| *** henrynash has quit IRC | 13:21 | |
| *** henrynash has joined #openstack-keystone | 13:22 | |
| *** ChanServ sets mode: +v henrynash | 13:22 | |
| *** henrynash has quit IRC | 13:27 | |
| *** henrynash has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v henrynash | 13:28 | |
| *** karimb has joined #openstack-keystone | 13:31 | |
| *** henrynash has quit IRC | 13:31 | |
| *** tellesnobrega has joined #openstack-keystone | 13:37 | |
| *** mzbik has joined #openstack-keystone | 13:45 | |
| *** radez_g0n3 is now known as radez | 13:48 | |
| *** mathias__ has quit IRC | 13:52 | |
| *** ljfisher has quit IRC | 13:54 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update policy doc to use new rule format https://review.openstack.org/155136 | 13:57 |
| *** avozza is now known as zz_avozza | 14:11 | |
| *** radez is now known as radez_g0n3 | 14:15 | |
| *** richm has joined #openstack-keystone | 14:17 | |
| *** krykowski has joined #openstack-keystone | 14:22 | |
| *** gordc has joined #openstack-keystone | 14:24 | |
| *** joesavak has joined #openstack-keystone | 14:24 | |
| *** david-lyle_afk is now known as david-lyle | 14:25 | |
| *** samueldmq has joined #openstack-keystone | 14:26 | |
| *** ctina has joined #openstack-keystone | 14:28 | |
| *** boris-42 has quit IRC | 14:32 | |
| *** r-daneel has joined #openstack-keystone | 14:36 | |
| *** samueldmq has quit IRC | 14:41 | |
| *** boris-42 has joined #openstack-keystone | 14:42 | |
| *** htruta has joined #openstack-keystone | 14:42 | |
| *** dmellado has left #openstack-keystone | 14:51 | |
| *** tellesnobrega has quit IRC | 14:51 | |
| *** tellesnobrega has joined #openstack-keystone | 14:54 | |
| *** tellesnobrega_ has joined #openstack-keystone | 14:54 | |
| *** topol has joined #openstack-keystone | 14:55 | |
| *** ChanServ sets mode: +v topol | 14:55 | |
| *** tellesnobrega_ has quit IRC | 14:55 | |
| *** ayoung has joined #openstack-keystone | 14:56 | |
| *** ChanServ sets mode: +v ayoung | 14:56 | |
| *** jasondotstar has quit IRC | 14:58 | |
| *** samueldmq has joined #openstack-keystone | 15:02 | |
| *** krykowski has quit IRC | 15:03 | |
| *** samueldmq has quit IRC | 15:07 | |
| *** zzzeek has joined #openstack-keystone | 15:13 | |
| *** ljfisher has joined #openstack-keystone | 15:14 | |
| *** dnalezyt has quit IRC | 15:14 | |
| *** stevemar has joined #openstack-keystone | 15:15 | |
| *** ChanServ sets mode: +v stevemar | 15:15 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Remove excess brackets in exception creation https://review.openstack.org/155351 | 15:24 |
| *** timcline has joined #openstack-keystone | 15:24 | |
| *** pnavarro|lunch is now known as pnavarro | 15:25 | |
| *** lnxnut_ has joined #openstack-keystone | 15:28 | |
| *** karimb has quit IRC | 15:28 | |
| *** lnxnut has quit IRC | 15:32 | |
| *** nellysmitt has quit IRC | 15:35 | |
| *** abhirc has joined #openstack-keystone | 15:37 | |
| *** lnxnut_ has quit IRC | 15:37 | |
| *** marg7175 has joined #openstack-keystone | 15:41 | |
| *** nellysmitt has joined #openstack-keystone | 15:43 | |
| *** nkinder has joined #openstack-keystone | 15:57 | |
| *** jaosorior has quit IRC | 16:01 | |
| *** lnxnut has joined #openstack-keystone | 16:07 | |
| *** lnxnut has quit IRC | 16:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 16:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubator version of log and local https://review.openstack.org/154783 | 16:14 |
| stevemar | breton == boris? or am i getting confused | 16:15 |
| *** amerine has joined #openstack-keystone | 16:26 | |
| openstackgerrit | Merged openstack/keystone: fix assertTableColumns https://review.openstack.org/155215 | 16:27 |
| amakarov | stevemar, yes, I was confused too :) | 16:29 |
| *** andreaf has quit IRC | 16:30 | |
| *** andreaf has joined #openstack-keystone | 16:31 | |
| stevemar | amakarov, i know who you are, but i don't know what 'Boris Bobrov' IRC name is :( | 16:31 |
| amakarov | stevemar, your guess is correct: breton - his nickname | 16:32 |
| *** zz_avozza is now known as avozza | 16:33 | |
| *** avozza is now known as zz_avozza | 16:35 | |
| stevemar | amakarov, excellent! says so here too: https://launchpad.net/~bbobrov :D | 16:35 |
| amakarov | stevemar, what a surprize! :D | 16:35 |
| stevemar | breton, so i don't know why we can't change the new KeywordsAdapter in oslo.log to change msgs to unicode | 16:36 |
| *** marg7175 has quit IRC | 16:37 | |
| stevemar | breton, maybe dhellmann can explain why, but i suspect its to have more consistent logging across projects, or go so we stop abusing it for logging exceptions like we do now | 16:37 |
| *** marg7175 has joined #openstack-keystone | 16:37 | |
| *** tellesnobrega_ has joined #openstack-keystone | 16:39 | |
| *** tellesnobrega_ has quit IRC | 16:39 | |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient: Remove ability to get global user roles. https://review.openstack.org/154238 | 16:43 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 16:44 |
| *** afazekas has quit IRC | 16:46 | |
| *** tellesnobrega_ has joined #openstack-keystone | 16:52 | |
| dstanek | stevemar: did you see my comment on that review? | 16:53 |
| lbragstad | david8hu: looks like you built the access stuff into the latest iteration? ^ | 16:54 |
| *** gyee has joined #openstack-keystone | 16:54 | |
| *** ChanServ sets mode: +v gyee | 16:54 | |
| *** lnxnut has joined #openstack-keystone | 16:54 | |
| lbragstad | gyee: had to rebase this one https://review.openstack.org/#/c/154238/ | 16:55 |
| *** dims__ has quit IRC | 16:56 | |
| *** dims__ has joined #openstack-keystone | 16:57 | |
| *** _cjones_ has joined #openstack-keystone | 17:04 | |
| gyee | lbragstad, ack | 17:05 |
| *** abhirc has quit IRC | 17:07 | |
| richm | stevemar: ping - question about openstack role list --user $userid --project $projname | 17:11 |
| richm | stevemar: My problem is that $projname is the name, not the id | 17:11 |
| richm | so openstack has to do a search GET /v3/projects?name=services | 17:11 |
| richm | however, I have two different domains each with a services project | 17:12 |
| richm | and openstack says "More than one project exists with the name 'services'" | 17:13 |
| stevemar | dstanek, i just saw it, how can i get the messages? e.message_whatever ? | 17:13 |
| stevemar | richm, ughhhhhh that domain scoped names has been the bane of OSC | 17:13 |
| bknudson | stevemar: _('%s'), e should do it | 17:14 |
| richm | yeah, it's becoming a pain for puppet-keystone v3 | 17:14 |
| stevemar | bknudson, i was thinking of six.text_type(e) | 17:15 |
| richm | stevemar: is there some way I can tell openstack role list to do GET /v3/projects?name=services&domain=mydomainname | 17:15 |
| stevemar | but yours will work too. | 17:15 |
| bknudson | stevemar: I think the problem is that the log call wanted a Message? | 17:16 |
| stevemar | bknudson, right now whatever is logged is pretty useless | 17:16 |
| stevemar | well, thats harsh, it's not helpful | 17:16 |
| dstanek | you don't need the _ because the message is already translated | 17:16 |
| bknudson | stevemar: what's logged is probably worse than not logging anything, but probably not going to try to fix all that here... | 17:17 |
| bknudson | let's just try to get through the transition to oslo.log | 17:17 |
| morganfainberg | richm, that would be the way i'd expect the API to work | 17:17 |
| morganfainberg | richm, if it doesn't it's a gap we should close | 17:17 |
| stevemar | bknudson, yeah, that's what i was trying to emphasize :) | 17:18 |
| bknudson | I've got a todo to try to get the logs to not be totally crappy but it's a lot of work. | 17:18 |
| morganfainberg | bknudson, totally not crappy logs? | 17:18 |
| morganfainberg | bknudson, blasphemy | 17:18 |
| dstanek | i actually think str(e) would work depending on how we build the message internally | 17:18 |
| morganfainberg | dstanek, str(e) only works if you don't have unicode values for sure | 17:19 |
| stevemar | bknudson, okay, i'll do as you suggested, just really want to eat my shawarma before it gets cold :D | 17:19 |
| morganfainberg | dstanek, if you're doing a %s | 17:19 |
| morganfainberg | subst | 17:19 |
| dstanek | morganfainberg: do our exceptions make unicode values? | 17:19 |
| morganfainberg | dstanek, they could | 17:19 |
| bknudson | yes, the exceptions can have unicode | 17:19 |
| dstanek | bknudson: but do we store it as bytes or unicode? str(e) will return the message that is being built already in the exception | 17:20 |
| bknudson | dstanek: that I don't know ... the contents of the message can come from the user if that helps... | 17:21 |
| bknudson | e.g., the contents of the message might come from the URL | 17:21 |
| bknudson | can also come from the database | 17:22 |
| bknudson | also, we've got the lazy translation so it might be a Message object that you're dealing with | 17:22 |
| dstanek | bknudson: that's probably a good thing because it deals with the unicode issues for us | 17:23 |
| morganfainberg | dstanek, ++ | 17:23 |
| *** tqtran_afk has joined #openstack-keystone | 17:23 | |
| *** tqtran_afk is now known as tqtran | 17:23 | |
| dstanek | this is the functionality that was removed: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/openstack/common/log.py#n318 | 17:25 |
| *** EmilienM is now known as EmilienM|afk | 17:25 | |
| morganfainberg | but that wouldn't solve unicode issues | 17:26 |
| *** jistr has quit IRC | 17:27 | |
| *** atiwari has joined #openstack-keystone | 17:28 | |
| dstanek | morganfainberg: but that's what's happening now that we have to replicate | 17:28 |
| *** lhcheng has joined #openstack-keystone | 17:31 | |
| richm | morganfainberg: stevemar: I'll open a bug if needed, but right now I'm just trying to figure out if there is a way to specify the domain for role list --project | 17:31 |
| dstanek | morganfainberg: for example: http://paste.openstack.org/show/172225/ | 17:32 |
| morganfainberg | dstanek, right | 17:33 |
| morganfainberg | richm, i'll defer to stevemar here, as i need to get on the road [have an appointment to get to] | 17:33 |
| stevemar | richm, it's probably a legit bug (sigh) | 17:35 |
| *** spandhe has joined #openstack-keystone | 17:43 | |
| stevemar | bknudson, still needs the _LE and _LW stuff, since it's doing variable substitution | 17:45 |
| richm | stevemar: https://bugs.launchpad.net/python-openstackclient/+bug/1421328 | 17:45 |
| openstack | Launchpad bug 1421328 in python-openstackclient "need to specify domain with role list" [Undecided,New] | 17:45 |
| *** nkinder is now known as nkinder_sick | 17:46 | |
| *** bknudson has quit IRC | 17:47 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 17:50 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 17:51 |
| dstanek | stevemar: why would you use _LE()? | 17:51 |
| dstanek | there isn't anything to translate | 17:52 |
| stevemar | dstanek, i think it's needed anytime you do string substitution http://docs.openstack.org/developer/oslo.i18n/guidelines.html#examples | 17:53 |
| dstanek | stevemar: only if it has to be translated | 17:53 |
| *** tellesnobrega_ has quit IRC | 17:53 | |
| *** david8hu has quit IRC | 17:54 | |
| dstanek | the _LE prioritizes translating '%s' over other things because it's logged at an error level - since there is no translation needed for %s it seems silly | 17:54 |
| dstanek | all the %s is doing in this case is acting similar to six.text_type() but not exactly the same since in python2 it returns a string and not a text type | 17:55 |
| stevemar | dstanek, so it should just be: LOG.warning('%s', e) | 17:56 |
| dstanek | the %s will break for unicode | 17:56 |
| stevemar | i'm going to do six.text_type(msg) then, that's what the old logger did | 17:56 |
| dstanek | stevemar: yes, i think you were right earlier when you said that. | 17:57 |
| stevemar | dstanek, i am starting to memorize the line numbers at this point ;P | 17:57 |
| dstanek | lol | 17:57 |
| morganfainberg | do we lose transifex/translation w/o the _LE() wrapper? | 17:58 |
| *** tellesnobrega_ has joined #openstack-keystone | 17:58 | |
| dstanek | morganfainberg: no, the translation is already happening in the Exception | 17:58 |
| morganfainberg | oh wait are we double stacking _() bits? | 17:59 |
| dstanek | the _LW will translate %s to %s | 17:59 |
| dstanek | _LW only works on literals and not generated strings | 17:59 |
| morganfainberg | oh gah | 17:59 |
| *** _cjones_ has quit IRC | 17:59 | |
| morganfainberg | i really should have let this one go instead of jumping in when about to grab laptop to head out :P | 17:59 |
| * morganfainberg 's brain hurts now | 18:00 | |
| *** aix has quit IRC | 18:00 | |
| stevemar | dstanek, seems like some of our hacking checks don't like it | 18:01 |
| stevemar | File "/opt/stack/keystone/keystone/hacking/checks.py", line 314, in visit_Call | 18:01 |
| stevemar | self._process_non_debug(node, method_name) | 18:01 |
| stevemar | File "/opt/stack/keystone/keystone/hacking/checks.py", line 338, in _process_non_debug | 18:01 |
| stevemar | func_name = msg.func.id | 18:01 |
| stevemar | oops | 18:01 |
| stevemar | pep8 still passes | 18:01 |
| dstanek | i wonder why the hacking check wouldn't like it | 18:02 |
| dstanek | maybe six.text_type is something stupid? | 18:02 |
| *** david8hu has joined #openstack-keystone | 18:02 | |
| *** lsmola has quit IRC | 18:04 | |
| dstanek | morganfainberg: good question for you https://review.openstack.org/#/c/154238/ | 18:08 |
| stevemar | dstanek, it's definitely checking the LOG calls there, >> Look for the 'LOG.*' calls. | 18:08 |
| * morganfainberg looks then goes to get to lunch meeting | 18:09 | |
| dstanek | morganfainberg: not critical | 18:09 |
| morganfainberg | oooh another "implementation" vs "documentation" question | 18:09 |
| dstanek | stevemar: actually did you update hacking to know about the new logger? | 18:10 |
| morganfainberg | i think this is a case where we explicitly design keystone to say "no global roles", we can probably fix the documentation here | 18:10 |
| stevemar | dstanek, i have never touched hacking, so no | 18:10 |
| morganfainberg | now... removing capability from ksc vs. getting a failure... | 18:11 |
| morganfainberg | that might be a harder bit to fix | 18:11 |
| *** mzbik has quit IRC | 18:12 | |
| stevemar | dstanek, i didn't think i would need to change it | 18:12 |
| dstanek | stevemar: it shouldn't check the lines using the new logger | 18:13 |
| *** bknudson has joined #openstack-keystone | 18:13 | |
| *** ChanServ sets mode: +v bknudson | 18:13 | |
| morganfainberg | dstanek, commented on that patch | 18:13 |
| morganfainberg | dstanek, the bigger concern is breaking people using that method in ksc by changing the signature | 18:14 |
| stevemar | dstanek, i'm still on the logging exceptions patch, i think you're a bit ahead | 18:14 |
| dstanek | stevemar: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/hacking/checks.py#n147 it looks for them by fully qualified module name | 18:14 |
| morganfainberg | even if we wont support the functionality in keystone | 18:14 |
| stevemar | dstanek, yeah, i'll need to do that in the 2nd patch of the chain, you're ahead :) | 18:14 |
| dstanek | stevemar: haha, ok | 18:14 |
| *** afazekas has joined #openstack-keystone | 18:17 | |
| *** _cjones_ has joined #openstack-keystone | 18:17 | |
| breton | yes, I am Boris Bobrov on gerrit :) | 18:20 |
| breton | stevemar: | 18:20 |
| stevemar | breton, good to know :D | 18:20 |
| breton | stevemar: I don't know why that coercion is gone either and would really love to hear dhellmann's opinion. Passing something coercable to text seems normal to me. | 18:20 |
| *** harlowja_away is now known as harlowja | 18:21 | |
| *** EmilienM|afk is now known as EmilienM | 18:22 | |
| *** MasterPiece has quit IRC | 18:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 18:23 |
| breton | in fact, I've seen the commit that does that | 18:23 |
| stevemar | dstanek, i gave up on trying to fix hacking ^ | 18:23 |
| stevemar | could you please look at it, since you wrote all of hacking :) | 18:24 |
| dstanek | stevemar: i can take a crack at it. | 18:24 |
| dstanek | is your change breaking or just trying to fix hacking breaking? | 18:24 |
| stevemar | dstanek, pep8 is still passing, but an exception comes up in the bg | 18:24 |
| dstanek | have you pushed? | 18:25 |
| stevemar | yep | 18:25 |
| stevemar | ^^^ | 18:25 |
| breton | so | 18:26 |
| dstanek | breton: what commit is that? | 18:26 |
| breton | the coercion was added here: https://review.openstack.org/#/c/112135/2/openstack/common/log.py | 18:26 |
| breton | in fact, all comments in https://blueprints.launchpad.net/oslo.log/+spec/remove-context-adapter are relevant | 18:27 |
| breton | *all commits | 18:28 |
| stevemar | breton, ahhh, 'third party code can't log with the same formatter' | 18:29 |
| stevemar | interesting | 18:30 |
| *** zz_avozza is now known as avozza | 18:30 | |
| *** tellesnobrega_ has quit IRC | 18:31 | |
| *** boris-42 has quit IRC | 18:32 | |
| dstanek | grrr... we should wait for dhellmann - hacking should break on this because it shouldn't be able to know the difference between this use an a bad one | 18:32 |
| dstanek | stevemar: ^ | 18:32 |
| * dhellmann perks up his ears | 18:33 | |
| dstanek | the hacking option would be to LOG.error(e.as_string()) or something like that | 18:33 |
| dstanek | hey dhellmann - we're discussing the safe exception change for oslo.log | 18:33 |
| dstanek | this guy - https://review.openstack.org/153029 | 18:34 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: AE Tokens https://review.openstack.org/145317 | 18:34 |
| dhellmann | dstanek: yeah | 18:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documentation for key terms and basic authenticating https://review.openstack.org/152018 | 18:34 |
| dstanek | dhellmann: the question breton brought up is why did the coercion go away? | 18:35 |
| dhellmann | so the thing that triggers that error is you have an Exception() containing a _Message() and when you do str(e) it ends up doing str(e.message) which is not allowed because it bypasses translation | 18:35 |
| stevemar | dstanek, reason for coersion removal is here https://blueprints.launchpad.net/oslo.log/+spec/remove-context-adapter | 18:35 |
| *** tellesnobrega_ has joined #openstack-keystone | 18:35 | |
| dhellmann | right, the coersion used to be done in the context adapter, but we're using a handler instead now so we don't catch the error | 18:36 |
| dhellmann | we used to call unicode(e) which is allowed | 18:36 |
| breton | stevemar: no, the coercion was added as a part of the bp :) | 18:36 |
| dstanek | dhellmann: that's what we changed the code to do 'six.text_type(e)', but that makes our hacking rules unhappy | 18:37 |
| dhellmann | so you could, theoretically, call unicode(e) yourself instead of inserting literal messages, but in some cases you were actually logging the same text twice (LOG.exception(e)) so I just put in some literals | 18:37 |
| breton | stevemar: have a look at second commit on the "whiteboard" | 18:37 |
| *** raildo has joined #openstack-keystone | 18:37 | |
| dhellmann | dstanek: I don't know why anything would be objecting to that. what's the rule? | 18:38 |
| breton | ok, maybe not added, but at least fixed. | 18:38 |
| dstanek | dhellmann: i wrote a custom rule to enforce translation | 18:39 |
| dstanek | dhellmann: we spent too much time commenting on logging issues so i added this: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/hacking/checks.py#n142 | 18:40 |
| dhellmann | dstanek: the problem is the stdlib is coercing to str() not unicode(), so you have to pass a unicode object of some sort to the function. Are you objecting to that, or are you just trying to understand the history? | 18:41 |
| dstanek | dhellmann: no, we were wondering why the functionality was being removed | 18:42 |
| dstanek | dhellmann: do you think calling 'LOG.error(six.text_type(e))' is a good solution for us since it just replicates the existing behavior? | 18:43 |
| *** abhirc has joined #openstack-keystone | 18:43 | |
| dhellmann | the thing that was doing the coercion sat at a different point in the logging stack. the blueprint stevemar linked above should have the details of why we removed it, but the tl;dr is with a handler instead of an adapter we're able to log context information when third-party libs log and our libs don't have to rely on using oslo.log.getLogger() | 18:43 |
| *** avozza is now known as zz_avozza | 18:44 | |
| *** zz_avozza is now known as avozza | 18:44 | |
| *** abhirc has quit IRC | 18:44 | |
| dhellmann | dstanek: I guess it's a reasonable alternative, but you're logging errors that might not include enough information about what is failing, which is why I thought adding literal messages was better. It's up to you all, though. | 18:45 |
| dstanek | dhellmann: our exceptions have messages in them that are very similar to what you added - so we'd be maintaining that info twice | 18:46 |
| dhellmann | for example, I think some of those could be triggered by KeyError or TypeError exceptions, and those wouldn't say what was failing just that something was wrong | 18:46 |
| *** samueldmq has joined #openstack-keystone | 18:47 | |
| dhellmann | dstanek: ok, that's fine -- if you're confident that you're logging enough info, you don't need the literals | 18:47 |
| dhellmann | that wasn't clear to me, so I erred on the side of adding information | 18:47 |
| *** abhirc has joined #openstack-keystone | 18:47 | |
| dstanek | dhellmann: there is one file, wsgi.py, that catches non-Keystone exceptions explicitly that we should really look at | 18:48 |
| dhellmann | ok | 18:49 |
| *** MasterPiece has joined #openstack-keystone | 18:49 | |
| dstanek | so now i have to figure out how to fix this hacking rule | 18:49 |
| dhellmann | dstanek: you should feel free to either take over that patch or write a new one -- if you do the latter and want to abandon mine, that's fine. | 18:50 |
| dstanek | dhellmann: stevemar's been updating yours, so i think we'll stick with it - i don't see any reason to change that | 18:50 |
| dhellmann | dstanek: ok, cool, I hadn't noticed that | 18:50 |
| dhellmann | stevemar: thanks :-) | 18:51 |
| dstanek | ok, late lunch time! | 18:51 |
| stevemar | dhellmann, np, was hoping you didn't mind :) | 18:51 |
| samueldmq | gyee, I replied your comments on the list role assignments chain, thanks | 18:52 |
| *** abhirc has quit IRC | 18:53 | |
| *** avozza is now known as zz_avozza | 18:59 | |
| *** _cjones_ has quit IRC | 19:00 | |
| gyee | samueldmq, k, I'll take a look later in the afternoon, got a meeting to attend | 19:01 |
| amakarov | stevemar, I have a fix for revocation https://review.openstack.org/#/c/141854/ Can you please look at it? You've already commented there... last year :) | 19:03 |
| *** _cjones_ has joined #openstack-keystone | 19:03 | |
| stevemar | last yer | 19:03 |
| stevemar | yeesh | 19:03 |
| *** utahcon has joined #openstack-keystone | 19:03 | |
| amakarov | stevemar, it's incorrect to say "a year ago" )) | 19:04 |
| *** thedodd has joined #openstack-keystone | 19:06 | |
| utahcon | I am having trouble with tokens and keystone http://fpaste.org/184876/37680061/ | 19:06 |
| utahcon | I generate a token with user/pass, but then get a bad request when I try to get a session based on that token | 19:07 |
| utahcon | v2.Token() seems to work just fine... not sure what I am doing wrong. | 19:07 |
| amakarov | utahcon, what's the origin of provider['OS_TOKEN_ID'] ? | 19:09 |
| utahcon | amakarov: if you look at my paste, line 4... it is just the string id | 19:10 |
| utahcon | I have triple checked that is waht I am passing | 19:10 |
| amakarov | are you sure that token there is valid? I don't see where is provider initialized? | 19:11 |
| amakarov | utahcon, provider['OS_TOKEN_ID'] from line 8 == token from line 4? | 19:12 |
| utahcon | yes | 19:13 |
| utahcon | sorry these are two different pieces of code shown in one paste | 19:14 |
| amakarov | utahcon, do you have some script to toy with? | 19:18 |
| *** abhirc has joined #openstack-keystone | 19:18 | |
| utahcon | pardon? | 19:19 |
| amakarov | I'd like to try your code and I need imports at least | 19:20 |
| amakarov | To be sure | 19:20 |
| amakarov | I can guess what is v2 and session in your example... | 19:23 |
| lbragstad | dstanek: do you happen to know where these are generated from ? http://developer.openstack.org/api-ref-identity-v2.html#detail-d486e3034 | 19:23 |
| utahcon | amakarov: from keystoneclient.auth.identity import v2 | 19:24 |
| utahcon | from keystoneclient import session | 19:24 |
| amakarov | utahcon, ok, thanks | 19:24 |
| utahcon | well, ok, it isn't failing on session now ... wtf | 19:26 |
| utahcon | if that all worked, I should just pass the session to nova client, and it would work right? | 19:26 |
| amakarov | utahcon, I'm not yet an expert in Nova, sorry :) | 19:29 |
| utahcon | lol -- no worries | 19:29 |
| utahcon | at this point I am really confused. all worked a week back | 19:30 |
| utahcon | now... not so much | 19:30 |
| utahcon | like I hit a wall and lost it all | 19:30 |
| utahcon | I guess the root of my issues are... how do I know if v2.Token() worked, and if session.Session() worked? | 19:31 |
| utahcon | will they throw exceptions if they don't or fail quietly? | 19:31 |
| utahcon | because, now it is appearing to work, but I pass the session off to nova and get BadRequests... argh | 19:31 |
| amakarov | utahcon, https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/session.py#L384 | 19:34 |
| amakarov | It raises exception | 19:34 |
| utahcon | ok, that is great then | 19:34 |
| *** atiwari has quit IRC | 19:36 | |
| utahcon | thanks amakarov you have helped me to the next step then :D | 19:37 |
| amakarov | utahcon, good luck then! | 19:37 |
| *** ctina has quit IRC | 19:38 | |
| *** atiwari has joined #openstack-keystone | 19:39 | |
| *** lnxnut has quit IRC | 19:47 | |
| *** dims__ has quit IRC | 19:48 | |
| *** amakarov is now known as amakarov_away | 19:49 | |
| *** dims__ has joined #openstack-keystone | 19:50 | |
| *** _cjones_ has quit IRC | 19:52 | |
| *** zz_avozza is now known as avozza | 19:54 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 19:56 |
| *** jsavak has joined #openstack-keystone | 20:00 | |
| *** joesavak has quit IRC | 20:02 | |
| stevemar | dolphm, i hope AE tokens land and become default :) | 20:02 |
| stevemar | down with token tables | 20:02 |
| dolphm | stevemar: ++ | 20:03 |
| dolphm | stevemar: working on it :) | 20:03 |
| dolphm | stevemar: i'll let you know when they're ready for review | 20:04 |
| stevemar | dolphm, lookin forward to reviewing it | 20:05 |
| *** briancurtin has quit IRC | 20:07 | |
| *** henrynash has joined #openstack-keystone | 20:07 | |
| *** ChanServ sets mode: +v henrynash | 20:07 | |
| dolphm | lbragstad: have some sort of diff on switching from encryption to signing? | 20:07 |
| *** serverascode has quit IRC | 20:07 | |
| dolphm | lbragstad: or was that just in an interactive session or something | 20:07 |
| lbragstad | dolphm: set CONF.ae_tokens.use_encrption = False | 20:08 |
| lbragstad | and restart keystone | 20:08 |
| *** zhiyan has quit IRC | 20:08 | |
| dolphm | lbragstad: oh poo you pushed a patchset | 20:08 |
| *** ctracey has quit IRC | 20:08 | |
| dolphm | lbragstad: i just stomped on it | 20:09 |
| lbragstad | dolphm: were you working on it | 20:09 |
| *** jraim has quit IRC | 20:09 | |
| dolphm | lbragstad: non stop | 20:09 |
| dolphm | lbragstad: added ae_setup, key rotation, restored the default key dir to /etc/keystone/keys, and used ae setup in tests | 20:09 |
| lbragstad | dolphm: cool! | 20:10 |
| lbragstad | dolphm: so I need to pull down the latest patch set and reapply what I did | 20:10 |
| dolphm | lbragstad: well, it's my fault -- i'd be happy to do the merging | 20:11 |
| lbragstad | dolphm: there should be much conflict, | 20:11 |
| lbragstad | dolphm: I just added the signing case and test cases for it | 20:11 |
| dolphm | lbragstad: we both touched common.config | 20:11 |
| lbragstad | dolphm: the only thing I added was a config option for encryption | 20:12 |
| lbragstad | dolphm: which shouldn't break the ae_setup stuff by default becuase it is set to True | 20:12 |
| dolphm | lbragstad: have you already started merging? | 20:14 |
| lbragstad | dolphm: I was reading gyee comments | 20:14 |
| lbragstad | dolphm: working on it | 20:14 |
| dolphm | lbragstad: wait! | 20:14 |
| dolphm | lbragstad: i have a couple uncommitted changes i can include too, let me fix it | 20:14 |
| *** nellysmitt has quit IRC | 20:14 | |
| lbragstad | ok | 20:14 |
| *** jraim has joined #openstack-keystone | 20:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 20:16 |
| stevemar | dstanek, ^ | 20:16 |
| stevemar | that one should pass pep8 hacking check and tests | 20:16 |
| *** ctracey has joined #openstack-keystone | 20:16 | |
| *** _cjones_ has joined #openstack-keystone | 20:16 | |
| *** briancurtin has joined #openstack-keystone | 20:17 | |
| *** zhiyan has joined #openstack-keystone | 20:18 | |
| *** serverascode has joined #openstack-keystone | 20:19 | |
| *** gyee has quit IRC | 20:20 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 20:21 |
| *** abhirc has quit IRC | 20:24 | |
| henrynash | stevemar: on the log exception patch…what’s the change to hacking doing? | 20:26 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 20:29 |
| *** nellysmitt has joined #openstack-keystone | 20:35 | |
| stevemar | henrynash, i need dstanek to take a look at that, it was the only way i could get pep8 to not toss up an exception | 20:38 |
| stevemar | henrynash, i suspect it looks to see if LOG.warning(msg) has an equivalent id and name in the .po backend? | 20:39 |
| stevemar | but i could be wrong | 20:39 |
| dolphm | lbragstad: you removed L182-L186 ? https://review.openstack.org/#/c/145317/3..4/keystone/token/providers/ae/token_formatters.py | 20:39 |
| *** atiwari has quit IRC | 20:40 | |
| *** tellesnobrega_ has quit IRC | 20:41 | |
| lbragstad | dolphm: the init for StandardTokenFormmater? | 20:41 |
| *** markvoelker has joined #openstack-keystone | 20:41 | |
| *** atiwari has joined #openstack-keystone | 20:41 | |
| *** atiwari has quit IRC | 20:41 | |
| dolphm | lbragstad: L182 in the left file | 20:42 |
| lbragstad | dolphm: I moved it from the formatter to ae/core.py | 20:43 |
| lbragstad | https://review.openstack.org/#/c/145317/3..4/keystone/token/providers/ae/core.py | 20:43 |
| *** spandhe has quit IRC | 20:44 | |
| *** spandhe has joined #openstack-keystone | 20:45 | |
| *** topol has quit IRC | 20:46 | |
| ayoung | failures=13 | 20:47 |
| *** abhirc has joined #openstack-keystone | 20:47 | |
| ayoung | failures=12 | 20:50 |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: [do not merge] Test patch under load https://review.openstack.org/155477 | 20:51 |
| dolphm | lbragstad: stop uploading pep8 violations! | 20:51 |
| ayoung | dolphm, what makes use of the fact that the Service catalog can have arbitrary data associated with the endpoint? I see we have a client side test that checks that an endpoint can have additional attributes, and the example is tenantId | 20:51 |
| lbragstad | dolphm: oops | 20:52 |
| dolphm | ayoung: uhh, there was a concept of API version metadata being included as explicit attributes in the endpoint, but we never used that | 20:52 |
| dolphm | ayoung: unless you mean IN the endpoint URL itself? | 20:52 |
| ayoung | dolphm, no, it is an additional attribute | 20:52 |
| dolphm | ayoung: like, in the endpoint dict? | 20:53 |
| ayoung | yeah | 20:53 |
| dolphm | ayoung: i have no idea, that's weird. | 20:53 |
| ayoung | keystoneclient.tests.v2_0.test_service_catalog.ServiceCatalogTest.test_service_catalog_endpoints | 20:55 |
| ayoung | I'll link | 20:55 |
| ayoung | GAH! | 20:56 |
| ayoung | HE JUST MOVED ALL THE TESTS AND I"VE CHANGED HALF OF THEM! | 20:56 |
| lbragstad | ayoung: what are you working on? | 20:57 |
| ayoung | lbragstad, unified access info | 20:57 |
| lbragstad | ahhh | 20:57 |
| ayoung | lbragstad, yeah | 20:57 |
| ayoung | I'm down to failures=12 | 20:58 |
| ayoung | dolphm, http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/unit/v2_0/test_service_catalog.py#n38 | 20:59 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 21:00 |
| *** joesavak has joined #openstack-keystone | 21:01 | |
| *** jsavak has quit IRC | 21:04 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 21:06 |
| dolphm | lbragstad: so i wrote a test that just passes UUIDs to the AE token validator which has passed just fine (expecting Unauthorized)... | 21:09 |
| dolphm | lbragstad: but it just failed with a fun transient error, keyczar raised: BadVersionError: Received a bad version number: 225 | 21:09 |
| *** boris-42 has joined #openstack-keystone | 21:09 | |
| lbragstad | ok | 21:10 |
| lbragstad | dolphm: paste your test case? | 21:10 |
| dolphm | lbragstad: http://pasteraw.com/8sme1kaf4vt1i4p1a1weztqzvt8xd58 | 21:11 |
| dolphm | lbragstad: oh, it's failing consistently now | 21:13 |
| lbragstad | dolphm: https://review.openstack.org/#/c/145317/4/keystone/token/providers/ae/token_formatters.py see line 176 | 21:13 |
| dolphm | lbragstad: it's because it's bypassing where you moved the token format check to | 21:13 |
| lbragstad | nad 163 | 21:13 |
| lbragstad | yeah | 21:13 |
| dolphm | lbragstad: why does that not belong in the token formatter? | 21:14 |
| lbragstad | so, I was thinking it should be in the provider, which has a map of formatters | 21:14 |
| dolphm | lbragstad: ah, i see that now | 21:14 |
| lbragstad | the provider needs the format | 21:15 |
| lbragstad | in order to pass it to the formatter that knows how to deal with it | 21:15 |
| dolphm | lbragstad: so the test should run against the Provider? | 21:15 |
| lbragstad | yes, | 21:15 |
| lbragstad | I need to do that yet, | 21:15 |
| lbragstad | I'm trying to think of the best way to lay out the tests | 21:15 |
| lbragstad | so, testing the formatter should just verify the information in the formatters and validate that the formatters are doing what they are suppose to | 21:16 |
| lbragstad | but testing the provider should only really handle the mapping, | 21:16 |
| lbragstad | like, I have an AE00 token, that means I pass it to this guy | 21:16 |
| lbragstad | or validating that something without a matching token format should throw your "Unrecognized AE format" exception | 21:17 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 21:17 |
| dolphm | lbragstad: ^^ | 21:17 |
| lbragstad | dolphm: do I need to run ae_setup before running tests? | 21:19 |
| dolphm | lbragstad: no, the tests should always create a temp directory, configure it as the key directory, run ae_setup on it, and go | 21:19 |
| lbragstad | hmm | 21:19 |
| lbragstad | ok | 21:19 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Remove symlinked file from tests https://review.openstack.org/155485 | 21:19 |
| *** MasterPiece has quit IRC | 21:20 | |
| dolphm | lbragstad: expecting /etc/keystone to exist when the tests are running is a bad idea | 21:20 |
| lbragstad | dolphm: I just pulled it down and ran the tests, | 21:20 |
| dolphm | lbragstad: which ones? | 21:21 |
| lbragstad | http://pasteraw.com/ckusk62f6gj3u6gl4tatnzrjn6yd2p8\ | 21:21 |
| lbragstad | http://pasteraw.com/ckusk62f6gj3u6gl4tatnzrjn6yd2p8 | 21:21 |
| dolphm | lbragstad: oops, i see that too | 21:24 |
| dolphm | lbragstad: okay, have a fix, let me clean it up | 21:25 |
| lbragstad | ok | 21:26 |
| lbragstad | dolphm: I think only 8 fail for me because I have existing keyczar repositories scattered around | 21:27 |
| *** atiwari has joined #openstack-keystone | 21:27 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 21:29 |
| *** timcline has quit IRC | 21:29 | |
| *** timcline has joined #openstack-keystone | 21:30 | |
| dolphm | lbragstad: refactored with a fix https://review.openstack.org/#/c/145317/6..7/keystone/tests/unit/token/test_ae_token_provider.py | 21:30 |
| lbragstad | sweet | 21:30 |
| lbragstad | dolphm: yeah, tests on the latest patch pass | 21:30 |
| dolphm | lbragstad: actually the create_key_directory() in that new class can be removed | 21:32 |
| lbragstad | dolphm: checking | 21:32 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 21:33 |
| lbragstad | dolphm: oh, right | 21:34 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 21:34 |
| lbragstad | dolphm: yeah I see it now... create_key_directory() is only if we specify the key_repository but tests will always use a tmpdir | 21:34 |
| dolphm | lbragstad: which they've already created | 21:35 |
| lbragstad | yep | 21:35 |
| lbragstad | dolphm: nice catch, makes sense | 21:35 |
| dolphm | lbragstad: could have the tests generate a temp dir name, and then exercise that code... if we wanted to | 21:35 |
| lbragstad | yeah, thats an idea | 21:36 |
| dolphm | lbragstad: i think i'm done iterating on this for the moment, if there's changes you want to make | 21:38 |
| dolphm | lbragstad: i'm going to play with signed tokens | 21:38 |
| dolphm | lbragstad: tempted to run a benchmark :P but i'm sure they'll come out within a margin of error as full encryption | 21:39 |
| lbragstad | dolphm: sounds good, running a benchmark against signed tokens? | 21:39 |
| lbragstad | or encrypted tokens? | 21:39 |
| dolphm | lbragstad: oh, also need to figure out another way to check if the formatter is using a crypter or a signer - i left FIXME's | 21:40 |
| dolphm | lbragstad: yes | 21:40 |
| lbragstad | dolphm: checking | 21:40 |
| dolphm | lbragstad: regarding my fixme's, maybe check for isinstance() of something in keyczar land instead of formatter.purpose | 21:40 |
| lbragstad | so, that should make the key repo stuff completely dependent on how it's set up initially | 21:41 |
| lbragstad | and nothing Keystone Config wise should know about it | 21:41 |
| dolphm | lbragstad: but it's dependent on keystone.conf ? | 21:41 |
| lbragstad | right now, when we want to use signing, we specify use_encryption = False in the keystone.conf | 21:42 |
| lbragstad | which tells the baseFormatter to use a signing object from keyczar, instead of an encrypting class | 21:42 |
| dolphm | lbragstad: right. instead just try to encrypt or sign a string using the repo and see what works :) | 21:43 |
| dolphm | lbragstad: and then set crypter to that | 21:43 |
| lbragstad | ok | 21:43 |
| dolphm | lbragstad: and then move the keystone.conf option to a keystone-manage ae_setup --option | 21:43 |
| lbragstad | dolphm: sure, that works | 21:44 |
| dolphm | lbragstad: (i can't think of a reason for that to be in conf forever) | 21:44 |
| dolphm | lbragstad: bbiab | 21:44 |
| lbragstad | dolphm: agreed | 21:44 |
| *** pnavarro has quit IRC | 21:45 | |
| lbragstad | dolphm: I'm going to work on that quick, in case you're pushing anything for review | 21:49 |
| stevemar | dstanek, not sure if you are back from your late lunch :) but i updated the exception logging patch if you want to take a look at the changes to hacking | 21:50 |
| *** jsavak has joined #openstack-keystone | 21:54 | |
| ayoung | dolphm, well lookee here: http://developer.openstack.org/api-ref-identity-v2.html#os-kscatalog-ext looks like we allow a slew of fields I never knew about | 21:55 |
| *** joesavak has quit IRC | 21:55 | |
| *** joesavak has joined #openstack-keystone | 21:57 | |
| *** jsavak has quit IRC | 22:00 | |
| *** nellysmitt has quit IRC | 22:03 | |
| *** spandhe has quit IRC | 22:09 | |
| *** spandhe has joined #openstack-keystone | 22:12 | |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: [do not merge] Test patch under load https://review.openstack.org/155477 | 22:15 |
| *** _cjones_ has quit IRC | 22:16 | |
| *** harlowja_ has joined #openstack-keystone | 22:18 | |
| *** atiwari1 has joined #openstack-keystone | 22:19 | |
| dolphm | ayoung: yeah, the version* ones i've never seen anyone use | 22:19 |
| *** _cjones_ has joined #openstack-keystone | 22:19 | |
| *** atiwari has quit IRC | 22:21 | |
| *** harlowja has quit IRC | 22:21 | |
| *** thedodd has quit IRC | 22:24 | |
| ayoung | dolphm, don't matter...I'll support them if they are documented...just keep them as optional | 22:26 |
| *** timcline has quit IRC | 22:28 | |
| *** thedodd has joined #openstack-keystone | 22:36 | |
| *** henrynash has quit IRC | 22:36 | |
| *** thedodd has quit IRC | 22:37 | |
| *** tellesnobrega_ has joined #openstack-keystone | 22:39 | |
| openstackgerrit | Alistair Coles proposed openstack/keystonemiddleware: Delay denial when service token is invalid https://review.openstack.org/153247 | 22:40 |
| breton | how's keystone configured in the gate? | 22:41 |
| breton | where can I find keystone.conf from there? | 22:41 |
| stevemar | http://logs.openstack.org/24/151524/3/check/check-tempest-dsvm-full/b8eb328/logs/etc/keystone/keystone.conf.txt.gz | 22:44 |
| stevemar | breton, ^ | 22:44 |
| stevemar | click on the logs of any dsvm job, and find logs/etc/keystone | 22:44 |
| stevemar | if you want the details look into devstack-gate project | 22:45 |
| breton | oh, ok, thank you | 22:47 |
| *** zzzeek_ has joined #openstack-keystone | 22:49 | |
| openstackgerrit | Merged openstack/oslo.policy: Remove symlinked file from tests https://review.openstack.org/155485 | 22:49 |
| *** zzzeek has quit IRC | 22:51 | |
| *** zzzeek_ is now known as zzzeek | 22:51 | |
| mgagne | guys, which policy file should I use? https://github.com/openstack/keystone/blob/master/etc/policy.json or https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json And what's the difference? | 23:00 |
| *** jsavak has joined #openstack-keystone | 23:01 | |
| ayoung | failures=9 | 23:02 |
| *** joesavak has quit IRC | 23:04 | |
| * lbragstad just got nerf'd | 23:05 | |
| * lbragstad needs to invest in desk protection devices! | 23:05 | |
| stevemar | lbragstad, best shield for protection http://img1.wikia.nocookie.net/__cb20100215023728/zelda/images/a/a8/Hylian_Shield_(Ocarina_of_Time).png | 23:08 |
| lbragstad | stevemar: taking notes | 23:08 |
| lbragstad | stevemar: I guess I have to research Nerf product | 23:09 |
| stevemar | just start throwing hammers | 23:09 |
| stevemar | we'll see who stops | 23:09 |
| lbragstad | stevemar: http://www.amazon.com/Nerf-N-Strike-Vulcan-EBF-25-Blaster/dp/B003H9MTJ6/ref=cm_lmf_tit_2 | 23:13 |
| *** avozza is now known as zz_avozza | 23:13 | |
| stevemar | that'll do | 23:15 |
| lbragstad | stevemar: I'll have to bolt it to the desk | 23:15 |
| *** chlong has joined #openstack-keystone | 23:17 | |
| *** zzzeek_ has joined #openstack-keystone | 23:22 | |
| *** zzzeek has quit IRC | 23:24 | |
| *** zzzeek_ is now known as zzzeek | 23:24 | |
| *** andreaf_ has joined #openstack-keystone | 23:27 | |
| *** gyee has joined #openstack-keystone | 23:29 | |
| *** ChanServ sets mode: +v gyee | 23:29 | |
| ayoung | morganfainberg, if we were to say we wanted datetimes in one format, it would it be TZ aware, right, not http://docs.openstack.org/developer/oslo.utils/api/timeutils.html#oslo_utils.timeutils.normalize_time | 23:30 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 23:31 |
| bknudson | oops, pep8 | 23:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 23:32 |
| *** gyee has quit IRC | 23:33 | |
| *** andreaf_ has quit IRC | 23:35 | |
| *** EmilienM is now known as EmilienM|afk | 23:35 | |
| *** gyee has joined #openstack-keystone | 23:35 | |
| *** ChanServ sets mode: +v gyee | 23:35 | |
| *** gyee has quit IRC | 23:35 | |
| *** gyee has joined #openstack-keystone | 23:36 | |
| *** gyee has quit IRC | 23:38 | |
| *** gyee has joined #openstack-keystone | 23:38 | |
| *** ChanServ sets mode: +v gyee | 23:38 | |
| *** tellesnobrega_ has quit IRC | 23:39 | |
| *** openstack has joined #openstack-keystone | 23:40 | |
| *** bknudson has quit IRC | 23:42 | |
| *** andreaf_ has joined #openstack-keystone | 23:44 | |
| *** samueldmq_ has joined #openstack-keystone | 23:46 | |
| lbragstad | dolphm: took a stab at removing use_encryption and building it into keystone-manage | 23:46 |
| lbragstad | dolphm: pushing a new patch now if you're working on anything | 23:46 |
| dolphm | lbragstad: i'm relearning how to java | 23:46 |
| lbragstad | dolphm: ... | 23:46 |
| dolphm | lbragstad: cloned keyczar | 23:46 |
| lbragstad | why | 23:47 |
| ayoung | failures=5 | 23:47 |
| lbragstad | oh | 23:47 |
| *** andreaf_ has quit IRC | 23:47 | |
| ayoung | dolphm, we have (or had) a crypto maestor here that I wanted to ask about keyczar, but I can't seem to find him. Wondering if he left the company | 23:47 |
| dolphm | lbragstad: i have a safe workaround in our code, but i figured i'd try to contribute a fix | 23:48 |
| dolphm | ayoung: well i found a security-related bug in keyczar if you find him :) | 23:48 |
| dolphm | lbragstad: i think i need to maven how do you maven | 23:48 |
| dolphm | lbragstad: also how to java? | 23:49 |
| lbragstad | jacorob: teach us to maven! | 23:49 |
| ayoung | Nope, he's still here...just couldn't remember how to spell his name... | 23:50 |
| dolphm | lbragstad: the instructions to build keyczar starts with: 1. Select the "File" menu, then the "Import" item. | 23:54 |
| dolphm | lbragstad: can you show me where the "File" menu is? http://i.imgur.com/gtKSdbR.png | 23:54 |
| lbragstad | dolphm: use your windows button | 23:55 |
| *** krtaylor has quit IRC | 23:57 | |
| *** ayoung has quit IRC | 23:57 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Authenticated Encryption (AE) tokens https://review.openstack.org/145317 | 23:57 |
| dolphm | lbragstad: is that one of these? http://i.imgur.com/hSGQQ0J.jpg | 23:57 |
| lbragstad | dolphm: new patch ^ | 23:58 |
| lbragstad | dolphm: relocating home | 23:58 |
| *** _cjones_ has quit IRC | 23:59 | |
| *** _cjones_ has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
