| *** ljfisher has quit IRC | 00:03 | |
| *** nellysmitt has joined #openstack-keystone | 00:03 | |
| *** gyee has quit IRC | 00:04 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:05 | |
| *** ncoghlan has joined #openstack-keystone | 00:05 | |
| *** zzzeek has quit IRC | 00:05 | |
| *** nellysmitt has quit IRC | 00:08 | |
| *** krtaylor has joined #openstack-keystone | 00:10 | |
| *** zzzeek has joined #openstack-keystone | 00:12 | |
| *** atiwari1 has quit IRC | 00:16 | |
| *** atiwari1 has joined #openstack-keystone | 00:17 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Create functional test base https://review.openstack.org/155543 | 00:20 |
|---|---|---|
| stevemar | dolphm, you need to request a new windows machine to continue your work | 00:20 |
| stevemar | please consult IT | 00:20 |
| *** markvoelker has quit IRC | 00:22 | |
| dolphm | stevemar: I DID IT I DEFEATED THE MAVEN! | 00:22 |
| jamielennox | none of this is inspiring confidence that we should want to have keyczar as a dependency | 00:24 |
| *** atiwari1 has quit IRC | 00:25 | |
| *** lnxnut has joined #openstack-keystone | 00:25 | |
| *** lhcheng_ has joined #openstack-keystone | 00:26 | |
| *** abhirc has quit IRC | 00:28 | |
| *** lhcheng has quit IRC | 00:28 | |
| *** marg7175 has quit IRC | 00:31 | |
| *** lnxnut has quit IRC | 00:33 | |
| *** david-lyle is now known as david-lyle_afk | 00:37 | |
| *** samueldmq_ has quit IRC | 00:37 | |
| *** abhirc has joined #openstack-keystone | 00:41 | |
| *** zzzeek has quit IRC | 00:41 | |
| *** abhirc has quit IRC | 00:42 | |
| *** gyee has joined #openstack-keystone | 00:42 | |
| *** ChanServ sets mode: +v gyee | 00:42 | |
| dolphm | jamielennox: it could be better, but i'm not aware of a replacement? | 01:01 |
| jamielennox | neither | 01:03 |
| jamielennox | but java... | 01:03 |
| openstackgerrit | Ian Wienand proposed openstack/oslo.policy: Deprecate default value for "policy_dirs" https://review.openstack.org/154742 | 01:05 |
| *** bknudson has joined #openstack-keystone | 01:13 | |
| *** ChanServ sets mode: +v bknudson | 01:13 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 01:19 |
| bknudson | jamielennox: making similar changes in keystone ^ | 01:19 |
| bknudson | why would we use tempest-lib in keystoneclient? | 01:20 |
| jamielennox | bknudson: yea, i saw - i was going to ask you a question about it earlier but you weren't around | 01:20 |
| bknudson | for cli tests? | 01:20 |
| bknudson | I was buying gas and milk. | 01:20 |
| jamielennox | bknudson: i was purely following a pattern set down by novaclient, i figured most of the tests that are coming from tempest will be written that way so we may as well use it | 01:21 |
| bknudson | I'll compare with the nova code. | 01:22 |
| jamielennox | also mtreinish is pushing me into it, so i figured I should go with the tempest settings | 01:22 |
| bknudson | looks like novaclient doesn't have a whole lot of functional tests yet. | 01:23 |
| bknudson | we don't even want to test the cli... should be deprecated. | 01:23 |
| jamielennox | bknudson: i think it's part of the plan to get it out of tempest for now | 01:24 |
| jamielennox | i agree with deprecating it, however whilst we ship it we should keep it tested | 01:25 |
| bknudson | I didn't know there were keystone cli tests in tempest now. | 01:25 |
| jamielennox | i don't want to write any more tests but i'm happy enough to take what exists | 01:25 |
| jamielennox | bknudson: not many: https://github.com/openstack/tempest/blob/master/tempest/cli/simple_read_only/identity/test_keystone.py | 01:26 |
| stevemar | just for listing i think | 01:26 |
| *** lhcheng_ has quit IRC | 01:27 | |
| *** jsavak has quit IRC | 01:27 | |
| *** lhcheng has joined #openstack-keystone | 01:27 | |
| bknudson | nova doesn't set OS_TEST_PATH in tox.ini: http://git.openstack.org/cgit/openstack/python-novaclient/tree/tox.ini | 01:28 |
| bknudson | in testenv. | 01:28 |
| jamielennox | bknudson: yea, and if you do testr it runs both functional and unit tests | 01:30 |
| jamielennox | i took that from nova/ | 01:31 |
| jamielennox | https://github.com/openstack/nova/blob/master/tox.ini | 01:31 |
| bknudson | jamielennox: that's how I thought dstanek would implement it in keystone. | 01:31 |
| *** lhcheng has quit IRC | 01:32 | |
| *** dims_ has joined #openstack-keystone | 01:32 | |
| *** dims_ has quit IRC | 01:32 | |
| *** dims_ has joined #openstack-keystone | 01:32 | |
| *** dims__ has quit IRC | 01:33 | |
| bknudson | jamielennox: is there a job for keystoneclient functional? | 01:35 |
| bknudson | jenkins jobs | 01:35 |
| jamielennox | bknudson: not yet - i was waiting for the review to merge | 01:35 |
| jamielennox | umm | 01:35 |
| *** dims__ has joined #openstack-keystone | 01:36 | |
| jamielennox | but i hvae: http://git.openstack.org/cgit/openstack-infra/project-config/commit/?id=c4093cd6d328a87ea9a2335ac2dd4d09a598bc8e which is the novaclient one | 01:36 |
| bknudson | novaclient doesn't need one. | 01:36 |
| jamielennox | i'm sceptical if keystoneclient needs one - beyond the CLI which we've deprecated i'm not sure what you want to do with functionally testing a library | 01:37 |
| bknudson | we'll have a keystone so you can do anything | 01:37 |
| bknudson | create projects | 01:37 |
| bknudson | get tokens and validate tokens | 01:37 |
| jamielennox | sure, but it should be keystone's functional tests that are validating those interfaces - and so long as the interfaces are right we should be ok to simply unit test the client | 01:38 |
| bknudson | the interfaces probably aren't right, since they're not tested. | 01:38 |
| jamielennox | especially now i ripped out all that mocking and we're testing at the http layer | 01:38 |
| jamielennox | true - problem with stubs is they always return correctly | 01:39 |
| *** dims_ has quit IRC | 01:39 | |
| bknudson | they always return something, not necessarily what the server would return. | 01:39 |
| jamielennox | right | 01:39 |
| bknudson | after keystoneclient released there were some problems in osc, I think... | 01:39 |
| bknudson | stevemar pointed me to a failure... | 01:40 |
| jamielennox | stevemar: ^ ? | 01:40 |
| stevemar | yo. | 01:40 |
| bknudson | crap, I closed the windows | 01:40 |
| stevemar | bknudson, right, let me find the bug | 01:40 |
| stevemar | https://bugs.launchpad.net/python-openstackclient/+bug/1420080 | 01:40 |
| openstack | Launchpad bug 1420080 in python-openstackclient "functional tests are failing with new keystoneclient release" [Undecided,New] | 01:40 |
| jamielennox | stevemar: for OSC you can run your tests against the master version in jenkins as well - you should probably do that as well | 01:40 |
| jamielennox | we can catch these prior to release | 01:41 |
| stevemar | jamielennox, good call... | 01:41 |
| stevemar | agreed | 01:41 |
| bknudson | thanks! | 01:41 |
| stevemar | jamielennox, making a note of that on my todo list | 01:41 |
| bknudson | stevemar: is that still failing? we haven't done anything to fix it as far as I know. | 01:41 |
| stevemar | bknudson, i skipped the test | 01:42 |
| jamielennox | stevemar: so is that a v2 thing? | 01:42 |
| bknudson | I think it's related to https://review.openstack.org/#/c/145532/ | 01:42 |
| jamielennox | bknudson: almost certainly | 01:43 |
| stevemar | bknudson, probably definitely | 01:43 |
| stevemar | this will also have implications on pycadf | 01:43 |
| stevemar | since it needs the service catalog | 01:43 |
| jamielennox | so my guess is that it's a v2/v3 mismatch | 01:43 |
| jamielennox | if you do data['token'] on a v2 token you get the token_id string? | 01:43 |
| jamielennox | if you do data['token'] on a v3 token you get a dictionary with the catalog as an element | 01:44 |
| jamielennox | it's just surely that would have been caught somewhere prior to that | 01:44 |
| jamielennox | to a functional test in OSC | 01:44 |
| bknudson | this is why we have functional tests. | 01:45 |
| *** gyee has quit IRC | 01:45 | |
| bknudson | also should improve unit tests to cover this somehow. | 01:45 |
| jamielennox | on the up side it means that our gate is almost entirely converted to v3 :) | 01:45 |
| jamielennox | this must be causing more problems.... | 01:46 |
| *** davechen has joined #openstack-keystone | 01:46 | |
| bknudson | stevemar: what test failed? all of them? | 01:47 |
| bknudson | maybe it's easy to recreate with tox -e functional in osc. | 01:47 |
| *** r-daneel has quit IRC | 01:48 | |
| stevemar | hmm | 01:49 |
| jamielennox | we should verify this, file against keystoneclient and then i think issue a bugfix release, because that has to be biting a lot of people | 01:50 |
| *** _cjones_ has quit IRC | 01:50 | |
| bknudson | jamielennox: I added keystoneclient | 01:50 |
| bknudson | jamielennox: do you want to work on a fix? | 01:51 |
| jamielennox | bknudson: great - i just got the requirements patch to bump keystoneclient merged | 01:51 |
| jamielennox | bknudson: yep, i can have a look at that | 01:51 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/155572 | 01:53 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/155573 | 01:53 |
| stevemar | bknudson, sorry, was otp | 01:53 |
| bknudson | I tried openstack user list --debug and no problems with the token | 01:54 |
| stevemar | bknudson, the problem is seen specifically with dtroyer's examples | 01:54 |
| stevemar | https://github.com/openstack/python-openstackclient/tree/master/examples | 01:54 |
| jamielennox | i have to run out for a bit, but i'll see if i can reproduce this afternoon | 01:54 |
| stevemar | we have functional tests that run the example files | 01:54 |
| stevemar | https://github.com/openstack/python-openstackclient/blob/master/functional/tests/test_examples.py#L26-L32 | 01:54 |
| stevemar | object_api.py and osc-lib.py were failing | 01:55 |
| jamielennox | stevemar: i think the problem is the same | 01:55 |
| jamielennox | bknudson: if you don't use --debug it won't try to print all that | 01:55 |
| bknudson | I thought the --debug output was the problem. | 01:58 |
| jamielennox | yea, there is an optimization in there because we process the data so much for logging to not print unless debug is enabled | 01:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/155584 | 02:00 |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 02:01 |
| jamielennox | alright - back later, let me know if someone fixes it otherwise i will look later | 02:01 |
| *** jamielennox is now known as jamielennox|away | 02:01 | |
| bknudson | Looks like the v2 token has "tenant": {"description": null, "enabled": true, "id": "3824a1c2bdfb4d16a1ece8bd7f0d5950", "parent_id": null, "name": "demo"} | 02:02 |
| bknudson | is it expected to have parent_id in there? | 02:02 |
| bknudson | the v2 token has ['access'] and not ['token'] | 02:03 |
| *** nellysmitt has joined #openstack-keystone | 02:04 | |
| bknudson | osc or keystone must be doing something really wacky. | 02:05 |
| *** nellysmitt has quit IRC | 02:09 | |
| stevemar | keystone dumped the parent_project_id everywhere i think, that's gotta be a bug on the server side | 02:12 |
| morganfainberg | stevemar, hmm? | 02:13 |
| morganfainberg | oh in v2 token, no | 02:13 |
| morganfainberg | parent_id should not be there | 02:13 |
| *** zz_avozza is now known as avozza | 02:13 | |
| stevemar | bknudson, we (osc) do funny things with auth, not so much the token we get bcak | 02:14 |
| morganfainberg | and yes please lets catch those bugs before release :) | 02:14 |
| * morganfainberg is finally back home. | 02:14 | |
| bknudson | I can propose a fix... give me a minute to try it out. | 02:14 |
| morganfainberg | bknudson, ++ thanks for chasing this down | 02:15 |
| bknudson | I don't really know how this is happening since v2 and v3 tokens work for me. | 02:15 |
| *** ayoung has joined #openstack-keystone | 02:16 | |
| *** ChanServ sets mode: +v ayoung | 02:16 | |
| bknudson | plus tokens aren't generally logged anyways, needed to force a variable to True | 02:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Refactor _send_audit_notification https://review.openstack.org/151551 | 02:20 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Ignore all failures removing catalog when logging token https://review.openstack.org/155605 | 02:20 |
| *** avozza is now known as zz_avozza | 02:23 | |
| *** spandhe has quit IRC | 02:24 | |
| morganfainberg | so interesting, I chatted with someone today who's using couchbase as the memcache backend for tokens | 02:25 |
| morganfainberg | or looking at it | 02:25 |
| morganfainberg | looks like couchbase solves a lot of the memcache-is-sucky problems | 02:25 |
| morganfainberg | replication, stable store, etc | 02:25 |
| openstackgerrit | Ian Wienand proposed openstack/oslo.policy: Deprecate default value for "policy_dirs" https://review.openstack.org/154742 | 02:27 |
| ayoung | jamielennox|away, let me know when you are back | 02:29 |
| ayoung | I am unclear on how the v2 tokens catalogs are supposed to be jhandled | 02:30 |
| ayoung | if it comes in as 3 urls in one endpoint, should that be one endpoint or three after the fact? | 02:30 |
| dstanek | bknudson: jamielennox|away: ? | 02:31 |
| ayoung | morganfainberg, tokens must die. | 02:31 |
| ayoung | We can keep unscoped tokens around for the luddites that insist on using passwords | 02:31 |
| morganfainberg | ayoung, tokens cannot die | 02:31 |
| ayoung | unscoped token plus trust ID | 02:31 |
| morganfainberg | ayoung, we can offer alterantives | 02:31 |
| ayoung | TOKENS MUJST DIE! | 02:31 |
| morganfainberg | ayoung, cant | 02:31 |
| ayoung | WILL! | 02:32 |
| morganfainberg | we can offer much better alternatives | 02:32 |
| ayoung | SHALL | 02:32 |
| morganfainberg | i'm not going to do a V4 api | 02:32 |
| morganfainberg | so... they wont die | 02:32 |
| ayoung | We don't need to | 02:32 |
| morganfainberg | yes, we would. | 02:32 |
| bknudson | next week is the OSSG meeting in san francisco | 02:32 |
| ayoung | Yes they can...unscoped token or real authentication + header with a delegation ID | 02:32 |
| morganfainberg | bknudson, damn it. i am going to be in seattle i wanted to go to that | 02:32 |
| bknudson | there will be plenty of hp folks there... | 02:33 |
| morganfainberg | ayoung, ok lets start with "Tokens wont die in Kilo" ;) | 02:33 |
| ayoung | CUZ HP is all about that cloud thing | 02:33 |
| morganfainberg | ayoung, and tokens will still be around in Liberty* | 02:33 |
| ayoung | morganfainberg, who cares | 02:34 |
| morganfainberg | * = there may be a new method to make tokens obsolete in Liberty and beyond | 02:34 |
| ayoung | get a better mechanism, deprecate them | 02:34 |
| ayoung | and stop puring good money after bad | 02:34 |
| *** erkules_ has joined #openstack-keystone | 02:34 | |
| morganfainberg | because i have to field questions on this stuff from many companies who freak when they hear this kind of stuff | 02:34 |
| morganfainberg | and saying "tokens wont be gone in kilo" is important on that | 02:34 |
| ayoung | unscoped token is there only to say "yes, use has handed me a password" | 02:34 |
| bknudson | switch to bitcoins | 02:35 |
| morganfainberg | bknudson, i like storing data in the blockchain as a secure method to ensure auditability as well | 02:35 |
| ayoung | How big is a bit coin? Bet it is bitter than a PKI token | 02:35 |
| ayoung | bigger | 02:35 |
| morganfainberg | bknudson, i'll bet we can even use the blockchain as the stable store for most userdata too. | 02:36 |
| morganfainberg | bknudson, i'm sold. lets do it ;) | 02:36 |
| *** tellesnobrega_ has quit IRC | 02:36 | |
| bknudson | we need april fools specs. | 02:36 |
| morganfainberg | bknudson, ++ | 02:36 |
| *** erkules has quit IRC | 02:37 | |
| *** tqtran has quit IRC | 02:41 | |
| bknudson | https://review.openstack.org/#/c/155605/ is the proposed fix for the osc test failures. | 02:42 |
| morganfainberg | bknudson, what was the fix to auth_token to let users not in the default domain be service users? | 02:47 |
| bknudson | morganfainberg: the fix was to support authentication plugins. | 02:47 |
| bknudson | morganfainberg: jamielennox|away did it | 02:48 |
| morganfainberg | bknudson, do we have documentation on how to configure auth_token that way? | 02:48 |
| bknudson | he he! | 02:48 |
| bknudson | actually, there might be somewhere. | 02:48 |
| morganfainberg | i actually have someone asking about this | 02:49 |
| morganfainberg | crap but they use neutron | 02:49 |
| morganfainberg | ... | 02:49 |
| bknudson | we need keystonemiddleware on this list: http://docs.openstack.org/developer/openstack-projects.html | 02:49 |
| * morganfainberg needs to get Jamie to fix juno nova to not explode with neutron | 02:49 | |
| bknudson | y, I don't see it on keystonemiddleware docs... http://docs.openstack.org/developer/keystonemiddleware/ | 02:50 |
| bknudson | maybe it was in keystoneclient | 02:50 |
| stevemar | now to figure out how we can run osc against ksc master | 02:50 |
| morganfainberg | and the whole documentation is saying put configs in paste-ini it looks like | 02:50 |
| bknudson | stevemar: sudo python setup.py develop | 02:51 |
| morganfainberg | hmm, darn jamielennox|away is away | 02:51 |
| bknudson | where does he go? | 02:51 |
| morganfainberg | no idea | 02:52 |
| stevemar | bknudson, i meant changing project-config | 02:52 |
| bknudson | grabbing a shimp of the barbie. | 02:52 |
| bknudson | shrimp | 02:52 |
| stevemar | on* | 02:52 |
| stevemar | off* | 02:52 |
| bknudson | it's getting too late | 02:52 |
| stevemar | not even 9pm for you | 02:53 |
| stevemar | you still have a solid 4-6 hrs of work left in ya | 02:53 |
| ayoung | He should be around. | 02:56 |
| ayoung | But...I went through that review. Let me pull it up | 02:56 |
| *** tellesnobrega_ has joined #openstack-keystone | 02:57 | |
| *** topol has joined #openstack-keystone | 03:00 | |
| *** ChanServ sets mode: +v topol | 03:00 | |
| ayoung | commit e77a7a225b0902da47fc4acd643d76ebd77e68d1 | 03:01 |
| ayoung | Merge: a7beb50 bb00caf | 03:01 |
| ayoung | Author: Jenkins <jenkins@review.openstack.org> | 03:01 |
| ayoung | Date: Sat Sep 27 05:16:01 2014 +0000 | 03:01 |
| ayoung | Merge "Support service user and project in non-default domain" | 03:01 |
| morganfainberg | ayoung, we're missing documentation | 03:02 |
| morganfainberg | and the test case has a gap in it | 03:02 |
| *** markvoelker has joined #openstack-keystone | 03:02 | |
| ayoung | a/doc/source/middlewarearchitecture.rst | 03:02 |
| morganfainberg | don't see documentation that shows how to configur with auth plugins | 03:03 |
| morganfainberg | and that patch from jamie doesn't include it | 03:03 |
| morganfainberg | i'm having to look at test cases to see what is expected | 03:04 |
| ayoung | bknudson, why would your patch "Support service user and project in non-default domain" not be enough? | 03:04 |
| morganfainberg | ayoung, and http://paste.openstack.org/show/172566/ as shown here, we are only testing the domain_id and project_id, not project_name + domain_id | 03:04 |
| morganfainberg | thats form the test case | 03:05 |
| ayoung | morganfainberg, that is different from your origianl question, though " what was the fix to auth_token to let users not in the default domain be service users?" | 03:06 |
| morganfainberg | ayoung, if you look at the whole convo i then asked about docs | 03:06 |
| *** dims__ has quit IRC | 03:07 | |
| morganfainberg | ayoung, thanks! you got to that commit about when I found it. | 03:07 |
| *** markvoelker has quit IRC | 03:07 | |
| ayoung | morganfainberg, I was still working to answer the important part "is it even possible" | 03:07 |
| morganfainberg | ayoung, i'm actually working on setting up an environment around this theory | 03:08 |
| morganfainberg | :) | 03:08 |
| ayoung | very nice | 03:08 |
| ayoung | I was supposed to be, but aside from being lost in auth_context/access_info loand, they blew up our internal cloud | 03:08 |
| morganfainberg | where SQL is the default identity store, but LDAP is the identity store for Default domain, allowing full use of V2 while service users live in v3 | 03:08 |
| morganfainberg | and then layer in some geographic replication of data. | 03:09 |
| ayoung | I'm supposed to do that, and then throw SSSD via Federation on top of it | 03:09 |
| ayoung | so...if you do this setup on a Fedora or RHEL system.... | 03:09 |
| ayoung | I'd be happy to help you with the FreeIPA setup. | 03:09 |
| ayoung | I need to accept that my setup on Dreamhost is toast and restart it, too | 03:10 |
| morganfainberg | right now i only have an ubuntu system to work with. | 03:10 |
| morganfainberg | but i'll want to setup something a bit more permanent as a POC once i have this working via devstack(s) | 03:10 |
| morganfainberg | which case using an IPA install amkes sense | 03:10 |
| morganfainberg | since it makes the user management in LDAP ... well not suck - and enables us to poke at other features | 03:11 |
| ayoung | Tell you waht...I'll loop back around on Dreamhost and get it back up and running wonce I get access_info down to 0 failing tests | 03:13 |
| ayoung | right now I have tto figure out what to do about the V2 catalogs, and then I think I'll be able to get the last 5-6 failures knocked off | 03:14 |
| morganfainberg | ayoung, sounds good and i'll want to setup a "geographically" separate keystone to test some data replication stuff | 03:14 |
| ayoung | it will still need a huge amount of revision | 03:14 |
| morganfainberg | ayoung, thanks for diving on the accessinfo grenande dude | 03:14 |
| morganfainberg | ayoung, i appreciate it | 03:14 |
| ayoung | I need to talk over a lot of the details with Jamie. He's had to deal with so many compteting deamns in this code base... | 03:15 |
| morganfainberg | ayoung, yeah. | 03:15 |
| morganfainberg | ayoung, but once we get it done i think we'll be in a much happier place | 03:16 |
| *** richm has quit IRC | 03:16 | |
| ayoung | Yeah...It will standarize policy enforcement, and we can use it for building the tokens cleanly in the server, too | 03:16 |
| ayoung | I think it is what termie was origianlly going for with the common/models.py code, but we never quite go things unified on that | 03:17 |
| ayoung | I'll have to loop back around with the SQL Alchemy code and see if we can avoid duplication of all the properties between the model objects and the values into/outof the database | 03:18 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/155573 | 03:19 |
| morganfainberg | ayoung, yeah i think you're right on that front | 03:23 |
| morganfainberg | re: termie's direction | 03:23 |
| *** harlowja_ is now known as harlowja_away | 03:27 | |
| *** tellesnobrega_ has quit IRC | 03:34 | |
| *** tellesnobrega_ has joined #openstack-keystone | 03:34 | |
| *** tellesnobrega_ has quit IRC | 03:34 | |
| morganfainberg | topol, found another whiskey you'd like | 03:38 |
| morganfainberg | "Midwinternight's Dram" | 03:38 |
| morganfainberg | it's great! | 03:38 |
| ayoung | failures=2 | 03:42 |
| morganfainberg | ayoung, nice!! | 03:42 |
| stevemar | ayoung, almost there | 03:46 |
| ayoung | and I know how to fix one already... | 03:46 |
| ayoung | failures=1 | 03:48 |
| topol | morganfainberg. sounds good. will they have it in vancouver? | 03:49 |
| morganfainberg | topol, eh | 03:50 |
| morganfainberg | topol, it's a rye whiskey | 03:50 |
| morganfainberg | maybe | 03:50 |
| morganfainberg | it's not super common fwiw | 03:50 |
| morganfainberg | but not exactly rare either | 03:50 |
| topol | morganfainberg, K | 03:51 |
| topol | stevemar that photo you posted was awesome | 03:52 |
| stevemar | topol, glad you enjoyed it | 03:52 |
| topol | stevemar I was one of those dumb asses | 03:53 |
| ayoung | Ran 1026 (+1025) tests in 8.262s (+8.252s) | 03:54 |
| ayoung | PASSED (id=1119, skips=3) | 03:54 |
| morganfainberg | woot | 03:54 |
| * topol tried to get up my steep driveway without turning off the auto traction on my car. was halarious | 03:54 | |
| ayoung | yeah...now if only he hadn't bumped all the tests down one level | 03:54 |
| ayoung | topol, I just got a new set of snow tires for my Hyundai | 03:55 |
| * morganfainberg just enjoyed t-shirt and shorts weather today. | 03:55 | |
| stevemar | topol, winter tires ftw! | 03:55 |
| morganfainberg | ~92F | 03:55 |
| topol | snow tires, what are those | 03:55 |
| stevemar | bigger tire tread | 03:55 |
| morganfainberg | felt like summer | 03:55 |
| topol | :-) | 03:55 |
| stevemar | morganfainberg, i hate you | 03:56 |
| ayoung | morganfainberg, aren't you headed to NYC soon. Might want to rethink that move if you are prone to gloating. | 03:56 |
| morganfainberg | ayoung, wont be till post summit | 03:56 |
| stevemar | it wasn't slushy outside today, but damn it was a biting cold | 03:56 |
| morganfainberg | at the earliest | 03:56 |
| topol | Im to NH on Monday :-( | 03:56 |
| morganfainberg | and i'd gloat about cold weather too | 03:56 |
| morganfainberg | cause.. for me i pref cold weather | 03:56 |
| morganfainberg | actually next week in seattle | 03:56 |
| morganfainberg | stevemar, i might be late to the keystone meeting | 03:57 |
| morganfainberg | mind running it for me? | 03:57 |
| stevemar | sure | 03:57 |
| morganfainberg | i'l be landing around the time it starts | 03:57 |
| morganfainberg | thanks | 03:57 |
| stevemar | np, i get to wield the power | 03:57 |
| morganfainberg | crap | 03:57 |
| stevemar | skip topics i don't like | 03:57 |
| morganfainberg | topol, you want to run the meeting instead, dunno if we can trust stevemar w/ the power | 03:58 |
| morganfainberg | ;) | 03:58 |
| stevemar | you can always trust the canadian | 03:58 |
| ayoung | looks like git handles merges that include directory moves OK...fingers crossed he | 03:59 |
| ayoung | here | 03:59 |
| topol | IF he doesnt behave we can force feed him ketchup chips | 03:59 |
| ayoung | 2 failures | 03:59 |
| morganfainberg | what... are.. you know i probably don't want to know what ketchup chips are | 03:59 |
| topol | ask the knooK | 03:59 |
| morganfainberg | ignorance is bliss | 04:00 |
| topol | stevemar^ | 04:02 |
| stevemar | morganfainberg, we had a whole twitter discussion about them | 04:02 |
| * morganfainberg ignores said twitter convo | 04:02 | |
| stevemar | apparently that flavor is only sold north of the border | 04:03 |
| stevemar | i had no idea | 04:03 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 04:03 |
| stevemar | bknudson, heard about them | 04:03 |
| ayoung | <geddy lee>Thank you very kindly, good night!</geddy lee> | 04:03 |
| *** ayoung is now known as ayoung_ZZZzzzZZZ | 04:03 | |
| topol | rush? | 04:04 |
| *** markvoelker has joined #openstack-keystone | 04:04 | |
| stevemar | apparently | 04:05 |
| *** nellysmitt has joined #openstack-keystone | 04:05 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 04:06 |
| *** dims__ has joined #openstack-keystone | 04:07 | |
| *** markvoelker has quit IRC | 04:08 | |
| *** nellysmitt has quit IRC | 04:10 | |
| *** dims__ has quit IRC | 04:12 | |
| *** topol has quit IRC | 04:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 04:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Publicize region/endpoint/policy/service events https://review.openstack.org/151774 | 04:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notification handling for policy/region/service/endpoint https://review.openstack.org/151786 | 04:27 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a test for create_domain in notifications https://review.openstack.org/151791 | 04:27 |
| *** lhcheng has joined #openstack-keystone | 04:29 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a test for create_domain in notifications https://review.openstack.org/151791 | 04:32 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 04:37 |
| *** _cjones_ has joined #openstack-keystone | 04:51 | |
| *** _cjones_ has quit IRC | 04:51 | |
| *** _cjones_ has joined #openstack-keystone | 04:52 | |
| *** _cjones_ has quit IRC | 04:56 | |
| *** ajayaa has joined #openstack-keystone | 05:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 05:18 |
| *** jacer_huawei has quit IRC | 05:19 | |
| stevemar | morganfainberg, around? | 05:59 |
| morganfainberg | Sortof | 06:00 |
| stevemar | morganfainberg, with grenade, if it pulled down .06 for a library, cause that's what it's capped at, for the N-1 install. | 06:02 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/155650 | 06:03 |
| stevemar | then during the update to N, in the requirements repo, the library is lower bounded by 0.6, but has newer versions out there... it's not going to upgrade it will it? | 06:03 |
| morganfainberg | I think that's right | 06:03 |
| *** nellysmitt has joined #openstack-keystone | 06:06 | |
| stevemar | stinks | 06:07 |
| stevemar | morganfainberg, -> Bump pycadf to 0.7.1 https://review.openstack.org/155652 | 06:07 |
| *** nellysmitt has quit IRC | 06:11 | |
| *** lhcheng_ has joined #openstack-keystone | 06:21 | |
| *** spandhe has joined #openstack-keystone | 06:21 | |
| *** lhcheng has quit IRC | 06:23 | |
| *** zz_avozza is now known as avozza | 06:37 | |
| *** abhirc has joined #openstack-keystone | 06:37 | |
| *** ajayaa has quit IRC | 06:38 | |
| *** jamielennox|away is now known as jamielennox | 06:44 | |
| *** afazekas_ has joined #openstack-keystone | 06:47 | |
| jamielennox | morganfainberg: you still looking for me? | 06:48 |
| morganfainberg | jamielennox: yeah. We don't have any documentation on configuring middleware to work with service users outside of he default domain. | 06:49 |
| jamielennox | umm, hmm... you may be right | 06:49 |
| morganfainberg | I also noticed the test looks like it is testing user_id and domain_id | 06:49 |
| morganfainberg | Not username. | 06:49 |
| jamielennox | which test? | 06:49 |
| morganfainberg | The one in ksm that was added with the domain handling bits. | 06:50 |
| jamielennox | morganfainberg: there's nothing really domain handling... that's kind of the point so long as the plugin works ksm doesn't care | 06:51 |
| morganfainberg | Right. But domain_id and project_id doesn't help does it? | 06:51 |
| morganfainberg | Since project id is unique. Only time domain would be needed is with project name. | 06:52 |
| morganfainberg | Right? | 06:52 |
| jamielennox | sure | 06:54 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Create functional test base https://review.openstack.org/155543 | 06:55 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 06:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - Add CADF notifications for trusts https://review.openstack.org/151867 | 07:01 |
| *** avozza is now known as zz_avozza | 07:03 | |
| *** dims__ has joined #openstack-keystone | 07:10 | |
| *** dims__ has quit IRC | 07:15 | |
| *** jacer_huawei has joined #openstack-keystone | 07:17 | |
| *** jacer_huawei is now known as wanghong | 07:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 07:24 |
| stevemar | dstanek, just for you bud ^ | 07:25 |
| *** ajayaa has joined #openstack-keystone | 07:25 | |
| *** abhirc has quit IRC | 07:26 | |
| *** pnavarro has joined #openstack-keystone | 07:36 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: [WIP] Add subject token token to user token plugin https://review.openstack.org/141614 | 07:41 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add subject token token to user token plugin https://review.openstack.org/141614 | 07:47 |
| *** nellysmitt has joined #openstack-keystone | 07:49 | |
| *** zz_avozza is now known as avozza | 07:53 | |
| *** stevemar has quit IRC | 07:56 | |
| *** nellysmitt has quit IRC | 07:58 | |
| *** krykowski has joined #openstack-keystone | 07:58 | |
| *** lhcheng_ has quit IRC | 07:59 | |
| *** markvoelker has joined #openstack-keystone | 08:09 | |
| *** spandhe has quit IRC | 08:13 | |
| *** markvoelker has quit IRC | 08:14 | |
| *** mzbik has joined #openstack-keystone | 08:14 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add service token token to user token plugin https://review.openstack.org/141614 | 08:20 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add Request ID to outbound calls when set https://review.openstack.org/155672 | 08:20 |
| *** ncoghlan has quit IRC | 08:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add Request ID to outbound calls when set https://review.openstack.org/155672 | 08:22 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add Request ID to outbound calls when set https://review.openstack.org/155672 | 08:22 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Add service token to user token plugin https://review.openstack.org/141614 | 08:22 |
| jamielennox | ugh | 08:22 |
| *** yanfengxi has joined #openstack-keystone | 08:33 | |
| *** yanfengxi has quit IRC | 08:36 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Ignore all failures removing catalog when logging token https://review.openstack.org/155605 | 08:37 |
| *** openstackgerrit has quit IRC | 08:42 | |
| *** openstackgerrit has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/155572 | 08:49 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/155650 | 08:50 |
| *** lhcheng has joined #openstack-keystone | 08:59 | |
| *** MasterPiece has joined #openstack-keystone | 09:05 | |
| ajayaa | rodrigods, raildo, Hi. | 09:09 |
| *** markvoelker has joined #openstack-keystone | 09:10 | |
| ajayaa | Right now it so happens that user's are contained inside a domain. When hmt comes into place, what happens to the users? | 09:10 |
| *** MasterPiece has quit IRC | 09:11 | |
| *** markvoelker has quit IRC | 09:14 | |
| *** henrynash has joined #openstack-keystone | 09:16 | |
| *** ChanServ sets mode: +v henrynash | 09:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 09:16 |
| *** jistr has joined #openstack-keystone | 09:16 | |
| *** lhcheng has quit IRC | 09:16 | |
| *** karimb has joined #openstack-keystone | 09:18 | |
| *** wanghong is now known as wanghong|away | 09:19 | |
| *** wanghong|away has quit IRC | 09:26 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 09:30 |
| *** obutenko has joined #openstack-keystone | 09:45 | |
| *** chlong has quit IRC | 09:49 | |
| *** davechen has quit IRC | 09:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 09:56 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 09:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 10:01 |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 10:05 |
| *** MasterPiece has joined #openstack-keystone | 10:09 | |
| *** markvoelker has joined #openstack-keystone | 10:11 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 10:11 |
| *** dims__ has joined #openstack-keystone | 10:12 | |
| *** markvoelker has quit IRC | 10:15 | |
| *** dims__ has quit IRC | 10:17 | |
| *** karimb has quit IRC | 10:21 | |
| *** bdossant has joined #openstack-keystone | 10:25 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 10:29 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 10:32 |
| *** henrynash has quit IRC | 10:33 | |
| *** lhcheng has joined #openstack-keystone | 10:39 | |
| *** amakarov_away is now known as amakarov | 10:44 | |
| *** erkules_ is now known as erkules | 10:48 | |
| *** karimb has joined #openstack-keystone | 10:51 | |
| *** markvoelker has joined #openstack-keystone | 11:12 | |
| *** dims__ has joined #openstack-keystone | 11:12 | |
| *** lhcheng has quit IRC | 11:12 | |
| *** markvoelker has quit IRC | 11:16 | |
| *** jacer_huawei has joined #openstack-keystone | 11:27 | |
| *** aix has joined #openstack-keystone | 11:27 | |
| *** karimb has quit IRC | 11:30 | |
| *** karimb has joined #openstack-keystone | 11:33 | |
| *** aix has quit IRC | 11:38 | |
| *** dims__ has quit IRC | 12:01 | |
| *** dims__ has joined #openstack-keystone | 12:02 | |
| *** aix has joined #openstack-keystone | 12:04 | |
| *** dims__ has quit IRC | 12:06 | |
| *** dims__ has joined #openstack-keystone | 12:07 | |
| *** markvoelker has joined #openstack-keystone | 12:13 | |
| *** htruta has quit IRC | 12:15 | |
| *** lsmola has joined #openstack-keystone | 12:16 | |
| *** markvoelker has quit IRC | 12:17 | |
| *** htruta has joined #openstack-keystone | 12:19 | |
| *** dims__ has quit IRC | 12:32 | |
| raildo | ajayaa, hi | 12:39 |
| ajayaa | raildo , hi. | 12:39 |
| ajayaa | I assume that you saw my question. | 12:39 |
| raildo | ajayaa, Domains continue will be the container of users | 12:40 |
| raildo | we will not change that | 12:40 |
| raildo | We are just add the possibility to create users in root domains and now in projects with the domains features | 12:40 |
| ajayaa | So basically, in the new terminology, root of a project is an owner of all users. | 12:40 |
| raildo | ajayaa, so you can distribute your users in the hierarchy instead all users in one single domain | 12:41 |
| ajayaa | The column name there I am assuming in user table would be renamed to root_project(or something similar) | 12:42 |
| ajayaa | There is a column called domain_id in project and user table. | 12:42 |
| raildo | ajayaa, hum... for now, we will not change this. | 12:42 |
| raildo | users keeps owned by a domain... we are not removing domain... we are just change how the Keystone storage a domain | 12:44 |
| ajayaa | raildo, got that. | 12:44 |
| raildo | ajayaa, now domain is a project with a flag "is_domain" = True.... | 12:44 |
| ajayaa | raildo, well I was hoping that there would be no namespace for users and authentication would happen with user_id instead of name. | 12:45 |
| raildo | ajayaa, but for the API and the other features, this is a normal domain... we can create users, groups, use domain specific backend, feedration.... | 12:45 |
| ajayaa | But that is a major change. | 12:45 |
| raildo | ajayaa, I think that is out of scope in our change... but we can discuss this for the next release :) | 12:46 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Re-use list_role_assignments wherever is possible https://review.openstack.org/155733 | 12:47 |
| ajayaa | raildo, Is there a flag in db called 'is_domain' in project table? | 12:48 |
| raildo | ajayaa, We will create this flag :) | 12:49 |
| raildo | ajayaa, in fact, I intend send a patch today with this change | 12:49 |
| ajayaa | raildo, You could just check for domains with "give me all the projects where project_id is null". | 12:53 |
| ajayaa | Are we differentiating between a root project and domain? | 12:53 |
| *** jaosorior has joined #openstack-keystone | 12:57 | |
| samueldmq | morning | 12:58 |
| samueldmq | dstanek, ping - there is a patch with 2x +2 waiting for you to see the latest changes :-) | 12:58 |
| samueldmq | dstanek, https://review.openstack.org/#/c/144544 | 12:58 |
| ajayaa | raildo, there? | 13:00 |
| samueldmq | ajayaa, sorry he just needed to go afk for a bit (grabbing a coffe) ... | 13:00 |
| samueldmq | coffee* | 13:00 |
| ajayaa | samueldmq, Okay. np | 13:01 |
| ajayaa | Do you sit in the same office? | 13:01 |
| samueldmq | ajayaa, yes, we're like 1.5 meter away | 13:02 |
| ajayaa | cool | 13:02 |
| samueldmq | :-) | 13:02 |
| dstanek | samueldmq: so link vs. url? why the change? | 13:04 |
| *** bdossant_ has joined #openstack-keystone | 13:07 | |
| *** markvoelker has joined #openstack-keystone | 13:10 | |
| *** bdossant has quit IRC | 13:11 | |
| raildo | ajayaa, I'm back now, sorry. | 13:11 |
| ajayaa | raildo, np man. | 13:11 |
| raildo | ajayaa, do you read the reseller spec? | 13:12 |
| ajayaa | I read a bunch of spec related to hmt. Is it in Juno? | 13:13 |
| *** dims__ has joined #openstack-keystone | 13:13 | |
| raildo | ajayaa, no, its a new spec, for kilo. just one minute | 13:14 |
| raildo | ajayaa, https://review.openstack.org/#/c/139824/29/specs/kilo/reseller.rst | 13:14 |
| ajayaa | raildo, Thanks man. I will read it. | 13:15 |
| raildo | ajayaa, and that is some more clarifications here: http://raildo.me/hierarchical-multitenancy-in-openstack/ | 13:15 |
| raildo | ajayaa, no problem, any questions I'm available. | 13:16 |
| *** dims___ has joined #openstack-keystone | 13:16 | |
| ajayaa | I saw your blog post earlier. It has undergone modification, I think. :) | 13:16 |
| *** atiwari has joined #openstack-keystone | 13:17 | |
| raildo | ajayaa, yes... I need to write other :) | 13:17 |
| raildo | ajayaa, I think here its more clean, to read the spec https://github.com/openstack/keystone-specs/blob/master/specs/kilo/reseller.rst | 13:17 |
| *** atiwari has quit IRC | 13:17 | |
| *** dims__ has quit IRC | 13:17 | |
| ajayaa | Somebody should make gerrit understand rst. | 13:19 |
| *** EmilienM|afk is now known as EmilienM | 13:19 | |
| *** ccard has quit IRC | 13:24 | |
| *** ccard has joined #openstack-keystone | 13:28 | |
| *** henrynash has joined #openstack-keystone | 13:30 | |
| *** ChanServ sets mode: +v henrynash | 13:30 | |
| *** mzbik has quit IRC | 13:36 | |
| *** bdossant has joined #openstack-keystone | 13:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use subunit-trace from tempest-lib https://review.openstack.org/145607 | 13:47 |
| *** htruta has quit IRC | 13:47 | |
| *** karimb has quit IRC | 13:48 | |
| *** karimb has joined #openstack-keystone | 13:48 | |
| *** bdossant_ has quit IRC | 13:49 | |
| *** ajayaa has quit IRC | 13:53 | |
| *** pnavarro is now known as pnavarro|mtg | 13:58 | |
| *** htruta has joined #openstack-keystone | 14:05 | |
| *** radez_g0n3 is now known as radez | 14:15 | |
| *** krykowski has quit IRC | 14:19 | |
| *** karimb has quit IRC | 14:22 | |
| *** david-lyle_afk is now known as david-lyle | 14:22 | |
| *** richm has joined #openstack-keystone | 14:23 | |
| *** joesavak has joined #openstack-keystone | 14:34 | |
| openstackgerrit | Dirk Mueller proposed openstack/python-keystoneclient: Avoid message concatenation in error path https://review.openstack.org/155758 | 14:37 |
| *** abhirc has joined #openstack-keystone | 14:40 | |
| openstackgerrit | Merged openstack/keystone: Improve creation of expected assignments in tests https://review.openstack.org/144544 | 14:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 14:45 |
| openstackgerrit | Merged openstack/keystone: Fix error message on check on RoleV3 https://review.openstack.org/144702 | 14:47 |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 14:47 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 14:49 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 14:51 |
| *** stevemar has joined #openstack-keystone | 14:54 | |
| *** ChanServ sets mode: +v stevemar | 14:54 | |
| *** r-daneel has joined #openstack-keystone | 15:00 | |
| bknudson | we have to decide whether we're going to do https://review.openstack.org/#/c/155531/ or something else for functional testing, because if it's not merged quickly it's going to be constant rebasing. | 15:01 |
| henrynash | bknduson: (aside): when you have a momentm I responded to your comment on https://review.openstack.org/#/c/151930/ | 15:06 |
| stevemar | bknudson, doesn't dstanek have a similar patch | 15:08 |
| *** topol has joined #openstack-keystone | 15:08 | |
| *** ChanServ sets mode: +v topol | 15:08 | |
| *** marg7175 has joined #openstack-keystone | 15:09 | |
| henrynash | bknudson: also, what’s teh thinking behind the /unit/unit/ naming.... | 15:10 |
| *** ayoung_ZZZzzzZZZ is now known as ayoung | 15:10 | |
| bknudson | henrynash: in nova, python-keystoneclient, etc., the unit tests are in nova.tests.unit , and the funcational tests are in nova.tests.functional | 15:11 |
| bknudson | this is so it's easy to have a tox env for functional tests that runs the tests in nova.tests.funcational | 15:12 |
| bknudson | henrynash: I don't see the point to cleaning up a comment when the comment is just going to be made redundant. | 15:12 |
| henrynash | bknudson: no issue with moving things to unit….it just looks odd to have /unit/unit/ in the path | 15:13 |
| *** marg7175 has quit IRC | 15:13 | |
| bknudson | henrynash: I agree with unit.unit... I can move things around in the current patch or propose a separate patch to move things out of unit.unit. | 15:13 |
| bknudson | (or anyone could propose a patch to move things around) | 15:13 |
| *** MasterPiece has quit IRC | 15:14 | |
| *** MasterPiece has joined #openstack-keystone | 15:15 | |
| *** dims___ is now known as dimsum__ | 15:15 | |
| henrynash | bknudson: so let’s only move things once….the rebasing is bad enough as it is…. | 15:15 |
| bknudson | henrynash: ok, I can work on getting rid of unit.unit. | 15:16 |
| henrynash | bbknudson: ok… | 15:17 |
| *** samueldmq is now known as samueldmq-away | 15:18 | |
| dstanek | unit.unit? | 15:18 |
| bknudson | dstanek: https://review.openstack.org/#/c/155531/ has unit.unit | 15:19 |
| bknudson | keystoneclient.tests.unit.unit | 15:19 |
| bknudson | since all the existing tests are moved wholesale into keystoneclient.tests.unit | 15:19 |
| dstanek | what's the point of that? | 15:19 |
| bknudson | it was easy to git mv everything and then the plan was to clean it up in separate commits. | 15:20 |
| dstanek | couldn't you just 'git mv keystoneclient/tests/*py keystoneclient/tests/unit/'? | 15:20 |
| bknudson | there are directories in keystone.tests that are only unit-test related. | 15:21 |
| bknudson | I could try keystoneclient/tests/*py instead. | 15:22 |
| dstanek | or do what you did and follow it up with a 'git mv unit/unit/ unit/' | 15:22 |
| dstanek | we have enough cores here that we can push this through quickly | 15:23 |
| bknudson | let me just try to rebase it as it is then. | 15:24 |
| bknudson | moving unit.unit tests back shouldn't be as disruptive. | 15:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 15:25 |
| bknudson | it's only gerrit that had a problem with merge conflict resolution. | 15:25 |
| stevemar | thanks dolphm | 15:26 |
| bknudson | we could probably have a separate directory for the "live" tests, next to unit and functional | 15:27 |
| bknudson | or maybe "live" tests don't fit in with the new testing model | 15:27 |
| dstanek | bknudson: what is the difference between a live test and a functional test? | 15:28 |
| *** timcline has joined #openstack-keystone | 15:28 | |
| bknudson | dstanek: the "live" tests run the unit tests against a real database... I think we've got them for the dbs and ldap. | 15:29 |
| *** avozza is now known as zz_avozza | 15:29 | |
| bknudson | probably no need for this if we have functional tests with enough coverage. | 15:30 |
| dstanek | true | 15:30 |
| *** zz_avozza is now known as avozza | 15:30 | |
| dstanek | in my ideal world the unit tests would never actually use a database - anything that needs one would be a functional test | 15:33 |
| bknudson | dstanek: we'll get there! | 15:36 |
| lbragstad | dstanek: ++ | 15:37 |
| *** carlosmarin has joined #openstack-keystone | 15:37 | |
| *** josecastroleon has joined #openstack-keystone | 15:40 | |
| *** jorge_munoz has joined #openstack-keystone | 15:41 | |
| *** mzbik has joined #openstack-keystone | 15:44 | |
| *** MasterPiece has quit IRC | 15:48 | |
| *** marg7175 has joined #openstack-keystone | 15:51 | |
| *** nkinder_sick has quit IRC | 15:51 | |
| *** josecastroleon has quit IRC | 15:52 | |
| *** marg7175 has quit IRC | 15:52 | |
| *** marg7175 has joined #openstack-keystone | 15:53 | |
| bknudson | there might actually be an infra issue causing the merge conflicts on rename... there was no merge conflict locally... I'll ask about it. | 15:53 |
| *** timcline has quit IRC | 15:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Create functional test base https://review.openstack.org/155543 | 15:56 |
| openstackgerrit | Merged openstack/keystone: remove the unused variables in indentity/core.py https://review.openstack.org/155247 | 15:57 |
| *** MasterPiece has joined #openstack-keystone | 15:57 | |
| *** timcline has joined #openstack-keystone | 16:01 | |
| *** mflobo has quit IRC | 16:01 | |
| *** cyeoh has quit IRC | 16:10 | |
| openstackgerrit | Merged openstack/keystone: Integrate logging with the warnings module https://review.openstack.org/143188 | 16:11 |
| *** topol has quit IRC | 16:12 | |
| *** bknudson has quit IRC | 16:12 | |
| *** cyeoh has joined #openstack-keystone | 16:13 | |
| *** topol has joined #openstack-keystone | 16:14 | |
| *** ChanServ sets mode: +v topol | 16:14 | |
| *** marg7175 has quit IRC | 16:15 | |
| openstackgerrit | Merged openstack/keystone: Log exceptions safely https://review.openstack.org/153029 | 16:16 |
| *** marg7175 has joined #openstack-keystone | 16:16 | |
| *** thedodd has joined #openstack-keystone | 16:20 | |
| *** MasterPiece has quit IRC | 16:20 | |
| *** MasterPiece has joined #openstack-keystone | 16:24 | |
| *** timcline has quit IRC | 16:25 | |
| *** timcline has joined #openstack-keystone | 16:26 | |
| *** radez is now known as radez_g0n3 | 16:27 | |
| *** bknudson has joined #openstack-keystone | 16:27 | |
| *** ChanServ sets mode: +v bknudson | 16:27 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 16:30 |
| *** bdossant_ has joined #openstack-keystone | 16:32 | |
| *** bdossant_ has quit IRC | 16:33 | |
| *** bdossant_ has joined #openstack-keystone | 16:34 | |
| *** zzzeek has joined #openstack-keystone | 16:35 | |
| *** pnavarro|mtg is now known as pnavarro|afk | 16:36 | |
| *** bdossant has quit IRC | 16:36 | |
| stevemar | dolphm is alive! | 16:37 |
| bknudson | things are so much better when dolphm is here. | 16:38 |
| openstackgerrit | Merged openstack/python-keystoneclient: Make remove_service_catalog private https://review.openstack.org/154334 | 16:38 |
| *** bdossant_ has quit IRC | 16:42 | |
| stevemar | bknudson, things are better when there are more people :D | 16:44 |
| *** timcline_ has joined #openstack-keystone | 16:45 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 16:46 |
| bknudson | turns out the merge conflicts caused by renaming files aren't that big of a deal... it's only gerrit's merging that has a problem with it. | 16:46 |
| stevemar | bknudson, it's that damn birds fault again | 16:48 |
| *** _cjones_ has joined #openstack-keystone | 16:48 | |
| *** timcline has quit IRC | 16:48 | |
| bknudson | stevemar: why does that stupid bird get its picture in gerrit and nobody else does. | 16:49 |
| stevemar | bknudson, we should all get little logos | 16:53 |
| *** afazekas_ has quit IRC | 16:53 | |
| dstanek | weird that they tests even exist https://review.openstack.org/#/c/144946/1/keystone/tests/test_associate_project_endpoint_extension.py | 16:53 |
| *** MasterPiece has quit IRC | 16:55 | |
| *** EmilienM is now known as EmilienM|afk | 16:56 | |
| openstackgerrit | Merged openstack/pycadf: Add deprecation message to Audit API https://review.openstack.org/154721 | 16:57 |
| *** MasterPiece has joined #openstack-keystone | 17:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 17:03 |
| *** radez_g0n3 is now known as radez | 17:03 | |
| openstackgerrit | Merged openstack/keystone: Fix evaluation logic of federation mapping rules https://review.openstack.org/151109 | 17:04 |
| openstackgerrit | Merged openstack/keystone: Don't try to convert LDAP attributes to boolean https://review.openstack.org/154722 | 17:05 |
| openstackgerrit | Merged openstack/keystone: Add new "RoleAssignment" exception https://review.openstack.org/133628 | 17:05 |
| openstackgerrit | Merged openstack/keystone: Update policy doc to use new rule format https://review.openstack.org/155136 | 17:05 |
| *** MasterPiece has quit IRC | 17:10 | |
| openstackgerrit | Merged openstack/keystone: Don't coerce port config values https://review.openstack.org/153872 | 17:10 |
| openstackgerrit | Merged openstack/keystone: Add local rules in the federation mapping tests. https://review.openstack.org/154916 | 17:11 |
| *** stevemar has quit IRC | 17:11 | |
| openstackgerrit | Merged openstack/keystone: Updates Python3 requirements https://review.openstack.org/130579 | 17:12 |
| breton | it's that merges time again | 17:12 |
| openstackgerrit | Merged openstack/keystone: Adds a fork of python-ldap for Py3 testing https://review.openstack.org/95827 | 17:18 |
| openstackgerrit | Merged openstack/keystone: Use subunit-trace from tempest-lib https://review.openstack.org/145607 | 17:19 |
| openstackgerrit | Merged openstack/keystone: Remove unused testscenarios requirement https://review.openstack.org/136940 | 17:19 |
| *** gyee has joined #openstack-keystone | 17:22 | |
| *** ChanServ sets mode: +v gyee | 17:22 | |
| ayoung | OK....this is still stupid. WHen we install, to avoid breaking old clients, we need AUTH_URL to end with V2.0 can we please make it so we ignore this from the client? And default the client to using v3 api? | 17:23 |
| ayoung | Its an RDO install, but Its Juno...not that old | 17:23 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 17:23 |
| *** ekarlso has quit IRC | 17:25 | |
| *** ekarlso has joined #openstack-keystone | 17:25 | |
| openstackgerrit | Merged openstack/keystone: Small cleanup of cloudsample policy https://review.openstack.org/155192 | 17:26 |
| openstackgerrit | Merged openstack/keystone: Refactor _send_audit_notification https://review.openstack.org/151551 | 17:27 |
| *** alex_xu_ has joined #openstack-keystone | 17:30 | |
| *** xu_alex has quit IRC | 17:32 | |
| morganfainberg | ayoung, didn't jamielennox do work to "fix" that? | 17:33 |
| ayoung | morganfainberg, maybe the common client doesn't honor that? There are enough other things that need to be set that it really is kindof minor. Horizon does handle it, which is the most important, I guess | 17:34 |
| ayoung | morganfainberg, I'm redoing horizon.younglogic.net | 17:34 |
| ayoung | I'lll have LDAP in a separate domain in a moment | 17:34 |
| *** lhcheng has joined #openstack-keystone | 17:36 | |
| *** jistr has quit IRC | 17:41 | |
| *** jacer_huawei has quit IRC | 17:42 | |
| *** lsmola has quit IRC | 17:42 | |
| *** harlowja_away is now known as harlowja_ | 17:48 | |
| *** stevemar has joined #openstack-keystone | 17:54 | |
| *** ChanServ sets mode: +v stevemar | 17:54 | |
| openstackgerrit | Merged openstack/keystone: Remove excess brackets in exception creation https://review.openstack.org/155351 | 17:55 |
| *** MasterPiece has joined #openstack-keystone | 17:55 | |
| *** spandhe has joined #openstack-keystone | 18:00 | |
| morganfainberg | ayoung: cool. | 18:02 |
| *** amakarov is now known as amakarov_away | 18:08 | |
| *** jaosorior has quit IRC | 18:21 | |
| *** tqtran has joined #openstack-keystone | 18:22 | |
| *** jaosorior has joined #openstack-keystone | 18:29 | |
| *** EmilienM|afk is now known as EmilienM | 18:32 | |
| dstanek | who does Dave Chen work for? | 18:32 |
| *** aix has quit IRC | 18:34 | |
| *** ccard has quit IRC | 18:35 | |
| morganfainberg | dstanek, intel? | 18:35 |
| dstanek | morganfainberg: yeah, just found him http://www.openstack.org/community/members/profile/24622 | 18:35 |
| morganfainberg | dstanek: wei.d.chen@intel.com on his proposed patches | 18:36 |
| openstackgerrit | Merged openstack/keystone: make federation part of keystone core https://review.openstack.org/153815 | 18:41 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup tests to not set multiple workers. https://review.openstack.org/151511 | 18:49 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move eventlet server options to a config section https://review.openstack.org/130962 | 18:49 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 18:50 |
| gyee | morganfainberg, I am still on the hook to more endpoint filtering to core right? | 18:53 |
| gyee | s/more/move | 18:53 |
| morganfainberg | gyee, collapse the SQL catalog drivers | 18:54 |
| morganfainberg | gyee, iirc | 18:54 |
| gyee | k, on it | 18:54 |
| morganfainberg | gyee, and make endpoint filtering core / not an extension | 18:54 |
| *** MasterPiece has quit IRC | 18:54 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Regenerate sample config file https://review.openstack.org/152563 | 18:54 |
| lbragstad | ayoung: loc doubled? https://review.openstack.org/#/c/138519/7 | 18:54 |
| gyee | morganfainberg, you got it sir | 18:54 |
| morganfainberg | gyee, but the collapse of the drivers is the important part | 18:54 |
| gyee | you want two separate reviews then? | 18:55 |
| morganfainberg | gyee, so move logic from the extesnion sql_driver to the base sql driver and make the extension sql driver just be a deprecated reference to the main one | 18:55 |
| morganfainberg | gyee, yes please | 18:55 |
| gyee | k man | 18:55 |
| morganfainberg | gyee, should help keep loc count down and reviewability up | 18:55 |
| gyee | k | 18:55 |
| morganfainberg | stevemar, ping: see my comment on https://review.openstack.org/#/c/154742/ and let me know if i'm crazy | 18:57 |
| morganfainberg | dolphm, lbragstad, ping re: AE Token Spec. | 18:59 |
| lbragstad | morganfainberg: dolphm o/ | 19:00 |
| morganfainberg | lbragstad, dolphm, any news on addressing the federation issue and requesting an SPFE? | 19:00 |
| lbragstad | yeah, that's next on my list. | 19:00 |
| lbragstad | morganfainberg: I'm just wrapping up some reviews | 19:00 |
| morganfainberg | the SPFE is *really* important to send ASAP if you want it | 19:00 |
| *** MasterPiece has joined #openstack-keystone | 19:01 | |
| morganfainberg | the fixing the spec can come after that request is sent. | 19:01 |
| morganfainberg | just outline what is outstanding to unblock the spec | 19:01 |
| morganfainberg | and please include reference to the POC code you have. | 19:01 |
| lbragstad | the only thing I see as blocking is the federation case | 19:01 |
| lbragstad | but I can work on drafting something up | 19:01 |
| morganfainberg | yes, please do not wait on the sPFE email | 19:02 |
| morganfainberg | if we dont except it soon i don't see it happening in kilo | 19:02 |
| lbragstad | ok | 19:02 |
| morganfainberg | we are really running out of time for m3 code. | 19:03 |
| morganfainberg | so let me rephrase it, i wont consider the exception unless we have the email today ;) | 19:03 |
| morganfainberg | even if the spec needs an update before it's approved. you have working code - that makes granting the exception easier | 19:03 |
| lbragstad | sure, I'll get something rolling | 19:03 |
| *** radez is now known as radez_g0n3 | 19:04 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/147367 | 19:05 |
| *** mzbik_ has joined #openstack-keystone | 19:06 | |
| *** abhirc has quit IRC | 19:08 | |
| *** mzbik has quit IRC | 19:09 | |
| *** stevemar has quit IRC | 19:13 | |
| ayoung | lbragstad, mostly due to tests, but also service catalog work. There is a lot of hacckishness in that patch to deal with backwards compat, and I expect a lot of shouting from jamielennox about it | 19:13 |
| lbragstad | ayoung: ok | 19:14 |
| ayoung | morganfainberg, I think we've painted ourselves into a corner with LDAP and multi-domain. I have a new domain, but I have no way, using the existing tools, of assign a user to a role in that domain. I can't a-priori assign users to roles, because they have no user ids...due to our id_mapping thing | 19:14 |
| ayoung | I think we need a utility to calculate what userid a user will be assigned in a new domain | 19:15 |
| openstackgerrit | Merged openstack/keystone: Add a check to see if a federation token is being used for v2 auth https://review.openstack.org/154368 | 19:15 |
| ayoung | or group id, even | 19:16 |
| *** radez_g0n3 is now known as radez | 19:16 | |
| morganfainberg | ayoung, not painted into a corner, just need a little extra code to solve it ;) | 19:16 |
| ayoung | morganfainberg, need to wait for the paint to dry | 19:16 |
| morganfainberg | ayoung, so we need a minor enhancement to the mapping/assignemnt bits to make it possible | 19:17 |
| morganfainberg | ayoung, shouldn't be too onerous to write | 19:17 |
| ayoung | yes, but we don't have it today. | 19:18 |
| morganfainberg | ayoung, worth classifying it as a bug and considering it for backport to juno - it should be something we can address via the API not need something totally new for | 19:18 |
| ayoung | THe nice thing is that it can be done out of tree to start | 19:18 |
| morganfainberg | ayoung, probably doesn't need to be out-of-tree fwiw | 19:19 |
| ayoung | to start..meaning I can write a utility that people can use now | 19:19 |
| ayoung | lets see... | 19:19 |
| morganfainberg | since this is a real feature for juno, this feels like a bug not a new feature fwiw | 19:19 |
| ayoung | we just need this one: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/id_generators/sha256.py | 19:20 |
| morganfainberg | the question is can we bake that into the API. | 19:20 |
| morganfainberg | s/./? | 19:20 |
| bknudson | 2015-02-13 13:20:33.632 INFO eventlet.wsgi.server [-] 192.168.122.176 - - [13/Feb/2015 13:20:33] "GET /v2.0/OS-KSADM/services/keystone HTTP/1.1" 404 252 0.010220 | 19:21 |
| bknudson | something in devstack is still using v2 | 19:21 |
| morganfainberg | bknudson, makes me cry a little | 19:21 |
| morganfainberg | bknudson, or a lot | 19:21 |
| morganfainberg | bknudson, not sure... | 19:22 |
| bknudson | let's cry a lot | 19:22 |
| morganfainberg | bknudson, sounds good to me | 19:22 |
| bknudson | someone was asking me if the "owner" rule really has any effect in "identity:check_token", validate_token, validate_token_head, and revoke_token... so will be digging into that. | 19:23 |
| lbragstad | bknudson: I just saw a review that was using something with respect to that | 19:24 |
| *** htruta has quit IRC | 19:24 | |
| lbragstad | bknudson: something to do with the credential api and non-owners being able to grab credentials even though they weren't the owner? Something like that | 19:24 |
| bknudson | lbragstad: yes, I think there's a review up for that... didn't look into it closely yet. | 19:25 |
| *** ctina has joined #openstack-keystone | 19:26 | |
| bknudson | if I get a token as admin I can delete the token using the token, but if I get a token as a regular user I can't delete the token using the token. | 19:31 |
| bknudson | seems like I should always be able to delete the token using the token | 19:31 |
| *** stevemar has joined #openstack-keystone | 19:33 | |
| *** ChanServ sets mode: +v stevemar | 19:33 | |
| *** ctina has quit IRC | 19:34 | |
| bknudson | looks like the policy should be user_id:%(target.token.user_id)s | 19:36 |
| *** saltsa has quit IRC | 19:37 | |
| *** jacer_huawei has joined #openstack-keystone | 19:43 | |
| *** saltsa has joined #openstack-keystone | 19:44 | |
| *** carlosmarin has quit IRC | 19:46 | |
| *** carlosmarin has joined #openstack-keystone | 19:46 | |
| bknudson | Another option is we could put the x-subject-token values in the context as "user", rather than as "target.token.user_id". | 19:48 |
| openstackgerrit | Merged openstack/keystone: Add schema for endpoint group https://review.openstack.org/150292 | 19:51 |
| *** radez is now known as radez_g0n3 | 19:51 | |
| openstackgerrit | Merged openstack/keystone: Minor fix in RestfulTestCase https://review.openstack.org/147361 | 20:00 |
| *** MasterPiece has quit IRC | 20:04 | |
| ayoung | morganfainberg, something like http://paste.openstack.org/show/173162/ | 20:07 |
| morganfainberg | ayoung, that looks about right. | 20:07 |
| morganfainberg | without testing it of course | 20:07 |
| ayoung | morganfainberg, I'll test it here shortly. | 20:11 |
| ayoung | morganfainberg, a utility that requests an unscoped token for a user would do the same thing. | 20:12 |
| morganfainberg | right | 20:13 |
| ayoung | hand in domain name and user name and get back the userid. But that means my set up is not right | 20:13 |
| ayoung | wait...I'm trying for a domain scoped token.... | 20:13 |
| ayoung | nope | 20:14 |
| *** diegows has joined #openstack-keystone | 20:18 | |
| *** MasterPiece has joined #openstack-keystone | 20:18 | |
| lhcheng | morganfainberg, ping: do you think we should fix https://bugs.launchpad.net/keystone/+bug/1156298 ? It has been there for awhile, just wanted to confirm I start working on it. | 20:24 |
| openstack | Launchpad bug 1156298 in Keystone "templated Catalog backend does not support listing services or endpoints" [Medium,Confirmed] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 20:24 |
| morganfainberg | lhcheng, looking | 20:24 |
| morganfainberg | hm. | 20:24 |
| morganfainberg | i mean - we kindof need our catalog to be the same regardless of the backend | 20:25 |
| lhcheng | morganfainberg: I agree | 20:25 |
| morganfainberg | so i'd say yes.. we do need to support that/fix it | 20:25 |
| morganfainberg | however *** it's been broken for a looong time. | 20:25 |
| morganfainberg | so lets be careful we don't break peiople using the templated catalog in the process of fixing this | 20:26 |
| lhcheng | morganfainberg: heh that's why I wondered if this should still be fix since it's been sitting there for a loong time | 20:26 |
| morganfainberg | yep | 20:26 |
| morganfainberg | the key is to ensure we don't break people in the process of fixing this | 20:27 |
| morganfainberg | bug | 20:27 |
| lhcheng | morganfainberg: sure, will definitely be on the lookout for that | 20:27 |
| morganfainberg | gyee, was https://bugs.launchpad.net/keystone/+bug/1409635 fixed with the other bug fix that referenced the DIT? | 20:28 |
| openstack | Launchpad bug 1409635 in Keystone "keystone fails to authenticate users when LDAP project_id_attribute is not CN" [Undecided,New] - Assigned to Adam Young (ayoung) | 20:28 |
| lhcheng | morganfainberg: thanks for checking | 20:28 |
| ayoung | not doing anything for assignment in ldap | 20:28 |
| morganfainberg | gyee, nkinder, ayoung, bknudson, ping re: https://bugs.launchpad.net/keystone/+bug/1408845 | 20:28 |
| openstack | Launchpad bug 1408845 in Keystone "Disabling user in ldap breaks user-list for project" [Undecided,New] | 20:28 |
| ayoung | nkinder is out with pewmonia | 20:29 |
| *** timcline_ has quit IRC | 20:29 | |
| morganfainberg | ayoung, doh, that was LDAP assignment, yeah gonna smuch that other bug | 20:29 |
| *** lhcheng is now known as lhcheng_afk | 20:29 | |
| morganfainberg | ^^ that disabled user in ldap looks like an issue | 20:29 |
| morganfainberg | though | 20:29 |
| *** timcline has joined #openstack-keystone | 20:29 | |
| ayoung | user_project_metadata? that might be old... | 20:29 |
| morganfainberg | yeah | 20:30 |
| *** lnxnut has joined #openstack-keystone | 20:33 | |
| morganfainberg | ayoung, i unassigned you from that bug (the LDAP assignment one) so it can time out if the answers to my questions are "yep we'll move to SQL assignment" | 20:34 |
| morganfainberg | if it's assigned to anyone it wont auto-timeout | 20:35 |
| morganfainberg | (yay LP wierdness) | 20:35 |
| morganfainberg | stevemar, ping: re https://bugs.launchpad.net/keystone/+bug/1420688 | 20:36 |
| openstack | Launchpad bug 1420688 in Keystone "keystone notification context is empty" [Undecided,New] | 20:36 |
| morganfainberg | stevemar, can you confirm / look into that please | 20:36 |
| stevemar | morganfainberg, i can confirm that it's correct | 20:36 |
| bknudson | https://review.openstack.org/#/c/155531/ -- would be nice to get merged so we can make progress on functional testing, and also so I don't have to rebase all the time. | 20:36 |
| bknudson | gerrit's auto-rebase is weak. | 20:36 |
| morganfainberg | bknudson, looking | 20:36 |
| stevemar | morganfainberg, the 'basic' notifications, the ones we've been emiting for a while, the context was always set to {} for some unknown silly reason | 20:37 |
| morganfainberg | stevemar, feel free to say the cadf notifications will solve it and close it | 20:37 |
| morganfainberg | stevemar, or classify/prioritize the bug. | 20:37 |
| morganfainberg | bknudson, +2 that was an easy review btw | 20:38 |
| stevemar | morganfainberg, oh i remember why, people were complaining that the context is too big to send all the way to the manager layer | 20:38 |
| bknudson | morganfainberg: that's the goal, easy reviews. | 20:39 |
| *** radez_g0n3 is now known as radez | 20:39 | |
| morganfainberg | bknudson, looks like stevemar +3'd it | 20:39 |
| bknudson | progress! | 20:39 |
| stevemar | bknudson, so whats the deal with 'this doesn't look like core to me' https://review.openstack.org/#/c/153842/ | 20:40 |
| *** abhirc has joined #openstack-keystone | 20:40 | |
| stevemar | bknudson, i think that's what morganfainberg wanted with his 'replace extensions' spec | 20:40 |
| bknudson | stevemar: I don't see how something is core if someone can just remove it from the paste pipeline. | 20:41 |
| morganfainberg | bknudson, so someone could remove assignment from the pipeline | 20:41 |
| stevemar | bknudson, oh, i suppose thats true | 20:41 |
| morganfainberg | bknudson, :P | 20:41 |
| *** lnxnut has quit IRC | 20:41 | |
| bknudson | how can you remove assignment from the pipeline? | 20:41 |
| morganfainberg | bknudson, it's just routers. | 20:41 |
| stevemar | morganfainberg, i don't think you can remove assignment | 20:41 |
| *** lnxnut has joined #openstack-keystone | 20:41 | |
| stevemar | but i know what you mean | 20:41 |
| morganfainberg | you *could* | 20:41 |
| morganfainberg | it doens't mean keystone would work | 20:42 |
| stevemar | maybe call it 'enable endpoint filter and endpoint policy by default :)' | 20:42 |
| morganfainberg | bknudson, the way i see this working is step 1) enable things by default, 2) migrate things out of contrib | 20:42 |
| morganfainberg | bknudson, if some verbiage changes are needed i'm sure we can accomodate it | 20:42 |
| bknudson | If we documented somewhere that the "endpoint_policy_extension", etc., MUST be in the paste pipeline and the server failed to start without it then I'd be fine with the change. | 20:43 |
| *** lnxnut_ has joined #openstack-keystone | 20:43 | |
| morganfainberg | bknudson, long term that stuff should just be merged into the main systems they were "Extending" | 20:43 |
| morganfainberg | bknudson, federation being the slightly wierd one because it's sortof-somewhere intwined with a lot of things | 20:43 |
| morganfainberg | same with revoke_api | 20:44 |
| bknudson | morganfainberg: and that's what I consider "Include other stable extensions in core", but until then the stable extensions aren't in core. | 20:44 |
| bknudson | we can call them "required extensions" | 20:44 |
| morganfainberg | bknudson, so, mark this as "enable by default" and the next step is merging them which = include in core | 20:44 |
| morganfainberg | just as the 2-step process to make sure we're not doing massive restructuring and turning on default behavior at once | 20:45 |
| morganfainberg | bknudson, that sound like a sane plan ? | 20:45 |
| morganfainberg | stevemar, ^^ | 20:45 |
| bknudson | morganfainberg: yes, I'm fine with that. | 20:45 |
| morganfainberg | bknudson, cool :) | 20:45 |
| stevemar | morganfainberg, bknudson i'm totally against it | 20:46 |
| morganfainberg | stevemar, shhh | 20:46 |
| stevemar | :D | 20:46 |
| stevemar | bknudson, yeah it was always meant to be a 2 step process | 20:46 |
| stevemar | we'll pull them out of contrib soon | 20:46 |
| bknudson | what's the second step if they're already core? | 20:46 |
| *** lnxnut has quit IRC | 20:46 | |
| bknudson | "really make them core" | 20:46 |
| morganfainberg | stevemar, bknudson, topol, jamielennox, henrynash, ayoung, dolphm, dstanek, gyee, http://lists.openstack.org/pipermail/openstack-dev/2015-February/056914.html please review and respond. | 20:46 |
| stevemar | pull the out of contrib | 20:46 |
| morganfainberg | bknudson, they should be mostly re-homed out of contrib... contrib should go away | 20:47 |
| morganfainberg | bknudson, it's a silly construct w/o extensions | 20:47 |
| stevemar | that should be the only real change left | 20:47 |
| morganfainberg | stevemar, and that'll be a 1-cycle deprecation or 2 w/ references to not break deployers | 20:47 |
| stevemar | morganfainberg, your comment here https://review.openstack.org/#/c/154742/3/oslo_policy/policy.py about oslo.policy being at 1.0.0 really confused me :P | 20:48 |
| morganfainberg | stevemar, in pypi it claimed it was 1.0.0 | 20:48 |
| stevemar | morganfainberg, da fack | 20:48 |
| morganfainberg | stevemar, yeah | 20:48 |
| morganfainberg | right?! | 20:48 |
| stevemar | i have no idea why it says that | 20:48 |
| stevemar | there are no downloads in pypi so thats okay | 20:48 |
| morganfainberg | https://pypi.python.org/pypi/oslo.policy/1.0.0 | 20:49 |
| stevemar | maybe it just defaulted to that | 20:49 |
| morganfainberg | 97 downloads this month | 20:49 |
| stevemar | hehe | 20:49 |
| * stevemar shrus | 20:49 | |
| * stevemar shrugs* | 20:49 | |
| morganfainberg | pypi is high | 20:49 |
| morganfainberg | but i based it upon that | 20:49 |
| stevemar | nah, not released yet | 20:50 |
| bknudson | am I wrong in thinking that AE tokens are going to require revocation event support/ | 20:50 |
| *** jacer_huawei has quit IRC | 20:50 | |
| bknudson | and also that it requires other work regarding refactoring the token code... | 20:51 |
| mtreinish | morganfainberg: I think it's because of all the pypi mirrors that the numbers end up high | 20:52 |
| morganfainberg | bknudson, correct | 20:52 |
| morganfainberg | bknudson, RE code is already supported in keystone, keystonemiddleware needs to support it for cached tokens | 20:52 |
| morganfainberg | bknudson, but since it's a UUID workflow w/o caching it queries keystone directly | 20:53 |
| stevemar | i imagine keystonemiddleware will some additional work for AE tokens | 20:53 |
| bknudson | morganfainberg: y, you're right... so AE doesn't require revocation events. | 20:54 |
| bknudson | could take advantage of it, I guess. | 20:54 |
| bknudson | might be a security vulnerability if it did, though... | 20:54 |
| morganfainberg | bknudson, AE doesn't require it, but def. would be better with it since it then allows caching to be properly handled in middleware | 20:54 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable endpoint_policy, endpoint_filter and oauth by default https://review.openstack.org/153842 | 20:54 |
| morganfainberg | bknudson, right now with AE tokens, caching the tokens at the endpoint in middleware = you'd miss revocations | 20:54 |
| morganfainberg | so, not a hard requirement but... realllllly should be fixed to be able to consume RE vs TRL | 20:55 |
| bknudson | you'd have to validate cached tokens against keystone... far from ideal. | 20:55 |
| bknudson | also, we didn't fix the TRL to use audit IDs. | 20:56 |
| stevemar | bknudson, i just changed the commit msg for the other extensions | 20:57 |
| bknudson | well, I would like to see AE tokens in Kilo, but have little hope that all this stuff is going to get done, especially considering there's been no progress since the summit (either on AE tokens or the prereqs). | 21:00 |
| morganfainberg | bknudson, i talked with lbragstad and re-ordering AE tokens to proceed the provider cleanup wouldn't be too bad | 21:01 |
| morganfainberg | the provider cleanup can happen afterwards as well | 21:01 |
| morganfainberg | bknudson, and lbragstad [in his email] has POC code, so i think this is doable. | 21:02 |
| morganfainberg | bknudson, in in either case please respond to the email thread w/ reasons for/against the exception [or conditions for/against accepting it] | 21:02 |
| morganfainberg | ayoung, you indicated you'd life the -2 if everyone was willing to take this on, is that still the case - and yes specifically it wouldn't be accepted unless it supported federation and all current token mechanics | 21:03 |
| bknudson | btw, I opened a bug for the sample policy and revoking / validating tokens : https://bugs.launchpad.net/keystone/+bug/1421825 | 21:03 |
| openstack | Launchpad bug 1421825 in Keystone "Sample policy should allow user to validate and revoke own token" [Undecided,New] - Assigned to Brant Knudson (blk-u) | 21:03 |
| ayoung | morganfainberg, hasn't changed | 21:03 |
| morganfainberg | ayoung, ok. cool just making sure. | 21:04 |
| ayoung | morganfainberg, I have some concerns about keyczar | 21:04 |
| morganfainberg | ayoung, i wont accept it if it doesn't meet same functionality of PKI or UUID tokens, which i think lance has addressed in the email. | 21:04 |
| morganfainberg | ayoung, ok please voice those. | 21:04 |
| ayoung | specifically, I don't think it is necessary, and I'm kindof surprised they are pursuing it | 21:04 |
| morganfainberg | ayoung, fair enough. | 21:05 |
| *** david8hu has quit IRC | 21:05 | |
| ayoung | IIUC only the keystone server needs to symmetric key, making keyczar somewhat questionable in requirement...I could see it being useful in the sync case | 21:05 |
| bknudson | Looks like Anchor is going to obsolete keystone -- https://wiki.openstack.org/wiki/Security/Projects/Anchor | 21:05 |
| ayoung | but it should not be a required piece | 21:05 |
| morganfainberg | ahahaha | 21:05 |
| bknudson | should find out more about it at the OSSG meetup | 21:06 |
| morganfainberg | bknudson, please let me know more | 21:06 |
| morganfainberg | if i wasn't elsewhere i would be very interested to have made it to OSSG | 21:06 |
| ayoung | ephemeral PKI | 21:06 |
| morganfainberg | w.t.f. does this mean: enable cryptographic trust in OpenStack services in a way that doesn't rely on broken provisioning and revocation mechanisms that undermine most PKI deployments | 21:06 |
| ayoung | revocation....heh | 21:06 |
| ayoung | it means short term PKI keys | 21:06 |
| morganfainberg | isn't that... a flaw in PKI | 21:07 |
| ayoung | if by flaw you mean logical necessity then yes | 21:07 |
| bknudson | morganfainberg: you should know rob clark. | 21:07 |
| morganfainberg | bknudson, i dont | 21:08 |
| morganfainberg | ayoung, it sounds like this is doing somewhat what certmonger is also doing? | 21:08 |
| bknudson | morganfainberg: bryan payne? | 21:08 |
| ayoung | morganfainberg, he's an HPer | 21:08 |
| morganfainberg | bknudson, i'm looking at the readme and code, not sure where it's going yet. | 21:08 |
| morganfainberg | bknudson, nope, don't know any of the names there | 21:08 |
| morganfainberg | ayoung, ^^ | 21:08 |
| bknudson | OSSG needs to get out more. | 21:08 |
| morganfainberg | ayoung, hp is also massive :P | 21:08 |
| ayoung | nkinder went to that presentation, I think | 21:09 |
| morganfainberg | bknudson, i know 2 OSSG people, you and nkinder | 21:09 |
| ayoung | I'll stay with X509 for now | 21:09 |
| bknudson | at least HP has a cloud security team, unlike just having half of me. | 21:09 |
| morganfainberg | bknudson, true. i haven't met most of them though :( | 21:09 |
| lbragstad | it you have to meet the security team, it's usually bad, right? | 21:10 |
| lbragstad | if* | 21:10 |
| bknudson | I thought nkinder was going to be at the OSSG meetup but if he's got pneumonia. | 21:10 |
| stevemar | how has no one made an 'anchors away' joke yet | 21:11 |
| bknudson | he should stay out of california or he'll get measels or polio or some other disease we thought was eradicated. | 21:12 |
| ayoung | stevemar, its an Army thing to ignore all Navy references. | 21:12 |
| gyee | morganfainberg, responded | 21:12 |
| stevemar | zing! | 21:14 |
| gyee | stevemar, good man! you made endpoint filter core | 21:15 |
| stevemar | gyee, begrudgingly | 21:16 |
| stevemar | i was none to happen about that sql migration error | 21:16 |
| stevemar | happy* | 21:16 |
| stevemar | but i reviewed the patch, so some of it is on me | 21:17 |
| gyee | we still need to consolidate the sql backend | 21:17 |
| gyee | which I'll work on | 21:17 |
| gyee | bknudson, that's because it doesn't snow around here. The cool will surly kill the measels :) | 21:19 |
| *** topol has quit IRC | 21:19 | |
| gyee | cold | 21:19 |
| openstackgerrit | Merged openstack/keystone: Cleanup tests to not set multiple workers. https://review.openstack.org/151511 | 21:19 |
| morganfainberg | ayoung, tell nkinder it is unacceptable for him to get pneumonia. | 21:25 |
| morganfainberg | ayoung, :P | 21:25 |
| ayoung | both lungs | 21:25 |
| ayoung | he was in Brno at devconf | 21:25 |
| *** timcline_ has joined #openstack-keystone | 21:26 | |
| dstanek | yay AE tokens! | 21:26 |
| morganfainberg | ayoung, yeah. | 21:26 |
| bknudson | he's probably wishing he had more fat to burn through. | 21:28 |
| *** timcline has quit IRC | 21:30 | |
| *** lnxnut_ has quit IRC | 21:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 21:31 |
| stevemar | that was not the most painful rebase, but it was up there ^ | 21:32 |
| stevemar | bknudson, dolphm ^ | 21:32 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubator version of log and local https://review.openstack.org/154783 | 21:32 |
| dolphm | stevemar: wait, let me merge this other thing first | 21:32 |
| * stevemar stabs dolphm through the computer | 21:33 | |
| bknudson | he he | 21:33 |
| morganfainberg | dolphm, it's ok bknudson's test change will force steve to rebase again | 21:33 |
| stevemar | lbragstad, can you nerf dolphm please | 21:33 |
| stevemar | morganfainberg, i know, i know... | 21:33 |
| dolphm | lbragstad: sucker, i'm in austin | 21:33 |
| stevemar | i approved it too | 21:33 |
| lbragstad | damnit! | 21:33 |
| stevemar | but i can't hold bknudson back | 21:33 |
| morganfainberg | dolphm, and i'm sure i'll approve something else between now and when i approve that rebase | 21:33 |
| morganfainberg | >.> | 21:33 |
| * morganfainberg goes to look for things to make steve rebase more | 21:34 | |
| stevemar | hopefully the jenkins bird is smarter for me than for bknudson, and will do the tests move fine | 21:34 |
| * lbragstad looks for a nerf gun that can shoot to Austin | 21:34 | |
| bknudson | do we have a bunch of log tests? | 21:35 |
| morganfainberg | lbragstad, you just need a drone that can shoot nerf that is controlled via the internet | 21:35 |
| morganfainberg | lbragstad, send it to austin office | 21:35 |
| morganfainberg | we *have* the technology | 21:35 |
| dolphm | morganfainberg: they're called predators | 21:35 |
| morganfainberg | dolphm, predators don't shoot nerf last i checked ;) | 21:36 |
| dolphm | morganfainberg: it's all in the branding | 21:36 |
| morganfainberg | ahahah | 21:36 |
| dolphm | morganfainberg: http://static.fjcdn.com/pictures/Ballistic+nerf+missile+found+this+doing+some+research+online+i_fa46b6_3538962.jpg | 21:37 |
| morganfainberg | ahahah | 21:37 |
| morganfainberg | yeaaah don't think that's really nerf :P | 21:37 |
| lbragstad | omg... | 21:38 |
| lbragstad | http://www.instructables.com/id/Nerf-longshot-50-cal/ | 21:38 |
| morganfainberg | you hasven't seen that lbragstad ? | 21:38 |
| *** lhcheng_afk is now known as lhcheng | 21:38 | |
| lbragstad | morganfainberg: my nerf knowledge is sad | 21:39 |
| dolphm | stevemar: https://review.openstack.org/#/c/152699/19/keystone/tests/unit/test_core.py | 21:41 |
| *** david-lyle has quit IRC | 21:42 | |
| *** david-lyle has joined #openstack-keystone | 21:42 | |
| ayoung | trying to debug Keystone in HTTPD from an RPM install. I'm trying to do the injection of an rpdb breakpoint. But the httpd server doesn't seem to be picking up the edited python source file. I removed the .pyc file in that directory. Where else could it be cached? | 21:43 |
| *** _cjones_ has quit IRC | 21:43 | |
| *** lnxnut has joined #openstack-keystone | 21:44 | |
| dolphm | ayoung: is keystone installed or fake installed? | 21:44 |
| morganfainberg | dolphm, fake installed? | 21:45 |
| dolphm | morganfainberg: python setup.py develop / pip install -e . | 21:45 |
| morganfainberg | ah | 21:45 |
| morganfainberg | yeah | 21:45 |
| *** stevemar has quit IRC | 21:45 | |
| *** timcline_ has quit IRC | 21:46 | |
| ayoung | dolphm, real installed....puppet | 21:46 |
| *** david-lyle has quit IRC | 21:47 | |
| dolphm | ayoung: puppet can do it either way | 21:47 |
| *** timcline has joined #openstack-keystone | 21:47 | |
| ayoung | puppet and rpm | 21:47 |
| dolphm | ayoung: it's a matter of where the source ends up living after you "install" it | 21:47 |
| ayoung | dolphm, there is a stack trace referreing to the file in /usr/lib/python27 | 21:47 |
| dolphm | ayoung: point is you might just be editing the wrong "source" file | 21:47 |
| dstanek | bknudson: it appears that subunit-trace hides errors :-) i had to edit pretty_tox.sh to find out what was happening | 21:48 |
| *** timcline has quit IRC | 21:48 | |
| ayoung | 2015-02-13 21:48:16.285 17951 TRACE keystone.auth.plugins.password File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 600, in get_user_by_name | 21:48 |
| bknudson | dstanek: revert it? maybe nova has a fix for it already? | 21:48 |
| ayoung | that is the file I am trying to edit, and I've removed the pyc file in the same directory | 21:48 |
| bknudson | or, if we can fix it then might also be able to contribute to nova. | 21:49 |
| ayoung | AHA! | 21:49 |
| ayoung | might be that systemctl restart httpd service is not the right thing | 21:49 |
| dstanek | bknudson: not sure - the problem was that i had a syntax error so testr crapped itself | 21:50 |
| ayoung | Oh no...we are still doing eventlet | 21:50 |
| ayoung | sob | 21:50 |
| bknudson | dstanek: don't have syntax errors. | 21:50 |
| morganfainberg | ayoung, wait what? | 21:50 |
| morganfainberg | you're still doing eventlet? *cry* | 21:50 |
| ayoung | Juno based RDO | 21:50 |
| bknudson | lots of crying today | 21:51 |
| morganfainberg | ayoung, double cry | 21:51 |
| ayoung | the puppet modules hadn't caught up. | 21:51 |
| bknudson | must be friday the 13th | 21:51 |
| *** _cjones_ has joined #openstack-keystone | 21:52 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move existing tests to unit https://review.openstack.org/155531 | 21:54 |
| bknudson | resolved merge conflict ^ | 21:54 |
| bknudson | (note that there was no merge conflict locally... not sure why jenkins has such a hard time) | 21:55 |
| bknudson | I think it's configured to not use all conflict resolution algos. | 21:55 |
| morganfainberg | bknudson, jgit | 21:56 |
| morganfainberg | bknudson, at least i blame jgit | 21:57 |
| bknudson | 2015-02-13T16:07:09 <fungi> bknudson: so after some futzing, it looks like it needs either the subtree or recursive merge strategies. octopus and resolve don't work | 21:58 |
| bknudson | morganfainberg: ^ is what I got back on -infra when I complained. | 21:58 |
| bknudson | I think they cripple their git merge strategies... maybe it's safer. | 21:58 |
| *** pnavarro|afk has quit IRC | 21:59 | |
| *** lnxnut has quit IRC | 21:59 | |
| morganfainberg | it probably is | 21:59 |
| morganfainberg | you can wind up in baaaaad places with wierd strategies | 21:59 |
| bknudson | any merge is dangerous without tests anyways. | 22:00 |
| *** lnxnut has joined #openstack-keystone | 22:00 | |
| ayoung | morganfainberg, OK, we're good. If a user requests a token, and they have never been into Keystone before, they get an entry in id_mapping, and a failed token request. Then you can add them | 22:03 |
| ayoung | no need for a new utility | 22:03 |
| ayoung | its a little schlocky. but it works | 22:04 |
| ayoung | OK, and I have a proof of concept LDAP in non-default-domain up and running | 22:04 |
| *** lnxnut has quit IRC | 22:04 | |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Add oslo request id middleware to keystone paste pipeline https://review.openstack.org/155901 | 22:06 |
| mtreinish | morganfainberg: ^^^ not sure if that'll work | 22:06 |
| mtreinish | also the commit msg is a mess | 22:06 |
| mtreinish | but it'll be a good test | 22:07 |
| dstanek | mtreinish: are you trying to add it to the default pipeline? | 22:19 |
| morganfainberg | mtreinish, yrah that wont actually add it to the pipeline | 22:21 |
| mtreinish | dstanek: yeah | 22:21 |
| mtreinish | ok, that's why I wasn't sure it was going to work :) | 22:21 |
| morganfainberg | mtreinish, you'd need to put it in [pipeline:api_v3] and the pipeline:public etc | 22:22 |
| morganfainberg | mtreinish, as well | 22:22 |
| dstanek | mtreinish: in that same file there are a few pipelines that are basically a list of filters - you'd have tp add it there | 22:22 |
| mtreinish | morganfainberg: ok will do | 22:22 |
| morganfainberg | so __call__ is run for the request | 22:22 |
| *** harlowja_ is now known as harlowja_away | 22:24 | |
| mtreinish | dstanek, morganfainberg: like this?: http://paste.openstack.org/show/173234/ | 22:25 |
| morganfainberg | my guess is you're going to want that before build_auth_context | 22:26 |
| morganfainberg | or just after | 22:26 |
| morganfainberg | vs at the very end | 22:26 |
| mtreinish | oh yeah I forgot that order matters :) | 22:26 |
| morganfainberg | otherwise you wont have the request id prior to hitting the other routers | 22:26 |
| mtreinish | guess it's after 5 on a friday | 22:26 |
| morganfainberg | hahaha | 22:26 |
| morganfainberg | dude, it's friday | 22:26 |
| morganfainberg | and it's been a loooong week | 22:26 |
| ayoung | morganfainberg, what do you think about the idea that if you do user list or group list with a domain specific backend you should get the entries that are in the mapped_id table? | 22:27 |
| ayoung | id_mapping table | 22:27 |
| ayoung | It will let us do limits like sql | 22:28 |
| *** harlowja_away is now known as harlowja_ | 22:28 | |
| ayoung | mtreinish, the last entry is not a filter. It has to be one before last, and after all the magic filters... | 22:29 |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Add oslo request id middleware to keystone paste pipeline https://review.openstack.org/155901 | 22:29 |
| *** gyee has quit IRC | 22:30 | |
| *** lnxnut has joined #openstack-keystone | 22:30 | |
| *** lnxnut has quit IRC | 22:31 | |
| *** gordc has quit IRC | 22:35 | |
| bknudson | it's not going to be easy to make it so that a user can invalidate their own token using v2. | 22:36 |
| bknudson | can we just leave that broken? | 22:36 |
| *** jaosorior has quit IRC | 22:41 | |
| *** radez is now known as radez_g0n3 | 22:42 | |
| morganfainberg | bknudson, how long has it been broken so far? | 22:43 |
| bknudson | morganfainberg: I assume forever. | 22:43 |
| morganfainberg | bknudson, then we can probably leave it as i | 22:44 |
| morganfainberg | s | 22:44 |
| *** jacer_huawei has joined #openstack-keystone | 22:51 | |
| bknudson | 2015-02-13 16:51:21.022 INFO keystone.common.wsgi [-] POST /endpoints?endpoint=%7Bu%27adminurl%27%3A+u%27http%3A%2F%2F192.168.122.176%3A35357%2Fv2.0%27%2C+u%27service_id%27%3A+u%2748ad0fbc3c81456daee92a8a8a54965d%27%2C+u%27region%27%3A+u%27RegionOne%27%2C+u%27internalurl%27%3A+u%27http%3A%2F%2F192.168.122.176%3A5000%2Fv2.0%27%2C+u%27publicurl%27%3A+u%27http%3A%2F%2F192.168.122.176%3A5000%2Fv2.0%27%7D | 22:53 |
| bknudson | wtf | 22:53 |
| morganfainberg | i.. | 22:53 |
| morganfainberg | wow | 22:53 |
| morganfainberg | thats awesome | 22:53 |
| morganfainberg | bknudson, wtf is right | 22:53 |
| bknudson | https://review.openstack.org/#/c/155531/ passed jenkins again. | 22:58 |
| morganfainberg | bknudson, still LGTM | 22:59 |
| *** abhirc has quit IRC | 23:01 | |
| *** abhirc has joined #openstack-keystone | 23:02 | |
| *** mzbik_ has quit IRC | 23:06 | |
| *** r-daneel has quit IRC | 23:06 | |
| *** clayg has joined #openstack-keystone | 23:08 | |
| clayg | please help me, i am *so* very stupid -> https://gist.github.com/clayg/9677d81cf17348e9a084 | 23:08 |
| *** abhirc has quit IRC | 23:08 | |
| *** junhongl has quit IRC | 23:08 | |
| clayg | i feel like it says the domain exists, but then it says it *doesn't* exist and ./devstack/stack.sh gives me a "ERROR: openstack Internal Server Error (HTTP 500)" | 23:09 |
| clayg | followed later by a "[ERROR] /home/vagrant/devstack/functions-common:642 Failure creating swift_tenant_test4" | 23:09 |
| *** joesavak has quit IRC | 23:12 | |
| *** carlosmarin has quit IRC | 23:15 | |
| *** topol has joined #openstack-keystone | 23:16 | |
| *** ChanServ sets mode: +v topol | 23:17 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy allows user to revoke or check own token https://review.openstack.org/155916 | 23:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy allows user to revoke or check own token https://review.openstack.org/155916 | 23:24 |
| bknudson | what do you think about policy in yaml rather than JSON? | 23:26 |
| bknudson | so we can have some comments. | 23:26 |
| *** zigo has quit IRC | 23:27 | |
| *** zigo has joined #openstack-keystone | 23:28 | |
| bknudson | actually, we can kind of have comments in json... can use something like "#": "Whatever" | 23:28 |
| topol | bknudson, I like yaml | 23:34 |
| bknudson | I'll try adding comments to the json ... | 23:34 |
| topol | use it for the Heat Translator templates. Works well | 23:34 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Comments for sample policy.json https://review.openstack.org/155919 | 23:35 |
| bknudson | here's an example ^ | 23:35 |
| *** topol has quit IRC | 23:36 | |
| *** henrynash has quit IRC | 23:36 | |
| *** MasterPiece has quit IRC | 23:42 | |
| *** topol has joined #openstack-keystone | 23:43 | |
| *** ChanServ sets mode: +v topol | 23:43 | |
| clayg | heh, comments in json - nice | 23:46 |
| clayg | could anyone point me to what might cause a 500 response reported as returned from keystone by the openstack client when setting up devstack? | 23:46 |
| clayg | it seems to not like the way I'm trying to add a v3 project to a domain -> https://gist.github.com/clayg/9677d81cf17348e9a084 but I'm rather sure it's just a usage issue :\ | 23:47 |
| clayg | unrelated, crockford on "comments in JSON" -> https://plus.google.com/+DouglasCrockfordEsq/posts/RK8qyGVaGSr | 23:48 |
| *** quack_quack_ has joined #openstack-keystone | 23:49 | |
| bknudson | I guess we could stick jsmin in front of the parser. | 23:51 |
| clayg | bknudson: I thought the '#' trick was sorta cute! | 23:51 |
| bknudson | clayg: nothing you can do as a user should cause the server to return a 500 response. | 23:52 |
| bknudson | I haven't seen the error but I don't run much in devstack. | 23:53 |
| clayg | bknudson: i'm not entirely sure I trust openstack client saying it got a 500 | 23:53 |
| clayg | i do feel like the part where I say show domain and it sees it, then I try to create a project and it says "no such project" is sorta strange tho | 23:54 |
| *** markvoelker has quit IRC | 23:54 | |
| * clayg expects PEBCAK | 23:54 | |
| *** markvoelker has joined #openstack-keystone | 23:55 | |
| clayg | er.. rahter it says "No domain with a name or ID of '1bd6893f4fae46b4b57c65c242cdc336' exists" | 23:55 |
| *** dimsum__ has quit IRC | 23:57 | |
| *** tqtran is now known as tqtran_afk | 23:58 | |
| *** quack_quack_ has left #openstack-keystone | 23:59 | |
| *** markvoelker has quit IRC | 23:59 | |
| bknudson | I don't see how that could be caused by anything you would do. | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
