| *** afazekas has quit IRC | 00:01 | |
| *** markvoelker has joined #openstack-keystone | 00:04 | |
| *** lhcheng has quit IRC | 00:05 | |
| *** carlosmarin has quit IRC | 00:08 | |
| *** markvoelker has quit IRC | 00:09 | |
| dstanek | henrynash: sorry...catching up | 00:17 |
|---|---|---|
| henrynash | dstanek: np…I think I got it worked out... | 00:18 |
| dstanek | henrynash: is this related to that blueprint? | 00:18 |
| henrynash | dstanek: the one on splittingup the tests for resoruce/assignmenet etc….yes | 00:18 |
| henrynash | dstanek: I’m particualarly interested in splittup up our 6000 line backend.py file!!!! | 00:19 |
| dstanek | that would be a good thing | 00:19 |
| dstanek | this was pitched at the last meeting https://blueprints.launchpad.net/keystone/+spec/backends-tests-restructuration | 00:19 |
| henrynash | dstanek: yep, was there….I’m just about ready to propose a first patch that shows a structure for doingthis…I’ll do that and let you and others review | 00:20 |
| henrynash | dtsanek: if we all hate it, np, we’ll try something else :-) | 00:20 |
| dstanek | that sounds good to me | 00:21 |
| *** dims_ has quit IRC | 00:27 | |
| *** dims__ has joined #openstack-keystone | 00:30 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend role tests into their own module https://review.openstack.org/156423 | 00:33 |
| atiwari | morganfainberg, yt? | 00:36 |
| stevemar | could i get a non-ibm to +A this patch: https://review.openstack.org/#/c/152699/22 (before i have to rebase things :) ) | 00:36 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: Use single quotes consistently https://review.openstack.org/156404 | 00:37 |
| *** nellysmitt has joined #openstack-keystone | 00:38 | |
| *** nellysmitt has quit IRC | 00:43 | |
| *** bknudson has joined #openstack-keystone | 00:48 | |
| *** ChanServ sets mode: +v bknudson | 00:48 | |
| *** jaosorior has quit IRC | 00:51 | |
| atiwari | stevemar, how did you add ascii flow in the spec? | 01:05 |
| *** markvoelker has joined #openstack-keystone | 01:05 | |
| stevemar | atiwari, you just prefix it with a double-colon (::), then indent everything with 4 spaces, you can see the raw source here: http://specs.openstack.org/openstack/keystone-specs/_sources/specs/juno/keystone-to-keystone-federation.txt | 01:10 |
| atiwari | let me see | 01:10 |
| atiwari | thanks | 01:11 |
| stevemar | or here: http://specs.openstack.org/openstack/keystone-specs/_sources/specs/kilo/websso-portal.txt | 01:11 |
| stevemar | np | 01:11 |
| *** markvoelker has quit IRC | 01:11 | |
| atiwari | so this flow was hand drafted? | 01:11 |
| atiwari | http://asciiflow.com/#0B4HXCa0rdYenSlRYYXJNY0VjMk0 | 01:11 |
| atiwari | I am trying to add above in my spec | 01:12 |
| atiwari | there is no way to cut it and paste | 01:12 |
| *** jamielennox is now known as jamielennox|away | 01:16 | |
| *** zzzeek has quit IRC | 01:21 | |
| *** zzzeek has joined #openstack-keystone | 01:23 | |
| *** henrynash has quit IRC | 01:29 | |
| *** jamielennox|away is now known as jamielennox | 01:31 | |
| wanghong | Morning and Happy Spring Festival! :) | 01:34 |
| *** samueldmq has joined #openstack-keystone | 01:36 | |
| *** amerine has joined #openstack-keystone | 01:37 | |
| *** zzzeek has quit IRC | 01:39 | |
| stevemar | atiwari yeah it was hand-drafted, didn't even know asciiflow.com existed | 01:40 |
| stevemar | atiwari, there is a button on the top-right, its the second one from the left, it allows for copy/paste | 01:41 |
| *** jamielennox is now known as jamielennox|away | 01:41 | |
| atiwari | hmm | 01:41 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Fix minor spelling issues in oslo.policy https://review.openstack.org/156405 | 01:41 |
| stevemar | wanghong, good morning and happy spring festival :) | 01:42 |
| wanghong | stevemar, aha, from tomorrow I will have a seven-day holiday. So, see you 7 days later:) | 01:43 |
| *** ncoghlan has joined #openstack-keystone | 01:45 | |
| mfisch | I just toyed around with LDAP connection pools in my virtual env and it's 3x faster when authing against AD | 01:51 |
| stevemar | mfisch, sounds like a good blog post :D | 01:51 |
| mfisch | I need this to land first | 01:51 |
| mfisch | https://review.openstack.org/#/c/156402/ | 01:51 |
| mfisch | puppet ^ | 01:51 |
| stevemar | wanghong, sounds great! i hope not to see you online :D | 01:52 |
| mfisch | I'm puppet-openstack core now but its not good form to approve yourself | 01:52 |
| stevemar | mfisch, for sure | 01:52 |
| mgagne | mfisch: +2 your change, lgtm | 01:54 |
| mfisch | oh yay | 01:54 |
| *** avozza is now known as zz_avozza | 01:56 | |
| *** amerine has quit IRC | 02:01 | |
| atiwari | stevemar, seems I don't have those buttons. which browser you are using? | 02:03 |
| stevemar | atiwari, one sec, i'll share | 02:04 |
| stevemar | atiwari, http://imgur.com/WENrFJT | 02:06 |
| *** markvoelker has joined #openstack-keystone | 02:08 | |
| *** _cjones_ has quit IRC | 02:09 | |
| *** jamielennox|away is now known as jamielennox | 02:09 | |
| *** richm has quit IRC | 02:12 | |
| *** markvoelker has quit IRC | 02:13 | |
| *** lhcheng has joined #openstack-keystone | 02:20 | |
| *** DaveChen has joined #openstack-keystone | 02:23 | |
| *** lhcheng has quit IRC | 02:25 | |
| *** erkules_ has joined #openstack-keystone | 02:29 | |
| *** erkules has quit IRC | 02:31 | |
| *** bknudson has quit IRC | 02:37 | |
| *** nellysmitt has joined #openstack-keystone | 02:39 | |
| *** dims__ has quit IRC | 02:40 | |
| *** nellysmitt has quit IRC | 02:44 | |
| *** darrenc is now known as darrenc_afk | 02:56 | |
| *** amerine has joined #openstack-keystone | 03:01 | |
| *** tqtran has quit IRC | 03:02 | |
| morganfainberg | stevemar, for "Federated" domain it's going to need to be a config option | 03:02 |
| mfisch | stevemar: with curls I see a 5x speedup, wow | 03:03 |
| morganfainberg | mfisch, 5x speedup with what? | 03:03 |
| mfisch | ldap connection pools | 03:03 |
| morganfainberg | yeah they're good | 03:03 |
| mfisch | just pulling 500 tokens | 03:03 |
| morganfainberg | now if we could only get our LDAP backend to be less chatty, even better | 03:04 |
| stevemar | morganfainberg, yeah, i figured that was the case, dammit | 03:04 |
| mfisch | stevemar made me do a blog post so I'm about to post it | 03:04 |
| stevemar | mfisch, i didn't realize i had the power to make you do things :P | 03:04 |
| morganfainberg | stevemar, *core powers* | 03:04 |
| morganfainberg | stevemar, ;P | 03:04 |
| morganfainberg | stevemar, jk | 03:04 |
| stevemar | good point | 03:05 |
| stevemar | now to wield them inappropriately | 03:05 |
| morganfainberg | it's like wonder twins... | 03:05 |
| morganfainberg | but less wierd | 03:05 |
| stevemar | like a green lantern wearing a power ring? | 03:05 |
| morganfainberg | there you go, i just ruined it didn't i? | 03:05 |
| morganfainberg | nope. def. wonder twins | 03:05 |
| morganfainberg | or aquaman | 03:05 |
| morganfainberg | stevemar, so ayoung ran across an issue w/ per-domain backends | 03:06 |
| morganfainberg | chicken-egg | 03:06 |
| morganfainberg | stevemar, how do you grant a role to someone who hasn't logged in yet... or a group that hasn't been referenced yet? | 03:06 |
| morganfainberg | stevemar, we need to bake a way into the API to solve that | 03:07 |
| mfisch | stevemar: http://www.mattfischer.com/blog/?p=624 | 03:07 |
| mfisch | perhaps you guys could explain why I never had more than 4 connections | 03:07 |
| morganfainberg | mfisch, behind apache? | 03:07 |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 03:07 |
| morganfainberg | or in eventlet? | 03:07 |
| mfisch | morganfainberg: unsure what my virtual dev node has lemme look | 03:08 |
| mfisch | eventlet I think | 03:08 |
| mfisch | I just run it with keystone-all | 03:08 |
| morganfainberg | yeah. so, under apache i'd expect way less benefit | 03:08 |
| morganfainberg | keystone-all == eventlet | 03:09 |
| mfisch | feel free to add that comment on my blog ;) | 03:09 |
| mfisch | yep | 03:09 |
| morganfainberg | so, you're probably running into limiations of the workers + eventlet yielding | 03:09 |
| mfisch | apache is a debbie downer | 03:09 |
| *** markvoelker has joined #openstack-keystone | 03:09 | |
| morganfainberg | how many workers do you have configured under eventlet? | 03:09 |
| mfisch | thats it | 03:09 |
| mfisch | this is a vbox, probably 4 | 03:09 |
| mfisch | I have 4 yep | 03:10 |
| mfisch | 64 on real h/w | 03:10 |
| mfisch | so duh | 03:10 |
| morganfainberg | yep. and python-ldap is c-bindings so it doesn't yield | 03:10 |
| morganfainberg | if it was pure python it would be able to yield | 03:10 |
| morganfainberg | so you're less bound up, because the workers are a bit smarter | 03:10 |
| morganfainberg | you don't need to spin up/spin down connections | 03:11 |
| mfisch | default must be 2x cpu | 03:11 |
| morganfainberg | but you're still limited per worker things | 03:11 |
| stevemar | mfisch, solid blog write up +1 | 03:11 |
| morganfainberg | if we isolated LDAP/SQL to a conductor | 03:11 |
| mfisch | puppet wont let you change worker count yet, dorman is working on it | 03:11 |
| morganfainberg | we could in theory handle more connections based upon scaling the conductor out | 03:11 |
| morganfainberg | since the majority of the time is in blocking calls that really aren't an issue for the CPU to context switch out of | 03:12 |
| morganfainberg | but python and especially eventlet python cannot optimise outof | 03:12 |
| morganfainberg | so the 3-5x improvement is purely not needing to spinup/down the sockets/connections to LDAP | 03:12 |
| mfisch | morganfainberg: as PTL what really makes this a great feature is that someone took the time to document the config | 03:13 |
| openstackgerrit | Merged openstack/keystone-specs: Deprecate keystone CLI https://review.openstack.org/155159 | 03:13 |
| morganfainberg | mfisch, we try to make sure config options/mechanisms are documented | 03:13 |
| morganfainberg | really we do | 03:13 |
| *** samueldmq has quit IRC | 03:13 | |
| morganfainberg | we miss the mark sometimes though | 03:13 |
| morganfainberg | *cough* middleware *cough* | 03:13 |
| mfisch | morganfainberg: I think it's improved | 03:13 |
| mfisch | when I first did LDAP I documented part of it while doing the work | 03:14 |
| morganfainberg | that reminds me... | 03:14 |
| morganfainberg | i need to send an email to your blog to a buddy now | 03:14 |
| mfisch | big opers who have 10 guys doing keystone may not need it but small and mid-size do | 03:14 |
| *** markvoelker has quit IRC | 03:14 | |
| morganfainberg | big opers still need the docs | 03:14 |
| morganfainberg | trust me ;) | 03:14 |
| mfisch | sure, but its easier when you have full time focused guys | 03:15 |
| mfisch | after this I'm back to working on ovs and heat tomorrow | 03:15 |
| *** darrenc_afk is now known as darrenc | 03:17 | |
| morganfainberg | mfisch, hehe | 03:20 |
| morganfainberg | oh crap i need to do laundry... | 03:20 |
| mfisch | morganfainberg: I updated to note your comment on apache, thx | 03:20 |
| morganfainberg | it'll still benefit apache, just at a lesser level | 03:20 |
| morganfainberg | you still avoid the need to spin up/down the LDAP connections for each request | 03:20 |
| mfisch | well I quoted you, shall I change it? | 03:21 |
| mfisch | According to the Keystone PTL, Morgan Fainberg, “under apache I’d expect way less benefit” | 03:22 |
| morganfainberg | no | 03:22 |
| morganfainberg | don't quote me like that :P | 03:22 |
| morganfainberg | "less benefit" | 03:22 |
| mfisch | ok | 03:22 |
| morganfainberg | not "way less" ;) | 03:22 |
| mfisch | done | 03:22 |
| stevemar | mfisch always with the libel and slander | 03:23 |
| morganfainberg | i would expect to still see noticeable improvements though | 03:23 |
| morganfainberg | so 2-3x [no you can't quote me on this] vs 3-5x | 03:23 |
| mfisch | I don't think it's libel if it's a quote | 03:23 |
| morganfainberg | would be the numbers i pull out of thin air | 03:23 |
| mfisch | let me update the blog again | 03:23 |
| mfisch | "I eat moose everyday for breakfast" - Steve Martinelli | 03:23 |
| morganfainberg | no quoting me on that | 03:23 |
| morganfainberg | mfisch, he is canadian | 03:24 |
| morganfainberg | mfisch it might be true | 03:24 |
| mfisch | a colleague's parents live on an island in Canada and I now have a legit moose tenderloin in the freezer | 03:24 |
| morganfainberg | i hear Moose-jerky is good | 03:25 |
| morganfainberg | from a friend who hunts. | 03:25 |
| morganfainberg | unfortunately they live waaaay far away and shipping moose jerky via mail is... suspect | 03:26 |
| stevemar | morganfainberg, only if you're not doing it correctly | 03:30 |
| morganfainberg | no the whole shipping meat internationally issue | 03:31 |
| morganfainberg | less the "it'll spoil" issue | 03:31 |
| *** ccard_ has joined #openstack-keystone | 03:31 | |
| stevemar | ughhh my lazy day off is ending, back at it tomorrow | 03:34 |
| *** ccard has quit IRC | 03:34 | |
| *** lhcheng has joined #openstack-keystone | 03:38 | |
| openstackgerrit | Merged openstack/keystone: Use oslo.log instead of incubator https://review.openstack.org/152699 | 03:40 |
| *** dims__ has joined #openstack-keystone | 03:40 | |
| stevemar | \o/ | 03:40 |
| morganfainberg | stevemar, you should fix the federation domain one so we can merge that too | 03:45 |
| morganfainberg | stevemar, >.> | 03:45 |
| *** dims__ has quit IRC | 03:45 | |
| *** amerine has quit IRC | 03:46 | |
| stevemar | morganfainberg, yesss, doing that now/soon, just added https://review.openstack.org/156456 | 03:47 |
| morganfainberg | ;) | 03:47 |
| stevemar | morganfainberg, i have so much to review | 03:48 |
| stevemar | i took 2 days off and i'm super behind | 03:48 |
| morganfainberg | stevemar, no weekedns for you! :P | 03:48 |
| morganfainberg | >.> | 03:48 |
| stevemar | and those days were 1) a weekend, and 2) a stat holiday | 03:48 |
| stevemar | ha | 03:48 |
| stevemar | feels that way sometimes :) | 03:48 |
| stevemar | morganfainberg, you want it in a subsequent patch so we can merge the first one? | 03:49 |
| morganfainberg | uhm. *shrug* | 03:49 |
| stevemar | this way you can +3 the first one in the chain | 03:49 |
| stevemar | with proof that it's fixed | 03:49 |
| stevemar | just cause Henry already +2ed it | 03:49 |
| morganfainberg | or i can +2 and marekd can +2/+A early tomorrow | 03:51 |
| *** ccard_ has quit IRC | 03:53 | |
| *** ccard_ has joined #openstack-keystone | 03:57 | |
| *** lhcheng has quit IRC | 04:00 | |
| mfisch | morganfainberg: I see that public_workers and admin_workers = CPU count (by default) | 04:01 |
| mfisch | I have 2 CPUs, so 4 total workers | 04:01 |
| mfisch | would each thread be doing LDAP? | 04:01 |
| mfisch | should only be public workers right since I'm just getting tokens | 04:01 |
| morganfainberg | well admin/public are really v2 only constructs | 04:01 |
| morganfainberg | v3 is the same pipeline | 04:01 |
| mfisch | I'm using v2 for my test | 04:02 |
| mfisch | I'd expect the # connections to max at 2 | 04:02 |
| morganfainberg | pool might also do a spare? | 04:02 |
| morganfainberg | i'd need to re-look at the code | 04:02 |
| mfisch | is there a way to tell which type from ps? | 04:03 |
| morganfainberg | uhm | 04:03 |
| morganfainberg | not really | 04:03 |
| mfisch | k | 04:03 |
| *** markvoelker has joined #openstack-keystone | 04:10 | |
| *** markvoelker has quit IRC | 04:16 | |
| *** ccard_ has quit IRC | 04:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 04:35 |
| stevemar | morganfainberg, ^ | 04:35 |
| *** ccard_ has joined #openstack-keystone | 04:36 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 04:38 |
| *** nellysmitt has joined #openstack-keystone | 04:40 | |
| *** nellysmitt has quit IRC | 04:45 | |
| morganfainberg | stevemar a couple nits on that new patch | 04:47 |
| *** ccard__ has joined #openstack-keystone | 04:48 | |
| morganfainberg | stevemar and you need a followup sample config update | 04:48 |
| stevemar | morganfainberg, thanks, yeah, we are in need for a regen for sample_config | 04:49 |
| stevemar | especially since oslo.log landed, need to make sure we didn't lose anything | 04:49 |
| *** ccard_ has quit IRC | 04:50 | |
| *** radez is now known as radez_g0n3 | 05:01 | |
| *** _cjones_ has joined #openstack-keystone | 05:10 | |
| *** lhcheng has joined #openstack-keystone | 05:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Additional doc clean up https://review.openstack.org/156463 | 05:12 |
| *** markvoelker has joined #openstack-keystone | 05:12 | |
| *** _cjones_ has quit IRC | 05:14 | |
| *** ccard__ has quit IRC | 05:15 | |
| *** devlaps has quit IRC | 05:16 | |
| *** ccard__ has joined #openstack-keystone | 05:16 | |
| *** markvoelker has quit IRC | 05:17 | |
| *** lhcheng has quit IRC | 05:18 | |
| *** rushiagr_away is now known as rushiagr | 05:23 | |
| *** ccard__ has quit IRC | 05:24 | |
| *** ccard__ has joined #openstack-keystone | 05:24 | |
| *** _cjones_ has joined #openstack-keystone | 05:26 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 05:27 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Provide a means to get all installed plugins https://review.openstack.org/156466 | 05:29 |
| *** ajayaa has joined #openstack-keystone | 05:33 | |
| openstackgerrit | Merged openstack/keystone: Add a domain to federated users https://review.openstack.org/110858 | 05:36 |
| openstackgerrit | Merged openstack/keystone: Fix nits from patch #110858 https://review.openstack.org/156158 | 05:42 |
| *** pcaruana has quit IRC | 05:47 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 05:52 |
| *** _cjones_ has quit IRC | 05:53 | |
| *** henrynash has joined #openstack-keystone | 06:03 | |
| *** ChanServ sets mode: +v henrynash | 06:03 | |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 06:05 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/156476 | 06:05 |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: No keystone Endpoint now gives a valid Error Message https://review.openstack.org/155260 | 06:06 |
| crinkle | stevemar: why does `openstack network create` not accept a tenant as a parameter? | 06:07 |
| stevemar | crinkle, my network knowledge is close to 0 :( | 06:08 |
| crinkle | it's making it hard to replicate `neutron net-create` for a tenant that the admin user doesn't have a role in | 06:08 |
| crinkle | hmm | 06:08 |
| stevemar | crinkle, I think (hope) we say that network support is limited at best | 06:09 |
| stevemar | we haven't really found anyone proficient enough with networking to add a bunch of commands | 06:09 |
| *** henrynash has quit IRC | 06:10 | |
| crinkle | damn, okay | 06:10 |
| stevemar | crinkle, how important is it? do you just need net-create parity? | 06:11 |
| stevemar | are there any other network related commands? | 06:12 |
| stevemar | (that you need) | 06:12 |
| *** ccard_ has joined #openstack-keystone | 06:13 | |
| *** markvoelker has joined #openstack-keystone | 06:13 | |
| *** ccard__ has quit IRC | 06:14 | |
| crinkle | stevemar: we also need port-create, subnet-create, router-create, and router-interface-add | 06:16 |
| crinkle | afaict | 06:16 |
| crinkle | I've only just started looking at it | 06:16 |
| morganfainberg | stevemar, updated the high priority reviews... i think we're going to be punting a lot of things out of kilo | 06:16 |
| morganfainberg | :( | 06:16 |
| stevemar | morganfainberg, i figured that was going to happen | 06:16 |
| morganfainberg | crinkle, Hi! :) | 06:16 |
| crinkle | morganfainberg: o/ | 06:16 |
| * morganfainberg waves like an insane person at crinkle :) | 06:17 | |
| crinkle | :D | 06:17 |
| morganfainberg | crinkle, if you have a moment to throw something at nibalizer, be sure to do it. cause... why not | 06:17 |
| morganfainberg | :) | 06:17 |
| stevemar | crinkle, whats the timeline on it? | 06:18 |
| morganfainberg | that is whenever you have a moment to do so. | 06:18 |
| stevemar | if i can deliver it after feature freeze, is that too late? | 06:18 |
| crinkle | stevemar: we were hoping before kilo | 06:18 |
| crinkle | but I don't think it's dire | 06:18 |
| * morganfainberg needs to swing through PDX again to bug people. | 06:18 | |
| *** markvoelker has quit IRC | 06:19 | |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Be ready to punt Kilo targeted specs, the "high priority" has been updated and looks scary now." | 06:20 | |
| stevemar | crinkle, file a bug with a list of the commands you need, hopefully me/dean/terry can get it in | 06:20 |
| crinkle | stevemar: thanks, will do | 06:20 |
| stevemar | morganfainberg, did you want to go through them? | 06:20 |
| morganfainberg | stevemar, not yet, but in a week yes | 06:20 |
| morganfainberg | seriously look at the list | 06:20 |
| stevemar | morganfainberg, technically functional testing can go in past FF | 06:21 |
| morganfainberg | yes | 06:21 |
| morganfainberg | as can a few others | 06:21 |
| morganfainberg | but not many | 06:21 |
| stevemar | CADF everywhere is done, just needs eyes | 06:21 |
| morganfainberg | stevemar, look at the BP cound for k3: https://launchpad.net/keystone/+milestone/kilo-3 | 06:21 |
| morganfainberg | it's rough | 06:21 |
| stevemar | looking at it now | 06:22 |
| morganfainberg | my guess is provider cleanup = punted | 06:22 |
| morganfainberg | x509 auth is likley punted | 06:23 |
| morganfainberg | i don't want to see it punted, but Domain configs in sql hasn't been started afaict | 06:23 |
| stevemar | it has not | 06:23 |
| morganfainberg | a bunch of henry's reviews aren't even tagged to the BPs they need to be | 06:23 |
| morganfainberg | for the assignment split | 06:24 |
| stevemar | kilo approved specs http://specs.openstack.org/openstack/keystone-specs/ is super long | 06:24 |
| morganfainberg | stevemar, i'm going to open specs for L at the k3 milestone | 06:24 |
| morganfainberg | and i think i want all specs approved by L1 | 06:24 |
| morganfainberg | l2 will be too late and get us in the same boat we're in now | 06:24 |
| morganfainberg | s/all specs/all feature specs | 06:25 |
| stevemar | morganfainberg, we're not in *that* bad shape | 06:25 |
| stevemar | proposed by L1, approved by end of L2 :D | 06:25 |
| morganfainberg | stevemar, no but we're cramming everything into the 2nd half of milestone3 | 06:25 |
| morganfainberg | i would rather have all features landed by L2 | 06:25 |
| morganfainberg | gives us a whole milestone to slip | 06:25 |
| morganfainberg | if anything slips in the list now we're pretty much not going to land it | 06:25 |
| stevemar | theres always that slow start for some reason | 06:25 |
| morganfainberg | L2 is a better place to freeze features | 06:26 |
| morganfainberg | i think we're going to have an unfun release this cycle tbh | 06:26 |
| morganfainberg | i think work towards RC is going to be ugly based upon things being crammed in at the last minute | 06:26 |
| stevemar | morganfainberg, anything not started by friday is punted? | 06:27 |
| stevemar | i think if you announce that you will see lots of people starting stuff :P | 06:27 |
| morganfainberg | anything not in progress by next IRC meeting (the one follows tomorrow) will be punted | 06:27 |
| morganfainberg | in progress with real work shown | 06:28 |
| * morganfainberg is travelling until saturday and doesn't want to have to play "cleanup" on friday/weekend | 06:28 | |
| stevemar | morganfainberg, yeah tokenless auth with x509 and configs in SQL are definitely on the chopping block | 06:29 |
| stevemar | maybe even the remove metadata thing | 06:30 |
| stevemar | functional testing andreaf enabled non-sqlite dbs can land post FF | 06:30 |
| morganfainberg | yep | 06:31 |
| *** zz_avozza is now known as avozza | 06:31 | |
| stevemar | morganfainberg, bump reseller and abfab | 06:31 |
| morganfainberg | ok added announcement for spec proposals and a notice that if things aren't started by 2/24 we're punting them | 06:31 |
| morganfainberg | to the agenda | 06:31 |
| morganfainberg | i'll send the email to the ML once we cut K3 about spec proposals being opened (doesn't need to be announced until it happens) | 06:32 |
| stevemar | fair enough | 06:32 |
| stevemar | i'm going to make a list of bps that haven't been started | 06:32 |
| morganfainberg | ty | 06:32 |
| stevemar | so the authors know to either start coding or bump it themselves to L | 06:32 |
| morganfainberg | do it as a list of BPs not started / in jeapordy due to scope without corresponding code | 06:32 |
| morganfainberg | it's easy to see which ones are in jeapordy | 06:33 |
| stevemar | i'll announce the BPs during the meeting | 06:33 |
| morganfainberg | ++ | 06:33 |
| stevemar | yes, all the links are there | 06:33 |
| morganfainberg | thanks for running this meeting | 06:33 |
| morganfainberg | i'll prob be there shortly into it, but you know how it goes with travel | 06:33 |
| stevemar | morganfainberg, if you want to review https://review.openstack.org/#/c/125521/ we can close a blueprint :P | 06:35 |
| morganfainberg | stevemar, has a -1 from henry fwiw | 06:36 |
| morganfainberg | and henry is right: https://bugs.launchpad.net/keystone/+bug/1417451 is likely an issue | 06:37 |
| openstack | Launchpad bug 1417451 in Keystone "SQL User & Group entities still have FK to domain" [Medium,Confirmed] - Assigned to Henry Nash (henry-nash) | 06:37 |
| stevemar | blah | 06:38 |
| * stevemar is trying to think of the implications of just dropping the FK.... | 06:39 | |
| morganfainberg | zero afaik | 06:39 |
| morganfainberg | except a domain delete *could* orphan users/groups | 06:39 |
| morganfainberg | but.. that is the risk we've always had | 06:39 |
| morganfainberg | stevemar, aslo https://blueprints.launchpad.net/keystone/+spec/kilo-sql-squash | 06:41 |
| *** nellysmitt has joined #openstack-keystone | 06:41 | |
| morganfainberg | that can be done post K3 | 06:41 |
| stevemar | morganfainberg, yep, that isn't even targeted to anything | 06:42 |
| morganfainberg | i just registered it | 06:42 |
| morganfainberg | :P | 06:42 |
| stevemar | morganfainberg, i guess we will have to have a new db migration to remove the FK | 06:45 |
| morganfainberg | yep | 06:45 |
| *** nellysmitt has quit IRC | 06:45 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 06:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Drop foreign key (domain_id) from user and group tables https://review.openstack.org/156488 | 06:58 |
| stevemar | morganfainberg, ^ | 06:58 |
| morganfainberg | stevemar, i see | 06:58 |
| stevemar | just a first swing at it | 06:58 |
| * morganfainberg is tempted to say that downward migrations stop being supported in keystone regardless of the x-project spec | 06:59 | |
| morganfainberg | but i'll wait until this meeting and bring up that the people who said they'd add more details on what they want to hear before the spec is approved, have yet to do so | 06:59 |
| *** MasterPiece has joined #openstack-keystone | 07:01 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 07:03 |
| morganfainberg | marekd, aha thanks. | 07:04 |
| stevemar | ha | 07:04 |
| marekd | morganfainberg: stevemar no problem. Just fixed small typo | 07:05 |
| stevemar | morganfainberg, you caused my patch to go nuclear | 07:05 |
| *** lhcheng has joined #openstack-keystone | 07:06 | |
| marekd | morganfainberg: stevemar so, how about enforcing "Federated" name in the code? | 07:07 |
| marekd | domain_name = CONF.federation.federated_domain or 'Federated' | 07:08 |
| stevemar | marekd, what do you mean? | 07:08 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Check token provider's configuration https://review.openstack.org/143990 | 07:08 |
| morganfainberg | oh if it's a None or "" | 07:08 |
| morganfainberg | yeah | 07:08 |
| morganfainberg | that would be fine | 07:08 |
| stevemar | marekd, it already defaults to that | 07:08 |
| *** lhcheng has quit IRC | 07:08 | |
| stevemar | oh | 07:08 |
| marekd | but deeeeeeeeeeefaults in the CONF | 07:08 |
| marekd | so if you make conf with value "" | 07:08 |
| stevemar | :) | 07:08 |
| morganfainberg | marekd, yeah good enhancement | 07:08 |
| marekd | it will use "" value | 07:08 |
| morganfainberg | and "" domain would be badddddd | 07:08 |
| morganfainberg | mmmmkay | 07:08 |
| morganfainberg | ;) | 07:08 |
| * marekd drugs are bad, mmmkay | 07:09 | |
| stevemar | marekd, since you already tossed the last patch, mind adding that bit? | 07:09 |
| marekd | stevemar: not at all. | 07:09 |
| stevemar | you can bring back the constant in federation.core | 07:09 |
| stevemar | ty sir | 07:09 |
| marekd | i think i will start coming to work earlier, so nice to meet alive people here :P | 07:09 |
| marekd | stevemar: not a problem at all, boss | 07:10 |
| stevemar | morganfainberg, how can i give voice to marekd :P | 07:10 |
| morganfainberg | stevemar, only dolph and I can | 07:10 |
| morganfainberg | or the -infra team | 07:10 |
| stevemar | morganfainberg, give the man some voice | 07:11 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 07:11 |
| *** ChanServ sets mode: +v marekd | 07:11 | |
| stevemar | \o/ | 07:11 |
| marekd | \o/ | 07:11 |
| marekd | tanks! | 07:11 |
| marekd | thanks! | 07:11 |
| stevemar | i will also take any tanks you have | 07:11 |
| marekd | stevemar: you must have huge condo...or a parking spot. | 07:12 |
| stevemar | morganfainberg, hey the timestamp spec doens't have a bp | 07:13 |
| marekd | stevemar: you were off recently, right? Some public holiday or "just because" ? | 07:13 |
| stevemar | marekd, just for today, public holiday "family day" | 07:13 |
| stevemar | but since i have no children, i slept in til 1pm | 07:13 |
| morganfainberg | stevemar, if it's approved feel free to add the BP | 07:13 |
| morganfainberg | and target it | 07:14 |
| morganfainberg | before targeting besure to set priority | 07:14 |
| morganfainberg | AND implementation status to whatever is correct | 07:14 |
| morganfainberg | if you try and target a BP w/o priority it'll auto untarget | 07:14 |
| morganfainberg | because of an awesome script ttx runs | 07:14 |
| marekd | LOL | 07:14 |
| morganfainberg | since only cores can set priority | 07:15 |
| morganfainberg | it stops people from tagging BPs to random milestones | 07:15 |
| stevemar | morganfainberg, done | 07:15 |
| *** markvoelker has joined #openstack-keystone | 07:15 | |
| morganfainberg | marekd / stevemar, feel free to +A this https://review.openstack.org/#/c/156461/ once jenkins passes it | 07:16 |
| marekd | morganfainberg: i am adding that enhancement now. | 07:17 |
| *** dims__ has joined #openstack-keystone | 07:18 | |
| *** henrynash has joined #openstack-keystone | 07:20 | |
| *** ChanServ sets mode: +v henrynash | 07:20 | |
| *** markvoelker has quit IRC | 07:21 | |
| *** mzbik has joined #openstack-keystone | 07:21 | |
| *** dims__ has quit IRC | 07:23 | |
| morganfainberg | marekd, FYI, openstack proposal bot, feel free to single core +2/+A them as long as they aren't broken/breaking things | 07:23 |
| morganfainberg | that'd be transifex and global req updates from the bot | 07:23 |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Be ready to punt Kilo targeted specs, the "high priority" has been updated and looks scary now. | Reminder: Triage Bugs" | 07:24 | |
| morganfainberg | marekd, and if you need/want to update the channel topic: /msg chanserv topic #openstack-keystone <new topic> | 07:25 |
| morganfainberg | marekd, all cores have access to do so | 07:25 |
| marekd | morganfainberg: ok, thanks :-) | 07:26 |
| morganfainberg | stevemar, i've re-ordered the meeting topics a bit | 07:27 |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: No keystone Endpoint now gives a valid Error Message https://review.openstack.org/155260 | 07:28 |
| morganfainberg | stevemar, just so there is the higher likelyhood i'll be online by the time the SPFE topics come up | 07:28 |
| stevemar | morganfainberg, cool | 07:28 |
| *** stevemar has quit IRC | 07:38 | |
| *** marg7175 has quit IRC | 07:51 | |
| *** ncoghlan has quit IRC | 07:56 | |
| *** rm_work is now known as rm_work|away | 07:57 | |
| *** ajayaa has quit IRC | 08:06 | |
| *** fifieldt has joined #openstack-keystone | 08:09 | |
| *** chlong has quit IRC | 08:11 | |
| *** lhcheng has joined #openstack-keystone | 08:12 | |
| *** pnavarro|afk has joined #openstack-keystone | 08:16 | |
| *** markvoelker has joined #openstack-keystone | 08:17 | |
| *** markvoelker has quit IRC | 08:22 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 08:23 |
| *** pnavarro|afk has quit IRC | 08:25 | |
| *** pnavarro has joined #openstack-keystone | 08:26 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/156476 | 08:27 |
| *** ajayaa has joined #openstack-keystone | 08:27 | |
| marekd | wanghong: thanks for the review | 08:37 |
| marekd | I am going to add new patch | 08:37 |
| *** nellysmitt has joined #openstack-keystone | 08:42 | |
| *** ajayaa has quit IRC | 08:44 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 08:44 |
| *** lhcheng has quit IRC | 08:44 | |
| marekd | wanghong: ^^ | 08:46 |
| *** nellysmitt has quit IRC | 08:46 | |
| *** nellysmitt has joined #openstack-keystone | 08:47 | |
| *** jistr has joined #openstack-keystone | 08:51 | |
| *** _cjones_ has joined #openstack-keystone | 08:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Add ``service_catalog`` in /auth/catalog response. https://review.openstack.org/156509 | 08:55 |
| *** DaveChen has quit IRC | 08:56 | |
| *** fifieldt has quit IRC | 08:56 | |
| *** ajayaa has joined #openstack-keystone | 08:57 | |
| *** _cjones_ has quit IRC | 08:58 | |
| *** karimb has joined #openstack-keystone | 09:00 | |
| *** markvoelker has joined #openstack-keystone | 09:18 | |
| *** aix has quit IRC | 09:21 | |
| *** ajayaa has quit IRC | 09:21 | |
| *** markvoelker has quit IRC | 09:23 | |
| *** avozza is now known as zz_avozza | 09:26 | |
| *** henrynash has quit IRC | 09:34 | |
| *** ajayaa has joined #openstack-keystone | 09:36 | |
| *** ajayaa has quit IRC | 09:43 | |
| *** karimb has quit IRC | 09:45 | |
| *** aix has joined #openstack-keystone | 09:48 | |
| *** marg7175 has joined #openstack-keystone | 09:51 | |
| *** zz_avozza is now known as avozza | 09:55 | |
| *** marg7175 has quit IRC | 09:56 | |
| *** arif-ali has joined #openstack-keystone | 10:00 | |
| *** aix has quit IRC | 10:05 | |
| *** avozza is now known as zz_avozza | 10:06 | |
| *** amakarov_away is now known as amakarov | 10:14 | |
| *** aix has joined #openstack-keystone | 10:17 | |
| *** henrynash has joined #openstack-keystone | 10:18 | |
| *** ChanServ sets mode: +v henrynash | 10:18 | |
| *** markvoelker has joined #openstack-keystone | 10:19 | |
| *** afazekas has joined #openstack-keystone | 10:23 | |
| *** markvoelker has quit IRC | 10:24 | |
| *** zz_avozza is now known as avozza | 10:26 | |
| *** wanghong has quit IRC | 10:30 | |
| *** krykowski has joined #openstack-keystone | 10:38 | |
| *** ajayaa has joined #openstack-keystone | 10:39 | |
| *** pnavarro has quit IRC | 10:41 | |
| *** henrynash has quit IRC | 10:56 | |
| *** pnavarro has joined #openstack-keystone | 11:09 | |
| *** ajayaa has quit IRC | 11:12 | |
| *** markvoelker has joined #openstack-keystone | 11:20 | |
| *** markvoelker has quit IRC | 11:25 | |
| *** ajayaa has joined #openstack-keystone | 11:30 | |
| *** dims__ has joined #openstack-keystone | 11:32 | |
| *** marg7175 has joined #openstack-keystone | 11:52 | |
| *** marg7175 has quit IRC | 11:58 | |
| *** krykowski has quit IRC | 11:58 | |
| *** krykowski has joined #openstack-keystone | 11:58 | |
| *** avozza is now known as zz_avozza | 12:14 | |
| *** marg7175 has joined #openstack-keystone | 12:17 | |
| *** markvoelker has joined #openstack-keystone | 12:21 | |
| *** markvoelker has quit IRC | 12:26 | |
| *** mzbik_ has joined #openstack-keystone | 12:31 | |
| *** mzbik has quit IRC | 12:33 | |
| *** MasterPiece has quit IRC | 12:36 | |
| *** pnavarro has quit IRC | 12:39 | |
| *** rushiagr is now known as rushiagr_away | 12:41 | |
| *** marg7175 has quit IRC | 12:44 | |
| *** marg7175 has joined #openstack-keystone | 12:44 | |
| *** markvoelker has joined #openstack-keystone | 12:52 | |
| openstackgerrit | Merged openstack/pycadf: cleanup documentation https://review.openstack.org/156333 | 12:54 |
| *** henrynash has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +v henrynash | 13:02 | |
| *** zz_avozza is now known as avozza | 13:05 | |
| *** avozza is now known as zz_avozza | 13:07 | |
| *** zz_avozza is now known as avozza | 13:15 | |
| *** gordc has joined #openstack-keystone | 13:34 | |
| *** bjornar has quit IRC | 13:36 | |
| *** ajayaa has quit IRC | 13:37 | |
| *** samueldmq has joined #openstack-keystone | 13:38 | |
| *** afazekas has quit IRC | 13:40 | |
| *** HenryG has left #openstack-keystone | 13:47 | |
| *** marg7175 has quit IRC | 13:48 | |
| *** radez_g0n3 is now known as radez | 13:56 | |
| samueldmq | henrynash, ping - I left some comments on the data-driven tests chain ... | 14:02 |
| samueldmq | henrynash, nothing related to the approach itself, just minor corrections | 14:03 |
| samueldmq | henrynash, I didn't know that approach but I did liked it :) | 14:03 |
| samueldmq | henrynash, complex test cases become really easy to understand | 14:03 |
| henrynash | samueldmq: yep, thanks…haev seen teh comments - agree with them and will be uploading new patches | 14:04 |
| *** avozza is now known as zz_avozza | 14:04 | |
| samueldmq | henrynash, great thanks | 14:05 |
| openstackgerrit | Konstantin Maximov proposed openstack/keystone: Improved policy setting in the 'v3 filter' tests https://review.openstack.org/156597 | 14:05 |
| *** ayoung has joined #openstack-keystone | 14:12 | |
| *** ChanServ sets mode: +v ayoung | 14:12 | |
| *** bknudson has joined #openstack-keystone | 14:20 | |
| *** ChanServ sets mode: +v bknudson | 14:20 | |
| *** joesavak has joined #openstack-keystone | 14:23 | |
| *** richm has joined #openstack-keystone | 14:24 | |
| *** pnavarro has joined #openstack-keystone | 14:29 | |
| *** rushiagr_away is now known as rushiagr | 14:37 | |
| *** ajayaa has joined #openstack-keystone | 14:38 | |
| *** mzbik_ has quit IRC | 14:40 | |
| *** zz_avozza is now known as avozza | 14:56 | |
| *** jaosorior has joined #openstack-keystone | 15:00 | |
| *** dims__ has quit IRC | 15:03 | |
| *** dims__ has joined #openstack-keystone | 15:04 | |
| *** dims__ has quit IRC | 15:04 | |
| *** dims__ has joined #openstack-keystone | 15:05 | |
| *** joesavak has quit IRC | 15:09 | |
| openstackgerrit | Matthew Treinish proposed openstack/keystone: Add oslo request id middleware to keystone paste pipeline https://review.openstack.org/155901 | 15:11 |
| *** marg7175 has joined #openstack-keystone | 15:13 | |
| *** pnavarro has quit IRC | 15:15 | |
| *** marg7175 has quit IRC | 15:16 | |
| *** marg7175 has joined #openstack-keystone | 15:17 | |
| *** rm_work|away is now known as rm_work | 15:18 | |
| *** timcline has joined #openstack-keystone | 15:24 | |
| *** joesavak has joined #openstack-keystone | 15:25 | |
| *** carlosmarin has joined #openstack-keystone | 15:26 | |
| *** stevemar has joined #openstack-keystone | 15:28 | |
| *** ChanServ sets mode: +v stevemar | 15:28 | |
| *** pnavarro has joined #openstack-keystone | 15:38 | |
| morganfainberg | morganfainberg: | 15:40 |
| ayoung | morganfainberg, did you just ping yourself? Not in public, please... | 15:46 |
| ayoung | dolphm, does this not support what you want to do with AE tokens https://cryptography.io/en/latest/fernet/ ? | 15:47 |
| ayoung | https://cryptography.io/en/latest/hazmat/primitives/mac/hmac/ lbragstad same question | 15:48 |
| morganfainberg | ayoung: | 15:49 |
| morganfainberg | Hah | 15:49 |
| ayoung | morganfainberg, do you know why the KLWT impl was looking to use keyczar instead of cryptogrphy.py? | 15:50 |
| *** zzzeek has joined #openstack-keystone | 15:51 | |
| dolphm | ayoung: it's probably been since atlanta since i looked at that API, but yes i think so. albeit, lbragstad was seeing less overhead using signatures rather than encryption, so i was tempted to pursue signatures further | 15:51 |
| *** rdo has quit IRC | 15:51 | |
| morganfainberg | ayoung: I thought cryptography would meet their needs. | 15:51 |
| dolphm | ayoung: we'd also have to implement our own key persistence in that case | 15:51 |
| dolphm | morganfainberg: lbragstad talked to redrobot about the use case; i imagine he would have pointed him to cryptography if it was a better alternative? | 15:52 |
| morganfainberg | But I figure that question is part of the spfe bit for the meeting today | 15:52 |
| morganfainberg | dolphm: sure. | 15:52 |
| ayoung | dolphm, lets talk to the cryptography.py team. I'm almost willing to carry the code in Keystone kindof like we would do with an Oslo approach: make sure it works and don't hold up our development, then move it to the real library. | 15:52 |
| dolphm | morganfainberg: ayoung: i'm certainly interested in trying an implementation using cryptography | 15:53 |
| *** rdo has joined #openstack-keystone | 15:53 | |
| morganfainberg | ayoung: I think lbragstad did talk to them. I just wasn't paying attention to the convo. So I was planning to ask at the meeting today. | 15:53 |
| morganfainberg | dolphm: ^^ | 15:53 |
| dolphm | morganfainberg: they might have talked in meatspace, they sit right next to each other | 15:53 |
| morganfainberg | yeah. Some irc chatter happened too. | 15:54 |
| morganfainberg | But like I said, wasn't really looking at it. | 15:54 |
| *** r-daneel has joined #openstack-keystone | 15:54 | |
| dolphm | morganfainberg: ayoung: i have a few little things to knock out this morning, and i'll try to get a PoC going with cryptography before the meeting | 15:54 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make user an object in mapping engine https://review.openstack.org/154934 | 15:55 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow. https://review.openstack.org/156308 | 15:55 |
| *** marg7175 has quit IRC | 15:55 | |
| morganfainberg | dolphm: sure. Even if not I told lbragstad to have a backup because key czar might not make the cut for global reqs. So spec ammend might be needed anyway. | 15:55 |
| ayoung | dolphm, that is fine. Also, We should make the impl such that we can swap the signing mechanism. I can see arguments for both symmetric and asym, and I'd like to be able to use either. If the symmetric stuff gets held up, we can still support asym with the existing, and move to symmetric as soon as we have a good solution. | 15:56 |
| ayoung | I think that symmetric will likely be the default most people want | 15:56 |
| ayoung | but I think that will require us getting Kite up to speed for key sharing. | 15:57 |
| dolphm | morganfainberg: i'm not a fan of keyczar's docs. i also opened a security-related bug with patch and it has sat for 4 days so far | 15:57 |
| dolphm | ayoung: i don't see a reason to block a kilo implementation on flexibility we're not going to use in kilo though | 15:58 |
| morganfainberg | dolphm: it is lightly maintained at best. It also locks us into sha1 | 15:58 |
| ayoung | dolphm, yeah, no reason to block...I'm more concerned with making sure we have something that we can use | 15:58 |
| morganfainberg | dolphm: since it doesn't do more secure digests. | 15:58 |
| ayoung | I'm sorry if I cam off as unsupportive | 15:58 |
| ayoung | I really like the idea. | 15:59 |
| morganfainberg | So likely we need to either get fixes in *or* use something better long term. | 15:59 |
| ayoung | We do have to be aware the adding crypto libraries is more of a burden to the distros than adding regular libraries. | 15:59 |
| morganfainberg | The only big concern with keyczar is if we use it, and decide to change we have to potentially migrate the "repo". | 16:00 |
| *** marg7175 has joined #openstack-keystone | 16:01 | |
| ayoung | If we need to drive work in a separate library, I'd rather focus efforts on cryptography.py | 16:01 |
| morganfainberg | Aside from potential security / major bugs and lack of clear maintenance. | 16:01 |
| morganfainberg | ayoung: I agree for sure on that front. | 16:01 |
| *** marg7175 has quit IRC | 16:01 | |
| *** marg7175 has joined #openstack-keystone | 16:02 | |
| amakarov | if we have crypto system pluggable why not use any or even all of them? | 16:02 |
| ayoung | morganfainberg, let's see if nkinder is up (he's recovereing from Pewmonia) as this kind of key management is what the rest of his (my) team does. We might be able to throw some weight behind getting a long term solution ready | 16:03 |
| ayoung | amakarov, the issue, I think, is symmetric key storage | 16:03 |
| ayoung | amakarov, in SSL, the symmetric keys are kept in memory only. If you are going to stoar a symmetric key for archival, there is a whole heavyweight handshake | 16:03 |
| morganfainberg | ayoung: pyasn1 is interesting. | 16:04 |
| ayoung | amakarov, I'm not an expert on this, so I am not sure what the right answer is for persisting a symmetric key for sharing between Apache/WSGI worker threads | 16:04 |
| morganfainberg | ayoung: slightly related to crypto stuff. | 16:04 |
| ayoung | morganfainberg, you mean as a message digest format? Yeah. Its more of a standard, but would be slightly more overhjead than the message pack approach | 16:05 |
| *** pnavarro has quit IRC | 16:05 | |
| morganfainberg | No the lib | 16:05 |
| morganfainberg | Pyasn1 is a python lib. | 16:05 |
| ayoung | morganfainberg, pyasn1 if for handling the asn1 format | 16:05 |
| ayoung | I can't claim to know it well, but I have worked with it in the CMS code | 16:05 |
| morganfainberg | Right was looking at it possibly for simplifying the OpenSSL call outs. | 16:05 |
| morganfainberg | Since PKI tokens aren't going away anytime soon. | 16:06 |
| ayoung | its not so much crypto as it is a wire format for binary data | 16:06 |
| lbragstad | redrobot: seemed to suggest that as long as we are using digital signatures and a digest attached to the token, we should be fine | 16:06 |
| ayoung | morganfainberg, so...yeah, here is what I was origianlly thinkgin | 16:06 |
| lbragstad | cc dolphm ^ | 16:06 |
| ayoung | we get a pki token, undoe the base64, then use pyas1 to pull out the signing info. With that, we could select which key to use for validation | 16:07 |
| dolphm | lbragstad: well then the only issue is that cryptography probably has better support behind it as a library than keyczar | 16:07 |
| lbragstad | dolphm: probably, but I wouldn't be able to say for sure | 16:07 |
| dolphm | lbragstad: do you have any changes you'd like to make that aren't already in review? i was going to take the latest patchset and convert it to use cryptography in the next couple hours | 16:07 |
| lbragstad | both signing and encrypting seem to work well for what we're using it for | 16:08 |
| lbragstad | dolphm: tons | 16:08 |
| lbragstad | I'm working on the trust stuff right now... | 16:08 |
| dolphm | lbragstad: o | 16:08 |
| lbragstad | I had to do a refactor for the naming | 16:08 |
| lbragstad | so that touched everything | 16:08 |
| morganfainberg | ayoung: so shared keys for Apache. There are three (good) ways you can do it - but it's a headache in all cases. We used one or two of them when j worked on CDN stuff. But in short the wsgi processes need to have access to the keys and so the either need to source them each time or the keys need to be file system accessible. | 16:08 |
| dolphm | lbragstad: i'll just make minimal changes in a separate review then | 16:08 |
| *** marg7175 has quit IRC | 16:08 | |
| ayoung | Ideally, I would like to be able to make all those same mechanisms work with the data inside the AE approach. The only thing missing in the current KLWT spec is some way of identifying the signer, but I think I don't want to add that yet. That would be a good add on for a later token format | 16:09 |
| morganfainberg | ayoung: direct nss integration is one of them. | 16:09 |
| lbragstad | dolphm: I just need to add some tests for the trust case, | 16:09 |
| ayoung | So use an nss database for the key? Yeah, I figured that was one use case. I'm guessing then that openssl has something comparable. | 16:09 |
| morganfainberg | ayoung: afaik, not easily. But this was years ago. | 16:10 |
| ayoung | http://stackoverflow.com/questions/10472697/how-can-i-save-a-encryption-key-securely-on-a-system-openssl-c | 16:11 |
| ayoung | lets see | 16:11 |
| morganfainberg | We ended up using an ids run, tripwire, and stored keys in a selinux wrapped ram disk location that had triggers to dump the ram if the ids triggered, the cage was opened, the chassis was opened, etc | 16:11 |
| morganfainberg | ayoung: ^^ because the alternatives got really icky. And we reran ids stuff a lot to ensure integrity. | 16:11 |
| morganfainberg | But again, years ago. | 16:11 |
| ayoung | morganfainberg, the ideal is a hardware security device, but NSS makes that abstraction fairly easy to work with. I'm guessing that openssl has had to do the same thing | 16:13 |
| *** marg7175 has joined #openstack-keystone | 16:13 | |
| morganfainberg | ayoung: not really feasible for keystone since keystone doesn't control the OS. Though we could do the same thing Apache does - support a couple (basic) ways of getting keys and let the deployer solve it (even if the way most people deploy it is use root/limited access file system). Add in a simple way for someone to use say Barbican etc (plug point) | 16:14 |
| dolphm | lbragstad: i'm going to carry a patch on top of yours; no worries | 16:14 |
| lbragstad | dolphm: thanks! | 16:14 |
| ayoung | morganfainberg, doesn't have to be the out-of-box solution, just has to be possible. pkcs11 | 16:14 |
| ayoung | looks like there are 3rd party libs for openssl pkcs11 support | 16:14 |
| ayoung | http://blog.go-lan.net/openssl-hsm-integration/ | 16:15 |
| morganfainberg | Sure. | 16:15 |
| * morganfainberg feels so dumb today. | 16:16 | |
| morganfainberg | Had to change my flight because I left my prescription at home. Found out as I was getting my boarding pass to go through security. | 16:17 |
| morganfainberg | 2hr drive home and a flight at 9pm tonight instead. | 16:17 |
| amakarov | morganfainberg, please suggest me, what can I do to https://review.openstack.org/#/c/153307/ ? Am I to wait with this patch till we have functional testing or try to figure something out myself? | 16:23 |
| morganfainberg | amakarov: I was waiting to talk to you about that actually. | 16:24 |
| *** my_rudzha_userna has joined #openstack-keystone | 16:24 | |
| my_rudzha_userna | hello? | 16:24 |
| my_rudzha_userna | if keystone.roles.grant doesn't add roles to users, then what does? | 16:24 |
| morganfainberg | The patch looks good. Maybe we just need to mock a redis thing to make sure we aren't breaking the lock with changes in the future. | 16:25 |
| morganfainberg | amakarov: ^^. Any thoughts? | 16:25 |
| amakarov | morganfainberg, I thought almost the same, the idea is to mock redis (or whatever is used as a backend) and make sure that nothing unexpected is called from it | 16:27 |
| morganfainberg | Yeah. That is my only real concern. That we know if we broke what we're fixing win your fix for the lock. | 16:27 |
| morganfainberg | I don't expect to actually test redis until functional testing is in place. | 16:28 |
| *** abhirc has quit IRC | 16:28 | |
| amakarov | morganfainberg, thanks, I'll proceed with it | 16:28 |
| morganfainberg | amakarov: sounds good. Like I said everything looks good there. Just want to make sure we don't regress. But wasn't sure of the best approach (which was why no negative score) | 16:29 |
| *** marg7175 has quit IRC | 16:29 | |
| *** marg7175 has joined #openstack-keystone | 16:30 | |
| my_rudzha_userna | hello? | 16:31 |
| *** amerine has joined #openstack-keystone | 16:31 | |
| ayoung | my_rudzha_userna, it does add roles to users | 16:33 |
| my_rudzha_userna | no, it didn't for me | 16:33 |
| ayoung | my_rudzha_userna, specifically, it assigns a role to a user in a project or in a domain | 16:33 |
| ayoung | my_rudzha_userna, I would need more information to debug | 16:33 |
| *** rudzha has joined #openstack-keystone | 16:38 | |
| rudzha | hello? | 16:38 |
| rudzha | keystone.roles.grant(role=role_id, user=user_id, project=proj_id) | 16:38 |
| rudzha | is how I pass it the parameters | 16:38 |
| *** my_rudzha_userna is now known as my_openstack_use | 16:39 | |
| dolphm | lbragstad: both TestStandardTokenFormatterWithEncryption and TestStandardTokenFormatterWithSigning use purpose='sign' !! | 16:39 |
| my_openstack_use | bitch | 16:40 |
| lbragstad | dolphm: I already fixed | 16:40 |
| dolphm | lbragstad: k | 16:40 |
| dolphm | lbragstad: you should, you know, push those changes back to gerrit ;) | 16:41 |
| rudzha | sorry, ignore that, colleague saw my pc unattended | 16:41 |
| lbragstad | dolphm: just wrapping up some tests | 16:41 |
| dolphm | rudzha: +1 for being security-minded | 16:41 |
| dolphm | lbragstad: also, i get 188 chars in test_encrypted_token_is_under_255_characters | 16:41 |
| dolphm | lbragstad: using cryptographer.fernet | 16:41 |
| dolphm | lbragstad: how does that compare to sign / encrypt with keyczar? | 16:42 |
| lbragstad | dolphm: chechking | 16:42 |
| lbragstad | dolphm: http://pasteraw.com/lunvuh82rkaxrx722oooyf164jicwyr | 16:43 |
| lbragstad | the first token prefixed with KLWT00 | 16:43 |
| lbragstad | is an unscoped token | 16:44 |
| lbragstad | the second, prefixed with KLWT01, is a token scoped with a trust | 16:44 |
| ayoung | my_openstack_use, I'll give you benefit of the doubt that "bitch" was directed at your IRC client or something.... | 16:45 |
| ayoung | ah...heh | 16:45 |
| *** Ephur has quit IRC | 16:46 | |
| *** blinky_ghost has joined #openstack-keystone | 16:46 | |
| rudzha | so about that user role granting, does it matter if the ids are unicode strings | 16:46 |
| *** nellysmitt has quit IRC | 16:47 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 16:48 |
| blinky_ghost | hi all, can anybody explain me how "policy back-end" works in Keystone? Does it use SQL as backend to create rules of access or uses policy.json type files? Or am I confused? :) Thanks | 16:48 |
| dolphm | lbragstad: ayoung: morganfainberg: no persistence or key rotation is implemented, but there you go ^ | 16:48 |
| dolphm | blinky_ghost: it's just a db-backed storage mechanism for policy.json-like policy blobs | 16:49 |
| blinky_ghost | dolphm: so I can save the policies on database or in the file, right? | 16:50 |
| dolphm | blinky_ghost: there's no business logic whatsoever, it's just write blob to database, read blob from database. it's designed to support policy.json or XACML or whatever your policy engine wants to read from a central store | 16:50 |
| *** bknudson has quit IRC | 16:50 | |
| dolphm | blinky_ghost: if you want to revise the oslo policy engine to pull policies from it, yes :) no one has upstreamed such a change AFAIK, but that's what it's intended to handle | 16:51 |
| blinky_ghost | dolphm: OK, cool thanks | 16:52 |
| *** rwsu has joined #openstack-keystone | 16:52 | |
| samueldmq | morganfainberg, ping - would like to talk about keystone gsoc | 16:55 |
| *** lhcheng has joined #openstack-keystone | 16:57 | |
| *** krykowski has quit IRC | 17:00 | |
| *** Guest31726 is now known as dank_ | 17:01 | |
| redrobot | lbragstad dolphm morganfainberg sorry I can't really jump into the conversation right now. We're in the middle of our mid-cycle meetup right now. | 17:03 |
| *** marg7175 has quit IRC | 17:04 | |
| dolphm | redrobot: no worries, already have an implementation running with cryptography :) | 17:04 |
| lbragstad | redrobot: hope you're getting a lot done! | 17:04 |
| openstackgerrit | Merged openstack/keystone: add missing API in docstring of EndpointFilterExtension https://review.openstack.org/149180 | 17:05 |
| *** _cjones_ has joined #openstack-keystone | 17:10 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 17:13 |
| lbragstad | dolphm: tested and pep8'd ^ | 17:13 |
| *** amakarov is now known as amakarov_away | 17:17 | |
| *** marg7175 has joined #openstack-keystone | 17:19 | |
| *** ajayaa has quit IRC | 17:23 | |
| morganfainberg | lbragstad, i see a lot of code restructure that is needed for the KLWT from your POC | 17:24 |
| *** jistr has quit IRC | 17:24 | |
| morganfainberg | samueldmq, sure lets talk post meeting | 17:24 |
| lbragstad | morganfainberg: yeah, I agree with that | 17:24 |
| ayoung | dolphm, that looks about right. Very cool | 17:24 |
| stevemar | jamielennox, ping for when you are up: this bp isn't targeted to anything: https://blueprints.launchpad.net/keystone/+spec/unscoped-catalog can you verify if it's complete and mark it as such, and associate it with k3 milestone | 17:25 |
| morganfainberg | lbragstad, notably checking for the provider string to skip persistence stuff | 17:25 |
| lbragstad | yeah, still working it out | 17:25 |
| morganfainberg | lbragstad, all of that needs to be shuffled so the provider can decide if it should call persistence, the manager shouldn't really care. but this is a good POC showing how it works | 17:25 |
| *** rushiagr is now known as rushiagr_away | 17:29 | |
| ayoung | so the baseline would be to store the sym key in a secure file, the way that we do with PKI. The difference is that PKI we generate the key using a different user, and make sure that the key is readable by the keystone OS user, but probably not writable. That scheme might work for lightweight, but it depends on how often we need to or want to regenerate the key | 17:30 |
| samueldmq | morganfainberg, great! | 17:30 |
| morganfainberg | ayoung, something like that | 17:31 |
| *** ljfisher has joined #openstack-keystone | 17:31 | |
| *** ajayaa has joined #openstack-keystone | 17:37 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 17:37 |
| marekd | breton: ^^ | 17:37 |
| *** rushiagr_away is now known as rushiagr | 17:37 | |
| *** tqtran has joined #openstack-keystone | 17:46 | |
| *** thedodd has joined #openstack-keystone | 17:46 | |
| breton | thank you, looking | 17:51 |
| *** gyee has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v gyee | 17:52 | |
| *** topol has joined #openstack-keystone | 17:57 | |
| *** ChanServ sets mode: +v topol | 17:57 | |
| *** raildo has joined #openstack-keystone | 17:58 | |
| samueldmq | henrynash, ping - can you take a look at https://blueprints.launchpad.net/keystone/+spec/assignment-manager-cleanup | 17:58 |
| samueldmq | henrynash, and then I will put it for non-spec status in the meetin | 17:59 |
| samueldmq | g | 17:59 |
| *** bknudson has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v bknudson | 18:01 | |
| *** bernardo-silva has joined #openstack-keystone | 18:01 | |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone-specs: HMAC signature based token https://review.openstack.org/153803 | 18:04 |
| *** abhirc has joined #openstack-keystone | 18:05 | |
| *** nellysmitt has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone-specs: HMAC signature based token https://review.openstack.org/153803 | 18:08 |
| *** harlowja_away is now known as harlowja_ | 18:10 | |
| *** bknudson has quit IRC | 18:14 | |
| *** bknudson has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +v bknudson | 18:16 | |
| *** jbonjean has quit IRC | 18:16 | |
| *** jbonjean has joined #openstack-keystone | 18:17 | |
| *** thedodd has quit IRC | 18:18 | |
| *** jbonjean has quit IRC | 18:21 | |
| *** jbonjean has joined #openstack-keystone | 18:27 | |
| *** ajayaa has quit IRC | 18:30 | |
| *** topol has quit IRC | 18:36 | |
| *** pnavarro has joined #openstack-keystone | 18:37 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 18:39 |
| *** spandhe has joined #openstack-keystone | 18:40 | |
| *** topol has joined #openstack-keystone | 18:40 | |
| *** ChanServ sets mode: +v topol | 18:40 | |
| *** devlaps has joined #openstack-keystone | 18:40 | |
| *** my_openstack_use has quit IRC | 18:43 | |
| *** jasondotstar has joined #openstack-keystone | 18:45 | |
| *** ljfisher has quit IRC | 18:46 | |
| *** devlaps has quit IRC | 18:49 | |
| *** tqtran has quit IRC | 18:55 | |
| anteaya | I was passing by and couldn't pass up the opportunity to troll | 18:58 |
| *** ljfisher has joined #openstack-keystone | 18:58 | |
| morganfainberg | anteaya, and troll you should! | 19:00 |
| marekd | jamielennox: this patch was eventually just a pure copy from ksc, right? | 19:01 |
| stevemar | anteaya, it was good | 19:01 |
| stevemar | bknudson, don't worry about your config option moving! i'm on that one | 19:01 |
| ayoung | morganfainberg, ok, here's the plan with access_info | 19:02 |
| * morganfainberg moves config options when stevemar and bknudson aren't looking | 19:02 | |
| *** rushiagr is now known as rushiagr_away | 19:02 | |
| ayoung | I'm going to submit the model code as a standalong patch, the tests and tie if for the client as a second one | 19:02 |
| anteaya | :) | 19:03 |
| morganfainberg | ayoung, ++ | 19:03 |
| ayoung | only the first is needed for the keystone server side, and we can mark the client side model code as experimental | 19:03 |
| morganfainberg | ayoung, perfect. | 19:03 |
| morganfainberg | ayoung, should make it easier to review that way. | 19:03 |
| jamielennox | marekd: yes | 19:03 |
| ayoung | getting it to work with the tests relatively unscathed is, I think going to be necessary for any sort of compatibility, so at least one more pass there before I split the patch | 19:03 |
| ayoung | morganfainberg, do we need to still support diablo tokens in the client? | 19:04 |
| morganfainberg | ayoung, uh. i want to say no, but... cc dolphm ^ thoughts? | 19:04 |
| marekd | jamielennox: and this can be treated as bug not bp ? | 19:05 |
| jamielennox | marekd: honestly i don't think it needs either - we are establishing the new repo with existing code, bug was on request | 19:06 |
| marekd | jamielennox: ok, i am +A | 19:06 |
| ayoung | morganfainberg, one potential approach is that I can hack out V2 and earlier support in my code. It means leaving around a larger portion of the existing code. So only V3 tokens would make use of the unified access info | 19:06 |
| morganfainberg | i really wish we could only issue v3 tokens and have middleware do conversions | 19:07 |
| morganfainberg | but... i don't think we can do that. | 19:07 |
| ayoung | morganfainberg, I do have code that converts a V2.0 token to the unified access info, but we don't need to use it. | 19:08 |
| ayoung | I don't have something that will go access_info to V2 | 19:08 |
| morganfainberg | thats the part we'd need | 19:09 |
| *** ljfisher has quit IRC | 19:09 | |
| morganfainberg | and only in 1 place really. | 19:09 |
| ayoung | and that might break things dependant on deep knowledge of the token response structure | 19:09 |
| morganfainberg | POST to /v2.0/tokens | 19:09 |
| ayoung | that can, I think, be a separate patch | 19:09 |
| morganfainberg | or GET on v2.0/tokens | 19:09 |
| ayoung | morganfainberg, nah, on the client side, it is more important | 19:09 |
| morganfainberg | no i meant in the case of having less cruft. | 19:10 |
| ayoung | right...that would need to be written anyway | 19:10 |
| ayoung | so.... | 19:10 |
| morganfainberg | i'm ok with staging it | 19:10 |
| morganfainberg | v3 tokens first | 19:10 |
| morganfainberg | then v2 | 19:10 |
| ayoung | this patch will start with model. On the client side, a second patch will use unified for V3tokens only | 19:10 |
| ayoung | then we work on v2 token generation | 19:10 |
| ayoung | and we could unify based on that | 19:10 |
| morganfainberg | ok i need to go get some coffee. | 19:12 |
| morganfainberg | since i had to change my flight... things have been wonky | 19:13 |
| marekd | bon app | 19:13 |
| *** samueldmq has quit IRC | 19:16 | |
| raildo | ayoung: So, we think in broke the reseller implementation in some patches, but the flow is something like: create the constraints ( block the creation of projects and domains whose name contain '/', block the creation of projects and domains whose parent name contain '/') | 19:16 |
| raildo | ayoung: this is a ease work... | 19:16 |
| ayoung | sounds aboutright | 19:16 |
| ayoung | ok...let me see if I can remember my thinking on domain is a project.... | 19:16 |
| ayoung | for reseller, it makes sense to have domain be an org boundary | 19:16 |
| ayoung | and a domain under a project that is not a domain was problematic | 19:17 |
| *** abhirc has quit IRC | 19:17 | |
| raildo | ayoung: after that I'm working now to allow create a project with is_domain flag using the Project API... (I'm finishing this patch) and I'll send this tomorrow | 19:17 |
| raildo | ayoung: right | 19:18 |
| ayoung | the choices were, as recall, keeping domain in its own table of is_domain flag | 19:18 |
| ayoung | the issue was the potential, and likely, conflict over naming | 19:18 |
| ayoung | right now the "RAILDO" domain can contain the "RAILDO" project | 19:18 |
| raildo | ayoung: right... | 19:19 |
| ayoung | even if we make an exception, the users will get confused | 19:19 |
| raildo | ayoung: we just can't have both in the same level... | 19:19 |
| ayoung | I would argue that the intention above is for them to be the same thing, but we've already set the identifiers | 19:19 |
| ayoung | and I think changing the domain_id is probablyt a no-go | 19:20 |
| *** openstackgerrit has quit IRC | 19:20 | |
| *** openstackgerrit has joined #openstack-keystone | 19:20 | |
| ayoung | of all the things to modify, that is probably the safest, though.... | 19:20 |
| ayoung | Now, are we saying that project name is unique throught the domain, or just in one nesting level? | 19:21 |
| *** abhirc has joined #openstack-keystone | 19:21 | |
| ayoung | cuz if it is not unique, then we need to be able to refere to a project by its relative name: in this case RAILDO/RAILDO | 19:21 |
| *** ajayaa has joined #openstack-keystone | 19:22 | |
| raildo | ayoung: we can distinguish a project and a domain with the same name, in different levels.. | 19:23 |
| raildo | ayoung: but if in the same level, we can't distinguish to get a project scoped token using the Name... | 19:23 |
| ayoung | raildo, right | 19:24 |
| raildo | ayoung: so, yes we can have something like RAILDO/RAILDO but not other brother RAILDO :P | 19:24 |
| ayoung | which will break people that are currrently referring to their project as just RAILDO | 19:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/130050 | 19:25 |
| *** jimbaker has quit IRC | 19:25 | |
| raildo | ayoung: yes... if you want to get a scoped token using the name, you need to pass the whole hierarchy name. | 19:26 |
| raildo | ayoung: so after migrate the domains (your patch) to the project table, we will change the domains operations in the drive, to referencing the project table... | 19:28 |
| raildo | ayoung: and to finish this, we will create some API calls https://review.openstack.org/#/c/153007/ | 19:29 |
| ayoung | raildo, so either we break things, or we do the domainid migration. | 19:29 |
| ayoung | which also breaks things | 19:29 |
| raildo | ayoung: we will just remove the domain table, after the migration and with the domains calls working in the project table.... so we will not break things | 19:30 |
| ayoung | what if the domain name matches the project name? | 19:30 |
| *** ljfisher has joined #openstack-keystone | 19:31 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Drop foreign key (domain_id) from user and group tables https://review.openstack.org/156488 | 19:32 |
| openstackgerrit | Merged openstack/keystone: Make federated domain configurable https://review.openstack.org/156461 | 19:32 |
| stevemar | \o/ | 19:33 |
| raildo | in the migration we don't have this problembecause they are not in the same level,so after that we can't have a subdomain and a project in the same level. | 19:33 |
| raildo | (with the same name)... | 19:33 |
| marekd | jamielennox: re https://review.openstack.org/#/c/150627/6 , http://logs.openstack.org/27/150627/6/gate/gate-python-keystoneclient-federation-requirements/6bb7baf/console.html are we happy with changing requirements python-keystoneclient > 1.0.0. to 1.1.0 ? | 19:37 |
| *** browne has joined #openstack-keystone | 19:37 | |
| *** blinky_ghost has quit IRC | 19:37 | |
| jamielennox | marekd: oh - yea, that's not an issue | 19:37 |
| jamielennox | marekd: can fix that quickly | 19:37 |
| marekd | jamielennox: OK | 19:37 |
| raildo | ayoung: so, for 2/24 I intend to have this implementation ready, we just have to create later the API calls, to list domains and projects using the parent_id... list projects using the "is_domain" flag, and now the recursive deletion | 19:38 |
| raildo | ayoung: what do you think? | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 19:39 |
| jamielennox | marekd: ^ | 19:39 |
| marekd | jamielennox: yep, thanks. | 19:39 |
| stevemar | jamielennox, marekd +2d it | 19:40 |
| stevemar | thanks a lot jamielennox | 19:40 |
| ayoung | raildo, so if a domain has the same name as a project, and we do an operation by project name, we get the non-domain one? | 19:40 |
| marekd | stevemar: let's wait for jenkins and then +A | 19:42 |
| stevemar | marekd, you can +A now, jenkins won't merge it | 19:43 |
| marekd | stevemar: ah, ok. | 19:43 |
| raildo | ayoung: we are join the assignments type, right? so, you can get a token for project or domain scoped, for a project with the domain flag enabled, we are just not allow to have a sub-domain and a project in the same level with the same name to have a way to distinguish both. | 19:44 |
| ayoung | raildo, I'm aware that we can make it work mechanically. I'm not certain that we can do it without confusing the hell out of end users | 19:45 |
| marekd | gyee, ayoung,stevemar: morganfainberg is there even a use case where ephemeral user is a member of non-federated domain? | 19:45 |
| ayoung | morganfainberg, does this make sense: if a domain has a project, and the project has the same name, assume that they are supposed to be the same thing, and migrate the domain ID to match the project ID? | 19:45 |
| marekd | i think not | 19:46 |
| ayoung | marekd, I'd say yes | 19:46 |
| ayoung | member mean "assigne a role in" and yes, that is a primary use case | 19:46 |
| dstanek | bknudson: when tests fail is there a way i can see the traceback if the output is larger than my scrollback buffer? | 19:46 |
| raildo | ayoung: I think that we need to make this clear in the documentation. something like we put here: https://review.openstack.org/#/c/153007/2/api/v3/identity-api-v3.rst line 1791 | 19:46 |
| bknudson | dstanek: I don't know ... you can run failing tests again with --failing | 19:47 |
| bknudson | I bet the output is in the .testrepository db somewhere | 19:47 |
| ayoung | stevemar, bknudson, same question I just asked morganfainberg , does this make sense: if a domain has a project, and the project has the same name, assume that they are supposed to be the same thing, and migrate the domain ID to match the project ID? | 19:47 |
| dstanek | bknudson: this change may have made it harder to run the tests - does nova actually use this? | 19:48 |
| *** ljfisher has quit IRC | 19:49 | |
| bknudson | dstanek: I copied it from nova -- http://git.openstack.org/cgit/openstack/nova/tree/tox.ini#n21 | 19:49 |
| *** ajayaa has quit IRC | 19:49 | |
| bknudson | although it's possible they make all sorts of changes. | 19:49 |
| stevemar | ayoung, i dunno about that one... this is for making all domains a project? | 19:52 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make user an object in mapping engine https://review.openstack.org/154934 | 19:58 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/156738 | 19:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/156739 | 19:59 |
| raildo | stevemar: this is about migrate the domains to the project table... Imagine that now, we have a domain "sales" and inside this domains exist a project with the name "sales". In the spec we say that we will migrate this domain sales, creating a new project. So we will have Sales/Sales. | 19:59 |
| raildo | I don't see a huge problem with that, since the users knows (before that migration) that its exists... | 20:00 |
| raildo | The user create this, not us :P | 20:00 |
| *** marg7175 has quit IRC | 20:00 | |
| bknudson | dstanek: if the pretty_tox isn't working for us then we can revert the change... or work with nova to see if they're seeing the same problems | 20:00 |
| stevemar | raildo, but what if there were role assignment different between domain and project | 20:01 |
| openstackgerrit | Merged openstack/python-keystoneclient-federation: Copy the existing federation plugins over. https://review.openstack.org/150627 | 20:03 |
| raildo | stevemar: in the role assignment we don't differentiate between both. Since we have domain_admin and project_admin... you can use this roles to distinguish both in the policy. We can distinguish a domain and a project when the user request a token. | 20:03 |
| *** marg7175 has joined #openstack-keystone | 20:03 | |
| dstanek | bknudson: is anyone else complaining for keystone? i usually don't use testr anyway so i'd be ok with leaving it as is if nobody else cares | 20:04 |
| *** bernardo-silva has quit IRC | 20:06 | |
| bknudson | dstanek: I haven't heard any other complaints... I haven't run into the issue you did... I just have a huge scrollback buffer. | 20:06 |
| *** nellysmitt has quit IRC | 20:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for most resources https://review.openstack.org/151137 | 20:09 |
| *** nellysmitt has joined #openstack-keystone | 20:12 | |
| stevemar | https://review.openstack.org/#/c/155982/ << needs a +A from non-ibmer | 20:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Authenticate local users via federated workflow. https://review.openstack.org/156308 | 20:13 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Publicize region/endpoint/policy/service events https://review.openstack.org/151774 | 20:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notification handling for policy/region/service/endpoint https://review.openstack.org/151786 | 20:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add a test for create_domain in notifications https://review.openstack.org/151791 | 20:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 20:15 |
| *** _cjones_ has quit IRC | 20:16 | |
| *** _cjones_ has joined #openstack-keystone | 20:16 | |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone-specs: HMAC signature based token https://review.openstack.org/153803 | 20:23 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 20:26 |
| *** ljfisher has joined #openstack-keystone | 20:35 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Made project_id required for ec2 credential https://review.openstack.org/155974 | 20:40 |
| *** haneef has joined #openstack-keystone | 20:40 | |
| *** ljfisher has quit IRC | 20:41 | |
| ayoung | raildo, stevemar sorry...real world interrup there. | 20:42 |
| *** _cjones_ has quit IRC | 20:42 | |
| ayoung | I'm wondering if we really need it, then. Could we punt on domain is a project, if we are going to have to go through convolutions to make things clear to the end users anyway? | 20:43 |
| ayoung | The reason for domain-is-a-project was to have a cut point in the hierarchy | 20:43 |
| ayoung | but...if projects must be under domains, and domains can only be nested under domains, maybe the problem goes away | 20:44 |
| ayoung | I think that is probably the sanest approach: | 20:44 |
| ayoung | domain can have a parent domain, user can only be in a domain, and domain's contain projects. DOesn't that still meet all the requirements of the reseller case? | 20:45 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove check_role_for_trust from sample policies https://review.openstack.org/156763 | 20:47 |
| ayoung | lhcheng, should we maybe leave the public method there, and just have it call the private method? | 20:48 |
| lhcheng | ayoung, thought of not exposing more than what we need to. more flexibility for us if we need to change the signature later. | 20:51 |
| ayoung | lhcheng, that is usually the case for new code, but in this case the function is already public...not that I would expect anything to call that, but...who knows | 20:51 |
| lhcheng | ayoung, you have a point... | 20:52 |
| lhcheng | so change it something like: | 20:52 |
| lhcheng | def check_role_for_trust(self, context, trust_id, role_id): | 20:52 |
| lhcheng | return self._check_role_for_trust(self, context, trust_id, role_id) | 20:52 |
| lhcheng | ayoung, that works for you? | 20:52 |
| ayoung | yeah | 20:53 |
| ayoung | needs to still have the policy wrapper too | 20:53 |
| lhcheng | ayoung, cool. Thanks for the review! | 20:53 |
| lhcheng | gotcha | 20:53 |
| ayoung | raildo, let me review the requirements for reseller again, but I think we have a solution, at least partially. There might be an issue with Quotas on the Nova side, if Nova doesn't have Domain level quotas, but I suspect they are going to want them anyway | 20:58 |
| *** marg7175 has quit IRC | 20:59 | |
| raildo | ayoung: Nova folks are implement nested quotas to coverage our implementation... | 21:01 |
| raildo | ayoung: I'm help the guys with this implementation | 21:01 |
| ayoung | raildo, please join #openstack-nova | 21:02 |
| raildo | ok | 21:02 |
| ayoung | I'm discussing there... | 21:02 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove check_role_for_trust from sample policies https://review.openstack.org/156763 | 21:02 |
| *** ljfisher has joined #openstack-keystone | 21:05 | |
| *** _cjones_ has joined #openstack-keystone | 21:11 | |
| *** ljfisher has quit IRC | 21:13 | |
| raildo | ayoung: a project and a subproject (or a domain and a project) with the same name its ugly, I know it, but imo this is not a huge problem for now, we discuss a lot of this during the spec, we find a lot of options and we decide to keep have a domain and a project with the same name. | 21:15 |
| ayoung | raildo, ok...I'm cautiously optimistic then. | 21:16 |
| *** drjones has joined #openstack-keystone | 21:16 | |
| *** _cjones_ has quit IRC | 21:16 | |
| ayoung | I think for the Quota sake we need to unify, so lets drive on. But can you point me to a link where the converstaion is summarized, or put it in an etherpad or something | 21:16 |
| raildo | ayoung: hahaha you will be more optimistic, I believe in that! | 21:16 |
| ayoung | raildo, I need to be able to point other people at it | 21:17 |
| raildo | ayoung: a link with this conversation about have a domain and a project with the same name? | 21:18 |
| ayoung | and how to deal with the clash, or why it doesn't matter, yes | 21:18 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 21:18 |
| ayoung | raildo, it can be a pointer and time hack for the conversation in IRC. THey are all in evesdrop | 21:18 |
| raildo | ayoung: ok, I'll take a look in the conversation logs | 21:18 |
| ayoung | thanks...I'm in a meeting for the next 40 minutes or so...talk to you after that | 21:19 |
| raildo | ayoung: I have to go now, later I'll send this to you. | 21:20 |
| ayoung | ++ | 21:20 |
| raildo | its carnival here, I need to stay a little with my family hahaha | 21:20 |
| *** aix has quit IRC | 21:20 | |
| lhcheng | for triaging and setting priority on bugs, does it have to be core to do that? | 21:22 |
| *** raildo has quit IRC | 21:22 | |
| ayoung | stevemar, Domains for federated users....you actively working on that? I don't remember seeing it in today's meeting, and I'm about to be grilled on it | 21:22 |
| stevemar | ayoung, that was merged just before the meeting | 21:23 |
| ayoung | stevemar, you just made me look good. First beers on me | 21:23 |
| *** marg7175 has joined #openstack-keystone | 21:23 | |
| *** marg7175 has quit IRC | 21:24 | |
| stevemar | ayoung, it'll default to "Federated" but we made it a config option just in case | 21:24 |
| stevemar | in case a deployer already has a domain named federated | 21:24 |
| *** marg7175 has joined #openstack-keystone | 21:24 | |
| *** marg7175 has quit IRC | 21:24 | |
| ayoung | and we can map a user to an existing user in a different domain, or that is a differnt patch and deferred to LizardLoze? | 21:24 |
| *** marg7175 has joined #openstack-keystone | 21:25 | |
| *** nellysmitt has quit IRC | 21:25 | |
| morganfainberg | ayoung, that is related to this | 21:25 |
| morganfainberg | ayoung, but a separate patch.. i think it should land in kilo iirc | 21:25 |
| ayoung | so what we have now is just that Federated user by default go into the Federated domain | 21:26 |
| ayoung | and the other...outstanding patch on it? | 21:26 |
| *** drjones has quit IRC | 21:31 | |
| morganfainberg | ayoung, marekd is working on it. it's part of the same spec | 21:31 |
| morganfainberg | the one we discussed at the midcycle | 21:31 |
| *** _cjones_ has joined #openstack-keystone | 21:31 | |
| morganfainberg | ayoung, iirc. but i'd need to go chase it down to be sure. | 21:31 |
| * morganfainberg is in meeting atm. | 21:31 | |
| stevemar | ayoung, yes, you have the right info | 21:33 |
| stevemar | this is the patch to authenticate local users https://review.openstack.org/#/c/154934/ | 21:33 |
| stevemar | and this one... https://review.openstack.org/#/c/156308/ | 21:34 |
| stevemar | but those should be the last pieces to the puzzle | 21:34 |
| morganfainberg | stevemar, thanks. | 21:34 |
| stevemar | np | 21:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 21:37 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 21:39 |
| *** rm_work is now known as rm_work|away | 21:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update sample config file https://review.openstack.org/156786 | 21:46 |
| stevemar | easy peasy ^ | 21:46 |
| stevemar | also easy peasy: https://review.openstack.org/#/c/154783/ | 21:47 |
| *** zzzeek has quit IRC | 21:51 | |
| dstanek | stevemar: are we allowed to modify the config file now? | 21:54 |
| stevemar | dstanek, it's fine to do it in spurts, just *not* part of a patch | 21:55 |
| stevemar | it should ideally be the only change in a patch | 21:55 |
| stevemar | so it doesn't cause rebase issues | 21:55 |
| *** gyee has quit IRC | 21:55 | |
| stevemar | i think it's especially important after adopting an oslo library :) to make sure we don't lose any options | 21:56 |
| dstanek | stevemar: cool, i didn't know that | 21:56 |
| dstanek | hmmm...or maybe i did - it appears to be in my notes, but apparently not in my head | 21:57 |
| stevemar | dstanek, reset the router between notes and head | 21:58 |
| stevemar | :) | 21:58 |
| *** bknudson has quit IRC | 22:00 | |
| ayoung | morganfainberg, please release Kerberos! | 22:05 |
| ayoung | Let slip the dogs of....Hades? | 22:05 |
| morganfainberg | I said it would happen today. | 22:05 |
| *** joesavak has quit IRC | 22:07 | |
| richm | just drink from the river Lethe . . . | 22:08 |
| *** henrynash has quit IRC | 22:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 22:14 |
| *** henrynash has joined #openstack-keystone | 22:14 | |
| *** ChanServ sets mode: +v henrynash | 22:14 | |
| stevemar | marekd, ^ | 22:14 |
| stevemar | rodrigods, ayoung could either take a look at: https://review.openstack.org/#/c/156404 and https://review.openstack.org/#/c/156405 they should be the last 2 patches for policy | 22:17 |
| morganfainberg | ayoung, jamielennox, python-keystoneclient-kerberos 0.1.0 has been tagged | 22:17 |
| morganfainberg | let me know if there are any issues | 22:17 |
| ayoung | TYVM! | 22:17 |
| ayoung | stevemar, looking | 22:18 |
| stevemar | ayoung, they are super minor, but we're just really ironing out everything before tag/release anything | 22:18 |
| ayoung | Elide to skip....oh come on! | 22:18 |
| stevemar | ayoung, oh wow, that's a word | 22:19 |
| ayoung | Yes it is. Yes it is. | 22:19 |
| ayoung | json to JSON | 22:19 |
| ayoung | OK. | 22:19 |
| ayoung | Think I can get behind that one | 22:19 |
| stevemar | i did it mostly for the elide one, i thought it was slide haha | 22:19 |
| ayoung | +2A on that | 22:19 |
| ayoung | it is ok. If you thought that, others would too. Maybe it is not a word in Canada | 22:20 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/156738 | 22:21 |
| stevemar | ayoung, i'm totally going to start using elide in everyday scenarios | 22:21 |
| *** ljfisher has joined #openstack-keystone | 22:21 | |
| stevemar | just to see how many people will look at me funny (more so than usual) | 22:21 |
| ayoung | +2 a on te quotes one | 22:22 |
| ayoung | stevemar, ... | 22:22 |
| *** jimbaker has joined #openstack-keystone | 22:23 | |
| stevemar | :D | 22:23 |
| stevemar | ayoung, i'm making bknudson proud | 22:24 |
| stevemar | henrynash, around? | 22:28 |
| stevemar | henrynash, nopeee, i'll email you | 22:29 |
| *** utahcon has quit IRC | 22:36 | |
| henrynash | stevemare: yes | 22:37 |
| *** zzzeek has joined #openstack-keystone | 22:37 | |
| henrynash | stevemar: even you | 22:37 |
| stevemar | henrynash, just emailed you :D | 22:37 |
| henrynash | ok | 22:38 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Create the temporary files needed for tests https://review.openstack.org/156811 | 22:44 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Change default set of tox environments https://review.openstack.org/156812 | 22:44 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Fix i18n imports https://review.openstack.org/156813 | 22:44 |
| *** bknudson has joined #openstack-keystone | 22:48 | |
| *** ChanServ sets mode: +v bknudson | 22:48 | |
| *** gyee has joined #openstack-keystone | 22:49 | |
| *** ChanServ sets mode: +v gyee | 22:49 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 23:01 |
| *** pnavarro has quit IRC | 23:02 | |
| stevemar | ah %^&* | 23:03 |
| stevemar | oslo.log broke the build :( | 23:03 |
| stevemar | http://logs.openstack.org/77/136177/22/check/check-tempest-dsvm-postgres-full/b415cc4/logs/screen-key.txt.gz#_2015-02-17_22_28_58_167 | 23:03 |
| stevemar | i think merging this will fix it: https://review.openstack.org/#/c/154783/ | 23:03 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove check_role_for_trust from sample policies https://review.openstack.org/156763 | 23:04 |
| openstackgerrit | Merged openstack/oslo.policy: Use single quotes consistently https://review.openstack.org/156404 | 23:04 |
| openstackgerrit | Merged openstack/oslo.policy: Fix minor spelling issues in oslo.policy https://review.openstack.org/156405 | 23:04 |
| stevemar | false alarm :) my patch is calling out "from keystone.openstack.common import log" | 23:06 |
| stevemar | so anyone else's patch now calling "from keystone.openstack.common import log" will fail | 23:06 |
| bknudson | stevemar: build is not broken? | 23:06 |
| stevemar | bknudson, no, just any patch that called out the incubated log will fail to build | 23:07 |
| bknudson | stevemar: good. | 23:07 |
| stevemar | bknudson, that's what i said after analyzing it :P | 23:07 |
| *** thedodd has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 23:08 |
| *** chlong has joined #openstack-keystone | 23:08 | |
| stevemar | bknudson, if you are feeling up to the task: https://review.openstack.org/#/c/154783/ | 23:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend LDAP role testing to the new backend testing module https://review.openstack.org/156830 | 23:12 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend LDAP role testing to the new backend testing module https://review.openstack.org/156830 | 23:16 |
| *** topol has quit IRC | 23:17 | |
| *** timcline has quit IRC | 23:21 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend LDAP role testing to the new backend testing module https://review.openstack.org/156830 | 23:21 |
| *** ljfisher has quit IRC | 23:22 | |
| *** gordc has quit IRC | 23:26 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Fix i18n imports https://review.openstack.org/156813 | 23:27 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Change default set of tox environments https://review.openstack.org/156812 | 23:28 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Create the temporary files needed for tests https://review.openstack.org/156811 | 23:28 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Update comments about tox configuration https://review.openstack.org/156836 | 23:28 |
| *** ljfisher has joined #openstack-keystone | 23:28 | |
| *** deep has joined #openstack-keystone | 23:29 | |
| *** deep has quit IRC | 23:30 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove duplicated test for get_role https://review.openstack.org/156840 | 23:32 |
| *** marg7175 has quit IRC | 23:39 | |
| *** _cjones_ has quit IRC | 23:50 | |
| openstackgerrit | Arvind Tiwari proposed openstack/keystone-specs: HMAC signature based token https://review.openstack.org/153803 | 23:52 |
| *** darrenc is now known as darrenc_afk | 23:52 | |
| *** _cjones_ has joined #openstack-keystone | 23:53 | |
| *** abhirc has quit IRC | 23:53 | |
| *** timcline has joined #openstack-keystone | 23:57 | |
| *** darrenc_afk is now known as darrenc | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!