| *** ljfisher has quit IRC | 00:00 | |
| *** jaosorior has quit IRC | 00:01 | |
| *** ljfisher has joined #openstack-keystone | 00:02 | |
| *** henrynash has quit IRC | 00:07 | |
| *** abhirc has joined #openstack-keystone | 00:12 | |
| *** thedodd has quit IRC | 00:12 | |
| *** ljfisher has quit IRC | 00:18 | |
| *** ljfisher has joined #openstack-keystone | 00:19 | |
| *** abhirc has quit IRC | 00:21 | |
| *** r-daneel has quit IRC | 00:26 | |
| *** dims__ has quit IRC | 00:33 | |
| *** dims__ has joined #openstack-keystone | 00:33 | |
| *** dims__ has quit IRC | 00:33 | |
| *** dims__ has joined #openstack-keystone | 00:35 | |
| *** markvoelker has quit IRC | 00:37 | |
| *** markvoelker has joined #openstack-keystone | 00:37 | |
| *** browne has quit IRC | 00:37 | |
| *** ljfisher has quit IRC | 00:39 | |
| *** bknudson has quit IRC | 00:41 | |
| *** markvoelker has quit IRC | 00:42 | |
| *** david-lyle has quit IRC | 00:44 | |
| *** jasondotstar has quit IRC | 00:55 | |
| *** avozza is now known as zz_avozza | 00:58 | |
| *** zz_avozza is now known as avozza | 00:58 | |
| *** ncoghlan has joined #openstack-keystone | 01:03 | |
| openstackgerrit | Merged openstack/keystone: Remove incubator version of log and local https://review.openstack.org/154783 | 01:08 |
|---|---|---|
| *** avozza is now known as zz_avozza | 01:08 | |
| adam_g | jamielennox, still around? | 01:09 |
| adam_g | keystoneclient question | 01:09 |
| jamielennox | adam_g: yep | 01:09 |
| openstackgerrit | Merged openstack/keystone: Move backend role tests into their own module https://review.openstack.org/156423 | 01:09 |
| adam_g | jamielennox, so im trying to migrate ironic away from directly creating Client objects and instead use a session everywhere it needs. i assume this is the preferred way moving forward? | 01:09 |
| *** timcline has quit IRC | 01:13 | |
| *** timcline has joined #openstack-keystone | 01:14 | |
| jamielennox | adam_g: yes - that's prefered, and great | 01:16 |
| adam_g | jamielennox, cool. so my question is this: theres a case where an ironic service needs to validate a token has not expired, and get a new one if it has. i'm attempting to create a session with a given token, but can't seem to do any operations on that session without it reauthenticating and getting a new token. should i be doing this another way? | 01:17 |
| jamielennox | adam_g: validate as in online validate? | 01:18 |
| jamielennox | like given a token fetch the data from keystone? | 01:18 |
| *** timcline has quit IRC | 01:19 | |
| adam_g | jamielennox, this is the existing check: https://git.openstack.org/cgit/openstack/ironic/tree/ironic/common/keystone.py#n131 | 01:20 |
| jamielennox | adam_g: ok - so you shouldn't need to do that any more. The session will fetch a new token for you when it is required | 01:21 |
| *** zzzeek has quit IRC | 01:22 | |
| jamielennox | or at least if i'm reading this right you won't | 01:23 |
| jamielennox | adam_g: ok - so the point of the session is to handle all this auth and token management for you | 01:23 |
| adam_g | jamielennox, well, in the ironic case it is needed (at least currently) | 01:23 |
| adam_g | the server writes out an admin token to disk, thats later used by a provisioning node to callback to the api server when its ready to proceed with provisioning | 01:23 |
| *** topol has joined #openstack-keystone | 01:23 | |
| *** ChanServ sets mode: +v topol | 01:24 | |
| jamielennox | the _get_ksclient would be converted into an auth plugin, and then when attached to a session that's managed for you | 01:24 |
| adam_g | prior to writing it out, we do a check to see if it will expire during the provisioning process and, if so, refresh it | 01:24 |
| jamielennox | ah | 01:24 |
| jamielennox | are you writing out the whole auth_ref object or just the token string? | 01:25 |
| adam_g | only the token string currently | 01:25 |
| *** timcline has joined #openstack-keystone | 01:25 | |
| jamielennox | so what you are currently doing (it looks like) is not reusing the token that's been written out, but using that token to fetch a new token | 01:25 |
| jamielennox | and in the v3 case not even that - in v3 you are always using user/pass form conf | 01:26 |
| jamielennox | oh - doh, misread that | 01:27 |
| jamielennox | but i think you are still doing a token exchange, rather than validating and reusing the old | 01:27 |
| adam_g | this is the corresponding writeout code https://git.openstack.org/cgit/openstack/ironic/tree/ironic/drivers/modules/pxe.py#n252 | 01:28 |
| jamielennox | they have a similar effect as the new token will be valid for the same period that the old one has remaining, but it is a new token | 01:28 |
| adam_g | theres a timeout that we enforce on the time it will take for the node to callback to the API.. we refresh the token if it looks like it will expire before that timeout | 01:29 |
| jamielennox | ok, but still the way you are instantiating keystoneclient it will fetch a new token using the old one as authentication | 01:31 |
| jamielennox | if you want to keep doing that you can use the ksc.auth.identity.[v2|v3].Token plugins | 01:31 |
| adam_g | so is the existing keystone.py token_expires_soon() not actually checking the expiry of the given token? | 01:31 |
| *** zzzeek has joined #openstack-keystone | 01:31 | |
| adam_g | (i didnt write the existing code, only trying to port it and it looks like thats the behavior /w the new sessions) | 01:32 |
| jamielennox | yes and no | 01:32 |
| jamielennox | when you use a token to get a new token the expiry will be set to the same as the old token | 01:32 |
| jamielennox | so it's checking the expiry of the new token - which happens to equal the expiry of the old token | 01:33 |
| adam_g | im creating a token auth_plugin, using that to create the session. then trying to session.auth.get_auth_ref(self.session) | 01:33 |
| jamielennox | but there is another auth process in ther e | 01:33 |
| adam_g | jamielennox, oh, i think thats making sense to me now | 01:33 |
| * adam_g goes to peak more at the returned auth_ref | 01:34 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 01:34 |
| jamielennox | so what you are doing is very equivalent to the old code, and its trying to auth with that token as a credential | 01:35 |
| adam_g | jamielennox, ok, i got it now. | 01:36 |
| adam_g | jamielennox, thanks for clarifying. would mind sanity checking this when i push it for review tomorrowish? | 01:36 |
| jamielennox | adam_g: sure | 01:37 |
| jamielennox | adam_g: also makes me think how i have a patch that solves a very similar case to this which may have more general use than i first though | 01:37 |
| jamielennox | not ready yet though - sorry | 01:38 |
| adam_g | :P | 01:38 |
| *** spandhe has quit IRC | 01:46 | |
| *** tqtran has joined #openstack-keystone | 01:47 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 01:48 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 01:48 |
| *** rwsu is now known as rwsu-afk | 01:54 | |
| *** markvoelker has joined #openstack-keystone | 01:59 | |
| *** zz_avozza is now known as avozza | 01:59 | |
| jamielennox | ayoung: here? | 02:03 |
| *** stevemar has quit IRC | 02:09 | |
| *** david-lyle has joined #openstack-keystone | 02:11 | |
| *** richm has quit IRC | 02:12 | |
| *** timcline has quit IRC | 02:15 | |
| *** timcline has joined #openstack-keystone | 02:16 | |
| *** _cjones_ has quit IRC | 02:18 | |
| *** abhirc has joined #openstack-keystone | 02:18 | |
| *** timcline has quit IRC | 02:21 | |
| *** stevemar has joined #openstack-keystone | 02:22 | |
| *** ChanServ sets mode: +v stevemar | 02:22 | |
| *** timcline has joined #openstack-keystone | 02:24 | |
| *** erkules has joined #openstack-keystone | 02:28 | |
| *** erkules_ has quit IRC | 02:31 | |
| *** samueldmq has joined #openstack-keystone | 02:35 | |
| *** abhirc has quit IRC | 02:35 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 02:42 |
| *** lhcheng has quit IRC | 02:46 | |
| *** avozza is now known as zz_avozza | 02:56 | |
| *** radez is now known as radez_g0n3 | 02:58 | |
| *** gyee has quit IRC | 03:06 | |
| *** browne has joined #openstack-keystone | 03:09 | |
| *** abhirc has joined #openstack-keystone | 03:10 | |
| *** boris-42 has quit IRC | 03:12 | |
| ayoung | jamielennox, I should not be here. | 03:22 |
| jamielennox | ayoung: that's ok - i got it eventually | 03:22 |
| *** harlowja_ is now known as harlowja_away | 03:22 | |
| jamielennox | ayoung: i still fail as often as not with basic ldap commands | 03:22 |
| ayoung | good. I'm going to bed. I'm taking the next two days off | 03:22 |
| jamielennox | ayoung: cool - enjoy | 03:23 |
| ayoung | so...let me know now if you have anything... | 03:23 |
| ayoung | skiing tomorrow...we'll see on the following day. School vacation. | 03:23 |
| jamielennox | skiing... i'm sitting here sweating | 03:23 |
| jamielennox | haven't been skiing for years now | 03:24 |
| jamielennox | ayoung: have fun | 03:24 |
| ayoung | have to find some positive outlet for all the snow. We've been hammered, as I am sure you've heard. | 03:25 |
| jamielennox | yea, it made the news even here | 03:25 |
| ayoung | Is there any skiing in Australia, or do you have to head to NZ? | 03:25 |
| jamielennox | there's a patch of mountains down on the nsw/victoria border | 03:26 |
| jamielennox | but it's a fair way from everywhere and it's stupidly expensive | 03:26 |
| jamielennox | really have to dedicate a few days to make it worth it | 03:26 |
| ayoung | Vancouver will be too late for ski season even up there | 03:27 |
| ayoung | Though I hear it is stellar skiing | 03:27 |
| jamielennox | they need to offset these summits by a few months | 03:27 |
| jamielennox | It'd be more interesting to go to vancouver in either proper summer, or deep winter | 03:28 |
| ayoung | https://en.wikipedia.org/wiki/Mt_Norquay | 03:28 |
| *** rushiagr_away is now known as rushiagr | 03:28 | |
| ayoung | Still a good way from Vancouver, but if you are coming all the way from Australia during the season it would be worth the extra trip | 03:29 |
| ayoung | OK...bed | 03:29 |
| *** ayoung has quit IRC | 03:29 | |
| *** samueldmq has quit IRC | 03:32 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 03:33 |
| stevemar | booooo on tokenless auth | 03:33 |
| stevemar | now there is more to review :( | 03:34 |
| *** david-lyle has quit IRC | 03:35 | |
| *** david-lyle has joined #openstack-keystone | 03:35 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 03:35 |
| *** david-lyle has quit IRC | 03:40 | |
| *** dims__ has quit IRC | 03:49 | |
| morganfainberg | stevemar, awww no more to review | 03:52 |
| morganfainberg | pooooooor you | 03:52 |
| morganfainberg | s/no more/more | 03:52 |
| morganfainberg | ;) | 03:52 |
| stevemar | morganfainberg, i'm beating the tokenless auth one down | 03:54 |
| *** browne has quit IRC | 04:12 | |
| *** timcline has quit IRC | 04:18 | |
| *** stevemar has quit IRC | 04:20 | |
| *** david-lyle has joined #openstack-keystone | 04:22 | |
| *** david-lyle is now known as david-lyle_afk | 04:23 | |
| *** lhcheng has joined #openstack-keystone | 04:26 | |
| morganfainberg | jamielennox, let me know if there are issues w/ -kerberos stuff | 04:28 |
| morganfainberg | it should be released | 04:28 |
| morganfainberg | well crap | 04:29 |
| morganfainberg | we messed up :( | 04:29 |
| morganfainberg | i'll need to clean this up | 04:29 |
| morganfainberg | we missed the versionin | 04:29 |
| morganfainberg | https://pypi.python.org/pypi/python-keystoneclient-kerberos/2a90b78 | 04:29 |
| morganfainberg | i'll deal with this tmmrow | 04:29 |
| *** stevemar has joined #openstack-keystone | 04:36 | |
| *** ChanServ sets mode: +v stevemar | 04:36 | |
| *** dims__ has joined #openstack-keystone | 04:50 | |
| *** dims__ has quit IRC | 04:54 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove check_role_for_trust from sample policies https://review.openstack.org/156763 | 04:55 |
| lhcheng | stevemar, hopefully bknudson will be happy with the last patch ^ :) | 05:04 |
| *** _cjones_ has joined #openstack-keystone | 05:04 | |
| stevemar | lhcheng, hopefully! | 05:04 |
| lhcheng | I haven't set the deprecation warning before, is the setting "remove_in=+2" correct? | 05:05 |
| openstackgerrit | Merged openstack/keystone: Drop foreign key (domain_id) from user and group tables https://review.openstack.org/156488 | 05:09 |
| *** abhirc has quit IRC | 05:10 | |
| *** timcline has joined #openstack-keystone | 05:19 | |
| *** timcline has quit IRC | 05:24 | |
| *** timcline has joined #openstack-keystone | 05:29 | |
| *** timcline has quit IRC | 05:34 | |
| *** _cjones_ has quit IRC | 05:38 | |
| *** _cjones_ has joined #openstack-keystone | 05:39 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 05:40 |
| stevemar | lhcheng, i believe so | 05:41 |
| lhcheng | stevemar: cool, thanks for the review! :) | 05:41 |
| stevemar | lhcheng, now you have me wondering... | 05:42 |
| lhcheng | hah | 05:42 |
| *** zzzeek has quit IRC | 05:43 | |
| stevemar | lhcheng, looks good: https://github.com/openstack/keystone/blob/18efc7827a2b6767182772134bd00d1c110de7f7/keystone/common/kvs/legacy.py#L49-L52 | 05:43 |
| stevemar | :D | 05:43 |
| lhcheng | lol thanks for checking! | 05:44 |
| lhcheng | you'll get a good sleep now | 05:44 |
| lhcheng | :) | 05:44 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 05:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Removes unnecessary checks when cleaning a domain https://review.openstack.org/146264 | 05:46 |
| *** lhcheng has quit IRC | 05:48 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Enable endpoint_policy, endpoint_filter and oauth by default https://review.openstack.org/153842 | 05:49 |
| *** ajayaa has joined #openstack-keystone | 05:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 05:57 |
| *** markvoelker has quit IRC | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/156895 | 06:04 |
| *** markvoelker has joined #openstack-keystone | 06:04 | |
| *** lhcheng has joined #openstack-keystone | 06:04 | |
| *** lhcheng_ has joined #openstack-keystone | 06:05 | |
| *** lhcheng has quit IRC | 06:05 | |
| *** zz_avozza is now known as avozza | 06:05 | |
| *** tqtran has quit IRC | 06:05 | |
| lhcheng_ | stevemar: when you get a chance, can you take a look at : https://bugs.launchpad.net/python-openstackclient/+bug/1418369 | 06:07 |
| openstack | Launchpad bug 1418369 in python-openstackclient "please support hypervisor servers command" [Medium,Triaged] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 06:07 |
| stevemar | lhcheng_, sure | 06:08 |
| lhcheng_ | stevemar, wondering if we should just close it. | 06:08 |
| lhcheng_ | stevemar, thanks! | 06:08 |
| stevemar | i remember looking at this one | 06:08 |
| stevemar | and was confused by what the author wanted | 06:08 |
| *** markvoelker has quit IRC | 06:08 | |
| lhcheng_ | stevemar, I think he was looking for listing instances by hypervisor | 06:09 |
| stevemar | lhcheng_, so hypervisor-servers is essentially supported, in the form of server list --host vm-ubuntu | 06:10 |
| stevemar | what about hypervisor-stats, and hypervisor-uptime ? | 06:10 |
| jamielennox | morganfainberg: i don't understand - shouldn't it take the version number from the tag you pushed | 06:10 |
| stevemar | i feel like we already report similar info already | 06:10 |
| lhcheng_ | nope, that's another opportunity :) | 06:10 |
| jamielennox | stevemar: you're being online later and later | 06:10 |
| stevemar | jamielennox, it's just 1am, :) | 06:11 |
| stevemar | jamielennox, i feel bad for not reviewing enough | 06:11 |
| lhcheng_ | jamielennox, sshh there's two stevemar, this is the good one | 06:12 |
| lhcheng_ | the guy that gives +2 in the evening | 06:12 |
| lhcheng_ | :P | 06:12 |
| stevemar | lhcheng_, haha | 06:12 |
| stevemar | lhcheng_, compare hypervisor-stats, and hypervisor-uptime to `os usage show` and `os usage list` | 06:12 |
| stevemar | if you can | 06:13 |
| stevemar | i feel like they will be similar | 06:13 |
| stevemar | i'll update the bug with that info | 06:13 |
| lhcheng_ | stevemar: sure, I can do that. | 06:13 |
| jamielennox | heh - he gets tired and just throws the +2 around | 06:13 |
| lhcheng_ | If we need to add that, probably open it as separate bug to make the bug history cleaner | 06:14 |
| stevemar | lhcheng_, ++ | 06:14 |
| stevemar | jamielennox, nah i just pick the easy ones at night to make me calm before sleep | 06:15 |
| lhcheng_ | jamielennox, hah I should submit more code in the evening then :) | 06:15 |
| jamielennox | alright - beach time | 06:15 |
| jamielennox | later all | 06:15 |
| *** avozza is now known as zz_avozza | 06:15 | |
| lhcheng_ | jamielennox, have fun! | 06:16 |
| stevemar | jamielennox, have fun | 06:16 |
| *** jamielennox is now known as jamielennox|away | 06:17 | |
| *** topol has quit IRC | 06:25 | |
| *** timcline has joined #openstack-keystone | 06:30 | |
| *** timcline has quit IRC | 06:34 | |
| stevemar | lhcheng_, i think i'll add the failure case at the end of the chain | 06:43 |
| stevemar | lhcheng_, tired of rebasing :) | 06:43 |
| lhcheng_ | stevemar: hah sure, that's fine :) | 06:43 |
| stevemar | and technically it's just about creating parity with the existing notifications | 06:44 |
| stevemar | lhcheng_, but yes, we technically can | 06:46 |
| lhcheng_ | stevemar, hmm yeah. from that perspective, what we have now is fine. the failure case could be treated as an enhancement | 06:47 |
| stevemar | yeah | 06:47 |
| lhcheng_ | stevemar, sounds good to me | 06:47 |
| stevemar | i'm writing up the code now, the code itself it easy, the test might take a while | 06:47 |
| lhcheng_ | it's always the damn test :P | 06:48 |
| marekd | morning. | 06:49 |
| *** markvoelker has joined #openstack-keystone | 06:53 | |
| *** markvoelker has quit IRC | 06:58 | |
| stevemar | marekd, o/ | 06:59 |
| * marekd half eating half looking at websso patch | 06:59 | |
| openstackgerrit | Merged openstack/keystone: Fix tests to not load federation manager twice. https://review.openstack.org/156065 | 07:09 |
| openstackgerrit | Merged openstack/keystone: Remove unnecessary code setting provider https://review.openstack.org/156069 | 07:09 |
| stevemar | marekd, i expect nothing less | 07:10 |
| openstackgerrit | Merged openstack/keystone: Wrap dependency registry https://review.openstack.org/156070 | 07:10 |
| marekd | stevemar: erm, did you actually manage to setup websso somewhere on a dev env? | 07:12 |
| marekd | stevemar: re: https://review.openstack.org/#/c/156509/ AFAIR morganfainberg advised service_providers should be included always (as long as there is something to include). | 07:15 |
| *** mzbik has joined #openstack-keystone | 07:16 | |
| marekd | stevemar: hm, docs say the other way round. | 07:16 |
| marekd | stevemar: i will in investigate it. | 07:17 |
| marekd | :P | 07:17 |
| stevemar | marekd, i did | 07:17 |
| stevemar | well, not me, but tqtran | 07:17 |
| marekd | stevemar: and what was the verdict? | 07:17 |
| marekd | did you double check with morgan ? | 07:17 |
| stevemar | marekd, it worked, a few kinks with some of the menus on the side | 07:18 |
| stevemar | double check what? | 07:18 |
| marekd | whether we should add service_providers to the SC always, or only upon explicit request (by adding ?service_providers ) | 07:18 |
| *** pnavarro has joined #openstack-keystone | 07:21 | |
| stevemar | marekd, i didn't double check, i just assumed since we don't always return it with /token then why change the behviour | 07:21 |
| *** _cjones_ has quit IRC | 07:23 | |
| *** _cjones_ has joined #openstack-keystone | 07:24 | |
| *** _cjones_ has quit IRC | 07:28 | |
| marekd | stevemar: we don't always return it with token, but in fact this patch https://review.openstack.org/#/c/152659/10/keystone/catalog/core.py,cm proposes that we only skip service_providers if thhere are no enabled service providers. | 07:28 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 07:30 |
| stevemar | lhcheng_, ^ | 07:30 |
| lhcheng_ | stevemar, you still not going to sleep? :P | 07:30 |
| lhcheng_ | stevemar, that was fast! | 07:31 |
| marekd | lhcheng_: forget it. | 07:31 |
| *** timcline has joined #openstack-keystone | 07:31 | |
| lhcheng_ | marekd, stevemar is in euro timezone now. so.. it is morning now | 07:31 |
| stevemar | :D | 07:31 |
| stevemar | so much to review! | 07:31 |
| marekd | yes, he switches zones. | 07:32 |
| stevemar | marekd, so i understand what you mean, i can go either wy | 07:32 |
| stevemar | way | 07:32 |
| marekd | i will check with morgan, but i *think* I had asked him about that and we concluded "always include service providers" | 07:32 |
| stevemar | marekd, find me the paper trail! | 07:33 |
| stevemar | marekd, ever since your work with pysaml2 i trust you with file descriptors | 07:34 |
| marekd | stevemar: hehe :D | 07:34 |
| marekd | stevemar: it can be added in a followup patch, nothing serious i think. | 07:35 |
| *** timcline has quit IRC | 07:35 | |
| stevemar | marekd, nice catch | 07:36 |
| stevemar | marekd, np, i can fix now, i don't mind, no additional rebasing :P | 07:36 |
| marekd | stevemar: OK, thanks. | 07:36 |
| marekd | I guess I cannot +2 this since i am mentioned somewhere as a Co-Author :( | 07:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add WebSSO support for federation https://review.openstack.org/136177 | 07:37 |
| stevemar | marekd, i think you can, it's pretty different from when you started | 07:37 |
| marekd | oh yeah, this belondg to you, sir :-) | 07:37 |
| marekd | belongs | 07:37 |
| stevemar | i did that more to honor you and jose, since it CERNs idea | 07:37 |
| marekd | yeha yeah | 07:37 |
| stevemar | but through the comments and such it became mutated into this :) | 07:37 |
| marekd | thanks, then :-) | 07:37 |
| *** pnavarro has quit IRC | 07:38 | |
| marekd | however, it'd be nice to try the code out | 07:38 |
| *** lhcheng_ is now known as lhcheng_afk | 07:38 | |
| lhcheng_afk | ok, I give up. I can't stay later than stevemar.. | 07:39 |
| stevemar | lhcheng_afk, haha | 07:39 |
| lhcheng_afk | stevemar, you win.. | 07:39 |
| lhcheng_afk | good night guys | 07:39 |
| stevemar | aren't you west coast? | 07:39 |
| lhcheng_afk | yeah | 07:39 |
| stevemar | booo! | 07:39 |
| stevemar | hehe | 07:39 |
| stevemar | good night! | 07:39 |
| lhcheng_afk | 11:40 | 07:39 |
| stevemar | i am joking of coure | 07:39 |
| * lhcheng_afk ashamed | 07:39 | |
| stevemar | lhcheng_afk, you've been so helpful to keystone, thanks a lot | 07:39 |
| lhcheng_afk | lol | 07:39 |
| marekd | ++ | 07:39 |
| stevemar | i mean it! | 07:40 |
| lhcheng_afk | glad to help! :) | 07:40 |
| morganfainberg | jamielennox|away: yes it should. Something went wrong and we need to fix. :( | 07:40 |
| stevemar | lhcheng_afk, and we welcome the help! good night sir | 07:40 |
| lhcheng_afk | stevemar: thanks! and good morning to you shortly... | 07:40 |
| lhcheng_afk | :D | 07:40 |
| stevemar | soon enough | 07:41 |
| morganfainberg | stevemar: marekd I think sps should always be there if available. But it's fine as is. (Ux is better if you don't need | 07:41 |
| morganfainberg | To ask again to get the sps) | 07:41 |
| stevemar | morganfainberg, so then what's the point of the query param ?service_providers | 07:41 |
| marekd | morganfainberg: so, this is what code does, we jus have docs out of sync. | 07:41 |
| marekd | stevemar: ^^ | 07:42 |
| morganfainberg | We should eliminate the query param | 07:42 |
| stevemar | marekd, glad i'm not going crazy | 07:42 |
| morganfainberg | From the docs. | 07:42 |
| morganfainberg | ;) | 07:42 |
| marekd | morganfainberg: stevemar i will remove it. | 07:42 |
| stevemar | morganfainberg, alright! full steam ahead with federation support for sps | 07:42 |
| morganfainberg | :) | 07:42 |
| morganfainberg | Just landed at SEA. | 07:43 |
| morganfainberg | Loong day. | 07:43 |
| marekd | SEA == Seattle ? | 07:43 |
| *** lhcheng_afk has quit IRC | 07:49 | |
| *** afazekas has joined #openstack-keystone | 07:54 | |
| *** markvoelker has joined #openstack-keystone | 07:54 | |
| morganfainberg | Yep | 07:56 |
| morganfainberg | I tend to use airport codes when talking about cities I'm in (if they have a real airport) | 07:57 |
| marekd | morganfainberg: sure | 07:57 |
| stevemar | marekd, where is get_v3_catalog() called? | 07:57 |
| marekd | stevemar: for 90% somewhere in /auth/controllers.py | 07:57 |
| marekd | but let me check. | 07:58 |
| stevemar | marekd, oh nvm, i see it now, it's a manager function that was originally going right to controller | 07:58 |
| stevemar | gah, i hate it when the code does that, just create the damn manager functions too | 07:58 |
| marekd | ./token/providers/common.py:323: service_catalog = self.catalog_api.get_v3_catalog( | 07:58 |
| marekd | ./auth/controllers.py:626: 'catalog': self.catalog_api.get_v3_catalog(user_id, project_id), | 07:58 |
| *** markvoelker has quit IRC | 07:59 | |
| *** boris-42 has joined #openstack-keystone | 08:00 | |
| stevemar | marekd, now to figure out why it's not conflicting with https://github.com/openstack/keystone/blob/master/keystone/catalog/core.py#L431 | 08:02 |
| stevemar | i think thats just the driver code for templated catalog? | 08:02 |
| stevemar | i hate our catalog/region/endpoint system | 08:02 |
| *** carlosmarin has quit IRC | 08:04 | |
| marekd | stevemar: afair it's because my impl of get_v3_catalog is in Manager class, so it's has a priority while calling Manager.get_v3_catalog() | 08:05 |
| marekd | if it was not there, Driver.get_v3_catalog would be called. | 08:05 |
| marekd | To be honest, I never know what Manager and Driver are responsible for :( | 08:05 |
| stevemar | marekd, i think it's OK | 08:06 |
| *** carlosmarin has joined #openstack-keystone | 08:06 | |
| marekd | stevemar: https://github.com/openstack/keystone/blob/master/keystone/common/manager.py#L72-L76 | 08:07 |
| marekd | this is why it;s not conflicting (code proving what i have said ) | 08:07 |
| *** jistr has joined #openstack-keystone | 08:08 | |
| *** amerine_ has joined #openstack-keystone | 08:08 | |
| *** amerine has quit IRC | 08:09 | |
| marekd | but oh | 08:09 |
| marekd | wait | 08:09 |
| *** chlong has quit IRC | 08:10 | |
| marekd | stevemar: thanks for the review. | 08:14 |
| stevemar | marekd, moar review | 08:17 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 08:18 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Re-use list_role_assignments wherever is possible https://review.openstack.org/155733 | 08:19 |
| *** rushiagr is now known as rushiagr_away | 08:21 | |
| *** ncoghlan has quit IRC | 08:26 | |
| *** bjornar has joined #openstack-keystone | 08:27 | |
| *** rushiagr_away is now known as rushiagr | 08:28 | |
| *** stevemar has quit IRC | 08:31 | |
| *** timcline has joined #openstack-keystone | 08:32 | |
| *** pnavarro has joined #openstack-keystone | 08:33 | |
| *** timcline has quit IRC | 08:36 | |
| *** pnavarro has quit IRC | 08:39 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make user an object in mapping engine https://review.openstack.org/154934 | 08:40 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/156895 | 08:45 |
| *** markvoelker has joined #openstack-keystone | 08:55 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make user an object in mapping engine https://review.openstack.org/154934 | 08:56 |
| *** markvoelker has quit IRC | 09:00 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Drop ?service_providers from /auth/catalog https://review.openstack.org/156925 | 09:01 |
| *** akuznetsova has left #openstack-keystone | 09:01 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Drop ?service_providers from /auth/tokens https://review.openstack.org/156925 | 09:02 |
| *** henrynash has joined #openstack-keystone | 09:21 | |
| *** ChanServ sets mode: +v henrynash | 09:21 | |
| *** amakarov_away is now known as amakarov | 09:25 | |
| *** henrynash has quit IRC | 09:32 | |
| *** timcline has joined #openstack-keystone | 09:34 | |
| *** timcline has quit IRC | 09:39 | |
| *** zz_avozza is now known as avozza | 09:46 | |
| *** markvoelker has joined #openstack-keystone | 09:56 | |
| *** pnavarro has joined #openstack-keystone | 10:00 | |
| *** markvoelker has quit IRC | 10:02 | |
| *** jamiec has quit IRC | 10:13 | |
| *** jamiec has joined #openstack-keystone | 10:17 | |
| *** MasterPiece has joined #openstack-keystone | 10:22 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 10:26 |
| *** MasterPiece has quit IRC | 10:26 | |
| *** timcline has joined #openstack-keystone | 10:35 | |
| *** timcline has quit IRC | 10:39 | |
| *** rudzha has quit IRC | 10:40 | |
| *** samueldmq has joined #openstack-keystone | 10:46 | |
| *** lhcheng_afk has joined #openstack-keystone | 10:49 | |
| *** nellysmitt has joined #openstack-keystone | 10:49 | |
| *** lhcheng_afk has quit IRC | 10:54 | |
| *** dims__ has joined #openstack-keystone | 11:19 | |
| *** pnavarro has quit IRC | 11:26 | |
| *** timcline has joined #openstack-keystone | 11:36 | |
| *** aix has joined #openstack-keystone | 11:37 | |
| *** timcline has quit IRC | 11:40 | |
| *** chlong has joined #openstack-keystone | 11:45 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 11:47 |
| *** fmarco76 has joined #openstack-keystone | 11:50 | |
| *** mzbik has quit IRC | 11:53 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 11:56 |
| *** aix_ has joined #openstack-keystone | 11:58 | |
| *** aix_ has quit IRC | 11:59 | |
| *** aix has quit IRC | 11:59 | |
| *** ajayaa has quit IRC | 11:59 | |
| *** aix has joined #openstack-keystone | 11:59 | |
| *** aix has quit IRC | 12:00 | |
| *** aix has joined #openstack-keystone | 12:00 | |
| *** jistr has quit IRC | 12:09 | |
| *** jistr has joined #openstack-keystone | 12:12 | |
| *** nellysmitt has quit IRC | 12:15 | |
| *** ajayaa has joined #openstack-keystone | 12:19 | |
| *** NellyK has joined #openstack-keystone | 12:23 | |
| *** pnavarro has joined #openstack-keystone | 12:25 | |
| *** NellyK has quit IRC | 12:32 | |
| *** NellyK has joined #openstack-keystone | 12:33 | |
| *** timcline has joined #openstack-keystone | 12:36 | |
| *** NellyK has quit IRC | 12:40 | |
| *** timcline has quit IRC | 12:41 | |
| *** pnavarro has quit IRC | 12:45 | |
| *** radez_g0n3 is now known as radez | 12:48 | |
| *** pnavarro has joined #openstack-keystone | 12:48 | |
| *** nellysmitt has joined #openstack-keystone | 12:53 | |
| *** pnavarro has quit IRC | 12:53 | |
| *** aix has quit IRC | 12:59 | |
| *** rushiagr is now known as rushiagr_away | 13:09 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| *** aix has joined #openstack-keystone | 13:12 | |
| *** samueldmq_ has joined #openstack-keystone | 13:13 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 13:13 |
| *** samueldmq has quit IRC | 13:16 | |
| *** zigo has quit IRC | 13:18 | |
| *** zigo has joined #openstack-keystone | 13:20 | |
| *** marg7175 has joined #openstack-keystone | 13:31 | |
| *** henrynash has joined #openstack-keystone | 13:35 | |
| *** ChanServ sets mode: +v henrynash | 13:35 | |
| *** gordc has joined #openstack-keystone | 13:37 | |
| *** aix has quit IRC | 13:37 | |
| *** timcline has joined #openstack-keystone | 13:37 | |
| *** marg7175 has quit IRC | 13:39 | |
| *** timcline has quit IRC | 13:42 | |
| *** krtaylor has quit IRC | 13:50 | |
| *** henrynash has quit IRC | 13:53 | |
| *** krtaylor has joined #openstack-keystone | 13:56 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 13:58 |
| *** abhirc has joined #openstack-keystone | 14:00 | |
| *** aix has joined #openstack-keystone | 14:03 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 14:06 |
| *** rushiagr_away is now known as rushiagr | 14:07 | |
| *** pnavarro has joined #openstack-keystone | 14:14 | |
| *** dims__ has quit IRC | 14:15 | |
| *** my_openstack_use has joined #openstack-keystone | 14:17 | |
| *** my_openstack_use is now known as sly_boots | 14:18 | |
| *** dims__ has joined #openstack-keystone | 14:20 | |
| *** dims__ has quit IRC | 14:20 | |
| *** dims__ has joined #openstack-keystone | 14:21 | |
| *** richm has joined #openstack-keystone | 14:21 | |
| *** dims__ has quit IRC | 14:25 | |
| *** Guest37356 has joined #openstack-keystone | 14:35 | |
| *** joesavak has joined #openstack-keystone | 14:37 | |
| *** Guest37356 is now known as dims__ | 14:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 14:51 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 14:52 |
| *** krtaylor has quit IRC | 14:54 | |
| *** krtaylor has joined #openstack-keystone | 14:55 | |
| *** topol has joined #openstack-keystone | 14:56 | |
| *** ChanServ sets mode: +v topol | 14:56 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 14:58 |
| *** ajayaa has quit IRC | 15:03 | |
| fmarco76 | HI all, I am writing on a blue-print extending a previous patch and I need to create a table whereas the previous patch I am extending were creating only a new column | 15:03 |
| marekd | https://review.openstack.org/#/c/152156/7 | 15:04 |
| fmarco76 | can I change the migration script so I will create a table or do I need to create a new migration script? | 15:04 |
| fmarco76 | the previous migration was never released because both patch are for kilo | 15:05 |
| *** Ephur has joined #openstack-keystone | 15:08 | |
| marekd | dstanek: dolphm ^^ fancy helpig with the marco's question ? | 15:11 |
| *** abhirc has quit IRC | 15:12 | |
| *** dnalezyt has joined #openstack-keystone | 15:13 | |
| morganfainberg | fmarco76, needs to be a new migration | 15:14 |
| morganfainberg | think about people who are chasing master | 15:14 |
| morganfainberg | unless the previous migration was never merged to git | 15:14 |
| marekd | morganfainberg: it was. | 15:14 |
| morganfainberg | (even kilo) | 15:14 |
| fmarco76 | OK | 15:15 |
| fmarco76 | but I have to remove the column from the previous patch or I can just leave it unsed and add the new column? | 15:16 |
| marekd | i'd say remove. | 15:16 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Fix for KVS cache backend incompatible with redis-py https://review.openstack.org/153307 | 15:16 |
| *** abhirc has joined #openstack-keystone | 15:16 | |
| fmarco76 | do I also migrate the content? | 15:17 |
| fmarco76 | or just the schema? | 15:17 |
| marekd | hm, good question. | 15:17 |
| * marekd morganfainberg to the rescue | 15:17 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Drop query parameter ?service_providers from docs https://review.openstack.org/156925 | 15:17 |
| *** abhirc has quit IRC | 15:18 | |
| morganfainberg | fmarco76, depends on what you're doing. | 15:19 |
| morganfainberg | fmarco76, if data already exists that needs to be in the table, you migrate content as well | 15:19 |
| fmarco76 | I get it, thanks | 15:20 |
| amakarov | morganfainberg, greetings! I've found a test for KVS with mocked mutex. It had lock_timeout field we shouldn't expect - removed it. Would you kindly review that again? :) https://review.openstack.org/#/c/153307 | 15:22 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/147367 | 15:23 |
| *** stevemar has joined #openstack-keystone | 15:24 | |
| *** ChanServ sets mode: +v stevemar | 15:24 | |
| amakarov | dstanek, good day! Addressed your comment - nice catch! | 15:25 |
| morganfainberg | amakarov, sure | 15:25 |
| morganfainberg | amakarov, might be a little later today. | 15:25 |
| * morganfainberg is just getting started. | 15:25 | |
| amakarov | morganfainberg, np, it's Jenkins turn anyway | 15:28 |
| *** timcline has joined #openstack-keystone | 15:29 | |
| *** devlaps has joined #openstack-keystone | 15:32 | |
| *** henrynash has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v henrynash | 15:33 | |
| *** samueldmq_ has quit IRC | 15:33 | |
| stevemar | henrynash, morganfainberg you may want to revisit https://review.openstack.org/#/c/125521/ now that the domain FK has been dropped... | 15:41 |
| morganfainberg | stevemar: aye | 15:42 |
| *** zzzeek has joined #openstack-keystone | 15:43 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 15:43 |
| henrynash | stevemar: your patch has merged? | 15:45 |
| stevemar | henrynash, yep | 15:45 |
| stevemar | henrynash, you +2d and morganfainberg +A'ed | 15:45 |
| stevemar | i'm hoping to knock both of brants bps off the blueprint list today, they are fairly small | 15:46 |
| breton | klwt +a! | 15:47 |
| breton | yay! | 15:47 |
| stevemar | \o/ | 15:47 |
| openstackgerrit | Merged openstack/keystone-specs: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/130050 | 15:47 |
| stevemar | today there is joy in the keystone kingdom | 15:48 |
| morganfainberg | so more important than that.. lbragstad , ^^ | 15:48 |
| lbragstad | morganfainberg: nice, thanks! | 15:48 |
| henrynash | stevemar: excellent…just +2’d yours….. | 15:48 |
| stevemar | lbragstad, is the bp open already? | 15:49 |
| morganfainberg | lbragstad, no further blocking comment. all outstanding comments look to be resolved. | 15:49 |
| stevemar | henrynash, i was just going to ask why no +A, but that's been our theme this release huh | 15:49 |
| henrynash | stevemar: yep! | 15:49 |
| lbragstad | morganfainberg: atiwari asked if we are going to use AE or KLWT for the impl acronym | 15:49 |
| lbragstad | stevemar: not yet | 15:50 |
| morganfainberg | lbragstad, so use KLWT where possible. but don't worry about renaming everything everywhere at once - docstrings etc can happen as things are worked on | 15:50 |
| morganfainberg | the bp can stay "ae-tokens" | 15:50 |
| morganfainberg | it doesn't really matter what the bp is named | 15:51 |
| dolphm | morganfainberg: lbragstad: breton: stevemar: \o/ | 15:51 |
| lbragstad | morganfainberg: from a user perspective, I think AE would be easier to look up/research | 15:51 |
| stevemar | lbragstad, the K is kinda assume no? just lwt in the code? | 15:51 |
| morganfainberg | lbragstad, but honestly, i don't really care what they are called | 15:51 |
| atiwari | morganfainberg, lbragstad +1 name does not matters | 15:51 |
| atiwari | :) | 15:51 |
| stevemar | ++ morganfainberg | 15:51 |
| dolphm | lbragstad: let's get a solid implementation and then figure out a more appropriate user-facing name | 15:51 |
| morganfainberg | lbragstad, ^^ | 15:51 |
| lbragstad | morganfainberg: dolphm works for me, just checking since atiwari asked in the review | 15:52 |
| * morganfainberg looks at coffee shops in seattle today. | 15:52 | |
| dolphm | lbragstad: my answer is that it doesn't matter until we ship it, until then we can brainstorm | 15:52 |
| dolphm | atiwari: ^ | 15:52 |
| *** henrynash has quit IRC | 15:52 | |
| lbragstad | agreed | 15:52 |
| dstanek | amakarov: no problem | 15:53 |
| gordc | stevemar: great day: https://www.openstack.org/vote-vancouver/presentation/openstack-is-doomed-and-it-is-your-fault | 15:53 |
| morganfainberg | lbragstad, so in short, we can cleanup names *after* code is ready | 15:53 |
| *** jaosorior has joined #openstack-keystone | 15:53 | |
| atiwari | lbragstad, ++ for the good work. Lets not worry for the name too much for now. If it is easy make the change if not please follow morganfainberg suggestions | 15:53 |
| lbragstad | morganfainberg: works for me | 15:54 |
| stevemar | gordc, that is a fantastic title | 15:54 |
| gordc | look who speaker is! | 15:54 |
| stevemar | by termie! oh man that is great! i love this +3 | 15:54 |
| morganfainberg | gordc, did you see the faith one? | 15:54 |
| lbragstad | I kinda jumped the gun in the renaming everything to klwt, so I'll be sure to take the todo when we want to change the name | 15:54 |
| gordc | morganfainberg: nope? link? | 15:54 |
| morganfainberg | https://www.openstack.org/vote-vancouver/Presentation/faith-the-secret-ingredient-of-a-successful-system-integration | 15:54 |
| morganfainberg | lbragstad, yeah the spec needed the name change, everything else can come as a final sweep | 15:55 |
| marekd | gordc: "You'll laugh, you'll cry, and you'll probably want to rewrite everything in Go." | 15:55 |
| morganfainberg | gordc, marekd, i'm disappointed he didn't say Rust. | 15:55 |
| lbragstad | marekd: ++ | 15:55 |
| marekd | morganfainberg: for the record, i am not biased for Go | 15:56 |
| atiwari | lbragstad, only suggestion is make extensible. I will add more int he specs | 15:56 |
| gordc | i like +3 even though i know it's just trigger a page refresh and nothing else.lol | 15:56 |
| marekd | morganfainberg: language looks interesting, but at the end it's just language. | 15:56 |
| dolphm | stevemar: +3 | 15:56 |
| atiwari | lbragstad, s/make/make it | 15:56 |
| morganfainberg | marekd, but Rust is awesome /holywar-verbiage | 15:56 |
| morganfainberg | ;) | 15:56 |
| marekd | morganfainberg: why?! | 15:57 |
| marekd | morganfainberg: teach, master! | 15:57 |
| morganfainberg | cause why not? | 15:57 |
| morganfainberg | ;) | 15:57 |
| gordc | marekd: don't ask why! | 15:57 |
| * marekd troll mode | 15:57 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Create extension provider instances once https://review.openstack.org/156071 | 15:57 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Avoid multiple instances for a provider https://review.openstack.org/124599 | 15:57 |
| * gordc googled "rust"... got exactly that. seems about right. | 15:58 | |
| morganfainberg | gordc, /non-troll: i actually like the language. but uhm.. lol | 15:58 |
| morganfainberg | we need to convert keystone to use https://github.com/dcramer/mangodb, it's CLOUD SCALE! :P | 15:59 |
| *** marg7175 has joined #openstack-keystone | 16:00 | |
| morganfainberg | hm. | 16:01 |
| marekd | morganfainberg: sad thing is that one could spend literally 8h/day reading all those blogposts about new kickass languages, databases, scalin techniques, engineering blogposts etc :( | 16:01 |
| gordc | morganfainberg: is it used in any (notable) projects? /me does not follow new cutting-edge languages | 16:01 |
| morganfainberg | gordc, afaik rust is too early to really be used. but i like a lot of what they're driving at. it feels like what i want from both python and c/c++ | 16:02 |
| gordc | marekd: you have to find the entertaining ones...(ie. a lot of profanity on why it sucks/is good) | 16:02 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Clean up configuration option management https://review.openstack.org/157044 | 16:02 |
| *** ajayaa has joined #openstack-keystone | 16:02 | |
| * morganfainberg has the nightly build on my laptop | 16:02 | |
| gordc | morganfainberg: i see.. yeah, that'd be a good blend. | 16:03 |
| marekd | morganfainberg: did you write anything in Rust? | 16:03 |
| marekd | morganfainberg: or just simple examples? | 16:03 |
| morganfainberg | marekd, just some hello-world examples | 16:03 |
| marekd | aha | 16:03 |
| *** rm_work|away is now known as rm_work | 16:04 | |
| morganfainberg | marekd, i also like that variables are CONST by default, you need to declare a variable mutable | 16:04 |
| morganfainberg | anyway... | 16:05 |
| gordc | morganfainberg: was going to say that sounds annoying... but then in most cases variables outside of counters/object don't get modified much. | 16:06 |
| morganfainberg | gordc, yep. and how many times do you run into issues where "oops i did an assignment where i meant to do something else" | 16:07 |
| stevemar | any oslo.policy core folk want to talk a string of patches? https://review.openstack.org/#/q/status:open+project:openstack/oslo.policy+branch:master+topic:cleanup,n,z | 16:08 |
| morganfainberg | gordc, it's a common issue people end up needing to chase down. at least this way you know everything that can be changed upfront. less to look at | 16:08 |
| morganfainberg | stevemar, no :P i mean yes on my list today ;) | 16:08 |
| morganfainberg | post coffee | 16:08 |
| stevemar | it's actually just 1 patch that needs to be kicked off, the rest have enough +2s | 16:09 |
| stevemar | https://review.openstack.org/#/c/156811/2 | 16:09 |
| *** pnavarro has quit IRC | 16:15 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Make user an object in mapping engine https://review.openstack.org/154934 | 16:17 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 16:18 |
| openstackgerrit | David Stanek proposed openstack/keystone: Update sample config file https://review.openstack.org/156786 | 16:21 |
| *** marg7175 has quit IRC | 16:22 | |
| *** marg7175 has joined #openstack-keystone | 16:22 | |
| *** david-lyle_afk is now known as david-lyle | 16:28 | |
| *** avozza is now known as zz_avozza | 16:33 | |
| *** thedodd has joined #openstack-keystone | 16:39 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Drop query parameter ?service_providers from docs https://review.openstack.org/156925 | 16:39 |
| *** radez is now known as radez_g0n3 | 16:41 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add ``service_providers`` in Service Catalog https://review.openstack.org/152659 | 16:45 |
| *** rwsu-afk is now known as rwsu | 16:46 | |
| amakarov | marekd, please reformat commit message there ^^ :) | 16:46 |
| stevemar | marekd, your commit message went crazy | 16:47 |
| marekd | which review? | 16:47 |
| marekd | maybe i went crazy? :/ | 16:47 |
| marekd | amakarov: stevemar https://review.openstack.org/#/c/156925/ ? | 16:48 |
| stevemar | marekd, yep | 16:48 |
| amakarov | marekd, ++ | 16:48 |
| stevemar | the commit msg is now all on one line | 16:48 |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Drop query parameter ?service_providers from docs https://review.openstack.org/156925 | 16:48 |
| stevemar | oh there we go | 16:49 |
| marekd | stevemar: it was not when i was editing it. | 16:49 |
| marekd | had to add hard CR | 16:49 |
| *** afazekas has quit IRC | 16:51 | |
| *** abhirc has joined #openstack-keystone | 16:51 | |
| stevemar | dstanek, may i ask why you rebased https://review.openstack.org/#/c/156786/ ? | 16:52 |
| stevemar | instead of just hitting the rebase button on gerrit? | 16:52 |
| stevemar | was it cause of the silly db2 ci saying 'merge failed' ? | 16:52 |
| dstanek | stevemar: no, my local script didn't like it for some reason | 16:53 |
| stevemar | dstanek, oh | 16:53 |
| stevemar | :( | 16:53 |
| stevemar | dstanek, cool then, was just wondering | 16:53 |
| stevemar | its always good to nuke .tox/sample_config before running it | 16:53 |
| dstanek | ever review i do gets pulled down and looked at by some test code - for some reason it barked at me | 16:54 |
| *** gyee has joined #openstack-keystone | 16:54 | |
| *** ChanServ sets mode: +v gyee | 16:54 | |
| *** samueldmq-away is now known as samueldmq | 16:55 | |
| * stevemar shrugs | 16:55 | |
| openstackgerrit | Merged openstack/oslo.policy: Create the temporary files needed for tests https://review.openstack.org/156811 | 17:03 |
| openstackgerrit | Merged openstack/oslo.policy: Change default set of tox environments https://review.openstack.org/156812 | 17:03 |
| *** ljfisher has joined #openstack-keystone | 17:08 | |
| openstackgerrit | Merged openstack/oslo.policy: Fix i18n imports https://review.openstack.org/156813 | 17:10 |
| openstackgerrit | Merged openstack/oslo.policy: Update comments about tox configuration https://review.openstack.org/156836 | 17:10 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 17:14 |
| *** tqtran has joined #openstack-keystone | 17:14 | |
| *** jistr has quit IRC | 17:15 | |
| *** lhcheng_afk has joined #openstack-keystone | 17:15 | |
| *** lhcheng_afk is now known as lhcheng | 17:20 | |
| *** chlong has quit IRC | 17:22 | |
| *** lhcheng_ has joined #openstack-keystone | 17:26 | |
| *** browne has joined #openstack-keystone | 17:27 | |
| *** raildo_ is now known as raildo | 17:28 | |
| *** lhcheng has quit IRC | 17:28 | |
| *** amakarov is now known as amakarov_away | 17:29 | |
| *** bknudson has joined #openstack-keystone | 17:33 | |
| *** ChanServ sets mode: +v bknudson | 17:33 | |
| *** marg7175 has quit IRC | 17:36 | |
| *** _cjones_ has joined #openstack-keystone | 17:36 | |
| *** EmilienM is now known as EmilienM|afk | 17:40 | |
| *** harlowja_away is now known as harlowja_ | 17:42 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.policy: Clean up configuration option management https://review.openstack.org/157044 | 17:47 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 17:47 |
| *** _cjones_ has quit IRC | 17:48 | |
| *** _cjones_ has joined #openstack-keystone | 17:48 | |
| *** fmarco76 has left #openstack-keystone | 17:50 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 17:51 |
| *** lhcheng_ has quit IRC | 17:54 | |
| *** thedodd has quit IRC | 17:54 | |
| *** carlosmarin has quit IRC | 17:55 | |
| *** carlosmarin has joined #openstack-keystone | 18:01 | |
| *** ljfisher has quit IRC | 18:09 | |
| *** rushiagr is now known as rushiagr_away | 18:10 | |
| stevemar | looks like check-swift-dsvm-functional is failing | 18:10 |
| *** abhirc has quit IRC | 18:10 | |
| morganfainberg | stevemar, something we did? | 18:11 |
| morganfainberg | or everything? | 18:11 |
| *** ljfisher has joined #openstack-keystone | 18:12 | |
| stevemar | everything | 18:13 |
| stevemar | http://logstash.openstack.org/#eyJzZWFyY2giOiJweS5lcnJvci5FQUNDRVMiLCJmaWVsZHMiOltdLCJvZmZzZXQiOjAsInRpbWVmcmFtZSI6IjE0NDAwIiwiZ3JhcGhtb2RlIjoiY291bnQiLCJ0aW1lIjp7InVzZXJfaW50ZXJ2YWwiOjB9LCJzdGFtcCI6MTQyNDI4MzE3MDgxMn0= | 18:13 |
| morganfainberg | stevemar, looks like it's bad build nodes | 18:13 |
| morganfainberg | EPERM on making directories | 18:13 |
| morganfainberg | EACCESS sorry | 18:14 |
| stevemar | ah | 18:14 |
| morganfainberg | http://logs.openstack.org/86/156786/2/check/check-swift-dsvm-functional/045f454/console.html#_2015-02-18_16_59_17_045 | 18:14 |
| stevemar | morganfainberg, open a bug against infra? | 18:14 |
| morganfainberg | notmyname, ping re ^ | 18:15 |
| morganfainberg | stevemar, maybe just a ping in -infra channel for fungi/clark | 18:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 18:15 |
| *** krtaylor has quit IRC | 18:16 | |
| *** lhcheng has joined #openstack-keystone | 18:17 | |
| *** zz_avozza is now known as avozza | 18:21 | |
| *** abhirc has joined #openstack-keystone | 18:22 | |
| *** ajayaa has quit IRC | 18:44 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 18:52 |
| *** krtaylor has joined #openstack-keystone | 18:53 | |
| *** sly_boots has quit IRC | 18:53 | |
| *** avozza is now known as zz_avozza | 18:58 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 18:59 |
| *** EmilienM|afk is now known as EmilienM | 19:02 | |
| clayg | there was something that just landed to move swiftclient functests into tox - is the check-swift-dsvm-functional swift functests or swiftclient functests? | 19:04 |
| *** clayg has left #openstack-keystone | 19:08 | |
| *** nellysmitt has quit IRC | 19:13 | |
| *** nellysmitt has joined #openstack-keystone | 19:14 | |
| *** bknudson has quit IRC | 19:14 | |
| *** spandhe has joined #openstack-keystone | 19:17 | |
| *** marg7175 has joined #openstack-keystone | 19:17 | |
| *** nellysmitt has quit IRC | 19:18 | |
| lhcheng | morganfainberg, should the project_parent_id be included in the v3 token response? | 19:27 |
| lhcheng | morganfainberg, this wasn't mentioned anywhere in the HMT specs. But wondering if that should be included. | 19:28 |
| lhcheng | raildo: ^ | 19:29 |
| openstackgerrit | Merged openstack/oslo.policy: Clean up configuration option management https://review.openstack.org/157044 | 19:39 |
| gyee | lhcheng, it should not, the parent hierarchy should be a separate lookup | 19:41 |
| *** carlosmarin has quit IRC | 19:47 | |
| *** carlosmarin has joined #openstack-keystone | 19:48 | |
| raildo | lhcheng, gyee are right, he have a API call to return the parent hierarchy. | 19:48 |
| morganfainberg | lhcheng, what gyee said. | 19:48 |
| morganfainberg | the issue is we'd bloat the token badly otherwise | 19:48 |
| *** marg7175 has quit IRC | 19:56 | |
| *** marg7175 has joined #openstack-keystone | 19:56 | |
| *** andreaf_ has joined #openstack-keystone | 19:58 | |
| *** bknudson has joined #openstack-keystone | 19:59 | |
| *** ChanServ sets mode: +v bknudson | 19:59 | |
| stevemar | gyee, responding to your comments | 20:00 |
| lhcheng | gyee, raildo, morganfainberg: thanks for confirming | 20:02 |
| lhcheng | we got the parent_id in the v2 token response and not in v3 token response | 20:03 |
| lhcheng | got wondering if we got it just the other way around | 20:03 |
| morganfainberg | oh wait | 20:03 |
| morganfainberg | hold on | 20:03 |
| morganfainberg | just the partent id | 20:03 |
| morganfainberg | not the whole hierarchy | 20:03 |
| morganfainberg | hmmmmm. | 20:03 |
| lhcheng | morganfainberg: yes, just the parent_id | 20:04 |
| morganfainberg | gyee, ^^ | 20:04 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 20:05 |
| bknudson | the v3 api spec says that the project is the full representation of the project -- http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#tokens | 20:06 |
| bknudson | "Includes the full resource description of a project." | 20:06 |
| morganfainberg | yes, the parent_id should be there | 20:06 |
| morganfainberg | sorry | 20:06 |
| morganfainberg | i was thining the whole hierarchy | 20:07 |
| bknudson | maybe the v3 api spec is wrong... not sure how the parent_id is useful in the token. | 20:07 |
| morganfainberg | the whole hierarchy should *not* be there | 20:07 |
| morganfainberg | bknudson, if it's the full resource description of the project, it's part of it | 20:07 |
| *** aix has quit IRC | 20:08 | |
| morganfainberg | but honestly i think we could leave that out | 20:08 |
| morganfainberg | on both v2 and v3 and fix the docs | 20:08 |
| bknudson | I'd prefer the spec was changed, too. | 20:08 |
| bknudson | if an application wants the hierarchy it can fetch that separately. | 20:09 |
| morganfainberg | so lets fix the spec | 20:09 |
| morganfainberg | sold. | 20:09 |
| *** ljfisher has quit IRC | 20:11 | |
| *** ljfisher has joined #openstack-keystone | 20:11 | |
| adam_g | can anyone shed light on why, when auth'ing with the password plugin, my auth_ref contains a populated service catalog and accurate list of role-se, but when auth'ing with a token only, it does not? | 20:12 |
| *** ljfisher has quit IRC | 20:12 | |
| lhcheng | morganfainberg, bknudson: okay, we'll leave it out. sounds good | 20:12 |
| *** ljfisher has joined #openstack-keystone | 20:13 | |
| *** devlaps has quit IRC | 20:27 | |
| *** henrynash has joined #openstack-keystone | 20:30 | |
| *** ChanServ sets mode: +v henrynash | 20:30 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move backend LDAP role testing to the new backend testing module https://review.openstack.org/156830 | 20:32 |
| gyee | morganfainberg, bknudson, lhcheng, yeah, token data should continue only the minimum set that are commonly used | 20:35 |
| gyee | stevemar, you mean the service provider one? | 20:35 |
| gyee | stevemar, marekd, I don't think we should treat the service providers any differently | 20:36 |
| stevemar | gyee, responded in the patch | 20:42 |
| *** devlaps has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 20:46 |
| *** _cjones_ has quit IRC | 20:48 | |
| *** Tahmina has joined #openstack-keystone | 20:53 | |
| stevemar | anyone want to be nice and save bknudson the headache of rebasing by approving https://review.openstack.org/#/c/147367/ ? | 20:55 |
| dstanek | stevemar: i can look at it right after i'm done with the one that i'm on | 20:57 |
| *** topol has quit IRC | 20:59 | |
| openstackgerrit | Merged openstack/keystone: Update sample config file https://review.openstack.org/156786 | 21:00 |
| *** marg7175_ has joined #openstack-keystone | 21:02 | |
| *** marg7175 has quit IRC | 21:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 21:04 |
| *** aix has joined #openstack-keystone | 21:04 | |
| *** Tahmina has quit IRC | 21:05 | |
| dstanek | lbragstad: you're killing me! | 21:06 |
| lbragstad | dstanek: :( I'm sorry | 21:06 |
| gyee | cold blooded | 21:06 |
| lbragstad | token work is ruthless! | 21:07 |
| *** Tahmina has joined #openstack-keystone | 21:08 | |
| lbragstad | dstanek: gyee good news is that the latest revision works with trusts! | 21:09 |
| henrynash | nkinder: ping | 21:09 |
| nkinder | henrynash: pong | 21:09 |
| henrynash | nkinder: hi…any chance you could get my LDAP filtering patches a once over? | 21:10 |
| henrynash | nkninder: there are two: first is here: https://review.openstack.org/#/c/147551/ and the second is dependant on that | 21:10 |
| gyee | lbragstad, awesome! | 21:10 |
| dhellmann | morganfainberg, stevemar: I just cut oslo.policy 0.1.0. This is a "quiet" release, to give us a distribution so we can test integration with one or two projects before announcing it more publicly. | 21:10 |
| nkinder | henrynash: sure, will look now | 21:10 |
| henrynash | nkinder: thx | 21:11 |
| *** nellysmitt has joined #openstack-keystone | 21:11 | |
| lbragstad | gyee: I was having some trouble validating trust scoped tokens | 21:11 |
| lbragstad | but, not I think the context is getting built properly | 21:11 |
| gyee | told u, writing code is the easiest part :) | 21:13 |
| *** samueldmq_ has joined #openstack-keystone | 21:13 | |
| *** _cjones_ has joined #openstack-keystone | 21:14 | |
| stevemar | dhellmann, i like it | 21:16 |
| dhellmann | stevemar: let's get a couple of patches for apps together before we make the formal announcement, just in case we have to break the API | 21:16 |
| dhellmann | :-) | 21:16 |
| stevemar | dhellmann, sounds good, i'll toss one up for keystone | 21:16 |
| *** Tahmina has quit IRC | 21:16 | |
| dhellmann | stevemar: ++ | 21:17 |
| stevemar | we might be able to convince sigmavirus24 to try out for swift :P he seemed to know stuff and things about it | 21:17 |
| dstanek | stevemar: damn, that's a lot of files :-) | 21:17 |
| stevemar | dstanek, +2, -2 of 90% of them :P | 21:17 |
| dstanek | yep, i'm almost done | 21:18 |
| marekd | gyee: whoa. https://review.openstack.org/#/c/156509/ that would rollback lots of work :( | 21:22 |
| marekd | what morganfainberg thinks about ^^ ? | 21:24 |
| *** abhirc has quit IRC | 21:27 | |
| gyee | marekd, you don't need to introduce different structure in the service catalog | 21:27 |
| gyee | fundamentally, service provider is just another endpoint | 21:27 |
| marekd | gyee: how interfaces would be decided? | 21:28 |
| marekd | 'interface' | 21:28 |
| *** marg7175_ has quit IRC | 21:28 | |
| gyee | marekd, sure, or introduce a new attribute | 21:28 |
| gyee | "interface": "sp_auth" | 21:29 |
| marekd | gyee: no, you put some example in the review | 21:29 |
| gyee | marekd, yes, in the spec review | 21:29 |
| marekd | and have 'interface':'auth' and 'interface':'service' | 21:29 |
| gyee | sure, we can pick a right word for it | 21:30 |
| gyee | my point is, it shouldn't change the fact that it is fundamentally an endpoint | 21:30 |
| nkinder | henrynash: first one reviewed. I had one question inline for you. | 21:30 |
| *** marg7175_ has joined #openstack-keystone | 21:31 | |
| henrynash | nkinder; great...looking | 21:31 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Not allow create a project with slash in name https://review.openstack.org/157152 | 21:32 |
| *** joesavak has quit IRC | 21:34 | |
| henrynash | nkinder: responded…agree with the nits (happy to fix)…and I *think* the delete is needed… | 21:35 |
| nkinder | henrynash: ok, the delete is fine (even if not needed). | 21:36 |
| nkinder | henrynash: but if you found it's needed, I definitely believe you! | 21:36 |
| *** timcline has quit IRC | 21:37 | |
| stevemar | dhellmann, alright, just testing it out now, we'll see if keystone falls on the floor or not | 21:37 |
| *** timcline has joined #openstack-keystone | 21:37 | |
| *** carlosmarin1 has joined #openstack-keystone | 21:40 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.policy instead of incubated version https://review.openstack.org/148624 | 21:41 |
| *** timcline has quit IRC | 21:42 | |
| dstanek | dolphm: looking now | 21:42 |
| *** carlosmarin has quit IRC | 21:43 | |
| stevemar | dhellmann, ^ | 21:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubated version of oslo policy https://review.openstack.org/157158 | 21:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubated version of oslo policy https://review.openstack.org/157158 | 21:44 |
| *** timcline has joined #openstack-keystone | 21:45 | |
| *** henrynash has quit IRC | 21:47 | |
| dstanek | dolphm: i think i answered your questions | 21:49 |
| *** henrynash has joined #openstack-keystone | 21:49 | |
| *** ChanServ sets mode: +v henrynash | 21:49 | |
| *** abhirc has joined #openstack-keystone | 21:50 | |
| *** jamielennox|away is now known as jamielennox | 21:51 | |
| *** ljfisher has quit IRC | 21:57 | |
| *** ljfisher has joined #openstack-keystone | 21:57 | |
| *** ljfisher has quit IRC | 21:57 | |
| *** marg7175_ has quit IRC | 21:59 | |
| *** marg7175 has joined #openstack-keystone | 21:59 | |
| dolphm | dstanek: danke! | 22:00 |
| *** ljfisher has joined #openstack-keystone | 22:01 | |
| *** joesavak has joined #openstack-keystone | 22:03 | |
| *** abhirc has quit IRC | 22:04 | |
| *** dnalezyt has quit IRC | 22:07 | |
| *** karimb has joined #openstack-keystone | 22:08 | |
| *** dnalezyt has joined #openstack-keystone | 22:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.policy instead of incubated version https://review.openstack.org/148624 | 22:17 |
| *** nellysmitt has quit IRC | 22:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: refactor: use _get_project_endpoint_group_url() where applicable https://review.openstack.org/139080 | 22:18 |
| *** joesavak has quit IRC | 22:18 | |
| *** iwi has joined #openstack-keystone | 22:19 | |
| *** henrynash has quit IRC | 22:20 | |
| *** tqtran has left #openstack-keystone | 22:20 | |
| *** tqtran has joined #openstack-keystone | 22:20 | |
| iwi | Hi there, I'm just curious - is it possible to combine all of the service accounts into one account and use it across all of the openstack services? | 22:21 |
| *** pnavarro has joined #openstack-keystone | 22:29 | |
| gyee | depends | 22:29 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Use cryptography.fernet instead of python-keyczar https://review.openstack.org/156657 | 22:39 |
| dolphm | iwi: yes | 22:40 |
| dolphm | iwi: whether it's recommended or not depends on your security requirements and configuration | 22:40 |
| iwi | @gyee,@dolphm: any cons of such solution that you might think of ? | 22:41 |
| gyee | iwi, if you are using the OpenStack toolings, it may not be possible as the service accounts are hardcoded in some places | 22:41 |
| iwi | I'm going to use AD for authorisation and just want to limit "service" accounts to bare minimum | 22:42 |
| gyee | but if you are using your own tooling it is possible | 22:42 |
| gyee | how are you deploying the stuff? via OOO? | 22:42 |
| iwi | I'm actually using fuel | 22:43 |
| iwi | and I'm wondering if its worth to customise it instead of convincing the AD guys to create more accounts | 22:44 |
| gyee | iwi, you don't want to use domain-specific backend? | 22:45 |
| gyee | with domain-specific backend, you don't have to create the service account in AD, you can isolate them in a separate domain | 22:45 |
| iwi | hmmm | 22:45 |
| iwi | didn't really look into that | 22:46 |
| iwi | can you keep all service accounts in one domain and use AD for a domain with actual users ? | 22:46 |
| gyee | yes, that's possible | 22:47 |
| iwi | are there any disadvantages of taking the domain route ? | 22:47 |
| iwi | besides enabling keystone v3? | 22:47 |
| iwi | :) | 22:47 |
| gyee | keystone v3 is not a disadvantage :) | 22:48 |
| iwi | but can it case any troubles ? | 22:48 |
| gyee | shouldn't not, I haven't run into any so far | 22:49 |
| gyee | just create the service account in the 'default' domain | 22:49 |
| *** pnavarro has quit IRC | 22:50 | |
| gyee | iwi, you'll also need to enable Keystone v3 authentication in Horizon | 22:50 |
| gyee | iwi, https://github.com/openstack/horizon/blob/master/openstack_dashboard/local/local_settings.py.example#L37 | 22:52 |
| *** timcline has quit IRC | 22:53 | |
| iwi | does all OS services support v3 ? | 22:57 |
| *** openstackgerrit has quit IRC | 23:00 | |
| *** openstackgerrit has joined #openstack-keystone | 23:00 | |
| gyee | iwi, there are two aspects, 1) validating a V3 token, and 2) authenticating service user | 23:00 |
| gyee | 1) is transparent to the services are it is handled by keystone auth_token middleware | 23:00 |
| gyee | as for 2), not all services are using v3 to authenticate the service user right now | 23:01 |
| gyee | but if you are creating the service accounts in the "default" domain, that should make the service account backward compatible regardless | 23:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.policy instead of incubated version https://review.openstack.org/148624 | 23:04 |
| stevemar | dhellmann, ^ there we go, that one should work | 23:05 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubated version of oslo policy https://review.openstack.org/157158 | 23:07 |
| jamielennox | iwi: there are some places that will be v2 only | 23:08 |
| jamielennox | (so can't be used in the non-default domain) | 23:09 |
| jamielennox | for example nova talking to neutron and vice-versa | 23:09 |
| jamielennox | i haven't looked but i think ceilometer will have provlbmes as well | 23:09 |
| gyee | jamielennox, speaking of that, did neutronclient have a new release yet? | 23:10 |
| jamielennox | gyee: i've been bugging mestry, he was going to do it within a few days | 23:10 |
| jamielennox | which might have happened by now | 23:10 |
| gyee | sweeet! | 23:10 |
| jamielennox | interestingly the neutron -> novaclient has the same problem - but neutron doesn't mind having the hackj | 23:10 |
| jamielennox | still nothing... | 23:11 |
| gyee | jamielennox, I think one of the neutron drivers are using using v2 directly | 23:11 |
| jamielennox | gyee: annoying as i wrote all this for k1 so that we'd have heaps of time to let it settle down and be tested | 23:11 |
| jamielennox | gyee: yea - i've seen that, not my problem | 23:12 |
| gyee | jamielennox, we are moving at the speed of light :) | 23:12 |
| gyee | hahahaha | 23:12 |
| iwi | @gyee: but what about services that are not using V3 - won't they try to authenticate AD only users (from a separate domain) against sql backend specified in "default" domain ? | 23:14 |
| gyee | iwi, "default" domain should be sql backend | 23:16 |
| iwi | yeap - I understood that part - but I'm just curious if there are any v2 only services that will need to authenticate actual users | 23:18 |
| *** chlong has joined #openstack-keystone | 23:18 | |
| gyee | iwi, I hope not, otherwise, the architecture is f'ed up | 23:19 |
| iwi | :) | 23:21 |
| jamielennox | iwi: heat can be deployed in that manner, but the newer work relies on trusts and you should use that instead | 23:21 |
| iwi | I guess I'll need to dig a bit on trusts now :) | 23:23 |
| iwi | thanks for help anyway | 23:23 |
| *** andreaf_ has quit IRC | 23:24 | |
| *** karimb has quit IRC | 23:25 | |
| *** iwi has quit IRC | 23:25 | |
| *** karimb has joined #openstack-keystone | 23:25 | |
| *** ljfisher has quit IRC | 23:32 | |
| *** ljfisher has joined #openstack-keystone | 23:35 | |
| *** krtaylor has quit IRC | 23:40 | |
| *** karimb has quit IRC | 23:41 | |
| *** dims_ has joined #openstack-keystone | 23:49 | |
| *** haneef_ has joined #openstack-keystone | 23:50 | |
| *** dims__ has quit IRC | 23:51 | |
| haneef_ | jamielennox: Any idea what am I missing? Did that ever work? https://bugs.launchpad.net/python-keystoneclient/+bug/1423316 | 23:51 |
| openstack | Launchpad bug 1423316 in python-keystoneclient "V3Password as plugin auth doesn't work with kesytonemiddleware" [Undecided,New] | 23:51 |
| *** carlosmarin1 has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!