| *** lhcheng_ has quit IRC | 00:00 | |
| *** abhirc_ has quit IRC | 00:00 | |
| *** abhirc has joined #openstack-keystone | 00:01 | |
| dolphm | dstanek: i've seen it more the second way | 00:01 |
|---|---|---|
| *** lhcheng has joined #openstack-keystone | 00:03 | |
| *** abhirc has quit IRC | 00:06 | |
| jamielennox | gyee: thanks for that | 00:07 |
| *** pdesai has joined #openstack-keystone | 00:13 | |
| gyee | jamielennox, no problem | 00:15 |
| *** david-lyle is now known as david-lyle_afk | 00:25 | |
| *** henrynash_ has joined #openstack-keystone | 00:26 | |
| *** ChanServ sets mode: +v henrynash_ | 00:26 | |
| *** henrynash has quit IRC | 00:29 | |
| *** henrynash_ is now known as henrynash | 00:29 | |
| openstackgerrit | Merged openstack/keystone: Rename test_content_types https://review.openstack.org/158854 | 00:33 |
| *** pdesai has quit IRC | 00:33 | |
| *** nkinder has joined #openstack-keystone | 00:33 | |
| openstackgerrit | Merged openstack/keystone: Rename test_keystoneclient* https://review.openstack.org/158856 | 00:34 |
| *** mattfarina has quit IRC | 00:38 | |
| *** dims__ has joined #openstack-keystone | 00:40 | |
| *** jaosorior has quit IRC | 00:41 | |
| *** dims has quit IRC | 00:42 | |
| *** _cjones_ has quit IRC | 00:51 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Separate exceptions into their own file https://review.openstack.org/157277 | 00:55 |
| openstackgerrit | Merged openstack/keystonemiddleware: Extract SigningDirectory into file https://review.openstack.org/157278 | 00:55 |
| *** abhirc_ has joined #openstack-keystone | 00:56 | |
| *** _cjones_ has joined #openstack-keystone | 00:57 | |
| *** lsmola has quit IRC | 01:07 | |
| *** arif-ali has quit IRC | 01:08 | |
| *** chmouel has quit IRC | 01:08 | |
| *** lsmola has joined #openstack-keystone | 01:09 | |
| *** openstack has joined #openstack-keystone | 01:11 | |
| *** chmouel has joined #openstack-keystone | 01:11 | |
| *** _cjones_ has quit IRC | 01:16 | |
| *** gabrielbezerra has joined #openstack-keystone | 01:16 | |
| *** ccard_ has quit IRC | 01:16 | |
| *** radez_g0n3 has quit IRC | 01:16 | |
| *** cburgess has quit IRC | 01:16 | |
| *** redrobot has quit IRC | 01:16 | |
| *** wolsen has quit IRC | 01:16 | |
| *** tristanC has quit IRC | 01:16 | |
| *** morganfainberg has quit IRC | 01:16 | |
| *** nonameentername has quit IRC | 01:16 | |
| *** gabriel-bezerra has quit IRC | 01:16 | |
| *** abhirc_ has quit IRC | 01:16 | |
| *** ccard_ has joined #openstack-keystone | 01:17 | |
| *** henrynash has quit IRC | 01:17 | |
| *** arif-ali has joined #openstack-keystone | 01:20 | |
| *** cburgess has joined #openstack-keystone | 01:20 | |
| *** radez_g0n3 has joined #openstack-keystone | 01:20 | |
| *** redrobot has joined #openstack-keystone | 01:20 | |
| *** wolsen has joined #openstack-keystone | 01:20 | |
| *** tristanC has joined #openstack-keystone | 01:20 | |
| *** morganfainberg has joined #openstack-keystone | 01:20 | |
| *** nonameentername has joined #openstack-keystone | 01:20 | |
| *** sendak.freenode.net sets mode: +v morganfainberg | 01:20 | |
| *** lhcheng has quit IRC | 01:30 | |
| *** mestery has joined #openstack-keystone | 01:31 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:31 | |
| *** gyee has quit IRC | 01:35 | |
| *** ekarlso has quit IRC | 01:35 | |
| *** haneef_ has quit IRC | 01:35 | |
| *** esp has quit IRC | 01:35 | |
| *** anteaya has quit IRC | 01:35 | |
| *** jogo has quit IRC | 01:35 | |
| *** greghaynes has quit IRC | 01:35 | |
| *** jbonjean has quit IRC | 01:35 | |
| *** dank_ has quit IRC | 01:35 | |
| *** svasheka has quit IRC | 01:35 | |
| *** charz has quit IRC | 01:35 | |
| *** marekd has quit IRC | 01:35 | |
| *** baffle has quit IRC | 01:35 | |
| *** navid_ has quit IRC | 01:35 | |
| *** zz_avozza has quit IRC | 01:35 | |
| *** mestery has quit IRC | 01:37 | |
| *** gyee has joined #openstack-keystone | 01:39 | |
| *** jogo has joined #openstack-keystone | 01:39 | |
| *** greghaynes has joined #openstack-keystone | 01:39 | |
| *** ekarlso has joined #openstack-keystone | 01:39 | |
| *** jbonjean has joined #openstack-keystone | 01:39 | |
| *** esp has joined #openstack-keystone | 01:39 | |
| *** haneef_ has joined #openstack-keystone | 01:39 | |
| *** 92AAALG4Y has joined #openstack-keystone | 01:39 | |
| *** anteaya has joined #openstack-keystone | 01:39 | |
| *** svasheka has joined #openstack-keystone | 01:39 | |
| *** charz has joined #openstack-keystone | 01:39 | |
| *** marekd has joined #openstack-keystone | 01:39 | |
| *** baffle has joined #openstack-keystone | 01:39 | |
| *** navid_ has joined #openstack-keystone | 01:39 | |
| *** zz_avozza has joined #openstack-keystone | 01:39 | |
| *** sendak.freenode.net sets mode: +vv gyee marekd | 01:39 | |
| *** abhirc has joined #openstack-keystone | 01:40 | |
| *** abhirc has quit IRC | 01:40 | |
| *** gyee has quit IRC | 01:40 | |
| *** ekarlso has quit IRC | 01:40 | |
| *** haneef_ has quit IRC | 01:40 | |
| *** esp has quit IRC | 01:40 | |
| *** anteaya has quit IRC | 01:40 | |
| *** jogo has quit IRC | 01:40 | |
| *** greghaynes has quit IRC | 01:40 | |
| *** jbonjean has quit IRC | 01:40 | |
| *** 92AAALG4Y has quit IRC | 01:40 | |
| *** svasheka has quit IRC | 01:40 | |
| *** charz has quit IRC | 01:40 | |
| *** marekd has quit IRC | 01:40 | |
| *** baffle has quit IRC | 01:40 | |
| *** navid_ has quit IRC | 01:40 | |
| *** zz_avozza has quit IRC | 01:40 | |
| *** dims__ has quit IRC | 01:40 | |
| *** tqtran_ has quit IRC | 01:40 | |
| *** david-lyle_afk has quit IRC | 01:40 | |
| *** gyee has joined #openstack-keystone | 01:41 | |
| *** jogo has joined #openstack-keystone | 01:41 | |
| *** greghaynes has joined #openstack-keystone | 01:41 | |
| *** ekarlso has joined #openstack-keystone | 01:41 | |
| *** jbonjean has joined #openstack-keystone | 01:41 | |
| *** esp has joined #openstack-keystone | 01:41 | |
| *** haneef_ has joined #openstack-keystone | 01:41 | |
| *** 92AAALG4Y has joined #openstack-keystone | 01:41 | |
| *** anteaya has joined #openstack-keystone | 01:41 | |
| *** svasheka has joined #openstack-keystone | 01:41 | |
| *** charz has joined #openstack-keystone | 01:41 | |
| *** marekd has joined #openstack-keystone | 01:41 | |
| *** baffle has joined #openstack-keystone | 01:41 | |
| *** navid_ has joined #openstack-keystone | 01:41 | |
| *** zz_avozza has joined #openstack-keystone | 01:41 | |
| *** sendak.freenode.net sets mode: +vv gyee marekd | 01:41 | |
| *** gyee has quit IRC | 01:56 | |
| *** jamielennox is now known as jamielennox|away | 01:58 | |
| *** ayoung has joined #openstack-keystone | 01:59 | |
| *** dims__ has joined #openstack-keystone | 01:59 | |
| *** david-lyle_afk has joined #openstack-keystone | 01:59 | |
| *** jamielennox|away is now known as jamielennox | 02:06 | |
| *** harlowja has quit IRC | 02:07 | |
| *** harlowja_ has joined #openstack-keystone | 02:07 | |
| *** ayoung has quit IRC | 02:10 | |
| *** dims__ has quit IRC | 02:10 | |
| *** david-lyle_afk has quit IRC | 02:10 | |
| *** ayoung has joined #openstack-keystone | 02:16 | |
| *** dims__ has joined #openstack-keystone | 02:16 | |
| *** david-lyle_afk has joined #openstack-keystone | 02:16 | |
| *** abhirc has joined #openstack-keystone | 02:16 | |
| *** jamielennox is now known as jamielennox|away | 02:17 | |
| *** erkules has joined #openstack-keystone | 02:19 | |
| *** erkules_ has quit IRC | 02:21 | |
| *** mestery has joined #openstack-keystone | 02:22 | |
| *** mestery has quit IRC | 02:23 | |
| *** jamielennox|away is now known as jamielennox | 02:27 | |
| *** mestery has joined #openstack-keystone | 02:33 | |
| *** jamielennox is now known as jamielennox|away | 02:38 | |
| *** himangi has joined #openstack-keystone | 02:42 | |
| *** richm has quit IRC | 02:42 | |
| *** jamielennox|away is now known as jamielennox | 02:47 | |
| *** dims__ has quit IRC | 02:48 | |
| *** browne has quit IRC | 02:49 | |
| *** jacer_huawei has joined #openstack-keystone | 02:54 | |
| *** jacer_huawei is now known as wanghong | 02:54 | |
| *** markvoelker has quit IRC | 02:56 | |
| *** markvoelker has joined #openstack-keystone | 02:57 | |
| *** stevemar has joined #openstack-keystone | 02:57 | |
| *** ChanServ sets mode: +v stevemar | 02:57 | |
| jamielennox | stevemar: i caught up to your +2s on the split auth_token middleware reviews | 03:00 |
| stevemar | jamielennox, \o/ | 03:00 |
| *** markvoelker has quit IRC | 03:01 | |
| *** alex_xu has quit IRC | 03:10 | |
| *** alex_xu has joined #openstack-keystone | 03:13 | |
| *** devlaps has joined #openstack-keystone | 03:14 | |
| *** jamielennox is now known as jamielennox|away | 03:22 | |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 03:24 |
| *** jamielennox|away is now known as jamielennox | 03:33 | |
| *** hogepodge has quit IRC | 03:34 | |
| openstackgerrit | wanghong proposed openstack/keystone: remove useless nocatalog tests of endpoint_filter https://review.openstack.org/144946 | 03:36 |
| *** hogepodge has joined #openstack-keystone | 03:39 | |
| openstackgerrit | wanghong proposed openstack/keystone: apply endpoint_group filters on token catalog https://review.openstack.org/144187 | 03:39 |
| *** devlaps has quit IRC | 03:40 | |
| *** sacharya has joined #openstack-keystone | 03:41 | |
| morganfainberg | stevemar, about to rebase the other notification ones. | 03:45 |
| *** sacharya has left #openstack-keystone | 03:45 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 03:49 |
| *** dims has joined #openstack-keystone | 03:49 | |
| *** dims has quit IRC | 03:54 | |
| morganfainberg | hmm | 04:02 |
| morganfainberg | not sure how to handle https://review.openstack.org/#/c/156905/4/keystone/notifications.py | 04:02 |
| morganfainberg | i *guess* we could move this into a context manager? | 04:03 |
| morganfainberg | that fires notification for success or failure if an exception is raised? | 04:03 |
| morganfainberg | but that feels wierd | 04:03 |
| morganfainberg | stevemar, ^ cc | 04:03 |
| openstackgerrit | wanghong proposed openstack/keystone: make trust manager raise formatted message exception https://review.openstack.org/149550 | 04:03 |
| stevemar | morganfainberg, yep, looking (and eating / watching tv) | 04:03 |
| stevemar | morganfainberg, why is it weird? | 04:04 |
| stevemar | exception is fired off if it fails | 04:04 |
| *** abhirc has quit IRC | 04:04 | |
| morganfainberg | i guess it would work in the __exit__ | 04:05 |
| stevemar | i thought we were going to do a try/catch to handle the failures | 04:05 |
| morganfainberg | it feels like we're going to run into similar issues as with the decorator | 04:05 |
| morganfainberg | with notification.Audit.created(args): | 04:05 |
| morganfainberg | do thing | 04:06 |
| *** markvoelker has joined #openstack-keystone | 04:06 | |
| *** harlowja_ is now known as harlowja_away | 04:06 | |
| morganfainberg | if it has an exception i guess it could just fire off as a FAILED instead of a SUCCESS | 04:06 |
| *** sluo_wfh has joined #openstack-keystone | 04:08 | |
| morganfainberg | stevemar, i'm trying to avoid needing to do try: thing: except: | 04:09 |
| morganfainberg | and having to put the same exact notify code in both places. | 04:09 |
| morganfainberg | i guess maybe try except finally? | 04:09 |
| morganfainberg | but doesn't a context manager make more sense then? | 04:09 |
| stevemar | as mentioned earlier, the failure notifications are add-ons, the regular notifications didn't do that | 04:10 |
| openstackgerrit | wanghong proposed openstack/keystone: use tokens returned by delete_tokens to invalidate cache https://review.openstack.org/153501 | 04:11 |
| *** sluo_wfh has quit IRC | 04:15 | |
| morganfainberg | stevemar, something like: http://paste.openstack.org/show/181600/ | 04:16 |
| stevemar | morganfainberg, agree to the try/except/finally stuff | 04:17 |
| morganfainberg | so we don't need to duplicate it everywehre context seems to be the right approach | 04:17 |
| stevemar | morganfainberg, so make the change to notifications.py to use contextmanager, but in the manager classes they'll call `with blah` | 04:19 |
| morganfainberg | stevemar yes. | 04:19 |
| morganfainberg | stevemar, seeing if this works as I think it'll work if it does it becomes easy to make this all happy. | 04:21 |
| *** sluo_wfh has joined #openstack-keystone | 04:23 | |
| stevemar | morganfainberg, i could rework some of the authN audit events to do the same thing | 04:26 |
| morganfainberg | hmm. ok this isn't working like i expect it to. | 04:26 |
| morganfainberg | i need to test @classmethod + contextlib | 04:26 |
| morganfainberg | might do some silly things | 04:26 |
| lbragstad | ok, I have a dumb question for all my smart Keystone friends... | 04:32 |
| lbragstad | where in the world is tenant_bar declared https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v2.py#L210 ? | 04:32 |
| * lbragstad sits in the corner wearing the Dunce cap | 04:33 | |
| *** himangi has quit IRC | 04:33 | |
| jamielennox | lbragstad: load_fixtures in unit/core.py | 04:36 |
| lbragstad | jamielennox: ahhh, gotcha | 04:39 |
| *** sluo_wfh is now known as sluo_laptop | 04:44 | |
| lbragstad | jamielennox: thanks! | 04:47 |
| jamielennox | lbragstad: np, i know that one cause i searched for it for ages once | 04:47 |
| lbragstad | jamielennox: same.. I've been grepping like crazy | 04:48 |
| stevemar | lbragstad, yep there are quite a few things in the tests that are magically setup from unit/core.py | 04:48 |
| lbragstad | stevemar: it looks like it | 04:48 |
| stevemar | there is some crazy inheritence in the tests | 04:48 |
| stevemar | probably not all that good | 04:48 |
| lbragstad | stevemar: well, the funny thing is that when you work in the test_v3* stuff you get really use to just following the restful test case | 04:49 |
| lbragstad | but https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v2.py#L32 doesn't inherit anything | 04:50 |
| lbragstad | at least not that I am aware of, | 04:50 |
| lbragstad | but yet it has class variables that are not created within the test module | 04:50 |
| *** krtaylor has quit IRC | 04:51 | |
| morganfainberg | stevemar, this might actually look better | 04:56 |
| morganfainberg | with notifications.Audit.created(self._SERVICE, service_id, initiator): | 04:56 |
| morganfainberg | return self.driver.create_service(service_id, service_ref) | 04:56 |
| stevemar | lbragstad, i think the restful test cases (rest.py) even leverage core.py too? | 04:57 |
| lbragstad | stevemar: they probably do, | 04:58 |
| stevemar | morganfainberg, err, feels weird to have a return statement in the with | 04:58 |
| morganfainberg | stevemar, it works though :P) | 04:58 |
| lbragstad | stevemar: maybe it's because there is more data created in each v3 test versus all up front? | 04:58 |
| *** krtaylor has joined #openstack-keystone | 05:03 | |
| *** krtaylor has quit IRC | 05:04 | |
| *** krtaylor has joined #openstack-keystone | 05:09 | |
| morganfainberg | stevemar this is kindof a mess. | 05:17 |
| morganfainberg | stevemar, is it a big deal to punt on the failure outcomes until later on? | 05:18 |
| morganfainberg | because there is *yet another* reason this type of magic stuff doesn't work (we don't emit certain types of updates in some cases becasue we did a disable instead of a update) | 05:18 |
| morganfainberg | it's... | 05:18 |
| morganfainberg | wonky | 05:18 |
| stevemar | morganfainberg, punt on it | 05:26 |
| morganfainberg | will comment that it needs some more rethinking and we should address it outside of the scope of this fix. | 05:26 |
| stevemar | fine with me | 05:26 |
| stevemar | like i said, the important part was parity with what existed in juno | 05:27 |
| stevemar | a deployer can just switch notifitcation_format to 'cadf' in config, and they'll see the exact same stuff in ceilometer, and in resource_info key of the payload | 05:28 |
| stevemar | there will be more stuff too, and they can choose to consume it | 05:28 |
| morganfainberg | stevemar, ok comented | 05:28 |
| morganfainberg | and tossed a -1 on it | 05:29 |
| stevemar | morganfainberg, is keystone's service id made available anywhere easily? or just catalog_api.get_service() | 05:29 |
| morganfainberg | otherwise dstanek had some questions on it, so i answered them, not sure if this needs a new patchset to address anything though | 05:29 |
| morganfainberg | stevemar, hmm... uh, i think it's only in the service catalog | 05:29 |
| stevemar | morganfainberg, just something i was thinking about adding to the cadf payload | 05:31 |
| *** lhcheng has joined #openstack-keystone | 05:45 | |
| *** browne has joined #openstack-keystone | 05:48 | |
| *** himangi has joined #openstack-keystone | 05:58 | |
| *** browne has quit IRC | 06:00 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 06:02 |
| *** lhcheng_ has joined #openstack-keystone | 06:05 | |
| *** lhcheng has quit IRC | 06:08 | |
| stevemar | morganfainberg, looking at https://review.openstack.org/#/c/158600 | 06:08 |
| stevemar | do we even need the changes to line 194 and such? | 06:08 |
| morganfainberg | Not sure what happens when you se initiator to {} vs None. was trying to mirror your other change somewhat. | 06:10 |
| morganfainberg | The note should be updated to say "yeah this won't ever work" in either case. | 06:10 |
| stevemar | but that part was only used because of the decorate | 06:10 |
| stevemar | decorator* | 06:10 |
| stevemar | with the new emit function, it just passes in the initiator right away | 06:10 |
| morganfainberg | Correct. But we aren't removing the decorator yet. (Can we this cycle?) | 06:11 |
| morganfainberg | So I just was making sure nothing is broken if the decorator is still used. | 06:11 |
| stevemar | morganfainberg, but you are removing the decorator | 06:12 |
| stevemar | in the subsequent patches | 06:12 |
| morganfainberg | No. We aren't. We are removing our use. Until the decorator is deleted from the code base, it should work ;) | 06:13 |
| morganfainberg | If that makes sense. | 06:14 |
| morganfainberg | So it probably isn't needed. | 06:18 |
| stevemar | morganfainberg, i think at that point it'll just be disabled/internal using it | 06:20 |
| morganfainberg | Sure. Can update tomorrow. | 06:20 |
| stevemar | and disabled events are pretty much the same as internal, i think | 06:20 |
| stevemar | all they end up doing is calling the callback handler | 06:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 06:25 |
| *** rwsu is now known as rwsu-afk | 06:25 | |
| *** himangi has quit IRC | 06:34 | |
| openstackgerrit | Abhishek Kekane proposed openstack/keystone: Eventlet green threads not released back to pool https://review.openstack.org/130824 | 06:42 |
| openstackgerrit | wanghong proposed openstack/keystone: make response of endpoint_group API contain full url https://review.openstack.org/151863 | 06:44 |
| openstackgerrit | wanghong proposed openstack/keystone: add missing links for v3 OS-EC2 API response https://review.openstack.org/151592 | 06:54 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: WIP - Add service provider CRUD https://review.openstack.org/159018 | 06:59 |
| *** stevemar has quit IRC | 07:10 | |
| *** stevemar has joined #openstack-keystone | 07:10 | |
| *** ChanServ sets mode: +v stevemar | 07:10 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: WIP - add support to samlize a token https://review.openstack.org/159022 | 07:12 |
| *** mzbik has joined #openstack-keystone | 07:18 | |
| *** markvoelker has quit IRC | 07:32 | |
| *** markvoelker has joined #openstack-keystone | 07:33 | |
| *** markvoelker has quit IRC | 07:37 | |
| *** ekarlso has quit IRC | 07:48 | |
| *** himangi has joined #openstack-keystone | 08:03 | |
| *** lhcheng_ has quit IRC | 08:08 | |
| *** afazekas_ has joined #openstack-keystone | 08:30 | |
| *** jaosorior has joined #openstack-keystone | 08:30 | |
| *** nellysmitt has joined #openstack-keystone | 08:40 | |
| *** himangi has quit IRC | 08:43 | |
| *** himangi has joined #openstack-keystone | 08:43 | |
| *** karimb has joined #openstack-keystone | 08:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/155584 | 08:47 |
| ccard | stevemar: did you get a chance to look at my issue? | 08:48 |
| *** ekarlso has joined #openstack-keystone | 08:52 | |
| marekd | ccard: i think he is asleep now. | 08:53 |
| marekd | ~4 a.m. at stevemar's clock | 08:53 |
| *** jistr has joined #openstack-keystone | 08:53 | |
| *** himangi has quit IRC | 08:53 | |
| ccard | marekd: ok. I think I have a work round anyway - "openstack role add --project <project_id> --user <user_id> _member_" works, presumably because the ids are unique across all domains, so the domain is not required to look up the project and user. | 08:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - add cadf notifications for oauth https://review.openstack.org/159045 | 09:04 |
| openstackgerrit | Alistair Coles proposed openstack/keystonemiddleware: Delay denial when service token is invalid https://review.openstack.org/153247 | 09:04 |
| *** rlt_ has joined #openstack-keystone | 09:11 | |
| rlt_ | Hello, I have set up a federated keystone for 2 regions. Is it possible to restrict access to a user to only one region ? | 09:14 |
| marekd | rlt_: hi. are you referring to K2K federation? | 09:15 |
| *** markvoelker has joined #openstack-keystone | 09:16 | |
| *** stevemar has quit IRC | 09:16 | |
| *** markvoelker has quit IRC | 09:21 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-federation: Refactor federated authentication plugins https://review.openstack.org/159049 | 09:25 |
| *** henrynash has joined #openstack-keystone | 09:29 | |
| *** ChanServ sets mode: +v henrynash | 09:29 | |
| *** himangi has joined #openstack-keystone | 09:43 | |
| *** himangi has quit IRC | 10:00 | |
| rlt_ | marekd, no i don't know K2K federation. I just look at the blueprints. | 10:05 |
| breton | is there any blogpost, doc or spec about endpoint filter exception? | 10:09 |
| breton | I want to understand why one might need it | 10:10 |
| *** fmarco76 has joined #openstack-keystone | 10:16 | |
| *** markvoelker has joined #openstack-keystone | 10:17 | |
| *** markvoelker has quit IRC | 10:22 | |
| rlt_ | marekd, i don't think K2K federation will answer my requirement for restrict ua user to a specific region. | 10:25 |
| marekd | rlt_: so, what did you set up actually? | 10:28 |
| marekd | Keystone SP and Keystone IdP, I am gussing. | 10:29 |
| marekd | rlt_: btw K2K == Keystone 2 Keystone | 10:29 |
| *** MasterPiece has joined #openstack-keystone | 10:32 | |
| rlt_ | First platform : One keystone (connect to LDAP) and one Horizon. Second Platform (RegionOne): Neutron, nova, glance...with out keystone and horizon. Third Platform (RegionTwo): Neutron, nova, glance...with out keystone and horizon. | 10:34 |
| marekd | rlt_: so you have one keysone only. and your users authenticate with that keystone? | 10:35 |
| rlt_ | Yes in relation with LDAP. | 10:35 |
| marekd | rlt_: ok | 10:36 |
| marekd | you mentioned you had set up federation | 10:36 |
| marekd | can you tell more how did you do that? | 10:36 |
| *** ioram has joined #openstack-keystone | 10:36 | |
| rlt_ | Ok, I made a mistake by using the word "federation" | 10:39 |
| rlt_ | Yes of course. | 10:39 |
| rlt_ | On my keystone, I defined two regions, two project "services" and two users this service on the LDAP. I set the endpoints per region. And on services (neutron nova ...) present on both platforms, they communicate with the only keystone (keystone authtoken) | 10:46 |
| rlt_ | I don't know if i'm clear | 10:47 |
| *** mzbik has quit IRC | 10:51 | |
| samueldmq | morning : ) | 10:52 |
| samueldmq | henrynash, hi, you around ? (domain-specific backends) | 10:54 |
| henrynash | samueldmq: yep | 10:54 |
| samueldmq | henrynash, I'm being caught at https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L450-L459 | 10:55 |
| samueldmq | henrynash, is self.driver always mapped to CONF.identity.default_domain_id? | 10:56 |
| henrynash | samueldmq: you’re probably executing a test that creats a new domain | 10:56 |
| samueldmq | henrynash, yes | 10:56 |
| henrynash | samueldmq: running under LDAP not configured for multi-domain | 10:56 |
| samueldmq | henrynash, and it do create the domain? | 10:57 |
| henrynash | you’ll need to add some stubs in test_backend_ldap….hold on let me find you an example | 10:57 |
| *** amakarov_away is now known as amakarov | 10:57 | |
| samueldmq | henrynash, shouldn't I have already an error in the instantiation of the domain? | 10:57 |
| henrynash | samueldmq: is it a new test? | 10:57 |
| samueldmq | henrynash, ok please | 10:58 |
| samueldmq | henrynash, yes let me find it for you | 10:58 |
| samueldmq | keystone.tests.unit.test_backend_ldap.DomainSpecificSQLIdentity.test_delete_is_domain_project | 10:59 |
| samueldmq | henrynash, on this patch https://review.openstack.org/#/c/143763/ | 10:59 |
| samueldmq | henrynash, a little of background ..... when I update a is-domain project, I need to update its correspondent domain as well.. | 11:01 |
| samueldmq | henrynash, so we disable that project, and consequently the correspondent domain ... and we get that | 11:02 |
| amakarov | henrynash, good day to you! I've done a little research on the cross-DC assignment sync and want to start working on it. As I see, we'll have the very same problem in revocation and other delegation stuff. My question: is it a spec, bug or blueprint? | 11:02 |
| *** aix has joined #openstack-keystone | 11:02 | |
| henrynash | samueldq: sorry, not sure I understand “update its corresponding domain as well”….I thought we were removing the domain table? | 11:03 |
| samueldmq | henrynash, yes but not in this step | 11:03 |
| samueldmq | henrynash, this patch only reflect domain operations on is_domain projects, and vice versa | 11:04 |
| samueldmq | henrynash, the next patches in the chain will migrate exisiting domains and drop the table | 11:04 |
| samueldmq | makes sense? | 11:04 |
| henrynash | amakarov: so it definitely isn;t a bug! ANd depending on the answr, it could be a spec, bp or just a best=practices guide | 11:04 |
| henrynash | samueldmq: ah, ok | 11:04 |
| samueldmq | henrynash, if I understood .... I created a domain without specifying its driver, right? | 11:05 |
| amakarov | henrynash, well, let it be a blueprint then | 11:05 |
| samueldmq | henrynash, and then it got mapped to the default driver ... | 11:06 |
| samueldmq | right? | 11:06 |
| henrynash | samueldmq: so I can’t quite work out what;s going on (and not entirely sure what you;ve changed in tehetst code)….but remember, if you don’t have domain_specific enabled, then we only support teh default domain | 11:06 |
| samueldmq | henrynash, that's a good tip ... I'll investigate a bit more and go back to you if I have any additional question | 11:08 |
| samueldmq | henrynash, dont intend to take your time (it's expensive!!!) :-) | 11:09 |
| samueldmq | thx | 11:09 |
| henrynash | samueldmq: np….sorry, a bit burried right now! | 11:09 |
| samueldmq | henrynash, sure np | 11:09 |
| *** henrynash has quit IRC | 11:11 | |
| *** rushiagr_away is now known as rushiagr | 11:12 | |
| *** markvoelker has joined #openstack-keystone | 11:18 | |
| *** dims has joined #openstack-keystone | 11:18 | |
| breton | morganfainberg: would you mind if I steal your work on squashing migrations? | 11:21 |
| *** markvoelker has quit IRC | 11:23 | |
| *** karimb has quit IRC | 11:33 | |
| *** henrynash has joined #openstack-keystone | 11:37 | |
| *** ChanServ sets mode: +v henrynash | 11:37 | |
| *** EmilienM is now known as EmilienM|afk | 11:39 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Redis token backend https://review.openstack.org/150844 | 11:45 |
| *** karimb has joined #openstack-keystone | 11:50 | |
| samueldmq | henrynash, ping - I think there is a bug in that bit ... let me give you one situation, and you say me how it's supposed to work, ok? | 11:51 |
| henrynash | samueldmq: sure | 11:52 |
| samueldmq | henrynash, how fast ... :p | 11:52 |
| samueldmq | henrynash, ldap for default domain for identity | 11:52 |
| samueldmq | henrynash, sql for resource | 11:52 |
| henrynash | ok | 11:52 |
| samueldmq | i) you create a new domain on resource | 11:52 |
| samueldmq | ii) list_users(domain_x) (only in resource) | 11:53 |
| samueldmq | suppose domain_specific_drivers are enabled | 11:53 |
| samueldmq | how this should work? domain_x is only on resource and has no users... | 11:54 |
| samueldmq | on resource core, _select_identity_driver will try to find an identity driver for domain_x .... but actually there is no identity driver for it | 11:55 |
| henrynash | i guess if you never call any identity methods… or none of the manager calls you amke do…but that’s hard | 11:55 |
| henrynash | samueldmq: so a common situation is that you have specific domain configs set up for some number of domains and then SQL for teh default domain and any other domains | 11:56 |
| samueldmq | henrynash, yep ... but any identity operation for a non-identity domain will fail, when selecting the driver | 11:57 |
| henrynash | samueldmq: what do you mean by “non-identity domain”? | 11:57 |
| samueldmq | henrynash, a domain only created on the resource backend ... that dont map to a specific driver | 11:58 |
| henrynash | samueldmq: Ok, so whether such a situation will work will still depend on how you have configured the ldap idenity drivers... | 11:59 |
| henrynash | samuledmq: so look at class MultiLDAPandSQLIdentity in test_baclend_ldap | 11:59 |
| samueldmq | henrynash, looking | 12:00 |
| *** jaosorior has quit IRC | 12:01 | |
| henrynash | samueldmq: as long as you have the identity driver assigned to SQL in the general keystone.conf, and have some number of named daomins with their own ldap configs…then mulitple domains are supported (since they’ll all be handled by the sql driver) | 12:02 |
| samueldmq | henrynash, hmm.. makes sense | 12:03 |
| samueldmq | so the default domain is mapped to sql | 12:03 |
| henrynash | samueldmq: not nececssarily! | 12:03 |
| henrynash | samueldmq: and domains that don’t have their own config file are mapped to SQL | 12:04 |
| henrynash | samueldmq: normally, I would agree, that would usually incude the default domain…but in this particular example, we also provide a specifc config file for teh default domain | 12:04 |
| henrynash | samueldmq: (typo) ANY domains that don’t have their own config file are mapped to SQL | 12:05 |
| samueldmq | henrynash, and if we have not a sql identity? we still create domains in the resource bakcned, and they will fail to list_users, etc | 12:05 |
| henrynash | samueldmq: …or you have to have the domains have their own config file…..hard today in a test…but easier whan i get my domain config in the database patch it (‘cause a test could create a config for teh new domai on teh fly) | 12:07 |
| samueldmq | henrynash, yes .. but what I mean is to forbid the creation of new domains if you don't have any sql identity.. because we won't be able to handle identity for that domain | 12:08 |
| samueldmq | henrynash, makes sense? | 12:08 |
| henrynash | samueldmq: so normally any tests taht today fail becuase of this should have an override teh base clase in test_backend_ldap to expect an error….but allowed to run in MultiLDAPandSQLIdentity | 12:08 |
| henrynash | samueldmq: hmm, there was a patch for this a while back….can’t remember what happend to it | 12:09 |
| henrynash | samueldmq: I think its a decorator you attach to tests.... | 12:09 |
| samueldmq | henrynash, skip_if_no_multiple_domains_support? | 12:10 |
| henrynash | samueldmq: yes…not sure how it works... | 12:10 |
| samueldmq | henrynash, already using it :p | 12:11 |
| henrynash | samueldmq: and whether it allows the tests to run in environemnts where they CAN run, like MultiLDAPandSQLIdentity | 12:11 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 12:11 |
| *** aix has quit IRC | 12:11 | |
| samueldmq | henrynash, I'll dig it a bit more ... and submit a test exposing a bug (if there is one) | 12:12 |
| henrynash | samueldmq: I’ll try and find where I did the test overriding in a recent patch (it mightbe that I should have used the decoratror) | 12:12 |
| henrynash | samueldmq: here you go, this is in one of teh data driven test patches: https://review.openstack.org/#/c/154302/12/keystone/tests/unit/test_backend_ldap.py | 12:14 |
| samueldmq | henrynash, hmm ... but looking at the code again .. I still think there is a bug | 12:15 |
| samueldmq | henrynash, now I think I can explain well.. are you ready to the battle? | 12:15 |
| henrynash | samuedlmq: ok…you have the floor | 12:15 |
| samueldmq | henrynash, 3 2 1 .. | 12:15 |
| samueldmq | henrynash, ldap for domain default + sql for domain1 (both specified in domain specific config files) | 12:16 |
| henrynash | samueldmq: ok | 12:16 |
| samueldmq | (this is what we have on that test DomainSpecificLDAPandSQLIdentity) | 12:16 |
| samueldmq | 1) create domain2 | 12:17 |
| henrynash | samueldmq: and SQL in the main keystone.conf ot not? | 12:17 |
| samueldmq | let's say no | 12:17 |
| henrynash | ok | 12:17 |
| samueldmq | henrynash, 2) after creating domain2: list_users(domain2) | 12:17 |
| henrynash | creating new domains will fail | 12:18 |
| samueldmq | ok... so sql in keystone.conf :p | 12:18 |
| henrynash | ok, should now work | 12:18 |
| samueldmq | step 2 will call _select_identity_driver(..), right? | 12:18 |
| henrynash | yes | 12:18 |
| samueldmq | what should it return? | 12:18 |
| henrynash | it should return the sql driver | 12:19 |
| samueldmq | the driver for domain1 (the sql one) | 12:19 |
| *** markvoelker has joined #openstack-keystone | 12:19 | |
| samueldmq | henrynash, ygreat! it does not! | 12:19 |
| samueldmq | henrynash, look at _select_identity_driver in identity core | 12:19 |
| henrynash | ahh, well to be speccific you cant have TWO sql drivers | 12:19 |
| henrynash | you can’t have an sql driver in keystone.conf AND one for domain1 | 12:19 |
| henrynash | you should just have SQL in keystone.conf and any ldap drivers in their own config files | 12:20 |
| samueldmq | henrynash, the default driver (self.driver) in identity manager | 12:21 |
| samueldmq | henrynash, it always map to what is set in keystone_conf | 12:21 |
| samueldmq | : | 12:21 |
| samueldmq | ? | 12:21 |
| henrynash | yes | 12:22 |
| samueldmq | henrynash, so lets step back | 12:22 |
| henrynash | samueldmq: remember there are two “defaults” you could mean | 12:22 |
| henrynash | samueldmq: there is the “default domain” and the “default driver” | 12:23 |
| henrynash | samuedmq: the “default driver” is the one sepcified in keystone.conf | 12:23 |
| henrynash | samueldmq: the “default domain” may or may not be using the “default driver" | 12:24 |
| *** markvoelker has quit IRC | 12:24 | |
| samueldmq | henrynash, hmmm.. great, this makes me think a bit more | 12:24 |
| samueldmq | henrynash, well.. you won | 12:24 |
| samueldmq | henrynash, but jsut the round 1 | 12:24 |
| samueldmq | henrynash, I'll mull it a bit more | 12:24 |
| henrynash | samueldmq: ok, round 2 | 12:24 |
| raildo | FIGHT! | 12:25 |
| henrynash | samueldmq: I’ll wait for the next…:-) | 12:25 |
| samueldmq | henrynash, wait .. need to prepare myself, I am injured | 12:25 |
| henrynash | samueldmq: ok! | 12:25 |
| samueldmq | henrynash, yep .. will be back soon | 12:25 |
| *** dims has quit IRC | 12:27 | |
| *** henrynash has quit IRC | 12:29 | |
| *** henrynash has joined #openstack-keystone | 12:36 | |
| *** ChanServ sets mode: +v henrynash | 12:36 | |
| samueldmq | henrynash, ready? | 12:38 |
| henrynash | ok | 12:38 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: WIP: Exposing bug in domain-specific - Round 2 https://review.openstack.org/159099 | 12:39 |
| samueldmq | henrynash, ^ | 12:39 |
| samueldmq | henrynash, this fails with the error I have now | 12:40 |
| henrynash | samueldmq: and it should | 12:40 |
| henrynash | samueldmq: since there is no driver that can handle multiple domains that is not assigned to a specific domain | 12:41 |
| samueldmq | henrynash, but I should get an exception when creting the new domain, no? | 12:41 |
| samueldmq | henrynash, and not be allowed to create it and then not being able to make identity calls on it ... | 12:42 |
| henrynash | samueldmq: now maybe that’s true... | 12:42 |
| samueldmq | henrynash, :-) | 12:42 |
| *** aix has joined #openstack-keystone | 12:43 | |
| henrynash | samueldmq: if we have implemened code in create domain to fail if there are no backends in identity that can handle it (I didn’t wrote that bit, is was added later)….then I’d agree, it should fail | 12:43 |
| samueldmq | henrynash, yes ... exactly | 12:44 |
| henrynash | samueldmq: yeah, i just looked at the check in create domain….and it’s too simple | 12:45 |
| samueldmq | henrynash, if the default driver is sql or not, is that? | 12:46 |
| henrynash | samuedmq: ahh, but we have kind of a chicken and egg problem | 12:46 |
| henrynash | samueldmq: you may need to create a domain before adding the domain specifc config to it (you will certainly need to with my patch of storing the configs in a database) | 12:46 |
| henrynash | samuedmq: and you would need to in the file case too….if you made the check REALLY accurate | 12:47 |
| samueldmq | henrynash, sure .... first I'll submit a bug ok? | 12:47 |
| henrynash | samueldmq: I’m not sure it can be fixed completely | 12:48 |
| henrynash | samueldmq: in fact, it can't | 12:48 |
| henrynash | samueldmq: we can’t fix the general case….since you need to create a domain before assign configs to it | 12:49 |
| henrynash | sorry off line for a bit, back on later | 12:54 |
| *** henrynash has quit IRC | 12:54 | |
| *** jaosorior has joined #openstack-keystone | 12:55 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 13:00 |
| *** EmilienM|afk is now known as EmilienM | 13:03 | |
| *** abhirc has joined #openstack-keystone | 13:03 | |
| *** henrynash has joined #openstack-keystone | 13:15 | |
| *** ChanServ sets mode: +v henrynash | 13:15 | |
| samueldmq | henrynash, since you need to create a domain before assign configs to it .... | 13:19 |
| samueldmq | henrynash, create the domain and assignt the config in the same call ... if there is no config, rollback | 13:19 |
| *** markvoelker has joined #openstack-keystone | 13:20 | |
| henrynash | samueldmq: so two problems with that | 13:20 |
| henrynash | samueldmq: how would you do that in the current situation when teh configs are storied in a file | 13:20 |
| henrynash | samueldmq: (2) unfortuantly peopel didn’t wnat the config to be par to fthe domain entity, rather to be “attached” to teh domain entity | 13:21 |
| henrynash | samueldmq: so both makes doing what you suggest hard | 13:21 |
| samueldmq | sure ... | 13:22 |
| samueldmq | but in the create_domain call, you i) create the entity ii)check for the file iii) if not specific file, check if it can be mapped in the default_driver | 13:22 |
| samueldmq | if iii fails, delte the domain entity and then return the exception still in the create_domain call | 13:23 |
| *** dims has joined #openstack-keystone | 13:24 | |
| henrynash | samuedmq: os you *could* do that, seems to be a bit over the top for me….. | 13:24 |
| *** markvoelker has quit IRC | 13:25 | |
| henrynash | samueldmq: if you have enabled multi_domain_configs, then I think we should accept that there may be a gao betwee creating a domain and configuring the domain configs…..I don’t see any harm in practice for that…..we just have to be cleverer in our testing | 13:25 |
| *** MasterPiece has quit IRC | 13:26 | |
| samueldmq | henrynash, maybe just enforce that, if multi_domain_configs are enabled, the default driver MUST be sql | 13:27 |
| samueldmq | henrynash, makes sense to me as well | 13:27 |
| *** ljfisher has joined #openstack-keystone | 13:27 | |
| samueldmq | henrynash, so any created domain will always be mapped | 13:28 |
| henrynash | samueldmq: so I’m not sure we can insist on that either…(for production), some peopel create all their sevice users in a special domain (that is SQL mapped) and everything else is LDAP | 13:28 |
| samueldmq | henrynash, this makes us to be happy because no one is not hitting this problem | 13:29 |
| samueldmq | henrynash, but the problem exists ... if you create a domain and can't even list_users, there is a problem in there that need to be fixed | 13:30 |
| samueldmq | henrynash, that's my opinion, we can get other views over this | 13:30 |
| henrynash | samuedlmq: not necessarily….maybe you are just about to define the config settinsg for it….nobody knows about it yet (and list domains is a cloud admin thinggy) so why is it a proplem? | 13:31 |
| samueldmq | henrynash, keystone is configurable, and in one of its possible configs (the one showed in the tests) it allows you to create a domain but do not use it ... | 13:32 |
| samueldmq | henrynash, this is independent of the fact of someone really using it | 13:33 |
| samueldmq | henrynash, if someone does, he/she will hit the bug | 13:33 |
| henrynash | samueldmq: well, they will find tehy can’t use it…it is still being onboarded | 13:34 |
| henrynash | samuedlmq: that is not an unsual situation | 13:34 |
| samueldmq | henrynash, so you create, everything is ok so far | 13:35 |
| samueldmq | henrynash, until the moment you try to use it | 13:35 |
| *** MaikZ has joined #openstack-keystone | 13:35 | |
| henrynash | samuedlmq: you need to think about this as to in reality how it would be used in practive | 13:35 |
| henrynash | samueldmq: onboarding a customer into a domain will be a multi step process, maybe even carried out by different people | 13:36 |
| MaikZ | Hi, I'm having an issue with Keystone where even though multiple processes are running, only one is handling requests. I'm guessing it's unintentionally blocking on a shared resource - any ideas? | 13:37 |
| *** gordc has joined #openstack-keystone | 13:37 | |
| samueldmq | henrynash, yes .. that's not something that affect final users .. but cloud admins instead, I agree | 13:37 |
| henrynash | samueldmq: you’ll create the domain, set up teh configs, try some tests to see if teh ldap connect s working, finally ad a user or two etc. | 13:37 |
| henrynash | samueldmq: so I, personally, don’t see it as an issue that you can’t use the domain untill you have set up a config that allows it to be used (if you’re environment is one that restricts things in that way) | 13:38 |
| samueldmq | henrynash, hmm... I think I got your point | 13:39 |
| samueldmq | henrynash, I have a cloud running with domain specific backends | 13:39 |
| samueldmq | henrynash, I want to add a new domain and use the config file (today) | 13:40 |
| henrynash | ok | 13:40 |
| samueldmq | henrynash, you may want to i) create the domain and then ii) add the file, before reloading backends | 13:40 |
| henrynash | that’s exactly waht you haev to do | 13:40 |
| samueldmq | 'you can’t use the domain *untill* you have set up a config that allows it to be used' | 13:40 |
| henrynash | correct | 13:41 |
| samueldmq | henrynash, but why not the reverse, i) first you add the config file defining how that domain will be connected and then ii) since you have everything that is necessary, create the domain | 13:41 |
| samueldmq | i) is what is you are saying, ii) is me | 13:41 |
| samueldmq | oops, no, i and ii are me | 13:42 |
| samueldmq | mine is the reverse of yours, is it clear? (sorry) | 13:42 |
| henrynash | so when you restart the backends, it will read teh file and say “Hmm I foudn a domain config file called ‘My New Domain”….what do I do withthat…there is no domain of that name" | 13:42 |
| samueldmq | so, when you find configs, you create domains for them | 13:43 |
| samueldmq | doesnt require the admin to go there and create the domain .. | 13:44 |
| henrynash | no, but you check teh domains are valid….and if you find one taht is not, you ignore it | 13:44 |
| henrynash | ignore the file that is | 13:44 |
| samueldmq | so the admin has to both i) setup files and ii) create domains that match manually? | 13:46 |
| henrynash | you could, change the meaning of a file, to imply creating the domain if it doesn’t exist….but you are also missing some data (e.g. description, and soon parent_id) | 13:46 |
| henrynash | samueldmq: yes…which is why I am implementing the domain configs in a a database.... | 13:46 |
| samueldmq | henrynash, yes that makes it easier to do o nthe fly | 13:47 |
| henrynash | samueldmq: which isn’t designed to make teh gap between domain creation and config creation zero…just make it all REST | 13:47 |
| samueldmq | yes I understand ... | 13:48 |
| *** nellysmitt has quit IRC | 13:48 | |
| samueldmq | I defend that the gap exists when you have the file but not the domain ... | 13:48 |
| *** nellysmitt has joined #openstack-keystone | 13:49 | |
| samueldmq | but not when you have the domain and not the file, this should be avoided | 13:49 |
| breton | MaikZ: how do you deploy Keystone? Got any logs? | 13:49 |
| samueldmq | henrynash, I'll think about it a little bit more ... and we can possibly have someone else view :) | 13:51 |
| henrynash | samueldmq: sure... | 13:51 |
| samueldmq | henrynash, nice thanks | 13:51 |
| henrynash | samueldmq: yw | 13:51 |
| MaikZ | breton: Both keystone-all and uwsgi, that was the point of my experiment. Interestingly, they have the same issue. | 13:51 |
| MaikZ | uwsgi version is running now | 13:52 |
| *** nellysmitt has quit IRC | 13:53 | |
| *** bknudson has joined #openstack-keystone | 13:53 | |
| *** ChanServ sets mode: +v bknudson | 13:53 | |
| breton | MaikZ: interesting. How may processes? Which version of Keystone? | 13:54 |
| MaikZ | Juno, four to start with (probably something like 40 when/if it works) | 13:54 |
| breton | also, what makes you think that only one process is handling the request? | 13:56 |
| MaikZ | CPU usage - of the 4 (uwsgi) or 16 (eventlet) Keystone processes, one is stuck at 98-point something %, the rest at 0% | 13:57 |
| MaikZ | Requests are being generated by jmeter, v3 token create | 13:58 |
| MaikZ | What the...I'm not sure what change did it, but the uwsgi version is now spreading load as expected | 14:04 |
| *** abhirc_ has joined #openstack-keystone | 14:09 | |
| *** abhirc has quit IRC | 14:11 | |
| *** abhirc_ has quit IRC | 14:11 | |
| *** jdennis has quit IRC | 14:12 | |
| *** richm has joined #openstack-keystone | 14:12 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 14:14 |
| *** dims has quit IRC | 14:17 | |
| *** dims has joined #openstack-keystone | 14:17 | |
| *** nkinder has quit IRC | 14:18 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 14:20 |
| *** markvoelker has joined #openstack-keystone | 14:21 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 14:21 |
| *** henrynash has quit IRC | 14:23 | |
| *** markvoelker has quit IRC | 14:26 | |
| *** mattfarina has joined #openstack-keystone | 14:30 | |
| *** jdennis has joined #openstack-keystone | 14:31 | |
| *** radez_g0n3 is now known as radez | 14:32 | |
| *** joesavak has joined #openstack-keystone | 14:32 | |
| *** bknudson has quit IRC | 14:33 | |
| *** bknudson has joined #openstack-keystone | 14:37 | |
| *** ChanServ sets mode: +v bknudson | 14:37 | |
| breton | morganfainberg: it seems that there was no migration squashing between I and J | 14:38 |
| *** jdennis has quit IRC | 14:41 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Make the default cache time more explicit in code https://review.openstack.org/113586 | 14:43 |
| *** david-lyle_afk is now known as david-lyle | 14:48 | |
| *** jdennis has joined #openstack-keystone | 14:49 | |
| *** jdennis has quit IRC | 14:49 | |
| *** jdennis has joined #openstack-keystone | 14:49 | |
| *** csoukup has joined #openstack-keystone | 14:52 | |
| *** markvoelker has joined #openstack-keystone | 14:52 | |
| *** markvoelker has quit IRC | 14:53 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 14:54 |
| *** henrynash has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v henrynash | 15:02 | |
| openstackgerrit | Merged openstack/keystone: Remove explicit mentions of JSON from test_v2 https://review.openstack.org/158917 | 15:04 |
| amakarov | bknudson, greetings! Looks like I've managed to rearrange server code to class hierarchy with minimal changes but changes looks too heavy for a 1-line patch. | 15:08 |
| *** openstackgerrit has quit IRC | 15:08 | |
| *** openstackgerrit has joined #openstack-keystone | 15:08 | |
| amakarov | s/looks/look/ | 15:08 |
| bknudson | 1-line patch? | 15:08 |
| *** nkinder has joined #openstack-keystone | 15:08 | |
| amakarov | bknudson, Initially it was so :) | 15:09 |
| bknudson | it was moving code around before and creating duplication. | 15:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 15:11 |
| amakarov | bknudson, agreed though the idea was just to swap setup order | 15:13 |
| bknudson | amakarov: the change to pass in a function ref instead seems simple enough. | 15:13 |
| bknudson | amakarov: or make the change to refactor to the classes first and then make the fix for the bug in a separate patch. | 15:14 |
| amakarov | bknudson, I like the second option | 15:15 |
| amakarov | so WIP now | 15:15 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:24 | |
| dstanek | amakarov: bknudson: what's the plan for that one? | 15:30 |
| amakarov | dstanek, there are 2 goals actually: 1) fix a bug when logging system uses generic locks under eventlet; 2) make it look nice and sexy | 15:32 |
| dstanek | i just don't want to spend too much effort on this if eventlet is going away soon anyway | 15:33 |
| bknudson | in 6 months. | 15:33 |
| amakarov | dstanek, the first idea bknudson told me was to pass additional function to be called at a specific point in the code | 15:34 |
| dstanek | amakarov: cool, i'd like to see how that looks | 15:36 |
| * amakarov with tears in the eyes tosses his beautiful code to /dev /null | 15:39 | |
| bknudson | amakarov: you can post the code to refactor separately and dry your tears. | 15:40 |
| amakarov | bknudson, cool :) | 15:40 |
| dstanek | amakarov: out of curiosity, was that code working? it looked like it was using variables that were never defined | 15:40 |
| bknudson | we need unit tests for that code... it was in keystone-all before so there was no way to test. | 15:41 |
| amakarov | dstanek, just loose end here and there | 15:41 |
| amakarov | s/end/ends/ | 15:41 |
| dstanek | amakarov: so the server actually started OK? | 15:42 |
| amakarov | dstanek, that in CR? No. Fixed locally. | 15:42 |
| dstanek | ah, ok | 15:42 |
| *** rushiagr is now known as rushiagr_away | 15:46 | |
| *** abhirc has joined #openstack-keystone | 15:48 | |
| rodrigods | morganfainberg, ping re: prevent use slash in project name patch (https://review.openstack.org/#/c/157152/), we have commented adding a possible workaround for the problem we were trying to solve | 15:49 |
| *** nellysmitt has joined #openstack-keystone | 15:49 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 15:51 |
| amakarov | dstanek, ^^ | 15:51 |
| *** nicodemos has joined #openstack-keystone | 15:53 | |
| amakarov | bknudson, thanks ) | 15:53 |
| *** stevemar has joined #openstack-keystone | 15:54 | |
| *** ChanServ sets mode: +v stevemar | 15:54 | |
| *** nellysmitt has quit IRC | 15:54 | |
| rodrigods | ayoung, can you also take a look in https://review.openstack.org/#/c/157152/ ? We are discussing how can we avoid name clashing during domain table -> project table migration and how can we can properly scope tokens to a target after this change | 15:55 |
| ayoung | rodrigods, looking | 15:56 |
| *** MasterPiece has joined #openstack-keystone | 15:56 | |
| *** ayoung is now known as ayoung-mtg | 15:56 | |
| ayoung-mtg | rodrigods, ask me again in about 40 minutes | 15:57 |
| rodrigods | ayoung-mtg, ok, thanks :) | 15:57 |
| dstanek | rodrigods: who will be using the / to request the token? the end user? | 16:01 |
| raildo | dstanek, yes | 16:02 |
| raildo | in the token request, using the API | 16:03 |
| dstanek | so they need to know the full hierarchy? | 16:03 |
| rodrigods | dstanek, with the discarded solution yes | 16:04 |
| rodrigods | but with the one we just proposed, no | 16:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:05 |
| dstanek | rodrigods: so do you still need to prevent / in the project name? | 16:05 |
| *** henrynash has quit IRC | 16:06 | |
| raildo | dstanek, no, We will dont need anymore use the /. The end user will use the name, not the full hierarchy name | 16:06 |
| raildo | dstanek, we want create a new API call for project scoped token request for is_domain_projects | 16:08 |
| dstanek | ah, ok. i didn't know if i should look at that review or not | 16:09 |
| rodrigods | dstanek, the code no, but we commented there with a solution for the problem | 16:12 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Refactor Keystone wsgi/eventlet app https://review.openstack.org/159172 | 16:14 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Refactor Keystone wsgi/eventlet app https://review.openstack.org/159172 | 16:24 |
| *** lhcheng has joined #openstack-keystone | 16:26 | |
| *** rwsu-afk has quit IRC | 16:31 | |
| *** rushiagr_away is now known as rushiagr | 16:33 | |
| *** openstackstatus has joined #openstack-keystone | 16:42 | |
| *** ChanServ sets mode: +v openstackstatus | 16:42 | |
| *** rwsu has joined #openstack-keystone | 16:52 | |
| morganfainberg | rodrigods: but today we support domain scoped tokens. How do you handle the domain scoped request? | 17:01 |
| rodrigods | morganfainberg, in the same way we do today? are you seeing any gaps in the solution? | 17:03 |
| morganfainberg | breton: the squash is a 2-cycle support. In j we supported h -> j. This cycle we need to support I -> K, next cycle will be J -> L | 17:04 |
| morganfainberg | rodrigods: it looks like you said we would restrict this to project scoped tokens only for is_domain projects. | 17:04 |
| morganfainberg | Am I misreading that? | 17:04 |
| rodrigods | morganfainberg, hmm I tried to say that for is_domain projects, we would get the token by specifying only the scope and the domain (no need to specify the project itself, since the domain is the project) | 17:05 |
| morganfainberg | rodrigods: ah so I am misreading it. No worries | 17:05 |
| rodrigods | morganfainberg, if we specify the project, means that we do not want tokens from is_domain projects | 17:05 |
| morganfainberg | Oh. | 17:06 |
| rodrigods | raildo, ^ | 17:06 |
| *** markvoelker has joined #openstack-keystone | 17:07 | |
| morganfainberg | Hmm. But that doesn't solve the "how do I get a token using a domain name" issue. How do I reference a domain named X in the hierarchy somewhere. Domain names are not unique except within a hierarchy / namespace | 17:08 |
| *** amakarov is now known as amakarov_away | 17:09 | |
| morganfainberg | Having not been picky/limiting in the past here is really biting us. | 17:09 |
| *** _cjones_ has joined #openstack-keystone | 17:09 | |
| rodrigods | morganfainberg, true :( | 17:10 |
| rodrigods | haven't thought about this gap | 17:10 |
| morganfainberg | So... I *think* we solve this in an not-as-good way. But it'll work. And I hate recommending this. | 17:12 |
| raildo | morganfainberg, we can forbid create a subdomain with the same name of other domain in the hierarchy? | 17:12 |
| rodrigods | morganfainberg, one option is to limit domain naming... | 17:12 |
| rodrigods | :) | 17:12 |
| morganfainberg | That is one option. But you still can't know how to reference a domain deep in the hierarchy since there is no delimiter that is restricted | 17:13 |
| rodrigods | morganfainberg, why not? | 17:14 |
| rodrigods | morganfainberg, if names are unique... | 17:14 |
| rodrigods | and we can't turn a project into a domain.. | 17:14 |
| morganfainberg | But domains x could be in 5 hierarchies. | 17:14 |
| morganfainberg | Which one do you want? | 17:14 |
| rodrigods | I meant unique across the whole cloud | 17:14 |
| rodrigods | like we have today | 17:15 |
| morganfainberg | That is what we have today. Yes | 17:15 |
| morganfainberg | ok | 17:15 |
| *** ljfisher has quit IRC | 17:15 | |
| morganfainberg | so i hate to come to this conclusion but... | 17:16 |
| morganfainberg | i think there are 3 ways to do this | 17:16 |
| morganfainberg | 1: what you just said, domains are unique globally | 17:16 |
| morganfainberg | 2: we pre-calculate the hierarchy key for the domains, when you create the domain the name key is pre-calculated in a way we can do some sort of speedy lookup-y thing. | 17:18 |
| morganfainberg | this also precludes starting a hierarchy in a specific location w/o knowing the parents | 17:19 |
| morganfainberg | i can't ask for domain HP to be the top unless it is globally unique, it is a top level, or i include <full_hierarchy>.HP | 17:20 |
| rodrigods | morganfainberg, got it | 17:20 |
| morganfainberg | 3: we look for a way to leave the hierarchy for domains in the domain table | 17:20 |
| morganfainberg | 3 doesn't solve the issues in the other options | 17:21 |
| morganfainberg | but it does isolate the problems some. | 17:21 |
| morganfainberg | i don't like any of these options | 17:22 |
| *** jamielennox is now known as jamielennox|away | 17:22 | |
| rodrigods | I liked the second one | 17:22 |
| *** jistr has quit IRC | 17:22 | |
| rodrigods | or, it was the one I disliked less | 17:23 |
| morganfainberg | haha fair enough | 17:23 |
| samueldmq | morganfainberg, the first one .... does it have any ux problem? | 17:23 |
| raildo | If we find some clash name in the migration, we need to update the project name to <domain_name>.project_name, too? | 17:24 |
| *** nellysmitt has joined #openstack-keystone | 17:24 | |
| morganfainberg | samueldmq, no - not really. it has the limitation that i can never name a domain "pepsi" if someone else in the cloud has a domain named "pepsi" | 17:24 |
| morganfainberg | raildo, it would be a lookup-key only not a rename. | 17:24 |
| samueldmq | morganfainberg, well, I would go for that option, keep it consistent with we have today, and simpler | 17:25 |
| samueldmq | that's what I think... | 17:25 |
| morganfainberg | the best option is likely to keep domains globally unique for now | 17:25 |
| morganfainberg | it is easier to find a solution to that problem than to undo another change that turns out bad | 17:25 |
| samueldmq | morganfainberg, ++ | 17:25 |
| morganfainberg | and technically a reseller could just prefix domains with their name "resellerX.pepsi" | 17:26 |
| morganfainberg | or some other unique identifier. | 17:26 |
| rodrigods | morganfainberg, that's true | 17:26 |
| rodrigods | just afraid of some restriction that could bite us in the future again | 17:26 |
| morganfainberg | ok so lets *start* by keeping domains globally unique | 17:26 |
| morganfainberg | it isn't changing any restriction | 17:26 |
| morganfainberg | nor changing any workflows | 17:26 |
| raildo | ok | 17:26 |
| morganfainberg | we can tackle that issue in Liberty | 17:27 |
| raildo | I'll update the API spec about this too. | 17:27 |
| morganfainberg | raildo, thanks | 17:27 |
| morganfainberg | it should at the very least simplify some stuff | 17:27 |
| rodrigods | morganfainberg, so you agree to request project scoped tokens as we proposed | 17:27 |
| morganfainberg | rodrigods, let me re-read that | 17:27 |
| morganfainberg | i don't know about that part | 17:28 |
| rodrigods | morganfainberg, keeping domain names unique was a solution to have that solution heh | 17:28 |
| morganfainberg | rodrigods, right i was working through the options | 17:28 |
| morganfainberg | so you only get domain [dual scoped] tokens if you use the domain reference and ask for a project scoped token? | 17:29 |
| *** rwsu has quit IRC | 17:29 | |
| morganfainberg | rodrigods, that feels wierd | 17:29 |
| rodrigods | morganfainberg, true, was thinking to limit to project scoped token when project scope was requested | 17:29 |
| morganfainberg | this might also be a case where we just keep domain scopes isolated and don't do the dual scope thing | 17:30 |
| rodrigods | morganfainberg, and dual scoped when requested with domain scope | 17:30 |
| morganfainberg | and also punt the dual scope thing to liberty when we solve the domain doesn't need to be unique | 17:30 |
| *** jamielennox|away is now known as jamielennox | 17:30 | |
| morganfainberg | i don't think that is a big issue tbh | 17:30 |
| morganfainberg | you will always be using a unique name if you use domain name | 17:31 |
| morganfainberg | so you can always issue dualscope if the resource is_domain | 17:31 |
| morganfainberg | even if only project was asked for | 17:31 |
| rodrigods | morganfainberg, yes... | 17:31 |
| raildo | morganfainberg, sure | 17:31 |
| morganfainberg | so either: 1) domains are only domains - no dual project scope ever | 17:31 |
| morganfainberg | or 2) always issue dual scope if resource is_domain | 17:31 |
| raildo | 2 | 17:32 |
| rodrigods | morganfainberg, I'd go for the second | 17:32 |
| morganfainberg | i don't feel strongly either direction | 17:32 |
| morganfainberg | both work for me, 1 is what we have today, 2 is generally waht we proposed | 17:32 |
| morganfainberg | at the summit | 17:32 |
| morganfainberg | both work. | 17:32 |
| raildo | the first is more simple, but the second is more usual... | 17:32 |
| rodrigods | second is harder to implement though | 17:32 |
| morganfainberg | you can always implement the first without changing anything and then we can add the dual scope as an addon | 17:33 |
| morganfainberg | get the whole project/domain hierarchy working then issue the dual scope | 17:33 |
| rodrigods | morganfainberg, ++ | 17:33 |
| morganfainberg | its the same amount of work, and you've solved all the issues with identifing a resource as _is_domain | 17:34 |
| rodrigods | thanks morganfainberg, seems like we have a solution | 17:34 |
| *** rwsu has joined #openstack-keystone | 17:34 | |
| morganfainberg | but just makes it so can initially return a "this is not a project" error, so you can be more confident about the impoementation. | 17:34 |
| rodrigods | and a "roadmap" | 17:34 |
| morganfainberg | and we can continue a number of enhancements/loosening of restrictions in the Liberty release | 17:35 |
| morganfainberg | the goal is always to get a base implementation that you're happy with and build upon it | 17:35 |
| rodrigods | morganfainberg, btw, keeping domain names unique was samueldmq idea | 17:36 |
| morganfainberg | sure | 17:36 |
| morganfainberg | :) | 17:36 |
| morganfainberg | thanks for keeping on this stuff rodrigods, samueldmq, and raildo | 17:36 |
| morganfainberg | let me know when you've udpated that review so i can un -2 it | 17:37 |
| raildo | morganfainberg, np :) let's go finish this | 17:37 |
| *** gyee has joined #openstack-keystone | 17:38 | |
| *** ChanServ sets mode: +v gyee | 17:38 | |
| crinkle | stevemar: openstackclient seems to be spitting out warnings in stderr, even when --quiet is used - http://paste.fedoraproject.org/190277/24870892/ | 17:41 |
| crinkle | is there a way to make it not do that? | 17:41 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 17:42 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 17:42 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 17:43 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 17:43 |
| morganfainberg | dstanek, i'm going to move functional testing target to kilo post k3, it's all test restructureing so i'm ok with it landing post FF. | 17:48 |
| morganfainberg | dstanek, it can always land earlier | 17:48 |
| *** EmilienM is now known as EmilienM|afk | 17:49 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove unused tmp directory in tests https://review.openstack.org/159207 | 17:49 |
| *** karimb has quit IRC | 17:51 | |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/145317/ i just left a comment in-line | 17:53 |
| morganfainberg | lbragstad, but in short, make the actual provider (not the provider manager) aware of if it needs persistence | 17:53 |
| morganfainberg | lbragstad, you're still locking klwt provider as the *only* provider that could skip persistence with the recent change | 17:53 |
| morganfainberg | lbragstad, don't do string checks ask the actual provider driver if it needs persistence - that way we could convert PKI over to it as well if we wanted. | 17:54 |
| *** fmarco76 has left #openstack-keystone | 17:54 | |
| *** fmarco76 has joined #openstack-keystone | 17:55 | |
| *** nkinder has quit IRC | 17:56 | |
| *** fmarco76 has left #openstack-keystone | 17:56 | |
| raildo | morganfainberg, so, now that we agreed with this solution, we don't need migrate the assignments types: USER_DOMAIN and GROUP_DOMAIN, right? Since we don't have dual scoped token anymore. | 17:58 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove deprecated methods and functions in token subsystem https://review.openstack.org/151381 | 17:59 |
| *** jamielennox is now known as jamielennox|away | 18:02 | |
| morganfainberg | raildo, i think not initially | 18:10 |
| morganfainberg | raildo when you do enable the dual scope you will | 18:11 |
| *** himangi has joined #openstack-keystone | 18:15 | |
| *** _cjones_ has quit IRC | 18:15 | |
| *** jamielennox|away is now known as jamielennox | 18:15 | |
| *** himangi has quit IRC | 18:16 | |
| *** himangi has joined #openstack-keystone | 18:16 | |
| *** himangi_ has joined #openstack-keystone | 18:16 | |
| *** himangi has quit IRC | 18:16 | |
| raildo | morganfainberg, ok, so we can move this migration for Liberty with dual scoped token. (just to know what we have to finish here) | 18:17 |
| morganfainberg | raildo, right. if we push the dual scope to liberty | 18:17 |
| morganfainberg | nothing saying it couldn't land in the next few days... but it doesn't have to happen for this spec | 18:17 |
| *** kallebe has joined #openstack-keystone | 18:18 | |
| *** pnavarro has joined #openstack-keystone | 18:18 | |
| *** david8hu has quit IRC | 18:18 | |
| raildo | morganfainberg, right. thanks :) | 18:19 |
| kallebe | Hello. Does anyone know if there is a way to get Keystone admin url port from keystoneclient in code? I know "keystone endpoint-list" shows it, but I could not find how to get it from code | 18:21 |
| kallebe | the default for the port is 35357, right? | 18:21 |
| *** ljfisher has joined #openstack-keystone | 18:22 | |
| kallebe | I was wondering if it from this method: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/endpoints.py#L65 but I don't know which value to give to "endpoint" | 18:25 |
| *** aix has quit IRC | 18:25 | |
| *** raildo has left #openstack-keystone | 18:26 | |
| *** raildo has joined #openstack-keystone | 18:26 | |
| *** _cjones_ has joined #openstack-keystone | 18:29 | |
| *** david8hu has joined #openstack-keystone | 18:31 | |
| *** MasterPiece has quit IRC | 18:33 | |
| *** MasterPiece has joined #openstack-keystone | 18:35 | |
| *** rushiagr is now known as rushiagr_away | 18:35 | |
| *** afazekas_ has quit IRC | 18:40 | |
| larsks | kallebe: If you have a keystone client object, you can call ksclient.service_catalog.get_endpoints(). | 18:42 |
| larsks | kallebe: that takes a service_type and endpoint_type parameter, where service_type can be something like 'compute' or 'identity' (the latter for keystone). | 18:42 |
| larsks | And endpoint_type can be somethig like 'adminurl' or 'publicurl' (I think). | 18:43 |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 [List has been cleaned up for K3 target] | K3 is next week. Prioritize reviews!" | 18:43 | |
| kallebe | larsks ok, thanks for the help. I was wondering if maybe the port could be changed in the future? Because there are some hard coded parts in other projects' clients using hard coded 35357 | 18:43 |
| kallebe | for example: https://github.com/openstack/python-cinderclient/blob/master/cinderclient/client.py#L373 | 18:43 |
| morganfainberg | lbragstad, dolphm, do you want me to address the comment in KLWT i had or can you, otherwise i think that is close [except the V2 bits] | 18:44 |
| lbragstad | morganfainberg: working on the V2 stuff now, I can address the comment | 18:44 |
| larsks | Well, you *could* change it, and clients that aren't using the service catalog are arguably broken. | 18:44 |
| morganfainberg | lbragstad, perfect i'll not step on what you're doing | 18:44 |
| larsks | But the port's not going to change unless *you* change it. | 18:44 |
| morganfainberg | lbragstad, catch the comment when you upload your next patch / or around then :) | 18:44 |
| morganfainberg | lbragstad, if there is anything else i can do let me know please. | 18:45 |
| lbragstad | morganfainberg: I should have another iteration up soon | 18:45 |
| morganfainberg | lbragstad, fantastic. will watch for it. | 18:45 |
| lbragstad | morganfainberg: jorge_munoz is working on a bunch of test cases for the revocation stuff, | 18:45 |
| morganfainberg | yay! | 18:46 |
| kallebe | larsks ok, I will certainly not change it :) I was just thinking about this. I will try to fix the hard coded 35357 parts | 18:46 |
| *** tqtran has joined #openstack-keystone | 18:46 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related tests https://review.openstack.org/158561 | 18:51 |
| *** pdesai has joined #openstack-keystone | 18:51 | |
| stevemar | bknudson, just for you big guy ^ | 18:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related tests https://review.openstack.org/158561 | 18:52 |
| *** nellysmitt has quit IRC | 18:53 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate Eventlet Deployment in favor of wsgi containers https://review.openstack.org/157495 | 18:57 |
| crinkle | we're having issues with openstackclient spitting out warnings even when --quiet is used, is there a flag to make it go away? http://paste.fedoraproject.org/190277/24870892/ | 19:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 19:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 19:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 19:15 |
| larsks | crinkle: If only the puppet modules would learn to separate stdout and stderr... | 19:16 |
| dtroyer | crinkle: those are coming from the nova lib directly, we'll have to explicitly turn it off for --quiet | 19:16 |
| lbragstad | morganfainberg: fixed ^ | 19:17 |
| crinkle | larsks: it would be nice if we could do it programmatically via the utility we're trying to use | 19:18 |
| crinkle | dtroyer: okay, thank you | 19:18 |
| larsks | crinkle: I thought there was some work at some point to move stuff to using the REST api directly? I haven't been following things for a while. | 19:18 |
| openstackgerrit | Merged openstack/keystone: Enable endpoint_policy, endpoint_filter and oauth by default https://review.openstack.org/153842 | 19:18 |
| crinkle | larsks: we were hoping using openstackclient would solve some of the problems without adding a lot of extra work to manage sessions and such | 19:20 |
| crinkle | plus it's the only thing that supports keystone v3 | 19:20 |
| crinkle | the api library we were planning to use doesn't | 19:20 |
| larsks | Ah, bummer. | 19:20 |
| gordc | stevemar: quickq, if i have project_id, is there an api to get the domain_id associated with it? | 19:24 |
| gordc | morganfainberg, bknudson: ^ | 19:26 |
| bknudson | gordc: should be able to get details for the project and it'll show the domain_id. | 19:26 |
| bknudson | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#projects-v3-projects | 19:27 |
| bknudson | not sure why domain_id is listed as an optional attribute? | 19:27 |
| gordc | bknudson: ah awesome. thanks! | 19:27 |
| bknudson | oh, it's optional on create | 19:27 |
| bknudson | the docs are ambiguous as to whether a client can expect it in the response. | 19:28 |
| gordc | bknudson: i see... but if i have v3 enabled and assuming i did link project to domain, it would be ethere. | 19:31 |
| bknudson | all projects are in a domain. | 19:31 |
| gordc | bknudson: awesome. thanks for confirmation... time to run away *fire alarm* | 19:33 |
| morganfainberg | gyee, re SP stuff in the catalog | 19:33 |
| gyee | k | 19:33 |
| morganfainberg | ok so you're good with how it is - doesn't need more generic? | 19:33 |
| morganfainberg | for other types of services for now? | 19:33 |
| gyee | that's fine | 19:34 |
| morganfainberg | we can expand it some [and probably more easily] so we have a non-OS service lcoation long term | 19:34 |
| morganfainberg | ok will approve that now. | 19:34 |
| gyee | go for it | 19:34 |
| morganfainberg | i think we're going to make it require ?service_providers though | 19:34 |
| morganfainberg | to not break things. | 19:34 |
| morganfainberg | then ksc can default to requesting that / new clients can always request | 19:35 |
| morganfainberg | same as ?nocatalog | 19:35 |
| gyee | oh, like an explicit request? | 19:35 |
| morganfainberg | cc marekd ^ | 19:35 |
| morganfainberg | to put it in the catalog | 19:35 |
| morganfainberg | today it'll break horizon >.< | 19:35 |
| gyee | I don't understand, how's that breaking horizon? | 19:35 |
| morganfainberg | because django_openstack_auth does a naive iteration | 19:35 |
| morganfainberg | that does direct key lookup in the dict | 19:35 |
| morganfainberg | for thing in catalog: for x in thing['endpoints'] | 19:35 |
| gyee | oh | 19:36 |
| morganfainberg | which goes boom if you don't have endpoints | 19:36 |
| gyee | how is django looking up sp url today? they are fetching the region right? | 19:37 |
| gyee | so either way, its new code for them | 19:37 |
| *** rlt_ has quit IRC | 19:38 | |
| morganfainberg | yeah | 19:40 |
| morganfainberg | so lets get DOA fixed and released quickly on that front if possible | 19:41 |
| morganfainberg | cc david-lyle - going to need to provide a fix to DOA shortly to land some code. | 19:41 |
| openstackgerrit | Merged openstack/keystone-specs: Drop unnecessary sections from federation docs https://review.openstack.org/156925 | 19:42 |
| morganfainberg | david-lyle, will ping you in a little bit on this front so we can just make sure the DOA stuff is more defensive. ideally i'd like to work to get a release out shortly if at all possible. | 19:42 |
| morganfainberg | david-lyle, so we can get global req updates as needed. | 19:42 |
| david-lyle | morganfainberg: sure | 19:42 |
| morganfainberg | david-lyle, but i need bowl-of-coffee before trying to get this done ;) | 19:43 |
| gyee | so DOA would have to maintain two dicts, one for catalog and the other for SP? | 19:43 |
| morganfainberg | gyee, no, DOA today just need to not explode. | 19:43 |
| gyee | 500 internal error :D | 19:43 |
| morganfainberg | we can figure out the right way to support this in horizon once we're not breaking people if they turn on K2K federation | 19:43 |
| morganfainberg | ;) | 19:43 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 19:44 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 19:44 |
| *** browne has joined #openstack-keystone | 19:46 | |
| stevemar | morganfainberg, i thought lhcheng had already provided fixes for DOA? | 19:48 |
| morganfainberg | stevemar, oh maybe | 19:48 |
| morganfainberg | cool if so | 19:48 |
| morganfainberg | i knew it was an issue | 19:48 |
| morganfainberg | but hadn't dug into it | 19:48 |
| stevemar | welp, guess not, might be just my imagination | 19:48 |
| gyee | happy thoughts :) | 19:49 |
| stevemar | yep | 19:50 |
| *** kallebe has left #openstack-keystone | 19:50 | |
| stevemar | bknudson, can you take another look at https://review.openstack.org/#/c/148624/ and the test cleanup patch? | 19:52 |
| stevemar | morganfainberg, ^ | 19:52 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related tests https://review.openstack.org/158561 | 19:54 |
| morganfainberg | stevemar, i un-starred lots of stuff and the high prio list looks more sane now | 19:54 |
| stevemar | \o/ | 19:54 |
| stevemar | morganfainberg, what else did you want done for the 'replace extensions' bp ? | 19:55 |
| morganfainberg | stevemar, i think we got the docs done, right? | 19:55 |
| stevemar | did you actually want to move the directories around? | 19:55 |
| morganfainberg | and uh.. the extensions are loaded by default, right? | 19:55 |
| stevemar | yes, and yes | 19:55 |
| morganfainberg | not this cycle | 19:55 |
| morganfainberg | or not for k3 | 19:55 |
| morganfainberg | more specifically | 19:56 |
| morganfainberg | god not for k3 ;) | 19:56 |
| stevemar | yeah, didn't think you wanted that done just yet :P | 19:56 |
| morganfainberg | i think we're pretty solid on the changes for now. i'd almost say we could close the BP and do further cleanup separately | 19:57 |
| gyee | where's the x509 stuff on that list? | 19:57 |
| morganfainberg | gyee, do we have x509 patches that aren't in merge-conflict? | 19:57 |
| lhcheng | morganfainberg, stevemar: I opened a bug yesterday to track fixing DOA to make it now blow-up. Haven't got the chance to work on it yet. | 19:57 |
| stevemar | morganfainberg, if we can get a few cores to actually +2 the 'use oslo.policy instead of incubator' patch, then i could bug dhellmann to tag a new release | 19:57 |
| gyee | morganfainberg, Sam's working on finishing up the unit tests today | 19:57 |
| morganfainberg | lhcheng, awesome let me know if you can get that done or want me to jump on it. | 19:57 |
| morganfainberg | stevemar, ++ | 19:57 |
| *** browne has quit IRC | 19:57 | |
| stevemar | lhcheng, i'll review it for ya | 19:57 |
| lhcheng | there is also a fix needed in horizon too, it is also doing some manual parsing of the service catalog :( | 19:57 |
| stevemar | booo | 19:58 |
| morganfainberg | lhcheng, ugh. | 19:58 |
| morganfainberg | lhcheng, UGHAHDFASDKAJDLSKFJ. :P | 19:58 |
| stevemar | but i think that's the only place? | 19:58 |
| *** browne has joined #openstack-keystone | 19:58 | |
| stevemar | morganfainberg, i'm going to mark the replace-extensions work as complete then | 19:58 |
| morganfainberg | stevemar, as long as we don't populate service_providers info if there are no SPs | 19:58 |
| morganfainberg | i think we should be safe to land the code w/o exploding people | 19:59 |
| stevemar | morganfainberg, that should be very easy to implement | 19:59 |
| morganfainberg | and we need to make sure we have filtering capabilities for SPs as well | 19:59 |
| morganfainberg | so we can limit who can get SAML for a given SP. | 19:59 |
| morganfainberg | but that should be built on the current stuff | 19:59 |
| *** ljfisher has quit IRC | 20:00 | |
| lhcheng | morganfainberg: when do you need the fix by? could simply test first if adding SP in the catalog would blow-up DOA. | 20:01 |
| *** atiwari has joined #openstack-keystone | 20:01 | |
| morganfainberg | lhcheng, as long as we don't blow up DOA unless k2k is turned on we're mostly ok | 20:01 |
| morganfainberg | but we do need it sooner vs later | 20:01 |
| morganfainberg | way sooner = way better ;) | 20:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 20:02 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 20:02 |
| lhcheng | morganfainberg, stevemar: looking at KSC, this should be fine right: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/service_catalog.py#L90 | 20:02 |
| morganfainberg | ksc should be fine | 20:02 |
| morganfainberg | it's doa that has the issue | 20:02 |
| lhcheng | look like invalid keys are handled well enough | 20:03 |
| morganfainberg | ksc is smart enough to know to skip things that doesn't make sense | 20:03 |
| lhcheng | ++ | 20:03 |
| *** browne has quit IRC | 20:03 | |
| *** browne has joined #openstack-keystone | 20:03 | |
| lhcheng | morganfainberg: okay, will take a look at DOA a bit. Just fighting some other issue atm. | 20:04 |
| morganfainberg | lhcheng, sure | 20:04 |
| morganfainberg | lhcheng, it should be adding a try/except in ~1 place like ksc does | 20:05 |
| morganfainberg | and then we're all happy | 20:05 |
| lhcheng | morganfainberg: going to check if I could just leverage the auth_plugin.get_endpoints () for endpoint lookup | 20:06 |
| morganfainberg | lhcheng, that'd be cool. | 20:06 |
| *** pdesai has quit IRC | 20:13 | |
| *** browne has quit IRC | 20:19 | |
| *** nkinder has joined #openstack-keystone | 20:19 | |
| *** browne has joined #openstack-keystone | 20:19 | |
| *** pdesai has joined #openstack-keystone | 20:20 | |
| stevemar | we need brave souls to look at marekd's work for direct user mapping -> https://review.openstack.org/#/c/154934 + dependent patches | 20:24 |
| stevemar | i've reviewed it about 4-5 times now | 20:25 |
| dstanek | stevemar: on it | 20:25 |
| stevemar | dstanek, thanks dave | 20:25 |
| stevemar | david* | 20:25 |
| stevemar | i had to go and throw in a real name, cmon stevemar you know better, stick to irc handles | 20:25 |
| dstanek | lol; fail | 20:26 |
| dstanek | stevemar: is there a spec or just the blueprint? | 20:26 |
| *** himangi_ has quit IRC | 20:28 | |
| gyee | dstanek, the browns got a new color, hot brown :) | 20:30 |
| stevemar | dstanek, there is http://specs.openstack.org/openstack/keystone-specs/specs/kilo/federated-direct-user-mapping.html | 20:31 |
| dstanek | gyee: it's been a big deal in the news here for a few weeks; "a secret uniform change to be announced soon" | 20:31 |
| dstanek | gyee: what a disappointment | 20:31 |
| gyee | pinkish brown? | 20:32 |
| dstanek | gyee: puke orange | 20:32 |
| bknudson | the whole team should go to rehab | 20:32 |
| stevemar | dstanek, the gist of it - the mapping engine should be able to handle a mapping where the user is locally authenticated | 20:32 |
| dstanek | stevemar: thx; I added a link to it in the bp | 20:32 |
| stevemar | bknudson, maybe just the fans? | 20:32 |
| stevemar | bknudson, the fans need out, it's a bad relationship | 20:33 |
| dstanek | stevemar: no, they are the reason to drink; without alcohol they would have nobody in the stadium | 20:33 |
| *** marzif_ has joined #openstack-keystone | 20:33 | |
| bknudson | hopefully johnny football will be allowed to be around alcohol when he gets out. | 20:33 |
| *** browne has quit IRC | 20:34 | |
| gyee | heh, I am sure he'll learn | 20:34 |
| *** browne has joined #openstack-keystone | 20:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP - add cadf notifications for oauth https://review.openstack.org/159045 | 20:38 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add documentation for key terms and basic authenticating https://review.openstack.org/152018 | 20:43 |
| stevemar | and not to sound like a broken record, but https://review.openstack.org/#/c/148624/ should be ready, (most of the comments around tests are addressed in a follow on patch) if we can get agreement on this one then we can release a new library \o/ | 20:47 |
| *** marzif_ has quit IRC | 20:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make RuleProcessor._UserType class public https://review.openstack.org/157711 | 20:53 |
| *** spandhe has joined #openstack-keystone | 20:55 | |
| *** MasterPiece has quit IRC | 20:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move UserAuthInfo to a separate file https://review.openstack.org/157717 | 20:55 |
| stevemar | dstanek, thanks for reviewing the patches dude :) | 20:56 |
| *** MasterPiece has joined #openstack-keystone | 20:57 | |
| *** atiwari has quit IRC | 20:58 | |
| dstanek | stevemar: np | 21:00 |
| dstanek | stevemar: i'm not 100% sure about the logic here: https://review.openstack.org/#/c/156308/12/keystone/auth/plugins/mapped.py | 21:01 |
| dstanek | ah, nm - i think i just answered my own question | 21:02 |
| *** karimb has joined #openstack-keystone | 21:02 | |
| *** 92AAALG4Y is now known as dank_ | 21:05 | |
| ayoung-mtg | I love this error: "TypeError: factory() takes at most 5 arguments (75 given)" | 21:06 |
| lbragstad | jorge_munoz: I'm pushing an iteration of the revocation patch, fixing some pep8 issues | 21:10 |
| stevemar | ayoung-mtg, that's a spectacular error | 21:10 |
| stevemar | dstanek, yeah theres a few things moving around there | 21:10 |
| lbragstad | jorge_munoz: just giving you a heads up since you'll have to pull again | 21:10 |
| jorge_munoz | lbragstad: ok, thanks for the heads up. | 21:11 |
| dstanek | ayoung-mtg: 75? what on earth are you doing? | 21:11 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Authenticate local users via federated workflow https://review.openstack.org/156308 | 21:12 |
| stevemar | dstanek, can you re +2 this one: https://review.openstack.org/#/c/157711/ i fixed up the commit message and it took the +2 away :( | 21:12 |
| stevemar | dstanek, awesome though, just the first patch in the chain needs to be fixed up | 21:13 |
| *** browne has quit IRC | 21:15 | |
| *** browne has joined #openstack-keystone | 21:16 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 21:16 |
| bknudson | when using the policy.v3cloudsample.json, what's the admin_domain_id supposed to be set to? is "default" a good idea? | 21:20 |
| gyee | bknudson, yes, for backward compat | 21:22 |
| bknudson | gyee: ok, thanks. | 21:22 |
| bknudson | also, found some docs: http://docs.openstack.org/developer/keystone/configuration.html#keystone-api-protection-with-role-based-access-control-rbac | 21:22 |
| *** ljfisher has joined #openstack-keystone | 21:24 | |
| gyee | that rule seem wrong, should be target.user.domain_id | 21:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 21:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 21:25 |
| lbragstad | jorge_munoz: you should be good to pull latest string of commits, ^ | 21:26 |
| bknudson | gyee: the policy file needs better unit tests if that rule is wrong. | 21:27 |
| gyee | yeah, we need more test coverage for both policy files | 21:27 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: Support read operations for templated catalogs https://review.openstack.org/158443 | 21:29 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes KVS catalog backend https://review.openstack.org/158442 | 21:29 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds an initial functional test https://review.openstack.org/158466 | 21:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: Support for running functional federation tests https://review.openstack.org/139137 | 21:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: enables bashate checking on dsvm code https://review.openstack.org/151309 | 21:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: adds a devstack plugin for running a pysaml2 IdP https://review.openstack.org/151310 | 21:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: adds a devstack plugin for setting up federation https://review.openstack.org/151311 | 21:35 |
| openstackgerrit | David Stanek proposed openstack/keystone: adds a tox target for functional tests https://review.openstack.org/150528 | 21:35 |
| *** markvoelker has quit IRC | 21:35 | |
| *** markvoelker has joined #openstack-keystone | 21:36 | |
| dstanek | too many reviews and not enough -1s | 21:37 |
| gyee | how many do you need? | 21:40 |
| *** markvoelker has quit IRC | 21:40 | |
| *** pnavarro has quit IRC | 21:41 | |
| *** markvoelker has joined #openstack-keystone | 21:42 | |
| dstanek | gyee: num_reviews * 2 | 21:42 |
| lbragstad | stevemar: this looks good to me and my comments were addressed. If you want, I can pull it down and address dstanek's comments? https://review.openstack.org/#/c/126180/17 | 21:47 |
| stevemar | lbragstad, sure | 21:49 |
| stevemar | lbragstad, gonna push it after that? i'm confused | 21:49 |
| lbragstad | stevemar: yeah, i was just going to fix the two comments dstanek and push back up for review, | 21:51 |
| lbragstad | stevemar: since it look close to being approved | 21:52 |
| stevemar | coolio to me lbragstad | 21:52 |
| *** radez is now known as radez_g0n3 | 21:53 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Keystone Lightweight Tokens (KLWT) https://review.openstack.org/145317 | 21:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use revocation events for lightweight tokens https://review.openstack.org/158414 | 21:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement KLWT for v2.0 tokens https://review.openstack.org/159229 | 21:54 |
| dstanek | lbragstad: nice - i have my +2 stamp ready to go! | 21:58 |
| lbragstad | dstanek: perfect! | 21:58 |
| *** jaosorior has quit IRC | 22:02 | |
| *** pnavarro has joined #openstack-keystone | 22:05 | |
| morganfainberg | woohoo | 22:08 |
| * morganfainberg finishes meeting and sees ^^ | 22:09 | |
| *** mattfarina has quit IRC | 22:10 | |
| *** pnavarro has quit IRC | 22:11 | |
| *** bknudson has quit IRC | 22:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Revamp the documentation surrounding notifications https://review.openstack.org/126180 | 22:16 |
| stevemar | lbragstad, thx | 22:17 |
| *** stevemar has quit IRC | 22:27 | |
| lbragstad | :q | 22:28 |
| lbragstad | ... sorry wrong window | 22:29 |
| morganfainberg | :wq! | 22:29 |
| rodrigods | :qa! | 22:29 |
| dstanek | i once knew a guy that send ":q!" to his boss as a resignation warning and followed it up with a letter in email | 22:30 |
| dstanek | classy | 22:30 |
| lbragstad | lol | 22:31 |
| rodrigods | haha lol | 22:31 |
| gyee | nice | 22:31 |
| gyee | my favor email title "OOO forever" | 22:31 |
| *** browne has quit IRC | 22:31 | |
| *** browne has joined #openstack-keystone | 22:32 | |
| *** csoukup has quit IRC | 22:35 | |
| *** karimb has quit IRC | 22:45 | |
| *** jorge_munoz has quit IRC | 22:48 | |
| *** browne has quit IRC | 22:51 | |
| *** browne has joined #openstack-keystone | 22:52 | |
| mfisch | are there any things to worry about when switching from keystone.token.backends.sql.Token to keystone.token.persistence.backends.sql.Token? | 22:54 |
| mfisch | or is it a drop-in | 22:54 |
| morganfainberg | mfisch, the former is an alias to the latter | 22:54 |
| mfisch | so just the name is deprecated? | 22:54 |
| morganfainberg | yeah | 22:55 |
| morganfainberg | see: https://github.com/openstack/keystone/blob/stable/juno/keystone/token/backends/sql.py | 22:55 |
| morganfainberg | it's just not that interesting ;) | 22:56 |
| mfisch | why read code when there's Morgan AAS available on IRC! | 22:56 |
| mfisch | or is it MaaS | 22:56 |
| morganfainberg | no, not MaaS as that is an ubuntu thing | 22:56 |
| mfisch | FBaaS then | 22:56 |
| * morganfainberg is clearly not an ubuntu thing | 22:56 | |
| morganfainberg | or PTLaaS | 22:57 |
| morganfainberg | we might have a few of those throughout openstack | 22:57 |
| mfisch | ones that actually answer questions on IRC? | 22:57 |
| mfisch | its not * anyway | 22:57 |
| morganfainberg | well i think there is only one in this channel | 22:58 |
| morganfainberg | but there are a lot who answer questions in irc | 22:58 |
| morganfainberg | oh wait no there are at least 2 in this channel | 22:58 |
| mfisch | yeah most are good ;) | 22:59 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract revocations to file https://review.openstack.org/157279 | 23:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract IdentityServer into file https://review.openstack.org/157282 | 23:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Move UserAuthPlugin into its own file https://review.openstack.org/157283 | 23:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Break default auth plugin into file https://review.openstack.org/157280 | 23:02 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract all TokenCache related classes to file https://review.openstack.org/157281 | 23:02 |
| mfisch | I assume that was a rebase and not the most productive person of all time | 23:03 |
| *** diegows has joined #openstack-keystone | 23:06 | |
| breton | dstanek: I will -1 those patches tomorrow morning, if nobody +a them | 23:09 |
| *** browne has quit IRC | 23:09 | |
| dstanek | breton: which patches? | 23:09 |
| *** browne has joined #openstack-keystone | 23:09 | |
| *** gordc has quit IRC | 23:13 | |
| *** spandhe has quit IRC | 23:16 | |
| *** gyee has quit IRC | 23:20 | |
| *** joesavak has quit IRC | 23:26 | |
| *** browne has quit IRC | 23:27 | |
| *** browne has joined #openstack-keystone | 23:27 | |
| morganfainberg | lbragstad, dolphm, so far so good. KLWT seem to be working, restacking to make sure i have a clean environment | 23:29 |
| dolphm | morganfainberg: =) | 23:30 |
| morganfainberg | well besides that i saw it loading things from the keyfile(s) a bazillion times | 23:30 |
| morganfainberg | but that might have been an artifact of my previous stack | 23:31 |
| *** samueldmq_ has joined #openstack-keystone | 23:35 | |
| *** afazekas has quit IRC | 23:37 | |
| openstackgerrit | Merged openstack/keystone: Correct initialization order for logging to use eventlet locks https://review.openstack.org/154915 | 23:37 |
| *** markvoelker has quit IRC | 23:42 | |
| *** markvoelker has joined #openstack-keystone | 23:42 | |
| *** chlong has quit IRC | 23:43 | |
| *** chlong_ has quit IRC | 23:44 | |
| *** markvoelker has quit IRC | 23:47 | |
| *** chlong has joined #openstack-keystone | 23:48 | |
| *** markvoelker has joined #openstack-keystone | 23:49 | |
| *** bknudson has joined #openstack-keystone | 23:51 | |
| *** ChanServ sets mode: +v bknudson | 23:51 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add parent_id to test_project_model https://review.openstack.org/159294 | 23:56 |
| *** browne has quit IRC | 23:56 | |
| *** browne has joined #openstack-keystone | 23:57 | |
| *** gordc has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!