| bknudson | so if you're willing to carry the wrapper then all you need from us is the token prefixing in keystone... that's like a 20 line change. | 00:00 |
|---|---|---|
| *** henrynash has quit IRC | 00:00 | |
| notmyname | interesting. ok, thanks! | 00:01 |
| notmyname | bknudson: morganfainberg: thanks. I'll think on it and see what we come up with | 00:02 |
| bknudson | just don't use a prefix of MII | 00:04 |
| bknudson | or whatever the prefix is for fernet tokens now. | 00:04 |
| *** bknudson has quit IRC | 00:05 | |
| *** markvoelker has quit IRC | 00:07 | |
| *** markvoelker has joined #openstack-keystone | 00:08 | |
| *** markvoelker has quit IRC | 00:10 | |
| *** markvoelker_ has joined #openstack-keystone | 00:10 | |
| *** csoukup has quit IRC | 00:12 | |
| *** spandhe has quit IRC | 00:12 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:13 | |
| *** markvoelker_ has quit IRC | 00:13 | |
| *** browne has quit IRC | 00:15 | |
| *** spandhe has joined #openstack-keystone | 00:15 | |
| *** david-lyle is now known as david-lyle_afk | 00:16 | |
| *** _cjones_ has quit IRC | 00:17 | |
| *** raildo has joined #openstack-keystone | 00:20 | |
| *** abhirc has joined #openstack-keystone | 00:34 | |
| *** _cjones_ has joined #openstack-keystone | 00:37 | |
| *** spandhe has quit IRC | 00:37 | |
| *** abhirc has quit IRC | 00:40 | |
| *** diegows has quit IRC | 00:40 | |
| *** spandhe has joined #openstack-keystone | 00:43 | |
| notmyname | bknudson isn't here | 00:53 |
| notmyname | looks like for now, we're going for the "wrap auth token middleware" approach. seems fairly small in scope and works for many use cases | 00:54 |
| *** raildo has quit IRC | 00:55 | |
| *** nellysmitt has joined #openstack-keystone | 01:01 | |
| *** csoukup has joined #openstack-keystone | 01:04 | |
| *** nellysmitt has quit IRC | 01:06 | |
| *** davechen has joined #openstack-keystone | 01:08 | |
| *** spandhe has quit IRC | 01:11 | |
| *** abhirc has joined #openstack-keystone | 01:12 | |
| *** _cjones_ has quit IRC | 01:12 | |
| *** abhirc has quit IRC | 01:13 | |
| *** hichtakk has quit IRC | 01:13 | |
| *** hichtakk has joined #openstack-keystone | 01:13 | |
| *** diegows has joined #openstack-keystone | 01:13 | |
| *** _cjones_ has joined #openstack-keystone | 01:16 | |
| *** flashgordon is now known as jogo | 01:18 | |
| *** _cjones_ has quit IRC | 01:38 | |
| *** abhirc has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add in non-decorator notifiers https://review.openstack.org/158600 | 02:02 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Get initiator from manager and send to controller https://review.openstack.org/155660 | 02:02 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add CADF notifications for trusts https://review.openstack.org/151867 | 02:03 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: WIP - add cadf notifications for oauth https://review.openstack.org/159045 | 02:03 |
| *** stevemar has joined #openstack-keystone | 02:08 | |
| *** ChanServ sets mode: +v stevemar | 02:08 | |
| *** gyee has quit IRC | 02:09 | |
| stevemar | morganfainberg, yay for k3 coming up | 02:10 |
| morganfainberg | stevemar, =/ | 02:11 |
| morganfainberg | still a ton to land | 02:11 |
| stevemar | yup | 02:11 |
| morganfainberg | i honestly don't know if henry's thing or x509 will land | 02:11 |
| morganfainberg | just looking at issues with them | 02:11 |
| morganfainberg | and we still need to get the SP fix in | 02:12 |
| morganfainberg | stevemar, https://review.openstack.org/#/c/159922/ | 02:12 |
| morganfainberg | and honestly i am worried about reseller landing | 02:13 |
| stevemar | morganfainberg, yeah, reseller for sure | 02:15 |
| stevemar | and henrys thing | 02:15 |
| *** erkules_ has joined #openstack-keystone | 02:16 | |
| *** csoukup has quit IRC | 02:16 | |
| stevemar | the x509 one isn't too bad, it has benefited by being up earlier | 02:16 |
| morganfainberg | oh that one also just got all cleaned up | 02:16 |
| stevemar | the list performance improvements is just too much to review as well | 02:16 |
| morganfainberg | passing gate | 02:16 |
| morganfainberg | thats a plus | 02:17 |
| stevemar | \o/ | 02:17 |
| morganfainberg | erm check | 02:17 |
| stevemar | found a few nits | 02:17 |
| stevemar | on the spec one | 02:17 |
| morganfainberg | marek's? | 02:17 |
| morganfainberg | things that are worth blocking it? | 02:17 |
| *** erkules has quit IRC | 02:19 | |
| stevemar | morganfainberg, maybe? i wouldn't mind pushing a new patch of his and +2'ing it. But if you want to be faster, we can do a follow on patch | 02:19 |
| morganfainberg | i'd rather it land if it's nits | 02:20 |
| morganfainberg | nits should be cleanup after not justification to hold a patch up. | 02:20 |
| stevemar | morganfainberg, take a look @ the comments tell me if you think they are nits, i think so | 02:20 |
| morganfainberg | if it would hold the patch up, it's not a nit ;) | 02:20 |
| morganfainberg | SAML2 is a nit, the o.o is a nit | 02:22 |
| morganfainberg | the other one is probably not. | 02:22 |
| morganfainberg | oh wait | 02:22 |
| morganfainberg | yeah it probably is. | 02:22 |
| stevemar | yeah, they are, i can submit a follow on patch | 02:22 |
| morganfainberg | yeah lets do that | 02:22 |
| openstackgerrit | Merged openstack/keystone-specs: Add service_providers to the documentation https://review.openstack.org/159922 | 02:28 |
| morganfainberg | stevemar, if we land https://review.openstack.org/#/c/151381/ then we can close another bp out | 02:31 |
| morganfainberg | actually https://review.openstack.org/#/c/151381/ and the eventlet one. | 02:31 |
| morganfainberg | oh no nvm eventlet one doesn't apply here | 02:31 |
| morganfainberg | yeah just that one. | 02:32 |
| morganfainberg | also it's -150 lines ;) | 02:32 |
| morganfainberg | +0 | 02:32 |
| *** flaviof has quit IRC | 02:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Fix nits from 159922 https://review.openstack.org/160065 | 02:34 |
| morganfainberg | actually | 02:34 |
| morganfainberg | i tthink the 3rd nit was wrong there stevemar | 02:35 |
| morganfainberg | since the SP would reference *your* IDP | 02:35 |
| morganfainberg | which is ACME | 02:35 |
| morganfainberg | for the auth_url, right? | 02:35 |
| * morganfainberg 's brain sudeenly hurts. | 02:36 | |
| stevemar | morganfainberg, oh man, now my brain hurts... | 02:36 |
| morganfainberg | right? | 02:36 |
| stevemar | no, it's where you would send your saml assertion | 02:36 |
| stevemar | oh yeah | 02:36 |
| stevemar | you are right | 02:36 |
| morganfainberg | right but.. i | 02:36 |
| morganfainberg | yeah it's not.. ouch :( | 02:36 |
| * morganfainberg 's brain explodes | 02:36 | |
| stevemar | the "idp" is still the original dude, acme | 02:37 |
| morganfainberg | yeah | 02:37 |
| morganfainberg | though the ID could be beta | 02:37 |
| stevemar | (it's actually not acme, but whatever" | 02:37 |
| stevemar | yes | 02:37 |
| *** rwsu is now known as rwsu-afk | 02:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Fix nits from 159922 https://review.openstack.org/160065 | 02:38 |
| stevemar | ^ | 02:38 |
| morganfainberg | better | 02:38 |
| stevemar | that made more sense in my head | 02:38 |
| stevemar | the 'acme' & 'ACME' was a bad move | 02:39 |
| stevemar | looks like a few other things that need to be removed | 02:43 |
| *** alex_xu has quit IRC | 02:48 | |
| *** alex_xu has joined #openstack-keystone | 02:48 | |
| *** Akshik has joined #openstack-keystone | 02:49 | |
| *** alex_xu has quit IRC | 02:54 | |
| *** hichtakk has quit IRC | 02:54 | |
| stevemar | morganfainberg, i'm pushing a few more patches for removing deprecation stuff | 02:55 |
| morganfainberg | stevemar, oh we have more? i thought i caught them. | 02:55 |
| morganfainberg | yes please | 02:56 |
| stevemar | nah, 2 more | 02:56 |
| morganfainberg | cool. lets kill them | 02:56 |
| morganfainberg | burn it with fire :) | 02:56 |
| morganfainberg | no lingering deprecation junk | 02:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove KVS backend for revocation api https://review.openstack.org/160067 | 02:57 |
| stevemar | morganfainberg, ^ | 02:57 |
| morganfainberg | oh uhm | 02:58 |
| morganfainberg | i think we undeprecated that >.< or were supposed to | 02:58 |
| morganfainberg | i *think* | 02:58 |
| *** diegows has quit IRC | 02:59 | |
| *** richm has quit IRC | 03:00 | |
| stevemar | oh? | 03:00 |
| morganfainberg | yeah poke ayoung on that one | 03:02 |
| *** nellysmitt has joined #openstack-keystone | 03:02 | |
| morganfainberg | plz | 03:02 |
| stevemar | sure | 03:02 |
| stevemar | morganfainberg, what about the 'revoke_by_expiration' bit? | 03:02 |
| stevemar | - @versionutils.deprecated(as_of=versionutils.deprecated.JUNO, | 03:03 |
| stevemar | - remove_in=0) | 03:03 |
| stevemar | - def revoke_by_expiration(self, user_id, expires_at, | 03:03 |
| morganfainberg | remove_in=0 means never remove | 03:03 |
| stevemar | welp | 03:03 |
| stevemar | pfft | 03:03 |
| stevemar | FINE | 03:03 |
| stevemar | :P | 03:03 |
| morganfainberg | NO PADDING YOUR STATS THIS TIME *muahahahah*! | 03:04 |
| morganfainberg | ;) | 03:04 |
| *** alex_xu has joined #openstack-keystone | 03:04 | |
| *** alex_xu has quit IRC | 03:05 | |
| *** alex_xu has joined #openstack-keystone | 03:07 | |
| *** alex_xu has quit IRC | 03:07 | |
| *** nellysmitt has quit IRC | 03:07 | |
| *** tqtran_afk has quit IRC | 03:07 | |
| *** Akshik has quit IRC | 03:08 | |
| stevemar | but it was a legit patch :( | 03:09 |
| stevemar | i followed the comments in the code | 03:09 |
| stevemar | morganfainberg, btw - https://review.openstack.org/#/c/142573/ i think is ready | 03:09 |
| stevemar | marek addressed the comments i had made | 03:10 |
| stevemar | morganfainberg, err there is also https://review.openstack.org/#/c/159347/4 and it's follow on patches | 03:12 |
| morganfainberg | ok re-reading it again | 03:13 |
| morganfainberg | actually i need food. | 03:13 |
| morganfainberg | i'll re-read post füd | 03:13 |
| stevemar | sounds good | 03:14 |
| stevemar | i need to review other stuff and things | 03:14 |
| morganfainberg | great.. cinder bug is blocking things up looks like | 03:15 |
| morganfainberg | http://logs.openstack.org/17/145317/31/check/check-tempest-dsvm-neutron-full/aa35d56/console.html#_2015-02-28_03_09_29_562 | 03:15 |
| *** alex_xu has joined #openstack-keystone | 03:16 | |
| *** alex_xu has quit IRC | 03:17 | |
| *** alex_xu has joined #openstack-keystone | 03:21 | |
| *** alex_xu has quit IRC | 03:23 | |
| *** alex_xu has joined #openstack-keystone | 03:24 | |
| *** Krast has quit IRC | 03:44 | |
| stevemar | lhcheng is having some trouble with osc patches | 03:48 |
| lhcheng | stevemar: I got the change-Id switched on my two patches lol | 03:51 |
| lhcheng | stevemar: easy one for you: https://review.openstack.org/#/c/159207/ | 03:53 |
| stevemar | lhcheng, easy you say | 03:54 |
| stevemar | i thought i reviewed this one | 03:54 |
| lhcheng | 0 line change | 03:54 |
| stevemar | i *think* it's okay to review | 03:54 |
| stevemar | err to delete | 03:54 |
| lhcheng | this beats my old record of one-character change patch | 03:55 |
| stevemar | lhcheng, hmm actually | 03:56 |
| dolphm | there's a lot of references to tmp in tests | 03:57 |
| stevemar | yeah | 03:57 |
| stevemar | i am seeing that | 03:57 |
| stevemar | and .gitkeep marks it as 'don't delete me bro' | 03:57 |
| lhcheng | weird, how come the test passes | 03:57 |
| dolphm | because we have more than one now :) this is probably redundant | 03:58 |
| lhcheng | lol | 03:58 |
| dolphm | stevemar: ^ keystone/tests/unit/tmp/ | 03:59 |
| stevemar | yep | 03:59 |
| stevemar | dolphm, commented on it | 03:59 |
| stevemar | dolphm, qq for ya | 03:59 |
| dolphm | stevemar: yeah but then i kicked the gate | 03:59 |
| stevemar | whats the policy on mucking around with old migration scripts? https://review.openstack.org/#/c/159803/ | 04:00 |
| dolphm | stevemar: do you want to +2 or should i remove the +A? | 04:00 |
| stevemar | dolphm, ha | 04:01 |
| stevemar | i'll +2 | 04:01 |
| dolphm | stevemar: the preferred approach is to add a new migration because people would have already run the broken ones | 04:01 |
| stevemar | if it bites us in the ass, we can revert | 04:01 |
| dolphm | stevemar: unless a migration is truly broken | 04:01 |
| dolphm | stevemar: in this case, there's probably also a default we should be setting somewhere so the *new* (unwritten) migration wouldn't have any effect on new deploys | 04:02 |
| morganfainberg | stevemar: what dolphm said | 04:04 |
| morganfainberg | For cd environments "fixing" a migration might break them horribly. | 04:04 |
| morganfainberg | S/might/probably will. | 04:05 |
| morganfainberg | stevemar: fwiw, id -2 that as it sits. | 04:06 |
| dolphm | morganfainberg: i think that "fix" is fine though - we just need another migration to supplement | 04:06 |
| dolphm | morganfainberg: really? | 04:06 |
| morganfainberg | Without the follow up migration. | 04:06 |
| stevemar | -2 is the right call | 04:06 |
| dolphm | morganfainberg: as ayoung would say: necessary but not sufficient | 04:06 |
| stevemar | but he didn't know any better | 04:06 |
| stevemar | this patch needs eyes: -2 | 04:06 |
| stevemar | err | 04:06 |
| stevemar | https://review.openstack.org/#/c/152156/16 | 04:06 |
| morganfainberg | dolphm: and ++ for follow up migration landing at the same time. | 04:07 |
| stevemar | ugh it's not targeted | 04:07 |
| morganfainberg | Anyway. | 04:09 |
| morganfainberg | dolphm: I'd minus 2 if it had had a +2. Sorry wasn't clear. | 04:10 |
| morganfainberg | To make sure it got eyes. Since t has lots of -1 and no +2 it's fine. | 04:10 |
| * morganfainberg is looking forward to Friday of next week. | 04:13 | |
| morganfainberg | No more milestone3 hell. ;) | 04:14 |
| lhcheng | dolphm: I don't see the tmp directory in https://github.com/openstack/keystone/tree/master/keystone/tests/unit | 04:24 |
| lhcheng | but I do see it in my local | 04:24 |
| lhcheng | maybe it is created if it doesn't exists | 04:25 |
| stevemar | morganfainberg, ha, you think that'll make a difference | 04:31 |
| morganfainberg | Wait wut?! | 04:32 |
| stevemar | you think all those things are going to go in by friday?! | 04:32 |
| morganfainberg | No. | 04:32 |
| morganfainberg | But k3 will be cut by then. | 04:33 |
| morganfainberg | So, people will cry, but things will be fairly set for kilo. | 04:33 |
| morganfainberg | Also. I'm in NYC next week. So looking for a place. Maybe I'll have a move to the east coast day by then. | 04:34 |
| stevemar | morganfainberg, bump this guy to keystone-next? | 04:34 |
| stevemar | * morganfainberg is looking forward to Friday of next week. | 04:34 |
| stevemar | <morganfainberg> No more milestone3 hell. ;) | 04:34 |
| stevemar | <lhcheng> dolphm: I don't see the tmp directory in https://github.com/openstack/keystone/tree/master/keystone/tests/unit | 04:34 |
| stevemar | <lhcheng> but I do see it in my local | 04:34 |
| stevemar | <lhcheng> maybe it is created if it doesn't exists | 04:34 |
| stevemar | <stevemar> morganfainberg, ha, you think that'll make a difference | 04:34 |
| stevemar | <morganfainberg> Wait wut?! | 04:34 |
| stevemar | <stevemar> you think all those things are going to go in by friday?! | 04:34 |
| stevemar | <morganfainberg> No. | 04:34 |
| stevemar | <morganfainberg> But k3 will be cut by then. | 04:34 |
| stevemar | ffs | 04:34 |
| morganfainberg | stevemar: really? | 04:34 |
| stevemar | i am copy/paste/failing today | 04:34 |
| stevemar | sorry | 04:34 |
| morganfainberg | :P | 04:34 |
| stevemar | i meant, bump this guy? https://blueprints.launchpad.net/keystone/+spec/tests-on-rdbmses | 04:34 |
| morganfainberg | I'm two glasses of chianti in. | 04:35 |
| morganfainberg | Oh yeah kilo next. | 04:35 |
| morganfainberg | That's test things. It lands when it lands. | 04:35 |
| stevemar | just double checking | 04:35 |
| stevemar | morganfainberg, here for meeting on tuesday? | 04:37 |
| morganfainberg | Yep will be. | 04:37 |
| morganfainberg | Going to the board meeting in NYC while I'm there. | 04:37 |
| morganfainberg | But I expect to be around for our normal meeting things. | 04:38 |
| openstackgerrit | Merged openstack/keystone: Remove unused tmp directory in tests https://review.openstack.org/159207 | 04:52 |
| *** dimsum__ has quit IRC | 04:58 | |
| morganfainberg | stevemar: fwiw, Nutella, banana and strawberries on a pizza. If this is wrong, I don't want to be right. | 04:59 |
| *** hockeynut has quit IRC | 05:03 | |
| *** nellysmitt has joined #openstack-keystone | 05:03 | |
| *** hockeynut has joined #openstack-keystone | 05:06 | |
| *** nellysmitt has quit IRC | 05:08 | |
| stevemar | mordred, that is very wrong | 05:10 |
| morganfainberg | stevemar, no it's *very* right | 05:14 |
| morganfainberg | stevemar also mo<tab> fail ;) | 05:14 |
| stevemar | morganfainberg, oh yep | 05:20 |
| stevemar | totes | 05:20 |
| morganfainberg | i keep wondering if i should permanently move to "needscoffee" as my nick to solve this issue | 05:20 |
| stevemar | morganfainberg, theres another 'mor'<tab> too | 05:21 |
| stevemar | i suspect stevemar isn't any better | 05:21 |
| morganfainberg | yeah mor<tab> doesn't work either | 05:21 |
| morganfainberg | st<tab> works | 05:21 |
| morganfainberg | at least here | 05:21 |
| *** fifieldt_ has quit IRC | 05:23 | |
| *** stevemar has quit IRC | 05:42 | |
| *** tqtran_afk has joined #openstack-keystone | 05:56 | |
| *** dimsum__ has joined #openstack-keystone | 05:59 | |
| *** dimsum__ has quit IRC | 06:04 | |
| *** himangi has joined #openstack-keystone | 06:28 | |
| *** stevemar has joined #openstack-keystone | 06:58 | |
| *** ChanServ sets mode: +v stevemar | 06:58 | |
| *** nellysmitt has joined #openstack-keystone | 07:04 | |
| *** nellysmitt has quit IRC | 07:08 | |
| *** tqtran_afk has quit IRC | 07:23 | |
| *** himangi has quit IRC | 07:47 | |
| *** pnavarro_ has joined #openstack-keystone | 07:49 | |
| *** himangi has joined #openstack-keystone | 07:53 | |
| *** pnavarro_ has quit IRC | 08:08 | |
| *** nellysmitt has joined #openstack-keystone | 09:01 | |
| *** lhcheng_ has joined #openstack-keystone | 09:04 | |
| *** lhcheng_ has quit IRC | 09:06 | |
| *** lhcheng_ has joined #openstack-keystone | 09:07 | |
| *** lhcheng has quit IRC | 09:07 | |
| *** lhcheng_ has quit IRC | 09:12 | |
| *** stevemar has quit IRC | 09:18 | |
| *** davechen has quit IRC | 09:52 | |
| *** himangi has quit IRC | 09:57 | |
| *** nellysmitt has quit IRC | 10:15 | |
| *** henrynash has joined #openstack-keystone | 11:00 | |
| *** ChanServ sets mode: +v henrynash | 11:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement backend driver support for domain config https://review.openstack.org/158051 | 11:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 11:29 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 11:30 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 11:30 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 11:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 11:32 |
| *** henrynash has quit IRC | 11:36 | |
| *** henrynash has joined #openstack-keystone | 11:48 | |
| *** ChanServ sets mode: +v henrynash | 11:48 | |
| *** henrynash has quit IRC | 12:36 | |
| *** dimsum__ has joined #openstack-keystone | 13:16 | |
| *** jaosorior has quit IRC | 14:22 | |
| *** krtaylor has quit IRC | 14:41 | |
| *** krtaylor has joined #openstack-keystone | 14:53 | |
| *** pnavarro_ has joined #openstack-keystone | 15:03 | |
| mordred | if I'm applying roles to user/projects - is there _Any_ situation in which I'd have a different domain value for the user and the project? | 15:07 |
| mordred | I mean, I know that users and projects each have a domain | 15:07 |
| mordred | but for sanity, I should be able to assume for a transaction that they are the same, yeah? | 15:07 |
| *** david-lyle_afk has quit IRC | 15:20 | |
| *** david-lyle_afk has joined #openstack-keystone | 15:20 | |
| *** karimb has joined #openstack-keystone | 15:23 | |
| *** david-lyle_afk has quit IRC | 15:25 | |
| *** alex_xu has quit IRC | 15:35 | |
| *** alex_xu has joined #openstack-keystone | 15:36 | |
| *** fifieldt has joined #openstack-keystone | 15:39 | |
| *** alex_xu has quit IRC | 15:53 | |
| *** Akshik has joined #openstack-keystone | 15:57 | |
| *** joesavak has joined #openstack-keystone | 16:03 | |
| *** alex_xu has joined #openstack-keystone | 16:03 | |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| *** joesavak has quit IRC | 16:08 | |
| *** himangi has joined #openstack-keystone | 16:12 | |
| ayoung | Akshik, ask questions like that in here. I'm not really working this morning, but others can help you, too | 16:20 |
| ayoung | you posted http://chunk.io/f/a22345d8a4874839bf85812f95f4df90 | 16:21 |
| Akshik | ayoung, Thanks | 16:22 |
| ayoung | Akshik, But I don't see anything Keystone specific in there | 16:22 |
| ayoung | you are trying to do a Federated setup? Akshik | 16:23 |
| *** Akshik has quit IRC | 16:23 | |
| ayoung | testshib ... I assume that is the public test Shibboleth instance ? | 16:23 |
| * ayoung has left the shibbolth stuff to others | 16:23 | |
| *** Akshik has joined #openstack-keystone | 16:26 | |
| *** jsavak has quit IRC | 16:50 | |
| *** joesavak has joined #openstack-keystone | 17:18 | |
| *** karimb has quit IRC | 17:20 | |
| *** henrynash has joined #openstack-keystone | 17:30 | |
| *** ChanServ sets mode: +v henrynash | 17:30 | |
| *** fifieldt has quit IRC | 17:46 | |
| *** nellysmitt has joined #openstack-keystone | 17:53 | |
| *** nellysmitt has quit IRC | 17:54 | |
| *** nkinder has joined #openstack-keystone | 18:00 | |
| *** dimsum__ has quit IRC | 18:03 | |
| *** Akshik has quit IRC | 18:11 | |
| *** Akshik has joined #openstack-keystone | 18:11 | |
| *** Akshik has quit IRC | 18:12 | |
| *** samueldmq has joined #openstack-keystone | 18:24 | |
| *** jorge_munoz has joined #openstack-keystone | 18:33 | |
| *** pnavarro_ has quit IRC | 18:39 | |
| *** stevemar has joined #openstack-keystone | 18:43 | |
| *** ChanServ sets mode: +v stevemar | 18:43 | |
| *** lhcheng has joined #openstack-keystone | 18:46 | |
| *** lhcheng has quit IRC | 18:56 | |
| *** dimsum__ has joined #openstack-keystone | 19:04 | |
| *** ayoung has quit IRC | 19:07 | |
| *** dimsum__ has quit IRC | 19:08 | |
| *** jorge_munoz has quit IRC | 19:36 | |
| *** lhcheng has joined #openstack-keystone | 19:48 | |
| *** samueldmq has quit IRC | 19:54 | |
| *** himangi has quit IRC | 19:56 | |
| *** bknudson has joined #openstack-keystone | 20:05 | |
| *** ChanServ sets mode: +v bknudson | 20:05 | |
| *** tqtran_afk has joined #openstack-keystone | 20:19 | |
| *** stevemar has quit IRC | 20:27 | |
| *** lhcheng has quit IRC | 20:33 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 20:43 |
| *** lhcheng has joined #openstack-keystone | 20:44 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/160131 | 20:51 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 20:51 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 20:51 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 20:51 |
| *** lhcheng has quit IRC | 20:57 | |
| *** lhcheng has joined #openstack-keystone | 21:03 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use Model for access_info https://review.openstack.org/160134 | 21:10 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 21:10 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Test updates to prep for unified access info https://review.openstack.org/160133 | 21:10 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Access Info https://review.openstack.org/138519 | 21:10 |
| morganfainberg | mordred, users can be in one domain easily and projects in another | 21:11 |
| *** ayoung has joined #openstack-keystone | 21:11 | |
| *** ChanServ sets mode: +v ayoung | 21:11 | |
| morganfainberg | mordred, the assumption that a user belongs to the same domain as the project isn't a good one to make | 21:12 |
| bknudson | if you're using domains with different backends (e.g., ldap) then you probably have users in a different domain then projects | 21:12 |
| mordred | morganfainberg: I'm glad I asked | 21:17 |
| mordred | morganfainberg: it's possible that while I thought I understood these concepts, I do not, in fact, understand them | 21:18 |
| morganfainberg | mordred, the easiest way to think about is that domains are containers of things (users, groups, projects, domains) | 21:19 |
| mordred | that's how I was thinking of it | 21:19 |
| morganfainberg | mordred, assignments are a mapping of identity resources (users, groups) to (project, domains) | 21:19 |
| mordred | but if a domain is a container, then wouldn't the user and the project be contained within the domain? | 21:19 |
| morganfainberg | and that is as far as it is enforced. | 21:20 |
| mordred | and wait- what is a group? | 21:20 |
| morganfainberg | you can assign any role to any user on any project | 21:20 |
| morganfainberg | group is like LDAP group, a grouping of users | 21:20 |
| *** richm1 has joined #openstack-keystone | 21:20 | |
| mordred | so I have a group, a project and a domain | 21:20 |
| *** lhcheng has quit IRC | 21:20 | |
| mordred | what does a project actually model | 21:20 |
| mordred | like, what is the conceptual resource | 21:20 |
| bknudson | projects are used by nova, etc. | 21:21 |
| morganfainberg | project is what is utilized by other services (e.g. nova) to relate ownership of that services thing | 21:21 |
| morganfainberg | like a vm | 21:21 |
| bknudson | keystone doesn't really care about them. | 21:21 |
| mordred | gotcha | 21:21 |
| mordred | so a thing lives inside ofa project | 21:21 |
| mordred | and via roles, a user can be associated with one or more projects | 21:21 |
| morganfainberg | yep. | 21:21 |
| bknudson | let's forget about roles on domains. | 21:22 |
| morganfainberg | which is where the token scope comes in, your token is scoped to the project you're working on, how nova knows what project a VM you said "boot" goes into | 21:22 |
| *** richm1 has quit IRC | 21:22 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document mapping of policy action to operation https://review.openstack.org/155919 | 21:23 |
| *** richm1 has joined #openstack-keystone | 21:23 | |
| morganfainberg | or what project owns a glance image [for example] | 21:23 |
| mordred | morganfainberg: I don't suppose the domain value for operations defaults to the domain the user is auth'd to does it? | 21:23 |
| morganfainberg | domain operations are more of a keystone only thing | 21:24 |
| mordred | right - for keystone operations | 21:24 |
| morganfainberg | nope, still token scope | 21:24 |
| mordred | if I'm creating roles or assigning roles to user/project | 21:24 |
| morganfainberg | roles are global [today] | 21:24 |
| mordred | hang on | 21:24 |
| morganfainberg | so cloud admin is the only one who could create a role definition | 21:24 |
| mordred | I will have authed and received a token and part of that auth transaction will have been me specifying a domain and a project domain | 21:24 |
| mordred | morganfainberg: I don't actually care about what's finished implemented - I care about the intent design | 21:25 |
| mordred | because I'm trying to get some ansible modules right and I don't want their UI to change once I do | 21:25 |
| bknudson | you can get a token scoped to a domain or a project. | 21:25 |
| bknudson | if you scope a token to a project then the project is in a domain. | 21:25 |
| mordred | what i'm trying to figure out is whether I need to explicitly pass in a domain and a project domain for role operations, or if there will be a default value if I don't pass one in | 21:26 |
| bknudson | note that the user has a default project... so if no project is specified when getting a token it'll be scoped to that project. | 21:27 |
| morganfainberg | you would need to pass a scope that grants you cloud admin priviledges, | 21:27 |
| morganfainberg | s/pass/request | 21:27 |
| mordred | token=auth(user, password, project, domain, project_domain) | 21:27 |
| morganfainberg | usernames are unique only to their namespace, so when you auth with a username that username needs to have a domain to know how to look it up | 21:27 |
| *** tqtran_afk has quit IRC | 21:28 | |
| bknudson | should be like token=auth(user, user_domain password, (project, project_domain) or domain) | 21:28 |
| morganfainberg | bknudson, ++ | 21:28 |
| bknudson | you can get a token scoped to a project or a domain | 21:28 |
| mordred | ok. let me start over | 21:28 |
| mordred | because I believe I'm not asking this question right | 21:28 |
| mordred | if I did token=auth(user, user_domain, password, project, project_domain) | 21:29 |
| *** dimsum__ has joined #openstack-keystone | 21:29 | |
| mordred | then I do map_role(token, role, user, project) ... do I need to pass in a user domain and a project domain? | 21:30 |
| bknudson | that looks good... wouldn't allow for domain-scoped tokens though. | 21:30 |
| mordred | bknudson: the generality is still lost on me, so I'm walking through a couple of specific choices to grok the impact | 21:30 |
| morganfainberg | mordred, i belive you can only use user_ids and project_ids for role mapping | 21:31 |
| mordred | morganfainberg: assume that I'm doing the right thing with names and ids | 21:31 |
| morganfainberg | at the rest api level | 21:31 |
| mordred | I'm really just trying to understand the concept | 21:31 |
| morganfainberg | sure. | 21:31 |
| bknudson | right, note that if you're using user IDs and project IDs then no need to specify the domain. | 21:31 |
| mordred | because it's batshit-crazy-confusing | 21:31 |
| morganfainberg | mordred, yes it is :( | 21:31 |
| bknudson | IDs are unique whereas names are not (for projects and users) | 21:31 |
| mordred | bknudson: awesome - so this breaks it down to a more simple question then | 21:32 |
| bknudson | since names aren't unique you need to specify the domain. | 21:32 |
| mordred | if I did that token as before | 21:32 |
| mordred | if I did token=auth(user, user_domain, password, project, project_domain) | 21:32 |
| *** richm1 is now known as richm | 21:32 | |
| mordred | and then I did "keystone.projects.list()" | 21:32 |
| mordred | am I going to see the projects outside of the domain I auth'd to | 21:32 |
| bknudson | I believe GET /v3/projects gives you back all projects (since that's what you're requesting) | 21:33 |
| bknudson | there should be a GET /v3/project?domain_id=<id>... | 21:33 |
| mordred | ok. great. I believe that answers my question | 21:33 |
| mordred | the act of authenticating to a domain does not affect default visibility of a resource | 21:34 |
| *** dimsum__ has quit IRC | 21:35 | |
| bknudson | right, although I think it's possible to set the policy so that only the projects in your domain are returned.... not sure. It's not the default policy. | 21:35 |
| mordred | have I mentioned that I HATE the policy system? | 21:35 |
| bknudson | you're not the only one. | 21:35 |
| mordred | it makes answering any questions completely impossible | 21:35 |
| mordred | "how does this work?" - depends on the policy | 21:36 |
| mordred | *STAB* | 21:36 |
| morganfainberg | mordred, yep. | 21:36 |
| mordred | morganfainberg: I'm trying to write CRUD ansible modules for roles, projects and users | 21:37 |
| morganfainberg | bknudson, no asking what projects a user can see is a different request, not defined by policy | 21:37 |
| morganfainberg | bknudson, that is a ... role_Assignments api thing i think. | 21:37 |
| mordred | it is AMAZING how much I'm having to learn to do that | 21:37 |
| morganfainberg | bknudson, and it's a brutal query. | 21:37 |
| bknudson | oh, is that what was asked? you're trying to figure out what projects a user has a role in? | 21:37 |
| mordred | nope | 21:38 |
| morganfainberg | bknudson, no just was confirming that it was something else | 21:38 |
| mordred | I'm trying to figure out what information I need to require my users to pass in | 21:38 |
| morganfainberg | \that v3/projects always returns all projects | 21:38 |
| mordred | and what information can be inferred from other information | 21:38 |
| morganfainberg | if you have access to the API call | 21:38 |
| morganfainberg | you can always filter | 21:38 |
| mordred | which is especially hard, because I want to be able to throw input data validation errors | 21:38 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/controllers.py#n160 | 21:38 |
| bknudson | we've got this "filterprotected" wrapper.... | 21:39 |
| bknudson | what does that do? | 21:39 |
| mordred | but I can't, because apparently many things can't be known without just trying and seeing if it fails | 21:39 |
| morganfainberg | bknudson, applies policy and allows for explicit filtering | 21:39 |
| mordred | so, my user _might_ need to pass in a domain, or they might not | 21:39 |
| morganfainberg | mordred, this is the whole reason we started conversations on moving policy to less insane-ness | 21:39 |
| mordred | I have no way of giving them a hint | 21:39 |
| bknudson | always pass in the domain. | 21:39 |
| mordred | except v2 clouds | 21:39 |
| mordred | bknudson: users have no idea if they are v2 or v3 | 21:40 |
| mordred | and don't care | 21:40 |
| morganfainberg | mordred, you can tell if you're v2 from keystoneclient, that is versioning stuff | 21:40 |
| bknudson | are there clouds that only support v2? | 21:40 |
| mordred | so I can't make the domain param _required_ | 21:40 |
| mordred | YES!!!!!! | 21:40 |
| morganfainberg | bknudson, RAX i think. | 21:40 |
| bknudson | must be old. | 21:40 |
| morganfainberg | not keystone | 21:40 |
| mordred | also, I don't do anything with domains on HP | 21:41 |
| mordred | basically, I've never used domains in my life | 21:41 |
| mordred | in production | 21:41 |
| morganfainberg | yeah hp doesn't support v3 really either | 21:41 |
| mordred | because none of my clouds support them | 21:41 |
| mordred | so, I'd say | 21:41 |
| morganfainberg | well not publically.. | 21:41 |
| mordred | no clouds | 21:41 |
| bknudson | there is a default domain. | 21:41 |
| morganfainberg | it's weird. | 21:41 |
| mordred | meh | 21:41 |
| mordred | it's not a real thing | 21:41 |
| mordred | I don't use it | 21:41 |
| mordred | which means that the ansible modules MUST support that sanely | 21:41 |
| mordred | which means I cannot require a domain parameter | 21:41 |
| bknudson | if you're stuck with v2 then all users and projects are in the default domain. | 21:41 |
| mordred | however, if the user needs one and doesn't pass one in | 21:41 |
| mordred | then the error they are going to get when they search for a project may be that they get a matching project in another domain? | 21:42 |
| mordred | *sigh* | 21:42 |
| mordred | I'll figure it out | 21:42 |
| mordred | thank you - this has been very helpful | 21:42 |
| morganfainberg | mordred, sorry it just piles more insanity on | 21:42 |
| mordred | morganfainberg: my frustration level with opensatck's complete and utter lack of usability only grows with every passing second | 21:43 |
| bknudson | it might be handy to have the GET /v3/domains API return an indicator which one is the default. | 21:44 |
| bknudson | then clients would at least know what domain all v2 users are in. | 21:44 |
| morganfainberg | mordred, so - if you only had to deal with V3 and not V2, a lot of the insanity becomes more managable - i know it's not an answer, but it's why we're trying so hard to make v2 go away. | 21:44 |
| bknudson | if the user doesn't provide domain info, then use the v2 API. | 21:45 |
| morganfainberg | bknudson, the only concern then is if they use a "name" and that name could be v3 somewhere not default domain, and is also in default domain | 21:45 |
| bknudson | although I think it would be better to use a default domain if the user doesn't provide domain info. | 21:45 |
| * morganfainberg wonders how close we really are to being able to ditch v2. | 21:46 | |
| bknudson | to clarigy: although I think it would be better to use the v3 API with a default domain if the user doesn't provide domain info. | 21:46 |
| bknudson | clarify | 21:46 |
| morganfainberg | bknudson, oh ++ yes | 21:46 |
| morganfainberg | bknudson, 10000% yes | 21:46 |
| mordred | morganfainberg: so - the problem is | 21:47 |
| mordred | domain is part of the auth info, right? | 21:47 |
| mordred | which means it might not have been provided in a context I'm working with | 21:47 |
| morganfainberg | mordred, if you're authing against v3 [only required if user is not in default domain] | 21:47 |
| mordred | because the user might have authenticated with a pre-existing token or with a cert or something | 21:47 |
| mordred | what I mean it, I may not know the user's domain | 21:47 |
| morganfainberg | mordred, any auth requests that exist via v2 are default domain, or would fail | 21:48 |
| mordred | but | 21:48 |
| morganfainberg | you can always validate the token which contains a user construct | 21:48 |
| morganfainberg | that will indicate the user's domain | 21:48 |
| bknudson | I might have mentioned this before... not sure... but seems like it should be possible to do v3 auth with a username and no domain, then keystone uses default domain. | 21:48 |
| mordred | ok | 21:48 |
| bknudson | that would make it easier to transition from v2 -> v3. | 21:48 |
| morganfainberg | if you have a token you *can* get info about the user/scope | 21:48 |
| mordred | so I can pull the current domain info from keystone | 21:48 |
| morganfainberg | bknudson, i think that was something we discussed | 21:48 |
| morganfainberg | bknudson, making v2 auth a middleware that translated to v3 | 21:48 |
| bknudson | also, we could put the user's domain in the token if they auth using v2 API. | 21:49 |
| morganfainberg | mordred, yes, via a token validate. | 21:49 |
| morganfainberg | bknudson, sure. i mean i wonder how many peopple we'd break if we stopped issuing V2 tokens. | 21:50 |
| bknudson | oh, right, could validate the v2 token using v3 and you'd get the domain. | 21:50 |
| morganfainberg | bknudson, it wouldn't be hard to wire up v3 tokens to v2 | 21:50 |
| bknudson | morganfainberg: good question... not sure why anyone would be affected if v2 auth returned a v3 token. | 21:51 |
| morganfainberg | bknudson, because they use repose and inspect the token directly instead of having keystone middleware do it for them. | 21:51 |
| morganfainberg | bknudson, not to put too fine a point on it | 21:51 |
| bknudson | y, the catalog. | 21:51 |
| morganfainberg | not just the catalog | 21:52 |
| morganfainberg | roles, etc | 21:52 |
| morganfainberg | mordred, https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/tokens.py#L55 is the call you'd be looking for to validate the token [you can validate a v2 token via v3 and get all the info such as domains] | 21:52 |
| morganfainberg | mordred, if you *can't* use v3, you know the domain is "default" and the v2 client object has a similar method | 21:53 |
| morganfainberg | if you need token information | 21:53 |
| bknudson | luckily I just added that API | 21:53 |
| morganfainberg | mordred, you'll get an accessinfo item back which lets you use attribute references for lots of things via magic @property stuff | 21:54 |
| morganfainberg | mordred, so you don't need to know the token structure to extract information | 21:54 |
| morganfainberg | bknudson, y! def good! | 21:54 |
| morganfainberg | we should bug lbragstad and ask if RAX can consume v3 tokens. | 21:55 |
| *** rwsu-afk has quit IRC | 21:55 | |
| morganfainberg | because if so... maybe we put an option in that makes v2 token issuance go away | 21:55 |
| * morganfainberg doesn't see lots of stuff in openstack that would *require* v2 [except maybe some horizon-isms] now. | 21:56 | |
| morganfainberg | for the API that is | 21:56 |
| bknudson | surprising anyone would want to stick with the v2 api considering the known security issues. | 21:56 |
| bknudson | don't validate a token using the v2 api. | 21:56 |
| morganfainberg | ever ;) | 21:57 |
| *** rwsu-afk has joined #openstack-keystone | 21:57 | |
| morganfainberg | bknudson, can i ask you a favor? | 21:58 |
| bknudson | morganfainberg: sure... | 21:58 |
| morganfainberg | bknudson, can i ask you to prioritise the ae token review [if you aren't too deep in other stuff] - you can absolutely say no :) | 21:58 |
| morganfainberg | i'd like to [if possible] make sure we're close to winding that down or identify what is needed to make it go before we need a FFE. | 21:58 |
| bknudson | morganfainberg: already prioritized... wasn't going to work on it today though. | 21:59 |
| morganfainberg | no no not a today thing | 21:59 |
| morganfainberg | dude, weekend | 21:59 |
| morganfainberg | :) | 21:59 |
| morganfainberg | i expect people to not be working on weekend tbh | 21:59 |
| bknudson | what's a weekend? | 21:59 |
| morganfainberg | hah | 21:59 |
| morganfainberg | ok so, while you *may* be working on saturday or sunday, I wouldn't expect you to be :P | 22:00 |
| bknudson | http://www.fanforum.com/f387/downton-abbey-quotes-1-what-weekend-63050759/ | 22:00 |
| *** joesavak has quit IRC | 22:00 | |
| morganfainberg | hahah | 22:01 |
| bknudson | AE tokens would also make my life easier. | 22:02 |
| bknudson | if they work. | 22:02 |
| morganfainberg | i also heard from a very large PKI token deployer ... they are also having issues with PKI and are very interested in AE | 22:02 |
| morganfainberg | s/AE/fernet-or-whatever-they-are-called-now | 22:03 |
| bknudson | haven't seen any middleware reviews for it. | 22:03 |
| morganfainberg | bknudson, no, there hasn't been any middleware for it yet afaik | 22:03 |
| morganfainberg | we've been focusing on getting the stuff that needed to land for FF in keystone | 22:04 |
| morganfainberg | though i *think* the middleware stuff is relatively low amounts of wiring up the revocation event code. | 22:04 |
| morganfainberg | ayoung, re: https://review.openstack.org/#/c/160067/ [kvs revoke backend going away] cool - i'm happy to see that go away, but remember we had a convo about it and i didn't want it removed if it needed to stay | 22:06 |
| morganfainberg | ayoung, thanks for the +1 on thart | 22:06 |
| mfisch | morganfainberg: I'm trying to remove admin_token_auth from my public pipeline, but it seems to also break the admin one | 22:07 |
| mfisch | unless I've made a large puppet fail... which is also a possibility | 22:08 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document mapping of policy action to operation https://review.openstack.org/155919 | 22:08 |
| morganfainberg | mfisch: you shouldn't need admin_token_auth anywhere in production. | 22:08 |
| morganfainberg | Post bootstrap if you use the api to bootstrap. | 22:08 |
| mfisch | yeah I agree | 22:08 |
| mfisch | puppet does bootstrap with it | 22:09 |
| mfisch | at a minimum I want it out of the public pipeline | 22:09 |
| morganfainberg | I wonder if we can make bootstrap something keystone manage can do instead. So you don't ever need it in the pipeline. | 22:09 |
| mfisch | ah I see I broke something | 22:09 |
| morganfainberg | mfisch: got rid of the filter too in the past-ini? | 22:10 |
| mfisch | no I had a variable wrrong and put the v3 pipeline in for v2 admin | 22:10 |
| morganfainberg | Oh hah ouch. Yeah that'd do it. | 22:10 |
| ayoung | morganfainberg, so...the only case where I could see us wanting it is some distributed way of doing revocations and sync was best on something lioke mongo | 22:10 |
| ayoung | but revocations need to be transactional...I think? | 22:11 |
| *** lhcheng has joined #openstack-keystone | 22:11 | |
| ayoung | I don't really see it as something desperately needing removal | 22:11 |
| ayoung | morganfainberg, BTW, did you see my Opus: http://adam.younglogic.com/2015/02/three-types-of-tokens/ | 22:11 |
| morganfainberg | Then let's not remove it. | 22:11 |
| morganfainberg | ayoung: I laughed, I cried, I wanted an encore | 22:12 |
| mfisch | that was good ayoung | 22:12 |
| ayoung | does it help? | 22:12 |
| morganfainberg | Alas the usher kicked us all out before we could rush the stage. | 22:12 |
| morganfainberg | I think it's an entertaining alternative description of things. | 22:12 |
| mfisch | morganfainberg: is removing admin_token_auth from the public_api pipeline but not the admin_api one a valid config? | 22:13 |
| morganfainberg | It definitely doesn't hurt. | 22:13 |
| morganfainberg | Help, I think that depends on the reader. | 22:13 |
| mfisch | okay it seems to have broken the service token even on 35357 | 22:13 |
| mfisch | I am told I have to go buy fish for the kids so I will look later thx | 22:13 |
| morganfainberg | mfisch: I never tried that. With v3 they are the same thing. | 22:13 |
| mfisch | we have public endpoints but not for the admin so since puppet uses that I thought I'd leave it and be "safer" | 22:14 |
| mfisch | removing it 100% is a longer project | 22:14 |
| morganfainberg | Like I said, I haven't tried that. | 22:14 |
| mfisch | I'll let you know what I find | 22:14 |
| mfisch | yep thx | 22:14 |
| *** lhcheng_ has joined #openstack-keystone | 22:14 | |
| *** lhcheng has quit IRC | 22:17 | |
| ayoung | and with that...I'm off to go see Gogol Bordello! | 22:23 |
| *** ayoung is now known as ayoung-out | 22:23 | |
| *** karimb has joined #openstack-keystone | 22:39 | |
| *** lhcheng_ has quit IRC | 22:55 | |
| *** karimb has quit IRC | 22:55 | |
| *** lhcheng has joined #openstack-keystone | 23:03 | |
| *** david-lyle_afk has joined #openstack-keystone | 23:08 | |
| *** stevemar has joined #openstack-keystone | 23:09 | |
| *** ChanServ sets mode: +v stevemar | 23:09 | |
| *** stevemar has quit IRC | 23:11 | |
| *** lhcheng has quit IRC | 23:13 | |
| *** lhcheng has joined #openstack-keystone | 23:28 | |
| *** lhcheng_ has joined #openstack-keystone | 23:37 | |
| *** lhcheng has quit IRC | 23:38 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!