| *** spandhe has quit IRC | 00:01 | |
| *** spandhe has joined #openstack-keystone | 00:03 | |
| *** timcline has joined #openstack-keystone | 00:05 | |
| *** ncoghlan has joined #openstack-keystone | 00:07 | |
| *** nkinder has joined #openstack-keystone | 00:09 | |
| *** jlk has joined #openstack-keystone | 00:11 | |
| jlk | So.. if keystone goes behind apache, as keystone dev docs suggest, how does one "stop" keystone in order to do a db migration, without stopping other things running behind apache? | 00:11 |
|---|---|---|
| *** thedodd has quit IRC | 00:12 | |
| *** amerine has joined #openstack-keystone | 00:13 | |
| *** zzzeek has quit IRC | 00:17 | |
| *** markvoelker has quit IRC | 00:26 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:26 | |
| morganfainberg | jlk: you typically stop Apache. | 00:35 |
| jlk | yeah... that's not going to fly when apache is doing other tasks, like fronting other services or being a load balancer | 00:35 |
| morganfainberg | jlk: you can also disable keystone and graceful/reload so the wsgi isn't running for it. | 00:35 |
| jlk | We could disable the keystone site, and reload apache, but AFAIK that doesn't close any active connections to the wsgi | 00:35 |
| jlk | maybe that's... okay? and the changes of active connections doing some sql thing while trying to do a migration is a thing I just shouldn't worry about? | 00:36 |
| morganfainberg | You can also disable the routing to the backend and remember keystone doesn't run long lived actions. | 00:37 |
| morganfainberg | So then new connections would be denied (make it raise a service unavailable at the Apache layer). You have to restart Apache anyway to load the new code / graceful | 00:37 |
| jlk | should be able to do that with an apache reload instead of restart though | 00:38 |
| morganfainberg | You can also kill the wsgi processes, which Apache will load new ones on the next request. | 00:38 |
| morganfainberg | Yeah graceful ~= reload. | 00:38 |
| openstackgerrit | Merged openstack/keystone: Update sample config file https://review.openstack.org/160970 | 00:38 |
| morganfainberg | The other option would be to use something like uwsgi with mod_uwsgi_proxy. You could then stop the uwsgi and not Apache. | 00:39 |
| morganfainberg | This is not well tested but is on the list to do post kilo. | 00:39 |
| openstackgerrit | Merged openstack/python-keystoneclient: Import functional CLI tests from tempest https://review.openstack.org/158503 | 00:40 |
| morganfainberg | I would probably just kill the wsgi processes after disabling the keystone "site" including a reload. Then when new code is deployed Id re-enable and on next request things go through and start the new code/wsgi processes managed by mod_wsgi | 00:40 |
| jlk | yeah, or put something in place to watch for the processes to die before continuing, a more graceful way | 00:41 |
| jlk | something close to nova's graceful shutdown of compute. | 00:41 |
| morganfainberg | Sure. Same net effect. | 00:42 |
| morganfainberg | Well again keystone doesn't really have log lived tasks. The traffic will likely quiesce in a few seconds. | 00:42 |
| gyee | dumb question, how do I rename a review topic? | 00:42 |
| morganfainberg | Compute could have things to do once shutdown is signaled. | 00:43 |
| morganfainberg | gyee: either via the gerrit interface (web) or you can do it with a git review command line switch. | 00:43 |
| jlk | morganfainberg: sure, but automation needs to be sure, and wait appropriately. Otherwise it can be too fast | 00:43 |
| morganfainberg | jlk: sure. | 00:44 |
| gyee | morganfainberg, thanks, ah -t option | 00:45 |
| mtreinish | jamielennox: looks like your keystoneclient cli test patch landed. Want to propose the tempest removal? :) | 00:48 |
| jamielennox | mtreinish: ah cool, yep i'll do that now | 00:48 |
| jamielennox | mtreinish: gotta take the glory after all that | 00:48 |
| *** gyee has quit IRC | 00:51 | |
| morganfainberg | mtreinish: jamielennox yeah I pushed that patch through the moment I saw it. Yay! | 00:51 |
| *** david-lyle has quit IRC | 00:52 | |
| mtreinish | morganfainberg: awesome thanks, I still hope I can kill all the cli tests in tempest by the end of the cycle | 00:52 |
| mtreinish | jamielennox: ^^^ if you want to be a good citizen and do it for everyone else :) | 00:52 |
| jamielennox | mtreinish: because you know how much of a PITA passing code through the clients is :p | 00:53 |
| mtreinish | jamielennox: heh, that's why I haven't just done it | 00:54 |
| morganfainberg | mtreinish: ++ | 00:55 |
| morganfainberg | jamielennox: I'm going to rip apart our middleware docs and make the "only supported" auth the plugin form soon. | 00:56 |
| jamielennox | morganfainberg: that's more of a problem than you think - but yay do it | 00:56 |
| *** ljfisher has quit IRC | 00:56 | |
| morganfainberg | Yah. It's a problem. But since no one knows how to really configure middleware to use the plugins... It's needed. | 00:56 |
| morganfainberg | I've been asked 5 times now. :P | 00:57 |
| jamielennox | morganfainberg: you saw my post? | 00:57 |
| jamielennox | i realize that's not sufficient | 00:57 |
| morganfainberg | Your site was not working the times I looked for it. | 00:57 |
| jamielennox | ... | 00:57 |
| morganfainberg | GitHub pages can really suck sometimes. | 00:58 |
| *** radez is now known as radez_g0n3 | 00:58 | |
| morganfainberg | It's not your site it was clearly gh pages on the fritz. | 00:58 |
| jamielennox | http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ | 00:58 |
| jamielennox | morganfainberg: i used gh pages so that it doesn't go down :( | 00:58 |
| jamielennox | can you host them on swift? | 00:58 |
| jamielennox | i know you can deploy to an s3 bucket | 00:58 |
| morganfainberg | jamielennox: I fronted mine with cloudflare. | 00:58 |
| morganfainberg | But probably could host it on swift or s3 easily. But gh pages and cloudflare is free. | 00:59 |
| *** timcline has quit IRC | 00:59 | |
| jamielennox | i beat the SSL everywhere drum as much as anyone, but i was just hoping github would figure it out for me | 00:59 |
| morganfainberg | jamielennox: but yeah. Post is good. Real docs = better. | 00:59 |
| morganfainberg | Eh cloudflare solved it for | 01:00 |
| morganfainberg | Me. | 01:00 |
| morganfainberg | Was good enough. | 01:00 |
| openstackgerrit | wanghong proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 01:01 |
| *** jaosorior has quit IRC | 01:02 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 01:02 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 01:03 |
| *** gyee has joined #openstack-keystone | 01:04 | |
| *** ChanServ sets mode: +v gyee | 01:04 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 01:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 01:05 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 01:05 |
| *** carlosmarin has quit IRC | 01:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:06 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 01:06 |
| samueldmq | lbragstad ^ replied your comments on list role assignments performance | 01:06 |
| samueldmq | lbragstad, thanks for your review | 01:07 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 01:08 |
| openstackgerrit | Ian Wienand proposed openstack/keystone: Move install of cryptography before six https://review.openstack.org/161055 | 01:08 |
| samueldmq | henrynash, would you mind if I rebase that data-driven tests chain? (since I sent a new version of list role assignments) | 01:08 |
| henrynash | samueldmq: go for it | 01:09 |
| *** markvoelker has joined #openstack-keystone | 01:09 | |
| openstackgerrit | wanghong proposed openstack/keystone: move region and service exist checks into manager layer https://review.openstack.org/141977 | 01:09 |
| samueldmq | henrynash, k thanks | 01:09 |
| henrynash | bknudson, stevemar, ayoung: if you are still about have fixed up the latest comments on https://review.openstack.org/#/c/158679/16 | 01:10 |
| openstackgerrit | wanghong proposed openstack/keystone: apply endpoint_group filters on token catalog https://review.openstack.org/144187 | 01:13 |
| *** markvoelker has quit IRC | 01:14 | |
| jlk | If running keystone behind http, do admin_workers and public_workers come into play? | 01:14 |
| jamielennox | jlk: no, that'd be controlled by httpd | 01:14 |
| jlk | now to mentally map that into processes and threads | 01:15 |
| *** dims_ has joined #openstack-keystone | 01:17 | |
| *** davechen has joined #openstack-keystone | 01:17 | |
| *** jeffDeville has joined #openstack-keystone | 01:18 | |
| *** dims has quit IRC | 01:19 | |
| *** henrynash has quit IRC | 01:22 | |
| *** henrynash has joined #openstack-keystone | 01:22 | |
| *** ChanServ sets mode: +v henrynash | 01:22 | |
| *** jeffDeville has quit IRC | 01:23 | |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 01:25 |
| lbragstad | dolphm: I'll take the blame for that one | 01:28 |
| *** _cjones_ has quit IRC | 01:29 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 01:30 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 01:31 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 01:31 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 01:32 |
| *** _cjones_ has joined #openstack-keystone | 01:32 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 01:32 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 01:33 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 01:33 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in Federation list projects endpoint https://review.openstack.org/158163 | 01:34 |
| *** kfox1111 has quit IRC | 01:42 | |
| *** samueldmq has quit IRC | 01:43 | |
| *** tqtran has quit IRC | 01:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 01:47 |
| *** _cjones_ has quit IRC | 01:49 | |
| *** jeffDeville has joined #openstack-keystone | 01:52 | |
| *** henrynash has quit IRC | 01:53 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Fix a minor coding nit in Fernet testing https://review.openstack.org/161068 | 01:54 |
| morganfainberg | oh god | 01:55 |
| morganfainberg | that turns into a literal set doesn't it | 01:55 |
| morganfainberg | '{<hex>}' | 01:55 |
| morganfainberg | lbragstad, be glad you didn't try that w/ py26 :P | 01:55 |
| morganfainberg | or.. wow thats just wierd | 01:56 |
| lbragstad | morganfainberg: yeah, not sure what the reason was behind that but dstanek caught it | 01:56 |
| morganfainberg | it works though | 01:56 |
| morganfainberg | weeeirdddd | 01:56 |
| morganfainberg | >>> uuid.UUID('{12345678901234567890123456789012}') | 01:56 |
| morganfainberg | UUID('12345678-9012-3456-7890-123456789012') | 01:56 |
| morganfainberg | >>> | 01:56 |
| morganfainberg | i ... don't even get that | 01:56 |
| morganfainberg | why are { allowed as part of that string... | 01:57 |
| *** jeffDeville has quit IRC | 01:57 | |
| lbragstad | morganfainberg: no idea, | 01:58 |
| lbragstad | i thought it was some weird qwirk | 01:58 |
| *** jeffDeville has joined #openstack-keystone | 01:59 | |
| *** jamielennox is now known as jamielennox|away | 01:59 | |
| morganfainberg | lbragstad, any idea how you're going to handle the v2 tokens? | 01:59 |
| *** jeffDeville has quit IRC | 02:01 | |
| lbragstad | morganfainberg: I originally tried sending whatever I could to the V3 token formatter and making it look like a v2 response | 02:01 |
| lbragstad | but that didn't quite turn out | 02:01 |
| morganfainberg | lbragstad, didn't work? | 02:01 |
| lbragstad | not really... | 02:01 |
| morganfainberg | what broke? | 02:01 |
| lbragstad | I don't think it was building the token data properly, | 02:02 |
| lbragstad | and it looked really ugly beating whatever we got back from the v3 data helper until it looked like a v2 repsonse | 02:03 |
| lbragstad | response* | 02:03 |
| morganfainberg | sure, but at least that could have been used by all providers | 02:04 |
| morganfainberg | and kept ick isolated. | 02:04 |
| morganfainberg | maybe i'll take a stab at doing it for all providers, pki being the only "wierd" one | 02:04 |
| *** jeffDeville has joined #openstack-keystone | 02:04 | |
| lbragstad | morganfainberg: that would be cool, jorge_munoz has something locally that he is hacking on to get it to work | 02:04 |
| lbragstad | morganfainberg: I'd probably sync with him to see what he has | 02:05 |
| morganfainberg | sure. | 02:05 |
| *** browne has quit IRC | 02:08 | |
| *** markvoelker has joined #openstack-keystone | 02:10 | |
| *** erkules_ has joined #openstack-keystone | 02:10 | |
| *** erkules has quit IRC | 02:13 | |
| *** jeffDeville has quit IRC | 02:13 | |
| *** markvoelker has quit IRC | 02:15 | |
| lbragstad | dolphm: are you still thinking that we should have a format schema for unscoped tokens? https://github.com/openstack/keystone/blob/fb9954caede1e9b2896739ff95ed38b7ec49ad98/keystone/token/providers/fernet/core.py#L24-L25 | 02:18 |
| lbragstad | dolphm: in that case, should we do different schemas for domain-scoped and unscoped? | 02:18 |
| dstanek | lbragstad: what'd i break? | 02:19 |
| morganfainberg | lbragstad, http://paste.openstack.org/show/187089/ just need to make the v2_token_data_helper able to do the convert method there | 02:19 |
| morganfainberg | lbragstad, i think. | 02:20 |
| morganfainberg | lbragstad, so yeah data munging but not really totally awful (could probably short-circuit the openssl call for v3 too by refactoring a minor bit. | 02:20 |
| lbragstad | dstanek: you caught the '{' + uuid_string + '}' stuff | 02:22 |
| dstanek | lbragstad: ah, yeah. it wasn't wrong, just unnecessary | 02:22 |
| morganfainberg | dstanek, not sure why { + string + } worked | 02:23 |
| lbragstad | morganfainberg: nice, you haven't tried that on fernet yet have you? | 02:23 |
| morganfainberg | lbragstad, don't have the transform yet, but this short circuits v2 token issuance globally. | 02:23 |
| dstanek | morganfainberg: https://docs.python.org/2/library/uuid.html - i don't think it's based on rfc 4122 though | 02:23 |
| dolphm | lbragstad: either yes, or put "null" into the "scoped" schema | 02:24 |
| dstanek | morganfainberg: i think it's because of the definition of namespaces | 02:24 |
| morganfainberg | lbragstad, so it always issues a v3, then it would transform to v2, for fernet you wouldn't care except on validate (validate would need the same rough treatment) | 02:24 |
| morganfainberg | oh nvm you would care for fernet, asnyway not that aweful to make v2 issuance just v3 + data transform | 02:25 |
| dstanek | lbragstad: did you guys get the unicode for v2 vs. str for v3 figured out? | 02:25 |
| morganfainberg | dstanek, that is routes vs header | 02:25 |
| morganfainberg | dstanek, if it comes in as part of the URL it's a different type | 02:25 |
| morganfainberg | :( | 02:25 |
| dstanek | ah, that seems wrong | 02:26 |
| morganfainberg | dstanek, at least that is my guess at why it's different. doesn't mean it's right | 02:26 |
| morganfainberg | or the correct behavioer | 02:26 |
| morganfainberg | just probably what is actually going on | 02:26 |
| *** ayoung has joined #openstack-keystone | 02:27 | |
| *** ChanServ sets mode: +v ayoung | 02:27 | |
| *** markvoelker has joined #openstack-keystone | 02:27 | |
| dstanek | morganfainberg: that's probably what it is. the routes gives us unicode which i've always thought was wrong, but i never took time to read the HTTP spec about it | 02:27 |
| *** stevemar has joined #openstack-keystone | 02:30 | |
| *** ChanServ sets mode: +v stevemar | 02:30 | |
| lbragstad | dstanek: morganfainberg that makes sense | 02:32 |
| lbragstad | because once we get into the auth/controller.py layer, we handle both pretty much the same | 02:32 |
| *** markvoelker has quit IRC | 02:33 | |
| dstanek | lbragstad: maybe that string conversion needs to happen in the controller since it's a web layer thing | 02:33 |
| dstanek | so checking for unicode isn't correct to find what is a v2 token | 02:33 |
| lbragstad | dstanek: agreed | 02:34 |
| *** stevemar has quit IRC | 02:35 | |
| morganfainberg | lbragstad, ok so i think http://paste.openstack.org/show/187113/ and then the conversion code. | 02:35 |
| morganfainberg | lbragstad, should do it. plus maaaaybe some testing | 02:35 |
| *** stevemar has joined #openstack-keystone | 02:36 | |
| *** ChanServ sets mode: +v stevemar | 02:36 | |
| *** jamielennox|away is now known as jamielennox | 02:37 | |
| lbragstad | morganfainberg: awesome, I'll see if I can get something working | 02:37 |
| morganfainberg | lbragstad, ** no guarantees that actually works, but it should be minor massaging of code at worst to fix any assumptions i made that are bogus. | 02:38 |
| morganfainberg | lbragstad, you could *probably* use the token_model as well to make converting easier | 02:38 |
| lbragstad | morganfainberg: that makes sense | 02:38 |
| lbragstad | morganfainberg: the v3_to_v2_token method doesn't exist yet, right? | 02:40 |
| morganfainberg | no it does not | 02:40 |
| morganfainberg | i figure you have some of that code already, i could hack it together as well. | 02:40 |
| lbragstad | ok, just double checking | 02:41 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 02:49 |
| stevemar | morganfainberg, whats the state of keystone!? | 02:50 |
| morganfainberg | stevemar huh? | 02:50 |
| stevemar | with the last few patches | 02:50 |
| morganfainberg | explain? | 02:51 |
| morganfainberg | oyu mean, are we ready to cut k3? | 02:51 |
| *** raildo_ has joined #openstack-keystone | 02:51 | |
| morganfainberg | stevemar, we need a patch or two to enable v2 tokens to work with fernet, and i think we're at the point where FFEs are needed for everything else | 02:52 |
| morganfainberg | because we need to be ready in ~2 days for k3 | 02:52 |
| morganfainberg | stevemar, aslo is cadf complete? | 02:52 |
| *** jamielennox is now known as jamielennox|away | 02:52 | |
| morganfainberg | oh nvm it is | 02:52 |
| *** gothicmindfood has joined #openstack-keystone | 02:53 | |
| * morganfainberg waves at gothicmindfood | 02:53 | |
| gothicmindfood | oh hai morganfainberg :) | 02:53 |
| morganfainberg | gothicmindfood, how are you this fine day? | 02:53 |
| morganfainberg | s/day/evening | 02:53 |
| gothicmindfood | morganfainberg: if you take away the migraine I'd be doing great. But we can't have everything we want all the time, I guess. | 02:54 |
| morganfainberg | gothicmindfood, boooooo. migranes are no fun | 02:54 |
| stevemar | morganfainberg, i'd like to merge this guy: https://review.openstack.org/#/c/159045/ | 02:55 |
| morganfainberg | thats one of those things you should always be able to have: migrane free days. | 02:55 |
| *** jamielennox|away is now known as jamielennox | 02:55 | |
| stevemar | but o/w it's complete, we can handle that guy as a bug? | 02:55 |
| morganfainberg | stevemar, notifications aren't too much critical path, that can land pretty much anytime i would guess | 02:55 |
| morganfainberg | s/notifications/audit notifications | 02:55 |
| stevemar | morganfainberg, yeah, thats whhat i figured | 02:55 |
| stevemar | thats why i was using my time to review instead of code | 02:56 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 02:56 |
| *** jamielennox is now known as jamielennox|away | 02:56 | |
| morganfainberg | what the... | 02:56 |
| *** jamielennox|away is now known as jamielennox | 02:57 | |
| morganfainberg | uhm... | 02:57 |
| morganfainberg | https://review.openstack.org/#/c/154370/ why are we adding the placeholders there? | 02:57 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 02:58 |
| morganfainberg | dstanek, ping. | 03:00 |
| morganfainberg | dstanek, ok since you talked this through w/ marekd mind stepping me through https://review.openstack.org/#/c/142573/16 because i am still missing the understanding of the .extend vs .append | 03:00 |
| morganfainberg | and why that is important | 03:00 |
| dstanek | morganfainberg: sure | 03:00 |
| morganfainberg | because the rest of it looks fine to me. | 03:01 |
| dstanek | so basically the output of the mapping is a list | 03:01 |
| * morganfainberg isn't a fan of the ast use, but whatever. | 03:01 | |
| morganfainberg | ok | 03:01 |
| dstanek | in the local section we use {0} to refer to the first element in the list; may the username or goup | 03:02 |
| dstanek | but...in the case of white or black listing those things are a list in a list | 03:02 |
| dstanek | morganfainberg: actually now that i think about it, i don't like the tests because they hide this | 03:03 |
| dstanek | morganfainberg: the test on line 900 here https://review.openstack.org/#/c/142573/16/keystone/tests/unit/test_v3_federation.py | 03:04 |
| morganfainberg | oh | 03:05 |
| morganfainberg | i think i see it. | 03:05 |
| morganfainberg | i *think* | 03:05 |
| morganfainberg | it's a bit weird | 03:06 |
| dstanek | that test uses a whitelist so the output of the mapping is effectively [[groups*], username] | 03:06 |
| morganfainberg | this almost tells me we should have used a proper object not abusing lists. | 03:06 |
| dstanek | very considering the list is str-ed and late evaled | 03:06 |
| morganfainberg | because this is not straight forward to see | 03:06 |
| dstanek | yeah i agree - i eluded to that earlier | 03:06 |
| dstanek | right now the logic is kind of distributed | 03:07 |
| morganfainberg | i'm ok with this going in as is.. but i'm not a fan of it. | 03:07 |
| *** raildo_ has quit IRC | 03:07 | |
| morganfainberg | this feels like another revocation event tree thing | 03:07 |
| morganfainberg | where very few people will get it. | 03:07 |
| morganfainberg | and it'll be at risk of regressions/bugs since it's not well understood | 03:08 |
| dstanek | agreed. i didn't want to +2 because i wanted to see if we could get a few other people to understand since it is to different | 03:08 |
| morganfainberg | dstanek, so, i'm going to +1 with a comment to consider my +1 a +2 when you feel there have been enough eyes on it | 03:08 |
| dstanek | morganfainberg: sounds good - we can discuss with the others tomorrow and see if anyone else is interested in diving in | 03:09 |
| morganfainberg | dstanek, ++ | 03:10 |
| morganfainberg | comment added. if no one else wants to dive in we can push it through gate tmrrow. | 03:10 |
| morganfainberg | and circle back to clean this up in k3 | 03:11 |
| morganfainberg | or liberty | 03:11 |
| morganfainberg | s/k3/by rc | 03:11 |
| *** spandhe has quit IRC | 03:12 | |
| morganfainberg | there are going to be a lot of -2s going out tomorrow. | 03:12 |
| * morganfainberg wants something beside a procedural -2. | 03:12 | |
| *** browne has joined #openstack-keystone | 03:12 | |
| wanghong | morganfainberg, ping, I find that 45-49 and 56-60 are all placeholder migrations. | 03:16 |
| *** timcline has joined #openstack-keystone | 03:16 | |
| morganfainberg | wanghong, right, why are the placeholders being added? | 03:16 |
| *** timcline has quit IRC | 03:17 | |
| *** dims_ has quit IRC | 03:17 | |
| morganfainberg | wanghong, usually placeholder migrations are added solely as the first commit of a new cycle. | 03:17 |
| wanghong | morganfainberg, ah, I know... | 03:17 |
| morganfainberg | wanghong, there is no specific numbering requirement for the placeholders ;) | 03:17 |
| *** timcline has joined #openstack-keystone | 03:17 | |
| morganfainberg | they just are added for backports when we start another cycle wherever we are at. | 03:18 |
| wanghong | morganfainberg, got it. I will remove them. | 03:19 |
| morganfainberg | wanghong, great! | 03:19 |
| *** harlowja_ is now known as harlowja_away | 03:21 | |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 03:22 |
| *** markvoelker has joined #openstack-keystone | 03:28 | |
| *** gyee has quit IRC | 03:29 | |
| davechen | morganfainberg, hi | 03:32 |
| morganfainberg | davechen, allo | 03:32 |
| *** markvoelker has quit IRC | 03:33 | |
| davechen | morganfainberg, just wanna have a short dicussion with you about this readonly admin role. | 03:33 |
| davechen | morganfainberg, https://blueprints.launchpad.net/keystone/+spec/admin-readonly-role | 03:33 |
| davechen | morganfainberg, do you think it | 03:33 |
| davechen | morganfainberg, do you think it's deserve to try in L? | 03:33 |
| stevemar | an admin user with read-only, that seems strange ^_- | 03:34 |
| morganfainberg | stevemar, think of it this way, a role that can "inspect anything" but can't change things | 03:34 |
| morganfainberg | stevemar, not "admin" but isn't restricted from looking at things. | 03:34 |
| stevemar | inspector role | 03:34 |
| davechen | yeah, there are some case the role just have a read permission but act as the admin. | 03:35 |
| morganfainberg | stevemar, go go gadget openstack? | 03:35 |
| stevemar | ha | 03:35 |
| morganfainberg | davechen, i think this is a case where we can represent this with current policy - and as we move towards dynamic policy it gets easier | 03:35 |
| morganfainberg | davechen, so in either case we will need work done in policy to represent this. | 03:36 |
| morganfainberg | i see it as having value. | 03:36 |
| morganfainberg | but it's definltey not keystone-exclusive | 03:36 |
| morganfainberg | *still see it as having value | 03:36 |
| davechen | is there anyone watch at this? | 03:36 |
| morganfainberg | so i think if we get rid of hard-coded admin everywhere and then we define an appropriate read-only role that is deployed in devstack we've demonstrated the direction | 03:37 |
| morganfainberg | davechen, ... so L should be targeting at least that? No more hard-coded admin and a demonstration of this type of role in devstack w/ proper testing? | 03:38 |
| stevemar | morganfainberg, i guess all the get/list calls would be 'admin-read' | 03:38 |
| morganfainberg | stevemar, yeah. | 03:38 |
| davechen | not just hard-coded, but remove them maybe a good starting. | 03:38 |
| morganfainberg | yeah, move all the "is_admin" type checks to rely on proper RBAC | 03:38 |
| morganfainberg | which can start with the "admin" role ;) | 03:39 |
| davechen | talked in nova project, they are not objective to this, but haven't see any action for this :) | 03:39 |
| morganfainberg | yeah no one has really jumped on it | 03:39 |
| morganfainberg | but the projects would all accept that type of change | 03:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 03:39 |
| davechen | so morganfainberg, maybe I can start from it and do some work in Keystone? | 03:40 |
| morganfainberg | davechen, i don't think we have hard-coded is_admin (don't look at v2, we can't change that) | 03:40 |
| morganfainberg | davechen, but you can absolutely do work to help along these lines. Lots of policy work to be done [centralizing policy] hopefully in Liberty | 03:41 |
| morganfainberg | davechen, so 2 bits: in keystone - work on the policy centralization stuff, in other projects make "is admin" checks use RBAC where they hard-code a role | 03:41 |
| davechen | yeah, policy centralization is good stuff. | 03:42 |
| davechen | morganfainberg, thanks for the answer. :) | 03:43 |
| morganfainberg | davechen, happy to help | 03:43 |
| *** raildo has quit IRC | 03:54 | |
| *** timcline has quit IRC | 03:54 | |
| *** raildo has joined #openstack-keystone | 03:54 | |
| stevemar | morganfainberg, some one wants to use federation as a reseller, and not use authZ | 03:59 |
| stevemar | it's... different | 03:59 |
| morganfainberg | wait what? | 03:59 |
| morganfainberg | you've said a bunch of words... and independently they all make sense...but put them together like that and.. huh? | 04:00 |
| ayoung | davechen, read up on the dynamic policy specs | 04:10 |
| ayoung | stevemar, Federation is explicitly about authZ | 04:10 |
| stevemar | ayoung, i dunno, sounds weird | 04:11 |
| ayoung | stevemar, well, federation is actually explicitly about authentication | 04:12 |
| ayoung | authZ builds on AuthN | 04:12 |
| *** adam_g has quit IRC | 04:20 | |
| *** _cjones_ has joined #openstack-keystone | 04:20 | |
| *** _cjones_ has quit IRC | 04:22 | |
| openstackgerrit | ayoung proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 04:23 |
| *** adam_g has joined #openstack-keystone | 04:28 | |
| *** markvoelker has joined #openstack-keystone | 04:29 | |
| *** breton_ has joined #openstack-keystone | 04:30 | |
| davechen | ayoung, lots of spec there, found them. | 04:30 |
| stevemar | ayoung, that wasn't why henry's tests were failing :( | 04:30 |
| *** breton has quit IRC | 04:30 | |
| *** jamiec has quit IRC | 04:30 | |
| ayoung | davechen, that is how to get top your read only admin: hierarchical roles | 04:31 |
| ayoung | stevemar, nah, I just wanted to get that one out of the way and merged | 04:31 |
| *** mgagne has quit IRC | 04:31 | |
| ayoung | it was unrelated to the others, had sufficient +2s and gerrit was kind enough to leave them on there after the rebase | 04:31 |
| *** jamiec has joined #openstack-keystone | 04:31 | |
| stevemar | ayoung, yah, i suppose | 04:32 |
| ayoung | it looks like his test is failing cuz some uuid is changed from the cached value in the test fixture | 04:32 |
| ayoung | he'll figure it out | 04:32 |
| davechen | ayoung, all of these spec is targeted for 'L'? | 04:32 |
| stevemar | aye | 04:32 |
| ayoung | davechen, heh. as much as we can get done. | 04:32 |
| ayoung | right now they are backlog | 04:32 |
| ayoung | we'll knock em on down. | 04:32 |
| ayoung | davechen, however, the readonly one can be done with just the "unified spec file" I think | 04:33 |
| stevemar | hey morganfainberg whats the milestone for ffe blueprints? | 04:33 |
| morganfainberg | stevemar, RC? | 04:34 |
| davechen | ayoung, maybe I can do something as well. | 04:34 |
| stevemar | morganfainberg, i guess it's not available yet | 04:34 |
| morganfainberg | stevemar, no it's not | 04:34 |
| davechen | ayoung, reading it... and thanks for the information. | 04:34 |
| *** markvoelker has quit IRC | 04:34 | |
| *** richm has quit IRC | 04:39 | |
| *** mgagne has joined #openstack-keystone | 04:45 | |
| *** mgagne is now known as Guest75711 | 04:45 | |
| *** openstackgerrit has quit IRC | 04:46 | |
| *** _cjones_ has joined #openstack-keystone | 04:50 | |
| *** openstackgerrit has joined #openstack-keystone | 04:52 | |
| *** _cjones_ has quit IRC | 04:54 | |
| *** comstud has quit IRC | 05:00 | |
| *** henrynash has joined #openstack-keystone | 05:05 | |
| *** ChanServ sets mode: +v henrynash | 05:05 | |
| *** markvoelker has joined #openstack-keystone | 05:31 | |
| *** jamielennox is now known as jamielennox|away | 05:32 | |
| *** openstack has joined #openstack-keystone | 05:35 | |
| *** markvoelker has quit IRC | 05:36 | |
| *** henrynash has quit IRC | 05:37 | |
| *** henrynash has joined #openstack-keystone | 05:37 | |
| *** ChanServ sets mode: +v henrynash | 05:37 | |
| *** ChristyF has joined #openstack-keystone | 05:45 | |
| *** CF_ has quit IRC | 05:48 | |
| *** ChristyF has quit IRC | 05:54 | |
| stevemar | jamielennox|away, i guess you don't need get_auth_ref here: https://review.openstack.org/#/c/161096/1/openstackclient/api/auth.py | 05:55 |
| stevemar | since there isn't really an auth ref... | 05:55 |
| stevemar | just a token and endpoint | 05:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/161104 | 06:04 |
| *** jacorob has quit IRC | 06:08 | |
| *** lbragstad has quit IRC | 06:08 | |
| *** jacorob has joined #openstack-keystone | 06:09 | |
| *** lhcheng has quit IRC | 06:10 | |
| *** lbragstad has joined #openstack-keystone | 06:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 06:11 |
| stevemar | henrynash, \o/ managed to get all the comments i hope | 06:11 |
| henrynash | stevmar: yep, Brant & I are going for the record number of suggestions per lines of code :-) | 06:12 |
| stevemar | he is certainly getting there | 06:13 |
| stevemar | henrynash, also one of your tests were failing, is that fixed up? | 06:14 |
| henrynash | stevemar: that’s in teh next patch…(consequnce of changes in that last one)…just fixing it now.... | 06:15 |
| stevemar | henrynash, cool cool, let me know when it's all ready to go, my laziness is paying off in the form of a timely review | 06:17 |
| henrynash | stevemar: :-) ready in 5 mins | 06:17 |
| *** lbragstad has quit IRC | 06:19 | |
| *** jacorob has quit IRC | 06:21 | |
| *** jacorob has joined #openstack-keystone | 06:22 | |
| *** lbragstad has joined #openstack-keystone | 06:22 | |
| *** Akshik has joined #openstack-keystone | 06:23 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 06:24 |
| henrynash | stevemar: done | 06:24 |
| henrynash | stevemar: sorry, it was 7 mins, I lied | 06:24 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 06:25 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 06:26 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 06:26 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 06:27 |
| *** markvoelker has joined #openstack-keystone | 06:32 | |
| *** markvoelker has quit IRC | 06:38 | |
| *** jogo has quit IRC | 06:53 | |
| Akshik | looping issue when trying to integrate openstack keystone icehouse with testshib, using ubuntu 12.04, any help | 06:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 06:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 06:59 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 07:01 |
| *** lbragstad has quit IRC | 07:08 | |
| *** jacorob has quit IRC | 07:10 | |
| *** lhcheng has joined #openstack-keystone | 07:21 | |
| stevemar | henrynash, i think DomainConfigNotFound should probably be renamed at this point | 07:24 |
| stevemar | or, meh... i guess not | 07:30 |
| *** david-lyle_afk has joined #openstack-keystone | 07:33 | |
| *** pnavarro has joined #openstack-keystone | 07:34 | |
| *** markvoelker has joined #openstack-keystone | 07:34 | |
| *** markvoelker has quit IRC | 07:39 | |
| *** afazekas has quit IRC | 07:48 | |
| *** lhcheng_ has joined #openstack-keystone | 07:49 | |
| *** openstackgerrit has quit IRC | 07:49 | |
| *** openstackgerrit has joined #openstack-keystone | 07:49 | |
| *** lhcheng has quit IRC | 07:52 | |
| *** ncoghlan has quit IRC | 08:07 | |
| *** pnavarro has quit IRC | 08:18 | |
| *** chlong has quit IRC | 08:20 | |
| -openstackstatus- NOTICE: Zuul check queue stuck due to reboot maintenance window at one of our cloud providers - no need to recheck changes at the moment, they won't move forward. | 08:30 | |
| *** ChanServ changes topic to "Zuul check queue stuck due to reboot maintenance window at one of our cloud providers - no need to recheck changes at the moment, they won't move forward." | 08:30 | |
| *** henrynash has quit IRC | 08:31 | |
| *** oguz has joined #openstack-keystone | 08:31 | |
| *** henrynash has joined #openstack-keystone | 08:32 | |
| *** ChanServ sets mode: +v henrynash | 08:32 | |
| *** ogzy has quit IRC | 08:33 | |
| *** pnavarro has joined #openstack-keystone | 08:33 | |
| *** markvoelker has joined #openstack-keystone | 08:35 | |
| *** markvoelker has quit IRC | 08:39 | |
| *** _afezekas|pub has joined #openstack-keystone | 08:42 | |
| *** karimb has joined #openstack-keystone | 08:42 | |
| stevemar | marekd, i already fixed up https://review.openstack.org/#/c/159865/6/keystone/tests/unit/test_v3_federation.py | 08:48 |
| stevemar | https://review.openstack.org/#/c/160584/ | 08:48 |
| marekd | stevemar: yeah, just saw it | 08:49 |
| marekd | stevemar: thanks. | 08:49 |
| stevemar | marekd, np! :) | 08:49 |
| marekd | stevemar: you know, us, mortals sometimes sleep, esp at 3 or 4am :-) | 08:50 |
| stevemar | marekd, anything less than immortality is a waste of time | 08:50 |
| stevemar | :D | 08:50 |
| *** jistr has joined #openstack-keystone | 08:50 | |
| marekd | stevemar: heh | 08:51 |
| marekd | stevemar: glad to see lots of patches merged. | 08:51 |
| stevemar | marekd, oh yeah a ton | 08:52 |
| marekd | ++ | 08:53 |
| *** jaosorior has joined #openstack-keystone | 09:01 | |
| openstackgerrit | Marcos Fermín Lobo proposed openstack/python-keystoneclient: Attributes required using token for auth https://review.openstack.org/115228 | 09:02 |
| henrynash | stevmar: back…you were thinking about the name of DomainConfigNotFound? | 09:02 |
| *** oguz_ has joined #openstack-keystone | 09:03 | |
| *** oguz has quit IRC | 09:06 | |
| stevemar | henrynash, yeah, no big deal | 09:06 |
| stevemar | henrynash, i'll take another whack at this stuff in a few hours | 09:06 |
| stevemar | marekd, time to be human aain | 09:06 |
| stevemar | again | 09:06 |
| marekd | stevemar: https://review.openstack.org/142573 - thanks for +2. I would like to enhance the way substitutions are done, but i think it's not very easy to do. | 09:06 |
| marekd | stevemar: that's why i don't want to do it now. | 09:07 |
| stevemar | marekd, agreed | 09:07 |
| stevemar | i was just thinking that | 09:07 |
| stevemar | that whole thing should be cleaned up a bit | 09:07 |
| *** openstack has joined #openstack-keystone | 15:27 | |
| *** samueldmq_ has joined #openstack-keystone | 15:31 | |
| ayoung | bknudson, let me see what the code says. I have not yet been able to make it work | 15:31 |
| bknudson | we could probably use more logging. | 15:31 |
| *** jorge_munoz has joined #openstack-keystone | 15:37 | |
| ayoung | richm, looks like the issue is specifically with Nova | 15:38 |
| ayoung | richm, the other services seem to do the right thing: | 15:38 |
| ayoung | But somehow Nova is hard-coded to use V2 for auth | 15:38 |
| *** vhoward has joined #openstack-keystone | 15:40 | |
| richm | ayoung: ok - do we need to close that bug and open a bug against nova? | 15:44 |
| ayoung | nah, just added Nova to the bug | 15:44 |
| richm | ayoung: ok - thanks | 15:44 |
| ayoung | richm, all nice and pretty now | 15:45 |
| *** samueldmq_ has quit IRC | 15:49 | |
| morganfainberg | ayoung: bknudson what is this about v2 tokens that are from v3 but missing domain info? | 15:54 |
| ayoung | morganfainberg, nah | 15:54 |
| ayoung | morganfainberg, it was ATM from Nova using V2 API to validate | 15:54 |
| *** henrynash has joined #openstack-keystone | 15:54 | |
| *** ChanServ sets mode: +v henrynash | 15:54 | |
| ayoung | so a V3 token would never be valid | 15:54 |
| ayoung | morganfainberg, we could hack a fix into Keystone, but its a config change in Nova | 15:54 |
| bknudson | does nova override atm options? | 15:55 |
| ayoung | Nova seems to have the V2.0 default hard coded in somehow | 15:55 |
| morganfainberg | A v3 token not in the default domain should be invalid against v2. Def a nova issue there. | 15:55 |
| ayoung | bknudson, I don't see how it could, but maybe | 15:55 |
| ayoung | morganfainberg, so the question is what if we backed off the rule "A v3 token not in the default domain should be invalid against v2" | 15:55 |
| morganfainberg | Or a bug in atm. | 15:55 |
| bknudson | http://git.openstack.org/cgit/openstack/nova/tree/etc/nova/api-paste.ini#n126 ? | 15:55 |
| ayoung | and I thin the answer is it would not break anything today | 15:55 |
| *** jacorob has joined #openstack-keystone | 15:56 | |
| morganfainberg | ayoung: it could break keystone. | 15:56 |
| ayoung | cuz other services do not know about DOmains | 15:56 |
| *** lbragstad has joined #openstack-keystone | 15:56 | |
| ayoung | but...the right thing is to fix in Nova | 15:56 |
| bknudson | btw - we had a similar issue in our chef cookbooks. | 15:56 |
| morganfainberg | ayoung: the token would be valid in potentially bad ways when used against keystone. So backing off that rule is bad. | 15:56 |
| bknudson | so seems to be a common issue with these tools -- can't keep up with our changes. | 15:56 |
| ayoung | morganfainberg, the nova conf file shows the default being V2. If I make is blank, discovery works right | 15:57 |
| morganfainberg | ayoung: nova defaulting to v2 is def an issue :( | 15:57 |
| bknudson | nova's default config file isn't in git anymore... | 15:57 |
| ayoung | I wonder if Nova is using the Keystone Client version still, and has an out of date middleware | 15:57 |
| morganfainberg | No they aren't afaik. | 15:58 |
| morganfainberg | At least Juno and later | 15:58 |
| bknudson | ayoung: I found an issue like that in our cookbooks... heat was still using keystoneclient middleware. | 15:58 |
| bknudson | again, similar issue with deployer tools not keeping up with our changes. | 15:58 |
| bknudson | and of course whenever the deployment fails the first place they go is keystone... they don't check the cookbooks first. | 15:59 |
| morganfainberg | If we split up ksc to "client" and "common" we could just get everyone to inherit the new ksm by having ksc import ksm | 16:00 |
| bknudson | here's the default nova config: http://docs.openstack.org/trunk/config-reference/content/list-of-compute-config-options.html | 16:00 |
| bknudson | morganfainberg: it's probably a little confusing to have APIs in ksc that we don't really expect applications to use (cms functions) | 16:01 |
| morganfainberg | bknudson: ++ | 16:02 |
| morganfainberg | if we did the split now (in the next week) we might be able to get it accepted by kilo release. | 16:03 |
| *** Bsony has quit IRC | 16:03 | |
| morganfainberg | But it's a chunk of work to do. | 16:03 |
| morganfainberg | We may want to do it for liberty though for sure. | 16:03 |
| *** david-lyle has joined #openstack-keystone | 16:08 | |
| ayoung | [filter:authtoken] | 16:11 |
| ayoung | paste.filter_factory = keystonemiddleware.auth_token:filter_factory | 16:11 |
| ayoung | so, not that. Not sure how it is defaulting the value. Maybe in an internal config | 16:11 |
| *** david-lyle has quit IRC | 16:15 | |
| ayoung | auth_version = None (StrOpt) API version of the admin Identity API endpoint. | 16:17 |
| ayoung | is not what my conf file was showing | 16:17 |
| *** darrenc has quit IRC | 16:25 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/161104 | 16:28 |
| rodrigods | dstanek, hi... any extra concerns in https://review.openstack.org/#/c/142573/16 ? | 16:28 |
| dstanek | rodrigods: no | 16:30 |
| *** david-lyle has joined #openstack-keystone | 16:30 | |
| rodrigods | dstanek, great. Thanks | 16:31 |
| *** darrenc has joined #openstack-keystone | 16:38 | |
| morganfainberg | lbragstad: ping re the v2 fernet stuff. This is something we need to get in the gate today if possible. | 16:41 |
| *** rwsu-afk is now known as rwsu | 16:42 | |
| morganfainberg | lbragstad: and verifying this works with federated tokens / format for it. | 16:42 |
| lbragstad | morganfainberg: agreed, jorge_munoz is working to get something up soon | 16:42 |
| lbragstad | morganfainberg: I'm working on the federated side | 16:42 |
| *** tqtran has joined #openstack-keystone | 16:43 | |
| morganfainberg | lbragstad: ok. I'd rather avoid a ffe for adding in these last two bits if we can avoid it - save those for things like domain SQL. | 16:44 |
| *** thedodd has joined #openstack-keystone | 16:46 | |
| morganfainberg | lbragstad: also remember it'll likely take 6+ hours to pass check at the moment. | 16:46 |
| morganfainberg | jorge_munoz: ^ | 16:47 |
| *** _cjones_ has joined #openstack-keystone | 16:47 | |
| jorge_munoz | ok | 16:49 |
| jorge_munoz | I’ll try to push in a patch by today. | 16:50 |
| *** henrynash has quit IRC | 16:57 | |
| *** atiwari has quit IRC | 17:03 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth and federation authentication to config file https://review.openstack.org/161317 | 17:07 |
| *** lhcheng has joined #openstack-keystone | 17:08 | |
| *** henrynash has joined #openstack-keystone | 17:08 | |
| *** ChanServ sets mode: +v henrynash | 17:08 | |
| *** jistr has quit IRC | 17:13 | |
| -openstackstatus- NOTICE: Issue solved, gate slowly digesting accumulated changes | 17:15 | |
| fmarco76 | hi morgan, is this patch as you indicated yesterday in the chat? https://review.openstack.org/#/c/159803/ | 17:17 |
| *** nellysmitt has quit IRC | 17:18 | |
| *** esp has left #openstack-keystone | 17:24 | |
| *** esp has joined #openstack-keystone | 17:26 | |
| *** fmarco76 has quit IRC | 17:29 | |
| *** edmondsw has quit IRC | 17:30 | |
| morganfainberg | I stand corrected. Fpf is tomorrow not kilo3 wow brain is broken by schedules of meetings. | 17:30 |
| morganfainberg | We have a couple more weeks before k3. :( sorry for rushing you guys. | 17:31 |
| stevemar | looks like a nice juicy bug with generating saml assertions | 17:31 |
| stevemar | morganfainberg, lol | 17:31 |
| stevemar | that is amazing | 17:32 |
| samueldmq | morganfainberg, yeah more time o/ | 17:32 |
| morganfainberg | Yes. | 17:32 |
| stevemar | morganfainberg, i have half a mind to think you planned this! | 17:32 |
| morganfainberg | >.> | 17:32 |
| morganfainberg | I wish I could have been that aware of the schedule to plan it. | 17:32 |
| morganfainberg | On the plus side all the code will be reviewable by tomorrow and hopefully through gate long before k3. | 17:33 |
| morganfainberg | Yes this means things can be re targeted to k3 as long as they are fully ready to review. | 17:34 |
| morganfainberg | (Hey it's better to think the k3 milestone is early rather than late) | 17:34 |
| morganfainberg | Right?! | 17:34 |
| dolphm | morganfainberg: right! | 17:35 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 17:36 |
| samueldmq | morganfainberg, haha yep :p and then we get happy when we realize it's later | 17:36 |
| morganfainberg | :P | 17:36 |
| morganfainberg | It still doesn't make me happy to have everything crammed into k3. | 17:37 |
| morganfainberg | Like it is. | 17:37 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 17:37 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 17:38 |
| henrynash | bknudson: all latest comments fixed up in https://review.openstack.org/158679 | 17:39 |
| *** fmarco76 has joined #openstack-keystone | 17:40 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 17:40 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 17:43 |
| *** spandhe has joined #openstack-keystone | 17:44 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 17:44 |
| *** afazekas has quit IRC | 17:44 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 17:44 |
| *** browne has quit IRC | 17:45 | |
| *** gyee has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v gyee | 17:47 | |
| *** fmarco76 has left #openstack-keystone | 17:48 | |
| *** zzzeek has joined #openstack-keystone | 17:51 | |
| *** afazekas has joined #openstack-keystone | 17:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 18:00 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 18:02 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 18:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 18:03 |
| *** karimb has quit IRC | 18:04 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 18:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 18:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 18:05 |
| henrynash | stevemar, ayoung, bknudson, gyee: hoping we can get https://review.openstack.org/#/c/158679/ in today (teh check queue gods willing) | 18:08 |
| *** aslaen has left #openstack-keystone | 18:09 | |
| gyee | yes sir | 18:10 |
| henrynash | gyee: thx | 18:16 |
| *** browne has joined #openstack-keystone | 18:17 | |
| *** harlowja_away is now known as harlowja_ | 18:19 | |
| raildo | hey, everyone. I'm writing the script that will drop the domain table. when I run the tests I get 'DatabaseAlreadyControlledError'. does anyone know what this mean? | 18:27 |
| raildo | haven't found anything useful on google | 18:28 |
| *** afazekas has quit IRC | 18:31 | |
| morganfainberg | raildo: it means the script is trying to initialize the db when it's already been initialized. Migrate starts by controlling the db, then running the scripts. You can't do that first part more than once. | 18:36 |
| raildo | morganfainberg: so, how can I be calling this initialization? it is happening on the tearDown. | 18:38 |
| morganfainberg | Not sure. It might be the connector you're using. I'd need to look at the code. | 18:39 |
| *** david-lyle has quit IRC | 18:42 | |
| *** david-lyle has joined #openstack-keystone | 18:42 | |
| *** haneef_ has joined #openstack-keystone | 18:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 18:44 |
| *** haneef_ has quit IRC | 18:45 | |
| *** gyee has quit IRC | 18:49 | |
| morganfainberg | Hmm | 18:50 |
| *** samueldmq_ has joined #openstack-keystone | 18:54 | |
| ayoung | henrynash, where is the test for "not enabled" that we discussed? | 18:59 |
| openstackgerrit | David J Hu proposed openstack/keystone: Version independent token issuance pipeline https://review.openstack.org/150629 | 18:59 |
| *** haneef_ has joined #openstack-keystone | 19:03 | |
| *** stevemar has quit IRC | 19:07 | |
| *** stevemar has joined #openstack-keystone | 19:08 | |
| *** ChanServ sets mode: +v stevemar | 19:08 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth and federation authentication to config file https://review.openstack.org/161317 | 19:14 |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth and federation authentication to config file https://review.openstack.org/161317 | 19:15 |
| *** ChanServ changes topic to "Release Blockers: https://gist.github.com/dolph/651c6a1748f69637abd0 << please review for client release on Feb 1st | http://opensax.com/ | Reviews Guarantee Citizenship </starship troopers>" | 19:16 | |
| *** iamjarvo has joined #openstack-keystone | 19:16 | |
| iamjarvo | hi all, i am using openstack-horizon and looking at the logs. i should be able to copy the curl command in the log and do a request right? when i copy the command i get an unauthorized error | 19:17 |
| iamjarvo | this is what i see in the logs http://pastie.org/private/o4rgelaygpgkpphajhi9w | 19:19 |
| *** gyee has joined #openstack-keystone | 19:19 | |
| *** ChanServ sets mode: +v gyee | 19:19 | |
| morganfainberg | wow | 19:20 |
| morganfainberg | that is an old channel topic | 19:20 |
| iamjarvo | morganfainberg what im asking is old? | 19:20 |
| *** ChanServ changes topic to "High Priority Reviews: https://gist.github.com/dolph/651c6a1748f69637abd0 | Reviews Guarantee Citizenship </starship troopers>" | 19:20 | |
| morganfainberg | iamjarvo, no what chanserv set the topic to | 19:20 |
| iamjarvo | ahh i see | 19:20 |
| morganfainberg | iamjarvo, i just fixed it. this was related to zuul getting bound up on check queue | 19:21 |
| iamjarvo | o ok | 19:21 |
| morganfainberg | so now your question | 19:21 |
| morganfainberg | let me look | 19:21 |
| iamjarvo | seems like access_token_id and trust_id should not be none | 19:21 |
| morganfainberg | ah ok so the curl command wont work perfectly | 19:21 |
| morganfainberg | because we scrub out sensitive data [ such as the token id] | 19:22 |
| iamjarvo | o ok | 19:22 |
| iamjarvo | so i would need to obtain those values myself and add them in | 19:22 |
| morganfainberg | yeah | 19:23 |
| morganfainberg | it's because a token conveys authorization | 19:23 |
| morganfainberg | so if osmeone looked at the logs, they now could [in theory] use a token from the logs | 19:23 |
| *** Bsony has joined #openstack-keystone | 19:24 | |
| morganfainberg | and perform actions on the cloud | 19:24 |
| *** aix has quit IRC | 19:24 | |
| iamjarvo | understood | 19:25 |
| morganfainberg | logs shouldn't contain the bearer token/authz for a given user - they may contain other information the public shouldn't see, but support staff shouldn't be able to act on a customer's behalf just by extracting a small bit of data out of logs. | 19:25 |
| lbragstad | dstanek: have a quick minute for a unit test inheritance question? I'm wondering if there is a way for me to use the existing federation tests in test_v3_federation.py in test_v3_auth.py. I have my federated fernet token class set to inherit from the federation tests, but it seems to try and run all federated tests with fernet even though I haven't created any yet | 19:25 |
| iamjarvo | so i am running into another problem and i am seeing similar none values. here is a log from keystong logs http://pastie.org/private/gchosiisnyutsbzeri8gyw | 19:25 |
| dstanek | lbragstad: sure | 19:26 |
| iamjarvo | an the error Recoverable error: Malformed request URL: URL's project_id 'None' doesn't match Context's project_id 'None' (HTTP 400) (Request-ID: req-4674f3cf-a147-4bdb-8195-be64be005879) | 19:27 |
| dstanek | lbragstad: the test runner runs all of a testcase's defined tests - if you inherit from a class you inherit all its methods too | 19:27 |
| iamjarvo | so i am trying to figure out what's the Context it is talking about | 19:27 |
| lbragstad | dstanek: cool, but what if you want the federated tests to run with a setup method done before that? | 19:27 |
| dstanek | lbragstad: this is why we defined shared tests in a class that inherits from 'object' - the test running won't pick them up and then we use that as a mixin in other classes | 19:28 |
| dstanek | lbragstad: if there is no shared setup you may want to do the mixin approach | 19:29 |
| lbragstad | dstanek: here is a small diff of what I have http://cdn.pasteraw.com/jindb5h7na60070cstlx172fs5o1c6o | 19:29 |
| lbragstad | dstanek: I have a mix in for setting up the key repo | 19:29 |
| morganfainberg | iamjarvo, in nova? | 19:29 |
| morganfainberg | iamjarvo, because i've seen that error from nova when you try and use an unscoped token or a domain scoped token | 19:29 |
| iamjarvo | morganfainberg i was poking in nova but someone said it might be keystone related | 19:30 |
| iamjarvo | i poked in the horizon code and did see that the project_id value is empty in the nova client | 19:30 |
| morganfainberg | iamjarvo, that means somehow you have either an unscoped token or a domain scoped token | 19:31 |
| morganfainberg | if the token has no project_id, and no domain_id, it's unscoped | 19:31 |
| morganfainberg | but i wasn't aware horizon could end up with unscoped/domain scoped tokens | 19:32 |
| iamjarvo | morganfainberg we are trying out the multidomain set up stuff | 19:32 |
| morganfainberg | hm. | 19:33 |
| morganfainberg | it should still work... i think | 19:33 |
| morganfainberg | i mean... ayoung you've had multidomain + horizon work right? | 19:33 |
| iamjarvo | and i am signed in as the admin as all domains | 19:33 |
| * morganfainberg hasn't seen anything to say it shouldn't work. | 19:33 | |
| * ayoung wakes up...wyhat | 19:33 | |
| morganfainberg | ayoung, multi domain, and horizon | 19:34 |
| ayoung | LDAP .... | 19:34 |
| ayoung | no default domainm, so list the domains and selelect the first | 19:34 |
| ayoung | not a domain scoped token though | 19:34 |
| iamjarvo | so what would make the token now have a project_id, my assumption is its not getting passed in from the front end | 19:35 |
| ayoung | iamjarvo, code is in django-openstack-auth...you doing LDAP? | 19:35 |
| iamjarvo | nope, just regular devstack setup for now | 19:35 |
| iamjarvo | im guessing users in a db somewhere | 19:36 |
| ayoung | http://git.openstack.org/cgit/openstack/django_openstack_auth/tree/openstack_auth/backend.py#n104 | 19:36 |
| ayoung | iamjarvo, devstack puts users inssql, they always have a default domain, and the domain should | 19:36 |
| ayoung | be set on all tokens. | 19:36 |
| ayoung | and horizon will convert one scoped token to another | 19:36 |
| dstanek | lbragstad: so it's running tests that you don't want/need? | 19:36 |
| lbragstad | dstanek: it not to say that I don't want those tests run, since they should work anyway, but I want to make sure the keyrepo is set up proir | 19:37 |
| iamjarvo | ayoung but if the user is the controller of all domains which project_id does the user have? | 19:37 |
| dstanek | lbragstad: in my experience you should use mixes for tests and leave the setup to the test class | 19:37 |
| lbragstad | prior* | 19:37 |
| ayoung | iamjarvo, when they log in, they start with a token that is scoped to their default project | 19:38 |
| ayoung | Horizon does not handle domain scoped tokens yet | 19:38 |
| iamjarvo | running this patch https://review.openstack.org/#/c/148082/ | 19:40 |
| lbragstad | dstanek: this is a little better idea http://paste.openstack.org/show/188029/ | 19:43 |
| dstanek | lbragstad: why are you calling config_overrides explicitly? isn't it getting called twice then? | 19:46 |
| lbragstad | dstanek: I was just playing with it trying to get different things to work | 19:46 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: fix import order in federation controller https://review.openstack.org/161375 | 19:46 |
| dstanek | lbragstad: if you setup is in there it will be executed before the tests | 19:46 |
| stevemar | lbragstad, dstanek ^ easy one... not sure why it was passing pep8, probably hacking related | 19:46 |
| lbragstad | stevemar: lgtm | 19:47 |
| *** r-daneel has joined #openstack-keystone | 19:47 | |
| dstanek | stevemar: hacking doesn't actually check the groupings; just alphabetical in each group | 19:48 |
| stevemar | ah | 19:48 |
| *** Bsony has quit IRC | 19:48 | |
| stevemar | but, it knows the standard ones and the project related imports... shouldn't it therefore know that all others are 3rd party? | 19:48 |
| stevemar | and then check alpha from there | 19:49 |
| stevemar | just shooting from the hip here | 19:49 |
| dstanek | stevemar: i don't think it actually knows out builtin vs project imports | 19:50 |
| lbragstad | dstanek: ok, so I modified to http://cdn.pasteraw.com/c4jaomvx110w229bdlq9h32ineii9ga | 19:51 |
| stevemar | dstanek, shouldn't that be something to easily determine, meh... another day | 19:52 |
| dstanek | stevemar: it's not terrible | 19:52 |
| *** mattamizer has joined #openstack-keystone | 19:53 | |
| *** mattamizer has quit IRC | 19:53 | |
| stevemar | dstanek, i have another question for ya | 19:53 |
| stevemar | dstanek, this bug: https://bugs.launchpad.net/keystone/+bug/1428251 | 19:54 |
| openstack | Launchpad bug 1428251 in Keystone "unable to generate saml assertion" [High,Confirmed] | 19:54 |
| dstanek | lbragstad: is that working for you | 19:54 |
| dstanek | stevemar: you think the rendering is incorrect? | 19:54 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix sample policy to allow user to revoke or check own token https://review.openstack.org/155916 | 19:54 |
| stevemar | dstanek, the saml assertion is generated correctly from the controller | 19:55 |
| stevemar | it's render_response() that gets messed up | 19:56 |
| dstanek | stevemar: what's wrong with it when it comes out? | 19:56 |
| dstanek | stevemar: what's in your apache log? | 19:56 |
| *** EmilienM is now known as EmilienM|afk | 19:56 | |
| *** harlowja_ has quit IRC | 19:57 | |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 19:57 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 19:57 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 19:57 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 19:57 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 19:57 |
| stevemar | dstanek, oops, forgot a critical log message | 19:57 |
| stevemar | dstanek, added to the bug | 19:58 |
| *** devlaps has joined #openstack-keystone | 19:58 | |
| stevemar | dstanek, i think maybe this line: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L341 it sending in a string format that render_response doesn't like | 19:58 |
| dstanek | stevemar: headers have to be bytes | 19:59 |
| dstanek | stevemar: are you setting a header somewhere? | 19:59 |
| stevemar | dstanek, there's also this guy as a reference: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L449 | 19:59 |
| stevemar | yes, it's in the first link | 19:59 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L343-L345 | 19:59 |
| stevemar | or this one ^ | 19:59 |
| lbragstad | dstanek: no, the unit tests still fail saying the key repo isn't setup | 19:59 |
| dstanek | lbragstad: can you push a quick patch to gerrit so i can pull down and experiment? | 20:00 |
| lbragstad | sure | 20:00 |
| dstanek | stevemar: i bet one or both of those URLs is a unicode object | 20:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unscoped token formatter for Fernet tokens https://review.openstack.org/161379 | 20:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 20:00 |
| dolphm | anyone ever seen this? it's a fresh ubuntu 12.04 box http://cdn.pasteraw.com/29ycne6aef1hcdrivxyiifjtgpsh3pg | 20:00 |
| stevemar | dstanek, blah | 20:01 |
| *** harlowja has joined #openstack-keystone | 20:01 | |
| lbragstad | dolphm: yeah, i've seen issues with that but I think you have to resolve by using a different python pip? | 20:01 |
| dolphm | ugh | 20:01 |
| lbragstad | dstanek: ^ | 20:01 |
| lbragstad | dolphm: did you try python-pip from apt? | 20:02 |
| stevemar | yep you are right dstanek | 20:02 |
| dolphm | lbragstad: it's too old | 20:02 |
| dstanek | dolphm: it looks like it's installing into you .local and i bet you don't have that bin in your path | 20:02 |
| dolphm | dstanek: why would it do that by default? | 20:02 |
| stevemar | dstanek, best to just wrap with str() ? | 20:02 |
| stevemar | or will that be py3 unfriendly? | 20:03 |
| dstanek | dolphm: pep-370 (i think), but i don't know why that's the default | 20:03 |
| dstanek | err..maybe 371 | 20:03 |
| dstanek | dolphm: it's this bad boy https://www.python.org/dev/peps/pep-0370/ | 20:04 |
| lbragstad | jorge_munoz: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L250 | 20:05 |
| *** bknudson has left #openstack-keystone | 20:05 | |
| *** bknudson has joined #openstack-keystone | 20:05 | |
| *** ChanServ sets mode: +v bknudson | 20:05 | |
| dolphm | dstanek: oh fun | 20:05 |
| jorge_munoz | lbragstad: thanks | 20:06 |
| dstanek | maybe ubuntu's python has that enabled by default :-( it's easy to disable it though | 20:06 |
| lbragstad | jorge_munoz: np, i was wrong, it doesn't live in the provider | 20:06 |
| dolphm | dstanek: if i delete .local/ before running get-pip.py it installs somewhere else, but that sucks | 20:06 |
| dolphm | (somwhere else == /usr/local/bin/pip) | 20:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change headers to be byte string friendly https://review.openstack.org/161383 | 20:07 |
| stevemar | dstanek, ^ | 20:07 |
| stevemar | thanks by the way | 20:07 |
| *** _cjones_ has quit IRC | 20:08 | |
| dstanek | stevemar: np | 20:10 |
| lbragstad | dolphm: I pushed a fernet refactor for adding an unscoped token formatter | 20:10 |
| dolphm | lbragstad: link? | 20:10 |
| lbragstad | https://review.openstack.org/#/c/161379/ | 20:10 |
| lbragstad | dolphm: ^ | 20:10 |
| *** lhcheng is now known as lhcheng_afk | 20:11 | |
| dolphm | lbragstad: did you consider the alternative -- just putting None into the "standard token format" | 20:11 |
| lbragstad | dolphm: that would work too | 20:12 |
| dolphm | lbragstad: well, i think they'd both work. i don't know which approach would be better :) | 20:13 |
| lbragstad | me either, but I wanted resolve that somehow before starting on the federated token formatter | 20:14 |
| lbragstad | dolphm: the old logic to determine if scope was included or not was not the best | 20:14 |
| lbragstad | dolphm: and I didn't want to drag that pattern to the federated formatter | 20:14 |
| dolphm | lbragstad: does one approach or the other impact federation? | 20:14 |
| dolphm | lbragstad: my thinking is that using None seems simpler in the short term, but two variants now might buy us something in the future? i just don't know what | 20:15 |
| *** amerine has quit IRC | 20:15 | |
| morganfainberg | dolphm, the cost of adding an additional formatter in the future is next to nil. | 20:16 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/161390 | 20:16 |
| lbragstad | dolphm: the only thing I can think of is that if we set scope to none, we'll have to do a type check on verify | 20:16 |
| morganfainberg | so, i'd erro on the side of keeping things as simple as possible. | 20:16 |
| morganfainberg | err* | 20:16 |
| *** lhcheng_afk is now known as lhcheng | 20:16 | |
| morganfainberg | but if a new one is justified, sure. | 20:16 |
| morganfainberg | the cost of removing the use of a formatter in the future is also next to nil. | 20:16 |
| morganfainberg | [we wont be able to actually remove the formatter, but we don't have to use it] | 20:17 |
| dolphm | i just noticed i still have a fork of keystone lite on my github account, everyone should enjoy the logo: https://github.com/dolph/keystone | 20:17 |
| morganfainberg | dolphm, i used to have one with the logo too! | 20:17 |
| stevemar | balloons! | 20:17 |
| lbragstad | I feel that logo predates me | 20:17 |
| bknudson | we should get shirts with that logo | 20:18 |
| lbragstad | the benefit of using a dedicated unscoped formatter is that on create we recognize the token is unscoped and on validation of that token we don't determining if there is a scope or not. | 20:19 |
| lbragstad | dolphm: ^ | 20:19 |
| dolphm | this predates me: https://github.com/juvvadi/keystone/tree/master/keystone | 20:19 |
| dolphm | there's a wadl file and an xsd dir | 20:19 |
| dolphm | bknudson: ++ | 20:20 |
| dolphm | lbragstad: does that benefit still exist if we move the version into the payload? | 20:20 |
| stevemar | ah simpler times | 20:21 |
| dstanek | lbragstad: did you push that review? | 20:21 |
| dolphm | the original implementation of auth_token: https://github.com/juvvadi/keystone/blob/master/keystone/middleware/remoteauth.py | 20:21 |
| lbragstad | it should, we'd just be making the distinction between unscoped and scoped in the token_formatter? | 20:21 |
| lbragstad | dstanek: https://review.openstack.org/#/c/161380/1 | 20:22 |
| dolphm | lbragstad: well then let's do 3 variants | 20:22 |
| dolphm | lbragstad: 0 is unscoped, right? | 20:23 |
| lbragstad | dolphm: F00 is scoped, F01 isunscoped, and F02 is trust scoped | 20:23 |
| lbragstad | but those can be changed | 20:23 |
| dolphm | lbragstad: i'd swap 00 and 01 for ocd reasons | 20:24 |
| morganfainberg | dolphm, ++ | 20:24 |
| lbragstad | dolphm: ok | 20:24 |
| morganfainberg | lbragstad, i'd -2000 that if i could unless they are swapped [for ocd reasons] | 20:24 |
| morganfainberg | >.> | 20:24 |
| lbragstad | morganfainberg: I think the indexing should start at 1 | 20:25 |
| *** _cjones_ has joined #openstack-keystone | 20:25 | |
| morganfainberg | lbragstad, don't make me hurt you :P | 20:25 |
| bknudson | we should use random numbers. | 20:25 |
| lbragstad | bknudson: ++ | 20:25 |
| bknudson | or letters... FUN | 20:25 |
| bknudson | FFD | 20:25 |
| bknudson | FSC | 20:25 |
| lbragstad | new token format FFS | 20:26 |
| lbragstad | .. perfect | 20:26 |
| morganfainberg | bknudson, base64.b64_encode(uuid.uuid4().bytes)[:-2] | 20:26 |
| morganfainberg | oh god | 20:27 |
| morganfainberg | dolphm, i just saw your tweet about [::-2] | 20:27 |
| morganfainberg | or whatever | 20:28 |
| morganfainberg | hah. | 20:28 |
| *** dims has quit IRC | 20:29 | |
| *** dims has joined #openstack-keystone | 20:29 | |
| *** chlong has joined #openstack-keystone | 20:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/161405 | 20:31 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 20:32 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 20:33 |
| stevemar | spammm | 20:33 |
| morganfainberg | stevemar, we should start using the deprecated_for_removal in keystone ;() | 20:36 |
| morganfainberg | ;) | 20:36 |
| stevemar | deprecate all of keystone? | 20:36 |
| morganfainberg | stevemar, yes! | 20:36 |
| stevemar | i'll be out of a job | 20:37 |
| dolphm | morganfainberg: source- https://github.com/openstack/keystone/blob/master/keystone/tests/unit/token/test_fernet_provider.py#L207-L212 | 20:38 |
| dstanek | stevemar: just tell uncle topol that you'll start working on the replacement | 20:38 |
| morganfainberg | dolphm, snicker | 20:38 |
| morganfainberg | yeah | 20:38 |
| morganfainberg | "hold my beer" ... really we got that into a commit? :P | 20:38 |
| stevemar | dstanek, it's depreated for *removal*, not for replacement :P | 20:38 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 20:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unscoped token formatter for Fernet tokens https://review.openstack.org/161379 | 20:40 |
| lbragstad | dstanek: ^ I pushed a new version of that patch set | 20:40 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Mirror domain entries to project table https://review.openstack.org/161408 | 20:40 |
| morganfainberg | lbragstad, so i have a nit... | 20:40 |
| morganfainberg | lbragstad, make the magic strings defined in 1 place, not in 2. 'F00' | 20:40 |
| bknudson | all tests that using mocking should say "hold my beer" | 20:41 |
| morganfainberg | lbragstad, you define both in the formatter class and in core.py | 20:41 |
| morganfainberg | lbragstad, as the global/const | 20:41 |
| lbragstad | bknudson: ++ | 20:41 |
| lbragstad | morganfainberg: fixing | 20:41 |
| dolphm | bknudson: +++ | 20:43 |
| *** elmiko has joined #openstack-keystone | 20:44 | |
| elmiko | lbragstad: mind if i bug you about a question with v3.Password object? | 20:45 |
| lbragstad | elmiko: go ahead, someone here should be able to help | 20:45 |
| elmiko | so, it looks like the v3.Password wants to have user_domain_name and project_domain_name supplied. will there be entries for those in the keystone_auth section of the config file for an admin user? | 20:46 |
| *** samueldmq_ has quit IRC | 20:47 | |
| elmiko | my issue is that in our project, sahara, we have always created keystone Client objects to work with. now i'm needing to create a Session object and looking at the examples i'm not sure how to properly handle those domains for the admin user. | 20:47 |
| dolphm | elmiko: good question... | 20:49 |
| elmiko | lol | 20:49 |
| elmiko | i really don't want to hard code 'Default' for those values | 20:49 |
| dolphm | where are the service user credential options defined now?! auth_token got butchered into little pieces last week | 20:49 |
| bknudson | elmiko: you should be able to use auth plugins... so it loads the config values from the config file. | 20:49 |
| morganfainberg | elmiko, so the keystone_auth (assuming this is the auth_token bit) section has a specific format that ksm will use, jamielennox|away has a blog on it... and we need to update the official docs | 20:49 |
| bknudson | there must be some docs somewhere... | 20:49 |
| bknudson | I think devstack sets it up for auth_token. | 20:49 |
| morganfainberg | consuming ksc for things *not* auth_token should not re-use the same options. | 20:50 |
| morganfainberg | auth_token options *may* change and break you. | 20:50 |
| bknudson | elmiko: http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/ | 20:50 |
| dolphm | bknudson: doesn't look like we support service users in non-default domains though? | 20:50 |
| morganfainberg | dolphm, we do. | 20:50 |
| dolphm | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L1033-L1043 | 20:50 |
| dolphm | morganfainberg: how? | 20:50 |
| morganfainberg | dolphm, sec. | 20:50 |
| dolphm | morganfainberg: oh right above my link i think | 20:51 |
| bknudson | dolphm: right before that: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L1025 | 20:51 |
| morganfainberg | dolphm, yeah | 20:51 |
| elmiko | bknudson: thanks | 20:51 |
| morganfainberg | elmiko, so if you're using keystone client for things not auth_token related, you should be defining your own options for it. | 20:51 |
| elmiko | we are using the keystonemiddleware auth stuff, i just didn't see anything about domains | 20:51 |
| dolphm | elmiko: so user_domain_name and project_domain_name would go into keystone_authtoken | 20:52 |
| dolphm | [keystone_authtoken] | 20:52 |
| morganfainberg | elmiko, ok but you're not doing what another project is doing, where they are consuming auth_token's options to talk to other services | 20:52 |
| morganfainberg | elmiko, you're just using those options to configure auth_token middleware | 20:52 |
| morganfainberg | correct? | 20:52 |
| bknudson | here's the devstack stuff: http://git.openstack.org/cgit/openstack-dev/devstack/tree/lib/keystone#n441 | 20:52 |
| elmiko | well, we also create admin Client objects to perform some options, like trust delegation | 20:52 |
| bknudson | iniset $conf_file $section auth_plugin password | 20:53 |
| morganfainberg | elmiko, don't re-use those options. | 20:53 |
| elmiko | but, i want to create barbicanclient Clients now. i think i need to use Session objects for that. | 20:53 |
| bknudson | so if you have a new section for your client auth config you can point to the same plugin. | 20:53 |
| morganfainberg | elmiko, define your own. because if you re-use those options, what happens is someone deploys auth_token in a new way, or we choose a new format and you break your core code. | 20:53 |
| bknudson | or the same plugin config options section | 20:53 |
| dolphm | morganfainberg: can i file a bug against keystonemiddleware to turn jamie's post into docs and assign it to jamie? | 20:54 |
| morganfainberg | dolphm, please do . | 20:54 |
| elmiko | yea, i mean, i can't add to the keystone_authtoken section. i'm concerned people won't like it if i start creating variables under DEFAULT for admin_domain and admin_project_domain | 20:54 |
| *** Bsony has joined #openstack-keystone | 20:55 | |
| bknudson | elmiko: you create a new section, just like keystone_authtoken is a section. | 20:55 |
| morganfainberg | elmiko, people can not like it all they want but relying on things being in the keystone_authtoken section is bad. we should probably socialized/fix all the projects to consume a separate file by default in devstack | 20:55 |
| morganfainberg | since projects can consume multiple conf files. | 20:55 |
| elmiko | fair | 20:55 |
| elmiko | thanks for the guidance everybody =) | 20:56 |
| morganfainberg | :) | 20:56 |
| bknudson | I think http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/ explains it pretty well. | 20:56 |
| openstackgerrit | Ben Nemec proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 20:56 |
| morganfainberg | dolphm, i might do the doc work if jamie doesn't.. but assign it to him first. | 20:56 |
| dolphm | morganfainberg: https://bugs.launchpad.net/keystonemiddleware/+bug/1428317 | 20:57 |
| openstack | Launchpad bug 1428317 in keystonemiddleware "Turn auth_token plugin config blog post into docs" [High,Triaged] - Assigned to Jamie Lennox (jamielennox) | 20:57 |
| morganfainberg | dolphm, ++ | 20:59 |
| *** Bsony has quit IRC | 20:59 | |
| *** raildo is now known as raildo_away | 21:00 | |
| dolphm | morganfainberg: and relatedly, https://bugs.launchpad.net/keystone/+bug/1428321 | 21:00 |
| openstack | Launchpad bug 1428321 in python-keystoneclient "Crosslink keystone documentation sites" [Wishlist,New] | 21:00 |
| morganfainberg | dolphm, yeah we need that. | 21:00 |
| * morganfainberg glances at stevemar, the resident sphinx expert... | 21:00 | |
| morganfainberg | [see what i did there?] | 21:00 |
| stevemar | morganfainberg, whos it whats it | 21:01 |
| stevemar | ohhh fancy | 21:02 |
| stevemar | maybe i'll tackle that one | 21:02 |
| stevemar | i have no idea how to do it | 21:02 |
| henrynash | ayoung: the test is in https://review.openstack.org/#/c/159675/ - that’s the patch that actually causes the config to be used (and is controller by a config switch)…see the test in test_backend.py | 21:02 |
| ayoung | henrynash, thanks | 21:02 |
| bknudson | we should be able to deprecate the auth options in auth_token (just use the plugin) | 21:06 |
| stevemar | thanks dstanek | 21:06 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Change headers to be byte string friendly https://review.openstack.org/161383 | 21:06 |
| ayoung | henrynash, so, on the .driver comment, the only reason to call the driver directly is if you need to skip overloaded behaviour in the manager's version of the function. You don;t have that.... | 21:06 |
| henrynash | ayoung: yeah…got it…..jsust removing that.... | 21:06 |
| ayoung | none of Brant's changes eem like stop-ship, excefpt for doc formatting... | 21:06 |
| ayoung | nothing else jumps out at me, | 21:06 |
| ayoung | ping me when you've got his changes made, and I;'ll give the final copy a once over | 21:07 |
| dolphm | stevemar: i'd just expect hard links, nothing fancy. each sphinx repo is independent | 21:07 |
| dolphm | stevemar: absolute* links | 21:07 |
| stevemar | dolphm, oh sure take away the fun | 21:07 |
| stevemar | dolphm, you thinking a small blurb at the top? | 21:08 |
| dolphm | stevemar: i'd just expect magic, nothing fancy. | 21:08 |
| dolphm | stevemar: yeah, probably. before Getting Started on http://docs.openstack.org/developer/keystone/ for example? | 21:08 |
| stevemar | dolphm, yeah, maybe a section entitled 'Related Projects' ? | 21:09 |
| dolphm | stevemar: could almost replace the sentence "Additional documentation on Keystone and other components of OpenStack can be found on the OpenStack wiki. " | 21:09 |
| stevemar | Associated/Related Identity Projects | 21:09 |
| stevemar | yeah, kill hte wiki with fire | 21:09 |
| bknudson | point to jamielennox|away's blog. | 21:09 |
| bknudson | and dolphm's twitter feed. | 21:10 |
| dolphm | stevemar: Additional Documentation? Additional Resources? | 21:10 |
| dolphm | bknudson: lol | 21:10 |
| stevemar | and the reference to the super old API link at the top | 21:10 |
| stevemar | gah! | 21:10 |
| stevemar | bknudson, oh sure leave out my twitter feed | 21:10 |
| bknudson | I need to get on twitter. | 21:11 |
| dolphm | stevemar: yeah, kill the API link too! (separate change?) | 21:12 |
| bknudson | there should be links to the developer docs on http://docs.openstack.org/developer/openstack-projects.html | 21:12 |
| dolphm | update* | 21:12 |
| bknudson | not sure where that page comes from | 21:12 |
| dolphm | bknudson: you mean from keystone? | 21:12 |
| bknudson | links to keystonemiddleware at least | 21:13 |
| *** Tahmina has joined #openstack-keystone | 21:13 | |
| bknudson | keystoneclient is on http://docs.openstack.org/developer/language-bindings.html | 21:13 |
| bknudson | but I don't see any links to keystonemiddleware developer docs. | 21:13 |
| bknudson | and now we've got extra keystoneclient libs... is there a link to them? | 21:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 21:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unscoped token formatter for Fernet tokens https://review.openstack.org/161379 | 21:15 |
| stevemar | bknudson, i was showing that page to someone yesterday, noticed it dind't have OSC either | 21:15 |
| stevemar | bknudson, i made a change to that... | 21:15 |
| lbragstad | dstanek: pushed a new version of the federated fernet patch ^ | 21:16 |
| lbragstad | dstanek: as well as the dependent patch, | 21:16 |
| lbragstad | incase you were doing anything to it | 21:16 |
| stevemar | bknudson, it's managed here: https://review.openstack.org/#/c/150907/ | 21:16 |
| stevemar | errr... you get the gist | 21:16 |
| elmiko | one more question about domains and the v3.Password, is 'Default' the proper default domain for users and projects, or is this highly installation dependent? | 21:16 |
| bknudson | stevemar: yep... I'll put it on my list o' things to do. | 21:17 |
| lbragstad | stevemar: easy one for you if you want to look it over | 21:17 |
| lbragstad | https://review.openstack.org/#/c/160959/ | 21:17 |
| dstanek | lbragstad: thx, i'll pull the latest | 21:17 |
| lbragstad | dstanek: anything sticking out that I'm doing wrong | 21:17 |
| lbragstad | ? | 21:17 |
| *** Tahmina has quit IRC | 21:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 21:21 |
| *** Tahmina has joined #openstack-keystone | 21:21 | |
| stevemar | lbragstad, dolphm beat me to it :( | 21:23 |
| lbragstad | stevemar: dolphm thanks! | 21:23 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 21:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 21:30 |
| ayoung | henrynash, looking | 21:30 |
| henrynash | ayoungL thx | 21:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 21:31 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 21:33 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 21:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 21:37 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 21:37 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 21:37 |
| stevemar | i just created my first cross repo dependency! | 21:38 |
| stevemar | how neat | 21:38 |
| dolphm | stevemar: you have an oddly low threshhold for entertainment value | 21:38 |
| stevemar | dolphm, maybe you just have an oddly high threshold for entertainment value | 21:39 |
| dolphm | stevemar: that's called "taste" | 21:39 |
| stevemar | dolphm, excuse me, mr hoity toity | 21:39 |
| *** samueldmq_ has joined #openstack-keystone | 21:41 | |
| bknudson | stevemar: tests won't run on the change until the other one is merged? | 21:42 |
| dolphm | bknudson: ?? | 21:43 |
| *** EmilienM|afk is now known as EmilienM | 21:43 | |
| bknudson | dolphm: stevemar: tests won't run on https://review.openstack.org/#/c/160407/ until https://review.openstack.org/#/c/161353/ is merged? | 21:43 |
| bknudson | dolphm: note that stevemar is a canadian... they think curling is entertaining. | 21:44 |
| *** zzzeek has quit IRC | 21:44 | |
| dolphm | bknudson: oh fancy! they finally implemented Depends-On? | 21:45 |
| bknudson | stevemar: now dolphm is excited. | 21:45 |
| dolphm | i've been asking for that for yyeaaaaarrrss | 21:46 |
| *** zzzeek has joined #openstack-keystone | 21:46 | |
| *** topol has quit IRC | 21:47 | |
| stevemar | dolphm, thats what i was exicted about! | 21:47 |
| stevemar | bknudson, i dunno what it does under the covers | 21:47 |
| dolphm | stevemar: i thought you meant linking documentation across repos! | 21:47 |
| stevemar | dolphm, pfft no | 21:48 |
| stevemar | bknudson, but it seems that way | 21:48 |
| dstanek | lbragstad: not really, you have a chicken/egg problem. you are wanting to do stuff in setup before things are actually setup | 21:49 |
| lbragstad | hmmm | 21:50 |
| stevemar | dolphm, can you take a look at https://review.openstack.org/#/c/161383/ | 21:50 |
| lbragstad | dstanek: so, do I have to setup federation stuff from scratch? | 21:50 |
| dstanek | lbragstad: i would. it's easier to consolidate than it is to split things apart | 21:51 |
| dstanek | lbragstad: with setUp the order of the code about the super() call in setUp matters as well as the ordering of the testcase's parents | 21:51 |
| lbragstad | dstanek: interesting | 21:52 |
| *** dhellmann has quit IRC | 21:52 | |
| *** leonchio_ has joined #openstack-keystone | 21:52 | |
| dstanek | lbragstad: in a couple of places you where expecting config_fixture to be there, but it wasn't created because the parent setUp hadn't gotten that far | 21:52 |
| *** leonchio_ has quit IRC | 21:52 | |
| *** Ephur_ has joined #openstack-keystone | 21:54 | |
| *** dhellmann has joined #openstack-keystone | 21:55 | |
| *** dhellmann has quit IRC | 21:56 | |
| *** Ephur has quit IRC | 21:57 | |
| *** dhellmann has joined #openstack-keystone | 21:57 | |
| *** harlowja has quit IRC | 21:58 | |
| *** stevemar2 has joined #openstack-keystone | 21:59 | |
| *** ChanServ sets mode: +v stevemar2 | 21:59 | |
| *** stevemar has quit IRC | 22:00 | |
| *** chlong has quit IRC | 22:12 | |
| *** iamjarvo has quit IRC | 22:13 | |
| *** jamielennox|away is now known as jamielennox | 22:14 | |
| openstackgerrit | Merged openstack/keystone: Cleanup docstrings in test_v3_federation.py https://review.openstack.org/160959 | 22:15 |
| *** radez is now known as radez_g0n3 | 22:15 | |
| *** joesavak has quit IRC | 22:17 | |
| *** iamjarvo has joined #openstack-keystone | 22:23 | |
| *** iamjarvo has quit IRC | 22:23 | |
| *** iamjarvo has joined #openstack-keystone | 22:24 | |
| *** kfox1111 has joined #openstack-keystone | 22:27 | |
| kfox1111 | Trying to put keystone behind a haproxy with ssl termination. | 22:27 |
| kfox1111 | some cases, its switching https urls to http ones. any idea how to fix? | 22:27 |
| *** harlowja has joined #openstack-keystone | 22:28 | |
| dstanek | kfox1111: what version are you using? | 22:29 |
| kfox1111 | juno. | 22:31 |
| kfox1111 | this it maybe: https://review.openstack.org/#/c/132235/ | 22:31 |
| *** Tahmina has quit IRC | 22:32 | |
| *** Tahmina has joined #openstack-keystone | 22:33 | |
| morganfainberg | dstanek, python MRO makes my head hurt sometimes... especially with multi-inheritance. | 22:36 |
| morganfainberg | dstanek, and even more so when we add in metaprogramming | 22:36 |
| dstanek | morganfainberg: yeah, our tests suck :-P | 22:37 |
| morganfainberg | dstanek, if only someone was fixing that | 22:37 |
| dstanek | kfox1111: yes, i believe that's the fix | 22:38 |
| *** mattfarina has quit IRC | 22:38 | |
| dstanek | morganfainberg: every time i get so far i hit a "oh crap" that has to be done first - feel overwhelmed every time i start it up again | 22:39 |
| dolphm | morganfainberg: i assume you run into some failures using fernet tokens without v2 support? | 22:39 |
| dolphm | ran* | 22:39 |
| morganfainberg | dolphm, some, but amazingly things kindof just worked overall | 22:39 |
| morganfainberg | in devstack that is | 22:40 |
| morganfainberg | dolphm, but the approach needs to be complete - because lots of people still rely on v2 :( | 22:40 |
| dolphm | morganfainberg: did you configure auth_token to hit v3? | 22:40 |
| bknudson | morganfainberg: do you have a devstack patch? | 22:40 |
| morganfainberg | dolphm, no. out of the box. | 22:40 |
| morganfainberg | dolphm, ksm *mostly* just did the right thing | 22:40 |
| bknudson | auth_token should default to none for the auth_versoin. | 22:40 |
| morganfainberg | bknudson, it did. | 22:40 |
| dolphm | so, v3? | 22:41 |
| dolphm | i thought we were still defaulting to v2 | 22:41 |
| kfox1111 | dstanek: yeah, it seems to work. :) | 22:41 |
| morganfainberg | dolphm, no, i'm fairly certain jamielennox fixed that a while back if it's not specified | 22:41 |
| kfox1111 | I'll mark it as backport potential. | 22:41 |
| jamielennox | hmm? | 22:41 |
| morganfainberg | jamielennox, auth_token using v3 for service accounts. | 22:42 |
| morganfainberg | and validating tokens | 22:42 |
| jamielennox | yea - but a couple of them have had to revert it | 22:42 |
| jamielennox | assuming you mean service users with v3 | 22:42 |
| dolphm | lbragstad: keystone-deploy uses a domain-based role assignment to provide for 'admin' - so it gets 401'd when it hits auth_token with a fernet token | 22:42 |
| dolphm | lbragstad: so now i'm wondering if we need to support domain-scoped tokens. | 22:42 |
| morganfainberg | jamielennox, yes, not "in a different domain" | 22:42 |
| morganfainberg | jamielennox, just using v3 itself. | 22:42 |
| jamielennox | validating with v3 (service user with v2 token) has been around for ages | 22:43 |
| bknudson | fernet should fallback to uuid if it doesn't support the token format. | 22:43 |
| morganfainberg | jamielennox, not with fernet tokens. fernet cannot be used for v2 atm | 22:43 |
| morganfainberg | bknudson, so... storing data in the db? | 22:43 |
| *** topol has joined #openstack-keystone | 22:44 | |
| morganfainberg | bknudson, i'd rather have the v2 tokens work than fallback. | 22:44 |
| bknudson | morganfainberg: it's better than not working at all. | 22:44 |
| *** ChanServ sets mode: +v topol | 22:44 | |
| morganfainberg | bknudson, to be fair, the SPF was granted with the requirement that all current token formats were supported | 22:44 |
| morganfainberg | bknudson, s/formats/use-cases | 22:44 |
| lbragstad | dolphm: I think we test domain scoped tokens https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_auth.py#L4083 | 22:44 |
| jamielennox | morganfainberg: why does auth_token care? or fernet care? | 22:44 |
| morganfainberg | jamielennox, just fernet doesn't support v2 tokens at all yet | 22:44 |
| dolphm | bknudson: that's an interesting approach though | 22:44 |
| jamielennox | my understanding was fernet would be more or less indistinguishable from uuid | 22:44 |
| dolphm | jamielennox: from the client perspective, yes | 22:45 |
| jamielennox | dolphm: right | 22:45 |
| dolphm | jamielennox: exact same flow & behaviors | 22:45 |
| morganfainberg | jamielennox, it will be. server just can't do v2 tokens yet thats all | 22:45 |
| jamielennox | so so long as the is_cms checks don't pick it up then auth_token doesn't care | 22:45 |
| lbragstad | dolphm: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_auth.py#L4252 | 22:45 |
| jamielennox | morganfainberg: yep - i don't know how you'll indicate that | 22:45 |
| morganfainberg | jamielennox, you don't you fix fernet ;) | 22:45 |
| dolphm | lbragstad: oh, i'm wrong. i'm actually getting *more* failures than i thought, so this is probably my fault | 22:46 |
| jamielennox | actually sure i do, if you use fernet tokens you _must_ set auth_version = 3 in [keysotne_authtoken] | 22:46 |
| lbragstad | dolphm: if it isn't, let me know. | 22:46 |
| morganfainberg | jamielennox, that isn't really viable. the token provider must support v2 tokens. it was a condition of the SPFE granted. | 22:46 |
| jamielennox | morganfainberg: i thought this was an 'experimental release | 22:47 |
| jamielennox | ' | 22:47 |
| jamielennox | auth_version = 3 seems reasonable for a prototype deployment | 22:47 |
| dolphm | lbragstad: will do | 22:47 |
| morganfainberg | jamielennox, it is. the SPFE requires it to support all token uses today. if it wasn't going to then it would have been pushed to liberty | 22:47 |
| jamielennox | morganfainberg: fair enough | 22:47 |
| morganfainberg | jamielennox, experimental means "we do everything we can to avoid changing things, but it could change with the right reasoning" aka "OMG THIS IS BROKEN" or an awful decision | 22:48 |
| henrynash | gyee, ayoung: if either of you are still about, perhpas you could see if you are still happy with: https://review.openstack.org/#/c/158679/ | 22:48 |
| morganfainberg | but experimental isn't meant to be "prototype, and not complete", especially if we grant a proposal freeze for it | 22:48 |
| jamielennox | morganfainberg: i'm sure the wording for fernet was way more hand wavy than that | 22:49 |
| morganfainberg | jamielennox, not when we granted the SPFE. "you will support all current use-cases for tokens" i think was the explicit condition for the exception | 22:49 |
| jamielennox | morganfainberg: ok | 22:49 |
| morganfainberg | jamielennox, so i expect the provider to support v2 tokens. | 22:50 |
| morganfainberg | when v2 is being deleted form the tree, in-tree providers can stop supporting that token version | 22:50 |
| *** bknudson has quit IRC | 22:50 | |
| *** henrynash has quit IRC | 22:51 | |
| dolphm | lbragstad: auth_token is getting 501's from keystone and returning 401's to the client | 22:51 |
| lbragstad | dolphm: are you calling something with v2.0? | 22:51 |
| dolphm | lbragstad: not that i'm aware of | 22:52 |
| dolphm | lbragstad: i have auth_token explicitly configured for v3 | 22:52 |
| morganfainberg | dolphm, to be fair, when i tested i used the current v2.0 patch. | 22:52 |
| morganfainberg | dolphm, in devstack (the one that needs to be updated/fixed) | 22:52 |
| dolphm | morganfainberg: oh | 22:52 |
| morganfainberg | it mostly just worked. | 22:52 |
| lbragstad | fyi jorge_munoz should be sending up a patch soon | 22:52 |
| lbragstad | cc dolphm morganfainberg ^ | 22:52 |
| jorge_munoz | I would not use soon. | 22:53 |
| morganfainberg | i never bothered to fully test devstack against fernet w/o v2 support patch. it's not really in-scope since we claim v2.0 is still supported (much to our chagrin) | 22:53 |
| *** timcline has quit IRC | 22:54 | |
| morganfainberg | when we start making expirimental jobs with gate running w/o v2 enabled... i think we will see how many gaps we still have. | 22:54 |
| morganfainberg | jorge_munoz, what timeframe is "not soon"? | 22:55 |
| morganfainberg | because if you use blizzard's "soon™" that could be years. | 22:55 |
| *** browne has quit IRC | 22:55 | |
| morganfainberg | *shiftyeyes* | 22:55 |
| dolphm | morganfainberg: i'd like to have that job running ASAP | 22:57 |
| morganfainberg | dolphm, the fernet one or the v3-only one? | 22:57 |
| dolphm | morganfainberg: v3-only | 22:57 |
| morganfainberg | dolphm, because i was going to co-opt the eventlet job for fernet to start, and then flip them liberty if we are happy w/ fernet | 22:57 |
| *** browne has joined #openstack-keystone | 22:58 | |
| morganfainberg | sure. i'll see about making devstack able to do that. | 22:58 |
| dolphm | morganfainberg: i'd rather have v3-only than a fernet job, frankly | 22:58 |
| morganfainberg | then we can do expirimental. | 22:58 |
| morganfainberg | dolphm, we need both. | 22:58 |
| dolphm | that's just my preference on priorities | 22:58 |
| jorge_munoz | morganfainberg: Well it depends, if this patch is meant more of a POC then the acutal implmentation then sometime time tomorrow. If its what we expect the final implementaion with full test coverage then it will require more time. | 22:58 |
| dolphm | if i had to choose one | 22:59 |
| morganfainberg | dolphm, the v3-only is actually lower on my priorities | 22:59 |
| morganfainberg | dolphm, only because i know it's massively broken. before liberty, yes, before testing fernet, no | 22:59 |
| morganfainberg | jorge_munoz, so because i am trying to make sure everything is in line for kilo-3, what is a general estimation to get it working? i'm just tyring to get a feel for "is it this week", is it next week? is it K3? is this happening in kilo at all? | 23:02 |
| morganfainberg | and i don't mean "POC"-not-really-ready. | 23:03 |
| lbragstad | morganfainberg: I think the majority of it is the translation of v3 to v2 | 23:04 |
| jorge_munoz | morganfainberg: I think I can get something this week, but for sure next week. | 23:07 |
| lbragstad | jorge_munoz: would you be able to post something to at least get eyes on it? | 23:07 |
| morganfainberg | jorge_munoz, ok sounds good. if you're short on test coverage but have most of the code, feel free to post it WIP | 23:07 |
| dolphm | jorge_munoz: put whatever you have up at the end of today as a WIP so we can start talking about it | 23:08 |
| *** gordc has quit IRC | 23:09 | |
| jorge_munoz | morganfainberg: dolphm ok | 23:10 |
| elmiko | hey folks, quick question about Session objects. want to make sure i understand this, if i create a Session based on a Password, that Session will be good for as long as i need to keep it around and it will only authenticate as needed? | 23:11 |
| dolphm | jamielennox: ^ | 23:12 |
| dolphm | elmiko: yep! | 23:12 |
| elmiko | dolphm: cool, thanks | 23:13 |
| elmiko | and jamielennox, your blog posts have been very insightful. thanks =) | 23:13 |
| jamielennox | elmiko: glad they're useful | 23:13 |
| elmiko | totally | 23:13 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 23:14 |
| *** david-lyle has quit IRC | 23:16 | |
| *** david-lyle has joined #openstack-keystone | 23:16 | |
| *** ljfisher has quit IRC | 23:21 | |
| dolphm | cool ^ | 23:22 |
| *** david-lyle has quit IRC | 23:29 | |
| *** gokrokve has joined #openstack-keystone | 23:31 | |
| *** gokrokve has quit IRC | 23:32 | |
| *** henrynash has joined #openstack-keystone | 23:33 | |
| *** ChanServ sets mode: +v henrynash | 23:33 | |
| *** david-lyle has joined #openstack-keystone | 23:34 | |
| *** iamjarvo has quit IRC | 23:35 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update developer docs landing page https://review.openstack.org/161475 | 23:35 |
| *** stevemar2 is now known as stevemar | 23:38 | |
| *** chlong has joined #openstack-keystone | 23:42 | |
| *** chlong has quit IRC | 23:46 | |
| *** chlong has joined #openstack-keystone | 23:46 | |
| *** topol has quit IRC | 23:52 | |
| *** bknudson has joined #openstack-keystone | 23:52 | |
| *** ChanServ sets mode: +v bknudson | 23:52 | |
| *** EmilienM is now known as EmilienM|afk | 23:56 | |
| *** Tahmina has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!