| *** joesavak has joined #openstack-keystone | 00:01 | |
| *** samueldmq_ has quit IRC | 00:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Crosslink to other sites that are owned by Keystone https://review.openstack.org/161490 | 00:03 |
|---|---|---|
| *** markvoelker has quit IRC | 00:07 | |
| *** jorge_munoz has quit IRC | 00:15 | |
| *** r-daneel has quit IRC | 00:15 | |
| *** thedodd has quit IRC | 00:16 | |
| jamielennox | how is tokenless auth going to work with X-Service-Token? | 00:19 |
| jamielennox | gyee: ^ | 00:20 |
| jamielennox | Sam Leong: ^ (what's his nick?) | 00:20 |
| gyee | jamielennox, you mean dual token approach? | 00:21 |
| gyee | tokenless is not designed for that use case | 00:22 |
| jamielennox | gyee: right, swift and others now are using a service-token to identify where the request came from | 00:22 |
| gyee | service-token is very specific | 00:23 |
| jamielennox | gyee: i assume it's largely designed for auth_token middleware though? | 00:23 |
| gyee | afaik, they are for glance to swift interaction where the account is jointly owned | 00:23 |
| gyee | jamelennox, right, for services talking to keystone | 00:24 |
| jamielennox | gyee: ok, i just know that there are other services looking to adopt the X-Service-Token approach and we've talked about doing policy on X-Service-Token | 00:24 |
| gyee | but the joined ownership is a very specific use case | 00:24 |
| jamielennox | if it's not going to work in all situations that's fine | 00:25 |
| jamielennox | gyee: kind of | 00:25 |
| jamielennox | gyee: specific cases, but the tokens are sent always | 00:25 |
| jamielennox | gyee: also; https://review.openstack.org/#/c/141614 | 00:26 |
| jamielennox | if it won't work in all situations that's fine - and what i assumed, was just wondering if you'd thought about it | 00:26 |
| gyee | I have | 00:27 |
| gyee | but I can't think of other use cases for X-Service-Token | 00:27 |
| gyee | wth? we always going to send service token? | 00:33 |
| gyee | why? | 00:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update developer docs landing page https://review.openstack.org/161475 | 00:35 |
| gyee | jamielennox, I think it should be optional instead of always sending it | 00:35 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Crosslink to other sites that are owned by Keystone https://review.openstack.org/161490 | 00:35 |
| jamielennox | gyee: that was the plan | 00:38 |
| kfox1111 | ok. just updated my cloud to have public stuff on a public ip and private stuf on a private network. compute nodes have no access to public ip's. | 00:39 |
| gyee | jamielennox, but the code doesn't seem reflect that | 00:39 |
| kfox1111 | mostly just works. but cinder attachments are not working. | 00:39 |
| jamielennox | gyee: we discussed going this way at a previous summit | 00:39 |
| kfox1111 | the compute node's trying to access the public api. any way to force it? | 00:39 |
| *** stevemar has quit IRC | 00:39 | |
| jamielennox | gyee: what i want to do for example is remove the need for the user that nova talks to neutron with to need admin rights | 00:39 |
| jamielennox | gyee: there are commands that are not supposed to be called by a user, they are for service to service use but on behalf of a user | 00:40 |
| jamielennox | gyee: i want to be able to write policy files that say this user called this command - but it came via nova and so it's ok | 00:40 |
| jamielennox | not: is_admin | 00:40 |
| gyee | jamielennox, but isn't what OAUTH is for? | 00:40 |
| jamielennox | gyee: not afaik | 00:40 |
| jamielennox | it's not a permission that the user has that it can delegate | 00:40 |
| jamielennox | its a combination thing | 00:41 |
| jamielennox | this service is allowed to perform this operation, but only on behalf of this user | 00:41 |
| jamielennox | probably user=owner | 00:41 |
| *** devlaps has quit IRC | 00:41 | |
| gyee | I thought x-service-token is designed for joined ownership, not for delegation | 00:42 |
| gyee | neither party owns it outright, access must be done in a joined manner | 00:42 |
| jamielennox | gyee: it's not delegation | 00:42 |
| jamielennox | that's not delegation | 00:42 |
| kfox1111 | cinder_catalog_info='volume:cinder:internalURL' looks like it might do the trick... | 00:42 |
| jamielennox | so barbican is going to need similar things | 00:43 |
| *** david-lyle has quit IRC | 00:43 | |
| gyee | jamielennox, I thought the only use case is glance uses swift backend | 00:43 |
| gyee | no, barbican is going with ACL model right? | 00:43 |
| jamielennox | gyee: they will have the same problem | 00:43 |
| gyee | at least that's what I heard | 00:43 |
| jamielennox | gyee: volume encryption keys will be glance/user | 00:44 |
| jamielennox | they are doing a per-secret ACL, i don't konw yet how they will configure it | 00:44 |
| gyee | you mean like split key encryption? | 00:44 |
| jamielennox | gyee: regarding ACL or volume encryption? | 00:45 |
| jamielennox | gyee: i don't think split key for either | 00:45 |
| gyee | for volume encryption | 00:45 |
| jamielennox | gyee: i just mean that the key should only be accessed by user and glance, not glance alone, and probably not user alone | 00:45 |
| jamielennox | though user is probably ok for that | 00:46 |
| gyee | ok, I need to check with them, I am now aware of the dual ownership model in Barbican | 00:46 |
| jamielennox | gyee: another thing i want it to do is make binding work | 00:47 |
| jamielennox | gyee: if you always submit an X-Service-Token then we can enforce binding only on that and all of a sudden it's feasable | 00:47 |
| gyee | interesting angle | 00:48 |
| gyee | so we bind a user token to a service? | 00:49 |
| jamielennox | gyee: no, not token to token | 00:50 |
| jamielennox | so binding doens't work because services reuse the user token | 00:50 |
| jamielennox | If X-Service-Token is set then this is the service from which the current request originated | 00:51 |
| jamielennox | so the binding on that token should be valid | 00:51 |
| jamielennox | If X-Service-Token is not set then this request came from a user and the binding on X-Auth-Token should be valid | 00:51 |
| jamielennox | then it's up to policy to determine what the combination of X-Auth-Token and X-Service-Token can do once that is validated | 00:52 |
| jamielennox | as assumedly the binding on X-Auth-Token was validated by the service that received the first user request | 00:52 |
| gyee | make sense | 00:53 |
| gyee | but always sending service token seem overkill | 00:54 |
| gyee | it should be optional | 00:54 |
| jamielennox | gyee: sure, if get_token() returns None it just won't include it | 00:57 |
| jamielennox | or that's the plan anyway | 00:57 |
| jamielennox | assumedly the X509 plugin would not set an X-Auth-Token | 00:57 |
| *** joesavak has quit IRC | 00:57 | |
| gyee | correct | 00:57 |
| gyee | or a no-op plugin :) | 00:58 |
| jamielennox | gyee: but i want in future an X509 auth that acutally gets a token | 00:58 |
| gyee | jamielennox, yes, it will work with the existing mapped auth plugin | 01:00 |
| gyee | x509 works just like federation | 01:00 |
| jamielennox | gyee: yep | 01:00 |
| gyee | attributes comes in from the request env, and we just need to set a mapping for it | 01:00 |
| jamielennox | gyee: we should probably try and make kerberos work that way as well? | 01:01 |
| gyee | oh absolutely | 01:01 |
| gyee | it is designed to be generic | 01:01 |
| gyee | and remote_user | 01:01 |
| bknudson | and HTTP basic auth | 01:01 |
| gyee | yes! | 01:01 |
| jamielennox | and keystone auth | 01:01 |
| gyee | basically anything that can be validated by apache mods | 01:01 |
| gyee | lots of possibilities | 01:02 |
| jamielennox | bknudson, gyee: so do you have any thoughts on the best way to make auth_token middleware accept regular options and other conf files? | 01:03 |
| *** henrynash has quit IRC | 01:03 | |
| jamielennox | i thought i could make a sublcass that took every option as a kwarg and then had a load_from_conf that converted it | 01:03 |
| jamielennox | it's kinda ugly, and at least regarding plugins it doesn't get us anything | 01:03 |
| bknudson | jamielennox: what do you mean? | 01:04 |
| bknudson | an auth_token middleware that takes options as arguments? | 01:04 |
| jamielennox | bknudson: right so extract a subclass of AuthProtocol which i'd called AuthToken | 01:05 |
| jamielennox | AuthToken knows nothing about CONF, it just takes kwargs | 01:05 |
| bknudson | then AuthProtocol reads its conf and creates AuthToken using the options? | 01:05 |
| jamielennox | we could do AuthToken.load_from_conf that converted all those options to kwargs or something similar | 01:06 |
| bknudson | I don't think a subclass is needed? | 01:06 |
| jamielennox | bknudson: well AuthProtocol.__init__ is a public method | 01:06 |
| jamielennox | and people do use it | 01:06 |
| jamielennox | annoyingly | 01:06 |
| jamielennox | the cases i know we need to solve are: | 01:07 |
| jamielennox | - swift, which doesn't use oslo.config and will load it all via paste | 01:07 |
| jamielennox | - zaqar, which uses oslo.config, but not the global one so needs to pass it in | 01:07 |
| jamielennox | - sahara, and other new ones that don't use paste | 01:08 |
| bknudson | you can already pass in app and conf to AuthProtocol. | 01:08 |
| gyee | make them pass the conf object in from the req env | 01:08 |
| jamielennox | - and at least one i've seen (and don't remember) that specifies the options manually | 01:08 |
| *** markvoelker has joined #openstack-keystone | 01:08 | |
| gyee | like the log object | 01:08 |
| gyee | that's how Swift prefer to do it anyway | 01:08 |
| *** kfox1111 has quit IRC | 01:09 | |
| gyee | that way, the can use oslo.conf or some_3rd_party.conf | 01:09 |
| jamielennox | sure, so swift uses paste | 01:09 |
| jamielennox | and we've covered a bunch of that already, i was just laying out the cases to see how they can fit together | 01:10 |
| jamielennox | ie not have to duplicate everything between a load_from_conf and a load_from_kwargs and load_from_conf_and_overrides | 01:10 |
| gyee | first look for conf object in the env, then global conf, then local conf | 01:10 |
| jamielennox | gyee: swift has neither | 01:11 |
| gyee | then they'll have to pass a conf object | 01:11 |
| jamielennox | gyee: swift does not have a dependency on oslo.config | 01:11 |
| jamielennox | (it kinda does because it depends on auth_token - but directly) | 01:12 |
| bknudson | I was just going to say auth_token has a dependency on oslo.config. | 01:12 |
| gyee | so they'll get it for freee | 01:12 |
| bknudson | so why can't they pass in a conf to AuthProtocol? | 01:13 |
| *** markvoelker has quit IRC | 01:13 | |
| jamielennox | it actually works out worse for them because there are default values in the global conf object | 01:13 |
| jamielennox | bknudson: they can, we just only supported loading auth plugins from config files | 01:13 |
| bknudson | support loading auth plugins from somewhere else. | 01:13 |
| jamielennox | bknudson: right | 01:15 |
| bknudson | I can't even find this code anymore. | 01:15 |
| jamielennox | this the easy way, auth_plugin.load_with_getter or something | 01:15 |
| gyee | like make them pass auth plugins via the env? | 01:15 |
| *** markvoelker has joined #openstack-keystone | 01:15 | |
| bknudson | auth_plugin = auth.load_from_conf_options(CONF, _base.AUTHTOKEN_GROUP) | 01:16 |
| bknudson | so that's using the global CONF | 01:16 |
| bknudson | and we need them to be able to pass their own CONF | 01:16 |
| jamielennox | gyee: i don't think so, i don't want other people creating plugins because the options will change | 01:17 |
| bknudson | question is does that CONF have to be oslo.config | 01:17 |
| *** zzzeek has quit IRC | 01:17 | |
| bknudson | or could it just be a dict that's built correctly | 01:17 |
| jamielennox | bknudson: right well that was getting around the fact that there is an auth.load_from_conf_options and it would be ugly to do a auth.load_with_getter(self._conf_get) | 01:17 |
| jamielennox | and we didn't know it was so widely used | 01:18 |
| bknudson | if it quacks like a duck. | 01:18 |
| gyee | quack, quack | 01:19 |
| jamielennox | bknudson: ages ago i wrote https://review.openstack.org/#/c/115565/6 and https://review.openstack.org/#/c/143423/ | 01:19 |
| jamielennox | the intention being that we could do like | 01:20 |
| jamielennox | new_config = CfgFilter(old_config) | 01:20 |
| jamielennox | new_config.set_overrides(paste_options) | 01:20 |
| bknudson | it's just about to merge! | 01:20 |
| *** markvoelker has quit IRC | 01:20 | |
| jamielennox | bknudson: they just released an oslo.config i saw though | 01:20 |
| bknudson | they release a new oslo.config every week. | 01:20 |
| jamielennox | so you could set overrides on a different config object without afecting the global | 01:21 |
| jamielennox | so i guess maybe we might need that after all | 01:21 |
| *** tqtran has quit IRC | 01:21 | |
| bknudson | val = conf[group][opt.dest] | 01:21 |
| bknudson | If you've got a dict with the right values you should be fine. | 01:22 |
| bknudson | that's in load_from_conf_options | 01:22 |
| jamielennox | conf gets sanitized on the way in though | 01:22 |
| bknudson | you mean the regular conf to auth_token? | 01:23 |
| jamielennox | oh, no the overrides get sanitized the base CONF doesn't | 01:23 |
| jamielennox | maybe i just handle a regular auth.load_from_options | 01:24 |
| bknudson | if they're passing in a conf we can also have an option on it that tells AuthProtocol to not mess with it. | 01:24 |
| jamielennox | it wouldn't handle the case where you had some options in CONF and some in overrides but i don't think anyone would | 01:25 |
| bknudson | they could pass in a conf with a .auth_plugins_conf or something... do whatever you want. | 01:26 |
| jamielennox | there's already auth.get_plugin_class to get the class, then i could do klass.load_from_options(self._conf) | 01:27 |
| jamielennox | ah, no it will throw an error if it gets options it doesn't recognize | 01:27 |
| *** jorge_munoz has joined #openstack-keystone | 01:27 | |
| *** jorge_munoz has quit IRC | 01:28 | |
| bknudson | where will it throw the error? | 01:28 |
| jamielennox | load_from_options is just cls(**kwargs) | 01:29 |
| jamielennox | so if you pass like cache_dir and other stuff from paste it would get passed to the auth plugin creation | 01:29 |
| *** davechen has joined #openstack-keystone | 01:30 | |
| bknudson | load_from_conf_options just needs a conf that works like a dict of dict. | 01:30 |
| jamielennox | bknudson: sure, but if i'm going to do that i could do it manually | 01:31 |
| mfisch | jamielennox: is that puppet chaneg you made just a drop-in? | 01:31 |
| jamielennox | do klass = auth.get_plugin_class() | 01:32 |
| jamielennox | mfisch: yea, it should work fine | 01:32 |
| mfisch | jamielennox: awesome, can you fix puppet-keystone too ;) thats my last deprecation... | 01:32 |
| mfisch | or I can just copy this | 01:32 |
| jamielennox | mfisch: i've no real idea how to test it end to end, but i need the same change made on a system deployed with those modules | 01:33 |
| jamielennox | mfisch: it shouldn't be in puppet-keystone | 01:33 |
| mfisch | maybe I'm thinking of something else | 01:33 |
| jamielennox | mfisch: yea, you can't deploy auth_token in front of keystone because it needs a keystone to talk to | 01:34 |
| mfisch | jamielennox: this is what I'm thinking of | 01:35 |
| mfisch | 2014-08-05 07:02:09.608 1894 WARNING keystone.openstack.common.versionutils [-] Deprecated: keystone.middleware.core.XmlBodyMiddleware is deprecated as of Icehouse in favor of support for "application/json" only and may be removed in K. | 01:35 |
| jamielennox | oh | 01:35 |
| mfisch | +2 on your puppet stuff | 01:35 |
| jamielennox | mfisch: i'd probably leave that one for now | 01:35 |
| jamielennox | mfisch: that removes XML from keysotne | 01:35 |
| mfisch | can we make a special deprecations flag that says "Jamie says no worries" | 01:35 |
| jamielennox | like the whole XML apis | 01:35 |
| mfisch | yeah someone might want that | 01:35 |
| mfisch | not sure who but someone | 01:36 |
| jamielennox | mfisch: god i hope not | 01:36 |
| mfisch | some .net developer somewhere ;) | 01:36 |
| *** gyee has quit IRC | 01:36 | |
| jamielennox | well they obviously love the pain anyway | 01:36 |
| mfisch | jamielennox: I've been working on your auth_uri change in puppet along with dan prince | 01:37 |
| mfisch | mostly cleaned up now | 01:37 |
| jamielennox | mfisch: i'm going to change it on you again real soon :p | 01:37 |
| mfisch | Thats the viscious cycle | 01:38 |
| jamielennox | i've no idea how puppet is going to handle auth plugins | 01:38 |
| mfisch | we file bugs, you deprecate in retaliation | 01:38 |
| jamielennox | mfisch: actually have you seen the auth plugins in auth_token middleware stuff yet? | 01:38 |
| mfisch | dont think so | 01:38 |
| jamielennox | because you might know how puppet will handle it | 01:39 |
| jamielennox | mfisch: http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ | 01:39 |
| *** Akshik has joined #openstack-keystone | 01:39 | |
| jamielennox | bknudson: anyway - i can always do a manual klass.get_options and grab those options out of self._conf_get and then load via klass.load_from_options | 01:41 |
| mfisch | jamielennox: I've honestly not looked into that at all but am happy to discuss the puppet side with you | 01:41 |
| mfisch | after dinner and what not here | 01:41 |
| mfisch | in fact I need to look into what puppet needs to do for Keystone Light tokens | 01:42 |
| jamielennox | bknudson: it's just this is so far auth_token is one of the primary use cases for these loaders and it's stupid i can't use the basic loaders | 01:42 |
| jamielennox | bknudson: but it should be backwards compatible so i'll give it a go | 01:42 |
| jamielennox | mfisch: great, whenever you like - it's not ready for all the service yet so i'm not pushing it for puppet yet | 01:42 |
| jamielennox | mfisch: i'm just not sure how it would be configured when you can drop in any auth credentials at all - does puppet just need to pick a default? | 01:43 |
| *** dims has quit IRC | 01:43 | |
| wanghong | Morning. One question: does our identity ldap driver support windows server 2008 R2 AD? | 01:43 |
| mfisch | jamielennox: a default or we can force people to make a choice, no default... | 01:44 |
| bknudson | wanghong: since there's no gate test for it, no. | 01:44 |
| jamielennox | mfisch: i think in 90% the password plugin is going to be correct, but if you want something different you don't want it continually being reset | 01:45 |
| wanghong | bknudson, do we have doc that shows which ldap servers that we support? | 01:45 |
| bknudson | wanghong: I've never seen a doc that says which ldap servers are supported. | 01:46 |
| bknudson | and there are no gate tests for any ldap server as far as I know. | 01:46 |
| lbragstad | marekd: around? | 01:46 |
| morganfainberg | lbragstad, my guess is it's super late for marekd right now. | 01:46 |
| bknudson | maybe when we get the in-tree functional testing going we can gate on OpenLDAP | 01:47 |
| lbragstad | morganfainberg: he's about 7ish hours ahead? | 01:47 |
| mfisch | jamielennox: we'd generally try to match what ubuntu/rh shipped as defaults there per platform and let people override | 01:47 |
| jamielennox | mfisch: makes sense | 01:47 |
| lbragstad | mfisch: for fernet tokens, you should just have to switch the provider to keystone.token.providers.fernet.Provider and set up the key repository | 01:48 |
| mfisch | yeah there will the keystone manage piece, no other options though? | 01:48 |
| lbragstad | mfisch: no other options for setting up keys? | 01:49 |
| morganfainberg | lbragstad, i think so.. | 01:49 |
| wanghong | bknudson, thanks. I searched on google, it seams that we support it. But, we don't have gate tests, so we can't say "yes"... | 01:50 |
| bknudson | wanghong: what LDAP servers are supported? | 01:50 |
| mfisch | I'll probably work on frenet stuff after the ops conf, thanks for the info lbragstad | 01:50 |
| wanghong | bknudson, windows server 2008 R2 AD | 01:50 |
| lbragstad | mfisch: no problem | 01:51 |
| *** jamielennox is now known as jamielennox|lunc | 01:51 | |
| bknudson | wanghong: where does it say that? | 01:51 |
| *** jaosorior has quit IRC | 01:52 | |
| wanghong | bknudson, I searched on google: keystone windows server 2008 R2 AD | 01:52 |
| bknudson | ok... I'm not seeing anything there that says that it's officially supported by OpenStack. | 01:53 |
| bknudson | mostly it's just facts about the keystone XL pipeline. | 01:54 |
| morganfainberg | bknudson, lol yeah. | 01:55 |
| bknudson | we need to buy that google adword. | 01:55 |
| morganfainberg | we support some AD versions... and some other LDAP servers depending on how crazy you get with the config mapping of LDAP things to keystone things | 01:55 |
| bknudson | if AD or LDAP was broken today we wouldn't know it. | 01:56 |
| morganfainberg | but for the most part if python-ldap can connect to it (with standard binds), we support it | 01:56 |
| morganfainberg | bknudson, no we wouldn't. | 01:56 |
| morganfainberg | i think i can setup a gate job now for it since we can just assume LDAP assignment is broken unless marekd and cern complain at us :P | 01:57 |
| bknudson | if MS wants us to support it they can provide some CI. | 01:57 |
| *** _cjones_ has quit IRC | 01:58 | |
| *** Akshik has quit IRC | 01:59 | |
| morganfainberg | bknudson, i need to circle up w/ the MS folks we are supposed to do that | 02:01 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove unnecessary import https://review.openstack.org/161541 | 02:04 |
| bknudson | easy one | 02:05 |
| openstackgerrit | wanghong proposed openstack/keystone: apply endpoint_group filters on token catalog https://review.openstack.org/144187 | 02:05 |
| *** iamjarvo has joined #openstack-keystone | 02:09 | |
| *** erkules_ has joined #openstack-keystone | 02:09 | |
| *** erkules has quit IRC | 02:12 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 02:12 |
| *** Akshik has joined #openstack-keystone | 02:13 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup test keeping unnecessary fixture references https://review.openstack.org/161544 | 02:15 |
| *** stevemar has joined #openstack-keystone | 02:16 | |
| *** ChanServ sets mode: +v stevemar | 02:16 | |
| *** markvoelker has joined #openstack-keystone | 02:16 | |
| *** andreaf_ has joined #openstack-keystone | 02:20 | |
| *** rwsu_ has joined #openstack-keystone | 02:20 | |
| *** andreaf has quit IRC | 02:21 | |
| *** nkinder has quit IRC | 02:21 | |
| *** rwsu has quit IRC | 02:21 | |
| *** chmouel has quit IRC | 02:21 | |
| *** andreaf_ is now known as andreaf | 02:21 | |
| *** markvoelker has quit IRC | 02:21 | |
| *** chmouel has joined #openstack-keystone | 02:22 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix typos in tests/unit/core.py https://review.openstack.org/161547 | 02:22 |
| *** ljfisher has joined #openstack-keystone | 02:23 | |
| *** nkinder has joined #openstack-keystone | 02:26 | |
| *** Akshik has quit IRC | 02:29 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 02:29 |
| *** davechen_ has joined #openstack-keystone | 02:32 | |
| *** david-lyle has joined #openstack-keystone | 02:33 | |
| *** rwsu_ is now known as rwsu-afk | 02:35 | |
| *** davechen has quit IRC | 02:35 | |
| *** dims has joined #openstack-keystone | 02:39 | |
| *** jamielennox|lunc is now known as jamielennox | 02:47 | |
| openstackgerrit | wanghong proposed openstack/keystone: add timestamp to project and role https://review.openstack.org/154370 | 02:48 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 02:52 |
| *** rm_work is now known as rm_work|away | 03:02 | |
| *** ChristyF has quit IRC | 03:03 | |
| *** david-lyle has quit IRC | 03:07 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update testing docs https://review.openstack.org/161553 | 03:08 |
| *** ljfisher has quit IRC | 03:16 | |
| *** markvoelker has joined #openstack-keystone | 03:17 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 03:19 |
| *** markvoelker has quit IRC | 03:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Return none for missing endpoints https://review.openstack.org/161558 | 03:26 |
| *** iamjarvo has quit IRC | 03:28 | |
| *** spandhe has quit IRC | 03:30 | |
| *** browne has quit IRC | 03:34 | |
| *** jamielennox is now known as jamielennox|away | 03:45 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:47 | |
| *** richm has quit IRC | 04:01 | |
| *** jamiec has quit IRC | 04:11 | |
| *** jamiec has joined #openstack-keystone | 04:15 | |
| *** markvoelker has joined #openstack-keystone | 04:19 | |
| *** dims has quit IRC | 04:22 | |
| *** markvoelker has quit IRC | 04:23 | |
| *** browne has joined #openstack-keystone | 04:27 | |
| *** mfisch has quit IRC | 04:32 | |
| *** mfisch has joined #openstack-keystone | 04:33 | |
| *** mfisch is now known as Guest63892 | 04:34 | |
| *** vishy has quit IRC | 04:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/161390 | 04:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/161576 | 04:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/161585 | 04:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/161586 | 04:57 |
| *** harlowja is now known as harlowja_away | 04:57 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/161587 | 04:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-federation: Updated from global requirements https://review.openstack.org/161588 | 04:57 |
| *** spandhe has joined #openstack-keystone | 05:07 | |
| *** ayoung has quit IRC | 05:11 | |
| *** stevemar has quit IRC | 05:13 | |
| *** spandhe_ has joined #openstack-keystone | 05:17 | |
| *** spandhe has quit IRC | 05:18 | |
| *** spandhe_ is now known as spandhe | 05:18 | |
| *** markvoelker has joined #openstack-keystone | 05:20 | |
| openstackgerrit | Merged openstack/keystone: fix import order in federation controller https://review.openstack.org/161375 | 05:20 |
| *** dims has joined #openstack-keystone | 05:23 | |
| *** Akshik has joined #openstack-keystone | 05:23 | |
| *** markvoelker has quit IRC | 05:25 | |
| *** dims has quit IRC | 05:28 | |
| openstackgerrit | Merged openstack/keystone: Change headers to be byte string friendly https://review.openstack.org/161383 | 05:48 |
| openstackgerrit | Merged openstack/keystone: Add support for whitelisting and partial domain configs https://review.openstack.org/158679 | 05:48 |
| *** iamjarvo has joined #openstack-keystone | 05:53 | |
| *** sluo_wfh has joined #openstack-keystone | 05:56 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 05:58 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/161606 | 06:03 |
| *** spandhe has quit IRC | 06:03 | |
| *** sluo_wfh has quit IRC | 06:04 | |
| *** sluo_wfh has joined #openstack-keystone | 06:14 | |
| *** iamjarvo has quit IRC | 06:20 | |
| *** iamjarvo has joined #openstack-keystone | 06:21 | |
| *** spandhe has joined #openstack-keystone | 06:22 | |
| *** markvoelker has joined #openstack-keystone | 06:22 | |
| *** markvoelker has quit IRC | 06:27 | |
| *** lhcheng has quit IRC | 06:37 | |
| *** iamjarvo has quit IRC | 06:43 | |
| *** Krast has joined #openstack-keystone | 06:51 | |
| *** stevemar has joined #openstack-keystone | 06:55 | |
| *** ChanServ sets mode: +v stevemar | 06:55 | |
| *** arunkant has quit IRC | 07:03 | |
| *** markvoelker has joined #openstack-keystone | 07:22 | |
| *** lhcheng has joined #openstack-keystone | 07:28 | |
| *** markvoelker has quit IRC | 07:28 | |
| *** spandhe has quit IRC | 07:32 | |
| marekd | morganfainberg: yeah, it was kind of late (in general, lbragstad adds +7h and morganfainberg +9 and there you have my local time :-) ) | 07:36 |
| *** openstackgerrit has quit IRC | 07:36 | |
| *** openstackgerrit has joined #openstack-keystone | 07:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the typo in `tests/unit/core.py` https://review.openstack.org/161634 | 07:39 |
| openstackgerrit | Merged openstack/keystone: Move install of cryptography before six https://review.openstack.org/161055 | 07:41 |
| *** Maike has joined #openstack-keystone | 07:51 | |
| Maike | Hey, I'm using Ubuntu14.04 and keystone from master branch. I cloned it yesterday and get the following error:"keystone TypeError: _get_value() takes exactly 4 arguments (5 given)" | 07:52 |
| Maike | is that a known problem? | 07:52 |
| marekd | Maike: and does it show where such error occurs (file, line, operation) ? | 07:52 |
| *** Akshik_ has joined #openstack-keystone | 07:52 | |
| *** Akshik has quit IRC | 07:54 | |
| Maike | marekd: 2015-03-04 14:50:44.608 | + mysql -uroot -pdevstack -h127.0.0.1 -e 'DROP DATABASE IF EXISTS keystone;' | 08:03 |
| Maike | 2015-03-04 14:50:44.635 | + mysql -uroot -pdevstack -h127.0.0.1 -e 'CREATE DATABASE keystone CHARACTER SET utf8;' | 08:03 |
| Maike | 2015-03-04 14:50:44.643 | + /opt/stack/keystone/bin/keystone-manage db_sync | 08:03 |
| Maike | 2015-03-04 14:50:45.391 | 28428 CRITICAL keystone [-] TypeError: _get_value() takes exactly 4 arguments (5 given) | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone Traceback (most recent call last): | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone File "/opt/stack/keystone/bin/keystone-manage", line 44, in <module> | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone cli.main(argv=sys.argv, config_files=config_files) | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/cli.py", line 310, in main | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone CONF.command.cmd_class.main() | 08:03 |
| Maike | 2015-03-04 14:50:45.392 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/cli.py", line 73, in main | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone migration_helpers.sync_database_to_version(extension, version) | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/common/sql/migration_helpers.py", line 204, in sync_database_to_version | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone _sync_common_repo(version) | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/common/sql/migration_helpers.py", line 157, in _sync_common_repo | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone engine = sql.get_engine() | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/common/sql/core.py", line 188, in get_engine | 08:04 |
| stevemar | next time use a paste site :) | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone return _get_engine_facade().get_engine() | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone File "/opt/stack/keystone/keystone/common/sql/core.py", line 176, in _get_engine_facade | 08:04 |
| marekd | Maike: please use something like paste.openstack.org for such things | 08:04 |
| Maike | 2015-03-04 14:50:45.393 | 28428 TRACE keystone _engine_facade = db_session.EngineFacade.from_config(CONF) | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone File "/usr/local/lib/python2.7/dist-packages/oslo_db/sqlalchemy/session.py", line 833, in from_config | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone return cls(sql_connection=conf.database.connection, | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone File "/usr/local/lib/python2.7/dist-packages/oslo_config/cfg.py", line 2502, in __getattr__ | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone return self._conf._get(name, self._group) | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone File "/usr/local/lib/python2.7/dist-packages/oslo_config/cfg.py", line 2224, in _get | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone value = self._do_get(name, group, namespace) | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone File "/usr/local/lib/python2.7/dist-packages/oslo_config/cfg.py", line 2261, in _do_get | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone return convert(opt._get_from_namespace(namespace, group_name)) | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone File "/usr/lib/python2.7/dist-packages/oslo/config/cfg.py", line 598, in _get_from_namespace | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone self._convert_value) | 08:04 |
| Maike | 2015-03-04 14:50:45.394 | 28428 TRACE keystone TypeError: _get_value() takes exactly 4 arguments (5 given) | 08:04 |
| Maike | it orrurs by running ./stack.sh (devstack) | 08:05 |
| Maike | sorry | 08:05 |
| stevemar | Maike, try updating oslo.config | 08:06 |
| marekd | ++ | 08:06 |
| *** Bsony has joined #openstack-keystone | 08:06 | |
| openstackgerrit | Marcos Fermín Lobo proposed openstack/keystone: Templated catalog backend not implemented https://review.openstack.org/120011 | 08:07 |
| Maike | stevemar: where can I find oslo.config? | 08:13 |
| stevemar | try `sudo pip install --upgrade oslo.policy` | 08:14 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/161390 | 08:15 |
| *** browne has quit IRC | 08:15 | |
| *** henrynash has joined #openstack-keystone | 08:16 | |
| *** ChanServ sets mode: +v henrynash | 08:16 | |
| openstackgerrit | Merged openstack/keystone: refactor: extract and document audit ID generation https://review.openstack.org/160980 | 08:20 |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/161586 | 08:21 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/161576 | 08:21 |
| *** henrynash has quit IRC | 08:21 | |
| *** henrynash has joined #openstack-keystone | 08:23 | |
| *** ChanServ sets mode: +v henrynash | 08:23 | |
| *** oguz has joined #openstack-keystone | 08:24 | |
| *** markvoelker has joined #openstack-keystone | 08:25 | |
| *** ogzy has quit IRC | 08:27 | |
| *** markvoelker has quit IRC | 08:29 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/161587 | 08:30 |
| *** Krast has quit IRC | 08:33 | |
| *** afazekas has joined #openstack-keystone | 08:33 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/161585 | 08:35 |
| *** jaosorior has joined #openstack-keystone | 08:46 | |
| *** cyeoh has quit IRC | 08:49 | |
| *** jistr has joined #openstack-keystone | 08:49 | |
| *** davechen_ has quit IRC | 08:53 | |
| *** Akshik_ has quit IRC | 08:55 | |
| *** karimb has joined #openstack-keystone | 09:00 | |
| *** dims has joined #openstack-keystone | 09:01 | |
| *** nellysmitt has joined #openstack-keystone | 09:03 | |
| *** stevemar has quit IRC | 09:03 | |
| *** stevemar has joined #openstack-keystone | 09:04 | |
| *** ChanServ sets mode: +v stevemar | 09:04 | |
| *** dims has quit IRC | 09:06 | |
| *** browne has joined #openstack-keystone | 09:14 | |
| *** Akshik has joined #openstack-keystone | 09:16 | |
| *** elmiko has quit IRC | 09:20 | |
| *** elmiko has joined #openstack-keystone | 09:20 | |
| *** Akshik has quit IRC | 09:25 | |
| *** Akshik has joined #openstack-keystone | 09:26 | |
| *** markvoelker has joined #openstack-keystone | 09:26 | |
| *** markvoelker has quit IRC | 09:31 | |
| *** lhcheng has quit IRC | 09:39 | |
| *** erkules_ is now known as erkules | 09:39 | |
| *** lhcheng has joined #openstack-keystone | 09:42 | |
| *** oguz_ has joined #openstack-keystone | 09:54 | |
| *** oguz has quit IRC | 09:57 | |
| *** lhcheng has quit IRC | 10:04 | |
| *** jlk has quit IRC | 10:06 | |
| *** browne has quit IRC | 10:11 | |
| *** sluo_wfh has quit IRC | 10:22 | |
| *** markvoelker has joined #openstack-keystone | 10:27 | |
| *** markvoelker has quit IRC | 10:31 | |
| openstackgerrit | Marcos Fermín Lobo proposed openstack/keystone: Templated catalog backend not implemented https://review.openstack.org/120011 | 10:32 |
| *** dstanek has quit IRC | 10:33 | |
| *** fmarco76 has joined #openstack-keystone | 10:37 | |
| samueldmq | morning | 10:43 |
| samueldmq | henrynash, hi - you around ? | 10:43 |
| henrynash | samueldmq: hi | 10:44 |
| samueldmq | henrynash, do we support driver_hints on ldap? I think we have added support for it in the last days :) | 10:44 |
| henrynash | samueldmq: yes, I added that…and it has merged….although we don’t support list limit | 10:45 |
| samueldmq | henrynash, but I can't find an example of its use, or where the method is placed (for sql it is in common/sql/core.py) | 10:45 |
| henrynash | (only filters) | 10:45 |
| samueldmq | henrynash, do you remember where the logic is placed? | 10:46 |
| samueldmq | for ldap .. | 10:46 |
| henrynash | common/ldap/core | 10:46 |
| samueldmq | henrynash, oh.. that was just my branch that needed a rebase :/ | 10:48 |
| samueldmq | henrynash, that's the reason I couldn't find the code :) | 10:48 |
| henrynash | no! | 10:48 |
| henrynash | np! | 10:48 |
| samueldmq | henrynash, thanks | 10:48 |
| henrynash | yw | 10:48 |
| *** aix has joined #openstack-keystone | 10:55 | |
| *** dims has joined #openstack-keystone | 10:55 | |
| openstackgerrit | Abhishek Talwar proposed openstack/python-keystoneclient: User-password-update accepts blank as password https://review.openstack.org/147399 | 11:02 |
| *** bjornar has joined #openstack-keystone | 11:25 | |
| *** Akshik has quit IRC | 11:26 | |
| *** stevemar has quit IRC | 11:28 | |
| *** markvoelker has joined #openstack-keystone | 11:28 | |
| *** markvoelker has quit IRC | 11:32 | |
| *** henrynash has quit IRC | 11:42 | |
| *** amakarov_away is now known as amakarov | 11:42 | |
| *** henrynash has joined #openstack-keystone | 11:45 | |
| *** ChanServ sets mode: +v henrynash | 11:45 | |
| *** henrynash has quit IRC | 11:51 | |
| *** oguz__ has joined #openstack-keystone | 12:02 | |
| *** oguz has joined #openstack-keystone | 12:04 | |
| *** EmilienM|afk is now known as EmilienM | 12:04 | |
| *** oguz_ has quit IRC | 12:05 | |
| *** oguz__ has quit IRC | 12:08 | |
| *** afazekas has quit IRC | 12:08 | |
| *** iamjarvo has joined #openstack-keystone | 12:10 | |
| *** afazekas has joined #openstack-keystone | 12:22 | |
| *** Maike_ has joined #openstack-keystone | 12:28 | |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| *** afazekas has quit IRC | 12:31 | |
| *** Maike has quit IRC | 12:31 | |
| *** markvoelker has quit IRC | 12:34 | |
| *** markvoelker has joined #openstack-keystone | 12:38 | |
| *** afazekas has joined #openstack-keystone | 12:43 | |
| *** ccard__ has quit IRC | 12:43 | |
| *** raildo_away is now known as raildo | 12:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in SQL/LDAP when honoring driver_hints https://review.openstack.org/158412 | 12:53 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug in SQL/LDAP when honoring driver_hints https://review.openstack.org/161702 | 12:54 |
| *** ccard__ has joined #openstack-keystone | 12:55 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: envlist option defaults to the list of all environments https://review.openstack.org/161705 | 13:07 |
| *** Bsony_ has joined #openstack-keystone | 13:24 | |
| *** Bsony has quit IRC | 13:26 | |
| *** henrynash has joined #openstack-keystone | 13:26 | |
| *** ChanServ sets mode: +v henrynash | 13:26 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: envlist option defaults to the list of all environments https://review.openstack.org/161705 | 13:31 |
| *** gordc has joined #openstack-keystone | 13:33 | |
| *** aix has quit IRC | 13:34 | |
| *** joesavak has joined #openstack-keystone | 13:42 | |
| *** dstanek has joined #openstack-keystone | 13:45 | |
| *** ChanServ sets mode: +v dstanek | 13:45 | |
| *** dims has quit IRC | 13:51 | |
| *** dims has joined #openstack-keystone | 13:52 | |
| *** karimb has quit IRC | 13:53 | |
| *** jsavak has joined #openstack-keystone | 13:53 | |
| *** ljfisher has joined #openstack-keystone | 13:54 | |
| *** joesavak has quit IRC | 13:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add checking for existing group/option to update domain config https://review.openstack.org/161718 | 14:00 |
| *** aix has joined #openstack-keystone | 14:02 | |
| *** ayoung has joined #openstack-keystone | 14:02 | |
| *** ChanServ sets mode: +v ayoung | 14:02 | |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 14:03 |
| openstackgerrit | Marco Fargetta proposed openstack/keystone: Adding utf8 to federations tables https://review.openstack.org/159803 | 14:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add checking for existing group/option to update domain config https://review.openstack.org/161718 | 14:03 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add checking for existing group/option to update domain config https://review.openstack.org/161718 | 14:05 |
| *** iamjarvo has quit IRC | 14:07 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 14:08 |
| *** richm has joined #openstack-keystone | 14:14 | |
| *** henrynash has quit IRC | 14:17 | |
| *** radez_g0n3 is now known as radez | 14:18 | |
| *** karimb has joined #openstack-keystone | 14:24 | |
| *** oguz is now known as ogzy | 14:28 | |
| *** ogzy has joined #openstack-keystone | 14:28 | |
| *** zzzeek has joined #openstack-keystone | 14:29 | |
| *** mattfarina has joined #openstack-keystone | 14:35 | |
| *** henrynash has joined #openstack-keystone | 14:35 | |
| *** ChanServ sets mode: +v henrynash | 14:35 | |
| *** topol has joined #openstack-keystone | 14:36 | |
| *** ChanServ sets mode: +v topol | 14:36 | |
| *** Maike_ has quit IRC | 14:38 | |
| *** iamjarvo has joined #openstack-keystone | 14:39 | |
| *** browne has joined #openstack-keystone | 14:45 | |
| *** r-daneel has joined #openstack-keystone | 14:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 14:47 |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 14:48 |
| *** krykowski has joined #openstack-keystone | 14:50 | |
| *** henrynash has quit IRC | 14:50 | |
| *** elmiko has left #openstack-keystone | 14:51 | |
| *** zzzeek has quit IRC | 14:52 | |
| *** ccrouch-afk has joined #openstack-keystone | 14:54 | |
| *** radez is now known as radez_g0n3 | 14:56 | |
| ccrouch-afk | quick question: | 14:58 |
| ccrouch-afk | I was just trying a GET request on /v2.0/users/{user_id}/roles against Juno keystone | 14:58 |
| ccrouch-afk | and am getting back 501: User roles not supported: tenant ID required | 14:58 |
| ccrouch-afk | would there be any interest in a patch to update the docs at http://developer.openstack.org/api-ref-identity-v2.html to note this? | 14:58 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:59 | |
| *** krtaylor has quit IRC | 14:59 | |
| *** karimb has quit IRC | 15:02 | |
| *** karimb has joined #openstack-keystone | 15:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 15:08 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug in SQL/LDAP when honoring driver_hints https://review.openstack.org/161702 | 15:09 |
| samueldmq | dstanek, ping - you around ? | 15:10 |
| samueldmq | dstanek, I submitted a new patch set for 'Exposes bug in SQL/LDAP when honoring driver_hints', because in fact this bug affects both SQL and LDAP | 15:11 |
| samueldmq | dstanek, then I modified the test to cover both .. please consider revisiting that (the old patch set had your +2) | 15:11 |
| samueldmq | dstanek, this affects our reseller implementation | 15:11 |
| *** henrynash has joined #openstack-keystone | 15:13 | |
| *** ChanServ sets mode: +v henrynash | 15:13 | |
| *** nellysmitt has quit IRC | 15:17 | |
| *** timcline has joined #openstack-keystone | 15:18 | |
| dstanek | samueldmq: sure | 15:21 |
| *** timcline has quit IRC | 15:21 | |
| *** timcline has joined #openstack-keystone | 15:22 | |
| samueldmq | dstanek, thanks | 15:22 |
| dolphm | lbragstad: p.s. this is where i got stuck yesterday with fernet: https://travis-ci.org/dolph/keystone-deploy/builds/53202078 | 15:23 |
| dolphm | lbragstad: same tests are passing against pki and uuiz | 15:24 |
| dolphm | uuid* | 15:24 |
| lbragstad | dolphm: interesting | 15:24 |
| *** iamjarvo has quit IRC | 15:24 | |
| lbragstad | where is test_exercises.py? | 15:24 |
| samueldmq | henrynash, hi - addressed your concerns on the driver_hitns patch | 15:24 |
| lbragstad | is that new? | 15:24 |
| bknudson | compressed UUID tokens? | 15:24 |
| henrynash | samueldmq: yep…just about to look at it | 15:24 |
| samueldmq | henrynash, thanks for your review there, we hope to that merged asap, since we depends on that for reseller (we add is_domain hints to look at thte project table ) | 15:25 |
| samueldmq | henrynash, great! thanks | 15:25 |
| *** krtaylor has joined #openstack-keystone | 15:26 | |
| dolphm | lbragstad: root directory | 15:26 |
| dolphm | bknudson: uuiz = base64.urlsafe_b64encode(uuid.uuid4().bytes) | 15:26 |
| bknudson | dolphm: could even chop off the trailing = | 15:27 |
| dolphm | bknudson: uuiz_max_compression = base64.urlsafe_b64encode(uuid.uuid4().bytes)[:-2] | 15:27 |
| lbragstad | marekd: I'm trying to figure out the best way to test the federated token formatter | 15:27 |
| *** spandhe has joined #openstack-keystone | 15:27 | |
| lbragstad | marekd: and there is a bunch of setup federation stuff in test_v3_federation.py that lives in the FederatedTokenTests module | 15:28 |
| lbragstad | marekd: would you be opposed to having that stuff broken out somewhere common so that it's easier to share across test modules versus inheriting them? | 15:28 |
| dolphm | bknudson: or .rstrip('=') i suppose | 15:28 |
| henrynash | samueldmq: see comment | 15:29 |
| openstackgerrit | Doug Fish proposed openstack/python-keystoneclient-federation: WIP: add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 15:29 |
| dolphm | lbragstad: git checkout fernet-tokens && git diff master | 15:31 |
| *** hockeynut has quit IRC | 15:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Stop debug logging of Ldap while running unit tests https://review.openstack.org/160872 | 15:32 |
| *** jorge_munoz has joined #openstack-keystone | 15:32 | |
| *** hockeynut has joined #openstack-keystone | 15:32 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug in SQL/LDAP when honoring driver_hints https://review.openstack.org/161702 | 15:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add checking for existing group/option to update domain config https://review.openstack.org/161718 | 15:33 |
| *** iamjarvo has joined #openstack-keystone | 15:33 | |
| samueldmq | henrynash, ^ | 15:33 |
| samueldmq | henrynash, thanks | 15:33 |
| *** iamjarvo has quit IRC | 15:33 | |
| *** iamjarvo has joined #openstack-keystone | 15:33 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 15:33 |
| *** krykowski has quit IRC | 15:33 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 15:35 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 15:35 |
| *** ccrouch-afk is now known as ccrouch | 15:36 | |
| *** edmondsw has joined #openstack-keystone | 15:46 | |
| *** edmondsw has quit IRC | 15:47 | |
| *** edmondsw has joined #openstack-keystone | 15:47 | |
| *** edmondsw has quit IRC | 15:47 | |
| *** edmondsw has joined #openstack-keystone | 15:48 | |
| *** krtaylor has quit IRC | 15:50 | |
| dolphm | jorge_munoz: o/ someone else here can probably answer better than i | 15:50 |
| dolphm | jorge_munoz: is_admin is set as a result of the user having the "admin" role as defined in policy.json | 15:51 |
| jorge_munoz | Yes, thanks. | 15:51 |
| jorge_munoz | Can someone point me to where the is_admin attribute is set for an auth request? | 15:52 |
| *** jorge_munoz has quit IRC | 15:53 | |
| *** tmcpeak has joined #openstack-keystone | 15:54 | |
| tmcpeak | welp… I've done something ridiculous | 15:54 |
| tmcpeak | I have system level access on my undercloud box | 15:55 |
| *** browne has quit IRC | 15:55 | |
| tmcpeak | but I have removed the admin user from the admin role | 15:55 |
| *** jorge_munoz has joined #openstack-keystone | 15:55 | |
| tmcpeak | any way to fix that? | 15:55 |
| tmcpeak | or pave and nuke? | 15:55 |
| dolphm | jorge_munoz: i think there's a decorator on v2 controller methods | 15:57 |
| dolphm | tmcpeak: yep! the keystone.conf [default] admin_token is intended for bootstrapping your deploy | 15:58 |
| dolphm | tmcpeak: use that as your --os-token combination with a raw --os-endpoint={keystone} to reassign the admin user that role | 15:58 |
| tmcpeak | dolphm: sweet! | 15:59 |
| jorge_munoz | Thanks, I'll take a look | 16:00 |
| tmcpeak | dolphm: thanks, I'll give that a shot | 16:00 |
| lbragstad | jorge_munoz: there is also some stuff for is_admin in keystone's middlware code https://github.com/openstack/keystone/blob/ce701f27710c1000d5d7babd3a7bd3fe7e1af083/keystone/middleware/core.py#L70 | 16:00 |
| tmcpeak | thought you guys might have some magic :) | 16:00 |
| jorge_munoz | lbragstad: Ok,but thats for the admin token. I was wondering more of a user with the admin role. | 16:01 |
| *** spandhe has quit IRC | 16:01 | |
| *** krtaylor has joined #openstack-keystone | 16:02 | |
| lbragstad | jorge_munoz: I was just looking for places in the code that had is_admin anywhere | 16:02 |
| dolphm | jorge_munoz: ++ | 16:03 |
| dolphm | jorge_munoz: v2 controller methods explicitly call is_admin(), which is defined in keystone/common/wsgi.py | 16:04 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 16:05 |
| dolphm | jorge_munoz: it checks to see that you either used the admin_token (bootstrapping) or that you pass the 'admin_required' policy in policy.json | 16:05 |
| dolphm | jorge_munoz: which i think is just defined as 'role:admin' by default | 16:05 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:05 |
| jorge_munoz | dolphm: so, when authenticating and a user has an admin role, should the is_admin attribute be set to 1? | 16:07 |
| dolphm | jorge_munoz: in the token response, you mean? | 16:08 |
| jorge_munoz | yes | 16:08 |
| dolphm | jorge_munoz: i suppose... yes. but absolutely *nothing* should depend on that because it's not a defined API | 16:08 |
| dolphm | documented* | 16:08 |
| dolphm | that's a big "should" though | 16:08 |
| jorge_munoz | dolphm: thanks, I'll try it on master and see whats the behavior. | 16:10 |
| *** browne has joined #openstack-keystone | 16:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 16:12 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 16:12 |
| dolphm | lbragstad: didn't we pull the created at time out of the fernet tokens? or did that never get into gerrit | 16:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 16:13 |
| dolphm | lbragstad: ... i don't think that ever got into gerrit. | 16:15 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 16:16 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 16:16 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:16 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 16:16 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 16:16 |
| openstackgerrit | Cyril Roelandt proposed openstack/python-keystoneclient: Prevent a UnicodeDecodeError in the s3token middleware https://review.openstack.org/161762 | 16:16 |
| lbragstad | dolphm: I don't think so | 16:17 |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth and federation authentication to config file https://review.openstack.org/161317 | 16:18 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 16:18 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support upload domain config files to database https://review.openstack.org/160364 | 16:19 |
| lbragstad | dolphm: trying to figure out the common federated test case setup stuff | 16:19 |
| dolphm | lbragstad: stuff https://bugs.launchpad.net/keystone/+bugs?field.tag=fernet | 16:20 |
| *** stevemar has joined #openstack-keystone | 16:21 | |
| *** ChanServ sets mode: +v stevemar | 16:21 | |
| lbragstad | dolphm: oo nice | 16:22 |
| lbragstad | dolphm: I'd like to pick one of those up when I get through the federation stuff | 16:22 |
| dolphm | lbragstad: you're welcome to - let me know which / when. i just wrote a wip to remove the token expiration in favor of returning the max datetime python supports lol | 16:23 |
| *** tellesnobrega has quit IRC | 16:24 | |
| jorge_munoz | dolphm: lbragstad I tested adding the admin role to a user on master with default provider. This is what i get: https://gist.github.com/kidster/155eb2511b6bf791192b | 16:28 |
| jorge_munoz | is_admin attribute is not set. | 16:28 |
| lbragstad | interesting... that's misleading | 16:28 |
| *** tellesnobrega has joined #openstack-keystone | 16:29 | |
| lbragstad | so where ever is_admin is being set it's getting copied into the metadata for v2? | 16:29 |
| dolphm | jorge_munoz: good! it's garbage anyway. it must only kick in for the admin_token, which you don't have to worry about | 16:29 |
| dolphm | lbragstad: it's set by that middleware you linked to, for admin_token | 16:30 |
| lbragstad | ah | 16:30 |
| dolphm | lbragstad: i thought maybe it was set elsewhere too, but guess not | 16:30 |
| lbragstad | dolphm: jorge_munoz that makes sense then | 16:30 |
| dolphm | if it's always false, we should remove it from the v2 tokens we emit | 16:30 |
| *** david-lyle has joined #openstack-keystone | 16:30 | |
| lbragstad | dolphm: ++ | 16:30 |
| *** Bsony_ has quit IRC | 16:30 | |
| dolphm | no one could possibly depend on it besides us | 16:30 |
| lbragstad | dolphm: and if we do have to keep it in there for some reason it should be renamed | 16:30 |
| dolphm | and we only use it internally | 16:31 |
| openstackgerrit | Steve Martinelli proposed openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 16:31 |
| *** Guest63892 is now known as mfisch | 16:31 | |
| *** mfisch has joined #openstack-keystone | 16:31 | |
| jorge_munoz | lbragstad: dolphm cool, I'll add a comment on the patch. | 16:34 |
| *** ChristyF has joined #openstack-keystone | 16:35 | |
| raildo | henrynash: I saw you are the author of the last drop table in keystone... have you seen something like "DatabaseAlreadyControlledError" in the migration tests? | 16:36 |
| lbragstad | dolphm: question in pulling the created at time out of the fernet token. The revocation event doesn't pull that information from the token data does it? It generates it as the event is created, yeah? | 16:38 |
| iamjarvo | i am trying to view the keystone catalog and its asking for -os-auth-url is that the keystone endpoint | 16:38 |
| *** spandhe has joined #openstack-keystone | 16:40 | |
| morganfainberg | lbragstad: probably not | 16:41 |
| dolphm | lbragstad: i don't understand the first question, but the second question is a yes: revocation events have timestamps which reflect the time at which the event occurred. if the creation time of a token is before that event, then it is impacted by the revocation event. | 16:41 |
| lbragstad | ok | 16:41 |
| morganfainberg | Created at isn't super relevant for event though. | 16:41 |
| dolphm | lbragstad: so we still need to be able to get create times out of tokens, but we should get it from the fernet encoding instead of from the payload | 16:42 |
| morganfainberg | Oh wait dolphm is right. Deep | 16:42 |
| morganfainberg | Derp* | 16:42 |
| lbragstad | dolphm: perfect, | 16:42 |
| dolphm | morganfainberg: i prefer "deep" | 16:42 |
| lbragstad | that works | 16:42 |
| * dolphm This has been dolphm on token philosophies. | 16:42 | |
| * dolphm Join us next time for a throught proking discussion of expiration dates. | 16:43 | |
| *** rwsu-afk is now known as rwsu | 16:43 | |
| * dolphm ... or "provoking," whatever. | 16:43 | |
| *** spandhe has quit IRC | 16:44 | |
| openstackgerrit | Merged openstack/keystone: Make the LDAP dependency clear between identity, resource & assignment https://review.openstack.org/151930 | 16:44 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 16:45 |
| dolphm | lbragstad: ^ | 16:46 |
| dolphm | lbragstad: fun fact- removing the expiration time reduces the size of fernet tokens from 187 chars to 167 chars | 16:47 |
| dolphm | lbragstad: i assume removing the created time will be similar | 16:47 |
| lbragstad | damn | 16:47 |
| stevemar | dolphm, depends on the month :O | 16:47 |
| morganfainberg | dolphm: you should go with "thought poking" | 16:47 |
| lbragstad | dolphm: I didn't expect the time ints to be that big | 16:48 |
| dolphm | stevemar: they're stored as integers since unix epoch - so not quite! | 16:48 |
| stevemar | oh noes | 16:48 |
| dolphm | morganfainberg: =) | 16:48 |
| henrynash | raildo: not on a clean run…but if you get an error and re-run, often the tables are still “locked” in some way | 16:48 |
| henrynash | raildo: if it’s a clean test, is this sqllite, mysql or what? | 16:49 |
| *** krtaylor has quit IRC | 16:49 | |
| dolphm | stevemar: if we're going to keep timestamps for whatever reason, i was going to argue that sacrifice precision by dividing them by 60 or 3600 to save a magnitude or three | 16:49 |
| morganfainberg | As long as that data is available it doesn't matter where it lives. Though tbh, it probably should be in a secure (signed?) location | 16:51 |
| *** Akshik has joined #openstack-keystone | 16:51 | |
| morganfainberg | So people can't craft / muck with it. | 16:51 |
| *** Akshik_ has joined #openstack-keystone | 16:52 | |
| morganfainberg | So, I've not looked at how fernet wrapper stores that vs when it is in the token encoded area. | 16:52 |
| raildo | henrynash: we could drop the table, and re-create it, but when we run all the tests, we got this error. | 16:53 |
| morganfainberg | dolphm: however expires can be derived from created, you just need to encode the Ttl in the token, not the whole expires time. So usually no more than 5 digits in an int. | 16:53 |
| raildo | henrynash, yes, it's run in sqlite | 16:54 |
| *** tmcpeak has left #openstack-keystone | 16:55 | |
| *** Akshik has quit IRC | 16:55 | |
| henrynash | raildo: so slqlite doesn’t support some things…but it does support drop table…what you can get is the fact that it hasn’t really realised that it has dropped it….so you might need to refresh the mapping you haev (I forget how I experimented wth this before) | 16:59 |
| *** Bsony has joined #openstack-keystone | 16:59 | |
| raildo | henrynash: I see... I've been trying to follow the steps on this commit of yours: https://github.com/openstack/keystone/commit/ec995b33763f99755e8512e0e0aa497c01e37449?diff=unified | 17:00 |
| *** krtaylor has joined #openstack-keystone | 17:01 | |
| raildo | it's pretty much the same steps, but I'm still getting the error in some tests like test_sql_upgrade.VersionTests.test_unversioned_extension | 17:01 |
| henrynash | raildo: ahh…..right so you in an extension….. | 17:02 |
| *** zzzeek has joined #openstack-keystone | 17:03 | |
| *** iamjarvo has quit IRC | 17:03 | |
| *** iamjarvo_ has joined #openstack-keystone | 17:03 | |
| *** jorge_munoz_ has joined #openstack-keystone | 17:04 | |
| henrynash | raildo: now I do remember some weirdness that a test in an extension repo was failing due to what had happend in the main repo….the main repo still had something mapped or the like…sadly it’s too long ago…but there definitely was something about teh interaction between the main repo and an extenions repo | 17:05 |
| dstanek | sqlite foreign keys!! | 17:06 |
| raildo | henrynash: I see... | 17:07 |
| raildo | dstanek, I've removed the foreign keys migration and I'm only doing the drop itself, and it's still not working | 17:07 |
| *** jistr has quit IRC | 17:08 | |
| dstanek | raildo: what issue are you having? | 17:08 |
| * morganfainberg looks forward to most of the extension repos collapsing into the main schema repo. | 17:08 | |
| morganfainberg | breton_: ping. Are you going to do the sql collapse or should I? (Don't want to duplicate effort if it isn't needed) | 17:09 |
| raildo | dstanek: I'm writing the drop domain table migration script and I succesfully can do and undo this drop | 17:09 |
| raildo | but I'm getting two kinds of errors: the DatabaseAlreadyControlledError in test_sql_upgrade.VersionTests.test_extension_migrated, for example | 17:10 |
| henrynash | stevemar, ayoung, gyee: nice byte-sized fix for a Thursday morning: https://review.openstack.org/#/c/161718/4 | 17:11 |
| dstanek | raildo: which patch is it? | 17:11 |
| amakarov | morganfainberg, he is ill today. not sure if he'll even respond | 17:12 |
| raildo | I have not submitted it yet | 17:12 |
| dstanek | raildo: let me know when you do and i can start poking at it | 17:12 |
| morganfainberg | amakarov: no worries. I figure irc is mostly async communication. | 17:12 |
| morganfainberg | dstanek: raildo ++. Feel free to post it if you need extra eyes to help debug it. | 17:13 |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| raildo | dstanek, morganfainberg: cool. I'll submit it and let you guys know | 17:13 |
| *** _cjones_ has quit IRC | 17:14 | |
| *** _cjones_ has joined #openstack-keystone | 17:15 | |
| morganfainberg | dstanek: https://review.openstack.org/#/c/142573/ so bknudson had the same question I did about .extend vs .append. I think this is sufficient to say we need to clarify that code. It will likely break because it doesn't make a lot of sense. | 17:17 |
| morganfainberg | In a future fix that is. | 17:17 |
| morganfainberg | S/fix/update | 17:17 |
| *** _cjones_ has quit IRC | 17:17 | |
| *** henrynash has quit IRC | 17:17 | |
| bknudson | morganfainberg: I thought I was just stupid. | 17:18 |
| *** _cjones_ has joined #openstack-keystone | 17:18 | |
| dolphm | morganfainberg: creation time is signed, but not encrypted in fernet | 17:18 |
| morganfainberg | bknudson: no it's related to late eval and handing the data diffidently when you're stopping out group info. | 17:19 |
| dolphm | morganfainberg: and yeah, when i originally thought about dropping the expiration time, we weren't using fernet, so my solution is actually outdated. we can/should just dynamically compute expiration time based on fernet's creation time + CONF token lifespan | 17:19 |
| morganfainberg | bknudson: in short it should be a data structure. | 17:19 |
| amakarov | morganfainberg, I have a fix for quite a long time https://review.openstack.org/#/c/141854/, don't want to be noisy, but I'd realy like to land it in this release - it fixes some weird revocation logic Fernet tokens will suffer from. | 17:19 |
| bknudson | it's going to require a lot of documentation for special-casing. | 17:19 |
| bknudson | also, I doubt the example that says {1} works. | 17:19 |
| morganfainberg | bknudson: yeah. So I think this is enough to justify a "go make this a data structure" and don't assume this makes sense. | 17:20 |
| morganfainberg | At least that becomes more usable. | 17:20 |
| dstanek | bknudson: haha, me too - i had to have it explained to me slowly and in small words | 17:21 |
| morganfainberg | dstanek: I think we all did | 17:21 |
| bknudson | if they want to make it specific to groups then they can document it that way. | 17:21 |
| morganfainberg | dstanek: so, let's ask it to be changed. | 17:21 |
| bknudson | also, if it's specific to groups then maybe don't try to make it generic at all... it looks like it can be used anywhere. | 17:21 |
| morganfainberg | 3 cores needing small words for it, that is a good canary for "this is wrong" | 17:22 |
| bknudson | stevemar figured it out. | 17:22 |
| morganfainberg | bknudson: we're not all cool like stevemar ;) | 17:23 |
| marekd | lbragstad: i don't really mind :-) go ahead :-) | 17:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 17:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add unscoped token formatter for Fernet tokens https://review.openstack.org/161379 | 17:24 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add Federation mixin for setting up data https://review.openstack.org/161793 | 17:24 |
| lbragstad | marekd: attempting to do it here https://review.openstack.org/#/c/161793/1 | 17:24 |
| dolphm | amakarov: targeted https://bugs.launchpad.net/keystone/+bug/1401926 to kilo-3 and added the review to our list of release blocking reviews https://gist.github.com/dolph/651c6a1748f69637abd0 | 17:26 |
| openstack | Launchpad bug 1401926 in Keystone "Role revocation invalidates tokens on all user projects" [Medium,In progress] - Assigned to Alexander Makarov (amakarov) | 17:26 |
| stevemar | lbragstad, nice | 17:26 |
| amakarov | dolphm, thanks, Horizon guys will appreciate this fix :) | 17:27 |
| dolphm | amakarov: we will too :) | 17:28 |
| openstackgerrit | Doug Fish proposed openstack/python-keystoneclient-federation: WIP: add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 17:29 |
| morganfainberg | amakarov: fyi, you can't revoke by Id here. We need the groups to be in the token for revocation events to be able to revoke by it. | 17:30 |
| openstackgerrit | Doug Fish proposed openstack/python-keystoneclient-federation: WIP: add Saml2KeystoneUnscoped for K2K federation https://review.openstack.org/161751 | 17:31 |
| morganfainberg | Which at the moment I think is not the case. Which is why the bug exists. | 17:31 |
| *** krtaylor has quit IRC | 17:31 | |
| pmath | driver = keystone.catalog.backends.templated.TemplatedCatalog --> ImportError: Class TemplatedCatalog cannot be found. What's the new name here? | 17:32 |
| *** spandhe has joined #openstack-keystone | 17:32 | |
| stevemar | pmath, almost the same keystone.catalog.backends.templated.Catalog | 17:33 |
| pmath | thanks stevemar | 17:33 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/catalog/backends/templated.py#L60 | 17:33 |
| *** browne has quit IRC | 17:33 | |
| morganfainberg | stevemar: did we break someone with a rename? Because if we did. We need to provide an alias symbol. | 17:33 |
| morganfainberg | pmath: when did you hit that? | 17:34 |
| stevemar | morganfainberg, it was deprecate and targeted for removal in L | 17:34 |
| stevemar | err K | 17:34 |
| morganfainberg | stevemar: ah ok. Just checking. | 17:34 |
| stevemar | morganfainberg, https://github.com/openstack/keystone/commit/1ea9d50a2c828a3eb976e458659008a5461b1418 | 17:34 |
| amakarov | morganfainberg, that's cool - I don't want the second table by size of the token table :) | 17:34 |
| *** ericpeterson has joined #openstack-keystone | 17:35 | |
| *** ericpeterson has left #openstack-keystone | 17:35 | |
| morganfainberg | amakarov: also I think you're going to run into issue with this code being over zealous in revocations in a different way. But I'll be honest this is not something I can definitely score via a mobile device ;) | 17:35 |
| pmath | morganfainberg: I updated a really old keystone install from about 2 years ago | 17:36 |
| *** ericpeterson has joined #openstack-keystone | 17:36 | |
| morganfainberg | So... I'll do more in depth review when I'm at a real screen. | 17:36 |
| morganfainberg | pmath: ah ok. | 17:36 |
| amakarov | morganfainberg, ok, I'll be careful :) | 17:37 |
| *** krtaylor has joined #openstack-keystone | 17:37 | |
| morganfainberg | amakarov: I'll comment if I find anything. | 17:37 |
| ericpeterson | question on looking at http://developer.openstack.org/api-ref-identity-v3.html That page leads me to believe I can get a new token, once I have an existing token. (see the /v3/auth/tokens section). Is that possible? | 17:37 |
| morganfainberg | ericpeterson: yes. But the token's expiration (new one) is the same as the original one. | 17:38 |
| morganfainberg | This is used to allow people to change scope (what project/tenant) they are working on. | 17:38 |
| ericpeterson | that cuts to the chase, exactly what I was wondering | 17:38 |
| ericpeterson | thanks morganfainberg :) | 17:39 |
| morganfainberg | ericpeterson: I've Answered that question a few times. Usually the expiration and rescoping are the relevant bits people are interested in. | 17:39 |
| morganfainberg | :) | 17:39 |
| * ericpeterson lurks back to the horizon room - his people. appreciates the help | 17:40 | |
| *** ericpeterson has left #openstack-keystone | 17:40 | |
| *** jorge_munoz_ has quit IRC | 17:43 | |
| fmarco76 | morganfainberg: my patch https://review.openstack.org/#/c/152156/ was planned for kilo and the code is ready but waiting for the bug https://review.openstack.org/#/c/159803/. Is there the possibility to land both in kilo? | 17:43 |
| *** timcline has quit IRC | 17:44 | |
| morganfainberg | fmarco76: yes. But I removed the targeting until we solved the bug. Let's get the bugfix landed and then your code can be landed. If it looks to be landing in k3 we will retarget the bp. | 17:44 |
| *** timcline has joined #openstack-keystone | 17:44 | |
| morganfainberg | fmarco76: the bugfix is also something we need to possibly backport. | 17:45 |
| fmarco76 | morganfainberg: thanks, I am waiting for the bug to be reviewd | 17:45 |
| morganfainberg | fmarco76: yeah I think I stuck that as a blocker for k3 | 17:45 |
| fmarco76 | morganfainberg: yes | 17:46 |
| morganfainberg | fmarco76: targeted bug and added to the gist. | 17:46 |
| fmarco76 | morganfainberg: what is gist? | 17:47 |
| morganfainberg | The link in the channel comment for high priority reviews. | 17:47 |
| morganfainberg | Channel topic* | 17:47 |
| *** amakarov is now known as amakarov_away | 17:47 | |
| fmarco76 | morganfainberg: OK (I am quite new here :) ) | 17:47 |
| morganfainberg | https://gist.github.com/dolph/651c6a1748f69637abd0 | 17:47 |
| morganfainberg | fmarco76: :) | 17:48 |
| fmarco76 | morganfainberg: OK, thanks | 17:49 |
| *** lhcheng_ has joined #openstack-keystone | 17:49 | |
| *** jlk has joined #openstack-keystone | 17:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/161813 | 17:52 |
| *** harlowja_away is now known as harlowja | 17:58 | |
| *** fmarco76 has left #openstack-keystone | 17:58 | |
| *** radez_g0n3 is now known as radez | 18:09 | |
| *** jlk has left #openstack-keystone | 18:10 | |
| ccrouch | (08:58:33 AM) ccrouch: quick question: | 18:11 |
| ccrouch | (08:58:33 AM) ccrouch: I was just trying a GET request on /v2.0/users/{user_id}/roles against Juno keystone | 18:11 |
| ccrouch | (08:58:33 AM) ccrouch: and am getting back 501: User roles not supported: tenant ID required | 18:11 |
| ccrouch | (08:58:33 AM) ccrouch: would there be any interest in a patch to update the docs at http://developer.openstack.org/api-ref-identity-v2.html to note this? | 18:11 |
| ccrouch | anyone have any thoughts ^ ? | 18:11 |
| morganfainberg | ccrouch: oh I think "user" global roles have never been supported. So sure fixing that would probably be good. | 18:15 |
| *** karimb has quit IRC | 18:16 | |
| ccrouch | ok, great, thanks for the confirmation | 18:16 |
| *** karimb has joined #openstack-keystone | 18:17 | |
| breton_ | morganfainberg: I am going, will put on review either tomorrow or on Saturday | 18:17 |
| *** karimb has quit IRC | 18:18 | |
| morganfainberg | breton_: no worries. Just making sure i knew you were working on it. :) that way I don't need to worry about doing it myself and just watch for the review. | 18:18 |
| breton_ | in fact, I am working on it right now. | 18:19 |
| *** breton_ is now known as breton | 18:19 | |
| morganfainberg | That can land even after k3 if needed. So there isn't a huge rush (though, of course I won't say no to it landing earlier) | 18:20 |
| *** iamjarvo_ has quit IRC | 18:25 | |
| *** iamjarvo has joined #openstack-keystone | 18:31 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Spelling and grammar cleanup https://review.openstack.org/161826 | 18:32 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes minor whitespace issues https://review.openstack.org/161828 | 18:32 |
| *** ljfisher has quit IRC | 18:32 | |
| *** zzzeek has quit IRC | 18:33 | |
| stevemar | dstanek, neat | 18:34 |
| dstanek | stevemar: ? | 18:34 |
| stevemar | your patches | 18:34 |
| stevemar | i am saying they are neat | 18:35 |
| stevemar | as in... neato | 18:35 |
| bknudson | pep8 should catch the whitespace issues. | 18:36 |
| *** ljfisher has joined #openstack-keystone | 18:36 | |
| dstanek | stevemar: ah - i have to fix stupid stuff as i review other patches :-) | 18:36 |
| dolphm | lbragstad: did you do any work to pull out the creation timestamp? if not, it'd be easier for me to depend the expires_at change on top of that | 18:36 |
| dolphm | lbragstad: because now i want to compute the expiration time on validation based on create time | 18:37 |
| openstackgerrit | Merged openstack/oslo.policy: deprecate policy_dirs option https://review.openstack.org/160407 | 18:37 |
| stevemar | \o/ policy merge@ | 18:37 |
| lbragstad | dolphm: go for it | 18:39 |
| dolphm | lbragstad: alrighty | 18:39 |
| lbragstad | dolphm: working on federated fernet testing | 18:39 |
| lbragstad | dolphm: https://review.openstack.org/#/c/161793/ | 18:39 |
| *** aix has quit IRC | 18:40 | |
| *** krtaylor has quit IRC | 18:45 | |
| rodrigods | morganfainberg, ping... re: did domain config in db get the FFE? | 18:50 |
| *** topol_ has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v topol_ | 18:55 | |
| *** topol has quit IRC | 18:55 | |
| *** topol_ is now known as topol | 18:55 | |
| *** krtaylor has joined #openstack-keystone | 18:59 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: rename the "standard" token formatter to "scoped" https://review.openstack.org/161838 | 18:59 |
| dolphm | lbragstad: ^ | 18:59 |
| lbragstad | dolphm: cool | 18:59 |
| lbragstad | dolphm: I'll review | 18:59 |
| *** dims_ has joined #openstack-keystone | 19:01 | |
| *** ljfisher has quit IRC | 19:01 | |
| *** gyee has joined #openstack-keystone | 19:01 | |
| *** ChanServ sets mode: +v gyee | 19:01 | |
| *** ljfisher has joined #openstack-keystone | 19:02 | |
| *** _cjones_ has quit IRC | 19:02 | |
| *** dims has quit IRC | 19:04 | |
| stevemar | lhcheng_, osc meeting in -meeting | 19:05 |
| *** ljfisher has quit IRC | 19:06 | |
| dolphm | lbragstad: you made a change somewhere to have audit_ids always be a list, right? | 19:06 |
| lhcheng_ | stevemar: thanks! | 19:07 |
| dolphm | lbragstad: i'm wonding if i'm looking at old code: audit_ids = audit_ids.pop() | 19:07 |
| lbragstad | dolphm: yes I did | 19:07 |
| lbragstad | dolphm: https://review.openstack.org/#/c/160993/ | 19:08 |
| dolphm | ah that's right | 19:09 |
| lbragstad | that should make audit ids always be a list | 19:09 |
| dolphm | lbragstad: thanks! | 19:09 |
| lbragstad | dolphm: yep | 19:09 |
| dolphm | lbragstad: dstanek has a good point there -- the commit message could just say "to a list of bytes before sending them to msgpack" | 19:12 |
| morganfainberg | rodrigods, i think we're set for it to land | 19:12 |
| rodrigods | morganfainberg, great | 19:13 |
| dolphm | lbragstad: i also wrote a unittest module for the other two b64 functions that you could add to | 19:13 |
| rodrigods | thanks | 19:13 |
| morganfainberg | dstanek, audit ids should always be a list in the resulting token | 19:13 |
| morganfainberg | dstanek, with either 1 element (this token is an original authentication, no rescope) or 2 elements (current audit id for the token and the original token in the chain) | 19:14 |
| morganfainberg | dstanek, if fernet didn't do that, it was wrong :P | 19:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 19:15 |
| dstanek | dolphm: i didn't know if that was right | 19:15 |
| lbragstad | dolphm: where was your unit test? | 19:15 |
| dolphm | dstanek: it was desirable as a simplification | 19:15 |
| dstanek | morganfainberg: :-) we should have a test for that | 19:15 |
| morganfainberg | dstanek, i think we do actually. | 19:15 |
| dolphm | dstanek: more consistency / fewer edge case | 19:15 |
| morganfainberg | dstanek, but it doesn't check the token data in fernet, just the resulting token body on validate/issue. | 19:16 |
| morganfainberg | dstanek, we don't care what the data encoded in the fernet id actually is as long as keystone can provide real data on issue/validate responses to be consumed | 19:16 |
| morganfainberg | so maybe in fernet's id it wasn't a list? | 19:17 |
| dolphm | lbragstad: i think you might be returning unscoped tokens when prompted for a domain scoped token, fyi | 19:17 |
| dstanek | morganfainberg: no idea what that translated into when the token is changed into a datastructure | 19:18 |
| morganfainberg | dstanek, ah | 19:18 |
| lbragstad | dolphm: is that on the new patch? | 19:18 |
| lbragstad | dolphm: or master? | 19:18 |
| morganfainberg | dstanek, ok so in the tokne id it wasn't a list before now it is. cool got it | 19:18 |
| dstanek | morganfainberg: the code that was changed moved from a string to a list and didn't say why | 19:18 |
| morganfainberg | yeah | 19:18 |
| dolphm | lbragstad: no i mean that's probably the issue i'm seeing in keystone-deploy ... i see some suspicious code in fernet.core | 19:18 |
| morganfainberg | i see what your comment was about now | 19:19 |
| lbragstad | dolphm: link? | 19:19 |
| *** lhcheng_ is now known as lhcheng | 19:19 | |
| morganfainberg | ok so i don't get the bug https://bugs.launchpad.net/keystone/+bug/1428600 | 19:19 |
| openstack | Launchpad bug 1428600 in Keystone "Domain Config updates for specific group/option don't honor NotFound" [High,In progress] - Assigned to Henry Nash (henry-nash) | 19:19 |
| morganfainberg | the words are all valid but what is the actual issue? | 19:20 |
| morganfainberg | that the option must be set in the main config before it can be overridden? | 19:20 |
| dolphm | lbragstad: you only ever pass a project id -- the domain ID is ignored https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L101 | 19:20 |
| dolphm | lbragstad: probably need a domain-scoped formatter :P | 19:20 |
| dolphm | lbragstad: even if it's not used long-term | 19:20 |
| dolphm | lbragstad: (post hierarchical multitenancy) | 19:21 |
| dolphm | lbragstad: don't worry about that today though | 19:21 |
| lbragstad | dolphm: that should be a oneline fix if we wanted to roll it into the token formatter we already have | 19:22 |
| lbragstad | https://review.openstack.org/#/c/161379/4/keystone/token/providers/fernet/core.py | 19:22 |
| lbragstad | line 104 | 19:22 |
| lbragstad | we could determine if we're scoping to a project or a token | 19:22 |
| lbragstad | s/token/domain/ | 19:22 |
| dolphm | lbragstad: that's how i idenfified the issue actually | 19:22 |
| dolphm | lbragstad: but when you decode the token, how do you know if the ID you have is a project or domain? | 19:23 |
| * lbragstad has way to many conversations going on, excuse the context jumping! | 19:23 | |
| lbragstad | dolphm: we would have to call to the assignment api | 19:23 |
| lbragstad | dolphm: to determine what is what | 19:23 |
| dolphm | lbragstad: (unless we're ready to say all domain IDs are also project IDs? <-- morganfainberg, raildo) | 19:23 |
| morganfainberg | dolphm, that patch has not landed. :P | 19:23 |
| dolphm | lbragstad: yeah, that would suck | 19:23 |
| lbragstad | dolphm: that's something we could get around if we introduced a new domain-scoped formatter | 19:24 |
| dolphm | morganfainberg: is it likely to land this cycle? | 19:24 |
| morganfainberg | dolphm, it has a chance to. | 19:24 |
| dolphm | lbragstad: right | 19:24 |
| morganfainberg | dolphm, it is not guaranteed to. | 19:24 |
| dolphm | morganfainberg: ack | 19:24 |
| morganfainberg | dolphm, it's part of the reseller work | 19:24 |
| dolphm | lbragstad: so, let's drag our feet on the issue and see if that has a chance to change. if it doesn't look like it's going to, it's easy for us to workaround with that fourth format | 19:25 |
| morganfainberg | so assume it will not land, if we need to yank a formatter out... the cost is low if it does land | 19:25 |
| dolphm | lbragstad: or that ^ | 19:25 |
| dolphm | same effect | 19:25 |
| lbragstad | ok | 19:25 |
| morganfainberg | formatters are relatively cheap for us | 19:25 |
| lbragstad | yank a formatter out? so pull out the domain formatter if we land it? | 19:25 |
| raildo | dolphm, morganfainberg is right :) | 19:25 |
| dolphm | morganfainberg: and working on making them cheaper! | 19:25 |
| dolphm | lbragstad: yeah, just delete it | 19:25 |
| lbragstad | and use the "project formatter" for everything "scoped" | 19:26 |
| lbragstad | like we are doing today? | 19:26 |
| morganfainberg | lbragstad, domain scope != project scope today | 19:26 |
| morganfainberg | and it may not in the future either | 19:26 |
| morganfainberg | assume you need to diffierentiate | 19:26 |
| morganfainberg | i don't care how you do that ;) | 19:26 |
| morganfainberg | if it means we need another formatted (even for a short bit) that is nbd | 19:26 |
| morganfainberg | we can always remove it. - in short, solve domain scopes however is easiest for you to do | 19:27 |
| morganfainberg | but don't assume domain scope == project scope (since it doesn't) | 19:28 |
| lbragstad | ok | 19:28 |
| *** david-lyle has quit IRC | 19:29 | |
| dstanek | dolphm: lbragstad: found another issue in https://review.openstack.org/#/c/160993/ | 19:30 |
| dstanek | the -2 slicing is likely to cause bugs if the string should be decodable | 19:31 |
| lbragstad | dstanek: I can refactor | 19:31 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes before msgpacking https://review.openstack.org/160993 | 19:33 |
| lbragstad | dstanek: ^ | 19:34 |
| *** rm_work|away is now known as rm_work | 19:34 | |
| morganfainberg | dstanek, ah sure .rstrip is fine, it was sliced initially because it was a fixed/known length it always had 2 '==' | 19:34 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Mirror domain entries to project table https://review.openstack.org/161408 | 19:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 19:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 19:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 19:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 19:36 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Bye bye domain table https://review.openstack.org/161854 | 19:36 |
| morganfainberg | raildo, LOL https://review.openstack.org/#/c/161854/ the name on that commit is awesome | 19:36 |
| raildo | morganfainberg, hahaha =D | 19:37 |
| rodrigods | raildo, morganfainberg ++ | 19:37 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: don't require token formatters to understand "token_data" https://review.openstack.org/161855 | 19:37 |
| dolphm | lbragstad: more refactarrrrr | 19:38 |
| dolphm | lbragstad: next step is to remove the formatter's dep on v3_token_data_helper | 19:38 |
| raildo | dstanek, morganfainberg, this last patch is WIP, we don't know how to resolve that problem when we drop the domain table. | 19:39 |
| htruta | dstanek, morganfainberg: this patch will break thousands of tests... our focus for a while is only the sql upgrade ones | 19:40 |
| dstanek | raildo: cool, i'll take a look | 19:41 |
| raildo | dstanek, thanks :) | 19:41 |
| *** browne has joined #openstack-keystone | 19:41 | |
| lbragstad | dolphm: this makes it so that fernet.core is still doing most of the logic | 19:42 |
| lbragstad | https://review.openstack.org/#/c/161855/1 | 19:42 |
| lbragstad | which goes against the idea of pushing more of the token context to the formatters (per the integrity protected token format conversation) | 19:42 |
| lbragstad | just curious if that's still the direction we want to move? | 19:43 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: WIP: Bye bye domain table https://review.openstack.org/161854 | 19:43 |
| dolphm | lbragstad: it is... i'm just going DRY DRY DRY until i can think of an elegant way to push versions into the tokens themselves... | 19:43 |
| raildo | just change the commit msg to put WIP :P | 19:43 |
| lbragstad | dolphm: makes sense, | 19:43 |
| dolphm | lbragstad: i don't really care where what responsibilities are, as long as they're only in one place | 19:44 |
| *** dims_ has quit IRC | 19:44 | |
| *** dims has joined #openstack-keystone | 19:45 | |
| morganfainberg | dolphm, couldn't you make fernet prefix F_ then make the first element the format 00, 01, 02, 03, then the formatter handles the rest with that being stripped off? | 19:45 |
| dolphm | morganfainberg: that's the direction i'm going with https://bugs.launchpad.net/keystone/+bug/1427485 | 19:45 |
| openstack | Launchpad bug 1427485 in Keystone "Fernet tokens contain a version identifier that is not integrity verified" [Medium,New] - Assigned to Dolph Mathews (dolph) | 19:45 |
| morganfainberg | dolphm, ah | 19:45 |
| dolphm | morganfainberg: except the last paragraph on the bug report also makes argument against any external prefixing (F_) | 19:46 |
| *** jlk has joined #openstack-keystone | 19:47 | |
| jlk | Hey all, I'm trying to setup keystone as a federated SP, and in the shibboleth setup it talks about a scriptalias, and it's trying to alias a path and send it to /var/www/keystone/main which seems to me like an odd path, since that path doesn't exactly exists on the filesystem. Is it instead supposed to reference the CGI alias in some way? | 19:48 |
| jlk | http://docs.openstack.org/developer/keystone/extensions/shibboleth.html is what I'm speaking of | 19:49 |
| morganfainberg | dolphm, well we need to external prefix so we can differentiate MII from Fernet [since MII isn't gone] and uuid. | 19:49 |
| jlk | morganfainberg: ^ | 19:49 |
| morganfainberg | dolphm, but that is a simple external-prefix not a complex one | 19:49 |
| dolphm | morganfainberg: only if you're going to have one keystone deployment validating both online | 19:49 |
| lbragstad | dolphm: so are we thinking about dropping the F** all together? | 19:50 |
| dolphm | lbragstad: that's my goal atm | 19:50 |
| morganfainberg | dolphm, i'll need to stew on that some | 19:50 |
| lbragstad | and when middleware gets to the point of being able to decrypt/verify we put the token version back on? | 19:50 |
| jlk | whoops, n/m, I see what's going on here | 19:50 |
| morganfainberg | jlk, ah was just about to respond, you got it? | 19:50 |
| jlk | looks like instead of /var/www/keystone/main it should be /var/www/cgi-bin/keystone/main (since we put our keystone.py in /var/www/cgi-bin/ | 19:51 |
| morganfainberg | jlk: s/respond/look at the questoon | 19:51 |
| jlk | ) | 19:51 |
| morganfainberg | ah, yeah wherever you actually put the main | 19:51 |
| jlk | main is the name of the function within the keystone.py file | 19:51 |
| morganfainberg | the doc writer just used /var/www/keystone/* vs. what you've picked /var/www/cgi-bin | 19:52 |
| jlk | yeah, the same doc uses /var/www/cgi-bin/ on http://docs.openstack.org/developer/keystone/apache-httpd.html | 19:53 |
| jlk | so the two should probably be reconciled | 19:53 |
| dolphm | morganfainberg: ++ | 19:54 |
| openstackgerrit | Merged openstack/keystone: Exposes bug in SQL/LDAP when honoring driver_hints https://review.openstack.org/158412 | 19:54 |
| dolphm | morganfainberg: i can't think of an argument to keep it, anyway. still working on getting there in the first place, so you'll have a review to vote on at some point | 19:55 |
| morganfainberg | jlk, yeah probably some doc mis-matches | 19:55 |
| jlk | morganfainberg: do we need a OS-FEDERATION script alias for both the standard port vhost and the admin port vhost? | 19:57 |
| jorge_munoz | lbragstad: dolphm Fernet tokens in v3 are not populating the audit_id. | 20:00 |
| jorge_munoz | on authenticate request. | 20:00 |
| dolphm | jorge_munoz: as in, they're not in the token's payload? or they're not returned to the user in the response body? | 20:01 |
| morganfainberg | stevemar, ^ jlk's question (i need to run to lunch) | 20:02 |
| jorge_munoz | dolphm: yes, its not in the token response body. | 20:02 |
| dolphm | jorge_munoz: does self.v3_token_data_helper.get_token_data() take audit_info in it's def? | 20:03 |
| dolphm | wondering if maybe the argument name is wrong or something | 20:03 |
| lbragstad | checking | 20:04 |
| lbragstad | yes, it takes audit_info | 20:04 |
| morganfainberg | jlk, for v3 admin/standard are the same thing (We don't differentiate) | 20:06 |
| lbragstad | dolphm: jorge_munoz https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L215 | 20:06 |
| morganfainberg | jlk, in the long run we're hoping to drop one of those (like as soon as v2 dies) | 20:07 |
| jlk | ooooh | 20:07 |
| jlk | that'd be nice | 20:07 |
| morganfainberg | :) | 20:07 |
| morganfainberg | long term i want to get keystone always deployed on port :443. | 20:07 |
| morganfainberg | and use web/url semantics to say "this is keystone" vs other things | 20:07 |
| *** jsavak has quit IRC | 20:08 | |
| morganfainberg | but having to choose a non-80/443 port, 5000 would be used because then the 35735 or whatever it is that is in the default linux ephemeral range is a non-issue | 20:08 |
| lbragstad | dolphm: jorge_munoz it looks like the audit_info is passed to the get_token_data method | 20:08 |
| morganfainberg | jlk, so i'd say best bet is for federation/v3 work assume both ports should be the same. | 20:09 |
| jlk | yeah, we'd have to arrange some things differently, set up our vhosts differently so provide both horizon and keystone (and whatever else we toss behind apache) on the same host, but that's all do-able. | 20:09 |
| jlk | doesn't work so well if you want to run different httpd processes for each service | 20:09 |
| jlk | they can't all listen on the same port, would have to put a proxy in place | 20:09 |
| jorge_munoz | lbragstad: dolphm It seems that the issue is that the create_token does not update the token_data with the audit_ids | 20:11 |
| bknudson | you can already deploy keystone that way... it's just apache config. | 20:11 |
| *** fifieldt has quit IRC | 20:11 | |
| *** fifieldt_ has joined #openstack-keystone | 20:11 | |
| *** timcline has quit IRC | 20:12 | |
| *** timcline has joined #openstack-keystone | 20:13 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/161813 | 20:13 |
| lbragstad | jorge_munoz: on create token, it should populate that information here? https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L88 | 20:14 |
| lbragstad | in which case, I think think it is touched when creating the token_id in the formatters | 20:14 |
| lbragstad | s/is/isn't/ | 20:16 |
| openstackgerrit | Merged openstack/keystone: Fix places where role API calls still called assignment_api https://review.openstack.org/153580 | 20:16 |
| jorge_munoz | lbragstad: The audit ids are being popped here: /home/jorge/source/keystone/keystone/token/providers/fernet/token_formatters.py(138) | 20:16 |
| lbragstad | jorge_munoz: you're right | 20:17 |
| jorge_munoz | https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L126 | 20:17 |
| morganfainberg | we put audit ids in for juno right? | 20:17 |
| morganfainberg | we can probably make them required for kilo and beyond | 20:18 |
| dolphm | morgdo not know | 20:18 |
| dolphm | morganfainberg: tab-complete fail! | 20:18 |
| morganfainberg | dol we should find out | 20:18 |
| morganfainberg | >.> | 20:18 |
| morganfainberg | i can fail to tab too! ;) | 20:19 |
| lbragstad | jorge_munoz: try that same tests with this https://review.openstack.org/#/c/161855/1 | 20:19 |
| lbragstad | test* | 20:19 |
| lbragstad | jorge_munoz: that change just gets rid of some of the token_data logic in the formatters | 20:20 |
| jorge_munoz | lbragstad: this is the problem if isinstance(audit_ids, list) and len(audit_ids) == 1: | 20:20 |
| lbragstad | jorge_munoz: yep, | 20:20 |
| lbragstad | jorge_munoz: that needs to go away | 20:20 |
| lbragstad | jorge_munoz: dolphm has a patch up to fix it | 20:20 |
| dolphm | how convenient! | 20:21 |
| morganfainberg | let me check on when audit ids were added | 20:21 |
| morganfainberg | if they were added in juno we can just make all tokens require them. the reason we didn't before was to support upgrades | 20:21 |
| morganfainberg | where some older tokens may not have had it | 20:21 |
| morganfainberg | (seems like a weird edge case but ... meh?) | 20:22 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove Fernet formatter's dep on trust_api / v3 token helper https://review.openstack.org/161876 | 20:23 |
| *** chrisshattuck has joined #openstack-keystone | 20:23 | |
| *** chrisshattuck has quit IRC | 20:24 | |
| jorge_munoz | lbragstad: sweet, that would fix the v2 stuff too. | 20:24 |
| lbragstad | jorge_munoz: ++ | 20:24 |
| *** chrisshattuck has joined #openstack-keystone | 20:25 | |
| *** openstackgerrit has quit IRC | 20:25 | |
| *** openstackgerrit has joined #openstack-keystone | 20:25 | |
| samueldmq | dstanek, thanks for your +2 on 'Fixes bug in SQL/LDAP when honoring driver_hints' (https://review.openstack.org/#/c/161702/) | 20:26 |
| samueldmq | morganfainberg, stevemar could you please take a look at this ? ^ we already have 2x +2 there :) | 20:27 |
| samueldmq | and we do need this fix for reseller, since we add is_domain filter to query for domains in the project table | 20:27 |
| samueldmq | :-) | 20:27 |
| *** afazekas has quit IRC | 20:29 | |
| lbragstad | jorge_munoz: that change should also make the tokens a little smaller since it converts them to bytes before sending them to msgpack | 20:30 |
| lbragstad | s/them/the audit_ids/ | 20:32 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove Fernet formatter's dep on trust_api / v3 token helper https://review.openstack.org/161876 | 20:35 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove token formatters dep on 'token_data' on create() https://review.openstack.org/161855 | 20:35 |
| dolphm | lbragstad: address your comments ^ | 20:35 |
| dolphm | addressed* | 20:35 |
| lbragstad | dolphm: thanks, lgtm | 20:36 |
| lbragstad | jorge_munoz: new patch up for your reviewing pleasure ^ | 20:36 |
| dolphm | lbragstad: i also think you'll like the first changed line here https://review.openstack.org/#/c/161876/2/keystone/tests/unit/token/test_fernet_provider.py | 20:37 |
| dolphm | bknudson: would like it too ^ | 20:37 |
| lbragstad | \o/ | 20:37 |
| *** g2` has quit IRC | 20:38 | |
| lbragstad | jorge_munoz: I lied about the audit_ids being shorter, that change lives here | 20:38 |
| lbragstad | https://review.openstack.org/#/c/160993/ | 20:38 |
| jorge_munoz | lbragstad: I'll take a look | 20:41 |
| *** g2` has joined #openstack-keystone | 20:43 | |
| *** david-lyle_afk has joined #openstack-keystone | 20:45 | |
| *** _cjones_ has joined #openstack-keystone | 20:46 | |
| *** david-lyle_afk has quit IRC | 20:47 | |
| *** david-lyle_afk has joined #openstack-keystone | 20:47 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 20:52 |
| *** chrisshattuck has quit IRC | 21:00 | |
| *** boris-42 has quit IRC | 21:02 | |
| *** chrisshattuck has joined #openstack-keystone | 21:02 | |
| *** raildo is now known as raildo_away | 21:03 | |
| *** david-lyle_afk is now known as david-lyle | 21:03 | |
| lbragstad | stevemar: have a minute for a federation testing question? | 21:06 |
| stevemar | lbragstad, i'm barely here | 21:06 |
| lbragstad | stevemar: no worries, I'll keep tinkering with it | 21:06 |
| stevemar | lbragstad, shoot away though | 21:07 |
| lbragstad | stevemar: I'm attempting to use the federation setup testing code for fernet tokens | 21:07 |
| stevemar | i saw the mixin patch, what else is up | 21:08 |
| lbragstad | stevemar: I seem to have pulled everything in the right place so it can be used by both the FederatedTokenTests as well as the FederatedFernetTokenTets | 21:08 |
| lbragstad | Tests* | 21:08 |
| lbragstad | I want to do a def test_federated_unscoped_token(self): | 21:08 |
| lbragstad | and call resp = self._issue_unscoped_token() | 21:08 |
| lbragstad | as my first test case | 21:08 |
| lbragstad | but get this instead, | 21:09 |
| lbragstad | stevemar: http://cdn.pasteraw.com/38cxjm9snavq3r7haf3bo826thvazdp | 21:09 |
| lbragstad | stevemar: which leads me to believe I don't have everything setup properly | 21:10 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 21:13 |
| morganfainberg | lbragstad, dolphm, audit ids were added for juno: https://github.com/openstack/keystone/commit/56527ee6575455ab664c3b7b247ef3db62cc2719 we could now make them mandatory for all tokens | 21:16 |
| dolphm | morganfainberg: are audit IDs emitted in CADF? | 21:17 |
| morganfainberg | dolphm, hm. i don't think they are. | 21:17 |
| openstackgerrit | Merged openstack/keystone: Fix a minor coding nit in Fernet testing https://review.openstack.org/161068 | 21:18 |
| lbragstad | dolphm: how does fernet know what we want the expiration time to be? | 21:18 |
| morganfainberg | lbragstad, DATETIME(created_at) + TIMEDELTA(ttl) ? | 21:18 |
| stevemar | lbragstad, hmm | 21:19 |
| stevemar | link to patch? | 21:19 |
| *** boris-42 has joined #openstack-keystone | 21:19 | |
| lbragstad | stevemar: this is the outdated one https://review.openstack.org/#/c/161380/ | 21:19 |
| lbragstad | stevemar: I'm still hacking on it | 21:19 |
| dolphm | lbragstad: morganfainberg ++ | 21:19 |
| dolphm | morganfainberg: the ttl isn't encoded in the token though, it's applied at validation time based on the current CONF | 21:20 |
| stevemar | lbragstad, search for auth_plugin_config_override | 21:20 |
| * dolphm more stateless all the things | 21:21 | |
| lbragstad | dolphm: I think I'm missing the part where we tell fernet what our token ttl is | 21:21 |
| dolphm | lbragstad: see L203 - L210 on the right https://review.openstack.org/#/c/161897/1/keystone/token/providers/fernet/core.py | 21:22 |
| morganfainberg | dolphm, TTL needs to be in the token afaik | 21:22 |
| dolphm | morganfainberg: why? if it was it'd be encrypted anyway | 21:23 |
| morganfainberg | dolphm, because otherwise i change the conf and tokens that weren't valid can become valid again | 21:23 |
| dolphm | morganfainberg: correct | 21:23 |
| morganfainberg | or vice versa | 21:23 |
| morganfainberg | change the conf and tokens that are valid are no longer | 21:23 |
| dolphm | morganfainberg: you can also permamently invalidate by doing key rotation | 21:23 |
| morganfainberg | we've always maintained a token has a fixed life when it is issued. | 21:23 |
| morganfainberg | this is a behavior change. | 21:23 |
| dolphm | morganfainberg: yeah, i'm suggesting we change that | 21:23 |
| lbragstad | dolphm: so fernet doesn't determine if the token is invalid based on expiration? | 21:24 |
| morganfainberg | dolphm, it also wouldn't be reflected in cached tokens at endpoints if KSM is caching | 21:24 |
| dolphm | morganfainberg: the above change still informs the client of the intended expiration. unless the deployer changes the CONF before that expiration date arrives, it'll hold true | 21:24 |
| morganfainberg | dolphm, i think this isn't a good change. | 21:24 |
| morganfainberg | you end up with potentially different behavior depending on configuration of KSM, keystone, etc. | 21:25 |
| morganfainberg | i am inclined to say we should encode the TTL in the token. | 21:25 |
| morganfainberg | i mean, i wont block this with it as is. | 21:25 |
| * morganfainberg would like to keep behavior as consistent as possible once a token has been issued. | 21:25 | |
| lbragstad | dolphm: one comment | 21:25 |
| dolphm | morganfainberg: sort of correct on the cache thing, i think. pretty sure we use the expiration as the cache timeout, right? so if you shortened the expiration in keystone on a live server, and had caching enabled in auth_token up to the token's intended expiration, the new, lowered CONF would take effect until new tokens are issued | 21:26 |
| dolphm | assuming perfect caching, etc | 21:26 |
| morganfainberg | if we cached a token [it was already used], lets assume a shared memcache between endpoints | 21:27 |
| morganfainberg | s/shared/non-shared/ | 21:27 |
| morganfainberg | then we use the token on an endpoint w/o a cache | 21:27 |
| *** joesavak has joined #openstack-keystone | 21:27 | |
| morganfainberg | the token would be rejected, but on the endpoint with the cache it would be accepted | 21:27 |
| morganfainberg | we don't use TTL as cache time, it's a fixed cache window | 21:28 |
| morganfainberg | like 300s | 21:28 |
| morganfainberg | or some such | 21:28 |
| morganfainberg | (configurable) | 21:28 |
| *** Akshik_ has quit IRC | 21:29 | |
| morganfainberg | dolphm, https://github.com/openstack/keystonemiddleware/blob/31cfc86526ce894ab7e130d389c73b78c1679aef/keystonemiddleware/auth_token/__init__.py#L269-L274 | 21:30 |
| morganfainberg | oh. crap | 21:30 |
| morganfainberg | this is potentially icky | 21:31 |
| dolphm | morganfainberg: which part? | 21:31 |
| *** Akshik_ has joined #openstack-keystone | 21:31 | |
| morganfainberg | we might store tokens in-process by default [the option comment says we do] | 21:31 |
| morganfainberg | meaning potentially validating tons of tokens causes memory bloat/ | 21:31 |
| *** topol has quit IRC | 21:31 | |
| morganfainberg | in services using KSM | 21:31 |
| morganfainberg | if they don't explicitly -1 cache time or use memcache | 21:32 |
| lbragstad | stevemar: cool, that worked, it's still giving me UUID tokens, but I'll keep poking it | 21:33 |
| morganfainberg | dolphm, and crap performance: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/openstack/common/memorycache.py#L64-L68 | 21:34 |
| * stevemar shrugs | 21:34 | |
| morganfainberg | if we have a lot of tokens that need to be purged | 21:34 |
| stevemar | lbragstad, tokens is your domain (pun intended) | 21:34 |
| morganfainberg | yeah... not good. | 21:34 |
| * morganfainberg has an in-memory caching idea to make cleanup less crap for dogpile and memorycache bad thing | 21:34 | |
| * lbragstad tips hat to stevemar | 21:34 | |
| dolphm | morganfainberg: uhh, i'm not following, which part is icky? the state of today, or with the proposed change? | 21:35 |
| morganfainberg | dolphm, the state of today | 21:35 |
| morganfainberg | dolphm, proposed change makes no difference | 21:35 |
| dolphm | oh, eek | 21:35 |
| morganfainberg | if you validate a ton of tokens and don't set memorycache you explode memory usage... and on each get we "cleanup" the cache | 21:35 |
| dolphm | morganfainberg: keep stewing on it. i'm just running with the narrative that fernet tokens are mostly stateless and everything occurs at validation time | 21:35 |
| morganfainberg | meaning we could bind up a lot of things. | 21:35 |
| dolphm | morganfainberg: gotcha lol | 21:36 |
| morganfainberg | AND worse we aren't threadsafe and so ksm could in theory seriously explode memory use | 21:36 |
| morganfainberg | because threadsafe/shared info is still important even with eventlet with multiple worker-things | 21:36 |
| morganfainberg | gah | 21:36 |
| dolphm | morganfainberg: but only with in-memory caching? | 21:36 |
| morganfainberg | yeah, for memcache we are only dealing with complete crap library, but we've worked around that using the advanced pool | 21:36 |
| *** Akshik_ has quit IRC | 21:37 | |
| * morganfainberg hangs head. | 21:39 | |
| morganfainberg | so uhm... i *think* i want to just drop memorycache in ksm for dogpile. | 21:39 |
| bknudson | you mean oslo.cache. | 21:39 |
| morganfainberg | bknudson, no because oslo.cache doesn't exist yet | 21:40 |
| morganfainberg | i mean.. just use dogpile directly and when oslo.cache becomes a reality make it better. | 21:40 |
| * morganfainberg also needs to go propose a pull request for upstream dogpile now. | 21:40 | |
| dstanek | i wouldn't think memcache itself (not just the library) would work all that well with our tokens | 21:40 |
| morganfainberg | dstanek, it offloads a lot of validation / call back to keystone if you share the cache | 21:41 |
| morganfainberg | dstanek, it works fine. | 21:41 |
| bknudson | the revocation list breaks it | 21:41 |
| morganfainberg | the revocation list is an issue. | 21:41 |
| morganfainberg | bknudson, we do have someone who has expressed interest in doing oslo.cache directly | 21:41 |
| morganfainberg | i think you know that cause you were at the meeting | 21:41 |
| bknudson | I was at the meeting. | 21:42 |
| morganfainberg | so let me go propose this in-memory caching backend that doesnt suck as badly to upstream dogpile. | 21:42 |
| morganfainberg | and then i think i'll rip out memorycache from ksm and use something better. | 21:43 |
| morganfainberg | cause this is no-bueno | 21:43 |
| dstanek | morganfainberg: i'm surprised that is works that well at scale because of the way the slabs work and the tremendous waste of memory | 21:43 |
| morganfainberg | dstanek, its better than asking keystone every time... but honestly, i think people don't use the memcahce part... they use the in-process cache, which has some serious issues. | 21:44 |
| *** joesavak has quit IRC | 21:44 | |
| * morganfainberg tries to remember bitbucket password | 21:44 | |
| * morganfainberg wonders if we could get dogpile moved over to under gerrit... | 21:45 | |
| *** iamjarvo has quit IRC | 21:53 | |
| *** _cjones_ has quit IRC | 21:53 | |
| *** iamjarvo has joined #openstack-keystone | 21:54 | |
| *** jamielennox|away is now known as jamielennox | 21:56 | |
| *** _cjones_ has joined #openstack-keystone | 21:57 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth and federation authentication to config file https://review.openstack.org/161317 | 22:02 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 22:03 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: refactor: scoped tokens are always scoped https://review.openstack.org/161921 | 22:03 |
| *** junhongl has quit IRC | 22:04 | |
| *** junhongl has joined #openstack-keystone | 22:05 | |
| *** edmondsw has quit IRC | 22:07 | |
| *** samueldmq_ has joined #openstack-keystone | 22:07 | |
| *** Bsony has quit IRC | 22:07 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes minor whitespace issues https://review.openstack.org/161828 | 22:09 |
| morganfainberg | well that is *not* cool. | 22:09 |
| *** tqtran has joined #openstack-keystone | 22:09 | |
| *** tqtran has quit IRC | 22:09 | |
| * morganfainberg was going to use something clever | 22:10 | |
| morganfainberg | but it's broken in python | 22:10 |
| morganfainberg | :( | 22:10 |
| *** tqtran has joined #openstack-keystone | 22:17 | |
| dstanek | morganfainberg: clever not good usually anyway | 22:17 |
| morganfainberg | dstanek, thing = [[]] * 10 | 22:17 |
| morganfainberg | dstanek, thing[0].append('stuff') | 22:18 |
| morganfainberg | [['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff'], ['stuff']] | 22:18 |
| morganfainberg | yeah... there goes using a mutable as the input for that | 22:18 |
| morganfainberg | :P | 22:18 |
| morganfainberg | i know why that is happening. it doens't mean it makes me happy | 22:19 |
| dstanek | yay, for references! | 22:19 |
| morganfainberg | yah | 22:19 |
| morganfainberg | sometimes python is a little wierd in when it chooses to use the reference and not | 22:19 |
| dstanek | thing = [[] for _ in range(10)]? | 22:19 |
| samueldmq_ | lol makes sense but weird | 22:19 |
| morganfainberg | yeah that'd work. | 22:19 |
| *** stevemar has quit IRC | 22:20 | |
| *** stevemar has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v stevemar | 22:20 | |
| *** ayoung has quit IRC | 22:24 | |
| samueldmq_ | morganfainberg, and as 'thing = ([] for _ in range(10))' it becomes a generator ... | 22:26 |
| morganfainberg | samueldmq_, yeah | 22:26 |
| samueldmq_ | morganfainberg, think I didnt knew about generators in python ... it's interesting | 22:27 |
| samueldmq_ | s/knew/know | 22:27 |
| *** lhcheng has quit IRC | 22:33 | |
| *** gordc has quit IRC | 22:38 | |
| *** richm has quit IRC | 22:41 | |
| *** lhcheng has joined #openstack-keystone | 22:42 | |
| bknudson | itertools.repeat([], 10) | 22:44 |
| dstanek | bknudson: i think that will have the same issue | 22:46 |
| bknudson | it does, it's a ref. | 22:47 |
| morganfainberg | hmm.. http://paste.openstack.org/show/189729/ | 22:59 |
| morganfainberg | i think ^^ that would make in-memory caches better [even if we just applied the same kind of logic to the oslo-incubator thing] | 22:59 |
| morganfainberg | some added logic is likely needed for memorycache since it doesn't store all the expiry w/ the value | 23:00 |
| *** mattfarina has quit IRC | 23:02 | |
| *** haneef_ has quit IRC | 23:06 | |
| *** _cjones_ has quit IRC | 23:09 | |
| *** _cjones_ has joined #openstack-keystone | 23:17 | |
| *** jorge_munoz has quit IRC | 23:18 | |
| *** _cjones_ has quit IRC | 23:22 | |
| *** _cjones_ has joined #openstack-keystone | 23:28 | |
| *** _cjones_ has quit IRC | 23:29 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:32 | |
| *** cyeoh has joined #openstack-keystone | 23:41 | |
| *** _cjones_ has joined #openstack-keystone | 23:43 | |
| *** openstack has joined #openstack-keystone | 23:52 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use oslo.policy instead of incubated version https://review.openstack.org/148624 | 23:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove incubated version of oslo policy https://review.openstack.org/157158 | 23:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Cleanup policy related tests https://review.openstack.org/158561 | 23:53 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove policy parsing exception https://review.openstack.org/158562 | 23:53 |
| *** ayoung has joined #openstack-keystone | 23:57 | |
| *** ChanServ sets mode: +v ayoung | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!