| *** esp has left #openstack-keystone | 00:02 | |
| *** henrynash has quit IRC | 00:04 | |
| breton | samueldmq: db_sync, in fact, applies migrations starting from 1. It does nothing else. So, if you already have Juno migrations applied, db_sync will apply only Kilo ones. | 00:10 |
|---|---|---|
| breton | samueldmq: from time to time squash old migrations and move them to one giant migration. It's called 034_havana.py now. db_sync considers it to be the first. | 00:11 |
| breton | *from time to time we squash | 00:16 |
| *** _cjones_ has quit IRC | 00:16 | |
| samueldmq | breton, ah ok ... so we always apply them | 00:26 |
| samueldmq | breton, I was concerned by the addition of an index | 00:26 |
| samueldmq | breton, from the table definition, sqlalchemy automatically names it ix_assignment_actor_id, but the migration names it ix_actor_id | 00:27 |
| samueldmq | breton, so I was concerned that if we had a fresh installation OR a previous installation | 00:27 |
| samueldmq | breton, we could have different names | 00:28 |
| samueldmq | breton, https://github.com/openstack/keystone/blob/master/keystone/assignment/backends/sql.py#L402 | 00:28 |
| samueldmq | breton, https://github.com/openstack/keystone/blob/master/keystone/common/sql/migrate_repo/versions/054_add_actor_id_index.py#L25 | 00:29 |
| samueldmq | breton, so in fact, for subsequent migrations, I only need to consider ix_actor_id | 00:29 |
| samueldmq | breton, thanks | 00:30 |
| *** abhirc has quit IRC | 00:51 | |
| *** abhirc has joined #openstack-keystone | 00:51 | |
| *** nicodemos has quit IRC | 00:52 | |
| *** nicodemos has joined #openstack-keystone | 00:53 | |
| *** abhirc has quit IRC | 00:55 | |
| *** abhirc has joined #openstack-keystone | 00:55 | |
| *** abhirc has quit IRC | 00:57 | |
| *** abhirc has joined #openstack-keystone | 00:57 | |
| *** abhirc has quit IRC | 00:58 | |
| *** abhirc has joined #openstack-keystone | 00:58 | |
| *** abhirc has quit IRC | 01:05 | |
| *** _cjones_ has joined #openstack-keystone | 01:12 | |
| *** samueldmq has quit IRC | 01:17 | |
| *** samueldmq has joined #openstack-keystone | 01:18 | |
| *** radez_g0n3 is now known as radez | 01:25 | |
| *** ncoghlan has joined #openstack-keystone | 01:29 | |
| *** _cjones_ has quit IRC | 01:31 | |
| *** abhirc has joined #openstack-keystone | 01:40 | |
| *** _cjones_ has joined #openstack-keystone | 01:51 | |
| *** radez is now known as radez_g0n3 | 01:51 | |
| *** qwebirc49866 has joined #openstack-keystone | 01:58 | |
| *** qwebirc49866 has quit IRC | 01:58 | |
| *** DaveChen has joined #openstack-keystone | 01:59 | |
| *** krtaylor has quit IRC | 02:04 | |
| *** diegows has quit IRC | 02:11 | |
| *** kaisers has joined #openstack-keystone | 02:19 | |
| *** kaisers1 has quit IRC | 02:20 | |
| *** lhcheng has quit IRC | 02:29 | |
| *** Krast has joined #openstack-keystone | 02:32 | |
| *** _cjones_ has quit IRC | 02:37 | |
| *** samueldmq has quit IRC | 02:47 | |
| *** erkules has joined #openstack-keystone | 02:49 | |
| *** erkules_ has quit IRC | 02:49 | |
| *** browne has joined #openstack-keystone | 02:49 | |
| *** krtaylor has joined #openstack-keystone | 02:55 | |
| *** dimsum__ has quit IRC | 03:02 | |
| *** lhcheng has joined #openstack-keystone | 03:30 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use region or region_id in a consistent way https://review.openstack.org/162465 | 03:33 |
| *** lhcheng has quit IRC | 03:34 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use `region` or `region_id` in a consistent way https://review.openstack.org/162465 | 03:39 |
| *** _cjones_ has joined #openstack-keystone | 03:44 | |
| *** iamjarvo has quit IRC | 03:45 | |
| *** _cjones_ has quit IRC | 03:55 | |
| *** iamjarvo has joined #openstack-keystone | 04:02 | |
| *** iamjarvo has quit IRC | 04:02 | |
| *** iamjarvo has joined #openstack-keystone | 04:03 | |
| *** dimsum__ has joined #openstack-keystone | 04:03 | |
| *** dimsum__ has quit IRC | 04:09 | |
| *** iamjarvo has quit IRC | 04:45 | |
| *** _cjones_ has joined #openstack-keystone | 04:52 | |
| *** _cjones_ has quit IRC | 04:56 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Don't autodoc the test suite https://review.openstack.org/162525 | 05:12 |
| *** lhcheng has joined #openstack-keystone | 05:19 | |
| *** lhcheng has quit IRC | 05:24 | |
| *** lhcheng has joined #openstack-keystone | 05:29 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Provide a generic auth plugin loader https://review.openstack.org/162529 | 05:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading auth plugins via getter function https://review.openstack.org/161962 | 05:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading auth plugins via getter function https://review.openstack.org/161962 | 05:52 |
| *** topol has joined #openstack-keystone | 05:55 | |
| *** ChanServ sets mode: +v topol | 05:55 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/162386 | 06:03 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow registering additional plugins https://review.openstack.org/112564 | 06:08 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add Foreign Key constraints to `assignment` https://review.openstack.org/162543 | 06:24 |
| *** topol has quit IRC | 06:37 | |
| *** _cjones_ has joined #openstack-keystone | 06:53 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add scope info to initiator data for CADF notifications https://review.openstack.org/162547 | 06:57 |
| *** rwsu has joined #openstack-keystone | 06:57 | |
| *** _cjones_ has quit IRC | 06:58 | |
| *** rwsu is now known as rwsu-afk | 06:58 | |
| *** afazekas has joined #openstack-keystone | 07:09 | |
| *** mflobo has joined #openstack-keystone | 07:14 | |
| *** dimsum__ has joined #openstack-keystone | 07:41 | |
| breton | samueldmq: I'd consider this difference a bug. Not sure how severe though | 07:44 |
| *** lhcheng has left #openstack-keystone | 07:45 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/162386 | 07:45 |
| *** dimsum__ has quit IRC | 07:46 | |
| *** _cjones_ has joined #openstack-keystone | 07:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add cadf notifications for oauth https://review.openstack.org/159045 | 07:55 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 07:59 |
| rodrigods | marekd, stevemar ^ | 08:00 |
| *** _cjones_ has quit IRC | 08:00 | |
| rodrigods | removed the dependency | 08:00 |
| *** nellysmitt has joined #openstack-keystone | 08:00 | |
| marekd | rodrigods: thanks. | 08:01 |
| *** stevemar has quit IRC | 08:01 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add Foreign Key constraints to table of `assignment` https://review.openstack.org/162543 | 08:05 |
| *** chlong has quit IRC | 08:07 | |
| *** nellysmitt has quit IRC | 08:12 | |
| *** nellysmitt has joined #openstack-keystone | 08:12 | |
| *** josecastroleon has joined #openstack-keystone | 08:15 | |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** browne has quit IRC | 08:28 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix naming convention in configuration.rst https://review.openstack.org/162561 | 08:34 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Correct utf8/innodb issues with tables https://review.openstack.org/159803 | 08:47 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use assertFalse and assertTrue instead of assertEqual https://review.openstack.org/162570 | 08:55 |
| *** _cjones_ has joined #openstack-keystone | 08:56 | |
| *** jamiec has quit IRC | 08:58 | |
| *** _cjones_ has quit IRC | 09:02 | |
| *** ncoghlan has quit IRC | 09:03 | |
| *** dobson has quit IRC | 09:04 | |
| *** hogepodge has quit IRC | 09:04 | |
| *** karimb has joined #openstack-keystone | 09:04 | |
| *** jamiec has joined #openstack-keystone | 09:06 | |
| *** dobson has joined #openstack-keystone | 09:06 | |
| *** hogepodge has joined #openstack-keystone | 09:06 | |
| *** henrynash has joined #openstack-keystone | 09:10 | |
| *** ChanServ sets mode: +v henrynash | 09:10 | |
| *** jistr has joined #openstack-keystone | 09:13 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: IdP ID registration and validation https://review.openstack.org/152156 | 09:18 |
| *** karimb has quit IRC | 09:25 | |
| *** karimb has joined #openstack-keystone | 09:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 09:27 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 09:34 |
| kaisers | Hi! Does anybody here have experience with RedHat RDO OpenStack installations? Any idea where RDO hides keystone-paste.ini ? | 09:44 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Mark the domain-config API as experimental https://review.openstack.org/162484 | 09:48 |
| *** lhcheng has joined #openstack-keystone | 09:48 | |
| *** _cjones_ has joined #openstack-keystone | 09:59 | |
| *** henrynash has quit IRC | 10:02 | |
| *** _cjones_ has quit IRC | 10:09 | |
| *** abhirc has quit IRC | 10:16 | |
| *** dims_ has joined #openstack-keystone | 10:16 | |
| *** lhcheng has left #openstack-keystone | 10:26 | |
| *** radez_g0n3 is now known as radez | 10:29 | |
| *** radez is now known as radez_g0n3 | 10:53 | |
| *** fmarco76 has joined #openstack-keystone | 10:54 | |
| *** fmarco76 has left #openstack-keystone | 10:55 | |
| *** fmarco76 has joined #openstack-keystone | 10:58 | |
| *** josecastroleon has quit IRC | 11:00 | |
| *** chlong has joined #openstack-keystone | 11:03 | |
| *** _cjones_ has joined #openstack-keystone | 11:05 | |
| marekd | kaisers: if i recall correctly it was somewhere in /usr/share ? | 11:09 |
| marekd | lbragstad: dolphinator: Remind me please. When I want to use any OpenStack service with Fernet tokens, such service will always need to connect with Keystone and validate it? | 11:11 |
| *** markvoelker has joined #openstack-keystone | 11:13 | |
| kaisers | marekd: Thanks! | 11:15 |
| *** erkules has quit IRC | 11:32 | |
| *** erkules has joined #openstack-keystone | 11:32 | |
| kaisers | One more question: is there a difference between "s3 extension" and "OS-KSS3" extension??? | 11:37 |
| kaisers | The API lists OS-KSS3 :http://developer.openstack.org/api-ref-identity-v2.html but in the keystone-paste.ini i can only find "s3 extension".... | 11:38 |
| *** _cjones_ has quit IRC | 11:38 | |
| *** diegows has joined #openstack-keystone | 11:46 | |
| *** markvoelker has quit IRC | 11:47 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| *** markvoelker has quit IRC | 11:52 | |
| *** samueldmq has joined #openstack-keystone | 12:00 | |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** panbalag has joined #openstack-keystone | 12:06 | |
| *** joesavak has joined #openstack-keystone | 12:19 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use assertFalse or assertTrue instead of assertEqual https://review.openstack.org/162570 | 12:27 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 12:30 |
| *** iamjarvo has joined #openstack-keystone | 12:31 | |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 12:32 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 12:32 |
| *** gordc has joined #openstack-keystone | 12:34 | |
| *** _cjones_ has joined #openstack-keystone | 12:36 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:39 | |
| *** joesavak has quit IRC | 12:40 | |
| *** mohammed__ has joined #openstack-keystone | 12:42 | |
| *** aix has joined #openstack-keystone | 12:43 | |
| *** dims_ has quit IRC | 12:44 | |
| *** dimsum__ has joined #openstack-keystone | 12:44 | |
| *** joesavak has joined #openstack-keystone | 12:48 | |
| *** mohammed__ has left #openstack-keystone | 12:48 | |
| kaisers | A more general question: How do i install/configure extensions in keystone in general? Can somebody pls point me to documentation regarding this? | 12:50 |
| marekd | kaisers: extensions like oauth etc? | 12:51 |
| kaisers | i do know about keystone-paste.ini. Are new extensions added by adding the respective filter entry & pipeline additions? Are there sources needed to be installed? | 12:51 |
| kaisers | Very specific OS-KSS3 :-D | 12:52 |
| kaisers | I mean extensions like listet at http://developer.openstack.org/api-ref-identity-v2.html | 12:52 |
| dstanek | kaisers: how did you install Keystone? | 12:53 |
| kaisers | RDO standard installation | 12:53 |
| kaisers | More specific RDO juno release on CentOS 7 | 12:53 |
| dstanek | kaisers: depending on the extension you may have to install Python libs if RDO didn't included them | 12:54 |
| kaisers | python libs should be installed, if stuff like that is missing i'll be able to install. My issue is that i have no idea and find no documentation how an (any) extension from that API listing is installed | 12:55 |
| kaisers | i mean in keystone, of course | 12:56 |
| *** Tahmina has joined #openstack-keystone | 12:57 | |
| kaisers | From looking at the keystone-paste.ini and looking at the API page i find no correlation and i find no plugins/modules/etc. that i can research into or test installing. In Fact almost the only place i find anyhting about OS-KSS3 is that API page (linked above). | 12:57 |
| dstanek | kaisers: generally speaking you were right about added the pipeline entries - i don't know what the KSS3 extension is though | 12:57 |
| kaisers | dstanek: OS-KSS3 admin adds user manipulation for s3 accounts | 12:57 |
| dstanek | kaisers: i don't see that in the tree | 12:59 |
| kaisers | I should have been more specific, this is the api we require: http://developer.openstack.org/api-ref-identity-v2.html#os-kss3-admin-ext | 12:59 |
| dstanek | kaisers: i know what you are talking about, but i don't see the code anywhere | 13:00 |
| *** dimsum__ is now known as dims | 13:01 | |
| kaisers | dstanek: Oooops :-D | 13:02 |
| dstanek | kaisers: you may have to wait for one of the old timers to tell you what happened to it | 13:02 |
| kaisers | So this should normally be in the Juno branch of keystone, is that correct? | 13:02 |
| *** bknudson has left #openstack-keystone | 13:03 | |
| *** chlong has quit IRC | 13:04 | |
| kaisers | dstanek: I'll lurk an pounce later on again. Thanks a lot for bringing me so far!! :) | 13:09 |
| *** _cjones_ has quit IRC | 13:09 | |
| *** iamjarvo has quit IRC | 13:14 | |
| *** iamjarvo has joined #openstack-keystone | 13:16 | |
| *** chlong has joined #openstack-keystone | 13:17 | |
| *** yasu_ has joined #openstack-keystone | 13:18 | |
| *** henrynash has joined #openstack-keystone | 13:23 | |
| *** ChanServ sets mode: +v henrynash | 13:23 | |
| *** bknudson has joined #openstack-keystone | 13:24 | |
| *** ChanServ sets mode: +v bknudson | 13:24 | |
| *** mattfarina has joined #openstack-keystone | 13:33 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Mirror domain entries to project table https://review.openstack.org/161408 | 13:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add domain_id checking in create_project https://review.openstack.org/159944 | 13:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 13:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Bye bye domain table https://review.openstack.org/161854 | 13:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 13:38 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 13:38 |
| *** richm has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 13:49 |
| *** iamjarvo has quit IRC | 13:51 | |
| *** vhoward has joined #openstack-keystone | 13:55 | |
| *** henrynash has quit IRC | 13:56 | |
| *** henrynash has joined #openstack-keystone | 13:58 | |
| *** ChanServ sets mode: +v henrynash | 13:58 | |
| *** yasu_ has quit IRC | 14:05 | |
| *** _cjones_ has joined #openstack-keystone | 14:06 | |
| *** samueldmq_ has joined #openstack-keystone | 14:08 | |
| *** markvoelker has joined #openstack-keystone | 14:11 | |
| *** timcline has joined #openstack-keystone | 14:13 | |
| *** jsavak has joined #openstack-keystone | 14:17 | |
| *** markvoelker has quit IRC | 14:18 | |
| *** markvoelker has joined #openstack-keystone | 14:19 | |
| *** timcline has quit IRC | 14:20 | |
| *** timcline has joined #openstack-keystone | 14:20 | |
| *** joesavak has quit IRC | 14:21 | |
| *** markvoelker has quit IRC | 14:23 | |
| *** nellysmitt has quit IRC | 14:24 | |
| *** markvoelker has joined #openstack-keystone | 14:24 | |
| *** r-daneel has joined #openstack-keystone | 14:28 | |
| *** dolphinator is now known as dolphm | 14:37 | |
| dolphm | marekd: yes, they behave just like UUID tokens in that respect | 14:38 |
| marekd | dolphm: ok, thanks. | 14:38 |
| *** _cjones_ has quit IRC | 14:39 | |
| *** erkules has quit IRC | 14:40 | |
| *** jorge_munoz has joined #openstack-keystone | 14:46 | |
| *** erkules has joined #openstack-keystone | 14:47 | |
| *** erkules has quit IRC | 14:48 | |
| *** erkules has joined #openstack-keystone | 14:48 | |
| *** carlosmarin has joined #openstack-keystone | 14:49 | |
| *** topol has joined #openstack-keystone | 14:58 | |
| *** ChanServ sets mode: +v topol | 14:58 | |
| *** zzzeek has joined #openstack-keystone | 15:01 | |
| *** edmondsw has joined #openstack-keystone | 15:02 | |
| *** stevemar has joined #openstack-keystone | 15:03 | |
| *** ChanServ sets mode: +v stevemar | 15:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/162350 | 15:04 |
| edmondsw | lbragstad, can you take a look at https://review.openstack.org/#/c/161543/ ? Need another +2 and +w since the existing +2s were both from same company | 15:05 |
| *** nellysmitt has joined #openstack-keystone | 15:08 | |
| lbragstad | edmondsw: one question, inline | 15:10 |
| lbragstad | edmondsw: do we need to init the assignment.Manager()? | 15:10 |
| marekd | lbragstad: i was just commenting on this. i assume this must be initialized, but it's not that straightforward (see identity.Manager() above questionable line) | 15:12 |
| marekd | lbragstad: anyway, good point. | 15:12 |
| lbragstad | marekd: ++ | 15:12 |
| lbragstad | marekd: I figured there was a reason, but not 100% sure. A comment would be helpful | 15:13 |
| lbragstad | cc edmondsw ^ | 15:13 |
| edmondsw | lbragstad, yes, we do... doesn't work without that | 15:16 |
| marekd | edmondsw: can we add a comment? | 15:17 |
| edmondsw | marekd, sure... what do you want it to say? | 15:17 |
| marekd | edmondsw: that this must be initialized even though it's seem not to be used/returned. | 15:18 |
| edmondsw | "init to avoid KeyError on assignment_api in resource.core" | 15:18 |
| marekd | something like this. | 15:18 |
| *** j_king has joined #openstack-keystone | 15:20 | |
| *** browne has joined #openstack-keystone | 15:21 | |
| *** ayoung has joined #openstack-keystone | 15:22 | |
| *** ChanServ sets mode: +v ayoung | 15:22 | |
| j_king | working on https://bugs.launchpad.net/cinder/+bug/1298135 and am trying to grok whether the trusts API is the correct way to extend a token authorization for long-running processes | 15:22 |
| openstack | Launchpad bug 1298135 in Cinder "Cinder should handle token expiration for long ops" [Medium,Confirmed] - Assigned to j_king (james-agentultra) | 15:22 |
| ayoung | morganfainberg, topol bknudson dstanek stevemar do we have a plan for getting the functional testing started ? | 15:22 |
| ayoung | we don't , today, have a functional subdir under tests | 15:23 |
| stevemar | ayoung, dstanek has a slew of patches to get stuff working | 15:23 |
| ayoung | stevemar, looking | 15:23 |
| bknudson | ayoung: https://review.openstack.org/#/c/150528/ | 15:23 |
| stevemar | gordc, so alls i gotta do is update event_definitions? | 15:24 |
| stevemar | gordc, hows that work? | 15:24 |
| dstanek | ayoung: i also have a bunch of stuff i started working on that i haven't completed yet | 15:24 |
| dstanek | mostly moving v3 tests over to the functional tests | 15:24 |
| gordc | stevemar: yeah, just update event_definitions... | 15:25 |
| stevemar | gordc, hows that mapping work? | 15:25 |
| dstanek | i've been doing too many streams of parallel work, me thinks | 15:25 |
| gordc | stevemar: it becomes an event. basically, a notificatoin comes in and the event_definitions will index the values you have in mapping | 15:26 |
| *** afazekas has quit IRC | 15:26 | |
| gordc | stevemar: we don't want to make samples of notifications that don't have measurements anymore... because well a metric should measure something. | 15:26 |
| ayoung | dstanek, so I think I have an easier way to go about testing Federation | 15:28 |
| dstanek | ayoung: ? | 15:28 |
| ayoung | it won't test the whole stack, but it will test the mapping part | 15:29 |
| stevemar | gordc, i see, so what happens if a field is incorrectly referenced? it just defaults to None? | 15:29 |
| ayoung | OK...so I wrote this up: http://adam.younglogic.com/2015/03/key-fed-lookup-redux/ | 15:29 |
| ayoung | now, for my work, I am doing Kerberos, but I think we can do something using Basic Auth. | 15:29 |
| *** edmondsw has quit IRC | 15:29 | |
| ayoung | We have the LDAP target already. So we can, probably, use devstack's ldap support to set up ldap, and use SSSD/mod_lookup_identity to drive the mapping instead of pysaml | 15:30 |
| dstanek | ayoung: that's easier than setting up an IdP you mean? | 15:30 |
| ayoung | yes | 15:30 |
| gordc | stevemar: nothing. if it ain't there it won't be there... each event has arbitrary collection of indexed values. | 15:30 |
| *** markvoelker has quit IRC | 15:30 | |
| stevemar | gordc, that's super weird, but you're the boss | 15:30 |
| ayoung | dstanek, and, it also gets us a path to killing off the LDAP-specific code | 15:30 |
| ayoung | 2 for 1 goodness | 15:31 |
| *** markvoelker has joined #openstack-keystone | 15:31 | |
| dstanek | does that test the whole saml path? | 15:31 |
| ayoung | No, just mapping | 15:31 |
| dstanek | then i don't think that would be good enough for a functional test | 15:32 |
| *** samueldmq_ has quit IRC | 15:32 | |
| ayoung | Hmm, probably would still want SAML, but it would be a good alternative path to testing the mapping code | 15:32 |
| dstanek | ayoung: to me that would just be another configuration of many - would all potential federation tests work on that or would it require different tests? | 15:33 |
| gordc | stevemar: well generally you'd index something you knew exists... but considering openstack notifications are crazytown we won't explode if it doesn't exist. | 15:33 |
| ayoung | dstanek, I think I misread your comment. WHen you said "This IdP is nowhere near production quality. " I was thinking you meant for the test...but you mean "sufficient for test, don't use in production" | 15:33 |
| dstanek | ayoung: yes, it's a piece of crap, but it works well enough for tests :-) | 15:33 |
| marekd | dstanek: i think that's the best what we have among python impls :/ | 15:34 |
| ayoung | dstanek, so what I want to do is use the Mapping auth plugin as the normal way of binding to existing data, to include LDAP. | 15:34 |
| marekd | stevemar: did some research some time ago and pysaml was all in all the best. | 15:34 |
| marekd | ayoung: and we use it in fact for K2K. | 15:34 |
| marekd | dstanek: ^^ | 15:34 |
| marekd | well, some parts of it. | 15:35 |
| ayoung | marekd, don't get me started | 15:35 |
| ayoung | as you recall I raised some objections when that design got started | 15:35 |
| *** markvoelker has quit IRC | 15:35 | |
| *** edmondsw has joined #openstack-keystone | 15:35 | |
| *** _cjones_ has joined #openstack-keystone | 15:35 | |
| marekd | dont remember. | 15:36 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 15:37 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make extras optional in v3 get_token_data https://review.openstack.org/162661 | 15:37 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Deprecate passing "extras" in token data https://review.openstack.org/162662 | 15:37 |
| *** david-lyle_afk is now known as david-lyle | 15:38 | |
| *** markvoelker has joined #openstack-keystone | 15:38 | |
| edmondsw | lbragstad, marekd, new patch set is up with the comment added https://review.openstack.org/#/c/161543/ | 15:40 |
| bknudson | "was introduced to copy a bug in v2" LOL | 15:40 |
| *** rwsu-afk is now known as rwsu | 15:41 | |
| *** diegows has quit IRC | 15:42 | |
| lbragstad | edmondsw: thanks for adding the comment, | 15:42 |
| lbragstad | looks good to me once Jenkins passes | 15:43 |
| dolphm | bknudson: it's true | 15:43 |
| edmondsw | lbragstad, tx | 15:43 |
| *** markvoelker has quit IRC | 15:43 | |
| *** markvoelker has joined #openstack-keystone | 15:44 | |
| *** nellysmitt has quit IRC | 15:49 | |
| *** markvoelker has quit IRC | 15:49 | |
| *** Tahmina has quit IRC | 15:52 | |
| *** nellysmitt has joined #openstack-keystone | 15:52 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove dep on trust_api / v3 token helper https://review.openstack.org/161876 | 15:55 |
| *** diegows has joined #openstack-keystone | 15:56 | |
| lbragstad | dolphm: you're rebasing those on master I take it? | 15:57 |
| dolphm | lbragstad: yes, indirectly i suppose. just made that depend on "make extras optional" | 15:58 |
| dolphm | which is based on master | 15:58 |
| *** tqtran has joined #openstack-keystone | 15:58 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 15:59 |
| *** _cjones_ has quit IRC | 16:01 | |
| lbragstad | dolphm: cool, I'm reworking the federated stuff on top of your latest changes. I was going to rebase to pick up the federated mixin change | 16:03 |
| dolphm | lbragstad: it should be there then? | 16:08 |
| lbragstad | dolphm: I'm building on https://review.openstack.org/#/c/160993/ | 16:08 |
| lbragstad | dolphm: which I think I'll need to rebase once https://review.openstack.org/#/c/161897/7 is rebased? | 16:09 |
| dolphm | lbragstad: i haven't rebased that one yet | 16:09 |
| dolphm | lbragstad: i'm rebasing and addressing comments on patch at a time | 16:09 |
| lbragstad | dolphm: yep, that's fine | 16:09 |
| *** nellysmitt has quit IRC | 16:11 | |
| *** _cjones_ has joined #openstack-keystone | 16:14 | |
| *** _cjones_ has quit IRC | 16:14 | |
| *** _cjones_ has joined #openstack-keystone | 16:14 | |
| *** browne has quit IRC | 16:21 | |
| *** jsavak has quit IRC | 16:21 | |
| *** nellysmitt has joined #openstack-keystone | 16:21 | |
| *** esp has joined #openstack-keystone | 16:29 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 16:35 |
| *** krtaylor has quit IRC | 16:36 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 16:38 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 16:38 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 16:38 |
| dolphm | lbragstad: all done ^ | 16:38 |
| dolphm | lbragstad: you're implementing a new payload version, right? | 16:39 |
| lbragstad | dolphm: yep | 16:41 |
| *** krtaylor has joined #openstack-keystone | 16:48 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactoring: remove self._config_file_list from TestCase https://review.openstack.org/162684 | 16:51 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactoring: removed client method from TestCase https://review.openstack.org/162685 | 16:51 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactoring: use BaseTestCase instead of TestCase https://review.openstack.org/162686 | 16:51 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes unused sys.exit mocking https://review.openstack.org/162687 | 16:51 |
| dstanek | ^ stash cleanup | 16:51 |
| *** Krast has quit IRC | 16:55 | |
| *** Krast has joined #openstack-keystone | 16:56 | |
| *** angular_mike has joined #openstack-keystone | 17:01 | |
| *** gyee has joined #openstack-keystone | 17:02 | |
| *** ChanServ sets mode: +v gyee | 17:02 | |
| *** browne has joined #openstack-keystone | 17:03 | |
| *** _cjones_ has quit IRC | 17:05 | |
| *** edmondsw has quit IRC | 17:08 | |
| *** nellysmitt has quit IRC | 17:11 | |
| *** nellysmitt has joined #openstack-keystone | 17:13 | |
| *** zzzeek has quit IRC | 17:16 | |
| *** nellysmitt has quit IRC | 17:17 | |
| *** zzzeek has joined #openstack-keystone | 17:21 | |
| *** _cjones_ has joined #openstack-keystone | 17:24 | |
| *** iamjarvo has joined #openstack-keystone | 17:36 | |
| *** iamjarvo has quit IRC | 17:36 | |
| *** iamjarvo has joined #openstack-keystone | 17:37 | |
| *** tqtran_ has joined #openstack-keystone | 17:38 | |
| *** lhcheng has joined #openstack-keystone | 17:38 | |
| *** tqtran_ has quit IRC | 17:38 | |
| *** harlowja has joined #openstack-keystone | 17:40 | |
| *** leonchio_ has joined #openstack-keystone | 17:41 | |
| *** lhcheng has quit IRC | 17:43 | |
| *** harlowja_ has joined #openstack-keystone | 17:43 | |
| *** harlowja has quit IRC | 17:45 | |
| *** fmarco76 has quit IRC | 17:47 | |
| *** lhcheng has joined #openstack-keystone | 17:57 | |
| *** lhcheng_ has joined #openstack-keystone | 17:58 | |
| *** jistr has quit IRC | 17:59 | |
| *** comstud has joined #openstack-keystone | 18:01 | |
| *** lhcheng has quit IRC | 18:01 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 18:02 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 18:03 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 18:04 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 18:04 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 18:04 |
| *** chlong has quit IRC | 18:05 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes logging code that supported Python <2.7 https://review.openstack.org/162706 | 18:19 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 18:20 |
| *** karimb has quit IRC | 18:27 | |
| *** pnavarro has quit IRC | 18:29 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/162711 | 18:30 |
| *** iamjarvo has quit IRC | 18:36 | |
| *** mgagne is now known as mgagne_PHL | 18:42 | |
| *** _cjones_ has quit IRC | 18:44 | |
| *** iamjarvo has joined #openstack-keystone | 18:49 | |
| openstackgerrit | Merged openstack/keystone: Refactor: make extras optional in v3 get_token_data https://review.openstack.org/162661 | 18:52 |
| *** thedodd has joined #openstack-keystone | 18:54 | |
| openstackgerrit | Merged openstack/keystone: Deprecate passing "extras" in token data https://review.openstack.org/162662 | 18:54 |
| * morganfainberg starts moving today. | 18:56 | |
| stevemar | morganfainberg, nice | 18:57 |
| stevemar | east coast is where its at | 18:57 |
| morganfainberg | no. not nice. | 18:57 |
| morganfainberg | oh not as in relocating unless you mean relocating beyond the edge of my bed :P | 18:59 |
| * morganfainberg is not moving living location(s) yet | 18:59 | |
| *** spandhe has joined #openstack-keystone | 19:01 | |
| *** iamjarvo has quit IRC | 19:02 | |
| *** iamjarvo has joined #openstack-keystone | 19:05 | |
| *** iamjarvo has quit IRC | 19:05 | |
| *** iamjarvo has joined #openstack-keystone | 19:06 | |
| *** _cjones_ has joined #openstack-keystone | 19:12 | |
| *** jorge_munoz has quit IRC | 19:19 | |
| lbragstad | dolphm: marekd federated fernet token length (w/ one group) http://cdn.pasteraw.com/ouzgugnazt0bf7fnjo5jdadddq1qs3k | 19:22 |
| dolphm | lbragstad: really? | 19:22 |
| dolphm | lbragstad: wasn't 140 unscoped size? | 19:22 |
| lbragstad | dolphm: yeah | 19:22 |
| lbragstad | dolphm: an unscoped token and federeated unscoped token are about the same | 19:23 |
| dolphm | lbragstad: then how is that possible? | 19:23 |
| lbragstad | dolphm: the only thing different from what I can tell, is the number of groups passed into the token | 19:23 |
| dolphm | lbragstad: so, keep adding groups to the list until you exceed 255 - what's the max number of groups? | 19:23 |
| lbragstad | so it can be a lot bigger than that | 19:23 |
| morganfainberg | and if it doesn't increase in size with more groups ... you might be missing something | 19:24 |
| morganfainberg | :P | 19:24 |
| morganfainberg | ayoung. ping re: https://review.openstack.org/#/c/159803/ i think this is a better setup to isolate the schema fixes. should be ready for review now. | 19:25 |
| ayoung | morganfainberg, lookING | 19:26 |
| morganfainberg | ayoung, it may still need massaging to be 100% right. | 19:26 |
| ayoung | morganfainberg, I see what you are aiming for...makes sense | 19:27 |
| ayoung | morganfainberg, so...the issue is in the federation tables. I think the version being 37 does not match that | 19:28 |
| morganfainberg | ayoung, its the same net effect | 19:28 |
| ayoung | the sanity check should be on the federation tables version, not the common one | 19:28 |
| morganfainberg | _37 had the same issue. | 19:28 |
| morganfainberg | just no FKs associated | 19:29 |
| ayoung | ah...so that is good there, but the Federation one should have it regardless... | 19:29 |
| ayoung | But I like the direction | 19:29 |
| morganfainberg | wait what? | 19:29 |
| ayoung | morganfainberg, the sanity check vesrion should be on the Federation repo | 19:29 |
| ayoung | not on the global one | 19:29 |
| morganfainberg | it should be in both cases. if you are wedged in more than 1 schema in an upgrade, you don't want to need to re-run | 19:30 |
| ayoung | https://review.openstack.org/#/c/159803/14/keystone/common/sql/migrate_repo/__init__.py,cm is good for fixing the common tabl;es, but a user can run the migrations for common and for federation separately | 19:30 |
| ayoung | db_sync did not automatically run for federation in the past | 19:30 |
| *** jorge_munoz has joined #openstack-keystone | 19:30 | |
| morganfainberg | ayoung, and you could still be equally wedged | 19:30 |
| ayoung | I *think* so | 19:30 |
| openstackgerrit | Merged openstack/keystone: Remove extra semicolon from mapping fixtures https://review.openstack.org/148080 | 19:30 |
| morganfainberg | you have 2 separate code paths. | 19:31 |
| morganfainberg | just using the same-ish logic | 19:31 |
| morganfainberg | main repo vs extensions | 19:31 |
| morganfainberg | both could get wedged in cases | 19:31 |
| morganfainberg | i dont want to run the "Fix" in all cases, we should know if/where we get wedged. | 19:31 |
| morganfainberg | again this comes back to "dont run things that change the db unless you really need to" | 19:32 |
| morganfainberg | even if it's a no op. i don't trust things to not go sideways. | 19:32 |
| morganfainberg | i think thats what your saying, just let _fix_37 run anywhere/anytime | 19:32 |
| morganfainberg | ? | 19:32 |
| ayoung | morganfainberg, I think that what should be done is to continue the logic you have for extensions. So in the federation extension __init__ file have the same code as https://review.openstack.org/#/c/159803/14/keystone/common/sql/migrate_repo/__init__.py,cm but for version 2 | 19:33 |
| * morganfainberg is almost a fan of just removing the sanity check completly | 19:33 | |
| morganfainberg | always run sanity_check=False | 19:33 |
| ayoung | morganfainberg, sanity check shoukld run at the end, not the beginning | 19:33 |
| morganfainberg | the sanity check should probably never run | 19:34 |
| ayoung | their heart was in the right place, their head, not so much | 19:34 |
| morganfainberg | not wedged down in oslo.db | 19:34 |
| morganfainberg | if we want to run a sanity check ourselves, thats fine. | 19:34 |
| ayoung | sanity check makes sense to run at the end of the migrations, to test if a new migration did something dumb | 19:34 |
| morganfainberg | but it shouldn't be in oslo.db critical path at all | 19:34 |
| ayoung | Yeah, it is the wrong time to run it | 19:34 |
| ayoung | better to have it in the functional tests | 19:35 |
| morganfainberg | it should (if anything) be run from our migration_helpers | 19:35 |
| morganfainberg | not the oslo_db.sqlalchemy.migration.db_sync | 19:35 |
| morganfainberg | once we have functional testing up we should swing back through and make sanity check only ever run there. | 19:36 |
| dolphm | jorge_munoz: lbragstad: have a link to the v2 fernet patch? | 19:37 |
| lbragstad | dolphm: I think this is the one jorge_munoz is working https://review.openstack.org/#/c/159229/ | 19:37 |
| dolphm | jorge_munoz: lbragstad: my last patch should make v2 simpler to implement https://review.openstack.org/#/c/162338/ | 19:38 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Implement validation on the Identity V3 API https://review.openstack.org/132122 | 19:39 |
| lbragstad | dolphm: ++ | 19:39 |
| dolphm | lbragstad: that's basically the end result that we discussed earlier last week | 19:39 |
| lbragstad | dolphm: yeah I was looking through it, it looks good | 19:39 |
| samueldmq | morganfainberg, could we have 'list role assignments refactoring' back to priority reviews? | 19:43 |
| morganfainberg | samueldmq, which one? | 19:44 |
| samueldmq | morganfainberg, https://review.openstack.org/#/c/137202/ | 19:44 |
| morganfainberg | samueldmq, as it stands we're not getting enough reviews on the current high priority ones | 19:45 |
| morganfainberg | that is pretty far down my list [especially since it involves a massive chain of patches] | 19:45 |
| morganfainberg | samueldmq, it's just an issue of getting reviews on everything at this point. | 19:46 |
| morganfainberg | samueldmq, and we are exceptionally close to a milestone. | 19:47 |
| morganfainberg | samueldmq, i don't see it as a blocker for K3 or kilo, i see it as a nice to have. | 19:47 |
| samueldmq | morganfainberg, ok I understand, it's just a question on getting reviews on it | 19:47 |
| morganfainberg | same with x509 at this point | 19:47 |
| morganfainberg | not a blocker for kilo/k3 | 19:48 |
| morganfainberg | nice to have if we get it | 19:48 |
| samueldmq | morganfainberg, maybe the old "review other's patches prior to get yours reviewed" may work here, I'll try :) | 19:48 |
| morganfainberg | samueldmq, this is what happens when everything gets wedged into the last milestone for features. | 19:48 |
| morganfainberg | samueldmq, the nice to haves get booted | 19:48 |
| morganfainberg | because there just isn't enough bandwidth to get everything in | 19:48 |
| ayoung | morganfainberg, remove the sanity check. Create an explicit sanity check option for keystone-manage as a follow on patch | 19:49 |
| *** thedodd has quit IRC | 19:49 | |
| samueldmq | morganfainberg, k I understand, especially this one, that has been there for almost a complete cycle now :/ | 19:49 |
| morganfainberg | ayoung, once we have functional testing | 19:49 |
| samueldmq | morganfainberg, but ok, your point is fair enough | 19:49 |
| samueldmq | morganfainberg, thanks for clarifying | 19:49 |
| morganfainberg | ayoung, but i don't see that as possible now and we need to backport this fix. | 19:49 |
| *** thedodd has joined #openstack-keystone | 19:49 | |
| morganfainberg | samueldmq, i know. =/ doing my best to get things landed | 19:50 |
| morganfainberg | lbragstad, https://review.openstack.org/#/c/161380/ needs a rebase. | 19:50 |
| lbragstad | morganfainberg: working on it now | 19:51 |
| samueldmq | morganfainberg, yeah you're doing well :) | 19:51 |
| *** radez_g0n3 is now known as radez | 19:51 | |
| samueldmq | morganfainberg, I'll review more patches to try to get things moving | 19:51 |
| samueldmq | morganfainberg, then maybe there will be time for this :) | 19:52 |
| samueldmq | morganfainberg, thanks | 19:52 |
| morganfainberg | jorge_munoz, dolphm, lbragstad, and we need some movement on the v2 fernet support early this week. | 19:52 |
| morganfainberg | so we can get eyes on it before "OMG k3 is being cut" | 19:52 |
| ayoung | morganfainberg, disable sanity check now | 19:53 |
| ayoung | add sanity check in the future | 19:53 |
| dolphm | morganfainberg: i'm reviewing it now, and looking at rebasing on top of some of my other patches, which should make it simpler to implement | 19:53 |
| ayoung | I don't see the value of the sanity check | 19:53 |
| morganfainberg | dolphm, ++ | 19:53 |
| *** thedodd has quit IRC | 19:54 | |
| dolphm | lbragstad: is jorge_munoz around today? | 19:54 |
| lbragstad | dolphm: should be | 19:54 |
| *** iamjarvo has quit IRC | 19:55 | |
| morganfainberg | dhellmann, zzzeek, ping re: sanity check in oslo.db. I think we're at the point where we're ready to just disable it. it has succefully wedged deployers at least twice. it is being run in the wrong place and can get people into a state where you cannot run further migrations | 19:55 |
| morganfainberg | dhellmann, zzzeek, any reason we should continue to use it before i rip it out of keystone? | 19:55 |
| morganfainberg | ayoung, ^cc | 19:55 |
| morganfainberg | ayoung, before we do that. | 19:55 |
| ayoung | morganfainberg, ++ | 19:55 |
| zzzeek | morganfainberg: the ping thing? it helps if your DB connection is gone, which we’ve observed happens a lot with mis-configured HAProxys | 19:55 |
| morganfainberg | no, sanity check | 19:56 |
| zzzeek | oh | 19:56 |
| zzzeek | morganfainberg: whats that? | 19:56 |
| morganfainberg | zzzeek, it's the "are we utf8/innodb" | 19:56 |
| zzzeek | morganfainberg: oh | 19:56 |
| morganfainberg | it's run before you run any migrations... it means if your DB is not utf8/innodb and then you get a new migration, you can't run it | 19:56 |
| morganfainberg | you can't even run a migration to fix it | 19:56 |
| zzzeek | morganfainberg: how is that messing people up ? at least the innodb part | 19:56 |
| ayoung | zzzeek, sanity check effectively prevents migrations from being run. It prevents you from closing the barn door after the horse is long gone | 19:56 |
| morganfainberg | because oslo.db explodes with a valueerror | 19:56 |
| zzzeek | whys that ? | 19:56 |
| *** iamjarvo has joined #openstack-keystone | 19:57 | |
| ayoung | it means we can't run any migrations after the sanity check detects a problem | 19:57 |
| ayoung | incvluding migrations to fix problems | 19:57 |
| *** iamjarvo has quit IRC | 19:57 | |
| morganfainberg | it runs sanity_check, verifies a table is utf8/innodb, but there is an issue because someone didn't put utf8 in their migration to create the table - and someone is running a mysql instance w/o utf8 being the default | 19:57 |
| morganfainberg | so, we just wedge a deployer | 19:57 |
| zzzeek | morganfainberg: the innodb part, not the utf8 part | 19:57 |
| morganfainberg | zzzeek, both | 19:57 |
| morganfainberg | zzzeek, it checks both of them. | 19:57 |
| *** iamjarvo has joined #openstack-keystone | 19:58 | |
| zzzeek | morganfainberg: how does the check for innodb throw a valueerror | 19:58 |
| *** dims_ has joined #openstack-keystone | 19:58 | |
| morganfainberg | oh | 19:58 |
| morganfainberg | it's only checking utf8 | 19:58 |
| morganfainberg | thought it was also checking innodb | 19:58 |
| morganfainberg | something was at one point | 19:58 |
| zzzeek | morganfainberg: OK. so, utf8, its in their my.cnf defaults and not table defs, that kind of thing? | 19:59 |
| morganfainberg | must have changed/not made it into oslo.db | 19:59 |
| morganfainberg | zzzeek, something like that | 19:59 |
| ayoung | regardless, running the check before he migrations is damaging | 19:59 |
| morganfainberg | zzzeek, and they have already created the db/tables. | 19:59 |
| ayoung | it should run at the end, maybe | 19:59 |
| morganfainberg | zzzeek, then you can't run even a "fix this" migration | 19:59 |
| morganfainberg | because the db is declared insane - even though it was sane minutes ago. | 19:59 |
| zzzeek | morganfainberg: whats the use case where someone has created all their tables with the wrong charset ? legacy, or they mucked around on their end ? | 20:00 |
| morganfainberg | usually upgrading | 20:00 |
| morganfainberg | from an old install | 20:00 |
| morganfainberg | not an uncommon case. | 20:00 |
| zzzeek | morganfainberg: so what will you do instead ? | 20:00 |
| *** dims has quit IRC | 20:00 | |
| morganfainberg | rip it out, once we have functional testing will run the same type of check on the db | 20:00 |
| morganfainberg | so for now: skip sanity check always | 20:01 |
| morganfainberg | soon: run it on each patch to ensure it doesn't happen in an explicit test | 20:01 |
| morganfainberg | but we need real mysql [not unit tests] | 20:01 |
| zzzeek | morganfainberg: none of this is something i have any opinion about. if you’re comfortable with a gap where ppl with bad DBs install the software and they have weird encoding problems, that’s an app-level decision | 20:01 |
| morganfainberg | zzzeek, at this point we're already there. | 20:02 |
| morganfainberg | that ship has long since sailed. | 20:02 |
| morganfainberg | sanity check has served to wedge our deployers - and afaict thats it | 20:02 |
| morganfainberg | then we get a bug and have to backport fixes to undo it. | 20:02 |
| ayoung | We can run it at the end of migrations in the future. | 20:02 |
| morganfainberg | ayoung, doesn't really solve the problem though. gate doesn't catch this really | 20:03 |
| ayoung | And then we will know after the migrations run that there is a problem, and they can report it | 20:03 |
| ayoung | morganfainberg, I know | 20:03 |
| ayoung | it will be informational | 20:03 |
| morganfainberg | ayoung, eh. a "hey go report a bug cause you saw this message" isn't great either you know | 20:04 |
| morganfainberg | maybe we just make the sanity check something that we run in devstack explicitly | 20:04 |
| openstackgerrit | Merged openstack/keystone: Refactoring: remove self._config_file_list from TestCase https://review.openstack.org/162684 | 20:04 |
| morganfainberg | for now. | 20:04 |
| morganfainberg | put that in, get the change to devstack landed [should be easy] | 20:04 |
| morganfainberg | anyway i need coffee. | 20:05 |
| openstackgerrit | Merged openstack/keystone: Refactoring: removed client method from TestCase https://review.openstack.org/162685 | 20:05 |
| morganfainberg | and an asprin. | 20:05 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Mirror domain entries to project table https://review.openstack.org/161408 | 20:06 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 20:06 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Bye bye domain table https://review.openstack.org/161854 | 20:06 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:06 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:06 |
| morganfainberg | ayoung, i'll spin up a check we can ruin our db with... uh run against our db and then propose it against devstack | 20:06 |
| ayoung | ++ | 20:06 |
| morganfainberg | ayoung, so we can get sanity check but not be stuck like we are. | 20:07 |
| stevemar | gordc, got a new patch for setting user_id in ceilometer, let me know if i went overkill | 20:07 |
| morganfainberg | or maybe even better | 20:07 |
| stevemar | i think i might have | 20:07 |
| openstackgerrit | Merged openstack/keystone: Docstring fixes in fernet.token_formatters https://review.openstack.org/162337 | 20:07 |
| morganfainberg | zzzeek, is there a way we can force the connection string to always do utf8? | 20:07 |
| morganfainberg | zzzeek, unless it's explicitly overridden | 20:07 |
| morganfainberg | zzzeek, that might be even better. which case someone would need to go out of their way to make tables w/o utf8 | 20:08 |
| morganfainberg | ayoung, and we still do the dvstack thing, but less rush. | 20:08 |
| ayoung | stevemar, so...in Federation group mapping. We throw an exception on the case where a glob matches the assertion, but one of the values from the assertion is not in the groups list | 20:09 |
| ayoung | this means that every single group from the assertion needs to be made in the identity backend | 20:09 |
| ayoung | I'd rather just ignore them | 20:10 |
| gordc | stevemar: you went overkill for a daylight savings monday | 20:10 |
| ayoung | actaully, it 500s right now | 20:10 |
| stevemar | ayoung, come again? i need an example | 20:10 |
| ayoung | stevemar, I was doing this with SSSD. Say I have two groiups: ipausers and admins | 20:10 |
| ayoung | those are in LDAP, and my user is assigned to them | 20:11 |
| ayoung | stevemar, my mapping looks like this | 20:11 |
| ayoung | http://adam.younglogic.com/2015/03/key-fed-lookup-redux/ | 20:11 |
| ayoung | "local": [ { "group": { "name": "{0}", "domain": {"name": "Default"} } } ], "remote": [ | 20:12 |
| ayoung | 28 { | 20:12 |
| ayoung | 29 "type": "REMOTE_USER_GROUPS" | 20:12 |
| ayoung | 30 } | 20:12 |
| ayoung | 31 ] | 20:12 |
| ayoung | stevemar, so that is going to match every group in REMOTE_USER_GROUPS. But If LDAP assigns me a new group, say the admins group, and Keystone doesn;'t know about it, 500 Groups | 20:13 |
| ayoung | {"error": {"message": "Group admins returned by mapping kerberos_mapping was not found in the backend. (Disable debug mode to suppress these details.)", "code": 500, "title": "Internal Server Error"}} | 20:13 |
| ayoung | stevemar, I think it is due to this call | 20:14 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/contrib/federation/utils.py#n163 | 20:14 |
| ayoung | stevemar, I think the right logic is to not map any groups that are not in the back end. | 20:16 |
| stevemar | hmm okay... i see what you're doing there | 20:17 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 20:17 |
| ayoung | stevemar, yeah, the user and kestone admins are not going to have control over what comes in the assertions. We have to only use the data we know about | 20:18 |
| stevemar | ayoung, i think what you're looking for is here: https://review.openstack.org/#/c/142573/ | 20:18 |
| ayoung | looking | 20:18 |
| stevemar | ayoung, check line 590ish | 20:18 |
| ayoung | stevemar, Not an explicit list | 20:18 |
| ayoung | stevemar, I don't like a whitelist | 20:19 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 20:19 |
| ayoung | I already have the list in the identity backend. If I do a glob, just limit the mapping to the groups that actually exist | 20:19 |
| ayoung | Looking at that, I am not sure it actually would solve my problem | 20:20 |
| stevemar | ayoung, try hacking something up to allow for groups 404'ing | 20:21 |
| stevemar | assuming it doesn't break any tests, i don't see why we can't add that mapping too | 20:21 |
| zzzeek | morganfainberg: i thought oslo.db adds ‘utf8’ to the connection for mysql anyway | 20:21 |
| zzzeek | morganfainberg: not sure if mysql can’t persist utf8 data correclty w/ a bad server side encoding tho | 20:21 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Migrations squash https://review.openstack.org/162170 | 20:23 |
| openstackgerrit | Merged openstack/keystone: 'Assignment' has no attr 'get_domain_by_name' https://review.openstack.org/161543 | 20:23 |
| htruta | morganfainberg: working here with rodrigods on the reseller stuff, we got into a discussion. what should happen if a user wants to create a project with is_domain disabled without passing the parent_id? | 20:24 |
| ayoung | stevemar, I think I would change it from " validate_groups_in_backend" to "remove_groups_not_in_backend" | 20:24 |
| ayoung | if there are 0 groups left, throw the error | 20:24 |
| stevemar | ayoung, that sounds like a viable move | 20:24 |
| morganfainberg | htruta, bad request. | 20:24 |
| morganfainberg | or validation error | 20:24 |
| ayoung | let me try it | 20:24 |
| htruta | we thought of either raising an error or make the project_id his domain_id | 20:24 |
| morganfainberg | raise an error | 20:24 |
| morganfainberg | imo | 20:25 |
| morganfainberg | oh wait sec | 20:25 |
| morganfainberg | htruta, mirror the behavior today, what happens when you try and create a project w/o specifying a domain? | 20:25 |
| morganfainberg | does it go into default domain, your domain, or error? | 20:26 |
| morganfainberg | if it goes into default the answer would be either your domain or error | 20:26 |
| morganfainberg | and likely into your domain is the right one | 20:26 |
| morganfainberg | if it errors today, it should error | 20:26 |
| morganfainberg | dolphm, doh https://review.openstack.org/#/c/161876/ merge conflict | 20:27 |
| rodrigods | morganfainberg, today we don't accept the creation of a project without a domain (the schema doesn't accept domain being null) | 20:28 |
| morganfainberg | rodrigods, then mirror that | 20:28 |
| morganfainberg | require a parent id. | 20:28 |
| morganfainberg | hm.. | 20:28 |
| morganfainberg | rodrigods, would that break today's api though | 20:29 |
| morganfainberg | rodrigods, oh wait no, if they specify a domain id only it would go into that domain at the top | 20:29 |
| morganfainberg | but if no domain is specified and no parent id is specified. | 20:29 |
| rodrigods | morganfainberg, but... we also do this https://github.com/openstack/keystone/blob/master/keystone/resource/controllers.py#L160 | 20:29 |
| morganfainberg | rodrigods, ok so the only time it would error is if no domain is specified *and* no parent is specified | 20:30 |
| rodrigods | morganfainberg, makes sense | 20:30 |
| morganfainberg | rodrigods, because if the domain id wasn't there it'd fail today | 20:30 |
| rodrigods | this approach also eases a lot the tests fixing | 20:30 |
| morganfainberg | if you don't specify a parent, but if you specify a domain id, you just get a project parented by the domain itself [same as today] | 20:31 |
| *** iamjarvo has quit IRC | 20:31 | |
| morganfainberg | rodrigods, so we don't break anyone using the API the same as they would today | 20:31 |
| *** aix has quit IRC | 20:31 | |
| rodrigods | morganfainberg, ++ | 20:31 |
| htruta | morganfainberg: ++ | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove dep on trust_api / v3 token helper https://review.openstack.org/161876 | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 20:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 20:31 |
| rodrigods | morganfainberg, htruta, I also believe that we need to improve the schema in the future, there is a lot of not so straight forward constraints with the domain_id, parent_id and is_domain combination | 20:32 |
| rodrigods | but... this is a discussion for later | 20:32 |
| dolphm | dstanek: morganfainberg: y'all +2/+A'd this earlier, but a merge conflict on docstrings landed first https://review.openstack.org/#/c/161876/ | 20:33 |
| jorge_munoz | dolphm: Thanks, I’ll take a look and I’ll try to focus some time today. | 20:33 |
| *** dims_ has quit IRC | 20:33 | |
| dolphm | jorge_munoz: do you have any offline changes that haven't made it to gerrit yet? | 20:34 |
| *** dims has joined #openstack-keystone | 20:34 | |
| dolphm | jorge_munoz: if not, i'd like to at least try to get a rebase into gerrit for you | 20:35 |
| jorge_munoz | dolphm: Some unit test | 20:35 |
| *** pnavarro has joined #openstack-keystone | 20:35 | |
| dolphm | jorge_munoz: unit or functional? i killed a bunch of tests in the other branch, see comment: https://review.openstack.org/#/c/159229/18/keystone/tests/unit/token/test_fernet_provider.py | 20:35 |
| jorge_munoz | Its new unit test for the token converter | 20:36 |
| jorge_munoz | dolphm: It should not affect the rebase | 20:37 |
| *** iamjarvo has joined #openstack-keystone | 20:37 | |
| *** radez is now known as radez_g0n3 | 20:37 | |
| jorge_munoz | dolphm: I can take care of it later today. | 20:37 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Mirror domain entries to project table https://review.openstack.org/161408 | 20:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 20:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Bye bye domain table https://review.openstack.org/161854 | 20:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 20:49 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 20:49 |
| dstanek | bknudson: why do you want to keep all that exit stuff? | 20:52 |
| openstackgerrit | Merged openstack/keystone: Removes logging code that supported Python <2.7 https://review.openstack.org/162706 | 20:52 |
| bknudson | dstanek: it was added for a reason -- there was some code doing system.exit() and it caused a problem... | 20:53 |
| bknudson | I think it caused the tests to complete successfully... | 20:53 |
| dstanek | bknudson: i just did a quick test and the tests will fail if sys.exit() is called and SystemExit is not explicitly caught | 20:54 |
| bknudson | maybe it's been fixed upstream. | 20:55 |
| dstanek | here's what i get: http://paste.openstack.org/show/191078/ | 20:55 |
| *** iamjarvo has quit IRC | 20:55 | |
| openstackgerrit | Merged openstack/keystone: Consistently use oslo_config.cfg.CONF https://review.openstack.org/162711 | 20:56 |
| *** henrynash has quit IRC | 20:56 | |
| *** iamjarvo has joined #openstack-keystone | 20:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Refactor: create a common base for notification tests https://review.openstack.org/162756 | 20:57 |
| bknudson | dstanek: https://github.com/openstack/keystone/commit/29b6421518de25d067ade422d3513a89d6febd60 | 20:59 |
| *** htruta has quit IRC | 20:59 | |
| bknudson | https://bugs.launchpad.net/keystone/+bug/1276885 | 20:59 |
| openstack | Launchpad bug 1276885 in Keystone "fail_gracefully can exit test suite" [Medium,Fix released] - Assigned to Jamie Lennox (jamielennox) | 20:59 |
| *** raildo is now known as raildo_away | 20:59 | |
| bknudson | dstanek: if I have 2 tests that call sys.exit(), I only get 1 failure... there should have been 2 failures. | 21:00 |
| *** henrynash has joined #openstack-keystone | 21:02 | |
| *** ChanServ sets mode: +v henrynash | 21:02 | |
| dstanek | you'll only get one because the process is dead | 21:02 |
| bknudson | we don't want the process to die. | 21:02 |
| dstanek | right, but that's enough to signal that we have a bug right? we not mock os._exit and raising SystemExit, which are two very common ways to exit a process. but if you use them you'll find out that it was wrong | 21:03 |
| dstanek | i can keep it if you really feel strongly; it just feels like wasted CPU | 21:04 |
| bknudson | get a faster computer. | 21:04 |
| dstanek | we should be able to run all of our tests on a macbook air in less than a minute. i shouldn't need 100 CPUs for such a small project. | 21:05 |
| bknudson | then I think we've got bigger problems than this mock. | 21:06 |
| dstanek | also it's important to note that this is not currently being mocked out on a growing set of our tests | 21:06 |
| bknudson | it should be moved into BaseTestCase | 21:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Refactor: move initiator test to cadf specific section https://review.openstack.org/162758 | 21:07 |
| dstanek | i can do that instead then | 21:07 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add scope info to initiator data for CADF notifications https://review.openstack.org/162547 | 21:08 |
| *** Tahmina has joined #openstack-keystone | 21:09 | |
| henrynash | ayoung, gyee: the next bit of domain-config is awaiting a push….if you get time: https://review.openstack.org/#/c/158752/ | 21:09 |
| ayoung | henrynash, is this the one with the disable test? | 21:10 |
| henrynash | ayoung: no, that’s the next one (and I did imprve the test for you) | 21:10 |
| ayoung | ok | 21:11 |
| *** thedodd has joined #openstack-keystone | 21:12 | |
| ayoung | henrynash, explain to me again why we don't need the kills switch yet? Is it that we can create cionfig objects, but not consume them yet? | 21:12 |
| *** topol has quit IRC | 21:17 | |
| *** iamjarvo has quit IRC | 21:17 | |
| *** timcline has quit IRC | 21:18 | |
| *** timcline has joined #openstack-keystone | 21:19 | |
| *** mattfarina has quit IRC | 21:19 | |
| *** timcline has quit IRC | 21:23 | |
| rodrigods | morganfainberg, this patch https://review.openstack.org/#/c/159944/15 is related to the FK discussion in the ML, it is also the first patch in the Reseller stack... can it get some attention (reviews)? | 21:27 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactoring: use BaseTestCase instead of TestCase https://review.openstack.org/162686 | 21:29 |
| openstackgerrit | David Stanek proposed openstack/keystone: Moved sys.exit mocking into BaseTestClass https://review.openstack.org/162763 | 21:29 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed maxDiff attribute from TestCase https://review.openstack.org/162764 | 21:29 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes tests to use the config fixture https://review.openstack.org/162765 | 21:29 |
| ayoung | stevemar, so..what I posted before, that just returns the first entry REMOTE_USER_GROUPS, doesn't it: "group": { "name": "{0}", | 21:32 |
| dstanek | bknudson: ^ fixed up those commits | 21:32 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor: extract and rename unique_id method https://review.openstack.org/162766 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Simplify injection testcase setup https://review.openstack.org/162767 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 21:33 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 21:33 |
| henrynash | ayoung: yes, you can create all the config objects you want…but if the config swicth to use them is not enabled, then they count for nothing | 21:33 |
| ayoung | henrynash, and the config switch is coming in the next patch? | 21:34 |
| jamielennox | bknudson: if you haven't seen it: https://review.openstack.org/#/c/162529/ is loading plugins with a getter function, it's good for the base plugin but i don't think it works to have a straight auth.load_from_options_getter | 21:34 |
| henrynash | ayoung: the config switch was created in a previous patch…but it is honored in the next patch, since that’s teh patch taht actually allows config objects to have an effect | 21:35 |
| jamielennox | bknudson: you want the place the way the options are defined to be reflected in the way options are loaded, so i'd prefer we keep the initial plugin name loading in ksm if that's where we read it from | 21:35 |
| ayoung | that is what I meant. It is not yet honored, so no way to enable | 21:35 |
| stevemar | ayoung, yeah, that's what i thought might happen, it'll do list -> single entity | 21:35 |
| stevemar | ayoung, that's why i brought up marek's patch, it'll to list -> list | 21:35 |
| henrynash | ayoung: it was not effect….see setup_domain_drivers() in identity.core in the curent patch | 21:35 |
| ayoung | stevemar, ah....yes, then I do want that patch | 21:36 |
| henrynash | (it has no effect)... | 21:36 |
| bknudson | jamielennox: what doesn't work? | 21:36 |
| ayoung | henrynash, +2A. | 21:36 |
| henrynash | ayoung: thx | 21:36 |
| bknudson | I think https://review.openstack.org/#/c/162529/1/keystoneclient/auth/base.py looks good. | 21:36 |
| bknudson | the change could use tests. | 21:36 |
| jamielennox | bknudson: there are two parts to loading a plugin, the bit that finds the plugin name and gets the class, and then the class loads the options related to the plugin | 21:37 |
| jamielennox | bknudson: the class specific part works ok with load_from_options_getter, but i don't know if it makes sense to have an auth.load_from_options_getter because there's really no way to define the register_with_options_setter | 21:37 |
| bknudson | jamielennox: where's the code that finds the plugin name and gets the class? | 21:37 |
| jamielennox | bknudson: i updated the ksm side as well: https://review.openstack.org/#/c/161962/ it obviously fails but it worked in my test env | 21:38 |
| bknudson | that's not pretty at all. | 21:38 |
| jamielennox | i like that it cuts out manually loading all the options for AuthTokenPlugin | 21:40 |
| *** g2` has quit IRC | 21:40 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:41 | |
| bknudson | jamielennox: it's not bad... so you're saying you don't want the ksc change? (there's no tests) | 21:41 |
| jamielennox | bknudson: i'll add the ksc tests if we are happy with the approach, it's fairly well tested already by virtue of load_from_conf_options and load_from_argparse_arguments both going through the new function | 21:42 |
| bknudson | there can't be a auth.load_from_conf_options that uses the getter? | 21:42 |
| bknudson | y, it shouldn't be a huge test. | 21:43 |
| bknudson | jamielennox: I'm happy with the approach. | 21:43 |
| jamielennox | bknudson: so i stopped shy of adding getter to load_from_conf_options, it feels weird | 21:43 |
| jamielennox | the load_from_conf_options should be the reverse of register_conf_options | 21:44 |
| ayoung | stevemar, wkil. | 21:44 |
| bknudson | jamielennox: who calls register_conf_options? | 21:44 |
| ayoung | stevemar, will https://review.openstack.org/#/c/142573/16/keystone/contrib/federation/utils.py,cm allow for globs? | 21:44 |
| jamielennox | bknudson: auth_token | 21:44 |
| jamielennox | bknudson: anyone that wants to load a plugin from conf | 21:45 |
| bknudson | not seeing it in auth_token... | 21:45 |
| *** chlong has joined #openstack-keystone | 21:45 | |
| bknudson | never mind, found one. | 21:46 |
| *** samueldmq_ has joined #openstack-keystone | 21:46 | |
| bknudson | for AuthTokenPlugin | 21:46 |
| jamielennox | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_auth.py#L180 | 21:47 |
| bknudson | at import-time. | 21:47 |
| stevemar | ayoung, what do you mean by globs? | 21:47 |
| bknudson | but that makes sense since only oslo.config requires registering options. | 21:47 |
| jamielennox | yea, all oslo.config stuff is done at import time | 21:48 |
| jamielennox | (which i think we'll need to change for auth_token - but different problem) | 21:48 |
| bknudson | doing stuff at import time is generally a bad idea anyways. | 21:48 |
| jamielennox | yea, and this was flapper's problem and bug, that zaqar doesn't use the global oslo.config option and it wanted to be able to pass their own one in | 21:49 |
| jamielennox | so we'd have to do all our option registering at __init__ | 21:49 |
| ayoung | stevemar, in bash * | 21:50 |
| ayoung | match anything | 21:50 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed maxDiff attribute from TestCase https://review.openstack.org/162764 | 21:50 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes tests to use the config fixture https://review.openstack.org/162765 | 21:50 |
| openstackgerrit | David Stanek proposed openstack/keystone: Moved sys.exit mocking into BaseTestClass https://review.openstack.org/162763 | 21:50 |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactoring: use BaseTestCase instead of TestCase https://review.openstack.org/162686 | 21:50 |
| *** g2` has joined #openstack-keystone | 21:51 | |
| stevemar | ayoung, lemme take a deeper look | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: remove dep on trust_api / v3 token helper https://review.openstack.org/161876 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 21:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 21:51 |
| bknudson | bot is going to get kicked for spamming. | 21:51 |
| bknudson | jamielennox: so are you planning to provide a load_from_conf_options_with_getter() ? Or is that impossible somehow? | 21:53 |
| *** angular_mike has quit IRC | 21:53 | |
| jamielennox | bknudson: it's possible | 21:54 |
| *** samueldmq has quit IRC | 21:54 | |
| *** samueldmq_ is now known as samueldmq | 21:54 | |
| jamielennox | bknudson: it's just a very weird and specialized case | 21:54 |
| jamielennox | that if it was anything other than ksm i'd probably say no to | 21:55 |
| bknudson | jamielennox: doesn't anyone who doesn't want to use oslo.config need this? | 21:55 |
| stevemar | ayoung, i think it'll work for you | 21:56 |
| stevemar | http://paste.openstack.org/show/191097/ | 21:56 |
| jamielennox | bknudson: not really, they would just follow the same process as i did in that middleware review | 21:56 |
| jamielennox | find the plugin name from whatever set of options you are using | 21:56 |
| bknudson | jamielennox: then we'll have all these copies of the code around. | 21:56 |
| stevemar | ayoung, set blacklist to nothing, and use 'groups | 21:56 |
| stevemar | 'groups' | 21:56 |
| ayoung | so no blacklist...you have to specify something to match....interesting. Ok, I'm going to try that | 21:56 |
| stevemar | ayoung, might still need to change that validator to not barf if group dne | 21:56 |
| jamielennox | then plugin = base.get_plugin_class(name) plugin.load_from_options_getter(_getter) | 21:56 |
| ayoung | stevemar, right | 21:57 |
| *** chlong has quit IRC | 21:57 | |
| stevemar | ayoung, yeah, no blacklist effectively means allow everything | 21:57 |
| jamielennox | mordred's shade is the other example i'm thinking of that would benefit from this | 21:57 |
| stevemar | i *think* thtat'll work | 21:57 |
| *** chlong has joined #openstack-keystone | 21:57 | |
| bknudson | mordred's shade sounds like a species of flower or tree. | 21:58 |
| jamielennox | poisonous mushroom | 21:58 |
| jamielennox | so he's pulling config options from oslo.config, some stuff from CLI from env and all sorts of other places | 21:59 |
| bknudson | jamielennox: ok, I'm fine with the changes in https://review.openstack.org/#/c/161962/5/keystonemiddleware/auth_token/__init__.py . | 21:59 |
| jamielennox | but either way you run this you've got a registration issue, i don't know how to correctly register the options for all those places | 21:59 |
| bknudson | just need a test in the ksc change | 21:59 |
| *** trey has quit IRC | 22:00 | |
| *** trey has joined #openstack-keystone | 22:00 | |
| jamielennox | bknudson: ok - i'll get on that one now, will see if we can get ksc then ksm updated in time for kilo | 22:01 |
| *** chlong has quit IRC | 22:04 | |
| *** gordc has quit IRC | 22:05 | |
| jamielennox | morganfainberg: i'm thinking that we overreached with ksc-federation, as it becomes more the standard i think the base plugin can be in ksc and then do like ksc-saml | 22:05 |
| ayoung | stevemar, {"error": {"message": "An unexpected error prevented the server from fulfilling your request: malformed string (Disable debug mode to suppress these details.)", "code": 500, "title": "Internal Server Error"}}[ | 22:06 |
| ayoung | stevemar, so...maybe on to something here... | 22:06 |
| morganfainberg | jamielennox: trivial to merge that back into the main tree. | 22:06 |
| jamielennox | morganfainberg: so still seperate out the lxml and other reqs, but the case came up (again) for kerberos and SSL to be just a federation plugin and i don't want them to have deps on lxml and other saml stuff | 22:06 |
| jamielennox | morganfainberg: yep - just letting you know | 22:06 |
| morganfainberg | jamielennox: I'd rather have over reached and move t back than have to split it out again. But to be fair I'm mulling over splitting up keystone server some (backends) | 22:07 |
| jamielennox | morganfainberg: i'll have to have another look at that base plugin stuff and see how appropriate it is to a non-federated federated plugin | 22:07 |
| morganfainberg | But the ksc side is less of an issue. | 22:07 |
| jamielennox | morganfainberg: right, i was think post a pecan split that some real models on the server side is a good idea | 22:07 |
| morganfainberg | ++ | 22:07 |
| jamielennox | would clean up the driver interfaces a lot | 22:08 |
| ayoung | stevemar, http://paste.openstack.org/show/191098/ | 22:08 |
| morganfainberg | Yes. I am thinking that might be a goal for liberty. Define ABIs for our drivers and commit to them. And split the drivers out | 22:08 |
| morganfainberg | So you install only the drivers you need and dependency mapping is easy. | 22:09 |
| jamielennox | morganfainberg: ++ | 22:09 |
| jamielennox | get rid of drivers needing to know the differences for v2 and v3 apis | 22:09 |
| jamielennox | which is a fairly small set, but still there in case | 22:09 |
| jamielennox | s | 22:09 |
| morganfainberg | Yep | 22:09 |
| ayoung | stevemar, "groups": "{0}", seems to pull out the first element of the list, not the whole set of groups | 22:11 |
| *** trey has quit IRC | 22:12 | |
| bknudson | ayoung: see https://review.openstack.org/#/c/142573/ | 22:14 |
| ayoung | bknudson, I'm running with that | 22:14 |
| bknudson | shoot... that's supposed to allow you to "groups": "{0}" | 22:14 |
| stevemar | ayoung, thats weird, it should do multiple groups, that's what the point of the patch it | 22:15 |
| stevemar | is | 22:15 |
| *** dims_ has joined #openstack-keystone | 22:15 | |
| *** trey has joined #openstack-keystone | 22:15 | |
| bknudson | you need whitelist or blacklist. | 22:16 |
| ayoung | bknudson, I have blacklist | 22:16 |
| stevemar | bknudson, he's using this http://paste.openstack.org/show/191097/ | 22:17 |
| ayoung | [{"local": [{"user": {"name": "{0}", "id": "{0}"}}], "remote": [{"type": "REMOTE_USER"}]}, {"local": [{"domain": {"name": "Default"}, "groups": "{0}"}], "remote": [{"blacklist": [], "type": "REMOTE_USER_GROUPS"}]}] | 22:17 |
| *** dims has quit IRC | 22:17 | |
| bknudson | that looks like the test fixture... | 22:17 |
| ayoung | stevemar I put a break point in the code at | 22:18 |
| ayoung | b/keystone/contrib/federation/utils.py | 22:18 |
| ayoung | def get_assertion_params_from_env(context): | 22:18 |
| stevemar | err change the {0}'s in 'user' to {1} | 22:18 |
| *** rushiagr_away has quit IRC | 22:18 | |
| ayoung | stevemar, nah, that one is fine | 22:19 |
| ayoung | its the group one that break... | 22:19 |
| ayoung | so groups {1}{ ? | 22:20 |
| bknudson | does whitelist or blacklist need to have a value? | 22:20 |
| stevemar | bknudson, both can have empty arrays | 22:21 |
| bknudson | it does "if blacklisted_values:" | 22:21 |
| stevemar | oh | 22:21 |
| stevemar | good point.. | 22:21 |
| bknudson | (not "if blacklisted_values is not None:") | 22:21 |
| stevemar | which maybe it shouldn't do... an empty list should be valid right | 22:21 |
| stevemar | ayoung, ^ want to try that change? | 22:22 |
| bknudson | I don't see the point of having an empty blacklist or whitelist. | 22:22 |
| ayoung | stevemar, groups: {1} gives the first entry in the list | 22:22 |
| ayoung | er..second | 22:22 |
| ayoung | what should be in groups? Are you telling me that it will be processed differntly if the blacklist is actaully accepted? | 22:23 |
| *** openstack has joined #openstack-keystone | 22:24 | |
| ayoung | different error | 22:25 |
| ayoung | stevemar, http://paste.openstack.org/show/191106/ | 22:26 |
| bknudson | still using group: {1} ? | 22:26 |
| bknudson | groups: {1} | 22:26 |
| ayoung | er..yeah | 22:26 |
| bknudson | there will only be groups: {0} if there's a blacklist or whitelist | 22:26 |
| bknudson | (despite what the example shows in the spec) | 22:27 |
| ayoung | bknudson, stevemar that made the difference | 22:27 |
| ayoung | let's get that patch in | 22:27 |
| *** bknudson has quit IRC | 22:28 | |
| stevemar | \o/ | 22:28 |
| stevemar | yeah, that patch is pretty slick | 22:28 |
| stevemar | i know nkinder really wanted something like that | 22:29 |
| *** atiwari has quit IRC | 22:29 | |
| ayoung | stevemar, needs my fix | 22:30 |
| ayoung | let me submit on top of that one | 22:30 |
| stevemar | ayoung, sure, try to address brants comments too | 22:30 |
| stevemar | the append vs extend is a bit wonky | 22:31 |
| *** pnavarro has quit IRC | 22:31 | |
| openstackgerrit | Merged openstack/keystone: Add API support for domain config https://review.openstack.org/158752 | 22:36 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/162350 | 22:43 |
| openstackgerrit | ayoung proposed openstack/keystone: ignore unknown groups https://review.openstack.org/162788 | 22:44 |
| ayoung | morganfainberg, do you have a proposed approach for https://review.openstack.org/#/c/158752 ? | 22:45 |
| ayoung | wropng patch sorry | 22:46 |
| morganfainberg | ayoung: huh? Haha ok | 22:46 |
| ayoung | morganfainberg, https://review.openstack.org/#/c/142573 | 22:46 |
| *** carlosmarin has quit IRC | 22:47 | |
| ayoung | your comment on There has been enough confusion here on the .extend vs. .append that we need either significantly more documentation, or this needs to be re-thought to make it into a data structure that is understandable vs. a list that ends up with late eval data in it. | 22:47 |
| morganfainberg | Yes. That needs to be an object representation not a list. Having a list that sort of works one way in one form and if you put a list of things in it works differently (hence the need for extend in one case vs append), makes this code hard to read/understand. | 22:48 |
| morganfainberg | I have talked with dstanek and marekd about it and looking back at it again it is hard to follow since it is not clear what is going on. If this was an object vs a parsed list it would help with understanding. | 22:49 |
| *** henrynash has quit IRC | 22:51 | |
| morganfainberg | so simply, turn the direct maps into something that is a bit more uniform vs just knowing that [ ['thing1', 'thing2']] will produce something very different behavior wise than ['thing1', 'thing2'] | 22:51 |
| morganfainberg | And have it be opaque to the developers who need to maintain it. | 22:52 |
| morganfainberg | The fact that three different cores went "why are you appending in one place and extending in another" clearly says that this is not straightforward. Let alone looking at the tests and fixtures to gain understanding. So, I am not in support of hard to understand and maintain code. Even if this means we lose this whitelist/blacklist for kilo. We have not been | 22:54 |
| morganfainberg | good at cleaning up messes yet. | 22:54 |
| *** jorge_munoz has quit IRC | 22:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add cadf notifications for oauth https://review.openstack.org/159045 | 23:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add scope info to initiator data for CADF notifications https://review.openstack.org/162547 | 23:03 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add cadf notifications for oauth https://review.openstack.org/159045 | 23:03 |
| *** thedodd has quit IRC | 23:10 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 23:20 | |
| anteaya | morganfainberg: has anyone gotten in contact with you yet about: http://lists.openstack.org/pipermail/third-party-announce/2015-March/000166.html | 23:23 |
| morganfainberg | anteaya, nope | 23:23 |
| *** openstack has joined #openstack-keystone | 23:23 | |
| morganfainberg | it's still posting btw afaict | 23:23 |
| morganfainberg | dunno if brant solved the issues | 23:24 |
| morganfainberg | or not | 23:24 |
| morganfainberg | it seems like it sometimes is passing now | 23:24 |
| morganfainberg | anteaya, as of 03-07 03:13 it was posting that is https://review.openstack.org/#/c/162170/ | 23:25 |
| morganfainberg | and that failure there was because it couldn't download something internally from some server in IBM. | 23:26 |
| morganfainberg | stevemar, ping re: https://review.openstack.org/#/c/142573/ | 23:26 |
| morganfainberg | stevemar, i don't think this is something we want in it's current state considering how much "what is actually going on here" questions we've had | 23:27 |
| anteaya | it shouldn't be posting any comments at all | 23:27 |
| morganfainberg | anteaya, well as of 2 days ago it did. | 23:27 |
| stevemar | morganfainberg, we definitely want the value it adds... just needs to be less cryptic | 23:28 |
| morganfainberg | stevemar, right as is was the key, the feature is good. the code is overloading things in very obscure ways | 23:28 |
| morganfainberg | stevemar, to be honest, i'm ok with this slipping kilo at this point. | 23:28 |
| anteaya | morganfainberg: thanks keep me posted | 23:29 |
| morganfainberg | stevemar, it is showing a gap in the mapping rules. | 23:29 |
| morganfainberg | anteaya, sure. | 23:29 |
| anteaya | I'll see if I can find out how they could post on the 7th | 23:29 |
| anteaya | let me know if you see them post comments again | 23:29 |
| morganfainberg | stevemar, and the implementation. i'd rather clear up the issues before digging us in deeper | 23:29 |
| morganfainberg | anteaya, absolutely. | 23:29 |
| anteaya | thanks | 23:29 |
| *** iamjarvo has joined #openstack-keystone | 23:30 | |
| stevemar | morganfainberg, right, thats what i was referring to | 23:30 |
| stevemar | morganfainberg, except i don't know how to make it less crazy | 23:30 |
| morganfainberg | stevemar, punt on the feature, refactor things into a full object represenation for the rules vs. the weird string-ified-lists | 23:31 |
| morganfainberg | stevemar, then re implement on top of it. | 23:31 |
| morganfainberg | stevemar, i think this is a case where accepting this feature as is will net us something very broken down the line when we try and fix it | 23:31 |
| morganfainberg | stevemar, especially since i can't tell from the tests how the hell it's supposed to work. i'm avoiding a -2 here by a very small margin in my view of it. | 23:32 |
| morganfainberg | stevemar, i can't even definitively tell the tests are resulting in a sane response. | 23:33 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:33 | |
| morganfainberg | stevemar, i'm worried about it being too opaque to support / cleanup. | 23:34 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Provide a generic auth plugin loader https://review.openstack.org/162529 | 23:35 |
| *** henrynash has joined #openstack-keystone | 23:37 | |
| *** ChanServ sets mode: +v henrynash | 23:37 | |
| stevemar | morganfainberg, i see your point | 23:42 |
| stevemar | fwiw, i think theres probably one more enhancement to the mapping engine down the line (project level mapping), and that should be it for a while. | 23:42 |
| stevemar | i dunno, it's tricky | 23:43 |
| *** chlong has joined #openstack-keystone | 23:43 | |
| stevemar | (doing the cleanup vs not) | 23:43 |
| morganfainberg | stevemar, i'd rather have code that is less opaque this late in the cycle. | 23:43 |
| morganfainberg | if this wasn't wedged in right before feature freeze i'd probably say "great now go clean it up or we'll revert it" | 23:44 |
| stevemar | morganfainberg, fwiw, it's only 92 lines, most of which is schema and comments, so it's not adding that much more zaniness to the problem | 23:44 |
| morganfainberg | stevemar, it's adding a lot of zaniness. | 23:45 |
| stevemar | morganfainberg, i don't have a vested interest in this fyi | 23:45 |
| stevemar | just playing devils advocate | 23:45 |
| *** _cjones_ has quit IRC | 23:45 | |
| morganfainberg | stevemar, it's making it so ['thing', 'thing2'] and [['thing1', 'thing2'], 'thing3'] are very very very different things | 23:45 |
| morganfainberg | and this feels like we're doing it wrong, this data doesn't need to be serialized | 23:45 |
| morganfainberg | to be usable. it's not going out on the wire | 23:46 |
| morganfainberg | stevemar, sure, i'm arguing we should do the cleanup because this is adding wierd changes. | 23:46 |
| morganfainberg | stevemar, i have a vested interest in seeing this land... and i don't think it can land in kilo as is :( | 23:46 |
| stevemar | womp womp | 23:47 |
| morganfainberg | stevemar, the more i discuss it the more i'm inclined to -2 it | 23:47 |
| stevemar | morganfainberg, it'll be a good project for someone | 23:47 |
| stevemar | cleaning this up | 23:47 |
| stevemar | the first pass was me and stanek at rax over a year ago (not geekdom) | 23:48 |
| *** _cjones_ has joined #openstack-keystone | 23:48 | |
| anteaya | morganfainberg: thanks we think it was an open connection on their end, so they continued to post even after they were disabled | 23:48 |
| stevemar | so it's due for a cleanup, but it's not the easiest thing clean up | 23:48 |
| morganfainberg | anteaya, ahh | 23:49 |
| anteaya | first time we either experienced it or noticed it, I'm not sure which | 23:49 |
| morganfainberg | anteaya, good to know | 23:49 |
| anteaya | so we will clear caches next time | 23:49 |
| anteaya | and thanks | 23:49 |
| morganfainberg | anteaya, probably because there hasn't been gerrit downtime recently (for renames etc) | 23:49 |
| anteaya | and yeah, if they post again before we re-enable them do let us know | 23:49 |
| anteaya | possibly | 23:49 |
| morganfainberg | anteaya, will do. thnx | 23:49 |
| anteaya | not sure how often gerrit flushes its account caches | 23:49 |
| morganfainberg | stevemar, so lets prioritize the cleanup before we build more features that could make the cleanup much harder | 23:50 |
| morganfainberg | stevemar, the fact that we needed late eval'd data should have been enough of a redflag earlier for me to punt it back here. | 23:51 |
| morganfainberg | anteaya, who knows. | 23:51 |
| morganfainberg | anteaya, but obviously not that often :P | 23:51 |
| stevemar | morganfainberg, alrighty | 23:52 |
| anteaya | not that often, yes | 23:52 |
| *** Tahmina has quit IRC | 23:52 | |
| anteaya | we havn't noticed it being an issue before | 23:52 |
| morganfainberg | stevemar, unrelated: this one should be easy[ish]: https://review.openstack.org/#/c/162170/ | 23:53 |
| morganfainberg | stevemar, but no rush on it, it can actually land post k3 [though earlier would be a bonus] | 23:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove fix for migration 37 https://review.openstack.org/162266 | 23:53 |
| stevemar | ahh | 23:55 |
| morganfainberg | jamielennox, are we waiting on bug #1428900 to release ksm? | 23:56 |
| openstack | bug 1428900 in keystonemiddleware "auth_token middleware cannot load plugins from paste" [Medium,In progress] https://launchpad.net/bugs/1428900 - Assigned to Jamie Lennox (jamielennox) | 23:56 |
| jamielennox | morganfainberg: we are going to do it the fix in ksc then the update ksm way | 23:56 |
| jamielennox | bknudson has gone | 23:56 |
| morganfainberg | jamielennox, so... hold on releasing ksm | 23:57 |
| morganfainberg | ? | 23:57 |
| jamielennox | i should have asked if he would approve keeping the hack until ksc catches up | 23:57 |
| jamielennox | then i could change it over to use the ksc featuers | 23:57 |
| morganfainberg | jamielennox, up to you on how you want to do this. postpone ksm release for ksc release + g-r update | 23:57 |
| morganfainberg | or go with a release earlier. | 23:57 |
| * morganfainberg is ok with a small hack until KSC features are available fwiw | 23:58 | |
| morganfainberg | as long as it's clearly commented as such | 23:58 |
| jamielennox | morganfainberg: having this blocking swift is a problem i want to solve sooner than it would take for the ksc and g-r updates to go through | 23:58 |
| morganfainberg | jamielennox, this is why i asked ;) | 23:59 |
| jamielennox | morganfainberg: let me revert the review to the older patch, i'll add some extra commenting | 23:59 |
| jamielennox | yes, i think we should release the short term fix | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!