| morganfainberg | jamielennox, great. | 00:00 |
|---|---|---|
| morganfainberg | jamielennox, lets do that and please post up the current change (from the hack to this one) | 00:00 |
| morganfainberg | so we have it ready to go once the ksc stuff catches up [if that isn't too hard to do] | 00:01 |
| morganfainberg | no rush on that second part though. | 00:01 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 00:02 |
| jamielennox | morganfainberg: https://review.openstack.org/162529 is the ksc change | 00:03 |
| morganfainberg | jamielennox, ah that one | 00:03 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading auth plugins via overrides https://review.openstack.org/161962 | 00:15 |
| jamielennox | morganfainberg: that's about the strongest warning i can put on ^ | 00:16 |
| *** rushiagr_away has joined #openstack-keystone | 00:16 | |
| morganfainberg | jamielennox, ooh ooh, we could write a c-binding that obfuscates that function >.> | 00:16 |
| morganfainberg | jamielennox, that works for me btw. it's good to see that separated out | 00:17 |
| jamielennox | morganfainberg: yea, makes the whole function up for replacement | 00:17 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 00:17 |
| morganfainberg | jamielennox, perfect. | 00:17 |
| jamielennox | morganfainberg: also i'm more worried about people reading it and thinking it's a good idea and c&p than reusing the method | 00:17 |
| morganfainberg | right | 00:18 |
| jamielennox | morganfainberg: start with a github plugin that blurs out that function | 00:18 |
| morganfainberg | LOL | 00:18 |
| jamielennox | vim, emacs etc | 00:18 |
| morganfainberg | obfuscated python | 00:18 |
| morganfainberg | use awful things that break static analysis too and then #noqa | 00:18 |
| morganfainberg | >.> | 00:18 |
| morganfainberg | make sure to use ctypes to dig everything out while you're at it | 00:19 |
| morganfainberg | even though it's not needed | 00:19 |
| jamielennox | i think you could probably like late attach the function with name '_' + uuid.uuid4().hex | 00:19 |
| jamielennox | right, back to ironic auth | 00:21 |
| openstackgerrit | henry-nash proposed openstack/keystone: Fix typo in name of variable in resource router https://review.openstack.org/162808 | 00:23 |
| *** iamjarvo has quit IRC | 00:34 | |
| *** gyee has quit IRC | 00:44 | |
| *** _cjones_ has quit IRC | 00:46 | |
| stevemar | morganfainberg, we need to decide if we are going forward with this bug: https://bugs.launchpad.net/keystone/+bug/1426128 | 00:48 |
| openstack | Launchpad bug 1426128 in Keystone "Add ECP related bits to saml generation code" [Undecided,New] | 00:48 |
| stevemar | gyee, marekd rodrigods ^ | 00:48 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Address nits for default cache time more explicit https://review.openstack.org/162815 | 00:49 |
| *** r-daneel has quit IRC | 00:49 | |
| *** leonchio_ has quit IRC | 00:49 | |
| morganfainberg | stevemar, wouldn't that break things if we leveraged a form of browser-based sso? | 00:50 |
| stevemar | morganfainberg, you mean combining k2k and sso? | 00:53 |
| morganfainberg | stevemar, yes | 00:53 |
| morganfainberg | stevemar, which... we likely will do longer term | 00:54 |
| morganfainberg | read: horizon things. | 00:54 |
| morganfainberg | i am just checking that we're not backing ourselves into a corner here | 00:54 |
| morganfainberg | by addressing that bug as you proposed | 00:54 |
| henrynash | morganfainberg: when you have a moment, like to talk about experimental/disabled etc.... | 00:55 |
| morganfainberg | henrynash, yes | 00:55 |
| morganfainberg | henrynash, i figured we'd hit it at the meeting otmorrow | 00:55 |
| morganfainberg | but.. | 00:55 |
| morganfainberg | can talk now | 00:55 |
| henrynash | sure…happyto have the wider conversation then | 00:56 |
| morganfainberg | henrynash, can have it in both places too ;) | 00:56 |
| morganfainberg | henrynash, your call | 00:56 |
| henrynash | just wanted to make sure I wasn’t misunderstadning your comment | 00:56 |
| morganfainberg | my comment is i disagree with "disabled" | 00:56 |
| morganfainberg | let HTTP do what it does well, tell them it's forbidden | 00:56 |
| morganfainberg | when they try and use it | 00:56 |
| morganfainberg | filtering out experimental and/or deprecated = these are valid but you either want to move away from them or be careful about using | 00:57 |
| morganfainberg | the hints are nice to be able to look at, but you don't need to know it. disabled is more of the same thing we had by removing things from the wsgi pipeline | 00:57 |
| morganfainberg | a 403 is a 403 is a 403 ;) | 00:58 |
| *** jorge_munoz has joined #openstack-keystone | 00:58 | |
| henrynash | don’t you think it is useful to know WHY its a 403? | 00:58 |
| morganfainberg | nope. not from JSON home | 00:58 |
| morganfainberg | a deployer could do the same thing from policy | 00:58 |
| henrynash | e.g. that API has been removed for ever….or that instalaltion has disabled it | 00:58 |
| morganfainberg | and you'd not see it | 00:58 |
| morganfainberg | if it's removed you get a 404 | 00:58 |
| morganfainberg | it's gone | 00:58 |
| morganfainberg | never to return | 00:58 |
| morganfainberg | maybe a 410 | 00:59 |
| morganfainberg | ;) | 00:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Rename get_events to list_events on the Revoke API https://review.openstack.org/162817 | 00:59 |
| samueldmq | stevemar, ^ I think you like this kind of patch, to keep consistency into the code base :) | 00:59 |
| morganfainberg | [ooh i like that, stub: 410 when we remove wsgi things] | 00:59 |
| henrynash | 410, intersteing | 01:00 |
| morganfainberg | fwiw, very few things use 410, but this is a case where 410 would make sense | 01:00 |
| stevemar | morganfainberg, we could add a flag to the API call | 01:01 |
| henrynash | I guess it feels odd me that in a REST word, we wouldn’t use JSON Home to give a richer set of info abour the status of our resources/APIs | 01:01 |
| stevemar | morganfainberg, but we're most FF | 01:01 |
| stevemar | post* | 01:01 |
| morganfainberg | i just dont see a big win to putting stuff into json home saying "disabled" | 01:01 |
| stevemar | henrynash, go to bed | 01:01 |
| morganfainberg | henrynash, go sleep dude ;) | 01:01 |
| henrynash | ok….we fight another day….tomorrow (well, actually today now for me) | 01:02 |
| henrynash | *fades to black* | 01:03 |
| *** henrynash has quit IRC | 01:03 | |
| morganfainberg | stevemar, can we use HTTP 418 somewhere in keystone | 01:06 |
| morganfainberg | i think we need to | 01:06 |
| morganfainberg | we could co-opt 499 for keystone too | 01:07 |
| stevemar | morganfainberg, sorry, i'm confused, why do we need that? | 01:07 |
| morganfainberg | stevemar, cause... why wouldn't keystone be a teapot?! :P | 01:09 |
| stevemar | morganfainberg, bugging you for https://review.openstack.org/#/c/162756/ and it's dependents, should hopefully make sense :) | 01:09 |
| morganfainberg | sorry... | 01:09 |
| morganfainberg | stevemar, oh i saw those earlier | 01:09 |
| morganfainberg | stevemar, just hadn't gotten to them since i sat down | 01:09 |
| stevemar | morganfainberg, you get to leave? | 01:09 |
| stevemar | no chain? | 01:10 |
| morganfainberg | stevemar, lunch man | 01:10 |
| morganfainberg | lunch | 01:10 |
| morganfainberg | stevemar, some plus 2s added to that chain | 01:12 |
| stevemar | morganfainberg, i have food now, whats the reason for the http code changes? | 01:13 |
| morganfainberg | teapot? cause it's funny | 01:14 |
| morganfainberg | the others cause "meh?" | 01:14 |
| morganfainberg | 410 makes sense if a resource/api is going away | 01:15 |
| stevemar | oh this is all in regard to henry handling disabled extensions | 01:16 |
| morganfainberg | yeash | 01:16 |
| stevemar | thats a tough one | 01:17 |
| stevemar | 410 isn't a good fit | 01:18 |
| morganfainberg | when things are removed permanently? | 01:18 |
| morganfainberg | e.g. an API has moved past deprecation | 01:18 |
| morganfainberg | like v2.0/* | 01:18 |
| morganfainberg | eventually | 01:18 |
| morganfainberg | i'd say 410 is a good fit for that | 01:18 |
| stevemar | yes | 01:19 |
| morganfainberg | not for disabled | 01:19 |
| morganfainberg | 403 = disabled | 01:19 |
| morganfainberg | just the same as if policy.json was to make it disabled | 01:19 |
| stevemar | ha, i tried googling and found a dolphm answer on SO: http://stackoverflow.com/questions/9220432/http-401-unauthorized-or-403-forbidden-for-a-disabled-user | 01:19 |
| *** dolphm has left #openstack-keystone | 01:19 | |
| *** dolphm has joined #openstack-keystone | 01:19 | |
| *** ChanServ sets mode: +o dolphm | 01:19 | |
| morganfainberg | stevemar, hehe | 01:19 |
| morganfainberg | disabled is 403, you do not have rights to access X | 01:20 |
| dolphm | stevemar: asked *and* answered | 01:20 |
| stevemar | i'm thinking 403 if the user is trying to access disabled stuff | 01:20 |
| morganfainberg | stevemar, yep | 01:20 |
| stevemar | (disabled extensions in this case) | 01:20 |
| stevemar | dolphm, nice | 01:20 |
| stevemar | dolphm, didn't notice that | 01:20 |
| morganfainberg | stevemar, if you disable some feature in the API it's simply a 403 | 01:21 |
| dolphm | stevemar: disabled extensions should 404 - the extension should not exist | 01:21 |
| morganfainberg | dolphm, no such thing as extensions | 01:21 |
| morganfainberg | dolphm, APIs are not optional. | 01:21 |
| morganfainberg | if you remove things from wsgi pipeline - sure 404, it's not there. | 01:21 |
| morganfainberg | but disabling something that is experimental should be the same as never granting someone rights to access it | 01:22 |
| stevemar | but they exist | 01:22 |
| dolphm | morganfainberg: so you're saying that there are two correct responses in that situation, and the correct response depends on the approach to implementation? | 01:22 |
| morganfainberg | otherwise the 404 is a question of "is the resource gone, or is the API gone" | 01:22 |
| morganfainberg | dolphm, i'd say yes. if the philosophy is "disabled API functionality is 'no one has access'" 403 [same as if a deployer disabled something via policy.json]. | 01:23 |
| morganfainberg | dolphm, if you're claiming APIs can be optional [much harder to program to as a consumer of an API], a 404 is more correct as you'd remove it from wsgi pipeline | 01:23 |
| morganfainberg | dolphm, i've been pushing to make APIs non-optional (don't confuse this with defcore) | 01:24 |
| morganfainberg | dolphm, so you don't need to figure out what APIs someone has deployed, you should have a good idea of what keystone's api surface area is. if you don't have access to it, that is something totally different | 01:25 |
| morganfainberg | if you want to get hard-core security, 404 for anything/everything | 01:25 |
| *** browne has quit IRC | 01:25 | |
| morganfainberg | but i think that is swinging too far away from user experience | 01:25 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 01:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 01:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 01:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 01:31 |
| dolphm | jorge_munoz: i didn't rerun tests on each individual commit, but the there's a pep8 fix and a unit test fix above ^ | 01:36 |
| dolphm | anyone else use debian testing for development? | 01:41 |
| openstackgerrit | ayoung proposed openstack/keystone: ignore unknown groups https://review.openstack.org/162788 | 01:44 |
| ayoung | stevemar, are you covering https://review.openstack.org/#/c/142573/16 | 01:46 |
| ayoung | If so... I will pay you in code reviews. Well, I'd do them anyways, but this is an explicit quid pro quo | 01:46 |
| morganfainberg | dolphm, debian scares me to dev on [same reason RHEL does], it moves like molasses for things and in the case of debian testing... or unstable... or whatever is not "Stable" it's hard to know what you're actually getting | 01:47 |
| *** rwsu has quit IRC | 01:47 | |
| dolphm | morganfainberg: i don't follow | 01:48 |
| morganfainberg | dolphm, i feel like things are very wonky with testing and unstable in debian | 01:49 |
| morganfainberg | dolphm, been bitten more than once using it for anything i want consistency in | 01:49 |
| morganfainberg | dolphm, personal experience. and stable is slooooow | 01:49 |
| * morganfainberg sticks with ubuntu LTS for dev fwiw. | 01:49 | |
| dolphm | morganfainberg: well testing and unstable are certainly not for consistency | 01:50 |
| morganfainberg | except when i need cool things.. like python3 | 01:50 |
| dolphm | morganfainberg: "stable is slooooow" is the advantage lol | 01:50 |
| * samueldmq finds the notifications callback system interesting | 01:50 | |
| samueldmq | observer pattern there :) | 01:50 |
| morganfainberg | i like the pace of LTS under ubuntu. it's not slooooow, but it's also not the wild west | 01:50 |
| morganfainberg | and trusty doesn't have systemd | 01:51 |
| dolphm | morganfainberg: then you can cherry pick from testing/backports if you need something more recent | 01:51 |
| morganfainberg | that is a huge huge huge win for me | 01:51 |
| dolphm | neither does debian :D | 01:51 |
| morganfainberg | the fact that debian jessie (sp?) will have systemd means i don't want to use it | 01:51 |
| morganfainberg | at least thats the info i gleaned from ML topics | 01:51 |
| morganfainberg | (not our ML, but debian ML) | 01:51 |
| morganfainberg | systemd makes me cry. | 01:52 |
| morganfainberg | there was nothing wrong with sysv init for servers. | 01:52 |
| morganfainberg | and i stand by that there is still nothing wrong with sysv init | 01:52 |
| morganfainberg | upstart and systemd are a solution looking for a problem. | 01:52 |
| * morganfainberg steps out before inciting a holy war. | 01:53 | |
| stevemar | ayoung, so morganfainberg doesn't like that one | 01:54 |
| stevemar | its mucking things up | 01:54 |
| stevemar | ayoung, reading your comment now... i'm a bit slow today | 01:55 |
| *** _cjones_ has joined #openstack-keystone | 01:56 | |
| morganfainberg | stevemar, ayoung just copy/pasted my comment to him. | 01:56 |
| morganfainberg | on why i didn't like it and what should be done instead... exactly what i talked to you about ;) | 01:57 |
| ayoung | yep | 01:57 |
| ayoung | morganfainberg, does this need any sort of blessing to go in? | 01:57 |
| morganfainberg | ayoung, i didn't block it with a -2. lets just say i'm very displeased with it and think it's going to make cleanup very hard. | 01:57 |
| ayoung | morganfainberg, nah, forget the code changes. Lets assume we get them done | 01:58 |
| ayoung | is the feature itself OK for Kilo> | 01:58 |
| morganfainberg | ayoung, oh nah it's good from a conceptual basis | 01:58 |
| ayoung | ? | 01:58 |
| ayoung | Cool | 01:58 |
| morganfainberg | ayoung, the feature is def. good. | 01:58 |
| ayoung | morganfainberg, I'd say essential | 01:58 |
| ayoung | didn't realize it, sorry for the late add | 01:58 |
| morganfainberg | i'd let it miss for kilo, but if is misses kilo it's def. going into Liberty | 01:58 |
| ayoung | I'll def help this one along | 01:58 |
| morganfainberg | if that makes it clear where i sit? | 01:58 |
| ayoung | Um...not clear | 01:59 |
| morganfainberg | i wont be unhappy if it misses kilo | 01:59 |
| morganfainberg | i know people want it for kilo | 01:59 |
| ayoung | ah...I'd be very sad | 01:59 |
| morganfainberg | if it misses kilo it has to land in liberty | 01:59 |
| ayoung | it implements the "you don't need to explcitly set the groups in Federation" which is essential | 01:59 |
| morganfainberg | like i said, if it misses kilo it has to land in liberty | 02:00 |
| morganfainberg | it's just late in the cycle so i can't be too hopped up if it misses kilo | 02:00 |
| *** iamjarvo has joined #openstack-keystone | 02:00 | |
| morganfainberg | the feature is good. | 02:00 |
| *** diegows has quit IRC | 02:02 | |
| *** tellesnobrega_ has joined #openstack-keystone | 02:14 | |
| *** tellesnobrega_ has quit IRC | 02:14 | |
| *** kaisers1 has joined #openstack-keystone | 02:18 | |
| *** kaisers has quit IRC | 02:20 | |
| *** lsg has joined #openstack-keystone | 02:26 | |
| *** erkules_ has joined #openstack-keystone | 02:30 | |
| *** erkules has quit IRC | 02:33 | |
| *** lsg has quit IRC | 02:34 | |
| *** lsg has joined #openstack-keystone | 02:35 | |
| *** browne has joined #openstack-keystone | 02:37 | |
| *** richm has quit IRC | 02:40 | |
| stevemar | lhcheng_ is making me pull down osc code and test it, *grumble grumble* | 02:41 |
| lhcheng_ | stevemar: oops, sorry! I was going to test that out again, then got distracted by another task at work | 02:42 |
| stevemar | lhcheng_, :) it's all good | 02:43 |
| *** spandhe has quit IRC | 02:44 | |
| *** iamjarvo has quit IRC | 02:44 | |
| *** spandhe has joined #openstack-keystone | 02:44 | |
| lhcheng_ | stevemar: the new patch works | 02:45 |
| lhcheng_ | the password prompt move to to a bit later | 02:45 |
| lhcheng_ | until the first command is invoked | 02:45 |
| lhcheng_ | stevemar: the password used to get prompted as the user enter openstack cli | 02:46 |
| *** iamjarvo has joined #openstack-keystone | 02:47 | |
| *** spandhe has left #openstack-keystone | 02:47 | |
| stevemar | lhcheng_, i'm doing the hypervisor show ones for now | 02:48 |
| stevemar | lhcheng_, maybe i'll get them all tonight! | 02:48 |
| stevemar | also when you run devstack now, OSC will add bash completion :) | 02:48 |
| stevemar | tabbing goodness | 02:49 |
| lhcheng_ | stevemar: cool | 02:49 |
| lhcheng_ | hmm not working for me, is there a library that I have to updated? | 02:49 |
| lhcheng_ | ciff library update? | 02:50 |
| stevemar | lhcheng_, update devstack? | 02:50 |
| lhcheng_ | *cliff | 02:50 |
| stevemar | lhcheng_, `os hypervisor stats show` is sort of a list | 02:50 |
| *** markvoelker has joined #openstack-keystone | 02:51 | |
| lhcheng_ | stevemar: yeah, OSC show command displays a list of Fields | 02:52 |
| lhcheng_ | stevemar: patterned it from that | 02:53 |
| lhcheng_ | stevemar: just updated devstack few hours ago, will try it again later | 02:53 |
| stevemar | lhcheng_, oh it displays aggregated data across all compute nodes | 02:57 |
| lhcheng_ | yes :) | 02:57 |
| stevemar | it's kinda weird that it's not it's own command | 02:58 |
| stevemar | err that it is it's own command | 02:58 |
| stevemar | and not bundled with `os hypervisor list` | 02:58 |
| stevemar | but whatever | 02:58 |
| stevemar | i think you and dtroyer already hashed that out | 02:58 |
| lhcheng_ | I had it in `os hypervisor list` originally | 02:59 |
| lhcheng_ | but it is kinda weird mixing those up | 02:59 |
| *** _cjones_ has quit IRC | 03:00 | |
| lhcheng_ | since the data is an aggregated data across, rather than per hypervisor | 03:00 |
| *** _cjones_ has joined #openstack-keystone | 03:00 | |
| stevemar | yeah, i guess so | 03:00 |
| lhcheng_ | stevemar: I started setting up oidc on keystone following: http://docs.openstack.org/developer/keystone/extensions/openidc.html | 03:02 |
| lhcheng_ | I noticed in the vm where you configured for testing, it still didn't have the federation configured yet. | 03:03 |
| stevemar | lhcheng_, i am delayed by 1 day for $reasons | 03:04 |
| lhcheng_ | stevemar: trying to look the vm config as I am doing my own config to validate I am heading the right direction | 03:04 |
| lhcheng_ | stevemar: oh okay, no rush | 03:04 |
| stevemar | lhcheng_, i can send you a guide for some of the work, how far have you gotten | 03:04 |
| lhcheng_ | as far as where the vm state is :) | 03:04 |
| lhcheng_ | so.. not that far :P | 03:05 |
| lhcheng_ | I've setup oidc on my google account | 03:05 |
| lhcheng_ | so got the clientid/secret configured in keystone | 03:05 |
| stevemar | lhcheng_, i can totally do a google hangout with you tomorrow and walk you through stuff | 03:08 |
| stevemar | lhcheng_, wheres the password related patch for osc? | 03:10 |
| lhcheng_ | https://review.openstack.org/#/c/161088/ | 03:10 |
| stevemar | ah the one i just commented on :) | 03:11 |
| openstackgerrit | Merged openstack/keystone: Moved sys.exit mocking into BaseTestClass https://review.openstack.org/162763 | 03:13 |
| lhcheng_ | stevemar: cool, I am thinking of try setting up oidc based on the docs. at least that helps validate that we have adequate docs :) | 03:14 |
| stevemar | lhcheng_, ha | 03:15 |
| stevemar | lhcheng_, whats the point of reviewing the OS_URL from https://review.openstack.org/#/c/161088/5 | 03:15 |
| *** tqtran has quit IRC | 03:15 | |
| lhcheng_ | hmm no idea, waiting for Dean to respond to that question | 03:16 |
| lhcheng_ | I think you asked in the previous patchset? | 03:17 |
| stevemar | i think so | 03:17 |
| lhcheng_ | ah that config moved to TokenEndpoint class | 03:18 |
| lhcheng_ | https://review.openstack.org/#/c/161088/6/openstackclient/api/auth_plugin.py | 03:18 |
| lhcheng_ | umm might break backward compatibility? | 03:19 |
| stevemar | lhcheng_, sent you a guide for some oidc help, but it doesn't setup websso | 03:21 |
| stevemar | that is ... other steps | 03:21 |
| lhcheng_ | stevemar: thanks | 03:23 |
| lhcheng_ | stevemar: the setup websso is the new feature, I am familiar with the patch I can probably figure that part | 03:24 |
| stevemar | lhcheng_, i'll try and recap the diffs here... | 03:25 |
| *** zzzeek has quit IRC | 03:26 | |
| stevemar | lhcheng_, 1) the redirect URL will /auth/OS-FEDERATION/websso/redirect 2) the IdP will need a 'remote_id' section, 3) keystone.conf will need to set remote_id_attribute option | 03:26 |
| stevemar | those are the keystone related changes | 03:27 |
| stevemar | then the horizon ones, which i think you know better than i do | 03:27 |
| openstackgerrit | Merged openstack/keystone: Refactoring: use BaseTestCase instead of TestCase https://review.openstack.org/162686 | 03:28 |
| openstackgerrit | Merged openstack/keystone: Removed maxDiff attribute from TestCase https://review.openstack.org/162764 | 03:28 |
| lhcheng_ | yeah, that sounds like it | 03:28 |
| lhcheng_ | what is the easiest way to validate federation is working? | 03:29 |
| lhcheng_ | does OSC works with it? :) | 03:29 |
| *** ccard_ has joined #openstack-keystone | 03:31 | |
| *** dims_ has quit IRC | 03:32 | |
| openstackgerrit | Merged openstack/keystone: Refactor: create a common base for notification tests https://review.openstack.org/162756 | 03:33 |
| *** ccard__ has quit IRC | 03:34 | |
| lhcheng_ | stevemar: oh, it's in the docs | 03:35 |
| lhcheng_ | stevemar: thank you sir | 03:35 |
| lhcheng_ | stevemar: time for dinner, later! | 03:36 |
| stevemar | lhcheng_, yup it does, have fun! | 03:41 |
| *** ayoung has quit IRC | 03:44 | |
| dolphm | running keystone tests real fast like http://cdn.pasteraw.com/h50534yi1aw3x1qqk4dluo9x2wkvh2y | 03:46 |
| dolphm | http://i.imgur.com/q8K6TAD.png | 03:46 |
| *** rushiagr_away has quit IRC | 03:49 | |
| *** jorge_munoz has quit IRC | 03:50 | |
| samueldmq | stevemar, marekd any of you around ? just woud | 03:51 |
| samueldmq | just would like to confirm something in federation* | 03:51 |
| *** markvoelker has quit IRC | 03:53 | |
| *** markvoelker has joined #openstack-keystone | 03:53 | |
| samueldmq | in the mapping rules, you use {0}, {1}, etc inside 'local' in the order they appear in the 'remote' properties | 03:54 |
| samueldmq | am I right? | 03:54 |
| *** jorge_munoz has joined #openstack-keystone | 03:55 | |
| *** markvoelker has quit IRC | 03:57 | |
| lbragstad | dolphm: nice, how long did those tests take? | 03:58 |
| dolphm | lbragstad: see the pasteraw link above | 03:58 |
| lbragstad | whoa... | 03:59 |
| morganfainberg | was that 90s dolphm ? | 04:01 |
| morganfainberg | or am i mis-reading it? | 04:01 |
| lbragstad | 28 minutes worth of work in ~90 seconds? | 04:02 |
| lbragstad | I'd take it | 04:02 |
| *** jorge_munoz has quit IRC | 04:02 | |
| dolphm | morganfainberg: you are correct sir | 04:03 |
| morganfainberg | 8 workers nice | 04:03 |
| morganfainberg | s/8workers// | 04:04 |
| morganfainberg | looks like 20 workers | 04:04 |
| samueldmq | and since the slower one took 0:01:27s, that that means ~6s to split test jobs and join results at the end? | 04:06 |
| samueldmq | lol | 04:06 |
| stevemar | samueldmq, sounds about right | 04:11 |
| samueldmq | stevemar, what? my federation comment? or the one just above? | 04:11 |
| stevemar | samueldmq, oops, federation comment | 04:12 |
| stevemar | i want a machine with 20 workers :( | 04:12 |
| dolphm | stevemar: it's a rackspace baremetal server | 04:12 |
| samueldmq | stevemar, yees, then I get federation workflow :) | 04:12 |
| dolphm | stevemar: rent it by the hour! | 04:13 |
| stevemar | i can't afford that | 04:13 |
| samueldmq | dolphm, how do we set up the number of workers to use? | 04:13 |
| stevemar | samueldmq, i think it's based on number of processors? or something crazy | 04:13 |
| dolphm | samueldmq: when you run tox, it defaults to the number of cores you have, ish | 04:13 |
| stevemar | oh right cores | 04:14 |
| dolphm | samueldmq: i have no idea how to override that though. there's a --concurrency={worker_count} option that doesn't seem to work | 04:14 |
| samueldmq | stevemar, dolphm k | 04:14 |
| dolphm | stevemar: this is a 10 core box with hyperthreading, so 20 virtual cores, and i don't know why it's doing 19 workers | 04:14 |
| samueldmq | dolphm, it's doing 20 workers | 04:15 |
| samueldmq | dolphm, 0 to 19 :) | 04:15 |
| dolphm | samueldmq: /facepalm. | 04:15 |
| stevemar | lol | 04:15 |
| stevemar | nice one dolphinator | 04:15 |
| dolphm | i'm going to bed now | 04:15 |
| samueldmq | o/ | 04:15 |
| stevemar | o/ | 04:15 |
| * dolphm shuffles away in sadness. | 04:15 | |
| samueldmq | dolphm, ahha, nah .. you just need to sleep :) | 04:16 |
| dolphm | as with all other things, i blame daylight savings | 04:16 |
| samueldmq | fair enough | 04:17 |
| samueldmq | :p | 04:17 |
| *** rushiagr_away has joined #openstack-keystone | 04:22 | |
| *** markvoelker has joined #openstack-keystone | 04:24 | |
| *** panbalag has quit IRC | 04:26 | |
| * samueldmq goes to bed zzZ | 04:30 | |
| *** samueldmq is now known as samueldmq_away | 04:31 | |
| *** dims has joined #openstack-keystone | 04:32 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 04:33 |
| *** samueldmq_away has quit IRC | 04:37 | |
| *** dims has quit IRC | 04:38 | |
| *** dims has joined #openstack-keystone | 04:40 | |
| *** markvoelker has quit IRC | 04:41 | |
| *** dims has quit IRC | 04:45 | |
| *** iamjarvo has quit IRC | 05:03 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 05:22 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 05:24 |
| *** jorge_munoz has joined #openstack-keystone | 05:25 | |
| *** _cjones_ has quit IRC | 05:29 | |
| *** stevemar has quit IRC | 05:31 | |
| *** markvoelker has joined #openstack-keystone | 05:38 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 05:44 |
| *** jorge_munoz has quit IRC | 05:45 | |
| *** harlowja_ is now known as harlowja_away | 05:57 | |
| *** dims has joined #openstack-keystone | 06:21 | |
| hugokuo | what kind of user has permission to validate all users's token ? | 06:24 |
| hugokuo | in Keystone V3 | 06:24 |
| *** dims has quit IRC | 06:26 | |
| *** david-lyle has quit IRC | 06:30 | |
| *** _cjones_ has joined #openstack-keystone | 06:31 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add Proxy plugins https://review.openstack.org/137864 | 06:36 |
| *** rushiagr_away is now known as rushiagr | 06:37 | |
| *** david-lyle has joined #openstack-keystone | 06:39 | |
| marekd | samuel: yes | 07:01 |
| *** _cjones_ has quit IRC | 07:02 | |
| *** _cjones_ has joined #openstack-keystone | 07:03 | |
| *** _cjones_ has quit IRC | 07:03 | |
| *** david-lyle is now known as david-lyle_afk | 07:11 | |
| *** browne has quit IRC | 07:11 | |
| *** chlong has quit IRC | 07:21 | |
| *** jistr has joined #openstack-keystone | 07:31 | |
| *** openstackgerrit has quit IRC | 07:35 | |
| *** openstackgerrit has joined #openstack-keystone | 07:35 | |
| *** erkules_ is now known as erkules | 08:09 | |
| *** erkules has joined #openstack-keystone | 08:09 | |
| *** pnavarro has joined #openstack-keystone | 08:31 | |
| hugokuo | Was x-service-catalog deprecated in Juno ? | 08:33 |
| *** nellysmitt has joined #openstack-keystone | 09:06 | |
| openstackgerrit | Kamil Rykowski proposed openstack/keystone: Use assertFalse or assertTrue instead of assertIs https://review.openstack.org/162918 | 09:10 |
| *** dims has joined #openstack-keystone | 09:11 | |
| *** dims has quit IRC | 09:18 | |
| *** aix has joined #openstack-keystone | 09:19 | |
| *** markvoelker has quit IRC | 09:22 | |
| *** david-lyle_afk has quit IRC | 09:30 | |
| *** david-lyle_afk has joined #openstack-keystone | 09:30 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Crosslink to other sites that are owned by Keystone https://review.openstack.org/161490 | 09:30 |
| *** jistr has quit IRC | 09:34 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 09:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 09:43 |
| *** jistr has joined #openstack-keystone | 09:46 | |
| *** lsg has quit IRC | 09:48 | |
| *** afazekas has joined #openstack-keystone | 09:52 | |
| *** dims has joined #openstack-keystone | 09:56 | |
| breton | dstanek: I love Jenkins' reaction to https://review.openstack.org/#/c/162766/1 :) | 09:58 |
| *** _cjones_ has joined #openstack-keystone | 10:03 | |
| *** _cjones_ has quit IRC | 10:04 | |
| *** _cjones_ has joined #openstack-keystone | 10:05 | |
| *** _cjones_ has quit IRC | 10:09 | |
| *** chlong has joined #openstack-keystone | 10:17 | |
| openstackgerrit | Elena Ezhova proposed openstack/keystone: Prevent calling waitall() inside a GreenPool's greenthread https://review.openstack.org/160720 | 10:30 |
| *** samueldmq has joined #openstack-keystone | 10:30 | |
| *** aix has quit IRC | 10:32 | |
| *** lhcheng_ has quit IRC | 10:32 | |
| *** nellysmitt has quit IRC | 10:41 | |
| *** chlong has quit IRC | 10:51 | |
| *** markvoelker has joined #openstack-keystone | 10:53 | |
| *** aix has joined #openstack-keystone | 10:57 | |
| marekd | samueldmq: yes | 11:00 |
| *** nellysmitt has joined #openstack-keystone | 11:09 | |
| *** Krast has quit IRC | 11:09 | |
| *** diegows has joined #openstack-keystone | 11:20 | |
| *** panbalag has joined #openstack-keystone | 11:47 | |
| *** amakarov_away is now known as amakarov | 11:54 | |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 11:57 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 11:58 |
| *** karimb has joined #openstack-keystone | 12:01 | |
| dstanek | breton: yeah, i saw that last night, but I didn't have time to look into why | 12:13 |
| *** raildo_away is now known as raildo | 12:14 | |
| amakarov | samueldmq, hi! Are you here? | 12:17 |
| dstanek | breton: yeah, i didn't add a file :-( so of course it works for me | 12:17 |
| *** bjornar has quit IRC | 12:20 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor: extract and rename unique_id method https://review.openstack.org/162766 | 12:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Simplify injection testcase setup https://review.openstack.org/162767 | 12:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 12:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 12:21 |
| openstackgerrit | David Stanek proposed openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 12:21 |
| *** iamjarvo has joined #openstack-keystone | 12:22 | |
| *** dims has quit IRC | 12:25 | |
| *** dims has joined #openstack-keystone | 12:25 | |
| *** kaisers has joined #openstack-keystone | 12:26 | |
| *** kaisers1 has quit IRC | 12:27 | |
| marekd | dstanek: could you look here and possibly vote: https://review.openstack.org/#/c/159803/ ? | 12:31 |
| *** htruta has joined #openstack-keystone | 12:35 | |
| *** markvoelker has quit IRC | 12:38 | |
| *** markvoelker has joined #openstack-keystone | 12:39 | |
| *** gordc has joined #openstack-keystone | 12:41 | |
| *** markvoelker has quit IRC | 12:43 | |
| *** jistr has quit IRC | 12:47 | |
| *** jistr has joined #openstack-keystone | 12:48 | |
| *** nellysmitt has quit IRC | 12:49 | |
| *** bknudson has joined #openstack-keystone | 12:56 | |
| *** ChanServ sets mode: +v bknudson | 12:56 | |
| *** richm has joined #openstack-keystone | 12:58 | |
| *** jistr has quit IRC | 13:04 | |
| *** jistr has joined #openstack-keystone | 13:05 | |
| *** stevemar has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +v stevemar | 13:06 | |
| *** joesavak has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Use assertFalse and assertTrue instead of assertEqual https://review.openstack.org/162570 | 13:13 |
| *** markvoelker has joined #openstack-keystone | 13:13 | |
| *** stevemar has quit IRC | 13:18 | |
| *** stevemar has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +v stevemar | 13:19 | |
| *** rushiagr is now known as rushiagr_away | 13:20 | |
| *** iamjarvo has quit IRC | 13:20 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:25 | |
| *** bjornar has joined #openstack-keystone | 13:26 | |
| *** henrique_ has joined #openstack-keystone | 13:31 | |
| *** mattfarina has joined #openstack-keystone | 13:35 | |
| *** jlk has left #openstack-keystone | 13:38 | |
| *** jorge_munoz has joined #openstack-keystone | 13:42 | |
| *** bdossant has joined #openstack-keystone | 13:42 | |
| *** iamjarvo has joined #openstack-keystone | 13:51 | |
| *** ayoung has joined #openstack-keystone | 13:51 | |
| *** ChanServ sets mode: +v ayoung | 13:51 | |
| *** iamjarvo has quit IRC | 13:52 | |
| *** iamjarvo has joined #openstack-keystone | 13:52 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Stops injecting revoke_api into TestCase https://review.openstack.org/163008 | 13:53 |
| *** iamjarvo has quit IRC | 13:56 | |
| *** r-daneel has joined #openstack-keystone | 13:58 | |
| amakarov | dstanek, greetings! Can you please put some bp or bug in your commit messages? | 13:59 |
| dstanek | amakarov: i do when there is a bp or bug associated with them | 14:00 |
| *** ayoung has quit IRC | 14:02 | |
| *** fmarco76 has joined #openstack-keystone | 14:02 | |
| *** iamjarvo has joined #openstack-keystone | 14:03 | |
| *** iamjarvo has quit IRC | 14:03 | |
| *** iamjarvo has joined #openstack-keystone | 14:05 | |
| openstackgerrit | Matthieu Huin proposed openstack/keystone: add oauth authentication to config file https://review.openstack.org/161317 | 14:05 |
| *** iamjarvo has quit IRC | 14:05 | |
| *** iamjarvo has joined #openstack-keystone | 14:06 | |
| *** zzzeek has joined #openstack-keystone | 14:08 | |
| breton | dstanek: aren't these patches about fixing di? | 14:09 |
| *** iamjarvo has quit IRC | 14:09 | |
| *** iamjarvo has joined #openstack-keystone | 14:11 | |
| dstanek | breton: which ones? | 14:11 |
| dstanek | breton: i have something like ~30 patches pushed to gerrit and about 20 more locally that need rebased or fixed :-) | 14:12 |
| amakarov | samueldmq, ping | 14:13 |
| *** rushiagr_away is now known as rushiagr | 14:13 | |
| *** iamjarvo_ has joined #openstack-keystone | 14:13 | |
| breton | dstanek: https://review.openstack.org/#/c/162766/ this and its 'Needed by' | 14:14 |
| *** samueldmq_away has joined #openstack-keystone | 14:14 | |
| *** iamjarvo has quit IRC | 14:15 | |
| dstanek | breton: those were not specific to my DI work - those are cherry picked refactorings that i was pushing | 14:15 |
| dstanek | breton: i did put the DI work on top of it though | 14:16 |
| *** timcline has joined #openstack-keystone | 14:16 | |
| *** timcline has quit IRC | 14:16 | |
| breton | oh, ok. It's a pity though that DI stuff didn't get in kilo | 14:16 |
| *** timcline has joined #openstack-keystone | 14:17 | |
| *** topol has joined #openstack-keystone | 14:17 | |
| *** ChanServ sets mode: +v topol | 14:17 | |
| *** iamjarvo has joined #openstack-keystone | 14:17 | |
| *** iamjarvo has quit IRC | 14:17 | |
| dstanek | yeah, i agree, but i think henry's resource split was more important | 14:18 |
| *** iamjarvo has joined #openstack-keystone | 14:18 | |
| openstackgerrit | Merged openstack/pycadf: Add api_audit_map.conf for Trove project https://review.openstack.org/162415 | 14:18 |
| *** iamjarvo_ has quit IRC | 14:18 | |
| *** bdossant has quit IRC | 14:31 | |
| *** markvoelker has quit IRC | 14:37 | |
| *** markvoelker has joined #openstack-keystone | 14:37 | |
| *** markvoelker has quit IRC | 14:42 | |
| *** rwsu has joined #openstack-keystone | 14:44 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 14:46 |
| openstackgerrit | David Stanek proposed openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 14:46 |
| openstackgerrit | David Stanek proposed openstack/keystone: Removed dependency.provider https://review.openstack.org/163029 | 14:46 |
| *** pnavarro has quit IRC | 14:49 | |
| *** markvoelker has joined #openstack-keystone | 14:49 | |
| *** pnavarro has joined #openstack-keystone | 14:49 | |
| *** iamjarvo has quit IRC | 14:52 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Stops injecting revoke_api into TestCase https://review.openstack.org/163008 | 14:53 |
| *** dims has quit IRC | 14:58 | |
| *** stevemar2 has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v stevemar2 | 15:01 | |
| *** stevemar has quit IRC | 15:01 | |
| *** dimsum__ has joined #openstack-keystone | 15:01 | |
| *** jsavak has joined #openstack-keystone | 15:04 | |
| *** joesavak has quit IRC | 15:06 | |
| *** iamjarvo has joined #openstack-keystone | 15:10 | |
| *** browne has joined #openstack-keystone | 15:12 | |
| *** tsufiev has quit IRC | 15:12 | |
| *** tsufiev has joined #openstack-keystone | 15:13 | |
| *** tsufiev has quit IRC | 15:14 | |
| *** radez_g0n3 is now known as radez | 15:15 | |
| *** Ephur has joined #openstack-keystone | 15:16 | |
| *** Ephur_ has joined #openstack-keystone | 15:17 | |
| *** krykowski has joined #openstack-keystone | 15:18 | |
| krykowski | Hey guys, I have some issue after reinstalling the whole devstack. It crashes on creating images in glance due to 401 Unauthorized. | 15:21 |
| *** Ephur has quit IRC | 15:21 | |
| krykowski | I tried to get image list with glance image-list but same error occured | 15:21 |
| krykowski | In the keystone logs I have following "Authorization failed. Could not find user: %SERVICE_USER%", what is that %SERVICE_USER% user? | 15:21 |
| *** boris-42 has quit IRC | 15:22 | |
| *** david-lyle_afk is now known as david-lyle | 15:23 | |
| *** tsufiev_ has joined #openstack-keystone | 15:24 | |
| lbragstad | krykowski: it could be a setup issue. The service user is a user account for use by the service. | 15:29 |
| lbragstad | krykowski: was this a clean stack.sh run? | 15:30 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 15:31 |
| *** joesavak has joined #openstack-keystone | 15:32 | |
| krykowski | <lbragstad>: I had some old devstack installation so run ./clean.sh and removed whole /opt/stack/ directory. After that I've just pulled latest devstack and run ./stack.sh | 15:32 |
| *** iamjarvo has quit IRC | 15:32 | |
| krykowski | I had to mess something, spent all day investigating it with no luck | 15:33 |
| *** jorge_munoz has quit IRC | 15:33 | |
| *** jsavak has quit IRC | 15:34 | |
| *** boris-42 has joined #openstack-keystone | 15:39 | |
| *** jorge_munoz has joined #openstack-keystone | 15:45 | |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** ChanServ sets mode: +v gyee | 15:46 | |
| *** thedodd has joined #openstack-keystone | 15:46 | |
| dolphm | jorge_munoz: you really can't set Workflow-1?! that's terrible | 15:48 |
| dolphm | wonder why & when they took that away? | 15:49 |
| jorge_munoz | Yes, I did not see it. | 15:51 |
| *** ayoung has joined #openstack-keystone | 15:52 | |
| *** ChanServ sets mode: +v ayoung | 15:52 | |
| ayoung | rodrigods, on https://review.openstack.org/#/c/142573/ I was just echoing morganfainberg 's comments from IRC into the review. Are you actively working on that patch? | 15:53 |
| dolphm | jorge_munoz: regarding your PM, no the expiration shouldn't include a timezone. it should be assumed to be UTC, but bknudson has a fix in review to convert it to a UTC datetime instead of a local datetime, which is probably the issue you're seeing | 15:55 |
| dolphm | jorge_munoz: https://review.openstack.org/#/c/162489/ | 15:55 |
| dolphm | jorge_munoz: did you pull the _get_token_id() refactor out? | 15:56 |
| ayoung | dolphm, Building the "assume UTC" aspect into the Access Info models was essential | 15:57 |
| jorge_munoz | dolphm: Yes, it was not part of the patch. | 15:57 |
| *** iamjarvo has joined #openstack-keystone | 15:57 | |
| jorge_munoz | dolphm: It was added in the initial commit. | 15:57 |
| dolphm | ayoung: this would be lower level than that - timestamps are ultimately encoded into the fernet token format itself using 64 bit ints | 15:57 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable use of database domain config https://review.openstack.org/159675 | 15:58 |
| dolphm | ayoung: we just need to read it back correctly :) | 15:58 |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable sensitive substitutions into whitelisted domain configs https://review.openstack.org/159928 | 15:58 |
| rodrigods | ayoung, nope... :) | 15:58 |
| ayoung | dolphm, Heh...I would not call that lower level. I'm agreeing with you, though, just that on the Keystone side, it will make it better if we have an abstraction that knows how to produce and consume the the right format | 15:58 |
| rodrigods | ayoung, you can assume it, as marekd did | 15:58 |
| dolphm | jorge_munoz: your current patch is failing without it - you can propose two (or more) patches at once that depend on each other | 15:58 |
| ayoung | rodrigods, If I assume it, I can;'t approve it | 15:59 |
| *** markvoelker has quit IRC | 15:59 | |
| *** markvoelker has joined #openstack-keystone | 16:00 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 16:00 |
| ayoung | dolphm, https://review.openstack.org/#/c/138519/16/keystoneclient/models/access_info.py,cm see the DateString class there. | 16:00 |
| ayoung | dolphm, what in the fernet patch needs review attention? | 16:01 |
| dolphm | jorge_munoz: thanks for the pep8 fixes :) | 16:01 |
| *** stevemar2 is now known as stevemar | 16:01 | |
| dolphm | ayoung: https://review.openstack.org/#/c/161876/ | 16:01 |
| dolphm | ayoung: https://review.openstack.org/#/c/162489/ | 16:01 |
| dolphm | ayoung: thanks! | 16:02 |
| *** timcline has quit IRC | 16:02 | |
| jorge_munoz | dolphm: OK, I'll add a new patch that includes the UTC time. | 16:02 |
| ayoung | dolphm, looks cood. | 16:03 |
| ayoung | good | 16:03 |
| *** fmarco76 has quit IRC | 16:04 | |
| *** pmath has left #openstack-keystone | 16:04 | |
| *** markvoelker has quit IRC | 16:05 | |
| *** iamjarvo has quit IRC | 16:07 | |
| *** browne has quit IRC | 16:08 | |
| ayoung | dolphm, so you are convinced that not having the expiration in the token itself is the right approach? I assume this is part of "get it as small as possible." | 16:08 |
| dolphm | ayoung: i am, yes | 16:08 |
| dolphm | ayoung: i agree with the concern, but it's a concern for an edge case (changing the token lifespan in a running system) that can be well documented behavior. | 16:09 |
| ayoung | dolphm, I think I'm OK with that. I want to make sure we are not painting ourselves into a corner whee we need to reengineer to get to distributed signing. In this case, the CONF value for timeout would have to be synchronized, but its just another piece of Keystone data that is cacheable. | 16:10 |
| dolphm | jorge_munoz: i'm confused - what are you adding, exactly, concerning UTC time? there's already a fix in review for the issue | 16:11 |
| stevemar | heads up keystone folks, probably a new release of osc coming out today, hold on to your hats! | 16:11 |
| dolphm | jorge_munoz: https://review.openstack.org/#/c/162489/ | 16:11 |
| dolphm | stevemar: \o/ | 16:11 |
| dolphm | ayoung: ++ | 16:11 |
| jorge_munoz | dolphm: I was just including the fix on my patch. | 16:12 |
| stevemar | dolphm, i said to hold on to your hat, like this, /o\ | 16:12 |
| dolphm | ayoung: there's another way to look at it as well - one keystone (maybe serving barbican or something) might have tighter security requirements (shorter ttl) than another that would otherwise recognize each other's tokens. | 16:13 |
| dolphm | ayoung: point is - we're gaining some flexibility that puts ttl validation a tiny bit closer to the authorization point | 16:14 |
| *** samueldmq_away has quit IRC | 16:14 | |
| dolphm | stevemar: /o\ | 16:14 |
| stevemar | much better | 16:14 |
| dolphm | jorge_munoz: how? | 16:14 |
| jorge_munoz | dolphm: cherry-pick | 16:15 |
| dolphm | jorge_munoz: but it's already in review and approved - if you upload another instance of that review, it'll pull it out of the gate | 16:15 |
| jorge_munoz | dolphm: Is the patch merged in? | 16:16 |
| dolphm | jorge_munoz: it's gating, so it'll be an hour or two | 16:16 |
| dolphm | jorge_munoz: since it's not the same dependency sequence, you could add "Depends-On: I56757e9636e7baf46eeb1657dab209616e310672" to your commit message so that it's not tested without it | 16:16 |
| ayoung | dolphm, in the token validator code you have: if isinstance(payload[1], str): Is that correct? Should it be instance of basestring, or even six.string_types to be future proof? | 16:16 |
| jorge_munoz | dolphm: Ok, thanks. | 16:17 |
| dolphm | ayoung: yeah, that sounds wrong. where's that? | 16:18 |
| ayoung | dolphm, https://review.openstack.org/#/c/161774/11/keystone/token/providers/fernet/token_formatters.py,cm | 16:18 |
| dolphm | ayoung: oh that might be nuked in a later patch. is that determining if it's a project scope or not? | 16:18 |
| ayoung | dolphm, its looking at the dataytype for a token | 16:18 |
| dolphm | ayoung: yeah, i didn't touch that bit in that specific patch, but the conditional is completely deleted later on | 16:18 |
| ayoung | payload = self.unpack(token_string) | 16:19 |
| ayoung | then | 16:19 |
| ayoung | if isinstance(payload[1], str): | 16:19 |
| dolphm | ayoung: it's deleted here, L179 or so on the left https://review.openstack.org/#/c/162031/11/keystone/token/providers/fernet/token_formatters.py,unified | 16:19 |
| *** joesavak has quit IRC | 16:20 | |
| * ayoung guess right! | 16:20 | |
| ayoung | dolphm, is it maybe worthwhile collapsing those changes? Is there any value in splitting them this way for review? | 16:20 |
| *** iamjarvo has joined #openstack-keystone | 16:20 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 16:21 |
| dolphm | ayoung: yes - the expiration removal and timestamp handling one warrant their own discussions | 16:21 |
| ayoung | ok | 16:21 |
| dolphm | ayoung: the following refactor is pretty big and would complicate things quite a bit :) | 16:21 |
| ayoung | Fair enough | 16:22 |
| ayoung | dolphm, the pattern of referring to string elements by position is also Fragile. I'll ignorethat, too, though if it is clean up later | 16:23 |
| ayoung | audit_ids = payload[4] for example | 16:23 |
| dolphm | ayoung: payload is a tuple there | 16:23 |
| dolphm | ayoung: and that's only done in that once class | 16:23 |
| stevemar | morganfainberg, might be late for the meeting... | 16:23 |
| dolphm | ayoung: one* class - nothing else is ever responsible for understanding / handling the payload order | 16:23 |
| morganfainberg | stevemar: np | 16:24 |
| ayoung | dolphm, so there is a better pattern for that kind of work. It is to have a collection of simple objects that read and write their individual values. You iterate throgu hone way to read, and the opposite way to write | 16:24 |
| ayoung | not a deal breaker...just fragile code | 16:24 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Refactor: remove dep on trust_api / v3 token helper https://review.openstack.org/161876 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Remove redundant creation timestamp from fernet tokens https://review.openstack.org/161897 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Remove the expiration timestamp from Fernet tokens https://review.openstack.org/161774 | 16:25 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 16:25 |
| dolphm | jorge_munoz: oh god | 16:25 |
| dolphm | jorge_munoz: please use --no-rebase each and every time you upload a change | 16:25 |
| morganfainberg | Looks like a rebase snuck in. | 16:25 |
| morganfainberg | dolphm: according to infra folks --no-rebase shouldn't be needed. | 16:26 |
| dolphm | jorge_munoz: because you're depending on other reviews, git-review has a tendency to try and automatically rebase the reviews your dependent on, which A) yanks gating changes out of the gate, B) clears Code-Review votes if the rebase is non-trivial, C) requires new check runs to occur on each patch | 16:26 |
| dolphm | morganfainberg: yeah well they're completely wrong and i'm tired of complaining about it | 16:26 |
| morganfainberg | dolphm: I should go poke git-review and fix that bug :P | 16:27 |
| ayoung | I've found --no-rebase was getting ignored on me | 16:27 |
| jorge_munoz | dolphm: oops | 16:27 |
| morganfainberg | dolphm: so... Ubuntu one keeps telling me I'm a bot when I login via iOS. Do you have the same issue? | 16:28 |
| dolphm | jorge_munoz: i should have mentioned it earlier! | 16:28 |
| dolphm | jorge_munoz: for future reference :) | 16:28 |
| morganfainberg | And...who the hell do I harass about that :( I'm not a bot. | 16:28 |
| dolphm | morganfainberg: i don't use linux on the desktop | 16:29 |
| jorge_munoz | dolphm: will do | 16:29 |
| dolphm | morganfainberg: oh, i see what you mean, no! | 16:29 |
| *** joesavak has joined #openstack-keystone | 16:29 | |
| morganfainberg | dolphm: I am hating lp more and more. | 16:29 |
| *** jsavak has joined #openstack-keystone | 16:30 | |
| morganfainberg | dolphm: iOS must be automatically populating a hidden field. That is such a stupid thing to randomly change/add | 16:31 |
| ayoung | morganfainberg, fairly certain you are a bot | 16:31 |
| morganfainberg | dolphm: doesn't happen on the desktop version with the same utilities. | 16:31 |
| morganfainberg | ayoung: I might be :(. But bknudson is probably more of one :P | 16:32 |
| *** ayoung is now known as ayoungbot | 16:32 | |
| * ayoungbot has revealed his true identity | 16:32 | |
| dolphm | morganfainberg: ayoungbot has a point | 16:32 |
| *** ayoungbot is now known as ayoung | 16:33 | |
| dolphm | bknudson: evilbrant_bot? | 16:33 |
| *** joesavak has quit IRC | 16:34 | |
| *** lhcheng has joined #openstack-keystone | 16:38 | |
| *** _cjones_ has joined #openstack-keystone | 16:39 | |
| *** lhcheng_ has joined #openstack-keystone | 16:40 | |
| *** iamjarvo has quit IRC | 16:42 | |
| dolphm | jorge_munoz: o/ | 16:43 |
| *** lhcheng has quit IRC | 16:43 | |
| dolphm | jorge_munoz: what do you have a merge conflict with, exactly? | 16:43 |
| jorge_munoz | dolphm: Nothing that I can tell, It started showing after I added the Depends-On | 16:44 |
| *** harlowja_away is now known as harlowja_ | 16:44 | |
| dolphm | jorge_munoz: you didn't change anything else since patchset 20? | 16:44 |
| jorge_munoz | dolphm: Nope | 16:45 |
| jorge_munoz | just the Depends-On on the commit message. | 16:46 |
| *** dimsum__ has quit IRC | 16:46 | |
| dolphm | jorge_munoz: let me try uploading one - i don't see an issue though | 16:46 |
| morganfainberg | ayoung: so we have one operator who is now heavily using ldap assignment because they want tight control of the entities between identity and assignment (the whole thing we are trying to break the habit of) | 16:47 |
| dolphm | jorge_munoz: i mean, a reason for a conflict | 16:47 |
| morganfainberg | ayoung: see https://bugs.launchpad.net/keystone/+bug/1409635 | 16:47 |
| openstack | Launchpad bug 1409635 in Keystone "keystone fails to authenticate users when LDAP project_id_attribute is not CN" [Undecided,New] | 16:47 |
| *** dimsum__ has joined #openstack-keystone | 16:47 | |
| morganfainberg | ayoung: the answers I have for his questions. Are "we don't support what you are doing" right now. | 16:47 |
| dolphm | jorge_munoz: so, you're patch actually conflicts with the patch you now Depends-On, which isn't allowed | 16:49 |
| *** browne has joined #openstack-keystone | 16:50 | |
| jorge_munoz | dolphm: Ah, ok. I'll just wait till the patch i depend on gets merged and then I'll just rebase. | 16:50 |
| dolphm | jorge_munoz: yeah, that's the easiest solution :-/ | 16:51 |
| dolphm | bknudson: if you have any more fixes for fernet, include them in the giant dep tree so we don't run into this ^ :P | 16:51 |
| * dolphm food time | 16:51 | |
| *** haneef has joined #openstack-keystone | 16:54 | |
| ayoung | morganfainberg, what he is proposing is probably correct...still reading through the comments, though | 16:57 |
| ayoung | its bascially what we did in the identity backend | 16:57 |
| morganfainberg | ayoung: this is ldap assignment. He has a question at the end, read only ldap backend, user is removed | 16:58 |
| openstackgerrit | Eric Brown proposed openstack/keystone: WIP: Replace exec calls with cryptography library https://review.openstack.org/163088 | 16:58 |
| morganfainberg | How does sql assignment know? | 16:58 |
| morganfainberg | Right now he is out-of band removing from both identity and assignment. I think the only answer is the tool that edits ldap has to make an API call to keystone. | 16:59 |
| morganfainberg | Or edit sql (scary) | 16:59 |
| *** iamjarvo has joined #openstack-keystone | 16:59 | |
| *** iamjarvo has quit IRC | 16:59 | |
| *** gyee has quit IRC | 17:00 | |
| ayoung | morganfainberg, I should probably cut and past my response to the mailing list about the FKs from last night | 17:00 |
| *** jorge_munoz_ has joined #openstack-keystone | 17:00 | |
| *** iamjarvo has joined #openstack-keystone | 17:00 | |
| ayoung | morganfainberg, It doesn't know, and it shouldn't know | 17:00 |
| ayoung | if I ahd my way, we would treat the identity operations as coming from a completely different, non integrated system from assignment operations | 17:00 |
| *** jistr has quit IRC | 17:01 | |
| morganfainberg | ayoung: I agree. We need a nice way to shift this operator that direction. | 17:01 |
| ayoung | I should be able to create a role assignment to a non-existant user or group | 17:01 |
| *** lhcheng_ is now known as lhcheng | 17:01 | |
| *** gyee has joined #openstack-keystone | 17:02 | |
| *** ChanServ sets mode: +v gyee | 17:02 | |
| topol | so Keystone meeting back to starting an hour later? | 17:02 |
| ayoung | and Mike Bayer really didn't get it. | 17:03 |
| stevemar | topol, yeah... wondering whats up | 17:03 |
| *** _cjones_ has quit IRC | 17:05 | |
| dstanek | time changes screw everything up | 17:05 |
| *** gyee has quit IRC | 17:07 | |
| *** markvoelker has joined #openstack-keystone | 17:09 | |
| *** _cjones_ has joined #openstack-keystone | 17:09 | |
| ayoung | There is a movement afoot to kill daylight savings time. Considering how it messed up my kids' sleep schedules this week I'm prone to sign on | 17:09 |
| stevemar | it looks like -meeting is being used by rally folks atm | 17:10 |
| * breton didn't have the time change | 17:10 | |
| breton | US problems | 17:10 |
| *** leonchio_ has joined #openstack-keystone | 17:10 | |
| *** jorge_munoz_ has quit IRC | 17:11 | |
| stevemar | morganfainberg, not around? | 17:12 |
| morganfainberg | stevemar, yes | 17:12 |
| morganfainberg | i'm here | 17:12 |
| stevemar | morganfainberg, isn't it keystone meeting time? | 17:13 |
| morganfainberg | you time changed didn't you | 17:13 |
| stevemar | i did | 17:13 |
| *** iamjarvo has quit IRC | 17:14 | |
| *** krtaylor has quit IRC | 17:14 | |
| morganfainberg | stevemar, keystone meeting is 1800 UTC | 17:14 |
| dstanek | stevemar: you have to put it in your calendar at 18:00 UTC | 17:14 |
| morganfainberg | stevemar, it is currently 1714 UTC | 17:14 |
| morganfainberg | http://www.worldtimeserver.com/current_time_in_UTC.aspx | 17:14 |
| stevemar | morganfainberg, mokay | 17:14 |
| dstanek | otherwise you'll be constantly messed up | 17:14 |
| morganfainberg | if you use exchange, you can do UTC, if you use google, you need to use https://www.google.com/search?client=safari&rls=en&q=reykjavik&ie=UTF-8&oe=UTF-8 | 17:15 |
| morganfainberg | erm | 17:15 |
| morganfainberg | reykjavik | 17:15 |
| *** spandhe has joined #openstack-keystone | 17:15 | |
| morganfainberg | so.. topol, stevemar, see you guys in ~45mins | 17:16 |
| topol | morganfainberg, stevemar. If I had realized sooner I couldhave gone to a long leisurely lunch... | 17:18 |
| dstanek | i have Google calendar configured to show my UTC and EST to make like easier | 17:18 |
| stevemar | topol, i know right, i rushed home | 17:18 |
| *** markvoelker has quit IRC | 17:19 | |
| *** markvoelker has joined #openstack-keystone | 17:19 | |
| topol | stevemar, rushed home??? didnt I tell Dini you now go into the office to show sympathy for her cause ? | 17:19 |
| morganfainberg | stevemar, topol, it's ok next week [just for you guys] we'll be starting at the same time as this week. | 17:19 |
| morganfainberg | so you can have a nice lunch | 17:20 |
| stevemar | topol, i had to rush home *from buying food* | 17:20 |
| morganfainberg | in fact... we will do this until the next daylight time shift | 17:20 |
| topol | morganfainberg you are the best! | 17:20 |
| *** markvoelker_ has joined #openstack-keystone | 17:21 | |
| topol | this left over trail mix from my last trip is oh so good | 17:21 |
| *** markvoelker has quit IRC | 17:24 | |
| *** krtaylor has joined #openstack-keystone | 17:27 | |
| *** stevemar has quit IRC | 17:32 | |
| *** spandhe has quit IRC | 17:32 | |
| *** _cjones_ has quit IRC | 17:36 | |
| *** iamjarvo has joined #openstack-keystone | 17:37 | |
| *** _cjones_ has joined #openstack-keystone | 17:37 | |
| *** iamjarvo has quit IRC | 17:37 | |
| *** iamjarvo has joined #openstack-keystone | 17:38 | |
| *** timcline has joined #openstack-keystone | 17:40 | |
| *** spandhe has joined #openstack-keystone | 17:41 | |
| *** spandhe has quit IRC | 17:41 | |
| *** spandhe has joined #openstack-keystone | 17:42 | |
| *** htruta has quit IRC | 17:49 | |
| *** stevedroid has joined #openstack-keystone | 17:51 | |
| stevedroid | topol, fyi my isp seems down | 17:52 |
| stevedroid | Even the connection through data is slow | 17:52 |
| ayoung | morganfainberg, so, I'd like to get https://review.openstack.org/#/c/142573/ through, and I don't think rewriting the object model like access info at this late stage is the right way to go | 17:54 |
| ayoung | this has been heavily enough reviewed that it should be OK as is, but I don't want to do a +2a when you have a -1 on it | 17:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Change project name constraint https://review.openstack.org/158372 | 17:55 |
| morganfainberg | ayoung: I'm inclined to say push it to liberty | 17:55 |
| ayoung | morganfainberg, I think it is too valuable | 17:55 |
| ayoung | morganfainberg, I thought this functioanlity was already in the product. Without it, we are building something very limited | 17:56 |
| morganfainberg | Then make it clear what is going on in the code. It is not clear in code, tests, fixtures, etc. we had at least 3 cores ask "what is going on here" | 17:56 |
| ayoung | I wish I had realized earlier. I would have put more time into this than the access info | 17:56 |
| rodrigods | morganfainberg, what about adding a clear comment? | 17:57 |
| morganfainberg | ayoung: frankly I think this is too late to wedge it in. | 17:57 |
| morganfainberg | Or ask for an ffe and do it post k3 | 17:57 |
| ayoung | That was what I was asking Yesterday. Does it need a FFE. And the strict answer is "yes if it lands after..." | 17:58 |
| morganfainberg | Yep. | 17:58 |
| *** henrynash has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v henrynash | 17:58 | |
| morganfainberg | But not if it lands before. | 17:58 |
| ayoung | what is the cut off | 17:58 |
| ayoung | ? | 17:58 |
| morganfainberg | Next week. | 17:59 |
| morganfainberg | K3 | 17:59 |
| samueldmq | amakarov, hi ... sorry I was away | 17:59 |
| ayoung | Let's discuss at the end of the meeting | 17:59 |
| amakarov | samueldmq, np | 17:59 |
| *** krykowski has quit IRC | 18:00 | |
| breton | fellas, it's meeting time | 18:01 |
| *** tsufiev_ has quit IRC | 18:07 | |
| *** tsufiev_ has joined #openstack-keystone | 18:16 | |
| iamjarvo | what exactly is the public id used for? | 18:16 |
| *** gyee has joined #openstack-keystone | 18:17 | |
| *** ChanServ sets mode: +v gyee | 18:17 | |
| *** karimb has quit IRC | 18:24 | |
| *** dimsum__ is now known as dims | 18:27 | |
| *** straycat has joined #openstack-keystone | 18:33 | |
| straycat | Hello | 18:33 |
| straycat | I've been setting up swift and got an odd message in the log: 'Auth Token confirmed use of v3.0 apis', this confuses me since I've not set up any v3 endpoint for keystone. | 18:35 |
| straycat | I've been setting up swift and got an odd message in the log: 'Auth Token confirmed use of v3.0 apis', this confuses me since I've not set up any v3 endpoint for keystone. | 18:35 |
| straycat | sorry :/ | 18:35 |
| *** _cjones_ has quit IRC | 18:38 | |
| breton | straycat: everyone is on the meeting now | 18:38 |
| breton | you should wait for ~30 minutes | 18:39 |
| straycat | breton, Okay thanks | 18:39 |
| *** stevemar has joined #openstack-keystone | 18:41 | |
| *** ChanServ sets mode: +v stevemar | 18:41 | |
| iamjarvo | if you are using ldap how do you then sign up users? i am trying to figure out the matching of id_mapping and user in the mysql identity database | 18:42 |
| iamjarvo | should public_id in id_mapping match id in user? | 18:43 |
| *** stevedroid has quit IRC | 18:43 | |
| *** henrynash has quit IRC | 18:44 | |
| *** henrynash has joined #openstack-keystone | 18:44 | |
| *** ChanServ sets mode: +v henrynash | 18:44 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Fix time issue in AccessInfo test https://review.openstack.org/163128 | 18:44 |
| *** panbalag has quit IRC | 18:45 | |
| *** panbalag has joined #openstack-keystone | 18:45 | |
| *** zzzeek has quit IRC | 18:48 | |
| *** zzzeek has joined #openstack-keystone | 18:53 | |
| *** _cjones_ has joined #openstack-keystone | 18:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Mark the domain-config API as experimental https://review.openstack.org/162484 | 19:00 |
| ayoung | jamielennox, did you see what I did with times in my accessinfo change? | 19:01 |
| jamielennox | ayoung: not recently | 19:01 |
| dstanek | what's the verdict on naming? | 19:01 |
| *** markvoelker_ has quit IRC | 19:01 | |
| ayoung | ah...yours makes sense...I thought it was more expansive | 19:01 |
| ayoung | jamielennox, just that I am trying to make a class the encapsulate time handling | 19:01 |
| dolphm | iamjarvo: public ID of what? as opposed to a private ID, or...? | 19:01 |
| ayoung | but I'm not doing the windows etc stuff | 19:02 |
| ayoung | "expires soon" | 19:02 |
| ayoung | so, disregard | 19:02 |
| dolphm | straycat: keystone's default paste configuration deploys v3 - you don't have to add it to your catalog like other services do. auth_token does the discovery work automatically | 19:02 |
| jamielennox | ayoung: i'm still not convinced it should be a client side change, as opposed to some sort of keystone-common | 19:02 |
| ayoung | jamielennox, you are not wrong | 19:03 |
| dolphm | iamjarvo: ah, that public_id, missed your other messages. normally you'd add your users directly to LDAP and just auth them through keystone | 19:03 |
| dolphm | iamjarvo: there's no additional registration process | 19:03 |
| ayoung | just that to get there is a lot more overhead, and the primary consumer is client, so I think making it work in client first and then splitting the repo is the right approach | 19:03 |
| henrynash | bknudson: fyi, I udpated https://review.openstack.org/#/c/159675/ to respond to your comments | 19:03 |
| jamielennox | ayoung: morganfainberg and i were talking the other day about declaring better interfaces for drivers etc and starting to split some stuff out, i think it would belong there | 19:04 |
| ayoung | jamielennox, if the code is not run against all of the client tests, we miss the majority of the logic | 19:04 |
| dolphm | iamjarvo: henrynash can probably answer more detailed questions if you have any | 19:04 |
| bknudson | henrynash: thanks! it's on my list. | 19:04 |
| henrynash | bknduson: thx | 19:04 |
| henrynash | iamjarvo: anyting I can help with? | 19:04 |
| ayoung | jamielennox, I also don't think that server, client, and common should be in three differnt git repos, but Python forces that upon us | 19:04 |
| * dolphm list of release blockers is updating again! https://gist.github.com/dolph/651c6a1748f69637abd0 | 19:04 | |
| dolphm | poke me if there's something missing | 19:04 |
| openstackgerrit | Merged openstack/python-keystoneclient: token signing support alternative message digest https://review.openstack.org/117372 | 19:05 |
| jamielennox | ayoung: client and server i do, common is more debatable | 19:05 |
| dolphm | i'm working now to add reviews that release blocking reviews are depedent on as well | 19:05 |
| *** amakarov is now known as amakarov_away | 19:05 | |
| ayoung | jamielennox, anyway, I am not going to drive splitting out common. I'll support you if you want to, though. | 19:05 |
| jamielennox | bknudson: can i have a hack exemption on https://review.openstack.org/#/c/161962/ ? | 19:06 |
| jamielennox | bknudson: we've got the ksc change that will come through but given the swift issue can we release with that and roll over to the client code as it makes g-r? | 19:06 |
| *** rushiagr is now known as rushiagr_away | 19:07 | |
| bknudson | jamielennox: y, I looked at this yesterday and I'm ok with the hack there... I think you explained it well enough. | 19:07 |
| jamielennox | bknudson: cool, i think the plan was to get this in and release today | 19:08 |
| henrynash | jamielennox: here’s my proposal for the json home approach (updated with teh removal of dsiabled since the meeting): https://review.openstack.org/#/c/162484/ | 19:08 |
| bknudson | jamielennox: not sure if I'll have time to review today due to meetings, it's on my list. | 19:08 |
| dolphm | morganfainberg: need to use #agree more often, that's handy: http://eavesdrop.openstack.org/meetings/keystone/2015/keystone.2015-03-10-18.03.html | 19:08 |
| dstanek | morganfainberg: rodrigods: ayoung: i'm not sure what a good object representation would look like since the really is an ordered set of data | 19:08 |
| bknudson | jamielennox: but I'm also fine with the hack for now and switching over to ksc when it's ready. | 19:08 |
| dstanek | forgot the link: https://review.openstack.org/#/c/142573/ | 19:08 |
| jamielennox | bknudson: you've seen it before though and are happy with the general idea if other people pass it | 19:08 |
| bknudson | jamielennox: yes. | 19:09 |
| jamielennox | henrynash: are there client side libraries for dealing with jsonhome? when i looked when it was first proposed i found i'd probably be writing my own | 19:09 |
| henrynash | jamielennox: a good quetsions…to which I don’t know the answer…bknudson? | 19:10 |
| jamielennox | henrynash: if that hints block is standard (i assume it is) then i'm ok with that | 19:10 |
| *** iamjarvo has quit IRC | 19:10 | |
| jamielennox | henrynash: and i was wondering if whatever we use to parse it would know how to deal with hints | 19:10 |
| henrynash | jamielennox: yes, hints block with a status property is standard | 19:10 |
| bknudson | I don't know about any JSON Home library either. | 19:10 |
| bknudson | here's our chance to make one. | 19:11 |
| henrynash | jamielennix: well. let me rephrase my answer: “it’s in the spec”…..:-) | 19:11 |
| jamielennox | bknudson: yep, i don't mind that | 19:11 |
| jamielennox | henrynash: cool - that works for me then | 19:11 |
| samueldmq | henrynash, just a quick question regarding domain-specific configs ... | 19:13 |
| henrynash | samueldmq: sure | 19:14 |
| samueldmq | henrynash, there we can set allow_user_update, etc ... for each config, right? | 19:14 |
| henrynash | samueldmq: yes | 19:14 |
| samueldmq | (ldap in this case) | 19:14 |
| samueldmq | henrynash, ok so one more advantage of your implementation is that you can query the keystone api to know whether a ldap is read-only/read-write | 19:15 |
| *** rushiagr_away is now known as rushiagr | 19:15 | |
| henrynash | sameuldmq: iindeed | 19:15 |
| samueldmq | henrynash, and then horizon (supporting multiple domains) could present the user the write operations (update, delete, create) of users, for example, just for domains that support it | 19:15 |
| henrynash | samueldmq: right | 19:16 |
| samueldmq | henrynash, oh! that's great | 19:16 |
| samueldmq | henrynash, thanks! | 19:16 |
| *** henrynash has quit IRC | 19:17 | |
| *** haneef has quit IRC | 19:19 | |
| *** haneef has joined #openstack-keystone | 19:20 | |
| *** iamjarvo has joined #openstack-keystone | 19:24 | |
| rodrigods | dstanek, a list containing tuples? | 19:25 |
| iamjarvo | henrynash so the workflow with ldap is add them to ldap then when they auth through horizon all the needed info will be added? would the roles and project get added to ldap? | 19:25 |
| iamjarvo | roles, projects and domain | 19:26 |
| dstanek | rodrigods: i don't think that is any clearer - i think the real issue is that the intent is hidden | 19:26 |
| morganfainberg | dstanek, ++ | 19:27 |
| dstanek | i think the list-of-lists data structure would be fine if something else around that code changed | 19:27 |
| rodrigods | dstanek, maybe we can always treat as a list of lists | 19:27 |
| morganfainberg | dstanek, if it was always a list of lists, not a list of lists-and-string-and-other-stuff | 19:27 |
| dstanek | rodrigods: i'll take a quick crack at it | 19:27 |
| morganfainberg | and it was clear what was expected | 19:28 |
| morganfainberg | rodrigods, ^ | 19:28 |
| jamielennox | morganfainberg: bknudson's ok with the ksm hack around for now if you would like to re-review and we can get it out today | 19:36 |
| *** rushiagr is now known as rushiagr_away | 19:36 | |
| morganfainberg | jamielennox, cool | 19:36 |
| jamielennox | https://review.openstack.org/#/c/161962/ | 19:36 |
| morganfainberg | jamielennox, will do | 19:36 |
| jamielennox | or anyone watching please check ^ | 19:37 |
| *** vishy has joined #openstack-keystone | 19:38 | |
| *** Qlawy has quit IRC | 19:40 | |
| *** Qlawy has joined #openstack-keystone | 19:40 | |
| *** iamjarvo has quit IRC | 19:46 | |
| dolphm | dstanek: how would you enumerate all tests in keystone without running any of them? | 19:49 |
| breton | # !!! - UNDER NO CIRCUMSTANCES COPY ANY OF THIS CODE - !!! | 19:49 |
| breton | wut | 19:49 |
| morganfainberg | breton, peope have a tendancy to see code in ksc and copy it in their own application | 19:49 |
| *** Tahmina has joined #openstack-keystone | 19:49 | |
| morganfainberg | breton, thinking it is a "good idea"™ | 19:49 |
| dolphm | breton: instead of just calling keystoneclient | 19:50 |
| morganfainberg | dolphm, subunit --list ? | 19:50 |
| stevemar | dolphm, theres a line that does that... | 19:50 |
| dolphm | morganfainberg: that probably needs a "instead, you should ..." | 19:50 |
| bknudson | might want to put a FIXME comment in there. | 19:50 |
| bknudson | hopefully it won't be there for long. | 19:50 |
| stevemar | dolphm, https://github.com/openstack/oslotest/blob/master/tools/oslo_debug_helper#L30 | 19:50 |
| *** dims has quit IRC | 19:51 | |
| jamielennox | bknudson: there's a FIXME there as well | 19:51 |
| *** gokrokve has joined #openstack-keystone | 19:51 | |
| bknudson | great. | 19:51 |
| dstanek | dolphm: stevemar: yeah, testtools discovery is what i use | 19:51 |
| dstanek | dolphm: stevemar: it won't run them, but it will import them | 19:52 |
| dolphm | dstanek: importing might be okay | 19:52 |
| dolphm | ideally i want a plaintext list of like "package.path.to.module:Class.test_name" | 19:53 |
| *** iamjarvo has joined #openstack-keystone | 19:55 | |
| *** iamjarvo has quit IRC | 19:55 | |
| *** iamjarvo has joined #openstack-keystone | 19:56 | |
| *** iamjarvo has quit IRC | 19:56 | |
| dolphm | morganfainberg: python -m subunut.run --list ? that outputs a bunch of binary along with test names? | 19:56 |
| dolphm | subunit* | 19:57 |
| morganfainberg | uhm. maybe it was a testtool thing | 19:57 |
| dstanek | subunit emits the subunit protocol | 19:57 |
| dolphm | dstanek: how do you use testtools for that without running tests? | 19:57 |
| *** iamjarvo has joined #openstack-keystone | 19:57 | |
| dolphm | dstanek: that makes sense | 19:57 |
| *** aix has quit IRC | 19:57 | |
| dstanek | dolphm: .tox/py27/bin/python -m testtools.run discover -t ./ keystone/tests/unit --list | 19:57 |
| morganfainberg | dstanek, that! | 19:57 |
| morganfainberg | :) | 19:57 |
| dolphm | dstanek: perfect! | 19:57 |
| stevemar | isn't that what i linked? | 19:57 |
| straycat | dolphm, Ahh, how can I go about disabling that? | 19:58 |
| straycat | I tried obvious options but they all crashed keystone | 19:58 |
| stevemar | i swear that's what i linked :) | 19:58 |
| dolphm | straycat: i don't know why you would want to do that, but you just need to edit your paste config for keystone and basically remove /v3 from the final composition | 19:59 |
| dolphm | compositions* (there's two) | 19:59 |
| morganfainberg | straycat, what are you trying to accomplish | 19:59 |
| morganfainberg | ? | 19:59 |
| straycat | dolphm, I'm just curious really, I should be able to specify the api in the swift config if I want | 19:59 |
| dolphm | straycat: you can explicitly tell auth_token to use v2, but i forget the config opiton | 20:00 |
| dolphm | straycat: api_version or something? | 20:00 |
| straycat | auth_version i think? | 20:00 |
| dolphm | straycat: ++ | 20:00 |
| dolphm | and auth_version='v2.0' is probably the magic value for v2-only | 20:01 |
| *** dims has joined #openstack-keystone | 20:01 | |
| *** topol has quit IRC | 20:01 | |
| straycat | cool | 20:02 |
| rodrigods | jamielennox, noticed you are going through kc reviews :) | 20:04 |
| rodrigods | jamielennox, please take a look in https://review.openstack.org/#/c/150078/ whenever you have a chance | 20:04 |
| jamielennox | rodrigods: it's been on my looming list, i look at it occasionally and change my mind each time | 20:04 |
| *** iamjarvo has quit IRC | 20:04 | |
| jamielennox | i feel like the python side of the API could be nicer, i just don't know what it should be | 20:05 |
| *** thedodd has quit IRC | 20:06 | |
| rodrigods | jamielennox, makes sense... but we'd need to change the behavior of the subtree_as_list... that is already merged | 20:06 |
| jamielennox | rodrigods: on client? | 20:07 |
| rodrigods | jamielennox, yes | 20:07 |
| jamielennox | oh - ok, well that might change my opinion | 20:07 |
| dolphm | dstanek: thank you sir! i'm now running every test in keystone in isolation 100 times to hunt for transient failures :) | 20:07 |
| rodrigods | jamielennox, see https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/projects.py#L107 | 20:07 |
| openstackgerrit | Merged openstack/keystone: Fix seconds since epoch use in fernet tokens https://review.openstack.org/162489 | 20:08 |
| dolphm | jorge_munoz: ^ | 20:09 |
| lbragstad | dolphm: sweet, do you think we should rebase the chain on that? | 20:09 |
| jorge_munoz | dolphm: cool | 20:09 |
| dolphm | lbragstad: yeah, one sec | 20:09 |
| lbragstad | dolphm: I'm seeing a weird case with federated tokens... | 20:09 |
| openstackgerrit | Merged openstack/keystone: Remove unused checkout_vendor https://review.openstack.org/162483 | 20:09 |
| dolphm | lbragstad: actually, need to wait for https://review.openstack.org/#/c/161876/ to land | 20:10 |
| lbragstad | dolphm: ok | 20:11 |
| dolphm | ... which got yanked out of the gate :( and is now sitting in check queue for 3h 45 min | 20:11 |
| lbragstad | :/ | 20:11 |
| dolphm | post queue looks broken too | 20:11 |
| lbragstad | dolphm: so I'm curious if what I'm experiencing with validating federation tokens is because of bknudson's change | 20:12 |
| dolphm | morganfainberg: any insight as to why the gate is getting increasingly sad today? | 20:12 |
| *** Qlawy has quit IRC | 20:12 | |
| *** thedodd has joined #openstack-keystone | 20:12 | |
| morganfainberg | dolphm: nope. Can look once I'm done with lunch. | 20:12 |
| dolphm | lbragstad: you're not seeing a failure in test_tampered_encrypted_token_throws_exception() are you? | 20:13 |
| lbragstad | dolphm: I don't think so | 20:13 |
| lbragstad | I'm seeing failures on validating tokens | 20:13 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L296 | 20:13 |
| dolphm | lbragstad: that has about a 7% chance of transient failure :) | 20:13 |
| openstackgerrit | Ian Cordasco proposed openstack/oslo.policy: Publicize oslo_policy.opts.register https://review.openstack.org/163163 | 20:13 |
| dolphm | lbragstad: you're probably getting a bad expiry unless your system clock is in UTC? | 20:14 |
| lbragstad | dolphm: for some reason, with federated tokens, (current_time < expiry) is always False | 20:14 |
| lbragstad | could be | 20:14 |
| dolphm | lbragstad: yeah, try setting your system clock to UTC or setting the token expiration to a day or so | 20:14 |
| lbragstad | dolphm: this is with the federation tests, | 20:14 |
| lbragstad | dolphm: our tests use the default expiration time, I think? | 20:15 |
| dolphm | lbragstad: which is short enough to running into UTC vs local time bugs | 20:15 |
| lbragstad | ok | 20:15 |
| dolphm | lbragstad: increase the default token lifespan in keystone.common.config and see if tests start passing | 20:15 |
| dolphm | lbragstad: what do you get when you run $ date on your system? | 20:16 |
| lbragstad | Tue Mar 10 15:16:40 CDT 2015 | 20:16 |
| bknudson | try date -u | 20:17 |
| *** henrynash has joined #openstack-keystone | 20:17 | |
| *** ChanServ sets mode: +v henrynash | 20:17 | |
| dolphm | bknudson: i was just wondering if his system time was UTC | 20:18 |
| dolphm | bknudson: i don't see those problems on my dev box because it's in UTC :-/ | 20:18 |
| dolphm | so bad timezone conversions never matter | 20:18 |
| bknudson | if I was setting up a cloud system I'd use utc. | 20:18 |
| bknudson | there's no timezones in the cloud | 20:19 |
| * dolphm today's #PROTIP ^ | 20:19 | |
| *** Qlawy has joined #openstack-keystone | 20:19 | |
| *** Qlawy has quit IRC | 20:19 | |
| *** Qlawy has joined #openstack-keystone | 20:19 | |
| dolphm | bknudson: that's like saying you don't care about the local weather forecast because it's sunny in geneva ;) | 20:21 |
| henrynash | ayoung: hi…on the tests for domain config - see my reply to you concern - there are two other tests already added which I *think* do what you are suggesting….but let me know if I am misunderstaning what you are adter | 20:22 |
| henrynash | ayoung: https://review.openstack.org/#/c/159675/ | 20:22 |
| *** thedodd has quit IRC | 20:23 | |
| bknudson | /opt/stack/keystone/.tox/py27/local/lib/python2.7/site-packages/cryptography/hazmat/backends/openssl/dsa.py:177: PendingDeprecationWarning: The DSAPublicKeyWithNumbers interface has been renamed to DSAPublicKeyWithSerialization | 20:23 |
| lbragstad | dolphm: tried suggestion one http://cdn.pasteraw.com/e03rk7rhqpz2p5z0yio08lxk203u6xv | 20:24 |
| *** chrisshattuck has joined #openstack-keystone | 20:24 | |
| dolphm | lbragstad: 7200 seconds is only 2 hours | 20:24 |
| dolphm | lbragstad: not long enough to account for CDT! | 20:25 |
| * lbragstad goes bigger! | 20:25 | |
| dolphm | lbragstad: try 86400 | 20:25 |
| bknudson | I'm starting to see all sorts of test failures ... AttributeError: 'exceptions.AttributeError' object has no attribute 'with_traceback' | 20:26 |
| bknudson | AttributeError: 'SkipTest' object has no attribute 'with_traceback' | 20:27 |
| bknudson | anybody else see these? | 20:27 |
| breton | bknudson: on tox -e py27? | 20:30 |
| bknudson | breton: yes, on keystone | 20:30 |
| breton | I'll try now | 20:30 |
| *** joesavak has joined #openstack-keystone | 20:31 | |
| *** samueldmq_ has joined #openstack-keystone | 20:31 | |
| dolphm | bknudson: i'm trying too, with -r | 20:33 |
| bknudson | pip freeze first then can diff it. | 20:33 |
| *** jsavak has quit IRC | 20:33 | |
| dolphm | bknudson: too late :( | 20:33 |
| bknudson | I think there was a note in -dev today from lifeless... | 20:33 |
| breton | pkg_resources.DistributionNotFound: virtualenv>=1.11.2 | 20:34 |
| breton | breton@breton-pc:~/src/keystone$ pip freeze | grep virtu | 20:34 |
| breton | virtualenv==12.0.7 | 20:34 |
| bknudson | not pointing fingers or jumping to conclustions or anything!!! | 20:34 |
| breton | wtf | 20:34 |
| *** jsavak has joined #openstack-keystone | 20:34 | |
| bknudson | you're in worse shape than me. | 20:34 |
| *** iamjarvo has joined #openstack-keystone | 20:34 | |
| *** radez is now known as radez_g0n3 | 20:35 | |
| *** joesavak has quit IRC | 20:36 | |
| dolphm | bknudson: i see those failures | 20:37 |
| bknudson | :( | 20:38 |
| dolphm | bknudson: 7 fails | 20:38 |
| bknudson | FAILED (id=214, failures=7, skips=1220) | 20:38 |
| bknudson | (and, rm -r .testrepository) | 20:38 |
| dolphm | bknudson: stuff like this http://cdn.pasteraw.com/8wc90sw9lh8zdkg3zi8uk13yg1310pj | 20:39 |
| dolphm | bknudson: testtools 1.7.0 release today https://pypi.python.org/pypi/testtools | 20:40 |
| straycat | little confused by, the default domain id in keystone.conf seems to be 'default' so shouldn't the tokens contain 'default' as the id? ( proxy-server[17222]: Inconsistent project domain id: None in token vs default in account metadata. ) | 20:41 |
| straycat | *by this, | 20:41 |
| dolphm | bknudson: i'm running again with testtools != 1.7.0 | 20:41 |
| bknudson | .tox/py27/bin/pip -U "testtools<1.7.0" | 20:41 |
| bknudson | (worked for me) | 20:41 |
| dolphm | straycat: v2 tokens don't have domains, they're just assumed to be in the default domain, but i'm also not sure what is producing that error or why exactly | 20:42 |
| *** boris-42 has quit IRC | 20:42 | |
| dolphm | straycat: did you override auth_token with v2? | 20:42 |
| straycat | dolphm, tbf no, since disabling in the keystone-paste.ini worked. I'll try overriding auth_token with v2 | 20:43 |
| dolphm | straycat: last i talked to them, swift looking to perform a live migration to v3-based identity information. i wonder if some of your data was migrated, and your override back to v2 isn't providing the data it needs to perform proper policy checks? | 20:44 |
| dolphm | straycat: the discovery mechanism will use v2 if that's all that's available, and it sounds like that's working. overriding it to v2 without re-enabling v3 on the server shouldn't have any additional affect | 20:44 |
| *** pnavarro has quit IRC | 20:44 | |
| straycat | hrm | 20:45 |
| *** pnavarro has joined #openstack-keystone | 20:45 | |
| dolphm | bknudson: i tried setting it in test-requirements.txt and using tox -r, but ended up with 1.7.0 installed anyway?! | 20:47 |
| dolphm | bknudson: just appended ,!=1.7.0 | 20:47 |
| dolphm | trying again after moving it to the end of the file, in case something else deps on it too | 20:47 |
| straycat | dolphm, yeah i tried it anyway and it didn't make a difference :) | 20:48 |
| openstackgerrit | David Stanek proposed openstack/keystone: this is a test to prove broken behavior is possible https://review.openstack.org/163172 | 20:49 |
| dstanek | morganfainberg, rodrigods, ayoung, stevemar, marekd: does this prove that append vs. extend has bugs or am i doing something wrong? ^ | 20:51 |
| dolphm | bknudson: no luck for me. i'm happy to blame testtools 1.7.0 though :) | 20:51 |
| bknudson | dolphm: posted change to g-r: https://review.openstack.org/#/c/163173/ | 20:52 |
| openstackgerrit | Merged openstack/python-keystoneclient: Creating parameter to list inherited role assignments https://review.openstack.org/117300 | 20:53 |
| dolphm | bknudson: i'm guessing we need to fix keystone to adapt | 20:54 |
| dolphm | bknudson: those look like intentional public API changes | 20:54 |
| bknudson | really? | 20:54 |
| bknudson | interesting... | 20:54 |
| dolphm | bknudson: but i +1'd because we're probably not the only project affected | 20:54 |
| *** iamjarvo has quit IRC | 20:55 | |
| openstackgerrit | Merged openstack/keystone: Prevent calling waitall() inside a GreenPool's greenthread https://review.openstack.org/160720 | 20:55 |
| *** iamjarvo has joined #openstack-keystone | 20:57 | |
| *** raildo is now known as raildo_away | 21:04 | |
| bknudson | dolphm: I guess there was something wrong with the wheel on pypi. | 21:09 |
| bknudson | missing part. | 21:09 |
| *** jsavak has quit IRC | 21:12 | |
| ayoung | dstanek, I have no clue. | 21:13 |
| *** iamjarvo has quit IRC | 21:14 | |
| ayoung | dstanek, what am I looking at ? | 21:14 |
| dstanek | ayoung: i'm guessing a boxy looking thing that's glowing | 21:15 |
| dstanek | ayoung: if one of the fields (in my test case Thing) has multiple values it throws off the indexing | 21:16 |
| ayoung | ah | 21:16 |
| ayoung | dstanek, the boxy looking thing saw ViewSonic. Where do I find Sonic? Isn't he a hedgehog? | 21:16 |
| *** Tahmina has quit IRC | 21:17 | |
| lbragstad | dolphm: ok, so I have a working federation commit | 21:18 |
| dolphm | lbragstad: =D | 21:19 |
| *** thedodd has joined #openstack-keystone | 21:20 | |
| lbragstad | dolphm: I'm about to push for review | 21:20 |
| dolphm | lbragstad: --no-rebase =D | 21:20 |
| lbragstad | dolphm: just double checking I can push a new version, and not destroy other changes | 21:20 |
| dolphm | lbragstad: 161876 is in the gate, so you can make sure that the git sha matches what's gating | 21:21 |
| dolphm | lbragstad: in case you accidentally rebased during dev or whatever | 21:21 |
| dolphm | lbragstad: it's when you upload a different git sha in the same branch in the same project to gerrit for the same Change-Id that zuul plucks the change out of the gate and resets everything | 21:22 |
| dolphm | lbragstad: hence the "Are you sure you really want to upload all this?" prompt that git-review shows you, with SHAs | 21:22 |
| lbragstad | dolphm: so, double checking, if I do a git review -d 161380; | 21:22 |
| dolphm | lbragstad: that'll give you what's gating | 21:22 |
| *** boris-42 has joined #openstack-keystone | 21:22 | |
| lbragstad | git stash pop; git commit -a; | 21:22 |
| dolphm | oh that's your change, nevermind | 21:23 |
| lbragstad | git review --no-rebase -y | 21:23 |
| dolphm | skip the -y | 21:23 |
| henrynash | ayoung: see me response to your comment on https://review.openstack.org/#/c/159675/ - I think the two other tests are doing what you want….but let me know if not | 21:23 |
| ayoung | henrynash, looking | 21:24 |
| dolphm | lbragstad: and make sure that the git SHA for "Refactor: make Fernet token creation/validation API agnostic" is one of the existing changesets on https://review.openstack.org/#/c/162338/ | 21:24 |
| dolphm | (which is your change's immediate parent) | 21:24 |
| ayoung | henrynash, the one below doesn't set or check CONF.identity.domain_configurations_from_database | 21:24 |
| ayoung | but... | 21:24 |
| henrynash | ayoung: yes it does, line 117 | 21:25 |
| dolphm | bknudson: robert collins just posted a fix for you on -dev | 21:25 |
| ayoung | why so it does...my browser search failed me! | 21:26 |
| henrynash | ayoung: :-) | 21:26 |
| lbragstad | dolphm: looks good | 21:26 |
| lbragstad | 2489970 Refactor: make Fernet token creation/validation API agnostic | 21:26 |
| henrynash | ayoung: and the one in test_backemd_ldap does this with a reload of all the drivers as well | 21:26 |
| ayoung | henrynash, so...looks good, but I would have named the res variable something different | 21:27 |
| ayoung | something like "base" versus "overload" | 21:27 |
| *** stevemar has quit IRC | 21:27 | |
| henrynash | ayoung: fair comment | 21:27 |
| ayoung | or ... something...I see what you are doing, though | 21:27 |
| *** stevemar has joined #openstack-keystone | 21:27 | |
| *** ChanServ sets mode: +v stevemar | 21:27 | |
| lbragstad | dolphm: matches the parent ID as listed here https://review.openstack.org/#/c/161380/ | 21:28 |
| ayoung | henrynash, tests should be written so that it is "actual, expected" do I read these that way? | 21:28 |
| ayoung | I think you have them reversed, is that correct? | 21:28 |
| lbragstad | dolphm: ahhh, nevermind... my patch (https://review.openstack.org/#/c/161380/) points to patch set 5 of https://review.openstack.org/#/c/162338/ | 21:29 |
| dolphm | lbragstad: now just hit the Rebase button on your patch | 21:30 |
| henrynash | Are you sure it;s that way round? I thought it was the otehr way round!!! | 21:30 |
| dolphm | lbragstad: oh upload it first, it's okay if it's outdated | 21:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 21:30 |
| ayoung | henrynash, +2A | 21:30 |
| lbragstad | dolphm: Rebase button won't work because of a conflict | 21:30 |
| henrynash | ayoung: thx | 21:31 |
| dolphm | lbragstad: okay so from where you're at on your machine... | 21:31 |
| dolphm | lbragstad: git log -n 1 | 21:31 |
| dolphm | lbragstad: take note of your *own* commit SHA, assuming you've committed everything as you would have liked to upload it | 21:31 |
| henrynash | ayoung: but is it really meant to be (actual, expected)? | 21:31 |
| ayoung | henrynash, yep | 21:31 |
| dolphm | lbragstad: then git review -d 162338 (you commit's parent) | 21:31 |
| ayoung | henrynash, I know, tripped me up, too | 21:31 |
| dolphm | lbragstad: then cherry pick yourself back on top: git cherry-pick <the commit sha you just noted> | 21:32 |
| dolphm | lbragstad: the cherry pick will fail, you can fix it, then git cherry-pick --continue && git review --no-rebase | 21:32 |
| henrynash | ayoung: i’ll do a follow up patch to clean it up | 21:33 |
| ayoung | henrynash, confirm it first. Remember: I lie. I make things up. | 21:34 |
| ayoung | But I'm pretty sure it is actual expected. Let me see if I can find the code | 21:34 |
| lbragstad | dolphm: cool, that seems to resolve the conflict, just confirming before I push http://cdn.pasteraw.com/4mgm6y2ellir06erwny29xu5bcj1mml | 21:36 |
| *** samueldmq has quit IRC | 21:36 | |
| *** samueldmq_ is now known as samueldmq | 21:37 | |
| lbragstad | dolphm: parent ids match, so that looks good. | 21:38 |
| dolphm | lbragstad: looks good to me! | 21:39 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 21:40 |
| *** mattfarina has quit IRC | 21:40 | |
| *** chlong has joined #openstack-keystone | 21:40 | |
| ayoung | henrynash, I'm wrong | 21:46 |
| ayoung | http://testtools.readthedocs.org/en/latest/api.html | 21:46 |
| ayoung | at least according to the docs I am wrong | 21:47 |
| bknudson | jamielennox: was confused by the test changes in https://review.openstack.org/#/c/161962/ | 21:50 |
| henrynash | ayoung: I did *think* it was the otehr way round…but I often struggle to rememeber! | 21:50 |
| ayoung | henrynash, I've learned never to trust me on what I think code says | 21:51 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove unused threads argument https://review.openstack.org/162475 | 21:51 |
| *** iamjarvo has joined #openstack-keystone | 21:57 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:00 | |
| * morganfainberg is back from lunch | 22:00 | |
| morganfainberg | and phone calls | 22:00 |
| *** bknudson has quit IRC | 22:04 | |
| *** chlong has quit IRC | 22:07 | |
| *** tsufiev_ has quit IRC | 22:14 | |
| *** breton has quit IRC | 22:17 | |
| *** trey has quit IRC | 22:24 | |
| *** trey has joined #openstack-keystone | 22:26 | |
| *** iamjarvo has quit IRC | 22:26 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix time issue in AccessInfo test https://review.openstack.org/163128 | 22:26 |
| *** pnavarro has quit IRC | 22:26 | |
| *** iamjarvo has joined #openstack-keystone | 22:31 | |
| *** henrynash has quit IRC | 22:34 | |
| *** thedodd has quit IRC | 22:34 | |
| *** tsufiev_ has joined #openstack-keystone | 22:36 | |
| *** timcline_ has joined #openstack-keystone | 22:40 | |
| *** timcline_ has quit IRC | 22:41 | |
| *** david8hu has quit IRC | 22:41 | |
| *** timcline has quit IRC | 22:42 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading auth plugins via overrides https://review.openstack.org/161962 | 22:45 |
| *** ayoung has quit IRC | 22:46 | |
| *** david8hu has joined #openstack-keystone | 22:50 | |
| *** _cjones_ has quit IRC | 23:05 | |
| *** _cjones_ has joined #openstack-keystone | 23:15 | |
| *** tsufiev_ has quit IRC | 23:16 | |
| *** tsufiev_ has joined #openstack-keystone | 23:21 | |
| *** iamjarvo has quit IRC | 23:24 | |
| *** iamjarvo has joined #openstack-keystone | 23:27 | |
| *** iamjarvo has quit IRC | 23:27 | |
| *** tsufiev_ has quit IRC | 23:27 | |
| *** iamjarvo has joined #openstack-keystone | 23:27 | |
| *** jorge_munoz has quit IRC | 23:29 | |
| morganfainberg | jamielennox, ping | 23:29 |
| morganfainberg | jamielennox, re https://review.openstack.org/#/c/161962/ | 23:29 |
| morganfainberg | jamielennox, a couple of in-line comments before upgrade to +2. | 23:29 |
| *** jorge_munoz has joined #openstack-keystone | 23:29 | |
| *** breton has joined #openstack-keystone | 23:31 | |
| *** david-lyle is now known as david-lyle_afk | 23:33 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow loading auth plugins via overrides https://review.openstack.org/161962 | 23:37 |
| *** amerine has joined #openstack-keystone | 23:37 | |
| morganfainberg | jamielennox, +2, thanks | 23:39 |
| jamielennox | morganfainberg: np - lets get that merged and released | 23:39 |
| morganfainberg | jamielennox, ++ thats why i pinged ya as soon as i reviewed | 23:40 |
| jamielennox | morganfainberg: brants not here - but he's ok with us passing it in his absense | 23:40 |
| * morganfainberg looks at the list of +v people... | 23:40 | |
| morganfainberg | i pick.... | 23:40 |
| morganfainberg | stevemar! | 23:40 |
| jamielennox | haha - that was my guess too | 23:41 |
| morganfainberg | stevemar, ^ should be an easy review so we can solve a real issue for swift in KSM [and do a release this week] | 23:41 |
| morganfainberg | stevemar, i'd like to get that gating tonight so i can release tomorrow. if it doesn't release tomorrow we're on hold until next week. | 23:41 |
| morganfainberg | jamielennox, if another +2 lands on it, feel free to +A once check passes. | 23:42 |
| morganfainberg | jamielennox, i'll release early [my time] tomorrow if possible. if not possible tomorrow, monday of next week is the next shot | 23:42 |
| lhcheng | stevemar: what should be the value of remote_id when configuring keystone for oidc? | 23:43 |
| jamielennox | marekd: https://review.openstack.org/161962 have a look at this please | 23:44 |
| samueldmq | jamielennox, what would be the override pattern you talk about in the docstring in there ? ^ | 23:45 |
| *** ayoung has joined #openstack-keystone | 23:46 | |
| *** ChanServ sets mode: +v ayoung | 23:46 | |
| *** tsufiev_ has joined #openstack-keystone | 23:46 | |
| *** david8hu has quit IRC | 23:51 | |
| *** gordc has quit IRC | 23:51 | |
| jamielennox | samueldmq: we always allowed people to specify options in the CONF and in a dictionary that is passed to __init__ | 23:53 |
| jamielennox | the dict is generally made up of options that are from the paste pipeline | 23:54 |
| jamielennox | its parameter name is conf though which is really confusing | 23:54 |
| *** chlong has joined #openstack-keystone | 23:54 | |
| jamielennox | so i call it that the passed in conf dict is the overrides of the global CONF object because that's how _conf_get treats them | 23:54 |
| samueldmq | jamielennox, so the past conf overrides the confs from the CONF | 23:55 |
| *** gyee has quit IRC | 23:55 | |
| samueldmq | ah ok | 23:56 |
| jamielennox | samueldmq: even i had to read that sentence a couple of times | 23:56 |
| jamielennox | yes | 23:56 |
| *** david8hu has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
