| dstanek | ah, cool. the map/list things was already fixed | 00:01 |
|---|---|---|
| *** markvoelker has quit IRC | 00:03 | |
| dstanek | morganfainberg: i feel like i'm doing something wrong having so many +2s in a row | 00:03 |
| *** iamjarvo has joined #openstack-keystone | 00:04 | |
| morganfainberg | dstanek, lol it's cause this code has been fairly well reviewed already | 00:04 |
| dstanek | nice! https://review.openstack.org/#/c/163601/9/keystone/auth/plugins/core.py | 00:04 |
| *** ljfisher has quit IRC | 00:04 | |
| dstanek | i'm glad that was moved out of the Fernet package | 00:05 |
| *** iamjarvo has quit IRC | 00:06 | |
| *** markvoelker has joined #openstack-keystone | 00:08 | |
| nkinder | morganfainberg: I can't reproduce https://bugs.launchpad.net/keystone/+bug/1408845 | 00:14 |
| openstack | Launchpad bug 1408845 in Keystone "Disabling user in ldap breaks user-list for project" [Undecided,New] | 00:14 |
| nkinder | morganfainberg: I updated the bug with the test I performed, but it all looks fine | 00:14 |
| nkinder | samueldmq: you were interested in this too ^^^ | 00:14 |
| morganfainberg | nkinder, great, it's probably just "ancient version of keystone" [aka icehouse] and fixed with the combined backend | 00:15 |
| nkinder | morganfainberg: yeah, that's my guess too | 00:16 |
| *** lhcheng has quit IRC | 00:17 | |
| samueldmq | nkinder, nice thanks | 00:19 |
| samueldmq | nkinder, morganfainberg I created an automated test at test_backend_sql to try to expose the potential bug | 00:19 |
| samueldmq | I ran against master, everything works correctly | 00:20 |
| samueldmq | I download the first version I saw ldap in (keystone-2013.2.1), run the test and everything works correctly as well | 00:20 |
| samueldmq | s/download/downloaded s/run/ran | 00:23 |
| samueldmq | so I couldnt reproduce the bug as well | 00:23 |
| dstanek | lbragstad: thanks for moving that methods code around | 00:23 |
| samueldmq | morganfainberg, so should we mark the bug as invalid? since we cant reproduce and the user who reported didnt provide further info (as requested by stevemar) | 00:27 |
| morganfainberg | samueldmq, incomplete, with a request for what information would be needed for duplication | 00:31 |
| morganfainberg | and make sure it is not assigned to anyone | 00:31 |
| morganfainberg | or to a milestone | 00:31 |
| morganfainberg | and in 30 days it'll timeout | 00:32 |
| samueldmq | morganfainberg, ack | 00:32 |
| *** dims has joined #openstack-keystone | 00:32 | |
| morganfainberg | if you aren't allowed to make those changes let me know | 00:32 |
| morganfainberg | and i can do it | 00:32 |
| samueldmq | morganfainberg, done: marked as incomplete and added a comment explaining the reason | 00:36 |
| morganfainberg | thanks | 00:36 |
| samueldmq | np | 00:36 |
| dstanek | jorge_munoz: are you still working on https://review.openstack.org/#/c/159229/ ? | 00:45 |
| morganfainberg | dstanek, i assume so, it is marked WIP in the commit msg | 00:45 |
| morganfainberg | dstanek, but it's the last outstanding patch [provided nothing goes sideways] | 00:46 |
| dstanek | morganfainberg: yeah, and there is a todo list in there | 00:46 |
| dstanek | morganfainberg: i'll probably just go ahead and fix my nits then | 00:46 |
| morganfainberg | dstanek, besure you -R review it though | 00:47 |
| * morganfainberg didn't rebase when fixing nits. | 00:47 | |
| dstanek | morganfainberg: yep. | 00:47 |
| morganfainberg | as soon as we have that v2 one in, i'll work on converting a devstack run over to fernet | 00:48 |
| *** radez is now known as radez_g0n3 | 00:51 | |
| morganfainberg | dstanek, this should be an easy review: https://review.openstack.org/#/c/162170/ | 00:52 |
| morganfainberg | dstanek, if you're done with the other stuff. | 00:52 |
| dstanek | morganfainberg: what's the rename about in there? | 00:54 |
| morganfainberg | dstanek, gerrit being silly | 00:54 |
| morganfainberg | it thinks we renamed a file, it's because that file contains most of the same content | 00:54 |
| dstanek | haha, git's funny sometimes | 00:57 |
| morganfainberg | yeah | 00:57 |
| stevemar | o/ | 00:59 |
| morganfainberg | stevemar, oh hai | 01:01 |
| stevemar | morganfainberg, oh hai to you too | 01:01 |
| morganfainberg | stevemar see what you miss. fernet tokens almost all approved. | 01:01 |
| stevemar | i am seeing that | 01:01 |
| stevemar | almost everything is all approved | 01:02 |
| morganfainberg | also: https://review.openstack.org/#/c/164042/ if you want clear metrics on how long any keystone query takes ;) | 01:02 |
| stevemar | i need to look at idp registration again https://review.openstack.org/#/c/152156/ | 01:02 |
| morganfainberg | i think henry's domain_SQL thing is going to hit a roadblock... | 01:02 |
| morganfainberg | and i don't know how to fix it | 01:03 |
| morganfainberg | the "we changed the config - now reload it" | 01:03 |
| stevemar | let me try it out (the timing one) | 01:04 |
| morganfainberg | stevemar, it's neat | 01:04 |
| morganfainberg | stevemar remember the timeing is in microseconds | 01:05 |
| morganfainberg | not ms | 01:05 |
| stevemar | oh wow | 01:06 |
| stevemar | thats super accurate | 01:06 |
| morganfainberg | well we had the options of seconds | 01:06 |
| morganfainberg | or microseconds | 01:06 |
| morganfainberg | seconds is pretty useless | 01:06 |
| *** ayoung has joined #openstack-keystone | 01:06 | |
| *** ChanServ sets mode: +v ayoung | 01:06 | |
| *** _cjones_ has quit IRC | 01:07 | |
| *** _cjones_ has joined #openstack-keystone | 01:09 | |
| *** ncoghlan has joined #openstack-keystone | 01:09 | |
| dstanek | morganfainberg: lgtm; the DB_INIT_VERSION is set to 1 lower than the first migration because to the code that performs the migration? | 01:09 |
| dstanek | morganfainberg: where does that happen? | 01:10 |
| morganfainberg | that is what is called when we do the initialize db [put it under control] | 01:10 |
| morganfainberg | this would mirror [for example] a db that was updated to icehouse | 01:10 |
| morganfainberg | so since 044 would be icehouse, if we want to run 044, we need to be 043 | 01:11 |
| morganfainberg | so our base init is 043 | 01:11 |
| morganfainberg | dstanek. https://github.com/openstack/keystone/blob/master/keystone/common/sql/migration_helpers.py#L161 | 01:11 |
| morganfainberg | which on line 164 will init the db if it's not already init. | 01:12 |
| dstanek | morganfainberg: that's what i figured, but wasn't sure where the code was that did that | 01:12 |
| morganfainberg | :) | 01:13 |
| *** rwsu is now known as rwsu-afk | 01:13 | |
| dstanek | forgot to +A | 01:15 |
| morganfainberg | dstanek, hehe no worries | 01:17 |
| *** _cjones_ has quit IRC | 01:18 | |
| *** gokrokve has joined #openstack-keystone | 01:45 | |
| ayoung | morganfainberg, looks like Ioram has been busy: https://wiki.openstack.org/wiki/PolicyDatabase . We're going to massage it into Spec form, but I suspect he needed something alittle more visual for presentation sake | 01:45 |
| morganfainberg | ayoung, yeah saw that today | 01:46 |
| ayoung | DNF? I always thought that meant Did Not Finish. That is what my professors told me. | 01:47 |
| *** gokrokve_ has quit IRC | 01:49 | |
| ayoung | morganfainberg, I like that document. Even if there are errors, I like that is lays it out to the degree that it is both implementable and testable | 01:49 |
| *** gokrokve has quit IRC | 01:50 | |
| openstackgerrit | Merged openstack/keystone: Add JSON schema validation for service providers https://review.openstack.org/163903 | 01:54 |
| *** tqtran has quit IRC | 01:54 | |
| *** harlowja is now known as harlowja_away | 02:07 | |
| *** leonchio_ has quit IRC | 02:09 | |
| *** david8hu has quit IRC | 02:10 | |
| *** david8hu has joined #openstack-keystone | 02:10 | |
| openstackgerrit | Merged openstack/keystone: Migrations squash https://review.openstack.org/162170 | 02:11 |
| morganfainberg | dolphm, lbragstad, i can almost taste the fernet tokens... sadly fernet liquor is disgusting in my view. | 02:13 |
| *** leonchio_ has joined #openstack-keystone | 02:14 | |
| *** leonchio_ has joined #openstack-keystone | 02:14 | |
| *** dims has quit IRC | 02:14 | |
| *** erkules_ has joined #openstack-keystone | 02:26 | |
| ayoung | morganfainberg, I think I want to globally replace the rule "a group must be in the Keystone Identity store or we throw an exception" with "If a group is not in the Keystone Identity backend, drop it " | 02:27 |
| *** erkules has quit IRC | 02:29 | |
| *** dims has joined #openstack-keystone | 02:34 | |
| *** chrisshattuck has joined #openstack-keystone | 02:37 | |
| *** dims has quit IRC | 02:39 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:42 | |
| *** devlaps has quit IRC | 02:43 | |
| samueldmq | morganfainberg, I think bug #1431015 relies on the consistency of v3/users and v3/groups API calls when domain specific backends are enabled or not | 02:53 |
| openstack | bug 1431015 in Keystone "v3/users or groups calls not working without domain_id" [Undecided,New] https://launchpad.net/bugs/1431015 | 02:53 |
| samueldmq | morganfainberg, please add it to your todo list :) and then you'll be able to confirm it or not (agreeing or disagreeing with me) | 02:53 |
| samueldmq | morganfainberg, I added a comment there | 02:54 |
| morganfainberg | samueldmq, thanks | 02:54 |
| samueldmq | explaining what I think | 02:54 |
| samueldmq | np | 02:54 |
| morganfainberg | sooooooo | 02:55 |
| openstackgerrit | Merged openstack/keystone: Drop Fernet token prefixes & add domain-scoped Fernet tokens https://review.openstack.org/162031 | 02:55 |
| morganfainberg | INCOMING! /me ducks | 02:55 |
| dolphm | \o/ | 02:55 |
| openstackgerrit | Merged openstack/keystone: Convert audit_ids to bytes https://review.openstack.org/160993 | 02:55 |
| dolphm | morganfainberg: thank you sir =) | 02:55 |
| openstackgerrit | Merged openstack/keystone: Refactor: make Fernet token creation/validation API agnostic https://review.openstack.org/162338 | 02:55 |
| openstackgerrit | Merged openstack/keystone: Federated token formatter https://review.openstack.org/161380 | 02:56 |
| openstackgerrit | Merged openstack/keystone: Allow methods to be carried in Fernet tokens. https://review.openstack.org/163601 | 02:56 |
| morganfainberg | dolphm, boom. | 02:56 |
| stevemar | \o/ | 02:56 |
| stevemar | the peasants rejoice | 02:56 |
| morganfainberg | dolphm, v2.0 is all that is left, and https://review.openstack.org/#/c/164026/ | 02:56 |
| morganfainberg | that one i linked can happen whenever. | 02:57 |
| dolphm | ooh | 02:57 |
| dolphm | ah, cool that's my validate thing | 02:57 |
| samueldmq | there are only 7 patches left on the priority list for keystone | 02:58 |
| samueldmq | o/ | 02:58 |
| dolphm | just need to setUp a new, non-admin user to act as the subject of those tests | 02:58 |
| morganfainberg | dolphm, yeah | 02:58 |
| morganfainberg | dolphm, was easier to just yank those out of the code. | 02:59 |
| dolphm | morganfainberg: good idea | 02:59 |
| morganfainberg | dolphm, i think we're stupidly close to having a workable non-persistent token | 03:03 |
| morganfainberg | dolphm, and by workable i mean "no gaps in coverage" | 03:03 |
| morganfainberg | dolphm, lbragstad, jorge_munoz, AWESOME WORK! | 03:03 |
| * morganfainberg is really happy about this. | 03:03 | |
| dolphm | morganfainberg: did you follow ayoung's thought experiment which lead towards not bothering with revocation events? | 03:03 |
| morganfainberg | dolphm, i did. i think we can't be there today. | 03:04 |
| *** richm has quit IRC | 03:04 | |
| ayoung | dolphm, I was just talking about for groups. Was that how you understood it? | 03:04 |
| morganfainberg | dolphm, i also found something very icky happening in keystonemiddleware by default. | 03:04 |
| morganfainberg | dolphm, as in default behavior could net extremely poor performance. | 03:04 |
| morganfainberg | and inconsistent responses. | 03:05 |
| dolphm | ayoung: that sounded like the direction you were headed | 03:05 |
| dolphm | morganfainberg: ? | 03:05 |
| morganfainberg | dolphm, default configuration: dict-in-memory cache (~300s) for token validates. | 03:05 |
| ayoung | dolphm, so, yeah, we can't do group revocation for Federated tokens today. For Fernet we are OK. Either we leave the existing behavior or turn off revoke for all members of group | 03:05 |
| morganfainberg | and a purge anything that is cache timed out on every get | 03:05 |
| ayoung | I say leave it as is for now, no more broken than it was in the past | 03:06 |
| morganfainberg | so every request to an endpoint *is* caching, in thread.local and with high throughput memorycache has been shown to be just bad | 03:06 |
| *** ptoohill has quit IRC | 03:06 | |
| * morganfainberg is leaning towards dropping dogpile in and making devstack actually use memcache for these things. | 03:07 | |
| morganfainberg | for gate that is. | 03:07 |
| morganfainberg | dolphm, so some folks i know were doing couch.db as a memcache backend, solves the replication of memcache issue | 03:08 |
| morganfainberg | across servers | 03:08 |
| morganfainberg | erm couchbase sorry | 03:09 |
| morganfainberg | not couch.db | 03:09 |
| morganfainberg | bah | 03:09 |
| dolphm | morganfainberg: that works wherever you're willing to share security-sensitive cache | 03:09 |
| morganfainberg | dolphm, between keystone servers, it is good | 03:09 |
| morganfainberg | between non-keystone servers = eh no thanks | 03:09 |
| morganfainberg | ayoung, i have some working code for dogpile that would at least [hopefully] limit the ick on cleanup for in-memory. it doesn't solve thread.local but it prevents for i in key, if key[expired] < now, del key | 03:11 |
| *** ptoohill has joined #openstack-keystone | 03:11 | |
| dolphm | morganfainberg: how? random sampling? | 03:13 |
| morganfainberg | dolphm, bucketing and cleanups of the bucket with weakrefs to the values | 03:13 |
| morganfainberg | internally it still does an iter, but in the c not in pure python | 03:13 |
| dolphm | morganfainberg: if that's a conventional technique, i'm not familiar with it at all? | 03:13 |
| morganfainberg | dolphm, i'm still poking at the code to prove out it doesn't suck more for performance at high volumes of keys | 03:14 |
| morganfainberg | dolphm, but in either case dogpile would be a better tool than oslo-incubator memorycache | 03:14 |
| morganfainberg | it also would remove the last oslo incubator item from ksm | 03:15 |
| dolphm | morganfainberg: the "on insert, choose 5 or 10 random keys and delete the oldest before inserting new cached value" approach would certainly scale | 03:15 |
| morganfainberg | dolphm, that is also possible, but how do you pick a random sampling of keys? | 03:15 |
| dolphm | morganfainberg: isn't there a random.choose() | 03:16 |
| dolphm | morganfainberg: https://docs.python.org/2/library/random.html#random.choice | 03:16 |
| morganfainberg | dolphm, maybe. | 03:17 |
| dolphm | morganfainberg: or random.sample(cache.keys(), 10) | 03:17 |
| *** lhcheng has joined #openstack-keystone | 03:17 | |
| morganfainberg | dolphm, here is the basic idea i had: https://bitbucket.org/morgan_fainberg/dogpile.cache/commits/166f1773b1dd6ba64b3c2730f1d71d7083a3a9ad | 03:18 |
| morganfainberg | dolphm, but i haven't spent much time on it. | 03:18 |
| *** lhcheng_ has joined #openstack-keystone | 03:19 | |
| *** ptoohill has quit IRC | 03:20 | |
| dolphm | morganfainberg: have you benchmarked it? | 03:21 |
| morganfainberg | dolphm, haven't even tested that it's going to work | 03:21 |
| *** samueldmq has quit IRC | 03:21 | |
| morganfainberg | dolphm, this was a hack out code in a few minutes and stash it somewhere so i can get back to it | 03:21 |
| morganfainberg | dolphm, you know "i don't want to lose this thought train" commit ;) | 03:22 |
| lbragstad | dstanek: no problem, thanks for pointing it out and reviewing it | 03:22 |
| dolphm | lbragstad: \o/ | 03:22 |
| * lbragstad cheers! | 03:22 | |
| * lbragstad is ready to be in bug-only mode! | 03:23 | |
| *** lhcheng has quit IRC | 03:23 | |
| *** gyee has quit IRC | 03:23 | |
| dolphm | lbragstad: it's time for v2-also mode! | 03:23 |
| lbragstad | dolphm: ++ | 03:23 |
| lbragstad | dolphm: my priority tomorrow | 03:23 |
| dolphm | morganfainberg: i'm just thinking it's imperfect cache invalidation, right? so i'd lean towards a simpler, also-imperfect, technique first if possible | 03:23 |
| *** ptoohill has joined #openstack-keystone | 03:23 | |
| morganfainberg | dolphm, talked to jamielennox, he thinks we are very close to being able to force everything to use v3 (even if service accounts have to be in the default domain) | 03:23 |
| morganfainberg | dolphm, which means... v2 deprecation is back [if that is true] | 03:24 |
| jamielennox | morganfainberg: that's not really what's been tested - i think we can have everything user facing being v3, because so many service->service users are still v2 only | 03:24 |
| dolphm | morganfainberg: i'm less concerned about a formal deprecation and more concerned about making sure everything can go without v2 | 03:25 |
| morganfainberg | jamielennox, as long as we can force the issue we're good. | 03:25 |
| morganfainberg | jamielennox, having some expiermental gate check that can run w/o v2 and show us explosions should hopefully be not that bad/far off. | 03:26 |
| dolphm | aside- how long would ya'll consider to be "fast" from "nova boot" to an ssh session? | 03:26 |
| morganfainberg | dolphm, uhhhh | 03:26 |
| morganfainberg | dolphm, "fast"? 10 seconds. reasonable? 30 | 03:26 |
| jamielennox | you would think - but as mentioned i've recently tried to fix ironic auth ... ughh | 03:26 |
| morganfainberg | slooooow 2+min | 03:26 |
| *** ptoohill has quit IRC | 03:26 | |
| morganfainberg | dolphm, assuming there is no crazy apt-magic needed and not stupid volumes of memory | 03:27 |
| morganfainberg | just a base VM on with minimal services and ssh | 03:27 |
| dolphm | digital ocean's "Deploy an SSD cloud server in 55 seconds!" made me wonder how quickly openstack could do it | 03:27 |
| morganfainberg | i think we're in the above 30s and below 2min range | 03:27 |
| morganfainberg | typically | 03:28 |
| morganfainberg | but last i played with that stuff is a few releases ago | 03:28 |
| morganfainberg | jamielennox, anyway lets make it so devstack can disable v2 keystone :) | 03:29 |
| dolphm | i timed a 2gb server at 40s on rackspace public cloud without doing anything to minimize overhead | 03:29 |
| dolphm | just wondering how much room for improvement there could be in OS | 03:29 |
| morganfainberg | jamielennox, then get an expirimental gate job that runs devstack-gate-full in that mode. | 03:29 |
| jamielennox | morganfainberg: yea, i've got fixes for tempest to work that way too | 03:29 |
| morganfainberg | jamielennox, see what all explodes. | 03:29 |
| morganfainberg | ofc w/ tempest not checking v2 :P | 03:29 |
| haneef | jamielennox: what happened to nova to neutron auth patch? Is that approved. In HP alteast we are still stuck with v2 for that | 03:34 |
| jamielennox | haneef: i've been pushing that and i went to the meeting today to get it looked at | 03:34 |
| jamielennox | it seems to work just fine | 03:34 |
| jamielennox | i just need to get someone on nova to push the button | 03:34 |
| jamielennox | yep, still only one +2 https://review.openstack.org/#/c/136931/ | 03:35 |
| jamielennox | if that misses k-3 i'll be pissed | 03:35 |
| *** samueldmq has joined #openstack-keystone | 03:35 | |
| *** ptoohill has joined #openstack-keystone | 03:35 | |
| haneef | I'm too waiting for that patch | 03:35 |
| jamielennox | i had that as a WIP waiting for kilo to open rather than submit close to the deadline of Juno | 03:37 |
| *** diegows has quit IRC | 03:38 | |
| stevemar | jamielennox, lemme bug mriedeman about it | 03:38 |
| haneef | stevemar: assertions doesn't work with fernet tokens | 03:39 |
| stevemar | haneef, noooo | 03:39 |
| stevemar | haneef, whats up with them? | 03:39 |
| haneef | https://bugs.launchpad.net/keystone/+bug/1431669 | 03:39 |
| openstack | Launchpad bug 1431669 in Keystone "Create saml assertion doesn't work with fernet token" [Undecided,New] | 03:40 |
| *** zzzeek has quit IRC | 03:40 | |
| stevemar | haneef, can you print out what the token_id is? | 03:40 |
| *** samueldmq has quit IRC | 03:40 | |
| stevemar | i don't think dolphm or lbragstad have a federated environment handy | 03:40 |
| stevemar | any info at all would be super helpful | 03:41 |
| dstanek | haneef, stevemar: that may be related to https://review.openstack.org/#/c/159229/ where we were discussing the oddity of v2 tokens being unicode instead of bytes | 03:41 |
| haneef | added in the comment | 03:42 |
| lbragstad | dstanek: yes, that looks similar | 03:42 |
| *** gokrokve has joined #openstack-keystone | 03:53 | |
| openstackgerrit | Joe Gordon proposed openstack/python-keystoneclient: Revert "Imports to fix build warnings" https://review.openstack.org/164066 | 03:55 |
| *** rushiagr_away is now known as rushiagr | 03:59 | |
| haneef | lbragstad: Does fernet try decryption with each key in case of key rotation? How does it know which key was used to encrypt the original token? | 04:06 |
| lbragstad | haneef: http://lbragstad.com/?p=133 | 04:06 |
| dolphm | haneef: fernet keys contain both a signing key and an encryption key - it brute forces the available signing keys until it finds a match, then uses the corresponding encryption key to decrypt | 04:07 |
| lbragstad | haneef: yep, nm ignore that link, I misread your questio | 04:07 |
| lbragstad | question* | 04:07 |
| *** gokrokve has quit IRC | 04:09 | |
| haneef | doplh: couple more questions on fernet. Is the key generated 256 bit key? How can I know which is signign key and which is encryption key from the keys generated by fernet_setup | 04:09 |
| dolphm | haneef: the first half is one 128-bit key, and the second half is another 128-bit key. one is for AES, one is for SHA256 HMAC. i forget the order, check the spec | 04:10 |
| haneef | So the key generated by fernet_setup which is filesystem is concatenation of 2 keys. Is that correct? | 04:11 |
| dolphm | haneef: yes | 04:11 |
| dolphm | haneef: one encryption key + one HMAC key == one "fernet" key | 04:12 |
| haneef | Thanks. that helps | 04:12 |
| dolphm | lbragstad: just benchmarked SHA256 HMACs on my laptop to see how many keys you could feasibly keep in rotation before you see appreciable performance degredation.... | 04:17 |
| lbragstad | ... | 04:17 |
| dolphm | lbragstad: average out to be 0.00001203745 seconds per SHA256 HMAC. | 04:17 |
| lbragstad | and that is per key tried? | 04:18 |
| dolphm | (of a 128 byte message with a 32 byte key) | 04:18 |
| lbragstad | dolphm: so this is with the brute force method? | 04:20 |
| dolphm | sorry, not a 32 byte key, a 128 bit key** | 04:20 |
| dolphm | lbragstad: one message, one key, a million iterations | 04:21 |
| lbragstad | dolphm: gotcha | 04:21 |
| dolphm | lbragstad: http://cdn.pasteraw.com/2uyoj4j6xhj1pa09dc1l1tgog3wylt8 | 04:22 |
| jamielennox | stevemar: https://review.openstack.org/164071 is an alternative to DOA plugins | 04:23 |
| jamielennox | stevemar: with it i could write https://github.com/jamielennox/django-openstack-auth-kerberos and maintain it completely seperate to DOA | 04:24 |
| jamielennox | stevemar: i think this is a better idea than plugins | 04:24 |
| lbragstad | dolphm: interesting | 04:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Instructions to install IETF ABFAB federation protocol on Keystone https://review.openstack.org/163878 | 04:44 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Instructions to install IETF ABFAB federation protocol on Keystone https://review.openstack.org/163878 | 04:47 |
| *** ayoung has quit IRC | 04:47 | |
| *** mhu has quit IRC | 04:57 | |
| *** mhu has joined #openstack-keystone | 04:59 | |
| *** chrisshattuck has quit IRC | 05:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Document websso setup https://review.openstack.org/164012 | 05:43 |
| stevemar | lhcheng_, ^ | 05:43 |
| morganfainberg | haneef: thanks for the bug on saml + fernet tokens. | 06:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/163705 | 06:09 |
| *** markvoelker has quit IRC | 06:11 | |
| *** markvoelker has joined #openstack-keystone | 06:12 | |
| *** markvoelker has quit IRC | 06:16 | |
| haneef | morganfainberg: Without this domain scope token won't work. https://bugs.launchpad.net/keystone/+bug/1430433 | 06:17 |
| openstack | Launchpad bug 1430433 in Keystone "Fernet token validation doesn't return catalog and role information for domain scoped tokens" [Undecided,New] - Assigned to Boris Bobrov (bbobrov) | 06:18 |
| morganfainberg | haneef: yep. | 06:18 |
| morganfainberg | haneef: I'm glad people are excited about the fernet tokens and helping to knock them into shape. | 06:19 |
| morganfainberg | More work to do on them tomorrow. | 06:21 |
| haneef | Yes. We are | 06:21 |
| *** stevemar has quit IRC | 06:22 | |
| *** stevemar has joined #openstack-keystone | 06:35 | |
| *** ChanServ sets mode: +v stevemar | 06:35 | |
| *** markvoelker has joined #openstack-keystone | 06:42 | |
| *** stevemar has quit IRC | 06:44 | |
| *** rushiagr is now known as rushiagr_away | 06:45 | |
| marekd|away | Morning | 06:46 |
| *** marekd|away is now known as marekd | 06:46 | |
| *** markvoelker has quit IRC | 06:47 | |
| *** ncoghlan has quit IRC | 06:53 | |
| *** browne has quit IRC | 06:57 | |
| *** afazekas has joined #openstack-keystone | 07:04 | |
| *** dims has joined #openstack-keystone | 07:23 | |
| *** dims has quit IRC | 07:27 | |
| *** jamielennox has quit IRC | 07:31 | |
| *** jamielennox has joined #openstack-keystone | 07:34 | |
| *** ChanServ sets mode: +v jamielennox | 07:34 | |
| *** jamielennox has quit IRC | 07:39 | |
| *** markvoelker has joined #openstack-keystone | 07:43 | |
| *** markvoelker has quit IRC | 07:48 | |
| *** jamielennox|away has joined #openstack-keystone | 07:55 | |
| *** jamielennox|away is now known as jamielennox | 07:55 | |
| *** ChanServ sets mode: +v jamielennox | 07:55 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Add a FederatedBase v3 plugin https://review.openstack.org/163271 | 08:08 |
| *** chlong has quit IRC | 08:09 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/163705 | 08:11 |
| *** jistr has joined #openstack-keystone | 08:12 | |
| davechen | marek, ping? | 08:13 |
| *** pnavarro|off has joined #openstack-keystone | 08:17 | |
| *** openstackgerrit has quit IRC | 08:21 | |
| *** openstackgerrit has joined #openstack-keystone | 08:21 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Move unit tests into tests.unit https://review.openstack.org/162482 | 08:29 |
| openstackgerrit | Merged openstack/keystone: Remove unnecessary import https://review.openstack.org/161541 | 08:34 |
| *** markvoelker has joined #openstack-keystone | 08:44 | |
| *** jistr has quit IRC | 08:46 | |
| *** markvoelker has quit IRC | 08:48 | |
| *** henrynash has joined #openstack-keystone | 08:54 | |
| *** ChanServ sets mode: +v henrynash | 08:54 | |
| *** erkules_ is now known as erkules | 08:57 | |
| *** erkules has quit IRC | 08:57 | |
| *** erkules has joined #openstack-keystone | 08:57 | |
| *** trey has quit IRC | 09:00 | |
| *** trey has joined #openstack-keystone | 09:01 | |
| *** henrynash has quit IRC | 09:04 | |
| *** jistr has joined #openstack-keystone | 09:04 | |
| marekd | davechen: hi | 09:11 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 09:24 | |
| *** dims has joined #openstack-keystone | 09:42 | |
| *** markvoelker has joined #openstack-keystone | 09:45 | |
| *** dims has quit IRC | 09:47 | |
| *** markvoelker has quit IRC | 09:49 | |
| *** dims has joined #openstack-keystone | 09:54 | |
| davechen | marekd: sorry, I must leave, ping you later. | 09:56 |
| davechen | marekd: have a good weekend | 09:56 |
| *** lhcheng_ has quit IRC | 10:01 | |
| *** sluo_wfh has quit IRC | 10:08 | |
| *** henrynash has joined #openstack-keystone | 10:09 | |
| *** ChanServ sets mode: +v henrynash | 10:09 | |
| marekd | davechen: ok | 10:16 |
| *** nellysmitt has joined #openstack-keystone | 10:17 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 10:35 |
| *** henrynash has quit IRC | 10:38 | |
| *** Ephur_ has quit IRC | 10:39 | |
| *** aix has joined #openstack-keystone | 10:44 | |
| *** henrynash has joined #openstack-keystone | 10:44 | |
| *** ChanServ sets mode: +v henrynash | 10:44 | |
| *** markvoelker has joined #openstack-keystone | 10:46 | |
| *** henrynash has quit IRC | 10:47 | |
| *** amakarov_away is now known as amakarov | 10:47 | |
| *** markvoelker has quit IRC | 10:50 | |
| *** samueldmq has joined #openstack-keystone | 10:55 | |
| *** jamielennox has quit IRC | 10:55 | |
| *** harlowja_away has quit IRC | 10:59 | |
| *** jamielennox|away has joined #openstack-keystone | 11:02 | |
| *** jamielennox|away is now known as jamielennox | 11:02 | |
| *** ChanServ sets mode: +v jamielennox | 11:02 | |
| *** jamielennox has quit IRC | 11:14 | |
| *** davechen_ has joined #openstack-keystone | 11:23 | |
| *** jamielennox|away has joined #openstack-keystone | 11:24 | |
| *** jamielennox|away is now known as jamielennox | 11:24 | |
| *** ChanServ sets mode: +v jamielennox | 11:24 | |
| *** krykowski has joined #openstack-keystone | 11:26 | |
| *** markvoelker has joined #openstack-keystone | 11:46 | |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 11:50 |
| openstackgerrit | Telles Mota Vidal Nóbrega proposed openstack/keystone: Creating domain and filtering by parent_id https://review.openstack.org/161378 | 11:51 |
| *** markvoelker has quit IRC | 11:51 | |
| *** diegows has joined #openstack-keystone | 11:57 | |
| *** ljfisher has joined #openstack-keystone | 11:58 | |
| *** nicodemos has quit IRC | 12:01 | |
| *** markvoelker has joined #openstack-keystone | 12:07 | |
| *** bknudson has joined #openstack-keystone | 12:21 | |
| *** ChanServ sets mode: +v bknudson | 12:21 | |
| *** radez_g0n3 is now known as radez | 12:22 | |
| *** chlong has joined #openstack-keystone | 12:24 | |
| *** raildo has joined #openstack-keystone | 12:28 | |
| *** openstackgerrit_ has joined #openstack-keystone | 13:01 | |
| *** openstackgerrit_ has quit IRC | 13:01 | |
| *** mattfarina has joined #openstack-keystone | 13:02 | |
| *** gordc has joined #openstack-keystone | 13:09 | |
| *** radez is now known as radez_g0n3 | 13:10 | |
| *** markvoelker has quit IRC | 13:16 | |
| *** markvoelker has joined #openstack-keystone | 13:17 | |
| *** jdennis has quit IRC | 13:25 | |
| *** jdennis has joined #openstack-keystone | 13:32 | |
| *** ljfisher has quit IRC | 13:39 | |
| *** richm has joined #openstack-keystone | 13:41 | |
| *** richm1 has joined #openstack-keystone | 13:49 | |
| *** richm has quit IRC | 13:49 | |
| *** richm1 is now known as richm | 13:49 | |
| *** ljfisher has joined #openstack-keystone | 13:51 | |
| *** obutenko_ has joined #openstack-keystone | 13:54 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: [WIP]Update inherited role assignments behavior https://review.openstack.org/164180 | 13:56 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: [WIP]Update inherited role assignments behavior https://review.openstack.org/164180 | 13:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Move _memcache_pool into auth_token https://review.openstack.org/162480 | 14:00 |
| *** gordc has quit IRC | 14:00 | |
| *** gordc has joined #openstack-keystone | 14:01 | |
| *** radez_g0n3 is now known as radez | 14:02 | |
| *** elowing has joined #openstack-keystone | 14:03 | |
| *** r-daneel has joined #openstack-keystone | 14:06 | |
| *** dims has quit IRC | 14:06 | |
| *** mattamizer has joined #openstack-keystone | 14:07 | |
| *** dims has joined #openstack-keystone | 14:07 | |
| *** mattamizer has quit IRC | 14:08 | |
| *** elowing has quit IRC | 14:08 | |
| *** elowing has joined #openstack-keystone | 14:09 | |
| *** carlosmarin has joined #openstack-keystone | 14:12 | |
| *** csoukup has joined #openstack-keystone | 14:16 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: More content for core components of DB migration https://review.openstack.org/164188 | 14:16 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix service provider table nullable constraints https://review.openstack.org/164189 | 14:18 |
| *** afazekas has quit IRC | 14:18 | |
| rodrigods | marekd, ^ | 14:18 |
| rodrigods | :) | 14:18 |
| *** dims is now known as dimsum__ | 14:21 | |
| elowing | morning y'all. trying to hide the admin dashboard for domain admins upon login. this should be configured through dashboard permissions in my overrides, no? | 14:23 |
| elowing | ex. admin_dashboard.permissions = tuple('openstack.roles.my_role') | 14:24 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix nullable constraints in service provider table https://review.openstack.org/164189 | 14:25 |
| *** davechen_ has quit IRC | 14:28 | |
| *** Nakato has quit IRC | 14:33 | |
| *** Nakato has joined #openstack-keystone | 14:34 | |
| *** thedodd has joined #openstack-keystone | 14:36 | |
| *** thedodd has quit IRC | 14:48 | |
| *** samueldmq_ has joined #openstack-keystone | 14:52 | |
| *** thedodd has joined #openstack-keystone | 14:53 | |
| lbragstad | breton: around? | 14:55 |
| lbragstad | I had a quick question on https://bugs.launchpad.net/keystone/+bug/1431434 | 14:55 |
| openstack | Launchpad bug 1431434 in Keystone "user creation with fernet tokens results in 401" [High,New] | 14:55 |
| lbragstad | breton: were you able to recreate that with an "admin-scoped" fernet token, instead of using the ADMIN_TOKEN? | 14:56 |
| *** samueldmq_ has quit IRC | 14:57 | |
| *** elowing has quit IRC | 14:58 | |
| *** elowing has joined #openstack-keystone | 15:00 | |
| *** radez is now known as radez_g0n3 | 15:02 | |
| *** gokrokve has joined #openstack-keystone | 15:04 | |
| *** radez_g0n3 is now known as radez | 15:05 | |
| *** chrisshattuck has joined #openstack-keystone | 15:06 | |
| *** thedodd has quit IRC | 15:06 | |
| *** elowing has quit IRC | 15:09 | |
| *** _cjones_ has joined #openstack-keystone | 15:10 | |
| *** elowing has joined #openstack-keystone | 15:10 | |
| *** nellysmitt has quit IRC | 15:12 | |
| *** bknudson has quit IRC | 15:13 | |
| haneef | lbragstad: I can create user with fernet token , token is project scoped token | 15:15 |
| lbragstad | haneef: so, everything is working properly for you/ | 15:16 |
| lbragstad | ? | 15:16 |
| haneef | Let me check with ADMIN_TOKEN and get back to you | 15:16 |
| lbragstad | haneef: ok, I'm firing up an env to see if I can recreate breton's issue | 15:17 |
| *** browne has joined #openstack-keystone | 15:18 | |
| openstackgerrit | Yuki Nishiwaki proposed openstack/python-keystoneclient: Enable to specify auth plugin as full class name https://review.openstack.org/161164 | 15:19 |
| *** stevemar has joined #openstack-keystone | 15:19 | |
| *** ChanServ sets mode: +v stevemar | 15:19 | |
| haneef | I can do with both ADMIN token (hardcoded one), and normal project scoped token. domain scoped token has problem, which I think is due to the other bug taht I raised, where domain scoped tokens doesn't have any roles | 15:19 |
| dolphm | haneef: that might be resolved in the latest master | 15:21 |
| dolphm | haneef: as of 12 hours ago, or so | 15:22 |
| haneef | My code base is is 8:00 PM PST yesterday. I will try today's version | 15:25 |
| *** david-lyle_afk is now known as david-lyle | 15:33 | |
| *** fmarco76 has joined #openstack-keystone | 15:33 | |
| *** zzzeek has joined #openstack-keystone | 15:35 | |
| *** thedodd has joined #openstack-keystone | 15:39 | |
| haneef | dolph: I just checked current version, and we still don't get roles for domain scoped token. I have your last night merges | 15:42 |
| dolphm | haneef: for a newly created domain scoped token, correct? | 15:42 |
| haneef | yes | 15:42 |
| *** arunkant has joined #openstack-keystone | 15:43 | |
| *** ayoung has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +v ayoung | 15:44 | |
| *** bknudson has joined #openstack-keystone | 15:45 | |
| *** ChanServ sets mode: +v bknudson | 15:45 | |
| *** thedodd has quit IRC | 15:49 | |
| *** chrisshattuck has quit IRC | 15:50 | |
| *** chrisshattuck has joined #openstack-keystone | 15:51 | |
| *** thedodd has joined #openstack-keystone | 15:57 | |
| openstackgerrit | Kamil Rykowski proposed openstack/python-keystoneclient: tenant-list updated to output Tenant Description https://review.openstack.org/140962 | 16:00 |
| openstackgerrit | Kamil Rykowski proposed openstack/python-keystoneclient: tenant-list updated to output Tenant Description https://review.openstack.org/140962 | 16:01 |
| *** krykowski has quit IRC | 16:05 | |
| *** samueldmq_ has joined #openstack-keystone | 16:09 | |
| *** browne has quit IRC | 16:11 | |
| *** rwsu-afk is now known as rwsu | 16:15 | |
| *** samueldmq_ has quit IRC | 16:17 | |
| *** fmarco76 has quit IRC | 16:20 | |
| *** elowing has quit IRC | 16:22 | |
| *** tqtran has joined #openstack-keystone | 16:33 | |
| lbragstad | haneef: dolphm this is what I get with a domain scoped curl request http://cdn.pasteraw.com/le33atp4dptqzk9jlyevi4olpjlw6q2 | 16:34 |
| breton | lbragstad: I will try now | 16:34 |
| lbragstad | haneef: dolphm I'm on master 55d940c70be405e6dcf48eaa4aed0c2d766aadeb | 16:35 |
| *** chrisshattuck has quit IRC | 16:35 | |
| lbragstad | haneef: this is what my auth request looks like http://cdn.pasteraw.com/f6y2zbkko7fxevpyo78p5tot0z7k5tb | 16:38 |
| lbragstad | haneef: the data was populated in keystone using https://gist.github.com/dolph/02c6d37f49596b3f4298#file-bootstrap-py | 16:39 |
| *** chrisshattuck has joined #openstack-keystone | 16:43 | |
| breton | lbragstad: is domain a required field? | 16:48 |
| *** iamjarvo has joined #openstack-keystone | 16:48 | |
| *** mestery has quit IRC | 16:50 | |
| *** mestery has joined #openstack-keystone | 16:51 | |
| haneef | lbragstad: is this fernet or uuid token? | 16:51 |
| lbragstad | haneef: those are fernet tokens | 16:56 |
| lbragstad | breton: no, domain isn't required, but that request will give you a domain-scoped token | 16:56 |
| *** harlowja has joined #openstack-keystone | 16:57 | |
| *** chrisshattuck has quit IRC | 16:58 | |
| haneef | lbragstad: I just tried, it doesn't return roles for fernet and returns for uuid. same commit in the master | 16:59 |
| *** chrisshattuck has joined #openstack-keystone | 16:59 | |
| *** chrisshattuck has quit IRC | 16:59 | |
| breton | lbragstad: well, http://paste.openstack.org/show/192139/ fails for me | 17:00 |
| breton | and doesn't fail if I pass domain to users.create() | 17:00 |
| *** chrisshattuck has joined #openstack-keystone | 17:00 | |
| *** chrisshattuck has quit IRC | 17:00 | |
| lbragstad | breton: so you can create a user? | 17:01 |
| haneef | lbragstad: Can you try to validate that fernet token. My bug is about token validation and not token response | 17:01 |
| lbragstad | haneef: can you post what you're sending to Keystone? | 17:01 |
| *** chrisshattuck has joined #openstack-keystone | 17:01 | |
| breton | lbragstad: no without domain, yes with domain | 17:01 |
| *** chrisshattuck has quit IRC | 17:01 | |
| breton | oh, I'm getting the same results with uuid | 17:02 |
| lbragstad | breton: ok, I'm using domain too, so that's consistent | 17:02 |
| haneef | lbragstad: This is waht I was trying , curl -k -H "X-Auth-Token:ADMIN" -H "X-Subject-Token:$FD" http://localhost:35357/v3/auth/tokens | python -mjson.tool | 17:02 |
| haneef | where FD is domain scoped fernet token | 17:02 |
| *** chrisshattuck has joined #openstack-keystone | 17:02 | |
| *** chrisshattuck has quit IRC | 17:02 | |
| lbragstad | haneef: ok, let me try that quick | 17:03 |
| *** chrisshattuck has joined #openstack-keystone | 17:03 | |
| *** carlosmarin has quit IRC | 17:05 | |
| *** carlosmarin has joined #openstack-keystone | 17:05 | |
| *** _cjones_ has quit IRC | 17:05 | |
| *** browne has joined #openstack-keystone | 17:07 | |
| mtreinish | dimsum__: I had a question, how do I go about logging request ids with oslo log. I added the req-id middleware to the pipeline, but I'm not sure what the next step would be | 17:08 |
| *** iamjarvo has quit IRC | 17:08 | |
| *** elowing has joined #openstack-keystone | 17:09 | |
| breton | so, I still don't understand. Is it normal that a user cannot be created without a domain using admin_token? | 17:10 |
| *** timcline has joined #openstack-keystone | 17:11 | |
| rodrigods | breton, you are making a create_user request where the domain is not provided? | 17:11 |
| haneef | brenton: domain is required field for user creation, if u are using v3 clients. v2 will default to "defauk" domain | 17:12 |
| breton | rodrigods: yes. I am trying this: http://paste.openstack.org/show/192139/ | 17:13 |
| breton | haneef: where can I read about it? | 17:13 |
| breton | and why doesn't it fail with some sane message? | 17:14 |
| lbragstad | breton: https://github.com/openstack/keystone/blob/master/keystone/identity/core.py#L657 | 17:14 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 17:14 |
| *** iamjarvo has joined #openstack-keystone | 17:14 | |
| dimsum__ | mtreinish: in keystone? | 17:15 |
| mtreinish | yes | 17:15 |
| dimsum__ | mtreinish: the review already merged? (with middleware) | 17:15 |
| *** timcline has quit IRC | 17:15 | |
| openstackgerrit | Will Foster proposed openstack/keystone: skip assignment rows migrate if duplicate entry exists. https://review.openstack.org/164267 | 17:15 |
| mtreinish | dimsum__: http://git.openstack.org/cgit/openstack/keystone/commit/?id=d333eac4ef2c98974fb717979281c96a1264f327 | 17:15 |
| breton | lbragstad: thanks | 17:16 |
| lbragstad | breton: what error do you get when you try to create a user without the domain_id? | 17:16 |
| rodrigods | breton, lbragstad thought the controller always adds the domain_id (set to the Default when not present) | 17:17 |
| rodrigods | https://github.com/openstack/keystone/blob/master/keystone/identity/controllers.py#L82 | 17:17 |
| *** _cjones_ has joined #openstack-keystone | 17:18 | |
| dimsum__ | mtreinish: looking | 17:18 |
| breton | lbragstad: "The request you have made requires authentication." | 17:18 |
| lbragstad | rodrigods: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L702-L706 | 17:18 |
| lbragstad | rodrigods: it does that on user create for v3 | 17:19 |
| breton | and it says that even with stable/juno | 17:19 |
| lbragstad | breton: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L681-L689 | 17:20 |
| lbragstad | on user create for v3 it will try and resolve the domain id using that code | 17:20 |
| haneef | lbragstad: that is only for domain scoped token. context won't have domain_id for project scoped token | 17:20 |
| breton | lbragstad: nope, it doesn't get to that section | 17:21 |
| lbragstad | haneef: it looks like it tries populating the token_ref | 17:21 |
| lbragstad | from the KeystoneToken model | 17:22 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: WIP: Bye bye domain table https://review.openstack.org/161854 | 17:23 |
| haneef | lbragstad: https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L58. domain_id will be there only if it is domain scoped token | 17:29 |
| dimsum__ | mtreinish: don't see keystone using oslo_context's RequestContext? | 17:31 |
| *** jistr has quit IRC | 17:31 | |
| lbragstad | haneef: gotcha | 17:35 |
| *** elowing has quit IRC | 17:35 | |
| dimsum__ | oslo.log picks up request id from the context | 17:35 |
| bknudson | oslo.context isn't documented: http://docs.openstack.org/developer/openstack-projects.html | 17:36 |
| *** ayoung has quit IRC | 17:36 | |
| stevemar | bknudson, it exists http://docs.openstack.org/developer/oslo.context/ | 17:37 |
| rodrigods | bknudson, regarding your comment in the subtree_as_ids and parent_as_ids patch in ksc, do you have any suggestion on how to make that code prettier? | 17:37 |
| bknudson | rodrigods: provide a little function that builds query parameters from arguments | 17:38 |
| rodrigods | bknudson, hm... ok | 17:38 |
| bknudson | actualy, python probably has one already | 17:38 |
| rodrigods | bknudson, it does, but it doesn't build key only params | 17:39 |
| rodrigods | since this approach is not very RESTy | 17:39 |
| *** lhcheng has joined #openstack-keystone | 17:39 | |
| bknudson | rodrigods: what's not RESTy about it? | 17:40 |
| rodrigods | bknudson, it is recommended to always have a key and a value | 17:40 |
| *** lhcheng_ has joined #openstack-keystone | 17:41 | |
| *** ayoung has joined #openstack-keystone | 17:43 | |
| *** ChanServ sets mode: +v ayoung | 17:43 | |
| *** lhcheng has quit IRC | 17:44 | |
| *** lhcheng_ is now known as lhcheng | 17:44 | |
| ayoung | Anyone that cares about Federation (and that is everyone) there is an Ipsilon test day going on; see #fedora-test-day if you are interested | 17:45 |
| mtreinish | dimsum__: ah, ok that's where I got too. I guess I'll jsut have to figure out how to use oslo.context in keystone | 17:48 |
| stevemar | ayoung, today? | 17:50 |
| ayoung | looks like it | 17:50 |
| ayoung | Gah...nope | 17:50 |
| ayoung | was yesterday...how can I have missed that! | 17:50 |
| ayoung | stevemar, still, the instructions are, by far, the most valuable part | 17:50 |
| ayoung | https://fedoraproject.org/wiki/Test_Day:2015-03-12_Ipsilon | 17:51 |
| *** rushiagr_away is now known as rushiagr | 17:51 | |
| stevemar | ayoung, that looks like it was fun | 17:52 |
| ayoung | stevemar, for my team, most days are Ipsilon test days these days | 17:53 |
| *** gokrokve has quit IRC | 17:54 | |
| bknudson | stevemar: what's up with https://review.openstack.org/#/c/156905/ ? is this needed for bp cadf-everywhere? | 17:55 |
| stevemar | bknudson, it's not needed for it, i will strike that from the commit msg | 17:57 |
| stevemar | bknudson, it was a 'nice to have' / stretch goal | 17:57 |
| bknudson | ok, thanks. | 17:57 |
| stevemar | i'll file a bug | 17:57 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Emit failure notifications for CADF audits events https://review.openstack.org/156905 | 17:59 |
| dimsum__ | mtreinish: AuthContext seems like the closest... | 18:00 |
| *** elowing has joined #openstack-keystone | 18:00 | |
| *** gokrokve has joined #openstack-keystone | 18:01 | |
| *** leonchio_ has quit IRC | 18:01 | |
| *** leonchio_ has joined #openstack-keystone | 18:02 | |
| *** mattamizer has joined #openstack-keystone | 18:10 | |
| *** straycat is now known as sadcat_ | 18:11 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Replace exec calls with cryptography library https://review.openstack.org/163088 | 18:14 |
| stevemar | now that is a cool patch ^ | 18:18 |
| bknudson | we need eric brown to hang out in irc | 18:18 |
| stevemar | bknudson, for sure | 18:21 |
| stevemar | morganfainberg, ping | 18:21 |
| morganfainberg | stevemar, ponnnnnng | 18:21 |
| stevemar | morganfainberg, feel like putting abfab back into K release ? https://review.openstack.org/#/c/163878/ | 18:21 |
| morganfainberg | stevemar, if it's a documentation only change, wont matter. if its more than a doc change... i need to see the code ready to go today. | 18:22 |
| morganfainberg | stevemar, or see an FFE with associated code | 18:22 |
| bknudson | are we going to document every apache mod? | 18:23 |
| stevemar | morganfainberg, they claim it's just a doc change | 18:24 |
| stevemar | bknudson, we have 2 doc'ed so far, abfab would be the 3rd | 18:25 |
| stevemar | it's rather essential to doc these things for federation :( | 18:25 |
| bknudson | the apache modules should be documenting how to work with keystone, not the other way around! | 18:25 |
| stevemar | bknudson, you are certainly drinking the openstack koolaid | 18:26 |
| *** amakarov is now known as amakarov_away | 18:26 | |
| bknudson | if we don't have tests for it I'd rather not have it documented like it's supported | 18:27 |
| stevemar | bknudson, the tests would just be exercising the mapping engine and auth config options | 18:28 |
| bknudson | right, what if we change the mapping engine or how auth config options work and it breaks the instructions... | 18:28 |
| stevemar | maybe have a header that says it's best effort? | 18:28 |
| bknudson | now we have to maintain these instructions? | 18:29 |
| bknudson | also, these are developer docs, so not sure why developers care how to set this up. | 18:29 |
| iamjarvo | does ldap support multidomain with out adding specific domain confs? | 18:30 |
| bknudson | iamjarvo: it doesn't. | 18:30 |
| iamjarvo | i am narrowing on the answer no | 18:30 |
| iamjarvo | bknudson thank | 18:30 |
| iamjarvo | thank you* | 18:31 |
| nkinder | stevemar: if I grab the websso horizon patches (plus the websso stuff you got into keystone), should everything work for federated auth to Horizon in devstack? | 18:33 |
| nkinder | stevemar: I'm about to test it out, but wanted to check if there is some known missing piece still | 18:33 |
| stevemar | nkinder, i believe it should :) | 18:34 |
| stevemar | nkinder, https://review.openstack.org/#/c/164012/ | 18:34 |
| stevemar | nkinder, make sure you have DOA set as 'install from git' in devstack | 18:35 |
| stevemar | otherwise it gets wonky when you download the patch | 18:35 |
| stevemar | there is 1 horizon patch and 1 DOA patch | 18:36 |
| *** drjones has joined #openstack-keystone | 18:42 | |
| *** ayoung has quit IRC | 18:42 | |
| *** ayoung has joined #openstack-keystone | 18:43 | |
| *** ChanServ sets mode: +v ayoung | 18:43 | |
| *** _cjones_ has quit IRC | 18:43 | |
| nkinder | stevemar: ok thanks. I'll give it a shot. | 18:43 |
| openstackgerrit | ayoung proposed openstack/keystone: ignore unknown groups https://review.openstack.org/162788 | 18:44 |
| *** lhcheng has quit IRC | 18:47 | |
| *** drjones has quit IRC | 18:49 | |
| *** _cjones_ has joined #openstack-keystone | 18:50 | |
| lbragstad | haneef: I'm able to validate unscoped, domain-scoped, and project scoped tokens with my admin token. | 18:51 |
| lbragstad | haneef: are you still having issues with it? | 18:51 |
| haneef | lbragstad: when you validate, what is the response you are getting. Does the response token body have role? | 18:52 |
| lbragstad | haneef: with which token? | 18:53 |
| haneef | fernet token, if you execute the curl command I posted, it should return token response, whcih doesn't have role | 18:53 |
| lbragstad | haneef: with a domain-scoped fernet token? | 18:53 |
| haneef | fernet token, domain scoped | 18:53 |
| lbragstad | haneef: ok, checking quick | 18:54 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 18:54 |
| dolphm | haneef: can you post the raw token value and the fernet key used to create it? | 18:54 |
| rodrigods | bknudson, ^tried to address your comments, some of them I responded instead. let me know if you are ok with them | 18:55 |
| lbragstad | haneef: this is what I get http://cdn.pasteraw.com/o4te8rf20it6gs33lxmjl54k9n7z8jt | 18:55 |
| lbragstad | cc dolphm | 18:55 |
| lbragstad | haneef: recreating with a uuid token | 18:55 |
| haneef | yes. that is the one. It is missing roles | 18:55 |
| dolphm | haneef: what is the value of $SUBJECT_TOKEN and what is the fernet key? | 18:57 |
| lbragstad | haneef: uuid response http://cdn.pasteraw.com/eqw4n3vh0bb0xnv6y195flz7zb0u33q | 18:59 |
| lbragstad | haneef: fernet response http://cdn.pasteraw.com/7kmeev9y0cssyk7puri1v47nlclleuv | 18:59 |
| haneef | dolphm: https://gist.github.com/haneefs/278148638adb32476a75 | 18:59 |
| morganfainberg | haneef, is that via v2.0 or via v3? | 19:01 |
| haneef | v3, using openstack token issue | 19:01 |
| *** henrynash has joined #openstack-keystone | 19:02 | |
| *** ChanServ sets mode: +v henrynash | 19:02 | |
| lbragstad | so, it looks like domain-scoped fernet responses are missing the token['catalog'], token['roles'], and token['domain'] dictionaries | 19:03 |
| lbragstad | compared to uuid responses | 19:04 |
| dolphm | haneef: lbragstad: it's payload version 1, so it's definitely a domain scoped token http://cdn.pasteraw.com/o6iygbunnimdx6rtuigunkl0xuc7lch | 19:04 |
| dolphm | i was thinking maybe it was getting packed as unscoped or something | 19:04 |
| dolphm | lbragstad: that also looks like a non-integer time being encoded == wasted bytes! | 19:06 |
| dolphm | (expiration) | 19:06 |
| *** gordc has quit IRC | 19:06 | |
| lbragstad | msgpack should know to convert that | 19:06 |
| lbragstad | I *think*? | 19:06 |
| openstackgerrit | henry-nash proposed openstack/keystone: Mark the domain config API as experimental https://review.openstack.org/160032 | 19:06 |
| lbragstad | bernardo-silva would know the answer to that | 19:07 |
| lbragstad | dolphm: haneef also, when we validate, this is what we're using to build the context on the way out https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/core.py#L175-L183 | 19:07 |
| dolphm | lbragstad: i didn't pack it correctly | 19:07 |
| openstackgerrit | Merged openstack/keystone: Rename get_events to list_events on the Revoke API https://review.openstack.org/162817 | 19:07 |
| dolphm | lbragstad: i meant to pass it an int, not a float | 19:08 |
| dolphm | lbragstad: i probably got lost in timeutils | 19:08 |
| stevemar | bknudson, as badly named as it is, the 'developer' docs have becomes the central resource for configuration | 19:09 |
| lbragstad | haneef: dolphm figured it out... | 19:10 |
| lbragstad | haneef: dolphm we're going to have to do a major rewrite to fix it though :( | 19:10 |
| morganfainberg | lbragstad, what is it? | 19:10 |
| *** jaosorior has joined #openstack-keystone | 19:10 | |
| morganfainberg | dolphm, ^ | 19:10 |
| lbragstad | morganfainberg: dolphm haneef this is the response, it matches what we get for uuid | 19:11 |
| lbragstad | but we're going to have to apply the following :( | 19:11 |
| bknudson | stevemar: we should be pushing contributors to the admin guide. http://docs.openstack.org/admin-guide-cloud/content/ | 19:11 |
| dolphm | lbragstad: wut | 19:11 |
| *** henrynash has quit IRC | 19:11 | |
| lbragstad | dolphm: haneef morganfainberg this is gonna suck | 19:11 |
| lbragstad | dolphm: haneef morganfainberg http://cdn.pasteraw.com/7aklvpeuajaxsi7ztsowce2jhkrtoby | 19:12 |
| *** thedodd has quit IRC | 19:12 | |
| * lbragstad ducks | 19:12 | |
| dolphm | lbragstad: how the hell did that get dropped?! | 19:13 |
| * dolphm hates rebase loops | 19:13 | |
| dolphm | lbragstad: put it in gerrit! | 19:13 |
| *** ljfisher has quit IRC | 19:13 | |
| morganfainberg | lbragstad, wait ... really? | 19:13 |
| lbragstad | morganfainberg: ;) | 19:14 |
| morganfainberg | that's it? | 19:14 |
| lbragstad | lol yeah, no big deal... it must have gotten lost in the rebase hell we were in | 19:14 |
| lbragstad | I'll push a patch for it | 19:14 |
| morganfainberg | htanks | 19:14 |
| lbragstad | haneef: ^ that should solve your issue | 19:14 |
| *** lhcheng has joined #openstack-keystone | 19:16 | |
| *** tqtran is now known as tqtran_afk | 19:16 | |
| haneef | Yes. that solves it. I have verified it | 19:17 |
| ayoung | stevemar, looking at the webssso patch, I don't see how Horizon can redirect to Keystone without knowing the protocol. Did you assume that the protocol was selected before hitting Keystone? | 19:21 |
| stevemar | ayoung, yessir, it's part of a drop down menu | 19:22 |
| ayoung | stevemar, um...that is a mistake | 19:22 |
| ayoung | stevemar, pretty sure the flowe is like this | 19:22 |
| stevemar | oh? | 19:22 |
| ayoung | horizon -> keystone with no protocol selelcte | 19:22 |
| ayoung | keystone to discovery | 19:22 |
| ayoung | in disvcoverly, select protocol and idp | 19:23 |
| ayoung | redirect user to idp, and then back to keystone | 19:23 |
| ayoung | stevemar, I did a wget against the cern one. Their first redirect to keystone has not Idp in it | 19:23 |
| stevemar | ayoung, better comment on the horizon patch soon then :\ | 19:24 |
| ayoung | stevemar, Is the Horizon patch doing discovery? | 19:24 |
| ayoung | I'm, OK if they end up building discovery into Horizon, but there is some issue with horionz nad Keystione syncing the Idp list | 19:24 |
| ayoung | or are they only doing protocol selection | 19:25 |
| ayoung | stevemar, ? | 19:26 |
| *** atiwari has joined #openstack-keystone | 19:27 | |
| stevemar | ayoung, let me find the patch | 19:27 |
| ayoung | https://review.openstack.org/#/c/151842/ | 19:27 |
| ayoung | tqtran_afk, probably asleep | 19:28 |
| ayoung | stevemar, with his patch, how do you select IdP? | 19:29 |
| nkinder | ayoung: horizon does protocol selection | 19:29 |
| nkinder | at least that's how I understood the patches | 19:29 |
| stevemar | ayoung, it's based off the 'remote_id' that the idp sees | 19:29 |
| ayoung | nkinder, who selects IdP | 19:29 |
| nkinder | you select saml2 or openid | 19:29 |
| nkinder | keystone, or a discovery service | 19:29 |
| stevemar | err that apache sees | 19:29 |
| *** nonameentername has joined #openstack-keystone | 19:32 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Build domain scope for Fernet tokens https://review.openstack.org/164315 | 19:33 |
| lbragstad | haneef: dolphm morganfainberg fixed ^ | 19:33 |
| morganfainberg | lbragstad, thanks for the test too | 19:34 |
| lbragstad | morganfainberg: sure thing | 19:35 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Prefer . to setattr() https://review.openstack.org/164318 | 19:35 |
| *** gordc has joined #openstack-keystone | 19:36 | |
| *** kashyap has joined #openstack-keystone | 19:39 | |
| kashyap | Hi, any hints why I see this w/ current Keystone git w/ DevStack: | 19:40 |
| kashyap | 2015-03-13 19:23:47.597 | Authorization Failed: type object 'HTTPHeaderDict' has no attribute 'from_httplib' | 19:40 |
| *** radez is now known as radez_g0n3 | 19:40 | |
| stevemar | kashyap, never seen that one before | 19:40 |
| *** iamjarvo has quit IRC | 19:40 | |
| morganfainberg | kashyap, that is a new one to me | 19:41 |
| dstanek | kashyap: that's coming from Keystone? | 19:41 |
| kashyap | andreaf, consequently, TOKEN=$(keystone token-get | grep ' id ' | get_field 2) fails | 19:41 |
| ayoung | kashyap, sounds like a version of a library issue | 19:41 |
| kashyap | Ugh, I meant, "And". Sorry Andrea :-( | 19:41 |
| ayoung | hhtplib | 19:41 |
| kashyap | ayoung, Hmm, there's no RPM for suire. | 19:41 |
| ayoung | kashyap, you on F22 by any chance? | 19:41 |
| kashyap | ayoung, Not yet - on F21, all updated. F22 update on a different machine in progress (to reproduce it) | 19:42 |
| ayoung | kashyap, httplib is the native, maybe that is the disconnect | 19:42 |
| kashyap | dstanek, You can see the contextual code where it's failing -- http://paste.openstack.org/show/192165/ | 19:42 |
| kashyap | ayoung, I really despise pip (poop!) sometimes, it's notorious when it has to interact w/ RPM | 19:43 |
| dstanek | from_httplib appears in requests | 19:43 |
| ayoung | nkinder, the thing is, if you select a discover service, I don't think we have a way in Keystone to handle that yet. | 19:43 |
| ayoung | I think we ened the same thing as is the WEBSSO/{protocol} url but without the {rptotcol} | 19:43 |
| morganfainberg | kashyap, sadly fedora lets pip install in the same place rpms install, it should do what ubuntu does and use /usr/local/ with the sys.path meant to look in /usr/local first.. | 19:44 |
| kashyap | Output of $ find / -name *httplib* -- http://paste.openstack.org/show/192166/ | 19:44 |
| ayoung | kashyap, if devstack fails there, you should be able to still see what is happening in Keystone. | 19:44 |
| kashyap | morganfainberg, The reason for that is, Fedora doesn't want to diverge from upstream. And, I think that reason is sensible. | 19:44 |
| ayoung | Try doing a token-get by hand, and you can debug | 19:44 |
| dstanek | kashyap: the symbol from_httplib is from requests | 19:44 |
| kashyap | ayoung, Yeah, loooking for logs, thought I'll go get some food, but this is blocking me :-) | 19:45 |
| ayoung | I tend toi use rpdb but for this straight pdb shouold work fine | 19:45 |
| ayoung | kashyap, if it is an internal machine I can see, and if you are still blocked after food, I'd be happy to take a look | 19:45 |
| morganfainberg | kashyap, except you totally break everything in some cases and you can't back it out by removing a file. it would replace your RPM installed python libs in cases | 19:45 |
| kashyap | ayoung, Unfortunately, it's my laptop. My remote installs works just fine. I don't want to blow away the VM, as I'm on a very slow network | 19:46 |
| morganfainberg | kashyap, pip simply installing in a place that isn't the same as your packaging is just good practice. overwriting what the rpm installs is very silly. | 19:46 |
| morganfainberg | kashyap, but thats my opinion. | 19:46 |
| kashyap | morganfainberg, Understood. | 19:47 |
| ayoung | kashyap, do not to devstacks on your laptop. I sure hope you mean "a vm on my laptop" | 19:47 |
| kashyap | ayoung, Yes, of course. :-) | 19:47 |
| kashyap | Sorry for being reckless w/ words. | 19:47 |
| ayoung | kashyap, I know you well enough that I figured you had it right | 19:47 |
| kashyap | Hmm, I do have a few dev environments on remote f21 VMs. But I just want to see if I can get this VM going locally. | 19:48 |
| ayoung | kashyap, I've a F21 devstack and I have not seen that. How long ago did you install? | 19:48 |
| ayoung | kashyap, also, what version of the python requests is you system using? | 19:49 |
| kashyap | ayoung, The VM? I don't recall, but less than a month ago, and I updated it to F21 completely | 19:49 |
| ayoung | kashyap, unstack and stack, with the option to reclone | 19:49 |
| kashyap | That's my ultra small config - https://kashyapc.fedorapeople.org/virt/openstack/Minimal-DevStack-local.conf | 19:49 |
| ayoung | no, when did you install devstack? | 19:50 |
| kashyap | ayoung, RECLONE=yes in local.conf? That proved detrimental as it was mucking around deleting tracking branches, so I gave it the axe. | 19:50 |
| lbragstad | I'm doing some perusing in our test code. Does anyone know if there is a way to enter a test case (obviously after setUp() has run) do some stuff, and rerun setUp() with config overrides to start keystone differently and then continue on with the same test case? | 19:50 |
| kashyap | ayoung, DevStack this afternoon | 19:50 |
| ayoung | export YUM=dnf is the only thing suspect | 19:50 |
| kashyap | ayoung, It had a FrankenDevStack previously | 19:50 |
| ayoung | that should be pointing at the same repos | 19:50 |
| kashyap | ayoung, Oh, not at all, really? It just gives me 10 minutes of speedup, on the contrary assuming you have all the dependent packages installed. | 19:51 |
| ayoung | kashyap, go with a clean VM if its not too much trouble. | 19:51 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Prefer . to setattr()/getattr() https://review.openstack.org/164318 | 19:51 |
| kashyap | Yep, I'll try a bit more before I give up. I already do have a woring env. | 19:51 |
| kashyap | working* | 19:51 |
| ayoung | is that warring or whoring? | 19:51 |
| ayoung | Ah | 19:51 |
| kashyap | :-) Language please. . . | 19:52 |
| ayoung | Yeah... | 19:52 |
| ayoung | Don't tell mismo on me | 19:52 |
| kashyap | One day, I hope DevStack can be installed w/ no root privs | 19:52 |
| kashyap | Thanks all. | 19:53 |
| *** thedodd has joined #openstack-keystone | 19:53 | |
| dstanek | lbragstad: no, that mean you are doing it wrong | 19:54 |
| dstanek | lbragstad: i | 19:54 |
| dstanek | lbragstad: i'm guess because all of our crazy subclassing | 19:54 |
| lbragstad | dstanek: ok, so a better solution would be to create a new test class that inherits the tests that you want to run and makes the same assertions? | 19:54 |
| *** tqtran_afk is now known as tqtran | 19:55 | |
| dstanek | lbragstad: if you need to share the tests, but have different setup then you want a subclass of object to hold the test cases and two different TestCase subclasses that do the right setup | 19:55 |
| lbragstad | dstanek: ok, makes sense | 19:56 |
| lbragstad | dstanek: thanks! | 19:56 |
| *** stevemar has quit IRC | 19:56 | |
| *** ljfisher has joined #openstack-keystone | 19:57 | |
| *** rushiagr is now known as rushiagr_away | 19:57 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Implements subtree_as_ids and parents_as_ids https://review.openstack.org/150078 | 20:00 |
| lbragstad | dolphm: so this is neat, http://cdn.pasteraw.com/lt7vpp43jqvcndfzghbylm2rahmgw33 | 20:02 |
| dstanek | lbragstad: np | 20:02 |
| lbragstad | dolphm: ^ that is all the test_v3_auth.py:TestAuth tests run with Fernet setup. | 20:02 |
| dolphm | lbragstad: what is token instead? | 20:02 |
| dstanek | lbragstad: byes again? | 20:03 |
| lbragstad | dolphm: token instead? | 20:03 |
| dolphm | lbragstad: type(token) | 20:03 |
| lbragstad | dolphm: the fernet token should be a string | 20:04 |
| *** iamjarvo has joined #openstack-keystone | 20:04 | |
| dolphm | lbragstad: what is it actually? | 20:04 |
| lbragstad | dolphm: let me check | 20:04 |
| lbragstad | (Pdb) type(token) | 20:08 |
| lbragstad | <type 'str'> | 20:08 |
| lbragstad | dolphm: ^ | 20:08 |
| lbragstad | dolphm: thats the token type for a v3 token on the validate path | 20:11 |
| *** gordc has quit IRC | 20:11 | |
| lbragstad | dstanek: byes? | 20:12 |
| *** iamjarvo has quit IRC | 20:19 | |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inherited role domain calls on keystoneclient v3 https://review.openstack.org/116081 | 20:22 |
| dstanek | lbragstad: oops, meant bytes | 20:27 |
| lbragstad | dstanek: gotcha, digging into the test case now | 20:27 |
| *** henrique_ has quit IRC | 20:28 | |
| lbragstad | dstanek: found it... | 20:28 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Cleanup tests don't keep engine https://review.openstack.org/164340 | 20:28 |
| lbragstad | dstanek: in this test case | 20:29 |
| lbragstad | https://github.com/openstack/keystone/blob/24bc6a1bf03e0ef71b16b2e973120aa9a8131778/keystone/tests/unit/test_v3_auth.py#L2600-L2610 | 20:29 |
| lbragstad | the type(token_id) here is unicode https://github.com/openstack/keystone/blob/24bc6a1bf03e0ef71b16b2e973120aa9a8131778/keystone/auth/plugins/token.py#L39 | 20:30 |
| lbragstad | which is where it breaks | 20:30 |
| *** mattamizer has quit IRC | 20:39 | |
| *** ljfisher has quit IRC | 20:40 | |
| *** ljfisher has joined #openstack-keystone | 20:41 | |
| lbragstad | dstanek: dolphm actually, when we get auth here, the token_id comes in as a unicode string http://cdn.pasteraw.com/dtvq4wk6bdgmfzlsmic52ovsz0f7wk2 | 20:41 |
| lbragstad | https://github.com/openstack/keystone/blob/24bc6a1bf03e0ef71b16b2e973120aa9a8131778/keystone/auth/controllers.py#L369 | 20:41 |
| *** ljfisher has quit IRC | 20:43 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: On creation default service name to empty string https://review.openstack.org/146962 | 20:47 |
| *** stevemar has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v stevemar | 20:52 | |
| dstanek | lbragstad: are you going to try to keep it bytes? | 20:54 |
| kashyap | ayoung, I reverted to a VM snapshot (it's super quick on SSDs :-) ) | 20:54 |
| lbragstad | dstanek: I was curious if the test would pass if I wrapped it in str() and it did | 20:54 |
| lbragstad | dstanek: I'm going to push the commit that I have locally to get some eyes on it. | 20:54 |
| dstanek | use six instead of str | 20:55 |
| ayoung | kashyap, make a difference? | 20:56 |
| *** harlowja has quit IRC | 21:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use existing token test for Fernet tokens. https://review.openstack.org/164348 | 21:00 |
| lhcheng | bknudson: I had to cleanup all pyc files to get the test migration working again in my local. | 21:01 |
| morganfainberg | lhcheng, migrations and .pycs are finacky | 21:01 |
| bknudson | lhcheng: I thought I tried that, will give it another go. | 21:01 |
| lhcheng | morganfainberg: I learned that lesson before, you helped me figure it out last time :P | 21:02 |
| *** elowing has quit IRC | 21:03 | |
| lhcheng | bknudson: when you get the chance https://review.openstack.org/#/c/156867/ - this is related to the bug you opened that we had the parent_id included in the token response. | 21:04 |
| lbragstad | dstanek: using https://pythonhosted.org/six/#six.string_types ? | 21:04 |
| *** raildo has quit IRC | 21:05 | |
| *** harlowja has joined #openstack-keystone | 21:06 | |
| dstanek | lbragstad: six.binary_type | 21:10 |
| *** iamjarvo has joined #openstack-keystone | 21:14 | |
| *** diegows has quit IRC | 21:14 | |
| *** csoukup has quit IRC | 21:15 | |
| *** mattfarina has quit IRC | 21:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use existing token test for Fernet tokens. https://review.openstack.org/164348 | 21:17 |
| ayoung | nkinder, are we ok with Horizon setting the Protocol? | 21:17 |
| ayoung | And I still don't see how we are going to keep the IdPs in sync | 21:18 |
| kashyap | ayoung, Sorry, was afk - since it rolled back in time, some `dnf update` in progress | 21:21 |
| *** bknudson has quit IRC | 21:35 | |
| *** iamjarvo has quit IRC | 21:39 | |
| *** iamjarvo has joined #openstack-keystone | 21:39 | |
| *** bknudson has joined #openstack-keystone | 21:41 | |
| *** ChanServ sets mode: +v bknudson | 21:41 | |
| openstackgerrit | Merged openstack/keystone: Crosslink to other sites that are owned by Keystone https://review.openstack.org/161490 | 21:41 |
| *** tqtran is now known as tqtran_afk | 21:44 | |
| *** rushiagr_away is now known as rushiagr | 21:44 | |
| *** iamjarvo has quit IRC | 21:46 | |
| *** rwsu has quit IRC | 22:00 | |
| *** harlowja has quit IRC | 22:04 | |
| lbragstad | jorge_munoz: I added one more comment here; https://review.openstack.org/#/c/159229/29/keystone/token/providers/fernet/core.py | 22:04 |
| lbragstad | jorge_munoz: which includes the fix that dstanek recommended on my patch | 22:04 |
| *** gokrokve has quit IRC | 22:05 | |
| *** gokrokve has joined #openstack-keystone | 22:05 | |
| *** harlowja has joined #openstack-keystone | 22:06 | |
| *** gokrokve has quit IRC | 22:06 | |
| *** harlowja has quit IRC | 22:06 | |
| *** gokrokve has joined #openstack-keystone | 22:06 | |
| *** harlowja has joined #openstack-keystone | 22:06 | |
| *** pnavarro|off has quit IRC | 22:10 | |
| jorge_munoz | lbragstad: ok | 22:10 |
| nkinder | ayoung: yeah, that's fine for now | 22:10 |
| jorge_munoz | lbragstad: ’ll add the change | 22:11 |
| nkinder | ayoung: For the single IdP per protocol case, that will work just fine. | 22:11 |
| nkinder | ayoung: for the multiple IdP case, I think the discovery service will be needed. | 22:11 |
| ayoung | nkinder, that will have to be in the Lzard release | 22:14 |
| nkinder | ayoung: that's fine I think | 22:14 |
| *** csoukup has joined #openstack-keystone | 22:15 | |
| nkinder | ayoung: better to have the single IdP case working in Kilo than nothing | 22:15 |
| ayoung | nkinder, I' tryin to get the last patch done, which is the "don't blow up if a mapped group is not in the backend" | 22:15 |
| ayoung | the code is simple...thetest is a PITA | 22:15 |
| *** henrynash has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v henrynash | 22:20 | |
| *** henrynash has quit IRC | 22:22 | |
| *** stevemar has quit IRC | 22:24 | |
| *** chrisshattuck has quit IRC | 22:26 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor sql filter code for clarity https://review.openstack.org/164362 | 22:32 |
| *** rwsu has joined #openstack-keystone | 22:33 | |
| *** tqtran_afk is now known as tqtran | 22:42 | |
| *** thedodd has quit IRC | 22:43 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 token response https://review.openstack.org/156867 | 22:51 |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Remove parent_id in v2 tenant response https://review.openstack.org/164367 | 22:51 |
| *** markvoelker has quit IRC | 22:56 | |
| kashyap | ayoung, Just to tie up the loose end, yes - it did make a difference. Yay, qcow2 snapshots! | 23:03 |
| *** browne has quit IRC | 23:03 | |
| kashyap | Have a nice weekend, all! | 23:04 |
| lhcheng | bknudson: ping | 23:15 |
| *** _cjones_ has quit IRC | 23:24 | |
| *** timcline has joined #openstack-keystone | 23:26 | |
| *** timcline has quit IRC | 23:28 | |
| *** timcline has joined #openstack-keystone | 23:28 | |
| *** david-lyle is now known as david-lyle_afk | 23:29 | |
| *** carlosmarin has quit IRC | 23:30 | |
| *** timcline has quit IRC | 23:31 | |
| *** jaosorior has quit IRC | 23:32 | |
| *** rwsu has quit IRC | 23:35 | |
| *** rwsu has joined #openstack-keystone | 23:38 | |
| *** csoukup has quit IRC | 23:41 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 23:43 |
| *** dimsum__ has quit IRC | 23:52 | |
| *** _cjones_ has joined #openstack-keystone | 23:53 | |
| *** _cjones_ has quit IRC | 23:55 | |
| *** dims_ has joined #openstack-keystone | 23:55 | |
| *** topol has joined #openstack-keystone | 23:56 | |
| *** ChanServ sets mode: +v topol | 23:56 | |
| *** markvoelker has joined #openstack-keystone | 23:57 | |
| *** dims_ has quit IRC | 23:57 | |
| *** dims_ has joined #openstack-keystone | 23:57 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Implement Fernet tokens for v2.0 tokens https://review.openstack.org/159229 | 23:57 |
| *** mattamizer has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!