| *** raildo has quit IRC | 00:20 | |
| *** stevemar has joined #openstack-keystone | 00:23 | |
| *** ChanServ sets mode: +v stevemar | 00:23 | |
| *** mhu has quit IRC | 00:27 | |
| *** mhu has joined #openstack-keystone | 00:28 | |
| *** markvoelker has quit IRC | 00:37 | |
| *** _cjones_ has quit IRC | 00:41 | |
| stevemar | gyee, around? | 00:46 |
|---|---|---|
| *** ncoghlan has joined #openstack-keystone | 00:46 | |
| gyee | stevemar, yes sir | 00:47 |
| gyee | found the issue | 00:47 |
| stevemar | gyee, yeah, thanks for that, i initially dismissed that prefix | 00:47 |
| gyee | I think we'll need to make relaystate part of service_provider | 00:47 |
| stevemar | did you try it out? | 00:47 |
| gyee | stevemar, yes | 00:47 |
| stevemar | oh okay, i was going to ask if you wanted me to put up a new patch so you could try it out | 00:48 |
| gyee | I changed text='ss:mem:' + uuid.uuid4().hex | 00:48 |
| gyee | and it works fine | 00:48 |
| stevemar | gyee, so just another attribute for sp_ref, which can be nullable... new column for sql | 00:48 |
| gyee | right | 00:48 |
| gyee | if it's null assuming relaystate is configured as 'cookie' at the SP side | 00:49 |
| stevemar | then when we do the lookup for token -> ecp, we can fetch the sp_ref | 00:49 |
| gyee | right | 00:49 |
| stevemar | gyee, okay, that shouldn't be hard at all | 00:50 |
| gyee | stevemar, thanks, that's good work! | 00:50 |
| gyee | we need that ecp patch | 00:50 |
| gyee | make it much easier on the clients | 00:50 |
| stevemar | gyee, i was also wondering.... whats the deal with the samlec:GeneratedKey value in rodrigos stuff | 00:50 |
| stevemar | http://paste.openstack.org/show/193677/ | 00:50 |
| gyee | stevemar, I don't know, I haven't look into that one | 00:50 |
| gyee | looks like your patch works with it | 00:51 |
| stevemar | gyee, the pysaml2 library doesn't seem to have much support for that one | 00:51 |
| stevemar | i didn't include it in the patch at all | 00:51 |
| gyee | stevemar, don't worry about it for now, I don't think we need it | 00:51 |
| stevemar | yeah | 00:51 |
| stevemar | okay, i'll make a new patch for the new attribute | 00:51 |
| gyee | thanks! | 00:51 |
| *** bknudson has joined #openstack-keystone | 00:51 | |
| *** ChanServ sets mode: +v bknudson | 00:51 | |
| stevemar | i was thinking about setting it on the idp keystone side, but that won't make sense | 00:51 |
| gyee | we can't | 00:52 |
| gyee | because we support multiple SPs | 00:52 |
| gyee | so relaystate could be different from SP to SP | 00:52 |
| *** edmondsw has quit IRC | 01:01 | |
| *** dims has joined #openstack-keystone | 01:08 | |
| stevemar | yah, good point | 01:10 |
| *** diegows has quit IRC | 01:11 | |
| *** markvoelker has joined #openstack-keystone | 01:17 | |
| *** iamjarvo has quit IRC | 01:20 | |
| *** iamjarvo has joined #openstack-keystone | 01:21 | |
| *** iamjarvo has quit IRC | 01:22 | |
| *** markvoelker has quit IRC | 01:22 | |
| *** iamjarvo has joined #openstack-keystone | 01:22 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change auth_token to use keystoneclient https://review.openstack.org/144248 | 01:26 |
| jamielennox | bknudson: when you get some time i'd appreciate thoughts on this middleware spec: https://review.openstack.org/#/c/164582/ | 01:27 |
| jamielennox | gyee: stevemar, morganfainberg: as well^ | 01:30 |
| bknudson | jamielennox: if we have x509 for service -> keystone then there isn't a service token. | 01:30 |
| jamielennox | bknudson: right, was talking to gyee about that - and the only answer i've got is "it's not a compulsary field" | 01:30 |
| jamielennox | if there is no token then you can't have a service token | 01:30 |
| jamielennox | but i think long term with policy we'll want that | 01:31 |
| bknudson | y... wonder how we could solve that? | 01:31 |
| jamielennox | because service tokens is how swift, barbican and i think others will eventually handle dual ownership situations | 01:31 |
| jamielennox | i know other services have this problem, i can't remember the details | 01:31 |
| bknudson | we also have to ensure somehow that the service token isn't expired... how do we do that? | 01:32 |
| jamielennox | but where a service creates a resource on behalf of a user | 01:32 |
| jamielennox | bknudson: so that one should be ok, because a plugin will re-authenticate as required, so whether that happens in auth_token or .get_token() doesn't get called until later that's ok | 01:33 |
| jamielennox | and a service-token should never be forwarded so it's only got to last for this one request | 01:33 |
| jamielennox | i'm excited that it could make token binding feasible again | 01:33 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate keystone CLI https://review.openstack.org/165669 | 01:34 |
| bknudson | jamielennox: I got a request from dims to put Nova's RequestContext processing into middleware -- https://github.com/openstack/nova/blob/master/nova/api/auth.py#L111 | 01:36 |
| jamielennox | the point is though that i want the plugin that middleware passes down to services to be consumed, that should be how service->service communication happens - is it reasonable to do all this on behalf of a service? | 01:36 |
| jamielennox | bknudson: excellent! i'm working towards that | 01:36 |
| bknudson | is the plugin consumed already? | 01:36 |
| bknudson | we don't need to wait for this for the plugin to be used? | 01:37 |
| * dims waves | 01:37 | |
| jamielennox | i want https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_user_plugin.py#L109 and context to be synonymous | 01:37 |
| jamielennox | you can construct a context directly from the plugin, you can construct a plugin from the context | 01:37 |
| jamielennox | what i'm really missing there is the ability to serialize that plugin | 01:38 |
| bknudson | the NovaKeystoneContext ? or something else? | 01:38 |
| bknudson | I mean the context.RequestContext | 01:38 |
| bknudson | this is actually from, oh, it's nova.context... | 01:39 |
| jamielennox | well most of context is shuffling around auth information, if we have the plugin available then we don't need to reach for headers or anything we can construct directly from the plugin | 01:39 |
| bknudson | but I guess there's an oslo context, too? | 01:39 |
| jamielennox | there is, it's thankfully fairly limited | 01:39 |
| bknudson | it's used for oslo.policy... the request context. | 01:39 |
| jamielennox | and it's used for oslo.messaging which is why they had to extract a common library | 01:40 |
| jamielennox | i'm hoping the plugin and oslo.context can deeply integrate | 01:40 |
| bknudson | in the call to "def enforce(self, rule, target, creds, do_raise=False," | 01:41 |
| bknudson | I guess the context would be the creds. | 01:41 |
| jamielennox | this is largely why i want the g-r bump for middleware for kilo, so for liberty we can start relying on the plugin being available | 01:41 |
| jamielennox | bknudson: te plugin can be the creds, probably not the context | 01:41 |
| bknudson | well, the creds is going to need more than just the user? | 01:42 |
| jamielennox | if the plugin is the creds then keystone owns both the inputs and the processing for policy - which is what i want | 01:42 |
| *** samueldmq has quit IRC | 01:42 | |
| bknudson | interesting. | 01:42 |
| bknudson | you need to blog this stuff. | 01:42 |
| jamielennox | it has all this: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_user_plugin.py#L16 for both user and the service token if available | 01:43 |
| jamielennox | yea, i always find it weird blogging ideas - i'm happy to write it all up at the end so people can use it, but the ideas don't always work out then there's bad info people can find | 01:43 |
| bknudson | so you were planning to update policy to take the plugin, or change the plugin to be a dict so it can be used with polciy? | 01:44 |
| jamielennox | i think for compatibility it will be a case of having helper functions for both | 01:45 |
| jamielennox | so oslo.policy will have enforce_from_plugin or something | 01:45 |
| bknudson | there's nothing weird in nova's RequestContext that isn't in the plugin you pointed to. | 01:45 |
| jamielennox | and plugin will probably have a .to_policy_dict() function or something | 01:46 |
| *** harlowja_ is now known as harlowja_away | 01:46 | |
| bknudson | and it's already got the user_auth_plugin. | 01:46 |
| jamielennox | that's probably best handled from policy itself actually | 01:46 |
| jamielennox | bknudson: i've been working towards this for a while :) | 01:46 |
| bknudson | so what's the point of oslo.context ? | 01:47 |
| jamielennox | bknudson: i talked to dhellmann about stopping it | 01:47 |
| bknudson | lol | 01:47 |
| jamielennox | however oslo.messaging relies heavily on a context as does logigng | 01:47 |
| *** browne has quit IRC | 01:48 | |
| jamielennox | a context dict is deeply ingrained in how RPC works | 01:48 |
| bknudson | .to_dict | 01:48 |
| bknudson | ... why not just support __item__? | 01:48 |
| jamielennox | so context will hopefully have a plugin object and i can hook it plugin serialization in to_dict | 01:48 |
| bknudson | or whatever it is. I'm no expert. | 01:49 |
| jamielennox | lots of this is historical | 01:49 |
| bknudson | you need to work together with dims and others pushing oslo.context. | 01:50 |
| jamielennox | context being an actual dict is a requirement in odd places | 01:50 |
| bknudson | although seems like they're both moving things in the right direction at least. | 01:50 |
| jamielennox | bknudson: yep, nova, neutron, heat and glance all have some form of context_to_plugin function | 01:50 |
| jamielennox | just the context is different in all those places so it's not the same | 01:51 |
| bknudson | jamielennox: so you don't want keystonemiddleware to provide an oslo.context RequestContext, too? | 01:51 |
| *** iamjarvo has quit IRC | 01:52 | |
| jamielennox | every service current has some form of customization on the standard context object | 01:52 |
| jamielennox | i think that's too hard a battle initially | 01:52 |
| bknudson | dims will fight that battle with you. | 01:52 |
| bknudson | actually, it's only dhellmann that has commits to oslo.context. | 01:52 |
| jamielennox | if we push plugin <-> context interop then we will get most of the way there over the next cycle or two, then look at having a single context | 01:53 |
| dims | bknudson: i switched nova to fully adopt oslo_context's RequestContext | 01:53 |
| bknudson | dims: where? | 01:53 |
| jamielennox | dims: oslo_context's context is really basic though | 01:53 |
| dims | see nova.context | 01:53 |
| jamielennox | actually it contains a lot of stuff i wish would die, but it doesn't have any auth data | 01:53 |
| bknudson | https://github.com/openstack/nova/blob/master/nova/context.py | 01:54 |
| dims | y | 01:54 |
| bknudson | got their own plugin. | 01:54 |
| bknudson | class RequestContext(context.RequestContext): | 01:55 |
| dims | y | 01:55 |
| jamielennox | nooooo, they added some auth data to oslo.context | 01:55 |
| jamielennox | wtf do they care about project_domain for .... | 01:55 |
| bknudson | you knew it was going to happen! | 01:55 |
| *** _cjones_ has joined #openstack-keystone | 01:56 | |
| *** _cjones_ has quit IRC | 01:56 | |
| jamielennox | last i spoke i still didn't have enough pieces in place to really have an alternative though | 01:56 |
| jamielennox | i'm kind of only just there now | 01:56 |
| dims | oslo context needs it so that i can store info needed by oslo.log | 01:56 |
| bknudson | so nova is going to extend context.RequestContext its way and neutron is going to extend context.RequestContext for what it needs. | 01:57 |
| dims | in the default formats | 01:57 |
| bknudson | jamielennox: that doesn't sound like it's getting closer to your dream, really. | 01:57 |
| *** tqtran has quit IRC | 01:58 | |
| bknudson | too much inheritance. | 01:58 |
| dims | what did you have in mind jamielennox? | 01:58 |
| bknudson | nova sure has a lot of stuff in its context... way more than a user plugin! | 01:59 |
| jamielennox | bknudson: right | 01:59 |
| jamielennox | dims: so you have a basic understanding of what we're trying to do with auth plugins? | 01:59 |
| bknudson | 'instance_lock_checked' ?? | 01:59 |
| bknudson | I can put that in my policy... instance_lock_checked: true | 02:00 |
| dims | jamielennox: no, honestly | 02:00 |
| jamielennox | ergh - yea they're throwing all this info at policy as well so i can't override the context there | 02:00 |
| bknudson | sounds like a summit jamboree. | 02:00 |
| jamielennox | dims: np, essentially we have too many credential types now, we have a session object which does transport and we have an auth plugin which handles everything auth related | 02:01 |
| dims | jamielennox: all i want was that nova should not have to figure out which http header etc which ones are deprecated or not etc | 02:01 |
| jamielennox | so services are transparent to the actual auth being used | 02:01 |
| dims | ok | 02:01 |
| jamielennox | for service->service communication we pass down an auth plugin out of auth_token middleware, so same story, all you do when communicating to another service is use that plugin and all the setting of headers is done for you | 02:02 |
| dims | ok | 02:03 |
| bknudson | if middleware generates a context.RequestContext, how is that going to turn into a nova RequestContext? pull it apart and put it back together? | 02:03 |
| bknudson | or do you want nova to pass in the factory function to auth_token? | 02:03 |
| dims | bknudson: i could pass a class which you can pass args, kwargs | 02:03 |
| bknudson | right. | 02:03 |
| dims | y | 02:03 |
| jamielennox | that plugin we pass down is essentially the total of all the ENV headers that auth_token used to pass and the services would rebuild into a context - so my argument is that essentially they are the same thing, with the addition of whatever service considers unique to their context | 02:04 |
| bknudson | how is the service going to add stuff to the plugin? | 02:04 |
| jamielennox | bknudson: right, which is why i can't see how auth_token could hand down a context, and i'm looking at how to build a context from a plugin and vice versa | 02:05 |
| jamielennox | plugin and context are going to have to be complimentary | 02:05 |
| bknudson | it's not composition or inheritance? they have to be convertable? | 02:05 |
| dims | jamielennox: if you can show me how you can build a oslo.RequestContext from it, i can come up with ideas on to build a nova.RequestContext from it :) | 02:06 |
| dims | over a period of time we can get rid of nova.RequestContext | 02:06 |
| dims | it's just a crutch right now because of lack of time | 02:07 |
| bknudson | if the service is passing in a function, then it could create whatever it wants... this is essentially just changing the env vars to function args. | 02:07 |
| bknudson | auth_token doesn't care what the function generates. | 02:07 |
| bknudson | and we could handle that by just providing a utility in middleware that takes the env and calls a function. | 02:08 |
| bknudson | well, maybe it's easier to handle in middleware anyways. | 02:08 |
| bknudson | just doesn't seem to be buying much. | 02:09 |
| jamielennox | bknudson: you need to implement the right interface for a plugin, i think it's ok for them to be seperate options | 02:09 |
| jamielennox | s/options/objects | 02:10 |
| bknudson | we've got to_dict to make the context serializable? | 02:11 |
| bknudson | it needs to be sent over rpc? | 02:11 |
| jamielennox | yes | 02:11 |
| jamielennox | we don't have plugin .to_dict though is the big stopper at the momment | 02:11 |
| bknudson | you don't want your plugin to be sent over rpc? what's the point of that? | 02:11 |
| jamielennox | i do want | 02:12 |
| jamielennox | it's just not written yet | 02:12 |
| bknudson | so someone sends a token to nova-api, they send it to nova-compute or scheduler and it can ... make a request as the user? | 02:12 |
| jamielennox | i was trying to write it as part of ksc, then the ksm plugin could do something standard - but generic serialization is hard | 02:12 |
| jamielennox | bknudson: it does now | 02:12 |
| bknudson | for what? | 02:12 |
| jamielennox | talk to glance, cinder, neutron | 02:13 |
| jamielennox | n-api tells compute to start a machine, compute asks for volumes and images etc all using the user token | 02:13 |
| bknudson | wow... I guess that makes sense. | 02:13 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:14 | |
| jamielennox | bknudson: openstack security is.. interesting | 02:14 |
| bknudson | how were you going to make an auth plugin serializable? to_dict? | 02:14 |
| jamielennox | essentially | 02:14 |
| bknudson | this means that everything in a plugin needs to be serializable too. | 02:14 |
| dims | to_dict / from_dict | 02:14 |
| jamielennox | the problem is there are competing needs for plugin serialization | 02:14 |
| dims | RequestContext has both | 02:14 |
| jamielennox | OSC has been wanting it for ages so that it can cache tokens between requests | 02:15 |
| bknudson | a token plugin is easy enough. | 02:15 |
| jamielennox | i have some POC stuff up for review | 02:15 |
| bknudson | I mean serializing a plugin that all it has is a token | 02:15 |
| bknudson | but I'm worried that there's some type of plugin where serializing won't make any sense. | 02:15 |
| jamielennox | kind of, they have here is all the cred data, then generate a unique id from that and if it matches what i have in cache then load up the AccessInfo object | 02:16 |
| jamielennox | and other plugins i expect you never want to serialize sensitive data | 02:16 |
| jamielennox | so yes, doing this generically is why it's not done yet | 02:16 |
| bknudson | is it really only this UserAuthPlugin that needs to be serializable to begin with? | 02:17 |
| jamielennox | for where i want to go with policy and context i think i just need UserAuthPlugin, OSC needs general, i just don't want to end up with something incompatible between the two | 02:17 |
| *** markvoelker has joined #openstack-keystone | 02:18 | |
| bknudson | if it's just to_dict/from_dict that's going to be compatible... | 02:18 |
| *** erkules_ has joined #openstack-keystone | 02:19 | |
| bknudson | and osc can getattr('to_dict') to find out if it's serializable. | 02:19 |
| *** erkules has quit IRC | 02:21 | |
| *** browne has joined #openstack-keystone | 02:21 | |
| bknudson | Depends-On worked! https://review.openstack.org/#/c/131435/ | 02:22 |
| *** markvoelker has quit IRC | 02:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add relay_state_prefix to Service Provider https://review.openstack.org/166078 | 02:25 |
| *** lhcheng has joined #openstack-keystone | 02:26 | |
| ayoung | jamielennox, done | 02:27 |
| jamielennox | bknudson: i have https://review.openstack.org/#/c/149175/ for OSC and https://review.openstack.org/#/c/113163/ for general - both WIP - i'm just looking for some way to combine the two | 02:28 |
| jamielennox | and preferably without adding a hundred new methods to plugins (though that's not really a problem) | 02:28 |
| jamielennox | ayoung: cool, thanks | 02:29 |
| jamielennox | ayoung: i've got one review left for DOA... i think it will make kilo | 02:31 |
| *** jamielennox is now known as jamielennox|lunc | 02:32 | |
| *** jamielennox|lunc is now known as jamielennox|food | 02:32 | |
| morganfainberg | Wow. Being on central time makes lots of stuff happen while I'm getting food. | 02:34 |
| stevemar | morganfainberg, where you at now? | 02:36 |
| morganfainberg | Austin | 02:36 |
| stevemar | morganfainberg, sounds like fun | 02:37 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Convert Exceptions to failures. https://review.openstack.org/165908 | 02:37 |
| morganfainberg | stevemar: always | 02:37 |
| stevemar | morganfainberg, we might need an FFE for the ecp stuff, it involves an API change :( | 02:38 |
| stevemar | a minor one... but one nonetheless | 02:38 |
| morganfainberg | stevemar: doh! | 02:50 |
| morganfainberg | stevemar: :(. Did I -2 those? I think I did. | 02:51 |
| morganfainberg | stevemar: anyway. Yeah. | 02:51 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 02:58 |
| *** greghaynes has quit IRC | 02:58 | |
| stevemar | gyee, ^^ | 02:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 03:01 |
| *** jamielennox|food is now known as jamielennox | 03:01 | |
| gyee | stevemar, jamielennox, ack | 03:05 |
| gyee | code review night for me | 03:05 |
| jamielennox | hmm, load up gyee with reviews... | 03:05 |
| gyee | s/review/coffee/ | 03:05 |
| *** greghaynes has joined #openstack-keystone | 03:06 | |
| stevemar | richm, the remote_id stuff is in progress https://review.openstack.org/#/c/161302/ | 03:06 |
| stevemar | smacked down your osc bug | 03:06 |
| *** davechen has joined #openstack-keystone | 03:12 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Rename requests mock object in testing https://review.openstack.org/164565 | 03:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Add a relay_state_prefix to the service provider resource https://review.openstack.org/166086 | 03:15 |
| stevemar | gyee, gotta check the the dependent patch ! | 03:18 |
| *** markvoelker has joined #openstack-keystone | 03:19 | |
| gyee | stevemar, my bad | 03:19 |
| gyee | stevemar, just one suggestion | 03:19 |
| gyee | the ending colon should be part of the prefix | 03:19 |
| gyee | otherwise, looks good! | 03:19 |
| *** dims has quit IRC | 03:20 | |
| *** jbonjean has quit IRC | 03:20 | |
| *** markvoelker has quit IRC | 03:23 | |
| stevemar | gyee, i wasn't sure about that, but i guess we'll do that | 03:25 |
| gyee | stevemar, it'll work as it because of the default | 03:25 |
| gyee | as is | 03:25 |
| nkinder | stevemar: ah, I just submitted a patch for OSC for --remote-id | 03:26 |
| nkinder | stevemar: I see that we're waiting on adding support for a list of remote ids | 03:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add relay_state_prefix to Service Provider https://review.openstack.org/166078 | 03:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 03:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 03:27 |
| stevemar | nkinder, yeppers | 03:28 |
| nkinder | stevemar: ok, so I guess we should wait and see if a FFE is granted... | 03:28 |
| stevemar | yeah, in case we are stuck with just the 1 | 03:29 |
| nkinder | my patch is just for a single remote_id (the way keystone works now) | 03:29 |
| stevemar | yep | 03:29 |
| nkinder | ok, if we get a FFE we can kill mine. I'll leave it for now | 03:29 |
| gyee | stevemar, I need to be offline for a couple of hours, but I'll do some more reviews later | 03:29 |
| stevemar | nkinder, if you could review the proposed patch that would be good :) | 03:29 |
| nkinder | stevemar: will do now that I know about it ;) | 03:29 |
| stevemar | gyee, fair enough, i changed up the colon thingy | 03:29 |
| *** darrenc is now known as darren_afk | 03:33 | |
| *** omkarjoshi has quit IRC | 03:34 | |
| *** darren_afk is now known as darrenc | 03:38 | |
| *** gyee has quit IRC | 03:41 | |
| morganfainberg | stevemar: so tomorrow I will be responding to FFE emails. Hopefully we will have a confirmation of ffe by next meeting on Tuesday. | 03:42 |
| *** Kennan has joined #openstack-keystone | 03:46 | |
| stevemar | morganfainberg, okie dokie | 03:58 |
| *** ccard_ has quit IRC | 03:59 | |
| *** ajayaa has joined #openstack-keystone | 04:01 | |
| *** lvh is now known as least_authority_ | 04:02 | |
| *** least_authority_ is now known as lvh | 04:02 | |
| *** markvoelker has joined #openstack-keystone | 04:19 | |
| *** markvoelker has quit IRC | 04:24 | |
| *** dims has joined #openstack-keystone | 04:25 | |
| *** omkarjoshi has joined #openstack-keystone | 04:26 | |
| *** dims has quit IRC | 04:32 | |
| *** richm has quit IRC | 04:38 | |
| *** _cjones_ has joined #openstack-keystone | 04:57 | |
| *** _cjones_ has quit IRC | 05:01 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 05:02 | |
| *** chlong has quit IRC | 05:02 | |
| *** rushiagr_away is now known as rushiagr | 05:07 | |
| *** ajayaa has quit IRC | 05:08 | |
| *** ishant has joined #openstack-keystone | 05:14 | |
| *** chlong has joined #openstack-keystone | 05:19 | |
| *** markvoelker has joined #openstack-keystone | 05:20 | |
| *** markvoelker has quit IRC | 05:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Document websso setup https://review.openstack.org/164012 | 05:35 |
| stevemar | lhcheng, ty sir | 05:36 |
| *** rushiagr is now known as rushiagr_away | 05:42 | |
| *** rushiagr_away is now known as rushiagr | 05:59 | |
| *** chlong has quit IRC | 06:01 | |
| stevemar | nkinder, thanks for the review nathaniel | 06:03 |
| *** ccard_ has joined #openstack-keystone | 06:12 | |
| *** chlong has joined #openstack-keystone | 06:13 | |
| *** dims has joined #openstack-keystone | 06:18 | |
| *** markvoelker has joined #openstack-keystone | 06:21 | |
| *** dims has quit IRC | 06:24 | |
| *** markvoelker has quit IRC | 06:26 | |
| *** ajayaa has joined #openstack-keystone | 06:27 | |
| *** fifieldt has joined #openstack-keystone | 06:32 | |
| *** jamielennox is now known as jamielennox|away | 06:35 | |
| *** ajayaa has quit IRC | 06:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 06:44 | |
| *** ajayaa has joined #openstack-keystone | 06:53 | |
| *** ParsectiX has joined #openstack-keystone | 06:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Document websso setup https://review.openstack.org/164012 | 06:58 |
| *** Bsony has quit IRC | 07:01 | |
| *** browne has quit IRC | 07:03 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add API to create ecp wrapped saml assertion https://review.openstack.org/162866 | 07:03 |
| Kennan | :+stevemar | 07:08 |
| Kennan | could you help one question? | 07:08 |
| stevemar | Kennan, o/ | 07:08 |
| stevemar | i can try | 07:08 |
| Kennan | I tried kubectl pod-create with -f , it said | 07:09 |
| Kennan | pod "redis-master" already exists\ | 07:09 |
| Kennan | don't kubenetes support pods with same name? | 07:09 |
| Kennan | for exmaple, user1 create one pod, it named pod1 | 07:10 |
| Kennan | user2 want to create one pod | 07:10 |
| Kennan | he want to nameis pod1 too | 07:10 |
| Kennan | is it reasonable ? | 07:10 |
| Kennan | +stevemar I didn't find kubernetes support UUID like | 07:11 |
| Kennan | so is it name used as ID ? | 07:11 |
| stevemar | Kennan, i have no knowledge on kubenetes, sorry :( | 07:11 |
| Kennan | ok. sorry, in wrong channel. :( | 07:12 |
| stevemar | Kennan, yeah, but you are providing me with reading material ;) | 07:12 |
| stevemar | apparently it's to manage containers, neat | 07:12 |
| stevemar | well, containerized applications* | 07:12 |
| *** rushiagr is now known as rushiagr_away | 07:16 | |
| *** omkarjoshi has quit IRC | 07:18 | |
| *** lhcheng has quit IRC | 07:20 | |
| *** ajayaa has quit IRC | 07:21 | |
| *** markvoelker has joined #openstack-keystone | 07:22 | |
| *** henrynash has joined #openstack-keystone | 07:22 | |
| *** ChanServ sets mode: +v henrynash | 07:22 | |
| *** markvoelker has quit IRC | 07:27 | |
| *** Ephur has quit IRC | 07:37 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Rename requests mock object in testing https://review.openstack.org/164568 | 07:37 |
| *** ajayaa has joined #openstack-keystone | 07:40 | |
| *** omkarjoshi has joined #openstack-keystone | 07:42 | |
| *** Bsony has joined #openstack-keystone | 07:43 | |
| *** henrynash has quit IRC | 07:45 | |
| *** chlong has quit IRC | 07:45 | |
| *** ncoghlan has quit IRC | 07:46 | |
| *** rushiagr_away is now known as rushiagr | 07:46 | |
| *** henrynash has joined #openstack-keystone | 07:46 | |
| *** ChanServ sets mode: +v henrynash | 07:46 | |
| openstackgerrit | Masaki Matsushita proposed openstack/keystone: Make max_header_line configurable https://review.openstack.org/166125 | 07:53 |
| *** jistr has joined #openstack-keystone | 07:58 | |
| *** dims has joined #openstack-keystone | 08:09 | |
| *** dims has quit IRC | 08:18 | |
| *** openstackgerrit has quit IRC | 08:22 | |
| *** openstackgerrit has joined #openstack-keystone | 08:22 | |
| *** jaosorior has joined #openstack-keystone | 08:22 | |
| *** markvoelker has joined #openstack-keystone | 08:22 | |
| *** markvoelker has quit IRC | 08:27 | |
| *** ajayaa has quit IRC | 08:28 | |
| *** lsmola has quit IRC | 08:28 | |
| *** ajayaa has joined #openstack-keystone | 08:28 | |
| *** boris-42 has quit IRC | 08:32 | |
| *** Bsony_ has joined #openstack-keystone | 08:39 | |
| *** Bsony has quit IRC | 08:40 | |
| marekd | stevemar: Good stuff with that relay_State_prefix | 08:43 |
| marekd | i didn't know that exists | 08:43 |
| stevemar | marekd, thank gyee for that | 08:43 |
| marekd | i will | 08:43 |
| marekd | but i also should thank you for quick implementation of that | 08:44 |
| *** lsmola has joined #openstack-keystone | 08:44 | |
| marekd | it's a api change, so touches everything | 08:44 |
| marekd | i will add ksc patch for that now. | 08:45 |
| stevemar | marekd, yeah, i put up the spec already, and gave morgan a heads up | 08:45 |
| *** stevemar has quit IRC | 08:54 | |
| *** omkarjoshi has quit IRC | 08:59 | |
| *** ajayaa has quit IRC | 09:02 | |
| *** krykowski has joined #openstack-keystone | 09:06 | |
| *** jamielennox|away is now known as jamielennox | 09:14 | |
| *** ajayaa has joined #openstack-keystone | 09:15 | |
| *** ishant has quit IRC | 09:15 | |
| *** markvoelker has joined #openstack-keystone | 09:23 | |
| *** ishant has joined #openstack-keystone | 09:26 | |
| *** markvoelker has quit IRC | 09:28 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add a FederatedBase v3 plugin https://review.openstack.org/163271 | 09:29 |
| *** mtreinish has quit IRC | 09:35 | |
| *** mtreinish has joined #openstack-keystone | 09:36 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Skip endpoints which is not available https://review.openstack.org/144860 | 09:42 |
| ccard | if I create a domain-specific keystone configuration for the openstack service users, for a domain called services say, do all the openstack services have to be configured to use the keystone v3 api? | 09:45 |
| *** davechen has left #openstack-keystone | 09:47 | |
| *** erkules_ is now known as erkules | 10:01 | |
| *** erkules has joined #openstack-keystone | 10:01 | |
| jamielennox | ccard: yes, you have to have v3 configured to use a services domain | 10:07 |
| jamielennox | ccard: also we aren't at the point where all the services _can_ be configured to use a services domain | 10:07 |
| *** dimsum__ has joined #openstack-keystone | 10:11 | |
| *** markvoelker has joined #openstack-keystone | 10:24 | |
| *** sluo_laptop has quit IRC | 10:26 | |
| *** markvoelker has quit IRC | 10:29 | |
| ccard | jamielennox: thanks. Which services can't be configured at the moment (in Juno)? | 10:41 |
| jamielennox | ccard: umm, most things talking to glance or swift | 10:41 |
| jamielennox | :p | 10:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 10:42 |
| jamielennox | ccard: https://trello.com/b/5qivasNp/keystone-v3 is my list, i'd love you to try and configure v3 everywhere and add whatever you find is missing | 10:42 |
| jamielennox | it's not complete, just what i'm vaguely working on | 10:42 |
| *** samueldmq has joined #openstack-keystone | 10:51 | |
| *** henrynash has quit IRC | 10:53 | |
| *** diegows has joined #openstack-keystone | 10:53 | |
| *** Ephur has joined #openstack-keystone | 10:55 | |
| ccard | jamielennox: thanks for that. It looks like putting the service users in a non-default domain is probably too risky for us at the moment. But I want to have a separate domain for end users so that we can use an LDAP backend for them. If I create a domain (called users say) for the end users, with a domain-specific configuration pointing at LDAP, should that work ok with Juno? I can see that horizon would need to be configured for the keystone v3 | 10:57 |
| ccard | api, so that end users can login, but would any other services need to be configured for v3? | 10:57 |
| jamielennox | ccard: AFAIK, if you have the service users in the default domain then you can put your actual users in another domain and it will all work | 10:58 |
| ccard | jamielennox: thanks | 10:58 |
| *** rushiagr is now known as rushiagr_away | 10:58 | |
| jamielennox | ccard: please tell me if you find this isn't the case | 10:58 |
| jamielennox | as that was my target for kilo | 10:59 |
| *** samueldmq has quit IRC | 11:07 | |
| ccard | jamielennox: will do | 11:13 |
| *** krykowski has quit IRC | 11:28 | |
| *** mestery is now known as mestery_afk | 11:45 | |
| *** fifieldt_ has joined #openstack-keystone | 11:54 | |
| *** fifieldt has quit IRC | 11:54 | |
| *** fifieldt__ has joined #openstack-keystone | 11:58 | |
| *** fifieldt_ has quit IRC | 12:00 | |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** krykowski has joined #openstack-keystone | 12:07 | |
| *** richm has joined #openstack-keystone | 12:14 | |
| *** gordc has joined #openstack-keystone | 12:27 | |
| *** bknudson has quit IRC | 12:29 | |
| *** henrynash has joined #openstack-keystone | 12:36 | |
| *** ChanServ sets mode: +v henrynash | 12:36 | |
| *** edmondsw has joined #openstack-keystone | 12:39 | |
| *** samueldmq has joined #openstack-keystone | 12:40 | |
| *** bknudson has joined #openstack-keystone | 12:54 | |
| *** ChanServ sets mode: +v bknudson | 12:54 | |
| *** henrynash has quit IRC | 12:58 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Improve feedback message in SSL error https://review.openstack.org/129769 | 13:01 |
| *** angular_mike has quit IRC | 13:03 | |
| *** krykowski has quit IRC | 13:06 | |
| *** davechen has joined #openstack-keystone | 13:07 | |
| *** mattfarina has joined #openstack-keystone | 13:10 | |
| *** samueldmq has quit IRC | 13:18 | |
| *** ishant has quit IRC | 13:19 | |
| *** ishant has joined #openstack-keystone | 13:20 | |
| *** ishant has quit IRC | 13:25 | |
| *** dimsum__ has quit IRC | 13:27 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change auth_token to use keystoneclient https://review.openstack.org/144248 | 13:30 |
| *** jamielennox is now known as jamielennox|away | 13:36 | |
| *** cucxabong has joined #openstack-keystone | 13:38 | |
| *** ljfisher has joined #openstack-keystone | 13:38 | |
| *** cucxabong has quit IRC | 13:46 | |
| *** jonxml has joined #openstack-keystone | 13:46 | |
| *** jonxml has quit IRC | 13:48 | |
| *** dimsum__ has joined #openstack-keystone | 13:51 | |
| *** raginbajin has joined #openstack-keystone | 13:55 | |
| *** tqtran has joined #openstack-keystone | 14:00 | |
| *** krykowski has joined #openstack-keystone | 14:00 | |
| *** tqtran has quit IRC | 14:01 | |
| *** csoukup has joined #openstack-keystone | 14:12 | |
| *** iamjarvo has joined #openstack-keystone | 14:14 | |
| *** ParsectiX has quit IRC | 14:18 | |
| *** mestery_afk has quit IRC | 14:19 | |
| *** tqtran has joined #openstack-keystone | 14:24 | |
| *** timcline has joined #openstack-keystone | 14:25 | |
| lbragstad | morganfainberg: when do you want to start adding release blocking reviews to dolphm's gist? | 14:29 |
| morganfainberg | lbragstad: can do it now. | 14:30 |
| morganfainberg | K3 is cut. | 14:30 |
| lbragstad | morganfainberg: ok, I'll go through and start starring rc-1 triaged stuff | 14:30 |
| morganfainberg | Sounds good. I'll be tagging things similarly, and going through your bug list. | 14:31 |
| lbragstad | morganfainberg: I tagged things as 'revisit' if I wasn't sure what to do with them | 14:32 |
| *** raildo|away has quit IRC | 14:39 | |
| *** gabrielbezerra has quit IRC | 14:40 | |
| ccard | jamielennox: I've configured a 'users' domain with an LDAP backend, and configured horizon for the v3 api and multi-domain support. | 14:41 |
| ccard | jamielennox: I can create a user and a project in the domain, and make the user a member of the project, but when I login as this user I get various Unauthorized errors when clicking on the project Compute menu items. | 14:43 |
| ccard | e.g. "Error: Unauthorized: Unable to retrieve instances" when I click on Project->Compute->Instances | 14:43 |
| *** krykowski has quit IRC | 14:43 | |
| ccard | any idea what other configuration I've missed? | 14:44 |
| *** browne has joined #openstack-keystone | 14:50 | |
| *** gabrielbezerra has joined #openstack-keystone | 14:52 | |
| *** ajayaa has quit IRC | 14:57 | |
| *** raildo has joined #openstack-keystone | 14:59 | |
| *** dimsum__ has quit IRC | 15:01 | |
| *** henrynash has joined #openstack-keystone | 15:01 | |
| *** ChanServ sets mode: +v henrynash | 15:01 | |
| lbragstad | morganfainberg: alright, I have most of what's targeted for rc1 on the gist, if it's in progress. | 15:01 |
| *** stevemar has joined #openstack-keystone | 15:02 | |
| *** ChanServ sets mode: +v stevemar | 15:02 | |
| lbragstad | morganfainberg: we'll just need to add the "revisited" bugs in launchpad to the gist if they are in progress when triaging | 15:03 |
| *** jeffDeville has joined #openstack-keystone | 15:03 | |
| *** zzzeek has joined #openstack-keystone | 15:08 | |
| *** _cjones_ has joined #openstack-keystone | 15:12 | |
| *** dimsum__ has joined #openstack-keystone | 15:14 | |
| *** mestery has joined #openstack-keystone | 15:15 | |
| *** dimsum__ has quit IRC | 15:16 | |
| jeffDeville | I'm just getting started with Keystone dev, and it looks like a lot of the specs are failing for me (~166) in both master and stable/juno. Is there something aside from git clone and ./run_tests.sh -V that I should know about? | 15:16 |
| *** openstackgerrit has quit IRC | 15:21 | |
| *** openstackgerrit has joined #openstack-keystone | 15:22 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:22 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the typo and problematic logic on ec2 signature https://review.openstack.org/143772 | 15:24 |
| stevemar | jeffDeville, i hope you mean tests - not specs :) | 15:25 |
| marekd | jeffDeville: try tox -epy27 | 15:25 |
| stevemar | jeffDeville, ^^ yeah, try using tox, avoid run_tests.sh, we're trying to kill it with fire | 15:26 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the typo and problematic logic on ec2 signature https://review.openstack.org/143772 | 15:26 |
| jeffDeville | Thanks stevemar:, marekd. Trying that now. | 15:28 |
| marekd | jeffDeville: you have couple of switches you may want to use (all of them with -e opton): py27, pep8, docs, cover | 15:28 |
| marekd | stevemar: should all responses for Service Providers be formatted that there is column "Auth URL" instead of "auth_url" ? | 15:29 |
| *** ayoung has quit IRC | 15:30 | |
| stevemar | i'd be cool with that, in the columns header you can put ("Auth URL") | 15:31 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the typo and problematic logic on ec2 signature https://review.openstack.org/143772 | 15:31 |
| stevemar | marekd, OSC is smart enough to ignore case and underscores | 15:31 |
| marekd | stevemar: uh | 15:31 |
| marekd | so i am not going to complicate life then. | 15:32 |
| marekd | stevemar: re: https://review.openstack.org/#/c/166078 if the shib has prefix set to '' than it looks like this is non-default setting and idp admins should reflect this change. | 15:33 |
| marekd | anyway, i am not sure who is actually in chage of this parameter : idp or sp | 15:33 |
| marekd | maybe it should be us (IdP) who say: hey, world, our asserion use this relay_state prefix | 15:33 |
| marekd | pity Guang is not here. | 15:34 |
| stevemar | marekd, we write it here: http://docs.openstack.org/developer/keystone/extensions/shibboleth.html | 15:34 |
| *** nellysmitt has joined #openstack-keystone | 15:35 | |
| *** davechen has left #openstack-keystone | 15:36 | |
| *** dimsum__ has joined #openstack-keystone | 15:37 | |
| marekd | but this is a config for Service Provider setup. | 15:37 |
| marekd | and it's per IdP | 15:37 |
| marekd | so my question is who should dictate the value, idp or sp ? | 15:37 |
| *** thedodd has joined #openstack-keystone | 15:37 | |
| *** lsmola has quit IRC | 15:38 | |
| marekd | stevemar: this would ease the change very much (one extra parameter in the CONF.saml2/CONF.federation) | 15:39 |
| stevemar | i thougth that too | 15:39 |
| stevemar | i am not sure | 15:40 |
| marekd | what/who made you think the other way round? :-) | 15:40 |
| stevemar | marekd, gyee made me do it! | 15:40 |
| stevemar | we figured it was set on a per-sp basis | 15:40 |
| stevemar | and one idp can have many SPs | 15:40 |
| marekd | stevemar: i recall a convo with morganfainberg and topol where they I was arguing that "I implemented it because gyee said he liked that feature" :D | 15:41 |
| stevemar | gyee - subtly convincing us to do things | 15:41 |
| marekd | hehe | 15:41 |
| *** mflobo has left #openstack-keystone | 15:44 | |
| *** browne has quit IRC | 15:46 | |
| *** lsmola has joined #openstack-keystone | 15:48 | |
| marekd | stevemar: yeah, one idp can have multiple SPs but each SP can configure relay_State per trusted IdP. | 15:48 |
| marekd | and I think it's the idp who builds the assertion | 15:49 |
| jeffDeville | Issuing SSL Certificate ... | 15:49 |
| jeffDeville | Using configuration from signing.conf | 15:49 |
| jeffDeville | default is an unsupported message digest type | 15:49 |
| jeffDeville | 8999:error:02001002:system library:fopen:No such file or directory:/SourceCache/OpenSSL098/OpenSSL098-52.10.1/src/crypto/bio/bss_file.c:126:fopen('./index.txt.attr','rb') | 15:49 |
| jeffDeville | 8999:error:2006D080:BIO routines:BIO_new_file:no such file:/SourceCache/OpenSSL098/OpenSSL098-52.10.1/src/crypto/bio/bss_file.c:129: | 15:49 |
| jeffDeville | 8999:error:0E078072:configuration file routines:DEF_LOAD:no such file:/SourceCache/OpenSSL098/OpenSSL098-52.10.1/src/crypto/conf/conf_def.c:197: | 15:49 |
| stevemar | marekd, it would also make my life easier | 15:49 |
| jeffDeville | Failed! rc=1 | 15:49 |
| jeffDeville | Bailing ... | 15:49 |
| jeffDeville | marekd: & stevemar: I got a similar number of errors with tox. Dug a bit deeper and it looks like it might be pki related. So I ran gen_pki.sh, which died here ^ | 15:49 |
| marekd | jeffDeville: which os ? | 15:50 |
| jeffDeville | osx yosemite | 15:50 |
| *** _cjones_ has quit IRC | 15:52 | |
| *** _cjones_ has joined #openstack-keystone | 15:52 | |
| marekd | jeffDeville: heard rumours that keystone doesn't work on osx. | 15:54 |
| stevemar | marekd, jeffDeville osx is definitely not supported :) it'll work for *most* things | 15:56 |
| jeffDeville | Mmmm... that's a shame. :-) Ok, what dev os would you recommend? | 15:56 |
| marekd | ubuntu | 15:56 |
| stevemar | jeffDeville, ubuntu! | 15:56 |
| marekd | jeffDeville: i have it running on Debian too | 15:56 |
| stevemar | jeffDeville, maybe dolphm or lbragstad can help you? | 15:56 |
| marekd | some RedHat folks will have Fedora up and running. | 15:56 |
| stevemar | they are our resident OSXers | 15:56 |
| * marekd wants to have Mact too | 15:57 | |
| bknudson | whatever system I was using I'd just set up an ubuntu vm. | 15:57 |
| stevemar | marekd, i'll keep my brick | 15:57 |
| * marekd has grown up and doesn't have more time to play with his configuration | 15:57 | |
| jeffDeville | Aight. Thanks guys. I guess I'll head that direction after I try recompiling openssl w/ cms support | 15:57 |
| dolphm | jeffDeville: the version of openssl bundled with OS X is far too old | 15:57 |
| lbragstad | jeffDeville: I'm currently doing most of my things on debian or ubuntu with vagrant or a cloud server. | 15:58 |
| marekd | dolphm: do they patch it? | 15:58 |
| bknudson | I hope they patch it!! | 15:58 |
| dolphm | jeffDeville: brew install openssl ( http://brew.sh/ ) | 15:58 |
| dolphm | marekd: bknudson: when they feel like it? | 15:58 |
| lbragstad | lol | 15:58 |
| jeffDeville | dolphm: that's what I'm using. But apparently cms is not enabled by default anymore | 15:58 |
| bknudson | considering the security problems in openssl they better be patching it frequently. | 15:59 |
| marekd | dolphm: you are using tox on OSS or using some VM ? | 15:59 |
| marekd | OSX | 15:59 |
| dolphm | marekd: debian wheezy | 15:59 |
| lbragstad | marekd: I tried tox on OSX once... it blew up and I wasn't feeling ambitious enough to figure out why, | 16:00 |
| marekd | dolphm: why OSX btw? prefer it for daily tasks? | 16:00 |
| lbragstad | marekd: but it blows up on the python2.7 environment, not pep8 | 16:00 |
| bknudson | marekd: he's also got the watch. | 16:01 |
| marekd | lbragstad: it must be sad to spend whole days working on a VM :P so much of CPU is wasted locally :P | 16:01 |
| bknudson | iwatch | 16:01 |
| marekd | bknudson: dolph? | 16:01 |
| bknudson | wears a black turtleneck everywhere. | 16:01 |
| *** iamjarvo has quit IRC | 16:01 | |
| marekd | i am far beyond all those tech toys :( | 16:02 |
| dolphm | marekd: it's the most reliable and least fussy OS i've tried for desktop use | 16:02 |
| lbragstad | marekd: ++, expect when you hose your dev environment and your thankful it wasn't hosted locally ;) | 16:02 |
| *** dimsum__ has quit IRC | 16:02 | |
| lbragstad | s/expect/except/ | 16:02 |
| lbragstad | *cough* dolphm *cough* | 16:03 |
| marekd | hose? | 16:03 |
| dolphm | marekd: break | 16:03 |
| marekd | dolphm: thanks | 16:03 |
| lbragstad | hose == screw up beyond repair | 16:03 |
| dolphm | marekd: i ran dist-upgrade on my dev box to downgrade from debian testing to debian stable, and it didn't go so well. | 16:04 |
| dolphm | marekd: quickest solution from there was to delete the vm and build a new oen | 16:04 |
| marekd | i sometimes need to run dist-upgrade on my laptop, imagine my fear then. | 16:04 |
| lbragstad | haha | 16:04 |
| marekd | as much as i like (and i am used to) tiling managers, i think i will try osx one day. | 16:05 |
| bknudson | can a region's ID be changed through modify? | 16:05 |
| *** lsmola has quit IRC | 16:05 | |
| lbragstad | marekd: what do you use? | 16:05 |
| marekd | debian testing. | 16:05 |
| marekd | well, i have 3 machines. one is ubuntu lts, and two are debian testing. | 16:06 |
| dolphm | bknudson: i don't think so | 16:06 |
| marekd | my VMs are usually ubuntus, as they are purely for devstack and stuff thing. | 16:06 |
| lbragstad | marekd: gotcha | 16:06 |
| bknudson | I'll give it a shot but doesn't seem like it since it's the id. | 16:06 |
| lbragstad | bknudson: and that's specified on the URL, right? | 16:06 |
| lbragstad | bknudson: or it can be | 16:07 |
| bknudson | http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#update-region | 16:07 |
| bknudson | y, it's in the URL. | 16:07 |
| *** _cjones_ has quit IRC | 16:09 | |
| *** _cjones_ has joined #openstack-keystone | 16:10 | |
| bknudson | when you create a region using POST /regions, it's given a random region name? | 16:13 |
| bknudson | that seems weird. | 16:13 |
| morganfainberg | sooooo hi all! | 16:14 |
| *** ayoung has joined #openstack-keystone | 16:15 | |
| *** ChanServ sets mode: +v ayoung | 16:15 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:17 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:20 | |
| stevemar | bknudson, i regions have names? | 16:21 |
| bknudson | stevemar: the ID is displayed everywhere. | 16:22 |
| bknudson | as the name. | 16:22 |
| bknudson | since you need to call it something. | 16:22 |
| *** dimsum__ has joined #openstack-keystone | 16:23 | |
| *** jeffDeville has quit IRC | 16:23 | |
| openstackgerrit | Mark T. Voelker proposed openstack/keystone: Specify time units for default_lock_timeout https://review.openstack.org/166304 | 16:23 |
| openstackgerrit | Mark T. Voelker proposed openstack/keystone: Specify time units for default_lock_timeout https://review.openstack.org/166304 | 16:25 |
| ayoung | stevemar, you sure we dont need a chat room specific to olso policy? Heh | 16:31 |
| stevemar | ayoung, we could use -oslo :) | 16:31 |
| ayoung | stevemar, anyway, I think I'm good. | 16:31 |
| stevemar | glad to hear | 16:31 |
| openstackgerrit | Mark T. Voelker proposed openstack/keystone: Specify time units for default_lock_timeout https://review.openstack.org/166304 | 16:32 |
| ayoung | The check I'm wokring on will make sure that if the domain id matches, it is the same for any of the fields that potentially can match | 16:32 |
| *** browne has joined #openstack-keystone | 16:35 | |
| *** ayoung has quit IRC | 16:37 | |
| *** ljfisher has quit IRC | 16:37 | |
| *** jeffDeville has joined #openstack-keystone | 16:40 | |
| *** EmilienM is now known as EmilienM|afk | 16:41 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Refactor: extract and rename unique_id method https://review.openstack.org/162766 | 16:42 |
| openstackgerrit | David Stanek proposed openstack/keystone: Simplify injection testcase setup https://review.openstack.org/162767 | 16:42 |
| openstackgerrit | David Stanek proposed openstack/keystone: Isolate injection tests https://review.openstack.org/162768 | 16:42 |
| *** lhcheng has joined #openstack-keystone | 16:45 | |
| *** iamjarvo has joined #openstack-keystone | 16:48 | |
| morganfainberg | stevemar, bleh. phone... bleh | 16:49 |
| *** david-lyle_ has joined #openstack-keystone | 16:50 | |
| *** david-lyle_ has quit IRC | 16:51 | |
| *** harlowja_away is now known as harlowja_ | 16:51 | |
| stevemar | morganfainberg, :( | 16:52 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:53 | |
| morganfainberg | stevemar, uhh | 16:57 |
| morganfainberg | stevemar, sorry https://review.openstack.org/#/c/166010/ -2 | 16:57 |
| morganfainberg | stevemar, i missed that one. | 16:57 |
| morganfainberg | stevemar, oh this was proposed post FF | 16:59 |
| rodrigods | henrynash, replied your comment in https://review.openstack.org/#/c/159944/ | 17:01 |
| *** _cjones_ has quit IRC | 17:06 | |
| stevemar | morganfainberg, oops | 17:08 |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| morganfainberg | stevemar, all good. i caught it with the -2 | 17:13 |
| morganfainberg | it wont merge | 17:13 |
| *** jistr has quit IRC | 17:19 | |
| *** openstackgerrit has quit IRC | 17:21 | |
| *** openstackgerrit has joined #openstack-keystone | 17:21 | |
| *** jeffDeville has quit IRC | 17:25 | |
| *** Bsony_ has quit IRC | 17:25 | |
| *** jeffDeville has joined #openstack-keystone | 17:25 | |
| *** ljfisher has joined #openstack-keystone | 17:27 | |
| *** gyee has joined #openstack-keystone | 17:27 | |
| *** ChanServ sets mode: +v gyee | 17:27 | |
| morganfainberg | lbragstad, https://bugs.launchpad.net/keystone/+bug/1433311 this is not wishlist | 17:33 |
| openstack | Launchpad bug 1433311 in Keystone "Fernet tokens current don't support token bind" [Medium,Triaged] | 17:33 |
| morganfainberg | lbragstad, this is much higher priority as token binding is a current feature of other tokens. | 17:33 |
| morganfainberg | lbragstad, and is an RC bug | 17:33 |
| *** nellysmitt has quit IRC | 17:37 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Add parent_id to GET /projects https://review.openstack.org/166326 | 17:39 |
| rodrigods | morganfainberg, noticed an API bug ^ | 17:39 |
| rodrigods | morganfainberg, it was also missing the tests: https://review.openstack.org/#/c/158314/ | 17:40 |
| *** jbonjean has joined #openstack-keystone | 17:42 | |
| marekd | gyee: you here? | 17:46 |
| gyee | marekd, yes sir | 17:47 |
| marekd | gyee: wanted to ask about https://review.openstack.org/#/c/166078/2 | 17:47 |
| marekd | and my last comment there | 17:47 |
| stevemar | gordc, is there a reason why the audit events are 'audit.http.request' now instead of 'http.request' cc edmondsw | 17:47 |
| stevemar | looks like they were renamed here: https://review.openstack.org/#/c/102958/21/keystonemiddleware/audit.py | 17:48 |
| gyee | marked, service_providers is utilized by IdP keystone only | 17:48 |
| gyee | IdP Keystone needs to know how to generated the ECP wrap | 17:49 |
| marekd | gyee: yes, but what does it change? | 17:49 |
| gyee | marekd, yes, each SP could configure relaystate differently | 17:49 |
| marekd | gyee: the question is whether they should conform, or us (IdP) | 17:49 |
| *** ayoung has joined #openstack-keystone | 17:49 | |
| *** ChanServ sets mode: +v ayoung | 17:49 | |
| morganfainberg | gyee, i also need to ask if this could break a websso workflow with a browser? | 17:49 |
| morganfainberg | gyee, if the SAML is *always* ECP wrapped | 17:50 |
| marekd | morganfainberg: nt always | 17:50 |
| marekd | not always | 17:50 |
| gyee | morganfainberg, no, afaik ecp is for non web browsers | 17:50 |
| marekd | morganfainberg: and it's k2k case here. | 17:50 |
| morganfainberg | marekd, but that is what gyee is proposing, k2k always issues ecp wrapped saml | 17:50 |
| morganfainberg | is there ever a desire to use a web browser | 17:50 |
| gyee | morganfainberg, no always, its a new API | 17:50 |
| morganfainberg | would there ever be | 17:50 |
| marekd | morganfainberg: yes, not always. | 17:50 |
| morganfainberg | gyee, oh separate from the current API? | 17:51 |
| gyee | existing client can still do the wrapping themselves | 17:51 |
| marekd | morganfainberg: /auth/OS-FEDERATION/saml2 and /auth/OS-FEDERATION/saml2/ecp | 17:51 |
| morganfainberg | oh | 17:51 |
| morganfainberg | marekd, ahh | 17:51 |
| gyee | what he said | 17:51 |
| marekd | morganfainberg: but still, it's k2k so we are not breaking ourselves wrt websso | 17:51 |
| morganfainberg | right | 17:51 |
| dstanek | fyi. i started working on this yesterday: https://github.com/dstanek/vim-gertty | 17:52 |
| gyee | marekd, we should not constraint what SP can or cann't do | 17:52 |
| gyee | we should offer flexibility | 17:52 |
| marekd | gyee: ok, let's make it flexible but be hard in negotiations (actually this is a part for admins who will be configuring it :P) | 17:53 |
| marekd | stevemar: ^^ | 17:53 |
| gyee | marekd, right, but its a one time setup | 17:53 |
| edmondsw | gordc, ceilometer/middleware.py is hardcoding "http.request" but keystonemiddleware/audit.py is hardcoding "audit.http.request"... mismatch | 17:53 |
| marekd | stevemar: ok, so i think we should resolve whether relay_state_prefix should be nullable or not. I think not. | 17:54 |
| marekd | gyee: ^^ | 17:54 |
| stevemar | probably not | 17:54 |
| gyee | marekd, I would agree, but its really a data migration trade-off | 17:55 |
| marekd | gyee: so lets add a default version | 17:55 |
| gyee | since stevemar have a default there, I am fine with it being nullable | 17:55 |
| marekd | in the backend not in the controller. | 17:55 |
| gyee | marekd, right, default means data migration | 17:55 |
| gyee | or adding new data or oppose to just schema | 17:55 |
| gyee | so its a design tradeoff | 17:56 |
| gyee | I am fine either way | 17:56 |
| gordc | edmondsw: i know. the payloads are actually different ie. it's full CADF in audit.http* and it's embedded (and possibly non-existent) in http.* | 17:58 |
| *** Bsony has joined #openstack-keystone | 17:58 | |
| gyee | memo to stevemar, if by making it not nullable make marekd a happier man, I would do it in a heartbeat :) | 17:59 |
| stevemar | gordc, but it was full CADF before, and on http.* (when a part of pycadf.audit) | 18:03 |
| *** c_soukup has joined #openstack-keystone | 18:03 | |
| stevemar | gyee, sure, i'll make the change, just busy atm | 18:05 |
| gordc | no. the payload was a random mismatch of environment variables...and then it might or might not have contained CADF (depending if you were using oslo.messaging notifier middleware or pycadfs audit middleware. | 18:05 |
| gyee | stevemar, thanks | 18:06 |
| *** csoukup has quit IRC | 18:06 | |
| gyee | lets figure out how to get shibd into one of them gates | 18:06 |
| marekd | gyee: what do you mean? | 18:07 |
| *** spandhe has joined #openstack-keystone | 18:09 | |
| gyee | marekd, I mean is shibboleth part of some jenkins gate? | 18:10 |
| dstanek | gyee: i started down a path to setup shib stuff for functional tests | 18:12 |
| gyee | dstanek, nice! | 18:12 |
| gyee | we can add ecp tests once we get it working | 18:12 |
| dstanek | gyee: that's what all of that devstack script junk is about | 18:12 |
| dstanek | gyee: are you planning on writing ecp tests? or are you saying that someone should? | 18:13 |
| gyee | someone would | 18:13 |
| dstanek | gyee: i was going to say that you didn't have to wait :-) | 18:14 |
| gyee | I'll have one of guys here do it if I don't have time to get to it | 18:14 |
| gyee | oh | 18:14 |
| gyee | dstanek, you added to devstack already? | 18:14 |
| dstanek | gyee: no, but if you have a federated installation you could run tests against it | 18:15 |
| dstanek | all of the devstack stuff is still in review and i think still has a few problems | 18:15 |
| gyee | yes, I have a devstack installation with shibd configured | 18:15 |
| dstanek | gyee: if you have someone to write the tests just let me know and i'll help them with where/how | 18:16 |
| dstanek | it'd be nice to get that stuff moving and get coverage | 18:17 |
| gyee | dstanek, sure, I'll have my cousin get in touch with your cousin | 18:17 |
| dstanek | sounds like a plan :-P | 18:17 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Distinguish between unset and empty black and white lists https://review.openstack.org/164798 | 18:19 |
| dstanek | gyee: once we get a little further with a couple of things we should be able to get our devstack scripts running in a gate. i ran it by some QA folks and they seemed to think that it was a good idea. | 18:19 |
| bknudson | what's not moving? | 18:19 |
| gyee | excellent! | 18:19 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Distinguish between unset and empty black and white lists https://review.openstack.org/164798 | 18:19 |
| gyee | dstanek, how's your bracket btw, 2 #3s went down on the first day, unreal! | 18:20 |
| dstanek | gyee: i'm too busy for that! | 18:21 |
| marekd | dstanek: actually, your functional tests are still WIP, aren't they ? | 18:21 |
| dstanek | marekd: the devstack configuration is for sure | 18:21 |
| marekd | dstanek: federation/saml ? | 18:21 |
| dstanek | marekd: i was thinking that since all the federation people will be in the same place at he summit that i can use your collective help to fix some configuration isues | 18:22 |
| marekd | i wanted to review some of those patches but they seemed to be slightly put aside. | 18:22 |
| marekd | dstanek: sure | 18:22 |
| stevemar | dstanek, we can create a brain trust | 18:22 |
| dstanek | there is one at the beginning of the chain that i need to fix a -1 on and then a few will be ready to merge. | 18:23 |
| dstanek | i have no revisited the devstack scripts in probably a month | 18:24 |
| edmondsw | gordc, so is ceilometer/middleware.py meant to be deprecated now? Since that is hardcoded to go with http.request, which comes from pycadf's audit middleware, which is deprecated... | 18:24 |
| *** omkarjoshi has joined #openstack-keystone | 18:27 | |
| *** iurygregory has joined #openstack-keystone | 18:27 | |
| dstanek | anyone have an opinion on the import comments from bknudson on https://review.openstack.org/#/c/158466/2/keystone/tests/functional/shared/test_running.py ? | 18:27 |
| dstanek | i left it in there in case people where not familiar with what Python does when you 'import x.y.z' | 18:28 |
| *** omkarjoshi has quit IRC | 18:28 | |
| bknudson | dstanek: stevemar changed a similar extra import somewhere. | 18:28 |
| dstanek | bknudson: removed it? | 18:28 |
| dstanek | i'm totally fine doing that | 18:29 |
| marekd | dstanek: "My mind is broken. This should be renamed because it isn't broken anymore." | 18:29 |
| dstanek | i'll fix up the patch | 18:29 |
| bknudson | dstanek: yes, removed the extra import. | 18:29 |
| gyee | heh | 18:29 |
| gyee | nothing broken | 18:29 |
| *** omkarjoshi has joined #openstack-keystone | 18:29 | |
| marekd | gyee: ++ | 18:29 |
| stevemar | bknudson, dstanek i remove them because i don't like the warning that eclipse shows :P | 18:29 |
| gordc | edmondsw: that will probably be deprecated in Liberty. we're starting to force events to be stored as events rather than meters/samples. | 18:29 |
| bknudson | y, eclipse shows a warning. | 18:29 |
| dstanek | marekd: that too | 18:29 |
| stevemar | gyee, marekd did we agree that the prefix stays in SPs as a property, or as a config option for idp? | 18:29 |
| bknudson | stevemar: there's some ldap ones you could clean up if you felt like it. | 18:29 |
| stevemar | bknudson, where at? | 18:30 |
| marekd | stevemar: service_provider attribute | 18:30 |
| bknudson | stevemar: ldap parts. | 18:30 |
| edmondsw | gordc, why not go ahead and deprecate it if it only works with something that is already deprecated? | 18:30 |
| gyee | stevemar, if you make it not nullible and fill it with the default | 18:30 |
| edmondsw | gordc, and is there any documentation you can point me to on how all this has changed to use events, audit.http.request, etc.? | 18:31 |
| gordc | edmondsw: that was part of what i mentioned above, the http.* 'meters' weren't only coming from audit middleware but also notifier middleware in oslo.messaging... | 18:31 |
| gordc | the original audit middleware was piggybacking off something else because of resistence to CADF adoption | 18:31 |
| edmondsw | gordc, guess I don't follow that part | 18:32 |
| iurygregory | dtroyer, Hello Dean, can you please take a look in this patch https://review.openstack.org/132083 ? | 18:35 |
| *** dougwig has quit IRC | 18:39 | |
| gordc | edmondsw: sorry, had a call. basically when i made the middleware a year+ ago, i couldnt' get support for it as a standalone, but i was able to embed the CADF audit data into another middleware. | 18:44 |
| gordc | which is why you'll noticed a bunch of junk associated with the http.* 'meter | 18:44 |
| gordc | you can look at how to use events here: http://docs.openstack.org/admin-guide-cloud/content/section_telemetry-events.html | 18:45 |
| edmondsw | gordc, so why are those pieces getting deprecated piecemeal instead of together? | 18:45 |
| edmondsw | gordc, tx for the link | 18:46 |
| gordc | we added a bit more features in kilo, but basic support is available in juno (icehouse if using sql) | 18:46 |
| gordc | edmondsw: tbh, i'm not sure who uses the oslo.messaging version of middleware (which also outpus http.* meters)... i think it was a requirement from another company. | 18:47 |
| edmondsw | gordc, for a product that was using meters and then upgrades to kilo and switches to events... is there a way to migrate the old data to events? | 18:49 |
| gordc | edmondsw: i was going to do that but i didn't get that far. you'll still be able to get them as meters in L cycles... i believe the plan was to turn them off by default in L and possibly remove the logic which builds meters in M or N. | 18:52 |
| *** _cjones_ has quit IRC | 18:52 | |
| *** _cjones_ has joined #openstack-keystone | 18:54 | |
| edmondsw | gordc, you mean I should stick with using the pycadf middleware, even though it's deprecated? | 18:55 |
| *** jeffDeville has quit IRC | 18:56 | |
| gordc | edmondsw: you could. alternatively you can just switch over and let ttl expire away the difference, or wait for my migration tool, | 18:57 |
| gordc | edmondsw: is it just the resource_metadata that you're working with? | 18:58 |
| edmondsw | gordc yes | 18:59 |
| gordc | edmondsw: kk. | 19:02 |
| *** tqtran is now known as tqtran_afk | 19:04 | |
| *** EmilienM|afk is now known as EmilienM | 19:10 | |
| *** _cjones_ has quit IRC | 19:15 | |
| *** omkarjoshi has quit IRC | 19:17 | |
| *** _cjones_ has joined #openstack-keystone | 19:17 | |
| iurygregory | dtroyer, in this patch there is a pending question for you | 19:25 |
| *** omkarjoshi has joined #openstack-keystone | 19:43 | |
| *** _cjones_ has quit IRC | 19:44 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 19:44 |
| openstackgerrit | James Page proposed openstack/keystone: Deal with PEP-0476 certificate chaining checking https://review.openstack.org/144988 | 19:56 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone: Change domain_id FK in project table https://review.openstack.org/166354 | 19:56 |
| nkinder | stevemar: you around for a websso question? | 20:01 |
| stevemar | nkinder, yessum | 20:02 |
| stevemar | nkinder, what do i know that you don't?! | 20:02 |
| *** c_soukup has quit IRC | 20:02 | |
| nkinder | stevemar: when I hit /v3/OS-FEDERATION/websso/saml2, it does the redirect dnace and the assertion comes back... | 20:02 |
| nkinder | stevemar: it's trying to find the IdP by the value in remote_id_attribute from the assertion | 20:02 |
| nkinder | ...but it fails | 20:03 |
| nkinder | stevemar: let me get you a pastebin | 20:03 |
| *** csoukup has joined #openstack-keystone | 20:04 | |
| stevemar | nkinder, okie | 20:04 |
| stevemar | the value for the remote_id_attribute (X-Shib-Name or whatever it is) should return the IdP ID | 20:05 |
| nkinder | stevemar: http://paste.openstack.org/show/194025/ | 20:06 |
| nkinder | The error message that I get back shows that it's pulling the IdP ID out of the assertion properly (MELLON_IDP in my case) | 20:06 |
| nkinder | Is it supposed to be the IdP ID, or the remote ID? | 20:07 |
| stevemar | whats the value of MELLON_IDP? | 20:07 |
| nkinder | stevemar: https://ipa.rdodom.test/idp/saml2/metadata | 20:08 |
| stevemar | 404'ed | 20:08 |
| stevemar | rather, DNS lookup failed for host | 20:09 |
| stevemar | i think it's on your intranet? | 20:09 |
| nkinder | stevemar: yeah, it's a totally private VM network | 20:09 |
| nkinder | that URL is my MELLON_IDP value | 20:09 |
| nkinder | I didn't mean for you to try to follow the link :P | 20:10 |
| stevemar | oh lol | 20:10 |
| stevemar | haha | 20:10 |
| *** Bsony has quit IRC | 20:10 | |
| stevemar | right, so we need to find the idp ID right | 20:10 |
| stevemar | which typically won't be in the env. | 20:10 |
| stevemar | since it's user defined | 20:10 |
| stevemar | thats why i had that note in the steps i was writing up | 20:10 |
| nkinder | So I thought we take the value of the remote_id_attribute, then do a lookup in Keystone by "remote_id" for a match | 20:11 |
| stevemar | nkinder, step 4 here: http://docs-draft.openstack.org/12/164012/7/check/gate-keystone-docs/d30fec1//doc/build/html/extensions/websso.html | 20:11 |
| *** Bsony has joined #openstack-keystone | 20:11 | |
| stevemar | i was just thinking that maybe we should be doing that... | 20:11 |
| stevemar | but what if more than 1 idp returns back | 20:11 |
| stevemar | nkinder, the big NOTE thing | 20:12 |
| nkinder | stevemar: yeah, I'm doing that (aren't I?) | 20:12 |
| stevemar | ah sh*t, i meant to keep it as the `ID of the IdP` not the `remote ID of the IdP` | 20:12 |
| nkinder | ah | 20:13 |
| *** dougwig has joined #openstack-keystone | 20:13 | |
| stevemar | if you change `ipsilon` to `https://ipa.rdodom.test/idp/saml2/metadata` as the IdP id, then i'll work... | 20:13 |
| nkinder | well, that's going to make for a horrible looking URL | 20:13 |
| stevemar | ugh you are right | 20:13 |
| nkinder | a url-escaped full URL in the normal federation auth URL | 20:13 |
| stevemar | ughhhhhhh | 20:14 |
| *** timcline has quit IRC | 20:14 | |
| stevemar | i didn't realize they were url escaped | 20:14 |
| nkinder | that's why I was hoping it would lookup by remote id | 20:14 |
| stevemar | nkinder, that's a quick fix, thankfully | 20:14 |
| stevemar | *now* i see why marco and marekd wanted to make those unique | 20:14 |
| nkinder | after all, we are taking the "remote_id_attribute", which logically should be looking up the "remote_id" | 20:14 |
| nkinder | it seems strange to compare the value of "remote_id_attribute" to the "id" | 20:15 |
| stevemar | nkinder, you are right | 20:15 |
| stevemar | we can do a query on all IdP entries to look for that remote_id_attribute and return the distinct idp id | 20:15 |
| stevemar | nkinder, file a bug? :D | 20:16 |
| nkinder | stevemar: sure, coming right up... | 20:16 |
| stevemar | nkinder, can you work around that part of the code for now? i assume you are testing something out | 20:16 |
| stevemar | just hardcode 'ipsilon' or something as the idp id? | 20:17 |
| nkinder | stevemar: I'll need to see what's possible on the IdP side there | 20:17 |
| stevemar | nkinder, also, i noticed that your trusted_dashboard value is just the hostname, it should be: trusted_dashboard = http://acme.horizon.com/auth/websso | 20:17 |
| stevemar | or i need to make the check smarter to parse for the hostname | 20:17 |
| nkinder | stevemar: I don't even really have the dashboard set up yet :) | 20:17 |
| stevemar | ah okay cool | 20:18 |
| nkinder | that's the next step | 20:18 |
| nkinder | stevemar: https://bugs.launchpad.net/keystone/+bug/1434701 | 20:27 |
| openstack | Launchpad bug 1434701 in Keystone "websso should compare remote_id_attribute to remote_id of IdP" [Undecided,New] | 20:27 |
| nkinder | richm: ^^^ you're probably interested too | 20:27 |
| richm | You are subscribed to all notifications for this bug. | 20:28 |
| richm | I am | 20:28 |
| *** ccard_ has quit IRC | 20:32 | |
| *** ccard_ has joined #openstack-keystone | 20:33 | |
| *** tqtran_afk is now known as tqtran | 20:33 | |
| *** gabrielbezerra has quit IRC | 20:34 | |
| *** tellesnobrega has quit IRC | 20:34 | |
| *** htruta has quit IRC | 20:34 | |
| *** raildo has quit IRC | 20:35 | |
| *** iurygregory has quit IRC | 20:35 | |
| *** ccard__ has joined #openstack-keystone | 20:41 | |
| *** iurygregory has joined #openstack-keystone | 20:43 | |
| *** ccard_ has quit IRC | 20:44 | |
| *** htruta has joined #openstack-keystone | 20:44 | |
| *** gabrielbezerra has joined #openstack-keystone | 20:44 | |
| *** _cjones_ has joined #openstack-keystone | 20:44 | |
| *** raildo has joined #openstack-keystone | 20:45 | |
| *** tellesnobrega has joined #openstack-keystone | 20:45 | |
| *** timcline has joined #openstack-keystone | 20:46 | |
| *** ccard_ has joined #openstack-keystone | 20:47 | |
| *** ccard__ has quit IRC | 20:48 | |
| stevemar | ayoung is the first talk of the conference :P | 20:50 |
| rodrigods | stevemar, results already online? | 20:51 |
| raildo | https://www.openstack.org/summit/vancouver-2015/schedule/ | 20:51 |
| stevemar | yep | 20:51 |
| *** jaosorior has quit IRC | 20:52 | |
| dimsum__ | yay for ayoung! | 20:53 |
| raildo | I want to see this talk: http://sched.co/2qcc :) | 20:54 |
| rodrigods | raildo, \o/ | 20:54 |
| raildo | 1 PTL , 3 keystone cores and rodrigods \o/ | 20:55 |
| rodrigods | ¬¬ | 20:55 |
| stevemar | raildo, that'll be a great talk ;) | 20:57 |
| david-lyle | My favorite talk title so far, "The OpenStack Summit talk selection process is broken" | 20:57 |
| *** ljfisher has quit IRC | 20:57 | |
| raildo | david-lyle, ++ haha | 20:58 |
| *** csoukup has quit IRC | 20:58 | |
| *** _cjones_ has quit IRC | 21:02 | |
| *** lhcheng_ has joined #openstack-keystone | 21:03 | |
| stevemar | david-lyle, "lets submit 100000000 talks" | 21:03 |
| *** raildo has quit IRC | 21:04 | |
| *** _cjones_ has joined #openstack-keystone | 21:05 | |
| *** lhcheng has quit IRC | 21:06 | |
| ayoung | So I guess my talk got approved | 21:07 |
| ayoung | nkinder, first talk of the conference. So it won't conflict with the development track. That is convenient | 21:08 |
| bknudson | I think half the talks are on docker. | 21:08 |
| ayoung | Dawkah! | 21:08 |
| ayoung | Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah!Dawkah! | 21:08 |
| *** lhcheng_ is now known as lhcheng | 21:11 | |
| stevemar | dock dock dock | 21:14 |
| ayoung | I like the trend, at least in Keystone, of tyhe core presenting to the less technical audiences. | 21:14 |
| *** mattfarina has quit IRC | 21:15 | |
| stevemar | ayoung, i don't know how we started that but i'm also happy about it | 21:15 |
| stevemar | it ensures the message is correct, and it lets us branch out a bit | 21:15 |
| *** timcline has quit IRC | 21:15 | |
| ayoung | stevemar, I think it has something to do with Nate Kinder pretty much being the security group | 21:15 |
| nkinder | ayoung: I wasn't on the selection board this time around | 21:16 |
| ayoung | And these all being somewhat security related | 21:16 |
| ayoung | nkinder, oh no? | 21:16 |
| ayoung | I know bpayne contacted me about the policy one | 21:16 |
| nkinder | nope, so you made it in on your own :) | 21:16 |
| nkinder | I think a lot of people want to know more about policy | 21:16 |
| nkinder | stevemar: I cobbled together a patch to search for the IdP by remote_id | 21:16 |
| ayoung | he want an update on policy for the deployment guide. | 21:16 |
| stevemar | nkinder, you are my hero | 21:17 |
| nkinder | stevemar: I have the keystone side of websso working now with mod_mellon | 21:17 |
| nkinder | stevemar: needs some cleanup, but maybe I'll get a WIP posted so you can let me know if I'm going about it the right way | 21:17 |
| stevemar | nkinder, fyi the websso parts are probably not going to land in horizon :( | 21:17 |
| stevemar | theres some push back there | 21:17 |
| stevemar | and it makes me sad | 21:17 |
| ayoung | stevemar, I want to +2 the ecp changes, but It realluy should get gyees' blessing first | 21:17 |
| stevemar | ayoung, i thought we're waiting til after rc1 officially? | 21:18 |
| stevemar | errr,... til rc1 *starts* | 21:18 |
| nkinder | stevemar: that makes me sad... | 21:18 |
| ayoung | stevemar, that , too | 21:19 |
| stevemar | nkinder, make your case to david-lyle, i made mine (i think he's still mulling it over) | 21:19 |
| stevemar | nkinder, i really don't want CERN using a fork for this, and i really don't want RH to have to manage a fork of it either, or something else | 21:20 |
| david-lyle | stevemar: the websso bits are in d-o-a, we can release that as required | 21:21 |
| ayoung | I thought we were there....we really should branch right at the *3 milestone | 21:21 |
| stevemar | david-lyle, we also have a horizon patch | 21:21 |
| *** iamjarvo has quit IRC | 21:21 | |
| david-lyle | that's unnecessary other than the documentation | 21:21 |
| stevemar | david-lyle, wha? how is that unnecessary? | 21:22 |
| david-lyle | wait, have to look again | 21:22 |
| *** timcline has joined #openstack-keystone | 21:22 | |
| david-lyle | a lot of it seemed like scope creep | 21:22 |
| stevemar | i thought it was pretty centralized, but i don't know too much about the horizon code base | 21:23 |
| stevemar | https://review.openstack.org/#/c/151842/ | 21:23 |
| stevemar | the DOA patch looked good to me too, https://review.openstack.org/#/c/136178/ aside from the bug lin brought up | 21:25 |
| stevemar | i would like tests, but the test structure for DOA is damn awful | 21:25 |
| stevemar | since everything is in 1 file | 21:26 |
| stevemar | i mean that in the nicest way possible | 21:26 |
| david-lyle | I didn't write it, I just have to maintain it | 21:26 |
| stevemar | :) | 21:27 |
| nkinder | stevemar: If I add a get_idp_from_remote_id(), do you think it should only return one IdP? | 21:28 |
| nkinder | stevemar: it's possible for two identity providers to have the same remote_id in the database technically... | 21:28 |
| nkinder | so I either make the backend function throw an exception if it gets >1 matches, or it returns a list of IdPs and the caller needs to sort it out. | 21:29 |
| stevemar | nkinder, we can change the remote_id value to be unique | 21:29 |
| nkinder | stevemar: where would that be done? That would simplify things. | 21:29 |
| stevemar | nkinder, here https://review.openstack.org/#/c/152156/ | 21:30 |
| stevemar | nkinder, we can add the sql.unique argument to the backend | 21:30 |
| nkinder | stevemar: ok, in 006_add_remote_id_table.py | 21:30 |
| stevemar | yep | 21:30 |
| *** iamjarvo has joined #openstack-keystone | 21:36 | |
| morganfainberg | david-lyle, was going to ping you re: websso | 21:42 |
| morganfainberg | david-lyle, looks like you caught up with stevemar already | 21:43 |
| david-lyle | yeah, still looking at it | 21:43 |
| morganfainberg | stevemar, oooh | 21:43 |
| morganfainberg | stevemar, we got a talk accepted | 21:43 |
| *** EmilienM is now known as EmilienM|PTO | 21:44 | |
| stevemar | morganfainberg, yeah buddy | 21:45 |
| mfisch | stevemar: you guys should do a Frenet talk as a brown bag: http://openstack.prov12n.com/vbrownbag-techtalks-in-vancouver/?awesm=awe.sm_p8ZHg | 21:45 |
| stevemar | mfisch, ++ i knew there had to be a way for an impromptu talk | 21:46 |
| stevemar | dolphm, lbragstad ^^ do a fernet talk | 21:46 |
| mfisch | I'd like one called "Transition to Frenet without pissing off your customers" | 21:46 |
| *** jamielennox|away is now known as jamielennox | 21:49 | |
| openstackgerrit | Nathan Kinder proposed openstack/keystone: Lookup identity provider by remote_id for websso https://review.openstack.org/166391 | 21:49 |
| stevemar | mfisch, "without pissing off your customers, and deployers" | 21:50 |
| *** timcline has quit IRC | 21:50 | |
| morganfainberg | mfisch, soooooo | 21:52 |
| morganfainberg | mfisch, time to make sure docs on db backups are solid | 21:52 |
| morganfainberg | mfisch, ;) | 21:52 |
| morganfainberg | mfisch, it was all merged. | 21:52 |
| *** edmondsw has quit IRC | 21:53 | |
| ayoung | morganfainberg, what is the plan for when we are going to branch? | 21:53 |
| ayoung | time wise.. | 21:53 |
| morganfainberg | ayoung, for RC? | 21:53 |
| morganfainberg | or for something else? | 21:53 |
| ayoung | for RC | 21:54 |
| morganfainberg | RC is slated for April 9 | 21:54 |
| ayoung | just wondering if it is long enough to go put preemptive minuses on reviews that are out, or if it will be soon enough to leave as is | 21:54 |
| morganfainberg | https://wiki.openstack.org/wiki/Kilo_Release_Schedule | 21:55 |
| morganfainberg | ok about to hop on a flight | 21:55 |
| morganfainberg | b ack on when we hit elevation | 21:55 |
| ayoung | morganfainberg, I mean when are we going to branch the git repo so we can keep doing approvals, but have to explicitl backport for real fixes | 21:55 |
| morganfainberg | ayoung, at RC that usually happens | 21:55 |
| morganfainberg | so around apr 9 | 21:55 |
| * morganfainberg lost his phone today and will likely be dark until it is replaced tomorrow after the flight lands. | 21:56 | |
| morganfainberg | ayoung, we're compressed down to ~3wks till RC | 21:57 |
| ayoung | OK | 21:57 |
| ayoung | morganfainberg, so anything that is not a bug fix gets a preemptive -2? | 21:57 |
| *** gordc has quit IRC | 21:58 | |
| ayoung | stevemar, so https://review.openstack.org/#/c/166391/1 you said to sync with another fix. Does that have to happen first, or can this one go in as is? | 21:58 |
| stevemar | ayoung, https://review.openstack.org/#/c/152156/ << should go in first | 22:00 |
| ayoung | stevemar, does it have to? Nate'sis a bug fix, | 22:01 |
| ayoung | the other is a new feature | 22:01 |
| stevemar | ayoung, well, if it doesn't then it'll go nathan's fix -> marcos feature -> another fix | 22:01 |
| ayoung | stevemar, I think that is the right sequence | 22:02 |
| stevemar | ayoung, malright, i | 22:02 |
| stevemar | i'm easy to convince | 22:02 |
| stevemar | as long as work is getting done, i'm happy to re-visit things | 22:02 |
| stevemar | we'll have to query IdPRemoteIdsModel instead of IdentityProviderModel | 22:04 |
| *** jamielennox is now known as jamielennox|away | 22:05 | |
| nkinder | stevemar: we really need to find out if the remote_idps thing is going to make it in | 22:05 |
| nkinder | I know my patch needs adjusting if that makes it for Kilo | 22:05 |
| nkinder | I wanted to propose something that will work if we don't get the FFE | 22:06 |
| stevemar | nkinder, understandable | 22:06 |
| stevemar | nkinder, marekd has proposed it for FFE and i sponsored it (all on ML) | 22:06 |
| nkinder | yep | 22:06 |
| stevemar | nkinder, morganfainberg hasn't gotten back to us - but it should be a non-issue, i hope | 22:06 |
| ayoung | Should we dogpile on the FFE? | 22:07 |
| nkinder | DOGPILE!!!! | 22:07 |
| nkinder | ...sorry, my inner 12 year old couldn't resist | 22:07 |
| stevemar | ayoung, naw, give morganfainberg a worry free weekend, we can check this on monday, we have a few weeks of rc1 | 22:07 |
| ayoung | http://wac.450f.edgecastcdn.net/80450F/nj1015.com/files/2014/01/Screen-Shot-2014-01-16-at-7.43.19-AM-630x449.png | 22:07 |
| marekd | nkinder: i didn't follow whole convo | 22:07 |
| nkinder | ayoung: he said he sent an e-mail yesterday, and he hoped to have an update by next week's meeting | 22:08 |
| ayoung | DOGPILE ON DA RABBIT! | 22:08 |
| marekd | but remote_id is essentially entityID | 22:08 |
| marekd | stevemar: ^^ | 22:08 |
| nkinder | marekd: https://review.openstack.org/#/c/166391/ | 22:08 |
| *** breton has quit IRC | 22:09 | |
| nkinder | I need to step away for a bit... | 22:10 |
| marekd | nkinder: o shit... | 22:10 |
| ayoung | marekd, yep. ooops. | 22:12 |
| nkinder | marekd: :) The good news is the rest of websso in keystone is working nicely for me | 22:12 |
| nkinder | ok, really stepping away now | 22:13 |
| *** iamjarvo has quit IRC | 22:13 | |
| *** _cjones_ has quit IRC | 22:30 | |
| *** _cjones_ has joined #openstack-keystone | 22:34 | |
| *** Ephur_ has joined #openstack-keystone | 22:35 | |
| *** Ephur_ has quit IRC | 22:35 | |
| *** Ephur has quit IRC | 22:36 | |
| *** bknudson has quit IRC | 22:36 | |
| marekd | stevemar: isn't primary_key assuring uniqueness? | 22:45 |
| marekd | this is what they tought me long time ago. | 22:45 |
| marekd | stevemar: anyway, commented. | 22:48 |
| *** lhcheng has quit IRC | 22:51 | |
| *** lhcheng has joined #openstack-keystone | 22:51 | |
| *** lhcheng has quit IRC | 22:56 | |
| *** dimsum__ has quit IRC | 22:58 | |
| *** dimsum__ has joined #openstack-keystone | 22:59 | |
| *** dimsum__ is now known as dims | 23:00 | |
| *** boris-42 has joined #openstack-keystone | 23:02 | |
| morganfainberg | stevemar, hi | 23:02 |
| morganfainberg | back | 23:02 |
| morganfainberg | ayoung, not bug fixes and not things like test retructure should have a -2 now | 23:03 |
| morganfainberg | ayoung, reseller, domain_sql, and uhm... the one from marekd about IDP registration could end up with FFEs | 23:03 |
| morganfainberg | nkinder, stevemar, cc ^ | 23:04 |
| marekd | morganfainberg: come on Morgan, the patch was blocked by a severe bug. Otherwise it would be already in master :-) | 23:04 |
| *** thedodd has quit IRC | 23:05 | |
| * marekd goes to bed | 23:07 | |
| * marekd bye | 23:07 | |
| morganfainberg | marekd, i expect to have FFE exceptions done by next meeting on tuesday | 23:12 |
| morganfainberg | marekd, :P | 23:12 |
| *** Bsony has quit IRC | 23:18 | |
| *** lhcheng has joined #openstack-keystone | 23:25 | |
| morganfainberg | stevemar: https://review.openstack.org/#/c/166086/1/api/v3/identity-api-v3-os-federation-ext.rst | 23:26 |
| morganfainberg | stevemar, this looks like something new API wise | 23:26 |
| morganfainberg | right? | 23:26 |
| *** breton has joined #openstack-keystone | 23:27 | |
| *** _cjones_ has quit IRC | 23:37 | |
| *** samueldmq has joined #openstack-keystone | 23:39 | |
| *** harlowja_ has quit IRC | 23:41 | |
| *** markvoelker has quit IRC | 23:42 | |
| *** harlowja has joined #openstack-keystone | 23:42 | |
| stevemar | morganfainberg, yep, it is | 23:43 |
| stevemar | needs a FFE | 23:43 |
| morganfainberg | ~2hr till home. | 23:47 |
| *** lhcheng has quit IRC | 23:54 | |
| *** lhcheng has joined #openstack-keystone | 23:57 | |
| *** _cjones_ has joined #openstack-keystone | 23:57 | |
| *** gyee has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
