| jamielennox | ayoung: you actually here? | 00:08 |
|---|---|---|
| *** lhcheng has quit IRC | 00:08 | |
| *** ncoghlan has joined #openstack-keystone | 00:16 | |
| *** gokrokve has joined #openstack-keystone | 00:39 | |
| *** gokrokve has quit IRC | 00:44 | |
| *** arif-ali has quit IRC | 00:48 | |
| jamielennox | stevemar: are you here? | 00:54 |
| bknudson | you're alone. | 00:57 |
| breton | nope | 00:58 |
| stevemar | jamielennox, here-ish | 01:00 |
| stevemar | bknudson, might be around too | 01:01 |
| jamielennox | everyone else shoulnd't be here, stevemar is just generally around all the time | 01:01 |
| stevemar | that's true | 01:01 |
| bknudson | I think he's got irc on his cell. | 01:01 |
| jamielennox | stevemar: i think i figured out my problem - i though it was something deeply federation related, but it appears to just be if you POST to a URL that doesn't have a trailing / then django will add the / for you | 01:02 |
| stevemar | bknudson, i do, but typically i'm on my laptop | 01:02 |
| stevemar | oh | 01:02 |
| jamielennox | but browsers won't redirect POST to POST so i was ending up with a GET where i should have had POST | 01:02 |
| stevemar | jamielennox, what was your problem looking like initially? | 01:02 |
| jamielennox | well by the time i got a request to /auth/websso it was a GET and i had lost the token coming back | 01:03 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Deprecate eventlet config options https://review.openstack.org/168752 | 01:03 |
| stevemar | yeah the token will get lost with a GET | 01:03 |
| * jamielennox just got a federated horizon login :) | 01:03 | |
| stevemar | nice | 01:04 |
| stevemar | jamielennox, whats your setup look like | 01:04 |
| stevemar | did you use the patches that tqtran and lhcheng have been pushing? | 01:05 |
| bknudson | What's up with this: $ openstack --os-token secrete user list --> ERROR: openstack | 01:05 |
| jamielennox | stevemar: i'm essentially rewriting https://review.openstack.org/#/c/136178/ | 01:05 |
| jamielennox | bknudson: generally means like an attributeerror or something weird from osc, | 01:06 |
| jamielennox | if you use --debug it'll give you a full trace | 01:06 |
| jamielennox | stevemar: the setup is the ipsilon setup nkinder was working on | 01:06 |
| bknudson | raise exceptions.EndpointNotFound() | 01:06 |
| bknudson | openstack --debug --os-token secrete --os-auth-url http://localhost:5000/v3 --os-identity-api-version=3 user list | 01:08 |
| bknudson | TypeError: __init__() got an unexpected keyword argument 'user_domain_id' | 01:08 |
| openstackgerrit | Merged openstack/python-keystoneclient: Expose audit_id via AccessInfo https://review.openstack.org/168212 | 01:14 |
| stevemar | jamielennox, re-writing it eh? what are the big diffs? | 01:16 |
| jamielennox | stevemar: what we were talking about with pulling it out of the DOA tree | 01:16 |
| bknudson | seems like extra arguments should be ignored when loading auth plugins. | 01:16 |
| stevemar | lhcheng was getting a weird error on the server side, user not found | 01:16 |
| jamielennox | i need https://github.com/jamielennox/django_openstack_auth/commit/ea7eab90f6d4ca36cb5c389ae10377b2ca9d7ca5 | 01:16 |
| stevemar | that patch should land easily | 01:17 |
| stevemar | bknudson, i noticed the token stuff was acting weird on friday | 01:17 |
| bknudson | freaky friday | 01:17 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Extract response headers to private method https://review.openstack.org/168720 | 01:18 |
| jamielennox | then https://github.com/jamielennox/django-openstack-auth-websso | 01:18 |
| rodrigods | bknudson, stevemar thanks for the reviews ^ | 01:18 |
| jamielennox | so what's missing from that new repo is any soft of initial form prompt | 01:18 |
| stevemar | oh wow, you made that repo quickly | 01:19 |
| jamielennox | stevemar: you haven't seen https://github.com/openstack-dev/cookiecutter | 01:20 |
| jamielennox | also it's almost exactly the same as what i did for the kerberos one | 01:20 |
| stevemar | jamielennox, does that pull in https://review.openstack.org/#/c/151842/ too? | 01:20 |
| jamielennox | stevemar: no | 01:20 |
| stevemar | i've seen cookiecutter, never used it though | 01:20 |
| stevemar | did you use that in your test evn? | 01:21 |
| jamielennox | i haven't figured out how to do the initial form login yet | 01:21 |
| jamielennox | no, i hit the keystone federation urls with evreything in place | 01:21 |
| bknudson | stevemar: worked around openstack error, looks like keystone isn't accepting it for user list. | 01:22 |
| jamielennox | i was kind of hoping not to have to modify the original /auth/login form | 01:22 |
| jamielennox | but i don't know enough django for that | 01:22 |
| stevemar | jamielennox, you mean you don't know everything? | 01:27 |
| stevemar | jamielennox, so now i'm wondering if https://review.openstack.org/#/c/151842/ is needed... | 01:27 |
| jamielennox | stevemar: ha, not even a decent percentage | 01:27 |
| stevemar | if that is a part of the -websso package, then theres no need for it | 01:28 |
| jamielennox | i really hate web stuff | 01:28 |
| stevemar | whens the horizon meeting? some ugly morning time | 01:28 |
| jamielennox | yea, i don't think it's good for me | 01:28 |
| stevemar | hopefully theres a time when we can all chat about this | 01:29 |
| stevemar | jamielennox, did you have to modify DOA much> | 01:30 |
| stevemar | ? | 01:30 |
| bknudson | this is why nobody uses the web. | 01:30 |
| stevemar | from the patch that is proposed | 01:30 |
| jamielennox | only that project list patch | 01:30 |
| jamielennox | although, i haven't implemented the whole thing | 01:30 |
| jamielennox | i'm not sure what https://review.openstack.org/#/c/136178/25/openstack_auth/user.py is for | 01:31 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Ignore unexpected kwargs to auth plugins https://review.openstack.org/168756 | 01:31 |
| jamielennox | i think it's for https://review.openstack.org/#/c/136178/25/openstack_auth/utils.py - but i just don't understand why they need that | 01:31 |
| ayoung | jamielennox, I am actually here. I was actually wokring in Open Office, tryin to get down the ideas for my presentation | 01:31 |
| ayoung | Just didn't look at IRC til now | 01:32 |
| jamielennox | ayoung: no worries, i was having trouble with some of the federation stuff i know you were looking at, i think i got it | 01:32 |
| stevemar | ayoung, is here now, i can go back to netflix | 01:33 |
| ayoung | jamielennox, cool. I think we are waiting on lin for DOA and Thai Tran on Horizon proper | 01:33 |
| ayoung | Noe...Thai is tracking! | 01:33 |
| ayoung | https://review.openstack.org/#/c/151842/ | 01:33 |
| jamielennox | that memoize_by_kwarg thing is caching to a dict - that seems like such a bad idea for horizon | 01:33 |
| jamielennox | ayoung: hit it now | 01:34 |
| ayoung | hit what now? | 01:34 |
| jamielennox | http://controller.rdodom.test:5000/v3/auth/OS-FEDERATION/websso/saml2?origin=http://controller.rdodom.test/dashboard/auth/websso/ | 01:34 |
| ayoung | memoize_by_kwarg ? | 01:34 |
| ayoung | jamielennox, ah...need to get inside the VPN etx. Is that Kerberos or SAML? | 01:35 |
| jamielennox | SAML | 01:35 |
| ayoung | You got it working, too? I got it rightat 5 On Friday | 01:36 |
| stevemar | good to know that y'all are interested in this too :) | 01:37 |
| jamielennox | ayoung: i got the federation -> horizon bit going | 01:37 |
| stevemar | should be easier to get david lyle on board with it | 01:37 |
| ayoung | jamielennox, did you see rcrit's suggestion? We can get devstack to use ipsilon via a local user and PAM. Simplelset was to get a SAML functional test | 01:37 |
| ayoung | stevemar, I'm doing the git review diff to confirm what you said, and I'll dogpile on that Horizon regview, too | 01:37 |
| jamielennox | ayoung: yea, i saw - devstack has plugins, it seems like we should be able to do something for it, just FreeIPA makes a mess of the httpd conf | 01:38 |
| ayoung | jamielennox, I know...It might be possible to get HTTP shared, but I don't want to put that on the short list | 01:38 |
| jamielennox | anyway, so i've got saml->horizon working, i've current got nfi how to get horizon to throw to saml though | 01:39 |
| *** gokrokve has joined #openstack-keystone | 01:39 | |
| ayoung | jamielennox, congrats. You've managed to confuse me. | 01:40 |
| jamielennox | well if you hit the keystone URLs correctly they redirect you back to horizon and it logs you in | 01:40 |
| ayoung | Ah...so you can do the second half...put the url into Keystone and it redirects you to horizon? Just not the frist part? | 01:40 |
| ayoung | OK...I can help | 01:40 |
| jamielennox | i just need to see if i can modify https://review.openstack.org/#/c/151842/ and get it out of the horizon specific tree | 01:41 |
| jamielennox | or maybe i'm too concerned about making this structurally seperate and should just let horizon do what they want | 01:41 |
| ayoung | ? | 01:41 |
| ayoung | Ah...you are trying to integrate it with you other work? | 01:41 |
| jamielennox | so everything related to kerberos is contained in doa-kerberos | 01:41 |
| jamielennox | which is easy because there is no front end to kerberos | 01:42 |
| jamielennox | i was hoping i could do the same thing for websso, and i can as far as the actual login goes | 01:42 |
| jamielennox | but i don't know if i can get all the javascript and html stuff into that doa-websso repo, or whether i should even bother trying | 01:43 |
| ayoung | I think the answer is "don't bother" | 01:43 |
| ayoung | If I understand where we are headed, let's leave it as is | 01:43 |
| ayoung | I think FEderation is going to be the norm, even for Kerberos. | 01:43 |
| *** gokrokve has quit IRC | 01:44 | |
| ayoung | doa-kerberos will be, I think, replaced by something like using Federation to Keystone without using SAML | 01:44 |
| jamielennox | kerberos will be different even if we move it to a federation route | 01:44 |
| ayoung | Somethinkg like my SSSD based FEderation, but just as a redirect, not as SAML one...if that makes sense> | 01:45 |
| jamielennox | because kerberos requires putting an httpd module in front of horizon, not just keystone | 01:45 |
| ayoung | I actually came over here to talk with you about that | 01:45 |
| *** stevemar has quit IRC | 01:45 | |
| jamielennox | and there will never be a form for kerberos, it should just log you in if a ticket is present | 01:45 |
| ayoung | right, so the question is, if we can do Federation for everything...even if all of the Data is in Keystone's identity store | 01:45 |
| *** stevemar has joined #openstack-keystone | 01:46 | |
| *** ChanServ sets mode: +v stevemar | 01:46 | |
| ayoung | So instead of a SAML redirect to Keystone, you would get a redirect to keystone:5000/v3/OS-FEDERATION/keystone/kerberos or something | 01:46 |
| ayoung | So you get an unscoped token from Keystone using negotiate, and then that redirects you to the websso page to post the token back to Horizion, just like SAML | 01:47 |
| ayoung | Make sense? | 01:47 |
| jamielennox | you would need to select "kerberos" from the /auth/login page of horizon | 01:47 |
| ayoung | if it was one of multiple options, but if it is the only option, no. But that shouidl be the case for SAML as well | 01:48 |
| ayoung | That is a Horizon decision | 01:48 |
| ayoung | speaking of which | 01:48 |
| ayoung | this will be cleared whe n you see what you need to do to get Horizon working...ok | 01:48 |
| ayoung | let me ssh to my machine to have a reference | 01:49 |
| ayoung | you need to make some changes to local_settings in Horiozn. Have you touched that yet? | 01:49 |
| ayoung | jamielennox, also, are you starting from devstack or packstack? | 01:50 |
| *** erkules has joined #openstack-keystone | 01:50 | |
| jamielennox | i'm starting from the machine that nkinder set up last week | 01:50 |
| ayoung | OK, I thin that was packstack | 01:51 |
| jamielennox | it's packstack | 01:51 |
| ayoung | it means that things are in slightly different locations | 01:51 |
| ayoung | I'm in devstack, so thuings are in the git trees, but the file you need to work with is in | 01:51 |
| ayoung | something like /etc/horizon/openstack_dashboard | 01:51 |
| ayoung | local_settings.py | 01:52 |
| ayoung | have you mulched that yet? | 01:52 |
| *** erkules_ has quit IRC | 01:53 | |
| jamielennox | ayoung: i've added some stuf to the end of local_settings, and i've uninstalled the rpm of DOA in favour of git with my patches on it | 01:53 |
| jamielennox | oh, there was a patch i had to manually apply to horizon because the RPM version isn't new enough and i didn't want to have to set that up from git | 01:54 |
| ayoung | jamielennox, are youe doing V3 Auth yet? | 01:54 |
| jamielennox | ayoung: it's wokring | 01:54 |
| ayoung | Oh...you need the git version of Horizon | 01:54 |
| ayoung | unless you have the patch we were just discussing | 01:54 |
| jamielennox | i'm not sure where you're going with this - what are you trying to show me? | 01:56 |
| ayoung | you configured the set of options ther? | 01:58 |
| ayoung | WEBSSO_CHOICES = ("saml2", _("Security Assertion Markup Language")) | 01:58 |
| ayoung | and | 01:58 |
| ayoung | WEBSSO_INITIAL_CHOICE = "saml2" | 01:59 |
| ayoung | WEBSSO_ENABLED=True | 01:59 |
| ayoung | OPENSTACK_KEYSTONE_URL="http://federate.cloudlab.freeipa.org:5000/v3" | 01:59 |
| ayoung | and | 01:59 |
| ayoung | OPENSTACK_API_VERSIONS = { "identity": 3,} | 01:59 |
| ayoung | also, I had an issue with Hostname versus IP address | 02:00 |
| ayoung | I do all hostname for this to work | 02:00 |
| ayoung | OPENSTACK_HOST="federate.cloudlab.freeipa.org" | 02:00 |
| ayoung | jamielennox, I think that was all the Horizon side I needed to make work | 02:00 |
| *** _cjones_ has joined #openstack-keystone | 02:03 | |
| ayoung | jamielennox, which machine is controller.rdodom.test? | 02:03 |
| *** yasu_ has joined #openstack-keystone | 02:04 | |
| *** _cjones_ has quit IRC | 02:09 | |
| ayoung | stevemar, guess what I figured out today? | 02:09 |
| ayoung | We can use policy to do endpoint binding of tokens with no new Python code, just policy | 02:10 |
| *** BAKfr has quit IRC | 02:11 | |
| *** BAKfr has joined #openstack-keystone | 02:13 | |
| *** david8hu has quit IRC | 02:13 | |
| *** david8hu has joined #openstack-keystone | 02:14 | |
| jamielennox | ayoung: yea, i think if we are going to go down that path then i'm not sure it's worth having a seperate repo for the like login logic of websso | 02:15 |
| ayoung | jamielennox, the Kerberos via Federation approach? Yeah. It was you that got me thinking that way | 02:16 |
| jamielennox | ayoung: kerberos via federation is right - we'll do that longer term | 02:18 |
| ayoung | We can do it now, I thin, with a minor tweak to only Horizon. | 02:19 |
| jamielennox | and for that project having kerberos login in a serperate repo to DOA make sense | 02:19 |
| jamielennox | ayoung: it's too late in the cycle - we're going S4U2 this time | 02:19 |
| ayoung | Yeah, I know, and that is fine | 02:19 |
| ayoung | I'm talking about longer term, we can make the whole thing more streamlined. My head is already in Liberty and Mike | 02:20 |
| ayoung | Mitsubishi? Musashi? | 02:20 |
| ayoung | I like Musashi! | 02:21 |
| jamielennox | but i was pushing lhcheng and others that websso should be the same out of tree for dependencies and stuff, but i don't know if it's worth trying to do extensible forms via django | 02:21 |
| ayoung | jamielennox, anyway...can you make your horizon work with the local settings I posted? | 02:24 |
| samueldmq_ | ayoung, mitsubishi lol | 02:24 |
| jamielennox | ayoung: oh, yea, i know what the patch is doing, i can figure that bit out - it was more about hosting the UI code outside of horizon | 02:25 |
| jamielennox | which is really something i need to talk to the horizon people about | 02:25 |
| ayoung | jamielennox, you mean so we don't for SAML, OpenID connect, etc on all of the deployemtns, just the ones that wnat them? | 02:26 |
| ayoung | I think that is a discussion to have at the summit | 02:26 |
| jamielennox | right | 02:26 |
| ayoung | jamielennox, so you were able to make it work? | 02:26 |
| jamielennox | because for example the keystoneclient plugins will go that way | 02:26 |
| jamielennox | ayoung: i haven't tried the front end bit | 02:26 |
| ayoung | OK. | 02:26 |
| jamielennox | will do so in a bit | 02:26 |
| jamielennox | it was more the token submission i was looking to get wokring | 02:27 |
| stevemar | if we could still squeeze in the horizon bits, and release a separate doa-websso when needed... i could live with that | 02:28 |
| stevemar | but you'll run into the issue of a user potentially turning on a feature in horizon and not realizing they need another package for it to work | 02:29 |
| ayoung | Does Horizon even need SAML specific logic? I thought that actaully started once it hit Keystone. | 02:38 |
| stevemar | ayoung, yeah, it does start when you hit keystone, but having horizon know about protocols makes it more user friendly | 02:39 |
| stevemar | rather than knowing the idp id | 02:39 |
| *** gokrokve has joined #openstack-keystone | 02:39 | |
| ayoung | stevemar, how did you confirm the only change was a minimal one on https://review.openstack.org/#/c/151842/ ? | 02:40 |
| stevemar | ayoung, compared ps 34 and 35 | 02:41 |
| ayoung | I'm getting a slew of differences | 02:41 |
| ayoung | not from this patch...I guess those files are identical? | 02:41 |
| stevemar | some other changeset must have included those | 02:41 |
| stevemar | i am referring to https://review.openstack.org/#/c/151842/34..35/horizon/static/angular/login/login.js | 02:42 |
| ayoung | tyhat's the onluy difference? Good. I can +1 that | 02:42 |
| *** gokrokve has quit IRC | 02:44 | |
| stevemar | the patch hasn't changed much since... ps 28/29 | 02:44 |
| stevemar | mostly nits and rebasing when merge conflicts happened | 02:44 |
| ayoung | stevemar, we'll encourage some Horizon folks to review and process it tomorrow | 02:47 |
| stevemar | ayoung, i've been trying that for weeks | 02:47 |
| stevemar | it's been just lhcheng and david-lyle | 02:47 |
| ayoung | stevemar, david-lyle's been doing his part. I 'll bug Mrunge | 02:47 |
| stevemar | i think the keystone parts, and messing around with authN bits scares folks | 02:48 |
| ayoung | Let's see who else we can bug... | 02:48 |
| *** lhcheng has joined #openstack-keystone | 02:48 | |
| ayoung | https://launchpad.net/~horizon-drivers/+members#active | 02:49 |
| ayoung | Thai and Lin should +2 each other's patches, even if they don't want to pull the trigger | 02:49 |
| stevemar | ayoung, well the DOA patch is now up in the air i thought | 02:50 |
| ayoung | Why? | 02:50 |
| stevemar | i thought it was not going to land and we will make it a part of jamie's DOA-sso repo | 02:51 |
| ayoung | Horizon meeting is tomorrow? | 02:51 |
| ayoung | let me see when it is... | 02:51 |
| david-ly_ | ayoung: Wed | 02:52 |
| *** david-ly_ is now known as david-lyle | 02:52 | |
| ayoung | david-ly_, sorry to wake you!@ | 02:52 |
| ayoung | Was trying to tiptoe | 02:52 |
| david-lyle | I'll review the horizon patch again in the morning, there's still something messed up with the help string, but it should be a minor fix. Was playing with it earlier. | 02:52 |
| david-lyle | no worries | 02:52 |
| ayoung | IN general, are we good as is? | 02:52 |
| ayoung | I'm afraid that trying to make it perfect will mess up good enough | 02:53 |
| ayoung | that refers to the DOA part | 02:53 |
| david-lyle | in general, my problem is a string shows up and says "if you don't know what auth mechanism to use, contact your admin" when you only have credentials | 02:53 |
| david-lyle | on the DOA, I think we're good, have to talk to Lin tomorrow | 02:54 |
| ayoung | good. | 02:54 |
| ayoung | david-lyle, I'm going to try and hack some devstack support for SAML in. | 02:55 |
| david-lyle | ok | 02:55 |
| ayoung | NO promises, but I think I can make it work with Ipsilon in a fairly light manner | 02:55 |
| ayoung | should give us a path to functional testing of this code | 02:55 |
| david-lyle | so supporting that and credential based auth? | 02:55 |
| david-lyle | a way easy test against it would be great | 02:56 |
| david-lyle | me type not much, apparently | 02:56 |
| lhcheng | ayoung: the DOA part, it is now in better shape. The project switching in horizon now works. | 02:57 |
| ayoung | lhcheng, ah...hadn't realized that was dead...It messed me up in the Kerberso work before | 02:57 |
| ayoung | lhcheng, let me try your rebased patch... | 02:58 |
| lhcheng | ayoung: I have to put a workaround though, there is a issue in keystone where /users/{user_id}/projects returns 404 UserNotFound | 02:58 |
| lhcheng | ayoung: we still have some hanging assert user check, and it fails for federated user :( | 02:58 |
| ayoung | of course it does...there is no user there.... | 02:58 |
| ayoung | what is the workaround? | 02:58 |
| lhcheng | I had to store the federated unscoped token, and make a separate call to /federation/projects list | 02:59 |
| *** dims has quit IRC | 02:59 | |
| *** dims has joined #openstack-keystone | 02:59 | |
| david-lyle | lhcheng: oooh, more stored tokens! | 02:59 |
| stevemar | lhcheng, we could take out the check on the keystone side | 02:59 |
| david-lyle | to simplify the confusion :) | 03:00 |
| lhcheng | had a chat with morgan, the project scoped token should still with /users/{user_id}/projects | 03:00 |
| *** dims has quit IRC | 03:00 | |
| lhcheng | but it would require some significant changes in the code and it won't get into RC | 03:00 |
| stevemar | booo | 03:00 |
| david-lyle | lhcheng: is your patch ready then? | 03:01 |
| lhcheng | david-lyle: yeah, it works now | 03:01 |
| lhcheng | david-lyle: but there's another idea that jamielennox brought up | 03:02 |
| david-lyle | oh? | 03:02 |
| lhcheng | david-lyle: do we really want to put this logic into horizon + doa | 03:02 |
| ayoung | Yes we do | 03:02 |
| lhcheng | david-lyle: why not have a doa-websso | 03:02 |
| ayoung | we want Fedeartion to be the norm here | 03:02 |
| ayoung | Nah | 03:02 |
| ayoung | too far | 03:02 |
| ayoung | there is no external dependencies | 03:03 |
| lhcheng | ayoung: I don't mind it to be in horizon | 03:03 |
| ayoung | let's live with the ugly hack for a first approximation and clean it up | 03:03 |
| lhcheng | ayoung: it works with different protocol | 03:03 |
| lhcheng | ayoung: seems generic enough | 03:03 |
| david-lyle | one DOA is all I want to manage for now | 03:03 |
| ayoung | david-lyle, it is one more than I really want myself | 03:03 |
| david-lyle | can hardly get anyone to look at it, much less a federation specific one | 03:04 |
| david-lyle | ayoung: I didn't want to say that, but agree | 03:04 |
| ayoung | david-lyle, we should probably split it, move all of the auth code to a Keystone repo, and keep just the UI in the horizon one...but not for Keeeeeeelow | 03:04 |
| ayoung | let's put this to bed for now... | 03:05 |
| david-lyle | one week before RC should be plenty of time | 03:05 |
| david-lyle | yeah we can discuss at the summit | 03:05 |
| ayoung | "perfect" is the enemy of "good enough" | 03:05 |
| david-lyle | lhcheng: let's get your patch merged | 03:05 |
| david-lyle | and figure out a better road in L | 03:05 |
| stevemar | ayoung, i'm so glad you voiced that. i think another repo is a better move architecturally, but i'd rather see something than nothing | 03:06 |
| jamielennox | lhcheng: you're here! i'm slowly converting more people to operate in my timezone | 03:07 |
| david-lyle | have to run, will review in the morning | 03:07 |
| lhcheng | david-lyle: I think there is just one minor comment from stevemar, should be an easy fix. | 03:07 |
| jamielennox | lhcheng: https://github.com/jamielennox/django-openstack-auth-websso | 03:07 |
| ayoung | stevemar, so, no, I don't think that is the right architecture. I think the right architecture is getting the stuff that the Keystone team should be managing into a Keystone managed repo | 03:07 |
| lhcheng | david-lyle: I haven't tested the horizon code yet. but I expect there are couple of stuff that needs to be fixed there | 03:07 |
| lhcheng | david-lyle: related to fetching the user's project | 03:08 |
| ayoung | DOA is doing too much, and some of it either belongs in client or in some non-django-speciific-webessessoh repo | 03:08 |
| jamielennox | lhcheng: so that handles the DOA side of things - i don't like needing all that stuff in horizon but i don't know how we can break it up and have it for kilo | 03:08 |
| stevemar | ayoung, i'm happy either way | 03:08 |
| lhcheng | jamielennox: hah | 03:08 |
| jamielennox | lhcheng: i don't like storing the unscoped federated token like you did in that patch, still trying to figure out how to work around it | 03:09 |
| stevemar | lhcheng, yeah minor stuff, you did an awesome job cleaning it up | 03:09 |
| lhcheng | jamielennox: would we still have an opportunity to update g-r after ksc release? | 03:09 |
| ayoung | david-lyle, BTW, you can propose someone as core for DOA and not all of Horizon. It might make sense to formalize the Keystone/Horizon cooperation in that repo. We recently Made topol core for spces, although not for code. | 03:09 |
| jamielennox | lhcheng: not at this point i think | 03:09 |
| lhcheng | jamielennox: if ksc gets release, I can switch DOA to /auth/projects | 03:10 |
| jamielennox | lhcheng: also there is not even a review for the project listing yet | 03:10 |
| lhcheng | jamielennox: /auth/projects is already in keystone though right? | 03:10 |
| jamielennox | lhcheng: yep, i'll work on exposing it via ksc today | 03:10 |
| jamielennox | but it won't make it | 03:10 |
| lhcheng | jamielennox: perhaps I'll just make a direct API call to it. | 03:11 |
| lhcheng | jamielennox: would be easier to strip out later when KSC bumps up | 03:11 |
| jamielennox | lhcheng: tempted to agree | 03:11 |
| jamielennox | lhcheng: only problem is that was added for juno, so you need a fallback | 03:11 |
| ayoung | jamielennox, why a fallback? None of this will work with Juno or earlier | 03:12 |
| lhcheng | jamielennox: I'll only make that call for federated user. | 03:12 |
| lhcheng | jamielennox: still not as clean as I wanted to, but at least I won't be storing an extra token | 03:13 |
| ayoung | We should be able to store either the federated token or the unscoped token. There should be no need for an unscoped token if you have a federated stored | 03:14 |
| jamielennox | ayoung: because if you use /auth/tokens that would work for regular tokens as well | 03:15 |
| jamielennox | ayoung: so like replace the standard DOA logic, but then that will only work for post Juno | 03:15 |
| stevemar | ayoung, i believe someone can be core for just DOA | 03:15 |
| *** iamjarvo has joined #openstack-keystone | 03:16 | |
| stevemar | clu is core for just horizon and not DOA | 03:16 |
| ayoung | Ok...headed to bed....I'm still on 9-5 Easter time due to the kids.. | 03:16 |
| david-lyle | stevemar: she's core on both | 03:16 |
| *** iamjarvo has quit IRC | 03:16 | |
| stevemar | david-lyle, one of those times i'm glad to be wrong :) | 03:16 |
| david-lyle | horizon-core for both | 03:16 |
| stevemar | shows how much i know wth is going on | 03:17 |
| david-lyle | but most are afraid to look in that repo, you know keystoney things happen in there | 03:17 |
| jamielennox | lhcheng: i just saw how https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/utils.py#L38 works - that's such a bad idea for horizon | 03:17 |
| david-lyle | jamielennox: we used to hit keystone on every request for that info | 03:18 |
| lhcheng | caching project list for a token? | 03:18 |
| lhcheng | jamielennox: what could be the side effect? | 03:18 |
| david-lyle | so every page load | 03:18 |
| jamielennox | that _PROJECT_CACHE exists on the process, of which you could have 10 different processes | 03:18 |
| jamielennox | if you get another process on another call then the cache is empty and you still take the hit | 03:19 |
| jamielennox | depending on the process it also doesn't get cleaned up when you delete the token either | 03:19 |
| jamielennox | so that cache would just continue to grow | 03:20 |
| jamielennox | or am i missing something hre | 03:20 |
| *** ayoung is now known as ayoung_ZZzz__ | 03:21 | |
| lhcheng | stevemar, jamielennox: I am going to split the token plugin code, into a separate patch. Seems like a good idea to reduce the scope of the websso patch, make it easier to review. | 03:22 |
| lhcheng | jamielennox: hmm yeah, good point about the cleanup | 03:22 |
| lhcheng | maybe it should only be cache per request | 03:23 |
| lhcheng | david-lyle: store in session? :P | 03:23 |
| stevemar | lhcheng, for sure | 03:23 |
| david-lyle | sadly, that's the best option we have | 03:23 |
| jamielennox | well, it just needs to go to memcache or something external to the process | 03:23 |
| jamielennox | or do you not deal with that level in django? | 03:23 |
| lhcheng | jamielennox: don't want to add more external dependency if possible | 03:24 |
| *** iamjarvo has joined #openstack-keystone | 03:24 | |
| jamielennox | right, i know you configure memcache as a cache store, i don't really know how the persistence works within django though | 03:24 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add support to create ECP assertion based on a token https://review.openstack.org/168678 | 03:26 |
| stevemar | i got bknudson to say | 03:29 |
| stevemar | 'neat' | 03:29 |
| stevemar | https://review.openstack.org/#/c/168212/ | 03:29 |
| jamielennox | trendsetter | 03:29 |
| jamielennox | that was a quick one actually | 03:29 |
| lhcheng | jamielennox: perhaps for short team, we could cache for the scope of the request. Just to make sure nothing blows up. | 03:29 |
| lhcheng | stevemar: lol that's impressive | 03:30 |
| jamielennox | lhcheng: it's been there since october 2013, i'd worry about that one after release | 03:30 |
| lhcheng | jamielennox: heh true | 03:31 |
| jamielennox | it was yours too | 03:31 |
| stevemar | jamielennox, i've been trying to pay more attention to client | 03:31 |
| lhcheng | jamielennox: yeah, I'm the trouble maker | 03:32 |
| jamielennox | heh | 03:32 |
| jamielennox | it can't be too big a problem, i would have though a big deployment would have seen memory leaks from it | 03:32 |
| lhcheng | jamielennox: hmm we did hit out of memory error before | 03:35 |
| stevemar | one week left and we can all celebrate | 03:35 |
| lhcheng | jamielennox: we release so often and have a lot of node on standby, that there was still no user impact | 03:36 |
| jamielennox | lhcheng: i'm getting more and more of that opinion, if it doesn't make it now 6 months is not that long | 03:36 |
| * jamielennox 's views does not represent those of his employer | 03:37 | |
| *** gokrokve has joined #openstack-keystone | 03:39 | |
| lhcheng | yeah, we're definitely moving fast | 03:40 |
| *** gokrokve has quit IRC | 03:43 | |
| *** iamjarvo has quit IRC | 03:47 | |
| *** samueldmq_ has quit IRC | 03:47 | |
| *** spandhe has quit IRC | 04:12 | |
| *** dims has joined #openstack-keystone | 04:15 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Bump advertised API version to 3.4 https://review.openstack.org/168771 | 04:16 |
| stevemar | jamielennox, btw - i've got 2 client side patches up | 04:18 |
| stevemar | i wasn't sure if they should go into regular ksc or ksc-federation | 04:19 |
| jamielennox | stevemar: umm, they don't do any XML processing themselves do they | 04:20 |
| stevemar | jamielennox, nope | 04:20 |
| stevemar | just return xml | 04:21 |
| *** dims has quit IRC | 04:21 | |
| jamielennox | stevemar: i think they're find to be in keystoneclient regular, it's generally only the actualy auth bits that have the aditional dependencies | 04:21 |
| stevemar | yep | 04:21 |
| jamielennox | the general federation management stuff belongs in ksc | 04:21 |
| stevemar | cool | 04:21 |
| stevemar | yeah | 04:21 |
| stevemar | no new deps | 04:21 |
| openstackgerrit | Merged openstack/keystone: Extract response headers to private method https://review.openstack.org/168720 | 04:24 |
| *** davechen has joined #openstack-keystone | 04:30 | |
| openstackgerrit | rajiv proposed openstack/python-keystoneclient: Now keystone enables listing of user by name https://review.openstack.org/167543 | 04:30 |
| *** pnavarro|off has quit IRC | 04:31 | |
| *** pnavarro|off has joined #openstack-keystone | 04:34 | |
| *** haneef_ has quit IRC | 04:39 | |
| *** gokrokve has joined #openstack-keystone | 04:39 | |
| *** gokrokve has quit IRC | 04:44 | |
| *** _cjones_ has joined #openstack-keystone | 05:10 | |
| *** _cjones_ has quit IRC | 05:14 | |
| *** lhcheng_ has joined #openstack-keystone | 05:20 | |
| *** lhcheng_ has quit IRC | 05:20 | |
| *** lhcheng_ has joined #openstack-keystone | 05:21 | |
| *** lhcheng has quit IRC | 05:22 | |
| *** nkinder has quit IRC | 05:22 | |
| *** lhcheng_ has quit IRC | 05:27 | |
| *** lhcheng has joined #openstack-keystone | 05:27 | |
| *** nkinder has joined #openstack-keystone | 05:29 | |
| *** lhcheng has quit IRC | 05:32 | |
| stevemar | jamielennox, thx for the review | 05:44 |
| jamielennox | stevemar: np | 05:45 |
| jamielennox | stevemar: i left a comment saying you don't need saml in create_saml_assertion, but i didn't relaize that the following patch had create_ecp_assertion | 05:45 |
| jamielennox | i see why you would want to distinguish those two, so i don't mind what you do there | 05:46 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Bump advertised API version to 3.4 https://review.openstack.org/168771 | 05:46 |
| stevemar | yeah, i'll keep as-is, i found the naming for this patch to not be easy | 05:46 |
| stevemar | i don't like federation.saml.xyz much either | 05:47 |
| stevemar | but i guess it works | 05:47 |
| jamielennox | i see why we named the initial blueprint 'federation' but we need to start rolling its usage back | 05:47 |
| jamielennox | the word | 05:48 |
| stevemar | i also realized there isn't a client call for /metadata either. i'd have to ask marek about that, most of the time it's done through a browser | 05:49 |
| jamielennox | if horizon doesn't need it there may be no use for it in client | 05:50 |
| stevemar | jamielennox, it's definitely something that can wait | 06:08 |
| stevemar | jamielennox, do you watch cricket? | 06:09 |
| jamielennox | stevemar: not really - i know we won though | 06:10 |
| jamielennox | convincingly | 06:10 |
| stevemar | jamielennox, yep - the games from the world cup have been playing on some local stations | 06:10 |
| jamielennox | stevemar: getting much interest? | 06:10 |
| jamielennox | it was pretty much the same teams in the finals | 06:11 |
| stevemar | i watched a 1 hr replay of the aus vs india match, pretty interesting stuff | 06:11 |
| stevemar | i think there is interest from the locals in toronto to see the matches. (afaik anyway) | 06:12 |
| stevemar | it was neat | 06:12 |
| stevemar | anyway, just wanted to let it be known that matches were being played (live) and replayed on some stations | 06:13 |
| jamielennox | there's a fairly high indian, pakistan, and NZ population so there was a lot of rivalry in it | 06:13 |
| jamielennox | ok, i'm out | 06:17 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Support discovery on the AUTH_INTERFACE https://review.openstack.org/168791 | 06:18 |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Support /auth routes for list projects and domains https://review.openstack.org/168792 | 06:18 |
| jamielennox | can finish that one tomorrow | 06:18 |
| stevemar | have fun | 06:18 |
| *** jamielennox is now known as jamielennox|away | 06:20 | |
| *** markvoelker has joined #openstack-keystone | 06:22 | |
| *** stevemar has quit IRC | 06:27 | |
| *** markvoelker has quit IRC | 06:27 | |
| *** stevemar has joined #openstack-keystone | 06:27 | |
| *** ChanServ sets mode: +v stevemar | 06:27 | |
| *** stevemar has quit IRC | 06:34 | |
| *** stevemar has joined #openstack-keystone | 06:34 | |
| *** ChanServ sets mode: +v stevemar | 06:34 | |
| *** ParsectiX has joined #openstack-keystone | 06:38 | |
| *** mflobo has quit IRC | 06:39 | |
| *** mflobo has joined #openstack-keystone | 06:41 | |
| *** erkules has quit IRC | 06:43 | |
| *** erkules has joined #openstack-keystone | 06:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add support to create SAML assertion based on a token https://review.openstack.org/159022 | 07:00 |
| *** afazekas has joined #openstack-keystone | 07:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add support to create ECP assertion based on a token https://review.openstack.org/168678 | 07:10 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add support to create ECP assertion based on a token https://review.openstack.org/168678 | 07:12 |
| openstackgerrit | Eli Qiao proposed openstack/oslo.policy: Don't reload policy files in policy.d every time https://review.openstack.org/168798 | 07:12 |
| *** stevemar has quit IRC | 07:19 | |
| *** markvoelker has joined #openstack-keystone | 07:23 | |
| *** markvoelker has quit IRC | 07:27 | |
| *** lhcheng has joined #openstack-keystone | 07:27 | |
| *** spandhe has joined #openstack-keystone | 07:34 | |
| *** henrynash has joined #openstack-keystone | 07:50 | |
| *** ChanServ sets mode: +v henrynash | 07:50 | |
| *** spandhe has quit IRC | 07:50 | |
| *** dims has joined #openstack-keystone | 07:53 | |
| *** dims has quit IRC | 07:58 | |
| *** browne has quit IRC | 08:08 | |
| *** jistr has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix for migration 062 on MySQL https://review.openstack.org/168003 | 08:19 |
| *** krykowski has joined #openstack-keystone | 08:21 | |
| *** lhcheng has quit IRC | 08:35 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix for migration 062 on MySQL https://review.openstack.org/168003 | 08:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Update configuration documentation for domain config https://review.openstack.org/165754 | 08:54 |
| *** henrynash has quit IRC | 08:55 | |
| *** henrynash has joined #openstack-keystone | 09:05 | |
| *** ChanServ sets mode: +v henrynash | 09:05 | |
| *** rdo has quit IRC | 09:11 | |
| *** rdo has joined #openstack-keystone | 09:13 | |
| *** ncoghlan has quit IRC | 09:17 | |
| *** markvoelker has joined #openstack-keystone | 09:24 | |
| *** markvoelker has quit IRC | 09:29 | |
| *** jacer_huawei has quit IRC | 09:30 | |
| *** lhcheng has joined #openstack-keystone | 09:36 | |
| *** lhcheng has quit IRC | 09:40 | |
| *** henrynash has quit IRC | 09:48 | |
| *** davechen has left #openstack-keystone | 09:49 | |
| *** dims has joined #openstack-keystone | 09:54 | |
| *** henrynash has joined #openstack-keystone | 10:08 | |
| *** ChanServ sets mode: +v henrynash | 10:08 | |
| *** jacer_huawei has joined #openstack-keystone | 10:13 | |
| *** pnavarro|off has quit IRC | 10:19 | |
| *** samueldmq-away is now known as samueldmq | 10:22 | |
| samueldmq | henrynash, hi, morning | 10:23 |
| henrynash | samueldmq: moring | 10:23 |
| samueldmq | henrynash, I am having a look at 'Adds inherited column to RoleAssignment PK' again | 10:24 |
| henrynash | morining | 10:24 |
| henrynash | ok | 10:24 |
| samueldmq | :-) | 10:24 |
| samueldmq | hha | 10:24 |
| samueldmq | so I better to do not rebase on morgan's patch, since it can land or not in kilo, right? | 10:24 |
| henrynash | i think it has already landed | 10:24 |
| henrynash | so just a rebase on master is fine | 10:25 |
| samueldmq | oh, I am so out-of-date :/ | 10:25 |
| *** markvoelker has joined #openstack-keystone | 10:25 | |
| henrynash | i know…a couple days and the world has changed | 10:25 |
| samueldmq | I think you noticed I was a bit disappeared from this channel :/ | 10:26 |
| samueldmq | yeah, I've been working on horizon for hierarchical projects | 10:26 |
| samueldmq | we then have an initial implementation :-) | 10:26 |
| henrynash | very cool | 10:26 |
| samueldmq | I'll write a blog post and put have a point on our tomorrow's meeting, so we can get feedback and let ppl know | 10:27 |
| henrynash | that would be great | 10:27 |
| samueldmq | and I hope to be definitively back to keystone again this week :-) | 10:27 |
| samueldmq | I think here is my place haha | 10:27 |
| henrynash | no worries…now’s a good time to be spending tme on other things…. | 10:29 |
| *** markvoelker has quit IRC | 10:30 | |
| samueldmq | henrynash, yeah, it isn't bad to at least know other projects | 10:31 |
| samueldmq | henrynash, I dont see myself working a long time on front-end, but that was great to know | 10:31 |
| *** pnavarro|off has joined #openstack-keystone | 10:31 | |
| henrynash | samueldmq: i think it’s a positive advantage | 10:31 |
| samueldmq | henrynash, I am also starting to work on openstack infra, ppl are so smart there too :-) | 10:32 |
| henrynash | samueldmq: anytrhing that conects developers more to the eventual end users is good | 10:32 |
| samueldmq | henrynash, yes it is, but sometimes hard due to UX, etc | 10:32 |
| *** iamjarvo has joined #openstack-keystone | 10:46 | |
| openstackgerrit | Konstantin Maximov proposed openstack/keystone: Improved policy setting in the 'v3 filter' tests https://review.openstack.org/156597 | 10:59 |
| samueldmq | henrynash, you still around ? | 11:08 |
| henrynash | indeed | 11:08 |
| samueldmq | henrynash, by default, we run sql live tests on a db called test_keystone | 11:09 |
| samueldmq | henrynash, I run tests once, then create tables, apply migrations, etc | 11:09 |
| samueldmq | henrynash, since the db state is kept, maybe I won't be able to run the tests again just after that | 11:09 |
| *** yasu_ has quit IRC | 11:09 | |
| samueldmq | henrynash, makes sense? | 11:10 |
| henrynash | samuledmq: depends if the tests clean up after themselves | 11:12 |
| samueldmq | henrynash, yeah, I am not sure we drop all after tests | 11:12 |
| samueldmq | henrynash, digging a bit more on it | 11:13 |
| *** ParsectiX has quit IRC | 11:13 | |
| *** henrynash has quit IRC | 11:13 | |
| samueldmq | henrynash, do you add mysql-python to your test-requirements when you need to run live tests? | 11:13 |
| *** henrynash_ has joined #openstack-keystone | 11:13 | |
| *** ChanServ sets mode: +v henrynash_ | 11:13 | |
| samueldmq | henrynash_, ops | 11:13 |
| samueldmq | henrynash_, do you add mysql-python to your test-requirements when you need to run live tests? | 11:14 |
| samueldmq | henrynash_, just to make sure I am using the right library to python-MySQLdb | 11:14 |
| henrynash_ | I do pip install MySQL-python | 11:16 |
| henrynash_ | or pip install psycopg2 | 11:17 |
| henrynash_ | for postgres | 11:17 |
| samueldmq | henrynash_, k got it | 11:17 |
| openstackgerrit | henry-nash proposed openstack/keystone: Reload drivers when their domain config is updated https://review.openstack.org/163322 | 11:19 |
| *** amakarov_away is now known as amakarov | 11:22 | |
| *** lhcheng has joined #openstack-keystone | 11:25 | |
| *** markvoelker has joined #openstack-keystone | 11:26 | |
| *** henrynash_ has quit IRC | 11:26 | |
| breton | and I do .tox/py27/bin/pip install <> | 11:28 |
| *** lhcheng has quit IRC | 11:29 | |
| *** markvoelker has quit IRC | 11:31 | |
| *** jaosorior has joined #openstack-keystone | 11:34 | |
| *** iamjarvo has quit IRC | 11:37 | |
| samueldmq | breton, hmm thanks for this, it is better than add to test-requirements and then forget to remove it :p | 11:43 |
| breton | there are issues with live tests though | 11:44 |
| samueldmq | breton, I am getting some migrate.exceptions.DatabaseAlreadyControlledError | 11:44 |
| samueldmq | breton, on master | 11:44 |
| samueldmq | breton, any idea? | 11:44 |
| breton | yep | 11:44 |
| breton | two | 11:44 |
| breton | even three | 11:44 |
| breton | firtsth, drop your database and recreate it before each test | 11:44 |
| breton | *first | 11:45 |
| samueldmq | breton, yes that's what I was talking to henrynash | 11:45 |
| breton | second -- use TEST_RUN_CONCURRENCY=1 | 11:45 |
| samueldmq | breton, as now we don't do downgrades anymore, the db state is kept | 11:45 |
| samueldmq | breton, and then we can't run them a second time | 11:45 |
| breton | that's not really true. Db state is not always kept. | 11:45 |
| breton | there is some cleanup afaik | 11:45 |
| samueldmq | breton, ah then I am wrong | 11:46 |
| breton | third -- don't run all tests, run only one test using tox -e py27 test_some_stuff | 11:46 |
| breton | in fact, live tests are broken. I think I should file some bugs on them | 11:47 |
| samueldmq | breton, what's the problem indeed? | 11:47 |
| *** iamjarvo has joined #openstack-keystone | 11:47 | |
| samueldmq | breton, hmm, cool, I 'll be glad if I can help, please feel free to ping me if you need help | 11:47 |
| breton | will, first is that migrate.exceptions.DatabaseAlreadyControlledError | 11:47 |
| breton | second -- I had some issues with postgres | 11:48 |
| samueldmq | breton, I am trying 'tox -e py27 -- use TEST_RUN_CONCURRENCY=1 test_sql_livetest' | 11:49 |
| samueldmq | breton, but it's running all tests | 11:49 |
| samueldmq | breton, I should add this '-- use', right? | 11:49 |
| samueldmq | breton, or is this just a venv to export ? :p | 11:50 |
| breton | err, it's a shell variable. do "TEST_RUN_CONCURRENCY=1 tox -e py27 ..." | 11:51 |
| * samueldmq facepalm | 11:51 | |
| samueldmq | breton, hmm so all these errors imply we do not have gate jobs to run tests in live dbs (mysql, prostgres, etc) | 11:53 |
| samueldmq | breton, maybe it could be good to have them | 11:53 |
| breton | samueldmq: dstanek does some work on functional testing | 11:56 |
| *** iamjarvo has quit IRC | 11:57 | |
| samueldmq | breton, yeah, he may have some good idea on how to have it | 11:58 |
| samueldmq | breton, will bug him later | 11:58 |
| samueldmq | breton, btw, I could run the tests, thanks | 11:58 |
| *** ParsectiX has joined #openstack-keystone | 12:01 | |
| *** raildo has joined #openstack-keystone | 12:04 | |
| *** jistr has quit IRC | 12:07 | |
| *** jistr has joined #openstack-keystone | 12:08 | |
| *** markvoelker has joined #openstack-keystone | 12:10 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 12:15 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Share engine between migration helpers. https://review.openstack.org/137778 | 12:15 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Add index to the revocation_event.revoked_at. https://review.openstack.org/137639 | 12:15 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Fix index name the assignment.actor_id table. https://review.openstack.org/137637 | 12:15 |
| *** dims has quit IRC | 12:17 | |
| *** dims has joined #openstack-keystone | 12:18 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Use metadata.create_all() to fill a test database https://review.openstack.org/93558 | 12:18 |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Comparision of database models and migrations. https://review.openstack.org/80630 | 12:18 |
| *** krtaylor has quit IRC | 12:19 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Restore name to services listed in catalog https://review.openstack.org/167675 | 12:22 |
| *** gordc has joined #openstack-keystone | 12:28 | |
| *** ayoung_ZZzz__ is now known as ayoung_short | 12:28 | |
| *** ayoung_short is now known as ayoung_cough | 12:28 | |
| *** ayoung_cough is now known as ayoung_yawn | 12:29 | |
| *** ayoung_yawn is now known as ayoung | 12:29 | |
| ayoung | Good morning.... | 12:29 |
| raildo | ayoung, morning :) | 12:31 |
| ayoung | raildo, samueldmq so...I figured out that we can do endpoint binding of tokens today with policy | 12:31 |
| ayoung | haven't done a proof of concept yet | 12:32 |
| ayoung | but... | 12:32 |
| ayoung | you would create a rule something like | 12:32 |
| ayoung | the role rule we have | 12:33 |
| ayoung | hmmm....can we do that today...? | 12:33 |
| ayoung | we'd need a "contains" check, wouldn't we? | 12:34 |
| raildo | you mean create rule that contains other rule (and a role)? | 12:34 |
| ayoung | not quite | 12:35 |
| ayoung | I mean a rule that says | 12:35 |
| ayoung | well, this is what role does | 12:35 |
| ayoung | return self.match.lower() in [x.lower() for x in creds['roles']] | 12:36 |
| ayoung | so | 12:36 |
| ayoung | return self.match.lower() in [x.lower() for x in token.service_catalog['endpoints']] | 12:36 |
| ayoung | but that is not right, since the endpoints are not in a single list | 12:36 |
| ayoung | lets see... | 12:36 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/examples/pki/cms/auth_v3_token_scoped.json#n28 | 12:37 |
| raildo | ayoung, hum... i get it... | 12:38 |
| ayoung | Let me try some code against that... | 12:38 |
| *** Ephur has joined #openstack-keystone | 12:39 | |
| samueldmq | ayoung, good morning, reading up ... | 12:40 |
| samueldmq | ayoung, well, not sure I follow, what problem are we trying to solve? | 12:42 |
| dstanek | morning all | 12:43 |
| ayoung | samueldmq, endpoint binding of tokens | 12:43 |
| ayoung | samueldmq, ensuring a token can only be used with a specific endpoint or set of endpoints | 12:43 |
| ayoung | now, we do know the service, so we could filter on that, or | 12:44 |
| *** pnavarro|off has quit IRC | 12:47 | |
| ayoung | raildo, samueldmq http://paste.openstack.org/show/197536/ | 12:50 |
| *** timcline has joined #openstack-keystone | 12:52 | |
| *** timcline has quit IRC | 12:52 | |
| *** timcline has joined #openstack-keystone | 12:53 | |
| samueldmq | ayoung, looking | 12:57 |
| *** iamjarvo has joined #openstack-keystone | 12:59 | |
| *** timcline has quit IRC | 12:59 | |
| *** krtaylor has joined #openstack-keystone | 13:00 | |
| raildo | ayoung, so... what happen if I got a unscoped token, since this token doesn't have a catolog, right? | 13:01 |
| ayoung | raildo, you can't use an unscoped token on remote endpoints anyway | 13:01 |
| raildo | ayoung, Do you need considerer this case? | 13:01 |
| raildo | ayoung, ok | 13:01 |
| samueldmq | ayoung, so let me say what I understood and you check if I am right | 13:01 |
| ayoung | the real question is what happens if a place decides to shut off the service catalog | 13:01 |
| samueldmq | ayoung, you add constraints in the policy for endpoints to be used | 13:01 |
| ayoung | you could even do this as a stand alone middleware piece | 13:02 |
| samueldmq | ayoung, to check the endpoint you're trying to use is one in the list of endps in your token | 13:02 |
| samueldmq | ayoung, right? | 13:02 |
| ayoung | and you load a specific rule, maybe even from a separate policy file | 13:02 |
| ayoung | that would allow it to vary per endpoint without compromising our goal of a unified policy file | 13:03 |
| ayoung | samueldmq, yes | 13:03 |
| samueldmq | ayoung, nice so I got it :-) | 13:03 |
| *** pnavarro|off has joined #openstack-keystone | 13:04 | |
| samueldmq | ayoung, today the issue is that you could use an endpoint you get an id somehow | 13:04 |
| samueldmq | ayoung, you could possibly .. | 13:04 |
| ayoung | yeah, we want to limit the damage that can be done with a token, so limit it to a specific set of endpoints | 13:04 |
| raildo | ayoung, sounds good to me | 13:05 |
| samueldmq | ayoung, the same ones that are in your list inside your token, right? | 13:05 |
| samueldmq | ayoung, that would then be applied to all API endpoints, wouldnt it? | 13:05 |
| ayoung | samueldmq, yeah, | 13:05 |
| *** bknudson has quit IRC | 13:05 | |
| samueldmq | ayoung, oh nice idea imo :-) | 13:05 |
| ayoung | note that my paste there is reading an example token from rthe client repo | 13:05 |
| samueldmq | ayoung, yeah, ran it | 13:06 |
| ayoung | samueldmq, I thuink the trick is that finding the endpoint ID is going to require python code. I wonder if it is soemthig we can make generic | 13:06 |
| samueldmq | ayoung, it will be placed on middleware, tight? | 13:06 |
| samueldmq | right* | 13:06 |
| ayoung | samueldmq, well, eventually | 13:07 |
| samueldmq | ayoung, and how the middleware knows the service that is using it ? | 13:07 |
| ayoung | I want soemthing that can be done with the exisitng policy setup, so in my presentation, I wanted to use this as an example | 13:07 |
| ayoung | but it might not be possible. I don;'t know how to find that endpoint id using the existing set of checks. I don't think we can | 13:07 |
| ayoung | so, I might try to get a new check in, one that looks for a value in a nested dictionary | 13:08 |
| ayoung | samueldmq, you would edit the policy file on the host running the service | 13:08 |
| ayoung | kinda like the cloudsample policy file and admin domain id | 13:09 |
| *** iamjarvo has quit IRC | 13:09 | |
| samueldmq | ayoung, so hard-coded ? | 13:09 |
| ayoung | policy files are designed to be like config files. Soft coded | 13:10 |
| samueldmq | ayoung, any($my_service_id in endpoint['id'] for endpoint in token['endpoints']) | 13:10 |
| ayoung | samueldmq, close | 13:11 |
| samueldmq | :-) | 13:11 |
| ayoung | that doesn't deal with the nesting, and, of course we don't have an any check yet | 13:11 |
| samueldmq | ayoung, yeah, that was a pseudo-python-like code | 13:12 |
| ayoung | so the language would have to be clear. | 13:12 |
| ayoung | something like | 13:12 |
| ayoung | any:token.catalog.[].endpoints.id( "1df0b44d92634d59bd0e0d60cf7ce432") | 13:14 |
| *** nkinder has quit IRC | 13:16 | |
| samueldmq | ayoung, how do we bind a policy to a service endpoint? | 13:18 |
| ayoung | samueldmq, read up. I thought I answered that one already | 13:20 |
| *** joesavak has joined #openstack-keystone | 13:23 | |
| samueldmq | ayoung, we could simply set 'service_ids:[]' in the policy and then middleware would enforce to check if any in this list match something in the token's catalog | 13:25 |
| samueldmq | ayoung, 'service_ids:[]' could be set by keystone once we have dynamic policies | 13:26 |
| samueldmq | ayoung, makes sense? | 13:26 |
| ayoung | samueldmq, so...sort of what I'm thinking, but more like this: | 13:26 |
| ayoung | 1. For Kilo, we get an extension in to policy that will let us check the endpoint as part of the existing policy check; it would have to be appended to the rule for eaach compuet:blah | 13:27 |
| ayoung | meanwhile, we start work on a middleware piece that would allow checking the service is in the token based on the policy engine, but using a separate policy file | 13:27 |
| ayoung | that file can be generated after the server is registered with Keystone, so we know what Id to put in it | 13:28 |
| ayoung | If we do dynamic policy, then, yes, we can dynamically put the service endpoint id into the file | 13:28 |
| *** sirushti has joined #openstack-keystone | 13:28 | |
| samueldmq | exactly | 13:28 |
| samueldmq | ayoung, ++ | 13:29 |
| ayoung | so the short term task is to figure out the language for the nesting | 13:29 |
| samueldmq | ayoung, so for now you just want to change the policy ? and you are wondering if its possible | 13:29 |
| ayoung | would this syntax work? any:token.catalog.[].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:30 |
| ayoung | use [] to imp;ly iterate through all of the elements of an array | 13:30 |
| samueldmq | ayoung, give me an example of nested endpoitns | 13:31 |
| samueldmq | ayoung, looked into that one on keystoenclient you posted, but they are flat there | 13:31 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/examples/pki/cms/auth_v3_token_scoped.json#n28 | 13:31 |
| ayoung | no...the catalog has multiple entries in an array | 13:31 |
| samueldmq | ayoung, ah got it | 13:32 |
| ayoung | we could do something like | 13:32 |
| ayoung | any:token.catalog.[type:timage].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:32 |
| samueldmq | ayoung, this any:token.catalog.[].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:32 |
| samueldmq | ayoung, makes sense to me | 13:32 |
| ayoung | make that any:token.catalog.[type:image].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:32 |
| samueldmq | ayoung, yeah applying filtering if we need | 13:32 |
| samueldmq | ayoung, but not necessary for now | 13:33 |
| samueldmq | ayoung, since the simple form workds | 13:33 |
| samueldmq | works* | 13:33 |
| ayoung | well, we would want to be able to write rules that say "this token is good for glance but no other service , and ignore the endpoint_id | 13:33 |
| ayoung | any:token.catalog.[], type:image ? | 13:34 |
| samueldmq | ayoung, so you just return glance endpoint in the token? | 13:34 |
| samueldmq | ayoung, what will define where a token can be used is the service list in the catalog | 13:35 |
| *** chlong has joined #openstack-keystone | 13:36 | |
| ayoung | samueldmq, sorry, didn't understand. was that a question, or were you confirming? | 13:37 |
| samueldmq | ayoung, you want to define that a token is only valid for glance, for example, irght? | 13:38 |
| ayoung | samueldmq, sure | 13:38 |
| samueldmq | ayoung, imo, the solution for this is that you only return Glance service endpoint in such token | 13:38 |
| samueldmq | that's all | 13:38 |
| ayoung | exactly | 13:39 |
| samueldmq | ayoung, no need to [type:image] | 13:39 |
| ayoung | and, yes, we'd need a machanism to do that | 13:39 |
| samueldmq | ayoung, just need to enforce any:token.catalog.[].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:39 |
| samueldmq | ayoung, if there is no other service than glance in the token's catalog, this will fail for other services | 13:40 |
| ayoung | samueldmq, \that would be in the policy file for the cases where you don't want to say "this specific endpoint" but rather "all glance instances are OK" | 13:40 |
| samueldmq | it's indeed ;) | 13:40 |
| samueldmq | ayoung, but this is part of binding policy files with specific endpoints, which is on keystone, right? | 13:40 |
| ayoung | a arnage of options | 13:41 |
| ayoung | range | 13:41 |
| samueldmq | ayoung, yeah I agree it's useful now (with this usecase you said), but we will need to make it conssitent in keystone, so it will be possible to generate it dynamically in the future | 13:41 |
| ayoung | so, need to get the grammar correct. I don;t want to build a mechanism specific to Service catalogm, but something generic for the policy engine to use for any problem set | 13:42 |
| samueldmq | ayoung, ok, it's like a OCL language, where we are navigating through the token properties :) | 13:43 |
| samueldmq | ayoung, http://en.wikipedia.org/wiki/Object_Constraint_Language | 13:44 |
| samueldmq | ayoung, ok I agree with you | 13:44 |
| samueldmq | ayoung, let's make the policy language much more powerful | 13:44 |
| samueldmq | o/ | 13:44 |
| ayoung | XACML | 13:44 |
| *** joesavak has quit IRC | 13:44 | |
| samueldmq | ayoung, I can find some time to be with you in this battle if you want help | 13:44 |
| *** bknudson has joined #openstack-keystone | 13:45 | |
| *** ChanServ sets mode: +v bknudson | 13:45 | |
| ayoung | samueldmq, so, lets say first we do a "ContainsCheck" which defines a path in the context and a value to look for | 13:47 |
| ayoung | and it will allow for [] to imply iterate through all the values in an list | 13:47 |
| ayoung | and returns true upon first match, false if no matches | 13:48 |
| samueldmq | ayoung, ++ | 13:48 |
| samueldmq | ayoung, what about | 13:51 |
| samueldmq | ayoung, (token.catalog.[].type, image).[].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:51 |
| samueldmq | ayoung, a = token.catalog.[].type, image | 13:52 |
| samueldmq | ayoung, b = a.[].endpoints.[].id, 1df0b44d92634d59bd0e0d60cf7ce432 | 13:52 |
| samueldmq | ayoung, then a is a list of services whose match type = image | 13:52 |
| *** stevemar has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v stevemar | 13:52 | |
| samueldmq | ayoung, having that list, you apply other function, to get only those in that first list (a) that match the given id | 13:52 |
| samueldmq | ayoung, b will then be either [something] or [] | 13:53 |
| samueldmq | ayoung, [somehting] is evaluated to True, [] to False | 13:53 |
| ayoung | so....we have to be careful. We could do something where the list function returns the value instead of "True" but we want to make sure we don;t get into a case where it returns a Falsey value | 13:54 |
| samueldmq | ayoung, k gotta to go now, talk to you later | 13:56 |
| *** gokrokve has joined #openstack-keystone | 14:02 | |
| *** nkinder has joined #openstack-keystone | 14:06 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:09 | |
| *** ParsectiX has quit IRC | 14:11 | |
| stevemar | dolphm, lbragstad ping | 14:19 |
| *** timcline has joined #openstack-keystone | 14:20 | |
| lbragstad | stevemar: pong | 14:23 |
| *** mattfarina has joined #openstack-keystone | 14:23 | |
| *** davechen has joined #openstack-keystone | 14:24 | |
| *** davechen has left #openstack-keystone | 14:26 | |
| stevemar | lbragstad, have any docs on how to set up fernet-y stuff? | 14:28 |
| lbragstad | stevemar: yes, I believe dolphm did do some stuff around that. Let me grab them for you | 14:28 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Restore name to services listed in catalog https://review.openstack.org/167675 | 14:29 |
| stevemar | lbragstad, eggcellent | 14:29 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Change ECP wrapped SAML assertion term in API https://review.openstack.org/168928 | 14:30 |
| lbragstad | stevemar: http://docs.openstack.org/developer/keystone/configuration.html#uuid-pki-pkiz-or-fernet | 14:30 |
| rodrigods | stevemar, ^ liked the term you used in the keystoneclient patch | 14:30 |
| lbragstad | stevemar: http://docs.openstack.org/developer/keystone/configuration.html#encryption-keys-for-fernet | 14:30 |
| lbragstad | stevemar: this is essentially the different in setting up fernet against master https://github.com/dolph/keystone-deploy/compare/fernet-tokens | 14:31 |
| lbragstad | stevemar: does that help? | 14:37 |
| *** david8hu has quit IRC | 14:37 | |
| stevemar | lbragstad, oh hai - yes, it does | 14:37 |
| stevemar | sorry, was busy reading them | 14:37 |
| *** david8hu has joined #openstack-keystone | 14:37 | |
| lbragstad | stevemar: cool, let me know if anything doesn't make sense and I'll get a patch pushed up | 14:39 |
| stevemar | lbragstad, yessir | 14:40 |
| *** krykowski has quit IRC | 14:40 | |
| *** me has joined #openstack-keystone | 14:42 | |
| *** me is now known as Guest54459 | 14:43 | |
| Guest54459 | hello guys ! | 14:49 |
| Guest54459 | newbie question : I am trying to deploy keystone, when i run : su -s /bin/sh -c "keystone-manage db_sync" keystone , it tell me : su : authentification failure, however i put the correct passwd of root. any ideas ? | 14:49 |
| *** timcline has quit IRC | 14:49 | |
| stevemar | Guest54459, you're not providing a login to the su command | 14:52 |
| stevemar | try that syntax with a non-openstack command | 14:53 |
| stevemar | running that command with sudo instead of su should work | 14:54 |
| *** thedodd has joined #openstack-keystone | 14:56 | |
| *** timcline has joined #openstack-keystone | 14:57 | |
| *** Guest96413 is now known as redrobot | 14:58 | |
| ayoung | samueldmq, so I think we messed up on the catalog definition. We could, I think, make it work on the GenericCheck if we had, instead of doing the Services as a list, used the "type" field as the name in a a dictionary | 15:00 |
| *** timcline_ has joined #openstack-keystone | 15:00 | |
| ayoung | it is the [] part that doesn't work. We probably should have done that all the way down the service catalog. | 15:00 |
| ayoung | we could have done: | 15:01 |
| *** rwsu has joined #openstack-keystone | 15:01 | |
| *** lhcheng has joined #openstack-keystone | 15:02 | |
| *** timcline has quit IRC | 15:03 | |
| *** iamjarvo has joined #openstack-keystone | 15:04 | |
| ayoung | id:token.catalog.image.endpoints.id | 15:06 |
| *** lhcheng has quit IRC | 15:07 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Add server_default to relay_state_prefix in service_provider model https://review.openstack.org/168947 | 15:15 |
| *** afazekas has quit IRC | 15:16 | |
| *** zzzeek has joined #openstack-keystone | 15:16 | |
| Guest54459 | Stevemar, i've tried severral times with sudo, it gives the following error http://paste.openstack.org/show/197568/ | 15:17 |
| ayoung | dstanek, is there a way in python to create a single iteration from nested list, short of doing something like this: | 15:17 |
| ayoung | def endpoints_from_token(jdoc): | 15:17 |
| ayoung | for service in jdoc['token']['catalog']: | 15:17 |
| ayoung | for endpoint in service['endpoints']: | 15:17 |
| ayoung | yield endpoint['id'] | 15:17 |
| rodrigods | ayoung, zip() ? | 15:17 |
| rodrigods | ayoung, ah... no | 15:18 |
| rodrigods | don't know* | 15:18 |
| dstanek | ayoung: not really. because you are not really flattening a set of nested lists | 15:18 |
| dstanek | ayoung: do you not like what you did there? | 15:20 |
| ayoung | dstanek, I want a way to write, in our policy grammar: at least one of token.catalog(all).endpoints(all).id == <literal> | 15:21 |
| ayoung | dstanek, I want to see if I can do it with the current generic check | 15:21 |
| stevemar | Guest54459, that error looks a lot more helpful :) | 15:22 |
| ayoung | dstanek, https://github.com/openstack/oslo.policy/blob/master/oslo_policy/_checks.py#L280 | 15:22 |
| ayoung | it uses AST | 15:22 |
| stevemar | Guest54459, looks like something is wrong with the mysql settings in keystone.conf | 15:22 |
| dstanek | ayoung: "<literal> in endpoints_from_token()" ? | 15:23 |
| ayoung | Guest54459, the root Unix password is different from the database password for the Root user | 15:23 |
| dstanek | ayoung: i think that GenericCheck isn't right for this | 15:23 |
| ayoung | dstanek, It is close | 15:24 |
| *** joesavak has joined #openstack-keystone | 15:24 | |
| ayoung | I want to see if I could force it with Generic, and if not, write the most straightforward extension to it | 15:24 |
| ayoung | and if there was something that AST could operate on for doing the collections, that would make the most sense...I think | 15:25 |
| *** chlong has quit IRC | 15:26 | |
| *** browne has joined #openstack-keystone | 15:27 | |
| Guest54459 | sudo grep connection= /etc/keystone/keystone.conf | 15:31 |
| Guest54459 | connection=mysql://keystone:swift@172.16.200.91/keystone | 15:31 |
| Guest54459 | 15:31 | |
| Guest54459 | guess it is write like that | 15:31 |
| dstanek | Guest54459: can you connect to mysql from the command line client? | 15:32 |
| Guest54459 | i can | 15:34 |
| Guest54459 | and when i ran $ keystone-manage db-sync | 15:34 |
| Guest54459 | it perform no output, but when i check the keystone database, i found no tables | 15:35 |
| ayoung | Guest54459, is 172.16.200.91 the same host? | 15:37 |
| ayoung | Could you be lookoing on the wrong machine? | 15:37 |
| ayoung | dstanek, for a path to, say the catalog, I write token.catalog which would return an array. If I knew it was the frist entry I could probably do | 15:39 |
| ayoung | token.catalog[0] | 15:39 |
| ayoung | and if I knew which value the endpoint was supposed to be | 15:39 |
| ayoung | token.catalog[0].endpoints[0] | 15:39 |
| ayoung | token.catalog[0].endpoints[0].id | 15:39 |
| Guest54459 | ayoung, yes it is the running interface onthe host | 15:40 |
| dstanek | ayoung: how would you know that you are looking for the first one? | 15:40 |
| ayoung | dstanek, I don't | 15:40 |
| ayoung | juwst trying to find a syntax that makes sense | 15:40 |
| ayoung | Moving from a path traversal to a search...It is certainly an expansion on the scope of the check | 15:41 |
| ayoung | so, yeah ,more than what Generic does | 15:41 |
| Guest54459 | but, the think is, when i run $ mysql -u keystone@172.16.200.91 -pswift | 15:41 |
| ayoung | OTOH, we should have made the service catalog more regualr | 15:41 |
| ayoung | Guest54459, try with the -H option | 15:42 |
| Guest54459 | it said Access Denied | 15:42 |
| ayoung | err --host | 15:42 |
| ayoung | --host=host_name, -h host_name | 15:42 |
| ayoung | so it would be | 15:42 |
| ayoung | mysql keystone --host=172.16.200.91 --user=keystone --password | 15:43 |
| Guest54459 | ERROR 2003 (HY000): Can't connect to MySQL server on '172.16.200.91' (111) | 15:44 |
| ayoung | Guest54459, maybe mysql is not listening on a port | 15:45 |
| *** haneef has quit IRC | 15:49 | |
| samueldmq | ayoung, do policy still accepts http urls to be evaluated ? | 15:50 |
| ayoung | yep | 15:50 |
| ayoung | samueldmq, but that way leads to madness | 15:50 |
| samueldmq | ayoung, yes, I agree :) | 15:50 |
| samueldmq | ayoung, do you have an example? | 15:50 |
| ayoung | Nope | 15:50 |
| samueldmq | ayoung, just to me to try something out | 15:50 |
| ayoung | just see in the code that it is still supported | 15:51 |
| samueldmq | ayoung, k will get one myself | 15:51 |
| ayoung | please don | 15:51 |
| ayoung | 't | 15:51 |
| ayoung | I'd rather deprecate that | 15:51 |
| samueldmq | ayoung, HttpCheck, right? | 15:51 |
| ayoung | yeah | 15:51 |
| samueldmq | ayoung, what do you think about going through resources in the cloud and doing arbitrary checks | 15:52 |
| samueldmq | ayoung, for example | 15:52 |
| samueldmq | ayoung, any(user.projects.number_instances < 20) | 15:52 |
| *** iamjarvo has quit IRC | 15:52 | |
| Guest54459 | i've got another prob, i just changed the bind address in /etc/mysql/my.conf then the mysql service wouldn't restart.... guess i'm gonna start the deploy on an other clean VM, anyway thank you guys ! | 15:53 |
| ayoung | samueldmq, I suspect that the Congress folks are thinking along those lines | 15:53 |
| samueldmq | ayoung, hmm, will dig a bit on this there | 15:53 |
| samueldmq | ayoung, thx | 15:53 |
| dstanek | ayoung: samueldmq: it seems to me that you are almost inventing/needing a new xpath language | 15:55 |
| samueldmq | dstanek, hmm, nice catch, need to revisit xpath | 15:56 |
| samueldmq | dstanek, what I was thinking was to provide a PoC in which we could do those arbitrary checks, using HttpChecks | 15:56 |
| samueldmq | dstanek, so that if you ask user.projects, the server on that url will then deduce: 'hmmm, that user's projects', let me call keystone to get this .. and so on | 15:57 |
| *** breton has quit IRC | 15:57 | |
| samueldmq | dstanek, and then apply logical expressions to validate anything, or not :-) | 15:57 |
| dstanek | samueldmq: wouldn't that lead to a ton of keystone calls? | 15:58 |
| *** breton has joined #openstack-keystone | 15:58 | |
| samueldmq | dstanek, complex expressions would be expensive to evaluate (taht's indeed) | 15:58 |
| samueldmq | dstanek, if you evaluate something already in the token (as we have today) then it's cheap | 15:59 |
| dstanek | samueldmq: right but you are adding a way to fetch more data right? | 15:59 |
| *** gokrokve_ has joined #openstack-keystone | 16:00 | |
| samueldmq | dstanek, yes | 16:01 |
| samueldmq | dstanek, if you want to do checks against more data, I need to get the data to do your checks agains | 16:01 |
| samueldmq | t | 16:01 |
| *** tqtran has joined #openstack-keystone | 16:02 | |
| *** edmondsw has joined #openstack-keystone | 16:02 | |
| *** gokrokv__ has joined #openstack-keystone | 16:02 | |
| *** gokrokve_ has quit IRC | 16:02 | |
| dstanek | samueldmq: that means that for every rule in the policy for every call to the service there will be a keystone hit | 16:03 |
| bknudson | http://goessner.net/articles/JsonPath/ | 16:03 |
| *** breton has quit IRC | 16:03 | |
| *** _cjones_ has joined #openstack-keystone | 16:04 | |
| *** gokrokve has quit IRC | 16:04 | |
| samueldmq | dstanek, yeah, keystone hit, or nova hit (if you want to assert something on instances state, etc) | 16:04 |
| samueldmq | dstanek, cons: with this approach, lots of added requests | 16:05 |
| samueldmq | dstanek, pros: too much flexibility added to policy checks | 16:05 |
| samueldmq | dstanek, do you think it is worth to make a PoC of this? | 16:05 |
| dstanek | samueldmq: it would be interesting, but i don't know how practical | 16:06 |
| dstanek | is someone asking for something like this? | 16:06 |
| samueldmq | dstanek, as for now, only my mind is asking for this | 16:06 |
| samueldmq | dstanek, to have a lot of flexibility and make the engine much more powerful | 16:06 |
| samueldmq | dstanek, if we find it really interesting, we can find a better way to do so | 16:07 |
| samueldmq | dstanek, if not, well, that was fun | 16:07 |
| dstanek | it would probably be interesting | 16:07 |
| dstanek | my caution would be that complexity is the enemy of security | 16:07 |
| samueldmq | dstanek, yeah I understand your concern | 16:10 |
| samueldmq | dstanek, I'll think a bit more about this, and how hard would be to implement a poc (at a glance, I think not too much effort) | 16:10 |
| *** thedodd has quit IRC | 16:10 | |
| openstackgerrit | Victor Sergeyev proposed openstack/keystone: Drop sql.transaction() usage in migration https://review.openstack.org/168987 | 16:12 |
| *** samueldmq_ has joined #openstack-keystone | 16:23 | |
| *** lhcheng has joined #openstack-keystone | 16:23 | |
| *** ericksonsantos has joined #openstack-keystone | 16:26 | |
| samueldmq | samueldmq_, hi - what's the motivation behind creating an IRC name almost equals to mine? | 16:27 |
| samueldmq | samueldmq_, pm'ed you | 16:29 |
| dstanek | samueldmq: are you talking to yourself? | 16:30 |
| raildo | lol | 16:30 |
| ayoung | dstanek, so...no, we don't need a new language. What I think I want to do is to extend the generic check such that, if a link in the chain is an array, it will search in each value of the array. It has to be in the generic checkl, I thin, otherwise we don;'t have enough information to idenityfy the value. | 16:30 |
| samueldmq | dstanek, haha no .. but I saw someone else registered samueldmq_, and linked samueldmq-away to it :/ | 16:31 |
| ayoung | samueldmq, want me to kick them? | 16:31 |
| ayoung | samueldmq, and, are you sure it in not your own nick in an additional xchat type window | 16:31 |
| ayoung | I know that if I spin up two windows, the second will have an _ at the end of the namne | 16:32 |
| dstanek | samueldmq: it's on from Brazil; home computer? | 16:32 |
| samueldmq | dstanek, let me check with my wife :-) | 16:32 |
| samueldmq | but anyway, someone else registered samueldmq_ on FreeNode | 16:32 |
| *** krykowski has joined #openstack-keystone | 16:33 | |
| ayoung | its the risk of IRC. | 16:33 |
| samueldmq | wait | 16:34 |
| *** samueldmq has quit IRC | 16:34 | |
| *** samueldmq-away has joined #openstack-keystone | 16:37 | |
| *** samueldmq-away is now known as samueldmq | 16:37 | |
| lbragstad | samueldmq: fixed? | 16:39 |
| samueldmq | lbragstad, well, that was my pc from home that got the second option ... but that still doesn't solve the issue someone else registered samueldmq_ on FreeNode :/ | 16:40 |
| * ayoung writing lisp code in python | 16:40 | |
| lbragstad | samueldmq: hmmm | 16:41 |
| samueldmq | lbragstad, maybe it's better to ask FreeNode staff about it :-) | 16:42 |
| samueldmq | lbragstad, or do not use samueldmq_ anymore, never! :p | 16:42 |
| lbragstad | samueldmq: either would be an option. | 16:43 |
| *** krykowski has quit IRC | 16:43 | |
| samueldmq | lbragstad, that makes me wonder how could we validate ppl 'token' in IRC :/ | 16:44 |
| *** jistr has quit IRC | 16:44 | |
| lbragstad | samueldmq: I think that's handled by registering your nick with Freenode, but I'm not 100% sure (cc dstanek) | 16:45 |
| samueldmq | lbragstad, yeah I registered samueldmq, but someone else registered samueldmq_ (and linked samueldmq-away) to it :/ | 16:46 |
| dstanek | samueldmq: is it possible that you registered it? | 16:46 |
| dstanek | or that your client did it for you? | 16:47 |
| lbragstad | a long time ago possibly? | 16:47 |
| dstanek | lbragstad: i think if you register the nick you need a password to use it | 16:47 |
| samueldmq | dstanek, only if my memory does not work anymore | 16:47 |
| dstanek | it was registered recently | 16:47 |
| dstanek | running this will tell you: /msg nickserv info samueldmq_ | 16:48 |
| dstanek | samueldmq: what irc client do you use at home? | 16:48 |
| samueldmq | dstanek, xchat | 16:48 |
| samueldmq | dstanek, I dont think it did it for me | 16:49 |
| samueldmq | dstanek, I registered samueldmq by myself | 16:49 |
| samueldmq | well, don't want to take your time with this :/ will ask FreeNode staff | 16:51 |
| dstanek | samueldmq: i'd go into the freenode channel and ask about it | 16:51 |
| samueldmq | dstanek, I went in there | 16:57 |
| samueldmq | dstanek, I ran: /msg NickServ SENDPASS samueldmq_ | 16:58 |
| samueldmq | dstanek, that sent an email to change the password, and it didnt do to any of my email addresses | 16:58 |
| samueldmq | dstanek, freenode staff told me to wait untill it expires, there is nothing to do | 16:58 |
| samueldmq | dstanek, cool! | 16:58 |
| *** bknudson has quit IRC | 17:04 | |
| lbragstad | has anyone had issues with pbr.version recently running db_sync ? | 17:12 |
| lbragstad | this is what I get when running latest keystone-deploy (eventlet branch) http://cdn.pasteraw.com/d44642a1dd67pogna457zs4ynmqwt8p | 17:13 |
| *** pnavarro|off has quit IRC | 17:14 | |
| *** spandhe has joined #openstack-keystone | 17:19 | |
| *** krykowski has joined #openstack-keystone | 17:20 | |
| ayoung | If you register it with a password, you need the password to kick someon. But iF you are not on IRC, someone else can use the Nick | 17:20 |
| ayoung | lbragstad, that looks familiar. | 17:21 |
| ayoung | lbragstad, rings a bell....but seems like it was an old version of PBR, or....pbr Version pulling in some dependnecy that was not resolved | 17:21 |
| ayoung | lbragstad, as I recall, it was due to how pbr version used the generated version string from setup.py in the git repo. | 17:22 |
| ayoung | We had issues along those lines when building RPMs | 17:23 |
| ayoung | PBR was doing things that should have been left to the RPM database, IIRC | 17:23 |
| lbragstad | ayoung: ahhh.. yeah I'm hitting issues with pip too though... trying to fix those first | 17:23 |
| ayoung | related | 17:23 |
| lbragstad | very | 17:23 |
| *** harlowja_away is now known as harlowja | 17:25 | |
| *** gokrokve has joined #openstack-keystone | 17:25 | |
| *** iamjarvo has joined #openstack-keystone | 17:26 | |
| *** krykowski has quit IRC | 17:27 | |
| *** gokrokv__ has quit IRC | 17:28 | |
| *** gokrokve has quit IRC | 17:30 | |
| *** amakarov is now known as amakarov_away | 17:40 | |
| *** jaosorior has quit IRC | 17:42 | |
| *** ljfisher has joined #openstack-keystone | 17:45 | |
| *** iamjarvo has quit IRC | 17:49 | |
| *** browne has quit IRC | 17:59 | |
| *** jaosorior has joined #openstack-keystone | 18:02 | |
| samueldmq | there is a test on test_backend_ldap failing due to a translation | 18:03 |
| samueldmq | it is ok if the os language is english, but fails if it isnt | 18:03 |
| samueldmq | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1353 | 18:03 |
| samueldmq | dstanek, ^ do you have a minute ? :-) | 18:04 |
| samueldmq | but there is something beyond that is making me confused ... why do the test just below passes ? | 18:05 |
| *** greghaynes has quit IRC | 18:07 | |
| *** bknudson has joined #openstack-keystone | 18:10 | |
| *** ChanServ sets mode: +v bknudson | 18:10 | |
| *** bknudson has left #openstack-keystone | 18:12 | |
| dstanek | samueldmq: looking now | 18:14 |
| *** bknudson has joined #openstack-keystone | 18:14 | |
| *** ChanServ sets mode: +v bknudson | 18:14 | |
| bknudson | in case you were wondering: https://wiki.openstack.org/wiki/VersionDiscovery -- there's a wiki on version discovery. | 18:15 |
| dstanek | samueldmq: is the translation happening? i thought it was lazy and nothing was translated in the tests | 18:16 |
| samueldmq | dstanek, yes the translation is happening for the test_wrong_ldap_scope | 18:18 |
| samueldmq | dstanek, but not for test_wrong_alias_dereferencing | 18:18 |
| samueldmq | it's ericksonsantos with his pt-br ubuntu | 18:19 |
| *** gokrokve has joined #openstack-keystone | 18:26 | |
| *** samueldmq_ has quit IRC | 18:35 | |
| stevemar | samueldmq, ping | 18:37 |
| samueldmq | stevemar, hi | 18:39 |
| *** krykowski has joined #openstack-keystone | 18:39 | |
| stevemar | samueldmq, hmm, what happened to that bug, about federation not honoring inherited flag? | 18:41 |
| stevemar | i was going to bug you about moving it to L release, but now i can't find it | 18:42 |
| samueldmq | stevemar, bug #1424500 | 18:42 |
| openstack | bug 1424500 in Keystone "Federation list projects endpoint does not honor project inherited role assignments" [Medium,Triaged] https://launchpad.net/bugs/1424500 - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 18:42 |
| samueldmq | stevemar, I can work on this for kilo if you think it is important | 18:42 |
| stevemar | samueldmq, well it relied on a bunch of other work, that's why i was going to re-target it | 18:43 |
| stevemar | if you think you can rebase it against master and merge it in 4 days, then go ahead :) | 18:43 |
| samueldmq | stevemar, the optimal solution was to do it after the list_role_assignments refactoring | 18:44 |
| samueldmq | stevemar, but I probably better remove the dependency | 18:44 |
| stevemar | samueldmq, it can wait til L then | 18:44 |
| samueldmq | stevemar, that's not a hard dependency, was just nice to have them together | 18:44 |
| stevemar | does it change any key functionality? or resolve a bug/error that a user was facing? | 18:44 |
| morganfainberg | But if we can fix it for kilo that'd be really nice. | 18:45 |
| morganfainberg | It can be deferred. | 18:45 |
| morganfainberg | It isn't a show stopping bug. | 18:45 |
| *** breton has joined #openstack-keystone | 18:45 | |
| samueldmq | stevemar, yes that bug affects the user, ofc | 18:45 |
| samueldmq | morganfainberg, yes I agree | 18:45 |
| morganfainberg | But if we can fix it for kilo that'd be nice. | 18:45 |
| stevemar | i looked at the review and it was just test changes | 18:45 |
| samueldmq | morganfainberg, stevemar I will work on that later today | 18:45 |
| stevemar | samueldmq, alright | 18:45 |
| morganfainberg | stevemar: our priority today is to get the last two items from henrynash's bp in | 18:46 |
| stevemar | morganfainberg, also, i'm going to call it and say this is bumped to L | 18:48 |
| stevemar | https://bugs.launchpad.net/keystone/+bug/1401057 | 18:48 |
| openstack | Launchpad bug 1401057 in Keystone "Direct mapping in mapping rules don't work with keywords" [High,In progress] - Assigned to Marek Denis (marek-denis) | 18:48 |
| stevemar | marek is away this week | 18:48 |
| morganfainberg | Unless you can fix it ;) | 18:49 |
| morganfainberg | But sure. | 18:49 |
| morganfainberg | We should at least document the limitation this cycle. | 18:49 |
| morganfainberg | stevemar: mind doing that? | 18:49 |
| stevemar | morganfainberg, we probably need to do a better job of documenting 'how to use this crazy mapping engine' anyway | 18:50 |
| *** iamjarvo has joined #openstack-keystone | 18:51 | |
| *** iamjarvo has quit IRC | 18:51 | |
| *** iamjarvo has joined #openstack-keystone | 18:52 | |
| stevemar | dstanek, morganfainberg this could use a review: https://review.openstack.org/#/c/167501/ | 18:52 |
| dstanek | stevemar: i can do that next | 18:52 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Lists for Generic Checks https://review.openstack.org/169045 | 18:54 |
| ayoung | dstanek, samueldmq raildo ^^ there ya go! | 18:54 |
| *** krykowski has quit IRC | 18:55 | |
| ayoung | morganfainberg, so with ^^ we can do endpoint binding of tokens with the current policy mechanism. | 18:59 |
| stevemar | ayoung, did you have to bust out your comp sci 101 text book for the recursion? | 18:59 |
| ayoung | stevemar, never | 18:59 |
| ayoung | stevemar, I recurse naturally | 18:59 |
| stevemar | you should get that looked at | 18:59 |
| ayoung | stevemar, you might recall the the revocation checks code I origianlly wrote was also recursive | 19:00 |
| ayoung | stevemar, its like Turettes, treatable with medication, but oh so much fun to watch | 19:00 |
| morganfainberg | Recursive probably would be more readable than the tree thing. | 19:00 |
| morganfainberg | In revocation events. | 19:01 |
| morganfainberg | ayoung: I shall read policy code post coffee. | 19:02 |
| morganfainberg | I do not expect to succeed precoffee | 19:02 |
| ayoung | morganfainberg, to give some context: | 19:02 |
| ayoung | service catalog has two lists in it, which messed up the attempt to use policy to enforec an endpoint binding | 19:03 |
| morganfainberg | Right. | 19:03 |
| ayoung | and, if we were to say "you need to know the index of the object in the list" it would be fragile, and not succeeded if the service catalog were reordered somehow | 19:03 |
| samueldmq | ayoung, nice, will take a look later, thanks | 19:03 |
| ayoung | so, this makes the decision to look at all the elements of the list, the Or rule. | 19:04 |
| morganfainberg | Wait, are we putting endpoint binding in Oslo.policy or in middleware ? | 19:04 |
| ayoung | morganfainberg, not decided yet | 19:04 |
| *** ljfisher has quit IRC | 19:04 | |
| ayoung | I think it should be done as a separate middleware | 19:04 |
| samueldmq | dstanek, any thought on why the string is being translated on that test? | 19:04 |
| samueldmq | dstanek, or any entry point into the code that could make that lazy? | 19:04 |
| ayoung | layered after auth token, so it has the expanded token data | 19:04 |
| ayoung | but can use its own, local policy file. | 19:04 |
| dstanek | samueldmq: i don't know if i have a way to test it, but i'm pretty sure it should not be translating at all | 19:05 |
| dstanek | samueldmq: can you find out where the translation is actually happening? | 19:05 |
| ayoung | However, if we just make the above change, at least we could enforce endpoint binding of a token in the exisint policy scheme. It would be messy, but possible. Right now, it is not possible | 19:05 |
| samueldmq | dstanek, the place the exception is thrown? | 19:06 |
| dstanek | samueldmq: is it? | 19:06 |
| ayoung | morganfainberg, this change also would be a potential, generic replacement for the role: Check, which is the only Keystone specific check in oslo policy | 19:06 |
| ayoung | now, let that sink, go get Coffee, and it will all make sense...I hope | 19:07 |
| samueldmq | dstanek, yes https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L208-L215 | 19:07 |
| *** krykowski has joined #openstack-keystone | 19:07 | |
| samueldmq | dstanek, this raises the exception caught at https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1353 | 19:07 |
| samueldmq | dstanek, and it's translated, and failing | 19:07 |
| samueldmq | dstanek, but for the test just below (https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1355-L1361) it does not translate | 19:08 |
| samueldmq | dstanek, raised at https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L187-L194 | 19:08 |
| samueldmq | dstanek, that's so weird | 19:08 |
| dstanek | samueldmq: that is where the string is wrapped for translation - where is it actually translated? usually this happens when you str() it, but that shouldn't be the case here | 19:08 |
| dstanek | using _() doesn't actually translate anything - it returns a Message object | 19:09 |
| samueldmq | dstanek, so I have no idea where it gets translated, need to dig a bit more | 19:09 |
| morganfainberg | ayoung: I'm currently drinking coffee. Just waiting until that is done before I try and grok the code. | 19:10 |
| samueldmq | dstanek, well, keystone i18n uses oslo one .. isnt there where it gets translated? by oslo .. | 19:10 |
| dstanek | it gets translated when it is used not when it is wrapped | 19:11 |
| dstanek | samueldmq: it's a wierd thing because the act of observing the object may cause it to be translated | 19:13 |
| samueldmq | dstanek, ah, so when we try to access the config property (identity.backends.ldap.Identity) | 19:13 |
| dstanek | the config property isn't translated | 19:13 |
| dstanek | samueldmq: when you _('something') you should get an instance of http://git.openstack.org/cgit/openstack/oslo.i18n/tree/oslo_i18n/_message.py#n30 | 19:14 |
| samueldmq | dstanek, yeah so that's what in the ValueError exception | 19:17 |
| ayoung | samueldmq, I wonder if you are seeing somethig due to native language settings on your machine | 19:17 |
| samueldmq | ayoung, yes | 19:18 |
| samueldmq | ayoung, ericksonsantos is | 19:18 |
| samueldmq | ayoung, this test (https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1353) | 19:18 |
| ayoung | samueldmq, so maybe something was not defined for the common case, and instead onlyh explcitly for en_US? | 19:18 |
| *** iamjarvo has quit IRC | 19:18 | |
| dstanek | samueldmq: does it show you the strings' values? | 19:19 |
| ericksonsantos | http://paste.openstack.org/show/197610/ | 19:19 |
| samueldmq | dstanek, ayoung ^ | 19:19 |
| ayoung | HA! | 19:20 |
| samueldmq | dstanek, yes it does | 19:20 |
| dstanek | and that's the only test that fails? | 19:20 |
| ayoung | assertRaisesRegexp | 19:21 |
| samueldmq | dstanek, yes, and I have no idea why, since the test just bellow does exactly the same | 19:21 |
| ayoung | Regex is not aparsing | 19:21 |
| ayoung | parsing | 19:21 |
| ayoung | Who wrote that? | 19:21 |
| *** krykowski has quit IRC | 19:21 | |
| samueldmq | ayoung, but why the first one fails and the second one doesnt | 19:21 |
| samueldmq | ayoung, https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1361 | 19:21 |
| dstanek | samueldmq: what happens if you run the failing test isolation? | 19:22 |
| samueldmq | dstanek, it fails, and the passing one passes | 19:23 |
| *** henrynash has joined #openstack-keystone | 19:23 | |
| *** ChanServ sets mode: +v henrynash | 19:23 | |
| ayoung | Yep, I+2ed that | 19:23 |
| ayoung | https://review.openstack.org/#/c/21664/ | 19:23 |
| ayoung | Just drop the REgexp part of the check | 19:23 |
| dstanek | samueldmq: i have no idea why that's translating - if you can't figure it out in a little bit i can come back to it | 19:24 |
| ayoung | could be an issue with venv... | 19:24 |
| samueldmq | dstanek, ok will try thanks | 19:24 |
| ayoung | it choses based on an Env var. Somehting might force it one way | 19:24 |
| samueldmq | ayoung, k will delete venv and try again | 19:24 |
| ayoung | samueldmq, nah | 19:24 |
| ayoung | just change the check to not be a regexp | 19:25 |
| ayoung | it is cute, but not necessary | 19:25 |
| dstanek | i don't think it would be venv based - env based is possible | 19:25 |
| ayoung | assertRaises is sufficient | 19:25 |
| samueldmq | ayoung, but why the other test doesnt fail | 19:25 |
| samueldmq | ? | 19:25 |
| samueldmq | ayoung, look https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1361 | 19:26 |
| samueldmq | ayoung, the first one fails, and the second passes | 19:26 |
| dstanek | samueldmq: what is the LANG set to? | 19:27 |
| ayoung | Maybe only one has a translation in Brazilian Portuguese | 19:28 |
| ayoung | Anyway, change them both, as there is obviously a problem when assuming error messages from LDAP match certain patterns. It is not part of the interface, just a message for the end user that can easily change. | 19:29 |
| samueldmq | dstanek, pt_BR | 19:29 |
| *** raildo has left #openstack-keystone | 19:30 | |
| *** raildo has joined #openstack-keystone | 19:30 | |
| samueldmq | ayoung, yeah I know that solves the issue, just trying to figure out why the behavior is not consistent | 19:30 |
| ayoung | samueldmq, because someone didn't get around to translating all of the error messages in the LDAP code | 19:30 |
| ayoung | Not sure if it is from Python or from the underlying LDAP libraries | 19:30 |
| ayoung | They are two different error messages. | 19:31 |
| dstanek | ayoung: that shouldn't matter because it's always matching english; i am under the impression that we don't translate at all during unit tests | 19:32 |
| ayoung | dstanek, it isn't us doing the translating | 19:32 |
| dstanek | maybe that changed when we moved to oslo.i18n | 19:32 |
| *** _cjones_ has quit IRC | 19:32 | |
| dstanek | s/we don't/translations don't happen/ | 19:33 |
| samueldmq | ayoung, dstanek yeah, we have a translation for the first one, but not to the second | 19:33 |
| samueldmq | let me get a link ... | 19:33 |
| samueldmq | this one has a translation https://github.com/openstack/keystone/blob/master/keystone/locale/pt_BR/LC_MESSAGES/keystone.po#L889-L892 | 19:33 |
| samueldmq | and this one does not https://github.com/openstack/keystone/blob/master/keystone/locale/pt_BR/LC_MESSAGES/keystone.po#L877-L880 | 19:34 |
| samueldmq | this is bad :p | 19:34 |
| dstanek | samueldmq: so i think the thing to figure out is why the translation is happening (maybe bknudson knows) | 19:34 |
| samueldmq | dstanek, ++ | 19:34 |
| bknudson | I don't know... might depend on if the translation library finds the compiled files or not. | 19:35 |
| bknudson | what's the issue? | 19:35 |
| dstanek | that's interesting | 19:35 |
| dstanek | bknudson: a test in failing because the error message is being translated | 19:35 |
| samueldmq | bknudson, yeah https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py#L1348-L1361 | 19:36 |
| samueldmq | bknudson, the first one has a translation and is being translated, the second one hasnt and then is kept as it is | 19:36 |
| *** topol has joined #openstack-keystone | 19:36 | |
| *** ChanServ sets mode: +v topol | 19:36 | |
| bknudson | doesn't seem like a good idea to try to match the translated part of the message. | 19:36 |
| bknudson | just try to match the non-translated part. | 19:36 |
| bknudson | e.g., change the regex from 'Invalid LDAP scope: %s. *' % CONF.ldap.query_scope to just CONF.ldap.query_scope | 19:37 |
| ayoung | Don't match the message | 19:37 |
| samueldmq | yes, do not match the message is the solution | 19:37 |
| ayoung | Just make it an assertRaises | 19:37 |
| samueldmq | but I guess dstanek is asking why it is getting translated, since translations should not happen in tests | 19:38 |
| samueldmq | :p | 19:38 |
| bknudson | why shouldn't translations happen in tests? | 19:38 |
| bknudson | there's probably a way to totally disable it. | 19:38 |
| bknudson | you could mock out the translation library I guess. | 19:38 |
| bknudson | or the tests could set LANG=C or whatever. | 19:38 |
| dstanek | i'm pretty sure there are other places where we match English against an error message. those will also break if there is a translation available. | 19:39 |
| samueldmq | bknudson, maybe .. there is no need to translate messages for tests, since we do not use to make any assertions on the errors messages | 19:39 |
| bknudson | I agree it's better for the tests to not try to translate since it's not going to be set up. | 19:39 |
| bknudson | have the tests set LANG=C or whatever. | 19:40 |
| dstanek | bknudson: you may have hit the nail on the head when you said that maybe it was because the library could find the translations | 19:40 |
| samueldmq | dstanek, ++ yeah, we're fixing for pt_BR, but what about the other languages? | 19:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 19:40 |
| *** timcline_ has quit IRC | 19:41 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 19:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Pull echo service out of auth_token. https://review.openstack.org/165171 | 19:45 |
| *** _cjones_ has joined #openstack-keystone | 19:48 | |
| *** pnavarro|off has joined #openstack-keystone | 19:52 | |
| htruta | bknudson, rodrigods: about these role tests: https://review.openstack.org/#/c/116081/12/keystoneclient/tests/unit/v3/test_roles.py | 19:54 |
| *** iamjarvo has joined #openstack-keystone | 19:54 | |
| htruta | I was just following the same pattern of the other tests... | 19:54 |
| htruta | what about keeping it as it is and sending a follow patch fixing this whole test_roles module? | 19:55 |
| htruta | does it make sense? | 19:55 |
| bknudson | htruta: ok, submit the patch. | 19:55 |
| rodrigods | htruta, ++ | 19:56 |
| htruta | I meant after this one. is that ok? | 19:56 |
| bknudson | htruta: that's ok... I'm not going to +2 this one until I see the other patch | 19:56 |
| htruta | bknudson: cool | 19:57 |
| bknudson | so it really doesn't make any difference. | 19:57 |
| dstanek | if that's the case it might as well be rolled into the original, right? | 19:57 |
| *** pnavarro|off has quit IRC | 19:57 | |
| samueldmq | dstanek, ++ fix the first and in a follow-on fix remaining | 19:58 |
| bknudson | seems best to just roll it into the original, but if it's easier for whatever reason to separate it I'm fine with it. | 19:58 |
| bknudson | or, submit the patch to fix the other ones first and rebase 116081 on that | 19:59 |
| *** pnavarro|off has joined #openstack-keystone | 20:00 | |
| htruta | bknudson, dstanek: ok... I think I'll roll it into the original first, and then I send another fixing the remaining | 20:01 |
| *** iamjarvo has quit IRC | 20:06 | |
| *** timcline has joined #openstack-keystone | 20:22 | |
| *** timcline has quit IRC | 20:22 | |
| *** timcline has joined #openstack-keystone | 20:23 | |
| *** samueldmq has quit IRC | 20:27 | |
| *** afazekas has joined #openstack-keystone | 20:27 | |
| *** samueldmq has joined #openstack-keystone | 20:27 | |
| *** afazekas has quit IRC | 20:34 | |
| *** afazekas has joined #openstack-keystone | 20:37 | |
| *** afazekas has quit IRC | 20:44 | |
| *** raildo is now known as raildo|away | 21:04 | |
| *** afazekas has joined #openstack-keystone | 21:06 | |
| *** joesavak has quit IRC | 21:10 | |
| stevemar | dstanek, ping | 21:17 |
| stevemar | what do you mean by thread here? https://bugs.launchpad.net/keystone/+bug/1416767 | 21:17 |
| openstack | Launchpad bug 1416767 in Keystone "event_type for role assignment notifications is incorrect" [Medium,In progress] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 21:17 |
| *** boris-42 has quit IRC | 21:18 | |
| dstanek | stevemar: was there any discussion or anything with the people that deal with the auditing? i was hoping to see confirmation that this wouldn't mess anyone up | 21:18 |
| *** afazekas has quit IRC | 21:18 | |
| stevemar | no discussion, just that it didn't match the convention that we usually use | 21:20 |
| stevemar | dstanek, ^ | 21:20 |
| dstanek | is there any possibility that this could mess up someone's auditing processes? | 21:20 |
| stevemar | dstanek, i posted something | 21:21 |
| stevemar | f5 that page | 21:21 |
| stevemar | or whatever it is on mac | 21:21 |
| dstanek | should we add docimpact or something to flag that the change should be documented (maybe in release/upgrade notes)? or was that notification new for kilo? | 21:23 |
| *** boris-42 has joined #openstack-keystone | 21:30 | |
| *** mattfarina has quit IRC | 21:32 | |
| *** jamielennox|away is now known as jamielennox | 21:36 | |
| stevemar | dstanek, good call on the release notes | 21:36 |
| stevemar | that's a good spot for it, the notification was new in Juno | 21:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Rename notification for create/delete grants https://review.openstack.org/167501 | 21:37 |
| stevemar | dstanek, added docImpact | 21:37 |
| dstanek | stevemar: thx! | 21:40 |
| stevemar | np dstanek fantastic suggestion | 21:40 |
| *** timcline has quit IRC | 21:43 | |
| *** jamielennox is now known as jamielennox|away | 21:46 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Support /auth routes for list projects and domains https://review.openstack.org/168792 | 21:47 |
| *** topol has quit IRC | 21:51 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Use UUID values in v3 test fixtures https://review.openstack.org/168546 | 21:52 |
| *** jamielennox|away is now known as jamielennox | 21:53 | |
| samueldmq | morganfainberg, stevemar looking at the federation bug now | 21:54 |
| lhcheng | jamielennox: tried out the /auth/projects call, it also returns an empty project list if I used a project scoped token from a federated user. | 22:02 |
| jamielennox | lhcheng: umm, that's plausible - i remember when we were discussing it we were talking how we want to enforce that you should only rescope an unscoped token | 22:02 |
| jamielennox | horizon doesn't persist the unscoped token now? | 22:03 |
| david-lyle | jamielennox: yes it does | 22:03 |
| jamielennox | lhcheng: so that it won't work with the unscoped token then? | 22:04 |
| david-lyle | https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/backend.py#L195 | 22:04 |
| lhcheng | jamielennox: it works with unscoped token | 22:04 |
| lhcheng | jamielennox: but not with project scoped token | 22:05 |
| jamielennox | yea, that makes sense | 22:05 |
| bknudson | hopefully we allow a user to get an unscoped token even when they have a default project. | 22:05 |
| lhcheng | jamielennox: the project scoped token is still not backward compatible | 22:05 |
| jamielennox | bknudson: there is a call for that somewhere... but in horizon's case it's easy because they are controlling that initial login request and just don't specify scoping information for the first auth call | 22:06 |
| lhcheng | from what I understand, the project scoped token should still work for list user project | 22:06 |
| jamielennox | lhcheng: we are specifically moving away from that being allowed, there is actually a config option we introduced this cycle that disallows that | 22:06 |
| bknudson | jamielennox: if the client doesn't specify the scope then they get a token scoped to the default project. | 22:06 |
| bknudson | the user's default project | 22:07 |
| jamielennox | bknudson: yes, what was ayoung's thing for this... did it ever make it to client | 22:07 |
| bknudson | I doubt the client was updated... it would have to be in the auth plugins | 22:08 |
| bknudson | or wherever the scope is set | 22:08 |
| lhcheng | jamielennox: I got a workaround to make it work in DOA, just trying to cleanup as much as possible. | 22:08 |
| jamielennox | lhcheng: yea, so i think for now it might be best to do federated project listing via the federated routes | 22:09 |
| lhcheng | jamielennox: yeah, sounds like no choice for now. | 22:09 |
| jamielennox | if you go via the plugin it will always work, there was somewhere though that you call utils.list_projects or something that i didn't know how to redirect to the plugin | 22:09 |
| lhcheng | jamielennox: yeah, we should do that | 22:10 |
| lhcheng | jamielennox: was planning to do that, but it seems not straight-forward | 22:11 |
| lhcheng | jamielennox: will look at it as followup | 22:11 |
| jamielennox | right, because the plugin information will be lost between calls | 22:11 |
| lhcheng | bknudson: would federated user have concept of default project? | 22:11 |
| jamielennox | lhcheng: are you still looking at the doa-websso package or just combining into doa | 22:11 |
| lhcheng | jamielennox: just combining into doa | 22:12 |
| jamielennox | damn, but makes sense | 22:12 |
| bknudson | lhcheng: when you do federated auth you get an unscoped token | 22:12 |
| lhcheng | ayoung's thought was federation should be default in the long term | 22:12 |
| *** nkinder has quit IRC | 22:13 | |
| lhcheng | bknudson: yeah, thought so. was confused when you mentioned that token scope will default to default project. | 22:13 |
| lhcheng | but would only apply to non-federated user | 22:14 |
| lhcheng | jamielennox: okay, I'll continue with what I have. Should be ready soon. | 22:14 |
| ayoung | reading up...kindof in family mode though | 22:16 |
| *** gokrokve has quit IRC | 22:21 | |
| *** henrynash has quit IRC | 22:21 | |
| *** henrynash has joined #openstack-keystone | 22:21 | |
| *** ChanServ sets mode: +v henrynash | 22:21 | |
| lhcheng | jamielennox: what's the name of the config that limit project scoped token to only actions it supposed to? | 22:25 |
| lhcheng | jamielennox: ah found it, allow_rescope_scoped_token | 22:26 |
| lhcheng | jamielennox: Using the unscoped token here fits nicely then for the long term. | 22:28 |
| jamielennox | lhcheng: yep, i'm just looking at how to ignore the default_project_id and get an unscoped token so can add that to auth plugins | 22:29 |
| *** ajayaa has joined #openstack-keystone | 22:37 | |
| *** iamjarvo has joined #openstack-keystone | 22:38 | |
| *** iamjarvo has quit IRC | 22:38 | |
| *** iamjarvo has joined #openstack-keystone | 22:39 | |
| *** _cjones_ has quit IRC | 22:41 | |
| lhcheng | jamielennox: I got the final version of the patch up: https://review.openstack.org/#/c/136178/ | 22:41 |
| lhcheng | done with the clean-ups | 22:41 |
| *** harlowja has quit IRC | 22:45 | |
| *** harlowja_ has joined #openstack-keystone | 22:45 | |
| *** _cjones_ has joined #openstack-keystone | 22:46 | |
| jamielennox | lhcheng: comments | 22:47 |
| lhcheng | jamielennox: thanks, looking | 22:47 |
| *** jaosorior has quit IRC | 22:52 | |
| *** markvoelker has quit IRC | 22:57 | |
| *** gordc has quit IRC | 22:58 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Allow requesting an unscoped Token https://review.openstack.org/169111 | 23:05 |
| jamielennox | lhcheng: ^ | 23:05 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Exposes bug in Federation list projects endpoint https://review.openstack.org/158163 | 23:06 |
| jamielennox | though i guess you don't really care until it's in global requirements | 23:06 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fixes bug in Federation list projects endpoint https://review.openstack.org/169113 | 23:06 |
| samueldmq | stevemar, morganfainberg, henrynash ^ | 23:07 |
| lhcheng | jamielennox: thanks, I'll open a bug to use that in DOA | 23:09 |
| jamielennox | i only realized how much ksc is missing when i started working with other projects | 23:10 |
| jamielennox | and still is missing | 23:10 |
| jamielennox | morganfainberg: do you remember why we didn't do https://review.openstack.org/#/c/168771/ in Juno? | 23:12 |
| jamielennox | i think it was raised but there was a reason we couldn't do it | 23:12 |
| *** zzzeek has quit IRC | 23:13 | |
| jamielennox | bknudson: ^ | 23:13 |
| morganfainberg | Ino idea | 23:13 |
| morganfainberg | no* | 23:13 |
| jamielennox | I have a feeling there was something about auth_token middleware and matching the 'v3.0' directly - but i can't remember the details | 23:13 |
| stevemar | samueldmq, thx | 23:13 |
| samueldmq | stevemar, np | 23:15 |
| *** yasu_ has joined #openstack-keystone | 23:16 | |
| jamielennox | stevemar: can you review https://review.openstack.org/#/c/162529/ - i'd like that in before we do another ksc release, especially if the release is to update auth_token middleware | 23:16 |
| *** samueldmq has quit IRC | 23:16 | |
| jamielennox | (i pick on you because you were trying to do more client reviews) | 23:16 |
| *** ajayaa has quit IRC | 23:17 | |
| jamielennox | morganfainberg: did you get far with keystoneauth lib? | 23:17 |
| morganfainberg | jamielennox, i have most if it ready. just was wiloing to wait a little longer | 23:18 |
| morganfainberg | since we were up against FFE stuff | 23:18 |
| morganfainberg | i figurte i'll push a 1st pass this week/weekend | 23:18 |
| *** stevemar has quit IRC | 23:18 | |
| jamielennox | morganfainberg: push? like pypi? | 23:18 |
| morganfainberg | to github | 23:19 |
| morganfainberg | so we can get it into gerrit | 23:19 |
| jamielennox | ok | 23:19 |
| morganfainberg | w/ assoaciated governance/infra changes | 23:19 |
| *** dims has quit IRC | 23:38 | |
| *** iamjarvo has quit IRC | 23:39 | |
| *** Tahmina has joined #openstack-keystone | 23:43 | |
| bknudson | jamielennox: we didn't up the version in juno or icehouse or havana... | 23:47 |
| bknudson | maybe figured it wouldn't be backwards compatible. | 23:47 |
| *** yasu_ has quit IRC | 23:47 | |
| *** _cjones_ has quit IRC | 23:52 | |
| *** _cjones_ has joined #openstack-keystone | 23:52 | |
| *** markvoelker has joined #openstack-keystone | 23:53 | |
| *** zzzeek has joined #openstack-keystone | 23:54 | |
| *** _cjones_ has quit IRC | 23:56 | |
| *** iamjarvo has joined #openstack-keystone | 23:56 | |
| *** iamjarvo has quit IRC | 23:57 | |
| *** iamjarvo has joined #openstack-keystone | 23:57 | |
| *** samueldmq has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!