| *** sdake_ has quit IRC | 00:00 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: WebSSO should use remote_id_attribute by protocol https://review.openstack.org/171889 | 00:03 |
|---|---|---|
| morganfainberg | jamielennox, heh | 00:04 |
| *** topol has joined #openstack-keystone | 00:19 | |
| *** ChanServ sets mode: +v topol | 00:19 | |
| openstackgerrit | Merged openstack/python-keystoneclient: pep8 fix for CMS https://review.openstack.org/160132 | 00:25 |
| *** chlong has joined #openstack-keystone | 00:25 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update sample data with audit ids https://review.openstack.org/171028 | 00:26 |
| jamielennox | morganfainberg: so import keystoneclient_kerberos gives Exception: Versioning for this project requires either an sdist tarball, or access to an upstream git repository. Are you sure that git is installed? on a new venv | 00:26 |
| jamielennox | any idea what's happening there? | 00:26 |
| jamielennox | damn, | 00:29 |
| lifeless | jamielennox: do you have git installed ? | 00:29 |
| *** Ephur has joined #openstack-keystone | 00:29 | |
| jamielennox | lifeless: heh, yes, but it's from pip | 00:29 |
| jamielennox | i think i found it | 00:30 |
| *** _cjones_ has quit IRC | 00:33 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient-kerberos: Use the package name when looking up version https://review.openstack.org/171898 | 00:36 |
| jamielennox | morganfainberg: there are no other reviews for ksc-kerberos, can we do a 0.1.4 with ^ ? | 00:38 |
| morganfainberg | sure | 00:38 |
| jamielennox | (there is a global reqs bump that i don't see any point in doing for a point release) | 00:38 |
| jamielennox | let's see if i have the perms... | 00:39 |
| lifeless | jamielennox: its a bit of a bug that that didn't barf locally before you pulled it down from pip | 00:43 |
| jamielennox | lifeless: yea, i was thinking that - i don't know how it got set that way in the first place | 00:43 |
| lifeless | jamielennox: (the bug would be on pbr) | 00:43 |
| jamielennox | but i guess it's doing the right thing by falling back on git and there's no way for it to know if there should be a dist-info or not | 00:44 |
| lifeless | we can build an egg-info if there isn't one from git | 00:44 |
| lifeless | and cross check the package name | 00:44 |
| jamielennox | that sounds like a unit test rather than a PBR runtime thing though? | 00:45 |
| *** samueldmq has joined #openstack-keystone | 00:47 | |
| *** bknudson has joined #openstack-keystone | 00:48 | |
| *** ChanServ sets mode: +v bknudson | 00:48 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Increase minimum token life required https://review.openstack.org/169947 | 00:48 |
| *** angular_mike has joined #openstack-keystone | 00:51 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/171860 | 00:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor common function for loading drivers https://review.openstack.org/166628 | 00:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Refactor MemcachedBackend to not be a Manager https://review.openstack.org/166615 | 00:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Tests don't override default config with default https://review.openstack.org/166631 | 00:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use stevedore https://review.openstack.org/166543 | 00:56 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use short names for drivers https://review.openstack.org/166622 | 00:56 |
| *** alexsyip has quit IRC | 01:16 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_communication_params interface to plugins https://review.openstack.org/141267 | 01:16 |
| bknudson | what do you think about removing this deprecated behavior: https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L64 | 01:23 |
| *** tqtran has quit IRC | 01:23 | |
| bknudson | 'Loading auth-plugins by class-name is deprecated.' | 01:23 |
| bknudson | I'm changing this code to use stevedore so was wondering if I can remove this complication. | 01:24 |
| bknudson | was deprecated Jul 17, 2014 | 01:25 |
| *** davechen has joined #openstack-keystone | 01:25 | |
| bknudson | in Juno | 01:26 |
| bknudson | so it was deprecated all of kilo... I think that's ok to remove in L. | 01:26 |
| jamielennox | morganfainberg: do you want to approve https://review.openstack.org/#/c/171898/ and i'll see if i can push a tag? | 01:33 |
| jamielennox | bknudson: that seems reasonable to me | 01:33 |
| jamielennox | bknudson: ideally we'd change those to use stevedore anyway | 01:34 |
| bknudson | that's what I'm working on. | 01:34 |
| jamielennox | maybe just have don't use the common loader for auth plugins because you'll need to check whether the param exists in the conf file | 01:34 |
| jamielennox | that sentence doesn't really work but i think i got the meaning across | 01:35 |
| bknudson | it didn't | 01:35 |
| bknudson | common loader? | 01:35 |
| jamielennox | you might just have to write a custom loading function for auth plugins rather than use the stevedore driver loading that the keystone drivers will use | 01:36 |
| bknudson | it looks like we want to use this pattern: http://docs.openstack.org/developer/stevedore/patterns_loading.html#extensions-many-names-many-entry-points | 01:36 |
| bknudson | I'm not quite sure how that's going to happen. | 01:37 |
| bknudson | crap, this is all sorts of broken already. | 01:38 |
| jamielennox | i expect so | 01:38 |
| jamielennox | i haven't actually done one like that with stevedore, though i would think it's the default arrangement | 01:38 |
| bknudson | auth_plugins.UserAuthInfo.create(auth_payload, METHOD_NAME) -- why does this take method name? | 01:39 |
| bknudson | the method name is supposed to be whatever they picked in the config file, right? | 01:39 |
| jamielennox | ah, maybe not, ExtensionManager looks like it will invoke all of the plugins defined on the system | 01:39 |
| bknudson | can you disable some extensions? | 01:40 |
| bknudson | in a config file or something | 01:40 |
| bknudson | I was planning to use the regular driver loader, where the namespace is like keystone.auth.password | 01:40 |
| bknudson | so you'd have keystone.auth.password = | 01:41 |
| jamielennox | bknudson: yea, there is a list of enabled auth extensions in the config file | 01:41 |
| jamielennox | maybe this: http://docs.openstack.org/developer/stevedore/managers.html#namedispatchextensionmanager | 01:41 |
| bknudson | keystone = keystone.auth.plugins.password | 01:41 |
| bknudson | and then the config file would have password = keystone | 01:42 |
| bknudson | hmmm... that looks interesting too. | 01:42 |
| bknudson | we want to support different "password" plugins | 01:42 |
| jamielennox | do we? | 01:42 |
| jamielennox | ugh | 01:43 |
| jamielennox | yea, ok | 01:43 |
| bknudson | y, I want to use the default keystone password or my custom password | 01:43 |
| bknudson | we could go back to where the extension itself provides its method | 01:43 |
| bknudson | but that's the thing that was deprecated and I'm planning to remove. | 01:44 |
| jamielennox | i don't see why we'd want that, auth plugins have an abc base class, they should follow a pattern | 01:45 |
| jamielennox | i don't really like the idea of having multiple keystone.auth.password but it would seem to be the best fit | 01:45 |
| bknudson | well, you can't have multiple passwords, you can pick one of many implementations | 01:46 |
| jamielennox | unfortunately then you still need an option though for which password to use | 01:46 |
| bknudson | right | 01:46 |
| jamielennox | i guess we have that already now | 01:46 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove support for loading auth plugin by class https://review.openstack.org/171906 | 01:48 |
| bknudson | ^ this is what I was asking about removing | 01:48 |
| jamielennox | oh, hmm, and you rely on stevdore to make sure the right thing is loaded? | 01:50 |
| jamielennox | i mean you could do that now i guess, give it the password plugin for the external | 01:50 |
| bknudson | let me implement the stevedore part then you'll see it. | 01:50 |
| bknudson | y, you could give it the password plugin for external. | 01:51 |
| bknudson | probably wouldn't be very happy with the result | 01:51 |
| jamielennox | but the response would say method == 'password' i think - i don't know if that's better or worse | 01:51 |
| *** erkules_ has joined #openstack-keystone | 01:56 | |
| *** dims has quit IRC | 01:56 | |
| *** erkules has quit IRC | 01:58 | |
| jamielennox | nevermind, i'm wrong, name is determined from config | 02:00 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use [] where a value is required https://review.openstack.org/171907 | 02:01 |
| *** zzzeek_ has quit IRC | 02:02 | |
| *** harlowja is now known as harlowja_away | 02:03 | |
| *** samueldmq has quit IRC | 02:04 | |
| *** browne has quit IRC | 02:07 | |
| *** stevemar has joined #openstack-keystone | 02:12 | |
| *** ChanServ sets mode: +v stevemar | 02:12 | |
| *** iamjarvo has joined #openstack-keystone | 02:21 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: WebSSO should use remote_id_attribute by protocol https://review.openstack.org/171889 | 02:27 |
| *** iamjarvo has quit IRC | 02:29 | |
| *** browne has joined #openstack-keystone | 02:38 | |
| openstackgerrit | Merged openstack/python-keystoneclient-kerberos: Use the package name when looking up version https://review.openstack.org/171898 | 02:51 |
| *** lhcheng has quit IRC | 02:51 | |
| *** richm has quit IRC | 02:52 | |
| *** alex_xu has quit IRC | 03:08 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint_policy migrations into keystone core https://review.openstack.org/171916 | 03:15 |
| jamielennox | morganfainberg: so, i actually think that ^ would be sufficient | 03:17 |
| jamielennox | i can't see a way in which you could have ran the migration once and have it be executed again | 03:17 |
| morganfainberg | jamielennox, and i think we need to drop db control | 03:18 |
| morganfainberg | jamielennox, but uhm... haven't tried that | 03:18 |
| jamielennox | morganfainberg: i looked at that - i don't think we can | 03:18 |
| morganfainberg | versioning_api has a dropcontrol | 03:19 |
| morganfainberg | it should be safe to use iirc | 03:19 |
| jamielennox | when you do drop it calls: https://github.com/stackforge/sqlalchemy-migrate/blob/master/migrate/versioning/schema.py#L59 | 03:20 |
| morganfainberg | lame | 03:20 |
| jamielennox | which wipes out the migrate_version table | 03:20 |
| jamielennox | which i learnt the hard way | 03:20 |
| morganfainberg | for all tables | 03:20 |
| morganfainberg | weird | 03:20 |
| morganfainberg | it's like no one ever thought you'd uncontroll a sub-schema | 03:21 |
| jamielennox | thinking about it though its kind of a protection | 03:21 |
| morganfainberg | meaning i think the subschema use-case is well.. not designed | 03:21 |
| jamielennox | it's a very small thing to leave hanging around in the database | 03:21 |
| morganfainberg | sure | 03:21 |
| *** rushiagr_away is now known as rushiagr | 03:22 | |
| jamielennox | i'll file a bug against sqlalchemy-migrate but i don't think its worth worrying about | 03:23 |
| *** gyee has quit IRC | 03:27 | |
| *** lhcheng has joined #openstack-keystone | 03:33 | |
| *** ChanServ sets mode: +v lhcheng | 03:33 | |
| *** _cjones_ has joined #openstack-keystone | 03:34 | |
| *** ozialien has joined #openstack-keystone | 03:35 | |
| *** rushiagr is now known as rushiagr_away | 03:36 | |
| *** _cjones_ has quit IRC | 03:38 | |
| *** topol has quit IRC | 03:41 | |
| *** topol has joined #openstack-keystone | 03:41 | |
| *** ChanServ sets mode: +v topol | 03:41 | |
| *** alexsyip has joined #openstack-keystone | 03:42 | |
| *** angular_mike has quit IRC | 03:43 | |
| *** lhcheng_ has joined #openstack-keystone | 03:45 | |
| *** dims has joined #openstack-keystone | 03:45 | |
| *** lhcheng has quit IRC | 03:48 | |
| *** dims has quit IRC | 03:50 | |
| openstackgerrit | Merged openstack/keystone: Update openstack-common reference in openstack/common/README https://review.openstack.org/171706 | 03:52 |
| *** iamjarvo has joined #openstack-keystone | 03:54 | |
| jamielennox | morganfainberg: it's a thursday, but i don't think anyone uses ksc-kerberos enough to worry if we push a release | 03:54 |
| morganfainberg | Yeah that's fine. | 03:57 |
| morganfainberg | Still wed night here. | 03:57 |
| morganfainberg | :) | 03:57 |
| morganfainberg | Anyway. | 03:57 |
| *** rushiagr_away is now known as rushiagr | 04:02 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint_policy migrations into keystone core https://review.openstack.org/171916 | 04:05 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move endpoint policy into keystone core https://review.openstack.org/171448 | 04:05 |
| *** rodrigods has quit IRC | 04:08 | |
| *** browne has quit IRC | 04:10 | |
| *** spandhe has quit IRC | 04:11 | |
| *** rodrigods has joined #openstack-keystone | 04:12 | |
| *** rushiagr is now known as rushiagr_away | 04:12 | |
| ayoung-mtg | morganfainberg, how do I tag something as RC potential? | 04:17 |
| ayoung-mtg | https://bugs.launchpad.net/keystone/+bug/1441827 | 04:17 |
| openstack | Launchpad bug 1441827 in Keystone "Cannot set per protocol remote_id_attribute" [High,In progress] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 04:17 |
| morganfainberg | In the bug "tags" add kilo-rc-potential | 04:18 |
| stevemar | ayoung-mtg, it's been tagged i believe | 04:18 |
| stevemar | we need to backport that one | 04:18 |
| stevemar | topol, quit working so late! | 04:19 |
| ayoung-mtg | stevemar, yep. I just +2aed and tested on live | 04:19 |
| morganfainberg | Rc2 should open next week | 04:19 |
| morganfainberg | Then we do the mad backport dash | 04:19 |
| stevemar | sounds good | 04:20 |
| lhcheng_ | ayoung: yup, that's already tagged :) | 04:20 |
| morganfainberg | If you propose it against the rc branch (doable now) I need to -2 it, but happy to have that happen. | 04:20 |
| morganfainberg | Whatever is easiest for you | 04:21 |
| *** lhcheng_ is now known as lhcheng | 04:21 | |
| *** ChanServ sets mode: +v lhcheng | 04:21 | |
| morganfainberg | But the bug tag is the really important part. | 04:21 |
| lhcheng | okay, I can propose it to rc when the patch gets merged. | 04:23 |
| ayoung-mtg | lhcheng, thanks. I think that one would have been nasty had we not caught it now. Good fix. | 04:24 |
| lhcheng | ayoung-mtg: thanks for finding the bug! we'll have websso, but can only support one protocol. that's awful :P | 04:26 |
| ayoung-mtg | lhcheng, I'll have a live demo of two side by side...probably tomorrow | 04:28 |
| lhcheng | ayoung-mtg: awesome, good luck! I hope there won't be any more hickups. | 04:30 |
| *** ayoung-mtg is now known as ayoung | 04:30 | |
| ayoung | lhcheng, I've done each separately, just not the two together | 04:31 |
| *** topol has quit IRC | 04:31 | |
| *** topol has joined #openstack-keystone | 04:31 | |
| *** iamjarvo has quit IRC | 04:31 | |
| *** ChanServ sets mode: +v topol | 04:31 | |
| *** raginbajin has quit IRC | 04:32 | |
| stevemar | jamielennox, does KSC have keyring support? | 04:34 |
| *** raginbajin has joined #openstack-keystone | 04:35 | |
| stevemar | lhcheng, hehe | 04:35 |
| jamielennox | stevemar: it used to, it won't work with session and i wouldn't trust it anyway | 04:35 |
| lhcheng | stevemar: I am remember asking that before | 04:35 |
| lhcheng | :P | 04:35 |
| stevemar | OSC definitely does not have keyring support | 04:35 |
| jamielennox | stevemar: right - you need that review to land | 04:35 |
| stevemar | jamielennox, what review? the documentation one? | 04:35 |
| jamielennox | i was going to try and write support on the osc side, haven't yet | 04:35 |
| lhcheng | KSC, it doesn't. remember jamielennox mentioend something about being flaky :P | 04:36 |
| jamielennox | https://review.openstack.org/#/c/149175/ | 04:36 |
| jamielennox | i mean you could always do it manually from OSC, but ^ is better | 04:36 |
| stevemar | oh that guy | 04:37 |
| stevemar | i meant this guy: https://review.openstack.org/#/c/163503/2 | 04:37 |
| jamielennox | oh, nfi | 04:37 |
| jamielennox | i haven't tested support from the CLI for a long time | 04:38 |
| jamielennox | it probably still works, it's just pretty horrible | 04:38 |
| lhcheng | jamielennox: oh, we actually use the keyring support! someone from our team was planning to submit the patch to fix that. | 04:40 |
| * lhcheng looking for the bug report | 04:41 | |
| jamielennox | lhcheng: fix what? | 04:41 |
| lhcheng | jamielennox: keyring in KSC | 04:41 |
| jamielennox | lhcheng: the problem with keyring support (one of) is that when it was written there was still the assumption that the only point of the library was a backend for a CLI | 04:41 |
| jamielennox | lhcheng: the keyring support does horrible things like insert keyring entries for everything that keystoneclient does | 04:42 |
| jamielennox | well if you set use_keyring=True, so i guess that's not surprising - but still | 04:43 |
| lhcheng | https://bugs.launchpad.net/python-keystoneclient/+bug/1357567 | 04:43 |
| openstack | Launchpad bug 1357567 in python-keystoneclient "auth_ref caching/retrieving is failing - user needs to provide password for every command" [Undecided,In progress] - Assigned to Shraddha Pandhe (shraddha-pandhe) | 04:43 |
| jamielennox | lhcheng: hmm, i think password every time is normal | 04:43 |
| jamielennox | but i can't remember | 04:43 |
| jamielennox | it's not about preventing you from entering a password, it's to prevent it from having to talk to keystone every time - but again i'd need to look up the exact flow again | 04:44 |
| lhcheng | I think the shell have to lookup the keyring first before prompting for password. I can't remember exactly the details of the bug and fix. | 04:45 |
| jamielennox | no, because the keyring code is in the client part, all the shell does is pass through a use_keyring flag | 04:45 |
| *** browne has joined #openstack-keystone | 04:46 | |
| *** rushiagr_away is now known as rushiagr | 04:47 | |
| *** iamjarvo has joined #openstack-keystone | 04:48 | |
| lhcheng | jamielennox: you're right, the shell checks if clients already have the token: https://review.openstack.org/#/c/151478/2/keystoneclient/shell.py | 04:48 |
| *** iamjarvo has quit IRC | 04:48 | |
| *** iamjarvo has joined #openstack-keystone | 04:49 | |
| lhcheng | we can circle back to it later, I'll check tomorrow if she's still going to work on it. | 04:51 |
| *** spandhe has joined #openstack-keystone | 04:54 | |
| *** stevemar has quit IRC | 04:57 | |
| *** spandhe_ has joined #openstack-keystone | 04:57 | |
| jamielennox | lhcheng: sounds good - in general i don't think i'd bother, send it to OSC instead | 04:57 |
| *** rushiagr is now known as rushiagr_away | 04:58 | |
| *** spandhe has quit IRC | 04:59 | |
| *** spandhe_ is now known as spandhe | 04:59 | |
| lhcheng | jamielennox: I agree, hopefully I can convince folks here to consume OSC on our next internal upgrade. | 04:59 |
| *** iamjarvo has quit IRC | 05:00 | |
| *** ozialien has quit IRC | 05:06 | |
| *** spandhe has quit IRC | 05:09 | |
| *** chlong has quit IRC | 05:09 | |
| openstackgerrit | Merged openstack/keystone: WebSSO should use remote_id_attribute by protocol https://review.openstack.org/171889 | 05:10 |
| *** crinkle has quit IRC | 05:24 | |
| *** crinkle has joined #openstack-keystone | 05:25 | |
| *** spandhe has joined #openstack-keystone | 05:37 | |
| *** ajayaa has joined #openstack-keystone | 05:38 | |
| *** tobberydberg has joined #openstack-keystone | 05:57 | |
| *** browne has quit IRC | 06:00 | |
| *** mflobo1 has joined #openstack-keystone | 06:15 | |
| *** mflobo1 has quit IRC | 06:16 | |
| *** mflobo has quit IRC | 06:17 | |
| *** mflobo has joined #openstack-keystone | 06:18 | |
| *** topol has quit IRC | 06:31 | |
| *** topol has joined #openstack-keystone | 06:32 | |
| *** ChanServ sets mode: +v topol | 06:32 | |
| *** sdake_ has joined #openstack-keystone | 06:32 | |
| *** topol has quit IRC | 06:37 | |
| *** lhcheng has quit IRC | 06:38 | |
| *** alex_xu has joined #openstack-keystone | 06:40 | |
| *** rushiagr_away is now known as rushiagr | 06:43 | |
| *** lhcheng has joined #openstack-keystone | 06:44 | |
| *** ChanServ sets mode: +v lhcheng | 06:44 | |
| *** alex_xu has quit IRC | 06:47 | |
| *** krykowski has joined #openstack-keystone | 06:51 | |
| *** alex_xu has joined #openstack-keystone | 06:51 | |
| *** trey has quit IRC | 06:53 | |
| *** lhcheng has quit IRC | 06:56 | |
| *** trey has joined #openstack-keystone | 06:58 | |
| *** pnavarro has joined #openstack-keystone | 07:02 | |
| *** sdake_ has quit IRC | 07:05 | |
| *** alexsyip has quit IRC | 07:08 | |
| *** alexsyip has joined #openstack-keystone | 07:11 | |
| *** afazekas has joined #openstack-keystone | 07:13 | |
| *** trey has quit IRC | 07:14 | |
| *** jistr has joined #openstack-keystone | 07:15 | |
| *** sdake has joined #openstack-keystone | 07:18 | |
| *** angular_mike has joined #openstack-keystone | 07:20 | |
| *** trey has joined #openstack-keystone | 07:20 | |
| *** alexsyip_ has joined #openstack-keystone | 07:23 | |
| *** sdake_ has joined #openstack-keystone | 07:25 | |
| *** alexsyip has quit IRC | 07:26 | |
| *** alexsyip_ is now known as alexsyip | 07:26 | |
| *** sdake has quit IRC | 07:26 | |
| *** pnavarro has quit IRC | 07:26 | |
| *** fhubik_afk has joined #openstack-keystone | 07:29 | |
| *** sdake_ has quit IRC | 07:30 | |
| *** alexsyip has quit IRC | 07:41 | |
| *** sdake has joined #openstack-keystone | 07:52 | |
| *** jamielennox is now known as jamielennox|away | 08:01 | |
| *** spandhe has quit IRC | 08:06 | |
| *** erkules_ is now known as erkules | 08:14 | |
| *** erkules has joined #openstack-keystone | 08:14 | |
| *** jasondotstar has quit IRC | 08:20 | |
| *** davechen has quit IRC | 08:41 | |
| *** davechen has joined #openstack-keystone | 08:41 | |
| *** rwsu has quit IRC | 08:41 | |
| *** boris-42 has joined #openstack-keystone | 09:16 | |
| *** pcaruana has joined #openstack-keystone | 09:17 | |
| *** angular_mike has quit IRC | 09:43 | |
| *** sdake_ has joined #openstack-keystone | 09:46 | |
| *** sdake_ has quit IRC | 09:49 | |
| *** sdake has quit IRC | 09:50 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** f13o has quit IRC | 09:54 | |
| *** pnavarro has joined #openstack-keystone | 09:59 | |
| *** pnavarro has quit IRC | 10:05 | |
| *** krykowski_ has joined #openstack-keystone | 10:06 | |
| *** krykowski has quit IRC | 10:09 | |
| *** dims_ has joined #openstack-keystone | 10:23 | |
| *** jaosorior has joined #openstack-keystone | 10:31 | |
| *** jamielennox|away is now known as jamielennox | 10:42 | |
| *** aix has joined #openstack-keystone | 10:51 | |
| *** topol has joined #openstack-keystone | 11:33 | |
| *** ChanServ sets mode: +v topol | 11:33 | |
| *** fhubik_afk has quit IRC | 11:34 | |
| *** fhubik has quit IRC | 11:35 | |
| *** fhubik has joined #openstack-keystone | 11:35 | |
| *** fhubik is now known as fhubik_afk | 11:35 | |
| *** stevemar has joined #openstack-keystone | 11:43 | |
| *** ChanServ sets mode: +v stevemar | 11:43 | |
| *** hogepodge has quit IRC | 11:47 | |
| *** jamielennox is now known as jamielennox|away | 11:53 | |
| *** stevemar has quit IRC | 12:02 | |
| *** fhubik_afk is now known as fhubik | 12:03 | |
| *** hogepodge has joined #openstack-keystone | 12:04 | |
| *** rodrigods has quit IRC | 12:06 | |
| *** rodrigods has joined #openstack-keystone | 12:06 | |
| *** dims_ has quit IRC | 12:10 | |
| *** dims_ has joined #openstack-keystone | 12:13 | |
| *** bknudson has quit IRC | 12:20 | |
| *** dims__ has joined #openstack-keystone | 12:23 | |
| *** raildo|away is now known as raildo | 12:25 | |
| *** dims_ has quit IRC | 12:27 | |
| *** gordc has joined #openstack-keystone | 12:37 | |
| *** browne has joined #openstack-keystone | 12:40 | |
| *** angular_mike has joined #openstack-keystone | 12:40 | |
| *** bknudson has joined #openstack-keystone | 12:42 | |
| *** ChanServ sets mode: +v bknudson | 12:42 | |
| *** bknudson has left #openstack-keystone | 12:43 | |
| *** bknudson has joined #openstack-keystone | 12:43 | |
| *** ChanServ sets mode: +v bknudson | 12:43 | |
| *** ozialien has joined #openstack-keystone | 12:43 | |
| *** aix has quit IRC | 12:53 | |
| *** aix has joined #openstack-keystone | 13:03 | |
| *** fhubik is now known as fhubik_afk | 13:04 | |
| *** lifeless has quit IRC | 13:07 | |
| *** fhubik_afk is now known as fhubik | 13:08 | |
| *** richm has joined #openstack-keystone | 13:23 | |
| *** dims__ has quit IRC | 13:28 | |
| *** dims_ has joined #openstack-keystone | 13:28 | |
| *** iamjarvo has joined #openstack-keystone | 13:33 | |
| *** dims__ has joined #openstack-keystone | 13:36 | |
| *** iamjarvo has quit IRC | 13:37 | |
| *** dims_ has quit IRC | 13:37 | |
| *** rushiagr is now known as rushiagr_away | 13:39 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Crating Liberty repository for specs https://review.openstack.org/171733 | 13:41 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Creating Liberty repository for specs https://review.openstack.org/171733 | 13:41 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Move reseller spec for Liberty release https://review.openstack.org/170926 | 13:41 |
| *** davidckennedy has joined #openstack-keystone | 13:43 | |
| davidckennedy | I'm trying to run tox in keystonemiddleware but getting complaints "oslo_config.cfg.NoSuchOptError: no such option in group keystone_authtoken: endpoint_id". Once I've set up the venv shouldn't I just be able to execute tox? | 13:44 |
| *** stevemar has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v stevemar | 13:46 | |
| rodrigods | stevemar, have a moment to discuss https://review.openstack.org/#/c/161751/ ? | 13:48 |
| *** edmondsw has joined #openstack-keystone | 13:50 | |
| *** openstackgerrit has quit IRC | 13:53 | |
| *** openstackgerrit has joined #openstack-keystone | 13:53 | |
| davidckennedy | OK, to answer my own question, yes I should. It appears that the patch set I've picked up was incomplete so I've more work to do than just babysitting. | 13:53 |
| stevemar | rodrigods, sure | 13:54 |
| *** jorge_munoz has quit IRC | 13:54 | |
| stevemar | rodrigods, i don't know how i want that patch to end up looking | 13:54 |
| rodrigods | stevemar, yeah :( | 13:54 |
| rodrigods | stevemar, the thing is... jamielennox|away said the -federation repo is going to change to -saml | 13:55 |
| rodrigods | until than it won't have a release | 13:55 |
| rodrigods | and the base class should be https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v3/federated.py#L25 | 13:56 |
| rodrigods | so he suggested to implement in ksc itself | 13:56 |
| *** _cjones_ has joined #openstack-keystone | 13:56 | |
| rodrigods | but this FederatedBaseAuth class is for a completely different use case if compared to k2k | 13:57 |
| stevemar | rodrigods, yeah, it's getting a bit tangled | 13:57 |
| stevemar | rodrigods, KSC has some of the saml stuff in it right? | 13:58 |
| stevemar | maybe propose this to regular KSC | 13:58 |
| *** markvoelker has quit IRC | 13:58 | |
| stevemar | i think jamielennox|away just wants to make sure we don't pull in lxml | 13:59 |
| *** _cjones_ has quit IRC | 13:59 | |
| *** markvoelker has joined #openstack-keystone | 13:59 | |
| rodrigods | stevemar, think the saml2 file was removed | 13:59 |
| rodrigods | stevemar, but we can always add it back :) | 13:59 |
| stevemar | naw, not without an alternative | 13:59 |
| *** krykowski has joined #openstack-keystone | 14:01 | |
| rodrigods | stevemar, so I'll resubmit the patch, but to ksc | 14:02 |
| *** krykowski_ has quit IRC | 14:04 | |
| *** browne has quit IRC | 14:05 | |
| *** zzzeek has joined #openstack-keystone | 14:08 | |
| *** sdake has joined #openstack-keystone | 14:10 | |
| stevemar | rodrigods, ++ | 14:17 |
| *** pcaruana has quit IRC | 14:17 | |
| *** lifeless has joined #openstack-keystone | 14:18 | |
| *** iamjarvo has joined #openstack-keystone | 14:24 | |
| *** iamjarvo has quit IRC | 14:24 | |
| *** iamjarvo has joined #openstack-keystone | 14:25 | |
| *** iamjarvo has quit IRC | 14:25 | |
| *** samueldmq has joined #openstack-keystone | 14:26 | |
| *** iamjarvo has joined #openstack-keystone | 14:26 | |
| *** fhubik has quit IRC | 14:27 | |
| *** afazekas has quit IRC | 14:29 | |
| *** rushiagr_away is now known as rushiagr | 14:30 | |
| gsilvis | ayoung: In response to one of our conversations yesterday... It seems that you can list the projects for a user, but only with the v3 API---does this sound right? | 14:30 |
| ayoung | gsilvis, as I said, it depends on policy...let me show you | 14:31 |
| gsilvis | I can't even see an appropriate API call in v2 | 14:31 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n38 | 14:32 |
| ayoung | So we would want a policy rule that would let a user see their own projectys | 14:32 |
| gsilvis | What API call does that correspond to? See also https://bugs.launchpad.net/keystone/+bug/1415190 | 14:32 |
| openstack | Launchpad bug 1415190 in Keystone "list_user_projects method at assignment manager needs to be removed" [Low,Fix released] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 14:32 |
| *** topol has quit IRC | 14:32 | |
| ayoung | but...yeah, we would want V3 anyway, so if you can make it work with V3, yiou should be better off anyway | 14:33 |
| ayoung | gsilvis, hmmm | 14:33 |
| ayoung | let's start at the router | 14:33 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/assignment/routers.py#n38 | 14:34 |
| *** rushiagr is now known as rushiagr_away | 14:34 | |
| ayoung | That is the only formally supported V2 API from the Public assignment api. | 14:34 |
| ayoung | so that should be on | 14:34 |
| *** csoukup has joined #openstack-keystone | 14:35 | |
| ayoung | http://keystone:5000/v2.0/tenants | 14:35 |
| ayoung | let's see what I get on my server... | 14:35 |
| gsilvis | Okay, that API call certainly exists, but I'm not authorized to do it yet. let's check the policy... | 14:35 |
| *** browne has joined #openstack-keystone | 14:36 | |
| ayoung | $ curl http://$HOSTNAME:5000/v2.0/tenants | 14:36 |
| ayoung | {"error": {"message": "Could not find token: (Disable debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}}-sh-4.2$ | 14:36 |
| bknudson | there's no policy for v2 api except for a couple of calls | 14:36 |
| *** krykowski has quit IRC | 14:36 | |
| samueldmq | gsilvis, ayoung that call was not used anymore | 14:37 |
| bknudson | can see https://review.openstack.org/#/c/168521/ | 14:37 |
| *** krykowski has joined #openstack-keystone | 14:37 | |
| ayoung | samueldmq, the call is the V2 supported call, it has to be there while deprecated and untyil removed | 14:37 |
| gsilvis | bknudson: ooh, I like that mapping file a lot | 14:37 |
| ayoung | get_projects_for_token does not do a policy check | 14:37 |
| samueldmq | ayoung, the call at the router/controller exists | 14:37 |
| samueldmq | ayoung, but that method in the manager was not being used | 14:38 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add redelegation columns to Trust SQL model https://review.openstack.org/172090 | 14:38 |
| samueldmq | ayoung, I am talking specifically about that bug ^ | 14:38 |
| ayoung | samueldmq, right | 14:38 |
| *** amakarov_away is now known as amakarov | 14:38 | |
| ayoung | gsilvis, so, you don't need to be admin to get you set of projects | 14:38 |
| ayoung | gsilvis, OK, so the keystone CLI calls port 35357. | 14:40 |
| ayoung | so, yeah, that won't work, as that is the addmin interface | 14:40 |
| gsilvis | oh!! | 14:40 |
| *** mattfarina has joined #openstack-keystone | 14:40 | |
| samueldmq | ayoung, https://github.com/openstack/keystone/blob/master/etc/policy.json#L38 | 14:40 |
| gsilvis | curl http://localhost:5000/v2.0/tenants -H"X-Auth-Token: <etc>" works, yeah | 14:41 |
| ayoung | http://docs.openstack.org/developer/keystone/api_curl_examples.html#get-tenants | 14:41 |
| gsilvis | I had been trying 35357 the whole time | 14:41 |
| ayoung | gsilvis, and now you know why we are trying to kill the v2 API. | 14:41 |
| gsilvis | :P | 14:41 |
| samueldmq | ++ | 14:41 |
| ayoung | gsilvis, you guys should be targetting v3 only for new dev | 14:42 |
| *** tobberydberg has quit IRC | 14:45 | |
| ayoung | stevemar, {"error": {"message": "Could not find Identity Provider: https://ipa.younglogic.net/idp/saml2/metadata", "code": 404, "title": "Not Found"}} | 14:50 |
| stevemar | ayoung, don't scare me now, whats up | 14:51 |
| ayoung | is that mapping from the remote_id_attribute? | 14:51 |
| ayoung | stevemar, I'm setting up SAML with Ipsilong. REdirect to Ipsilon works, but coming back the Keystone page errors out ^^ | 14:51 |
| ayoung | http://keystone.younglogic.net:5000/v3/auth/OS-FEDERATION/websso/saml2?origin=http://keystone.younglogic.net/auth/websso/ | 14:52 |
| ayoung | nkinder, just suggested I was not matching the remote id | 14:52 |
| ayoung | let's see... | 14:52 |
| ayoung | select * from idp_remote_ids; | 14:52 |
| ayoung | yep, not in there.... | 14:53 |
| ayoung | nkinder, OK, I think I jknow where it messed uop | 14:53 |
| ayoung | nkinder, https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-federation-setup/vm-post-cloud-init-rdo.sh#L242 | 14:54 |
| ayoung | I'm using devstack, so I should not need to do the curl, no? | 14:54 |
| ayoung | stevemar, do we have OSC support for setting the remote_id? | 14:55 |
| stevemar | ayoung, you betcha | 14:56 |
| samueldmq | <stevemar> ayoung, don't scare me now, whats up | 14:56 |
| samueldmq | haha | 14:56 |
| ayoung | stevemar, ah, maybe I have an older client | 14:56 |
| ayoung | nope | 14:56 |
| stevemar | ayoung, it's in the master branch, not released yet | 14:57 |
| ayoung | stevemar, I'm working from master | 14:57 |
| stevemar | git pull origin master && python setup.py install | 14:57 |
| stevemar | it shouuuuuld be there | 14:57 |
| stevemar | on identity provider create / set | 14:57 |
| ayoung | $ cat /usr/lib/python2.7/site-packages/python-openstackclient.egg-link | 14:58 |
| ayoung | /opt/stack/python-openstackclient | 14:58 |
| ayoung | stevemar, its not in the help list | 14:58 |
| *** mflobo has quit IRC | 14:58 | |
| ayoung | $ openstack --help 2>&1 | grep remote | 14:58 |
| ayoung | console url show Show server's remote console URL | 14:58 |
| stevemar | it wouldn't be in the generic help output | 14:59 |
| stevemar | try $ openstack help identity provider create | 14:59 |
| ayoung | Group ipausers returned by mapping ipsilon_mapping was not found in the backend. | 15:03 |
| ayoung | OK...good, new error | 15:03 |
| ayoung | Guessing that is a Federated domain issue. I want to map to the default domain | 15:04 |
| ayoung | maybe update my mapping? | 15:05 |
| *** rhagarty_ has quit IRC | 15:07 | |
| *** rhagarty has joined #openstack-keystone | 15:07 | |
| stevemar | ayoung, thought it wasn't supposed to barf on groups that aren't found? | 15:08 |
| ayoung | stevemar, yep...but I created that group...sort of | 15:08 |
| ayoung | stevemar, I think I'm good...I just needed to get over the remote_id thing | 15:09 |
| stevemar | ayoung, okie dokie | 15:09 |
| *** krykowski has quit IRC | 15:10 | |
| *** topol has joined #openstack-keystone | 15:11 | |
| *** ChanServ sets mode: +v topol | 15:11 | |
| ayoung | GAH | 15:13 |
| ayoung | select * from 'group'; | 15:13 |
| ayoung | ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''group'' at line 1 | 15:13 |
| *** jistr is now known as jistr|mtg | 15:15 | |
| ayoung | stevemar, OK, got it | 15:16 |
| ayoung | I was mapping group id, should have been name | 15:16 |
| stevemar | ah | 15:16 |
| stevemar | yeah, we're going for name now! | 15:16 |
| stevemar | screw those ids | 15:16 |
| *** samueldmq has quit IRC | 15:18 | |
| ayoung | nkinder, what should mod_mellon be producing for the list of groups? I know there was some issue there with ; vs : | 15:22 |
| ayoung | what is the env var, though? | 15:22 |
| *** ajayaa has quit IRC | 15:26 | |
| *** jistr|mtg is now known as jistr | 15:27 | |
| morganfainberg | stevemar, can i point out that --help not being on stdout is weird? | 15:30 |
| morganfainberg | if 2>&1 is needed to grep | 15:30 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add redelegation columns to Trust SQL model https://review.openstack.org/172090 | 15:32 |
| stevemar | morganfainberg, it does go to stdout, and grep works | 15:35 |
| morganfainberg | ok | 15:35 |
| stevemar | openstack --help | grep 'user' | 15:35 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: Add Endpoint Enforcement to Keystonemiddleware https://review.openstack.org/153296 | 15:38 |
| *** jistr has quit IRC | 15:40 | |
| ayoung | stevemar, OK, I got SAML to wrok along side Kerberos for Horizon websso. | 15:44 |
| stevemar | \o/ | 15:46 |
| ayoung | http://keystone.younglogic.net should work with SAML. If you don't have a Kerberos TGT, it will default to Userid and password | 15:48 |
| ayoung | you have an account | 15:48 |
| stevemar | you are right, i do | 15:49 |
| *** angular_mike has quit IRC | 15:53 | |
| stevemar | ayoung, i'm on a train, so my connect is pretty awful :) | 15:54 |
| ayoung | heh | 15:54 |
| ayoung | stevemar, OK...when you get settled. | 15:54 |
| stevemar | your horizon is taking a while to load | 15:54 |
| morganfainberg | FYI we now have stable branches for middleware and keystoneclient | 15:56 |
| morganfainberg | we will need to do backports for | 15:56 |
| morganfainberg | middleware is stable/juno | 15:56 |
| morganfainberg | client is stable/juno and stable/icehouse | 15:56 |
| stevemar | nice | 15:56 |
| stevemar | i am le in | 15:56 |
| morganfainberg | we will be doing semver backports for security reasons to the version number.Z++ as needed | 15:56 |
| stevemar | i see the projects, that's goood | 15:57 |
| bknudson | I just hope there's no security vulnerabilities in middleware or client! | 15:57 |
| morganfainberg | bknudson, there already is. | 15:58 |
| bknudson | we can test the process | 15:58 |
| morganfainberg | bknudson, and we have to go through all advisories and prioritise these fixes and then do a g-r update for the .Z update for juno/icehouse | 15:58 |
| *** gyee has joined #openstack-keystone | 15:59 | |
| *** ChanServ sets mode: +v gyee | 15:59 | |
| bknudson | morganfainberg: seems like the cap should have included .Z++? | 15:59 |
| morganfainberg | the g-r was already there | 15:59 |
| morganfainberg | so we need to propose that fix to g-r for the stables | 16:00 |
| *** rwsu has joined #openstack-keystone | 16:02 | |
| *** bdossant has joined #openstack-keystone | 16:04 | |
| *** jdennis1 has joined #openstack-keystone | 16:05 | |
| * morganfainberg issued the recheck on the g-r update for ksm | 16:06 | |
| morganfainberg | stevemar, bknudson, jamielennox|away, please make sure we get anything we want in the client/ksm for kilo capped version in gate today. | 16:06 |
| *** jdennis has quit IRC | 16:06 | |
| bknudson | is jenkins still failing everything? | 16:08 |
| lbragstad | bknudson: looks to be that way | 16:09 |
| morganfainberg | for ksc and ksm the failures should now stop | 16:09 |
| morganfainberg | use https://review.openstack.org/#/c/166438/ as the baseline | 16:10 |
| morganfainberg | we also have an issue where keystone cannot upgrade in grenade with mod_wsgi deployment | 16:10 |
| morganfainberg | [04/09/2015 -:- 08:48:16] <sdague>the error you get is that keystone.openstack.common.log doesn't exist | 16:10 |
| morganfainberg | the fix needs to go into devstack so devstack is smart about tearing down keystone under mod_wsgi | 16:11 |
| morganfainberg | could someone jump on that grenade right away? if not i'll be looking at it when i get back from my errands across town | 16:11 |
| morganfainberg | but, i'd rather not have this wait 3-4 hours before someone starts poking at it | 16:12 |
| morganfainberg | sdague in -qa brought this to my attention | 16:12 |
| morganfainberg | stevemar, dstanek, gyee, bknudson, ayoung, lbragstad, dolphm, ^ [or anyone else who loves devstack work] | 16:12 |
| nkinder | ayoung: mellon uses a ';', and you need to enable MellonMergeEnvVars for it to create a list | 16:14 |
| nkinder | ayoung: that option is only in 0.10 | 16:14 |
| ayoung | nkinder, yeah, I think I'm getting one group using MELLO_groups | 16:15 |
| dolphm | morganfainberg: have a link to the grenade failure? | 16:15 |
| morganfainberg | sec | 16:15 |
| morganfainberg | nope | 16:16 |
| morganfainberg | config isn't running anywhere yet | 16:16 |
| dolphm | morganfainberg: i'm guessing the upgrade process isn't using the newer https://github.com/openstack/keystone/blob/master/httpd/keystone.py | 16:16 |
| morganfainberg | grenade has only been eventlet | 16:16 |
| *** davidckennedy has quit IRC | 16:16 | |
| morganfainberg | dolphm, sdague was tryng to get the uprade testing to work from what i gather | 16:16 |
| morganfainberg | dolphm, it likely copies the file in, then upgrades and fails to copy the new file in | 16:17 |
| * morganfainberg has to run. errand on the other side of town. | 16:17 | |
| dolphm | morganfainberg: right, that's what i'm thinking | 16:17 |
| nkinder | ayoung: the detailf behavior for multiple values is tpo have separate env. vars. with an index number (MELLON_GROUP_0, MELLON_GROUP_1, ...) | 16:17 |
| nkinder | err.... default | 16:17 |
| morganfainberg | dolphm, if no one can jump on it while i'm out, i'll jump on it when back :) | 16:17 |
| nkinder | damn muscle memory | 16:18 |
| dolphm | morganfainberg: i'm poking sdague in -dev now | 16:18 |
| morganfainberg | dolphm, thanks. | 16:18 |
| morganfainberg | dolphm, and -qa is good. | 16:18 |
| morganfainberg | if he's less focused in -dev | 16:18 |
| morganfainberg | dolphm, thanks!! | 16:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/172139 | 16:18 |
| *** alexsyip has joined #openstack-keystone | 16:20 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add redelegation columns to Trust SQL model https://review.openstack.org/172090 | 16:20 |
| gyee | morganfainberg, k, since dolphm volunteered | 16:21 |
| *** ajayaa has joined #openstack-keystone | 16:21 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/155584 | 16:25 |
| *** bdossant has quit IRC | 16:25 | |
| *** ozialien has quit IRC | 16:26 | |
| *** arunkant_ has joined #openstack-keystone | 16:32 | |
| stevemar | ayoung, you should do a volume list on the demo project <.< >.> | 16:34 |
| *** harlowja_away is now known as harlowja | 16:35 | |
| ayoung | SCHAWING! | 16:35 |
| ayoung | stevemar, so, I was messing around with IPAs Host Based Access Control, cuz I don't want web-only users to be able to ssh in to the machine, and I had broken it, and fixed it while you wer playing | 16:36 |
| ayoung | OK...lunch! | 16:36 |
| *** ayoung is now known as ayoung-lunch | 16:36 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add redelegation columns to Trust SQL model https://review.openstack.org/172090 | 16:39 |
| *** lhcheng has joined #openstack-keystone | 16:39 | |
| *** ChanServ sets mode: +v lhcheng | 16:39 | |
| *** csoukup has quit IRC | 16:42 | |
| *** jdennis1 has quit IRC | 16:43 | |
| *** david8hu has quit IRC | 16:54 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add redelegation columns to Trust SQL model https://review.openstack.org/172090 | 16:57 |
| *** angular_mike has joined #openstack-keystone | 16:57 | |
| *** viktors is now known as viktors|afk | 17:02 | |
| amakarov | morganfainberg, hi! I remember it was discussion about removing 'extra' field from models: is there any blueprint to use? | 17:13 |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| *** _cjones_ has quit IRC | 17:13 | |
| *** _cjones_ has joined #openstack-keystone | 17:13 | |
| *** openstack has quit IRC | 17:13 | |
| *** openstack has joined #openstack-keystone | 17:13 | |
| *** jdennis has joined #openstack-keystone | 17:16 | |
| openstackgerrit | guang-yee proposed openstack/keystone: make sure we properly initialize the backends before using the drivers https://review.openstack.org/171864 | 17:20 |
| ayoung-lunch | stevemar, we are now at the pint where I am thinking things like: OK, if the authentication fails via Federation, we need a better error page...we need to know what page in Horizon to redirect the user back to, or how to talk to the Django login mechanism | 17:25 |
| ayoung-lunch | But I am not really here...I still didn;t make it to lunch | 17:25 |
| *** ozialien has joined #openstack-keystone | 17:25 | |
| stevemar | ayoung-lunch, go eat lunch! | 17:26 |
| stevemar | ayoung-lunch, we can provide a fail template like we do with the callback template | 17:27 |
| ayoung-lunch | stevemar, nah, we need a redirect to Horizon and let them handle the UI | 17:27 |
| *** boris-42 has quit IRC | 17:28 | |
| *** zzzeek has quit IRC | 17:29 | |
| *** amakarov is now known as amakarov_away | 17:29 | |
| lhcheng | morganfainberg: for rc-2 backport, I should be proposing the patch to proposed/kilo branch? | 17:35 |
| *** aix has quit IRC | 17:37 | |
| morganfainberg | lhcheng: yeah but anything proposed there needs to be -2 unless rc2 window is open and bug appropriately targeted. | 17:38 |
| morganfainberg | lhcheng: you might want to wait on the back port to when we open rc2 window. | 17:38 |
| *** zzzeek has joined #openstack-keystone | 17:38 | |
| * morganfainberg is afk for a couple hours. Bbiab | 17:38 | |
| lhcheng | morganfainberg: gotcha, I'll wait for rc2 window then | 17:39 |
| lhcheng | ayoung-lunch: for websso federation, how about if keystone posting back three fields instead? token, status_code and message | 17:39 |
| stevemar | lhcheng, now you're cooking with fire! | 17:40 |
| *** gyee has quit IRC | 17:40 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/172155 | 17:40 |
| rodrigods | stevemar, ^ | 17:40 |
| lhcheng | stevemar: first time I heard the expression. :P is it the other end of the expression "cooking with gas"? | 17:44 |
| stevemar | lhcheng, sure, or maybe my expression is wrong :P | 17:44 |
| lhcheng | canadian version ? :) | 17:45 |
| rodrigods | lhcheng, raildo available to discuss https://review.openstack.org/#/c/158720/ ? | 17:45 |
| *** david8hu has joined #openstack-keystone | 17:45 | |
| lhcheng | bknudson might have some thoughts about error response too ^ | 17:46 |
| bknudson | I like henrynash's suggestion, from a purity point of view. | 17:47 |
| rodrigods | bknudson, lhcheng ++ | 17:48 |
| rodrigods | me too | 17:48 |
| bknudson | but we've already got a mess of managers returning HTTP exceptions, so this isn't something strange. | 17:48 |
| bknudson | might as well try it out and then maybe henrynash will +2 it. | 17:48 |
| bknudson | is that all there was to discuss? | 17:49 |
| lhcheng | aside from the controller vs manager | 17:49 |
| lhcheng | there is another question about what to raise for ProjectNotFound, DomainNotFound error | 17:50 |
| lhcheng | For example: when we create a project with parent_id | 17:50 |
| lhcheng | we validate that the parent_id exists | 17:50 |
| lhcheng | Should we be translating the ProjectNotFound exception to ValidationError too | 17:51 |
| lhcheng | because really, we are performing a validation | 17:51 |
| rodrigods | the HTTP code makes sense | 17:51 |
| rodrigods | to be 400 | 17:51 |
| rodrigods | not 404 | 17:52 |
| raildo | lhcheng, Do you have see the henrynash's comment here: https://review.openstack.org/#/c/159944/ | 17:53 |
| lhcheng | raildo: yeah. Seems like going forward, the handling of the error code should be handled in the controller. I am fine with that too, as long as we'll do it consistently. | 17:56 |
| rodrigods | right now, we do not convert *NotFound to ValidationError | 17:59 |
| rodrigods | (in other cases, as for creating a user for example) | 17:59 |
| rodrigods | so I think we need to be consistent here | 17:59 |
| rodrigods | if the 404 should be turned into a 400, that is a separate discussion, I think | 17:59 |
| bknudson | POST /v3/projects should never return a 404 | 18:00 |
| bknudson | because the /v3/projects resource exists. | 18:00 |
| rodrigods | bknudson, sagreeo we have a bug in POST /v3/users | 18:01 |
| rodrigods | agreed and we have a bug in* | 18:01 |
| lhcheng | bknudson: agree, that's kinda weird response | 18:01 |
| bknudson | I don't think we can fix that... let's try to not mess it up elsewhere. | 18:01 |
| lhcheng | rodrigods: yeah, that could be tackled separately to make it consistent | 18:01 |
| lhcheng | bknudson: so we keep thing as is? and just make the new API return the correct response? | 18:02 |
| bknudson | lhcheng: yes. | 18:02 |
| lhcheng | bknudson: I am fine with that, I can imagine some consumer that may already relying on that 404 error since we already have it out. | 18:03 |
| lhcheng | ++ for not breaking backward compatibility | 18:04 |
| raildo | lhcheng, ok, we have to explain this for henrynash later, just to keep everyone updated about this :) | 18:04 |
| bknudson | raildo: explain what? | 18:05 |
| bknudson | I thought you were going to do what he suggested. | 18:05 |
| rodrigods | lhcheng, the behavior is not documented https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#create-user and the consumer may be testing for 40* | 18:05 |
| raildo | bknudson, about waht he said in this comment: https://review.openstack.org/#/c/158720/10/keystone/resource/core.py | 18:05 |
| *** sdake_ has joined #openstack-keystone | 18:05 | |
| rodrigods | lhcheng, so I believe we can create the bug, update the API spec and fix the return code | 18:06 |
| bknudson | oh, his suggestion was something different. | 18:06 |
| raildo | bknudson, yeap | 18:06 |
| bknudson | maybe he just wants a different exception. | 18:07 |
| *** mestery has quit IRC | 18:07 | |
| *** sdake has quit IRC | 18:09 | |
| rodrigods | bknudson, I think he is concerned about the POST /v3/users behavior, which returns the *NotFound | 18:09 |
| bknudson | I don't think the API stability requirements allow that change. | 18:10 |
| rodrigods | bknudson, from 404 to 400? just for the create_user case, right? | 18:10 |
| *** mestery has joined #openstack-keystone | 18:10 | |
| bknudson | yes, just for the POST /v3/users case, if that's what it did before. | 18:11 |
| rodrigods | bknudson, even if it is not documented in our API spec? | 18:11 |
| bknudson | especially if it's not documented in the API spec. | 18:11 |
| rodrigods | lol | 18:11 |
| rodrigods | ok | 18:11 |
| bknudson | the spec should be updated. | 18:12 |
| rodrigods | it's really strange one call return 400 and another return 404 for the same error :( | 18:13 |
| bknudson | I agree... someone should have been reviewing these changes and making sure that didn't happen. | 18:13 |
| *** tqtran has joined #openstack-keystone | 18:14 | |
| rodrigods | bknudson, this is an example of a trade off where I don't know yet what to choose: the correct return breaking the consistency between different calls or the wrong return keeping the consistency | 18:16 |
| rodrigods | but seems the first option is the one to go, right? | 18:16 |
| bknudson | the first option is the one to choose. | 18:16 |
| lhcheng | it is what it is, we have to commit to API stability. | 18:18 |
| lhcheng | bknudson: thanks for you inputs, very helpful | 18:18 |
| rodrigods | lhcheng, bknudson ++ | 18:22 |
| *** sdake has joined #openstack-keystone | 18:25 | |
| *** sdake_ has quit IRC | 18:29 | |
| *** ajayaa has quit IRC | 18:30 | |
| *** BAKfr has quit IRC | 18:40 | |
| *** pnavarro has joined #openstack-keystone | 18:41 | |
| *** ozialien has quit IRC | 18:42 | |
| *** BAKfr has joined #openstack-keystone | 18:44 | |
| *** ozialien has joined #openstack-keystone | 18:44 | |
| *** zzzeek has quit IRC | 18:46 | |
| *** aix has joined #openstack-keystone | 18:55 | |
| *** Farhan has quit IRC | 19:01 | |
| gordc | is there some unique setting that needs to be set to get pki tokens working in devstack? | 19:20 |
| *** iamjarvo has quit IRC | 19:26 | |
| *** kr4zy has joined #openstack-keystone | 19:28 | |
| kr4zy | Can anyone confirm that caching is available for the identity component using ldap? | 19:29 |
| *** iamjarvo has joined #openstack-keystone | 19:30 | |
| *** iamjarvo has quit IRC | 19:31 | |
| *** iamjarvo has joined #openstack-keystone | 19:31 | |
| *** iamjarvo has quit IRC | 19:32 | |
| *** iamjarvo has joined #openstack-keystone | 19:32 | |
| *** samueldmq has joined #openstack-keystone | 19:33 | |
| stevemar | gordc, why are you subjecting yourself to that? | 19:33 |
| gordc | stevemar: apparently it don't work for ceilometer. i'm debugging. i think it might be how we configure it in devstack. | 19:37 |
| rodrigods | stevemar, if I have two projects with the same name (in different domains), we may have a problem in k2k mapping, right? | 19:38 |
| *** pnavarro has quit IRC | 19:39 | |
| *** iurygregory has joined #openstack-keystone | 19:40 | |
| *** _cjones_ has quit IRC | 19:48 | |
| dolphm | nkinder: ayoung-lunch: what's ipsilon? | 19:49 |
| andreaf | morganfainberg: hi - I implemented bp to make tempest capable to work on an identity v3 only cloud - and I have this bp https://blueprints.launchpad.net/tempest/+spec/keystone-v3-jobs about setting up CI for it - however I need a identity v3 only devstack to actually verify my work - do you think it's something feasible right now? | 19:50 |
| *** dims__ is now known as dims | 19:50 | |
| rodrigods | dolphm, https://fedorahosted.org/ipsilon/ | 19:50 |
| morganfainberg | andreaf: devstack can't do that today but it is on the list of what I'm hoping to see this cycle. And get everything else able to work in that mode. | 19:51 |
| dolphm | rodrigods: thanks! | 19:51 |
| morganfainberg | So we can gate on it. | 19:51 |
| andreaf | morganfainberg: oh, is that a limit of devstack only or is it the services who cannot all talk v3? | 19:52 |
| bknudson | you'd need to remove v2 from the paste pipeline. | 19:53 |
| morganfainberg | andreaf: most services don't care v3 or otherwise. We don't have a mode where devstack can deploy v2 keystone disabled atm, so we aren't testing it. | 19:53 |
| morganfainberg | andreaf: devstack is limited, therefore other testing has been "as we find things that don't play nice" | 19:54 |
| morganfainberg | Like I said, target for liberty. | 19:55 |
| *** zzzeek has joined #openstack-keystone | 19:55 | |
| rodrigods | morganfainberg, stevemar, ayoung-lunch, can you check bug #1442343? | 19:55 |
| openstack | bug 1442343 in Keystone "Mapping openstack_project attribute in k2k assertions with different domains" [Undecided,New] https://launchpad.net/bugs/1442343 | 19:55 |
| andreaf | morganfainberg: ok - let me know if you find any issue on tempest side when working on that | 19:55 |
| *** ayoung-lunch is now known as ayoung | 19:55 | |
| ayoung | rodrigods, you need to clean up the language on that bug. I can't tell what you are saying is wrong/ | 20:00 |
| ayoung | dolphm, ipsilon is a project for doing SAML from existing IdPs | 20:00 |
| ayoung | https://fedorahosted.org/ipsilon/ | 20:00 |
| ayoung | dolphm, its basically an attempt to make it easier to add SAML and other SSO techs on to LDAP | 20:01 |
| nkinder | ayoung: correction. Ipsilon is a multi-protocol IdP | 20:01 |
| nkinder | Currently SAML, OpenID, and Persona | 20:01 |
| nkinder | OpenID Connect is in progress | 20:01 |
| dolphm | ayoung: nkinder: cool | 20:01 |
| bknudson | keystone can generate saml assertions from LDAP, too. | 20:02 |
| ayoung | dolphm, since it can back to PAM, one potential is to use if for Testing Fedration in devstack with not LDAP or any other external | 20:02 |
| nkinder | backed by things like FreeIPA, PAM, Kerberos, generic LDAP, or other IdPs | 20:02 |
| *** angular_mike has quit IRC | 20:03 | |
| *** ozialien has quit IRC | 20:03 | |
| rodrigods | ayoung, better? | 20:05 |
| ayoung | rodrigods, yes. THat is kindof a big limitation.... | 20:06 |
| rodrigods | ayoung, is there a problem if we pass the domain in the assertion as well? | 20:07 |
| ayoung | rodrigods, I've been ignoring K2K thus far. I'm not really the driver for it. | 20:08 |
| rodrigods | ayoung, the problem is even bigger if we introduce the project naming constraints planned in Reseller | 20:08 |
| rodrigods | ayoung, ok :( | 20:08 |
| rodrigods | ayoung, neither stevemar, marekd or gyee here, so... | 20:08 |
| ayoung | rodrigods, I think K2K needs some rethinking anyway | 20:09 |
| ayoung | I think it will end up being split into two distinct things | 20:09 |
| ayoung | one is the Keystione IdP, which | 20:10 |
| ayoung | will let companies continue to use their existing user databases.... | 20:10 |
| morganfainberg | ayoung, the main usecase for k2k is many aggregate IDPs and then sub-clouds | 20:10 |
| morganfainberg | ayoung, where accepting identity from all the IDPs for every sub-cloud (aka vendor) becomes a real orchestration headache | 20:11 |
| ayoung | morganfainberg, um...sure | 20:11 |
| ayoung | or we can make it not be a headache | 20:11 |
| morganfainberg | ayoung, i have vendors in italy, canada, and california who need access to my swift store(s), they supply their own IDPs. i can then manage their access to my outside cloud vendors aka bluebox | 20:11 |
| ayoung | but that is leading in to the design of Federation | 20:12 |
| morganfainberg | ayoung, how do you make that *not* a headache | 20:12 |
| ayoung | morganfainberg, first off, we make the FEderation mapping such that you don;'t need to be All powerful to make changes | 20:12 |
| morganfainberg | every time you add another designated cloud you ask the endpoints to generate saml for them? | 20:12 |
| morganfainberg | no. | 20:12 |
| ayoung | Yes | 20:12 |
| ayoung | that is like, 101 | 20:12 |
| morganfainberg | god enterprises are going to kill you | 20:13 |
| morganfainberg | i've already had to fight this battle twice | 20:13 |
| raildo | lol | 20:13 |
| *** _cjones_ has joined #openstack-keystone | 20:13 | |
| ayoung | Heh | 20:13 |
| morganfainberg | and asking it every time "oh now do it for X, and then Y and then Z" | 20:13 |
| morganfainberg | the answer is "yep, we don't want this anymore" | 20:13 |
| *** Ephur_ has joined #openstack-keystone | 20:13 | |
| ayoung | morganfainberg, I tried to beg off the questions... | 20:13 |
| *** Ephur has quit IRC | 20:14 | |
| morganfainberg | they want to be able to access the *aaS thing and let that be wherever it needs to be with the central place they've authed | 20:14 |
| ayoung | morganfainberg, and what doees it mean by " the central place they've authed?" | 20:14 |
| morganfainberg | ayoung, the base keystone | 20:14 |
| morganfainberg | the one *I* as the principle contact controls | 20:14 |
| morganfainberg | auth here, access where needed. | 20:15 |
| *** jlk has joined #openstack-keystone | 20:15 | |
| morganfainberg | assuming the remote sites are not controlled by the same keystone (Cannot be due to different orgs) | 20:15 |
| *** iamjarvo has quit IRC | 20:15 | |
| morganfainberg | and multi-signer doesn't work either. you need a full blown token for the remote side since only that remote side can control it's resources | 20:15 |
| morganfainberg | so you need a way to S4u2proxy but for keystone | 20:16 |
| ayoung | Keystones of Unusual size? I don't think they exist | 20:16 |
| morganfainberg | anyway | 20:16 |
| morganfainberg | we'll just have to agree to disagree | 20:16 |
| ayoung | NO, I'll have to agree that I don;'t understand WTF you are talking about | 20:16 |
| morganfainberg | k2k is a real thing | 20:16 |
| morganfainberg | and useful | 20:16 |
| ayoung | YOu blogged this at one point? | 20:16 |
| jlk | morganfainberg: howdy. When we talked, you had mentioned a couple things I needed to do in haproxy, for SP. Was it session affinity (via SERVERID cookie) and was there one other thing? | 20:17 |
| morganfainberg | jlk, uhmm..... brain distracted | 20:17 |
| jlk | hehe | 20:17 |
| morganfainberg | jlk, guang has that right away... dang where did he go | 20:17 |
| morganfainberg | jlk, i think it was that. | 20:17 |
| morganfainberg | uhm. | 20:17 |
| morganfainberg | the request-uri | 20:17 |
| jlk | and making sure we don't re-write the url | 20:17 |
| morganfainberg | yeah | 20:17 |
| morganfainberg | that sounds like the two things gyee said. | 20:18 |
| jlk | I don't see any rewrite rules, but I'm not sure if haproxy does that by default. | 20:18 |
| morganfainberg | jlk, yeah not sure. | 20:18 |
| jlk | We add a header, X-Forwarded_proto:\ https | 20:18 |
| jlk | but that's about it | 20:18 |
| morganfainberg | should be ok from my understanding | 20:19 |
| jlk | alright, I'll add the cookie to keep things going to the same session | 20:19 |
| morganfainberg | let me see what i can do to summon a gyee to the convo | 20:19 |
| morganfainberg | jlk, and the meta xml thing, that turned out to be a red herring for what we're working on right? | 20:19 |
| jlk | I think so | 20:19 |
| morganfainberg | jlk, cool. | 20:20 |
| jlk | I was worried about any redirection the SSO stuff might do, but maybe we can worry about that when trying to actually /do/ things | 20:20 |
| morganfainberg | jlk, for the k2k case it's IDP initiated SAML | 20:20 |
| morganfainberg | jlk, so you don't do the normal: SP -> IDP -> SP dance | 20:21 |
| morganfainberg | jlk, you do IDP -> SP | 20:21 |
| jlk | nod | 20:21 |
| morganfainberg | redirects should be minimal | 20:21 |
| morganfainberg | if at all | 20:21 |
| *** ayoung has left #openstack-keystone | 20:21 | |
| morganfainberg | ayoung, i'm including some of this in the presentation i'm giving on thursday next week | 20:21 |
| *** ayoung has joined #openstack-keystone | 20:22 | |
| morganfainberg | and he left. | 20:22 |
| morganfainberg | ayoung, and he's back | 20:22 |
| *** jaosorior has quit IRC | 20:22 | |
| ayoung | morganfainberg, heh, so I somehow managed to put this chat in its own window | 20:22 |
| morganfainberg | ayoung, i'm including some of this stuff in the authn/authz presentation i'm doing next week. hope i can get it a bit more clear then | 20:22 |
| ayoung | I don;'t jknow how to join other than to close the window and reopen in the main one | 20:22 |
| morganfainberg | ayoung, xchat? | 20:22 |
| ayoung | morganfainberg, OK...let's start by defining your terms here. | 20:22 |
| morganfainberg | ayoung, cause that was a reason i disliked xchat | 20:22 |
| ayoung | yeah xchat | 20:23 |
| morganfainberg | ayoung, so here we go: Company - I use openstack for an application - it's my openstack | 20:23 |
| ayoung | hold it right there | 20:23 |
| morganfainberg | notably i consume swift. | 20:23 |
| ayoung | "it's my openstack" you mean private, in house cloud...this is just your starting pioint | 20:23 |
| morganfainberg | yes private in-house | 20:24 |
| jlk | Do y'all have pre-written tool to help validate unscoped tokens? | 20:24 |
| jlk | or even before that, for adding IdPs to the SP? | 20:24 |
| morganfainberg | jlk, no pre-canned tool afaik :( | 20:24 |
| morganfainberg | jlk, one of the rough edges. | 20:24 |
| jlk | alright. | 20:24 |
| jlk | I'm reading through http://blog.rodrigods.com/playing-with-keystone-to-keystone-federation/ and cribbing | 20:24 |
| morganfainberg | jlk, sorry! :( | 20:24 |
| morganfainberg | yeah rodrigods blog is fantastic | 20:25 |
| jlk | *shrug* earlyadopterprobs | 20:25 |
| rodrigods | not it is not :) | 20:25 |
| rodrigods | Kilo version on its way | 20:25 |
| ayoung | morganfainberg, ok...so inhouse os instance ,swift... go on | 20:25 |
| morganfainberg | ayoung, so my private in-house cloud. with my swift. [lets stick with swift for now, other services make this complex as hell] | 20:25 |
| morganfainberg | ayoung, i place data in swift., i use federated identity to manage who [my customers] can access the swift data | 20:26 |
| morganfainberg | i am now out of capacity. | 20:26 |
| ayoung | ok, so my OS instance is hosting web services open to my customer, and they use swift API to fetch data, | 20:26 |
| morganfainberg | instead of spinning up more swift locally (not an option for business reasons) | 20:26 |
| *** ozialien has joined #openstack-keystone | 20:26 | |
| ayoung | hold on | 20:26 |
| morganfainberg | correct | 20:27 |
| ayoung | are we saying that people are using Swift API to be able to write to my cloud? They don't need it to read | 20:27 |
| morganfainberg | more read than write | 20:27 |
| ayoung | read is a Web call. | 20:27 |
| morganfainberg | but it is a secured call. | 20:27 |
| morganfainberg | needing a token | 20:27 |
| morganfainberg | it's not public read, it's authenticated read | 20:27 |
| ayoung | and we arwe using project assignments to say who can read what? | 20:27 |
| morganfainberg | it somewhat works like that. | 20:28 |
| morganfainberg | project assignments are used | 20:28 |
| morganfainberg | so, when i run out of capacity | 20:28 |
| morganfainberg | and can't spin up more locally [many many reasons for this] | 20:29 |
| morganfainberg | i contact jlk over at bluebox | 20:29 |
| morganfainberg | and they give me swift | 20:29 |
| morganfainberg | with federated identity | 20:29 |
| morganfainberg | assume i have many customers [and adding more every day] | 20:29 |
| morganfainberg | every time i add a customer i need to have bluebox configure *that* swift to allow the new idp? | 20:30 |
| morganfainberg | as well as mine | 20:30 |
| morganfainberg | as well as any other vendor (or alternate bluebox deployment) | 20:30 |
| morganfainberg | jlk, sorry using you as a stawman here | 20:30 |
| jlk | totes fine | 20:30 |
| ayoung | morganfainberg, ok...swift is wierd, because it really is an *aaS, unlike glance and so forth | 20:30 |
| ayoung | Is it really swift driving this use case? | 20:31 |
| morganfainberg | ayoung, no. there are other apps that rely on OpenStack that are *aaS | 20:31 |
| morganfainberg | it just happens that working even with a PaaS layered on openstack it makes this a lot easier | 20:31 |
| ayoung | morganfainberg, so, what you are saing is we are talking about Keystone being used more by the cloud consuemrs than by the infrastructure here. | 20:31 |
| morganfainberg | ayoung, already is a case that occurs | 20:32 |
| ayoung | We will expect more and more apps to be able to consume Keystone authentication | 20:32 |
| morganfainberg | ayoung, because we allowed it - swift was really the first. | 20:32 |
| morganfainberg | ayoung, yep. | 20:32 |
| morganfainberg | ayoung, and it's not an unreasonable thing to do with keystone for your *aaS stuff related to OpenStack | 20:32 |
| morganfainberg | i initially argued we should have an infrastructure keystone and a XaaS keystone | 20:33 |
| morganfainberg | better design | 20:33 |
| ayoung | We still could....nothing precludes that | 20:33 |
| morganfainberg | but it *still* doesn't change what we are supporting | 20:33 |
| morganfainberg | XaaS with keystone auth | 20:33 |
| morganfainberg | IaaS is the easy case. | 20:33 |
| ayoung | OK...so If a customer needs to go to bluebox, they have 3 different rediectes? SAML from their home station, keystone token from me, keystone token from bluebox? | 20:34 |
| morganfainberg | ayoung, home -> me -> Bluebox | 20:34 |
| morganfainberg | bluebox never would be back to <local>, they are an external SP in this strawman | 20:34 |
| ayoung | so do we have client code to handle that? | 20:34 |
| *** ozialien has quit IRC | 20:34 | |
| morganfainberg | ayoung, we have the server code to. client code is actively being worked on | 20:35 |
| morganfainberg | it's a liberty target to be fair | 20:35 |
| morganfainberg | ayoung,but we needed server support to do client work | 20:35 |
| morganfainberg | and 6mo cycles means some things are rough and then get smoother as more support happens | 20:36 |
| morganfainberg | ayoung, the way i see it is k2k is orthogonal to the pure federation case. | 20:36 |
| morganfainberg | it's supporting a clear use-case that exists today | 20:36 |
| morganfainberg | it doesn't eliminate what you're trying to do | 20:36 |
| ayoung | So...for my inhouse cloud, whenever I burst to another provider...am I going to add that provider to my serivce catalog? | 20:37 |
| morganfainberg | it in-fact just leverages some of the same underpinnings (the SP doesn't know it's a keystone or anything else, it just knows it gets SAML) | 20:37 |
| morganfainberg | ayoung, yep. | 20:37 |
| morganfainberg | ayoung, and the business relationship/rates/billing etc is all on the remote cloud | 20:38 |
| ayoung | morganfainberg, but it shows up as a separate region, cuz bluebox nova can't talk to my inhouse neutron | 20:38 |
| morganfainberg | there is one other rough edge we *should* try and solve long term | 20:38 |
| morganfainberg | ayoung, not even a region | 20:38 |
| morganfainberg | ayoung, as an SP | 20:38 |
| morganfainberg | SP is a top-level concept in the catalog | 20:38 |
| morganfainberg | ayoung, mucking SP and region together was messy. | 20:38 |
| ayoung | region is lower than SP? | 20:38 |
| morganfainberg | ayoung, correct. | 20:39 |
| morganfainberg | ayoung, region is a local keystone construct "I own regions" | 20:39 |
| ayoung | gsilvis, you catching this? | 20:39 |
| morganfainberg | you *might* have mirrored regions in the SP. | 20:39 |
| morganfainberg | but its not guaranteed | 20:39 |
| ayoung | morganfainberg, ok, so for the user, the flow is something like: | 20:40 |
| ayoung | got to home keystone list projects, requrest token for project that has Service catalog in remote clode | 20:41 |
| ayoung | client is smart enough to take that token to remote Keystone | 20:41 |
| morganfainberg | client allows you to take it to remote keystone. | 20:42 |
| morganfainberg | you *might* also have capacity locally. | 20:42 |
| morganfainberg | you might only have SPs | 20:42 |
| morganfainberg | but yes | 20:42 |
| ayoung | and get a scoped token in the public cloud. SInce everything in now done with SC, that is going to be done once. We need token cacthing to keep this from being painful | 20:42 |
| morganfainberg | ayoung, the piece we need to also solve to smooth out the experience is "what can SP provide me" | 20:42 |
| ayoung | and we are saying that a given project can only point at one SC, right? | 20:42 |
| ayoung | er SP | 20:42 |
| morganfainberg | ayoung, a project could have many SPs | 20:42 |
| morganfainberg | SPs are like endpoints, filterable | 20:42 |
| *** iamjarvo has joined #openstack-keystone | 20:43 | |
| ayoung | then if I do Nova listm, which do I talk to? | 20:43 |
| gsilvis | ayoung: I hadn't been paying attention---how far back should I scroll? | 20:43 |
| morganfainberg | i might have SPs for the project in EU, AUS, and US | 20:43 |
| morganfainberg | ayoung, nova list is your current scoped token | 20:43 |
| morganfainberg | ayoung, this is where we need to work on the UX and discovering what the remote SPs can provide | 20:44 |
| morganfainberg | today we're at "we can support the workflow" | 20:44 |
| morganfainberg | which is the raw "can i use my identity here to burst into an SP over there" | 20:44 |
| morganfainberg | there are 3 cases this is aiming to solve long term: 1) pure burst capacity | 20:45 |
| morganfainberg | 2) services i *never will* support in my local cloud, but should be integrated (sahara) for my cloud consumers | 20:45 |
| morganfainberg | aka $SP provides sahara install, but i don't want to run a hadoop thing locally | 20:46 |
| ayoung | morganfainberg, why do we insist on doing this all in one project? | 20:46 |
| morganfainberg | and least important [but useful] 3) regional deployments (likely short-lived) | 20:46 |
| ayoung | The rest of it I get | 20:46 |
| morganfainberg | ayoung, this can spin out into the ability to tier keystone into multiple things | 20:47 |
| morganfainberg | ayoung, which might be the long term solution | 20:47 |
| morganfainberg | ayoung, but it starts with what we have. | 20:48 |
| morganfainberg | smoothing out the "what can cloud X do for me" might be where that splits. | 20:48 |
| ayoung | morganfainberg, I haven't given this the attention it deserves, but there is something in it that I want to think more about... | 20:49 |
| morganfainberg | ayoung, please do. | 20:49 |
| ayoung | I don't want to hold things up, which is why it has been eaiser for me to ignore it | 20:49 |
| morganfainberg | ayoung, the k2k bits were also almost free since we had federation already built | 20:49 |
| morganfainberg | they are very small compared to the lifting we did to consume the data | 20:50 |
| morganfainberg | the #1 reason we went SAML vs just shipping a keystone token over was a political issue | 20:50 |
| ayoung | but...I'm just afraid we are once again headed in a direction where we are doing thing s in Keystone that are better handled using other technologies...and that is why I have said nothing...cuz I haven;t done my homework yet | 20:50 |
| morganfainberg | i don't want to explain why the keystone token made sense. | 20:50 |
| ayoung | Yeah, the SAML part I get. It actually is using the Protocol for what it is designed to do | 20:51 |
| morganfainberg | putting this in the SAML spec allowed us to pass the "does the framework pass muster" | 20:51 |
| morganfainberg | ayoung, so if k2k morphs into something way better on top of keystone - thats fine | 20:51 |
| morganfainberg | ayoung, think about this. it's really about building composite clouds. not nessicarily hybrid clouds | 20:52 |
| morganfainberg | ayoung, it's fine for it to morph and change and become better. | 20:52 |
| morganfainberg | ayoung, even if it long term becomes it's own thing. | 20:52 |
| morganfainberg | ayoung, the basic workflow lets us build that. and we have a clear "prior" art for spinning things out where it makes sense (nova -> cinder|glance|keystone) | 20:53 |
| ayoung | morganfainberg, but...what I said at the begining is even more true with all you said. We need to make the mapping code so it can be managed by the end users, not by an admin. | 20:53 |
| morganfainberg | ayoung, 100% | 20:53 |
| *** iamjarvo has quit IRC | 20:53 | |
| morganfainberg | ayoung, that was never a question in my mind | 20:53 |
| ayoung | bluebox needs to let the in house Keystone smartiepants manage it. | 20:53 |
| morganfainberg | i think we even looked at that for kilo iirc | 20:53 |
| *** sdake has quit IRC | 20:53 | |
| morganfainberg | but came to the conclusion it was too big an ask for kilo cycle | 20:54 |
| morganfainberg | (this was at the midcycle afair) | 20:54 |
| ayoung | rodrigods, to get back to your question: I think that with HMT we need the whole path, not just domain, in the SAML assertion | 20:54 |
| morganfainberg | now for liberty. esp. if we can have the details (aka formerly what our midcycle was) hammered out at the summit... | 20:54 |
| ayoung | morganfainberg, you are a dreamer... | 20:55 |
| morganfainberg | ayoung, it becomes a more reasonable ask to make the mapping manageable in that way. or at least in a way that allows the remote keystone admin to limit what the local keystone admin can screw up | 20:55 |
| ayoung | morganfainberg, what we really need to do is schedule the midcycle for the day after RC1 | 20:55 |
| morganfainberg | ayoung, it might be 2 cycles out | 20:55 |
| rodrigods | ayoung, exactly | 20:55 |
| ayoung | Summit is too late | 20:55 |
| morganfainberg | ayoung, no, not if the summit is what our mid cycle has been | 20:56 |
| morganfainberg | summit is enough time to have some thoughts on liberty | 20:56 |
| ayoung | Summit needs to be what our milestone 2 has been, too | 20:56 |
| morganfainberg | plus add in the etherpad and specs proposed as soon as K3 was cut | 20:56 |
| morganfainberg | should help | 20:56 |
| morganfainberg | we've rolled back a lot of things. | 20:57 |
| morganfainberg | as soon as RC is cut we should be ready to discuss priorities for L | 20:57 |
| morganfainberg | so L2 is the 1st line of defence for Feature Freeze | 20:57 |
| morganfainberg | then we have L2->L3 to smooth out the rest of the things | 20:58 |
| *** ashleighfarnham has joined #openstack-keystone | 20:58 | |
| *** iamjarvo has joined #openstack-keystone | 20:58 | |
| morganfainberg | but L2 really does need to be where most of the work is being pushed through. | 20:58 |
| *** stevemar has quit IRC | 20:58 | |
| morganfainberg | but this is also why i want to limit us to ~5 "features" | 20:58 |
| morganfainberg | API impacting/major initiatives | 20:58 |
| *** ashleighfarnham has left #openstack-keystone | 20:59 | |
| ayoung | OK...forget swift for the moment...lets talk, say,. Sahara or Hadoop, or something with less legacy than swift. Something at the app lefvel, that ignores the undercloud should not be talking to blueboxes Keystone | 20:59 |
| morganfainberg | ayoung, sahara is a lot like swift, but you're right very little legacy | 20:59 |
| ayoung | If I am using Keystone, or any other thing, to authorize decisions, and I am running that thing in the cloud, then it doesn't matter which cloud provider I talk to | 20:59 |
| morganfainberg | lets just call whatever it is "hadoop as a service" | 20:59 |
| morganfainberg | if HaaS exists locally you can use it | 21:00 |
| morganfainberg | if it doesn't you might need to use the remote SP. | 21:00 |
| morganfainberg | right now we don't know which SP has that (you could name it funny things i guess) | 21:00 |
| morganfainberg | but that is the next step once the auth flow is smoothed out via client imo | 21:01 |
| ayoung | So, we are talking about anything where the underlying Openstack layer is exposed? | 21:01 |
| morganfainberg | ayoung, I would say that is a reasonable assessment for today | 21:02 |
| morganfainberg | ayoung, next week who knows, but lets not think too hard on next week | 21:02 |
| ayoung | Lets say my customer is talking to my Hadoop service. They kick off a job, and my cloud lacks capacity. We want to burst to another location | 21:02 |
| ayoung | So my hadoop service needs to allocate the capacity. And ... its like Heat... we want it done in the users account.... | 21:03 |
| ayoung | so we need to kick off a handful of vms, storage ,etc... | 21:03 |
| gsilvis | ayoung: I'm going to come back and read this later, by the way---too busy now to really pay attention right now | 21:03 |
| ayoung | gsilvis, its all in evesdrop | 21:03 |
| gsilvis | ayoung: yup :) | 21:04 |
| ayoung | start with 2015-04-09T20:10:44 | 21:04 |
| morganfainberg | ayoung, less autoscaling internally - more i have X quota, and i know i need more than X, so SP is available to do the work at X+Y allocation | 21:05 |
| morganfainberg | the burst is more a pure compute or swift concept i think :( | 21:05 |
| ayoung | morganfainberg, so since they are running my HaaS, I will bill them, but they are going to need to spin up resources ... and it is my HaaS that will do that, not their clients | 21:05 |
| morganfainberg | right, and the SP would bill me, and i'd bill my customer | 21:06 |
| morganfainberg | the biusiness relationship is between <me> and <SP> not <customer> and <sp> | 21:06 |
| morganfainberg | if it was customer and sp, we're out of the loop. | 21:06 |
| morganfainberg | and don't care | 21:06 |
| ayoung | morganfainberg, I have to check out...I'm going to think through the ramifications | 21:06 |
| morganfainberg | ayoung, sure. | 21:07 |
| morganfainberg | ayoung, there has been a ton of interest in this type of support. mostly where you may have different services in different deployments - or pure compute burst | 21:08 |
| morganfainberg | ayoung, we can keep discussing as needed. | 21:08 |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Move reseller spec for Liberty release https://review.openstack.org/170926 | 21:10 |
| *** raildo has quit IRC | 21:12 | |
| *** ayoung has quit IRC | 21:12 | |
| *** topol has quit IRC | 21:15 | |
| morganfainberg | jamielennox|away, FYI https://review.openstack.org/#/c/127066/ will land once we cut stable/kilo for KSM | 21:17 |
| *** edmondsw has quit IRC | 21:17 | |
| morganfainberg | jamielennox|away, i want to avoid giving spurious errors to deployers where they can't switch auth methods because something re-used auth token's config options | 21:17 |
| morganfainberg | jamielennox|away, liberty target in otherwords. | 21:17 |
| samueldmq | morganfainberg: we have the patches for fixing that role inheritance bug | 21:18 |
| samueldmq | morganfainberg:we need reviews | 21:18 |
| samueldmq | morganfainberg: https://review.openstack.org/#/c/171596 | 21:18 |
| morganfainberg | samueldmq, thanks | 21:18 |
| samueldmq | morganfainberg:np | 21:18 |
| samueldmq | morganfainberg:I split the tests exposing the bug vs the fix | 21:19 |
| morganfainberg | good idea | 21:19 |
| samueldmq | I use to do this when we have bugs, but in this case specifically was a suggestion from henry :) | 21:20 |
| *** dims_ has joined #openstack-keystone | 21:21 | |
| *** pnavarro has joined #openstack-keystone | 21:21 | |
| *** dims has quit IRC | 21:24 | |
| *** dims_ has quit IRC | 21:26 | |
| *** samueldmq has quit IRC | 21:28 | |
| *** r-daneel has joined #openstack-keystone | 21:31 | |
| *** mancdaz has quit IRC | 21:35 | |
| *** rushiagr_away has quit IRC | 21:35 | |
| *** iamjarvo has quit IRC | 21:37 | |
| *** mancdaz has joined #openstack-keystone | 21:38 | |
| *** gyee has joined #openstack-keystone | 21:41 | |
| *** ChanServ sets mode: +v gyee | 21:41 | |
| *** pnavarro has quit IRC | 21:52 | |
| *** kr4zy has quit IRC | 21:53 | |
| *** raildo has joined #openstack-keystone | 21:54 | |
| *** rushiagr_away has joined #openstack-keystone | 21:54 | |
| *** iamjarvo has joined #openstack-keystone | 22:03 | |
| *** sdake has joined #openstack-keystone | 22:07 | |
| *** sdake_ has joined #openstack-keystone | 22:10 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Increase minimum token life required https://review.openstack.org/169947 | 22:10 |
| *** Guest77301 has joined #openstack-keystone | 22:11 | |
| *** Guest77301 is now known as dims_ | 22:12 | |
| *** ayoung has joined #openstack-keystone | 22:13 | |
| *** ChanServ sets mode: +v ayoung | 22:13 | |
| *** sdake has quit IRC | 22:14 | |
| *** bknudson has quit IRC | 22:20 | |
| *** Ephur_ has quit IRC | 22:20 | |
| *** sdake_ has quit IRC | 22:47 | |
| *** gyee has quit IRC | 22:51 | |
| openstackgerrit | Merged openstack/keystone: make sure we properly initialize the backends before using the drivers https://review.openstack.org/171864 | 22:51 |
| *** dims_ has quit IRC | 22:52 | |
| *** gordc has quit IRC | 22:55 | |
| *** ayoung has quit IRC | 22:59 | |
| *** mattfarina has quit IRC | 23:05 | |
| *** zzzeek has quit IRC | 23:06 | |
| openstackgerrit | Merged openstack/keystone: Update testing docs https://review.openstack.org/161553 | 23:07 |
| *** r-daneel has quit IRC | 23:13 | |
| *** arunkant_ has quit IRC | 23:16 | |
| *** gyee has joined #openstack-keystone | 23:16 | |
| *** ChanServ sets mode: +v gyee | 23:16 | |
| *** iamjarvo has quit IRC | 23:22 | |
| *** mattfarina has joined #openstack-keystone | 23:27 | |
| *** zzzeek has joined #openstack-keystone | 23:32 | |
| *** dims_ has joined #openstack-keystone | 23:38 | |
| *** mattfarina has quit IRC | 23:41 | |
| *** bknudson has joined #openstack-keystone | 23:45 | |
| *** ChanServ sets mode: +v bknudson | 23:45 | |
| *** edmondsw has joined #openstack-keystone | 23:56 | |
| *** ayoung has joined #openstack-keystone | 23:58 | |
| *** ChanServ sets mode: +v ayoung | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!