| dstanek | besides a few 'if' statements in migrations, do we actually maintain sqlite specific code? | 00:00 |
|---|---|---|
| *** browne has quit IRC | 00:00 | |
| morganfainberg | dstanek: i'm hoping to ditch pysqlite | 00:00 |
| morganfainberg | dstanek: if we have another option, maybe since we do SQL-A, we can do something that mocks up what SQL-A does for "Test backend" | 00:01 |
| dstanek | do we need that now that we don't support 2.6? | 00:01 |
| *** markvoelker has joined #openstack-keystone | 00:01 | |
| morganfainberg | dstanek: oh was that a 2-6 specific thing? | 00:01 |
| *** browne has joined #openstack-keystone | 00:01 | |
| morganfainberg | dstanek: dude if it is kill it from our requirements | 00:01 |
| dstanek | actually...it may have been 2.5 specific | 00:01 |
| dstanek | python has had that builtin for a long time | 00:01 |
| morganfainberg | dstanek, then we literally are "migrate from python-ldap to ldap3" from being 3.4 compatible | 00:01 |
| morganfainberg | at least from a "does this install" | 00:01 |
| morganfainberg | not making any guarantees we didn't do 3.4 incompatible things in our codebase | 00:02 |
| morganfainberg | but we can actually work on fixing it all. | 00:02 |
| dstanek | we have to delete eventlet and fix python-memcache | 00:02 |
| morganfainberg | dstanek, python-memcache installs on 3.4 now | 00:02 |
| morganfainberg | and eventlet is 3 compatible | 00:02 |
| dstanek | i have a ton of py3 patches to push | 00:02 |
| morganfainberg | dstanek, and we could move to pymemcache | 00:03 |
| morganfainberg | it's less work than migrating from python-ldap to ldap3 | 00:03 |
| dstanek | i don't know much about pymemcache, but i don't see why not | 00:03 |
| morganfainberg | dstanek, it's not a hard switch | 00:04 |
| morganfainberg | it is a *way* better library | 00:04 |
| *** roxanaghe has joined #openstack-keystone | 00:04 | |
| morganfainberg | amazingly so | 00:04 |
| morganfainberg | dstanek but if python-memcache works and we can ditch pysqlite | 00:05 |
| morganfainberg | i'm quite happy | 00:05 |
| dstanek | morganfainberg: i'll put a little effort into python-memcache if you think we may stay on it, otherwise i'll leave it be | 00:06 |
| dstanek | it's pretty close, but there are still a few issues | 00:06 |
| morganfainberg | dstanek: i'd rather move to the other library | 00:07 |
| dstanek | then i'll ignore the github thread :-) | 00:07 |
| morganfainberg | dstanek: tbh. pymemcache just has less baggage and is a much better design | 00:07 |
| morganfainberg | dstanek: we need to convert middleware over to it as well. | 00:07 |
| *** zzzeek has quit IRC | 00:08 | |
| morganfainberg | also ldap3 would mean we could support OS X (hahahahahahahahahaha) again for keystone >.> | 00:08 |
| dstanek | :-( just as i'm ditching it | 00:09 |
| morganfainberg | dstanek, i wont change course on it being "use at your own risk" | 00:09 |
| morganfainberg | because i don't want to guess what will break again | 00:10 |
| * morganfainberg sticks w/ VMs for testing even if it'll work. | 00:10 | |
| morganfainberg | mostly cause then if i have to test for juno etc i'm already in that mode | 00:10 |
| *** gyee has quit IRC | 00:23 | |
| *** stevemar has quit IRC | 00:24 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove pysqlite test-requirement dependency https://review.openstack.org/176557 | 00:26 |
| morganfainberg | dstanek: ^^ | 00:26 |
| dstanek | morganfainberg: neat, running the tests now | 00:31 |
| *** _cjones_ has quit IRC | 00:38 | |
| *** _cjones_ has joined #openstack-keystone | 00:39 | |
| *** sdake has joined #openstack-keystone | 00:44 | |
| *** bknudson has quit IRC | 00:45 | |
| *** dramakri has quit IRC | 00:46 | |
| *** sdake has quit IRC | 00:50 | |
| *** roxanaghe has quit IRC | 01:11 | |
| *** _cjones_ has quit IRC | 01:15 | |
| ayoung | samleon, I think that we should support basic auth, but it is something that I think we will get by default with your exisitng patch. | 01:16 |
| *** bknudson has joined #openstack-keystone | 01:20 | |
| *** ChanServ sets mode: +v bknudson | 01:20 | |
| *** sdake has joined #openstack-keystone | 01:31 | |
| *** markvoelker has quit IRC | 01:33 | |
| *** erkules_ has joined #openstack-keystone | 01:37 | |
| *** tqtran has quit IRC | 01:38 | |
| *** erkules has quit IRC | 01:40 | |
| morganfainberg | ayoung, is there a legitimate case we would have a python interpreter that can't do SSL? | 01:49 |
| ayoung | morganfainberg, HMMM | 01:50 |
| ayoung | morganfainberg, as a client or as a server? | 01:50 |
| morganfainberg | ayoung, in keystone | 01:50 |
| ayoung | you mean eventlet? | 01:50 |
| morganfainberg | ayoung, no i mean python itself. | 01:50 |
| morganfainberg | python | 01:50 |
| morganfainberg | import ssl | 01:50 |
| * morganfainberg is working to provide a patch that converts keystone from python-ldap to ldap3 | 01:51 | |
| ayoung | morganfainberg, ah | 01:51 |
| dstanek | morganfainberg: i think only if Python was compiled on the machine | 01:51 |
| morganfainberg | which is pure python, and py2/3 compat | 01:51 |
| morganfainberg | but it doesn't have the nice pretty compat stuff built | 01:51 |
| dstanek | pretty sure all major packages will have it included | 01:51 |
| morganfainberg | dstanek, my thought is... we require a python interpreter that can do ssl | 01:52 |
| morganfainberg | dstanek, waaaaaaaay less magic import testing | 01:52 |
| *** browne has quit IRC | 01:52 | |
| ayoung | morganfainberg, muy kneejerk reaction is please don't...I want to get us out of that world. But I know you must have a reason for wanting ldap3. I'd ask richm or rcrit or simo myself | 01:52 |
| ayoung | nkinder is at a conf this week | 01:52 |
| morganfainberg | ayoung, because python-ldap is awful | 01:52 |
| morganfainberg | and we can't get rid of ldap support | 01:53 |
| ayoung | yeah, but is ldap3 going to fix it? | 01:53 |
| morganfainberg | ayoung, well ldap3 does 1 major thing for us | 01:53 |
| morganfainberg | py34 compat | 01:53 |
| morganfainberg | it and python-memcache (to be replaced with pymemcache) are the blockers | 01:53 |
| ayoung | do we know have that possibilituy now? That alone is a deal-maker | 01:53 |
| ayoung | ah...ok...so, to answer your question, I think we are OK | 01:54 |
| ayoung | if a platform can't make an ssl call, it shouldn't be supported | 01:54 |
| morganfainberg | ayoung, it looks like (key: LOOKS) like we need to fix 2 libraries and we can run in py34 | 01:54 |
| morganfainberg | and probably a bunch of "fix our bad py27 assumptions" | 01:54 |
| morganfainberg | but doable in liberty | 01:54 |
| morganfainberg | ayoung, also ldap3 has some nice interfaces that *might* help to make it easier to cleanup our code | 01:55 |
| ayoung | that would be nice | 01:56 |
| morganfainberg | ayoung, since we can't be rid of LDAP in any definitive timeframe (anything beyond 2-3 cycles is too far out to see) | 01:56 |
| *** davechen1 has joined #openstack-keystone | 01:56 | |
| morganfainberg | ayoung, it has an orm-ish like abstraction | 01:56 |
| morganfainberg | so you have less digging into the lists of tuples of list of ick | 01:56 |
| ayoung | so, I would move ahead with the assumption that we can do ssl anywhere we need to. Post to the mailing list to cover us, but if there are any real issues, I think the answer is "tough luck" | 01:57 |
| morganfainberg | ayoung, first will be the POC change so we can get you/nkinder/brant to run through the uses | 01:57 |
| ayoung | ++ | 01:57 |
| morganfainberg | make sure we aren't massively missing things. | 01:57 |
| morganfainberg | thankfully the ldap core code has been mostly static | 01:57 |
| ayoung | yeah | 01:57 |
| morganfainberg | means less rebase hell issues. | 01:58 |
| morganfainberg | also... we can support server pools | 01:58 |
| morganfainberg | as in "server X, Y and Z" nicely with this new lib | 01:58 |
| ayoung | part of me is contrite for having written it, but then I realize I just copied what was tin the pre-KSL wholesale, and I become a whole lot more contrite... | 01:58 |
| morganfainberg | the python-ldap version does bad things. | 01:59 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 01:59 | |
| morganfainberg | when you try that. | 01:59 |
| morganfainberg | while this new lib is not even remotely drop in compat... | 01:59 |
| *** david-lyle has quit IRC | 01:59 | |
| dstanek | so is the plan to have no ldap backends at all? | 01:59 |
| ayoung | we need to deprecate a whole slew of LDAP config options that no one should be using | 01:59 |
| morganfainberg | it looks to be good. | 01:59 |
| ayoung | dstanek, I'd like to replace it with an SSSD and mod_lookup_identity based approach | 01:59 |
| morganfainberg | dstanek, i'd like to push people towards federated identity or SSSD | 01:59 |
| morganfainberg | dstanek, but that is a long long way out | 02:00 |
| ayoung | dstanek, combine that with Kerberos and Federation and it works very nicely | 02:00 |
| morganfainberg | dstanek, and i don't think we can say people wont still want direct ldap support | 02:00 |
| morganfainberg | dstanek, direct ldap support is unlikely to be deprecated in the next 3 cycles at least | 02:00 |
| ayoung | we need to firmly deprecate the assignment backend in Liberty | 02:00 |
| bknudson | anybody got a hint as to what might be going wrong here: https://review.openstack.org/#/c/176576/1/tests/unit/test_service.py | 02:00 |
| morganfainberg | ayoung, uh. | 02:00 |
| morganfainberg | ayoung, ldap assigment is deprecated in kilo | 02:01 |
| ayoung | morganfainberg, I thought we backed off...I am happy to hear we did not | 02:01 |
| morganfainberg | ayoung, i sure as hell haven't backed off | 02:01 |
| bknudson | the app creates a subprocess, which writes to stdout, but there's nothing on out_q, only err_q. | 02:01 |
| dstanek | bknudson: still not working? | 02:01 |
| bknudson | dstanek: I'm trying to write a test for it now. | 02:01 |
| morganfainberg | ayoung, we had 1 person crop up saying "We use this" besides cern and wikimedia | 02:01 |
| bknudson | the test is harder to write than the fix. | 02:01 |
| ayoung | so we need to support it until Mike? | 02:01 |
| morganfainberg | ayoung, not sure when we slated it. probably M | 02:02 |
| dstanek | bknudson: you are trying to use a queue across processes? | 02:02 |
| morganfainberg | @versionutils.deprecated( | 02:02 |
| morganfainberg | versionutils.deprecated.KILO, | 02:02 |
| morganfainberg | remove_in=+2, | 02:02 |
| morganfainberg | what='keystone.assignment.backends.ldap.Assignment') | 02:02 |
| morganfainberg | yeah in M release | 02:02 |
| ayoung | nice | 02:02 |
| bknudson | dstanek: no, the queue is just to enqueue the output of the subprocess. | 02:02 |
| morganfainberg | ayoung, in all seriousness if we had a clear "we really use this" from more than 1 deployer and 2 shops committed to moving to sql | 02:03 |
| ayoung | morganfainberg, so...wanna see what Amazon does with Federation? http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html#cconfiguring-IdP | 02:03 |
| morganfainberg | ayoung, and the 1 deployer was "this is a bug". | 02:03 |
| morganfainberg | ayoung, yeah i need to read up on that | 02:03 |
| ayoung | note where there flow starts. Hint, it is not with "go to amazon and try to log in" | 02:03 |
| dstanek | bknudson: what about iter(f.readline, ...) does that actually call readline()? | 02:03 |
| morganfainberg | ayoung, i was asked if I wanted to represent Keystone and OpenStack at Cloud Identity Summit (or find someone else) | 02:03 |
| bknudson | that does look fishy. | 02:03 |
| dstanek | i wouldn't expect that to work | 02:04 |
| morganfainberg | ayoung, so need to read up on AWS IAM, google identity, MSFT identity etc for the IaaS track | 02:04 |
| bknudson | dstanek: shouldn't it just be for line in f? | 02:04 |
| ayoung | it has at least one person in #ipsilon scratching their head | 02:04 |
| dstanek | bknudson: i would think so | 02:04 |
| morganfainberg | ayoung, if your entire product is predicated on "you're logged into Amazon" | 02:04 |
| morganfainberg | ayoung, ... | 02:04 |
| ayoung | but this is to log in to Amazon | 02:05 |
| morganfainberg | ayoung, we have a similar requirement | 02:05 |
| morganfainberg | ayoung, create an IDP | 02:05 |
| ayoung | yeah, I know | 02:05 |
| morganfainberg | ayoung, it's a chicken-egg issue | 02:05 |
| ayoung | I dojn;t have an answer for it. I'll try to figure out how people do it when using Amazon | 02:05 |
| morganfainberg | ayoung, they use a "local" account to IAM | 02:05 |
| ayoung | I think that the best we can do is host a weblogin in the users project | 02:06 |
| morganfainberg | ayoung, same as we would | 02:06 |
| morganfainberg | ayoung, then they setup the SAML Federation | 02:06 |
| ayoung | nah, that is not what I am talking about | 02:06 |
| ayoung | look at their SAML flow | 02:06 |
| ayoung | in the diagram, step one is browser to IdP | 02:06 |
| ayoung | For us step one is browser to horizon | 02:07 |
| morganfainberg | oh | 02:07 |
| morganfainberg | ayoung, i think they just omitted the "go to SP and redirect to IDP" | 02:07 |
| ayoung | right, if the service provbider does not start the workflow, SAML assertions are bearer tokens | 02:07 |
| ayoung | No, they didn't | 02:07 |
| ayoung | its the same issue we have | 02:07 |
| morganfainberg | The user browses to your organization's portal and selects the option to go to the AWS Management Console. In your organization, the portal functions as a identity provider (IdP) that handles the exchange of trust between your organization and AWS. | 02:08 |
| ayoung | Horizon can't enumerate all of the IdPs | 02:08 |
| bknudson | dstanek: I tried regular f.readline(), and still don't get the stdout... https://review.openstack.org/#/c/176576/2/tests/unit/test_service.py | 02:08 |
| morganfainberg | portal i think is AWS portal | 02:08 |
| morganfainberg | in this case | 02:08 |
| ayoung | morganfainberg, are you looking at the diagram in the link I posted? | 02:08 |
| morganfainberg | yes | 02:08 |
| morganfainberg | i am looking at the text below it | 02:08 |
| ayoung | step one is to a box in "your organization" | 02:09 |
| morganfainberg | step 1 is what i pasted to you | 02:09 |
| morganfainberg | look right below the diagram | 02:09 |
| morganfainberg | someone sucked at making a diagram | 02:09 |
| morganfainberg | this is a "portal" that does that redirect stuff | 02:09 |
| morganfainberg | not your orgs "IDP" like ipsilon | 02:09 |
| morganfainberg | notice they also use a LDAP store | 02:10 |
| ayoung | "portal" is on the diagram inside the users organization, not in Amazon. I think they expect you to host something that kicks off the workflow | 02:10 |
| morganfainberg | this is an AWS "portal" | 02:10 |
| morganfainberg | not "ipsilon" portal | 02:10 |
| morganfainberg | or generic portal | 02:10 |
| ayoung | not according to the rest of the document | 02:10 |
| morganfainberg | ah so it is bearer: | 02:11 |
| morganfainberg | You also configure your organization's portal to route user requests for the AWS Management Console to the AWS SAML endpoint for authentication using SAML assertions. | 02:11 |
| morganfainberg | this is a "put a link on sharepoint" | 02:11 |
| morganfainberg | or similar | 02:11 |
| ayoung | yep, but it has to have the same magic we have "here is a generated poage that posts to the web protal" just posting SAML, not A token | 02:12 |
| *** samueldmq has quit IRC | 02:12 | |
| morganfainberg | oooor it's the AWS portal | 02:12 |
| morganfainberg | that does the initial redirect | 02:12 |
| *** samueldmq has joined #openstack-keystone | 02:12 | |
| *** harlowja is now known as harlowja_away | 02:12 | |
| *** TommyTheKid has joined #openstack-keystone | 02:12 | |
| morganfainberg | i think portal is: http://aws.amazon.com/partners/apn-portal/ | 02:13 |
| morganfainberg | ayoung, i *think* this really is just bad documentation | 02:13 |
| ayoung | TommyTheKid, http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2015-04-23.log | 02:13 |
| TommyTheKid | heh, thanks | 02:13 |
| ayoung | morganfainberg, TommyTheKid here is the one that pointed it out to me... | 02:13 |
| morganfainberg | TommyTheKid, allo | 02:13 |
| bknudson | dstanek: I'm going to try not using pipes... write to a file instead. | 02:13 |
| TommyTheKid | hello | 02:14 |
| TommyTheKid | I used to work with OpenSSO when I worked at Sun and later HPES, but today I am doing Ipsilon ... :) | 02:14 |
| ayoung | morganfainberg, how would that know to kick you over to the right IdP? | 02:14 |
| ayoung | its just form auth | 02:14 |
| ayoung | and nothing on their Knoweldge Base about SAML | 02:15 |
| TommyTheKid | So, that is where the Amazon docs seem to indicate that your "portal" (part of the M$ Federation thing?) should have a link to Amazon and know its supopsed to send a SAMLv2 assertion with the redirect? | 02:15 |
| morganfainberg | ayoung, you configure the portal: You also configure your organization's portal to route user requests for the AWS Management Console to the AWS SAML endpoint for authentication using SAML assertions. | 02:15 |
| morganfainberg | ayoung, i think this is very poor docs | 02:15 |
| *** _cjones_ has joined #openstack-keystone | 02:15 | |
| morganfainberg | and probably written by someone who hasn't been living SAML2 or SSO | 02:16 |
| morganfainberg | just was told "put these things in a doc and make a diagram like X" | 02:16 |
| morganfainberg | smart tech writer, but may not be eating/breathing/sleeping SSO like we have | 02:16 |
| ayoung | Maybe, but I don't parse it that way | 02:16 |
| morganfainberg | ayoung, i'm reading this and the *only* way this makes sense is the APN portal | 02:16 |
| ayoung | there is too much technical content for that big of an error to slip through | 02:16 |
| morganfainberg | and *that* is configured for the IDP | 02:17 |
| ayoung | it needs to be an organziation specific url | 02:17 |
| TommyTheKid | so, how do I bounce a request through IdP to Amazon from my portal? (that I don't have) .. but lets just say I have a link in a wiki ... what would that link point to? | 02:17 |
| morganfainberg | it is. | 02:17 |
| morganfainberg | each partner gets a portal | 02:17 |
| morganfainberg | TommyTheKid, you'd go to the APN portal and select "login with IDP" or whatever it is. | 02:17 |
| TommyTheKid | hmmm | 02:18 |
| morganfainberg | TommyTheKid, then you'd do the SAML/Federation dance for credentials | 02:18 |
| TommyTheKid | right | 02:18 |
| TommyTheKid | APN Portal.. looking... | 02:18 |
| morganfainberg | TommyTheKid, http://aws.amazon.com/partners/apn-portal/ | 02:18 |
| * ayoung takes a perverse pleasure in being able to type his full state name correctly | 02:18 | |
| morganfainberg | TommyTheKid or it's http://aws.amazon.com just the org-specific login page | 02:19 |
| TommyTheKid | but I am not a "P" | 02:19 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 02:19 | |
| morganfainberg | any org with AWS can have their own login page | 02:19 |
| TommyTheKid | something like accountid.signin.aws.amazon.com | 02:19 |
| TommyTheKid | *https:// | 02:19 |
| morganfainberg | we used Google Auth at my last job to access amazon at one point | 02:19 |
| morganfainberg | because we used gapps for stuff | 02:19 |
| morganfainberg | TommyTheKid, yeah but i think it's aws.amazon.com/<account> | 02:20 |
| TommyTheKid | oh, thats actually our IAM login screen | 02:20 |
| morganfainberg | TommyTheKid, Yeh. | 02:20 |
| TommyTheKid | Google auth would work too | 02:20 |
| morganfainberg | TommyTheKid, so the IAM login bounces you to the IDP | 02:20 |
| morganfainberg | like an SP would. | 02:20 |
| morganfainberg | since it is the SP effectively | 02:20 |
| morganfainberg | for the console | 02:20 |
| TommyTheKid | my IAM login prompts for user/pass/MFA | 02:20 |
| morganfainberg | it's a configuration afaik | 02:21 |
| morganfainberg | all i can say is these docs are not good. | 02:21 |
| TommyTheKid | and that might be the key | 02:21 |
| morganfainberg | worse than some of our bitrotting ones | 02:21 |
| morganfainberg | it's mixing "federation" verbiage with aws verbiage and it isn't clear what is what | 02:22 |
| *** browne has joined #openstack-keystone | 02:22 | |
| *** markvoelker has joined #openstack-keystone | 02:22 | |
| TommyTheKid | http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-manualURL.html | 02:24 |
| TommyTheKid | I (think) that is what I am looking for? | 02:25 |
| ayoung | morganfainberg, I've been doing OpenStack for how long now and I 've just now signed up for an Amazon account. Scary | 02:26 |
| TommyTheKid | but I have a meeting now, sorry I can't continue this fun :) | 02:26 |
| ayoung | OK morganfainberg more serious question | 02:26 |
| morganfainberg | ayoung, my guess is you need a org account not the free one fwiw | 02:26 |
| ayoung | is it ok to use a lime to make a hot Toddy? | 02:26 |
| morganfainberg | just a hunch | 02:26 |
| morganfainberg | ayoung, uh | 02:26 |
| morganfainberg | ayoung, sounds like the wrong citrus to me | 02:26 |
| ayoung | touch of a sore throat...but we have a fresh lime we used earlier and I'd hate to waste it | 02:27 |
| morganfainberg | but people do it w/ lime | 02:27 |
| morganfainberg | looks like | 02:27 |
| ayoung | OK...whew | 02:27 |
| morganfainberg | hot toddy + ginger + lime | 02:27 |
| morganfainberg | etc | 02:27 |
| ayoung | oooh, ginger | 02:27 |
| morganfainberg | yeah | 02:27 |
| morganfainberg | sounds good | 02:27 |
| ayoung | hadn't thought of that...going to add that in | 02:27 |
| ayoung | export OS_AUTH_URL=https://us-west-2.console.aws.amazon.com/console/home | 02:28 |
| ayoung | heh | 02:28 |
| morganfainberg | HAH | 02:28 |
| morganfainberg | keystone get-token | 02:28 |
| morganfainberg | or is that token-get | 02:28 |
| * morganfainberg uses that command line *never* | 02:28 | |
| ayoung | the latter...I see you've moved on to useing OSC | 02:28 |
| morganfainberg | yeah | 02:28 |
| ayoung | I think we actually need to add support for it in OSC | 02:28 |
| morganfainberg | well been fighting OSC | 02:29 |
| ayoung | it is a key debugging tool | 02:29 |
| morganfainberg | to get devstack to build with V3 only | 02:29 |
| morganfainberg | i think i'm down to maybe 10 functions to fix | 02:29 |
| morganfainberg | that use osc | 02:29 |
| morganfainberg | but it's almost working | 02:29 |
| morganfainberg | doesn't mean it'll work for tempest | 02:30 |
| ayoung | IAM users sign-in link: | 02:31 |
| ayoung | https://979316197786.signin.aws.amazon.com/console | 02:31 |
| ayoung | | | 02:31 |
| ayoung | I wonder if that is it | 02:31 |
| ayoung | I should read up on this before Vancouver https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html | 02:33 |
| bknudson | subprocess.Popen behavior is non-obvious. | 02:34 |
| ayoung | bknudson, I could have told you that | 02:37 |
| morganfainberg | bknudson, oh haha | 02:40 |
| bknudson | I guess you can't do .stdout.readline() | 02:40 |
| morganfainberg | why can't we have nice things? | 02:40 |
| * morganfainberg wants SSLContext instead of crummy Tls() wrapper object | 02:41 | |
| ayoung | morganfainberg, P2 vs p3 with popen is painful | 02:41 |
| morganfainberg | ayoung, yesh | 02:41 |
| morganfainberg | solution: ditch popen | 02:41 |
| morganfainberg | ayoung, :P | 02:41 |
| morganfainberg | running in apache the benefit of popen yielding is minimized | 02:41 |
| ayoung | morganfainberg, especially when you are trying to popoen, something that returns binary data instead of a string...say cuz you need to compress it before base64 encoding it | 02:41 |
| morganfainberg | so we *could* potentially move to pyasn1 or something similar | 02:42 |
| ayoung | I think pythin cryptography has all we need..or its on the way | 02:42 |
| morganfainberg | and just consume process/stack space vs needing to fork out | 02:42 |
| morganfainberg | ayoung, yeah it does | 02:42 |
| morganfainberg | ayoung, just would be a *bad* choice until eventlet dies | 02:42 |
| morganfainberg | since it would lockup the worker | 02:42 |
| ayoung | I'm ok with that | 02:42 |
| ayoung | :) | 02:42 |
| morganfainberg | ayoung, actually we could just say "if eventlet: popen | 02:43 |
| morganfainberg | for another cycle | 02:43 |
| morganfainberg | then watch that all go away | 02:43 |
| morganfainberg | the eventlet flush is coming. | 02:43 |
| ayoung | so, I think the issue would be PKIZ + eventlet + python3 if I pushed to not to the PEM format...I have not plans to touch any of that | 02:44 |
| ayoung | so..yeah | 02:44 |
| * morganfainberg glares | 02:44 | |
| morganfainberg | the hardest thing to replicate in this new ldap module: paged searches | 02:45 |
| ayoung | cuz they are dumb | 02:47 |
| morganfainberg | how many bloody ldap handlers do we need. | 02:48 |
| ayoung | morganfainberg, two | 02:49 |
| ayoung | users and groups | 02:49 |
| ayoung | or do you mean something else? | 02:50 |
| morganfainberg | ayoung, PooledLDAPHandler, LDAPHandler, PythonLDAPHandler, KeystoneLDAPHandler | 02:50 |
| morganfainberg | this is all in common ldap core | 02:50 |
| * morganfainberg is trying to figure out which ones of these are even used. | 02:50 | |
| morganfainberg | oh gah | 02:51 |
| morganfainberg | there is black magic in here | 02:51 |
| morganfainberg | oh look we instantiate a handler every time | 02:53 |
| morganfainberg | ayoung, i think i'm staring at the abyss | 02:55 |
| morganfainberg | ayoung, i'm going to back away slowly and just duplicate our current mechanisms. but i think i see some reasons ldap is bloody awful performance | 02:56 |
| ayoung | link? | 02:56 |
| morganfainberg | https://github.com/openstack/keystone/blob/master/keystone/common/ldap/core.py#L1252-L1257 | 02:57 |
| morganfainberg | if you chase the _get_connection we instantiate a handler every time | 02:57 |
| morganfainberg | oh we have a static pool dict | 02:58 |
| morganfainberg | on the ldappool handler | 02:58 |
| morganfainberg | but this is so many layers of indirection | 02:58 |
| morganfainberg | it's painful. | 02:58 |
| ayoung | it really is bad code | 02:59 |
| ayoung | morganfainberg, OTOH, I just ran into the fact that Ipsilon requires a version of sssd so recent no one has built it for EPEL yet | 03:00 |
| morganfainberg | oh cool | 03:01 |
| morganfainberg | can specify at the connection level read_only=False, | 03:01 |
| morganfainberg | thats nice. extra safety net if we want | 03:01 |
| ayoung | OK...with that, I am officially giving up and stopping work for the evening | 03:03 |
| *** _cjones_ has quit IRC | 03:04 | |
| morganfainberg | hm | 03:09 |
| * morganfainberg is wondering if we want connections to auto_bind or lazy bind | 03:10 | |
| bknudson | I think you have to import threading early. | 03:12 |
| bknudson | oh, and I guess you have to have a bunch of print statements too. | 03:14 |
| *** stevemar has joined #openstack-keystone | 03:15 | |
| *** ChanServ sets mode: +v stevemar | 03:15 | |
| bknudson | no, must be a timing issue... | 03:15 |
| stevemar | bknudson, *you* are a timing issue | 03:20 |
| *** samueldmq has quit IRC | 03:26 | |
| *** lhcheng_ has joined #openstack-keystone | 03:28 | |
| *** lhcheng has quit IRC | 03:28 | |
| openstackgerrit | Merged openstack/keystone: Sync oslo-incubator Ie51669bd278288b768311ddf56ad31a2f28cc7ab https://review.openstack.org/176391 | 03:49 |
| *** spandhe has quit IRC | 03:53 | |
| *** tqtran has joined #openstack-keystone | 04:03 | |
| *** rm_work is now known as rm_work|away | 04:06 | |
| *** ayoung has quit IRC | 04:06 | |
| *** tqtran has quit IRC | 04:07 | |
| *** richm has quit IRC | 04:38 | |
| *** sdake has quit IRC | 04:41 | |
| *** sdake has joined #openstack-keystone | 04:46 | |
| *** sdake_ has joined #openstack-keystone | 04:49 | |
| *** sdake has quit IRC | 04:50 | |
| *** david-lyle has joined #openstack-keystone | 04:59 | |
| *** sdake has joined #openstack-keystone | 05:05 | |
| *** sdake_ has quit IRC | 05:10 | |
| *** markvoelker_ has joined #openstack-keystone | 05:21 | |
| *** markvoelker has quit IRC | 05:21 | |
| *** rwsu has quit IRC | 05:21 | |
| openstackgerrit | Pengtao Huang proposed openstack/keystone: Please enter the commit message for your changes. Lines starting https://review.openstack.org/176620 | 05:27 |
| openstackgerrit | Pengtao Huang proposed openstack/keystone: dddd https://review.openstack.org/176621 | 05:27 |
| stevemar | pengtao seems to be having some difficulties | 05:29 |
| *** ajayaa has joined #openstack-keystone | 05:31 | |
| *** josecastroleon has joined #openstack-keystone | 05:38 | |
| *** _cjones_ has joined #openstack-keystone | 05:48 | |
| *** _cjones_ has quit IRC | 05:53 | |
| *** kiran-r has joined #openstack-keystone | 05:53 | |
| *** lhcheng_ is now known as lhcheng | 06:06 | |
| *** ChanServ sets mode: +v lhcheng | 06:06 | |
| *** sdake has left #openstack-keystone | 06:11 | |
| *** afazekas_ has joined #openstack-keystone | 06:11 | |
| *** stevemar has quit IRC | 06:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove local conf information from paste-ini https://review.openstack.org/134124 | 06:39 |
| *** erkules_ is now known as erkules | 06:50 | |
| *** erkules has joined #openstack-keystone | 06:50 | |
| *** rushiagr_away is now known as rushiagr | 07:12 | |
| *** davechen has joined #openstack-keystone | 07:14 | |
| *** alex_xu has quit IRC | 07:15 | |
| *** alex_xu_ has joined #openstack-keystone | 07:15 | |
| *** davechen1 has quit IRC | 07:16 | |
| kiran-r | Hello! Why am I seeing this warning while using keystone clients. /usr/lib/python2.7/site-packages/keystoneclient/shell.py:65: DeprecationWarning: The keystone CLI is deprecated in favor of python-openstackclient. For a Python library, continue using python-keystoneclient. | 07:17 |
| kiran-r | 'python-keystoneclient.', DeprecationWarning) | 07:17 |
| lhcheng | kiran-r: it is going to be deprecated in favor of openstackclient | 07:21 |
| marekd | kiran-r: because we now recommend using unified CLI which is pythyon-openstackclient | 07:21 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Misuse `versionutils.deprecated` https://review.openstack.org/176646 | 07:22 |
| marekd | kiran-r: try typing | 07:22 |
| marekd | # openstack | 07:22 |
| marekd | (shell cmd) | 07:22 |
| *** davechen1 has joined #openstack-keystone | 07:22 | |
| davechen1 | kiran-r: why are you thinking it's incorrect? :) | 07:23 |
| *** davechen has quit IRC | 07:24 | |
| davechen1 | kiran-r: It's deprected in favor of OSC, and it's only supported in OSC for Keystone V3 APIs | 07:26 |
| kiran-r | davechen1: Thanks! :) | 07:26 |
| *** browne has quit IRC | 07:27 | |
| davechen1 | kiran-r: This link may help, link: http://docs.openstack.org/developer/keystone/cli_examples.html | 07:29 |
| kiran-r | davechen1: I was not aware of the new python client. | 07:30 |
| lhcheng | actually OSC supports both Keystone V2 and V3 API. :) | 07:30 |
| *** henrynash has quit IRC | 07:32 | |
| kiran-r | lhcheng: cool! | 07:33 |
| *** toddnni has quit IRC | 07:37 | |
| *** _cjones_ has joined #openstack-keystone | 07:37 | |
| *** jistr has joined #openstack-keystone | 07:38 | |
| *** e0ne has joined #openstack-keystone | 07:41 | |
| *** _cjones_ has quit IRC | 07:42 | |
| *** e0ne is now known as e0ne_ | 07:53 | |
| *** lhcheng has quit IRC | 07:56 | |
| *** e0ne_ is now known as e0ne | 08:14 | |
| *** davidckennedy has joined #openstack-keystone | 08:14 | |
| *** fhubik has joined #openstack-keystone | 08:17 | |
| *** e0ne is now known as e0ne_ | 08:25 | |
| *** e0ne_ is now known as e0ne | 08:26 | |
| *** e0ne has quit IRC | 08:32 | |
| *** fhubik is now known as fhubik_afk | 08:50 | |
| *** pnavarro has joined #openstack-keystone | 08:56 | |
| *** fhubik_afk is now known as fhubik | 09:04 | |
| *** e0ne has joined #openstack-keystone | 09:13 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the misuse of `versionutils.deprecated` https://review.openstack.org/176646 | 09:14 |
| *** d0ugal has quit IRC | 09:29 | |
| *** d0ugal has joined #openstack-keystone | 09:29 | |
| *** d0ugal is now known as Guest81472 | 09:29 | |
| *** e0ne is now known as e0ne_ | 09:31 | |
| *** fhubik is now known as fhubik_afk | 09:34 | |
| *** aix has joined #openstack-keystone | 09:35 | |
| *** e0ne_ is now known as e0ne | 09:35 | |
| *** fhubik_afk is now known as fhubik | 09:37 | |
| *** Guest81472 is now known as d0ugal2 | 09:40 | |
| *** d0ugal2 is now known as d0ugal | 09:47 | |
| *** d0ugal has quit IRC | 09:47 | |
| *** d0ugal has joined #openstack-keystone | 09:47 | |
| *** josecastroleon has quit IRC | 09:51 | |
| *** e0ne is now known as e0ne_ | 09:53 | |
| *** davechen1 has quit IRC | 09:59 | |
| *** fhubik has quit IRC | 10:02 | |
| *** fhubik has joined #openstack-keystone | 10:02 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose base check classes as part of public API https://review.openstack.org/176683 | 10:03 |
| *** e0ne_ has quit IRC | 10:03 | |
| *** e0ne has joined #openstack-keystone | 10:09 | |
| *** afazekas_ has quit IRC | 10:14 | |
| *** samueldmq has joined #openstack-keystone | 10:19 | |
| *** fhubik is now known as fhubik_afk | 10:21 | |
| samueldmq | morning | 10:21 |
| *** fhubik_afk is now known as fhubik | 10:25 | |
| *** afazekas has joined #openstack-keystone | 10:32 | |
| *** rushiagr is now known as rushiagr_away | 10:40 | |
| *** fhubik is now known as fhubik_afk | 10:50 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 10:51 |
| *** fhubik_afk is now known as fhubik | 11:11 | |
| *** _cjones_ has joined #openstack-keystone | 11:14 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 11:15 |
| *** _cjones_ has quit IRC | 11:19 | |
| *** aix has quit IRC | 11:22 | |
| *** fhubik is now known as fhubik_afk | 11:22 | |
| *** jaosorior has joined #openstack-keystone | 11:26 | |
| *** david-lyle has quit IRC | 11:29 | |
| *** fhubik_afk is now known as fhubik | 11:34 | |
| *** alex_xu_ has quit IRC | 11:38 | |
| *** alex_xu has joined #openstack-keystone | 11:41 | |
| *** josecastroleon has joined #openstack-keystone | 11:43 | |
| *** bknudson has quit IRC | 11:57 | |
| *** aix has joined #openstack-keystone | 12:00 | |
| *** aix has quit IRC | 12:00 | |
| *** aix has joined #openstack-keystone | 12:00 | |
| *** e0ne is now known as e0ne_ | 12:04 | |
| *** david-lyle has joined #openstack-keystone | 12:05 | |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** tqtran has joined #openstack-keystone | 12:09 | |
| *** tqtran has quit IRC | 12:14 | |
| *** richm has joined #openstack-keystone | 12:16 | |
| *** e0ne_ is now known as e0ne | 12:24 | |
| *** gordc has joined #openstack-keystone | 12:27 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: New attributes for SAML assertion https://review.openstack.org/174462 | 12:27 |
| *** josecastroleon has quit IRC | 12:28 | |
| *** david-lyle has quit IRC | 12:31 | |
| *** fhubik is now known as fhubik_afk | 12:34 | |
| *** fhubik_afk is now known as fhubik | 12:38 | |
| *** ajayaa has quit IRC | 12:39 | |
| *** krykowski has joined #openstack-keystone | 12:49 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Refactor federation plugins. https://review.openstack.org/176727 | 12:50 |
| *** rushil has joined #openstack-keystone | 13:00 | |
| *** bknudson has joined #openstack-keystone | 13:00 | |
| *** ChanServ sets mode: +v bknudson | 13:00 | |
| *** edmondsw has joined #openstack-keystone | 13:02 | |
| *** _cjones_ has joined #openstack-keystone | 13:03 | |
| *** davechen has joined #openstack-keystone | 13:05 | |
| *** _cjones_ has quit IRC | 13:09 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Refactor federation plugins. https://review.openstack.org/176727 | 13:10 |
| *** josecastroleon has joined #openstack-keystone | 13:13 | |
| *** ayoung has joined #openstack-keystone | 13:14 | |
| *** ChanServ sets mode: +v ayoung | 13:14 | |
| *** davechen1 has joined #openstack-keystone | 13:16 | |
| *** mattfarina has joined #openstack-keystone | 13:16 | |
| *** davechen has quit IRC | 13:19 | |
| *** joesavak has joined #openstack-keystone | 13:23 | |
| *** e0ne has quit IRC | 13:25 | |
| *** amakarov_away is now known as amakarov | 13:26 | |
| *** davechen1 has left #openstack-keystone | 13:26 | |
| *** e0ne has joined #openstack-keystone | 13:27 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose base check classes as part of public API https://review.openstack.org/176683 | 13:28 |
| *** fhubik has quit IRC | 13:29 | |
| *** kiran-r has quit IRC | 13:32 | |
| *** pnavarro has quit IRC | 13:33 | |
| *** ihrachyshka has joined #openstack-keystone | 13:36 | |
| *** kiran-r has joined #openstack-keystone | 13:36 | |
| ihrachyshka | hey all. can anyone clear up my confusion (and it seems, other teams too) on which term is blessed one - project or tenant? | 13:37 |
| breton | ihrachyshka: project | 13:44 |
| ihrachyshka | breton, ok. I am considering adding a new attribute to oslo.context, and it already has .tenant, so I choose between project_name and tenant_name: https://review.openstack.org/176333 | 13:46 |
| ihrachyshka | breton, should we plan for .tenant deprecation? | 13:46 |
| breton | ihrachyshka: i'm not really sure, I was not around yet when the decision was done :) Maybe US folks will answer you in a couple of hours | 13:47 |
| breton | *decision was made | 13:48 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 13:56 |
| *** rdo has quit IRC | 13:58 | |
| *** BAKfr has quit IRC | 13:59 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 13:59 |
| *** rdo has joined #openstack-keystone | 14:00 | |
| *** BAKfr has joined #openstack-keystone | 14:01 | |
| *** ajayaa has joined #openstack-keystone | 14:08 | |
| *** browne has joined #openstack-keystone | 14:18 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient: Standardize federated auth token scoping https://review.openstack.org/176759 | 14:22 |
| *** rwsu has joined #openstack-keystone | 14:24 | |
| *** rdo has quit IRC | 14:29 | |
| *** stevemar has joined #openstack-keystone | 14:32 | |
| *** ChanServ sets mode: +v stevemar | 14:32 | |
| *** jistr is now known as jistr|mtg | 14:35 | |
| *** rdo has joined #openstack-keystone | 14:42 | |
| *** pnavarro has joined #openstack-keystone | 14:42 | |
| *** davidckennedy has quit IRC | 14:43 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Enable test_auth_token_middleware() on Python 2 https://review.openstack.org/176778 | 14:44 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 14:48 |
| marekd | stevemar: Hi Boss. Any idea how to solve my issue from the comment here: https://review.openstack.org/#/c/176746/3/keystoneclient_federation/v3/saml2.py ? | 14:50 |
| *** josecastroleon has quit IRC | 14:57 | |
| dstanek | marekd: about the deprecation? | 14:58 |
| marekd | dstanek: that's what i am basically asking about :-) Just a comment somewhere around is enough or some more actions need to be done ? | 14:59 |
| *** ajayaa has quit IRC | 14:59 | |
| dstanek | marekd: if you want to eventually remove that default value and force one to be specified you'll have to issue a deprecation warning | 14:59 |
| dstanek | i would think you would go to where the DEFAULT_PROTOCOL is used and if it's the default then issue a warning | 15:00 |
| marekd | dstanek: uh, that might be hard as i would imagine many people would like to use value which is now equal in DEFAULT_PROTOCOL | 15:01 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 15:02 |
| dstanek | marekd: you could change the value to be nonsense, issue the warning and then use the real default | 15:02 |
| marekd | dstanek: hacky, but may work in fact. Ok, let me go that way. | 15:02 |
| *** gordc has quit IRC | 15:03 | |
| *** gordc has joined #openstack-keystone | 15:03 | |
| dstanek | hacky is my middle name! | 15:03 |
| *** ihrachyshka has quit IRC | 15:03 | |
| marekd | let's see how others like this workaround. anyway, how do i add deprecation warning? :( I think i've never done in the past. | 15:04 |
| *** zzzeek has joined #openstack-keystone | 15:05 | |
| *** csoukup has joined #openstack-keystone | 15:09 | |
| *** ajayaa has joined #openstack-keystone | 15:12 | |
| *** henrynash has joined #openstack-keystone | 15:13 | |
| *** ChanServ sets mode: +v henrynash | 15:13 | |
| stevemar | marekd, use @versionutils.deprecated ? | 15:14 |
| marekd | stevemar: allright | 15:14 |
| marekd | stevemar: i think ksc is more manual in that way | 15:16 |
| marekd | just a comment is the way to do that... | 15:16 |
| stevemar | marekd, no LOG.warning? | 15:17 |
| dstanek | marekd: do we actually remove code without a warning and only a comment? | 15:17 |
| marekd | stevemar: LOG.warning() but not via versionutils.deprecated | 15:17 |
| marekd | dstanek: ^^ | 15:17 |
| dstanek | ah | 15:18 |
| dstanek | that's all versionutils.deprecated does - just give you a standard language for the message | 15:18 |
| stevemar | yep | 15:19 |
| stevemar | dstanek, i think it uses the class / method name | 15:19 |
| stevemar | and other goodness | 15:19 |
| stevemar | you added stuff to that i think... so why am i explaining it to you | 15:19 |
| * dstanek wrote it! :-P | 15:20 | |
| *** bdossant has joined #openstack-keystone | 15:20 | |
| marekd | hah | 15:20 |
| *** vhoward- has quit IRC | 15:24 | |
| *** vhoward has joined #openstack-keystone | 15:24 | |
| *** david-lyle has joined #openstack-keystone | 15:29 | |
| *** rm_work|away is now known as rm_work | 15:29 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Refactor SAML2 auth plugins https://review.openstack.org/176746 | 15:29 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/176833 | 15:30 |
| stevemar | :) | 15:30 |
| stevemar | dstanek, didn't know you wrote it, i thought you added stuff... but good to know | 15:30 |
| stevemar | dstanek, speaking of... https://review.openstack.org/#/c/176646/2/keystone/token/providers/common.py | 15:36 |
| ayoung | stevemar, morganfainberg, https://review.openstack.org/#/c/138519/ (Access info) passed check, but doesn't have the +1 from CI on it. but it is ready for review, with a lot waiting on it | 15:37 |
| morganfainberg | . | 15:40 |
| morganfainberg | ayoung, cool. | 15:41 |
| morganfainberg | ayoung, thanks. | 15:41 |
| dstanek | stevemar: looking | 15:45 |
| *** _cjones_ has joined #openstack-keystone | 15:53 | |
| dstanek | marekd: i just dug up https://review.openstack.org/#/c/130013/2/keystone/catalog/backends/sql.py for another review - i just deprecated in a unique way there | 15:53 |
| *** gabrielbezerra is now known as gabriel-bezerra | 15:55 | |
| marekd | dstanek: what i ended up doing something like that: https://review.openstack.org/#/c/176746/5/keystoneclient_federation/v3/saml2.py lines ~80 | 15:56 |
| *** david-lyle has quit IRC | 15:56 | |
| dstanek | marekd: deprecated as of when? when will it go away? | 15:56 |
| marekd | dstanek: yeah, so this where i need some help from more experienced colleagues. | 15:57 |
| marekd | dstanek: usually there are 2 cycles in keystone | 15:57 |
| *** _cjones_ has quit IRC | 15:57 | |
| marekd | dstanek: in ksc case that would be what...two releases too ? | 15:57 |
| morganfainberg | ksc is harder to deprecate things | 15:58 |
| morganfainberg | because the general contract is "it works with any version of keystone" | 15:58 |
| marekd | morganfainberg: it will in my case. | 15:58 |
| marekd | morganfainberg: what i want to do is to make users specify one parameter and not rely on something default | 15:58 |
| dstanek | morganfainberg: he's really deprecating something that effects plugin devs and should work regardless of keystone version | 15:59 |
| marekd | dstanek: ++ | 15:59 |
| morganfainberg | dstanek, hm | 15:59 |
| morganfainberg | i'll need to look at it. | 15:59 |
| marekd | https://review.openstack.org/#/c/176746/5/keystoneclient_federation/v3/saml2.py | 15:59 |
| marekd | morganfainberg: ^^ | 15:59 |
| *** bdossant has quit IRC | 16:00 | |
| *** _cjones_ has joined #openstack-keystone | 16:01 | |
| *** gyee has joined #openstack-keystone | 16:03 | |
| *** ChanServ sets mode: +v gyee | 16:03 | |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| *** joesavak has quit IRC | 16:06 | |
| *** pnavarro has quit IRC | 16:10 | |
| *** rm_work is now known as rm_work|away | 16:11 | |
| openstackgerrit | Baldemar Silva proposed openstack/pycadf: Add test to cover mask value for utils.mask_value https://review.openstack.org/176479 | 16:12 |
| *** arunkant_ has joined #openstack-keystone | 16:16 | |
| *** aix has quit IRC | 16:17 | |
| *** jistr|mtg is now known as jistr | 16:18 | |
| *** lhcheng has joined #openstack-keystone | 16:19 | |
| *** ChanServ sets mode: +v lhcheng | 16:19 | |
| *** lhcheng_ has joined #openstack-keystone | 16:21 | |
| *** pnavarro has joined #openstack-keystone | 16:23 | |
| *** lhcheng has quit IRC | 16:23 | |
| *** kiran-r has quit IRC | 16:28 | |
| openstackgerrit | Fernando Diaz proposed openstack/pycadf: Added a testcase to cover ValueError in tag.py https://review.openstack.org/176901 | 16:29 |
| *** _cjones_ has quit IRC | 16:29 | |
| *** _cjones_ has joined #openstack-keystone | 16:31 | |
| morganfainberg | marekd, oh | 16:34 |
| morganfainberg | marekd, this is fine we never did a release of this project | 16:34 |
| morganfainberg | marekd, saml2/federation plugin can be mucked with at anypoint right now | 16:35 |
| morganfainberg | since it's in it's own repo | 16:35 |
| *** e0ne has quit IRC | 16:36 | |
| *** jsavak has quit IRC | 16:36 | |
| *** jaosorior has quit IRC | 16:42 | |
| *** spandhe has joined #openstack-keystone | 16:42 | |
| *** jistr has quit IRC | 16:43 | |
| *** dramakri has joined #openstack-keystone | 16:46 | |
| *** alexsyip has joined #openstack-keystone | 16:47 | |
| *** dramakri has left #openstack-keystone | 16:47 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:49 | |
| samueldmq | morganfainberg, ping - given that to have v3 auth on all services will require changes in clients, etc, I have a different plan to get there | 16:49 |
| samueldmq | morganfainberg, starting by simply testing the services REST APIs directly (curl) | 16:50 |
| morganfainberg | samueldmq, most clients use session | 16:50 |
| morganfainberg | this should be a non issue really | 16:50 |
| morganfainberg | just need the right endpoints passed. | 16:50 |
| samueldmq | morganfainberg, see http://paste.openstack.org/show/205246/ | 16:50 |
| samueldmq | morganfainberg, hmm, nice ... will ease things | 16:50 |
| morganfainberg | yeah all clients should support v3 already | 16:50 |
| morganfainberg | for auth | 16:50 |
| samueldmq | morganfainberg, nice, and we're talking about v3 auth for L right ? | 16:51 |
| morganfainberg | yes. | 16:51 |
| samueldmq | morganfainberg, or do you want further ? | 16:51 |
| samueldmq | ah k | 16:51 |
| morganfainberg | we should be able to run openstack w/ keystone v2 disabled in liberty | 16:51 |
| samueldmq | morganfainberg, I was thinking if we could actually do this | 16:51 |
| morganfainberg | almost everything should work with just v3 already | 16:52 |
| samueldmq | morganfainberg, if we disable v2 completely, we'll be disabling auth + the other APIs | 16:52 |
| samueldmq | morganfainberg, if someone did /tenants/xpto will need to do /projects/xpto , and I dunno if services are all prepared to fully support all the keystoen v3 api | 16:53 |
| samueldmq | morganfainberg, besides auth | 16:53 |
| morganfainberg | samueldmq, correct | 16:53 |
| morganfainberg | samueldmq, everything should work with v3 | 16:53 |
| morganfainberg | most clients/services [except heat] | 16:53 |
| morganfainberg | don't care about talking to keystojne | 16:53 |
| morganfainberg | keystone* | 16:53 |
| morganfainberg | they only care what is in the token | 16:53 |
| samueldmq | morganfainberg, that's what I was suspecting, they just need a project id, and store resources binded to it | 16:54 |
| samueldmq | morganfainberg, ++ | 16:54 |
| samueldmq | morganfainberg, did you see http://paste.openstack.org/show/205246/ ? | 16:55 |
| samueldmq | morganfainberg, I think this bottom-up approach works well (starting at the rest apis and make sure incompatibilities instead of starting at the tempest/osclient) | 16:56 |
| samueldmq | morganfainberg, let me know if you disagree/have any suggestion | 16:56 |
| morganfainberg | i think heat will break | 16:57 |
| morganfainberg | fwiw | 16:57 |
| morganfainberg | but yes. that works | 16:58 |
| samueldmq | morganfainberg, nice ! I am just bugging you more to make sure we will always be on right path | 16:58 |
| morganfainberg | me personally, i'm only focused on the "make devstack spin evertyhign up using v3 apis only" | 16:58 |
| morganfainberg | :) | 16:58 |
| samueldmq | morganfainberg, yeah, I know, that's the final goal anyway | 16:58 |
| samueldmq | morganfainberg, just having a plan to get there incrementally | 16:59 |
| samueldmq | morganfainberg, and have a way to delegate work :) | 16:59 |
| morganfainberg | oh no no. i'm a step below that | 16:59 |
| morganfainberg | this is make it so if you tell devstack to use v3, it actually uses v3 to do the install | 17:00 |
| morganfainberg | not some v2 some v3 and some other stuff randomly | 17:00 |
| morganfainberg | not even to the point of "fix things to work with the v3 things" | 17:00 |
| morganfainberg | your stuff is all spot on | 17:00 |
| *** rushil has quit IRC | 17:02 | |
| samueldmq | morganfainberg, so 2 things: i) devstack deploy a full v3 auth working cloud so gate jobs can rely on it | 17:02 |
| samueldmq | morganfainberg, ii) devstack uses v3 auth (I think it uses osclient) to setup everything | 17:02 |
| morganfainberg | yeah | 17:03 |
| samueldmq | morganfainberg, and we want both, am I right ? | 17:03 |
| morganfainberg | yes. and we also want devstack to use v3 crud for bootstrapping the data in | 17:03 |
| morganfainberg | not some v2 some v3 | 17:03 |
| morganfainberg | that last bit is what i'm working on. so when you type ./stack.sh it doesn't rely on keystone v2 | 17:04 |
| samueldmq | morganfainberg, ++ sure | 17:04 |
| morganfainberg | or some weird mix of v2/v3 | 17:04 |
| samueldmq | morganfainberg, in my plan, after having testes/get all clients working on v3, we go to osclient | 17:04 |
| *** rushil has joined #openstack-keystone | 17:04 | |
| samueldmq | morganfainberg, and after that, we'll have a fully v3 devstack cloud, and we can get i) and ii) | 17:04 |
| morganfainberg | osclient is just a cli btw | 17:05 |
| samueldmq | morganfainberg, since devstack will just need to configure/use the v3 auth on clients | 17:05 |
| morganfainberg | and devstack uses osc for stuff | 17:05 |
| samueldmq | morganfainberg, for everything ? not mixing other clients ? | 17:05 |
| morganfainberg | afaik it uses osc for it's work | 17:05 |
| morganfainberg | remember osc uses all the other client libs | 17:06 |
| *** gyee has quit IRC | 17:07 | |
| samueldmq | morganfainberg, yeah, that's why I am making sure all the clients work with v3 auth first | 17:07 |
| *** rushiagr_away is now known as rushiagr | 17:07 | |
| morganfainberg | they should | 17:07 |
| samueldmq | I am not saying they wouldn't as we have today, but we need to make sure | 17:07 |
| *** krykowski has quit IRC | 17:07 | |
| samueldmq | :) | 17:07 |
| morganfainberg | jamielennox|away has done a ton of work for them to | 17:07 |
| morganfainberg | if they use session it should work. | 17:07 |
| samueldmq | yeah, I was thinking we will need him when looking at the clients | 17:08 |
| samueldmq | morganfainberg, I will bug him to talk a bit more about it later, thx | 17:08 |
| morganfainberg | my guess is everything will actually work with v3 | 17:08 |
| samueldmq | morganfainberg, I hope too, and it makes sense to work | 17:09 |
| samueldmq | morganfainberg, since middleware supports v3 and clietns use sessions | 17:09 |
| samueldmq | morganfainberg, sorry I need to go afk for a bit | 17:10 |
| morganfainberg | no worried | 17:10 |
| morganfainberg | worries* | 17:10 |
| samueldmq | o/ | 17:10 |
| *** tqtran has joined #openstack-keystone | 17:11 | |
| samleon | ayoung, hey | 17:13 |
| ayoung | samleon ! | 17:13 |
| *** harlowja_away is now known as harlowja | 17:13 | |
| ayoung | samleon, get your patch to pass check! | 17:13 |
| ayoung | I! am! speak! ing! with! BANGS! | 17:13 |
| samleon | ayoung, that's great!, sure, let me do that and appreciate for another review! | 17:14 |
| *** openstackgerrit_ has joined #openstack-keystone | 17:14 | |
| *** openstackgerrit_ has quit IRC | 17:14 | |
| *** tqtran has quit IRC | 17:17 | |
| *** tqtran has joined #openstack-keystone | 17:18 | |
| *** browne has quit IRC | 17:20 | |
| *** kiran-r has joined #openstack-keystone | 17:34 | |
| *** jaosorior has joined #openstack-keystone | 17:36 | |
| dolphm | ayoung: o/ you left me hanging yesterday with an ellipsis on ldap identity vs heat in juno, do you remember your line of thinking? | 17:37 |
| *** rm_work|away is now known as rm_work | 17:37 | |
| ayoung | dolphm, I was trying to mine the email trail | 17:39 |
| ayoung | the issue is with how usable multiple domains are, and for Juno...we couldn't have service users in non-default domains, right? | 17:40 |
| ayoung | which meant that non-service users (LDAP users) had to be in non-default domains...which Horizon can support | 17:40 |
| dolphm | ayoung: right | 17:40 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Materialized path for project hierarchy https://review.openstack.org/173424 | 17:41 |
| ayoung | and Keystone can support...not sure about the other services in the Juno time frame | 17:41 |
| ayoung | dolphm, but...assuming that you can put service users in LDAP, you could make the LDAP domain the default domain, and still have a SQL Identity backend | 17:41 |
| ayoung | then heat could put temporary users in a non-default domain | 17:41 |
| dolphm | ayoung: but not in juno, right? | 17:41 |
| dolphm | ayoung: actually, that does make sense to me, if it works in juno | 17:43 |
| *** cloudnull has joined #openstack-keystone | 17:44 | |
| *** claco has joined #openstack-keystone | 17:44 | |
| *** alextrcitiy has joined #openstack-keystone | 17:44 | |
| *** miguelgrinberg has joined #openstack-keystone | 17:45 | |
| ayoung | dolphm, that should work in Juno...let's assume your installer is smart enough to set up LDAP with service users in an LDAP backend, you could then reconfig Keystone to make SQL the backend, but domain specific config for the LDAP backed domain be the default | 17:45 |
| dolphm | ayoung: interesting; i hadn't thought about domain-specific config being used for the default domain at all... | 17:46 |
| amakarov | henrynash, greetings! I've described the concept of moving sub-trees and eager to present it :) https://review.openstack.org/#/c/173424 | 17:46 |
| ayoung | dolphm, the one part I have not tested is making a domain specific config the default domain ex-post-facto, but I think henrynash tried it | 17:46 |
| dolphm | miguelgrinberg: did you just join, or do you have backlog? | 17:48 |
| miguelgrinberg | I don't have the backlog unfortunately | 17:48 |
| dolphm | miguelgrinberg: copy pasta of the last few minutes w/ ayoung http://cdn.pasteraw.com/s7rharjaxlhco3x4dq3a93ug3d500e8 | 17:48 |
| dolphm | miguelgrinberg: what i'm not familiar with at all is how heat ended up managing temporary users with v3. is heat creating temporary domains? or it just needs one domain to create temporary users in? | 17:50 |
| *** BjoernT has joined #openstack-keystone | 17:50 | |
| miguelgrinberg | dolphm: there is one domain, heat puts all its temp users in it | 17:50 |
| dolphm | BjoernT: o/ | 17:50 |
| dolphm | BjoernT: backlog http://cdn.pasteraw.com/s7rharjaxlhco3x4dq3a93ug3d500e8 | 17:50 |
| BjoernT | hey | 17:50 |
| dolphm | miguelgrinberg: and its expected to be a non-default domain, correct? | 17:51 |
| BjoernT | it's right, we have no users outside off the default domain | 17:51 |
| miguelgrinberg | yes, it is expected. Not sure what happens if you set the config entry for that domain to "default" though | 17:51 |
| BjoernT | but there is also a customer requirement to enable multi domain support in horizion which would mean we have users separated by domains | 17:52 |
| dolphm | miguelgrinberg: so you configure heat with a domain ID to use, or something? | 17:52 |
| miguelgrinberg | yes, a domain name | 17:52 |
| BjoernT | but I doubt this is working with ldap anyway | 17:52 |
| miguelgrinberg | using anything other than keystone will require changes in heat | 17:52 |
| BjoernT | we were configuring heat to use the domain id, not the name | 17:53 |
| dolphm | miguelgrinberg: so as long as heat has free reign to manage users & projects in a single, arbitrary domain, it shouldn't have any issues | 17:53 |
| dolphm | the best way to guarantee that is with a non-default SQL-backed domain | 17:53 |
| dolphm | BjoernT: good to know that it supports both | 17:53 |
| *** e0ne has joined #openstack-keystone | 17:53 | |
| miguelgrinberg | for the creation of these temp users it should be fine, but there are other problems. You can't use auth plugins right now | 17:53 |
| dolphm | BjoernT: and using the domain ID would be slightly more efficient | 17:53 |
| dolphm | and more reliable! | 17:54 |
| BjoernT | yepp, no additional lookup | 17:54 |
| dolphm | miguelgrinberg: the temp users can't use auth plugins? or? | 17:54 |
| miguelgrinberg | dolphm: heat can't | 17:54 |
| *** saltsa has left #openstack-keystone | 17:54 | |
| miguelgrinberg | let me find the launchpad bug | 17:54 |
| dolphm | i'd be curious what that's blocking | 17:55 |
| miguelgrinberg | dolphm: https://bugs.launchpad.net/heat/+bug/1446918 | 17:56 |
| openstack | Launchpad bug 1446918 in heat "Heat uses keystone_authtoken for trustee user -can't do v3 auth" [Undecided,New] | 17:56 |
| miguelgrinberg | heat goes in the [keystone_authtoken] section and uses settings from there, it does not entirely rely on keystone to manage that | 17:56 |
| dolphm | ah, so instead of owning it's own config, it's just hijacking ours | 17:57 |
| miguelgrinberg | right | 17:57 |
| *** amakarov is now known as amakarov_away | 17:59 | |
| dolphm | ... if we left config in paste pipelines, i don't think that would be possible ... | 17:59 |
| bknudson | heat should stop doing that | 18:00 |
| bknudson | not a public interface | 18:00 |
| *** e0ne is now known as e0ne_ | 18:01 | |
| dolphm | agree | 18:01 |
| miguelgrinberg | I think we all agree, there's consensus on the heat side as well | 18:01 |
| bknudson | we have all sorts of client configs in other server config files, so do something like what they do... | 18:02 |
| bknudson | e.g., nova for neutron, etc., and neutron for nova notifications | 18:02 |
| dolphm | miguelgrinberg: cool. but i'm lost on how / if that poses an issue vs ldap identity? | 18:02 |
| bknudson | seems like heat is going to require that keystone has a r/w domain. | 18:02 |
| miguelgrinberg | dolphm: so maybe this is my own lack of knowledge. I assumed you would use an auth plugin, which will require different set of args in [keystone_authtoken] | 18:03 |
| bknudson | luckily keystone supports domain-specific backends. | 18:03 |
| bknudson | heat should have a separate section for its own comm with keystone. | 18:03 |
| BjoernT | wasn't that domain-specific backend support only in kilo? | 18:04 |
| *** browne has joined #openstack-keystone | 18:04 | |
| bknudson | it should also be a different role that heat uses and we configure the policy to allow only whatever operations heat needs. | 18:04 |
| *** kiran-r has quit IRC | 18:04 | |
| bknudson | don't make the mistake that nova and neutron made and require your user to have admin. | 18:05 |
| BjoernT | yes, currently we do use admin for heat... | 18:05 |
| bknudson | BjoernT: domain-specific backends are in juno, also. | 18:05 |
| dolphm | miguelgrinberg: that's correct | 18:06 |
| bknudson | the new feature in kilo is that you can create domain-specific backends using the REST API. | 18:06 |
| *** e0ne_ has quit IRC | 18:06 | |
| BjoernT | so all that means we can use a sqldb backend for heat only, already in Juno ? | 18:07 |
| dolphm | bknudson: but is the domain-specific backend support in juno sufficiently mature to have LDAP as the default domain, while backing all other domains to SQL? | 18:07 |
| *** david-lyle has joined #openstack-keystone | 18:07 | |
| ayoung | dolphm, Heat using temporary users in their own domain is yet another thing that I am somewhat responsible for suggesting. | 18:07 |
| bknudson | well, you really need SQL as the default domain | 18:07 |
| dolphm | ayoung: i don't have an opinion on that behavior :P | 18:07 |
| *** david-lyle_ has joined #openstack-keystone | 18:07 | |
| dolphm | bknudson: why? | 18:08 |
| BjoernT | Debugging that issue, let me with the impression that the missing domain id from the heat user causes this issue | 18:08 |
| ayoung | dolphm, it was the only way I could see to solve their problem | 18:08 |
| bknudson | since in juno and kilo the services don't really support v3 auth | 18:08 |
| BjoernT | it was reporting heat inside the default domain | 18:08 |
| bknudson | so the service users need to be in the default domain | 18:08 |
| dolphm | BjoernT: the ldap driver *should* be returning a domain ID with all it's users -- it's just not getting that attribute from LDAP | 18:08 |
| BjoernT | so mixing it with LDAP as the default domain might not work unless we get the domain id correctly reported for the hear user | 18:08 |
| dolphm | bknudson: right, that makes sense | 18:09 |
| bknudson | if we had v3 everywhere then you could use any domain. | 18:09 |
| ayoung | With V2, you will not get a domain, with V3, you will, even for something in the default domain | 18:09 |
| BjoernT | dolphm : Right, that's why heat was reported as default domain as well so how should it work for heat, if ldap does not support it and keystone won't lookup the heat specific configuration because all users are inside the default domain? | 18:10 |
| ayoung | there may be a bug, but I know the code that does domain specific backends adds it in. LDAP ID backned also reads the values out of the config file to fill in domain data | 18:10 |
| bknudson | your default domain is typically SQL, since you typically can't put service users in LDAP | 18:10 |
| ayoung | is the problem in token or list users? | 18:10 |
| BjoernT | In our case we added the service users to ldap, just FYI | 18:11 |
| dolphm | BjoernT: oh awesome, that solves a constraint here | 18:12 |
| bknudson | you have more permissive ldap admins than most. | 18:12 |
| morganfainberg | i *think* heat is the last of the services doing something really wonky w/ auth that prevents v3 use | 18:12 |
| morganfainberg | i *think* | 18:12 |
| BjoernT | dolphm: we manually created them inside the AD | 18:12 |
| richm | I think Jamie Lennox was looking at heat and how it uses v3 auth | 18:13 |
| *** e0ne has joined #openstack-keystone | 18:13 | |
| dolphm | BjoernT: so then it sound you need to set [identity] domain_specific_drivers_enabled = True in keystone.conf and move the ldap configuration into /etc/keystone/domains/keystone.Default.conf | 18:14 |
| bknudson | morganfainberg: are keystonclient stable/kilo releases open now? https://review.openstack.org/#/q/project:openstack/python-keystoneclient+branch:stable/kilo,n,z | 18:14 |
| dolphm | BjoernT: then create an arbitrary domain in keystone for use by heat, and then configure heat to use that domain you just created, which will be backed by sql | 18:14 |
| bknudson | I heard that other clients were being released. | 18:14 |
| morganfainberg | bknudson, need to check w/ ttx on it but probably | 18:15 |
| morganfainberg | bknudson, there was a blocker | 18:15 |
| *** gyee has joined #openstack-keystone | 18:15 | |
| *** ChanServ sets mode: +v gyee | 18:15 | |
| dolphm | ayoung: bknudson: does that sound right? ^ (keystone will default to the sql backend for domains without a domain-specific conf) | 18:15 |
| ayoung | 1 sec | 18:15 |
| morganfainberg | dolphm, correct | 18:15 |
| dolphm | richm: he definitely was, but i figure he's asleep at the moment :) | 18:15 |
| morganfainberg | dolphm, if you don't override a specific domain, it goes into the SQL backend | 18:15 |
| morganfainberg | dolphm, provided the driver is SQL not LDAP | 18:16 |
| richm | yeah, Jamie should be online in a few hours | 18:16 |
| bknudson | dolphm: if you create a domain it's going to be whatever's in your keystone.conf. Which I think should be SQL. | 18:16 |
| morganfainberg | if you have LDAP as the base driver... well don't ever expect domains | 18:16 |
| bknudson | I also think if you're not using SQL as the driver in keystone.conf you won't be able to create domains? | 18:16 |
| bknudson | since LDAP only has one domain. | 18:16 |
| morganfainberg | bknudson, well domains are a resource/assigment thing | 18:17 |
| morganfainberg | and you can still create per-domain backends | 18:17 |
| morganfainberg | but you can only ever have 1 SQL backed domain. so best bet is make the driver SQL and override specific domains for LDAP | 18:17 |
| bknudson | y, I agree with that. | 18:17 |
| morganfainberg | with a per-domain identity store config | 18:17 |
| morganfainberg | and the default domain should be 100% workable with LDAP as a per-domain backend... *if* all the relevant users are loaded into that LDAP store for things that only do v2 | 18:18 |
| bknudson | if we get tokenless auth you won't need service users. | 18:19 |
| dolphm | ++ | 18:19 |
| morganfainberg | bknudson, and we should get tokenless in Liberty :) | 18:19 |
| bknudson | maybe heat could take advantage of that. | 18:19 |
| bknudson | heat should be its own idp | 18:19 |
| bknudson | plug in that way | 18:20 |
| morganfainberg | bknudson, heat would need to work w/ normal tokens too. but tokenless would be way better. | 18:20 |
| miguelgrinberg | guys where can I find info on the tokenless auth? Sounds interesting, but know nothing about it | 18:20 |
| gyee | ++tokenless :) | 18:21 |
| gyee | there's a spec | 18:21 |
| miguelgrinberg | so it's work in progress | 18:21 |
| gyee | miguelgrinberg, https://review.openstack.org/#/c/156870/ | 18:22 |
| miguelgrinberg | gyee: thanks | 18:23 |
| gyee | is miguelgrinberg a reflection of morganfainberg? | 18:23 |
| gyee | just curious | 18:23 |
| miguelgrinberg | :) | 18:23 |
| bknudson | he he | 18:23 |
| miguelgrinberg | you know I always have to read his nick twice to make sure it's not me | 18:23 |
| *** morganfainberg is now known as grebniafnagrom | 18:24 | |
| grebniafnagrom | better? | 18:24 |
| gyee | hah | 18:24 |
| *** grebniafnagrom is now known as morganfainberg | 18:24 | |
| gyee | word scrambling | 18:24 |
| claco | ɯıƃnǝlƃɹıuqǝɹƃ | 18:24 |
| dstanek | how quickly we get off topic in here :-) | 18:25 |
| morganfainberg | claco, toobad can't use multi-byte chars for nics | 18:25 |
| *** csoukup has quit IRC | 18:25 | |
| gyee | miguelgrinberg, https://github.com/openstack/keystone-specs/blob/master/specs/backlog/keystone-tokenless-authz-with-x509-ssl-client-cert.rst | 18:25 |
| morganfainberg | gyee, someone needs to move that to liberty | 18:25 |
| gyee | I think we need to move it to Liberty once the patch gets in | 18:25 |
| morganfainberg | no before the patch goes in | 18:25 |
| gyee | k | 18:26 |
| gyee | let me do | 18:26 |
| *** e0ne is now known as e0ne_ | 18:28 | |
| gyee | though tokenless auth does not support ephemeral users right now, but we can make it configurable | 18:28 |
| *** jlk has left #openstack-keystone | 18:28 | |
| *** ashishjain has joined #openstack-keystone | 18:28 | |
| gyee | should be trivial | 18:28 |
| ashishjain | Hello. | 18:28 |
| ashishjain | I am stuck for quite sometime in a problem, need just one simple clue | 18:29 |
| *** e0ne_ is now known as e0ne | 18:29 | |
| ashishjain | Is it possible to get the tokens for all the users using admin token | 18:29 |
| *** gyee has quit IRC | 18:30 | |
| *** david-lyle_ has quit IRC | 18:30 | |
| *** esp has left #openstack-keystone | 18:30 | |
| bknudson | there wasn't a backport to stable/kilo keystonemiddleware for this CVE, so I posted one: https://review.openstack.org/#/q/Id674f40532215788675c97a8fdfa91d4420347b3,n,z | 18:30 |
| ashishjain | My problem is to get all the instances for all the users and I do not want to give credential details for all the user | 18:30 |
| morganfainberg | oh hm. | 18:31 |
| morganfainberg | yeah | 18:31 |
| *** BjoernT has left #openstack-keystone | 18:37 | |
| *** e0ne is now known as e0ne_ | 18:40 | |
| dolphm | ashishjain: with regard to fetching other user's tokens: no, and that wouldn't be reliable anyway because there might not be active tokens for all users | 18:41 |
| dolphm | ashishjain: nova client has an --all-tenants option (IIRC, someone can correct me on that) to do that if you have admin authorization | 18:42 |
| dolphm | ashishjain: at least, in openstackclient it's exposed as "openstack server list --all-projects" | 18:43 |
| *** e0ne_ is now known as e0ne | 18:44 | |
| ashishjain | dolphm: So it means once I get an admin token I can always get details of all the instances using http://<host>:8774/v2/<tenant_id>/servers for all the tenants | 18:45 |
| dolphm | ashishjain: i don't know what nova's HTTP API call is for that, but yes, any token with the "admin" role assignment included should work | 18:45 |
| ashishjain | and I just use X-Auth-Token as admin token | 18:45 |
| ashishjain | http://developer.openstack.org/api-ref-compute-v2.html#listServers | 18:45 |
| ashishjain | dolphm: The problem I am facing is I cannot list instance lists for another tenant using admin token | 18:49 |
| dolphm | ashishjain: what do you mean by "admin token"? | 18:50 |
| ashishjain | So this means for each username/password combination I need to first generate the auth token and than use that token for finding out instances under that tenant or user | 18:51 |
| ashishjain | admin token is basically a user which has got admin privileges | 18:51 |
| dolphm | ashishjain: one admin token should be able to list all instances in all tenants / projects in a single API call | 19:00 |
| dolphm | ashishjain: i just wanted to make sure you weren't referring to keystone.conf's admin_token which is a different concept | 19:00 |
| ashishjain | dolphm: I am using passwordCredentials for admin user and genenrating a token | 19:02 |
| ashishjain | than I am using it to list instance as pointed out earlier http://<host>:8774/v2/<tenant_id>/servers | 19:03 |
| ashishjain | I know the keystone.conf concept is for initially creating users etc | 19:03 |
| dolphm | ashishjain: then you're authorization should be correct, but i can't speak as to whether or not that's correct HTTP API call or not. i use the client bindings to talk to nova myself | 19:03 |
| ashishjain | my policy.json is default and which says "admin_required": "role:admin or is_admin:1" | 19:04 |
| ashishjain | I have created a admin role and added admin user to it | 19:04 |
| ashishjain | so that means the user is admin | 19:04 |
| ashishjain | But I keep 401 unauthorised | 19:05 |
| ashishjain | because I am using a different tenant_id other than admin | 19:05 |
| *** ayoung has quit IRC | 19:05 | |
| ashishjain | and the token has been generated for user admin | 19:06 |
| *** claco has left #openstack-keystone | 19:06 | |
| ashishjain | and the moment I generate another set of token for the said tenant I am able to get all what I want | 19:06 |
| ashishjain | So that means my admin user auth token is good for itself | 19:06 |
| ashishjain | and not for any other tenants | 19:07 |
| ashishjain | I have used the following guide to configure all the users | 19:10 |
| ashishjain | http://docs.openstack.org/juno/install-guide/install/apt/content/keystone-users.html | 19:10 |
| *** _cjones_ has quit IRC | 19:12 | |
| dolphm | ashishjain: i suspect you're making the wrong api call to nova | 19:12 |
| dolphm | ashishjain: but you do need to specify a tenant / project when authenticating with keystone in order to consume the admin role assignment | 19:13 |
| *** rushiagr is now known as rushiagr_away | 19:14 | |
| ashishjain | dolphm: Here is the payload I pass when authenticating to keystone | 19:15 |
| ashishjain | http://paste.openstack.org/show/205368/ | 19:15 |
| ashishjain | and url used is http://192.168.56.57:5000/v2.0/tokens | 19:15 |
| dolphm | ashishjain: looks good | 19:15 |
| ashishjain | now I get a token | 19:15 |
| ashishjain | which is basically my X-Auth-Token | 19:15 |
| ashishjain | http://192.168.56.57:8774/v2/d8e084688c154c84b10afe0bccc2e406/servers | 19:16 |
| ashishjain | this is the call to nova to list all the servers | 19:16 |
| ashishjain | the token_id here is for a user called demo | 19:16 |
| ashishjain | I get 401 | 19:16 |
| ashishjain | sorry tenant_id | 19:16 |
| ashishjain | not token_id | 19:17 |
| ashishjain | What I try next is to include X-Auth-Token as a header I still get 401 | 19:17 |
| ashishjain | this is the tenant id for my admin tenant 9e1d18ac5e3b47e1b87c305c2d1a94ef | 19:18 |
| *** browne has quit IRC | 19:18 | |
| ashishjain | once I use this all is well and no longer 201 | 19:18 |
| ashishjain | *401 | 19:18 |
| *** browne has joined #openstack-keystone | 19:19 | |
| *** _cjones_ has joined #openstack-keystone | 19:19 | |
| dolphm | ashishjain: what does nova client do when you get an instance list with --all-tenants? | 19:19 |
| ashishjain | it lists me the instances | 19:21 |
| ashishjain | OS_AUTH_URL=http://openstackcontroller:35357/v2.0 | 19:21 |
| ashishjain | OS_USERNAME=admin | 19:21 |
| ashishjain | OS_TENANT_NAME=admin | 19:21 |
| ashishjain | if u see I am using all admin but still I am able to get instance list for demo tenant too | 19:21 |
| ashishjain | when I use --all-tenants option | 19:22 |
| ashishjain | Could this be a bug | 19:22 |
| ashishjain | ? | 19:22 |
| ashishjain | This is the response I get http://paste.openstack.org/show/205369/ | 19:25 |
| *** esp has joined #openstack-keystone | 19:26 | |
| *** _cjones_ has quit IRC | 19:40 | |
| openstackgerrit | Merged openstack/pycadf: Add test to cover mask value for utils.mask_value https://review.openstack.org/176479 | 19:44 |
| *** tqtran has quit IRC | 19:50 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/176833 | 19:52 |
| *** jaosorior has quit IRC | 19:52 | |
| *** ajayaa has quit IRC | 19:58 | |
| *** ashishjain has quit IRC | 19:59 | |
| *** _cjones_ has joined #openstack-keystone | 20:09 | |
| *** Ephur has quit IRC | 20:15 | |
| *** ayoung has joined #openstack-keystone | 20:19 | |
| *** ChanServ sets mode: +v ayoung | 20:19 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: drop audit middleware https://review.openstack.org/176969 | 20:24 |
| *** e0ne is now known as e0ne_ | 20:26 | |
| *** e0ne has joined #openstack-keystone | 20:27 | |
| morganfainberg | RC2 should be tagged and released | 20:30 |
| *** tqtran has joined #openstack-keystone | 20:37 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Refactor: remove unused arguments from method signature https://review.openstack.org/176976 | 20:43 |
| *** ayoung has quit IRC | 20:44 | |
| *** ayoung has joined #openstack-keystone | 20:45 | |
| *** ChanServ sets mode: +v ayoung | 20:45 | |
| dolphm | morganfainberg: just approved this then noticed you had outstanding concerns from a previous patchset https://review.openstack.org/#/c/141854/ | 20:45 |
| *** raildo has quit IRC | 20:45 | |
| morganfainberg | dolphm,will look in a moment.. | 20:45 |
| morganfainberg | fighting expense report system for the next couple minutes | 20:46 |
| dolphm | morganfainberg: be strong, i believe in you | 20:46 |
| morganfainberg | i think my concerns might have been addressed. but i'll +A it once i look. | 20:46 |
| morganfainberg | dolphm, hah. | 20:46 |
| morganfainberg | dolphm, expense reports... always painful | 20:46 |
| *** e0ne has quit IRC | 20:47 | |
| samueldmq | dolphm, morganfainberg I also had concerns on that change back in patch set 13 ... my concerns still apply | 20:48 |
| samueldmq | I put a comment in there, will let morgan decide what way to go | 20:48 |
| samueldmq | thanks | 20:48 |
| *** samueldmq has quit IRC | 20:51 | |
| *** mattfarina has quit IRC | 21:01 | |
| *** pnavarro has quit IRC | 21:12 | |
| *** vhoward has quit IRC | 21:12 | |
| *** vhoward has joined #openstack-keystone | 21:13 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: drop audit middleware https://review.openstack.org/176969 | 21:17 |
| openstackgerrit | Steve Martinelli proposed openstack/pycadf: Add trove conf file to setup.cfg https://review.openstack.org/176988 | 21:19 |
| *** tqtran_ has joined #openstack-keystone | 21:20 | |
| *** tqtran has quit IRC | 21:21 | |
| *** vhoward has quit IRC | 21:23 | |
| *** vhoward has joined #openstack-keystone | 21:24 | |
| *** pnavarro has joined #openstack-keystone | 21:24 | |
| *** mwhahaha has joined #openstack-keystone | 21:26 | |
| ayoung | dolphm, sorry, I've been in SAML/ECP-land all day. I just read what you wrote and it looks right | 21:33 |
| ayoung | anyone know how to get debugging output from a sample python script using KC and auth plugins? | 21:35 |
| ayoung | actually, I am not even creating a client, just doing: | 21:35 |
| ayoung | response = self.saml2plugin.get_auth_ref(self.session) | 21:35 |
| morganfainberg | dolphm, yah my concerns not addressed | 21:38 |
| morganfainberg | dolphm, unless we're getting rid of TRL support (don't think we can) this isn't a compatible change | 21:39 |
| * morganfainberg goes back to fighting travel and expense systems. | 21:39 | |
| *** gyee has joined #openstack-keystone | 21:48 | |
| *** ChanServ sets mode: +v gyee | 21:48 | |
| *** samueldmq has joined #openstack-keystone | 21:50 | |
| *** mwhahaha has left #openstack-keystone | 21:54 | |
| *** lhcheng_ is now known as lhcheng | 21:54 | |
| *** ChanServ sets mode: +v lhcheng | 21:54 | |
| *** rm_work is now known as rm_work|away | 21:55 | |
| *** rushil has quit IRC | 22:02 | |
| *** openstackstatus has quit IRC | 22:09 | |
| *** pnavarro has quit IRC | 22:10 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:19 | |
| *** browne has quit IRC | 22:25 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: drop audit middleware https://review.openstack.org/176969 | 22:26 |
| *** arunkant_ has quit IRC | 22:27 | |
| openstackgerrit | guang-yee proposed openstack/keystone-specs: Tokenless authz with X.509 SSL client cert https://review.openstack.org/177019 | 22:31 |
| *** bknudson has quit IRC | 22:33 | |
| *** browne has joined #openstack-keystone | 22:33 | |
| openstackgerrit | Merged openstack/pycadf: Added a testcase to cover ValueError in tag.py https://review.openstack.org/176901 | 22:33 |
| *** gordc has quit IRC | 22:36 | |
| *** edmondsw has quit IRC | 22:41 | |
| *** tqtran_ has quit IRC | 22:44 | |
| *** tqtran has joined #openstack-keystone | 22:48 | |
| *** arunkant_ has joined #openstack-keystone | 22:55 | |
| *** tqtran_ has joined #openstack-keystone | 23:14 | |
| *** tqtran has quit IRC | 23:15 | |
| *** tqtran has joined #openstack-keystone | 23:17 | |
| *** arunkant_ has quit IRC | 23:18 | |
| *** browne has quit IRC | 23:20 | |
| *** tqtran has quit IRC | 23:22 | |
| *** tqtran_ has quit IRC | 23:34 | |
| *** ncoghlan has joined #openstack-keystone | 23:42 | |
| *** tqtran has joined #openstack-keystone | 23:47 | |
| *** tqtran_ has joined #openstack-keystone | 23:55 | |
| *** tqtran has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!