| *** topol has quit IRC | 00:10 | |
| *** jaosorior has quit IRC | 00:22 | |
| *** zzzeek has quit IRC | 00:22 | |
| *** gyee has quit IRC | 00:22 | |
| dolphm | release notes! edits welcome https://wiki.openstack.org/wiki/ReleaseNotes/Kilo#OpenStack_Identity_.28Keystone.29 | 00:22 |
|---|---|---|
| *** topol has joined #openstack-keystone | 00:25 | |
| *** ChanServ sets mode: +v topol | 00:25 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Add endpoint and service ids to fixtures https://review.openstack.org/174668 | 00:33 |
| *** edmondsw has quit IRC | 00:33 | |
| *** packet has joined #openstack-keystone | 00:36 | |
| *** packet has quit IRC | 00:46 | |
| *** alexsyip has quit IRC | 00:53 | |
| *** packet has joined #openstack-keystone | 00:57 | |
| *** Rockyg has quit IRC | 00:58 | |
| *** lhcheng has quit IRC | 00:59 | |
| *** browne has quit IRC | 01:00 | |
| *** _cjones_ has quit IRC | 01:05 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:05 | |
| *** bknudson has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v bknudson | 01:09 | |
| *** stevemar has joined #openstack-keystone | 01:11 | |
| *** ChanServ sets mode: +v stevemar | 01:11 | |
| *** markvoelker has joined #openstack-keystone | 01:11 | |
| *** samueldmq has joined #openstack-keystone | 01:12 | |
| bknudson | jamielennox: see my responses on https://review.openstack.org/#/c/144248/ ? | 01:12 |
| jamielennox | bknudson: not yet | 01:13 |
| jamielennox | bknudson: hmm, i wonder where version started getting passed as a string | 01:13 |
| bknudson | looks like there's a bug in keystoneclient, so I posted a fix for it... https://review.openstack.org/#/c/178866/ | 01:13 |
| jamielennox | it must be because we are using the full ksc client now rather than our own get(..., version=X) functions | 01:14 |
| jamielennox | that would make sense | 01:14 |
| bknudson | so we could wait for that in a keystoneclient release and then we wouldn't need the workaround in ksm. | 01:14 |
| jamielennox | bknudson: it's not just us that uses adapters though so we would have problems with other clients | 01:15 |
| bknudson | actually, I never really tried to see if it allows ksm to pass... I should try that. | 01:15 |
| jamielennox | (not that that matters fr ksm) | 01:15 |
| bknudson | if other adapters are using strings rather than tuples then they also have bugs. | 01:15 |
| bknudson | because the adapter says version is a tuple not a string. | 01:16 |
| jamielennox | bknudson: i'm ok to use a string there if we need it | 01:17 |
| jamielennox | bknudson: deep in discovery we normalize it https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/_discover.py#L252 | 01:17 |
| bknudson | I'm going to at least file a bug and put a comment in there. | 01:17 |
| jamielennox | so in almost all situations it's not going to be a problem, it's just because we're not doing real discovery there it shows | 01:18 |
| bknudson | maybe it's time to do real discovery. | 01:18 |
| samueldmq | dolphm, hi, just reviewing the release notes | 01:18 |
| samueldmq | dolphm, I would replace 'Deployers can enable the Fernet [token] provider = keystone.token.providers.fernet.Provider in keystone.conf.' | 01:18 |
| samueldmq | dolphm, with 'Deployers can enable the Fernet **TOKEN PROVIDER USING** [token] provider = keystone.token.providers.fernet.Provider in keystone.conf.' | 01:19 |
| samueldmq | dolphm, also, there is a place where we use 'keystone' instead of 'Keystone' | 01:19 |
| samueldmq | dolphm, can I fix those? | 01:19 |
| bknudson | if we're going to switch to doing real discovery some time then might as well keep the workaround. | 01:20 |
| bknudson | and work on switching to using discovery | 01:20 |
| bknudson | we should be able to turn some of the ksm code over once it's using ksc. | 01:21 |
| bknudson | e.g., just create a keystoneclient (not v2 or v3) and call it, rather than having separate classes. | 01:21 |
| bknudson | I didn't want to do all that in a single step. | 01:22 |
| bknudson | also we can mock at the keystoneclient level rather than at the requests level in the tests. | 01:22 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Adapter version is a tuple https://review.openstack.org/178866 | 01:28 |
| samueldmq | dolphm, reviewed! lgtm | 01:30 |
| *** tqtran has quit IRC | 01:30 | |
| ayoung | bknudson, I suggested a cross project policy talk as well. I think we should merge your "role for service users" under that. The hierarchical roles approach will address that, and we should do it in the context of a unified policy file. | 01:35 |
| ayoung | dolphm, should WebSSO go under Keystone or Horizon? I'm guessing Horizon. | 01:36 |
| ayoung | Oh..its there already, first thing! | 01:36 |
| bknudson | the role for service users shouldn't require much of a discussion... it's really not much of a change... just need to limit the capabilities of the service users. | 01:37 |
| bknudson | could do it today without any new features | 01:37 |
| ayoung | bknudson, the thing is that we need to identify which operations need that role | 01:37 |
| ayoung | and I guess it is not hierarchical, as you need "service" role on the "service" domain in order to execute it | 01:38 |
| bknudson | we know what operations auth_token is going to do. | 01:38 |
| bknudson | we know what operations nova is going to do on neutron and glance | 01:38 |
| ayoung | validate tokens, maybe fetch certs if they are still doing PKI. Fetch policy in the future | 01:38 |
| bknudson | and what operations neutron is going to do for nova. | 01:38 |
| bknudson | and what operations heat needs to do? | 01:39 |
| ayoung | bknudson, nova ops on neutron and glance are done using the users token, right? | 01:39 |
| bknudson | but we can't require admin role for any of these. | 01:39 |
| ayoung | bknudson, we can and should make Heat its own thing if it is doing special operations | 01:39 |
| bknudson | not always. | 01:39 |
| ayoung | it creates a domain for one thing | 01:39 |
| bknudson | yikes! | 01:39 |
| ayoung | bknudson, it puts all its temporary users in that domain | 01:39 |
| ayoung | then the users token is used to create trusts, delegating roles to those users | 01:40 |
| bknudson | that seems like a bad idea... require the admin to create the domain. | 01:40 |
| bknudson | and use the domain that the admin set up | 01:40 |
| ayoung | it is done at install time...probably not by the heat user | 01:40 |
| ayoung | but it does a lot more than other service users its my point | 01:40 |
| ayoung | make HEAT its own role, I would think | 01:40 |
| ayoung | alloed to create and delete users in the heat domain... | 01:41 |
| bknudson | it still doesn't need to have admin authority. | 01:41 |
| ayoung | cnothing really needs admin..I hate that term | 01:41 |
| bknudson | yes, create a specific role for it. | 01:41 |
| ayoung | admin needs to die | 01:41 |
| bknudson | so that's what the session I proposed is about | 01:41 |
| ayoung | bknudson, so I want a unified policy file | 01:41 |
| bknudson | somehow we have to educate folks to not allow it. | 01:41 |
| bknudson | There's no reason we shouldn't be able to have a unified policy file. | 01:41 |
| ayoung | and a header section that defines the role hierarchy | 01:41 |
| bknudson | might have to figure out why neutron implemented their own rules. | 01:42 |
| bknudson | and unwind that | 01:42 |
| ayoung | that way, if we do have heat role it will have common definition across the other projects | 01:42 |
| ayoung | they have one thing they do which is unuique..I'll link | 01:42 |
| bknudson | a unified policy file would make it easier to enforce these things. | 01:42 |
| ayoung | http://git.openstack.org/cgit/openstack/neutron/tree/etc/policy.json#n12 | 01:43 |
| *** alex_xu has quit IRC | 01:43 | |
| ayoung | so they do some enforcing on fields | 01:43 |
| bknudson | ayoung: do we want that in oslo.policy? | 01:43 |
| ayoung | I think so | 01:43 |
| ayoung | it is a generalizable rule, it should be common | 01:43 |
| bknudson | should be easy to just copy the class from neutron | 01:43 |
| ayoung | let me see if I can find the code definition for it | 01:43 |
| bknudson | because ihar has been expecting to keep it in neutron. | 01:44 |
| bknudson | I don't know why he thinks we don't want it in oslo.policy | 01:44 |
| ayoung | http://git.openstack.org/cgit/openstack/neutron/tree/neutron/policy.py#n319 | 01:44 |
| ayoung | .RESOURCE_ATTRIBUTE_MAP[resource][field] might be the reason... | 01:45 |
| bknudson | there's no reason you shouldn't be able to tell oslo.policy what your application's RESOURCE_ATTRIBUTE_MAP is. | 01:46 |
| ayoung | http://git.openstack.org/cgit/openstack/neutron/tree/neutron/api/v2/attributes.py#n688 | 01:46 |
| bknudson | policy.set_resource_attribute_map(...) | 01:46 |
| ayoung | is that something that should be in the policy file itself? Or maybe should be in a separate json file? | 01:46 |
| bknudson | that's another possibility | 01:47 |
| ayoung | It might be an issue having a unified file. May make more sense to compose the policy from multiple files, with just a common set of rules | 01:47 |
| ayoung | that way, each of the projects can own their set of APIs, but inherit common logic for roles and so on | 01:48 |
| *** dims has joined #openstack-keystone | 01:48 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change auth_token to use keystoneclient https://review.openstack.org/144248 | 01:50 |
| *** topol has quit IRC | 01:51 | |
| *** stevemar has quit IRC | 01:52 | |
| ayoung | bknudson, does _discover.normalize_version_number(self.version) handle both the tuple and the "v3" forms of the version in https://review.openstack.org/#/c/178866/4/keystoneclient/httpclient.py,cm | 01:55 |
| bknudson | ayoung: yes, it's got code to accept an iterable (tuple) : http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/_discover.py#n97 | 01:57 |
| ayoung | I thought I rememberd that | 01:57 |
| bknudson | it's very permissive. | 01:57 |
| jamielennox | bknudson: that was back when i was trying to please everyone | 01:58 |
| bknudson | probably because the services are inconsistent | 01:58 |
| bknudson | jamielennox: you've given up on pleasing everyone? | 01:58 |
| jamielennox | now we have enough moment to just make them conform to us | 01:58 |
| *** packet has quit IRC | 01:58 | |
| jamielennox | absolutely - now we dictate the right way to do it | 01:59 |
| *** richm has quit IRC | 02:00 | |
| bknudson | maybe there's some way we could make it really hard to create a user with admin role. | 02:01 |
| bknudson | maybe a domain property. | 02:02 |
| ayoung | bknudson, I think the problem with admin is the policy enforcement accepts it everywhere | 02:02 |
| ayoung | the idea is that admin is the root account, that can unstuck things | 02:03 |
| morganfainberg | bknudson: interesting idea | 02:03 |
| ayoung | I think that the right approach is more like this | 02:03 |
| ayoung | admin must always be scoped | 02:03 |
| ayoung | we use Hierarchical role assignements so that admin at the domain means admin on projects | 02:03 |
| morganfainberg | ayoung: have some feedback/ideas that fit into delegation for the summit. :) | 02:04 |
| ayoung | have a single hierarchy, with a root domain | 02:04 |
| bknudson | y, but we don't want any admin. | 02:04 |
| bknudson | ok, maybe we want a user to be admin | 02:04 |
| ayoung | and admin becomes an aggregate role | 02:04 |
| bknudson | but service users shouldn't be admin | 02:04 |
| ayoung | it means "all permissions" but it still needs to be scoped | 02:04 |
| morganfainberg | ayoung: fwiw, it is somewhere between what you and I have each talked about for a while. /me relaxes for the next flight | 02:04 |
| ayoung | right.. but not only service users need to perform those operations | 02:04 |
| ayoung | validate token...probably a service user | 02:05 |
| ayoung | but would we say exclusively a service user? | 02:05 |
| bknudson | no reason to do that | 02:05 |
| bknudson | if you know what an application is going to do then limit application user to those operations | 02:06 |
| ayoung | but even the service role should be scoped. service role on the admin domain can validate a token..or on the service project or something | 02:06 |
| bknudson | e.g., you know auth_token is going to validate tokens so limit the auth_token user to validating tokens. | 02:06 |
| ayoung | assume that any proejct admin can assign any role to any user within their project | 02:07 |
| ayoung | so it can;'t just be the role name | 02:07 |
| ayoung | if always has to be "role in scope" | 02:07 |
| bknudson | if we're going to have admins then it should be possible to limit their adminity | 02:09 |
| bknudson | and limited admin should be the default | 02:09 |
| ayoung | bknudson, that is the goal | 02:10 |
| ayoung | bknudson, its been assigned to me for a long time: https://bugs.launchpad.net/keystone/+bug/968696 | 02:11 |
| openstack | Launchpad bug 968696 in Keystone ""admin"-ness not properly scoped" [High,Confirmed] - Assigned to Adam Young (ayoung) | 02:11 |
| ayoung | time to finally make progress on it | 02:11 |
| bknudson | only since 2012. | 02:12 |
| ayoung | bknudson, so there are a couple problems. The biggest is that we can't change the default policy out from under people. That will break many apps. The second is that we don;t have a good way to publish "this is the admin domain" as you see in the v3 cloudsample file | 02:14 |
| bknudson | one suggestion was to support a domain name rather than an ID. | 02:15 |
| ayoung | making it so installations can fetch their policy from Keystone provides a way: when an install cuts over, they get the new rules | 02:15 |
| ayoung | bknudson, that is better ,but still needs to be definied and distributed per installation | 02:15 |
| ayoung | You would need to go and set it in every policy file. And most people treat policy files as code distributed from the base installation, not a config file | 02:16 |
| bknudson | we also need to make progress on domains-are-projects | 02:16 |
| bknudson | since it should be admin project not admin domain | 02:17 |
| ayoung | bknudson, there are reviews out for that...I have one open right now | 02:17 |
| ayoung | https://review.openstack.org/#/c/158398/9 | 02:17 |
| openstackgerrit | liusheng proposed openstack/python-keystoneclient: Use openstack common util method to find name-or-id resource https://review.openstack.org/178594 | 02:17 |
| ayoung | see the related patches | 02:17 |
| ayoung | bknudson, which reminds me: isn't it time we added mysql to the test-requirements.txt file? | 02:18 |
| bknudson | ayoung: I think victor was working on that | 02:18 |
| bknudson | opportunistic live testing. | 02:18 |
| ayoung | even if we don't use it in the actualy tests, we should have it in the test file as just about everything needs it. That way, if you create a tox environemnt, you can cut it over to a live mysql | 02:19 |
| ayoung | among other things | 02:19 |
| bknudson | that would be nice to see since it's hard to fix migrations | 02:19 |
| ayoung | I can submit it...one sec | 02:19 |
| ayoung | bknudson, ah...it requires mysql devel to be installed...maybe that is why we held off | 02:20 |
| ayoung | that is a binary | 02:20 |
| bknudson | yuck | 02:21 |
| ayoung | I'll submit anyway, we can always reject | 02:21 |
| ayoung | bknudson, if the license just says GPL...is that OK? I'm guessing V2 but it doesn;'t specify | 02:23 |
| bknudson | https://review.openstack.org/#/q/owner:%22Victor+Sergeyev%22+status:open,n,z | 02:23 |
| bknudson | for tests I don't think it matters | 02:23 |
| bknudson | it's Victor Sergeyev, not Victor Stinner | 02:24 |
| bknudson | ayoung: look at this: https://review.openstack.org/#/c/171115/ | 02:24 |
| bknudson | https://review.openstack.org/#/c/171115/5/test-requirements.txt | 02:24 |
| *** stevemar has joined #openstack-keystone | 02:25 | |
| *** ChanServ sets mode: +v stevemar | 02:25 | |
| ayoung | gpl v2 and v3 for mysql ond psycopg | 02:29 |
| bknudson | luckily redhat packages it for us so we don't have to try to ship it ourselves. | 02:30 |
| *** dims has quit IRC | 02:31 | |
| *** fifieldt has joined #openstack-keystone | 02:36 | |
| *** stevemar has quit IRC | 02:38 | |
| *** alex_xu has joined #openstack-keystone | 02:44 | |
| *** browne has joined #openstack-keystone | 02:45 | |
| ayoung | Yeah. Luck | 02:45 |
| *** stevemar has joined #openstack-keystone | 02:48 | |
| *** ChanServ sets mode: +v stevemar | 02:48 | |
| *** ir2ivps8_ has quit IRC | 02:48 | |
| *** ir2ivps8 has joined #openstack-keystone | 02:48 | |
| *** harlowja has quit IRC | 02:56 | |
| *** harlowja has joined #openstack-keystone | 02:56 | |
| *** harlowja has quit IRC | 02:57 | |
| *** lhcheng has joined #openstack-keystone | 03:11 | |
| *** ChanServ sets mode: +v lhcheng | 03:11 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Reorganize exceptions https://review.openstack.org/178910 | 03:17 |
| *** packet has joined #openstack-keystone | 03:20 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Rename _discover module https://review.openstack.org/178911 | 03:23 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove management_url from AccessInfo https://review.openstack.org/178912 | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove auth_url property from AccessInfo https://review.openstack.org/178913 | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove region_name from catalog https://review.openstack.org/178914 | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove the AccessInfo Factory https://review.openstack.org/178915 | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove region_name from service catalog https://review.openstack.org/178916 | 03:25 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Cannot retrieve a token from service catalog https://review.openstack.org/178917 | 03:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Don't save version into the dictionary https://review.openstack.org/178918 | 03:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove the factory from service catalog https://review.openstack.org/178919 | 03:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make ServiceCatalog take an actual catalog https://review.openstack.org/178920 | 03:26 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: AccessInfo is not a dict https://review.openstack.org/178921 | 03:26 |
| *** harlowja has joined #openstack-keystone | 03:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove cli functions from utils https://review.openstack.org/178922 | 03:28 |
| jamielennox | that was fun, alright real work... | 03:30 |
| *** _cjones_ has joined #openstack-keystone | 04:10 | |
| morganfainberg | jamielennox: will run through those tonight or tomorrow. | 04:22 |
| morganfainberg | jamielennox: once I know what things look like re: release notes. | 04:23 |
| jamielennox | morganfainberg: i'm not being super neat but trying to keep each change contained | 04:23 |
| morganfainberg | And I'm actually home. | 04:23 |
| jamielennox | i'm also ripping out stuff that we may need again later, but i'd prefer to not have | 04:23 |
| jamielennox | because we can always add it back | 04:23 |
| morganfainberg | jamielennox: I'm less worried about "neat" and more worried about getting things in the repo. This is still cleanup | 04:23 |
| morganfainberg | In/out whatever. But getting things in shape for a release is the important part :) | 04:24 |
| morganfainberg | jamielennox: going to also do another ksm .z release for spammy log fix. | 04:25 |
| morganfainberg | Tomorrow. | 04:25 |
| morganfainberg | (I know Thursday...) | 04:25 |
| jamielennox | the cinder thing? | 04:25 |
| jamielennox | what did you fix on ksm side/ | 04:25 |
| *** packet has quit IRC | 04:26 | |
| samueldmq | morganfainberg, hi | 04:43 |
| samueldmq | morganfainberg, in the release notes, the section Known Issues is still empty | 04:44 |
| samueldmq | morganfainberg, is that related to security notes (like https://wiki.openstack.org/wiki/OSSN/OSSN-0047) | 04:44 |
| samueldmq | morganfainberg, or is that issues we know and didnt solve | 04:45 |
| samueldmq | ? | 04:45 |
| *** samueldmq has quit IRC | 05:02 | |
| *** lhcheng has quit IRC | 05:17 | |
| *** josecastroleon has joined #openstack-keystone | 05:17 | |
| morganfainberg | jamielennox: stopped logging a warning when no token is in headers | 05:18 |
| jamielennox | morganfainberg: stopped or downgraded to info? | 05:18 |
| morganfainberg | jamielennox: no logging for it | 05:18 |
| jamielennox | or some other debug | 05:18 |
| morganfainberg | It doesn't | 05:18 |
| morganfainberg | Need to be debug we dump the headers and raise an error | 05:18 |
| *** josecastroleon has quit IRC | 05:19 | |
| morganfainberg | Was being hit millions of times per week in the gate. Very spammy, not useful. | 05:19 |
| morganfainberg | What does it tell an operator? Nothing really. | 05:19 |
| morganfainberg | No request ids at that point etc. for a developer in debug, we already dump th full header dict. | 05:20 |
| *** openstackgerrit has quit IRC | 05:22 | |
| *** lhcheng has joined #openstack-keystone | 05:22 | |
| *** ChanServ sets mode: +v lhcheng | 05:22 | |
| *** openstackgerrit has joined #openstack-keystone | 05:22 | |
| *** harlowja is now known as harlowja_away | 05:23 | |
| *** lhcheng has quit IRC | 05:26 | |
| *** kiran-r has joined #openstack-keystone | 05:40 | |
| *** ajayaa has joined #openstack-keystone | 05:46 | |
| *** josecastroleon has joined #openstack-keystone | 06:00 | |
| *** _cjones_ has quit IRC | 06:07 | |
| *** kiran-r has quit IRC | 06:14 | |
| *** topol has joined #openstack-keystone | 06:26 | |
| *** ChanServ sets mode: +v topol | 06:26 | |
| *** kiran-r has joined #openstack-keystone | 06:40 | |
| *** e0ne has joined #openstack-keystone | 06:45 | |
| *** stevemar has quit IRC | 06:46 | |
| *** kiran-r has quit IRC | 06:46 | |
| *** pnavarro has joined #openstack-keystone | 06:50 | |
| breton | good morning, folks | 06:53 |
| *** henrynash has joined #openstack-keystone | 06:54 | |
| *** ChanServ sets mode: +v henrynash | 06:54 | |
| *** kiran-r has joined #openstack-keystone | 06:55 | |
| *** rushiagr_away is now known as rushiagr | 06:57 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: enforce endpoint constraint https://review.openstack.org/177661 | 07:07 |
| *** afazekas has quit IRC | 07:08 | |
| *** e0ne has quit IRC | 07:09 | |
| *** browne has quit IRC | 07:09 | |
| *** vhoward has quit IRC | 07:13 | |
| *** vhoward has joined #openstack-keystone | 07:15 | |
| mabrams | ayoung: i did this but child's parent_project_id is ""; expecting "Parent" | 07:22 |
| mabrams | ayoung: plus i need a "grandchild" project | 07:22 |
| mabrams | ayoung: as well... | 07:23 |
| *** chlong has quit IRC | 07:42 | |
| marekd | breton: hi | 07:45 |
| breton | marekd: \o | 07:59 |
| *** kiran-r has quit IRC | 08:03 | |
| *** jistr has joined #openstack-keystone | 08:04 | |
| *** svasheka has joined #openstack-keystone | 08:13 | |
| ajayaa | marekd, Hi. Looking at the tables it seems that the trust data is stored only on two tables. i.e. trust and trust_role. Is that right? | 08:16 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Change keystoneclient to keystoneauth in docs https://review.openstack.org/178972 | 08:24 |
| *** krykowski has joined #openstack-keystone | 08:30 | |
| ajayaa | marekd, I am asking this because we are working on a NoSql backend for Keystone and the schema seems to have changed since we created a POC. | 08:31 |
| *** dobson` has quit IRC | 08:31 | |
| ajayaa | marekd, there? | 08:31 |
| *** topol has quit IRC | 08:36 | |
| *** pnavarro has quit IRC | 08:36 | |
| *** rlt_ has joined #openstack-keystone | 08:36 | |
| *** e0ne has joined #openstack-keystone | 08:37 | |
| *** dobson has joined #openstack-keystone | 08:49 | |
| *** Steap has joined #openstack-keystone | 08:50 | |
| *** kiran-r has joined #openstack-keystone | 08:56 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystonemiddleware: enforce endpoint constraint https://review.openstack.org/177661 | 08:57 |
| marekd | ajayaa: i am now. | 09:00 |
| marekd | ajayaa: i am not master of trusts. I really suggest goning through the code and checking on when and what tables are used. | 09:02 |
| *** pnavarro has joined #openstack-keystone | 09:02 | |
| ajayaa | That's what I did. Thanks. | 09:02 |
| marekd | it should be somewhere near https://github.com/openstack/keystone/blob/master/keystone/trust/backends/sql.py or keystone/trust in general | 09:02 |
| ajayaa | marekd ^^ | 09:02 |
| marekd | ajayaa: if you examine the code you will have a better understanding on what's going on there and be able to better fit your PoC | 09:03 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add openstack_user_domain to assertion https://review.openstack.org/172562 | 09:09 |
| *** kodoku has joined #openstack-keystone | 09:15 | |
| kodoku | Hi, How Can I modify links when I request /v2.0 ? because links return http://serveur/v2.0 and my endpoint is http://serveur/identity/v2.0 | 09:16 |
| kodoku | and cinder no works because it use this links for contact keystone | 09:16 |
| openstackgerrit | Lin Yang proposed openstack/keystone: Fix tiny typo in comment message https://review.openstack.org/178984 | 09:17 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone-specs: Spec for distributed database driver for Keystone https://review.openstack.org/178999 | 09:44 |
| *** e0ne is now known as e0ne_ | 09:48 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Refactor _create_attribute_statement IdP method https://review.openstack.org/172647 | 09:49 |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone-specs: Spec for distributed database driver for Keystone https://review.openstack.org/178999 | 09:51 |
| jamielennox | kodoku: it's when you set up services and endpoints in keystone | 09:53 |
| jamielennox | umm, the v2 cli had keystone service-create and endpoint-create | 09:53 |
| jamielennox | it's slightly different in OSC but it shouldn't be hard to find | 09:54 |
| *** kodoku has quit IRC | 09:55 | |
| *** dims has joined #openstack-keystone | 09:56 | |
| *** e0ne_ is now known as e0ne | 09:58 | |
| *** e0ne is now known as e0ne_ | 10:13 | |
| *** openstackgerrit_ has joined #openstack-keystone | 10:16 | |
| *** e0ne_ is now known as e0ne | 10:16 | |
| *** krykowski has quit IRC | 10:26 | |
| *** krykowski_ has joined #openstack-keystone | 10:26 | |
| *** openstackgerrit_ has quit IRC | 10:31 | |
| openstackgerrit | Ioram Schechtman Sette proposed openstack/keystone-specs: Policy rules mangaged from a database https://review.openstack.org/133814 | 10:37 |
| *** krykowski_ has quit IRC | 10:37 | |
| *** krykowski_ has joined #openstack-keystone | 10:38 | |
| *** _dguerri is now known as dguerri | 10:38 | |
| *** josecastroleon has quit IRC | 10:44 | |
| *** samueldmq has joined #openstack-keystone | 10:58 | |
| samueldmq | morning | 10:58 |
| *** krykowski_ has quit IRC | 11:02 | |
| *** henrynash has quit IRC | 11:02 | |
| *** krykowski has joined #openstack-keystone | 11:02 | |
| *** henrynash has joined #openstack-keystone | 11:03 | |
| *** ChanServ sets mode: +v henrynash | 11:03 | |
| *** e0ne has quit IRC | 11:05 | |
| *** rushiagr is now known as rushiagr_away | 11:08 | |
| *** e0ne has joined #openstack-keystone | 11:10 | |
| *** kiran-r has quit IRC | 11:15 | |
| *** markvoelker has quit IRC | 11:18 | |
| *** josecastroleon has joined #openstack-keystone | 11:19 | |
| *** jamielennox is now known as jamielennox|away | 11:20 | |
| *** e0ne is now known as e0ne_ | 11:20 | |
| *** e0ne_ is now known as e0ne | 11:21 | |
| *** aix has joined #openstack-keystone | 11:21 | |
| openstackgerrit | Merged openstack/keystone: Fix tiny typo in comment message https://review.openstack.org/178984 | 11:22 |
| *** krykowski has quit IRC | 11:34 | |
| *** kiran-r has joined #openstack-keystone | 11:37 | |
| *** ajayaa has quit IRC | 11:38 | |
| *** kiran-r has quit IRC | 11:54 | |
| *** kiranr has joined #openstack-keystone | 11:54 | |
| *** raildo has joined #openstack-keystone | 11:58 | |
| *** kiranr has quit IRC | 11:59 | |
| marekd | samueldmq: Hi | 12:00 |
| raildo | henrynash, regarding yout comment here: https://review.openstack.org/#/c/158372/ I was thinking in send this part in a different patch. In a future I can update then with the rest of the code related to dual scoped token. What do you think? | 12:01 |
| raildo | s/yout/your | 12:01 |
| marekd | samueldmq: i wanted to ask "Groups appearing in federated identity assertions may now be automatically created as local groups with local user membership mappings." what spec were you referring to (ReleaseNotes) | 12:01 |
| samueldmq | marekd, hello | 12:01 |
| samueldmq | marekd, let me check | 12:02 |
| samueldmq | marekd, I think this one was added by dolphm or stevemar | 12:04 |
| samueldmq | marekd, is there somehting wrong with this assertion ? | 12:05 |
| samueldmq | sentence* | 12:05 |
| marekd | samueldmq: AFAIR the groups are not created, they will be auto mapped. | 12:06 |
| marekd | dolphm: around ? | 12:06 |
| samueldmq | marekd, hmm, so they are dynamically mapped .. so there are role assignments for groups that doesnt really exist / | 12:07 |
| samueldmq | ? | 12:07 |
| marekd | let me revisit specs | 12:08 |
| marekd | samueldmq: take a look here: https://github.com/openstack/keystone-specs/blob/master/specs/kilo/mapping-enhancements.rst#proposed-change | 12:09 |
| marekd | First half of the paragraph. It's statet, that groups must exist apriori | 12:10 |
| marekd | they are automatically mapped, but not created locally. | 12:10 |
| *** mabrams has left #openstack-keystone | 12:10 | |
| *** markvoelker has joined #openstack-keystone | 12:11 | |
| *** bdossant has joined #openstack-keystone | 12:13 | |
| marekd | samueldmq: i can edit that | 12:14 |
| marekd | or you can do this as well | 12:14 |
| marekd | but i think this is not what we currently have in Keystone | 12:14 |
| samueldmq | marekd, do it yourself :) | 12:15 |
| samueldmq | marekd, also, do groups appear in the assertion ? | 12:15 |
| marekd | samueldmq: they may appear | 12:15 |
| marekd | samueldmq: well, there is no format parameter for groups | 12:15 |
| marekd | you are obliged to know what will come in the assertion (i.e. names of parameters) | 12:16 |
| samueldmq | marekd, I am not sure about that sentence, something looks inconsistent, but I'd check with dolphm ir stevemar, just to clarify what is being said there | 12:16 |
| samueldmq | :-) | 12:17 |
| marekd | samueldmq: ok, changed | 12:19 |
| *** krykowski has joined #openstack-keystone | 12:27 | |
| *** gordc has joined #openstack-keystone | 12:32 | |
| *** jistr has quit IRC | 12:39 | |
| *** jistr has joined #openstack-keystone | 12:54 | |
| *** jistr is now known as jistr|biab | 12:55 | |
| openstackgerrit | Merged openstack/keystone: Updates the *py3 requirements files https://review.openstack.org/177409 | 12:58 |
| *** topol has joined #openstack-keystone | 13:04 | |
| *** ChanServ sets mode: +v topol | 13:04 | |
| *** fifieldt has quit IRC | 13:04 | |
| *** Ctina has joined #openstack-keystone | 13:06 | |
| *** bknudson has quit IRC | 13:09 | |
| *** jaosorior has joined #openstack-keystone | 13:14 | |
| *** joesavak has joined #openstack-keystone | 13:17 | |
| *** stevemar has joined #openstack-keystone | 13:18 | |
| *** ChanServ sets mode: +v stevemar | 13:18 | |
| dolphm | samueldmq: marekd: o/ | 13:22 |
| marekd | dolphm: FYI. Hi. I edited ReleaseNotes a little bit | 13:22 |
| marekd | dolphm: IdentityFederation section, to be more specific. | 13:23 |
| dolphm | marekd: i was hoping you would! | 13:23 |
| marekd | dolphm: hehe. | 13:24 |
| *** nkinder has quit IRC | 13:25 | |
| dolphm | marekd: on the "Remote IDs" one -- i totally missed that feature. remote IDs of what? (IdPs?) | 13:25 |
| marekd | dolphm: yes. | 13:25 |
| marekd | dolphm: so now we can identify at the keystone level who issued this assertion. Before we knew it was "one of the guys we trust" | 13:26 |
| *** jsavak has joined #openstack-keystone | 13:26 | |
| *** bdossant_ has joined #openstack-keystone | 13:29 | |
| *** lsmola_ is now known as lsmola | 13:29 | |
| *** joesavak has quit IRC | 13:30 | |
| *** richm has joined #openstack-keystone | 13:30 | |
| *** bdossant_ has quit IRC | 13:30 | |
| *** bdossant has quit IRC | 13:30 | |
| dolphm | oh that's right, i remember that conversation | 13:37 |
| marekd | dolphm: yep | 13:37 |
| *** packet has joined #openstack-keystone | 13:39 | |
| *** bknudson has joined #openstack-keystone | 13:43 | |
| *** ChanServ sets mode: +v bknudson | 13:43 | |
| stevemar | dolphm, marekd it's a neat feature - allows for lots of external idps to use a single IDP resource | 13:44 |
| *** krykowski has quit IRC | 13:44 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:44 | |
| dolphm | could you hear me okay yesterday? | 13:44 |
| dolphm | lbragstad: ^ | 13:44 |
| lbragstad | dolphm: yep | 13:45 |
| marekd | stevemar: we can say that :-) | 13:45 |
| *** jistr|biab is now known as jistr | 13:53 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policy Overview https://review.openstack.org/147651 | 13:53 |
| samueldmq | ayoung, henrynash, dstanek, morganfainberg and everyone else ^ | 13:53 |
| samueldmq | I modified the spec to address dynamic policy in terms of what problems we are trying to solve | 13:54 |
| ayoung | samueldmq, thanks. looking | 13:54 |
| samueldmq | And how to incrementally get there :) | 13:54 |
| samueldmq | ayoung, yes please, let me know if I missed any detail or any other suggestion | 13:55 |
| *** chlong has joined #openstack-keystone | 13:56 | |
| *** edmondsw has joined #openstack-keystone | 13:59 | |
| ayoung | samueldmq, that is a great summary of the RBAC process | 14:01 |
| samueldmq | ayoung, yeah I tried to contextualize a bit more :-) | 14:03 |
| samueldmq | ayoung, you think it still need more details ? big changes ? | 14:03 |
| samueldmq | ayoung, I kept your original general idea/steps | 14:04 |
| *** browne has joined #openstack-keystone | 14:04 | |
| *** amakarov_away is now known as amakarov | 14:10 | |
| *** iamjarvo has joined #openstack-keystone | 14:11 | |
| *** iamjarvo has quit IRC | 14:11 | |
| *** nkinder has joined #openstack-keystone | 14:11 | |
| *** iamjarvo has joined #openstack-keystone | 14:11 | |
| *** lsmola has quit IRC | 14:12 | |
| gordc | hey folks, is PROJECT_NAME unique or is only PROJECT_ID guaranteed to be unique | 14:12 |
| bknudson | gordc: name is not unique across domains | 14:13 |
| gordc | bknudson: cool cool. as i guessed. thanks for confirming | 14:13 |
| stevemar | mfisch, do you have any AD experience? | 14:15 |
| ayoung | samueldmq, reminds me of the "Situation" section of an Operations Order: gordc With HMT, what I want is project name is unique within the parent project only | 14:18 |
| mfisch | stevemar: a small amount | 14:18 |
| ayoung | stevemar, we have some on our end. not me directly, I'll deny it, but other team members. | 14:19 |
| stevemar | mfisch, ayoung okay cool - i might call on you guys soon :) | 14:19 |
| samueldmq | ayoung, ++ | 14:20 |
| ayoung | samueldmq, hey can you adjust the "policy from client" spec to "emnforce policy from middleware?" | 14:20 |
| samueldmq | ayoung, looking at your comments now | 14:21 |
| samueldmq | ayoung, sure will do | 14:21 |
| ayoung | samueldmq, the big difference is going to be that the middleware mananges the cache, and calls oslo.policy. I don't think we need KC in there. | 14:21 |
| ayoung | oslo will assume it is presented a policy file, but we should make it so that it can accecpt the policy as parsed JSON as well. THat might be a separate spec.... | 14:22 |
| ayoung | just have middleware handle the cache for now | 14:22 |
| samueldmq | ayoung, k, but middleware will use kc to get the policy right (either json or file) | 14:23 |
| samueldmq | right ? | 14:23 |
| *** Ctina has quit IRC | 14:23 | |
| ayoung | samueldmq, that is correct | 14:23 |
| ayoung | but KC should already have policy crud. If it does not, that is a separate spec | 14:23 |
| *** Ctina has joined #openstack-keystone | 14:24 | |
| samueldmq | ayoung, what I was saying is that middleware enforces, based on the policy it gets using kc | 14:24 |
| samueldmq | ayoung, maybe clarify this ? | 14:24 |
| ayoung | samueldmq, heh...even more complex. | 14:24 |
| *** e0ne is now known as e0ne_ | 14:25 | |
| ayoung | middleware exposes a Policy Enforcement Point (PEP) API that nova et alles call in to. It won't be straight middleware. The PEP API does the following | 14:25 |
| ayoung | 1. Fetches policy from KC | 14:25 |
| samueldmq | ayoung, ahhhhhhhhhhhhhhhhh | 14:25 |
| samueldmq | ayoung, got it | 14:25 |
| dolphm | anyone know if keystone fails silently (no logging) when you enable caching but there's no memcache available/ | 14:25 |
| ayoung | 2. stores in cache | 14:25 |
| ayoung | 3. calls into oslo policy | 14:25 |
| samueldmq | ayoung, middleware does not know about the kc or whatever the policy was fetched with | 14:25 |
| samueldmq | ayoung, it just has the code to enforce | 14:26 |
| ayoung | samueldmq, I think you mean Oslo | 14:26 |
| samueldmq | ayoung, everything is still coordinated by the service, who connects the actions of fetch, enforce, etc | 14:26 |
| ayoung | middleware knows about KC and Oslo | 14:26 |
| samueldmq | ayoung, ah .. step back, middleware calls kc to fetch the policy, caches it, and enforces it using tthe common code in oslo | 14:28 |
| *** mattfarina has joined #openstack-keystone | 14:28 | |
| samueldmq | ayoung, as I was thinking all the time, just got confused for a few momnets | 14:28 |
| *** e0ne_ is now known as e0ne | 14:30 | |
| morganfainberg | Morning | 14:32 |
| morganfainberg | dolphm: samueldmq: release notes look great! | 14:32 |
| morganfainberg | Thank you!!! | 14:32 |
| bknudson | guten morganfainberg | 14:32 |
| dolphm | morganfainberg: /salute | 14:32 |
| samueldmq | morganfainberg, hi, nice ... anytime! | 14:33 |
| * morganfainberg yawns. | 14:33 | |
| morganfainberg | Feels good to be home. | 14:34 |
| *** josecastroleon has quit IRC | 14:35 | |
| ayoung | samueldmq, one sec, before you edit, I am going to add an ascii flow to that spec | 14:35 |
| breton | kilo got released! | 14:35 |
| samueldmq | ayoung, go ahead, I will edit it only this afternoon | 14:35 |
| samueldmq | ayoung, lunch time now | 14:36 |
| samueldmq | henrynash, appreciate your quick feedback on the spec, thanks | 14:37 |
| *** lhcheng has joined #openstack-keystone | 14:39 | |
| *** ChanServ sets mode: +v lhcheng | 14:39 | |
| dstanek | dolphm: i would not expect failure at all...generally speaking the memcache client will just not save the data and will report back that it didn't get any data | 14:43 |
| *** dims has quit IRC | 14:44 | |
| *** lhcheng has quit IRC | 14:44 | |
| *** dims has joined #openstack-keystone | 14:44 | |
| raildo | dstanek, can you review this bug later? :) https://review.openstack.org/#/c/158720/ | 14:47 |
| gordc | bknudson: one more q: is there ever a chance there will be HTTP_X_PROJECT_ID, HTTP_X_SERVICE_PROJECT_ID, HTTP_X_TENANT_ID (more than one) in a single request? if so, would they be different values? | 14:48 |
| bknudson | PROJECT_ID is a rename of TENANT_ID | 14:48 |
| bknudson | SERVICE_PROJECT_ID can be different than the PROJECT_ID... it's expected to be. | 14:48 |
| gordc | bknudson: you have a pointer to some docs that highlights the purpose of each? | 14:50 |
| gordc | oh service related user? | 14:50 |
| bknudson | http://docs.openstack.org/trunk/ ?? | 14:50 |
| gordc | bknudson: just using this https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py | 14:51 |
| bknudson | that's not even rendered. | 14:51 |
| bknudson | gordc: http://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#exchanging-user-information | 14:51 |
| gordc | bknudson: i'll read through. thanks | 14:52 |
| bknudson | gordc: and http://docs.openstack.org/developer/keystonemiddleware/api/keystonemiddleware.auth_token.html#what-auth-token-adds-to-the-request-for-use-by-the-openstack-service | 14:52 |
| *** chlong has quit IRC | 14:53 | |
| amakarov | morganfainberg, hi! I've addressed you concern about TRL update on revoke: https://review.openstack.org/#/c/141854/ Would you please look into? | 14:57 |
| morganfainberg | amakarov: thanks I am back home now so more able to do reviews. | 14:58 |
| amakarov | morganfainberg, that's cool! | 14:58 |
| morganfainberg | amakarov: :) | 14:58 |
| *** zzzeek has joined #openstack-keystone | 14:58 | |
| amakarov | And a spec for KMW on the same topic https://review.openstack.org/#/c/169399 :) | 14:59 |
| *** edmondsw has quit IRC | 15:00 | |
| morganfainberg | Kmw? | 15:03 |
| morganfainberg | Oh middleware :) | 15:03 |
| *** topol has quit IRC | 15:03 | |
| amakarov | morganfainberg, is "KSM" a correct abbreviation? )) | 15:06 |
| morganfainberg | amakarov: both work. | 15:07 |
| morganfainberg | amakarov: my brain is just getting going though. | 15:07 |
| marekd | morganfainberg: drink more coffeeeeeeeeee | 15:07 |
| marekd | :) | 15:08 |
| amakarov | marekd, as for me green tea is more effective btw | 15:08 |
| ayoung | which spec has an ascii flow diagram in it? Ican't get mine to pass tox, want to compare. Anyone? | 15:21 |
| bknudson | dstanek: I posted a similar comment to yours on https://review.openstack.org/#/c/133135/ -- I don't see the point of it. | 15:21 |
| bknudson | also, not sure what to do with it other than to just let it sit there forever unmerged. | 15:21 |
| bknudson | unless we just -2 it | 15:21 |
| bknudson | maybe morganfainberg as PTL has an opinion | 15:22 |
| morganfainberg | Looking. | 15:22 |
| morganfainberg | bkundson: The only question I have is for zzzeek on if it materially changes the same in a positive way. Afaict, this just is harder to read | 15:25 |
| bknudson | if zzzeek said this was an improvement then I'd +2 | 15:25 |
| *** e0ne is now known as e0ne_ | 15:25 | |
| morganfainberg | I think this does lower overhead in the Python sense because it doesn't call .filter_by over and over | 15:26 |
| bknudson | then profile it | 15:26 |
| bknudson | I stopped trusting my gut as far as performance improvements since I've been burned in the past. | 15:26 |
| morganfainberg | So less method mro lookups. But I mean. It's not worth spending hours on it unless someone has profiled it. I don't expect cores to profile things like this | 15:27 |
| morganfainberg | The code proposer should be showing us why this is better. Not just for the sake of shuffling code | 15:28 |
| bknudson | that's my opinion too. otherwise somebody's going to come along later and just change it back. | 15:28 |
| bknudson | since we have no reason to pick one or the other | 15:29 |
| morganfainberg | zzzeek: if you have a moment to let us know about some sql-a stuff, your insight would be really appreciated. | 15:29 |
| zzzeek | morganfainberg: i see the pages am trying to jam out some code before a 12 pm call | 15:29 |
| morganfainberg | bknudson: I'd err to the side of readability in all cases here. | 15:29 |
| morganfainberg | zzzeek: sounds good. No rush. Post call then :) | 15:29 |
| bknudson | both of them are equally readable to me. | 15:30 |
| morganfainberg | Or post lunch. Or. Whenever you have some spare moments. | 15:30 |
| morganfainberg | bknudson: the change of indent in a couple of them makes my eyes hurt more :P in the new version. | 15:30 |
| *** _cjones_ has joined #openstack-keystone | 15:31 | |
| bknudson | there should be a pep8-style tool for eyehurt | 15:31 |
| morganfainberg | bknudson: yessssss | 15:31 |
| morganfainberg | :) | 15:31 |
| marekd | amakarov: for sure initial K2K had some ascii flows | 15:32 |
| marekd | ayoung: ^^ | 15:32 |
| marekd | amakarov: sorry, meant ayoung | 15:32 |
| marekd | amakarov: i was juno | 15:32 |
| marekd | morganfainberg: you mentioned some questions for me on Tuesday (some metadata sort of stuff) | 15:34 |
| *** _cjones_ has quit IRC | 15:34 | |
| *** _cjones_ has joined #openstack-keystone | 15:34 | |
| morganfainberg | Hmm brain is fried. Can't remember. Maybe post coffee I will | 15:34 |
| marekd | :D | 15:34 |
| *** e0ne_ is now known as e0ne | 15:35 | |
| morganfainberg | But i did have questions. | 15:35 |
| morganfainberg | Hmm. | 15:35 |
| marekd | morganfainberg: sorry, you didn't provide me any more info at that time, so i will not help you | 15:35 |
| morganfainberg | marekd: I think it was around handling the aggregate metadata for the groups that have many many ISPs. | 15:36 |
| *** arunkant_ has joined #openstack-keystone | 15:36 | |
| marekd | morganfainberg: ISPs or IDPs (which still may sound weird) | 15:37 |
| morganfainberg | Idps | 15:37 |
| morganfainberg | So university systems. | 15:37 |
| morganfainberg | They have a large number of idps. Shib based. They provide an aggregate metadata for them. | 15:37 |
| *** rm_work|away is now known as rm_work | 15:38 | |
| morganfainberg | But then you also need to isolate the idp for say $deployer reasons (aka billing etc) | 15:38 |
| marekd | uhm | 15:38 |
| morganfainberg | I think I need to look at this model a bit more closely. | 15:38 |
| morganfainberg | Which is why I held off on asking on Tuesday | 15:39 |
| morganfainberg | The question wasn't ripe. So the question is a weird one ATM | 15:39 |
| morganfainberg | marekd: give me a little more time to see how this is constructed. Then I can ask the question the right way. | 15:39 |
| morganfainberg | Might be @ the summit. | 15:39 |
| marekd | do you have some specific feature/usecase you want to add/solve? | 15:40 |
| morganfainberg | Or be a non-question | 15:40 |
| zzzeek | morganfainberg: if we’re talking abotu filter_by(a=, b=, c=, ..), +1, I think its more concise. clearly either form is fine, do whichever one you find easier to read. Theres no performance impact either way | 15:40 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Enforce policy from keystoneclient https://review.openstack.org/133480 | 15:40 |
| *** jdennis has joined #openstack-keystone | 15:40 | |
| *** emagana has joined #openstack-keystone | 15:40 | |
| morganfainberg | Yeah. But I am missing some details before I can type out the use case. | 15:41 |
| morganfainberg | marekd: ^ | 15:41 |
| zzzeek | morganfainberg: originally, filter()’s predecessor did both the *clasues and the **kw. that’s my favorite, but people didnt understand the calling signature | 15:41 |
| morganfainberg | zzzeek: thanks. :) | 15:41 |
| morganfainberg | bknudson: ^^ | 15:41 |
| emagana | Keystone Experts! Could anyone tell me when the concept of the "hybrid" driver was included in keystone to authenticated against both mysql and ldap | 15:41 |
| marekd | morganfainberg: sure. | 15:41 |
| morganfainberg | emagana: the per-domain drivers became usable in Juno. | 15:42 |
| morganfainberg | emagana: prior to that, you would have needed custom drivers. | 15:42 |
| stevemar | emagana, it became awesome in kilo | 15:42 |
| openstackgerrit | Merged openstack/python-keystoneclient-saml2: Remove unused private classes on tests https://review.openstack.org/171263 | 15:42 |
| emagana | morganfainberg and stevemar: So, prior to Juno I need to use something like: https://github.com/SUSE-Cloud/keystone-hybrid-backend ?? | 15:43 |
| *** richm has quit IRC | 15:43 | |
| morganfainberg | emagana: yes something like that. | 15:43 |
| morganfainberg | emagana: and there were many variations on that theme. | 15:43 |
| *** richm has joined #openstack-keystone | 15:43 | |
| stevemar | yep | 15:43 |
| emagana | morganfainberg: Thanks! We are still in Icehouse :-( Trying to move to Juno ASAP | 15:43 |
| stevemar | emagana, skip juno and go right up to kilo ;) | 15:44 |
| emagana | I'd love that..! | 15:44 |
| dstanek | that's not exactly the same as domain specific backends. we don't really have a hybrid backend. | 15:44 |
| dstanek | it depends on the usecase you have | 15:44 |
| morganfainberg | emagana: and you should! Juno was waaaay better. Though I am biased. Kilo is even better (fernet tokens/non-persistent drivers) are better | 15:44 |
| emagana | morganfainberg: I heard about that! | 15:44 |
| stevemar | dstanek, it's what was made available :( | 15:44 |
| morganfainberg | dstanek: almost all cases the hybrid auth was used, per-domain backends is what was wanted. | 15:44 |
| morganfainberg | dstanek: the fall through is for service accounts | 15:45 |
| emagana | I just need to authenticated against LDAP but I can't create openstack service users in this LDAP, so I need hybrid | 15:45 |
| morganfainberg | Not for mixed / different sources of passwords for he same user. | 15:45 |
| dstanek | morganfainberg: sure, but i don't know what emagana uses it for | 15:45 |
| emagana | dstanek: Just mentioned ! | 15:45 |
| morganfainberg | In fact, I'd say anyone who wants mixed sources of passwords and isn't using federation is insane ;) | 15:45 |
| dstanek | emagana: the domain backends should work for you then | 15:46 |
| morganfainberg | emagana: yeah your use case is 100% the common reason for hybrid backend | 15:46 |
| emagana | dstanek: I need to get familiar with it. It was introduced in Juno, right? | 15:46 |
| dstanek | insane, but that was SUSE enabled :-( | 15:46 |
| dstanek | emagana: i believe so yes. it's actually really easy to use | 15:46 |
| emagana | dstanek: That SUSE driver has a performace issue! | 15:46 |
| morganfainberg | Ctina: ping. https://review.openstack.org/#/c/156870/ here is tokenless auth code we talked about. | 15:47 |
| marekd | stevemar: some juicy stuff for ya: https://review.openstack.org/#/c/176746/8 | 15:48 |
| Ctina | @morganfainberg I was just searching for that, thanks! | 15:48 |
| morganfainberg | Ctina: :) | 15:48 |
| emagana | Thanks All!! | 15:48 |
| morganfainberg | Ctina: it should be super close to being ready to land. | 15:48 |
| Ctina | morganfainberg good to hear | 15:49 |
| stevemar | it's definitely on it's way to landing | 15:49 |
| *** iamjarvo has quit IRC | 15:49 | |
| marekd | samueldmq: ayoung: what API call is henry talking in https://review.openstack.org/#/c/147651/4/specs/backlog/dynamic-policy.rst ? | 15:49 |
| dstanek | uggg...i really hate giving presentations. i don't know why i put myself through this | 15:49 |
| * morganfainberg swaps dstanek's name in for his own for 2 more presentations at the summit >.> | 15:50 | |
| bknudson | dstanek: you look good in a suit. | 15:50 |
| morganfainberg | stevemar: so, I now have more time to look at slides. So... Summit-y things soon? (Sorry for being less-available until now) | 15:51 |
| * dstanek will hide all summit! He needs the beer time anyway. | 15:51 | |
| morganfainberg | dstanek: are you talking on stage at the summit? | 15:51 |
| morganfainberg | Or this a presentation elsewhere? | 15:51 |
| dstanek | morganfainberg: nope. i conference here in Ohio | 15:51 |
| morganfainberg | Ahh | 15:51 |
| dstanek | i am talking OpenStack though | 15:52 |
| morganfainberg | stevemar: you should convince Topol to send you to cloud identity summit in San Diego | 15:52 |
| *** jaosorior has quit IRC | 15:52 | |
| *** Ctina is now known as ctina | 15:52 | |
| dstanek | morganfainberg: http://stirtrek.com/Sessions#Getting-Started-As-An-OpenStack-Contributor | 15:52 |
| morganfainberg | dstanek: aha nice | 15:52 |
| stevemar | morganfainberg, i suspect that wouldn't be hard | 15:53 |
| stevemar | morganfainberg, just finishing up a demo today, then i'm all presentations for the next 2 weeks | 15:54 |
| morganfainberg | stevemar: it's expensive but it's where all the identity companies that do IAM things talk about identity. | 15:54 |
| stevemar | morganfainberg, you going? | 15:54 |
| morganfainberg | stevemar: I'm going because I was asked to talk about keystone on the IaaS track (aws, azure, and google are the others) | 15:54 |
| morganfainberg | They wanted OpenStack representation. | 15:55 |
| stevemar | makes sense | 15:55 |
| morganfainberg | So I think it'll be worth it from a networking pov and to see what others are doing in the IAM cloudy space. | 15:55 |
| ayoung | bknudson, stevemar morganfainberg, "The initial default policy file will cover the rules currently provided by | 15:55 |
| ayoung | policy files from Nova, Neutron, Glance, Cinder, and Keystone." Are there any other Services I should add in there? | 15:55 |
| *** EmilienM is now known as EmilienM|afk | 15:55 | |
| morganfainberg | Maybe it makes sense for a couple keystone folks show up. | 15:55 |
| ayoung | Heat? | 15:56 |
| morganfainberg | stevemar: the conference ticket is like $1600 though since you're not speaking there (I have a $200 off code if that helps) | 15:56 |
| *** emagana has quit IRC | 15:57 | |
| morganfainberg | ayoung: any project tagged as part of the integrated release | 15:57 |
| ayoung | morganfainberg, we have a list of those? | 15:57 |
| morganfainberg | ayoung: the governance repo should be able to tell you that in the project tank | 15:57 |
| morganfainberg | Yaml* | 15:57 |
| morganfainberg | really autocorrect. yaml -> tank?! | 15:58 |
| bknudson | ayoung: ceilometer | 15:58 |
| ayoung | http://git.openstack.org/cgit/openstack/governance/tree/resolutions/20140617-defcore-capabilities-scoring/defcore.csv ? | 15:59 |
| morganfainberg | ctina: let me know if you want me to chase down any other information / reviews for you. | 15:59 |
| ayoung | swift | 15:59 |
| morganfainberg | ayoung: http://git.openstack.org/cgit/openstack/governance/tree/reference/projects.yaml | 15:59 |
| *** emagana has joined #openstack-keystone | 15:59 | |
| morganfainberg | It will have a name: integrated-release | 16:00 |
| morganfainberg | Tag | 16:00 |
| ayoung | morganfainberg, do you think it is OK if default policy round one does a subset of those? | 16:00 |
| openstackgerrit | Merged openstack/keystone: Prohibit invalid ids in subtree and parents list https://review.openstack.org/158720 | 16:01 |
| morganfainberg | ayoung: sure, just target by release to include the integrated tagged projects | 16:01 |
| *** alexsyip has joined #openstack-keystone | 16:01 | |
| morganfainberg | ayoung: it can be done bit-by-bit one project at a time if you want. | 16:02 |
| morganfainberg | :) | 16:02 |
| morganfainberg | It's easy to add new projects once you have a few working. | 16:02 |
| ayoung | morganfainberg, since it is a deconflicting thing, we need to learn the peculiarities. So far, Neutron is by far the most peculiar | 16:02 |
| marekd | samueldmq: ping | 16:03 |
| morganfainberg | Like I said, aim for a few and expand. You could start with nova, neutron, cinder, glance, swift, keystone | 16:03 |
| morganfainberg | ayoung: that would be a very basic OpenStack deployment | 16:03 |
| *** edmondsw has joined #openstack-keystone | 16:04 | |
| morganfainberg | I think swift is going to be the really odd one if it even does policy enforcement like anyone else. | 16:04 |
| *** Bjoern___ has joined #openstack-keystone | 16:05 | |
| *** gyee has joined #openstack-keystone | 16:07 | |
| *** ChanServ sets mode: +v gyee | 16:07 | |
| *** jdennis has quit IRC | 16:12 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 16:13 |
| *** Bjoern___ has left #openstack-keystone | 16:14 | |
| *** amakarov is now known as amakarov_away | 16:36 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Service with no endpoints should not be in catalog https://review.openstack.org/176383 | 16:37 |
| *** gyee has quit IRC | 16:37 | |
| *** lhcheng has joined #openstack-keystone | 16:38 | |
| *** ChanServ sets mode: +v lhcheng | 16:38 | |
| *** iamjarvo has joined #openstack-keystone | 16:41 | |
| samueldmq | marekd, hi, I am back | 16:43 |
| samueldmq | dstanek, hmm, will there be any broadcasting on your talk ? | 16:45 |
| ctina | morganfainberg will do, sorry went to grab lunch :) | 16:47 |
| *** samleon has joined #openstack-keystone | 16:47 | |
| morganfainberg | ctina: lunch > IRC :) | 16:47 |
| * morganfainberg is doing coffee and breakfast. | 16:48 | |
| *** dims has quit IRC | 16:48 | |
| *** dims has joined #openstack-keystone | 16:49 | |
| *** e0ne is now known as e0ne_ | 16:49 | |
| *** e0ne_ is now known as e0ne | 16:50 | |
| *** e0ne has quit IRC | 16:51 | |
| dstanek | samueldmq: no, they are recording audio and will pair it up with the slide - i'm going to submit the same talk to PyOhio which does usually record videos | 16:52 |
| samueldmq | dstanek, nice, please share the links with me if they are open :) | 16:54 |
| morganfainberg | Ooh we should rewrite keystone in nodejs :P | 16:55 |
| * morganfainberg hides from the angry mobs. | 16:55 | |
| dstanek | samueldmq: will do - but it's nothing new for you | 16:55 |
| samueldmq | dstanek, yeah I know, I am interested on getting better on presentations, talk correctly according to the audience etc :p | 16:56 |
| samueldmq | dstanek, not on how to start contributing to openstack, I hope I already started :p | 16:57 |
| dstanek | samueldmq: ah, then you're out of luck - i suck at them - i do them in hopes that i'll get better | 16:57 |
| dstanek | instead of toastmasters i do trial by fire | 16:58 |
| samueldmq | dstanek, hehe nah .. I think you're good :p | 17:00 |
| *** emagana has quit IRC | 17:00 | |
| samueldmq | dstanek, please just share, I liked the subject, sometimes it's hard to explain the basics when you're too deep in : ) | 17:01 |
| samueldmq | morganfainberg, nodejs ? | 17:01 |
| dstanek | samueldmq: that's hipster coding | 17:02 |
| samueldmq | morganfainberg, k give me a weekend ? want it to the summit ? | 17:02 |
| dstanek | samueldmq: yeah, i go over very high level architecture concepts ( just enough for people to understand the size/scope ) and spend most of the time showing how to push and modify changesets | 17:03 |
| samueldmq | dstanek, hipster coding ? what is it ? | 17:03 |
| *** rm_work is now known as rm_work|away | 17:03 | |
| samueldmq | dstanek, nice | 17:03 |
| morganfainberg | samueldmq: should use rust and toml if we want to go crazy. /s | 17:03 |
| dstanek | morganfainberg: brainf*ck | 17:03 |
| morganfainberg | dstanek: might be too readable | 17:04 |
| dstanek | i've been meaning to leave that anyway | 17:04 |
| morganfainberg | Swift in go - interesting concept. | 17:04 |
| morganfainberg | If you missed the ML Topic | 17:04 |
| samueldmq | hummingbird | 17:06 |
| samueldmq | lol | 17:06 |
| *** emagana has joined #openstack-keystone | 17:06 | |
| morganfainberg | Hmm. I see a distinct lack of topol in the channel. | 17:07 |
| morganfainberg | I might have to resort to email. :P | 17:07 |
| *** ayoung is now known as ayoung-afk | 17:10 | |
| *** harlowja_away is now known as harlowja | 17:11 | |
| samueldmq | henrynash, hi , 'Adds inherited column to RoleAssignment PK' already has a +2 | 17:21 |
| samueldmq | henrynash, please consider revisiting it | 17:22 |
| samueldmq | breton, lhcheng cc ^ | 17:22 |
| *** emagana has quit IRC | 17:35 | |
| *** dims_ has joined #openstack-keystone | 17:37 | |
| openstackgerrit | Merged openstack/keystone: Add openstack_project_domain to assertion https://review.openstack.org/172536 | 17:39 |
| *** BAKfr has quit IRC | 17:40 | |
| *** topol has joined #openstack-keystone | 17:43 | |
| *** ChanServ sets mode: +v topol | 17:43 | |
| *** cburgess_ has joined #openstack-keystone | 17:45 | |
| *** dims has quit IRC | 17:46 | |
| *** samleon has quit IRC | 17:46 | |
| *** edmondsw has quit IRC | 17:46 | |
| *** ayoung-afk has quit IRC | 17:47 | |
| *** cburgess has quit IRC | 17:47 | |
| *** jistr has quit IRC | 17:47 | |
| *** Ephur has quit IRC | 17:47 | |
| *** gabriel-bezerra has quit IRC | 17:47 | |
| *** grantbow has quit IRC | 17:47 | |
| *** samueldmq has quit IRC | 17:47 | |
| *** mflobo has quit IRC | 17:47 | |
| *** junhongl has quit IRC | 17:47 | |
| *** mkoderer has quit IRC | 17:47 | |
| *** morganfainberg has quit IRC | 17:47 | |
| *** wpf has quit IRC | 17:47 | |
| *** ptoohill has quit IRC | 17:47 | |
| *** bigjools has quit IRC | 17:47 | |
| *** raildo has quit IRC | 17:48 | |
| *** raildo has joined #openstack-keystone | 17:49 | |
| rodrigods | hi, how can I propose for a bug to be backported? | 17:49 |
| *** samueldmq has joined #openstack-keystone | 17:49 | |
| *** mflobo has joined #openstack-keystone | 17:49 | |
| *** junhongl has joined #openstack-keystone | 17:49 | |
| *** mkoderer has joined #openstack-keystone | 17:49 | |
| *** morganfainberg has joined #openstack-keystone | 17:49 | |
| *** wpf has joined #openstack-keystone | 17:49 | |
| *** ptoohill has joined #openstack-keystone | 17:49 | |
| *** bigjools has joined #openstack-keystone | 17:49 | |
| *** sendak.freenode.net sets mode: +v morganfainberg | 17:49 | |
| bknudson | rodrigods: add kilo-backport-potential to the bug tags | 17:51 |
| *** edmondsw has joined #openstack-keystone | 17:53 | |
| *** ayoung-afk has joined #openstack-keystone | 17:53 | |
| *** gabriel-bezerra has joined #openstack-keystone | 17:54 | |
| bknudson | we should have a python-to-go compiler and then compile that | 17:54 |
| rodrigods | bknudson, thanks... you already did it in the bugs was intending to add :) | 17:56 |
| *** rlt_ has quit IRC | 17:57 | |
| *** harlowja has quit IRC | 17:58 | |
| *** e0ne has joined #openstack-keystone | 18:02 | |
| *** BAKfr has joined #openstack-keystone | 18:02 | |
| bknudson | Do we need a new bp for https://review.openstack.org/#/c/132122/ ? | 18:06 |
| bknudson | morganfainberg: ptl question ^ | 18:06 |
| *** aix has quit IRC | 18:07 | |
| *** iamjarvo has quit IRC | 18:08 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Refactor _create_attribute_statement IdP method https://review.openstack.org/172647 | 18:11 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add openstack_user_domain to assertion https://review.openstack.org/172562 | 18:11 |
| *** EmilienM|afk is now known as EmilienM | 18:11 | |
| *** emagana has joined #openstack-keystone | 18:12 | |
| rodrigods | bknudson, should I repropose https://review.openstack.org/#/c/172536/ targeting to stable/kilo? | 18:13 |
| bknudson | rodrigods: sure | 18:14 |
| *** iamjarvo has joined #openstack-keystone | 18:14 | |
| openstackgerrit | Merged openstack/keystoneauth: Change keystoneclient to keystoneauth in docs https://review.openstack.org/178972 | 18:21 |
| *** rm_work|away is now known as rm_work | 18:23 | |
| *** mattfarina has quit IRC | 18:31 | |
| *** rm_work is now known as rm_work|away | 18:35 | |
| *** esmute has quit IRC | 18:35 | |
| *** esmute has joined #openstack-keystone | 18:35 | |
| *** ctina_ has joined #openstack-keystone | 18:37 | |
| *** ctina has quit IRC | 18:41 | |
| *** ctina_ has quit IRC | 18:42 | |
| *** iamjarvo has quit IRC | 18:43 | |
| *** iamjarvo has joined #openstack-keystone | 18:47 | |
| *** rm_work|away is now known as rm_work | 18:48 | |
| *** topol has quit IRC | 18:58 | |
| *** iamjarvo has quit IRC | 19:03 | |
| stevemar | lhcheng, around? | 19:12 |
| lhcheng | stevemar: yes | 19:12 |
| *** iamjarvo has joined #openstack-keystone | 19:13 | |
| stevemar | lhcheng, when you played with websso, did you try assigning a user 2 roles on different projects? | 19:13 |
| stevemar | i think DOA is having some issues with that | 19:13 |
| samueldmq | ayoung-afk, let me know when you're available | 19:14 |
| stevemar | or i'm using an old version | 19:14 |
| samueldmq | ayoung-afk, have something to discuss regarding the spec, we've got some reviews on there | 19:14 |
| lhcheng | stevemar: only 1 role but multiple projects | 19:15 |
| lhcheng | stevemar: the initial patch from thai doesn't work on multiple projects | 19:15 |
| stevemar | lhcheng, oh? | 19:16 |
| lhcheng | stevemar: should be fixed with the merged patch | 19:16 |
| stevemar | lhcheng, when was it merged? | 19:16 |
| stevemar | lhcheng, the one we reviewed right? | 19:16 |
| lhcheng | stevemar: yes | 19:16 |
| lhcheng | stevemar: april 1st | 19:17 |
| lhcheng | https://review.openstack.org/#/c/136178/ | 19:18 |
| stevemar | hmm weird | 19:18 |
| stevemar | still having trouble with multi projects | 19:18 |
| stevemar | maybe it's just me | 19:18 |
| lhcheng | stevemar: are you testing from master? | 19:19 |
| lhcheng | stevemar: ah, I think I know what's the problem | 19:19 |
| lhcheng | stevemar: did you change the session backend for horizon? | 19:20 |
| lhcheng | stevemar: try this: http://docs.openstack.org/developer/horizon/topics/deployment.html#local-memory-cache | 19:20 |
| stevemar | lhcheng, i am testing from master | 19:25 |
| stevemar | and no, i didn't touch that setting, should i? | 19:25 |
| lhcheng | stevemar: for keystone v3, the size of the catalog is larger. the default session backend of horizon can't handle it. | 19:26 |
| stevemar | so what do i do about that? | 19:27 |
| stevemar | oh if there are 2 projects in the catalog it'll crap out? | 19:27 |
| lhcheng | stevemar: for dev setup, update the local_settings.py with http://docs.openstack.org/developer/horizon/topics/deployment.html#local-memory-cache | 19:27 |
| lhcheng | stevemar: it could even crap out with just 1 project, if the deployment have a lot of services configured (bigger catalog) | 19:29 |
| *** dguerri is now known as _dguerri | 19:32 | |
| marekd | morganfainberg: i knew sooner or later somebody would try to implement part of OpenStack in Go! I should have said that earlier on Twitter to have some proof (maybe i will find some IRC logs as i am sure i said it here!) | 19:33 |
| morganfainberg | marekd: haha | 19:33 |
| *** wolsen has quit IRC | 19:33 | |
| *** d0ugal has quit IRC | 19:33 | |
| *** grantbow has joined #openstack-keystone | 19:33 | |
| *** wolsen_ has joined #openstack-keystone | 19:33 | |
| *** grantbow has quit IRC | 19:33 | |
| *** grantbow has joined #openstack-keystone | 19:33 | |
| dstanek | marekd: i'm just wondering what happens when Google abandons Go like it does with everything else | 19:33 |
| *** trey has quit IRC | 19:33 | |
| *** navid__ has quit IRC | 19:33 | |
| morganfainberg | lhcheng: stevemar: we need to figure out how to handle the SC in horizon | 19:33 |
| morganfainberg | stevemar: stevemar: I think we can probably be a lot smarter about it. | 19:33 |
| *** cburgess_ has quit IRC | 19:34 | |
| morganfainberg | lhcheng: ^ | 19:34 |
| *** navid__ has joined #openstack-keystone | 19:34 | |
| *** cburgess has joined #openstack-keystone | 19:34 | |
| *** d0ugal has joined #openstack-keystone | 19:34 | |
| lhcheng | morganfainberg: I put a topic in the etherpad to discuss the token mgmt and SC in horizon | 19:34 |
| lhcheng | morganfainberg: not sure though if that should go into a working session | 19:34 |
| morganfainberg | ok so i'm going to put together a proposal for summit sessions | 19:34 |
| *** trey has joined #openstack-keystone | 19:35 | |
| marekd | dstanek: i think this has enough or might get enough momentym to be picked by the 'community' and later some companies with $$$ | 19:35 |
| morganfainberg | today. | 19:35 |
| lhcheng | or discuss it on Friday | 19:35 |
| morganfainberg | will bug people to review shortly | 19:35 |
| morganfainberg | before i push to cheddar (sched.org proxy thing) | 19:35 |
| marekd | dstanek: who stands behind Python? who pays for that? | 19:35 |
| marekd | dstanek: or a Go Fundation will be created :-) | 19:35 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Reorganize exceptions https://review.openstack.org/178910 | 19:35 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Rename _discover module https://review.openstack.org/178911 | 19:36 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove cli functions from utils https://review.openstack.org/178922 | 19:36 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove region_name from catalog https://review.openstack.org/178914 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove the AccessInfo Factory https://review.openstack.org/178915 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove management_url from AccessInfo https://review.openstack.org/178912 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove auth_url property from AccessInfo https://review.openstack.org/178913 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Don't save version into the dictionary https://review.openstack.org/178918 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove the factory from service catalog https://review.openstack.org/178919 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove region_name from service catalog https://review.openstack.org/178916 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Cannot retrieve a token from service catalog https://review.openstack.org/178917 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make ServiceCatalog take an actual catalog https://review.openstack.org/178920 | 19:38 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: AccessInfo is not a dict https://review.openstack.org/178921 | 19:38 |
| marekd | ^^^ whoa | 19:38 |
| marekd | morganfainberg: dstanek: wow, suprisingly the ML thread has a very positive feedback. | 19:40 |
| marekd | i was expecting something opposite. | 19:40 |
| dstanek | i haven't read the thread, but not i'm curious | 19:42 |
| *** afaranha has joined #openstack-keystone | 19:49 | |
| lhcheng | morganfainberg: from the list of things we want to do for Liberty: https://etherpad.openstack.org/p/keystone-liberty-priority-specs | 19:52 |
| lhcheng | morganfainberg: how do I figure out which don't have anyone working on it yet? | 19:53 |
| morganfainberg | lhcheng: I am [now that I'm home] going to send out our priority list | 19:53 |
| morganfainberg | that we discussed in the Meeting. | 19:53 |
| morganfainberg | or well maybe i'll just update that etherpad with the definitive list. | 19:53 |
| * morganfainberg shrugs. | 19:54 | |
| lhcheng | morganfainberg: okay, I might be able to help out on a couple. I can take whichever work that doesn't have an owner yet. | 19:54 |
| morganfainberg | lhcheng: great | 19:55 |
| *** e0ne has quit IRC | 20:01 | |
| ayoung-afk | stevemar, I'm back | 20:06 |
| *** ayoung-afk is now known as ayoung | 20:06 | |
| stevemar | ayoung, wonderful, but i wasn't pinging you hehe | 20:07 |
| stevemar | maybe it was samueldmq ? | 20:07 |
| *** gordc has quit IRC | 20:10 | |
| ayoung | stevemar, samueldmq vhat is deeeeference? | 20:13 |
| *** gordc has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Deprecate auth_token authentication https://review.openstack.org/127066 | 20:19 |
| *** harlowja has joined #openstack-keystone | 20:20 | |
| *** jdennis has joined #openstack-keystone | 20:21 | |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Change auth_token to use keystoneclient https://review.openstack.org/144248 | 20:24 |
| ayoung | bknudson, we still chasing that? I thought it was in long ago | 20:26 |
| bknudson | ayoung: it was blocked for a long time on keystoneclient release and global-requirements update. | 20:27 |
| ayoung | bknudson, it can go in now? | 20:27 |
| bknudson | ayoung: yes, global-requirements was updated with the version of keystoneclient that has the new apis that were needed. | 20:28 |
| ayoung | bknudson, excellent. lets get that in. THanks for caring | 20:28 |
| bknudson | I think it should make things a lot cleaner. | 20:28 |
| *** emagana has quit IRC | 20:30 | |
| *** alexsyip has quit IRC | 20:33 | |
| *** _dguerri is now known as dguerri | 20:36 | |
| *** alexsyip has joined #openstack-keystone | 20:37 | |
| *** harlowja has quit IRC | 20:45 | |
| *** harlowja has joined #openstack-keystone | 20:45 | |
| *** htruta has quit IRC | 20:46 | |
| *** raildo has quit IRC | 20:46 | |
| *** edmondsw has quit IRC | 20:52 | |
| *** pnavarro has quit IRC | 20:59 | |
| marekd | BTW seen that: https://code.visualstudio.com/Download ? | 21:04 |
| *** josecastroleon has joined #openstack-keystone | 21:04 | |
| *** jdennis has quit IRC | 21:07 | |
| *** harlowja has quit IRC | 21:07 | |
| *** josecastroleon has quit IRC | 21:07 | |
| stevemar | nkinder, marekd ayoung talk me off the ledge here... | 21:08 |
| stevemar | how can i have two idps for single sign on that are both openid connect? | 21:08 |
| stevemar | if i create two idp entries - and they have distinct remote-ids... | 21:09 |
| stevemar | 2 different protocols work | 21:09 |
| stevemar | but not 2 idps with same protocol? | 21:09 |
| ayoung | stevemar, today you cannot. I raised that in the websso work and it was too late for Kilo | 21:10 |
| stevemar | gah | 21:10 |
| stevemar | well, work for liberty | 21:10 |
| stevemar | i don't even know how i want to approach taht | 21:10 |
| marekd | stevemar: DS? | 21:12 |
| marekd | stevemar: Discovery Service | 21:12 |
| stevemar | marekd, right, that magical thing | 21:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystone-specs: Deprecations https://review.openstack.org/153881 | 21:13 |
| bknudson | ^ is simply proposing to use debtcollector for deprecations in keystoneclient. | 21:13 |
| bknudson | I thought we'd use regular python warnings but debtcollector provides some more functionality, and it's oslo so might as well support it. | 21:14 |
| ayoung | stevemar, so, I don;'t think we awant to enumerate by protocol | 21:14 |
| ayoung | people know who they are supposed to talk to | 21:14 |
| ayoung | so we enumerate by IdP | 21:14 |
| ayoung | if one IdP wants to support mutliplt protocols...they show up as two entries | 21:15 |
| ayoung | on the horizon side, we make each entry a 3pl | 21:15 |
| stevemar | ayoung, i thought we were against enumerating idps, for $security_reason | 21:15 |
| ayoung | "String to show user" , "idp_id", "protocol" | 21:15 |
| ayoung | stevemar, we need both | 21:15 |
| marekd | ayoung: why would even an IdP (with one url) would need to support more than protocol ? | 21:16 |
| ayoung | But if we enumerate "anything" an attacker gets that info | 21:16 |
| ayoung | marekd, I don;t know | 21:16 |
| ayoung | marekd, maybe they are transitioning | 21:16 |
| marekd | ..... | 21:16 |
| ayoung | marekd, the short of it is we need both pieces of info | 21:16 |
| ayoung | idp_id and protocol | 21:17 |
| ayoung | the user visible string is attached to that tuple | 21:17 |
| marekd | stevemar: before kilo, i made a poc setup of a DS | 21:18 |
| marekd | provided by a shib | 21:18 |
| marekd | stevemar: i am more than sure i was posting you the links, also pasting them in some reviews. | 21:18 |
| *** joesavak has joined #openstack-keystone | 21:19 | |
| marekd | stevemar: https://wiki.shibboleth.net/confluence/display/EDS10/1.+Overview | 21:20 |
| marekd | ayoung: nkinder ^^ | 21:20 |
| ayoung | marekd, stevemar so I would think that Horizon would show the public list of IdPs, and for anything that people want to keep private, you would run a dedicated Horizon on a suburl or something | 21:21 |
| *** iurygregory has quit IRC | 21:22 | |
| stevemar | i suppose we can chat about this at the summit | 21:22 |
| *** jsavak has quit IRC | 21:22 | |
| ayoung | Since there is going to be a redirect, and the redirect is going to have the public URL of the IdP id, you can't enumerate without advertising "Hey, here is my client list" | 21:22 |
| marekd | stevemar: we can. | 21:23 |
| marekd | stevemar: for far you can try configuring distinct URLs so they 'server' distinct oidc idps | 21:24 |
| marekd | idp/steve/protocols/oidc/auth will redirect to Steve's IdP, while /idp/marek/protocols/oidc/auth to mine. | 21:25 |
| marekd | it's a matter of apache/mod configuration. | 21:25 |
| stevemar | marekd, but horizon/doa will always point to os-federation/websso | 21:26 |
| marekd | stevemar: ah, right, forgot that. | 21:26 |
| marekd | anyway, i suspect shib DS could also work for OIDC | 21:27 |
| marekd | i saw the source code and it wasn't complicated. | 21:27 |
| marekd | mostly html | 21:27 |
| marekd | so it wasn't even 'code' | 21:27 |
| stevemar | marekd, yeah, it wouldn't work right now -- federated_sso_auth is expecting an env. var that identifies the idp (remote_id) | 21:29 |
| stevemar | by that time it's already been configured | 21:29 |
| *** jdennis has joined #openstack-keystone | 21:29 | |
| marekd | stevemar: hum ? federated_sso_auth is keystone, right? | 21:30 |
| stevemar | marekd, yeah | 21:30 |
| stevemar | horizon will always point to /v3/auth/OS-FEDERATION/websso/{protocol} | 21:31 |
| marekd | i know that. | 21:31 |
| nkinder | the protocol is just a name, so you *could* do something hacky like make it oidc1, oidc2, right? | 21:31 |
| stevemar | which can only be protected by one mod entry: https://gist.github.com/stevemart/4b41bd5437048a7fdfab#file-websso_federation_setup-sh-L107-L111 | 21:31 |
| stevemar | nkinder, hmm | 21:31 |
| stevemar | maybe maybe | 21:32 |
| nkinder | like I said, hacky... | 21:32 |
| nkinder | but protocol is just used as a string IIRC | 21:32 |
| *** iamjarvo has quit IRC | 21:32 | |
| stevemar | something to try :D | 21:32 |
| marekd | stevemar: hold on, you are worried that mod_oidc will let you configure only one trusted IdP ? | 21:32 |
| nkinder | gotta drop to drive home... bbiab | 21:32 |
| *** nkinder has quit IRC | 21:32 | |
| stevemar | marekd, no no, i know it can configure many | 21:33 |
| stevemar | marekd, meh, know what, let me hack around with this for a bit | 21:33 |
| stevemar | as nkinder just said, i also have to go | 21:34 |
| stevemar | marekd, o/ | 21:34 |
| marekd | \o | 21:34 |
| marekd | me too | 21:35 |
| *** alexsyip has quit IRC | 21:38 | |
| *** emagana has joined #openstack-keystone | 21:39 | |
| *** stevemar has quit IRC | 21:39 | |
| *** alexsyip has joined #openstack-keystone | 21:50 | |
| *** jdennis has quit IRC | 21:52 | |
| *** jdennis has joined #openstack-keystone | 21:55 | |
| *** jsavak has joined #openstack-keystone | 21:55 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove setUp for RevokeTests https://review.openstack.org/179259 | 21:55 |
| *** Rockyg has joined #openstack-keystone | 21:58 | |
| *** lhcheng has quit IRC | 21:58 | |
| *** joesavak has quit IRC | 21:58 | |
| *** emagana has quit IRC | 21:59 | |
| *** bknudson has quit IRC | 22:01 | |
| *** jdennis has quit IRC | 22:03 | |
| *** dims has joined #openstack-keystone | 22:04 | |
| *** dims_ has quit IRC | 22:05 | |
| *** lhcheng has joined #openstack-keystone | 22:05 | |
| *** ChanServ sets mode: +v lhcheng | 22:05 | |
| *** arunkant_ has quit IRC | 22:11 | |
| *** jsavak has quit IRC | 22:11 | |
| *** gyee has joined #openstack-keystone | 22:13 | |
| *** ChanServ sets mode: +v gyee | 22:13 | |
| *** jamielennox|away is now known as jamielennox | 22:16 | |
| *** iamjarvo has joined #openstack-keystone | 22:19 | |
| *** richm has quit IRC | 22:23 | |
| *** jdennis has joined #openstack-keystone | 22:26 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:27 | |
| *** packet has quit IRC | 22:30 | |
| *** topol has joined #openstack-keystone | 22:34 | |
| *** ChanServ sets mode: +v topol | 22:34 | |
| *** chlong has joined #openstack-keystone | 22:36 | |
| *** emagana has joined #openstack-keystone | 22:36 | |
| *** richm has joined #openstack-keystone | 22:40 | |
| *** emagana has quit IRC | 22:42 | |
| *** jdennis has quit IRC | 22:45 | |
| *** nkinder has joined #openstack-keystone | 22:46 | |
| *** emagana has joined #openstack-keystone | 22:46 | |
| lhcheng | gyee: is this issue similar to what you hit before? https://bugs.launchpad.net/keystone/+bug/1450344 | 22:49 |
| openstack | Launchpad bug 1450344 in Keystone "Invalid SQL Identity Assertion - Load Config from Database" [Undecided,New] | 22:49 |
| lhcheng | gyee: I recall you reported a bug related to loading config from SQL. | 22:50 |
| lhcheng | gyee: nm, found the bug you reported, not the same. | 22:58 |
| *** gordc has quit IRC | 22:58 | |
| gyee | lhcheng, no, mine was related to keystone-manage not being initialized properly | 22:58 |
| gyee | 1450344 is interesting, looks like there's a change of functionality | 22:59 |
| lhcheng | gyee: yeah, this seems critical | 23:00 |
| lhcheng | haven't got the chance to reproduce it yet | 23:00 |
| gyee | domain-specific driver for the non-default domain can't be sql versus only one domain-specific driver can be sql | 23:01 |
| gyee | I don't think we ever make that point clear | 23:01 |
| lhcheng | gyee: non-default domain can't be on non-sql identity backend? | 23:03 |
| lhcheng | why not? | 23:03 |
| gyee | looks like a backward incompatible change | 23:04 |
| gyee | https://github.com/openstack/keystone/blob/stable/juno/doc/source/configuration.rst | 23:05 |
| gyee | "Although Keystone supports multiple LDAP backends via domain specific configuration files, it currently only supports one SQL backend. This could be either the default driver or a single domain-specific backend, perhaps for storing service users in a predominantly LDAP installation." | 23:05 |
| morganfainberg | gyee: that has been the case since inception of per-domain backends | 23:05 |
| morganfainberg | gyee: you cannot have more than one SQL driver | 23:05 |
| gyee | yeah, you're right | 23:05 |
| gyee | we probably didn't enforce it correctly in Juno | 23:06 |
| morganfainberg | we had a bug in the enforcement logicx | 23:06 |
| morganfainberg | but it would cause weird errors | 23:06 |
| morganfainberg | if you managed to do it | 23:06 |
| morganfainberg | i also love that we don't get people testing this stuff via RC window. | 23:07 |
| morganfainberg | :P | 23:07 |
| gyee | so do we have a tough-shit-wont-fix status for the bug? :) | 23:07 |
| *** iamjarvo has quit IRC | 23:07 | |
| morganfainberg | i'm responding to the bug now | 23:08 |
| lhcheng | gyee: that note is confusing.. So the SQL backend can be used only for default domain? | 23:09 |
| gyee | lhcheng, yes, as a former ESL student that's my interpretation :) | 23:10 |
| *** darrenc is now known as darrenc_afk | 23:11 | |
| gyee | morganfainberg, any part of Keystone can be reimplemented in Go? | 23:16 |
| lhcheng | gyee: in our unit tests, the Default is configured with SQL and the non-default with LDAP :P | 23:16 |
| lhcheng | https://github.com/openstack/keystone/tree/master/keystone/tests/unit/config_files/domain_configs_one_sql_one_ldap | 23:16 |
| lhcheng | gyee: sorry, I meant the other way around | 23:17 |
| lhcheng | Default is configured with LDAP and the non-default with SQL :P | 23:17 |
| gyee | lhcheng, so even our unit tests confirmed that | 23:18 |
| lhcheng | morganfainberg: so this should be the other way around? | 23:18 |
| gyee | I thought there's a blog out there that uses this technique: use LDAP as default and SQL as non-default | 23:19 |
| gyee | though I can't seem to find it at the moment | 23:19 |
| morganfainberg | lhcheng: so wait what? | 23:23 |
| morganfainberg | lhcheng: we can support a single SQL driver. | 23:24 |
| morganfainberg | lhcheng: the correct configuration is the default driver is SQL, a specific domain is overridden with LDAP | 23:24 |
| lhcheng | morganfainberg: confirming if the unit tests is wrong: Default is configured with LDAP and the non-default with SQL | 23:25 |
| *** _cjones_ has quit IRC | 23:25 | |
| *** _cjones_ has joined #openstack-keystone | 23:26 | |
| morganfainberg | lhcheng: we have a test allowing that right? | 23:26 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Merge tag '2015.1.0' https://review.openstack.org/179288 | 23:26 |
| morganfainberg | lhcheng: we previously supported a single SQL driver. Either a per-domain config *or* as the default, but not default driver *and* per-domain | 23:26 |
| lhcheng | https://github.com/openstack/keystone/tree/master/keystone/tests/unit/config_files/domain_configs_one_sql_one_ldap | 23:26 |
| lhcheng | morganfainberg: in the config above, the Default is configured with LDAP | 23:27 |
| morganfainberg | that should work fine | 23:27 |
| *** rm_work is now known as rm_work|away | 23:27 | |
| morganfainberg | as long as the main keystone.conf [identity]/driver=LDAP | 23:27 |
| *** rm_work|away is now known as rm_work | 23:27 | |
| morganfainberg | and the per-domain [domain1] is SQL | 23:27 |
| morganfainberg | if [domain1] is SQL and main conf is also SQL, boom | 23:28 |
| morganfainberg | no go | 23:28 |
| *** rm_work is now known as rm_work|away | 23:29 | |
| lhcheng | morganfainberg: ah okay, it is clearer now. I got confused with the term "default driver", not really sure what it is referring to. | 23:29 |
| lhcheng | morganfainberg: that makes sense | 23:30 |
| morganfainberg | yeah the main driver is configured in keystone.conf | 23:30 |
| morganfainberg | you then can supply a config for a specific domain | 23:30 |
| morganfainberg | no matter how it is configured, you can have 1 and only 1 driver be the SQL driver. | 23:30 |
| morganfainberg | it is recommended that the SQL driver be the one specified in the ksytone.conf | 23:30 |
| morganfainberg | vs. a per-domain specific one | 23:30 |
| morganfainberg | because then you can have multiple domains w/o needing a specific driver for them | 23:31 |
| morganfainberg | and only override the domains you want to source form a non-specific backend | 23:31 |
| *** darrenc_afk is now known as darrenc | 23:36 | |
| lhcheng | morganfainberg: sounds like a best practice worth documenting :) maybe something that could go into the publications idea you mentioned in the previous meeting | 23:37 |
| morganfainberg | yep | 23:37 |
| *** emagana has quit IRC | 23:38 | |
| gyee | morganfainberg, lhcheng, so there's a difference between "default driver" versus "defaut domain driver"? | 23:40 |
| gyee | I think that's the confusing part | 23:40 |
| lhcheng | gyee: heh I mis-interpreted that part. But when morganfainberg mentioned that default driver refers to keystone.conf [identity]/driver=LDAP , everything makes sense. | 23:41 |
| *** emagana has joined #openstack-keystone | 23:41 | |
| *** jdennis has joined #openstack-keystone | 23:46 | |
| *** ncoghlan has joined #openstack-keystone | 23:51 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Base Documentation changes https://review.openstack.org/179298 | 23:54 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!