| *** samueldmq_ has joined #openstack-keystone | 00:00 | |
| *** bknudson has joined #openstack-keystone | 00:00 | |
| *** ChanServ sets mode: +v bknudson | 00:00 | |
| *** dims has joined #openstack-keystone | 00:00 | |
| *** ericksonsantos has joined #openstack-keystone | 00:15 | |
| *** blewis has quit IRC | 00:16 | |
| *** blewis has joined #openstack-keystone | 00:18 | |
| *** erickson has quit IRC | 00:18 | |
| *** iamjarvo has joined #openstack-keystone | 00:25 | |
| *** ankita_wagh has joined #openstack-keystone | 00:33 | |
| *** samleon has quit IRC | 00:33 | |
| *** ankita_w_ has quit IRC | 00:35 | |
| *** erickson has joined #openstack-keystone | 00:36 | |
| *** ericksonsantos has quit IRC | 00:39 | |
| *** packet has joined #openstack-keystone | 00:44 | |
| *** lhcheng has quit IRC | 00:48 | |
| Raildo_ | Quicky doubt, is there some size limit for a patch? for exemple, if a change has more than 600 LOC, I need to break this in more than one. | 00:53 |
|---|---|---|
| Raildo_ | *quickly | 00:53 |
| *** diegows has quit IRC | 00:53 | |
| *** iamjarvo has quit IRC | 00:53 | |
| bknudson | Raildo_: changes should be split up if they can be. | 00:55 |
| bknudson | make each patch a logical unit | 00:55 |
| bknudson | reviews will go faster | 00:55 |
| *** ChanServ changes topic to "Liberty Development Open | Review Liberty Specs | See you at the summit!" | 00:55 | |
| -openstackstatus- NOTICE: Gerrit has been downgraded to version 2.8 due to the issues observed today. Please report further problems in #openstack-infra. | 00:55 | |
| Raildo_ | bknudson, right... I was thinking about it, sometimes that is huge changes, and this make difficult to review and it's difficult to the reviewer see if the change can be splitted. | 00:57 |
| *** ankita_wagh has quit IRC | 01:05 | |
| *** ankita_wagh has joined #openstack-keystone | 01:06 | |
| *** gyee has quit IRC | 01:12 | |
| *** Raildo_ has quit IRC | 01:17 | |
| *** ankita_wagh has quit IRC | 01:17 | |
| *** ankita_wagh has joined #openstack-keystone | 01:17 | |
| *** redrobot has quit IRC | 01:25 | |
| *** stevemar has joined #openstack-keystone | 01:25 | |
| *** ChanServ sets mode: +v stevemar | 01:25 | |
| *** redrobot has joined #openstack-keystone | 01:26 | |
| *** redrobot is now known as Guest20306 | 01:26 | |
| *** dstanek has quit IRC | 01:26 | |
| *** dstanek has joined #openstack-keystone | 01:26 | |
| *** ChanServ sets mode: +v dstanek | 01:26 | |
| *** alexsyip has quit IRC | 01:27 | |
| *** _cjones_ has quit IRC | 01:28 | |
| *** blewis has quit IRC | 01:33 | |
| *** ankita_wagh has quit IRC | 01:36 | |
| *** ankita_wagh has joined #openstack-keystone | 01:36 | |
| *** browne has quit IRC | 01:39 | |
| *** zzzeek has quit IRC | 01:40 | |
| *** ankita_wagh has quit IRC | 01:41 | |
| openstackgerrit | Merged openstack/keystone: Remove support for loading auth plugin by class https://review.openstack.org/171906 | 01:42 |
| *** iamjarvo has joined #openstack-keystone | 01:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use stevedore for auth drivers https://review.openstack.org/182102 | 01:52 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Short names for auth plugins https://review.openstack.org/182107 | 01:52 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Tests don't override default auth methods/plugins https://review.openstack.org/182137 | 01:52 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:54 | |
| *** ankita_wagh has joined #openstack-keystone | 01:55 | |
| *** ankita_wagh has quit IRC | 01:55 | |
| *** ankita_wagh has joined #openstack-keystone | 01:56 | |
| *** ericksonsantos has joined #openstack-keystone | 01:59 | |
| *** packet has quit IRC | 02:00 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182138 | 02:00 |
| *** erickson has quit IRC | 02:02 | |
| *** erickson has joined #openstack-keystone | 02:03 | |
| *** ericksonsantos has quit IRC | 02:03 | |
| *** ericksonsantos has joined #openstack-keystone | 02:05 | |
| *** bknudson has quit IRC | 02:08 | |
| *** erickson has quit IRC | 02:09 | |
| *** ericksonsantos has quit IRC | 02:11 | |
| *** browne has joined #openstack-keystone | 02:13 | |
| *** samueldmq_ has quit IRC | 02:14 | |
| *** hightall has joined #openstack-keystone | 02:14 | |
| hightall | how can I update user password through rest api? | 02:15 |
| hightall | I debug "keystone user-password-update", but I can not see where is the new password written. | 02:16 |
| hightall | Only see "PUT /v2.0/users/35b3026e368c4bbba57765c417b69a79/OS-KSADM/password" | 02:16 |
| hightall | why? | 02:16 |
| *** lhcheng has joined #openstack-keystone | 02:18 | |
| *** richm has quit IRC | 02:18 | |
| *** ChanServ sets mode: +v lhcheng | 02:18 | |
| *** yasu_ has joined #openstack-keystone | 02:19 | |
| *** lhcheng has quit IRC | 02:19 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 02:21 | |
| hightall | anybody can help? | 02:28 |
| *** spandhe has quit IRC | 02:33 | |
| stevemar | hightall, the new password won't be in the logs | 02:36 |
| *** ajayaa has joined #openstack-keystone | 02:36 | |
| hightall | stevemar, so I need look at the code | 02:37 |
| stevemar | hightall, the owning user can just create a request to the documented API | 02:38 |
| hightall | stevemar, yes I know it, but I want to force reset user's password through admin, when user forget the password. | 02:39 |
| stevemar | hightall, should be the same request | 02:40 |
| stevemar | the policy should allow for admin or owning user | 02:40 |
| *** dims has quit IRC | 02:45 | |
| *** packet has joined #openstack-keystone | 02:45 | |
| *** packet has quit IRC | 02:47 | |
| hightall | stevemar, I have seen the code in keystoneclient, and the body is {"user": {"id": base.getid(user), "password": password}} | 03:00 |
| *** davechen has joined #openstack-keystone | 03:00 | |
| stevemar | nkinder, ping | 03:01 |
| nkinder | stevemar: hey | 03:01 |
| stevemar | nkinder, anyway we could meetup a tinch earlier | 03:01 |
| nkinder | stevemar: sure. When were you thinking? | 03:01 |
| stevemar | i leave at 4pm on wednesdays for rec league sports | 03:01 |
| stevemar | 1 hr earlier is fine with me | 03:02 |
| stevemar | or literally all of tomorrow :P | 03:02 |
| nkinder | I'm swamped tomorrow | 03:03 |
| nkinder | I'll move it to be a bit earlier on Wed. | 03:03 |
| stevemar | cool with me, thanks a lot | 03:04 |
| nkinder | no problem | 03:04 |
| *** davechen1 has joined #openstack-keystone | 03:07 | |
| *** lhcheng has joined #openstack-keystone | 03:08 | |
| *** ChanServ sets mode: +v lhcheng | 03:08 | |
| *** davechen has quit IRC | 03:08 | |
| *** lhcheng has quit IRC | 03:11 | |
| *** davechen has joined #openstack-keystone | 03:12 | |
| *** ankita_wagh has quit IRC | 03:12 | |
| *** davechen1 has quit IRC | 03:14 | |
| *** dstanek has quit IRC | 03:16 | |
| *** dstanek has joined #openstack-keystone | 03:19 | |
| *** ChanServ sets mode: +v dstanek | 03:19 | |
| *** stevemar has quit IRC | 03:31 | |
| *** ankita_wagh has joined #openstack-keystone | 03:32 | |
| *** lhcheng has joined #openstack-keystone | 03:38 | |
| *** ChanServ sets mode: +v lhcheng | 03:38 | |
| *** lhcheng_ has joined #openstack-keystone | 03:40 | |
| *** lhcheng has quit IRC | 03:42 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add missing part for `token` https://review.openstack.org/182147 | 03:42 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add missing part for `token` object https://review.openstack.org/182147 | 03:45 |
| *** davechen has left #openstack-keystone | 03:48 | |
| *** mabrams has joined #openstack-keystone | 04:01 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 04:05 | |
| *** spandhe has joined #openstack-keystone | 04:11 | |
| *** spandhe_ has joined #openstack-keystone | 04:12 | |
| *** spandhe has quit IRC | 04:16 | |
| *** spandhe_ is now known as spandhe | 04:16 | |
| *** _cjones_ has joined #openstack-keystone | 04:28 | |
| *** ajayaa has quit IRC | 04:29 | |
| *** dims has joined #openstack-keystone | 04:33 | |
| *** _cjones_ has quit IRC | 04:33 | |
| *** dims has quit IRC | 04:38 | |
| *** lhcheng_ has quit IRC | 04:43 | |
| *** yasu_ has quit IRC | 04:52 | |
| *** stevemar has joined #openstack-keystone | 04:54 | |
| *** ChanServ sets mode: +v stevemar | 04:54 | |
| *** markvoelker has joined #openstack-keystone | 04:54 | |
| *** ayoung has quit IRC | 05:06 | |
| *** ericksonsantos has joined #openstack-keystone | 05:07 | |
| *** ericksonsantos has quit IRC | 05:11 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add missing part for `token` object https://review.openstack.org/182147 | 05:12 |
| *** iamjarvo has quit IRC | 05:13 | |
| *** davechen has joined #openstack-keystone | 05:13 | |
| *** lhcheng has joined #openstack-keystone | 05:16 | |
| *** ChanServ sets mode: +v lhcheng | 05:16 | |
| *** ajayaa has joined #openstack-keystone | 05:23 | |
| *** arunkant has quit IRC | 05:48 | |
| *** topol has joined #openstack-keystone | 05:58 | |
| *** ChanServ sets mode: +v topol | 05:58 | |
| *** ankita_wagh has quit IRC | 06:02 | |
| *** arunkant has joined #openstack-keystone | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/179331 | 06:06 |
| *** hugokuo has quit IRC | 06:07 | |
| *** dstanek has quit IRC | 06:08 | |
| *** dstanek has joined #openstack-keystone | 06:09 | |
| *** ChanServ sets mode: +v dstanek | 06:09 | |
| *** hugokuo has joined #openstack-keystone | 06:09 | |
| *** ankita_wagh has joined #openstack-keystone | 06:11 | |
| *** mflobo has quit IRC | 06:14 | |
| *** markvoelker has quit IRC | 06:15 | |
| *** mflobo has joined #openstack-keystone | 06:16 | |
| *** afazekas_ has joined #openstack-keystone | 06:16 | |
| *** ankita_w_ has joined #openstack-keystone | 06:17 | |
| *** ankita_w_ has quit IRC | 06:17 | |
| *** markvoelker has joined #openstack-keystone | 06:18 | |
| *** ankita_w_ has joined #openstack-keystone | 06:18 | |
| *** ankita_wagh has quit IRC | 06:21 | |
| *** topol has quit IRC | 06:29 | |
| *** spandhe has quit IRC | 06:39 | |
| *** lhcheng_ has joined #openstack-keystone | 06:39 | |
| *** lhcheng has quit IRC | 06:43 | |
| *** kiran-r has joined #openstack-keystone | 06:50 | |
| *** kiran-r has quit IRC | 06:55 | |
| *** stevemar has quit IRC | 06:57 | |
| *** lhcheng_ has quit IRC | 07:00 | |
| *** browne has quit IRC | 07:15 | |
| *** junkao has joined #openstack-keystone | 07:20 | |
| *** ankita_w_ has quit IRC | 07:20 | |
| *** ankita_wagh has joined #openstack-keystone | 07:20 | |
| *** ankita_wagh has quit IRC | 07:26 | |
| *** jistr has joined #openstack-keystone | 07:33 | |
| *** jaosorior has joined #openstack-keystone | 07:38 | |
| *** openstackstatus has quit IRC | 07:52 | |
| *** openstack has joined #openstack-keystone | 07:53 | |
| *** openstackstatus has joined #openstack-keystone | 07:53 | |
| *** ChanServ sets mode: +v openstackstatus | 07:53 | |
| *** e0ne has joined #openstack-keystone | 08:17 | |
| *** e0ne is now known as e0ne_ | 08:17 | |
| *** kiran-r has joined #openstack-keystone | 08:18 | |
| *** junkao has quit IRC | 08:22 | |
| *** mabrams has quit IRC | 08:26 | |
| *** davidckennedy has joined #openstack-keystone | 08:33 | |
| *** jimbaker has quit IRC | 08:42 | |
| *** ericksonsantos has joined #openstack-keystone | 08:44 | |
| *** e0ne_ is now known as e0ne | 08:46 | |
| *** e0ne is now known as e0ne_ | 08:46 | |
| *** jimbaker has joined #openstack-keystone | 08:46 | |
| *** jimbaker has quit IRC | 08:46 | |
| *** jimbaker has joined #openstack-keystone | 08:46 | |
| *** e0ne_ is now known as e0ne | 08:55 | |
| *** tellesnobrega has quit IRC | 08:59 | |
| *** raildo has quit IRC | 09:00 | |
| *** htruta has quit IRC | 09:00 | |
| *** samueldmq has quit IRC | 09:00 | |
| *** ericksonfgds has quit IRC | 09:00 | |
| *** hightall has quit IRC | 09:11 | |
| *** aix has joined #openstack-keystone | 09:16 | |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 09:18 |
| *** fhubik has joined #openstack-keystone | 09:22 | |
| *** ericksonsantos has quit IRC | 09:22 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add notes for the SQLite database https://review.openstack.org/182205 | 09:23 |
| *** hightall has joined #openstack-keystone | 09:25 | |
| *** hightall has quit IRC | 09:29 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Upgrade Foreign key in Endpoint with ondelete='CASCADE' https://review.openstack.org/179767 | 09:30 |
| *** diabloneo_ has joined #openstack-keystone | 09:34 | |
| *** diabloneo_ has quit IRC | 09:34 | |
| *** diabloneo has joined #openstack-keystone | 09:35 | |
| *** kiranr has joined #openstack-keystone | 09:37 | |
| *** jimbaker has quit IRC | 09:37 | |
| *** fhubik is now known as fhubik_afk | 09:40 | |
| *** ajayaa has quit IRC | 09:40 | |
| *** kiran-r has quit IRC | 09:40 | |
| *** jimbaker has joined #openstack-keystone | 09:41 | |
| *** jimbaker has quit IRC | 09:41 | |
| *** jimbaker has joined #openstack-keystone | 09:41 | |
| *** davechen has left #openstack-keystone | 09:45 | |
| *** kiranr is now known as kiran-r | 09:50 | |
| *** ajayaa has joined #openstack-keystone | 09:53 | |
| *** kiranr has joined #openstack-keystone | 09:56 | |
| *** kiran-r has quit IRC | 09:58 | |
| *** kiranr has quit IRC | 10:00 | |
| *** mabrams has joined #openstack-keystone | 10:02 | |
| *** diabloneo has quit IRC | 10:07 | |
| *** ericksonsantos has joined #openstack-keystone | 10:08 | |
| *** e0ne is now known as e0ne_ | 10:21 | |
| *** ericksonsantos has quit IRC | 10:22 | |
| *** diabloneo__ has joined #openstack-keystone | 10:26 | |
| *** ericksonsantos has joined #openstack-keystone | 10:26 | |
| *** kiran-r has joined #openstack-keystone | 10:27 | |
| *** diabloneo__ has quit IRC | 10:27 | |
| *** diabloneo has joined #openstack-keystone | 10:28 | |
| *** jsheeren has joined #openstack-keystone | 10:30 | |
| *** dims has joined #openstack-keystone | 10:33 | |
| *** ajayaa has quit IRC | 10:34 | |
| *** kiran-r has quit IRC | 10:37 | |
| *** e0ne_ is now known as e0ne | 10:39 | |
| *** kiran-r has joined #openstack-keystone | 10:41 | |
| *** fhubik_afk is now known as fhubik | 10:47 | |
| *** ajayaa has joined #openstack-keystone | 10:48 | |
| *** ericksonfgds has joined #openstack-keystone | 10:53 | |
| *** amakarov_away is now known as amakarov | 10:53 | |
| *** ericksonsantos has quit IRC | 10:54 | |
| *** links has joined #openstack-keystone | 11:04 | |
| *** ajayaa has quit IRC | 11:04 | |
| *** tellesnobrega has joined #openstack-keystone | 11:31 | |
| *** ericksonfgds has quit IRC | 11:34 | |
| *** samueldmq has joined #openstack-keystone | 11:34 | |
| samueldmq | morning | 11:34 |
| marekd | hi | 11:35 |
| *** jistr is now known as jistr|class | 11:46 | |
| *** jistr|class is now known as jistr | 11:47 | |
| *** jistr is now known as jistr|class | 11:50 | |
| *** jistr|class is now known as jistr | 11:57 | |
| *** e0ne is now known as e0ne_ | 12:00 | |
| *** dims_ has joined #openstack-keystone | 12:03 | |
| *** dims has quit IRC | 12:06 | |
| dstanek | marekd: hi | 12:15 |
| *** raildo has joined #openstack-keystone | 12:15 | |
| *** jsheeren has quit IRC | 12:15 | |
| dstanek | so, if i sit in a review too long (take my time and test it) I get logged out | 12:16 |
| *** aix has quit IRC | 12:17 | |
| *** gordc has joined #openstack-keystone | 12:18 | |
| *** htruta has joined #openstack-keystone | 12:21 | |
| marekd | dstanek: hi | 12:24 |
| *** aix has joined #openstack-keystone | 12:28 | |
| *** iurygregory has joined #openstack-keystone | 12:29 | |
| *** e0ne_ is now known as e0ne | 12:34 | |
| *** dims_ has quit IRC | 12:40 | |
| *** dims has joined #openstack-keystone | 12:42 | |
| *** mestery has joined #openstack-keystone | 12:43 | |
| *** radez_g0n3 is now known as radez | 12:49 | |
| *** fhubik is now known as fhubik_afk | 12:56 | |
| *** fhubik_afk is now known as fhubik | 13:00 | |
| *** vhoward has joined #openstack-keystone | 13:00 | |
| *** jistr is now known as jistr|mtg | 13:04 | |
| *** vhoward has left #openstack-keystone | 13:05 | |
| *** richm has joined #openstack-keystone | 13:06 | |
| *** kiran-r has quit IRC | 13:06 | |
| *** iamjarvo has joined #openstack-keystone | 13:09 | |
| *** lmtaylor1 has joined #openstack-keystone | 13:12 | |
| *** iamjarvo has quit IRC | 13:13 | |
| davidckennedy | jamielennox - looking at keystone middleware bug https://bugs.launchpad.net/keystonemiddleware/+bug/1207922 | 13:21 |
| openstack | Launchpad bug 1207922 in keystonemiddleware "auth_token middleware always use v2.0 to request admin token" [High,Confirmed] - Assigned to Jamie Lennox (jamielennox) | 13:21 |
| davidckennedy | Currently the Identity servier instantiates the appropriate client but still gets revoked list from v2 | 13:21 |
| openstackgerrit | Merged openstack/keystone: Add missing part for `token` object https://review.openstack.org/182147 | 13:22 |
| davidckennedy | Why is that. Shouldn't be too hard to delegate to the request_strategy, and if v2 is disabled getting the revoked list will bomb the middleware right? | 13:23 |
| *** richm has quit IRC | 13:24 | |
| *** hightall has joined #openstack-keystone | 13:25 | |
| *** mattfarina has joined #openstack-keystone | 13:38 | |
| raildo | hey, in a reseller patch, I need to add a new parameter "is_domain"in the get_project_by_name method, and I want to use this parameter as a kwars, since I can set a default value to it. but I found a cache problem, "ValueError: dogpile.cache's default key creation function does not accept keyword arguments." | 13:43 |
| raildo | trace error: http://pastebin.com/index/7WX3HL1C | 13:43 |
| *** jsavak has joined #openstack-keystone | 13:43 | |
| *** links has quit IRC | 13:44 | |
| raildo | anyone can help me with this? | 13:44 |
| *** lufix has joined #openstack-keystone | 13:45 | |
| samueldmq | raildo, can you share the code as well ? :) | 13:45 |
| raildo | https://review.openstack.org/#/c/158372/51/keystone/auth/controllers.py | 13:45 |
| raildo | when I put the lbragstad suggestion I got this error | 13:46 |
| *** vhoward has joined #openstack-keystone | 13:46 | |
| *** iamjarvo has joined #openstack-keystone | 13:46 | |
| lbragstad | raildo: interesting | 13:46 |
| lbragstad | raildo: we can't pass a kwarg to another api within Keystone? | 13:47 |
| raildo | lbragstad, I believe that we can, the problem is that the cache doesn't handle with a kwarg | 13:48 |
| raildo | lbragstad, and I don't know why. | 13:48 |
| lbragstad | sounds like a bug in dogpile | 13:48 |
| samueldmq | raildo, how do you pass that argument ? I think lbragstad was talking about passing it as is_domain=is_domain | 13:49 |
| raildo | samueldmq, exactly if I pass in this way, I have this error. | 13:49 |
| *** browne has joined #openstack-keystone | 13:50 | |
| raildo | samueldmq, since the dogpile cache for get_project_by_name doesn't know how to handle with a kwarg. =/ | 13:50 |
| raildo | lbragstad, if don't use this as a kwarg, I need to set the default value in every call to the manager, right? or handle with thin in the manager level. | 13:52 |
| samueldmq | raildo, remove the @MEMOISE annotation, and use the cache mechanism as in create_project | 13:52 |
| samueldmq | raildo, https://review.openstack.org/#/c/158372/51/keystone/resource/core.py | 13:52 |
| samueldmq | lbragstad, cc ^ makes sense ? | 13:52 |
| *** mestery has quit IRC | 13:53 | |
| lbragstad | raildo: digging into the patch again | 13:53 |
| *** e0ne is now known as e0ne_ | 13:53 | |
| *** markvoelker has quit IRC | 13:53 | |
| samueldmq | but it should be cehcking/getting from the cache instead of setting | 13:54 |
| *** e0ne_ is now known as e0ne | 13:55 | |
| *** hightall has quit IRC | 13:57 | |
| *** bknudson has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v bknudson | 13:57 | |
| *** fhubik is now known as fhubik_afk | 13:59 | |
| lbragstad | raildo: have you seen this at all? https://bitbucket.org/zzzeek/dogpile.cache/issue/24/cache-invalidation-for-class-or-instance | 14:00 |
| raildo | lbragstad, I had seen and later I come here to see if someone have passed for this. | 14:07 |
| *** zzzeek has joined #openstack-keystone | 14:15 | |
| lbragstad | raildo: and that's because of the call to cache.get_memoization_decorator() | 14:16 |
| lbragstad | right? | 14:16 |
| lbragstad | that's where this all blows up? | 14:16 |
| *** stevemar has joined #openstack-keystone | 14:17 | |
| *** ChanServ sets mode: +v stevemar | 14:17 | |
| raildo | lbragstad, yes | 14:18 |
| *** fhubik_afk is now known as fhubik | 14:18 | |
| *** fhubik is now known as fhubik_afk | 14:20 | |
| *** fhubik_afk is now known as fhubik | 14:22 | |
| *** topol has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v topol | 14:23 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:25 | |
| *** ericksonsantos has joined #openstack-keystone | 14:30 | |
| *** blewis has joined #openstack-keystone | 14:32 | |
| davidckennedy | jamielennox ^^ I see the issues are more complicated as the auth_token plugin makes its own mind up about where it's going to authenticate the auth token anyway. This code is a rollercoaster. | 14:32 |
| stevemar | marekd, added an image for SSO \o/ | 14:33 |
| *** thedodd has joined #openstack-keystone | 14:34 | |
| *** ericksonsantos has quit IRC | 14:35 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/178426 | 14:35 |
| *** spandhe has joined #openstack-keystone | 14:37 | |
| *** spandhe_ has joined #openstack-keystone | 14:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/182323 | 14:39 |
| *** jistr|mtg is now known as jistr | 14:39 | |
| *** Guest20306 is now known as redrobot | 14:39 | |
| *** spandhe has quit IRC | 14:41 | |
| *** spandhe_ is now known as spandhe | 14:41 | |
| *** emagana has joined #openstack-keystone | 14:42 | |
| *** blewis has quit IRC | 14:45 | |
| *** fhubik is now known as fhubik_afk | 14:51 | |
| *** fhubik_afk is now known as fhubik | 14:51 | |
| *** e0ne is now known as e0ne_ | 14:51 | |
| *** fhubik is now known as fhubik_afk | 14:51 | |
| dstanek | davidckennedy: jamielennox probably won't be on for a while | 14:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/182323 | 14:57 |
| *** e0ne_ is now known as e0ne | 14:58 | |
| *** rwsu has joined #openstack-keystone | 14:59 | |
| *** mabrams has quit IRC | 15:00 | |
| *** browne has quit IRC | 15:00 | |
| *** lufix has quit IRC | 15:04 | |
| davidckennedy | dstanek yes, thanks. Seems I can spend as much time as I like looking through this code.... | 15:05 |
| *** kiran-r has joined #openstack-keystone | 15:08 | |
| *** richm has joined #openstack-keystone | 15:09 | |
| *** fhubik_afk is now known as fhubik | 15:11 | |
| *** kiranr has joined #openstack-keystone | 15:11 | |
| *** kiran-r has quit IRC | 15:13 | |
| *** fhubik has quit IRC | 15:14 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182341 | 15:14 |
| *** afazekas_ has quit IRC | 15:15 | |
| *** ayoung has joined #openstack-keystone | 15:17 | |
| *** ChanServ sets mode: +v ayoung | 15:17 | |
| *** _cjones_ has joined #openstack-keystone | 15:19 | |
| *** rlt_ has joined #openstack-keystone | 15:20 | |
| marekd | stevemar: thanks \o/ | 15:22 |
| stevemar | marekd, slowly but surely it'll get done | 15:24 |
| marekd | stevemar: i wouldn't worry about that. | 15:25 |
| marekd | do we have a meeting today? | 15:25 |
| stevemar | marekd, just the regular keystone meeting | 15:25 |
| *** kiranr has quit IRC | 15:26 | |
| *** mattamizer has joined #openstack-keystone | 15:27 | |
| *** blewis has joined #openstack-keystone | 15:27 | |
| *** _cjones_ has quit IRC | 15:29 | |
| *** _cjones_ has joined #openstack-keystone | 15:30 | |
| marekd | stevemar: that's what i asked about :-) | 15:30 |
| openstackgerrit | Merged openstack/keystonemiddleware: Add keystone v3 API to fetch revocation list https://review.openstack.org/180172 | 15:32 |
| stevemar | marekd, i see you looking at the slides | 15:33 |
| marekd | stevemar: yes | 15:33 |
| *** mattamizer has quit IRC | 15:35 | |
| *** lhcheng has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v lhcheng | 15:39 | |
| *** gyee has joined #openstack-keystone | 15:41 | |
| *** ChanServ sets mode: +v gyee | 15:41 | |
| marekd | ^^ west coast is waking up slowly | 15:42 |
| *** ccrouch has quit IRC | 15:42 | |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose base check classes as part of public API https://review.openstack.org/176683 | 15:45 |
| *** Bjoern__ has joined #openstack-keystone | 15:46 | |
| *** spandhe_ has joined #openstack-keystone | 15:47 | |
| gyee | marekd, g'morning! | 15:47 |
| marekd | gyee: good afternoon! | 15:48 |
| gyee | hah | 15:48 |
| *** spandhe has quit IRC | 15:49 | |
| *** spandhe_ is now known as spandhe | 15:49 | |
| *** links has joined #openstack-keystone | 15:50 | |
| *** jistr has quit IRC | 15:50 | |
| *** blewis has quit IRC | 15:51 | |
| *** josecastroleon has quit IRC | 15:54 | |
| stevemar | marekd, hehe | 15:55 |
| stevemar | marekd, yeah, i know it's lunch time when i see gyee and lhcheng sign on | 15:55 |
| marekd | stevemar: yeah, i know i should not be in the office when they sign on :P | 15:56 |
| *** lufix has joined #openstack-keystone | 15:56 | |
| *** lufix has joined #openstack-keystone | 15:56 | |
| stevemar | marekd, time to head home! | 15:56 |
| * gyee drops stevemar and marekd a hang loose sign | 15:56 | |
| marekd | will stay here for a while | 15:57 |
| *** mtreinish has quit IRC | 15:58 | |
| marekd | stevemar: did you actually even confirmed that openid connect doesn't support profiles for pure http user agents? | 15:58 |
| *** ericksonfgds has joined #openstack-keystone | 15:58 | |
| *** rwsu has quit IRC | 15:58 | |
| marekd | s/even/ever/ | 15:58 |
| *** rwsu has joined #openstack-keystone | 15:59 | |
| *** mtreinish has joined #openstack-keystone | 16:00 | |
| stevemar | marekd, you mean browserless flow? | 16:00 |
| marekd | stevemar: yes | 16:00 |
| stevemar | marekd, i have someone working on that internally, he thinks it's do-able | 16:00 |
| marekd | stevemar: so he works on what exactly, SP, RP? or just a client? | 16:01 |
| *** ankita_wagh has joined #openstack-keystone | 16:03 | |
| lhcheng | stevemar, stevemar: good morning! | 16:04 |
| *** thedodd has quit IRC | 16:04 | |
| lhcheng | oops | 16:04 |
| lhcheng | marekd: good morning | 16:04 |
| *** thedodd has joined #openstack-keystone | 16:04 | |
| marekd | lhcheng: hello | 16:04 |
| * lhcheng still waking up | 16:04 | |
| lhcheng | lol | 16:04 |
| * marekd stevemar got 2x combo | 16:05 | |
| lhcheng | well, there's really two stevemar. one that start works in the morning and the other one that starts work in the evening | 16:06 |
| lhcheng | :P | 16:06 |
| *** Bjoern__ is now known as BjoernT | 16:06 | |
| *** ericksonfgds is now known as ericksonsantos | 16:06 | |
| *** iamjarvo has quit IRC | 16:08 | |
| *** thedodd has quit IRC | 16:09 | |
| stevemar | :) | 16:10 |
| stevemar | marekd, he works on a product team, but wants the functionality | 16:11 |
| *** openstackgerrit_ has quit IRC | 16:11 | |
| marekd | stevemar: Kilo is the version where roughly all actions for federated users were CADF'ied, right? | 16:14 |
| *** spandhe_ has joined #openstack-keystone | 16:15 | |
| *** thedodd has joined #openstack-keystone | 16:16 | |
| stevemar | for any user | 16:16 |
| stevemar | marekd, ^ | 16:16 |
| marekd | cool | 16:16 |
| *** alexsyip has joined #openstack-keystone | 16:17 | |
| *** spandhe has quit IRC | 16:17 | |
| *** spandhe_ is now known as spandhe | 16:17 | |
| *** davidckennedy has quit IRC | 16:18 | |
| gyee | marekd, about Sam's email, he's not changing the protocol | 16:23 |
| gyee | still using SAML | 16:23 |
| marekd | gyee: but wants to put it as attribute in some JSON structure | 16:23 |
| gyee | noooh | 16:24 |
| marekd | so mod_shib and any other tool would be unusable, right? | 16:24 |
| *** iamjarvo has joined #openstack-keystone | 16:24 | |
| *** iamjarvo has quit IRC | 16:24 | |
| *** spandhe has quit IRC | 16:24 | |
| *** BjoernT has left #openstack-keystone | 16:25 | |
| *** iamjarvo has joined #openstack-keystone | 16:25 | |
| marekd | gyee: that what i understood from the spec draft he had sent (See Workflows) | 16:26 |
| gyee | lemme re-read the stuff | 16:26 |
| marekd | sure | 16:30 |
| *** browne has joined #openstack-keystone | 16:33 | |
| marekd | gyee: for the openstack onyeco system it could ease many things, but imho this is not really lightweight k2k, it's just token that is signed and encrypted :-) | 16:34 |
| gyee | marekd, yeah, you're right, the path would have to change, that's no good | 16:34 |
| *** afazekas_ has joined #openstack-keystone | 16:35 | |
| marekd | sticking with SAML just because we would reuse few lines of code and a library that nobody likes is pointless. | 16:36 |
| gyee | but we have to use SAML right? | 16:36 |
| marekd | gyee: no we don't. | 16:37 |
| gyee | like what, jwt? :) | 16:37 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/178426 | 16:37 |
| *** mestery has joined #openstack-keystone | 16:37 | |
| *** mestery has quit IRC | 16:38 | |
| marekd | gyee: the reason we used saml last time with k2k was that joe savak insited on standardized protocol. I raised some questions, and still raise them: how can you communicate your cloud with non openstack sevice - keystoneclient will do that? | 16:38 |
| marekd | gyee: i think morganfainberg's just closed the discussion. | 16:40 |
| gyee | marekd, "non openstack service"? | 16:40 |
| *** spandhe has joined #openstack-keystone | 16:41 | |
| marekd | gyee: yeah, joe had an idea that private cloud provider may want to federated with some service, say ticketing as a service (whatever it is) and he would use his existing keystone to act as a IdP. | 16:42 |
| *** afazekas_ has quit IRC | 16:42 | |
| marekd | gyee: anyway, read morgans reply | 16:43 |
| jsavak | that joe - full of crazy ideas. | 16:44 |
| *** ankita_wagh has quit IRC | 16:44 | |
| marekd | jsavak: revolution, not evolution :-) | 16:45 |
| jsavak | revolution looks like evolution in hindsight sometimes. : ) | 16:45 |
| *** spandhe has quit IRC | 16:45 | |
| gyee | Keystone is not a real IdP :) | 16:46 |
| gyee | it is an IdP proxy, really | 16:46 |
| marekd | gyee: yeah, but provides standardized way (SAML) of exposing some data to trusted peers | 16:46 |
| marekd | jsavak: for the records i am now quite thankful that we did k2k at that time, as with some extra work on other services, this will help us bursting into different clouds. | 16:47 |
| jsavak | keystone as an idp proxy, enabling federation of identity into openstack and out of openstack | 16:47 |
| jsavak | marekd - i agree : ) | 16:48 |
| rodrigods | think weak link in k2k is the SP, so it should have robust verification IMO | 16:48 |
| *** emagana has quit IRC | 16:48 | |
| gyee | Keystone is an IdP Decorator :) | 16:48 |
| dstanek | gyee: don't say that. i hate decorators | 16:49 |
| marekd | dstanek: syntactic sugar, nothing more :P | 16:49 |
| gyee | design pattern, will get you past most job interviews | 16:49 |
| marekd | i doubt it. | 16:49 |
| dstanek | gyee: not if you say that Python decorators are a way to implement the decorator pattern :-P | 16:50 |
| *** emagana has joined #openstack-keystone | 16:50 | |
| gyee | damn, I almost got away with that one | 16:51 |
| gyee | jsavak, in that case, it has to be more than just saml | 16:52 |
| jsavak | gyee, it should be extensible - | 16:52 |
| marekd | gyee: like another protocol ? | 16:52 |
| jsavak | wsfed, oauth2 | 16:52 |
| gyee | right, pluggable protocol | 16:53 |
| *** lmtaylor1 has quit IRC | 16:53 | |
| *** samleon has joined #openstack-keystone | 16:54 | |
| marekd | gyee: do you think adding oidc would solve sam's problems? | 16:54 |
| marekd | gyee: i doubt it. | 16:54 |
| gyee | marekd, like rodrigods said, we need robust validation | 16:55 |
| marekd | gyee: the only thing i don't like in apache modules concept is that they don't overlap with keystone logic. | 16:55 |
| gyee | proxies are way of life in any production deployment | 16:55 |
| marekd | gyee: agree | 16:56 |
| marekd | gyee: i bet somebody, somewhere had this problem already. | 16:56 |
| gyee | marekd, everybody have this problem :) | 16:56 |
| gyee | also, REST API and session affinity does sound pretty | 16:57 |
| gyee | isn't REST APIs sessionless? :) | 16:57 |
| lbragstad | gyee: I hope so | 16:57 |
| marekd | it is, you simply move your scalability problem from fronend to backend :P | 16:57 |
| marekd | gyee: for the record, i'd be happy to evaluate new ways of such data layers, but to me this will not be 'lightweight k2k' :-) | 16:59 |
| marekd | and this will not be open standard. | 16:59 |
| marekd | probably token on steroids. | 16:59 |
| morganfainberg | For the record: open standard pleas let's use those. | 17:00 |
| morganfainberg | Let's not NIH things. | 17:00 |
| morganfainberg | If at all possible. | 17:00 |
| gyee | marekd, isn't PKI token on steroids? | 17:00 |
| gyee | morganfainberg, yeah I agree, stick with open standard is a requirement | 17:01 |
| *** ankita_wagh has joined #openstack-keystone | 17:02 | |
| *** emagana has quit IRC | 17:02 | |
| *** mtreinish has quit IRC | 17:02 | |
| *** ptoohill has quit IRC | 17:02 | |
| *** mtreinish_ has joined #openstack-keystone | 17:02 | |
| *** Guest25580 is now known as dan | 17:02 | |
| marekd | morganfainberg: don't get me wrong - i am *not* writing any spec right now. I basically share your concerns, as much as I would like to have something better than sam or more integrated into keystone (with use of good 3rd party lib). For sure i will not push for new protocol because "i know how to do this right, they don't " | 17:02 |
| *** ptoohill has joined #openstack-keystone | 17:02 | |
| marekd | :-) | 17:02 |
| *** mtreinish_ is now known as mtreinish | 17:02 | |
| *** emagana has joined #openstack-keystone | 17:02 | |
| gyee | SAML is perfectly fine right now | 17:03 |
| gyee | its the deployment part we need to get better at | 17:04 |
| marekd | gyee: as long as we don't need to dig too much into it | 17:05 |
| morganfainberg | marekd: I really do not want to have a non open standard here. Just my view. And if we can solve this without implementing it all ourselves - I'm much happier. But I don't want to have to go to some people and explain why this non-standard is not an problem. | 17:05 |
| marekd | looks like nobody wants to have a non-standard solution, so we are all ok . | 17:06 |
| *** iamjarvo has quit IRC | 17:08 | |
| stevemar | marekd, can you look @ slide 19 for a sec? | 17:08 |
| marekd | stevemar: i am now | 17:09 |
| samleon | morganfainberg, marekd, yeah, this is a non standard way, but it's not something to replace the current protocol, but just an alternative | 17:13 |
| *** links has quit IRC | 17:14 | |
| samleon | it basically just provides clients another 'simple' way if they decided to have less complex configuration | 17:14 |
| morganfainberg | samleon: i don't think it's a good alternative if we're implementing all the code ourselves | 17:14 |
| morganfainberg | samleon: my answer stays the same, i'm against doing a non-open standard here. | 17:15 |
| morganfainberg | samleon, marekd: lets hold off on this and see what ayoung and nkinder have come up with using mellon | 17:16 |
| *** lufix has quit IRC | 17:16 | |
| *** lufix has joined #openstack-keystone | 17:17 | |
| morganfainberg | but let me say that if we do the "simple version", 1st: most people will move to it because it's easier - and now we have a whole slew of potential CVEs to keep up on and track. maintaining security code like this is not something we as keystone should really be in the business of. | 17:17 |
| morganfainberg | or well not move to it, but start with it | 17:18 |
| dstanek | ++ | 17:18 |
| marekd | morganfainberg: i am not pushing for that! | 17:18 |
| morganfainberg | and then moving to a more robust solution will be hard | 17:18 |
| morganfainberg | marekd: i know you're not, but i want to make sure we're not headed that way with this convo | 17:18 |
| dstanek | the hardest part about securing a system isn't the crypto it's the process of using the crypto correctly | 17:18 |
| samleon | morganfainberg, yeah i agree | 17:18 |
| dstanek | we should be very careful in this area | 17:18 |
| gyee | yeah man, being there, done that | 17:18 |
| gyee | still have burn marks | 17:19 |
| morganfainberg | when people say "it provides a simple way" - that sets off tons of red flags | 17:19 |
| morganfainberg | i mean, tons. | 17:19 |
| morganfainberg | unless the simple way is talking about chef or puppet recipes | 17:19 |
| morganfainberg | then i smirk because it's simple for some things and some people and hard for others -- but not really our concern | 17:20 |
| *** iamjarvo has joined #openstack-keystone | 17:20 | |
| morganfainberg | we have lots of smart puppet and chef people to make that part better :) | 17:20 |
| samleon | ++ | 17:20 |
| *** harlowja has quit IRC | 17:22 | |
| dstanek | morganfainberg: we are still having a meeting right? | 17:22 |
| morganfainberg | dstanek: yep | 17:22 |
| *** harlowja has joined #openstack-keystone | 17:22 | |
| morganfainberg | dstanek: hopefully it'll be super short | 17:22 |
| marekd | ++ | 17:22 |
| ayoung | reading up | 17:22 |
| dstanek | cook, then i'll go a grab some lunch now | 17:22 |
| morganfainberg | dstanek: i have no agenda besides "hi, see you at the summit" | 17:22 |
| dstanek | morganfainberg: "not if i see you first" | 17:22 |
| morganfainberg | haha | 17:22 |
| ayoung | samleon, having trouble knowing where to start in the backlog | 17:23 |
| samleon | ayoung, sorry did not put you in the loop | 17:23 |
| ayoung | samleon, No problem. | 17:24 |
| ayoung | samleon, is this about Shib? | 17:24 |
| samleon | ayoung, i basically sent out an email last regarding some concerns for the issues we were facing with shib and had some proposes | 17:24 |
| samleon | ayoung, i can forward you the email if you are interested | 17:25 |
| samleon | with an initial 'specs' for the propose | 17:25 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/182323 | 17:25 |
| *** hemna has joined #openstack-keystone | 17:25 | |
| ayoung | samleon, please do | 17:26 |
| morganfainberg | samleon: next time I highly recommend posting the spec to gerrit for review, or using a ML topic :) | 17:26 |
| morganfainberg | samleon: you can mark it WIP or get more people involved. but privated emails like this end up missing some key people like ayoung and nkinder at times :) | 17:27 |
| morganfainberg | (the exception is clearly security bugs and the like) | 17:27 |
| ayoung | morganfainberg, yep | 17:28 |
| samleon | morganfainberg, ayoung, yeah, I will do that, and ayoung is included in the email now ;-) | 17:29 |
| ayoung | morganfainberg, time to revisit http://adam.younglogic.com/2013/07/a-vision-for-keystone/ | 17:29 |
| morganfainberg | samleon: lets move this convo to an open place vs. just adding people to the thread | 17:29 |
| samleon | morganfainberg, yep, let me do that | 17:30 |
| morganfainberg | samleon: either post the RST or start a new thread on the ML | 17:30 |
| morganfainberg | if you do the latter just summarize the previous convos | 17:30 |
| ayoung | samleon, let me read quick, and I can help short circuit the conversation | 17:31 |
| ayoung | samleon, so...my origianl proposal along these lines was to use PKI tokens | 17:32 |
| samleon | morganfainberg, what's RST? | 17:32 |
| ayoung | samleon, RST is the doc format we use for specs | 17:32 |
| morganfainberg | .rst ? the format for the spec that was attached | 17:32 |
| morganfainberg | ReStructuredText | 17:32 |
| marekd | samleon: the one you had used :P | 17:32 |
| samleon | oh, sorry, it's in cap ;-) | 17:32 |
| ayoung | samleon, and the PKI format was deemed not appropriate for reasons I do not agree with | 17:32 |
| ayoung | but, that is water under the bridge | 17:32 |
| ayoung | samleon, SAML, JWT, Keystone...the format is less important than the document contents | 17:33 |
| ayoung | now, I would argue that the Keystone V3 tokens API defines the minimal amount of data we need to share | 17:34 |
| ayoung | converting that to SAML makes sense in that it is the best supported standard there is | 17:34 |
| morganfainberg | samleon as a file extension .rst is fine, as an initialism describing the format, people use RST | 17:34 |
| ayoung | JWT was not quite there when we started | 17:34 |
| ayoung | samleon, so..since we started with SAML, let us at least get SAML working | 17:35 |
| samleon | morganfainberg, got that | 17:35 |
| ayoung | we are not going to trash it yet, and the overhead is...meh | 17:35 |
| ayoung | its a pain in the kiester, but there are no good options yet | 17:35 |
| ayoung | samleon, for example http://adam.younglogic.com/2014/06/why-popen-for-openssl-calls/ | 17:36 |
| ayoung | which is no longer the case...but anyway | 17:36 |
| ayoung | samleon, so, if we are going to do anything besides SAML, I would argue for Keystone tokens in PKIZ format | 17:37 |
| ayoung | the issues around that have to do with certificate exchange and mapping to Keystone users, but I think we can use the work gyee 's team is doing for X509 Tokenless to deal with mapping | 17:38 |
| *** tellesnobrega_ has joined #openstack-keystone | 17:38 | |
| ayoung | so really, it is a question of cert management | 17:38 |
| samleon | ayoung, ++ | 17:38 |
| morganfainberg | ayoung: and my biggest complaint about PKIZ tokens is really justifying the protocol when explaining to everyone why we didn't use SAML or similar | 17:38 |
| *** tellesnobrega_ has quit IRC | 17:39 | |
| morganfainberg | ayoung: and as much as i wish that wasnt an issue, it sadly is. | 17:39 |
| ayoung | morganfainberg, Not going to argue it. | 17:39 |
| marekd | morganfainberg: is it a justified issue and concern? | 17:39 |
| morganfainberg | ayoung: i know, that argument sailed a while ago | 17:39 |
| marekd | is PKIZ worse/ less usable / less secure than SAML? | 17:39 |
| ayoung | marekd, comparable | 17:39 |
| morganfainberg | marekd: no, it is an unknown | 17:39 |
| ayoung | marekd, it is a document format. Period | 17:40 |
| morganfainberg | marekd: talk to security guys | 17:40 |
| ayoung | SAML is a protocol | 17:40 |
| ayoung | and a docment format | 17:40 |
| morganfainberg | marekd: unknowns are scary and painful | 17:40 |
| morganfainberg | marekd: even if they really arent | 17:40 |
| morganfainberg | if we did the whole ietf formal process, this would be less of an issue. | 17:40 |
| morganfainberg | but is there a benefit for us to do that? | 17:40 |
| morganfainberg | maybe | 17:40 |
| marekd | don't know. was just asking. | 17:41 |
| morganfainberg | it wouldn't have been something we can do in the term we wanted federated id | 17:41 |
| ayoung | when it comes down to brass tacks, they are both documents signed using PKI | 17:41 |
| ayoung | if the cert management is done right, they are comparable. If it is not done right, they are both suspect | 17:41 |
| morganfainberg | ayoung: correct. and i'm fine with saying we should go and ietf our protocol/document exchange | 17:41 |
| morganfainberg | and run it ourself | 17:41 |
| ayoung | marekd, I wanted to push for distribtued signing, and splitting things along domain lines | 17:42 |
| ayoung | keystoneX can sing for DomX in my cloud, and only DomX | 17:42 |
| morganfainberg | but i really like having a set of knowns that people are comfortable with. | 17:42 |
| ayoung | Does it matter if it is in SAML or PKIZ format? | 17:42 |
| morganfainberg | even if they are roughly equivalent. | 17:42 |
| morganfainberg | SAML is already a known. | 17:42 |
| marekd | ayoung: what stopped you from doing that? | 17:42 |
| ayoung | marekd, 2 things | 17:42 |
| ayoung | 1. jsavak needed something that met with morganfainberg 's criteria above. 2. I was working on other priorities | 17:43 |
| marekd | ayoung: it does matter - as you said PKIZ is a format, so you can adjust and tweak workflow to your needs. If you break workflow with SAML - it's not SAML anymore. | 17:43 |
| ayoung | marekd, the way either are used in this case it becomes a bearer token | 17:43 |
| ayoung | you can't make a silk purse out of a sow's ear | 17:44 |
| ayoung | and you can't build a secure system out of passing around symmetric secrets | 17:44 |
| gyee | noooh | 17:44 |
| ayoung | marekd, Federation uses SAML properly | 17:44 |
| ayoung | it is not a bearer token if the Service gives you a nonce that is part of the aserrtion | 17:45 |
| ayoung | WebSSO, I should state | 17:45 |
| ayoung | I'm stil undecided on ECP.... | 17:45 |
| ayoung | but, let's assume ECP also does the right thing... | 17:45 |
| marekd | ayoung: agreed. For our needs we had to start using extensions because SAML didn't assume there are browserless clients who may want to use that. | 17:45 |
| ayoung | what the user needs from Keystone is not authentication, but authorization | 17:45 |
| morganfainberg | marekd: PKIZ would end up being wraped into a protocol since we'd be using it between keystones of unknown code level - we would have to define it the same way SAML needs to be defined | 17:45 |
| morganfainberg | you can't "just change it" or the other end may not understand it | 17:46 |
| morganfainberg | it's all the same boat(s). | 17:46 |
| morganfainberg | just starting from different places | 17:46 |
| *** chlong has quit IRC | 17:46 | |
| *** e0ne is now known as e0ne_ | 17:47 | |
| ayoung | morganfainberg, I'm not going to go into deisgn right now...I had a different vision and I stepped out of the way due to practical considerations. I don't regret that. But I can't really talk through the issues without going in to hwo I think it should have been designed | 17:47 |
| ayoung | We have other use cases that we are not yet supporting | 17:48 |
| marekd | morganfainberg: if the PKIZ is just a format and you want to use it between peers running your software you can do eerything. What stops you from wrapping your PKIZ token with a JSON structure? | 17:48 |
| morganfainberg | ayoung: i was commented only on marekd's assertion pkiz as a transport | 17:48 |
| ayoung | marekd, GAH | 17:48 |
| ayoung | marekd, PKIZ IS a JSON FORMAT! | 17:48 |
| morganfainberg | ayoung: i think we're all in the same general mindset at the moment. | 17:48 |
| ayoung | take JSON, sign it, compress it, and base64 encode it | 17:48 |
| gyee | pkiz is not a transport | 17:48 |
| morganfainberg | anyway | 17:49 |
| ayoung | gyee, HTTP is a transport | 17:49 |
| * morganfainberg is going to a coffee shop - shoddy internet | 17:49 | |
| gyee | right | 17:49 |
| ayoung | the thing that PKIZ gives you is commitment to the data in the document mathcing the OpenStack view of authorziation. Nothing more. | 17:49 |
| morganfainberg | i might be a few minutes to start the meeting | 17:49 |
| morganfainberg | late* | 17:49 |
| ayoung | morganfainberg, want me to kick it off? | 17:50 |
| morganfainberg | if someone else wants to start it, please feel free to (hint ayoung or gyee ) | 17:50 |
| morganfainberg | :) | 17:50 |
| morganfainberg | yeah | 17:50 |
| ayoung | Will do | 17:50 |
| morganfainberg | agenda is up. | 17:50 |
| morganfainberg | really i have exactly 1 item: hi everyone, see you at the summit, safe travels | 17:50 |
| gyee | ayoung, currently there's no mechanism in pkiz to guard replay | 17:50 |
| morganfainberg | try and keep it short - if i miss the whole thing because it lasted 5 minutes id be happy | 17:50 |
| marekd | morganfainberg: cool | 17:50 |
| gyee | do we have a wiki on the vancouver hot spots? | 17:51 |
| gyee | like how to get around? | 17:51 |
| morganfainberg | gyee: someone sent a ML thread on it to -dev i think | 17:51 |
| *** jaypipes has joined #openstack-keystone | 17:52 | |
| jaypipes | ayoung: ping, oh sir. ? about LDAP. Does Keystone support global cross-DC LDAP read/write with both auth and assignment in LDAP? | 17:53 |
| morganfainberg | jaypipes: keystone does not support Assignment LDAP - it is deprecated and going away | 17:53 |
| ayoung | jaypipes, even if it does, it shouldn't | 17:53 |
| morganfainberg | jaypipes: assigment being resources (projects/domains) and roles/assigment of role-user-project | 17:54 |
| ayoung | jaypipes, Galera sucks that bad? | 17:54 |
| *** haneef has joined #openstack-keystone | 17:54 | |
| gyee | morganfainberg, I don't see that email, outlook probably filtered it out | 17:54 |
| morganfainberg | jaypipes: and it shouldn't do R/W LDAP identity. but that is a different thing | 17:54 |
| morganfainberg | and a separate argument i'm not willing to make *yet* | 17:54 |
| gyee | I need to have a serious conversation with IT guys, they keep filtering out the good shit! | 17:54 |
| ayoung | morganfainberg, does galera really suck that bad that people want LDAP for replication? | 17:55 |
| jaypipes | lol, thx ayoung and morganfainberg :) was just checking, cuz I wasn't sure. I never recommend using LDAP for writeable anything, but you know, solutions architects... that think they know best. | 17:55 |
| morganfainberg | jaypipes: :) | 17:56 |
| jaypipes | ayoung: and no, Galera rocked for all large cross-DC deployments I was ever involved in. | 17:56 |
| *** e0ne_ is now known as e0ne | 17:56 | |
| morganfainberg | Yeah galera is good until high latency | 17:56 |
| gyee | ayoung, do you know anyone running galera with more than 2 DCs? :) | 17:56 |
| morganfainberg | Then it's "eh ok with some potential ickyness" | 17:56 |
| morganfainberg | But still not "oh god why" level of bad | 17:57 |
| ayoung | jaypipes, to be honest, I can see why people would want LDAP; its a database tuned for REad only eventual consistency, with a decent replciation story. Which sortof matches the openstack use case, but it confuses too many people, since LDAP is , for just about everyone else, readonly from an Openstack deployment | 17:57 |
| morganfainberg | ayoung: I *really* like galera | 17:57 |
| dstanek | gyee: dolphm and lbragstad have been doing testing in this area | 17:57 |
| gyee | dstanek, how many sites? | 17:57 |
| morganfainberg | gyee: not 80 | 17:57 |
| gyee | heh | 17:58 |
| morganfainberg | gyee: a couple sites iirc | 17:58 |
| dstanek | gyee: i think 3 or 4 DCs, but you'd have to ask them for sure | 17:58 |
| morganfainberg | Yeah. | 17:58 |
| dstanek | morganfainberg: 80 DCs? | 17:58 |
| lbragstad | we did it across three | 17:58 |
| morganfainberg | dstanek: was an ask I had at one point. | 17:58 |
| morganfainberg | I laughed at people for it. | 17:58 |
| morganfainberg | jaypipes: 100% what ayoung said btw. | 17:58 |
| morganfainberg | jaypipes: :) | 17:59 |
| *** e0ne has quit IRC | 17:59 | |
| *** chlong has joined #openstack-keystone | 17:59 | |
| jaypipes | morganfainberg, ayoung; At AT&T, we actually used LDAP -- for the sysadmin deployment stuff :) For tenant/user identity/assignment, we used Galera. | 18:01 |
| jaypipes | that way, we used LDAP for replicating the small list of sysadmin credentials to the baremetal hosts and that's it. | 18:01 |
| dolphm | lbragstad: we did 5 last time | 18:01 |
| jaypipes | use LDAP for what it's good for, and use Galera for what it's good for. | 18:02 |
| lbragstad | dolphm: ++ yep, we successfully done it with five. | 18:02 |
| morganfainberg | jaypipes: about how I'd design things. | 18:02 |
| lbragstad | the most recent deployment (30+ keystone nodes) spanned 3 | 18:02 |
| jaypipes | morganfainberg: great minds... | 18:02 |
| jaypipes | when I left T, we were replicated multi-writer across 12 regions throughout the U.S., which each region's Keystone endpoint pointing to the nearest Galera cluster node housed inside that DC. | 18:03 |
| lbragstad | jaypipes: that makes sense | 18:04 |
| lbragstad | jaypipes: what did the replication footprint look like without tokens? | 18:04 |
| lbragstad | or, excluding the token operations? | 18:04 |
| jaypipes | lbragstad: virtually nothing. | 18:05 |
| jaypipes | lbragstad: near 99% read activity (which is perfect for Galera loads across a WAN, actually) | 18:05 |
| lbragstad | jaypipes: did you have issues with schema upgrades? | 18:06 |
| jaypipes | lbragstad: since, if you think about it, how many times do you create a user/tenant record or role record vs. reading that information? | 18:06 |
| jaypipes | lbragstad: nope. | 18:06 |
| lbragstad | jaypipes: did you use the percona toolkit at all? | 18:06 |
| lbragstad | TOI or RSU? | 18:06 |
| jaypipes | lbragstad: RSU | 18:06 |
| lbragstad | interesting... | 18:06 |
| jaypipes | lbragstad: we would take the API services down for a little while during the few schema migrations we needed to do. | 18:07 |
| lbragstad | so you did incur some downtime | 18:07 |
| jaypipes | lbragstad: even on a largish user/tenant collection, it's not like the Keystone DB is large... | 18:07 |
| jaypipes | lbragstad: yup. needed some anyway to restart/upgrade services. | 18:07 |
| lbragstad | cool, I just tried using the percona toolkit upgrade tool | 18:08 |
| lbragstad | for the first time | 18:08 |
| jaypipes | lbragstad: and we used only the memcache token UUID driver. | 18:08 |
| lbragstad | that must have helped | 18:08 |
| jaypipes | lbragstad: with the downside that folks needed to log into each region's dashboard to do shit on that region. | 18:08 |
| jaypipes | it was a downside we were OK with. | 18:08 |
| lbragstad | sure | 18:08 |
| lbragstad | that makes sense | 18:09 |
| gyee | jaypipes, it more than just keystone data right? you mean there's virtually nothing from keystone or other services if we take out the token data? | 18:10 |
| *** samleon has quit IRC | 18:12 | |
| lbragstad | gyee: how do you mean? | 18:16 |
| gyee | lbragstad, there's got to be more than just keystone data right? or the database is not shared | 18:16 |
| *** iamjarvo has quit IRC | 18:17 | |
| jaypipes | gyee: sorry, I'm not following you... | 18:18 |
| lbragstad | oh, if you have like nova and keystone sharing the same database? | 18:18 |
| ayoung | gyee, so, yes, for K2K with SAML, the SAML assertion is not subject to a replay attack, but the tokens on either side of the wire are. Perhaps that is sufficient security | 18:18 |
| jaypipes | gyee: we happen to have the image registry database in the same Galera cluster, but that's not necessary. | 18:18 |
| dolphm | gyee: keystone should have it's own DB in a multi-region scenario, no? | 18:18 |
| lbragstad | yeah, I would imagine a production environment would isolate them | 18:18 |
| jaypipes | lbragstad, gyee: ah, yes, Nova, Neutron, Cinder, and those services have a separate internal-to-a-region Galera cluster that does not bleed across failure domains, yes. | 18:19 |
| lbragstad | jaypipes: ++ | 18:19 |
| dolphm | jaypipes: sharing with the image registry makes sense | 18:19 |
| jaypipes | dolphm: yeah, it's very similar data patterns. heavy read, low write, mostly PK lookups and inserts. | 18:19 |
| gyee | dolphm, jaypipes, lbragstad, shared db have its advantages too | 18:19 |
| *** palendae has joined #openstack-keystone | 18:20 | |
| gyee | otherwise, separate HA, monitoring, replication, etc has cost too | 18:20 |
| jaypipes | gyee: not sure I'm following you... | 18:21 |
| dolphm | gyee: i assume you mean per-region HA of things that might otherwise be HA'd across regions? | 18:22 |
| lbragstad | gyee: but that's stuff that can be mitigated by bandwidth and compute power | 18:22 |
| *** leveldoc has joined #openstack-keystone | 18:22 | |
| dolphm | lbragstad: so, $ | 18:22 |
| lbragstad | lol yes | 18:22 |
| gyee | no, not HA across region | 18:23 |
| gyee | per region | 18:23 |
| *** rlt_ has quit IRC | 18:23 | |
| dolphm | low cost, HA, scale: choose any 2! ;) | 18:23 |
| *** iurygregory has quit IRC | 18:24 | |
| dolphm | gyee: i think we're on the same page | 18:25 |
| leveldoc | hi all... | 18:25 |
| jaypipes | hi Stephan :) | 18:25 |
| leveldoc | looking to understand plans for LDAP integration in Keystone. | 18:26 |
| leveldoc | hi Jay :) | 18:26 |
| dolphm | lbragstad: so what's the zero-downtime schema upgrade strategy you're looking at? | 18:26 |
| leveldoc | Assignment LDAP going away? | 18:26 |
| dolphm | leveldoc: it's almost gone already! | 18:26 |
| jaypipes | leveldoc: dolphm, ayoung, morganfainberg are all good resources for you :) | 18:26 |
| leveldoc | why is a r/w LDAP backend the wrong thing to do? | 18:26 |
| ayoung | I lie! | 18:26 |
| leveldoc | ayoung: hah! | 18:26 |
| leveldoc | :) | 18:26 |
| lbragstad | dolphm: well, I had requests going against the existing deployment then just dropped a column and added a new one using the percona toolkit | 18:27 |
| *** geoffarnold has joined #openstack-keystone | 18:27 | |
| ayoung | leveldoc, 2 reasons | 18:27 |
| lbragstad | http://www.severalnines.com/blog/online-schema-upgrade-mysql-galera-cluster-using-toi-method | 18:27 |
| dolphm | leveldoc: what and why do you want keystone to write to LDAP? | 18:27 |
| ayoung | leveldoc, from my perspective, most people are using LDAP for Read only. | 18:27 |
| ayoung | so supporting R/W is an edge case that has little bang for the buck | 18:27 |
| ayoung | for the operators standpoint, it menas using something that is not the norm | 18:27 |
| lbragstad | dolphm: the migration was simple but I wanted to see if performance took a hit | 18:28 |
| dolphm | lbragstad: i assume it did? | 18:28 |
| *** blewis has joined #openstack-keystone | 18:28 | |
| lbragstad | nope | 18:28 |
| dolphm | lbragstad: wut | 18:28 |
| lbragstad | dolphm: ... yeah | 18:28 |
| dolphm | lbragstad: i assume you hit a table that was being read from? | 18:28 |
| leveldoc | ayoung: OK... so in other words we don't see enough usage of this feature | 18:28 |
| lbragstad | rpm didn't budge | 18:28 |
| ayoung | leveldoc the User list is a corporate asset, not part of the openstack deployment | 18:28 |
| dolphm | lbragstad: what did you change? | 18:28 |
| lbragstad | throughput didn't move | 18:28 |
| ayoung | Keystone should consume that list, but not manage it; | 18:28 |
| lbragstad | I added a column to the user table | 18:29 |
| ayoung | I don't add empolyees to my corporate LDAP via horizon | 18:29 |
| dolphm | lbragstad: "dropped a column" (what column?) | 18:29 |
| lbragstad | dolphm: which consisted of 240k users. | 18:29 |
| dolphm | ayoung: behind the times, man | 18:29 |
| leveldoc | ayoung: understood - I get that and that's fine. What about role assignments and service users that have no place in the corporate directory? | 18:29 |
| ayoung | I use a more full bodies workflow that knows about things like Kerberos principals and imaginary numbers and rainbows and capricorns. | 18:29 |
| lbragstad | dolphm: sorry, I didn't drop it, I added a column | 18:29 |
| ayoung | leveldoc, if LDAP is Read Only, you have a real problem | 18:29 |
| ayoung | you can't manage projects | 18:29 |
| dolphm | leveldoc: those belong in SQL, right? | 18:30 |
| ayoung | and the assignemt code assumes it lives in the same server as the identity code | 18:30 |
| ayoung | since, in the past, those two backends were unified | 18:30 |
| leveldoc | why would these things belong in SQL? | 18:30 |
| *** amakarov is now known as amakarov_away | 18:30 | |
| dolphm | leveldoc: you just suggested they don't belong in LDAP | 18:30 |
| ayoung | leveldoc, assignments are Openstack specific data | 18:30 |
| leveldoc | roles, groups, rights have always been managed by a directory server | 18:30 |
| ayoung | leveldoc, not cross-app they aren;'t | 18:30 |
| dolphm | leveldoc: where do you want service users and openstack authorization metadata to live? | 18:30 |
| leveldoc | of course they are :) | 18:30 |
| leveldoc | that's the point of an LDAP server | 18:31 |
| dolphm | leveldoc: and you want keystone to write that stuff to your LDAP server? | 18:31 |
| leveldoc | that my rights, groups and access controls are properly propagated throughout my infrastructure | 18:31 |
| ayoung | leveldoc, the way Keystone uses them, the user comes with a set of groups. That is input. Openstack requires an additional layer of authorization | 18:31 |
| ayoung | leveldoc, if you want to set up a new server, you should not need to go talk to HR | 18:31 |
| jaypipes | lbragstad: I was wrong earlier. we used TOI. | 18:32 |
| jaypipes | lbragstad: during a downtime. | 18:32 |
| lbragstad | jaypipes: ah, sweet | 18:32 |
| leveldoc | hmm. OK so I think that this is probably best explained in person, or it's going to take all day typing it up in IRC | 18:32 |
| dolphm | leveldoc: can you explain what & why you want keystone to write to LDAP? | 18:32 |
| lbragstad | jaypipes: so you're app didn't have to deal with being backwards compatible with two schemas. | 18:32 |
| jaypipes | lbragstad: correct. | 18:33 |
| lbragstad | jaypipes: good to know | 18:33 |
| dolphm | is nova backwards compatible at all during schema upgrades? i know there's interest, but i don't know where the state of things has landed between pipe dream and reality | 18:34 |
| lbragstad | jaypipes: so, the identity api was talking to an ldap backend, right? | 18:35 |
| leveldoc | I'd ultimately like Keystone to manage RBAC in LDAP, not in policy.json. This implies that my projects are in there. An object oriented database is better suited for role assignments and access rights management, which is why directory servers exist. These permissions, groups, roles, etc. that pertain to OpenStack can be written to a directory server and then consumed much easier from it. | 18:35 |
| lbragstad | jaypipes: so all users were living in ldap, which took care of that replication? | 18:35 |
| leveldoc | I'm not suggesting to write to the corporate directory server, mind you - that's just silly. :) | 18:35 |
| ayoung | leveldoc, https://blog-nkinder.rhcloud.com/?p=130 | 18:36 |
| jaypipes | lbragstad: no, only the sysadmin credentials for the baremetal nodes were in LDAP. We didn't use LDAP and Keystone together at all. | 18:36 |
| ayoung | The rest is commentary. GO and study | 18:36 |
| lbragstad | oh... | 18:36 |
| lbragstad | jaypipes: and this was all globally replicated? | 18:37 |
| dolphm | leveldoc: even if you deploy a second LDAP environment for keystone to read from (i've heard of people doing just that, but it's never been their first choice of solutions), why do you want to manage it through keystone? | 18:37 |
| jaypipes | lbragstad: yes. the LDAP store was tiny ... just a handful of sysadmin credentials. less than 30 people, AFAICR | 18:38 |
| *** ksavich has joined #openstack-keystone | 18:38 | |
| jaypipes | dolphm: I can walk you through what is rolling-upgrade possible in Nova. | 18:38 |
| jaypipes | dolphm: jerdfelt almost completed the online schema migration stuff, but we still need to comlpete it this cycle. | 18:39 |
| dolphm | jaypipes: how is it tested? | 18:39 |
| jaypipes | dolphm: the rolling compute node upgrade stuff, or the online schema migration stuff? | 18:40 |
| dolphm | jaypipes: online migrations | 18:40 |
| dolphm | jaypipes: or rather, the interaction between nova and a live migration | 18:41 |
| jaypipes | dolphm: one sec | 18:42 |
| jaypipes | dolphm: have you seen/read this? http://specs.openstack.org/openstack/nova-specs/specs/kilo/approved/online-schema-changes.html | 18:43 |
| leveldoc | ayoung: the blog entry covers authentication. I'm talking about assigment. | 18:43 |
| *** jsavak has quit IRC | 18:43 | |
| dolphm | jaypipes: i have not, i was hoping you could point me to something, thanks! | 18:43 |
| jaypipes | dolphm: no problemo. :) | 18:43 |
| ayoung | leveldoc, yes.. And the LDAP assignment code assumes that both are in the same backend | 18:43 |
| leveldoc | dolphm: roles, permissions, etc. do not belong in a policy.json file. They belong in a policy server, IMHO and keystone should manage the appropriate permissions because they concern openstack? | 18:44 |
| lbragstad | jaypipes: so that spec will go through and make all existing migrations for nova "online capable"? | 18:44 |
| *** iamjarvo has joined #openstack-keystone | 18:44 | |
| *** iamjarvo has quit IRC | 18:44 | |
| leveldoc | ayoung: OK so assignment backend still remains pluggable then? | 18:45 |
| jaypipes | lbragstad: nope. | 18:45 |
| ayoung | leveldoc, yes | 18:45 |
| dolphm | leveldoc: keystone doesn't own policy.json in the first place. you could certainly write a policy driver for oslo.policy that reads from LDAP | 18:45 |
| jaypipes | lbragstad: it applies to new ones. | 18:45 |
| *** jsavak has joined #openstack-keystone | 18:45 | |
| morganfainberg | leveldoc: are you going to be at the summit? | 18:45 |
| *** iamjarvo has joined #openstack-keystone | 18:45 | |
| ayoung | leveldoc, even more so now with keystone. ROles and projects are in two different backends now | 18:45 |
| leveldoc | morganfainberg: yes... planning to get in touch with you guys there anyway | 18:45 |
| dolphm | morganfainberg: when is our first pod-like timeslot? | 18:45 |
| lbragstad | jaypipes: ah, so each migration has a state, and it's this specs job to figure out how to expand or contract to that state from another given state? | 18:45 |
| morganfainberg | leveldoc: great! i think we have some stuff that will help you and you can see where we are going on this | 18:46 |
| morganfainberg | dolphm: uhm.. checking | 18:46 |
| leveldoc | morganfainberg: awesome. looking forward to engaging more | 18:46 |
| jaypipes | lbragstad: well, no, the spec describes the overall framework for splitting new DB schema migrations into things that can be run while the DB is online, things that can be batched during a downtime, and things that can run after the migration but when the DB is back online. | 18:46 |
| leveldoc | ayoung: awesome, that's what I wanted to hear. :) Looking forward to meeting you guys at the summit. | 18:47 |
| ayoung | Come to my talk | 18:47 |
| morganfainberg | dolphm: http://libertydesignsummit.sched.org/event/2625474f5b6a797403fe562ad8e776da | 18:47 |
| jaypipes | ayoung: conf whore. | 18:48 |
| jaypipes | :P | 18:48 |
| ayoung | https://openstacksummitmay2015vancouver.sched.org/event/14f4c5993e34b0f6a10c810510abbd73 | 18:48 |
| ayoung | jaypipes, while what you say is true, in this case my talk also happens to be relevant | 18:48 |
| jaypipes | :) | 18:48 |
| jaypipes | just pulling your leg. | 18:48 |
| ayoung | hmmm (116) now subtract out the keystone cores.... | 18:49 |
| ayoung | crud...I better finish this presentation | 18:49 |
| *** iamjarvo_ has joined #openstack-keystone | 18:50 | |
| *** iamjarvo_ has quit IRC | 18:50 | |
| *** iamjarvo_ has joined #openstack-keystone | 18:50 | |
| lbragstad | dolphm: the way the migration I tried earlier works, is that it creates a new shadow table with the new schema, sets up a trigger to copy all writes from the old table to the new one, and then start copying over data from the old table to the new table incrementally. Once it's done, it renames the new table and deletes the old one. | 18:51 |
| *** afazekas_ has joined #openstack-keystone | 18:51 | |
| *** e0ne has joined #openstack-keystone | 18:51 | |
| *** Rockyg has joined #openstack-keystone | 18:53 | |
| *** iamjarvo has quit IRC | 18:53 | |
| *** afazekas_ has quit IRC | 19:03 | |
| *** ayoung has quit IRC | 19:03 | |
| * samueldmq missed the meeting :/ looking the logs | 19:03 | |
| *** ayoung has joined #openstack-keystone | 19:05 | |
| *** ChanServ sets mode: +v ayoung | 19:05 | |
| *** dguerri is now known as _dguerri | 19:06 | |
| *** lmtaylor1 has joined #openstack-keystone | 19:06 | |
| *** samleon has joined #openstack-keystone | 19:07 | |
| *** SunnyRainbow has joined #openstack-keystone | 19:08 | |
| samueldmq | ayoung, hi, need me to take a look at the policy presentation, anything related ? | 19:09 |
| ayoung | samueldmq, heh...still wokring on it | 19:09 |
| ayoung | samueldmq, appreciate the offer, but I suspect I'll be reworking it right up til the actual presentation | 19:10 |
| samueldmq | ayoung, nice, let me know if you want me to take a look | 19:10 |
| samueldmq | ayoung, oh ok then :) | 19:10 |
| ayoung | will do... | 19:10 |
| *** geoffarnold has quit IRC | 19:11 | |
| *** afazekas_ has joined #openstack-keystone | 19:13 | |
| *** afazekas_ has quit IRC | 19:15 | |
| *** afazekas_ has joined #openstack-keystone | 19:16 | |
| *** openstackgerrit_ has joined #openstack-keystone | 19:16 | |
| morganfainberg | lbragstad: interesting | 19:17 |
| *** aix has quit IRC | 19:18 | |
| dolphm | lbragstad: smart | 19:21 |
| *** afazekas_ has quit IRC | 19:22 | |
| jsavak | lbragstad: bodacious | 19:23 |
| *** openstackgerrit_ has quit IRC | 19:25 | |
| morganfainberg | ayoung: having to learn the new gerrit ui is weird | 19:26 |
| dstanek | lbragstad: have you started to think about the code issues we talked about yesterday? | 19:27 |
| *** jsavak has quit IRC | 19:31 | |
| *** jaosorior has quit IRC | 19:32 | |
| *** ayoung has quit IRC | 19:35 | |
| *** ayoung has joined #openstack-keystone | 19:36 | |
| *** ChanServ sets mode: +v ayoung | 19:36 | |
| ayoung | samueldmq, rodrigods as of Kilo; Role assignement inheritance is either on the parent OR all the children, but not both, correct? | 19:37 |
| ayoung | or rather | 19:37 |
| ayoung | samueldmq, rodrigods as of Kilo; Role assignement is either on the parent OR inherited by all the children, but not both, correct? | 19:37 |
| *** _dguerri is now known as dguerri | 19:38 | |
| *** thedodd has quit IRC | 19:38 | |
| *** jsavak has joined #openstack-keystone | 19:39 | |
| *** thedodd has joined #openstack-keystone | 19:41 | |
| stevemar | was there no meeting today? | 19:41 |
| stevemar | or was it just cut short/ | 19:41 |
| lbragstad | morganfainberg: dolphm jsavak what's bodaciously smart and interesting? | 19:41 |
| lbragstad | stevemar: there was, but it was short | 19:42 |
| morganfainberg | lbragstad: the shadow table thing | 19:42 |
| rodrigods | ayoung, correct | 19:42 |
| lbragstad | morganfainberg: oh yeah.. pretty slick | 19:42 |
| raildo | lbragstad, morganfainberg can you talk about the cache problem now? :) | 19:42 |
| morganfainberg | cache problem? | 19:43 |
| *** iurygregory has joined #openstack-keystone | 19:43 | |
| raildo | morganfainberg, ops, I forgot that I don't had explained for you. | 19:43 |
| morganfainberg | hehe | 19:43 |
| openstackgerrit | Merged openstack/oslo.policy: Remove support for Python 3.3 https://review.openstack.org/181767 | 19:44 |
| raildo | morganfainberg, lbragstad suggested here: https://review.openstack.org/#/c/158372/51/keystone/auth/controllers.py handle with the is_domain as a kwarg | 19:45 |
| *** markvoelker has joined #openstack-keystone | 19:45 | |
| raildo | morganfainberg, but when I try do this, the get_project_by_name https://review.openstack.org/#/c/158372/51/keystone/resource/core.py | 19:45 |
| morganfainberg | you can't use kwargs with caching | 19:46 |
| gyee | lbragstad, you read from both tables during upgrade | 19:46 |
| *** turul_ has joined #openstack-keystone | 19:46 | |
| morganfainberg | the cache decorator can't handle them | 19:46 |
| morganfainberg | for many many hard-to-fix reasons | 19:46 |
| raildo | yeap... this is the problem | 19:46 |
| morganfainberg | in short: don't | 19:46 |
| morganfainberg | i'll describe at the summit why it doesn't work [will take 5 mins at the summit] and like 20 to type it out ;) | 19:46 |
| morganfainberg | but it's based on how python processes default arguments and how you consume argspec for memoization via a decorator | 19:47 |
| raildo | morganfainberg, wow... i can wait for the summit :P | 19:47 |
| morganfainberg | default args are not passed to the method, but are part of "locals" | 19:47 |
| morganfainberg | and caching becomes hard with that. | 19:47 |
| raildo | the other problem is that this method is a public API call for v2, so I don't know if put is_domain as a obligated parameter is the right way | 19:48 |
| raildo | morganfainberg, so, maybe can I still setting the default value as hard-coded in the manager level? | 19:49 |
| morganfainberg | raildo: you'll see how we do it in some cases where the manager calls self._<same method, but memoized> | 19:49 |
| morganfainberg | where the argspec doesn't have default args | 19:50 |
| *** afazekas has quit IRC | 19:50 | |
| morganfainberg | so manager.get_thing(default_arg=None) | 19:50 |
| morganfainberg | and that calls self._get_thing(default_arg) | 19:50 |
| morganfainberg | and self._get_thing is memoized vs the main manager method you'd call elsewhere | 19:50 |
| raildo | morganfainberg, ok, i get it. thanks :) | 19:51 |
| *** gyee has quit IRC | 19:52 | |
| stevemar | link for working group sessions? | 19:53 |
| samueldmq | ayoung, you're right on that sentence | 19:54 |
| bknudson | any thoughts on keystoneclient / keystonemiddleware release? changes have been piling up. | 19:55 |
| ayoung | bknudson, after the summit | 19:55 |
| bknudson | I don't think anything's waiting on it, just don't like to see lots of changes piling up | 19:55 |
| morganfainberg | bknudson: yeah lets do that today or tomorrow. | 19:55 |
| ayoung | let's not spend the summit fixing something | 19:55 |
| ayoung | man | 19:55 |
| morganfainberg | or post summit | 19:56 |
| morganfainberg | but after tomorrow no go | 19:56 |
| bknudson | I hope it doesn't take us a week to recover from a botched release | 19:56 |
| morganfainberg | jamielennox: KSA - how close are we to a pre-release to pypi | 19:56 |
| morganfainberg | bknudson: it shouldn't... but if we're all at the summit we have other things to do than "fix" a botched release | 19:56 |
| morganfainberg | ;) | 19:56 |
| morganfainberg | unless we make henrynash handle it :P | 19:57 |
| bknudson | well, since I think it'll be 2.0 of keystoneclient it might be more difficult to back it off | 19:57 |
| morganfainberg | bknudson: then maybe we wait for the end of the summit? | 19:57 |
| bknudson | y, might as well wait until after the summit | 19:58 |
| morganfainberg | bknudson: sounds good. | 19:58 |
| morganfainberg | bknudson: maybe we'll release on friday before people hop on planes >> | 19:58 |
| bknudson | that would also be a good time to upgrade gerrit, too. | 19:58 |
| morganfainberg | haha | 20:00 |
| morganfainberg | i'll suggest it to the infra folks | 20:00 |
| morganfainberg | :P | 20:00 |
| lbragstad | gyee I don't think so, the second table has a different name | 20:02 |
| *** topol has quit IRC | 20:03 | |
| *** ayoung has quit IRC | 20:07 | |
| *** lufix has quit IRC | 20:09 | |
| *** iamjarvo_ has quit IRC | 20:12 | |
| *** iamjarvo has joined #openstack-keystone | 20:16 | |
| *** iamjarvo has quit IRC | 20:16 | |
| *** iamjarvo has joined #openstack-keystone | 20:17 | |
| *** ayoung has joined #openstack-keystone | 20:19 | |
| *** ChanServ sets mode: +v ayoung | 20:19 | |
| *** ayoung has quit IRC | 20:21 | |
| *** ayoung has joined #openstack-keystone | 20:21 | |
| *** sendak.freenode.net sets mode: +v ayoung | 20:21 | |
| *** lmtaylor1 has quit IRC | 20:28 | |
| *** markvoelker has quit IRC | 20:30 | |
| *** lmtaylor1 has joined #openstack-keystone | 20:30 | |
| samueldmq | morganfainberg, did you see bug #1207922 ? | 20:31 |
| openstack | bug 1207922 in keystonemiddleware "auth_token middleware always use v2.0 to request admin token" [High,Confirmed] https://launchpad.net/bugs/1207922 - Assigned to Jamie Lennox (jamielennox) | 20:31 |
| samueldmq | morganfainberg, I think this is what causes devstack to fail when we have v3 only | 20:31 |
| jamielennox | that should be closed... | 20:31 |
| samueldmq | ( at least one of the things ) | 20:31 |
| samueldmq | jamielennox, oh great .. fix released ? | 20:32 |
| jamielennox | samueldmq: if you use auth plugins then it should do the right thing | 20:32 |
| jamielennox | it was just that the old admin_user etc options are v2 specific | 20:33 |
| samueldmq | jamielennox, cool .. but we can't use the admin user on v3 ? | 20:33 |
| samueldmq | jamielennox, how devstack is supposed to create data before any project/user/role assignment exists ? | 20:33 |
| *** leveldoc has quit IRC | 20:34 | |
| samueldmq | in a v3 only environemnt | 20:34 |
| *** leveldoc has joined #openstack-keystone | 20:34 | |
| richm | admin_token? | 20:37 |
| *** openstackgerrit has quit IRC | 20:37 | |
| *** openstackgerrit has joined #openstack-keystone | 20:37 | |
| richm | samueldmq: take a look a nkinder's scripts https://github.com/nkinder/rdo-vm-factory/blob/master/rdo-domain-setup/vm-post-cloud-init-rdo.sh | 20:38 |
| richm | samueldmq: never mind | 20:38 |
| richm | that's not what it is doing | 20:38 |
| jamielennox | samueldmq: i don't think that's different between v2 and v3 | 20:39 |
| richm | samueldmq: but you can use admin_token to bootstrap the v3 stuff - once the v3 policy is in place, it is recommended to use v3 auth | 20:39 |
| richm | you can continue to use the admin_token, but you'll have to hack your v3 policy to add is_admin:1 in a few places | 20:39 |
| *** radez is now known as radez_g0n3 | 20:44 | |
| jamielennox | richm: samueldmq was doing the v3 only gate job we talked about | 20:44 |
| jamielennox | if you are looking for more current information | 20:44 |
| *** rlt_ has joined #openstack-keystone | 20:44 | |
| samueldmq | richm, jamielennox k got it ... I will try again and see what it gives .. but I remember it was saying me a domain_id must be specified to get the token .. and there was no data created .. | 20:45 |
| samueldmq | maybe it's just the way devstack is using it which is wrong | 20:45 |
| jamielennox | samueldmq: are you using the v3 policy file or the original one? | 20:45 |
| samueldmq | jamielennox, the original one ... | 20:45 |
| jamielennox | then that's weird | 20:46 |
| jamielennox | using the ADMIN_TOKEN? | 20:46 |
| samueldmq | jamielennox, richm btw, the patches for the gate jobs can be found here https://review.openstack.org/#/q/status:open+branch:master+topic:identity-v3-only-jobs,n,z | 20:46 |
| samueldmq | morgan gave a +1 in the devstack change | 20:46 |
| jamielennox | samueldmq: looking at https://review.openstack.org/#/c/179663/5/stackrc | 20:49 |
| jamielennox | directly above your change is IDENTITY_API_VERSION, would we not want to incorporate that somehow? | 20:49 |
| bknudson | jamielennox: I made the same comment | 20:49 |
| bknudson | https://review.openstack.org/#/c/179663/3..5/stackrc | 20:50 |
| samueldmq | jamielennox, yes and we do now, see https://review.openstack.org/#/c/179663/5/lib/keystone | 20:50 |
| samueldmq | export IDENTITY_API_VERSION=3 | 20:50 |
| samueldmq | bknudson, cc ^ | 20:50 |
| samueldmq | bknudson, I included this after your comment | 20:50 |
| bknudson | it's still confusing | 20:50 |
| bknudson | why not have IDENTITY_API_VERSION=v3-only ? | 20:51 |
| jamielennox | bknudson: that value is used in openrc and other places so you would have to strip the -only from it | 20:51 |
| bknudson | translate it however you want. | 20:51 |
| bknudson | I don't think devstack even works if you set it to 3 | 20:52 |
| *** e0ne has quit IRC | 20:52 | |
| jamielennox | i really doubt it | 20:52 |
| bknudson | should just get rid of the option if it doesn't work | 20:53 |
| *** iamjarvo has quit IRC | 20:53 | |
| *** e0ne has joined #openstack-keystone | 20:53 | |
| jamielennox | samueldmq: i'll comment on the review but i want to get rid of https://github.com/openstack-dev/devstack/blob/master/lib/keystone#L429 | 20:54 |
| jamielennox | I don't want to append /v3 to the keystone catalog url, just be the root keystone url | 20:54 |
| jamielennox | i'm not sure if that will be more or less problems | 20:55 |
| samueldmq | jamielennox, yes sure ;; other changes to make devstack work properlyu will follow this patch | 20:55 |
| bknudson | v3 isn't going to work in the catalog since clients don't know what version the keystone endpoint supports | 20:55 |
| samueldmq | jamielennox, and effectivelly use it | 20:56 |
| bknudson | they think the identity endpoint is v2.0 | 20:56 |
| samueldmq | but if we specify no version, it defaults to v3 somehow, rihgt ? | 20:56 |
| bknudson | if there's no version in the catalog or if there is a version clients are going to assume it's v2. | 20:57 |
| bknudson | because that's what it's always been | 20:57 |
| jamielennox | right some things will break with removing /v2.0 | 20:58 |
| bknudson | unless clients have all been updated to fetch the endpoint to discover what version it is | 20:58 |
| jamielennox | but we're supposed to list the root url and then services query that and discover what versions are available | 20:58 |
| jamielennox | if just update to /v3 then things that assume /v2.0 will still break and we will be in the same problem in future | 20:59 |
| samueldmq | getting a multiple choices ? and choosing the verison | 20:59 |
| jamielennox | yes | 21:00 |
| jamielennox | samueldmq: commented | 21:00 |
| *** lhcheng has quit IRC | 21:00 | |
| *** gyee has joined #openstack-keystone | 21:01 | |
| *** ChanServ sets mode: +v gyee | 21:01 | |
| jamielennox | i made another on the choice of flag name, i wouldn't -1 it based on that but it feels a little wrong at the moment | 21:01 |
| samueldmq | jamielennox, nice thanks for your review, will take a look | 21:01 |
| *** iamjarvo has joined #openstack-keystone | 21:01 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove discover and iso8601 dependencies https://review.openstack.org/177687 | 21:02 |
| *** e0ne has quit IRC | 21:03 | |
| samueldmq | jamielennox, hmm .. I kinda hate you ... you're good with names :) | 21:03 |
| samueldmq | jamielennox, IDENTITY_DISABLE_V2 looks better | 21:03 |
| *** iamjarvo has quit IRC | 21:04 | |
| jamielennox | me? i'm terrible with names | 21:04 |
| *** lhcheng has joined #openstack-keystone | 21:04 | |
| *** ChanServ sets mode: +v lhcheng | 21:04 | |
| jamielennox | that was probably the 3rd one i typed into that comment | 21:04 |
| samueldmq | hehe | 21:05 |
| *** ankita_w_ has joined #openstack-keystone | 21:05 | |
| samueldmq | jamielennox, regarding the urls that should not be versioned in the catalog in v3 ... | 21:06 |
| jamielennox | samueldmq: that's something i've been trying to do for a while | 21:06 |
| jamielennox | if it breaks other things in devstack we can do it as a seperate change | 21:06 |
| samueldmq | jamielennox, do you think that is part of that patch ? I think that is much more the patches that will be coming in order to make devstack work properly with v3 only | 21:06 |
| samueldmq | jamielennox, yeah it's already broken as it is ... devstack need other changes | 21:07 |
| *** jsavak has quit IRC | 21:07 | |
| *** stevemar has quit IRC | 21:08 | |
| *** iamjarvo has joined #openstack-keystone | 21:08 | |
| *** iamjarvo has quit IRC | 21:08 | |
| *** iamjarvo has joined #openstack-keystone | 21:09 | |
| openstackgerrit | Victor Stinner proposed openstack/python-keystoneclient: Remove unused fixtures https://review.openstack.org/182453 | 21:09 |
| *** iamjarvo has quit IRC | 21:09 | |
| *** ankita_wagh has quit IRC | 21:09 | |
| samueldmq | jamielennox, bknudson sorry need to go afk for a bit | 21:09 |
| lbragstad | dstanek: catching up now, what questions did you have about our code discussion yesterday? | 21:10 |
| jamielennox | samueldmq: np, are you at summit? | 21:11 |
| *** ayoung has quit IRC | 21:12 | |
| *** gyee has quit IRC | 21:13 | |
| *** gyee has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v gyee | 21:15 | |
| *** rlt_ has quit IRC | 21:22 | |
| *** chlong has quit IRC | 21:24 | |
| *** ayoung has joined #openstack-keystone | 21:25 | |
| *** ChanServ sets mode: +v ayoung | 21:25 | |
| *** iamjarvo has joined #openstack-keystone | 21:26 | |
| *** iamjarvo has quit IRC | 21:26 | |
| *** blewis has quit IRC | 21:27 | |
| *** haneef has quit IRC | 21:28 | |
| dstanek | jamielennox: yes, samueldmq will be there | 21:28 |
| jamielennox | dstanek: thanks | 21:28 |
| *** iamjarvo has joined #openstack-keystone | 21:29 | |
| *** haneef has joined #openstack-keystone | 21:29 | |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: Handle attempts to "filter" list() calls by globally unique IDs https://review.openstack.org/182459 | 21:29 |
| *** SunnyRainbow has quit IRC | 21:30 | |
| *** emagana has quit IRC | 21:30 | |
| *** emagana has joined #openstack-keystone | 21:30 | |
| *** mattfarina has quit IRC | 21:35 | |
| *** lmtaylor1 has left #openstack-keystone | 21:40 | |
| *** ayoung has quit IRC | 21:41 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve error message when tenant ID does not exist https://review.openstack.org/131255 | 21:43 |
| *** lhcheng_ has joined #openstack-keystone | 21:49 | |
| *** lhcheng has quit IRC | 21:49 | |
| *** iamjarvo has quit IRC | 21:55 | |
| *** ksavich has quit IRC | 22:09 | |
| *** wasmum has quit IRC | 22:09 | |
| *** ankita_w_ has quit IRC | 22:10 | |
| *** ksavich has joined #openstack-keystone | 22:12 | |
| *** ankita_wagh has joined #openstack-keystone | 22:13 | |
| *** jaypipes has quit IRC | 22:13 | |
| *** wasmum has joined #openstack-keystone | 22:16 | |
| *** bknudson has quit IRC | 22:18 | |
| *** josecastroleon has joined #openstack-keystone | 22:23 | |
| *** markvoelker has joined #openstack-keystone | 22:24 | |
| *** thedodd has quit IRC | 22:24 | |
| *** Rockyg has quit IRC | 22:24 | |
| *** josecastroleon has quit IRC | 22:24 | |
| *** dims_ has joined #openstack-keystone | 22:28 | |
| *** dims has quit IRC | 22:30 | |
| *** iamjarvo has joined #openstack-keystone | 22:31 | |
| *** iamjarvo has quit IRC | 22:31 | |
| *** ksavich has quit IRC | 22:41 | |
| *** ericksonfgds has joined #openstack-keystone | 22:50 | |
| *** lhcheng_ is now known as lhcheng | 22:56 | |
| *** ChanServ sets mode: +v lhcheng | 22:56 | |
| *** emagana has quit IRC | 23:06 | |
| *** jimbaker has quit IRC | 23:07 | |
| dstanek | sqlalchemy-migrate is super frustrating - i just want to know why it doesn't like it when sqlite dbs have fks | 23:08 |
| *** markvoelker has quit IRC | 23:08 | |
| *** mestery has joined #openstack-keystone | 23:09 | |
| *** jimbaker has joined #openstack-keystone | 23:11 | |
| *** jimbaker has quit IRC | 23:11 | |
| *** jimbaker has joined #openstack-keystone | 23:11 | |
| *** SunnyRainbow has joined #openstack-keystone | 23:12 | |
| *** chlong has joined #openstack-keystone | 23:15 | |
| * morganfainberg glares at internets | 23:26 | |
| * morganfainberg is back... for a 3rd time | 23:26 | |
| *** SunnyRainbow has quit IRC | 23:38 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone-specs: Updated endpoint enforcement spec https://review.openstack.org/174799 | 23:45 |
| sigmavirus24 | morganfainberg: go home, you don't need more internet =P | 23:46 |
| morganfainberg | sigmavirus24: hahahaha | 23:46 |
| morganfainberg | sigmavirus24: coffee shop wifi is better than home wifi today | 23:46 |
| morganfainberg | and i've only been dropped 4 times here | 23:46 |
| sigmavirus24 | all the more reason to go home | 23:46 |
| jamielennox | yep, that's the universe telling you to stop working | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!