| morganfainberg | vilobhmm: there was a nova spec... let me see if i can find it | 00:00 |
|---|---|---|
| morganfainberg | that was meant for cleanup/new quota allocations etc | 00:00 |
| morganfainberg | vilobhmm: https://review.openstack.org/#/c/92507/ and https://review.openstack.org/#/c/160605/ | 00:02 |
| vilobhmm | thanks morganfainberg | 00:06 |
| *** mattfarina has quit IRC | 00:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove the deprecated external authentication methods https://review.openstack.org/185541 | 00:08 |
| morganfainberg | yay Dave Chen doing cleanup stuff! yay! | 00:12 |
| * morganfainberg doesn't know Dave Chen's irc...so... | 00:12 | |
| morganfainberg | still cheering! | 00:12 |
| morganfainberg | zigo: since i see you're around... did we finally get keystoneclient happier w/ py3 packaging? | 00:14 |
| zigo | morganfainberg: Nop, we need pysaml2 to understand Py3, and Clint Byrum is working on that. | 00:15 |
| zigo | morganfainberg: He did lots of it already. | 00:15 |
| morganfainberg | zigo: great just checking in | 00:15 |
| morganfainberg | zigo: thanks! | 00:15 |
| zigo | morganfainberg: All the rest has been done already. | 00:15 |
| morganfainberg | zigo: woohoo | 00:15 |
| zigo | morganfainberg: Victor wrote a huge patch for memcached ! :) | 00:15 |
| zigo | It's not merged upstream yet, but I already uploaded the package with the patch to Sid. | 00:16 |
| jamielennox | zigo: memcached for auth_token middleware? | 00:18 |
| morganfainberg | zigo: fwiw we are still planning to move to pymemcache | 00:18 |
| zigo | jamielennox: Yup. | 00:19 |
| morganfainberg | zigo: and ditch python-memcache altogether | 00:19 |
| jamielennox | is there a use for dogpile there? | 00:19 |
| morganfainberg | jamielennox: same issue, but yes. | 00:19 |
| morganfainberg | we should move to dogpile. | 00:19 |
| jamielennox | morganfainberg: same issue - but not our issue :) | 00:19 |
| zigo | morganfainberg: Yeah, but it's *done*, so that is already out of the way for Py3 support. | 00:19 |
| morganfainberg | jamielennox: there is a wonderful person (she was one of the women in openstack scholarship winners from HP) who is helping oslo team do better cache w/ dogpile | 00:20 |
| morganfainberg | jamielennox: thats what I want us to use. | 00:20 |
| morganfainberg | zigo: sure. | 00:20 |
| morganfainberg | zigo: hope we can have keystone fully py3 friendly this cycle | 00:20 |
| morganfainberg | zigo: move to ldap3 is one of the major blockers. | 00:20 |
| zigo | morganfainberg: I hope we can have that AND all of oslo too. | 00:20 |
| morganfainberg | zigo: but i am optimistic it will happen | 00:20 |
| morganfainberg | zigo: oslo - i can't make promises | 00:21 |
| zigo | morganfainberg: qpid is the blocker here. | 00:21 |
| morganfainberg | zigo: oh. i don't really care about qpid. | 00:21 |
| morganfainberg | at all | 00:21 |
| zigo | morganfainberg: I don't either, but it's still on our way to get stuff moved to Py3. | 00:21 |
| morganfainberg | isn't qpid going away? </heard rumors> | 00:21 |
| zigo | So we should either remove it completely, or port it to Py3. | 00:21 |
| zigo | morganfainberg: It's planned for in 2 releases. | 00:21 |
| morganfainberg | i think it is deprecated / will be | 00:22 |
| morganfainberg | and going away | 00:22 |
| morganfainberg | then.. in 2 releases boom | 00:22 |
| morganfainberg | :) | 00:22 |
| zigo | So that's not an option to say "it's going to be releases". | 00:22 |
| zigo | I'm not going to wait another year... | 00:22 |
| zigo | Porting Qpid to Py3 will be faster. | 00:22 |
| morganfainberg | zigo: maybe we can split qpid bits out to their own little world | 00:22 |
| zigo | I'd be all for it. | 00:22 |
| morganfainberg | and say "must run py27 if you want it" | 00:22 |
| zigo | It's contained into oslo.messaging, but everything depends on that... | 00:22 |
| * morganfainberg has no horse in this race | 00:22 | |
| zigo | Including a bunch of other oslo libs. | 00:22 |
| morganfainberg | zigo: it might be possible to just split that bit out. | 00:23 |
| morganfainberg | *might* | 00:23 |
| morganfainberg | like we're working on for the auth plugins | 00:23 |
| zigo | The issue is that unit test listing must also work in py3, and that cannot be done if we keep a single "import qpid" | 00:23 |
| morganfainberg | zigo: ah see that is why you do it like dogpile does. lazy import | 00:23 |
| zigo | morganfainberg: Any chance to get a SQRL pluggin for Horizon one day? :) | 00:23 |
| morganfainberg | SQRL? | 00:24 |
| * morganfainberg is unfamiliar with that initialism | 00:24 | |
| zigo | morganfainberg: It's a login system without login/password pairs. | 00:24 |
| morganfainberg | oh | 00:24 |
| zigo | Just identity based or keys. | 00:24 |
| zigo | The server doesn't even store anything for you, so you don't have to trust it. | 00:24 |
| morganfainberg | well... WebSSO is there, meaning you can login w/ whatever IdP you have | 00:24 |
| zigo | It only knows who you are. | 00:24 |
| morganfainberg | which *could* be cert-only | 00:25 |
| morganfainberg | or similar | 00:25 |
| zigo | With SSO, you trust *less* server, but you still trust someone to store your login/pass in a db. | 00:25 |
| morganfainberg | zigo: you still trust someone to verify who you are | 00:25 |
| morganfainberg | the IdP may only use keys | 00:25 |
| morganfainberg | nothing saying it has to be username/password | 00:25 |
| kfox1111 | Ah... client.service_catalog.catalog.... very interesting. | 00:25 |
| zigo | https://www.grc.com/sqrl/sqrl.htm | 00:25 |
| morganfainberg | it could also just translate a DN from a cert to something useful | 00:26 |
| morganfainberg | i don't see a win for SQRL like login since we still need the authz metadata, i'd push off to an IdP that does SQRL then | 00:26 |
| morganfainberg | i don't want to support every form of auth ;) i want to have a few standards that let anyone convey authn to us | 00:27 |
| morganfainberg | OIDC, SAML, etc | 00:27 |
| zigo | Anyway, I'm getting-up in a few hours, I shouldn't be up this late. | 00:27 |
| zigo | Bye. | 00:27 |
| morganfainberg | zigo: have a good night | 00:27 |
| jamielennox | morganfainberg: was there a plan to do another ksc release before 2.0 | 00:28 |
| morganfainberg | jamielennox: yes | 00:28 |
| morganfainberg | jamielennox: was on my list to do today | 00:28 |
| jamielennox | ah | 00:28 |
| morganfainberg | jamielennox: will still happen today-ish | 00:29 |
| morganfainberg | just got meeting wrapped up and stuff. | 00:29 |
| jamielennox | any chance i could get https://review.openstack.org/#/c/179563/ | 00:29 |
| morganfainberg | (and booking travel) | 00:29 |
| jamielennox | i came across another cli today doing things completely wrong and abusing sessions, but i'm not going to rewrite that cli plugin every time | 00:29 |
| morganfainberg | jamielennox: find me another +2, i want it gating in the next 20mins so i can actually release today | 00:30 |
| morganfainberg | jamielennox: i don't mind waiting if we can dig up a second +2 for it | 00:30 |
| jamielennox | ayoung: awake? | 00:30 |
| jamielennox | gyee: awake? | 00:30 |
| morganfainberg | jamielennox: and we are holding 2.0 for KSA *and* cli/middleware removal | 00:31 |
| jamielennox | yea, that's going to take some time | 00:31 |
| morganfainberg | lets not wait too long on it if possible | 00:31 |
| morganfainberg | but more important is to get ksa out the door | 00:32 |
| morganfainberg | we can lag a little on the convert to using ksa | 00:32 |
| *** tobe has joined #openstack-keystone | 00:32 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystonemiddleware: Send the correct user-agent to Keystone https://review.openstack.org/180769 | 00:35 |
| *** tobe has quit IRC | 00:36 | |
| jamielennox | it's glorious: https://viswaug.files.wordpress.com/2008/11/http-headers-status1.png | 00:43 |
| morganfainberg | oh.. wow | 00:44 |
| *** zzzeek has quit IRC | 00:45 | |
| gyee | jamielennox, yes sir | 00:46 |
| gyee | scrolling back | 00:46 |
| *** timcline has joined #openstack-keystone | 00:47 | |
| jamielennox | https://review.openstack.org/#/c/179563/ | 00:47 |
| gyee | looking | 00:47 |
| jamielennox | gyee: ^ can you hace a look at that one | 00:47 |
| *** kfox1111 has quit IRC | 00:47 | |
| *** vilobhmm has quit IRC | 00:47 | |
| gyee | jamielennox, where's the bp/bug? | 00:49 |
| * gyee puts on the bknudson hat | 00:49 | |
| morganfainberg | gyee: careful with that hat... with great power.... something something something | 00:49 |
| jamielennox | damn, if it's not linked i didn't do one | 00:49 |
| jamielennox | i always forget to do a bug | 00:49 |
| gyee | ha | 00:49 |
| jamielennox | it never seems right for a new feature | 00:49 |
| gyee | we need to doc it, hence bp/bug | 00:50 |
| jamielennox | yea | 00:50 |
| gyee | -1! | 00:50 |
| jamielennox | ok, -1 it, morganfainberg can release without it | 00:50 |
| morganfainberg | we don't *have* to wait for a 2.0 for it to land | 00:50 |
| morganfainberg | we just have enough backed up we need a 1.4 this week | 00:51 |
| morganfainberg | so maybe we will have a 1.5 mini release prior to 2.x | 00:51 |
| *** timcline has quit IRC | 00:51 | |
| morganfainberg | ooooor we just say "f-it" and when the time comes to merge in ksa we 2.0 branch all the things | 00:51 |
| jamielennox | oh yea, i wouldn't say this will be the last 1.x it was just something i always put off because i don't want to fix people's crappy clis | 00:52 |
| jamielennox | but the ironic one is super broken | 00:52 |
| *** dsirrine has joined #openstack-keystone | 00:53 | |
| *** dsirrine has quit IRC | 00:54 | |
| *** dsirrine has joined #openstack-keystone | 00:54 | |
| *** rushiagr_away is now known as rushiagr | 00:56 | |
| morganfainberg | and we want ironic people to be happy | 00:57 |
| *** _cjones_ has quit IRC | 00:59 | |
| *** _cjones_ has joined #openstack-keystone | 00:59 | |
| *** gyee has quit IRC | 01:07 | |
| *** alanf-mc_ has quit IRC | 01:16 | |
| *** tobe has joined #openstack-keystone | 01:18 | |
| *** vilobhmm has joined #openstack-keystone | 01:20 | |
| *** rushiagr is now known as rushiagr_away | 01:24 | |
| *** lhcheng has joined #openstack-keystone | 01:27 | |
| *** ChanServ sets mode: +v lhcheng | 01:27 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: A Default CLI plugin https://review.openstack.org/179563 | 01:27 |
| *** lhcheng_ has joined #openstack-keystone | 01:29 | |
| *** browne has quit IRC | 01:29 | |
| *** markvoelker has quit IRC | 01:30 | |
| *** markvoelker_ has joined #openstack-keystone | 01:30 | |
| *** Rockyg has quit IRC | 01:31 | |
| *** lhcheng has quit IRC | 01:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Add testcases to test DefaultDomain https://review.openstack.org/185855 | 01:34 |
| *** dims_ has quit IRC | 01:35 | |
| *** dsirrine has quit IRC | 01:38 | |
| *** vilobhmm has quit IRC | 01:38 | |
| *** vilobhmm has joined #openstack-keystone | 01:38 | |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 01:47 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 01:50 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Serialize user auth plugin https://review.openstack.org/167181 | 01:50 |
| *** vilobhmm has quit IRC | 01:55 | |
| *** gokrokve has joined #openstack-keystone | 02:00 | |
| *** _cjones_ has quit IRC | 02:04 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Enable service role to list/get users https://review.openstack.org/181298 | 02:05 |
| mfisch | here's my first fernet bug: https://bugs.launchpad.net/keystone/+bug/1459483 | 02:06 |
| openstack | Launchpad bug 1459483 in Keystone "able to verify a Fernet token with garbage at the end" [Undecided,New] | 02:06 |
| mfisch | that should say "Validate" ^ | 02:07 |
| *** rushiagr_away is now known as rushiagr | 02:08 | |
| *** liusheng has quit IRC | 02:08 | |
| *** liusheng has joined #openstack-keystone | 02:08 | |
| *** spandhe has quit IRC | 02:15 | |
| *** gokrokve has quit IRC | 02:17 | |
| *** gokrokve has joined #openstack-keystone | 02:23 | |
| *** gokrokve has quit IRC | 02:29 | |
| *** browne has joined #openstack-keystone | 02:29 | |
| ayoung | mfisch, why is that a bug? | 02:29 |
| *** gokrokve has joined #openstack-keystone | 02:30 | |
| ayoung | mfisch, works as designed | 02:30 |
| *** gokrokve has quit IRC | 02:31 | |
| *** alanf-mc has joined #openstack-keystone | 02:32 | |
| *** lhcheng_ has quit IRC | 02:37 | |
| jamielennox | hmm, i'd consider it a bug but fairly low priority | 02:39 |
| jamielennox | if nothign else there is an element of known plaintext there, probably not a big problem though | 02:39 |
| *** rwsu has quit IRC | 02:46 | |
| *** rushiagr is now known as rushiagr_away | 02:55 | |
| *** alanf-mc_ has joined #openstack-keystone | 02:59 | |
| *** alanf-mc has quit IRC | 03:01 | |
| *** alanf-mc_ has quit IRC | 03:01 | |
| *** alanf-mc has joined #openstack-keystone | 03:03 | |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 03:06 |
| *** samueldmq has quit IRC | 03:08 | |
| morganfainberg | mfisch: not sure if it's a bug or the way b64decoder is working | 03:16 |
| morganfainberg | mfisch: does any garbage work? | 03:16 |
| morganfainberg | mfisch: or just urlencoded junk | 03:16 |
| morganfainberg | if it's the latter, i'd say we're ok, because urlencoded junk is really not allowed in the token id. | 03:17 |
| morganfainberg | and if it's in the middle it is def. not going to validate | 03:17 |
| morganfainberg | and %3D is '=' which could be padding. | 03:18 |
| morganfainberg | in normal b64 | 03:18 |
| *** mabrams has joined #openstack-keystone | 03:29 | |
| ayoung | morganfainberg, he appended garbage on to the token. THe encoded part probably has a length, and ignores anything beyond that, but then it gets copied in as the ID later in the process | 03:41 |
| ayoung | we should probably have a length check in in there ,and reject if there is anything outside the encoded portion, but, meh...not a huge deal. Should be fixed, though | 03:41 |
| *** ayoung has quit IRC | 03:42 | |
| morganfainberg | sure | 03:42 |
| *** rushiagr_away is now known as rushiagr | 04:00 | |
| *** spandhe has joined #openstack-keystone | 04:01 | |
| *** spandhe_ has joined #openstack-keystone | 04:05 | |
| *** jaison has joined #openstack-keystone | 04:05 | |
| *** spandhe has quit IRC | 04:06 | |
| *** spandhe_ is now known as spandhe | 04:06 | |
| *** tobe has quit IRC | 04:36 | |
| *** openstackgerrit has quit IRC | 04:50 | |
| *** openstackgerrit has joined #openstack-keystone | 04:51 | |
| *** lhcheng has joined #openstack-keystone | 04:56 | |
| *** ChanServ sets mode: +v lhcheng | 04:56 | |
| *** lhcheng_ has joined #openstack-keystone | 04:57 | |
| *** mdrnstm has joined #openstack-keystone | 04:58 | |
| *** ChanServ sets mode: +v mdrnstm | 04:58 | |
| *** davechen has joined #openstack-keystone | 05:00 | |
| *** lhcheng has quit IRC | 05:01 | |
| mdrnstm | sure is quiet this evening | 05:01 |
| *** cloudm2 has quit IRC | 05:02 | |
| *** gokrokve has joined #openstack-keystone | 05:03 | |
| *** stevemar has joined #openstack-keystone | 05:06 | |
| *** ChanServ sets mode: +v stevemar | 05:06 | |
| mdrnstm | stevemar: we need to finish up a slide deck | 05:06 |
| mdrnstm | stevemar: sorry been swamped with meetings. i'll be working on the k2k diagram and the keystone architecture diagram shortly | 05:06 |
| stevemar | mdrnstm, same | 05:09 |
| stevemar | mdrnstm, i spoke with the guy from CIS, he said friday EOD is good | 05:09 |
| stevemar | so we have some buffer | 05:09 |
| mdrnstm | stevemar: great | 05:09 |
| stevemar | what the heck is app-catalog | 05:09 |
| *** gokrokve has quit IRC | 05:10 | |
| *** gokrokve has joined #openstack-keystone | 05:10 | |
| mdrnstm | stevemar: a name that is not correct. i need to step in here shortly | 05:10 |
| mdrnstm | and say "uhhhhhhhhhhhhh" | 05:10 |
| mdrnstm | or something useful | 05:10 |
| stevemar | select all -> delete | 05:11 |
| *** gokrokve has quit IRC | 05:11 | |
| mdrnstm | stevemar: '; drop tables apps; | 05:11 |
| mdrnstm | >.> | 05:11 |
| *** gokrokve has joined #openstack-keystone | 05:12 | |
| stevemar | hehe | 05:12 |
| stevemar | omgggg someone is going to do cinder v2 stuff for osc | 05:12 |
| stevemar | and it's not ME! | 05:12 |
| *** qianli has joined #openstack-keystone | 05:16 | |
| *** gokrokve has quit IRC | 05:17 | |
| *** gokrokve has joined #openstack-keystone | 05:18 | |
| *** jaison has quit IRC | 05:18 | |
| *** kiran-r has joined #openstack-keystone | 05:21 | |
| *** kiranr has joined #openstack-keystone | 05:22 | |
| *** gokrokve has quit IRC | 05:23 | |
| *** kiran-r has quit IRC | 05:24 | |
| *** kiranr is now known as kiran-r | 05:24 | |
| *** kiranr has joined #openstack-keystone | 05:25 | |
| *** fifieldt has joined #openstack-keystone | 05:25 | |
| *** kiran-r has quit IRC | 05:25 | |
| *** kiran-r has joined #openstack-keystone | 05:25 | |
| *** kiran-r has quit IRC | 05:26 | |
| *** kiranr has quit IRC | 05:26 | |
| *** kiran-r has joined #openstack-keystone | 05:27 | |
| *** mdrnstm is now known as morgan | 05:31 | |
| *** lhcheng_ has quit IRC | 05:37 | |
| *** lhcheng has joined #openstack-keystone | 05:38 | |
| *** ChanServ sets mode: +v lhcheng | 05:38 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix assertion examples https://review.openstack.org/185985 | 05:40 |
| *** harlowja_ has quit IRC | 05:40 | |
| *** gokrokve has joined #openstack-keystone | 05:41 | |
| *** setmason has quit IRC | 05:44 | |
| *** spandhe has quit IRC | 05:58 | |
| *** tobe has joined #openstack-keystone | 06:04 | |
| *** krykowski has joined #openstack-keystone | 06:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/186279 | 06:07 |
| *** setmason has joined #openstack-keystone | 06:12 | |
| *** setmason_ has joined #openstack-keystone | 06:14 | |
| *** lhcheng has quit IRC | 06:15 | |
| *** setmason has quit IRC | 06:17 | |
| *** setmason_ is now known as setmason | 06:17 | |
| *** _cjones_ has joined #openstack-keystone | 06:18 | |
| *** _cjones_ has quit IRC | 06:19 | |
| *** _cjones_ has joined #openstack-keystone | 06:19 | |
| *** stevemar has quit IRC | 06:25 | |
| *** lhcheng has joined #openstack-keystone | 06:28 | |
| *** ChanServ sets mode: +v lhcheng | 06:28 | |
| *** drjones has joined #openstack-keystone | 06:28 | |
| *** _cjones_ has quit IRC | 06:31 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fixe example code in Using Sessions page https://review.openstack.org/175135 | 06:41 |
| *** setmason has quit IRC | 06:41 | |
| *** setmason has joined #openstack-keystone | 06:42 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fixed grammatical errors in the V2 Client API doc https://review.openstack.org/186074 | 06:43 |
| *** alanf-mc has quit IRC | 06:43 | |
| *** ajayaa has joined #openstack-keystone | 06:54 | |
| *** vilobhmm has joined #openstack-keystone | 06:59 | |
| *** drjones has quit IRC | 07:03 | |
| *** vilobhmm has quit IRC | 07:10 | |
| *** setmason has quit IRC | 07:10 | |
| *** rlt_ has joined #openstack-keystone | 07:13 | |
| *** browne has quit IRC | 07:21 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: `api_curl_examples.rst` is out of date https://review.openstack.org/186310 | 07:44 |
| *** jistr has joined #openstack-keystone | 07:54 | |
| *** kiran-r is now known as help | 08:00 | |
| *** help is now known as Guest32271 | 08:00 | |
| *** Guest32271 is now known as kiran-r | 08:01 | |
| *** dims_ has joined #openstack-keystone | 08:02 | |
| *** lufix has joined #openstack-keystone | 08:05 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Remove oslo.i18n dependency https://review.openstack.org/185799 | 08:06 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Remove lxml test-requirement https://review.openstack.org/185790 | 08:06 |
| *** dims_ has quit IRC | 08:08 | |
| *** User17 has joined #openstack-keystone | 08:22 | |
| *** qianli has quit IRC | 08:23 | |
| User17 | hi all.. where i can get the passwords of user in keystone database | 08:24 |
| *** dguerri`away is now known as dguerri | 08:30 | |
| davechen | User17: you cannot, the password is hashed. | 08:32 |
| davechen | User17: The hashed value is in the table of user. | 08:34 |
| User17 | davechen: oh ok thanks.. i cant even change it with admin role?? | 08:34 |
| davechen | User17: I don't aware of a approach to update the password. | 08:35 |
| davechen | User17: you can try this command: user-password-update | 08:35 |
| davechen | User17: keystone user-password-update ... | 08:36 |
| morgan | davechen, User17: you can update the user with an admin role. via the update user API | 08:37 |
| openstackgerrit | Merged openstack/keystoneauth: Remove old request method https://review.openstack.org/185492 | 08:37 |
| morgan | the "user-password-update" action is meant to be used if you have the user's current password (non-admin, so a user can update their own password) | 08:37 |
| User17 | davechen:ok thank u.. i installed keystone from source... i added the user details.. i could be able to display it using keystone user-list.. but when i enter into keystone database.. the user table has nothing.. | 08:38 |
| davechen | morgan: Ah! you are still working. :) | 08:38 |
| morgan | davechen: shhhh don't tell anyone | 08:39 |
| davechen | morgan: everyone is dreaming... except three guys. | 08:39 |
| davechen | User17: it's not make sense, keystone user-list is actually read the database. | 08:41 |
| User17 | I can able to use --os-auth-url with two ports 5000 and 35357 and corresponding username and password credentials... what is the purpose of two ports over there.. I installed glance from source..It is using one one port for endpoint creation | 08:42 |
| User17 | <davechen>: thanks.. will check it | 08:43 |
| davechen | User17: one is public port and another is admin port, there is some action which could be only done with admin port imo. | 08:44 |
| lhcheng | User17: davechen is correct. port 5000 is for authentication, token validation. While port 35357 is the admin port, used for managing keystone user/group/roles. | 08:44 |
| morgan | lhcheng, davechen, User17: with V3 (and proper RBAC) all APIs are available on both ports. the strict admin vs non-admin break was specific to the Keystone V2 API | 08:45 |
| User17 | thanks davechen,lhcheng,morgan | 08:46 |
| morgan | ugh. 178 open reviews in keystone :( | 08:48 |
| morgan | sooooo much to review | 08:48 |
| davechen | User17: welcome. I am interesting in your db issue. | 08:49 |
| User17 | after installation of keystone and creation of keystone db.. what keystone db_sync will do?? will it create the tables with the schema provided in keystone source?? | 08:49 |
| User17 | thanks davechen.. :) | 08:50 |
| *** mkoderer has quit IRC | 08:50 | |
| davechen | morgan: fortunately, there is not much new patches recently, keep reviewing... :P | 08:50 |
| lhcheng | morgan: wow.. a lot of review to catch up to. :( should be able to spend more time reviewing later next week just have some more internal stuff to finish up. | 08:52 |
| morgan | lhcheng: realize i also just did a gertty sync, so it's missing a bunch of reviews i've already looked at | 08:52 |
| lhcheng | morgan: I hope it is not the review count that's keeping you up late. :P | 08:52 |
| morgan | nah | 08:52 |
| morgan | setting up new laptop | 08:52 |
| morgan | and all the toys that comes with that | 08:52 |
| *** mkoderer has joined #openstack-keystone | 08:53 | |
| morgan | plus needing to release a new python-keystoneclient | 08:53 |
| lhcheng | got the new macbook? | 08:53 |
| openstackgerrit | Merged openstack/keystoneauth: Make utils file private https://review.openstack.org/185806 | 08:53 |
| openstackgerrit | Merged openstack/keystoneauth: Remove oslo.utils dependency https://review.openstack.org/185807 | 08:53 |
| morgan | lhcheng: X1 Carbon 3rd Gen | 08:53 |
| User17 | <davechen> : same db issue was there.. user table still show empty.. but the command user-list is listed with few users... | 08:54 |
| davechen | User17: yep, db_sync will handle with DB migration for you. | 08:54 |
| morgan | ugh... we lost a release somewhere in keystoneclient :( | 08:55 |
| lhcheng | morgan: thought you were going for the macbook some time back | 08:55 |
| morgan | lhcheng: tired of yosemite | 08:56 |
| morgan | and linux works better on the X1C | 08:56 |
| morgan | so, using linux as the primary os for my work/travel laptop now | 08:56 |
| morgan | the 12" MacBook (i want it for many reasons) is out because the "core M" processor | 08:57 |
| morgan | that is a deal breaker | 08:57 |
| lhcheng | morgan: ah yosemite, I had a terrible experience when I upgraded. Keeps on freezing, turned off the graphics power save mode seem to fixed it. | 08:57 |
| User17 | <davechen> : thanks really... db_sync works perfectly in keystone.... i installed glance from source... and tried with glance-manage db_sync.. it throws an error " TRACE glance ValueError: Invalid target type: None" any idea? | 08:57 |
| lhcheng | morgan: ugh, understood | 08:59 |
| davechen | User17: How do you install openstack, from source or from the packages? | 08:59 |
| davechen | User17: I have no idea about the glance DB issue, sorry abou that. | 09:00 |
| lhcheng | morgan: okay, I'm out. It's been a long day. | 09:00 |
| lhcheng | good night everyone | 09:00 |
| davechen | lhcheng: good night. | 09:01 |
| breton | afternoon! | 09:01 |
| davechen | morgan: have a good dream. | 09:01 |
| morgan | breton: did you see my ping from much earlier re: alembic spec? | 09:01 |
| User17 | i installed keystone component seperately from source.. | 09:01 |
| lhcheng | and good day too for some folks :) | 09:01 |
| morgan | breton: lets get that retargeted to Liberty and get some work done on it as we discussed at the summit :) | 09:01 |
| User17 | davechen: i installed keystone component seperately from source.. thanks :) | 09:02 |
| breton | morgan: haven't seen, but now have. https://review.openstack.org/#/c/177220/ | 09:02 |
| *** lhcheng is now known as lhcheng_afk | 09:02 | |
| morgan | breton: perfect! | 09:02 |
| *** lhcheng_afk has quit IRC | 09:08 | |
| *** markvoelker_ has quit IRC | 09:16 | |
| *** e0ne has joined #openstack-keystone | 09:22 | |
| openstackgerrit | Merged openstack/keystone: Don't fail on converting user ids to bytes https://review.openstack.org/186120 | 09:29 |
| *** e0ne is now known as e0ne_ | 09:30 | |
| *** e0ne_ has quit IRC | 09:35 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** e0ne has joined #openstack-keystone | 09:57 | |
| *** dims_ has joined #openstack-keystone | 09:57 | |
| *** hogepodge has quit IRC | 10:11 | |
| *** afazekas_ has joined #openstack-keystone | 10:11 | |
| *** hogepodge has joined #openstack-keystone | 10:13 | |
| *** markvoelker has joined #openstack-keystone | 10:17 | |
| *** samueldmq has joined #openstack-keystone | 10:20 | |
| samueldmq | morning | 10:21 |
| *** markvoelker has quit IRC | 10:23 | |
| *** lufix has quit IRC | 10:26 | |
| breton | samueldmq: morning! | 10:27 |
| breton | dolphm: great blogpost! | 10:27 |
| breton | dolphm: I would love to see a follow-up about how clients should navigate the catalog | 10:28 |
| breton | dolphm: and what $(tenant_id)s is for, if it should not be used | 10:35 |
| samueldmq | breton, hmm, going to take a look at such post :) | 10:37 |
| *** e0ne is now known as e0ne_ | 10:39 | |
| *** e0ne_ has quit IRC | 10:45 | |
| *** lufix has joined #openstack-keystone | 10:45 | |
| *** e0ne has joined #openstack-keystone | 10:53 | |
| *** mabrams has quit IRC | 10:58 | |
| *** hogepodge has quit IRC | 10:59 | |
| *** dobson has quit IRC | 11:00 | |
| *** hogepodge has joined #openstack-keystone | 11:02 | |
| *** dobson has joined #openstack-keystone | 11:03 | |
| *** e0ne is now known as e0ne_ | 11:11 | |
| *** e0ne_ is now known as e0ne | 11:12 | |
| *** aix has joined #openstack-keystone | 11:13 | |
| *** dims_ has quit IRC | 11:16 | |
| *** dims_ has joined #openstack-keystone | 11:17 | |
| *** e0ne is now known as e0ne_ | 11:20 | |
| *** baffle_ is now known as baffle | 11:24 | |
| *** e0ne_ has quit IRC | 11:25 | |
| *** dims_ has quit IRC | 11:28 | |
| *** dims_ has joined #openstack-keystone | 11:28 | |
| *** tobe has quit IRC | 11:30 | |
| *** dims_ has quit IRC | 11:33 | |
| *** e0ne has joined #openstack-keystone | 11:34 | |
| samueldmq | jamielennox, fyi, devstack change for identity v3 only has merged | 11:35 |
| samueldmq | jamielennox, project-config change has +2, just waiting for mtreinish to take a look, since it's adding experimental jobs for tempest/devstack | 11:36 |
| samueldmq | jamielennox, https://review.openstack.org/#/c/179661/ | 11:36 |
| *** dobson has quit IRC | 11:37 | |
| *** openstackgerrit has quit IRC | 11:39 | |
| *** dobson has joined #openstack-keystone | 11:39 | |
| *** openstackgerrit has joined #openstack-keystone | 11:39 | |
| *** dims_ has joined #openstack-keystone | 11:39 | |
| *** tobe has joined #openstack-keystone | 11:39 | |
| *** afazekas_ is now known as afazekas | 11:42 | |
| *** radez_g0n3 is now known as radez | 11:43 | |
| jamielennox | samueldmq: yep - i've been watching it | 11:43 |
| *** aix has quit IRC | 11:44 | |
| samueldmq | jamielennox, great | 11:44 |
| jamielennox | i'm keen, there's a few things i want to try once we get that bit in | 11:44 |
| *** dobson has quit IRC | 11:47 | |
| *** rushiagr is now known as rushiagr_away | 11:48 | |
| samueldmq | jamielennox, nice, I hope it isn't taking longer to merge than you were expecting to :) | 11:49 |
| jamielennox | samueldmq: these things always take time | 11:49 |
| *** dobson has joined #openstack-keystone | 11:53 | |
| *** aix has joined #openstack-keystone | 11:59 | |
| openstackgerrit | Flavio Percoco proposed openstack/keystonemiddleware: Don't assume everyone uses `CONF` https://review.openstack.org/143063 | 11:59 |
| *** dsirrine has joined #openstack-keystone | 12:00 | |
| *** ajayaa has quit IRC | 12:00 | |
| *** markvoelker has joined #openstack-keystone | 12:02 | |
| *** fhubik has joined #openstack-keystone | 12:19 | |
| *** ajayaa has joined #openstack-keystone | 12:19 | |
| *** dsirrine has quit IRC | 12:22 | |
| *** ajayaa has quit IRC | 12:28 | |
| dolphm | lbragstad: will you backport 186120 to stable/kilo? | 12:29 |
| *** dsirrine has joined #openstack-keystone | 12:30 | |
| samueldmq | I think this is fair enough to be backported :) | 12:30 |
| samueldmq | although I do not know what exactly defines if a fix should be backported or not | 12:31 |
| dolphm | breton: we're stuck with tenant_ids in urls because swift | 12:32 |
| *** e0ne is now known as e0ne_ | 12:32 | |
| dolphm | samueldmq: https://wiki.openstack.org/wiki/StableBranch#Stable_branch_policy | 12:33 |
| samueldmq | swift is very different from other services.. I mean in the access control, they don't even have a policy file | 12:34 |
| samueldmq | looks like one openstack role is mapped there, and one with such role is able to do anything | 12:34 |
| samueldmq | dolphm, thanks for this link | 12:34 |
| *** ajayaa has joined #openstack-keystone | 12:40 | |
| *** e0ne_ has quit IRC | 12:43 | |
| *** e0ne has joined #openstack-keystone | 12:47 | |
| *** pauloewerton has quit IRC | 12:51 | |
| dolphm | lbragstad: we should log a warning when keystone generates a Fernet token > 255 chars | 12:58 |
| lbragstad | dolphm: yeah, that's a good idea. | 12:59 |
| *** krykowski has quit IRC | 12:59 | |
| *** krykowski has joined #openstack-keystone | 12:59 | |
| lbragstad | dolphm: and yes, I can do the backport | 12:59 |
| rodrigods | dolphm, ping... we want to backport this changes: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/kilo+topic:bug/1442787,n,z , bknudson is alreay ok with them, can you take a look whenever you have a moment? | 13:01 |
| *** Ephur has joined #openstack-keystone | 13:02 | |
| lbragstad | dolphm: morganfainberg backport to stable/kilo https://review.openstack.org/#/c/186376/ | 13:05 |
| *** krykowski has quit IRC | 13:06 | |
| *** krykowski has joined #openstack-keystone | 13:07 | |
| samueldmq | lbragstad, I was looking at your patch .. | 13:07 |
| samueldmq | lbragstad, isn't that the case to use attemp_ for trust_id as well ? | 13:08 |
| *** tobe has quit IRC | 13:08 | |
| samueldmq | lbragstad, hmm .. actually that is just the trust_id, not the trustor/trustee ... | 13:09 |
| samueldmq | lbragstad, but what about group_id | 13:09 |
| lbragstad | samueldmq: yep | 13:09 |
| lbragstad | samueldmq: I'm not sure about group ids | 13:10 |
| lbragstad | if they can be created externally with non uuid ids then that should be changed too. | 13:10 |
| *** fifieldt has quit IRC | 13:11 | |
| samueldmq | lbragstad, group_id = cls.convert_uuid_bytes_to_hex(group_id_in_bytes) | 13:11 |
| samueldmq | lbragstad, yeah that's the point, and I do thing groups may be imported from LDAP as well | 13:11 |
| lbragstad | samueldmq: ok, I can push a second patch then | 13:11 |
| samueldmq | lbragstad, yes that makes sense | 13:13 |
| samueldmq | lbragstad, https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1095 | 13:13 |
| *** bknudson has joined #openstack-keystone | 13:19 | |
| *** ChanServ sets mode: +v bknudson | 13:19 | |
| *** radez is now known as radez_g0n3 | 13:19 | |
| *** ayoung has joined #openstack-keystone | 13:20 | |
| *** ChanServ sets mode: +v ayoung | 13:20 | |
| *** nkinder has quit IRC | 13:21 | |
| samueldmq | lbragstad, also, even if it's not very used ... projects may also be coming from LDAP (https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L992) | 13:21 |
| samueldmq | lbragstad, I think we should be compatible, but I let you decide if we should support that with fernet :) | 13:22 |
| samueldmq | lbragstad, if we don't, I think we should document that | 13:22 |
| lbragstad | samueldmq: yeah, that makes sense. but at the same time the functionality is deprecated (shrug?) | 13:22 |
| lbragstad | morganfainberg: ^ | 13:23 |
| samueldmq | lbragstad, LDAP for resource ? I know LDAP for assignment is | 13:23 |
| dolphm | lbragstad: i was going to suggest doing the same for projects, but LDAP assignments is also deprecated. still minimal effort to support it, though | 13:23 |
| lbragstad | I can roll it into the patch I'm working on | 13:23 |
| samueldmq | great :) | 13:24 |
| lbragstad | nice catch samueldmq | 13:24 |
| dolphm | lbragstad: groups can come from LDAP, but i know of literally no one that's using that... nor how they would go about using it effectively, it's never made sense to me | 13:24 |
| samueldmq | lbragstad, thanks, sorry for not reviewing that before | 13:24 |
| *** fhubik is now known as fhubik_afk | 13:24 | |
| lbragstad | samueldmq: no worries, | 13:24 |
| dolphm | lbragstad: subsequent patch right, not a backport | 13:24 |
| lbragstad | dolphm: so we're not going to backport the group_id/project_id patch? | 13:25 |
| lbragstad | right/ | 13:25 |
| samueldmq | dolphm, yeah, I don't know if someone uses LDAP for resource as well (project, domain), but we should be compatible as well IMO | 13:25 |
| samueldmq | dolphm, as it is not a big effort (as you said) | 13:25 |
| jamielennox | aww crap, it's US morning time already | 13:26 |
| ayoung | jamielennox, run away | 13:27 |
| ayoung | got to bed | 13:27 |
| lbragstad | good evening jamielennox ! | 13:27 |
| jamielennox | i am, i am | 13:27 |
| ayoung | dolphm, do we need "id_to_bytes" for the various IDs that go in the token now? | 13:28 |
| *** radez_g0n3 is now known as radez | 13:28 | |
| samueldmq | jamielennox, still there ? | 13:29 |
| *** jamielennox is now known as jamielennox|away | 13:29 | |
| ayoung | samueldmq, let him go! | 13:29 |
| dolphm | ayoung: context? | 13:29 |
| samueldmq | ayoung, oh sure, I meant ayoung (not really) but .. | 13:29 |
| ayoung | dolphm, I saw the bug about Fernet with LDAP | 13:29 |
| samueldmq | jamielennox|away, go, good night | 13:29 |
| dolphm | ayoung: oh that just saves space. hex encoding isn't particularly efficient | 13:29 |
| dolphm | when you know it's hex | 13:30 |
| ayoung | and I think that it might just be a general issue with serializing objects to the fernet format | 13:30 |
| ayoung | dolphm, as for groups from LDAP, I'd actually expect it to be fairly common, just it would be a single group that is actually used: I'd expect that the organization that the user works in (team, office, whatever) has a project in a shared environment. | 13:32 |
| ayoung | what I think you were getting at is that more people want some form of Grouping out of SQL as well.... | 13:33 |
| ayoung | I hope HMT gives us that | 13:33 |
| dolphm | ayoung: i've just never seen or heard of a deployment using user groups from LDAP | 13:34 |
| *** mattfarina has joined #openstack-keystone | 13:34 | |
| samueldmq | lbragstad, btw, I left a couple of comments on the main change, just to document that projects/groups need to/will be addressed :) | 13:36 |
| ayoung | dolphm, id expect it more for internal cloud. Its a fairly common pattern in enterprise apps | 13:36 |
| *** krykowski has quit IRC | 13:37 | |
| *** dims_ has quit IRC | 13:37 | |
| dolphm | ayoung: have you seen a production openstack deployment use user groups out of LDAP or are you just theorizing? | 13:37 |
| ayoung | dolphm, they don't let me anywhere near production deployments. | 13:37 |
| *** dims_ has joined #openstack-keystone | 13:38 | |
| ayoung | But I am extrapolating from what other applications do | 13:38 |
| *** vhoward has joined #openstack-keystone | 13:39 | |
| *** ajayaa has quit IRC | 13:41 | |
| dolphm | mfisch: ping | 13:41 |
| *** vhoward has left #openstack-keystone | 13:41 | |
| dolphm | mfisch: i'm sort of baffled by what's going on in https://bugs.launchpad.net/keystone/+bug/1459483 | 13:41 |
| openstack | Launchpad bug 1459483 in Keystone "able to validate a Fernet token with garbage at the end" [Undecided,New] | 13:41 |
| openstackgerrit | Ihar Hrachyshka proposed openstack/oslo.policy: Expose base check classes as part of public API https://review.openstack.org/176683 | 13:42 |
| *** kiran-r has quit IRC | 13:43 | |
| *** setmason has joined #openstack-keystone | 13:47 | |
| *** fhubik_afk is now known as fhubik | 13:47 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Don't assume group IDs are UUID format https://review.openstack.org/186392 | 13:51 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Don't assume project IDs are UUID format https://review.openstack.org/186393 | 13:51 |
| *** dsirrine_ has joined #openstack-keystone | 13:53 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove region reference from service provider https://review.openstack.org/186395 | 13:58 |
| mfisch | dolphm: fixed that bug, sorry I missed that CURL | 13:58 |
| mfisch | you add anything to the end of the token in the CURL and it gets added onto the ID | 13:58 |
| dolphm | mfisch: i actually just verified the issue | 13:58 |
| mfisch | I assume the code knows the length of the token and ignores anything past it | 13:58 |
| mfisch | cool | 13:58 |
| dolphm | mfisch: it's an issue in pypi/cryptography though | 13:59 |
| mfisch | not sure how big of an issue it is but our tests caught it | 13:59 |
| dolphm | mfisch: so, filing upstream with steps to repro that removes keystone | 13:59 |
| dolphm | mfisch: good tests :) | 13:59 |
| mfisch | I'll let Kim know, it was her suite | 13:59 |
| lbragstad | dolphm: mfisch can you paste link to the upstream bug when possible? | 14:00 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning for long Fernet tokens https://review.openstack.org/186396 | 14:00 |
| mfisch | everything else still okay so far, having a shower debate with myself this morning on whether we'll wait for the new keystone-middleware which we get with K before rolling this out more | 14:00 |
| *** krykowski has joined #openstack-keystone | 14:02 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Update testing keystone2keystone doc https://review.openstack.org/186395 | 14:02 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:02 | |
| *** radez is now known as radez_g0n3 | 14:04 | |
| dolphm | lbragstad: mfisch https://bugs.launchpad.net/keystone/+bug/1459483/comments/3 | 14:04 |
| openstack | Launchpad bug 1459483 in Keystone "able to validate a Fernet token with garbage at the end" [Medium,Confirmed] | 14:04 |
| lbragstad | dolphm: thanks | 14:05 |
| dolphm | lbragstad: perhaps more importantly... the token ID included in the JSON response is NOT url encoded :( see the = at the end? that should be %3D as it is in the request | 14:05 |
| lbragstad | dolphm: https://review.openstack.org/#/c/186392/ and https://review.openstack.org/#/c/186393/ should address the project/group id stuff | 14:06 |
| *** bandwidth has joined #openstack-keystone | 14:06 | |
| lbragstad | dolphm: I noticed that too | 14:06 |
| bknudson | is the token ID used in URLs? | 14:06 |
| bknudson | why does it need to be URL encoded? | 14:06 |
| dolphm | bknudson: v2 | 14:06 |
| bandwidth | is it possible to use the clients (nova, cinder, glance...) with OS-FEDERATION enabled? | 14:06 |
| lbragstad | dolphm: that's v2 specific | 14:06 |
| *** zzzeek has joined #openstack-keystone | 14:07 | |
| *** krykowski has quit IRC | 14:13 | |
| *** ayoung has quit IRC | 14:14 | |
| *** dsirrine__ has joined #openstack-keystone | 14:15 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add "enabled" to create service provider example https://review.openstack.org/186402 | 14:16 |
| *** dsirrine_ has quit IRC | 14:18 | |
| *** dsirrine has quit IRC | 14:18 | |
| *** HT_sergio has joined #openstack-keystone | 14:25 | |
| *** timcline has joined #openstack-keystone | 14:25 | |
| *** csoukup has joined #openstack-keystone | 14:27 | |
| *** nkinder has joined #openstack-keystone | 14:28 | |
| bknudson | bandit is running on keystonemiddleware now: http://logs.openstack.org/07/178707/1/check/gate-keystonemiddleware-tox-bandit/85d81b0/console.html | 14:31 |
| bknudson | non-voting | 14:31 |
| bknudson | for keystoneclient, we need https://review.openstack.org/#/c/182912/ | 14:33 |
| *** ayoung has joined #openstack-keystone | 14:33 | |
| *** ChanServ sets mode: +v ayoung | 14:33 | |
| *** dsirrine has joined #openstack-keystone | 14:33 | |
| *** dsirrine__ has quit IRC | 14:37 | |
| *** afazekas has quit IRC | 14:39 | |
| *** ayoung has quit IRC | 14:46 | |
| *** gokrokve has quit IRC | 14:48 | |
| *** ajayaa has joined #openstack-keystone | 14:49 | |
| *** afaranha has joined #openstack-keystone | 14:51 | |
| *** ducttape_ has joined #openstack-keystone | 14:51 | |
| ducttape_ | ping mfisch | 14:51 |
| *** stevemar has joined #openstack-keystone | 14:51 | |
| *** ChanServ sets mode: +v stevemar | 14:51 | |
| mfisch | lbragstad: our testers found another issue | 14:52 |
| *** Daviey has joined #openstack-keystone | 14:52 | |
| mfisch | lbragstad: when you rescope a token its dropping the MS portion of the expiration | 14:52 |
| mfisch | and the issue | 14:52 |
| mfisch | "issued_at": "2015-05-27T22:17:51.102223Z", | 14:52 |
| mfisch | "expires": "2015-05-28T00:17:51.102148Z", | 14:52 |
| mfisch | then | 14:52 |
| mfisch | "issued_at": "2015-05-27T22:17:51.000000Z", | 14:52 |
| mfisch | "expires": "2015-05-28T00:17:51.000000Z", | 14:52 |
| mfisch | Fernet issue I should be clear ^ | 14:53 |
| lbragstad | mfisch: I think that's because we convert the timestamp to an epoch | 14:53 |
| lbragstad | and then back to a timestamp | 14:53 |
| mfisch | that'd do it | 14:53 |
| * ducttape_ is pretty sure keystone is stealing time to be used later | 14:53 | |
| mfisch | I'll file this one but it doesn't seem serious | 14:53 |
| lbragstad | mfisch: it will serve as documentation at the very least | 14:54 |
| mfisch | I'll bump token expiration to 7201 and nobody can complain ;) | 14:54 |
| lbragstad | mfisch: that works | 14:55 |
| ducttape_ | thanks for explanation lbragstad | 14:55 |
| lbragstad | ducttape_: no problem, thanks for your testing | 14:55 |
| lbragstad | worst case is that your token expires .102148 seconds early | 14:55 |
| lbragstad | :) | 14:55 |
| bknudson | the milliseconds get sent to lbragstad's swiss account. | 14:56 |
| lbragstad | bknudson: shhh! | 14:56 |
| *** User17 has quit IRC | 14:56 | |
| ducttape_ | thats my concern, lbragstad will use all that extra time as paid vacation | 14:56 |
| *** david-lyle_ has joined #openstack-keystone | 14:56 | |
| * lbragstad busted | 14:56 | |
| bknudson | we need superman to stop this. | 14:56 |
| bknudson | https://www.youtube.com/watch?v=iLw9OBV7HYA | 14:57 |
| ducttape_ | using 1980s videos to help explain how openstack works, does not instill confidence | 14:58 |
| *** vhoward has joined #openstack-keystone | 14:58 | |
| mfisch | ducttape_: those rows of cabinets are the disks we use for our DB servers | 14:59 |
| ducttape_ | that would be a sweet sweet improvement | 14:59 |
| *** gordc has joined #openstack-keystone | 14:59 | |
| *** e0ne is now known as e0ne_ | 15:00 | |
| *** emagana has joined #openstack-keystone | 15:00 | |
| *** e0ne_ is now known as e0ne | 15:00 | |
| *** krykowski has joined #openstack-keystone | 15:01 | |
| *** spandhe has joined #openstack-keystone | 15:02 | |
| *** spandhe_ has joined #openstack-keystone | 15:05 | |
| *** ayoung has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v ayoung | 15:06 | |
| *** spandhe has quit IRC | 15:06 | |
| *** spandhe_ is now known as spandhe | 15:06 | |
| *** dsirrine_ has joined #openstack-keystone | 15:12 | |
| *** dsirrine_ has quit IRC | 15:13 | |
| *** dsirrine has quit IRC | 15:13 | |
| *** dsirrine has joined #openstack-keystone | 15:13 | |
| *** mattfarina has quit IRC | 15:17 | |
| stevemar | gordc, whats up with the ceilometer policy file? | 15:18 |
| dolphm | lbragstad: the issue would be that we're returning a non-zero decimal in the first place :P | 15:20 |
| dolphm | mfisch: ^ | 15:20 |
| dolphm | the non-zero decimal never goes into the token | 15:21 |
| *** kiran-r has joined #openstack-keystone | 15:21 | |
| dolphm | so the JSON response is just a lie | 15:21 |
| *** edmondsw has joined #openstack-keystone | 15:23 | |
| *** radez_g0n3 is now known as radez | 15:23 | |
| *** fhubik is now known as fhubik_afk | 15:25 | |
| *** browne has joined #openstack-keystone | 15:26 | |
| gordc | stevemar: ... am i suppose to tell you or are you going to tell me? | 15:26 |
| *** ayoung has quit IRC | 15:27 | |
| gordc | stevemar: need to some context. | 15:27 |
| *** ducttape_ has quit IRC | 15:30 | |
| *** iamjarvo has joined #openstack-keystone | 15:36 | |
| *** lufix has quit IRC | 15:36 | |
| *** kiran-r has quit IRC | 15:36 | |
| *** jorge_munoz has quit IRC | 15:38 | |
| *** arunkant_ has joined #openstack-keystone | 15:41 | |
| *** gyee has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v gyee | 15:43 | |
| *** ajayaa has quit IRC | 15:45 | |
| stevemar | gordc, why are policy.json.sample and policy.json so different? | 15:46 |
| *** amakarov_away is now known as amakarov | 15:46 | |
| openstackgerrit | Merged openstack/oslo.policy: Expose base check classes as part of public API https://review.openstack.org/176683 | 15:47 |
| *** raildo has left #openstack-keystone | 15:47 | |
| *** raildo has joined #openstack-keystone | 15:47 | |
| *** jorge_munoz has joined #openstack-keystone | 15:51 | |
| amakarov | hello everybody! What's the workflow for security issues - can you please point me to any doc? | 15:51 |
| *** chlong has quit IRC | 15:54 | |
| gordc | stevemar: looing | 15:55 |
| *** bandwidth has quit IRC | 15:55 | |
| gordc | looking* | 15:55 |
| *** jistr has quit IRC | 15:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning for long Fernet tokens https://review.openstack.org/186396 | 15:59 |
| gordc | stevemar: the sample is just an example of how the new rbac stuff works. | 16:00 |
| bknudson | amakarov: https://security.openstack.org/vmt-process.html | 16:00 |
| gordc | stevemar: the policy.json is the legacy while we've always had. | 16:00 |
| gordc | stevemar: basically policy.json is the unrestricted copy and policy.json.sample is the 'hey you can do some crazy sh*t copy'... that's my understanding of the patch. | 16:01 |
| amakarov | bknudson, thank you | 16:02 |
| stevemar | gordc, nuke policy.json! | 16:02 |
| *** krykowski_ has joined #openstack-keystone | 16:02 | |
| *** gokrokve has joined #openstack-keystone | 16:03 | |
| gordc | stevemar: i have on powers. every time i try to do something, someone yells 'backward compatibility!' | 16:03 |
| dolphm | BACKWARD COMPATIBILITY! | 16:04 |
| gordc | see! it haunts me. | 16:04 |
| *** guest34578 has joined #openstack-keystone | 16:05 | |
| *** krykowski has quit IRC | 16:05 | |
| guest34578 | BACKWARD COMPATIBILITY! | 16:05 |
| *** guest34578 has quit IRC | 16:06 | |
| stevemar | BACKWARD COMPATIBILITY! | 16:06 |
| *** chlong has joined #openstack-keystone | 16:07 | |
| morganfainberg | I... Think stevemar and dolphm covered it. | 16:08 |
| dims_ | morganfainberg: others: is there a schedule for removing eventlet support in keystone? | 16:09 |
| *** fhubik_afk is now known as fhubik | 16:09 | |
| morganfainberg | dims_: yes. The m-release. | 16:09 |
| dims_ | thanks | 16:09 |
| dolphm | Liberty will be the last with eventlet | 16:09 |
| morganfainberg | Yes!! | 16:11 |
| morganfainberg | :) | 16:11 |
| bknudson | dolphm: what about BACKWARD COMPATIBILITY! | 16:11 |
| * morganfainberg does a dance on the eventlet code from keystone's grave. | 16:11 | |
| nkinder | wh ois going to write the eulogy? | 16:11 |
| *** lhcheng_afk has joined #openstack-keystone | 16:11 | |
| morganfainberg | nkinder: you just got voluntossed into it! Congrats! ;) | 16:11 |
| dolphm | we should require eulogy's in commit messages for massive deletes | 16:12 |
| dolphm | eulogies? | 16:12 |
| dstanek | nkinder: it's done. "It took too long to get rid of you. You won't be missed." | 16:12 |
| morganfainberg | I'd ask termie to... But ... We all know how that'd work. | 16:12 |
| dolphm | $ git rm -r * && git commit --author="termie" | 16:13 |
| *** _cjones_ has joined #openstack-keystone | 16:13 | |
| *** lhcheng__ has joined #openstack-keystone | 16:13 | |
| morganfainberg | dolphm: ahaha | 16:14 |
| morganfainberg | dstanek: so the x1carbon is working pretty damn well. | 16:15 |
| dstanek | morganfainberg: what are you running on it? | 16:15 |
| morganfainberg | Ubuntu 15.04 | 16:15 |
| morganfainberg | It just... Works. | 16:15 |
| morganfainberg | Haven't tried suspend yet. | 16:16 |
| morganfainberg | That was one of the questions. | 16:16 |
| *** rwsu has joined #openstack-keystone | 16:16 | |
| morganfainberg | And fingerprint reader I just don't care about. | 16:16 |
| * sigmavirus24 knows someone else really enjoying their x1 carbon with *nix on it | 16:16 | |
| *** lhcheng_afk has quit IRC | 16:16 | |
| dolphm | how much memory does yours have? | 16:16 |
| *** david-lyle_ has quit IRC | 16:16 | |
| morganfainberg | dolphm: sadly it caps at 8gb | 16:16 |
| gordc | morganfainberg: 2015 x1carbon or 2014? | 16:16 |
| dolphm | and which display? | 16:16 |
| morganfainberg | gordc: 3rd gen | 16:17 |
| dstanek | morganfainberg: do you run any VMs on it or do you just use the cloud for all that jazz? | 16:17 |
| morganfainberg | dolphm: high-rez touch (but only cause high Rez with touch was the option for high Rez) | 16:17 |
| morganfainberg | dstanek: that's the plan. I can run a vm | 16:17 |
| gordc | morganfainberg: does it have the single trackpad or separate buttons for the trackpoint? i hate my x1 because of the damn trackpad. | 16:18 |
| morganfainberg | dstanek: if needed. I also plan on using docker docker docker docker docker docker for isolation in testing. | 16:18 |
| bknudson | morganfainberg: install openstack on it | 16:18 |
| morganfainberg | gordc: yes it has hardware buttons again and non-stupid function keys. | 16:18 |
| bknudson | I hear it can be used for vms and docker | 16:19 |
| lbragstad | ba-dum-psh | 16:19 |
| morganfainberg | dolphm: I really wanted the MacBook 12" to be good. Keyboard was a win, track pad was a win. Core M processor was a deal breaker. | 16:19 |
| morganfainberg | Yosemite kindof sucks majorly as a developer OS unless you're developing apple things. | 16:20 |
| dolphm | well there's cloud | 16:20 |
| morganfainberg | Also battery on the MacBook was suspect. | 16:20 |
| gordc | morganfainberg: yeah, i want that. i can't stand the touch buttons. | 16:21 |
| morganfainberg | x1c will charge (I think) to 85% in 35 min | 16:21 |
| dstanek | OSX is malware | 16:21 |
| lbragstad | dev tools for mac == ssh | 16:21 |
| morganfainberg | dstanek: pretty much. Yosemite turned it into a virus. ;( | 16:21 |
| morganfainberg | I also figure if I don't like the x1c I know lots of people who will take it off my hands. | 16:22 |
| * morganfainberg also sees why desktop developers like systemd now. And I hate it even more than before. | 16:22 | |
| *** spandhe has quit IRC | 16:23 | |
| sigmavirus24 | == lbragstad | 16:25 |
| *** kiran-r has joined #openstack-keystone | 16:29 | |
| *** kiranr has joined #openstack-keystone | 16:30 | |
| *** lufix has joined #openstack-keystone | 16:31 | |
| *** kiran-r has quit IRC | 16:33 | |
| *** kiranr is now known as kiran-r | 16:34 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Log warning for long Fernet tokens https://review.openstack.org/186396 | 16:37 |
| david8hu | ayoung, where is my invite to join to dynamic policy work group? :) | 16:37 |
| *** henrynash has joined #openstack-keystone | 16:41 | |
| *** ChanServ sets mode: +v henrynash | 16:41 | |
| henrynash | can anyone point me to the liberty design summit etherpads for Keystone? The don’t seem to be listed here: https://wiki.openstack.org/wiki/Design_Summit/Liberty/Etherpads#Keystone | 16:44 |
| morgan | henrynash: blame me | 16:44 |
| henrynash | morgan: far be it from me…. | 16:45 |
| morgan | henrynash: i sucked at filling out those wiki things.. this time | 16:45 |
| morgan | they are all linked from the sched.org sessions | 16:45 |
| morgan | i'll fill it out today | 16:45 |
| henrynash | ok | 16:45 |
| henrynash | thx | 16:45 |
| morgan | but not sure when | 16:45 |
| morgan | i'm still chasing down how i lost a release in keystoneclient so i can get 1.4 or 1.5 or whatever cut | 16:46 |
| henrynash | np! | 16:46 |
| henrynash | that sounds kinda of more important | 16:46 |
| *** morgan is now known as mdrnstm | 16:46 | |
| dolphm | henrynash: are you looking for a particular etherpad? | 16:47 |
| henrynash | dolphm: just wanted to make sure I was upto speed with the stuff we decided….dynamic policy for one | 16:47 |
| dolphm | henrynash: dynamic policy wasn't a design session, it was just ayoung | 16:48 |
| dolphm | henrynash: so, no etherpad that i'm aware of | 16:49 |
| henrynash | dolphm: ahh | 16:49 |
| *** kiran-r has quit IRC | 16:53 | |
| gyee | henrynash, need your opinion on role assignment listing | 16:54 |
| gyee | https://bugs.launchpad.net/keystone/+bug/1437407 | 16:54 |
| openstack | Launchpad bug 1437407 in Keystone "With using V3 cloud admin policy, domain admin unable to list role assignment for projects in his domain" [Medium,In progress] - Assigned to Priti Desai (priti-desai) | 16:54 |
| henrynash | gyee: syre | 16:54 |
| gyee | henrynash, so we have some tough choices | 16:54 |
| gyee | I can do 'GET /v3/role_assignments?scope.domain.id=<id>&all' to get all the assignments for resources within that domain | 16:55 |
| *** kiran-r has joined #openstack-keystone | 16:55 | |
| gyee | because right now, '?scope.domain.id' only get you the assignments on the domain | 16:55 |
| *** lhcheng__ is now known as lhcheng | 16:56 | |
| *** ChanServ sets mode: +v lhcheng | 16:56 | |
| *** gsilvis has quit IRC | 16:56 | |
| gyee | either way we need custom callback to handle authorization on that one, just like the role grants APIs | 16:56 |
| *** ayoung has joined #openstack-keystone | 16:56 | |
| *** ChanServ sets mode: +v ayoung | 16:56 | |
| gyee | ayoung! | 16:57 |
| ayoung | gyee! | 16:57 |
| raildo | gyee ayoung! | 16:57 |
| gyee | ayoung, policy stuff, so {'endpoint_constraint': 'token.catalog.endpoints.id:1234'} works for a v3 token | 16:57 |
| gyee | but won't work for a v2 token | 16:57 |
| ayoung | right | 16:57 |
| *** gsilvis has joined #openstack-keystone | 16:58 | |
| gyee | ayoung, is there a generic one I can use? | 16:58 |
| ayoung | gyee, we need to convert v2 tokens to v3 | 16:58 |
| gyee | that works for both? | 16:58 |
| henrynash | gyee: I’ll take a look a bit later if that’s Ok… | 16:58 |
| ayoung | and to do that we need to be able to read deafult domain id out of the config from Keystone | 16:58 |
| gyee | henrynash, that's fine, thanks! | 16:58 |
| gyee | raildo! | 16:58 |
| openstackgerrit | Merged openstack/keystone-specs: Do not add new 'db' command and subcommands for it https://review.openstack.org/177219 | 16:58 |
| openstackgerrit | Merged openstack/keystone-specs: Target Alembic for Liberty https://review.openstack.org/177220 | 16:59 |
| raildo | gyee, we need to continue our discussion later about project scoped token :P | 16:59 |
| gyee | ayoung, I'll see what I can do, but I was trying to avoid the conversion | 16:59 |
| *** alanf-mc has joined #openstack-keystone | 16:59 | |
| ayoung | gyee, nah, we need to convert | 16:59 |
| ayoung | gyee, otherwise, things are going to expect V2.0 format for evar! | 17:00 |
| gyee | ayoung, k | 17:00 |
| *** gokrokve has quit IRC | 17:00 | |
| gyee | ayoung, how about "if you want endpoint constraint, use V3!" :) | 17:00 |
| ayoung | nope | 17:00 |
| *** gokrokve has joined #openstack-keystone | 17:01 | |
| ayoung | policy is enforced on V3 token format | 17:01 |
| ayoung | it allows us to enforce on any portion of the token. It gives us admin domain for admin tasks, too | 17:01 |
| gyee | ayoung, what about accessinfo? | 17:01 |
| ayoung | gyee, jamielennox|away killed it | 17:01 |
| gyee | that's a dict too right? | 17:01 |
| ayoung | yep | 17:02 |
| gyee | so we can just flatten it and do the enforcement | 17:02 |
| ayoung | and it has to live in their | 17:02 |
| ayoung | sure | 17:02 |
| ayoung | so long as both parts make it look the same | 17:02 |
| *** browne has quit IRC | 17:02 | |
| gyee | right, at least a consistent representation of a token | 17:02 |
| *** rushiagr_away is now known as rushiagr | 17:03 | |
| *** pnavarro has joined #openstack-keystone | 17:03 | |
| *** lufix has quit IRC | 17:04 | |
| *** aix has quit IRC | 17:04 | |
| gyee | raildo, sorry, I have to run, be back in an hour | 17:04 |
| *** gyee has quit IRC | 17:04 | |
| *** harlowja has joined #openstack-keystone | 17:05 | |
| *** gokrokve has quit IRC | 17:05 | |
| *** dguerri is now known as dguerri`away | 17:06 | |
| *** krykowski_ has quit IRC | 17:08 | |
| *** krykowski has joined #openstack-keystone | 17:08 | |
| *** e0ne has quit IRC | 17:08 | |
| *** david-lyle_ has joined #openstack-keystone | 17:09 | |
| *** iamjarvo has quit IRC | 17:10 | |
| *** pnavarro has quit IRC | 17:11 | |
| david8hu | ayoung, ping | 17:12 |
| david8hu | ayoung, did you forget about me | 17:12 |
| ayoung | david8hu, who are you again? | 17:13 |
| david8hu | david hu. lol | 17:13 |
| david8hu | ayoung, how do I joing the dynamic policy work group and sign up for stuff | 17:13 |
| ayoung | david8hu, so, you might have sent something while my machine was bouncing up and down network wise | 17:13 |
| ayoung | david8hu, thought I added you, but it was a mad crush at the time...let me see | 17:14 |
| *** kiran-r has quit IRC | 17:14 | |
| samueldmq | ayoung, hi! need talk to you | 17:14 |
| ayoung | david8hu, what email address? | 17:14 |
| samueldmq | ayoung, fetch policy using ksmiddleware | 17:14 |
| david8hu | ayoung, ok | 17:14 |
| ayoung | david8hu, what email address? | 17:14 |
| ayoung | should I uise for trello? | 17:15 |
| david8hu | ayoung, david.hu@hp.com | 17:15 |
| *** krykowski has quit IRC | 17:15 | |
| ayoung | david8hu, sign in to trello using that email address and you should have access | 17:15 |
| ayoung | samueldmq, WHAT ABOUT IT? | 17:15 |
| ayoung | gah CAPS LOCK! | 17:15 |
| david8hu | ayoung, thx | 17:16 |
| samueldmq | ayoung, sorry, nothing :( | 17:16 |
| samueldmq | ayoung, hehe I thought you were screaming " WHAT ABOUT IT?" | 17:16 |
| samueldmq | ayoung, so ... first, how do the ksmiddleware knows the service/endpoint he is serving, to then be able to fetch the right policy ? | 17:17 |
| ayoung | samueldmq, I think it needs to be a config option | 17:17 |
| ayoung | I can't see any way around that | 17:17 |
| mdrnstm | ayoung: capslock is cruisecontrol for awesome *duck* | 17:18 |
| ayoung | mdrnstm, is it Casual Nick Thursday? | 17:18 |
| mdrnstm | ayoung: new laptop | 17:18 |
| *** david-lyle_ has quit IRC | 17:18 | |
| mdrnstm | not connected via znc atm | 17:18 |
| ayoung | ah | 17:18 |
| * mdrnstm points at morganfainberg | 17:18 | |
| ayoung | softling | 17:19 |
| ayoung | mdrnstm, did you see samueldmq 's question? Am I right, it needs to be a config file option? | 17:19 |
| mdrnstm | the Lenovo screen is so much easier to read than the glossy-apple screen | 17:19 |
| * mdrnstm reads scrollback | 17:19 | |
| ayoung | it makes it a pain, as it means you need to create the endpoint prior to kicking off the service, or you need to reboot the service | 17:20 |
| ayoung | but the endpoint has not way of going "what is my own ID" | 17:20 |
| mdrnstm | ayoung: it probably should be URL based for fetching | 17:20 |
| mdrnstm | that way you don't get into things that make heat an everyone cry | 17:21 |
| mdrnstm | where you need to pre-create the endpoint | 17:21 |
| mdrnstm | you already know what the url will be | 17:21 |
| *** woodster_ has joined #openstack-keystone | 17:21 | |
| ayoung | mdrnstm, actually, I agree, but there are three problems with that | 17:21 |
| mdrnstm | but yes, it has to be config based. | 17:21 |
| samueldmq | but in any way the middleware has no idea who it is serving | 17:21 |
| ayoung | 1. Webservers don't know their own hostnames either | 17:21 |
| ayoung | 2. We do IDs by UUID for fetch policy by UUID, so we need to build that | 17:22 |
| mdrnstm | easier to know what the hostname/url will be for a given endpoint, but yes. | 17:22 |
| mdrnstm | 2: that is one of the reasons our policy api has been fairly useless for distributing the policy files | 17:22 |
| ayoung | 3. Most things provision by IP address, and stack multiple servicews on the same thing, so the URL is not guaranteed to be unique | 17:22 |
| *** dguerri`away is now known as dguerri | 17:22 | |
| mdrnstm | no "friendly" way to know wtf the uuid means | 17:22 |
| ayoung | UUIDs suck, I agree | 17:23 |
| mdrnstm | even programatically... it is unfriendly | 17:23 |
| mdrnstm | so we should fix it. | 17:23 |
| ayoung | OK. | 17:23 |
| * mdrnstm is good with deprecating "policy" api as is | 17:23 | |
| mdrnstm | and making it a new thing "policy-distribution" | 17:23 |
| mdrnstm | or something | 17:23 |
| mdrnstm | the policy api is... mostly useless atm and internally we namespace collide with our own policy enforcement code | 17:24 |
| samueldmq | mdrnstm, in a new service ? | 17:24 |
| mdrnstm | samueldmq: no just new subsystem/module in keystone, like "identity" is not the same as "resource" | 17:24 |
| samueldmq | mdrnstm, yeah, that should be good | 17:24 |
| *** dan has joined #openstack-keystone | 17:24 | |
| samueldmq | mdrnstm, though I think it already is https://github.com/openstack/keystone/tree/master/keystone/policy | 17:25 |
| *** pnavarro has joined #openstack-keystone | 17:25 | |
| mdrnstm | samueldmq: that is the point, that is useless. | 17:25 |
| ayoung | mdrnstm, we have "fetch policy for endpoint" which is what I planned on using | 17:25 |
| *** vilobhmm has joined #openstack-keystone | 17:26 | |
| mdrnstm | ayoung: sure. my only point is that whole rest api as it sits is very unfriendly. we can improve it significantly | 17:26 |
| mdrnstm | and dodge the uuid ick | 17:26 |
| ayoung | mdrnstm, from endpoint we know service. And it was dolphm 's suggestion we unify all into a single large policy file. BUt that might bite us on defaults...still, we could expand out the defaults on a per service basis | 17:26 |
| mdrnstm | or make it silently go into the night. | 17:26 |
| mdrnstm | right | 17:27 |
| ayoung | mdrnstm, I'd call it an API, not sure if it is REST | 17:27 |
| ayoung | its just kind of webby | 17:27 |
| mdrnstm | ayoung: sure. and i'd call it only sort of an API :P | 17:27 |
| mdrnstm | currently | 17:27 |
| ayoung | mdrnstm, however, lets assume that each web server allowed the endpoint to have it's own URL | 17:28 |
| mdrnstm | sure | 17:28 |
| ayoung | how, then, would we fetch policy? Or would we follow termies suggestion and do all the enforcement in Keystone for each call? | 17:28 |
| mdrnstm | ayoung: ok so here is where i'd start | 17:30 |
| mdrnstm | an endpoint (or HA grouping of endpoints) has a known URL | 17:30 |
| mdrnstm | and you have to know this. | 17:31 |
| mdrnstm | there are many reasons [inc. SSL] that this is in the realm of CMS | 17:31 |
| mdrnstm | use that as the means to fetch the policy, just dodge the uuid/unique id issue | 17:31 |
| *** iamjarvo has joined #openstack-keystone | 17:31 | |
| mdrnstm | the URL *is* the endpoint | 17:31 |
| mdrnstm | i don't want 1 of say 3 HA'd novas getting a different policy behind the same endpoint URL | 17:32 |
| mdrnstm | you can do things in keystone to cascade defaults for all novas because you know endpoint url X is a nova, so it gets "nova" policy, then it's specific policy | 17:32 |
| ayoung | We can't put an url in an url, so would it be: | 17:33 |
| mdrnstm | so, b64 it. | 17:33 |
| mdrnstm | or something we can say "this is how you get the id" and it's programatic in a way CMS doesn't need to work too hard at it | 17:34 |
| ayoung | GET https://keystone.hostname/v3/policy?enopoint=https://one.nova.hstname/v2.8 | 17:34 |
| mdrnstm | that works too | 17:34 |
| ayoung | we can make the endpoint URL a parameter, that works fine | 17:34 |
| mdrnstm | it'd be urlencoded but thats perfectly fine | 17:34 |
| ayoung | mdrnstm, we just have it by endpoint ID right now. | 17:34 |
| *** rlt_ has quit IRC | 17:34 | |
| ayoung | and the endpoint itself knows neither | 17:35 |
| mdrnstm | yeah, the id is going to be a high barrier to entry | 17:35 |
| ayoung | so...it would have been better if you had mentioned this back when I suggested "fetch policy by endpoint" | 17:35 |
| mdrnstm | sorry :( | 17:35 |
| mdrnstm | i've been saying this on and off for a while | 17:35 |
| ayoung | just adds another delay to getting to dynamic policy. How strong do you feel about this? | 17:35 |
| *** gsilvis has quit IRC | 17:36 | |
| ayoung | Do we fetch by ID for nw, and change to URL? | 17:36 |
| mdrnstm | i honestly think we will get exactly zero adoption using uuids | 17:36 |
| *** iamjarvo_ has joined #openstack-keystone | 17:36 | |
| ayoung | mdrnstm, we'll get the same either way | 17:36 |
| *** iamjarvo_ has quit IRC | 17:36 | |
| ayoung | it is not the form of the identifier that is the problem | 17:36 |
| mdrnstm | no, the ID since it has to be pre-generated by pushing things into keysotne is the issue | 17:36 |
| ayoung | solution! | 17:37 |
| *** iamjarvo_ has joined #openstack-keystone | 17:37 | |
| ayoung | we put a "fetch policy URL" into the config file | 17:37 |
| ayoung | it can be by ID, or by endpoint, or whatever we want in the future | 17:37 |
| mdrnstm | if we can re-use data that the cms is already aware of (in many cases the URL is) that can go in the config. then it's really easy to after the fact create the endpoint policy in keystone | 17:38 |
| mdrnstm | it's a known value | 17:38 |
| ayoung | cms? | 17:38 |
| *** iamjarvo has quit IRC | 17:38 | |
| ayoung | Content management system? | 17:38 |
| mdrnstm | config management | 17:38 |
| mdrnstm | yeah | 17:38 |
| ayoung | Puppet? | 17:38 |
| *** browne has joined #openstack-keystone | 17:38 | |
| mdrnstm | puppet, chef, etc | 17:38 |
| mdrnstm | this allows you to *avoid* needing to push things into keystone to get the id, then reconfigure the endpoint and restart | 17:38 |
| mdrnstm | that is my concern | 17:38 |
| ayoung | OK, so what we should have done it made the URL of the endpoint the ID in the first place | 17:39 |
| *** kbringard has joined #openstack-keystone | 17:39 | |
| ayoung | UUIDs are not a great approach for host naming | 17:39 |
| mdrnstm | especially if you are layering policy like you're talking about: all nova's get policy X, then i ant to add policy y, i need to create a sane id etc then reconfigure/restart | 17:39 |
| ayoung | But we can't create the ID for the endpoint | 17:39 |
| mdrnstm | ayoung: how far down the uuid path are we at this point | 17:40 |
| ayoung | mdrnstm, ok, what, ideally, should tell a service endpoint its name? | 17:40 |
| mdrnstm | and how painful is it to move to url? | 17:40 |
| mdrnstm | i think an endpoint is cannonically defined by it's url | 17:41 |
| mdrnstm | at least that is how i see it | 17:41 |
| ayoung | mdrnstm, but the endpoint itself can't even tell you that | 17:41 |
| mdrnstm | if you say my url is http://x.y.z/nova that is the endpoint | 17:41 |
| ayoung | look at tjhe hoops we go through in keystone in versions.py | 17:41 |
| ayoung | we have to set it in the keystone.conf | 17:41 |
| mdrnstm | most deployers have that info because they are SSLing/HAproxying infront of a series of endpoints | 17:41 |
| mdrnstm | this is something you can know apriori | 17:42 |
| mdrnstm | vs. needing to use something generated by keystone | 17:42 |
| ayoung | Let's say we do "fetch policy for URL" | 17:42 |
| ayoung | then we look up the URLs in the endpoint table, etc | 17:43 |
| mdrnstm | yes. | 17:43 |
| ayoung | we need to make sure that the endpoint can send us that data | 17:43 |
| ayoung | it can't right now | 17:43 |
| *** gsilvis has joined #openstack-keystone | 17:43 | |
| mdrnstm | right, but we need to solve sending that data even if it was a uuid | 17:43 |
| ayoung | but, we can add the endpoint_url to the auth_tojken sec tion and use that value | 17:43 |
| ayoung | and the CMS will know that value A-priori | 17:44 |
| ayoung | Why is it we only start doing things properly when I have a deadline? | 17:44 |
| mdrnstm | ayoung: because we're still digging out tech debt from many cycles ago | 17:45 |
| ayoung | mdrnstm, we are still digging out technical debt from before Keystone was incubated | 17:45 |
| mdrnstm | and trying to change course/realizing where we have issues is a slow process | 17:45 |
| mdrnstm | but we *are* getting better at it | 17:45 |
| mdrnstm | at least we have a deadline and some direction, not fully implemented "well crap now what" issues | 17:46 |
| ayoung | OK...so fetch policy by endpoint was a wasted effort. | 17:46 |
| ayoung | And the way that this dealys things, we now need a spec and an implementation of fetch policy by url | 17:46 |
| mdrnstm | ayoung: sorry =/ i mean we can make it work | 17:46 |
| ayoung | so this will effectively derail dynamic policy unless we fasttrack it | 17:47 |
| mdrnstm | i just think we're going to see almost no adpotion by uuid. | 17:47 |
| mdrnstm | so lets fasttrack it. | 17:47 |
| mdrnstm | this should not be hyper controversial | 17:47 |
| ayoung | I wish we could somehow phase this | 17:48 |
| ayoung | like...make use of the UUID today, buyt use the URL if we get it in by the ned opf the cycle | 17:48 |
| ayoung | end | 17:48 |
| *** vilobhmm has left #openstack-keystone | 17:49 | |
| ayoung | mdrnstm, how about this | 17:49 |
| mdrnstm | i expect no one will want to use dynamic poilcy (even as nice as it is) with something keysotne generates | 17:49 |
| ayoung | in ATM we allow a policy URL | 17:49 |
| mdrnstm | just looking at past experience - it will be a massive uphill battle | 17:49 |
| ayoung | we can set that to use one of the existing mechanisms | 17:49 |
| ayoung | if it does not exist, we write one that falls back to fetch_policy_by_endpoint_url | 17:50 |
| ayoung | that way, we have a working mechanism with its own value by the end opf the cycle, but a plan that will work better with the CMS, too | 17:50 |
| *** gsilvis has quit IRC | 17:51 | |
| ayoung | yeah, I hear you, and as I said, I kindof have felt this way for a while, too | 17:51 |
| ayoung | just trying not to boil more than one ocean at a time | 17:51 |
| mdrnstm | ok i need to hop on a call | 17:51 |
| mdrnstm | and get food. | 17:51 |
| ayoung | and I need to run an errand | 17:51 |
| mdrnstm | ugh is it really almost 11 | 17:51 |
| mdrnstm | :( | 17:51 |
| * mdrnstm sighs | 17:51 | |
| ayoung | samueldmq, read up. we can discuss later or tonight | 17:51 |
| mdrnstm | getting into bad habbits again | 17:51 |
| samueldmq | ayoung, yes .. trying to follow your quick fingers ... | 17:52 |
| ayoung | samueldmq, I added a card to trello | 17:52 |
| samueldmq | mdrnstm, I kind of agree with your url definition for endpoint | 17:52 |
| ayoung | fETCH opOLICY BY url | 17:52 |
| ayoung | damn cpas lock | 17:52 |
| samueldmq | mdrnstm, if I have multiples keystone (without HAproxy in fornt of them), I can use differet policies | 17:52 |
| ayoung | samueldmq, but I have to go pick up my son and take him to an appt, so I can't stick around right now | 17:53 |
| ayoung | I'll be back online shortly | 17:53 |
| samueldmq | mdrnstm, since urls would be different (keystone1.com, keyston2...) | 17:53 |
| *** gsilvis has joined #openstack-keystone | 17:53 | |
| ayoung | samueldmq, can you work up a spec for the server side fgetch? real minimal | 17:53 |
| samueldmq | ayoung, great, I will re-read carefully | 17:53 |
| ayoung | fetch policy by URL, uses the url to look up the endpoint, uses the fetch policy buy endpoint internals after that | 17:53 |
| samueldmq | ayoung, yes, I will re-read and we discuss more when you're back | 17:53 |
| ayoung | deal. thanks a bunch | 17:53 |
| samueldmq | np | 17:53 |
| *** ayoung has quit IRC | 17:54 | |
| *** mattfarina has joined #openstack-keystone | 17:57 | |
| *** fhubik is now known as fhubik_afk | 18:00 | |
| *** nkinder has quit IRC | 18:03 | |
| *** e0ne has joined #openstack-keystone | 18:06 | |
| *** mattfarina has quit IRC | 18:09 | |
| *** bknudson has quit IRC | 18:13 | |
| *** gyee has joined #openstack-keystone | 18:17 | |
| *** ChanServ sets mode: +v gyee | 18:17 | |
| *** bknudson has joined #openstack-keystone | 18:18 | |
| *** ChanServ sets mode: +v bknudson | 18:18 | |
| samueldmq | mdrnstm, dolphm, jamielennox|away identity v3 only jobs are now merged! o/ | 18:18 |
| lhcheng | samueldmq: nice! \o/ | 18:19 |
| samueldmq | lhcheng, yeah, I am happy, need another mug of coffee o/ | 18:20 |
| *** e0ne has quit IRC | 18:21 | |
| lhcheng | samueldmq: can you send me the link the patch that got merged, curious to see the change needed | 18:24 |
| *** nkinder has joined #openstack-keystone | 18:24 | |
| lhcheng | samueldmq: heh one step closer to moving to v3 default, thanks for the good work! | 18:25 |
| *** Swanson has joined #openstack-keystone | 18:26 | |
| *** fhubik_afk is now known as fhubik | 18:26 | |
| *** fhubik has quit IRC | 18:27 | |
| samueldmq | lhcheng, thanks .. however jamielennox|away is the one who is responsible for getting sessions in the other clients, in order to enable v3 easily :) | 18:27 |
| samueldmq | lhcheng, he has been doing most of the work, I've only worked in this job so far .. :) | 18:27 |
| samueldmq | lhcheng, and here is the link https://review.openstack.org/#/q/status:merged+branch:master+topic:identity-v3-only-jobs,n,z | 18:28 |
| *** jimbaker has quit IRC | 18:30 | |
| samueldmq | lhcheng, btw, I have a devstack change and I am waiting that job to be ran agaisnt it | 18:35 |
| samueldmq | lhcheng, see https://review.openstack.org/#/c/186523/ (I left a 'check experimental' comment in there) | 18:35 |
| lhcheng | samueldmq: to be able to display the "domain" field in the horizon login page, this flags need to be set to: https://github.com/openstack/horizon/blob/master/openstack_dashboard/local/local_settings.py.example#L58 | 18:39 |
| lhcheng | samueldmq: something we can add later. Without that flag, horizon won't expose panel for creating additional domains. | 18:42 |
| lhcheng | samueldmq: cool, hopeful that job will just pass :) | 18:42 |
| *** jimbaker has joined #openstack-keystone | 18:43 | |
| *** edmondsw has quit IRC | 18:43 | |
| *** browne has quit IRC | 18:45 | |
| mdrnstm | samueldmq: nice!! | 18:47 |
| *** nkinder has quit IRC | 18:49 | |
| *** jimbaker has quit IRC | 18:53 | |
| *** ayoung has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v ayoung | 18:54 | |
| samueldmq | mdrnstm, lhcheng and the first 'check experimental' has successfully failed :D | 18:56 |
| samueldmq | https://jenkins02.openstack.org/job/check-tempest-dsvm-neutron-identity-v3-only-full/1/ | 18:56 |
| *** csoukup has quit IRC | 18:58 | |
| mdrnstm | samueldmq: w00t, good news. we have a way to identify where things are broken | 19:01 |
| *** elmiko has joined #openstack-keystone | 19:01 | |
| *** nkinder has joined #openstack-keystone | 19:01 | |
| elmiko | ayoung: hey, i'm looking at the sahara policy file and i want to clean up the namespaces. is there any further docs/guidance than your talk from summit? | 19:01 |
| ayoung | elmiko, for the namespaces? Link? | 19:02 |
| elmiko | https://github.com/openstack/sahara/blob/master/etc/sahara/policy.json | 19:02 |
| ayoung | elmiko, in general, I would recommend treating the rules as two pars: | 19:02 |
| ayoung | parts | 19:02 |
| samueldmq | mdrnstm, ++ I will dig a bit more on that tonight, jamielennox also told me he has a bunch of things to test :) | 19:02 |
| ayoung | 1. how to match the scope. 2. WHat role to assign | 19:02 |
| ayoung | looking | 19:02 |
| elmiko | thanks | 19:02 |
| ayoung | elmiko, so default is "" | 19:03 |
| * elmiko nods | 19:03 | |
| ayoung | I would get a common namespace in front of all of them | 19:03 |
| elmiko | ok, so like "sahara-*"? | 19:03 |
| ayoung | elmiko, otherwise, things like image is going to conflict with clance and so on | 19:03 |
| elmiko | ayoung: yea, that's what i thought. most of our are pretty specific except that one | 19:04 |
| ayoung | elmiko, yea, although we can still treat it like a path | 19:04 |
| ayoung | and use the good name, not the project code name | 19:04 |
| ayoung | like, we use identity, not keystone | 19:04 |
| elmiko | ahh, ok | 19:04 |
| elmiko | it better to go with "data-processing:*" or "data-processing-*" ? | 19:04 |
| ayoung | what is the service type for sahara? | 19:04 |
| elmiko | data processing | 19:04 |
| *** jimbaker has joined #openstack-keystone | 19:05 | |
| ayoung | I'd go with the colon form | 19:05 |
| ayoung | treat it like just another namespace, and not flat | 19:05 |
| elmiko | cool, thanks. i need to write up a quick bug and then i'll patch them up | 19:05 |
| ayoung | you have a bunch already, so you can leave them as is, just one level under | 19:05 |
| elmiko | and the main concern here is that our namespaces could collide with other projects? | 19:05 |
| ayoung | elmiko, so, why are the rules all empty? | 19:05 |
| ayoung | yes, avoid collisions, so if we have a unified policy file you can participate | 19:06 |
| elmiko | good question, i'm guessing that we use default for everything. but i am just starting to investigate this. | 19:06 |
| ayoung | elmiko, what would you want it to look like? | 19:07 |
| ayoung | in general it should be a projectid match and a role | 19:07 |
| elmiko | ayoung: well, for starters i want to implement better scoping. i'm not sure where to go with our roles though | 19:07 |
| elmiko | is "role:member" a valid permission for a givent project? | 19:08 |
| ayoung | you can start with member, or you can define a new one. It is this problem that the hierarchical roles spec is supposed to address | 19:08 |
| ayoung | yep | 19:08 |
| ayoung | but we also need to know where to match the project id | 19:08 |
| elmiko | is there an example of how to use the project id? | 19:09 |
| ayoung | and that, unfortunately, is resource specific | 19:09 |
| ayoung | elmiko, it depends on the call. If you are creating a resource, you tend to know the project ID from the URL | 19:09 |
| elmiko | maybe i'll just start with the namespace scoping and the do more research on the role stuff | 19:09 |
| *** alanf-mc has quit IRC | 19:10 | |
| ayoung | whereas, if you are callling on some resource, you tend to have to fetch the resourcefirst in order to know the project | 19:10 |
| ayoung | which is suboptimal | 19:10 |
| ayoung | I'd rather we had the project in the URL everywhere, kindof like how you access a file by its path, not by its inode | 19:10 |
| elmiko | ok, currently that works for us as we have the project id in the url | 19:11 |
| ayoung | excellent | 19:11 |
| ayoung | let me see if I can find you an example | 19:11 |
| elmiko | awesome, thanks! | 19:11 |
| ayoung | elmiko, so we have rules like http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json that are kindof...all over the place | 19:15 |
| elmiko | ayoung: interesting... | 19:15 |
| ayoung | the role comes out of the token, but the project_id is typcally converted into a parameter in the call | 19:15 |
| ayoung | for example, list credentials | 19:16 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n68 | 19:16 |
| ayoung | that gets called from.... | 19:16 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/credential/controllers.py#n84 | 19:16 |
| ayoung | and we have some decorator majik we invoke | 19:16 |
| elmiko | ok, i think the roles are going to require more research on my part before we start implementing | 19:17 |
| elmiko | i can, at least, start making headway though | 19:17 |
| ayoung | elmiko, sounds good | 19:19 |
| elmiko | ayoung: thanks again for the help =) | 19:19 |
| ayoung | elmiko, what you have currently is basically "valid token" | 19:19 |
| ayoung | there is nothing matching the token to the resource at either the project or role level | 19:19 |
| ayoung | I'd probably recommend you design a series of specialized roles | 19:20 |
| elmiko | i think it would be cool to implement a more fine-grained approach, i just need to figure out *what* we want to do | 19:20 |
| elmiko | yea | 19:20 |
| ayoung | read and writer per resource type | 19:20 |
| ayoung | what are your resources... looking | 19:20 |
| ayoung | cluster, cluster-templats, | 19:20 |
| ayoung | maybe templates in general? | 19:21 |
| elmiko | mainly, images, clusters, cluster templates, node group templates, jobs, and data sources/job binaries | 19:21 |
| ayoung | ok. so would you expect one person to be modifying all these resources, or do people fall into distinct roles for operations? | 19:22 |
| *** gordc has quit IRC | 19:22 | |
| elmiko | and by default we give carte blanche access to a user in their project | 19:22 |
| ayoung | I would recommend separaating write access from read access | 19:22 |
| elmiko | we are just starting to get into the type of scenarios that might require more roles | 19:22 |
| ayoung | then at least you can have an audit process that does not change state | 19:22 |
| elmiko | yea, that makes a great deal of sense | 19:22 |
| ayoung | if you start with a data-processing role, you can compose it out of smaller roles like this | 19:22 |
| elmiko | we are also just starting to explore the topic of how we advise users to segregate their project and what not, so this will dovetail nicely | 19:23 |
| elmiko | excellent, i like the sound of that | 19:23 |
| ayoung | rule:role_data_processor: role:data_reader or role:data_writer | 19:23 |
| elmiko | exactly | 19:23 |
| ayoung | and then on the individual rule, match using the rule_ form | 19:23 |
| ayoung | so you can specify at the lowest level, but then infer that big roles inherit the privs of smller roles | 19:24 |
| ayoung | and _member_ can inherit them all | 19:24 |
| ayoung | as can admin | 19:24 |
| elmiko | yea, definitely makes sense | 19:24 |
| ayoung | cool | 19:24 |
| ayoung | then, if *You* set up a cluster for *her* you can deleage only those roles that *she* should have | 19:25 |
| elmiko | that would be kick ass | 19:26 |
| ayoung | rodrigods, can you and samueldmq sort out who is working on the "fetch policy from middleware" | 19:31 |
| elmiko | ayoung: i'll probably add you to the CRs i create just for sanity, fair warning | 19:31 |
| ayoung | elmiko, thanks | 19:32 |
| ayoung | I'll try to keep up, but feel free to ask me directly, too, if they are malingering | 19:32 |
| samueldmq | ayoung, hi | 19:34 |
| samueldmq | ayoung, I read and understood the convertation you had with morgan | 19:34 |
| ayoung | samueldmq, I just saw the rodrigods was asking questions on the trello card about "fetch' and want to make sure you guys agre who is working on it | 19:34 |
| ayoung | samueldmq, ah | 19:34 |
| *** csoukup has joined #openstack-keystone | 19:34 | |
| rodrigods | ayoung, it is samueldmq, was just asking questions alway | 19:34 |
| samueldmq | yep :) | 19:35 |
| ayoung | rodrigods, cool. Are you taking any piece of dyanmic policy? | 19:35 |
| rodrigods | ayoung, nope | 19:35 |
| samueldmq | ayoung, so the policy by url is in the highest priority now right ? | 19:37 |
| samueldmq | ayoung, is there anything else to be decided or can I start the spec ? | 19:38 |
| ayoung | samueldmq, I think we can say it is top priority | 19:38 |
| samueldmq | ayoung, sure | 19:38 |
| ayoung | its an API change, and those need to be in early | 19:38 |
| ayoung | and the other thingscan't go forward until that one is in | 19:38 |
| samueldmq | ayoung, and you need me to start that, right ? | 19:38 |
| samueldmq | ayoung, great, I will start the spec/api spec | 19:39 |
| ayoung | samueldmq, yes, please | 19:39 |
| ayoung | samueldmq, it should be a modification of the endpoiunt_policy spec | 19:39 |
| ayoung | which was a separate extension, and is now moving in to core | 19:39 |
| ayoung | but let's do it in the existing spec | 19:39 |
| ayoung | er...existing API | 19:40 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3-os-endpoint-policy.rst | 19:40 |
| ayoung | samueldmq, OK, the API is here http://git.openstack.org/cgit/openstack/keystone-specs/tree/api/v3/identity-api-v3-os-endpoint-policy.rst#n220 | 19:44 |
| ayoung | I think is needs to be | 19:44 |
| *** spandhe has joined #openstack-keystone | 19:45 | |
| ayoung | GET /OS-ENDPOINT-POLICY/policy?url=<endpointurl> | 19:46 |
| ayoung | dolphm, you wrote the endpoint-policy spec (at least git claims you did) do you agree with the "fetch policy by URL" approach where the url is then matched with the endpoint? | 19:48 |
| ayoung | and, if so, is GET /OS-ENDPOINT-POLICY/policy?url=<endpointurl> the right form of the fetch url for it? | 19:49 |
| *** mdrnstm has quit IRC | 19:55 | |
| *** iamjarvo_ has quit IRC | 19:57 | |
| *** gokrokve has joined #openstack-keystone | 19:59 | |
| *** nkinder has quit IRC | 19:59 | |
| *** ayoung has quit IRC | 20:01 | |
| *** HT_sergio has quit IRC | 20:09 | |
| *** rushiagr is now known as rushiagr_away | 20:10 | |
| *** alanf-mc has joined #openstack-keystone | 20:13 | |
| *** mattfarina has joined #openstack-keystone | 20:16 | |
| *** browne has joined #openstack-keystone | 20:20 | |
| *** timcline has quit IRC | 20:23 | |
| morganfainberg | Is it really only like 1330 west coast time? If feels like it should be 5pm | 20:24 |
| *** timcline has joined #openstack-keystone | 20:25 | |
| evrardjp | think about the time it is in Europe :p | 20:27 |
| *** mattfarina has quit IRC | 20:27 | |
| raildo | morganfainberg, here it's 5pm \o/ | 20:29 |
| *** mattfarina has joined #openstack-keystone | 20:31 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 20:37 |
| *** HT_sergio has joined #openstack-keystone | 20:39 | |
| openstackgerrit | Phil Hopkins proposed openstack/keystone: updates sample_data script to use the new openstack commands https://review.openstack.org/186560 | 20:40 |
| *** mattfarina has quit IRC | 20:43 | |
| dstanek | bknudson: how about "Templated backend doesn't correctly implement write operations"? | 20:50 |
| bknudson | dstanek: works for me. | 20:51 |
| dstanek | bknudson: it actually doesn't work for anyone. that's the problem :-) | 20:54 |
| *** samueldmq has quit IRC | 20:58 | |
| morganfainberg | Templates backend bothers me a lot :( | 21:00 |
| morganfainberg | In its current form. | 21:00 |
| *** someara2 has joined #openstack-keystone | 21:00 | |
| *** radez is now known as radez_g0n3 | 21:02 | |
| *** blewis has joined #openstack-keystone | 21:03 | |
| morganfainberg | It seems to | 21:04 |
| bknudson | it's unmaintained | 21:04 |
| bknudson | which usually means it's a candidate for deprecation | 21:04 |
| bknudson | unless someone wants to step up to maintain it | 21:04 |
| morganfainberg | Me that the template should be the same kind of hard-set template we have in swl if we keep it. And let people supply yaml or such as the input | 21:04 |
| morganfainberg | If we keep it that is. | 21:04 |
| morganfainberg | In its current form it is useless. | 21:05 |
| morganfainberg | Or worse: broken | 21:05 |
| *** dguerri is now known as dguerri`away | 21:06 | |
| *** lhcheng has quit IRC | 21:08 | |
| *** dguerri`away is now known as dguerri | 21:08 | |
| *** dguerri is now known as dguerri`away | 21:09 | |
| morganfainberg | Wonder if we have any real feedback on how much templated is used. | 21:11 |
| morganfainberg | cburgess: you've moved to the sql catalog right? | 21:12 |
| *** samueldmq has joined #openstack-keystone | 21:12 | |
| morganfainberg | lbragstad: btw - already hearing feedback that is positive about fernet. Just a bit of info telling you it is looking good. | 21:13 |
| *** lhcheng has joined #openstack-keystone | 21:14 | |
| *** ChanServ sets mode: +v lhcheng | 21:14 | |
| *** dguerri`away is now known as dguerri | 21:17 | |
| *** dguerri is now known as dguerri`away | 21:18 | |
| *** ayoung has joined #openstack-keystone | 21:29 | |
| *** ChanServ sets mode: +v ayoung | 21:29 | |
| stevemar | lbragstad, yeah you have a fan in mfisch with fernet tokens | 21:32 |
| dolphm | morganfainberg: i'm enjoying the bug reports :) | 21:32 |
| dolphm | working on my fernet deep dive now... that effort ended prematurely last friday | 21:33 |
| dstanek | morganfainberg: i think mfisch uses it | 21:33 |
| dstanek | morganfainberg: i think all that's left to do is remove write capabilities from it | 21:33 |
| *** jamielennox|away is now known as jamielennox | 21:34 | |
| *** openstackgerrit has quit IRC | 21:36 | |
| *** openstackgerrit has joined #openstack-keystone | 21:37 | |
| ayoung | stevemar, check me on this: we don't have the ability to directly query keystone conf, but we could craft a service catalog URL with a replacement string that could be set with any of the values from the conf file. | 21:40 |
| ayoung | would it make more sense to allow the query of those non-blacklisted values via an API? That would let us enforce policy on admin domain, and convert a V2 token to a v3 token with default domain set | 21:42 |
| *** mdrnstm_ has joined #openstack-keystone | 21:43 | |
| stevemar | ayoung, is the point of this to not use keystone.conf? | 21:43 |
| ayoung | stevemar, we don't have it in a remote service | 21:43 |
| dstanek | ayoung: what info from the conf does the remote service need? | 21:44 |
| ayoung | dstanek, so far just those two values: admin domain and default domain | 21:44 |
| *** kbringard has quit IRC | 21:44 | |
| ayoung | what do we have whitelisted... | 21:45 |
| mdrnstm_ | FYI: I am releasing 1.5.0 KeystoneClient in a couple minutes | 21:45 |
| *** mdrnstm_ is now known as morgan | 21:45 | |
| morgan | Please let me know if i need to wait | 21:45 |
| morgan | this will be tagged from master. | 21:45 |
| *** morgan is now known as Guest99687 | 21:46 | |
| Guest99687 | . | 21:47 |
| * Guest99687 mutters | 21:47 | |
| stevemar | morganfainberg, i think you are suffering from an identity crisis | 21:48 |
| *** Guest99687 is now known as mdrnstm | 21:48 | |
| *** blewis has quit IRC | 21:48 | |
| mdrnstm | stevemar: shush | 21:48 |
| mdrnstm | issri just got confused | 21:48 |
| mdrnstm | connected me 4 times | 21:48 |
| *** mdrnstm is now known as Guest96972 | 21:48 | |
| Guest96972 | needed to kill a connection | 21:48 |
| Guest96972 | yep | 21:48 |
| Guest96972 | there it goes again | 21:48 |
| ayoung | stevemar, actully bknudson removed the feature I was thinking of in commit 93311737973866fc0c459f6aabaec0b55db21b23 | 21:49 |
| *** Guest96972 has quit IRC | 21:49 | |
| ayoung | whitelisted properties were WHITELISTED_PROPERTIES = [ | 21:49 |
| ayoung | + 'tenant_id', 'user_id', 'public_bind_host', 'admin_bind_host', | 21:49 |
| ayoung | + 'compute_host', 'compute_port', 'admin_port', 'public_port', | 21:49 |
| ayoung | + 'public_endpoint', 'admin_endpoint', ] | 21:49 |
| openstackgerrit | Kent Wang proposed openstack/keystone: Allows for reset of dependency injections https://review.openstack.org/186571 | 21:49 |
| stevemar | ayoung, luckily reverting stuff is easy in software | 21:50 |
| stevemar | not so much when building a bridge | 21:50 |
| ayoung | we wouldn't need any of those values | 21:50 |
| ayoung | stevemar, a bridge only existing at one place and one point in time. Software replicates and mutates endlessly | 21:51 |
| *** mdrnstm has joined #openstack-keystone | 21:51 | |
| *** ChanServ sets mode: +v mdrnstm | 21:51 | |
| mdrnstm | stevemar: ok back | 21:52 |
| mdrnstm | lets see if irssi is less confused now | 21:52 |
| ayoung | and...back into the car. this day has been one of constant shuttling... | 21:52 |
| *** timcline has quit IRC | 21:52 | |
| *** someara2_ has joined #openstack-keystone | 21:53 | |
| *** dguerri`away is now known as dguerri | 21:53 | |
| bknudson | there was a security vulnerability where if you set the endpoint to $(admin_token)s you could get the admin token. | 21:53 |
| bknudson | you'd need authority to create whatever endpoints you want so it's only admin by default anyway | 21:54 |
| lbragstad | morganfainberg: stevemar \o/ | 21:54 |
| *** topol has joined #openstack-keystone | 21:55 | |
| *** someara2 has quit IRC | 21:55 | |
| *** ChanServ sets mode: +v topol | 21:55 | |
| *** someara2 has joined #openstack-keystone | 21:55 | |
| *** dguerri is now known as dguerri`away | 21:56 | |
| openstackgerrit | Fernando Diaz proposed openstack/python-keystoneclient: WIP - Add openid connect client support https://review.openstack.org/134700 | 21:56 |
| *** ayoung has quit IRC | 21:56 | |
| stevemar | topol is on! | 21:58 |
| *** someara2_ has quit IRC | 21:59 | |
| topol | stevemar hi! | 22:00 |
| stevemar | topol, nice of you to show up | 22:00 |
| *** Ephur has quit IRC | 22:00 | |
| topol | stevemar, we didnt all take a mental margarita for a few days to decompress from the summit? | 22:01 |
| stevemar | topol, few days? i need a week | 22:01 |
| topol | stevemar I am now back in the game. What did I miss? | 22:01 |
| dolphm | stevemar: marekd: has anyone tested Fernet in a federated deployment? | 22:02 |
| dolphm | there's a few considerations in Fernet for federation, but i haven't tested it myself | 22:02 |
| topol | besides morganfainberg cleaning house on old abandoned specs? | 22:02 |
| stevemar | dolphm, not myself personally | 22:03 |
| stevemar | i could swing it easily i think | 22:03 |
| lbragstad | I don't think there would be any specific migration steps for a federated deployment versus anything else? | 22:04 |
| *** lhcheng has quit IRC | 22:06 | |
| *** lhcheng has joined #openstack-keystone | 22:06 | |
| *** ChanServ sets mode: +v lhcheng | 22:06 | |
| *** ChanServ sets mode: +o mdrnstm | 22:07 | |
| *** pnavarro has quit IRC | 22:07 | |
| mdrnstm | 1.5.0 keystoneclient was just pushed to gerrit | 22:08 |
| jamielennox | mdrnstm: now just have to see what happens to the gate | 22:10 |
| mdrnstm | jamielennox: yep | 22:11 |
| openstackgerrit | Fernando Diaz proposed openstack/python-keystoneclient: WIP - Add openid connect client support https://review.openstack.org/134700 | 22:12 |
| *** iamjarvo has joined #openstack-keystone | 22:15 | |
| *** iamjarvo has quit IRC | 22:15 | |
| *** ayoung has joined #openstack-keystone | 22:16 | |
| *** ChanServ sets mode: +v ayoung | 22:16 | |
| *** iamjarvo has joined #openstack-keystone | 22:16 | |
| *** iamjarvo has quit IRC | 22:16 | |
| *** mdrnstm has quit IRC | 22:16 | |
| *** iamjarvo has joined #openstack-keystone | 22:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add openid connect client support https://review.openstack.org/134700 | 22:17 |
| *** nkinder has joined #openstack-keystone | 22:17 | |
| morganfainberg | Well crap. | 22:18 |
| stevemar | sigmavirus24, dstanek asking for a review of ^ https://review.openstack.org/#/c/134700/ (helping out one of our new guys) | 22:18 |
| morganfainberg | My router died. | 22:18 |
| morganfainberg | *sigh* | 22:18 |
| morganfainberg | like. It's not transmitting wifis anymore. | 22:18 |
| ayoung | morganfainberg, I'm using my phone | 22:18 |
| stevemar | morganfainberg, you are always plagued with technology woes | 22:18 |
| morganfainberg | stevemar: I've only had this router for 2yrs. | 22:19 |
| sigmavirus24 | stevemar: is this a ploy to make me review more keystone things? | 22:19 |
| morganfainberg | So... Probably about time for it to just die. | 22:19 |
| morganfainberg | sigmavirus24: ploy?! Hah. It's not a ploy. >.> | 22:19 |
| stevemar | sigmavirus24, nah, it involves requests ... so i figured you know a thing or two about it | 22:19 |
| morganfainberg | stevemar: maybe I have an entropic field that just makes things break. :( | 22:20 |
| bknudson | https://review.openstack.org/#/c/134700/7/testo.py | 22:20 |
| stevemar | i am beginning to think so | 22:20 |
| jamielennox | stevemar: that's one's a bit odd | 22:20 |
| jamielennox | stevemar: why doesn't it use v3.FederatedBase? | 22:20 |
| stevemar | yeah, that'll be removed | 22:20 |
| stevemar | jamielennox, excellent feedback! | 22:20 |
| jamielennox | odd because it's parsing a form | 22:21 |
| stevemar | it's his first real patch so be brutal | 22:21 |
| stevemar | jamielennox, yeah, i am not crazy about that either | 22:21 |
| bknudson | stevemar is a new guy? | 22:22 |
| *** mdrnstm has joined #openstack-keystone | 22:22 | |
| jamielennox | :) brutal to the new guy? | 22:22 |
| *** mdrnstm has quit IRC | 22:22 | |
| *** mdrnstm has joined #openstack-keystone | 22:22 | |
| *** ChanServ sets mode: +v mdrnstm | 22:22 | |
| stevemar | bknudson, someone is taking over it, he pushed ps 5 and 6. | 22:22 |
| *** csoukup has quit IRC | 22:23 | |
| ayoung | rodrigods, on https://review.openstack.org/#/c/184651/ I didn't do Service providers because they were not needed for policy or for tokens. I agree they should be in there, but that can be a follow on review, no? | 22:23 |
| dstanek | stevemar: sure, i can review that | 22:23 |
| rodrigods | ayoung, as long as we have them, I'm ok with the change | 22:23 |
| rodrigods | ayoung, just created a bug to add service provider support in AccessInfoV3 (keystoneclient) | 22:24 |
| ayoung | rodrigods, yeah, I think it won't be too hard to add them, but would rather not hold up this change. | 22:24 |
| mdrnstm | jamielennox: if you have a couple mins to rubber stamp the ksa changes through | 22:24 |
| mdrnstm | jamielennox: i'd like to get another pre-release out the door that limits the deps before we start too much integration work | 22:24 |
| jamielennox | mdrnstm: will look | 22:24 |
| mdrnstm | jamielennox: really easy changes. | 22:24 |
| jamielennox | mdrnstm: really don't see the point in keeping _() around - but i don't care | 22:25 |
| mdrnstm | jamielennox: easier to make it a no-op and cleanup as we go | 22:26 |
| rodrigods | ayoung, removed the -1, didn't +1 because hadn't reviewed the whole change yet | 22:26 |
| mdrnstm | the cleanup can happen even after 1.0 is cut | 22:26 |
| ayoung | rodrigods, Service providers only show up in Federated tokens, right? | 22:26 |
| mdrnstm | i just started hitting rebase ick trying to strip the hints out | 22:26 |
| mdrnstm | so, solution: no op, and cleanup as we can. eventually delete the i18n file once we're done | 22:26 |
| ayoung | do we have a sample Federated token in our fixtures? | 22:26 |
| rodrigods | ayoung, no... every token alongside the service catolog | 22:26 |
| rodrigods | the link I posted in the change shows how they show up in the token | 22:27 |
| ayoung | Ah...then, yeah, we need them in there | 22:27 |
| ayoung | leave the -1 | 22:27 |
| rodrigods | you can add in a follow up patch ayoung | 22:27 |
| ayoung | I'll get them in. Need some updated sample data | 22:27 |
| rodrigods | the change is already big enough :) | 22:27 |
| ayoung | rodrigods, if there are no ServiceProviders, is there still a field for them in the token's service catalog? | 22:28 |
| ayoung | true | 22:28 |
| rodrigods | ayoung, let me check | 22:28 |
| *** darrenc is now known as darrenc_afk | 22:28 | |
| ayoung | rodrigods, if there is, then the sample code I have is invalid anyway | 22:28 |
| ayoung | the sample tokens are invalid rather | 22:29 |
| rodrigods | ayoung, https://review.openstack.org/#/c/159865/6/keystone/token/providers/common.py they entry is only added if we have a non-empty list | 22:29 |
| rodrigods | the* | 22:30 |
| ayoung | rodrigods, OK...then I think it can be a follow on | 22:31 |
| rodrigods | ayoung, ++ | 22:31 |
| rodrigods | it absolutely can | 22:32 |
| *** gokrokve has quit IRC | 22:32 | |
| jamielennox | samueldmq: so i'm looking at the failure caused by v3 only devstack, are you intending to start fixing those issues? otherwise i'll start looking | 22:32 |
| *** iamjarvo has quit IRC | 22:32 | |
| jamielennox | samueldmq: i don't mind, i just don't want us to be both working on the same thing | 22:34 |
| mdrnstm | ayoung: the accessinfo spec - is it still a bit dated? or is it accurate now in your opinion? | 22:34 |
| mdrnstm | oh APR 1 | 22:35 |
| mdrnstm | nvm | 22:35 |
| *** Raildo_ has joined #openstack-keystone | 22:36 | |
| rodrigods | mdrnstm, I'll keep ping you until you take a look in the changes we're willing to back port :) | 22:36 |
| *** darrenc_afk is now known as darrenc | 22:37 | |
| mdrnstm | rodrigods: i'm going through lots of reviews now | 22:37 |
| mdrnstm | :) | 22:37 |
| mdrnstm | this is the one with the config opitons right? | 22:37 |
| ayoung | mdrnstm, I've been working on some things for years. Doesn't mean I've abandonded them, just that our process is so slow | 22:37 |
| rodrigods | mdrnstm, the ones that add new attributes to the SAML assertion generated by keystone, https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/kilo+topic:bug/1442787,n,z | 22:38 |
| jamielennox | bknudson: i fixed up the auth_token cache review, can you have another look when you have time | 22:38 |
| mdrnstm | ayoung: the abandon spree are -2 specs targeted to not backlog | 22:38 |
| mdrnstm | ayoung: and you can always restore things that get abandoned | 22:38 |
| ayoung | let me see if I have any of those, but I thinkI moved everything to backlog | 22:38 |
| mdrnstm | ayoung: all yours were backlog'd | 22:39 |
| *** gokrokve has joined #openstack-keystone | 22:39 | |
| *** csoukup has joined #openstack-keystone | 22:40 | |
| mdrnstm | ayoung: we also *should* reduce the number of open reviews in general - if it isn't being worked on it can be restored. if we let things sit forever it makes on boarding new reviewers harder because they can't identify active reviews or inactive/importance until juno the system would have auto abandoned. i'm thinking if it hasn't been active for > 1 cycle it should be shelved for later. but tha | 22:41 |
| mdrnstm | t is a different discussion than the cleanup i'm doing now. | 22:41 |
| mdrnstm | ayoung: and all your specs were backlog'd i did check | 22:41 |
| rodrigods | mdrnstm, btw, started some clean ups in the docs, mostly in federation stuff | 22:42 |
| mdrnstm | rodrigods: nice | 22:42 |
| cburgess | morganfainberg: yes we have | 22:43 |
| * stevemar hands rodrigods the crown and scepter of being the officially doc guy | 22:43 | |
| mdrnstm | cburgess: great. | 22:43 |
| rodrigods | not too fast stevemar | 22:43 |
| rodrigods | haha | 22:43 |
| mdrnstm | cburgess: tryin to figure out if we can kill it. | 22:43 |
| rodrigods | not so fast* | 22:43 |
| cburgess | mdrnstm In L? | 22:43 |
| mdrnstm | rodrigods: no give-sie-back-sies. | 22:43 |
| mdrnstm | cburgess: deprecate in L | 22:43 |
| mdrnstm | cburgess: but it's not been well maintained (clearly) | 22:44 |
| cburgess | mdrnstm: Oh yeah no complaints here. Kill it | 22:44 |
| mdrnstm | or find someone to step up and maintain [preferably allow for yaml input vs. a free-form template] | 22:44 |
| mdrnstm | cburgess: you up north today? | 22:44 |
| cburgess | mdrnstm: Last day in LA, then east coast for 10 days. | 22:44 |
| mdrnstm | cburgess: ah. east coast. coffee? | 22:44 |
| mdrnstm | or you chillin at home? | 22:44 |
| *** bknudson has quit IRC | 22:45 | |
| ayoung | do we have a way to run tox tests short circuit? | 22:45 |
| mdrnstm | ayoung: in what way? as in stop on first failure? --failfast? | 22:45 |
| ayoung | yeah | 22:45 |
| mdrnstm | ayoung: there is an option... i need to look everytime for what it is | 22:45 |
| ayoung | mdrnstm, that was not the testr option IIRC | 22:45 |
| cburgess | mdrnstm: In the office, going to replace my cracked phone screen at 4:10 though. How fast can you get here? | 22:45 |
| mdrnstm | ayoung: but i *know* it exists | 22:45 |
| mdrnstm | cburgess: 15 mins? | 22:45 |
| mdrnstm | it's about how long it takes to walk | 22:46 |
| cburgess | mdrnstm: OK.. if you can get here by 4 we can make my 4:10 appintment if you want to hang out with me at the a store. | 22:46 |
| mdrnstm | sounds good omw | 22:46 |
| ayoung | morganfainberg, mdrnstm https://wiki.openstack.org/wiki/Testr#How_can_I_exit_a_test_run_after_the_first_failure.3F | 22:48 |
| *** mdrnstm has quit IRC | 22:50 | |
| *** someara2 has quit IRC | 22:51 | |
| *** chlong has quit IRC | 22:52 | |
| stevemar | i think we lost morganfainberg for now | 22:53 |
| * morganfainberg is not here. | 22:53 | |
| morganfainberg | I swear. | 22:53 |
| samueldmq | jamielennox, sorry I was afk | 22:58 |
| samueldmq | jamielennox, you can start looking at that :) | 22:58 |
| samueldmq | jamielennox, I have a spec/some implementation in the dynamic policy stuff for now | 22:58 |
| samueldmq | jamielennox, but I will watch that to get familiar on how the fixes will look like | 22:59 |
| samueldmq | jamielennox, works for you? | 22:59 |
| jamielennox | samueldmq: yep, sounds good | 22:59 |
| jamielennox | samueldmq: i think the first ones will just be converting devstack to use v3 always | 22:59 |
| *** topol has quit IRC | 22:59 | |
| samueldmq | jamielennox, great | 22:59 |
| samueldmq | jamielennox, yes, I guess too | 23:00 |
| samueldmq | jamielennox, maybe the first is to set osclient to use v3 (I didn't look deeply) | 23:00 |
| jamielennox | samueldmq: yea, i've had patches for that in the past for testing that i never submitted | 23:00 |
| samueldmq | jamielennox, but yes, devstack use v3 always, as you just said | 23:00 |
| samueldmq | jamielennox, great, it will help us to move quicker | 23:01 |
| *** ayoung has quit IRC | 23:04 | |
| *** Raildo_ has quit IRC | 23:17 | |
| openstackgerrit | Merged openstack/keystoneauth: Remove oslo.i18n dependency https://review.openstack.org/185799 | 23:17 |
| *** dims_ has quit IRC | 23:17 | |
| *** hemna is now known as hemnafk | 23:18 | |
| *** setmason has quit IRC | 23:18 | |
| *** dims_ has joined #openstack-keystone | 23:20 | |
| openstackgerrit | Merged openstack/keystoneauth: Remove lxml test-requirement https://review.openstack.org/185790 | 23:20 |
| openstackgerrit | Merged openstack/keystoneauth: Replace datetime calculations with utility functions https://review.openstack.org/186076 | 23:20 |
| *** csoukup has quit IRC | 23:21 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Create new user plugin tests https://review.openstack.org/167180 | 23:24 |
| *** gokrokve has quit IRC | 23:34 | |
| *** gokrokve has joined #openstack-keystone | 23:35 | |
| *** gokrokve has quit IRC | 23:40 | |
| *** alanf-mc has quit IRC | 23:50 | |
| *** alanf-mc has joined #openstack-keystone | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
