| *** markvoelker has joined #openstack-keystone | 00:01 | |
| *** markvoelker has quit IRC | 00:05 | |
| *** bradjones has quit IRC | 00:22 | |
| *** bradjones has joined #openstack-keystone | 00:23 | |
| *** bradjones has quit IRC | 00:23 | |
| *** bradjones has joined #openstack-keystone | 00:23 | |
| *** diazjf has joined #openstack-keystone | 00:33 | |
| *** dimsum__ has quit IRC | 00:39 | |
| *** dimsum__ has joined #openstack-keystone | 00:41 | |
| *** dims_ has joined #openstack-keystone | 00:50 | |
| *** dimsum__ has quit IRC | 00:50 | |
| *** diazjf has quit IRC | 00:57 | |
| *** charlesw has joined #openstack-keystone | 01:13 | |
| *** browne has joined #openstack-keystone | 01:16 | |
| *** vilobhmm has joined #openstack-keystone | 01:17 | |
| *** dimsum__ has joined #openstack-keystone | 01:17 | |
| *** dims_ has quit IRC | 01:17 | |
| *** davechen has joined #openstack-keystone | 01:31 | |
| *** dims_ has joined #openstack-keystone | 01:40 | |
| *** dimsum__ has quit IRC | 01:41 | |
| *** diazjf has joined #openstack-keystone | 01:46 | |
| *** ncoghlan has joined #openstack-keystone | 01:48 | |
| *** markvoelker has joined #openstack-keystone | 01:50 | |
| *** markvoelker has quit IRC | 01:55 | |
| *** stevemar has joined #openstack-keystone | 01:57 | |
| *** ChanServ sets mode: +v stevemar | 01:57 | |
| davechen | samueldmq: ping? | 01:59 |
|---|---|---|
| *** linkedinyou has quit IRC | 02:06 | |
| *** woodster_ has joined #openstack-keystone | 02:10 | |
| *** iamjarvo has joined #openstack-keystone | 03:01 | |
| *** vilobhmm has quit IRC | 03:05 | |
| *** rm_work is now known as rm_work|away | 03:16 | |
| *** charlesw has quit IRC | 03:32 | |
| *** markvoelker has joined #openstack-keystone | 03:38 | |
| *** dims_ has quit IRC | 03:40 | |
| *** markvoelker has quit IRC | 03:43 | |
| *** mestery has joined #openstack-keystone | 03:44 | |
| *** charlesw has joined #openstack-keystone | 03:57 | |
| *** electrichead has quit IRC | 03:59 | |
| *** iamjarvo has quit IRC | 04:09 | |
| *** charlesw has quit IRC | 04:15 | |
| *** redrobot has joined #openstack-keystone | 04:16 | |
| *** redrobot is now known as Guest47789 | 04:16 | |
| *** Guest47789 has quit IRC | 04:28 | |
| *** spandhe has joined #openstack-keystone | 04:39 | |
| *** dimsum__ has joined #openstack-keystone | 04:41 | |
| *** iamjarvo has joined #openstack-keystone | 04:43 | |
| *** dimsum__ has quit IRC | 04:46 | |
| *** mestery has quit IRC | 04:54 | |
| *** vilobhmm has joined #openstack-keystone | 04:56 | |
| *** diazjf has quit IRC | 05:04 | |
| *** vilobhmm has quit IRC | 05:05 | |
| *** vilobhmm has joined #openstack-keystone | 05:08 | |
| *** iamjarvo has quit IRC | 05:10 | |
| *** vilobhmm has quit IRC | 05:10 | |
| *** vilobhmm has joined #openstack-keystone | 05:12 | |
| *** vilobhmm has quit IRC | 05:12 | |
| *** stevemar has quit IRC | 05:19 | |
| *** iamjarvo has joined #openstack-keystone | 05:21 | |
| *** markvoelker has joined #openstack-keystone | 05:27 | |
| *** rushiagr_away is now known as rushiagr | 05:27 | |
| *** davechen has quit IRC | 05:30 | |
| *** markvoelker has quit IRC | 05:32 | |
| *** kiran-r has joined #openstack-keystone | 05:33 | |
| *** richm has quit IRC | 05:35 | |
| *** mabrams has joined #openstack-keystone | 05:44 | |
| *** spandhe has quit IRC | 05:56 | |
| *** spandhe has joined #openstack-keystone | 05:56 | |
| *** belmoreira has joined #openstack-keystone | 06:10 | |
| *** spandhe has quit IRC | 06:13 | |
| *** iamjarvo has quit IRC | 06:18 | |
| *** browne has quit IRC | 06:19 | |
| *** ihrachyshka has joined #openstack-keystone | 06:27 | |
| *** ihrachyshka has quit IRC | 06:49 | |
| *** rlt has joined #openstack-keystone | 06:57 | |
| *** markvoelker has joined #openstack-keystone | 07:16 | |
| *** markvoelker has quit IRC | 07:21 | |
| *** pnavarro has joined #openstack-keystone | 07:21 | |
| *** Guest87092 has quit IRC | 07:23 | |
| *** d0ugal has joined #openstack-keystone | 07:24 | |
| *** d0ugal is now known as Guest14875 | 07:24 | |
| *** Guest14875 is now known as d0ugal | 07:25 | |
| *** d0ugal has quit IRC | 07:25 | |
| *** d0ugal has joined #openstack-keystone | 07:25 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add is_domain to tokens for projects acting as a domain https://review.openstack.org/193543 | 07:26 |
| *** dguerri` is now known as dguerri | 07:31 | |
| *** afazekas has joined #openstack-keystone | 07:31 | |
| *** dguerri is now known as dguerri` | 07:35 | |
| *** rlt has quit IRC | 07:37 | |
| *** chlong has quit IRC | 07:39 | |
| *** rlt has joined #openstack-keystone | 07:40 | |
| *** bradjones has quit IRC | 07:43 | |
| *** bradjones has joined #openstack-keystone | 07:45 | |
| *** bradjones has quit IRC | 07:45 | |
| *** bradjones has joined #openstack-keystone | 07:45 | |
| *** vg_ has joined #openstack-keystone | 07:47 | |
| openstackgerrit | Merged openstack/keystone-specs: Add spec for decoupling auth from API versions to backlog https://review.openstack.org/175983 | 07:48 |
| *** woodster_ has quit IRC | 08:01 | |
| *** bradjones has quit IRC | 08:02 | |
| *** e0ne has joined #openstack-keystone | 08:05 | |
| *** fhubik has joined #openstack-keystone | 08:08 | |
| *** e0ne has quit IRC | 08:11 | |
| *** bradjones has joined #openstack-keystone | 08:14 | |
| *** bradjones has quit IRC | 08:14 | |
| *** bradjones has joined #openstack-keystone | 08:14 | |
| *** dguerri` is now known as dguerri | 08:20 | |
| *** josecastroleon has joined #openstack-keystone | 08:21 | |
| *** belmoreira has quit IRC | 08:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/194008 | 08:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/194017 | 08:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/192386 | 08:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/192319 | 08:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-saml2: Updated from global requirements https://review.openstack.org/192320 | 08:27 |
| *** aix has joined #openstack-keystone | 08:36 | |
| *** bradjones has quit IRC | 08:38 | |
| *** bradjones has joined #openstack-keystone | 08:40 | |
| *** bradjones has quit IRC | 08:40 | |
| *** bradjones has joined #openstack-keystone | 08:40 | |
| *** amakarov_away is now known as amakarov | 08:52 | |
| *** marzif has joined #openstack-keystone | 08:56 | |
| *** linkedinyou has joined #openstack-keystone | 09:02 | |
| *** markvoelker has joined #openstack-keystone | 09:05 | |
| *** e0ne has joined #openstack-keystone | 09:05 | |
| *** belmoreira has joined #openstack-keystone | 09:07 | |
| *** markvoelker has quit IRC | 09:09 | |
| *** henrynash has quit IRC | 09:17 | |
| *** henrynash has joined #openstack-keystone | 09:19 | |
| *** ChanServ sets mode: +v henrynash | 09:19 | |
| *** dguerri is now known as dguerri` | 09:20 | |
| *** dguerri` is now known as dguerri | 09:20 | |
| *** jaosorior has joined #openstack-keystone | 09:21 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Relax newly imposed sql driver restriction for domain config https://review.openstack.org/191976 | 09:22 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused code in domain config checking https://review.openstack.org/194057 | 09:22 |
| *** e0ne is now known as e0ne_ | 09:22 | |
| *** davechen has joined #openstack-keystone | 09:22 | |
| *** henrynash has quit IRC | 09:23 | |
| *** e0ne_ is now known as e0ne | 09:27 | |
| *** ncoghlan has quit IRC | 09:30 | |
| *** fhubik is now known as fhubik_afk | 09:50 | |
| *** richm has joined #openstack-keystone | 10:03 | |
| *** rm_work|away is now known as rm_work | 10:10 | |
| vg_ | <samueldmq> there ? | 10:12 |
| *** dimsum__ has joined #openstack-keystone | 10:14 | |
| vg_ | <+ayoung> there ? | 10:14 |
| *** fhubik_afk is now known as fhubik | 10:17 | |
| *** jamielennox is now known as jamielennox|away | 10:25 | |
| *** fhubik is now known as fhubik_afk | 10:29 | |
| vg_ | hi guys , Keystone v2.0 API's didn't had the role of domains... | 10:32 |
| *** fhubik_afk is now known as fhubik | 10:32 | |
| vg_ | I have v2.0 working for devstack .....if I have to change the v3 to be used for Identity Service , do i just need to change in stackrc Identity_Service_API =3.0 | 10:33 |
| vg_ | ? | 10:33 |
| *** davechen has quit IRC | 10:43 | |
| *** jaosorior has quit IRC | 10:43 | |
| *** d0ugal has quit IRC | 10:43 | |
| *** kiran-r has quit IRC | 10:43 | |
| *** gabriel-bezerra has quit IRC | 10:43 | |
| *** lbragstad has quit IRC | 10:43 | |
| *** rm_work has quit IRC | 10:43 | |
| *** Kiall has quit IRC | 10:43 | |
| *** wasmum has quit IRC | 10:43 | |
| *** dolphm has quit IRC | 10:43 | |
| *** _d34dh0r53_ has quit IRC | 10:43 | |
| *** hockeynut has quit IRC | 10:43 | |
| *** eglute_s has quit IRC | 10:43 | |
| *** sigmavirus24_awa has quit IRC | 10:43 | |
| *** Guest11697 has quit IRC | 10:43 | |
| *** adam_g has quit IRC | 10:43 | |
| *** jacorob has quit IRC | 10:43 | |
| *** gus has quit IRC | 10:43 | |
| *** zigo has quit IRC | 10:43 | |
| *** Trozz_ has quit IRC | 10:43 | |
| *** comstud has quit IRC | 10:43 | |
| *** comstud has joined #openstack-keystone | 10:43 | |
| *** gus has joined #openstack-keystone | 10:43 | |
| *** Trozz_ has joined #openstack-keystone | 10:43 | |
| *** Kiall has joined #openstack-keystone | 10:43 | |
| *** kiran-r has joined #openstack-keystone | 10:43 | |
| *** rm_work has joined #openstack-keystone | 10:43 | |
| *** d0ugal has joined #openstack-keystone | 10:43 | |
| *** jacorob has joined #openstack-keystone | 10:43 | |
| *** adam_g has joined #openstack-keystone | 10:43 | |
| *** d0ugal is now known as Guest29011 | 10:43 | |
| *** mgagne has joined #openstack-keystone | 10:43 | |
| *** mgagne is now known as Guest81202 | 10:43 | |
| *** davechen has joined #openstack-keystone | 10:43 | |
| *** adam_g has quit IRC | 10:43 | |
| *** adam_g has joined #openstack-keystone | 10:43 | |
| *** lbragstad has joined #openstack-keystone | 10:44 | |
| *** hockeynut has joined #openstack-keystone | 10:44 | |
| *** zigo has joined #openstack-keystone | 10:44 | |
| *** Guest29011 is now known as d0ugal | 10:44 | |
| *** d0ugal has quit IRC | 10:44 | |
| *** d0ugal has joined #openstack-keystone | 10:44 | |
| *** e0ne is now known as e0ne_ | 10:44 | |
| *** dolphm has joined #openstack-keystone | 10:44 | |
| *** eglute has joined #openstack-keystone | 10:44 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 10:45 | |
| *** d34dh0r53 has joined #openstack-keystone | 10:45 | |
| *** wasmum has joined #openstack-keystone | 10:46 | |
| *** dimsum__ is now known as dims | 10:48 | |
| *** gabriel-bezerra has joined #openstack-keystone | 10:48 | |
| *** mabrams has quit IRC | 10:51 | |
| *** dims has quit IRC | 10:53 | |
| *** fhubik is now known as fhubik_afk | 10:53 | |
| *** e0ne_ is now known as e0ne | 10:53 | |
| *** markvoelker has joined #openstack-keystone | 10:53 | |
| *** fhubik_afk is now known as fhubik | 10:58 | |
| *** markvoelker has quit IRC | 10:58 | |
| *** linkedinyou has quit IRC | 11:04 | |
| *** dims has joined #openstack-keystone | 11:05 | |
| *** pnavarro is now known as pnavarro|lunch | 11:05 | |
| *** dguerri is now known as dguerri` | 11:07 | |
| *** dguerri` is now known as dguerri | 11:08 | |
| *** davechen1 has joined #openstack-keystone | 11:12 | |
| samueldmq | morning | 11:12 |
| samueldmq | vg_: hi, as you noticed, domain is a v3 concept | 11:14 |
| *** davechen has quit IRC | 11:14 | |
| samueldmq | vg_: we are still working towards having devstack fully compatible with v3 + other services using it properly | 11:15 |
| *** daemontool_ has joined #openstack-keystone | 11:16 | |
| *** marzif has quit IRC | 11:18 | |
| vg_ | hi <samueldmq> thanks , so in v2.0 API if i I have to define the custom role and after adding the rule , how do I test if that works fine ? through command line API tests | 11:28 |
| *** fhubik is now known as fhubik_afk | 11:31 | |
| samueldmq | vg_: oh that's easy, once you created the role and assigned to someone, i) get a token as that users and ii) with that token, execute an API which is constrained by that role in the poliyc | 11:31 |
| samueldmq | vg_: makes sense ? | 11:31 |
| vg_ | so I have created a role , assigned that role to the user , got the token of the user by simple curl call ... | 11:32 |
| vg_ | now how do i test the next step | 11:32 |
| vg_ | now to check this user ability to create new users | 11:33 |
| vg_ | hey <samueldmq> can you explain 2nd point through a live call | 11:35 |
| vg_ | exact call , how would i made that | 11:35 |
| vg_ | i need to know if I use a user token in my API , how would it work through this policy | 11:36 |
| samueldmq | vg_: ok, you want to make that call using curl | 11:36 |
| vg_ | yes | 11:36 |
| *** daemontool_ has quit IRC | 11:38 | |
| *** marzif has joined #openstack-keystone | 11:39 | |
| samueldmq | vg_: it should be something like 'curl -H "X-Auth-Token:<YOUR_TOKEN>" http://localhost:5000/v2.0/tenants' | 11:39 |
| samueldmq | vg_: where you put your token as the value in the specified header in the request (<YOUR_TOKEN>) | 11:39 |
| vg_ | yes | 11:40 |
| vg_ | earlier when i used to have project id i used to access projects in my call | 11:40 |
| vg_ | I am trying this call though ...just a sec | 11:41 |
| *** marzif_ has joined #openstack-keystone | 11:42 | |
| *** pnavarro|lunch is now known as pnavarro | 11:48 | |
| *** jdennis has joined #openstack-keystone | 11:50 | |
| *** HT_sergio has joined #openstack-keystone | 11:51 | |
| vg_ | curl -H "X-Auth-Token:82104fc385c8486ead81673b0f9f39a8" http://10.157.132.5:5000/v2.0/tenants {"error": {"message": "The request you have made requires authentication. (Disable debug mode to suppress these details.)", | 11:53 |
| vg_ | <samueldmq> still the same.. | 11:53 |
| vg_ | my rule is below.. | 11:53 |
| samueldmq | vg_: how list_projects looks like in your policy ? | 11:54 |
| *** markvoelker has joined #openstack-keystone | 11:54 | |
| vg_ | "identity:list_projects": "rule:admin_required", | 11:55 |
| vg_ | ohh | 11:55 |
| vg_ | ok | 11:55 |
| vg_ | changing it.. | 11:55 |
| vg_ | "identity:get_project": "rule:admin_required or rule:Tenant_Admin", "identity:list_projects": "rule:admin_required or rule:Tenant_Admin", | 11:57 |
| vg_ | no luck.. | 11:57 |
| vg_ | {"error": {"message": "The request you have made requires authentication. (Disable debug mode to suppress these details.)", "code": 401, "title": "Unauthorized"}} | 11:57 |
| *** markvoelker has quit IRC | 11:59 | |
| samueldmq | vg_: list_projects | 11:59 |
| samueldmq | vg_: not get_project | 12:00 |
| samueldmq | vg_: oh sorry you changed that as well | 12:00 |
| samueldmq | vg_: wait ..... | 12:00 |
| vg_ | yes | 12:00 |
| vg_ | ok | 12:00 |
| samueldmq | vg_: rule:Tenant_Admin should be role:Tenant_Admin | 12:00 |
| samueldmq | vg_: that should be role: instead of rule: | 12:00 |
| vg_ | nopes it's role:project_admin | 12:01 |
| samueldmq | vg_: rules are what you define inside the policy | 12:01 |
| samueldmq | vg_: unless you have something like "Tenant_Admin":"role:Tenant_Admin" in your policyu | 12:01 |
| samueldmq | vg_: would you mind to paste your entire policy at http://paste.openstack.org/ | 12:02 |
| samueldmq | vg_: so I could take a better look at | 12:02 |
| samueldmq | it | 12:02 |
| vg_ | sure.. | 12:02 |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** fhubik_afk is now known as fhubik | 12:10 | |
| davechen1 | samueldmq, ayoung: hi, | 12:10 |
| *** raildo has joined #openstack-keystone | 12:10 | |
| davechen1 | samueldmq, ayoung, are you there? | 12:10 |
| vg_ | <samueldmq> done | 12:11 |
| samueldmq | vg_: please share the link with me :-) | 12:15 |
| samueldmq | davechen1: hi I am here | 12:15 |
| davechen1 | samueldmq: morning. :) | 12:15 |
| *** davechen1 is now known as davechen | 12:16 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Keystone2KeystoneAuthPlugin scoping capabilities https://review.openstack.org/188881 | 12:16 |
| davechen | samueldmq: I read the wiki you created for the dynamic policy, it's really cool! | 12:16 |
| davechen | samueldmq: just one simply question. | 12:17 |
| davechen | samueldmq: what's the policy management API? is it incorporated in 'policy by URL'? | 12:17 |
| *** e0ne is now known as e0ne_ | 12:18 | |
| vg_ | http://paste.openstack.org/show/JBPdBXSUHVR9FrrUdJJH/ | 12:18 |
| vg_ | <samueldmq> | 12:18 |
| davechen | samueldmq: I think you didn't mean the CRUD API for the policy, right? | 12:18 |
| davechen | samueldmq: so what's it? just a little curious about it. | 12:18 |
| *** e0ne_ is now known as e0ne | 12:19 | |
| *** HT_sergio has quit IRC | 12:19 | |
| *** edmondsw has joined #openstack-keystone | 12:22 | |
| *** chlong has joined #openstack-keystone | 12:25 | |
| *** chlong has quit IRC | 12:28 | |
| *** mestery has joined #openstack-keystone | 12:29 | |
| *** iurygregory has joined #openstack-keystone | 12:31 | |
| *** tobasco_ is now known as tobasco | 12:32 | |
| vg_ | @smuaeldmq> had a look ? | 12:34 |
| *** rlt_ has joined #openstack-keystone | 12:38 | |
| *** rlt has quit IRC | 12:41 | |
| samueldmq | vg_: and the user you get a token for has the role project_admin assigned to him/her ? | 12:42 |
| vg_ | yep | 12:43 |
| samueldmq | vg_: that's weird | 12:46 |
| samueldmq | vg_: change the api to "" (nothing) | 12:47 |
| samueldmq | vg_: just to make sure it will work | 12:47 |
| vg_ | ok trying | 12:48 |
| *** dsirrine has joined #openstack-keystone | 12:50 | |
| *** pnavarro is now known as pnavarro|afk | 12:51 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: OS-FEDERATION no longer extension in docs https://review.openstack.org/192671 | 12:51 |
| *** lufix has joined #openstack-keystone | 12:51 | |
| *** bradjones has quit IRC | 12:52 | |
| vg_ | <samueldmq> curl -H "" http://10.157.132.5:5000/v2.0/tenants | 12:52 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/194008 | 12:52 |
| vg_ | no luck ..:( | 12:53 |
| vg_ | curl -H "X-Auth-Token:" http://10.157.132.5:5000/v2.0/tenants | 12:53 |
| samueldmq | vg_: oh, you still need to pass the tokenb | 12:54 |
| vg_ | yes | 12:54 |
| samueldmq | vg_: I meant "" in the policy | 12:54 |
| samueldmq | vg_: "list_projects":"" | 12:54 |
| *** bradjones has joined #openstack-keystone | 12:54 | |
| *** bradjones has quit IRC | 12:54 | |
| *** bradjones has joined #openstack-keystone | 12:54 | |
| vg_ | oh ok | 12:55 |
| *** gordc has joined #openstack-keystone | 12:56 | |
| vg_ | "identity:get_project": "", "identity:list_projects": "", "identity:list_user_projects": "rule:admin_or_owner", | 12:56 |
| vg_ | still no luck after modifying this | 12:57 |
| *** radez_g0n3 is now known as radez | 12:57 | |
| *** e0ne is now known as e0ne_ | 12:58 | |
| *** e0ne_ is now known as e0ne | 12:59 | |
| marekd | What was the proper way of reusing existing token with osc ? OS_TOKEN="my_token_here" OS_AUTH_TYPE=v3token openstack server list? | 12:59 |
| bknudson | marekd: I think you're also going to have to specify the endpoint for the request. | 12:59 |
| bknudson | since you didn't get a new token it doesn't have the catalog | 12:59 |
| bknudson | although why doesn't the plugin fetch the catalog? http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#get-service-catalog | 13:00 |
| marekd | bknudson: exactly, but executing such command should *only* validate $OS_TOKEN | 13:00 |
| *** woodster_ has joined #openstack-keystone | 13:01 | |
| marekd | bknudson: it does, the thing is i am testing k2k plugins, and since there is no osc wrapper yet i simply developer my own wrapper,get a token and tried to use it later with OSC. | 13:01 |
| bknudson | I was having some issues with authenticating using openstack CLI / auth plugins and the errors and responses really aren't helpful | 13:03 |
| marekd | bknudson: my error is very clear, i am wondering whether we have a severe bug in keystone or i am doing something wrong..like missing a parameter or something. | 13:03 |
| bknudson | marekd: if the error is clear then why are you asking here if you're doing something wrong? | 13:04 |
| bknudson | what's the error? | 13:04 |
| marekd | bknudson: i get a scoped federated token (via k2k) and try to use it with OS_TOKEN=<token> OS_AUTH_TYPE=v3token openstack image list . I get the error that indicates that plugin wants to map the ephemeral user again. | 13:05 |
| *** vg_ has quit IRC | 13:05 | |
| bknudson | when I do `openstack --os-token cff5453d74ec402986d4cb9b6831b9c9 user list` it says `Set a username with --os-username, OS_USERNAME, or auth.username` | 13:07 |
| bknudson | but I want to use a token and not a user | 13:07 |
| marekd | bknudson: --os-auth-type=v3token | 13:07 |
| bknudson | then it says to set a os-auth-url. | 13:07 |
| bknudson | when I provide --os-auth-url it says `ERROR: openstack The service catalog is empty.` | 13:08 |
| marekd | bknudson: http://cdn.pasteraw.com/7oluioikgs1ynijjxasgs8tekek7zc3 | 13:08 |
| marekd | no the problem is that the roles,roles assignments,groups, projects setup is fine. | 13:09 |
| *** rushiagr is now known as rushiagr_away | 13:10 | |
| bknudson | marekd: I tried running with debug and the output shows that it's trying to get a new token even though I used --os-token. | 13:11 |
| bknudson | that doesn't make sense | 13:11 |
| bknudson | DEBUG: requests.packages.urllib3.connectionpool "POST /v3/auth/tokens HTTP/1.1" 201 332 | 13:11 |
| marekd | bknudson: yeah.... | 13:11 |
| bknudson | maybe v3token isn't the right plugin? | 13:11 |
| marekd | bknudson: maybe token_endpoint is the right here. | 13:14 |
| marekd | i will check. | 13:14 |
| marekd | thanks. | 13:14 |
| bknudson | openstack --os-token cff5453d74ec402986d4cb9b6831b9c9 --os-auth-type token_endpoint --os-url http://localhost:5000/v3 user list | 13:15 |
| bknudson | worked for me. | 13:15 |
| marekd | yep | 13:18 |
| marekd | thanks! | 13:18 |
| *** pnavarro|afk is now known as pnavarro | 13:21 | |
| *** 1JTAAA236 is now known as cloudnull | 13:22 | |
| *** fhubik is now known as fhubik_afk | 13:27 | |
| *** jdandrea has joined #openstack-keystone | 13:28 | |
| jdandrea | A colleague is lamenting the use of HTTP headers (vs. the JSON response) o return tokens in POST /v3/auth/tokens. Can someone please point me to rationale/info as to why the header is used? (I'm not pro/against here. Just looking for info to share.) | 13:29 |
| *** mestery has quit IRC | 13:30 | |
| samueldmq | vg_ you then probably does not have a valid tokne | 13:31 |
| samueldmq | don't | 13:31 |
| jdandrea | Or, as he put it: "Why doesn't the json response to v3/auth/tokens include the actual token that was generated?" | 13:31 |
| *** kiran-r has quit IRC | 13:32 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update federation driver name in documentation https://review.openstack.org/192706 | 13:35 |
| *** csoukup has joined #openstack-keystone | 13:37 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Update docs: xmlsec1 required for K2K https://review.openstack.org/192674 | 13:38 |
| *** ayoung has joined #openstack-keystone | 13:41 | |
| *** ChanServ sets mode: +v ayoung | 13:41 | |
| *** jasondotstar has joined #openstack-keystone | 13:42 | |
| *** jasondotstar has quit IRC | 13:42 | |
| *** jasondotstar has joined #openstack-keystone | 13:43 | |
| *** jasondotstar has quit IRC | 13:44 | |
| *** jasondotstar has joined #openstack-keystone | 13:46 | |
| *** zigo has quit IRC | 13:47 | |
| *** rushiagr_away is now known as rushiagr | 13:49 | |
| *** r-daneel has joined #openstack-keystone | 13:52 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Add Keystone2KeystoneAuthPlugin for K2K federation https://review.openstack.org/188581 | 13:53 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth: Keystone2KeystoneAuthPlugin scoping capabilities https://review.openstack.org/188881 | 13:54 |
| arif-ali | hi, we are migrating our Juno installation from keystone v2 to v3, we are on the last hurdle (we think) wrt policy.json file, where we get the following error message | 13:56 |
| arif-ali | ERROR: openstack You are not authorized to perform the requested action: identity:list_users (HTTP 403) | 13:56 |
| arif-ali | anyone have any clues where to look on getting this to work? | 13:56 |
| *** cbrown2_ocf has joined #openstack-keystone | 13:56 | |
| *** e0ne is now known as e0ne_ | 13:57 | |
| *** e0ne_ is now known as e0ne | 13:57 | |
| *** jasondotstar has quit IRC | 14:02 | |
| *** iamjarvo has joined #openstack-keystone | 14:02 | |
| marekd | dstanek: Hi, does my answer (and suggestion) make you happy enough to positively vote on the patch? https://review.openstack.org/#/c/192674/2..3/doc/source/federation/federation.rst | 14:02 |
| *** iamjarvo has quit IRC | 14:03 | |
| *** iamjarvo has joined #openstack-keystone | 14:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch to oslo.service https://review.openstack.org/193732 | 14:04 |
| *** stevemar has joined #openstack-keystone | 14:04 | |
| *** ChanServ sets mode: +v stevemar | 14:04 | |
| *** zigo has joined #openstack-keystone | 14:05 | |
| marekd | stevemar: https://review.openstack.org/#/c/134700/ i assume it worked for you? :-) | 14:11 |
| *** charlesw has joined #openstack-keystone | 14:11 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:12 | |
| *** tellesnobrega_ is now known as tellesnobrega | 14:22 | |
| *** henrynash has joined #openstack-keystone | 14:26 | |
| *** ChanServ sets mode: +v henrynash | 14:26 | |
| *** vg_ has joined #openstack-keystone | 14:31 | |
| vg_ | <samueldmq> sorry i was coomuting , I am back do you get anything from my policy.json ? | 14:31 |
| *** nkinder has joined #openstack-keystone | 14:31 | |
| samueldmq | vg_: so, you changed policy.json to have "list_projects":"" and it still didn't work | 14:32 |
| samueldmq | vg_: I suppose your token isn't valid then | 14:32 |
| vg_ | nopes man... | 14:32 |
| vg_ | nopes it's correct.. | 14:32 |
| vg_ | i generated through the curl call... | 14:33 |
| vg_ | I can paste you the output... | 14:33 |
| samueldmq | vg_: please paste the whole requests (token + tenant api) and responses | 14:34 |
| samueldmq | ayoung: bknudson henrynash is /tenants available on pulbic api in v2.0 (5000) ? | 14:35 |
| *** mfisch` is now known as mfisch | 14:36 | |
| bknudson | samueldmq: see the docs: http://developer.openstack.org/api-ref-identity-v2.html | 14:36 |
| *** mfisch is now known as Guest82290 | 14:36 | |
| samueldmq | bknudson: oh thanks, it is | 14:37 |
| bknudson | samueldmq: note that the operation is different on public vs admin api | 14:37 |
| samueldmq | bknudson: I didn't know we had two docs for admin vs public | 14:37 |
| samueldmq | bknudson: thanks, I really don't know that much when we talk about how things worked in v2.0 | 14:38 |
| *** marzif_ has quit IRC | 14:39 | |
| bknudson | you should forget 2.0 and focus on v3. | 14:39 |
| samueldmq | bknudson: yes, in the public it returns only the projects the user has access to | 14:39 |
| samueldmq | bknudson: sure, just trying to help people using v2.0 (cc vg_ _ :) | 14:39 |
| *** marzif_ has joined #openstack-keystone | 14:39 | |
| bknudson | the best way to help would be to tell them to use v3. | 14:40 |
| samueldmq | bknudson: yes, once all services are able to talk v3 properly, and devstakc works fine with v3 :) | 14:40 |
| *** MaxV has joined #openstack-keystone | 14:40 | |
| bknudson | ?? service are using /v2.0/tenants ? | 14:40 |
| *** jaosorior has joined #openstack-keystone | 14:41 | |
| bknudson | I think the v3 equivalent to public v2.0/tenants is /v3/auth/projects | 14:41 |
| MaxV | Hello I am writing some documentation for the openstack-sdk project and I have a question about the /extensions resource | 14:41 |
| samueldmq | bknudson: no, vg_ has a runnning devstack and is trying some customization around the policies | 14:41 |
| MaxV | I do not find a clear explanation of what is the namespace property | 14:41 |
| samueldmq | bknudson: and he can't use v3 since he still want to use horizon (so no domain_admin in the policy) | 14:42 |
| MaxV | on keystone documentation it looks like some sort of openstack docs | 14:42 |
| bknudson | samueldmq: this is insane... what does one have to do with the other? | 14:42 |
| samueldmq | bknudson: he is doing some tests around the policy, but he could definitely be using v3 for testing | 14:42 |
| bknudson | I've used v3 with horizon just fine. Horizon doesn't even support domain-scoped tokens as far as I know | 14:43 |
| stevemar | marekd, ping? | 14:43 |
| bknudson | and horizon has no use for them. | 14:43 |
| *** HT_sergio has joined #openstack-keystone | 14:43 | |
| samueldmq | bknudson: yes he wanted to use domian scoped tokens, which is not supported | 14:43 |
| samueldmq | bknudson: but I agree he could use v3 for testing around the policy, however cannot be using domain_admin anyway | 14:44 |
| marekd | stevemar: hello | 14:44 |
| bknudson | you can use domain admin it's just not going to work in horizon. use the CLI. | 14:45 |
| bknudson | or write your own gui | 14:45 |
| samueldmq | vg_: yes you could be using v3 keystone v3 to your policy tests | 14:45 |
| samueldmq | bknudson: sure | 14:45 |
| samueldmq | vg_: try this http://adam.younglogic.com/2013/09/keystone-v3-api-examples/ | 14:46 |
| stevemar | marekd, is my blog confirmation enough for the oidc plugin? | 14:46 |
| samueldmq | bknudson: I've missed to give the advice 'do not use v2.0 anymore', thanks | 14:47 |
| raildo | that why I want to propose project scoped token to project.is_domain=True... just saying :P | 14:47 |
| marekd | stevemar: i think so. | 14:48 |
| samueldmq | bknudson: however ... I am still abit confused ... how do horizon use v3 tokens if services cannot use them ? | 14:48 |
| samueldmq | bknudson: or do horizon just use the v3 endpoint ot get v2 tokens anyway ? | 14:48 |
| bknudson | samueldmq: what services can't use v3 tokens? | 14:49 |
| samueldmq | bknudson: hard-coded format? etc ? | 14:49 |
| bknudson | samueldmq: if you use the v3 API to get a token you get a v3 token, you can't get a v2 token using the v3 API | 14:49 |
| vg_ | ok | 14:49 |
| vg_ | so how do i convert v2.0 API to 3.0 | 14:49 |
| samueldmq | bknudson: I think that's the whole thing on v3 compability we've been looking at | 14:50 |
| vg_ | i tried changing stackrc for Identity_API to 3.0 | 14:50 |
| *** kfox1111 has quit IRC | 14:50 | |
| samueldmq | bknudson: on that v3 only gate job and jamielennox|away working on the clients, etc | 14:50 |
| bknudson | samueldmq: there are some services that can't get a token using the v3 API. | 14:50 |
| bknudson | samueldmq: but that doesn't mean that you can't use v3 for anything. | 14:50 |
| bknudson | as far as I know every service accepts v3 tokens just fine. | 14:51 |
| *** redrobot has joined #openstack-keystone | 14:51 | |
| *** redrobot is now known as Guest44405 | 14:51 | |
| samueldmq | bknudson: so if providing a token v3 to them will work | 14:51 |
| bknudson | so if you don't disable the v2 api you'll be fine. | 14:51 |
| samueldmq | bknudson: k so the may issue we have may be only the clients | 14:51 |
| *** MaxV has quit IRC | 14:51 | |
| samueldmq | s/may/main | 14:51 |
| *** MaxV has joined #openstack-keystone | 14:52 | |
| *** fhubik_afk is now known as fhubik | 14:52 | |
| bknudson | samueldmq: I think the only issue is the clients. | 14:52 |
| bknudson | so, let's fix that, but don't spread rumors that v3 doesn't work. | 14:52 |
| *** browne has joined #openstack-keystone | 14:53 | |
| *** Guest44405 is now known as redrobot | 14:53 | |
| samueldmq | bknudson: yes we're definitely fixing that, and I am all for that, I created that v3 only jobs to make it happen | 14:53 |
| samueldmq | bknudson: I just thought there were issues with the services themselves | 14:53 |
| bknudson | samueldmq: has that v3-only job shown any issues with the services? | 14:53 |
| samueldmq | bknudson: I didn't say v3 doesn't work to anyone, I said we cannot have domain_admin as other services don't talk about domains | 14:54 |
| bknudson | why would services care about domain_admin? | 14:54 |
| samueldmq | bknudson: horizon managing users + groups ? | 14:54 |
| bknudson | oh, sure. I don't consider horizon a service. | 14:55 |
| bknudson | it's a GUI | 14:55 |
| samueldmq | bknudson: k so the issue I was talking with vg_ was about using horizon and domain_amdin | 14:55 |
| *** marzif has quit IRC | 14:55 | |
| samueldmq | bknudson: I think domain_amdins shoudl be able to do anything inside a domain, if the policy is configured that way | 14:56 |
| samueldmq | bknudson: and not sure we can do taht today if we can't add domain_id checks in the policies | 14:56 |
| *** vg_ has quit IRC | 14:56 | |
| samueldmq | bknudson: makes snes ? | 14:56 |
| samueldmq | sense* | 14:57 |
| bknudson | samueldmq: I think that's going to require a lot of work to get the other services to support it. | 14:57 |
| bknudson | and also not sure that it's worth it | 14:57 |
| bknudson | if you can convert a domain-scoped token to a project-scoped one. | 14:57 |
| bknudson | but if the services are just looking at roles then it shouldn't matter if it's a domain token or project token. | 14:58 |
| bknudson | only problem is services tend to have projects embedded in URLs, etc., and enforce that the token must have a project | 14:59 |
| samueldmq | bknudson: yes, but in this case I think it would be needed to check scope, since a domain_amdin wouldn't be able to touch instances from a project in another domain | 14:59 |
| henrynash | samueldmq: this as the point of inherited role assignments….if you place an inherited assignment on the top level project, then you get it for all projects in the tree…..I think this is how you get rights to everything in a tree, not via a domain scoped token | 15:00 |
| *** c_soukup has joined #openstack-keystone | 15:00 | |
| *** lufix has quit IRC | 15:00 | |
| bknudson | can't I get a project-scoped token given a domain-scoped one? | 15:00 |
| samueldmq | henrynash: so a domain_admin shouldn't be able to manage everythin inside his/her domain usign his domain scoped token | 15:00 |
| samueldmq | henrynash: if the deployer choose that in his policy ? | 15:01 |
| henrynash | samueldmq: no, I have always objected to that view (and the orginal v3sample i wrote did not try and do this) | 15:01 |
| samueldmq | henrynash: ok so in this view, other projects definitely do not need to know anything about domains | 15:02 |
| samueldmq | bknudson: ^ | 15:02 |
| henrynash | samueldmq: correct | 15:02 |
| bknudson | this seems to be a pretty common use case, where somebody wants to be able to get status for all servers in all projects | 15:02 |
| bknudson | and they're thinking that the solution involves domain-scoped tokens | 15:03 |
| *** charlesw has quit IRC | 15:03 | |
| *** csoukup has quit IRC | 15:03 | |
| henrynash | samueldmq: I am hard over now on: a domain is just a special type of project (and only special in that it can hold users and groups), teh current domain API should be frozen (and in the end depreciated), if we add is_domain to a project token for a project acting as a domain (as per https://review.openstack.org/#/c/193543/) then we can deprecate domain tokens as well | 15:04 |
| *** charlesw has joined #openstack-keystone | 15:05 | |
| bknudson | why do we is_domain in tokens? | 15:05 |
| *** kiran-r has joined #openstack-keystone | 15:05 | |
| bknudson | do token consumers care if the token is scoped to a domain project? | 15:06 |
| *** Tedster has joined #openstack-keystone | 15:06 | |
| henrynash | bknudson: if we were to add is_domain=true to tokens issued for projects acting as a domain, then policy files could use that in place of where today they expect domain tokens (you need to provie SOME differentiaton in order to stop someone adding roles to a regular project in order to try and give themselves extra powers) | 15:08 |
| henrynash | bknduson: only if you want to restrict operations like add_user, for instance to someone with a token to the project acting as the domain | 15:08 |
| bknudson | henrynash: can I run servers in projects acting as a domain? | 15:08 |
| henrynash | bkundson: we don’t prevent it | 15:09 |
| samueldmq | henrynash: yes I see | 15:09 |
| henrynash | bknudson: it would be upto policy files to determin if that should be allowed | 15:10 |
| *** c_soukup has quit IRC | 15:10 | |
| bknudson | admins might want to stop that I guess. seems like they could do it just as well using role assignments | 15:10 |
| *** kiran-r has quit IRC | 15:11 | |
| samueldmq | bknudson: henrynash have we ever thought about multi-scoped tokens ? | 15:11 |
| samueldmq | like, gimme a token scope for projects where I am admin | 15:11 |
| henrynash | samueldmq: do you mean a project and a domain, or multiple projects? | 15:11 |
| samueldmq | henrynash: multiple projects (would be the result of a effetive call in a inherited domain role, for example) | 15:12 |
| henrynash | samueldmq: I think token bloat would be the problem | 15:12 |
| bknudson | what does the catalog look like for a multi-scoped token? | 15:12 |
| henrynash | samueldmq: you’d have to have an list of project IDs, each with a list of roles | 15:13 |
| samueldmq | henrynash: yes, and the catalog ? as bknudson asked .. | 15:13 |
| bknudson | seems like OpenStack is complicated enough without adding all these wacky features. | 15:13 |
| marekd | morganfainberg: hello sir, will you find 1 min to +1 this infra patch https://review.openstack.org/#/c/190631/ ? | 15:14 |
| henrynash | samueldmq: this kind of thing also really goes against good secuirty practices…you want bearer tokens to be as limited in scope as possible | 15:14 |
| henrynash | samueldmq: a bearer token that gave me cart-blanche to everything in a domain is a scary thing | 15:14 |
| samueldmq | henrynash: bknudson ok fair enough | 15:15 |
| samueldmq | henrynash: however .. | 15:15 |
| samueldmq | henrynash: could a check in the policy like : domain_scoped and inherited role to projects role + this project is part of that domain = that role in this project | 15:16 |
| *** cbrown2_ocf has quit IRC | 15:16 | |
| bknudson | tokens already give you access to everything, since using a token I can get another token | 15:16 |
| samueldmq | henrynash: that goes in the same direction, but complicate things | 15:16 |
| *** ChanServ sets mode: +o dolphm | 15:16 | |
| samueldmq | bknudson: ok so tokens have to be specific to certain workflows (dealing with a givne project, for exmaple) | 15:16 |
| *** aix has quit IRC | 15:16 | |
| breton | folks | 15:18 |
| breton | why did we need domains? | 15:18 |
| marekd | breton: for better separation of resources i guess... | 15:19 |
| samueldmq | breton: they're the containers of users and groups, so they own identity | 15:19 |
| samueldmq | breton: and they own projects as well, where resourcer like vms, volumes etc are created | 15:19 |
| samueldmq | bknudson, henrynash this was a very good conversation, thanks for clarifying some points | 15:20 |
| samueldmq | have to go afk for a bit now, back soon | 15:20 |
| breton | samueldmq: what was the usecase when projects by themselves were not sufficient? | 15:20 |
| *** pballand has joined #openstack-keystone | 15:20 | |
| henrynash | samueldmq: np….there are many ways to skin this particualr feline | 15:20 |
| breton | I mean, I know there is 968696 | 15:20 |
| samueldmq | breton: 968696 is about not checking the scopes when checking api permissions | 15:21 |
| samueldmq | breton: so if you just check for role:admin, that's not enough | 15:21 |
| samueldmq | breton: since you get have role:admin from project X and be changing thngs in project Y (you don't have role:admin there) | 15:21 |
| samueldmq | breton: because we dont check scope properly | 15:21 |
| samueldmq | breton: so it's said: 'admin anywhere is amdin eveywhere', if that makes sense | 15:22 |
| samueldmq | breton: need to go now, sorry | 15:22 |
| marekd | breton: you have a client, who wants to have multiple projects. To me it looks like a easy way to logically separate for instance clients...or experiments (competing, but in a healthy manner!) at cern :-) | 15:22 |
| *** afazekas has quit IRC | 15:23 | |
| *** kfox1111 has joined #openstack-keystone | 15:24 | |
| *** jasondotstar has joined #openstack-keystone | 15:25 | |
| *** davechen has left #openstack-keystone | 15:26 | |
| *** belmoreira has quit IRC | 15:28 | |
| *** haneef__ has quit IRC | 15:30 | |
| *** vg_ has joined #openstack-keystone | 15:34 | |
| morganfainberg | bknudson: ++ on OpenStack being too complex already | 15:35 |
| *** jasondotstar has quit IRC | 15:35 | |
| *** Guest81202 is now known as mgagne | 15:36 | |
| *** mgagne has joined #openstack-keystone | 15:36 | |
| rodrigods | stevemar, ping... can you take a look in https://review.openstack.org/#/c/123539/ ? it is important for the HMT support in OSC | 15:38 |
| *** jasondotstar has joined #openstack-keystone | 15:39 | |
| *** zzzeek has joined #openstack-keystone | 15:40 | |
| *** csoukup has joined #openstack-keystone | 15:40 | |
| MaxV | Hello I am writing some documentation for the openstack-sdk project and I have a question about the /extensions resource | 15:40 |
| MaxV | I do not find a clear explanation of what is the namespace property | 15:40 |
| MaxV | on keystone documentation it looks like some sort of openstack docs | 15:40 |
| *** marzif_ has quit IRC | 15:41 | |
| *** marzif_ has joined #openstack-keystone | 15:41 | |
| *** janonymous_ has joined #openstack-keystone | 15:43 | |
| *** vg_ has quit IRC | 15:44 | |
| stevemar | rodrigods, will do | 15:44 |
| rodrigods | stevemar, ty | 15:45 |
| morganfainberg | bknudson henrynash: so we could also just say !is_domain in the policy when it checks against the context passed down from middleware. | 15:46 |
| morganfainberg | henrynash: did I read that correctly that you're supporting making domain scope go away? | 15:47 |
| henrynash | morganfaiberg: yes | 15:47 |
| henrynash | (oops) | 15:47 |
| morganfainberg | Yay | 15:47 |
| morganfainberg | I like this plan | 15:47 |
| morganfainberg | This seems like a much simpler approach than introducing all the edge cases of something is a domain...sometimes,.. But a project maybe others. | 15:48 |
| henrynash | morganfainberg: we need to somehome provide the ability on policy checks to differentiate when you can do “domainy” things (like create users)….but I’d like us not to have a totally duplicate set of things (like tokens) in order to do this | 15:49 |
| henrynash | see https://review.openstack.org/#/c/193543/ | 15:50 |
| morganfainberg | I'm fine with checking the project for the domain flag | 15:50 |
| morganfainberg | That is a lot lower overhead than a whole domain scope token | 15:50 |
| bknudson | so without policy I could create a user under any project, not just a domain-project? | 15:51 |
| openstackgerrit | Merged openstack/python-keystoneclient: Add openid connect client support https://review.openstack.org/134700 | 15:51 |
| *** janonymous_ has quit IRC | 15:52 | |
| henrynash | bknduson: well, right now our code would stop that (since we check in crete user that the thing is a domain)….but I think it would make policy rules less obvious if haev they checks are in code and half in rules | 15:52 |
| bknudson | it's just a limitation of non-domain-projects that user domain can't be set to it. | 15:53 |
| henrynash | bknduson: indeed | 15:53 |
| *** cinerama` is now known as cinerama | 15:53 | |
| bknudson | then I don't see what policy has to do with it. You can set policy any way you want it's not going to allow you to have a user in non-domain-project | 15:54 |
| morganfainberg | bknudson: exactly, middleware just needs to pass down the "is this a domain" info | 15:56 |
| morganfainberg | If anyone cares about it. | 15:56 |
| henrynash | bknudson, morganfainberg: I guess we could just do it that way…..dictate that although plicy might not block it, our code will…..I’ll have to think through if there are any other back doors this might open (you always have to think about whether a project admin could add roles to their pojects that somehow give them teh right to do somthing broader) | 15:56 |
| *** MaxV has quit IRC | 15:56 | |
| *** MaxV has joined #openstack-keystone | 15:56 | |
| morganfainberg | Then policy can just check the value - we could even update default policies to reject is_domain (in nova for example) preemptive lay and have no effect today | 15:56 |
| samueldmq | henrynash: morganfainberg and yes, lines 38-42 summarizes things :) | 15:57 |
| samueldmq | we do "project_id:%(user.domain_id)s and is_domain:True" for domain checks | 15:57 |
| bknudson | preemptive lay... | 15:57 |
| morganfainberg | samueldmq: yes. | 15:57 |
| morganfainberg | bknudson: autocorrect fail | 15:57 |
| morganfainberg | Yes I am on my mobile tiny screen device. | 15:57 |
| *** pnavarro has quit IRC | 15:58 | |
| *** afazekas has joined #openstack-keystone | 15:58 | |
| *** charlesw_ has joined #openstack-keystone | 15:58 | |
| samueldmq | morganfainberg: nice, I was discussing that approach to affect the policy with henrynash last friday | 15:59 |
| samueldmq | morganfainberg: glad to see you like it :) | 15:59 |
| *** jasondotstar has quit IRC | 15:59 | |
| henrynash | indeed: it was samueldmq’s idea…he gets the credit | 16:00 |
| *** charlesw has quit IRC | 16:00 | |
| morganfainberg | Cool. | 16:00 |
| *** jasondotstar has joined #openstack-keystone | 16:00 | |
| *** charlesw_ is now known as charlesw | 16:00 | |
| morganfainberg | Much better design than the explicit domain scoped tokens imo | 16:00 |
| samueldmq | henrynash: well, thanks, we had that idea together (on the policy side) | 16:00 |
| morganfainberg | And the domain APIs can be frozen (not deprecated) unless we have a clear reason to poke them. | 16:01 |
| samueldmq | morganfainberg: ++ we check for domainess in a smooth way | 16:01 |
| samueldmq | :-) | 16:01 |
| morganfainberg | samueldmq: don't use "domainess" it is not a good word and will confuse people. | 16:01 |
| samueldmq | ok, you just got me confused | 16:01 |
| morganfainberg | Even in chat here, try to use "is_domain" | 16:01 |
| samueldmq | morganfainberg: ^ :_) | 16:01 |
| henrynash | you could also do the following if you don’t want a project acting as a domain to being able to hold VMs: compute: create_server: ”project_id:%(project_id)s and is_domain:False” | 16:01 |
| morganfainberg | henrynash: yep | 16:02 |
| kfox1111 | morganfainberg: get a chance to review the nova instance user spec? It sounds like the final deadline's the 25th. And I need to get some nova folks to review too. But they don't seem to want to unless both barbian and keystone folks have weighed in on the idea. | 16:02 |
| samueldmq | henrynash: yeah we provide flexibility that way :-) | 16:02 |
| *** jasondotstar has quit IRC | 16:02 | |
| morganfainberg | kfox1111: I am back to closer to 100% here this week. | 16:02 |
| morganfainberg | kfox1111: catching up from trying to take last week off and failing miserably at it. | 16:02 |
| morganfainberg | So I did ready | 16:03 |
| morganfainberg | Read it. Just have not scored it. | 16:03 |
| *** jasondotstar has joined #openstack-keystone | 16:03 | |
| kfox1111 | morganfainberg: Ok. Sorry to keep bugging you. The deadline's really a pain. :/ | 16:03 |
| morganfainberg | It didn't look too crazy. | 16:03 |
| henrynash | morganfainberg, samueldmq: what we DO need however, to make this work, is a way of asking for a token on a project acting as a domain…..I actually don’t care so much “how” we specifiy teh scope, just as long as we can | 16:03 |
| kfox1111 | ok. thanks. | 16:03 |
| morganfainberg | kfox1111: no worries. I get it. | 16:03 |
| samueldmq | henrynash: yes, I think this is what guys here are taking care, cc raildo htruta ... | 16:04 |
| morganfainberg | henrynash: the same way we do today, just ask for the token. If you scope request as a domain, it just fails if it isn't, it gives a project scoped token if it is a domain. If you ask for it as a project, it gives you a token as a project. | 16:05 |
| morganfainberg | And I think the answer is passing the hierarchy for anything at depth. | 16:05 |
| morganfainberg | *think* I don't re,beer if we had full resolution on that point. | 16:05 |
| *** iamjarvo has quit IRC | 16:06 | |
| *** gyee has joined #openstack-keystone | 16:06 | |
| *** ChanServ sets mode: +v gyee | 16:06 | |
| *** afazekas has quit IRC | 16:06 | |
| henrynash | morganfainberg: let’s make sure we nail this in teh next few days….doing these two things would be a great thing to get into L | 16:07 |
| samueldmq | morganfainberg: having something related to is_domain when asking for a token would be consistent with what is used in the policy checks though | 16:08 |
| samueldmq | henrynash: cc ^ | 16:08 |
| samueldmq | and what we get back in a token for an is_domain project (is_domain=True) | 16:09 |
| *** thedodd has joined #openstack-keystone | 16:10 | |
| morganfainberg | henrynash: and if there is a conflict on determining a single depth (domain -> project, nothing deeper than first tier) scope for some reason (though I don't know how we would run into this - domains should always be owned by their parent domain or "none" afair) we would need to fall back to the project itself - for compatibility) | 16:10 |
| *** Guest82290 is now known as mfisch | 16:10 | |
| *** mfisch has quit IRC | 16:10 | |
| *** mfisch has joined #openstack-keystone | 16:10 | |
| *** fhubik has quit IRC | 16:11 | |
| *** e0ne has quit IRC | 16:11 | |
| *** arunkant has joined #openstack-keystone | 16:12 | |
| samueldmq | ayoung: morganfainberg I asked sdague to be in our meeting tomorrow to discuss about dynamic policies | 16:12 |
| samueldmq | ayoung: morganfainberg he will be able to attend it, sounds good ? | 16:12 |
| morganfainberg | Great. | 16:12 |
| *** e0ne has joined #openstack-keystone | 16:13 | |
| samueldmq | morganfainberg: ayoung so we talk about their requirements and how we can synchronize with our first iteration on roadmap/scope | 16:13 |
| samueldmq | :) | 16:13 |
| *** richm has quit IRC | 16:13 | |
| *** dtroyer has joined #openstack-keystone | 16:14 | |
| henrynash | morganfainberg, samueldmq: (not sure if this is what you just said, morgan, but); we could not make any changes to the token request scope at all…..if you ask for a project by name, and you get a conflict you always get the project. If you have clashing names for project and domain, then we don’t support getting the “project acting as a domain”, by name | 16:14 |
| *** afazekas has joined #openstack-keystone | 16:14 | |
| morganfainberg | henrynash: that is exactly what i just said. Except that if your project is waaaaaaaaay deep in a hierarchy (more than 1 level) you must always pass the hierarchy | 16:15 |
| samueldmq | henrynash: ++ | 16:15 |
| morganfainberg | henrynash: but it should be impossible to get a conflict between the domain and the project - the owning domain of the domian (ugh bad wording) should always be its parent. | 16:16 |
| henrynash | morganfainberg: I would say that the hierarachy part is an options extenion to that….and only needed if we want to solve the “let’s make project name only have to be unique to their immediate parent” problem | 16:16 |
| morganfainberg | henrynash: the issue is chasing into a deep hierarchy. My view is always pass the hierarchy when you're more than the model of domain with one layer under it | 16:17 |
| morganfainberg | But if projects have to be unique names no matter the demon under the domain, that solves it too | 16:17 |
| morganfainberg | Demon = depth | 16:17 |
| samueldmq | morganfainberg: haha ++ | 16:18 |
| henrynash | morganfainberg: which is true *today*, but understand the goal of moveing away from that….and it’s at that point we need to support passing the hierachy into the request | 16:18 |
| *** david-ly_ is now known as david-lyle | 16:18 | |
| morganfainberg | henrynash: yeah. We may want to force that point sooner vs later so we don't have an api contract break. | 16:19 |
| morganfainberg | But... Eh.... | 16:19 |
| henrynash | going offline or a bit… | 16:21 |
| *** henrynash has quit IRC | 16:21 | |
| *** MaxV has quit IRC | 16:22 | |
| *** david8hu has joined #openstack-keystone | 16:26 | |
| *** richm has joined #openstack-keystone | 16:28 | |
| *** kiran-r has joined #openstack-keystone | 16:29 | |
| *** kiran-r has quit IRC | 16:32 | |
| *** kiran-r has joined #openstack-keystone | 16:32 | |
| *** tqtran has joined #openstack-keystone | 16:32 | |
| *** kiranr has joined #openstack-keystone | 16:33 | |
| ayoung | samueldmq, nice....and, now I head in to another meeting | 16:36 |
| *** kiran-r has quit IRC | 16:37 | |
| *** jasondotstar has quit IRC | 16:41 | |
| *** RichardRaseley has joined #openstack-keystone | 16:41 | |
| *** dguerri is now known as dguerri` | 16:42 | |
| samueldmq | ayoung: good luck :-) | 16:44 |
| *** lhcheng has joined #openstack-keystone | 16:44 | |
| *** ChanServ sets mode: +v lhcheng | 16:44 | |
| *** rwsu has joined #openstack-keystone | 16:45 | |
| *** afazekas has quit IRC | 16:49 | |
| *** henrynash has joined #openstack-keystone | 16:50 | |
| *** ChanServ sets mode: +v henrynash | 16:50 | |
| *** afazekas has joined #openstack-keystone | 16:54 | |
| ayoung | samueldmq, I'm rereading my http://adam.younglogic.com/2015/06/dyn-policy-microversions/ to see if that is what I still think is the right approach. | 16:56 |
| *** cinerama has quit IRC | 16:58 | |
| *** vilobhmm has joined #openstack-keystone | 16:59 | |
| *** cinerama has joined #openstack-keystone | 17:00 | |
| *** afazekas has quit IRC | 17:00 | |
| samueldmq | ayoung: sure, also see https://dague.net/2015/06/05/the-nova-api-in-kilo-and-beyond-2/ | 17:02 |
| samueldmq | ayoung: I am still looking at it | 17:02 |
| ayoung | samueldmq, I've rad that, but good to review as well | 17:02 |
| ayoung | samueldmq, I think that what he's really going to want is to split the policy, and have the code responsible for the scope, and have a decent default rule for the role. | 17:03 |
| ayoung | then, enforcing scope is done in code, as he origianally suggested is not such a horrible idea | 17:03 |
| samueldmq | ayoung: so people there do want a /policy API, so keysotne reads from endpoint_url/policy in a given timeout | 17:04 |
| samueldmq | ayoung: instead of having CMS uploading the primary source of truth | 17:05 |
| samueldmq | ayoung: I think this is the main point of divergence now, since this is opposite to unified policy | 17:05 |
| ayoung | samueldmq, let's discuss that with him. I think it would make far more sense for that the be pushed into keystone instead of a timeout. Just practically speaking, there is no thread in keystone to do that work | 17:05 |
| samueldmq | ayoung: sure | 17:05 |
| *** e0ne has quit IRC | 17:05 | |
| ayoung | but, that does not mean that it could not be pushed mulitple locations...it could be sent to Horizon as well. | 17:06 |
| ayoung | and, we have to make sure we don't overwrite anything custom on the system, we need to nail down what would be acceptable by such an update. | 17:06 |
| samueldmq | ayoung: well, I guess keystonemiddleware could do such work, connecting /policy of the service it's serving with keystone server | 17:06 |
| samueldmq | ayoung: yes, we can do role checking (at least) when updating | 17:07 |
| ayoung | Also, another problem with /policy is it would report a different answer than keystone would give, unless it was based on fetching the policy from Keystone first...so, maybe if it is limited to "query what this nova endpoitn can do" it makes sense, but that is beyond the scope of what we need to solve | 17:07 |
| samueldmq | ayoung: that would be loaded to keystone as the primary source of truth | 17:08 |
| ayoung | samueldmq, we can't have it both ways | 17:08 |
| samueldmq | ayoung: as I've planned to be done by the CMS when installing | 17:08 |
| ayoung | if it is the priamry source of truth, it will be out of sync with a customized keystone | 17:08 |
| *** dims has quit IRC | 17:09 | |
| samueldmq | ayoung: at install, keystone loads the Stock policy, that comes from /policy | 17:09 |
| ayoung | where are we at with the diagrams... | 17:09 |
| * ayoung looking | 17:09 | |
| samueldmq | ayoung: customized will be a diff, that applies on the stock policy | 17:09 |
| *** dims has joined #openstack-keystone | 17:09 | |
| samueldmq | ayoung: https://wiki.openstack.org/w/images/4/41/Dynamic-policies-install.png | 17:09 |
| samueldmq | ayoung: step 4 will change, that's all | 17:10 |
| samueldmq | ayoung: it will be using /policy from nova | 17:10 |
| ayoung | samueldmq, dumb question...you've continued to update the description of the diagrams with the code use to generate them, right? | 17:10 |
| samueldmq | ayoung: yes they've the code in there as well | 17:11 |
| samueldmq | ayoung: as you did first | 17:11 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystonemiddleware: WIP - Fetch Policy File by Service Endpoint https://review.openstack.org/188561 | 17:12 |
| samueldmq | ayoung: ^ this PoC gets the policy from keystone and stores at policy.json :) | 17:13 |
| samueldmq | ayoung: although I am still having trouble when saving to the file, after that oslo.policy is having trouble to open/read such file | 17:13 |
| *** rwsu has quit IRC | 17:19 | |
| rushiagr | I am interested in stable driver interfaces work. I would appreciate if somebody can tell me where can I look to contribute to it.. Basically, I want to know what is the direction we're moving ahead.. | 17:19 |
| ayoung | samueldmq, https://review.openstack.org/#/c/188561/ is "by endpoint URL" correct? | 17:19 |
| samueldmq | davechen_: hi, sorry for not replying you earlier | 17:19 |
| ayoung | rushiagr, morganfainberg is driving that. | 17:20 |
| samueldmq | ayoung: yes, though it is using GET /policies?endpoint_url=<> .. and getting the first on the list | 17:20 |
| ayoung | samueldmq, I think that is OK | 17:20 |
| samueldmq | ayoung: as we'd discussed before, that could return multiple policies | 17:20 |
| ayoung | is GET /policies?endpoint_url=<> implemented? | 17:20 |
| samueldmq | ayoung: yes it is, however we agreed to not do that way anymore | 17:21 |
| samueldmq | ayoung: and with you'll be defining in your new spec called ... | 17:21 |
| samueldmq | ayoung: Policy by URL (https://review.openstack.org/#/c/192422/1/) | 17:21 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 17:21 |
| samueldmq | ayoung: it was implemented here before (https://review.openstack.org/#/c/186874/) | 17:22 |
| rushiagr | hi morganfainberg | 17:22 |
| morganfainberg | rushiagr: hi. | 17:22 |
| morganfainberg | rushiagr: so, I'll have some more details tomorrow on where we stand with that spec. | 17:22 |
| morganfainberg | Trying to find out where the resources who committed to working on it are going to be time wise. | 17:23 |
| *** dramakri has joined #openstack-keystone | 17:23 | |
| rushiagr | morganfainberg: okay. Please let me know too if I can help | 17:23 |
| morganfainberg | rushiagr: absolutely. If you catch gyee online he can give updates as well, as he is also helping to drive that. | 17:24 |
| morganfainberg | rushiagr: I should have more info tomorrow after the keystone meeting (meeting is 1800utc) | 17:24 |
| rushiagr | morganfainberg: okay, that sounds great | 17:25 |
| *** jasondotstar has joined #openstack-keystone | 17:25 | |
| david8hu | ayoung, I am trying to figure out what we can do for better default policy for liberty. Do you think the unified policy feature will land in liberty? | 17:27 |
| *** harlowja has joined #openstack-keystone | 17:28 | |
| *** iurygregory has quit IRC | 17:33 | |
| *** spandhe has joined #openstack-keystone | 17:34 | |
| *** iamjarvo has joined #openstack-keystone | 17:35 | |
| *** rwsu has joined #openstack-keystone | 17:36 | |
| *** marzif_ has quit IRC | 17:39 | |
| david8hu | ayoung, I am trying to figure out how I can help with better default policy and move forward. I replied to your -2 on https://review.openstack.org/#/c/189486/. Any thoughts? | 17:42 |
| *** amakarov is now known as amakarov_away | 17:43 | |
| samueldmq | david8hu: actually unified policy is still under discussion | 17:46 |
| samueldmq | david8hu: people from other projects are against it, and have fair reasons (there are messages in the ML from nova guys from a couple of weeks ago) | 17:47 |
| samueldmq | david8hu: we will be discussing with someone from nova (Sean Dague - sdague) in our IRC meeting tomorrow | 17:47 |
| samueldmq | david8hu: I hope a lot of points will be clarified, including whether unify or not | 17:48 |
| david8hu | samueldmq, Thanks for the info ! | 17:49 |
| samueldmq | david8hu: np | 17:51 |
| *** iurygregory has joined #openstack-keystone | 17:52 | |
| *** kiranr has quit IRC | 17:56 | |
| *** kiran-r has joined #openstack-keystone | 17:57 | |
| morganfainberg | kfox1111: commented on the spec. No score but I indicated it was in line with what we discussed. | 18:04 |
| morganfainberg | kfox1111: have a concern about metadata service directly handing a keystone token back to the vm. | 18:04 |
| *** kiran-r has quit IRC | 18:04 | |
| *** jasondotstar has quit IRC | 18:06 | |
| ayoung | david8hu, I am not certain. i think that there are a few things we need to blanace out | 18:08 |
| ayoung | we can't break people assuming that that the default policy as they have them now will change | 18:08 |
| ayoung | let me say that better | 18:08 |
| *** jasondotstar has joined #openstack-keystone | 18:08 | |
| ayoung | we can't change the meaning of the default policies currently shipped from the proejcts | 18:09 |
| ayoung | to do so will break people upon upgrade | 18:09 |
| *** jasondotstar has quit IRC | 18:09 | |
| samueldmq | ayoung: ++ | 18:09 |
| ayoung | thus, policy needs to be dynamic, so that people can ship their own custom policieis | 18:09 |
| ayoung | we need a unified view of policy so that admin means the same things everywhere: a scopeed user that can perform sensitive operations | 18:10 |
| ayoung | and that a clouad/superadmin can also exist | 18:10 |
| ayoung | but that a local admin cannot accidentally (or intentionally) create a superadmin | 18:10 |
| samueldmq | ayoung: yes, 100% on the unified view, but we can have a cross-project effort on policies, to make all of them v3cloud or something so :) | 18:10 |
| *** fangzhou has joined #openstack-keystone | 18:10 | |
| ayoung | we need make the meaning of superadmin the same across multiple endpoints | 18:11 |
| ayoung | samueldmq, I know you know this..just anserwing david8hu 's question | 18:11 |
| samueldmq | ayoung: I think that is exactly what people from my team started last year (cloud sample policy for all projects) | 18:11 |
| ayoung | samueldmq, yeah, and I think that unified is the right approach | 18:11 |
| ayoung | I'm really not too worrieds about microversions | 18:11 |
| *** rlt_ has quit IRC | 18:12 | |
| *** e0ne has joined #openstack-keystone | 18:12 | |
| samueldmq | ayoung: k sure, we will discuss better tomorrow :-) | 18:12 |
| ayoung | if we get the base policy written correctly, it should be trivial to keep up with microversions, even if it is in a common repo | 18:12 |
| *** afazekas has joined #openstack-keystone | 18:12 | |
| *** jasondotstar has joined #openstack-keystone | 18:13 | |
| *** browne has quit IRC | 18:13 | |
| david8hu | ayoung, samueldmq, perhaps the way to have a better default is by providing sample policy. Deployer has o make a concious decision to deploy it over the default. | 18:13 |
| *** browne has joined #openstack-keystone | 18:13 | |
| david8hu | ayoung, base policy meaning the default policy? | 18:14 |
| *** jasondotstar has quit IRC | 18:14 | |
| ayoung | david8hu, I think what you are saying is we should have a sample unified policy | 18:16 |
| ayoung | david8hu, if so, then I agree, 100% | 18:16 |
| ayoung | we can't force it on people, but it is the starting point for dynamic policy | 18:16 |
| ayoung | david8hu when I say "default" I mean "the one you get from the keystone api if one has not ben assiged specifically ot the endpoint, or to the service..." | 18:17 |
| david8hu | ayoung, yes. Base deployment, use the default. Service admin segregation deployer, use sample_admin_seg_policy.json. | 18:17 |
| ayoung | so...yes, the default | 18:17 |
| *** jasondotstar has joined #openstack-keystone | 18:17 | |
| *** arunkant_ has joined #openstack-keystone | 18:17 | |
| ayoung | david8hu, and to distinguish | 18:17 |
| ayoung | the policy that ships from Nova as their policy.json is the "stock" policy | 18:17 |
| david8hu | ayoung, default is overloaded :) | 18:17 |
| *** jasondotstar has quit IRC | 18:18 | |
| ayoung | david8hu, so, unified is the default, and then, when an operator customized for a given deployment, they would redefine a subset of targets on top of that | 18:19 |
| ayoung | david8hu, so, lets assume we had a system like this...what would happen with a microversion change | 18:20 |
| ayoung | we have (at least) 2 options | 18:20 |
| *** arunkant has quit IRC | 18:20 | |
| ayoung | 1. default policy does not know about the microversion, so the default rule would be applied. | 18:20 |
| ayoung | 2. THe new microversion policy would get pushed up to the keystone server and applied to all policies | 18:21 |
| ayoung | which is less scary? | 18:21 |
| *** fangzhou has quit IRC | 18:21 | |
| *** fangzhou has joined #openstack-keystone | 18:21 | |
| david8hu | Now, I am getting my vocabulary straight. Samueldmq did mentioned stock policy last Friday. Now stock policy is officially registering in my head :) | 18:23 |
| *** e0ne is now known as e0ne_ | 18:23 | |
| *** e0ne_ is now known as e0ne | 18:24 | |
| *** jasondotstar has joined #openstack-keystone | 18:25 | |
| *** jasondot_ has joined #openstack-keystone | 18:25 | |
| *** belmoreira has joined #openstack-keystone | 18:26 | |
| david8hu | ayoung, 1 is less scary, if microversion is part of the rule, we do not need to even know about microversion | 18:36 |
| ayoung | david8hu, that is what I think, too | 18:37 |
| ayoung | david8hu, so, an update to the stock policy should probably have no impact on the custom policy. But what Sean is saying is it should be the policy rule executed. You see the disconnect? | 18:38 |
| dolphm | stevemar: doesn't OS-FEDERATION only include groups in unscoped tokens? or does it include groups in scoped tokens as well? | 18:38 |
| david8hu | ayoung, What does it mean "...it should be the policy rule executed"? | 18:39 |
| stevemar | dolphm, only groups in unscoped | 18:40 |
| stevemar | dolphm, marekd, asked the same question last week | 18:40 |
| *** tqtran is now known as tqtran_afk | 18:40 | |
| dolphm | stevemar: then the spec has a mistake | 18:40 |
| david8hu | ayoung, does it mean calling policy enforcement api and give version as an arg? | 18:40 |
| dolphm | stevemar: see the scoped token example https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#request-a-scoped-os-federation-token | 18:41 |
| dolphm | stevemar: i'll propose a patch to clean that up then | 18:41 |
| *** afazekas has quit IRC | 18:42 | |
| ayoung | david8hu, let me try to say that clearer. | 18:43 |
| ayoung | Sean is asying that if they add a new microversion, the policy should be bundled with the microversion code and that is what should be executed, not the dynamic policy. | 18:44 |
| ayoung | david8hu, now, I think the solution uses the Widom of King Solomon. We cut the baby in half. | 18:44 |
| ayoung | In this case, the baby is policy, and we actually cut it in half, not just threaten | 18:44 |
| ayoung | the two halves are "scope" and "role" | 18:45 |
| *** kiran-r has joined #openstack-keystone | 18:45 | |
| ayoung | scope is "where do I find the project Id when calling this API" | 18:45 |
| ayoung | role is "what role does the user have on that scope when calling this api" | 18:46 |
| ayoung | scope can (and probably should) be enforced in code like Sean is suggesting | 18:46 |
| ayoung | role, on the other hand, can be safely defaulted. | 18:46 |
| ayoung | However, if we split the two, and allow for "update dynamic policy when Nova is updated" all it would be updating is the role side of dynamic policy | 18:47 |
| ayoung | david8hu, does that makes sense, of have I finally slipped into my dotage? | 18:47 |
| *** afazekas has joined #openstack-keystone | 18:49 | |
| *** jasondot_ has quit IRC | 18:51 | |
| *** Rockyg has joined #openstack-keystone | 18:51 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Groups are not included in federated scoped tokens https://review.openstack.org/194300 | 18:53 |
| dolphm | stevemar: ^ | 18:53 |
| dolphm | marekd: ^ | 18:53 |
| mgagne | I'm running Keystone Icehouse and somehow when running with Apache WSGI, v2.0 is not advertised under the admin endpoint (35357) but it's there with keystone-all eventlet. Any idea? | 18:54 |
| mgagne | could it be that controllers.register_version('v2.0') is missing from https://github.com/openstack/keystone/blob/stable/icehouse/keystone/service.py#L97 ? But why different between eventlet vs WSGI ? | 18:55 |
| *** gsilvis_ is now known as gsilvis | 18:55 | |
| mgagne | looks like icehouse is missing a patch found in juno | 19:02 |
| *** afazekas has quit IRC | 19:03 | |
| *** Lactem has joined #openstack-keystone | 19:03 | |
| *** afazekas has joined #openstack-keystone | 19:04 | |
| *** gordc is now known as gordc_afk | 19:04 | |
| *** e0ne has quit IRC | 19:04 | |
| *** e0ne has joined #openstack-keystone | 19:05 | |
| Lactem | dolphm: I did more tests on that bug on this other laptop. After creating the endpoint normally (without the space between i and d), I listed the endpoints. I deleted and listed the endpoints again after that. I repeated the process using the endpoint name that the bug reporter said caused problems (with a space between i and d). Both times, the ne | 19:06 |
| Lactem | w endpoint was deleted properly. I pasted my logs here: https://paste.ee/p/pdyrS The bug is located here: https://bugs.launchpad.net/keystone/+bug/1098564 | 19:06 |
| openstack | Launchpad bug 1098564 in Keystone "Cannot delete a service or endpoint" [Low,Incomplete] - Assigned to Theodore Ilie (theoilie-ti) | 19:06 |
| dolphm | Lactem: GREAT to hear! | 19:06 |
| Lactem | So should I post those logs in a new comment on the bug page? Is it now proved invalid? | 19:08 |
| *** rushiagr is now known as rushiagr_away | 19:08 | |
| Lactem | My first bug. :D | 19:08 |
| dolphm | Lactem: i'll leave that up to you. we can certainly mark it as invalid, but it'd also be handy to write a functional test proving that it's invalid so that we avoid any regressions. that part is up to you- interested? | 19:09 |
| Lactem | Of course. | 19:09 |
| Lactem | So I need to actually write some code for this? | 19:09 |
| rodrigods | dolphm, ping... can you take a look in the k2k auth plugin changes? https://review.openstack.org/#/c/188581/ and follow up patch | 19:10 |
| dolphm | yep! | 19:10 |
| dolphm | rodrigods: probably not today, i'm getting ready to go to an event. i'll put it on my list for tomorrow | 19:10 |
| rodrigods | dolphm, np! thanks | 19:10 |
| *** dsirrine has quit IRC | 19:11 | |
| dolphm | Lactem: there's a bunch of functional API tests in keystone.tests.unit.test_v3_* (nevermind the package name). i believe there's one for test_v3_catalog | 19:11 |
| *** Lactem has quit IRC | 19:12 | |
| *** roxanaghe has joined #openstack-keystone | 19:13 | |
| *** rwsu has quit IRC | 19:15 | |
| stevemar | dolphm, can i run an ansible playbook that installs stuff on my local machine? | 19:19 |
| *** afazekas has quit IRC | 19:19 | |
| ayoung | stevemar, heh | 19:19 |
| ayoung | I was just asking ths ame question | 19:19 |
| ayoung | stevemar, yes you can | 19:19 |
| stevemar | ayoung, hehe | 19:20 |
| ayoung | stevemar, one sec...let me find it in my history | 19:20 |
| ayoung | stevemar, https://docs.ansible.com/playbooks_delegation.html#local-playbooks | 19:20 |
| ayoung | stevemar, and... the other think we just discovered is you can use update the view of the inventory in mememory | 19:20 |
| ayoung | so if you want to, say create a new vm via nova, you can then add that to your inventory for later calls in the same playbook | 19:21 |
| stevemar | interesting | 19:21 |
| ayoung | I was just about to start trying this stuff out | 19:21 |
| stevemar | i was hoping to use it to setup my dev env | 19:21 |
| stevemar | something basic | 19:21 |
| stevemar | as a first exercise | 19:21 |
| *** jasondot_ has joined #openstack-keystone | 19:24 | |
| *** mgarza has joined #openstack-keystone | 19:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: add --slowest flag to testr https://review.openstack.org/179725 | 19:33 |
| *** e0ne is now known as e0ne_ | 19:35 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 19:35 |
| *** e0ne_ is now known as e0ne | 19:35 | |
| *** diazjf has joined #openstack-keystone | 19:37 | |
| *** rwsu has joined #openstack-keystone | 19:38 | |
| kfox1111 | morganfainberg: Thanks for reviewing. I'll add comments addressing your questions shortly. | 19:39 |
| *** marzif_ has joined #openstack-keystone | 19:39 | |
| *** rwsu has quit IRC | 19:40 | |
| *** tqtran_afk has quit IRC | 19:40 | |
| *** rwsu has joined #openstack-keystone | 19:40 | |
| *** fangzhou has quit IRC | 19:41 | |
| dolphm | stevemar: yes | 19:44 |
| stevemar | dolphm, have any easy ansible playbooks that i can copy? | 19:44 |
| *** dramakri has quit IRC | 19:52 | |
| *** dramakri has joined #openstack-keystone | 19:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/190405 | 19:54 |
| stevemar | bknudson, can you confirm if this bp is complete? https://blueprints.launchpad.net/keystone/+spec/stevedore | 19:57 |
| *** afazekas has joined #openstack-keystone | 19:57 | |
| bknudson | stevemar: I can confirm it's not complete. | 19:57 |
| stevemar | doh | 19:58 |
| bknudson | stevemar: https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/stevedore,n,z | 19:58 |
| stevemar | y, looking there now | 19:59 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/192386 | 20:00 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Simplify fernet rotation code https://review.openstack.org/194335 | 20:01 |
| morganfainberg | bknudson, stevemar: +2 on that chain (stevedore) | 20:04 |
| *** edmondsw has quit IRC | 20:04 | |
| stevemar | thx morganfainberg i have a few patches opened up and reviewing now (while i craft a note) | 20:05 |
| *** marzif_ has quit IRC | 20:07 | |
| *** kiran-r has quit IRC | 20:09 | |
| *** Lactem has joined #openstack-keystone | 20:10 | |
| *** rwsu has quit IRC | 20:10 | |
| Lactem | dolphm: Did you say anything before? I timed out. | 20:10 |
| *** iurygregory has quit IRC | 20:14 | |
| *** gordc_afk is now known as gordc | 20:15 | |
| *** jasondotstar has quit IRC | 20:18 | |
| *** afazekas has quit IRC | 20:19 | |
| *** belmoreira has quit IRC | 20:21 | |
| *** afazekas has joined #openstack-keystone | 20:21 | |
| *** iurygregory has joined #openstack-keystone | 20:31 | |
| openstackgerrit | Merged openstack/keystone: Add missing keystone-manage commands to doc https://review.openstack.org/193663 | 20:31 |
| *** jasondot_ has quit IRC | 20:33 | |
| openstackgerrit | Merged openstack/keystone: Fix Fernet key rotation https://review.openstack.org/192782 | 20:34 |
| openstackgerrit | Merged openstack/keystone: Add unit test to exercise key rotation https://review.openstack.org/192792 | 20:34 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/190405 | 20:34 |
| *** Rockyg has quit IRC | 20:34 | |
| *** fangzhou has joined #openstack-keystone | 20:36 | |
| kfox1111 | morganfainberg: Sorry for the delay. I hope I addressed your concern in the comments. If not, I'll update it asap. | 20:36 |
| kfox1111 | thanks again for reviewing. | 20:36 |
| *** iurygregory has quit IRC | 20:37 | |
| *** mestery has joined #openstack-keystone | 20:38 | |
| david8hu | ayoung, let me digest the information | 20:42 |
| *** iurygregory has joined #openstack-keystone | 20:44 | |
| *** iurygregory has quit IRC | 20:44 | |
| *** afazekas has quit IRC | 20:50 | |
| *** gordc has quit IRC | 20:53 | |
| *** gordc has joined #openstack-keystone | 20:54 | |
| *** mestery has quit IRC | 20:56 | |
| *** afazekas has joined #openstack-keystone | 20:58 | |
| *** jasondotstar has joined #openstack-keystone | 20:59 | |
| morganfainberg | kfox1111: just responded | 21:01 |
| morganfainberg | kfox1111: i think you're just moving the concern of a leaving project admin and sortof hiding the issues - it's not really adding more security having the metadata service issue the tokens | 21:02 |
| *** raildo has quit IRC | 21:02 | |
| *** e0ne has quit IRC | 21:03 | |
| *** mestery has joined #openstack-keystone | 21:03 | |
| morganfainberg | it *might* be slightly less overhead for the VM's admin, but I'm not convinced that this wont turn into a vector of DOS attack that is hard to chase down without impacting people relying on the new cert structures. | 21:03 |
| *** aix has joined #openstack-keystone | 21:05 | |
| *** e0ne has joined #openstack-keystone | 21:06 | |
| *** Lactem has quit IRC | 21:07 | |
| *** e0ne has quit IRC | 21:09 | |
| *** rwsu has joined #openstack-keystone | 21:10 | |
| openstackgerrit | Sergey Vilgelm proposed openstack/keystone: Switch to oslo.service https://review.openstack.org/194382 | 21:10 |
| *** Lactem has joined #openstack-keystone | 21:13 | |
| Lactem | Sorry I keep timing out for some reason. | 21:13 |
| *** HT_sergio has quit IRC | 21:13 | |
| Lactem | dolphm: So what exactly do I need to do to finish off this bug? | 21:13 |
| *** iamjarvo has quit IRC | 21:17 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch to oslo.service https://review.openstack.org/193732 | 21:20 |
| *** marzif_ has joined #openstack-keystone | 21:20 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Simplify fernet rotation code https://review.openstack.org/194335 | 21:21 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Tests for correct key removed https://review.openstack.org/194388 | 21:21 |
| *** Lactem has quit IRC | 21:22 | |
| *** jasondotstar has quit IRC | 21:27 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample configuration file https://review.openstack.org/193879 | 21:28 |
| *** jasondotstar has joined #openstack-keystone | 21:28 | |
| *** henrynash has quit IRC | 21:28 | |
| *** afazekas has quit IRC | 21:28 | |
| *** arunkant__ has joined #openstack-keystone | 21:30 | |
| bknudson | jamielennox|away: https://pypi.python.org/pypi/requests-cache | 21:31 |
| *** arunkant has joined #openstack-keystone | 21:33 | |
| *** arunkant_ has quit IRC | 21:34 | |
| *** kfox1111 has quit IRC | 21:36 | |
| *** arunkant__ has quit IRC | 21:36 | |
| *** jasondot_ has joined #openstack-keystone | 21:37 | |
| openstackgerrit | gordon chung proposed openstack/pycadf: ensure id is not empty https://review.openstack.org/194397 | 21:39 |
| stevemar | gordc, we need another branch for pycadf dev ! | 21:41 |
| stevemar | diazjf, mapping regex fail eh? | 21:43 |
| *** zigo has quit IRC | 21:43 | |
| diazjf | stevemar yup | 21:43 |
| *** brad[] has quit IRC | 21:43 | |
| diazjf | doesn't seem to be supported by the mapping-engine because of the parsing | 21:44 |
| *** ayoung has quit IRC | 21:44 | |
| stevemar | that's funny | 21:44 |
| stevemar | i wouldn't have thought that at all | 21:44 |
| diazjf | setup a break point | 21:46 |
| diazjf | https://github.com/openstack/keystone/blob/master/keystone/cli.py#L598 | 21:46 |
| diazjf | causes it to fail | 21:46 |
| diazjf | :/ | 21:46 |
| *** Lactem has joined #openstack-keystone | 21:48 | |
| *** zigo has joined #openstack-keystone | 21:49 | |
| stevemar | diazjf, what's causing read_rules to fail? it doesn't like regex? | 21:50 |
| stevemar | jsonutils.load? | 21:50 |
| stevemar | maybe the input is wrong? | 21:50 |
| *** Lactem has quit IRC | 21:50 | |
| stevemar | diazjf, also, sorry for not replying to your email earlier :P | 21:50 |
| diazjf | no worries I know you guys are busy :-D | 21:51 |
| diazjf | input is correct, iyt just doesn't like boolean values | 21:51 |
| diazjf | so True can't be used | 21:51 |
| *** nkinder has quit IRC | 21:53 | |
| stevemar | any takers for https://blueprints.launchpad.net/keystone/+spec/liberty-sql-squash ? | 21:54 |
| stevemar | diazjf, ohhh | 21:54 |
| stevemar | maybe not related to regex then... since that's all stringified | 21:54 |
| *** jasondotstar has quit IRC | 21:54 | |
| *** telemonster has quit IRC | 21:54 | |
| *** telemonster has joined #openstack-keystone | 21:55 | |
| *** kfox1111 has joined #openstack-keystone | 21:55 | |
| *** jasondotstar has joined #openstack-keystone | 21:55 | |
| diazjf | also if True is set as a string, then we get an error at https://github.com/openstack/keystone/blob/master/keystone/cli.py#L599 | 21:55 |
| diazjf | since the schema isn't matched | 21:56 |
| gordc | stevemar: eh? | 21:57 |
| kfox1111 | morganfainberg: Thanks for the review. Your argument is compelling. I'll update the spec accordingly. I think it also ties in with redrobot's suggesting of not storing the certs in the novadb. if its not issuing the tokens, then the call can passed through to barbican for fetching the cert since its only done once. | 21:57 |
| diazjf | https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L88-L90 | 21:59 |
| diazjf | jsonutils.load(file) won't work with regex since True is not a string | 22:01 |
| diazjf | and if it is a String then it won't be supported | 22:01 |
| diazjf | so this needs to be fixed | 22:01 |
| morganfainberg | kfox1111: yeah. | 22:04 |
| *** mgarza has quit IRC | 22:04 | |
| *** mancdaz has quit IRC | 22:04 | |
| kfox1111 | though I think there is one workflow issue there. | 22:04 |
| kfox1111 | so the nova server create needs to support a flag to return the instance user's id. | 22:05 |
| kfox1111 | so its gota go from nova -> barbican (create cert) then to keystone (get user id). | 22:05 |
| kfox1111 | I think barbican's cert api is async only. | 22:05 |
| *** iamjarvo has joined #openstack-keystone | 22:06 | |
| kfox1111 | so I'm not sure how to make that work. | 22:06 |
| diazjf | stevemar: should https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/utils.py#L88-L90 be changed to allow string values. | 22:06 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:06 | |
| *** mancdaz has joined #openstack-keystone | 22:06 | |
| diazjf | that way json can be parsed | 22:07 |
| kfox1111 | one possible way around that would be to allow fetching the user_id from keystone before a cert is associated with it. would that be viable? | 22:07 |
| kfox1111 | you could then nova -> kesytone (get user id) -> async create barbican cert and return. | 22:07 |
| *** jasondotstar has quit IRC | 22:07 | |
| kfox1111 | nova would kick off the barbican cert creation but not wait for return. | 22:08 |
| kfox1111 | return/completion. | 22:08 |
| *** afazekas has joined #openstack-keystone | 22:08 | |
| *** henrynash has joined #openstack-keystone | 22:09 | |
| *** ChanServ sets mode: +v henrynash | 22:09 | |
| stevemar | diazjf, yeah, if we can make regex be string || boolean, that would be cool | 22:10 |
| stevemar | diazjf, maybe change that line to: { "type": ["number", "string"] } | 22:12 |
| stevemar | diazjf, try it out, open a bug, make the fix with a test :) | 22:12 |
| *** jasondot_ has quit IRC | 22:12 | |
| *** rushiagr_away has quit IRC | 22:13 | |
| *** afazekas has quit IRC | 22:13 | |
| *** zigo has quit IRC | 22:15 | |
| diazjf | stevemar, gotcha. Gonna take some refactoring but I'll work on it :) | 22:16 |
| *** marzif__ has joined #openstack-keystone | 22:16 | |
| *** zigo has joined #openstack-keystone | 22:17 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Bandit config updates https://review.openstack.org/194417 | 22:17 |
| *** marzif_ has quit IRC | 22:19 | |
| *** marzif__ has quit IRC | 22:21 | |
| *** mestery has quit IRC | 22:25 | |
| *** rushiagr_away has joined #openstack-keystone | 22:28 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable bandit check for password_config_option_not_marked_secret https://review.openstack.org/194420 | 22:31 |
| *** stevemar has quit IRC | 22:37 | |
| *** diazjf has quit IRC | 22:38 | |
| kfox1111 | morganfainberg: think it would be possible to pre'return the id from keystone without the cert beign created? | 22:39 |
| *** aix has quit IRC | 22:41 | |
| *** arunkant_ has joined #openstack-keystone | 22:41 | |
| *** aix has joined #openstack-keystone | 22:41 | |
| *** jasondotstar has joined #openstack-keystone | 22:43 | |
| *** arunkant has quit IRC | 22:45 | |
| *** charlesw has quit IRC | 22:46 | |
| *** Lactem has joined #openstack-keystone | 22:49 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182138 | 22:50 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Short names for auth plugins https://review.openstack.org/182107 | 22:50 |
| Lactem | dolphm: I got disconnected again after messaging you. Sorry about that. I'm trying to figure out what exactly you want me to do about that bug. My tests show that it gets deleted like it should, so should it be marked as invalid | 22:52 |
| *** pballand has quit IRC | 22:54 | |
| *** iamjarvo has quit IRC | 22:54 | |
| *** rwsu has quit IRC | 23:00 | |
| morganfainberg | kfox1111: the user id? | 23:00 |
| morganfainberg | kfox1111: we'd need the cert to know what the id would map to. Since we take a part of the data (cert) and hash it with the domain_id | 23:01 |
| kfox1111 | which part of the cert do you need to know? | 23:02 |
| *** Lactem has quit IRC | 23:02 | |
| kfox1111 | the plan was to make available the instance's id as part of the cert. that should be unique. | 23:02 |
| kfox1111 | if I passed the domain and the instance id, would that be enough to build the user id? | 23:02 |
| kfox1111 | then the cert request and the keystone request could happen in parallel. | 23:03 |
| morganfainberg | kfox1111: depends on what would be generated. i think we'd need a bit of the DN | 23:04 |
| morganfainberg | kfox1111: the API to generate the user_id isn't really done atm, we'd need to implement it ;) | 23:05 |
| morganfainberg | kfox1111: means it is a bit of a questionmark | 23:05 |
| kfox1111 | well, I think the dn would come from nova, woudln't it? | 23:05 |
| kfox1111 | I should be able to send the full dn in that case. | 23:05 |
| morganfainberg | kfox1111: I *think* this is a implementation detail that we can work on down the line. | 23:05 |
| morganfainberg | as in, not required right this second. | 23:05 |
| kfox1111 | well, I'd like to redo the spec to include barbican creating the cert, | 23:06 |
| kfox1111 | but I'm worried it can only do async creation. | 23:06 |
| morganfainberg | it feels like an optimisation to support in parallel vs. issue cert and then ask for keystone | 23:06 |
| kfox1111 | which means the flow as defined now won't work. | 23:06 |
| morganfainberg | to generate the id | 23:06 |
| kfox1111 | if I can syncronously get the user id without having the cert done, it allows the nova create call to still be syncronous. | 23:06 |
| morganfainberg | since the API doesn't exist in keystone, no reason we can't make it work that way | 23:07 |
| kfox1111 | ok. perfect. I'll write it in the spec that way, and we'll work out the details later then. thanks. :) | 23:07 |
| morganfainberg | but to be fair, i don't know what part of the cert is needed, since tokenless auth isn't done | 23:07 |
| morganfainberg | it may be hard™ to make it work like you're asking | 23:08 |
| kfox1111 | I'm thinking the spec is mostly advisory anyway. there's going to be some devil in the details when we go to implement it anyway. | 23:08 |
| morganfainberg | yeah like i said... i'd not specify it has to work in parallel | 23:08 |
| morganfainberg | i'd specify that keystone will return the user_id | 23:08 |
| kfox1111 | I just want to get a rough concensus on the algorithm so we can get it approved and start working on finding those devils. :) | 23:08 |
| morganfainberg | how that works becomes implementation specific depending on what shakes out on barbican vs keystone vs nova sides | 23:09 |
| kfox1111 | I'd like to mention the barbican request is async or else people might hold up the spec further. :/ | 23:09 |
| morganfainberg | really? | 23:09 |
| morganfainberg | they'd hold it up because you didn't say "this is async" | 23:09 |
| morganfainberg | i try and leave sync vs. async out of these things unless it's important | 23:09 |
| morganfainberg | this doesn't feel like it's super important to specify | 23:09 |
| kfox1111 | It feels like the spec was held up a lot due to lack of specifics. :/ | 23:09 |
| * morganfainberg is also not dealing with the nova team | 23:10 | |
| kfox1111 | ok. I'll leave it out and see how it goes. | 23:10 |
| morganfainberg | i'd call that bikeshedding. but you know, different people different views | 23:10 |
| kfox1111 | I'm guessing a +1 from a ptl will have more weight then a -1 from someone wanting specifics. | 23:10 |
| kfox1111 | I hope. | 23:10 |
| kfox1111 | Yeah. bikeshedding is a major drawback to the openstack review process. :/ | 23:10 |
| morganfainberg | i think that if you clearly say "barbican will create cert" and "based on cert data [even if it's not something you would need the signed cert for] keystone returns the user_id" | 23:11 |
| morganfainberg | i think that is sufficient | 23:11 |
| kfox1111 | yeah. that sounds good. | 23:11 |
| morganfainberg | the [] was not meant to be in the spec that is | 23:11 |
| morganfainberg | but, you know what i meant | 23:11 |
| * kfox1111 nods | 23:11 | |
| *** david-lyle_ has joined #openstack-keystone | 23:12 | |
| *** david_lyle__ has joined #openstack-keystone | 23:12 | |
| *** david_lyle__ has quit IRC | 23:13 | |
| *** thedodd has quit IRC | 23:13 | |
| *** jaosorior has quit IRC | 23:15 | |
| *** markvoelker has quit IRC | 23:16 | |
| kfox1111 | wait... | 23:19 |
| kfox1111 | one other problem with config drive. | 23:19 |
| kfox1111 | you probably don't want it to always create it. | 23:19 |
| kfox1111 | I guess you just require precreate for use with configdrive. if you don't specify precreate, it won't ever get one. | 23:20 |
| *** gordc has quit IRC | 23:23 | |
| kfox1111 | I was returning the keystone endpoint and the region name as part of the returned document as well as the token. | 23:23 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update sample config file https://review.openstack.org/182138 | 23:24 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Document entrypoint namespaces https://review.openstack.org/194435 | 23:24 |
| morganfainberg | yep | 23:24 |
| kfox1111 | but with returning the cert, I can just return the pem file. | 23:24 |
| kfox1111 | so the other stuff probably belongs in a different api endpoint? | 23:24 |
| kfox1111 | if so, what to call it? the endpoint for the cert cloud be: http://169.254.169.254/openstack/latest/instance_user_key | 23:24 |
| kfox1111 | s/cloud/could/ | 23:25 |
| kfox1111 | http://169.254.169.254/openstack/latest/keystone.json ? | 23:25 |
| kfox1111 | http://169.254.169.254/openstack/latest/about_cloud.json? :/ | 23:25 |
| *** jasondotstar has quit IRC | 23:29 | |
| *** RichardRaseley has quit IRC | 23:29 | |
| *** vilobhmm has quit IRC | 23:36 | |
| *** vilobhmm has joined #openstack-keystone | 23:36 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and public httpd files https://review.openstack.org/194442 | 23:40 |
| *** nkinder has joined #openstack-keystone | 23:42 | |
| *** csoukup has quit IRC | 23:43 | |
| *** darrenc is now known as darrenc_afk | 23:44 | |
| *** lhcheng has quit IRC | 23:45 | |
| *** kfox1111 has quit IRC | 23:46 | |
| *** kfox1111 has joined #openstack-keystone | 23:46 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 23:48 | |
| *** gyee has quit IRC | 23:48 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:51 | |
| kfox1111 | arg.... wordwrapping and rst's painful. | 23:53 |
| *** jasondotstar has joined #openstack-keystone | 23:54 | |
| *** vilobhmm has quit IRC | 23:57 | |
| kfox1111 | there we go. should be fixed. | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
