| *** markvoelker has joined #openstack-keystone | 00:00 | |
| *** r-daneel has quit IRC | 00:01 | |
| openstackgerrit | Merged openstack/keystone: Remove unused requirements https://review.openstack.org/193734 | 00:02 |
|---|---|---|
| openstackgerrit | Merged openstack/keystone: Update sample configuration file https://review.openstack.org/193878 | 00:02 |
| *** shaleh has joined #openstack-keystone | 00:05 | |
| openstackgerrit | Merged openstack/keystone: Refactor extract function load_auth_method https://review.openstack.org/187004 | 00:10 |
| *** pballand has joined #openstack-keystone | 00:14 | |
| *** kfox1111 has quit IRC | 00:19 | |
| *** kfox1111 has joined #openstack-keystone | 00:19 | |
| *** arunkant__ has joined #openstack-keystone | 00:20 | |
| *** darrenc_afk is now known as darrenc | 00:20 | |
| *** shaleh has quit IRC | 00:23 | |
| *** arunkant_ has quit IRC | 00:23 | |
| *** jasondotstar has quit IRC | 00:29 | |
| *** jamielennox|away is now known as jamielennox | 00:29 | |
| jamielennox | bknudson: https://github.com/ionrock/cachecontrol is the one i've seen - but anything works | 00:31 |
| *** pballand has quit IRC | 00:34 | |
| *** browne has quit IRC | 00:35 | |
| *** browne has joined #openstack-keystone | 00:36 | |
| *** kfox1111 has quit IRC | 00:39 | |
| jamielennox | interesting - that one like ptaches requests globaly | 00:46 |
| *** vilobhmm has joined #openstack-keystone | 00:51 | |
| *** bradjones has quit IRC | 00:54 | |
| *** dims has quit IRC | 00:55 | |
| *** dims has joined #openstack-keystone | 00:57 | |
| *** bradjones has joined #openstack-keystone | 00:59 | |
| *** bradjones has quit IRC | 00:59 | |
| *** bradjones has joined #openstack-keystone | 00:59 | |
| bknudson | we don't want to patch it globally | 01:04 |
| bknudson | https://github.com/ionrock/cachecontrol/tree/master/cachecontrol/caches has redis and file | 01:04 |
| *** bradjones has quit IRC | 01:07 | |
| *** charlesw has joined #openstack-keystone | 01:08 | |
| *** bradjones has joined #openstack-keystone | 01:09 | |
| *** bradjones has quit IRC | 01:09 | |
| *** bradjones has joined #openstack-keystone | 01:09 | |
| *** chengkunye has joined #openstack-keystone | 01:12 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 01:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 01:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 01:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 01:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 01:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 01:15 |
| *** jasondotstar has joined #openstack-keystone | 01:15 | |
| *** Kennan has quit IRC | 01:16 | |
| *** Kennan has joined #openstack-keystone | 01:16 | |
| *** chengkunye has left #openstack-keystone | 01:19 | |
| *** stevemar has joined #openstack-keystone | 01:19 | |
| *** ChanServ sets mode: +v stevemar | 01:19 | |
| *** cing has joined #openstack-keystone | 01:21 | |
| *** larainema has joined #openstack-keystone | 01:34 | |
| *** zzzeek has quit IRC | 01:43 | |
| *** dramakri has quit IRC | 01:44 | |
| *** spandhe has quit IRC | 01:44 | |
| *** scorpio-xiatian has joined #openstack-keystone | 01:46 | |
| *** davechen has joined #openstack-keystone | 01:47 | |
| *** davechen1 has joined #openstack-keystone | 01:52 | |
| *** davechen has quit IRC | 01:53 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Use six.moves.range https://review.openstack.org/193820 | 01:55 |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Fix Python 3 unicode issue. https://review.openstack.org/193866 | 01:59 |
| *** liusheng has joined #openstack-keystone | 02:02 | |
| *** roxanaghe has quit IRC | 02:05 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Use range instead of xrange. https://review.openstack.org/193820 | 02:06 |
| *** csoukup has joined #openstack-keystone | 02:10 | |
| *** fangzhou has quit IRC | 02:12 | |
| *** zzzeek has joined #openstack-keystone | 02:17 | |
| *** csoukup has quit IRC | 02:18 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't allow webob to set a default content type https://review.openstack.org/194470 | 02:24 |
| *** csoukup has joined #openstack-keystone | 02:35 | |
| *** dims has quit IRC | 02:36 | |
| *** csoukup has quit IRC | 02:39 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Rename _LOG to log in auth_token middleware https://review.openstack.org/192948 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 02:40 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 02:40 |
| *** zzzeek has quit IRC | 02:41 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 02:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Extract basic validation processing to base class https://review.openstack.org/180818 | 02:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Separate the fetch and validate token processes https://review.openstack.org/190940 | 02:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 02:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Don't cache signed tokens https://review.openstack.org/190941 | 02:45 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a simple base class from AuthProtocol https://review.openstack.org/180816 | 02:45 |
| jamielennox | i'm going to get openstackgerrit flood kicked | 02:45 |
| *** diazjf has joined #openstack-keystone | 02:47 | |
| *** jasondotstar has quit IRC | 02:47 | |
| *** scorpio-xiatian has quit IRC | 02:50 | |
| *** scorpio-xiatian has joined #openstack-keystone | 02:51 | |
| *** rushiagr_away is now known as rushiagr | 02:53 | |
| stevemar | jamielennox, possibly, possibly... | 02:53 |
| *** scorpio-xiatian has quit IRC | 02:54 | |
| *** vilobhmm has quit IRC | 02:55 | |
| *** richm has quit IRC | 02:56 | |
| davechen1 | jamielennox: looks grand, so many patches in a chain... | 02:58 |
| jamielennox | davechen1: the theory is it's easier to review small patches, the practical is you have to do a hell of a lot of rebasing when there are small issues in the early ones | 02:58 |
| *** davechen1 is now known as davechen | 02:59 | |
| *** nkinder has quit IRC | 03:06 | |
| *** davechen1 has joined #openstack-keystone | 03:07 | |
| *** davechen1 has quit IRC | 03:08 | |
| *** davechen has quit IRC | 03:11 | |
| *** davechen has joined #openstack-keystone | 03:11 | |
| *** nkinder has joined #openstack-keystone | 03:19 | |
| *** tobe has joined #openstack-keystone | 03:26 | |
| *** rushiagr is now known as rushiagr_away | 03:32 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Add get_token_data to token CRUD https://review.openstack.org/194484 | 03:33 |
| *** mgarza has joined #openstack-keystone | 03:35 | |
| *** larainema has quit IRC | 03:40 | |
| *** spandhe has joined #openstack-keystone | 03:42 | |
| *** nkinder has quit IRC | 03:43 | |
| *** harlowja has quit IRC | 03:43 | |
| *** charlesw has quit IRC | 03:45 | |
| *** nkinder has joined #openstack-keystone | 03:52 | |
| *** ajayaa has joined #openstack-keystone | 03:54 | |
| *** vilobhmm has joined #openstack-keystone | 03:56 | |
| *** mgarza has quit IRC | 03:58 | |
| *** iamjarvo has joined #openstack-keystone | 03:59 | |
| *** brad[] has joined #openstack-keystone | 03:59 | |
| *** dramakri has joined #openstack-keystone | 03:59 | |
| *** dramakri has left #openstack-keystone | 04:00 | |
| *** kiran-r has joined #openstack-keystone | 04:01 | |
| *** pballand has joined #openstack-keystone | 04:02 | |
| *** david-lyle_ has quit IRC | 04:03 | |
| *** rushiagr_away is now known as rushiagr | 04:11 | |
| stevemar | oh man, i just noticed how much cruft the auth entrypoint patch gets rid of bknudson | 04:11 |
| stevemar | its lovely | 04:11 |
| *** rushiagr is now known as rushiagr_away | 04:14 | |
| *** rushiagr_away is now known as rushiagr | 04:15 | |
| *** pballand has quit IRC | 04:17 | |
| *** mestery has joined #openstack-keystone | 04:19 | |
| *** iamjarvo has quit IRC | 04:25 | |
| openstackgerrit | Merged openstack/keystone: Use stevedore for auth drivers https://review.openstack.org/182102 | 04:29 |
| *** brad[] has quit IRC | 04:35 | |
| *** mgarza_ has joined #openstack-keystone | 04:38 | |
| *** mgarza__ has joined #openstack-keystone | 04:41 | |
| *** mgarza_ has quit IRC | 04:43 | |
| *** mestery has quit IRC | 04:49 | |
| *** brad[] has joined #openstack-keystone | 04:54 | |
| openstackgerrit | Merged openstack/keystone-specs: Groups are not included in federated scoped tokens https://review.openstack.org/194300 | 05:06 |
| *** tobe has quit IRC | 05:11 | |
| *** boris-42 has quit IRC | 05:12 | |
| *** tobe has joined #openstack-keystone | 05:17 | |
| *** tobe has quit IRC | 05:19 | |
| *** woodster_ has quit IRC | 05:21 | |
| *** arunkant_ has joined #openstack-keystone | 05:28 | |
| *** arunkant__ has quit IRC | 05:32 | |
| *** diazjf has quit IRC | 05:42 | |
| *** stevemar has quit IRC | 05:54 | |
| *** d43pan has joined #openstack-keystone | 05:54 | |
| *** stevemar has joined #openstack-keystone | 05:54 | |
| *** ChanServ sets mode: +v stevemar | 05:54 | |
| d43pan | hi all - quick question about debugging models? | 05:55 |
| d43pan | I have two files models which both reference and are both referenced by the same other models... and in one of them I keep getting "TypeError: Cannot read property '{ModelName}' of undefined"when trying to create a new instance of a third model | 05:57 |
| d43pan | new keystone.list('{ModelName}').model ---- | 05:58 |
| *** vilobhmm has quit IRC | 05:58 | |
| d43pan | so then i think... ok ... i'll just try to include that list at the every top of the model .... | 06:00 |
| d43pan | same error | 06:01 |
| *** stevemar2 has joined #openstack-keystone | 06:10 | |
| *** ChanServ sets mode: +v stevemar2 | 06:10 | |
| *** Kennan has quit IRC | 06:11 | |
| *** Kennan2 has joined #openstack-keystone | 06:11 | |
| *** stevemar has quit IRC | 06:12 | |
| *** mgarza__ has quit IRC | 06:16 | |
| morganfainberg | stevemar2: shady shady stevemar2 is here | 06:16 |
| morganfainberg | stevemar2: i don't trust stevemar2, he did something with stevemar | 06:17 |
| stevemar2 | morganfainberg, bunch of tstorms in toronto are causing flakiness with my isp | 06:17 |
| *** browne has quit IRC | 06:17 | |
| *** stevemar2 is now known as stevemar | 06:17 | |
| morganfainberg | you should get a bouncer man | 06:17 |
| morganfainberg | znc ftw | 06:17 |
| *** arunkant__ has joined #openstack-keystone | 06:18 | |
| * morganfainberg realizes he should read the irc meeting plan for the week | 06:18 | |
| stevemar | morganfainberg, a bunch of bknudson's stuff is landing, that's good | 06:18 |
| morganfainberg | yes i know | 06:18 |
| *** arunkant_ has quit IRC | 06:20 | |
| d43pan | (is this the wrong place to ask questions?) | 06:21 |
| *** tobe has joined #openstack-keystone | 06:22 | |
| morganfainberg | d43pan: it's not really the wrong place, but a lot of us are US timezones, right now it's ~2330 on the west coast of the US (and I'm usually one of the few up late around here) | 06:23 |
| morganfainberg | d43pan: you might have to be patient for some folks to get going in the morning - i'm about to go to bed personally. | 06:24 |
| d43pan | yeah... i'm US east coast :-) about to go to bed too --- way too late | 06:24 |
| morganfainberg | there are a lot of us keystone-types who are east coast and central timezones | 06:24 |
| morganfainberg | so i'd hit up people tomorrow morning then :) my advice, get some sleep. | 06:25 |
| morganfainberg | openstack is usually easier post sleep (and morning coffee) | 06:25 |
| *** spandhe has quit IRC | 06:25 | |
| d43pan | thanks | 06:26 |
| *** belmoreira has joined #openstack-keystone | 06:26 | |
| *** markvoelker has quit IRC | 06:40 | |
| *** rushiagr is now known as rushiagr_away | 06:42 | |
| *** Kennan2 is now known as Kennan | 06:53 | |
| *** pnavarro has joined #openstack-keystone | 06:56 | |
| *** smija has joined #openstack-keystone | 07:00 | |
| *** rlt has joined #openstack-keystone | 07:08 | |
| *** pnavarro has quit IRC | 07:10 | |
| openstackgerrit | liusheng proposed openstack/keystone: Remove the unused config_files parameter of service entry https://review.openstack.org/186987 | 07:11 |
| *** vilobhmm has joined #openstack-keystone | 07:13 | |
| *** pnavarro has joined #openstack-keystone | 07:19 | |
| jamielennox | morganfainberg: not around for meeting tomorrow but back next week | 07:25 |
| *** jdandrea has quit IRC | 07:31 | |
| *** boris-42 has joined #openstack-keystone | 07:32 | |
| *** markvoelker has joined #openstack-keystone | 07:41 | |
| *** stevemar has quit IRC | 07:43 | |
| *** jaosorior has joined #openstack-keystone | 07:45 | |
| *** markvoelker has quit IRC | 07:46 | |
| *** kiran-r has quit IRC | 07:57 | |
| *** d43pan has quit IRC | 08:01 | |
| *** davechen_ is now known as davechen_away | 08:05 | |
| evrardjp | good morning everyone | 08:08 |
| *** vilobhmm has quit IRC | 08:10 | |
| *** mabrams has joined #openstack-keystone | 08:15 | |
| *** fhubik has joined #openstack-keystone | 08:16 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Upgrade Foreign key in Endpoint with ondelete='CASCADE' https://review.openstack.org/179767 | 08:25 |
| *** fhubik is now known as fhubik_afk | 08:26 | |
| *** e0ne has joined #openstack-keystone | 08:32 | |
| *** fhubik_afk is now known as fhubik | 08:35 | |
| *** e0ne is now known as e0ne_ | 08:38 | |
| *** e0ne_ has quit IRC | 08:44 | |
| *** e0ne has joined #openstack-keystone | 08:48 | |
| *** dguerri` is now known as dguerri | 08:48 | |
| *** aix has quit IRC | 08:53 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Upgrade Foreign key in Endpoint with ondelete='CASCADE' https://review.openstack.org/179767 | 08:56 |
| *** e0ne is now known as e0ne_ | 09:06 | |
| *** aix has joined #openstack-keystone | 09:07 | |
| *** e0ne_ has quit IRC | 09:11 | |
| *** e0ne has joined #openstack-keystone | 09:15 | |
| *** fhubik is now known as fhubik_afk | 09:17 | |
| *** markvoelker has joined #openstack-keystone | 09:17 | |
| *** fhubik_afk is now known as fhubik | 09:20 | |
| *** markvoelker has quit IRC | 09:22 | |
| *** afazekas has joined #openstack-keystone | 09:22 | |
| *** afazekas has quit IRC | 09:23 | |
| *** afazekas has joined #openstack-keystone | 09:24 | |
| *** vg_ has joined #openstack-keystone | 09:25 | |
| *** mancdaz has quit IRC | 09:25 | |
| *** mancdaz has joined #openstack-keystone | 09:25 | |
| vg_ | Guys , anyone has any doc available for migrating the v2.0 API to v3 API for keystone in devstack ? | 09:25 |
| vg_ | I am running devstack kilo version | 09:25 |
| *** fhubik is now known as fhubik_afk | 09:30 | |
| vg_ | <samueldmq> there ? | 09:35 |
| *** janonymous has joined #openstack-keystone | 09:37 | |
| *** jasondotstar has joined #openstack-keystone | 09:37 | |
| *** fhubik_afk is now known as fhubik | 09:42 | |
| *** smija has quit IRC | 09:43 | |
| *** marzif has joined #openstack-keystone | 09:48 | |
| *** davechen is now known as davechen_afk | 09:51 | |
| *** davechen_afk has left #openstack-keystone | 09:51 | |
| *** vg__ has joined #openstack-keystone | 09:53 | |
| *** vg_ has quit IRC | 09:55 | |
| vg__ | hi | 09:55 |
| *** pdar has joined #openstack-keystone | 10:03 | |
| *** dims has joined #openstack-keystone | 10:06 | |
| *** e0ne is now known as e0ne_ | 10:10 | |
| *** henrynash has quit IRC | 10:20 | |
| *** cing has quit IRC | 10:20 | |
| *** e0ne_ has quit IRC | 10:20 | |
| *** arunkant_ has joined #openstack-keystone | 10:34 | |
| *** smija has joined #openstack-keystone | 10:35 | |
| *** tobe has quit IRC | 10:39 | |
| *** arunkant__ has quit IRC | 10:39 | |
| *** jamielennox is now known as jamielennox|away | 11:00 | |
| *** radez is now known as radez_g0n3 | 11:01 | |
| vg__ | <bknudson> u there ? | 11:02 |
| *** fhubik is now known as fhubik_afk | 11:02 | |
| *** markvoelker has joined #openstack-keystone | 11:06 | |
| *** liusheng has quit IRC | 11:08 | |
| *** liusheng has joined #openstack-keystone | 11:08 | |
| *** e0ne has joined #openstack-keystone | 11:09 | |
| *** markvoelker has quit IRC | 11:11 | |
| samueldmq | vg__: hi, morning | 11:11 |
| *** aix has quit IRC | 11:15 | |
| *** radez_g0n3 is now known as radez | 11:19 | |
| vg__ | so as suggested by community - I would like to use the Keystone API 3 ...right now when I stood up new instance of stable/kilo , my all service endpoints on Horizon shows up v2.0 | 11:22 |
| vg__ | but in keystone-paste.ini i can see the support for v3 | 11:23 |
| vg__ | I need to know how to do the migration of my keystone v2.0 to v3 - any doc ? | 11:23 |
| vg__ | or if no doc. how do i setup a new Devstack so by default it has v3 support for all services | 11:24 |
| vg__ | or atleast I want keystone to be v3 | 11:24 |
| samueldmq | vg__: keystone is already v3, it's running both v2.0 and v3 endpoints, respectively on localhost:5000/v2.0/ and localhost:5000/v3/ | 11:25 |
| samueldmq | vg__: do you want to do something specific ? or just to use keystone v3 through horizon? | 11:26 |
| vg__ | well Initially i wanted to use Keystone through Horizon | 11:27 |
| vg__ | but now I just have a simple use case | 11:27 |
| vg__ | I need a Tenant Admin role created | 11:27 |
| samueldmq | vg__: when you manage users/projects/roles, etc through Horizon, you're using keystone | 11:27 |
| samueldmq | vg__: see https://docs.hpcloud.com/helion/openstack/1.1/services/identity/configure/ | 11:27 |
| vg__ | and define the permissions for this - so if any user has this role , he should be able to create new users, manage them | 11:28 |
| samueldmq | vg__: this might help to make Horizon use keystone v3 API | 11:28 |
| *** aix has joined #openstack-keystone | 11:28 | |
| samueldmq | vg__: you definitely can do that, but such role cannot be on the domain, it must be in a project | 11:28 |
| samueldmq | vg__: since horizon is not able to work with domain scoped tokens yet | 11:29 |
| vg__ | yes | 11:29 |
| vg__ | agree , i have this user under one project and that role is also accessible in that project | 11:29 |
| samueldmq | vg__: nice | 11:29 |
| samueldmq | vg__: in step 1 of the link I just sent you | 11:29 |
| samueldmq | vg__: as you're running devstack, I think your file will be in devstack/horizon/openstack_dashboard/local/local_settings.py | 11:30 |
| vg__ | ok | 11:30 |
| samueldmq | vg__: so you modify configs a,b,c in step 2 | 11:30 |
| vg__ | yes | 11:30 |
| samueldmq | vg__: and then restart, this is quite simple | 11:31 |
| *** radez is now known as radez_g0n3 | 11:31 | |
| vg__ | trying now | 11:31 |
| *** e0ne is now known as e0ne_ | 11:36 | |
| *** kiran-r has joined #openstack-keystone | 11:38 | |
| vg__ | #OPENSTACK_API_VERSIONS = { # "data-processing": 1.1, # "identity": 3, # "volume": 2, #} | 11:39 |
| *** Ctina__ has joined #openstack-keystone | 11:40 | |
| vg__ | <samueldmq> http://paste.openstack.org/show/pyYECquY9N6Md0xcy75M/ | 11:40 |
| vg__ | is this correct ? | 11:40 |
| samueldmq | vg__: need to uncomment, see http://paste.openstack.org/show/316485/ | 11:41 |
| *** henrynash has joined #openstack-keystone | 11:43 | |
| *** ChanServ sets mode: +v henrynash | 11:43 | |
| *** e0ne_ has quit IRC | 11:46 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on python-keystoneauth https://review.openstack.org/186854 | 11:55 |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 12:03 |
| *** d43pan has joined #openstack-keystone | 12:03 | |
| *** markvoelker has joined #openstack-keystone | 12:05 | |
| *** jasondotstar has quit IRC | 12:06 | |
| *** fhubik_afk is now known as fhubik | 12:06 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 12:06 |
| *** iurygregory has joined #openstack-keystone | 12:11 | |
| *** gordc has joined #openstack-keystone | 12:12 | |
| *** raildo has joined #openstack-keystone | 12:15 | |
| *** dguerri is now known as dguerri` | 12:15 | |
| *** dguerri` is now known as dguerri | 12:15 | |
| d43pan | hi all... anyone have any thoughts on what to do when this happens: ---- i'm requiring keystone at the top of every model (along with keystone.Filed.Types and some other modules I use) i've added new models i need also... but now when referencing certain models from other models via keystone.list('ModelName}').model() I'm getting the following error | 12:18 |
| d43pan | TypeError: Cannot read property 'ModelName' of undefined | 12:18 |
| *** mgarza_ has joined #openstack-keystone | 12:19 | |
| *** kiran-r has quit IRC | 12:24 | |
| *** woodster_ has joined #openstack-keystone | 12:25 | |
| *** edmondsw has joined #openstack-keystone | 12:28 | |
| *** aix has quit IRC | 12:31 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 12:33 |
| *** bknudson has quit IRC | 12:35 | |
| *** ajayaa has quit IRC | 12:37 | |
| *** fhubik is now known as fhubik_afk | 12:37 | |
| *** fhubik_afk is now known as fhubik | 12:37 | |
| *** e0ne has joined #openstack-keystone | 12:37 | |
| *** radez_g0n3 is now known as radez | 12:39 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 12:40 |
| *** janonymous_ has joined #openstack-keystone | 12:41 | |
| *** boris-42 has quit IRC | 12:42 | |
| *** aix has joined #openstack-keystone | 12:47 | |
| *** d43pan has quit IRC | 12:50 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Use range instead of xrange for py3 compatibility. https://review.openstack.org/193820 | 12:52 |
| vg__ | <samueldmq> my UI has became unresponsive after that | 12:57 |
| samueldmq | vg__: oh I need to use memcache as session backend | 13:02 |
| samueldmq | vg__: I am stepping in a meeting now, talk to you later, someone on horizon channel would be able to help you better | 13:03 |
| *** vg__ has quit IRC | 13:04 | |
| openstackgerrit | janonymous proposed openstack/keystone: Python 3: Replace unicode with six.text_type. https://review.openstack.org/193866 | 13:08 |
| *** richm has joined #openstack-keystone | 13:17 | |
| *** jasondotstar has joined #openstack-keystone | 13:17 | |
| *** openstack has quit IRC | 13:17 | |
| *** openstack has joined #openstack-keystone | 13:17 | |
| *** ajayaa has joined #openstack-keystone | 13:29 | |
| *** aix has quit IRC | 13:29 | |
| *** ayoung has joined #openstack-keystone | 13:33 | |
| *** ChanServ sets mode: +v ayoung | 13:33 | |
| *** janonymous_ has quit IRC | 13:38 | |
| *** aix has joined #openstack-keystone | 13:42 | |
| *** fhubik_afk is now known as fhubik | 13:43 | |
| *** bknudson has joined #openstack-keystone | 13:48 | |
| *** ChanServ sets mode: +v bknudson | 13:48 | |
| *** charlesw has joined #openstack-keystone | 13:49 | |
| *** bknudson has quit IRC | 13:54 | |
| openstackgerrit | Marek Denis proposed openstack/python-keystoneclient-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 13:56 |
| *** browne has joined #openstack-keystone | 13:59 | |
| *** rwsu has joined #openstack-keystone | 14:01 | |
| *** timsim has left #openstack-keystone | 14:07 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:07 | |
| *** bknudson has joined #openstack-keystone | 14:08 | |
| *** ChanServ sets mode: +v bknudson | 14:08 | |
| *** HT_sergio has joined #openstack-keystone | 14:12 | |
| *** fangzhou has joined #openstack-keystone | 14:12 | |
| *** fhubik is now known as fhubik_afk | 14:16 | |
| *** mgarza_ has quit IRC | 14:17 | |
| *** iamjarvo has joined #openstack-keystone | 14:19 | |
| *** jasondotstar has quit IRC | 14:31 | |
| *** fhubik_afk is now known as fhubik | 14:33 | |
| *** afazekas has quit IRC | 14:36 | |
| *** csoukup has joined #openstack-keystone | 14:38 | |
| *** e0ne is now known as e0ne_ | 14:44 | |
| *** fangzhou has quit IRC | 14:46 | |
| *** jasondotstar has joined #openstack-keystone | 14:46 | |
| *** stevemar has joined #openstack-keystone | 14:46 | |
| *** ChanServ sets mode: +v stevemar | 14:46 | |
| *** thedodd has joined #openstack-keystone | 14:47 | |
| *** mgarza_ has joined #openstack-keystone | 14:48 | |
| *** e0ne_ is now known as e0ne | 14:49 | |
| *** kiran-r has joined #openstack-keystone | 14:51 | |
| *** zzzeek has joined #openstack-keystone | 14:58 | |
| *** charlesw_ has joined #openstack-keystone | 15:00 | |
| *** kiran-r has quit IRC | 15:02 | |
| *** charlesw has quit IRC | 15:02 | |
| *** charlesw_ is now known as charlesw | 15:02 | |
| *** vilobhmm has joined #openstack-keystone | 15:06 | |
| *** fhubik is now known as fhubik_afk | 15:07 | |
| *** r-daneel has joined #openstack-keystone | 15:07 | |
| *** fhubik_afk is now known as fhubik | 15:08 | |
| *** diazjf has joined #openstack-keystone | 15:11 | |
| *** vilobhmm has quit IRC | 15:12 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and main httpd files https://review.openstack.org/194442 | 15:13 |
| *** mabrams has quit IRC | 15:15 | |
| *** belmoreira has quit IRC | 15:21 | |
| *** fhubik has quit IRC | 15:23 | |
| *** kiran-r has joined #openstack-keystone | 15:23 | |
| *** pnavarro is now known as pnavarro|off | 15:28 | |
| *** vg_ has joined #openstack-keystone | 15:29 | |
| *** kfox1111 has joined #openstack-keystone | 15:31 | |
| *** pballand has joined #openstack-keystone | 15:32 | |
| *** rlt has quit IRC | 15:33 | |
| *** mabrams has joined #openstack-keystone | 15:34 | |
| *** mestery has joined #openstack-keystone | 15:34 | |
| *** mestery_ has joined #openstack-keystone | 15:35 | |
| *** kiranr has joined #openstack-keystone | 15:36 | |
| *** navid__ has joined #openstack-keystone | 15:37 | |
| *** mestery has quit IRC | 15:39 | |
| *** mestery_ is now known as mestery | 15:40 | |
| *** kiran-r has quit IRC | 15:40 | |
| breton | folks, what is AccessInfo? | 15:40 |
| morganfainberg | breton: it is a structure that we use internally that unifies the forms of token data | 15:40 |
| morganfainberg | so we don't need to have tons of conditionals because the token body changed | 15:40 |
| morganfainberg | between v2 and v3 | 15:40 |
| kfox1111 | morganfainberg: did the changes I made look ok to you? | 15:41 |
| morganfainberg | kfox1111: haven't looked yet. | 15:42 |
| *** mgarza_ has quit IRC | 15:42 | |
| kfox1111 | ok. | 15:42 |
| breton | so, it's a wrapper for token data fetched from ks, right? | 15:43 |
| morganfainberg | kfox1111: +1 specifically from a keystone interaction standpoint | 15:43 |
| *** mgarza_ has joined #openstack-keystone | 15:43 | |
| *** pballand has quit IRC | 15:43 | |
| morganfainberg | kfox1111: commented that i am not in favor or against the whole concept, but you've addressed my concerns re: keystone interaction | 15:44 |
| morganfainberg | breton: essentially | 15:44 |
| *** e0ne is now known as e0ne_ | 15:46 | |
| breton | where do we mainly develop it now -- in ks-auth or ks-client? | 15:46 |
| breton | I see they are different there | 15:46 |
| *** mgarza_ has quit IRC | 15:47 | |
| kfox1111 | morganfainberg: ok. I was hoping for a +1 but if a non -1 is the best I can do, thats ok. Thanks for the help in coming up with a good solution to the problem. | 15:47 |
| *** e0ne_ is now known as e0ne | 15:47 | |
| morganfainberg | kfox1111: you have a +1, but i don't have a strong opinion if nova instances should be able to do this | 15:47 |
| morganfainberg | kfox1111: so my +1 is "you aren't doing anything that makes me cringe with keystone" | 15:48 |
| kfox1111 | yeah, but I think nova's only caring about seeing +1's on the review. :/ | 15:48 |
| kfox1111 | I'll try and relay that info though. | 15:48 |
| morganfainberg | kfox1111: then they are not utilizing the review system very well from a cross-project standpoint | 15:48 |
| kfox1111 | :/ | 15:49 |
| morganfainberg | kfox1111: again, i did +1 it, just i left a comment as well saying that this +1 is really just about keystone interaction | 15:49 |
| kfox1111 | I think thats a big issue with most openstack projects. :/ | 15:49 |
| morganfainberg | breton: you'll need to talk to ayoung and jamielennox|away - it's in a bit of flux | 15:50 |
| kfox1111 | but it doesn't show up as Code-Review+1 so they don't catch it unless they are looking very closely. Would you be willing to review +1 it and then say in the comments your not for or against the feature, but are ok with the solution as specified? | 15:51 |
| *** mgarza_ has joined #openstack-keystone | 15:51 | |
| kfox1111 | ah. nm. just saw your review. | 15:52 |
| kfox1111 | thanks. :) | 15:52 |
| *** pballand has joined #openstack-keystone | 15:52 | |
| kfox1111 | I really appreciate all your help with this. | 15:52 |
| morganfainberg | kfox1111: yeah i get the need to +1. if they take that as support for the concept, i'll correct them when asked. but you've addressed all my concerns wrt keystone and interactions | 15:53 |
| dstanek | Just an FYI... My wife has to have surgery later today so I may not be at the meeting | 15:54 |
| morganfainberg | kfox1111: if i was able to +2 that spec, i would still +1 because i don't have a strong opinion on if instances should have that superpower | 15:54 |
| morganfainberg | dstanek: lets make it easy, don't show up even if you're around | 15:54 |
| morganfainberg | dstanek: family > openstack | 15:54 |
| morganfainberg | family > irc meetings | 15:54 |
| morganfainberg | dstanek: take care of your wife :) | 15:55 |
| dstanek | I may be sitting the with nothing to do. if I don't keep busy I may go crazy | 15:55 |
| morganfainberg | dstanek: i promise keystone will still be here when you're back. | 15:55 |
| kfox1111 | morganfainberg: Thats cool. totally understand. You don't need the feature so I understand not having an opinion about it. I'm actually glad that you are taking that stance. Some folks say "I dont need that feature, so I'll -1 it. | 15:55 |
| dstanek | :) | 15:55 |
| kfox1111 | which is way worse. | 15:56 |
| morganfainberg | dstanek: hah, ok, just know that i expect you should be gone for things like that. if you still want to show up and have time/energy for it, by all means... but ... | 15:56 |
| morganfainberg | dstanek: like i said, keystone will still be here (I don't think i can get the rm -rf patch through the gate between now and tomorrow) | 15:57 |
| morganfainberg | dstanek :P | 15:57 |
| dstanek | Start with deleting the tempest tests first! | 15:57 |
| *** rwsu has quit IRC | 15:58 | |
| stevemar | dstanek, best of luck to the wife :) | 15:58 |
| breton | bradjones: what was the problem with https://review.openstack.org/#/c/189018/3? | 15:58 |
| morganfainberg | kfox1111: i think that view (oh i don't need this -1) is far different than "this is a terrible idea". The "i don't need this, -1" is equivalent to bikeshedding imo | 15:58 |
| breton | err | 15:58 |
| breton | bknudson: was the problem with https://review.openstack.org/#/c/189018/3 ? | 15:59 |
| morganfainberg | breton: jenkins hated it. | 15:59 |
| bknudson | breton: I need to figure out where it belongs in jamielennox|away 's patches | 15:59 |
| morganfainberg | breton: it probably needs a rebase and some extra eyes to see what tempest is barfing on. | 15:59 |
| bknudson | or even if we need it anymore. | 15:59 |
| *** gordc_ has joined #openstack-keystone | 15:59 | |
| *** gordc has quit IRC | 16:00 | |
| *** gordc_ is now known as gordc | 16:00 | |
| morganfainberg | bknudson: it might not be needed - but that not being needing is probaly when keystoneauth becomes a reality | 16:00 |
| bknudson | but I'd rather just wait for some of jamielennox|away 's patches to merge and then I'll look at it again | 16:00 |
| *** Lactem has joined #openstack-keystone | 16:01 | |
| Lactem | Hey dolphm . | 16:01 |
| *** pballand has quit IRC | 16:01 | |
| breton | jamie's patch looks good, I don't see why it wouldn't merge | 16:01 |
| ayoung | breton, Ok, so access Info is defined the name of the client view of the data; it is a dictionary created from the token. WHat I was doing, to dynamically create tokens, is the server side (only) model | 16:01 |
| ayoung | breton, so acces info is, I think, moving to ks-auth, but jamie is the authoritative on that. I've actually not looked at the ks-auth code in a few | 16:02 |
| breton | ayoung: so, there will be keystoneauth-AccessInfo and kestone-AccessInfo? | 16:02 |
| ayoung | not the latter | 16:03 |
| ayoung | breton, one sec, I'll link | 16:03 |
| dstanek | morganfainberg, stevemar: thx | 16:03 |
| *** Lactem has quit IRC | 16:03 | |
| *** pballand has joined #openstack-keystone | 16:04 | |
| ayoung | breton, https://review.openstack.org/#/c/184651/ is mine...server side. Now, server side, we will be importing the keystoneauth-AccessInfo ( I think) to do validation and revocation checking | 16:04 |
| *** charlesw_ has joined #openstack-keystone | 16:04 | |
| breton | ayoung: is there a spec? | 16:05 |
| *** henrynash has quit IRC | 16:05 | |
| ayoung | breton, ther are a million specs, for all facets of keystone, including these. What part? | 16:06 |
| *** charlesw has quit IRC | 16:06 | |
| ayoung | going to get lunch | 16:06 |
| *** charlesw_ is now known as charlesw | 16:06 | |
| *** ayoung is now known as ayoung-lunch | 16:06 | |
| breton | ayoung-lunch: regarding accessinfo. Or it's a no-spec change and considered refactoring? | 16:07 |
| *** spandhe has joined #openstack-keystone | 16:09 | |
| *** iamjarvo has quit IRC | 16:13 | |
| *** RichardRaseley has joined #openstack-keystone | 16:13 | |
| *** vg_ has quit IRC | 16:16 | |
| *** samueldmq has quit IRC | 16:21 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and public httpd files https://review.openstack.org/194442 | 16:22 |
| *** _cjones_ has joined #openstack-keystone | 16:24 | |
| *** samueldmq has joined #openstack-keystone | 16:24 | |
| samueldmq | ayoung-lunch: morning, let me know when you're back | 16:25 |
| samueldmq | ayoung-lunch: I'd like to synchronize with you the points to be addressing in the meeting | 16:26 |
| openstackgerrit | Michael Tupitsyn proposed openstack/keystone: Fix for LDAP filter on group search by name https://review.openstack.org/194733 | 16:27 |
| *** vg has joined #openstack-keystone | 16:27 | |
| *** roxanaghe has joined #openstack-keystone | 16:28 | |
| *** _kiran_ has joined #openstack-keystone | 16:28 | |
| *** mestery has quit IRC | 16:28 | |
| *** e0ne has quit IRC | 16:29 | |
| *** spandhe has quit IRC | 16:30 | |
| *** dims has quit IRC | 16:30 | |
| *** vg has quit IRC | 16:31 | |
| *** kiranr has quit IRC | 16:32 | |
| *** d43pan has joined #openstack-keystone | 16:32 | |
| *** dims has joined #openstack-keystone | 16:33 | |
| *** mabrams has left #openstack-keystone | 16:35 | |
| *** _kiran_ has quit IRC | 16:36 | |
| *** _kiran_ has joined #openstack-keystone | 16:36 | |
| *** jasondotstar has quit IRC | 16:43 | |
| *** kiranr has joined #openstack-keystone | 16:43 | |
| samueldmq | morganfainberg: hello, good morning | 16:45 |
| samueldmq | morganfainberg: for the scope of our dynamic policies discussion today with nova folks | 16:46 |
| samueldmq | morganfainberg: I am planning to address two main points: i) whether have a unified policy or not; ii) microversions and redefine scope for L | 16:46 |
| samueldmq | morganfainberg: ayoung-lunch sounds good ? ^ | 16:46 |
| *** fangzhou has joined #openstack-keystone | 16:46 | |
| *** _kiran_ has quit IRC | 16:47 | |
| *** fangzhou has quit IRC | 16:48 | |
| david8hu | jamielennox, Have you read this email thread http://lists.openstack.org/pipermail/openstack-dev/2015-June/067795.html. Cinder thinks that there is a bug in the keystoneclient discovery. | 16:48 |
| morganfainberg | david8hu: yeah we've been discussing it with thingee and cinder folks | 16:49 |
| *** marzif_ has joined #openstack-keystone | 16:50 | |
| *** ayoung-lunch is now known as ayoung-burp | 16:50 | |
| david8hu | cool, I wonder if it is cinder specific. Nova, heat clients also uses the discovery code. | 16:50 |
| *** ayoung-burp is now known as ayoung | 16:51 | |
| *** jasondotstar has joined #openstack-keystone | 16:52 | |
| ayoung | samueldmq, I'd like to save unified for last. I think it might derail the other discussions | 16:54 |
| ayoung | samueldmq, lets focus on support for microversions | 16:55 |
| *** brad[] has quit IRC | 16:55 | |
| samueldmq | ayoung: that works fine for me, then | 16:55 |
| samueldmq | ayoung: i) microversions and revisit scope for L ii) whether unify | 16:56 |
| *** marzif has quit IRC | 16:56 | |
| ayoung | samueldmq, and then a unified policy file would just be the starting point, but we'd need the microversion support to update it once it is deployed | 16:56 |
| samueldmq | ayoung: what if common roles came to projects from a sort of oslo-incubator, and their individual policies would include that, and define checks using that ? | 16:58 |
| samueldmq | ayoung: just an idea .. | 16:58 |
| ayoung | samueldmq, I like the idea that the policy files are additive somehow. I think importing a common set of roles would be a good step | 16:59 |
| ayoung | samueldmq, I think we also need to seriously consider splitting the file into two parts, and only let end users customize one of them | 16:59 |
| ayoung | samueldmq, we could do that by naming them differently, list policy-rbac.json versus policy-scope.json | 17:00 |
| samueldmq | ayoung: make sense ... that's already a story in our plans .. | 17:00 |
| ayoung | still not 100% sold on that, buit it is the best I've come across yet | 17:00 |
| samueldmq | ayoung: however, agreeing in common definitions coming from a sort of oslo-incubator, we agree that we don't need to unify | 17:01 |
| ayoung | I'd like to discuss that part, as I think it would benefit from other brains chewing on it | 17:01 |
| samueldmq | ayoung: to keep common rules consistent | 17:01 |
| *** dontalton has joined #openstack-keystone | 17:01 | |
| *** shaleh has joined #openstack-keystone | 17:01 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Rename _LOG to log in auth_token middleware https://review.openstack.org/192948 | 17:02 |
| d43pan | anyone have any insights into why keystone models aren't loaded in model files ? They seem to be loaded alphabetically upto the model which is including keystone.... I am trying to go through keystone.list('ModelName') to create new instances to attach them in pre-saves, but I don't have access to models alphabeically after the model i'm currently in | 17:02 |
| samueldmq | ayoung: if you agree with me in that ... since from what I uderstood, keepign common rules consistent was the best motivation for unifying :0 | 17:02 |
| samueldmq | :) | 17:02 |
| ayoung | samueldmq, I think that should be our #1 design goal: " keep common rules consistent" | 17:03 |
| samueldmq | ayoung: yes, and doing so for a sort of oslo-incubator would interfeer in other things | 17:03 |
| ayoung | samueldmq, as well as fix 968696 | 17:03 |
| samueldmq | ayoung: like what sdague pointed out as issues with unifying | 17:04 |
| samueldmq | ayoung: I agree with you about common definitions, we need to fix that, and provide better default policies | 17:04 |
| *** sirushti has joined #openstack-keystone | 17:04 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Make token bind work with a request https://review.openstack.org/180817 | 17:05 |
| samueldmq | ayoung: I am 100% with you on this (and I am sure my team is as well, since we've been trying to introduce better defaults during last year) | 17:05 |
| ayoung | samueldmq, something came up that might affect reseller. Was talking with someone about Juno, and they wanted some form of HMT. I suggested that the may a domain per customer, and then put an admin project in each domain. To execute domain scoped operations needed a token scoped to the domains project named domain_admin. | 17:05 |
| *** jaosorior has quit IRC | 17:05 | |
| ayoung | I think we need to enforce that the token is not used for scoping in the operation itself, but that scope needs to be somewhere in the request | 17:06 |
| ayoung | or needs to be somewhere on the resource, in the case of a modify/delete by ID | 17:06 |
| samueldmq | ayoung: operations already know their scopes .. hm .. | 17:08 |
| samueldmq | ayoung: but maybe you want to check 'indirect' scopes .. like the project's domain | 17:08 |
| ayoung | samueldmq, more than that | 17:08 |
| ayoung | samueldmq, If I have a token on the admin_project, I want to be able to assign a role on any project in that domain | 17:08 |
| ayoung | so the domain matches ,but not the project id | 17:09 |
| ayoung | it toally breaks my idea of "split the RBAC from the scope" | 17:09 |
| ayoung | totally | 17:09 |
| samueldmq | ayoung: yeah... did you see https://review.openstack.org/#/c/193543/ ? | 17:10 |
| samueldmq | ayoung: look at lines 38-42, that's the interesting part | 17:11 |
| ayoung | samueldmq, so the admin projects would eventually be rolled up by that...would just need a migration of some sort | 17:12 |
| ayoung | samueldmq, I think that is essentially OK, although is_domain really means "this is the admin proejct" | 17:14 |
| ayoung | I think I' | 17:14 |
| ayoung | m OK with it... | 17:14 |
| raildo | haha http://openstackreactions.enovance.com/2015/06/getting-a-token-from-keystone/ | 17:14 |
| *** HT_sergio has quit IRC | 17:15 | |
| samueldmq | ayoung: hm .. but we need to be careful, since the is_domain project has the same id as the domain | 17:15 |
| ayoung | samueldmq, that actually does not bother me at all | 17:15 |
| samueldmq | ayoung: which is not true in the case one has a domain and a project called is_domain in it | 17:15 |
| ayoung | Heh | 17:16 |
| samueldmq | ayoung: that's great then, that solves the case you were talking above (your customer with domain_project) | 17:16 |
| ayoung | samueldmq, yeah, they could migrate once Liberty becomes available to them | 17:16 |
| samueldmq | ayoung: ++ | 17:16 |
| samueldmq | ayoung: yeah , that's a great idea on how to represent those things in the policy (talked about this with henry last friday :)) | 17:17 |
| samueldmq | ayoung: ok ... you said me: 'I think I'm OK with it....' | 17:17 |
| ayoung | samueldmq, I mean, the wording is dumb, but meh | 17:18 |
| samueldmq | ayoung: is that related to henry's spec ? or the idea of having common definitions coming from oslo-incubator (or somehting like) | 17:18 |
| samueldmq | ayoung: :-) | 17:18 |
| ayoung | just "is_domain" | 17:18 |
| ayoung | meh | 17:18 |
| ayoung | good enough, I think | 17:18 |
| *** kiranr has quit IRC | 17:19 | |
| samueldmq | ayoung: k :-) | 17:19 |
| samueldmq | ayoung: you're hard to be convinced, but I am making sure we communicate as much as we can with our ideas | 17:20 |
| samueldmq | ayoung: and then we agree sometimes,:) | 17:20 |
| *** dguerri is now known as dguerri` | 17:21 | |
| *** mestery has joined #openstack-keystone | 17:25 | |
| *** harlowja has joined #openstack-keystone | 17:26 | |
| *** rwsu has joined #openstack-keystone | 17:31 | |
| *** gyee_ has quit IRC | 17:33 | |
| *** rwsu has quit IRC | 17:33 | |
| *** nkinder has quit IRC | 17:34 | |
| *** gyee has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +v gyee | 17:36 | |
| *** rwsu has joined #openstack-keystone | 17:39 | |
| *** rwsu has quit IRC | 17:42 | |
| *** rwsu has joined #openstack-keystone | 17:43 | |
| *** RichardRaseley has quit IRC | 17:44 | |
| david8hu | ayoung, samueldmq, will common defintion include context_is_admin? I guess the direction is not, but that that diverges from what is there already. | 17:49 |
| ayoung | david8hu, that rule is not a helpful one | 17:50 |
| ayoung | I'd like it to go away | 17:50 |
| morganfainberg | ayoung: (/s) Lets make a rule "admin_is_context" and... oh wait... | 17:50 |
| ayoung | david8hu, the content of the policy files can change, just not the meaning | 17:50 |
| ayoung | morganfainberg, /me tired and cranky today. | 17:51 |
| ayoung | Saving my good natured reserves for the meeting | 17:51 |
| morganfainberg | ayoung: to be fair, i've been fighting off a cold for the last 5 days | 17:51 |
| morganfainberg | so i've mostly not gotten out of bed. | 17:51 |
| david8hu | I will be taking the keystone meeting from my jaccuzi, but I do not have a jaccuzi. | 17:53 |
| morganfainberg | david8hu: i'd worry about electronics :P | 17:54 |
| morganfainberg | in a jaccuzi | 17:54 |
| kfox1111 | "What could go wrong... " :) | 17:55 |
| david8hu | ayoung, should we get rid of context_is_admin when we go common unified header? If we can get it done is one shot why not. | 17:55 |
| david8hu | Iphone 6+ is 2915 mAh. Is that enough to eletricute a person? :) | 17:57 |
| ayoung | david8hu, my current hack looks like this https://github.com/admiyo/openstack-core-policy | 17:58 |
| ayoung | https://github.com/admiyo/openstack-core-policy/blob/master/policy.json | 17:58 |
| david8hu | ayoung, looking | 17:58 |
| ayoung | david8hu, that is built from the different sources: | 17:59 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and public httpd files https://review.openstack.org/194442 | 17:59 |
| ayoung | "is_admin:True needs to die, too...haven't finished it | 17:59 |
| samueldmq | meeting time ! right ? :-) | 17:59 |
| *** mestery has quit IRC | 18:00 | |
| *** mestery has joined #openstack-keystone | 18:01 | |
| *** henrynash has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +v henrynash | 18:02 | |
| *** spandhe has joined #openstack-keystone | 18:03 | |
| *** htruta_ has joined #openstack-keystone | 18:03 | |
| *** roxanaghe has quit IRC | 18:04 | |
| *** ericksonfgds is now known as ericksonsantos | 18:04 | |
| *** HT_sergio has joined #openstack-keystone | 18:04 | |
| *** iamjarvo has joined #openstack-keystone | 18:05 | |
| *** jasondotstar has quit IRC | 18:07 | |
| *** spandhe has quit IRC | 18:07 | |
| *** e0ne has joined #openstack-keystone | 18:08 | |
| *** mestery has quit IRC | 18:10 | |
| *** spandhe has joined #openstack-keystone | 18:13 | |
| *** jasondotstar has joined #openstack-keystone | 18:14 | |
| stevemar | so much doug hellmann in my inbox :) | 18:19 |
| morganfainberg | jamielennox|away: ping you awake? | 18:20 |
| morganfainberg | jamielennox|away: if not no worries | 18:20 |
| morganfainberg | stevemar: haha | 18:20 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add is_domain to tokens for projects acting as a domain https://review.openstack.org/193543 | 18:26 |
| *** e0ne is now known as e0ne_ | 18:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Add is_domain to tokens for projects acting as a domain https://review.openstack.org/193543 | 18:27 |
| *** dguerri` is now known as dguerri | 18:28 | |
| *** dguerri is now known as dguerri` | 18:29 | |
| *** e0ne_ has quit IRC | 18:32 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 18:33 |
| stevemar | diazjf, btw, we're all in #openstack-meeting - the keystone meeting is happening now | 18:34 |
| *** ksavich has joined #openstack-keystone | 18:35 | |
| *** e0ne has joined #openstack-keystone | 18:41 | |
| diazjf | stevemar, thanks for the heads up, just joined | 18:41 |
| *** aix has quit IRC | 18:42 | |
| *** marzif_ has quit IRC | 18:43 | |
| *** janonymous_ has joined #openstack-keystone | 18:43 | |
| *** lhcheng has joined #openstack-keystone | 18:45 | |
| *** ChanServ sets mode: +v lhcheng | 18:45 | |
| *** spandhe has quit IRC | 18:48 | |
| *** belmoreira has joined #openstack-keystone | 18:51 | |
| *** rwsu has quit IRC | 18:51 | |
| *** dguerri` is now known as dguerri | 18:53 | |
| *** rwsu has joined #openstack-keystone | 18:53 | |
| *** dguerri is now known as dguerri` | 18:54 | |
| marekd | stevemar: does mod_auth_oidc sets REMOTE_USER by default? | 18:55 |
| samueldmq | ayoung: wait .. I think there is still some misunderstanding on things... terminologies, needs, etc | 18:56 |
| stevemar | marekd, ....... hmm... i believe so | 18:56 |
| marekd | diazjf: ^^ | 18:56 |
| samueldmq | ayoung: that conversation will continue :) | 18:56 |
| ayoung | samueldmq, endlessly | 18:56 |
| samueldmq | ayoung: morganfainberg said : Further discussion on policy needed. | 18:56 |
| ayoung | samueldmq, the bottom line is it is not heading in a direction that will solve any problem | 18:57 |
| diazjf | marekd, stevemar, thanks. | 18:57 |
| samueldmq | ayoung: I see three steps: | 18:57 |
| diazjf | I'll make note of it in the documentation | 18:57 |
| ayoung | samueldmq, I see an scher draing | 18:57 |
| ayoung | escher | 18:57 |
| samueldmq | 1) stock policies are uploaded to keystone | 18:57 |
| stevemar | marekd, diazjf "By default the module sets the REMOTE_USER variable to the id_token [sub] claim" | 18:57 |
| samueldmq | 2) policies are customized | 18:57 |
| ayoung | samueldmq, you ahave already diverged | 18:57 |
| stevemar | https://github.com/pingidentity/mod_auth_openidc | 18:58 |
| samueldmq | 3) keystone gives back updated policies to services | 18:58 |
| samueldmq | ayoung: why ? | 18:58 |
| samueldmq | and where ? | 18:58 |
| ayoung | becvause /policy means we have to go and query them...but continue | 18:58 |
| ayoung | and we have no way of knowing htat and endpoint has changed | 18:58 |
| samueldmq | ayoung: timeout | 18:58 |
| samueldmq | ayoung: as we currently do in the middleware side | 18:58 |
| ayoung | samueldmq, you and I can talk until we are blue in the face. It Does not matter | 18:59 |
| ayoung | what he is saying is that the code will win. ALways | 18:59 |
| diazjf | stevemar, marekd, I'll make sure the documentation shows that the user attribute is not necesarry if using mod_auth_openidc | 18:59 |
| diazjf | but neccessary otherwise | 18:59 |
| marekd | diazjf: no. | 18:59 |
| diazjf | good catch | 18:59 |
| samueldmq | ayoung: when I said i'm resigned to this being a useless cycle | 18:59 |
| samueldmq | │15:27:18 morganfainberg | at this point | 18:59 |
| david-lyle | ayoung: trying to catch up on the scrollback in #openstack-meeting | 19:00 |
| samueldmq | ayoung: 1) stock policies are uploaded to keystone | 19:00 |
| marekd | diazjf: please, don't assume this is normal situation. Make it other way round. Say, normally it's required, unless the plugin sets REMOTE_USER | 19:00 |
| david-lyle | so now we're pushing defaults into the code and having to query from each service endpoint? | 19:00 |
| samueldmq | ayoung: I don't mind if this is being uploaded via /policy or | 19:00 |
| samueldmq | ayoung: policy files | 19:00 |
| diazjf | Sorry, I mean style the documentation using user as a standard case and adding a Note for the exception. :-/ | 19:01 |
| marekd | diazjf: anyway, your tests got me thinking about keystone-manage mapping_engine | 19:01 |
| marekd | diazjf: i will have to fix it and make it work correctly. Thanks. | 19:01 |
| ayoung | samueldmq, no | 19:02 |
| ayoung | because /policy will never happen | 19:02 |
| diazjf | marekd, thanks and no problemo | 19:02 |
| ayoung | it would require a change getting into every single openstack proejct | 19:02 |
| ayoung | it would never fly...adn any one porject coukld veto it | 19:02 |
| ayoung | its a non-starter | 19:02 |
| morganfainberg | ayoung: this becomes an x-project spec | 19:02 |
| henrynash | morganfainberg: I added the description of the rules under which you can get project scoped token to a project acting as a domain to https://review.openstack.org/#/c/193543/, so that it is now a complete package that will allow us to do this | 19:02 |
| stevemar | ayoung, just get the change into nova, and the rest follow suit | 19:02 |
| morganfainberg | and then the TC is involved | 19:02 |
| morganfainberg | not a "one project can veto" thing | 19:03 |
| david8hu | stevemar, ++ | 19:03 |
| ayoung | stevemar, it is a broken proposal | 19:03 |
| henrynash | ayoung: so what would make a nice (small) incremental step in the right direction that would help solve this issue? | 19:04 |
| ayoung | we have 18+ projects, and now we tell them they all need to implement a new public API. With data that is only used at astart up? | 19:04 |
| morganfainberg | david-lyle: the thought was /policy for the endpoint is where we start, it's a basis of truth [what the basic policy is] - keystone would eventually receive this base policy and/or provide an update to the endpoint so you could query either keystone or the endpoint | 19:04 |
| ayoung | come on...this is not even worth discussing | 19:04 |
| morganfainberg | david-lyle: at least that was what was tossed out as the way to get to centralized | 19:04 |
| *** mgarza_ has quit IRC | 19:04 | |
| ayoung | morganfainberg, and how does Horizon know that one endpoint out of 50 has changed? | 19:05 |
| ayoung | Is horizon going to go and poll every time> | 19:05 |
| morganfainberg | ayoung: maybe we should just punt all policy out of keystone and make a new service that does this. | 19:05 |
| ayoung | morganfainberg, it still does not matter | 19:05 |
| *** rwsu has quit IRC | 19:05 | |
| ayoung | morganfainberg, please, no. Evalute the dynamic policy approach on its own merits | 19:06 |
| ayoung | we have a unified view of policy across all the services of an opnestack deployemnt | 19:06 |
| ayoung | because work flowas go across policues | 19:06 |
| ayoung | we have hierarchical roles, and we have scoped RBAC | 19:06 |
| morganfainberg | i don't think we're going to get out of this mire. i think you're trying to boil the ocean | 19:07 |
| morganfainberg | and that is where we're locked | 19:07 |
| ayoung | NO. I am not trying to boil the ocean | 19:07 |
| ayoung | I've laid out a very straight forward step by steps seris of specs, with an over view that show how we will get there eventually | 19:07 |
| morganfainberg | yes you are. everything i'm hearing is the solution must be perfect out the door | 19:07 |
| ayoung | No... | 19:07 |
| morganfainberg | it's an all or nothing - | 19:07 |
| morganfainberg | that is what i'm seeing | 19:08 |
| morganfainberg | the specs are not clearly lined up as a scope of work it's a lot of "we need all of this" | 19:08 |
| ayoung | then you are not apying attention, and,. as distracted as you are as PTL, I don't fault you for that | 19:08 |
| morganfainberg | ok, i'm going to step out of this conversation and get lunch | 19:08 |
| samueldmq | morganfainberg: enjoy, bon apetit | 19:09 |
| ayoung | We have to deal with large distributions | 19:09 |
| ayoung | not a single Nova | 19:09 |
| openstackgerrit | Merged openstack/keystonemiddleware: Refactor _confirm_token_bind takes AccessInfo https://review.openstack.org/179676 | 19:09 |
| ayoung | we need to deal with multi site, pmulpte endpoitns of nova | 19:09 |
| ayoung | we need to deal with an ever increasing number of services | 19:10 |
| ayoung | so...step by step. | 19:10 |
| *** htruta_ has quit IRC | 19:10 | |
| ayoung | Each end point gains the ability to fetch its policy from keystone | 19:11 |
| ayoung | so..lets start right there | 19:11 |
| ayoung | ...you knwo what....go eat | 19:11 |
| *** geoffarnold has joined #openstack-keystone | 19:12 | |
| *** dramakri has joined #openstack-keystone | 19:12 | |
| *** csoukup has quit IRC | 19:12 | |
| *** rwsu has joined #openstack-keystone | 19:13 | |
| *** mgarza_ has joined #openstack-keystone | 19:15 | |
| browne | ayoung: on the role descriptions, what are your thoughts? i think it would be useful once policy is easy enough for users to create custom roles. | 19:16 |
| *** htruta_ has joined #openstack-keystone | 19:17 | |
| ayoung | browne, ok, so in short, there is nothing per-se wrong with descriptions. They are, at this point, rearraingeing deck chairs on the titanic | 19:20 |
| ayoung | browne right now we have one role | 19:21 |
| ayoung | admin | 19:21 |
| ayoung | we have Member, but nothing actually chekcs member | 19:21 |
| ayoung | so..until we have a non-trivial number of roles, desciption is superfluous | 19:21 |
| ayoung | and..weith that. I am going out for some exercise | 19:21 |
| *** openstackgerrit has quit IRC | 19:21 | |
| *** htruta_ has quit IRC | 19:22 | |
| browne | true by default. what if a deployer creates others? | 19:22 |
| browne | ok | 19:22 |
| *** openstackgerrit has joined #openstack-keystone | 19:22 | |
| *** spandhe has joined #openstack-keystone | 19:25 | |
| *** yottatsa has joined #openstack-keystone | 19:28 | |
| *** janonymous_ has quit IRC | 19:29 | |
| *** fifieldt_ has joined #openstack-keystone | 19:31 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and public httpd files https://review.openstack.org/194442 | 19:31 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: admin and public httpd files https://review.openstack.org/194442 | 19:32 |
| *** fifieldt has quit IRC | 19:34 | |
| *** belmoreira has quit IRC | 19:35 | |
| *** shaleh has quit IRC | 19:35 | |
| *** pnavarro|off has quit IRC | 19:37 | |
| *** iamjarvo has quit IRC | 19:39 | |
| *** pnavarro|off has joined #openstack-keystone | 19:39 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: This patch allows the keystone-manage mapping engine to be able to process a mapping containing regex. It alters the mapping schema to use a string value for regex rather than using a boolean value. https://review.openstack.org/194795 | 19:41 |
| *** rwsu has quit IRC | 19:41 | |
| *** HT_sergio has quit IRC | 19:41 | |
| *** aix has joined #openstack-keystone | 19:43 | |
| *** rwsu has joined #openstack-keystone | 19:45 | |
| *** rdo has quit IRC | 19:45 | |
| *** rdo has joined #openstack-keystone | 19:47 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: regex support in keystone-manage mapping engine https://review.openstack.org/194795 | 19:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Refactor extract method for offline validation https://review.openstack.org/188650 | 19:48 |
| *** rwsu has quit IRC | 19:51 | |
| *** Rockyg has joined #openstack-keystone | 19:51 | |
| sigmavirus24 | I was wondering if there were any stable maintainers that could take a look at https://review.openstack.org/#/c/181007/ | 19:53 |
| bknudson | sigmavirus24: I already looked at it. | 19:54 |
| sigmavirus24 | *any stable maintainers other than bknudson =P | 19:54 |
| *** brad[] has joined #openstack-keystone | 19:56 | |
| *** roxanaghe has joined #openstack-keystone | 19:56 | |
| *** csoukup has joined #openstack-keystone | 20:01 | |
| *** spandhe has quit IRC | 20:03 | |
| rodrigods | endpoint filter for service providers requires spec? cc morganfainberg marekd | 20:03 |
| ayoung | browne, OK, I'm back. Look, I don't disagree, just that description is a new field, which means we either need to fill it in or provide a defualt or something. It provides more work at deployment time, and it is an API change. I THe amount of churn does not justify the effort, compared to what i really wrong with how we do RBAC today | 20:04 |
| *** yottatsa has quit IRC | 20:05 | |
| ayoung | samueldmq, OK...I went for a run. Got a shower. Ready for a rational discussion | 20:05 |
| ayoung | henrynash, sorry, just saw your question. | 20:05 |
| ayoung | " so what would make a nice (small) incremental step in the right direction that would help solve this issue?" | 20:05 |
| *** e0ne is now known as e0ne_ | 20:05 | |
| *** e0ne_ is now known as e0ne | 20:05 | |
| morganfainberg | stevemar: i'm going to miss the x-project meeitng likely -- STILL haven't gotten lunch (family phone call... was not fun) | 20:06 |
| morganfainberg | stevemar: can you be there for the meeting as a proxy for me | 20:06 |
| ayoung | morganfainberg, sorry for being so touchy | 20:06 |
| morganfainberg | ayoung: wasn't you | 20:06 |
| morganfainberg | ayoung: seriously i've been trying to go get lunch for an hour | 20:06 |
| morganfainberg | or more now | 20:06 |
| ayoung | morganfainberg, probablym ore correct to say it wasn't just me | 20:06 |
| morganfainberg | nope, wasn't you in this case, i walked away frmo the compute the moment i said i was going to lunch ;) | 20:07 |
| ayoung | morganfainberg, I'll try to put together a coherent presentation for the midcycle | 20:07 |
| morganfainberg | ayoung: so definitively not you this time. | 20:07 |
| morganfainberg | but phone call happned right at that moment and just ended | 20:07 |
| samueldmq | Zanatoz: morganfainberg ayoung ... :-) | 20:07 |
| ayoung | samueldmq, I don't think I can get Zanatoz without a prescription | 20:08 |
| samueldmq | Zanatoz: not sure why I included you name above, sorry | 20:08 |
| samueldmq | haha | 20:08 |
| * samueldmq is tired .. :( | 20:08 | |
| *** greghaynes has quit IRC | 20:08 | |
| *** yottatsa has joined #openstack-keystone | 20:08 | |
| samueldmq | ayoung: I need to go home in a bit and have a shower | 20:08 |
| ayoung | samueldmq, OK. so...we need to make clear what we are working on here. I think that you and I can have detail discussion, and a few other people get pieces of it | 20:08 |
| samueldmq | ayoung: we talk later today .. if that works for you | 20:09 |
| ayoung | samueldmq, of course | 20:09 |
| *** navid__ has quit IRC | 20:09 | |
| samueldmq | ayoung: nice | 20:09 |
| bknudson | "Surveys say Brazilians are the world's most frequent bathers," | 20:09 |
| morganfainberg | bknudson: if stevemar can't proxy for me @ x-project meeting, would you mind representing keystone? | 20:09 |
| bknudson | morganfainberg: I'll be at the x-project meeting | 20:10 |
| ayoung | bknudson, its a mistranslation. The Portugeuse word is used from swimming, too. | 20:10 |
| morganfainberg | bknudson: awesome thankx | 20:10 |
| samueldmq | bknudson: it's very hot here :) | 20:10 |
| ayoung | I'd go swimming more if I had Brzailian beaches | 20:10 |
| samueldmq | ayoung: haha | 20:10 |
| samueldmq | ayoung: bknudson we should have a midcycle in Brazil in a few cycles | 20:10 |
| samueldmq | midcycle meetup I meant :) | 20:11 |
| bknudson | why wait? | 20:11 |
| raildo | or a OpenStack Summit Rio :D | 20:11 |
| samueldmq | bknudson: M midcycle ? | 20:11 |
| samueldmq | bknudson: I'd be happy to help organizing if enough people are interested on it | 20:11 |
| yottatsa | hello everybody | 20:12 |
| samueldmq | yottatsa: hey | 20:12 |
| yottatsa | we've done migrating onto new pluggable auth framework: class YandexOauth(base.AuthConstructor): | 20:13 |
| yottatsa | so there is a question | 20:13 |
| *** Ctina__ has quit IRC | 20:14 | |
| yottatsa | python-keystoneclient package in kilo is way too old | 20:14 |
| breton | what is AuthConstructor? | 20:14 |
| breton | oh, nevermind | 20:15 |
| ayoung | $851 .32 | 20:15 |
| morganfainberg | yottatsa: in kilo is way too old? what is way too old? and what distribution? | 20:15 |
| ayoung | samueldmq, ^^ price for a round trip flight from Boston to Rio in Mid Janauary | 20:16 |
| bknudson | can we get rid of the keystone-v3 feature branch? http://git.openstack.org/cgit/openstack/python-keystoneclient/log/?h=feature/keystone-v3 | 20:16 |
| * morganfainberg thinks there has only been one release or so since kilo | 20:16 | |
| bknudson | last commit is 2012 | 20:16 |
| morganfainberg | bknudson: uhm sure. | 20:16 |
| morganfainberg | bknudson: you'll need to ask dhellmann or ttx to do so i think | 20:16 |
| yottatsa | *** 1:1.2.0-0ubuntu1~cloud0 0 | 20:16 |
| yottatsa | trusty-updates/kilo/main | 20:16 |
| ayoung | add in recife and it becomes...$1,114 | 20:16 |
| morganfainberg | yottatsa: i can't control what is shipped by ubuntu | 20:16 |
| *** ksavich has quit IRC | 20:17 | |
| morganfainberg | yottatsa: you can grab what is in git and use that or on pypi | 20:17 |
| samueldmq | ayoung: Recife would be a good place :) | 20:17 |
| morganfainberg | yottatsa: that is the best answer i can give, unfortunately | 20:17 |
| samueldmq | ayoung: is that too expensive? | 20:17 |
| bknudson | I'll ask on -dev. | 20:17 |
| yottatsa | morganfainberg: yup | 20:17 |
| yottatsa | morganfainberg: I'll file a bug about it on launchpad | 20:18 |
| ayoung | samueldmq, let's just say it would be difficult to justify | 20:18 |
| *** shaleh has joined #openstack-keystone | 20:18 | |
| samueldmq | ayoung: haha yes, expensive is very relative | 20:19 |
| morganfainberg | yottatsa: make sure to file it against ubuntu not against keystone/keystoneclient | 20:19 |
| raildo | ayoung, now you understand how difficult is to us go to the mid cycle in Boston :P | 20:19 |
| stevemar | ohhh i should book my boston flight | 20:20 |
| ayoung | stevemar, or drive | 20:20 |
| ayoung | 8 h 5 min without traffic | 20:20 |
| yottatsa | morganfainberg: sure! still trying to find right one on lp )) | 20:21 |
| ayoung | looks likethe worst traffic is between Toronto and Burlington | 20:21 |
| yottatsa | hope I found it https://launchpad.net/~ubuntu-cloud-archive | 20:22 |
| samueldmq | ayoung: I won't be able to attend Boston midcycle meetup :( | 20:22 |
| *** iamjarvo has joined #openstack-keystone | 20:22 | |
| ayoung | samueldmq, too bad, but I kindof expected that | 20:22 |
| *** jasondotstar has quit IRC | 20:22 | |
| samueldmq | ayoung: yeah :( | 20:22 |
| morganfainberg | yottatsa: that looks correct to me | 20:22 |
| ayoung | Openstack is a lot of travel, even if you limit it to stateside | 20:22 |
| bknudson | morganfainberg: https://review.openstack.org/#/c/194801/ | 20:22 |
| bknudson | infra change | 20:22 |
| samueldmq | ayoung: need to go home, talk to you in a bit | 20:23 |
| morganfainberg | bknudson: +1 | 20:23 |
| raildo | ayoung, can you take a look on that later? https://review.openstack.org/#/c/193543/ :) | 20:23 |
| bknudson | I don't know who's supposed to have merge powers but keystone-core seems good enough | 20:23 |
| morganfainberg | good enough for the feature branch | 20:23 |
| bknudson | morganfainberg: I was wondering if the keystoneauth_integration branch is essentialy keystoneclient 2.0 ? | 20:23 |
| morganfainberg | yep | 20:24 |
| morganfainberg | it is | 20:24 |
| morganfainberg | that is the plan at least | 20:24 |
| bknudson | b/c we could put delete of middleware in it | 20:24 |
| yottatsa | BTW when openstack/keystoneauth is goint to be released? | 20:24 |
| morganfainberg | yottatsa: hopefully soon | 20:24 |
| morganfainberg | yottatsa: but we're not sure exactly when yet | 20:24 |
| morganfainberg | bknudson: sure do it | 20:24 |
| morganfainberg | bknudson: and delete cli | 20:25 |
| yottatsa | morganfainberg: Will it be introduced in liberty? | 20:25 |
| bknudson | morganfainberg: great, thanks. | 20:25 |
| morganfainberg | yottatsa: yes that is the plab | 20:25 |
| morganfainberg | plan* | 20:25 |
| *** henrynash has quit IRC | 20:29 | |
| *** fangzhou has joined #openstack-keystone | 20:30 | |
| david8hu | ayoung, samuldmq, please include me as well. | 20:32 |
| *** dontalton has quit IRC | 20:32 | |
| ayoung | david8hu, happy to | 20:32 |
| *** dontalton has joined #openstack-keystone | 20:33 | |
| david8hu | thanks ayoung | 20:33 |
| stevemar | ayoung, yeah toronto has horrible traffic these days :( | 20:34 |
| *** pnavarro|off has quit IRC | 20:38 | |
| dramakri | dolphm: ping... can you please take a look at the patch which reuses token_ref fetched in AuthContextMiddleware - https://review.openstack.org/#/c/190863/? Rally test result shows that there is ~35 improvement in latency (average, median, 90%ile) for both create and delete token. | 20:39 |
| dramakri | https://review.openstack.org/#/c/190863/ | 20:39 |
| dolphm | dramakri: awesome! | 20:39 |
| *** rwsu has joined #openstack-keystone | 20:39 | |
| *** Rockyg has quit IRC | 20:40 | |
| *** ajayaa has quit IRC | 20:41 | |
| *** Rockyg has joined #openstack-keystone | 20:41 | |
| *** rm_work is now known as rm_work|away | 20:42 | |
| bknudson | crap, merge conflict in keystoneauth_integration somehow :( | 20:43 |
| tobasco | looking for a good token driver for keystone, want to avoid sql and go with multiple haproxy loadbalanced memcached or same with redis or redis replication with custom token driver, anybody deployed a big keystone setup with a different token driver than sql also with caching (dont even know if caching is needed) | 20:45 |
| yottatsa | tobasco: our installation is pretty big, BTW we're still using sql backend and lookin forward on new fernet tokens | 20:46 |
| yottatsa | ~200k tokens per day is not really a problem | 20:47 |
| *** Rockyg has quit IRC | 20:47 | |
| *** spandhe has joined #openstack-keystone | 20:48 | |
| *** Rockyg has joined #openstack-keystone | 20:48 | |
| *** htruta has quit IRC | 20:52 | |
| morganfainberg | tobasco: you really don't want to use the memcache driver. Sql is the best option if you can't use fernet. | 20:53 |
| *** d43pan has left #openstack-keystone | 20:54 | |
| *** csoukup has quit IRC | 20:56 | |
| *** Raildo_ has joined #openstack-keystone | 21:03 | |
| *** csoukup has joined #openstack-keystone | 21:04 | |
| *** shaleh has quit IRC | 21:05 | |
| tobasco | yottatsa: morganfainberg thanks for your input, i'm looking up fernet asap, is there any downsides/stuff that won't work with fernet tokens? | 21:06 |
| *** shaleh has joined #openstack-keystone | 21:06 | |
| dolphm | tobasco: fernet does not handle token "binding" (x509/kerberos) | 21:06 |
| dolphm | tobasco: (but we haven't heard from anyone using that recently) | 21:07 |
| *** yottatsa has quit IRC | 21:07 | |
| *** arunkant__ has joined #openstack-keystone | 21:07 | |
| *** arunkant_ has quit IRC | 21:10 | |
| tobasco | dolphm: ok thanks i will research and maybe do a quick lab, i actually see now i got your blog(?) in one of the search result, nice writeup! | 21:11 |
| ekarlso | what blog is that ? :d | 21:11 |
| tobasco | ekarlso: http://dolphm.com/benchmarking-openstack-keystone-token-formats/ | 21:13 |
| tobasco | ekarlso: i did an assumption it was him :] | 21:13 |
| *** rm_work|away is now known as rm_work | 21:15 | |
| *** shaleh has quit IRC | 21:18 | |
| *** shaleh has joined #openstack-keystone | 21:20 | |
| *** diazjf has quit IRC | 21:25 | |
| dolphm | tobasco: thank you! hopefully you find it helpful | 21:25 |
| dolphm | tobasco: a related post http://dolphm.com/openstack-keystone-fernet-tokens/ | 21:25 |
| dolphm | tobasco: and mfisch and lbragstad have several as well on their blogs | 21:25 |
| *** charlesw has quit IRC | 21:25 | |
| *** arunkant_ has joined #openstack-keystone | 21:27 | |
| tobasco | dolphm: thank you :] | 21:28 |
| *** e0ne is now known as e0ne_ | 21:28 | |
| *** e0ne_ has quit IRC | 21:29 | |
| *** arunkant__ has quit IRC | 21:30 | |
| *** radez is now known as radez_g0n3 | 21:33 | |
| *** iamjarvo has quit IRC | 21:34 | |
| *** e0ne has joined #openstack-keystone | 21:34 | |
| mfisch | we have not seen a downside yet tobasco | 21:41 |
| *** e0ne is now known as e0ne_ | 21:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/190405 | 21:43 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/192375 | 21:43 |
| *** e0ne_ is now known as e0ne | 21:45 | |
| morganfainberg | mfisch: that is the kind of endorsement I like to hear. | 21:47 |
| mfisch | morganfainberg: When you run openstack as long as you're not currently on-fire it's a good day | 21:48 |
| mfisch | we had a "minor" firewall change last night at 2am that only set off about 50 pagerduties | 21:48 |
| morganfainberg | mfisch: meh. My rule is I don't take a job where pager duty calls me :p | 21:49 |
| mfisch | I'm not on call which is good | 21:49 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/192319 | 21:49 |
| *** spandhe has quit IRC | 21:50 | |
| *** henrynash has joined #openstack-keystone | 21:51 | |
| *** ChanServ sets mode: +v henrynash | 21:51 | |
| mfisch | dolphm: did you guys consider keeping the fernet keys with the API services so that they dont have to call back to keystone? | 21:51 |
| *** thedodd has quit IRC | 21:53 | |
| morganfainberg | mfisch: nope. The pki token issue would occur. | 21:54 |
| mfisch | whats that? | 21:54 |
| morganfainberg | mfisch: we don't store all he token data in he fernet payload. | 21:54 |
| mfisch | ah | 21:54 |
| morganfainberg | We store minimal data to ensure the token stays small. Just enough to reconstruct the token. | 21:55 |
| lbragstad | mfisch: there was a case around that from atwari, but that was focused on HMAC signing | 21:55 |
| *** e0ne has quit IRC | 21:55 | |
| morganfainberg | mfisch: I also don't trust nova with a way to issue its own keys. | 21:55 |
| morganfainberg | mfisch: since fernet is symmetrical. | 21:55 |
| mfisch | wouldn't it just use the same keys that everyone uses? | 21:56 |
| mfisch | I'd deploy them to every API node | 21:56 |
| morganfainberg | S/nova/any service not keystone/ | 21:56 |
| lbragstad | it also would have meant a "roll your own" implementation versus just building off the Fernet spec that exists in cryptography | 21:56 |
| morganfainberg | mfisch: if you do that any endpoint can issue a new valid token. We don't want that exposure. | 21:56 |
| *** spandhe has joined #openstack-keystone | 21:56 | |
| morganfainberg | mfisch: better to limit that to keystone itself. | 21:57 |
| lbragstad | mfisch: dolphm has an idea for getting to that use case through the fernet path though | 21:57 |
| morganfainberg | Asymmetric encryption was about a minimum of 1KB overhead. Which also added to the token size issues. | 21:57 |
| morganfainberg | For pki. | 21:57 |
| morganfainberg | mfisch: I'd rather tell people to scale out keystone. | 21:59 |
| mfisch | after fernet I'm retired from keystone, no more changes ;) | 21:59 |
| morganfainberg | mfisch: but...... | 21:59 |
| morganfainberg | We <3 you. | 22:00 |
| bknudson | mfisch: just wait till we deprecate the identity API | 22:00 |
| bknudson | and switch to SCIM at least | 22:01 |
| mfisch | operators file bugs and you guys deprecate in retaliation, I know the drill | 22:01 |
| bknudson | we could automate that... | 22:01 |
| mfisch | CI/CD for Deprecations | 22:01 |
| bknudson | morganfainberg: "--Morgab" -- is that your autocorrect again? | 22:03 |
| morganfainberg | No just a typo | 22:03 |
| morganfainberg | Stupid smudgy tiny screen. | 22:04 |
| *** shaleh_ has joined #openstack-keystone | 22:05 | |
| *** edmondsw has quit IRC | 22:05 | |
| tobasco | thanks mfisch, good news if fernet token can become standard when liberty goes stable, offtopic im off see you later | 22:06 |
| *** Rockyg has quit IRC | 22:08 | |
| *** shaleh has quit IRC | 22:08 | |
| *** bknudson has quit IRC | 22:09 | |
| *** radez_g0n3 is now known as radez | 22:11 | |
| *** Raildo_ has quit IRC | 22:11 | |
| *** dontalton2 has joined #openstack-keystone | 22:19 | |
| *** gyee has quit IRC | 22:23 | |
| *** Ctina__ has joined #openstack-keystone | 22:25 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:26 | |
| *** henrynash has quit IRC | 22:26 | |
| *** gyee has joined #openstack-keystone | 22:27 | |
| *** ChanServ sets mode: +v gyee | 22:27 | |
| *** pballand has quit IRC | 22:28 | |
| *** pballand has joined #openstack-keystone | 22:31 | |
| *** charlesw has joined #openstack-keystone | 22:37 | |
| *** zzzeek has quit IRC | 22:40 | |
| *** rwsu has quit IRC | 22:47 | |
| *** csoukup has quit IRC | 22:59 | |
| *** r-daneel has quit IRC | 23:00 | |
| *** bknudson has joined #openstack-keystone | 23:02 | |
| *** ChanServ sets mode: +v bknudson | 23:02 | |
| *** shaleh_ has quit IRC | 23:08 | |
| *** lhcheng has quit IRC | 23:10 | |
| *** richm has quit IRC | 23:11 | |
| *** pballand has quit IRC | 23:12 | |
| *** charlesw has quit IRC | 23:15 | |
| *** dontalton2 has quit IRC | 23:16 | |
| *** dontalton has quit IRC | 23:16 | |
| *** mgarza_ has quit IRC | 23:22 | |
| *** jasondotstar has joined #openstack-keystone | 23:23 | |
| *** stevemar has quit IRC | 23:29 | |
| *** pballand has joined #openstack-keystone | 23:32 | |
| *** pballand has quit IRC | 23:34 | |
| *** Ctina__ has quit IRC | 23:45 | |
| *** Ctina__ has joined #openstack-keystone | 23:45 | |
| *** Ctina___ has joined #openstack-keystone | 23:48 | |
| *** roxanaghe has quit IRC | 23:49 | |
| *** Ctina__ has quit IRC | 23:50 | |
| *** dims has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!