| *** Kennan2 is now known as Kennan | 00:11 | |
| morganfainberg | anteaya: if no one else has addressed the comments...i'l be looking at it here shortly | 00:18 |
|---|---|---|
| *** _cjones_ has quit IRC | 00:27 | |
| *** dobson has quit IRC | 00:27 | |
| anteaya | thanks | 00:27 |
| *** mylu has quit IRC | 00:30 | |
| *** mylu has joined #openstack-keystone | 00:31 | |
| *** darrenc is now known as darrenc_afk | 00:34 | |
| *** gyee has quit IRC | 00:36 | |
| *** dims has quit IRC | 00:40 | |
| *** jasonsb has quit IRC | 00:48 | |
| openstackgerrit | Merged openstack/keystone: Fixes docstring to make it more precise https://review.openstack.org/199338 | 00:49 |
| *** h00327910_ has joined #openstack-keystone | 00:50 | |
| *** Kennan has quit IRC | 00:54 | |
| *** Kennan has joined #openstack-keystone | 00:58 | |
| *** btully has quit IRC | 00:59 | |
| *** darrenc_afk is now known as darrenc | 01:00 | |
| openstackgerrit | Merged openstack/keystone: Fix log message in one of the v3 create call methods. https://review.openstack.org/199420 | 01:01 |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/199886 | 01:01 |
| bigjools | does anyone know if the federation mapping gets consulted for every token that's generated, or is it done only once when getting the initial OK from the IdP? | 01:02 |
| *** lhcheng has quit IRC | 01:03 | |
| *** ankita_wagh has quit IRC | 01:07 | |
| *** mylu has quit IRC | 01:13 | |
| *** piyanai has joined #openstack-keystone | 01:16 | |
| *** chlong has joined #openstack-keystone | 01:20 | |
| *** davechen has joined #openstack-keystone | 01:23 | |
| *** dims has joined #openstack-keystone | 01:24 | |
| *** stevemar has joined #openstack-keystone | 01:25 | |
| *** dims has quit IRC | 01:25 | |
| *** dims has joined #openstack-keystone | 01:26 | |
| *** stevemar has quit IRC | 01:27 | |
| *** stevemar has joined #openstack-keystone | 01:27 | |
| *** davechen1 has joined #openstack-keystone | 01:32 | |
| *** crc32 has quit IRC | 01:32 | |
| bigjools | jamielennox: I don't suppose you know the answer? --^ | 01:32 |
| jamielennox | bigjools: off the top of my head i would expect only when getting the OK from the idp | 01:33 |
| jamielennox | with federation you always receive an unscoped token first | 01:33 |
| bigjools | we're a little concerned about performance and that was an outstanding question | 01:33 |
| bigjools | yeah, I thought the same | 01:34 |
| jamielennox | generating the unscoped token is going to require going through mapping because you need to figure out where to put the user, but for validation etc all that information is stored to the db | 01:34 |
| *** davechen has quit IRC | 01:34 | |
| bigjools | right. Thanks! | 01:35 |
| *** mylu has joined #openstack-keystone | 01:35 | |
| *** dims has quit IRC | 01:36 | |
| *** mylu has quit IRC | 01:37 | |
| *** dims has joined #openstack-keystone | 01:37 | |
| *** tobe has joined #openstack-keystone | 01:39 | |
| *** davechen has joined #openstack-keystone | 01:41 | |
| *** dims has quit IRC | 01:42 | |
| *** fangzhou has quit IRC | 01:43 | |
| *** davechen1 has quit IRC | 01:43 | |
| *** jdandrea has quit IRC | 01:43 | |
| *** btully has joined #openstack-keystone | 01:50 | |
| *** skylerberg has quit IRC | 01:51 | |
| *** richm has quit IRC | 01:54 | |
| *** btully has quit IRC | 01:55 | |
| *** spandhe has quit IRC | 02:07 | |
| *** chenhong has joined #openstack-keystone | 02:08 | |
| chenhong | dstanek: ping | 02:13 |
| *** arunkant__ has joined #openstack-keystone | 02:19 | |
| *** diabloneo has joined #openstack-keystone | 02:19 | |
| *** chenhong has quit IRC | 02:20 | |
| *** arunkant_ has quit IRC | 02:22 | |
| *** chenhong has joined #openstack-keystone | 02:24 | |
| *** diabloneo has quit IRC | 02:24 | |
| *** kiran-r has joined #openstack-keystone | 02:25 | |
| chenhong | jamielennox: hi, are you available to review my changes? | 02:25 |
| *** dims has joined #openstack-keystone | 02:38 | |
| *** dims has quit IRC | 02:43 | |
| *** stevemar has quit IRC | 02:45 | |
| *** stevemar has joined #openstack-keystone | 02:45 | |
| *** mylu has joined #openstack-keystone | 02:46 | |
| dstanek | chenhong: pong | 02:48 |
| chenhong | dstanek: hi, I want to ask you to review my two changes. Are you available now? | 02:49 |
| dstanek | chenhong: which ones? i can add them to my list | 02:50 |
| chenhong | dstanek: https://review.openstack.org/#/c/187899/ and https://review.openstack.org/#/c/197184/ | 02:50 |
| chenhong | dstanek: Thanks very much. | 02:50 |
| dstanek | chenhong: np | 02:51 |
| *** mylu has quit IRC | 02:51 | |
| *** arunkant has joined #openstack-keystone | 03:01 | |
| *** arunkant__ has quit IRC | 03:05 | |
| *** Kennan has quit IRC | 03:07 | |
| *** Kennan has joined #openstack-keystone | 03:07 | |
| *** htruta_ has quit IRC | 03:11 | |
| *** rwsu has quit IRC | 03:11 | |
| *** lhcheng has joined #openstack-keystone | 03:15 | |
| *** ChanServ sets mode: +v lhcheng | 03:15 | |
| *** jkomg has joined #openstack-keystone | 03:21 | |
| *** stevemar has quit IRC | 03:22 | |
| *** stevemar has joined #openstack-keystone | 03:22 | |
| *** rushiagr_away has quit IRC | 03:28 | |
| *** dobson has joined #openstack-keystone | 03:40 | |
| *** ankita_wagh has joined #openstack-keystone | 03:54 | |
| *** crc32 has joined #openstack-keystone | 03:59 | |
| *** arunkant_ has joined #openstack-keystone | 04:03 | |
| *** arunkant has quit IRC | 04:06 | |
| *** arunkant__ has joined #openstack-keystone | 04:08 | |
| *** crc32 has quit IRC | 04:11 | |
| *** arunkant_ has quit IRC | 04:11 | |
| *** darrenc is now known as darrenc_afk | 04:15 | |
| *** piyanai has quit IRC | 04:24 | |
| *** darrenc_afk is now known as darrenc | 04:30 | |
| *** spandhe has joined #openstack-keystone | 04:30 | |
| *** spandhe_ has joined #openstack-keystone | 04:33 | |
| *** spandhe has quit IRC | 04:35 | |
| *** spandhe_ is now known as spandhe | 04:35 | |
| *** arunkant__ has quit IRC | 04:37 | |
| *** kiran-r has quit IRC | 04:37 | |
| *** tobe has quit IRC | 04:44 | |
| lhcheng | hi jamielennox | 04:48 |
| jamielennox | hey lin | 04:48 |
| lhcheng | found your ksc patch to clean the duplicate code from keystoneauth | 04:49 |
| lhcheng | is this okay to merge? https://review.openstack.org/#/c/196479/2 | 04:49 |
| jamielennox | lhcheng: please do! | 04:50 |
| jamielennox | that's on a feature branch so it's not going to land in client straight away | 04:50 |
| lhcheng | ah! didn't notice that | 04:50 |
| lhcheng | cool | 04:50 |
| jamielennox | there's no real risk there as it's all still experimental | 04:50 |
| lhcheng | great | 04:50 |
| lhcheng | question on osc, I know you hate the new 'os_endpoint_type' option added | 04:51 |
| lhcheng | you want to give your take on this: https://review.openstack.org/#/c/198506/ | 04:51 |
| jamielennox | lhcheng: excellent, i'm glad that's happening | 04:53 |
| jamielennox | commented, i think --os-interface is better | 04:53 |
| lhcheng | hopefully we can rename it before the next osc release :) | 04:53 |
| jamielennox | interface-type doesn't really make sense | 04:53 |
| lhcheng | agreed | 04:53 |
| *** ajayaa has joined #openstack-keystone | 04:56 | |
| * stevemar releases osc right now just to piss off lhcheng and jamielennox | 05:00 | |
| stevemar | >>.>> | 05:00 |
| stevemar | <<.<< | 05:00 |
| *** chenhong has quit IRC | 05:01 | |
| *** chenhong has joined #openstack-keystone | 05:01 | |
| lhcheng | haha that's so mean | 05:03 |
| *** dims has joined #openstack-keystone | 05:03 | |
| jamielennox | and largely hurting yourself | 05:03 |
| *** dims_ has joined #openstack-keystone | 05:04 | |
| openstackgerrit | Ning Sun proposed openstack/keystone: Corrected a typo in README https://review.openstack.org/200377 | 05:06 |
| *** dims has quit IRC | 05:08 | |
| *** dims_ has quit IRC | 05:08 | |
| *** ajayaa has quit IRC | 05:10 | |
| openstackgerrit | Merged openstack/keystone: Add more Rally scenarios https://review.openstack.org/188457 | 05:27 |
| *** spandhe has quit IRC | 05:32 | |
| *** markvoelker has quit IRC | 05:32 | |
| *** jbonjean has joined #openstack-keystone | 05:33 | |
| *** btully has joined #openstack-keystone | 05:33 | |
| *** spandhe has joined #openstack-keystone | 05:36 | |
| *** ajayaa has joined #openstack-keystone | 05:37 | |
| *** david-ly_ has joined #openstack-keystone | 05:37 | |
| *** david-lyle has quit IRC | 05:40 | |
| *** annasort has quit IRC | 05:46 | |
| *** ig0r__ has joined #openstack-keystone | 05:52 | |
| *** j_king has quit IRC | 05:53 | |
| *** j_king has joined #openstack-keystone | 05:54 | |
| *** ig0r_ has quit IRC | 05:55 | |
| *** amaretskiy has joined #openstack-keystone | 05:56 | |
| *** dims has joined #openstack-keystone | 06:01 | |
| *** Kennan has quit IRC | 06:02 | |
| *** Kennan has joined #openstack-keystone | 06:03 | |
| *** ankita_wagh has quit IRC | 06:04 | |
| *** Kennan2 has joined #openstack-keystone | 06:06 | |
| *** Kennan has quit IRC | 06:07 | |
| *** dims has quit IRC | 06:09 | |
| *** spandhe has quit IRC | 06:10 | |
| *** ankita_wagh has joined #openstack-keystone | 06:13 | |
| *** dims has joined #openstack-keystone | 06:13 | |
| *** dims_ has joined #openstack-keystone | 06:14 | |
| *** mylu has joined #openstack-keystone | 06:17 | |
| *** dims has quit IRC | 06:17 | |
| stevemar | lhcheng: you found it was a mock change, now you have to fix it | 06:21 |
| *** dims_ has quit IRC | 06:21 | |
| lhcheng | stevemar: testing it now on my local :) | 06:22 |
| *** mylu has quit IRC | 06:22 | |
| *** dims has joined #openstack-keystone | 06:22 | |
| *** dims has quit IRC | 06:27 | |
| *** markvoelker has joined #openstack-keystone | 06:32 | |
| *** markvoelker has quit IRC | 06:37 | |
| *** lufix3 has joined #openstack-keystone | 06:40 | |
| *** afazekas has joined #openstack-keystone | 06:44 | |
| *** stevemar has quit IRC | 06:44 | |
| *** tobe has joined #openstack-keystone | 06:45 | |
| *** stevemar has joined #openstack-keystone | 06:45 | |
| *** stevemar has quit IRC | 06:50 | |
| *** ajayaa has quit IRC | 06:58 | |
| *** jkomg has quit IRC | 06:58 | |
| *** ajayaa has joined #openstack-keystone | 06:59 | |
| *** lhcheng has quit IRC | 07:02 | |
| *** lhcheng has joined #openstack-keystone | 07:02 | |
| *** ChanServ sets mode: +v lhcheng | 07:02 | |
| *** browne has quit IRC | 07:03 | |
| *** rharwood has quit IRC | 07:08 | |
| *** rharwood has joined #openstack-keystone | 07:11 | |
| *** jistr has joined #openstack-keystone | 07:16 | |
| *** jamielennox is now known as jamielennox|away | 07:17 | |
| *** hrou has quit IRC | 07:19 | |
| *** cloudnull has quit IRC | 07:26 | |
| *** sigmavirus24_awa has quit IRC | 07:27 | |
| *** fhubik has joined #openstack-keystone | 07:27 | |
| *** d34dh0r53 has quit IRC | 07:30 | |
| *** eglute has quit IRC | 07:30 | |
| *** dolphm has quit IRC | 07:30 | |
| *** odyssey4me has quit IRC | 07:45 | |
| *** stevemar has joined #openstack-keystone | 07:46 | |
| *** ankita_wagh has quit IRC | 07:48 | |
| *** stevemar has quit IRC | 07:50 | |
| *** henrynash has quit IRC | 07:52 | |
| *** rletrocquer has joined #openstack-keystone | 08:01 | |
| *** rletrocquer has quit IRC | 08:02 | |
| *** rletrocquer has joined #openstack-keystone | 08:02 | |
| *** odyssey4me has joined #openstack-keystone | 08:07 | |
| *** chlong has quit IRC | 08:10 | |
| *** chenhong has quit IRC | 08:18 | |
| *** chenhong has joined #openstack-keystone | 08:18 | |
| *** christx2 has joined #openstack-keystone | 08:18 | |
| *** ccard has joined #openstack-keystone | 08:19 | |
| *** WormMan has quit IRC | 08:21 | |
| *** WormMan has joined #openstack-keystone | 08:22 | |
| *** Pawel__ has joined #openstack-keystone | 08:22 | |
| *** henrynash has joined #openstack-keystone | 08:25 | |
| *** ChanServ sets mode: +v henrynash | 08:25 | |
| *** christx2 has quit IRC | 08:25 | |
| *** christx2 has joined #openstack-keystone | 08:26 | |
| *** markvoelker has joined #openstack-keystone | 08:34 | |
| *** josecastroleon has joined #openstack-keystone | 08:36 | |
| *** btully has quit IRC | 08:38 | |
| *** markvoelker has quit IRC | 08:38 | |
| *** dims has joined #openstack-keystone | 08:40 | |
| *** odyssey4me_ has joined #openstack-keystone | 08:42 | |
| *** dims has quit IRC | 08:45 | |
| *** odyssey4me_ has quit IRC | 08:47 | |
| *** stevemar has joined #openstack-keystone | 08:47 | |
| *** stevemar has quit IRC | 08:51 | |
| *** lhcheng has quit IRC | 08:52 | |
| *** chenhong has quit IRC | 08:59 | |
| *** chenhong has joined #openstack-keystone | 08:59 | |
| *** jistr has quit IRC | 09:00 | |
| *** jistr has joined #openstack-keystone | 09:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Provide config option to direct inheritance rules https://review.openstack.org/200434 | 09:27 |
| *** bdossant has joined #openstack-keystone | 09:35 | |
| *** lhcheng has joined #openstack-keystone | 09:39 | |
| *** ChanServ sets mode: +v lhcheng | 09:39 | |
| *** e0ne has joined #openstack-keystone | 09:51 | |
| *** davechen has left #openstack-keystone | 09:54 | |
| *** fhubik is now known as fhubik_afk | 09:58 | |
| *** gordc has joined #openstack-keystone | 10:26 | |
| *** dims has joined #openstack-keystone | 10:28 | |
| *** dhague_ has joined #openstack-keystone | 10:29 | |
| *** dims_ has joined #openstack-keystone | 10:29 | |
| *** lhcheng has quit IRC | 10:32 | |
| *** dims has quit IRC | 10:33 | |
| *** arunkant__ has joined #openstack-keystone | 10:34 | |
| *** dims_ has quit IRC | 10:34 | |
| *** markvoelker has joined #openstack-keystone | 10:35 | |
| *** stevemar has joined #openstack-keystone | 10:36 | |
| *** markvoelker has quit IRC | 10:39 | |
| *** stevemar has quit IRC | 10:40 | |
| *** arunkant__ has quit IRC | 10:41 | |
| *** dhague_ has quit IRC | 10:41 | |
| samueldmq | morning | 10:44 |
| chenhong | samueldmq: evening, :-) | 10:46 |
| samueldmq | chenhong: hehe, good evening then :) | 10:47 |
| *** e0ne is now known as e0ne_ | 10:49 | |
| samueldmq | henrynash: hi, just looking at 'config option to direct inheritance rules' ... | 10:51 |
| henrynash | samueldmq: hi | 10:52 |
| samueldmq | henrynash: why not just put the default as being applying to parent + children ? | 10:52 |
| samueldmq | henrynash: having config option would be still more complex to use (inherited role assignments are complex by themselves ... ) | 10:52 |
| henrynash | samuedmq:…becasue that would change existing beahviour | 10:52 |
| samueldmq | henrynash: that would be compatible with the existing behavior .. I'd say it'd extend the existing behavior | 10:53 |
| *** eglute has joined #openstack-keystone | 10:53 | |
| *** dolphm has joined #openstack-keystone | 10:53 | |
| *** ChanServ sets mode: +o dolphm | 10:53 | |
| samueldmq | henrynash: notice that the assignment would be expanded to the children anyway, but just considering the root entity instead of droping it | 10:54 |
| henrynash | samueldmq: I don’t think we want to (on an update) suddenly include roles in tokens taht were not there before | 10:54 |
| *** jamielennox|away is now known as jamielennox | 10:54 | |
| *** d34dh0r53 has joined #openstack-keystone | 10:54 | |
| samueldmq | henrynash: yes, that is an interesting point, we can't just disconsider that :( | 10:58 |
| samueldmq | henrynash: are we trying to fix the fact that 'inherited' maps better to 'me and my children' ? | 10:58 |
| henrynash | yep | 10:58 |
| henrynash | but I think we need to be cautous | 10:58 |
| samueldmq | henrynash: wouldn't we have a better name for what we have today? | 10:59 |
| samueldmq | henrynash: yes we need ++ | 10:59 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/oslo.policy: Dynamic Policies Overlay https://review.openstack.org/200257 | 10:59 |
| *** e0ne_ is now known as e0ne | 11:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Provide config option to direct inheritance rules https://review.openstack.org/200434 | 11:12 |
| *** tobe has quit IRC | 11:15 | |
| *** chenhong has quit IRC | 11:16 | |
| *** tobe has joined #openstack-keystone | 11:16 | |
| samueldmq | henrynash: in a near future .. will there be any distinction between domain and project assignments ? | 11:17 |
| samueldmq | henrynash: how do you see this ? | 11:17 |
| henrynash | samueldmq: no, I think there are just assignments | 11:18 |
| henrynash | samueldmq: it will be upto the policy file to decide is an assignment on a project where is_domain=True means something different | 11:19 |
| henrynash | imho | 11:19 |
| samueldmq | henrynash: so just project assignments, it doesn't matter if it is is_domain or not in the server side | 11:19 |
| henrynash | samueldmq: I *think* that’s correct | 11:20 |
| *** odyssey4me has quit IRC | 11:20 | |
| samueldmq | henrynash: k so one with a role in a domain would have that role in its project .. so domain 'admin' would become a project 'admin' as well (besides the admin of the is_domain project, which is the domain .. ) | 11:22 |
| henrynash | samuedmq: so maybe…it would depend on policy, a project admin rule *might* specifi that project admin only applied to projects with is_doman=False, in which case no, they wouldn’t also be a project admin | 11:24 |
| samueldmq | henrynash: yes, but I am thinking in the bad policies we have today, where admin anywhere is admin everywhere | 11:25 |
| samueldmq | henrynash: but I think this is a separate concern | 11:25 |
| *** fhubik_afk is now known as fhubik | 11:26 | |
| henrynash | true | 11:26 |
| henrynash | be offline for a bit, back on later | 11:26 |
| samueldmq | sure | 11:27 |
| *** henrynash has quit IRC | 11:28 | |
| *** e0ne is now known as e0ne_ | 11:35 | |
| *** markvoelker has joined #openstack-keystone | 11:35 | |
| *** markvoelker has quit IRC | 11:40 | |
| *** piyanai has joined #openstack-keystone | 11:41 | |
| *** piyanai has quit IRC | 11:41 | |
| *** tobe has quit IRC | 11:45 | |
| *** ankita_wagh has joined #openstack-keystone | 11:48 | |
| *** ankita_wagh has quit IRC | 11:53 | |
| *** radez is now known as radez_g0n3 | 11:57 | |
| *** christx2 has quit IRC | 11:57 | |
| *** bknudson has joined #openstack-keystone | 12:07 | |
| *** ChanServ sets mode: +v bknudson | 12:07 | |
| *** markvoelker has joined #openstack-keystone | 12:07 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes some grammar in the httpd README https://review.openstack.org/200492 | 12:08 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes grammar in the httpd README https://review.openstack.org/200492 | 12:08 |
| *** christx2 has joined #openstack-keystone | 12:09 | |
| *** dims has joined #openstack-keystone | 12:15 | |
| *** ig0r__ has quit IRC | 12:17 | |
| *** mylu has joined #openstack-keystone | 12:19 | |
| *** dims has quit IRC | 12:20 | |
| *** e0ne_ is now known as e0ne | 12:21 | |
| *** henrynash has joined #openstack-keystone | 12:22 | |
| *** ChanServ sets mode: +v henrynash | 12:22 | |
| *** ig0r_ has joined #openstack-keystone | 12:23 | |
| *** mylu has quit IRC | 12:24 | |
| *** stevemar has joined #openstack-keystone | 12:25 | |
| *** david-lyle has joined #openstack-keystone | 12:28 | |
| *** chlong has joined #openstack-keystone | 12:28 | |
| *** stevemar has quit IRC | 12:28 | |
| *** david-ly_ has quit IRC | 12:30 | |
| *** edmondsw has joined #openstack-keystone | 12:32 | |
| *** hockeynut has quit IRC | 12:38 | |
| *** dims has joined #openstack-keystone | 12:41 | |
| *** hockeynut has joined #openstack-keystone | 12:42 | |
| dstanek | henrynash: you around? | 12:43 |
| dstanek | henrynash: is there a security risk to scoping to the wrong project? | 12:44 |
| breton | dstanek: you put +2a to https://review.openstack.org/#/c/187899/ , but -1 to a dependency :) | 12:44 |
| dstanek | breton: yes, its code looked fine, but i dep needs to change | 12:45 |
| *** e0ne is now known as e0ne_ | 12:46 | |
| dstanek | breton: although how i now want it to change will impact that review so i should probably remove the +a | 12:46 |
| *** chenhong has joined #openstack-keystone | 12:47 | |
| *** odyssey4me has joined #openstack-keystone | 12:47 | |
| *** e0ne_ is now known as e0ne | 12:47 | |
| henrynash | dstanek: hi | 12:49 |
| *** raildo_ has joined #openstack-keystone | 12:50 | |
| dstanek | henrynash: hi | 12:50 |
| henrynash | dstanek: well, it’s only a risk if you already have a role on it (i.e. if you have no role on the project acting as a domain, then you won’t be able to scope to it) | 12:50 |
| *** raildo_ has quit IRC | 12:51 | |
| dstanek | henrynash: what happens if you have a token scoped to a project X valid for some long period of time; then X is turned into an is_domain project with X as a sub-project? will the user be getting access to the sub-project now? | 12:51 |
| henrynash | dstanek: in which case you would be able to get a domain scoped token for it | 12:51 |
| henrynash | dstanek: is_domain is immuatble | 12:52 |
| chenhong | dstanek: hi, thanks for you review. | 12:52 |
| henrynash | dstanek: i.e. one is set to either true or false, you can’t change it…there is no ability to “upgrade” a project toa domain | 12:52 |
| dstanek | henrynash: what will that existing token be scope to? | 12:53 |
| chenhong | dstanek: I think add one extra utils class for assignment related test is a good idea. What do you think about the class name AssignmentTestMixin? | 12:54 |
| henrynash | dtsanek: sorry, not sure i follow…. | 12:54 |
| *** jsavak has joined #openstack-keystone | 12:54 | |
| dstanek | chenhong: i'd take out the 'Test'' from the name | 12:55 |
| henrynash | dstanek: btw, I agree with you on teh V2 point… | 12:56 |
| dstanek | henrynash: hmmm...misspoke. i was typing and thinking two different things at the same time | 12:56 |
| henrynash | dstanek: a dangerous thing to do….think and type | 12:57 |
| dstanek | henrynash: i mean existing scripts/things would now be broken since they have to know they are looking for a domain | 12:57 |
| openstackgerrit | jiaxi proposed openstack/keystone: Invalid URLs are not suppressed when create endpoint https://review.openstack.org/200512 | 12:57 |
| dstanek | they'll successfully get a token scope to the wrong thing - how would they know? | 12:57 |
| chenhong | dstanek: I just follow the name AuthTestMixin. Is it clear to have a Test in the name? AssignmentMixin or AssignmentTestMixin, I prefer to the second one. | 12:58 |
| dstanek | henrynash: since you must hear me i'll stop thinking | 12:58 |
| henrynash | dstanek: well. no, since if they are after teh domain the would have to be explictly asking for a domain scoped token…and this works exactly as it does now….if they are lookig for project they ONLY expect a regualr project | 12:58 |
| dstanek | henrynash: right, but in my example the admin changed X to a domain and created another X project under it. | 12:59 |
| *** amakarov_away is now known as amakarov | 12:59 | |
| henrynash | dstanek: so, to do that, they wold have to first delete X and re-create | 13:00 |
| henrynash | dtsanek: in which case all the assignment will be deleted as well | 13:00 |
| henrynash | dstanek: since is_domain is immuatble | 13:00 |
| *** raildo_ has joined #openstack-keystone | 13:01 | |
| *** hrou has joined #openstack-keystone | 13:01 | |
| *** jdandrea has joined #openstack-keystone | 13:02 | |
| dstanek | henrynash: hmm...ok. i didn't know that. in doing that they'd lose access to their cloud resources anyway. | 13:02 |
| dstanek | henrynash: i'll un-object to that part. do you know if we document this behavior anywhere? | 13:04 |
| henrynash | dstanek: I think the API species is_domain is immuatble | 13:05 |
| *** richm has joined #openstack-keystone | 13:06 | |
| *** Pawel__ has quit IRC | 13:08 | |
| *** jsavak has quit IRC | 13:08 | |
| *** cloudnull has joined #openstack-keystone | 13:09 | |
| *** jamielennox is now known as jamielennox|away | 13:09 | |
| dstanek | henrynash: is there any reason to allow project scoping to a domain at all? | 13:12 |
| henrynash | dstanek: so that we can get rid of doamin scoped tokens!!! | 13:12 |
| *** arunkant has joined #openstack-keystone | 13:13 | |
| henrynash | dstanek: See: https://review.openstack.org/#/c/193543/ | 13:13 |
| dstanek | henrynash: but you lose the ability to scope to it if you have a sub-project with the same name right? | 13:13 |
| henrynash | dtsanek: scoping by name, yes, you can setill scope by ID | 13:14 |
| dstanek | henrynash: haha, ok. this is why everyone yells at me when i tell them i work on keystone. | 13:16 |
| henrynash | dstanek: and my goal is so that people yell at you less.... | 13:16 |
| *** jsavak has joined #openstack-keystone | 13:16 | |
| *** stevemar has joined #openstack-keystone | 13:16 | |
| dstanek | henrynash: i appreciate that! | 13:17 |
| henrynash | dstanek: :-) | 13:17 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Centralizing build_role_assignment_* functions https://review.openstack.org/197184 | 13:17 |
| chenhong | dstanek: I just submit a new patchset. Can you take a look at it now? | 13:19 |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 13:19 |
| *** fhubik has quit IRC | 13:20 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Standardize documentation at Service Managers https://review.openstack.org/158094 | 13:20 |
| samueldmq | bknudson: ^ addressed your comments in this centenary patch :) | 13:20 |
| samueldmq | henrynash: cc ^ | 13:20 |
| *** radez_g0n3 is now known as radez | 13:21 | |
| *** TheIntern has joined #openstack-keystone | 13:22 | |
| samueldmq | dstanek: do you know why all our tests are under a 'unit' directory if most of them aren't unit tests ? | 13:22 |
| dstanek | samueldmq: they are not unit tests according to the classical definition, but they are what we consider to be unit tests | 13:23 |
| *** fhubik has joined #openstack-keystone | 13:23 | |
| dstanek | the exception is the V3 style tests where we spin up a server - those will eventually turn into something else | 13:24 |
| samueldmq | dstanek: hmm, and what we consider to be unit tests ? is there any documentation about them ? | 13:24 |
| dstanek | samueldmq: lets say small, semi-isolated tests | 13:24 |
| chenhong | sameuldmq: I'm curious, too. It's hard to write purely unit test case, now. hah | 13:25 |
| samueldmq | chenhong: :-) | 13:25 |
| dstanek | chenhong: it's not hard because of our existing tests though, it's hard because of our existing code | 13:25 |
| samueldmq | dstanek: some time ago I was looking more at our tests .. I think they could be re-organized | 13:26 |
| dstanek | it's not really designed in a modular way, but we've been moving that way slowly | 13:26 |
| samueldmq | dstanek: like some files are too big, etc | 13:26 |
| samueldmq | dstanek: yeah, we're a big project, getting better every day :) | 13:26 |
| *** gordc has quit IRC | 13:28 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Invalid URLs are not suppressed when create endpoint https://review.openstack.org/200512 | 13:28 |
| chenhong | dsstanek: yes, it's hard to isolate code logic. I know we have a spec about functional test. | 13:28 |
| *** raildo has quit IRC | 13:28 | |
| *** aix has quit IRC | 13:29 | |
| *** fhubik has quit IRC | 13:30 | |
| *** raildo_ has quit IRC | 13:30 | |
| *** raildo has joined #openstack-keystone | 13:30 | |
| *** lufix3 has quit IRC | 13:32 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 13:33 |
| *** woodster_ has joined #openstack-keystone | 13:36 | |
| *** arunkant has quit IRC | 13:36 | |
| samueldmq | ayoung: would you be OK if I created another BP to dinamic-policies-delivery ? | 13:38 |
| samueldmq | ayoung: this would only contain the subset of things we're addressing in L (the dynamic delivery, ofc) :-) | 13:39 |
| ayoung | samueldmq, go for it | 13:39 |
| samueldmq | ayoung: thanks ... I think people people will be less scared than looking and seeing just dynamic-policy, which is much more general | 13:40 |
| samueldmq | ayoung: btw, did you see my patch to oslo.policy ? that was simples than I thought | 13:40 |
| ayoung | samueldmq, not yet....we have a bit of a fire going on here | 13:40 |
| *** arunkant has joined #openstack-keystone | 13:40 | |
| samueldmq | ayoung: sure, get your fire extinguisher and good luck sir ! o/ | 13:41 |
| *** mylu has joined #openstack-keystone | 13:42 | |
| *** kiran-r has joined #openstack-keystone | 13:44 | |
| *** henrynash has quit IRC | 13:45 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Centralizing build_role_assignment_* functions https://review.openstack.org/197184 | 13:46 |
| *** henrynash has joined #openstack-keystone | 13:46 | |
| *** ChanServ sets mode: +v henrynash | 13:46 | |
| openstackgerrit | Chenhong Liu proposed openstack/keystone: Add testcases for list_role_assignments of v3 domains https://review.openstack.org/187899 | 13:47 |
| dstanek | well, today is a vacation day for me so i should start acting like i'm on vacation | 13:48 |
| chenhong | dstanek: I update the changes. https://review.openstack.org/197184 and https://review.openstack.org/#/c/187899/ . Please add them to your review list. | 13:49 |
| chenhong | dstanek: Enjoy your vacation. | 13:49 |
| *** afazekas has quit IRC | 13:53 | |
| *** gordc has joined #openstack-keystone | 13:56 | |
| *** aix has joined #openstack-keystone | 13:59 | |
| *** jsavak has quit IRC | 14:02 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 14:04 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:05 | |
| *** annasort has joined #openstack-keystone | 14:05 | |
| dolphm | dstanek: vacation harderer | 14:05 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:05 | |
| sigmavirus24 | I second dolphm's suggestion dstanek | 14:06 |
| dstanek | dolphm: i keep seeing reviews i want to comment on! | 14:06 |
| dolphm | dstanek: yeah, you're doing the vacation thing completely wrong | 14:06 |
| *** mestery has quit IRC | 14:07 | |
| dstanek | dolphm: no surprise there. my 13yo says i do everything wrong | 14:07 |
| sigmavirus24 | dstanek: "sudo echo "::1 review.openstack.org" >> /etc/hosts" | 14:07 |
| sigmavirus24 | dstanek: 13 year olds are usually correct | 14:07 |
| dstanek | sigmavirus24: IME it doesn't even matter :-) | 14:09 |
| *** fangzhou has joined #openstack-keystone | 14:09 | |
| sigmavirus24 | dstanek: how do you mean? | 14:09 |
| sigmavirus24 | dolphm: here's an idea: Temporarily remove dstanek from the keystone-core gerrit group | 14:09 |
| sigmavirus24 | That way all he can do is +/- 1 | 14:10 |
| dolphm | vacation mode! | 14:10 |
| *** chenhong has left #openstack-keystone | 14:10 | |
| *** chenhong has joined #openstack-keystone | 14:10 | |
| dstanek | ...or...you can help me figure out how to make a google docs template so i can get away from my computer! | 14:10 |
| *** kiran-r has quit IRC | 14:10 | |
| dstanek | i can't find the 'submit to template gallery' in the new interface | 14:11 |
| dolphm | google docs supports templates? | 14:11 |
| *** chenhong has quit IRC | 14:11 | |
| *** chenhong has joined #openstack-keystone | 14:11 | |
| dstanek | it did in 2013 before the redesign. event their docs say the old way to do things | 14:11 |
| bknudson | did they finally add the ribbon interface? | 14:11 |
| *** mylu has quit IRC | 14:11 | |
| dstanek | what's the ribbon interface? | 14:14 |
| *** mylu has joined #openstack-keystone | 14:14 | |
| bknudson | dstanek: https://www.google.com/search?q=microsoft+word+ribbon&tbm=isch&imgil=i7kBfUYW3UYQlM%253A%253BFlGt2zwKqvMscM%253Bhttps%25253A%25252F%25252Fmsdn.microsoft.com%25252Fen-us%25252Flibrary%25252Fwindows%25252Fdesktop%25252Fdn742393%28v%2525253Dvs.85%29.aspx&source=iu&pf=m&fir=i7kBfUYW3UYQlM%253A%252CFlGt2zwKqvMscM%252C_&biw=1784&bih=897&usg=__XBrnz268oVveXpJfmQkMJ24v9ow%3D&ved=0CCgQyjc&ei=fdOfVcPtMpb6oQTE5rqoBg#imgrc | 14:15 |
| *** jsavak has joined #openstack-keystone | 14:15 | |
| bknudson | https://msdn.microsoft.com/en-us/library/windows/desktop/dn742393%28v=vs.85%29.aspx | 14:16 |
| dstanek | gdocs isn't nearly as complicated or crowded | 14:17 |
| *** diabloneo has joined #openstack-keystone | 14:17 | |
| diabloneo | dstanek: https://drive.google.com/templates?view=author | 14:17 |
| diabloneo | dstanek: you can find a link 'Submit a template', I hope this can help you. | 14:17 |
| bknudson | not yet. | 14:17 |
| *** chenhong has quit IRC | 14:17 | |
| dstanek | diabloneo: no button for me :-( | 14:18 |
| dstanek | diabloneo: the old way was to select the file in the fist and the more menu had a 'submit a template' option | 14:19 |
| *** diabloneo has quit IRC | 14:19 | |
| *** gordc has quit IRC | 14:19 | |
| *** chenhong has joined #openstack-keystone | 14:20 | |
| chenhong | dstanek: https://drive.google.com/templates?view=author | 14:20 |
| chenhong | dstanek: you can find a link 'Submit a template', I hope this can help you. | 14:20 |
| bknudson | dstanek: The page says "You haven't submitted any templates to the gallery yet. Submit a template" | 14:21 |
| bknudson | and there's also "Submit a template" in the upper-right | 14:21 |
| *** jistr is now known as jistr|mtg | 14:22 | |
| dstanek | maybe my domain has some bit turned off because there's no way to submit | 14:22 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Project tree deletion https://review.openstack.org/148730 | 14:23 |
| bknudson | dstanek: what does the page say? just "You haven't submitted any templates to the gallery yet." ? | 14:23 |
| dstanek | bknudson: yes | 14:23 |
| *** afazekas has joined #openstack-keystone | 14:25 | |
| *** btully has joined #openstack-keystone | 14:25 | |
| *** gordc has joined #openstack-keystone | 14:25 | |
| dstanek | bknudson: more specifically https://www.dropbox.com/s/fzf107xppbqm479/Screenshot%202015-07-10%2010.25.20.png?dl=0 | 14:25 |
| *** kiran-r has joined #openstack-keystone | 14:25 | |
| bknudson | Mine has different tabs. I've got "My Templates" | 14:26 |
| chenhong | dstanek: I have three tabs, Public Templates Templates I've used, My Templates | 14:27 |
| chenhong | bknudson: Mine is like yours. | 14:27 |
| *** chenhong has quit IRC | 14:29 | |
| *** mylu has quit IRC | 14:30 | |
| *** fangzhou has quit IRC | 14:38 | |
| dstanek | thanks for the help everyone. seems like my domain is messed up. but the domain for my wife's non-profit is fine, which is why i was doing this anyway | 14:39 |
| *** kiran-r has quit IRC | 14:39 | |
| *** mylu has joined #openstack-keystone | 14:39 | |
| *** dims has quit IRC | 14:40 | |
| *** mylu has quit IRC | 14:40 | |
| *** mylu has joined #openstack-keystone | 14:44 | |
| *** gordc has quit IRC | 14:45 | |
| *** markvoelker has quit IRC | 14:48 | |
| *** fifieldt has quit IRC | 14:49 | |
| *** gordc has joined #openstack-keystone | 14:50 | |
| *** jecarey has joined #openstack-keystone | 14:50 | |
| *** chlong is now known as chlong-weekend | 14:54 | |
| *** fangzhou has joined #openstack-keystone | 14:56 | |
| *** jkomg has joined #openstack-keystone | 14:57 | |
| *** jsavak has quit IRC | 15:02 | |
| *** mflobo has quit IRC | 15:03 | |
| *** jsavak has joined #openstack-keystone | 15:04 | |
| *** geoffarnold has joined #openstack-keystone | 15:05 | |
| *** dims has joined #openstack-keystone | 15:07 | |
| *** dims_ has joined #openstack-keystone | 15:07 | |
| *** alex_xu has quit IRC | 15:08 | |
| *** geoffarnold has quit IRC | 15:08 | |
| *** alex_xu has joined #openstack-keystone | 15:10 | |
| *** csoukup has joined #openstack-keystone | 15:10 | |
| *** jsavak has quit IRC | 15:11 | |
| *** csoukup has quit IRC | 15:11 | |
| *** geoffarnold has joined #openstack-keystone | 15:11 | |
| *** dims has quit IRC | 15:11 | |
| *** mestery has joined #openstack-keystone | 15:14 | |
| *** r-daneel has joined #openstack-keystone | 15:16 | |
| morganfainberg | Wait dstanek is on vacation?! | 15:18 |
| * morganfainberg glares him off IRC. | 15:18 | |
| *** browne has joined #openstack-keystone | 15:19 | |
| *** ig0r__ has joined #openstack-keystone | 15:19 | |
| *** ig0r_ has quit IRC | 15:22 | |
| *** anhhuynx has joined #openstack-keystone | 15:23 | |
| *** jsavak has joined #openstack-keystone | 15:23 | |
| *** fangzhou has quit IRC | 15:25 | |
| *** chlong-weekend has quit IRC | 15:26 | |
| *** e0ne is now known as e0ne_ | 15:28 | |
| *** e0ne_ is now known as e0ne | 15:29 | |
| *** jistr|mtg is now known as jistr | 15:30 | |
| *** hrou has quit IRC | 15:38 | |
| *** sp4wnr0ot_ has quit IRC | 15:38 | |
| *** diazjf has joined #openstack-keystone | 15:40 | |
| *** ajayaa has quit IRC | 15:42 | |
| anhhuynx | dstanek: Can the API accept more than one query currently? | 15:51 |
| anhhuynx | dstanek: Whenever I tried to pass more than two queries to the API it just omits the second one | 15:52 |
| *** rwsu has joined #openstack-keystone | 15:52 | |
| *** jistr has quit IRC | 15:55 | |
| *** jkomg has quit IRC | 15:55 | |
| morganfainberg | anhhuynx: what do you mean more than one query? And dstanek is on vacation today. Someone else here will probably be able to answer for you :) | 15:57 |
| anhhuynx | oh ok :) | 15:57 |
| *** bdossant has quit IRC | 15:57 | |
| anhhuynx | morganfainberg: so when I do /v3/user?name="blah"&enabled="true" it will not take the second query enabled | 15:58 |
| anhhuynx | it will always omit it | 15:58 |
| anhhuynx | this is GET btw | 15:58 |
| morganfainberg | Oh. Hmm that might be a bug in the filtering code then. | 15:58 |
| morganfainberg | If you switch the request is name omitted? | 15:58 |
| *** chenhong has joined #openstack-keystone | 15:58 | |
| anhhuynx | then enabled will be accepted but not name | 15:58 |
| morganfainberg | Just confirming | 15:58 |
| morganfainberg | Making sure enabled wasnt acting special. | 15:59 |
| anhhuynx | i've tried this with credentials also | 15:59 |
| anhhuynx | with different params | 15:59 |
| anhhuynx | but no luck | 15:59 |
| anhhuynx | can you try it too? just to make sure it's not my end | 15:59 |
| samueldmq | does enabled accept "true" with quotes ? | 15:59 |
| morganfainberg | Its likely our query param code has a bug then. | 15:59 |
| anhhuynx | yes, enabled takes a string | 15:59 |
| morganfainberg | anhhuynx: ill need to standup a test environment. What version are you using? | 16:00 |
| samueldmq | morganfainberg: I remember to have fixed a bug exactly like this ... let me find the patch | 16:00 |
| morganfainberg | Of keystone that is. | 16:00 |
| *** mylu has quit IRC | 16:00 | |
| morganfainberg | If it is icehouse or earlier, we cant fix it :(. Since those are EOL. | 16:00 |
| anhhuynx | I'm using Liberty | 16:00 |
| anhhuynx | and devstack | 16:00 |
| morganfainberg | Ok cool. | 16:01 |
| morganfainberg | anhhuynx: feel free to open a bug on this and link it here. We can do some testing and confirm. Adding your results will help too. | 16:01 |
| anhhuynx | ok | 16:01 |
| morganfainberg | anhhuynx: samueldmq might already have a fix or somethkng close too. Would make it easy ;) | 16:02 |
| *** mylu has joined #openstack-keystone | 16:02 | |
| *** stevemar has quit IRC | 16:02 | |
| anhhuynx | hopefully :) | 16:02 |
| samueldmq | morganfainberg: anhhuynx found it .. | 16:03 |
| samueldmq | https://review.openstack.org/#/c/161702/ | 16:03 |
| morganfainberg | Paste the link to the bug here in channel once you open it. | 16:03 |
| morganfainberg | Orrrr | 16:03 |
| samueldmq | fixing but https://bugs.launchpad.net/keystone/+bug/1424745 | 16:03 |
| openstack | Launchpad bug 1424745 in Keystone "SQL/LDAP are not able to honor multiple filters in driver_hints.Hints()" [Medium,Fix released] - Assigned to Samuel de Medeiros Queiroz (samueldmq) | 16:03 |
| *** lhcheng has joined #openstack-keystone | 16:03 | |
| morganfainberg | Hmm | 16:03 |
| *** ChanServ sets mode: +v lhcheng | 16:03 | |
| morganfainberg | That shpuld be in liberty | 16:03 |
| morganfainberg | Ok we might need to revisit | 16:03 |
| morganfainberg | anhhuynx: lets get a new bug, reference the old one and paste your duplication / results. | 16:04 |
| morganfainberg | We can dig into it. | 16:04 |
| anhhuynx | alright | 16:04 |
| morganfainberg | You can just say "this looks like a repeat of bug xxxx" | 16:05 |
| samueldmq | ++ | 16:05 |
| morganfainberg | It might be something different. | 16:05 |
| *** browne has quit IRC | 16:05 | |
| anhhuynx | https://bugs.launchpad.net/keystone/+bug/1473489 | 16:06 |
| openstack | Launchpad bug 1473489 in Keystone "Identity API v3 does not accept more than one query" [Undecided,New] | 16:07 |
| samueldmq | anhhuynx: thanks | 16:07 |
| anhhuynx | man, my original low hanging fruit bug sure has blown out of proportion ;) | 16:07 |
| morganfainberg | Lol. Its always a rabbithole you end up going down. | 16:08 |
| morganfainberg | And then you look around and wonder how you got there. | 16:08 |
| anhhuynx | haha | 16:08 |
| anhhuynx | how should I go about investigating this? | 16:09 |
| *** mgarza has joined #openstack-keystone | 16:09 | |
| *** amaretskiy has left #openstack-keystone | 16:10 | |
| *** e0ne has quit IRC | 16:11 | |
| samueldmq | anhhuynx: get the code, run the tests .. see tests in test_v3_filters | 16:11 |
| samueldmq | anhhuynx: you could create a test that exposes this bug | 16:11 |
| *** mylu has quit IRC | 16:15 | |
| chenhong | hi, I got a jenkins check failed whose name is check-tempest-dsvm-full. Any one know why? | 16:15 |
| *** hrou has joined #openstack-keystone | 16:23 | |
| samueldmq | dstanek: what do I need to run functional tests tox env ? | 16:24 |
| samueldmq | dstanek: does it need something pre-installed ? (a devstack in the current machine ?) | 16:24 |
| *** chenhong_ has joined #openstack-keystone | 16:24 | |
| samueldmq | dstanek: or simply 'tox -efunctional' | 16:24 |
| *** ankita_wagh has joined #openstack-keystone | 16:25 | |
| anhhuynx | isn't dstanek on vacation today? | 16:26 |
| *** chenhong has quit IRC | 16:26 | |
| samueldmq | anhhuynx: dunno, I should not disturb him if that is true :) | 16:27 |
| anhhuynx | morganfainberg said he is | 16:28 |
| *** chenhong_ has quit IRC | 16:28 | |
| samueldmq | dstanek: enjoy your vacation! o/ | 16:29 |
| *** markvoelker has joined #openstack-keystone | 16:31 | |
| *** fangzhou has joined #openstack-keystone | 16:31 | |
| *** mylu has joined #openstack-keystone | 16:32 | |
| *** chenhong has joined #openstack-keystone | 16:32 | |
| anhhuynx | what is a functional test vs a unit test? | 16:32 |
| bknudson | anhhuynx: functional tests run against a running keystone (for example, running under devstack) | 16:33 |
| bknudson | you should also be able to run the functional tests against a production deployment. | 16:33 |
| *** mestery has quit IRC | 16:34 | |
| anhhuynx | thank you | 16:34 |
| anhhuynx | samueldmq: there is a test_multiple_filters in here | 16:36 |
| samueldmq | anhhuynx: yes but in the setup it's running, possibly it isn't testing things correctly | 16:37 |
| samueldmq | anhhuynx: I mean ... it filters by name + enabled | 16:38 |
| anhhuynx | i see that it does /domain?enabled&name="xxx" | 16:38 |
| samueldmq | anhhuynx: but if there is only that user with such name, and it's enabled, we aren't testing anything :( | 16:38 |
| anhhuynx | but | 16:38 |
| anhhuynx | but the thing is | 16:39 |
| anhhuynx | if you try doing /v3/domain?enabled="true"&name="blah" it won't work i think | 16:39 |
| anhhuynx | i'll try that now actually | 16:39 |
| *** mylu has quit IRC | 16:40 | |
| *** mylu has joined #openstack-keystone | 16:41 | |
| chenhong | morganfainberg: do you know about check-tempest-dsvm-full job in jenkins? | 16:45 |
| *** dims_ has quit IRC | 16:46 | |
| *** tqtran has joined #openstack-keystone | 16:46 | |
| *** _cjones_ has joined #openstack-keystone | 16:46 | |
| morganfainberg | Uhm? What about it chenhong? | 16:46 |
| *** dims has joined #openstack-keystone | 16:46 | |
| *** dims has quit IRC | 16:47 | |
| *** dims has joined #openstack-keystone | 16:47 | |
| chenhong | morganfainberg: One of my change can not pass jenkins test, failed in 'check-tempest-dsvm-full' | 16:47 |
| chenhong | morganfainberg: I think it's not caused by my patch set. Do you know why? My change is https://review.openstack.org/#/c/197184/ | 16:48 |
| morganfainberg | Unlikely to be your change because youre updating tests only. | 16:49 |
| morganfainberg | Might just be a transient error. | 16:49 |
| *** ankita_wagh has quit IRC | 16:50 | |
| chenhong | morganfainberg: Can I trigger jenkins checking by comment a 'recheck' to resolve this? | 16:50 |
| morganfainberg | chenhong: i already triggered a recheck for you | 16:50 |
| morganfainberg | but yes | 16:51 |
| *** stevemar has joined #openstack-keystone | 16:51 | |
| chenhong | morganfainberg: Thanks. You are so nice. | 16:51 |
| morganfainberg | chenhong: happy to help | 16:51 |
| chenhong | morganfainberg: B.T.W, may I ask you to review this change? | 16:52 |
| morganfainberg | chenhong: i'll take a look at it a bit later today. i have some stuff i need to take care of before I get to code review today | 16:52 |
| *** shaleh has joined #openstack-keystone | 16:52 | |
| chenhong | morganfainberg: Thank you very much. | 16:53 |
| chenhong | It's midnight in China and I'm going to sleep. Have a good day, everyone. :-) | 16:54 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 16:54 |
| *** chenhong has quit IRC | 16:54 | |
| anhhuynx | samueldmq: it seems like if you do /v3/domains?enabled&name="admin" it won't take name="admin" at all | 16:55 |
| anhhuynx | samuelmq: can you reproduce this on your end? | 16:55 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 16:56 |
| *** gyee has joined #openstack-keystone | 16:57 | |
| *** ChanServ sets mode: +v gyee | 16:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 16:59 |
| *** spandhe has joined #openstack-keystone | 17:00 | |
| *** bitblt has joined #openstack-keystone | 17:01 | |
| *** janonymous has joined #openstack-keystone | 17:10 | |
| *** ankita_wagh has joined #openstack-keystone | 17:14 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Changing excpetion type to ValidationError instead of Forbidden https://review.openstack.org/200295 | 17:14 |
| *** browne has joined #openstack-keystone | 17:16 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Changing exception type to ValidationError instead of Forbidden https://review.openstack.org/200295 | 17:16 |
| openstackgerrit | Merged openstack/keystone: Fixes grammar in the httpd README https://review.openstack.org/200492 | 17:17 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:18 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fixes modules index generated by Sphinx https://review.openstack.org/199724 | 17:25 |
| *** e0ne has joined #openstack-keystone | 17:28 | |
| *** arunkant has quit IRC | 17:29 | |
| *** radez is now known as radez_g0n3 | 17:30 | |
| *** diazjf has quit IRC | 17:31 | |
| *** arunkant has joined #openstack-keystone | 17:32 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 17:35 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 17:36 |
| *** mestery has joined #openstack-keystone | 17:42 | |
| *** mylu has quit IRC | 17:51 | |
| *** mylu has joined #openstack-keystone | 17:52 | |
| *** e0ne has quit IRC | 17:52 | |
| *** raildo_ has joined #openstack-keystone | 17:52 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 17:53 |
| *** e0ne has joined #openstack-keystone | 17:54 | |
| *** e0ne has quit IRC | 17:58 | |
| *** raildo has quit IRC | 17:59 | |
| *** raildo has joined #openstack-keystone | 17:59 | |
| *** tqtran is now known as tqtran-afk | 18:02 | |
| *** geoffarnold has quit IRC | 18:03 | |
| *** raildo_ has quit IRC | 18:09 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 18:09 |
| *** mylu has quit IRC | 18:10 | |
| *** mylu has joined #openstack-keystone | 18:10 | |
| *** boris-42 has quit IRC | 18:12 | |
| *** geoffarnold has joined #openstack-keystone | 18:12 | |
| *** mylu has quit IRC | 18:17 | |
| *** jsavak has quit IRC | 18:19 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 18:20 |
| *** aix has quit IRC | 18:21 | |
| *** jsavak has joined #openstack-keystone | 18:21 | |
| *** vilobhmm has joined #openstack-keystone | 18:26 | |
| *** dims has quit IRC | 18:29 | |
| *** csoukup has joined #openstack-keystone | 18:29 | |
| *** mylu has joined #openstack-keystone | 18:29 | |
| lbragstad | stevemar: ping | 18:31 |
| stevemar | lbragstad: ahoy matey | 18:31 |
| lbragstad | stevemar: happy friday! | 18:31 |
| stevemar | lbragstad: true that | 18:31 |
| lbragstad | stevemar: quick federation + keystone ssl + osc question for you if you have a minute | 18:31 |
| lbragstad | I have two separate keystone nodes up and running, one is the identity provider and the other is the service provider. Both are configured to use ssl. I can confirm the ssl connection is working by passing the cacert for the respective keystone node in curl. | 18:33 |
| lbragstad | like curl --cacert /path/to/cert.pem https://<keystone-sp-ip>/ | 18:34 |
| lbragstad | and I get the version information back, so that's all good | 18:34 |
| lbragstad | now I'm trying to get osc to connect to that same keystone instance | 18:34 |
| stevemar | lbragstad: hmm, never tried federation with ssl and osc | 18:35 |
| lbragstad | stevemar: so, this is what I have exported http://cdn.pasteraw.com/9ar9f4yce5ojvy2fbktct9r9b3kbh4s | 18:35 |
| *** arunkant_ has joined #openstack-keystone | 18:36 | |
| lbragstad | stevemar: so far so good, | 18:36 |
| lbragstad | then I go to use the openstack cli | 18:36 |
| lbragstad | and when I do a 'user list' I get a bunch of http://cdn.pasteraw.com/3anzwzz6hvfkad1p5pry71u3lt9efxd | 18:37 |
| lbragstad | stevemar: any ideas or should I just keep tinkering? | 18:38 |
| stevemar | lbragstad: try adding --debug to see whats going on | 18:38 |
| *** arunkant has quit IRC | 18:39 | |
| *** mylu has quit IRC | 18:40 | |
| lbragstad | stevemar: ahh, EndpointNotFound | 18:40 |
| *** mylu has joined #openstack-keystone | 18:41 | |
| lbragstad | stevemar: it does look like it's trying to use v2 over v3 though | 18:42 |
| gyee | lbragstad, you can try setting OS_IDENTITY_API_VERSION to 3 | 18:45 |
| *** geoffarnold has quit IRC | 18:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Delivering Mechanism https://review.openstack.org/197980 | 18:46 |
| lbragstad | gyee: hey hey! | 18:46 |
| lbragstad | gyee: stevemar that worked! | 18:46 |
| gyee | look like there will be rain in Boston next week | 18:46 |
| gyee | that 0.6 mile walk in the rain is going to feel like a 2 mile walk instead :) | 18:46 |
| *** harlowja_ has quit IRC | 18:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Delivering Mechanism https://review.openstack.org/197980 | 18:49 |
| *** radez_g0n3 is now known as radez | 18:50 | |
| *** harlowja has joined #openstack-keystone | 18:50 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies with Custom IDs https://review.openstack.org/198000 | 18:53 |
| *** mylu has quit IRC | 18:54 | |
| *** mylu has joined #openstack-keystone | 18:54 | |
| *** geoffarnold has joined #openstack-keystone | 18:54 | |
| *** mylu has quit IRC | 18:58 | |
| stevemar | lbragstad: yay | 19:00 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Fetch and Cache https://review.openstack.org/134655 | 19:01 |
| stevemar | gyee: goot cactch with the no OS_IDENTITY_API_VERSION set | 19:01 |
| openstackgerrit | Merged openstack/keystone: Add test showing password logged https://review.openstack.org/193703 | 19:01 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/200675 | 19:03 |
| gyee | stevemar, yay | 19:03 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 19:04 |
| gyee | lbragstad, did you have a patch to fix fernet token time sync issue? | 19:04 |
| lbragstad | gyee: I think morganfainberg had one for that? | 19:04 |
| *** mylu has joined #openstack-keystone | 19:04 | |
| lbragstad | I had a few that needed to be rebased on that once it merged | 19:04 |
| gyee | basically, the sub seconds were left out on validation | 19:04 |
| lbragstad | gyee: I think according to morganfainberg and dolphm it's because the subseconds are included on auth | 19:05 |
| *** d34dh0r53 is now known as th31nt3rn | 19:05 | |
| gyee | lbragstad, I mean issued_at and expires_at | 19:06 |
| *** mylu has quit IRC | 19:06 | |
| gyee | on validation, the sub seconds are rounded to zeros | 19:06 |
| *** mylu has joined #openstack-keystone | 19:07 | |
| lbragstad | gyee: yep | 19:07 |
| lbragstad | gyee: but on auth, they aren't | 19:07 |
| gyee | not sure if I understand, that's token data returned from token validation API | 19:09 |
| gyee | so there shouldn't be inconsistency on those two fields | 19:10 |
| lbragstad | gyee: I'm not 100% I know the right answer, but I thought it was suppose to be that the auth api should round it in the first place | 19:11 |
| lbragstad | I *think*? | 19:11 |
| *** rm_work is now known as rm_work|away | 19:11 | |
| *** dims has joined #openstack-keystone | 19:12 | |
| gyee | lbragstad, let me do some code diving. I would expect the time stamps are embedded in the fernet token ID | 19:12 |
| gyee | and return as is on validation | 19:12 |
| lbragstad | gyee: yep they are | 19:13 |
| lbragstad | gyee: the token creation is actually done by the cryptography library | 19:13 |
| lbragstad | gyee: the token expiration is packed in to the token schema | 19:13 |
| gyee | so the time stampes should be exactly the same on both creation and validation | 19:13 |
| lbragstad | gyee: https://github.com/openstack/keystone/blob/8e7bb573fb2414a4d0253a2d50714ef8cdc6adf3/keystone/token/providers/fernet/token_formatters.py#L339 | 19:14 |
| lbragstad | gyee: yes | 19:14 |
| lbragstad | gyee: but... that can't be because we take the expiration at tmp stamp and convert it to an integer | 19:14 |
| lbragstad | which is where we lose the subsecond calculation | 19:14 |
| gyee | ahhh | 19:14 |
| gyee | I would expect that to be a bug, no? | 19:15 |
| lbragstad | gyee: which is how all of this kinda came into light :) | 19:15 |
| lbragstad | gyee: what part? | 19:15 |
| gyee | loosing the subseconds | 19:15 |
| lbragstad | gyee: I'd probably consider it the other way around, | 19:15 |
| gyee | CADF is matching the entire timestamp right? | 19:16 |
| *** mylu has quit IRC | 19:16 | |
| lbragstad | at least for the fernet provider | 19:16 |
| *** dims has quit IRC | 19:17 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain field in Project Table https://review.openstack.org/157427 | 19:17 |
| *** dims has joined #openstack-keystone | 19:17 | |
| *** ig0r__ has quit IRC | 19:19 | |
| *** ig0r_ has joined #openstack-keystone | 19:19 | |
| *** ankita_wagh has quit IRC | 19:21 | |
| *** mylu has joined #openstack-keystone | 19:23 | |
| *** stevemar has quit IRC | 19:25 | |
| *** stevemar has joined #openstack-keystone | 19:25 | |
| *** raildo has quit IRC | 19:26 | |
| *** ankita_w_ has joined #openstack-keystone | 19:26 | |
| *** raildo has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Solomon proposed openstack/keystone: Adds script that checks for etc/keystone.conf https://review.openstack.org/199758 | 19:26 |
| *** topol has joined #openstack-keystone | 19:29 | |
| *** ChanServ sets mode: +v topol | 19:29 | |
| gyee | lbragstad, you saying we should round the subseconds at token creation time? I am fine with that too so as long as they are consistent | 19:30 |
| *** ankita_wagh has joined #openstack-keystone | 19:33 | |
| *** raildo has quit IRC | 19:33 | |
| bknudson | your token will be valid before the current time | 19:34 |
| bknudson | that seems strange | 19:34 |
| *** annasort has quit IRC | 19:35 | |
| lbragstad | gyee: same here | 19:35 |
| lbragstad | gyee: maybe we can bring it up at the meetup? | 19:35 |
| gyee | yeah | 19:36 |
| *** raildo has joined #openstack-keystone | 19:36 | |
| gyee | lets make them consistent | 19:36 |
| *** ankita_w_ has quit IRC | 19:36 | |
| *** odyssey4me has quit IRC | 19:37 | |
| gyee | bknudson, actually it won't be a problem if we always round them down | 19:38 |
| pgbridge | i have probably a very confused question, mind if i ask y'all here? | 19:38 |
| bknudson | if you round the issued_at time down then the service could get a token that's issued_at before the current time. | 19:39 |
| bknudson | if it takes < 1 second | 19:39 |
| bknudson | oh, wait, that's normal | 19:39 |
| gyee | right, should work | 19:40 |
| bknudson | btw - we also have to consider revocation events | 19:40 |
| gyee | revocation events is also based on cut off time | 19:40 |
| pgbridge | eh nm | 19:40 |
| bknudson | since revocation event might have issued_after | 19:40 |
| gyee | right, issued_after should work fine if we round them down | 19:40 |
| bknudson | if it's issued_after time 1:15.5 and the token has issued_at 1:15 | 19:41 |
| bknudson | then it won't be revoked | 19:41 |
| openstackgerrit | Merged openstack/keystone: Tests for correct key removed https://review.openstack.org/194388 | 19:41 |
| *** jsavak has quit IRC | 19:41 | |
| openstackgerrit | Merged openstack/keystone: Simplify fernet rotation code https://review.openstack.org/194335 | 19:41 |
| bknudson | it must be issued_before in revocation events | 19:41 |
| bknudson | so that would be fine, too | 19:41 |
| gyee | yeah | 19:41 |
| bknudson | unless the revocation events are truncated too ? | 19:42 |
| gyee | I hope not, they should be token format agnostic | 19:43 |
| *** raildo_ has joined #openstack-keystone | 19:44 | |
| *** th31nt3rn is now known as d34dh0r53 | 19:45 | |
| *** topol is now known as topol_oldme | 19:46 | |
| *** fangzhou has quit IRC | 19:47 | |
| *** topol has joined #openstack-keystone | 19:48 | |
| *** ChanServ sets mode: +v topol | 19:48 | |
| *** topol_oldme has quit IRC | 19:49 | |
| *** jsavak has joined #openstack-keystone | 19:54 | |
| *** topol has quit IRC | 19:54 | |
| *** topol has joined #openstack-keystone | 19:54 | |
| *** ChanServ sets mode: +v topol | 19:54 | |
| *** topol has quit IRC | 19:58 | |
| *** topol has joined #openstack-keystone | 19:58 | |
| *** ChanServ sets mode: +v topol | 19:58 | |
| *** rwsu has quit IRC | 19:58 | |
| *** Kupo24z has joined #openstack-keystone | 19:58 | |
| *** geoffarnold has quit IRC | 19:59 | |
| Kupo24z | Hey all, does keystone currently support redis cache backend? I've seen this https://blueprints.launchpad.net/keystone/+spec/redis-storage-backend but its not implemented | 19:59 |
| *** geoffarnold has joined #openstack-keystone | 19:59 | |
| *** gordc has quit IRC | 20:00 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Separate the fetch and validate parts of auth_token https://review.openstack.org/190940 | 20:02 |
| *** jecarey has quit IRC | 20:04 | |
| *** jsavak has quit IRC | 20:04 | |
| *** jsavak has joined #openstack-keystone | 20:05 | |
| *** mylu has quit IRC | 20:07 | |
| *** topol has quit IRC | 20:08 | |
| *** topol has joined #openstack-keystone | 20:08 | |
| *** ChanServ sets mode: +v topol | 20:08 | |
| *** harlowja has quit IRC | 20:09 | |
| *** harlowja has joined #openstack-keystone | 20:09 | |
| *** topol has quit IRC | 20:09 | |
| *** topol_oldme has joined #openstack-keystone | 20:10 | |
| *** ChanServ sets mode: +v topol_oldme | 20:10 | |
| *** topol_oldme is now known as topol | 20:10 | |
| *** mylu has joined #openstack-keystone | 20:10 | |
| *** topol has quit IRC | 20:11 | |
| *** Kiall has quit IRC | 20:11 | |
| *** Kiall has joined #openstack-keystone | 20:12 | |
| *** topol has joined #openstack-keystone | 20:12 | |
| *** topol is now known as Guest13637 | 20:12 | |
| *** bitblt has quit IRC | 20:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/200675 | 20:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 20:21 |
| *** Guest13637 has quit IRC | 20:21 | |
| *** amakarov has quit IRC | 20:21 | |
| *** harry51s has joined #openstack-keystone | 20:26 | |
| openstackgerrit | Merged openstack/keystone: Decouple notifications from DI https://review.openstack.org/162769 | 20:28 |
| openstackgerrit | Merged openstack/keystone: Removed optional dependency support https://review.openstack.org/162770 | 20:29 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Federation API provides method to evaluate rules https://review.openstack.org/196308 | 20:32 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move constants out of federation.core https://review.openstack.org/200706 | 20:32 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Federation API provides method to evaluate rules https://review.openstack.org/196308 | 20:34 |
| *** crc32 has joined #openstack-keystone | 20:40 | |
| *** fangzhou has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 20:46 |
| *** topol has joined #openstack-keystone | 20:46 | |
| *** ChanServ sets mode: +v topol | 20:46 | |
| *** crc32 has quit IRC | 20:49 | |
| *** crc32 has joined #openstack-keystone | 20:50 | |
| *** rm_work|away is now known as rm_work | 20:53 | |
| *** topol has quit IRC | 20:56 | |
| *** htruta has quit IRC | 20:57 | |
| *** topol has joined #openstack-keystone | 20:57 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 20:57 |
| *** topol is now known as Guest22240 | 20:58 | |
| *** mylu has quit IRC | 20:58 | |
| *** mylu has joined #openstack-keystone | 20:58 | |
| *** Guest22240 has quit IRC | 21:00 | |
| *** blewis has joined #openstack-keystone | 21:00 | |
| -openstackstatus- NOTICE: Gerrit will be unavailable from 22:00 to 22:30 UTC for project renames | 21:02 | |
| *** gabriel-bezerra has quit IRC | 21:10 | |
| *** ig0r_ has quit IRC | 21:10 | |
| *** iurygregory has quit IRC | 21:12 | |
| *** samueldmq has quit IRC | 21:12 | |
| *** ericksonsantos has quit IRC | 21:12 | |
| *** raildo has quit IRC | 21:12 | |
| *** tellesnobrega has quit IRC | 21:12 | |
| *** raildo_ has quit IRC | 21:13 | |
| openstackgerrit | guang-yee proposed openstack/python-keystoneclient: Change default endpoint type for Keystone v3 to 'public' https://review.openstack.org/185200 | 21:17 |
| browne | Fernet token question: i ran tempest on a kilo keystone (installed from ubuntu packages) and several of the negative tests that verify unauthorized after a token is revoked fail. any clues on this? | 21:17 |
| *** mylu has quit IRC | 21:17 | |
| browne | like test_delete_role_request_without_token | 21:18 |
| browne | it behaves as if the token is not revoked. gets a 204 instead of Unauthorized | 21:19 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Clean up notifications type checking https://review.openstack.org/200733 | 21:19 |
| *** solomondg has joined #openstack-keystone | 21:19 | |
| *** jsavak has quit IRC | 21:24 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Clean up code to use .items() https://review.openstack.org/200734 | 21:27 |
| *** tqtran-afk has quit IRC | 21:30 | |
| bknudson | browne: you can also see https://review.openstack.org/#/c/195780/ | 21:35 |
| bknudson | same failures? | 21:36 |
| browne | let me see | 21:36 |
| *** stevemar has quit IRC | 21:36 | |
| *** hrou has quit IRC | 21:38 | |
| browne | bknudson: yes, it does look like at least test_list_roles_request_without_token was the same error. Is this a known issue? | 21:39 |
| bknudson | browne: it is now! | 21:39 |
| browne | ha | 21:39 |
| browne | bknudson: will you open a bug or should i? | 21:40 |
| bknudson | browne: I haven't had a chance to open a bug. | 21:40 |
| bknudson | browne: if you're planning to work on it go ahead and open the bug | 21:41 |
| gyee | critical! | 21:42 |
| bknudson | otherwise it's on my todo list | 21:42 |
| bknudson | IMO fernet tokens are experimental at this point anyways | 21:42 |
| browne | bknudson: i'll open the bug and whoever fixes it first is welcome to it | 21:42 |
| bknudson | so not critical | 21:42 |
| *** rwsu has joined #openstack-keystone | 21:43 | |
| browne | bknudson: do we label fernet as experimental anywhere. just want to know whether i'm using something too bleeding edge | 21:43 |
| gyee | bknudson, revocation is broken is not critical? | 21:43 |
| *** henrynash has quit IRC | 21:44 | |
| bknudson | browne: if it's not labeled as experimental then that's a critical bug. | 21:44 |
| bknudson | gyee: if revocation was broken then that would be critical since we support and test revocation | 21:44 |
| gyee | but isn't that's the case here? role deletion does not constitute revocation | 21:45 |
| bknudson | gyee: revocation for fernet tokens isn't critical since fernet tokens are experimental | 21:46 |
| *** gabriel-bezerra has joined #openstack-keystone | 21:51 | |
| browne | gyee, bknudson: https://bugs.launchpad.net/keystone/+bug/1473567 | 21:53 |
| openstack | Launchpad bug 1473567 in Keystone "Fernet tokens fail tempest runs" [Undecided,New] | 21:53 |
| gyee | browne, thanks | 21:53 |
| *** edmondsw has quit IRC | 21:53 | |
| *** raildo has joined #openstack-keystone | 21:55 | |
| *** tellesnobrega has joined #openstack-keystone | 21:55 | |
| *** ericksonsantos has joined #openstack-keystone | 21:55 | |
| *** iurygregory has joined #openstack-keystone | 21:55 | |
| -openstackstatus- NOTICE: Gerrit is unavailable from approximately 22:00 to 22:30 UTC for project renames | 21:58 | |
| *** csoukup has quit IRC | 21:58 | |
| *** ChanServ changes topic to "Gerrit is unavailable from approximately 22:00 to 22:30 UTC for project renames" | 21:58 | |
| bknudson | we should change keystone so that you have to shut it down every time you rename something | 21:59 |
| morganfainberg | bknudson: i like it | 21:59 |
| morganfainberg | bknudson: +2+2+A | 21:59 |
| *** solomondg has quit IRC | 22:00 | |
| *** solomondg has joined #openstack-keystone | 22:02 | |
| *** christx2 has quit IRC | 22:06 | |
| gyee | bknudson, FTW! | 22:07 |
| *** harlowja_ has joined #openstack-keystone | 22:09 | |
| *** harlowja has quit IRC | 22:10 | |
| *** samueldmq has joined #openstack-keystone | 22:10 | |
| *** boris-42 has joined #openstack-keystone | 22:15 | |
| solomondg | Quick question: When I copy (line by line) the code from keystone/keystone/cmd/manage.py into the Python2.7 Interactive Prompt, then print dev_conf, it appears to be using /usr/etc/keystone.conf and/or /etc/keystone.conf as the location to the keystone.conf file. Considering that there isn't a keystone.conf in either of those locations, did I confi | 22:16 |
| solomondg | gure something wrong? The only keystone.conf scripts I know of are in etc/keystone/keystone.conf and /opt/stack/keystone/etc/keystone.conf | 22:16 |
| *** anhhuynx has quit IRC | 22:18 | |
| *** radez is now known as radez_g0n3 | 22:22 | |
| *** mgarza has quit IRC | 22:23 | |
| morganfainberg | solomondg: thats a bit weird, but you should be able to specify the config file directory | 22:28 |
| morganfainberg | solomondg: oh you're doing like a pip install? | 22:29 |
| morganfainberg | solomondg: yeah you'll need to specify the location of the config files, but if it's a full devstack, it should put files in /etc/keystone | 22:29 |
| *** ChanServ changes topic to "| Review Code, Specs, Etc | Keystone MidCycle 15, 16, 17 | US Independence Day is observed 7/3 (Friday)" | 22:30 | |
| *** dsirrine has quit IRC | 22:30 | |
| solomondg | morgamfainberg: Huh, okay. Thanks. | 22:31 |
| *** topol has joined #openstack-keystone | 22:39 | |
| *** ChanServ sets mode: +v topol | 22:40 | |
| *** alex_xu has quit IRC | 22:43 | |
| *** alex_xu has joined #openstack-keystone | 22:43 | |
| *** ankita_w_ has joined #openstack-keystone | 22:47 | |
| *** ankita_wagh has quit IRC | 22:47 | |
| *** krykowski has quit IRC | 22:52 | |
| *** krykowski has joined #openstack-keystone | 22:53 | |
| *** dhellmann has quit IRC | 22:54 | |
| *** andreaf has quit IRC | 22:54 | |
| *** navid_ has quit IRC | 22:54 | |
| *** navid_ has joined #openstack-keystone | 22:55 | |
| *** dhellmann has joined #openstack-keystone | 22:56 | |
| *** andreaf has joined #openstack-keystone | 22:57 | |
| *** ntpttr has joined #openstack-keystone | 23:10 | |
| *** josecastroleon has quit IRC | 23:12 | |
| *** dims has quit IRC | 23:13 | |
| *** josecastroleon has joined #openstack-keystone | 23:13 | |
| *** ntpttr has quit IRC | 23:14 | |
| *** dims has joined #openstack-keystone | 23:17 | |
| *** rm_work is now known as rm_work|away | 23:20 | |
| *** gyee has quit IRC | 23:21 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use dict.items() rather than six.iteritems() https://review.openstack.org/200762 | 23:24 |
| *** spandhe has quit IRC | 23:29 | |
| *** TheIntern has quit IRC | 23:36 | |
| *** hrou has joined #openstack-keystone | 23:37 | |
| *** solomondg has quit IRC | 23:38 | |
| *** openstackgerrit has quit IRC | 23:39 | |
| *** openstackgerrit has joined #openstack-keystone | 23:40 | |
| *** shaleh has quit IRC | 23:43 | |
| *** guest123 has joined #openstack-keystone | 23:48 | |
| *** blewis has quit IRC | 23:50 | |
| *** geoffarnold has quit IRC | 23:53 | |
| *** rwsu has quit IRC | 23:54 | |
| *** r-daneel has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
