| *** mylu has quit IRC | 00:02 | |
| *** topol has joined #openstack-keystone | 00:03 | |
| *** ChanServ sets mode: +v topol | 00:03 | |
| *** mylu has joined #openstack-keystone | 00:03 | |
| openstackgerrit | Merged openstack/keystone: Fix for LDAP filter on group search by name https://review.openstack.org/194733 | 00:06 |
|---|---|---|
| *** topol has quit IRC | 00:07 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project name constraints https://review.openstack.org/158372 | 00:08 |
| *** dims_ has joined #openstack-keystone | 00:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/202282 | 00:15 |
| *** amickus has quit IRC | 00:15 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: test_base64utils works with py34 https://review.openstack.org/203853 | 00:17 |
| *** gyee has quit IRC | 00:20 | |
| *** chlong has joined #openstack-keystone | 00:22 | |
| *** tqtran-afk is now known as tqtran | 00:23 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 00:27 | |
| *** adam_g has quit IRC | 00:32 | |
| *** piyanai has quit IRC | 00:33 | |
| *** Nakato_ is now known as Nakato | 00:34 | |
| *** btully has joined #openstack-keystone | 00:40 | |
| *** btully has quit IRC | 00:45 | |
| *** spandhe has quit IRC | 00:53 | |
| *** _cjones_ has quit IRC | 00:55 | |
| *** mylu has quit IRC | 00:58 | |
| *** mylu has joined #openstack-keystone | 01:00 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: test_base64utils works with py34 https://review.openstack.org/203853 | 01:04 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix pemutils for py34 https://review.openstack.org/203892 | 01:04 |
| openstackgerrit | Merged openstack/keystone: Fix docstrings in contrib https://review.openstack.org/203607 | 01:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/202282 | 01:08 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: test_base64utils works with py34 https://review.openstack.org/203853 | 01:13 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix pemutils for py34 https://review.openstack.org/203892 | 01:13 |
| openstackgerrit | Merged openstack/keystone: Additional Fernet test coverage https://review.openstack.org/192739 | 01:16 |
| *** tqtran has quit IRC | 01:17 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/202282 | 01:17 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix test_utils for py34 https://review.openstack.org/203896 | 01:19 |
| *** mylu has quit IRC | 01:20 | |
| *** jiaxi has joined #openstack-keystone | 01:22 | |
| *** rm_work|away is now known as rm_work | 01:22 | |
| *** mestery has quit IRC | 01:29 | |
| *** bitblt has quit IRC | 01:29 | |
| *** ankita_w_ has quit IRC | 01:38 | |
| *** mylu has joined #openstack-keystone | 01:39 | |
| *** browne has quit IRC | 01:40 | |
| *** mylu has quit IRC | 01:40 | |
| *** jdandrea has quit IRC | 01:42 | |
| *** mylu has joined #openstack-keystone | 01:44 | |
| jiaxi | Hello everyone | 01:44 |
| *** jasonsb has quit IRC | 01:47 | |
| jiaxi | Anyone here ? | 01:47 |
| *** mylu has quit IRC | 01:47 | |
| jiaxi | you need to wrap the string here with the _LW i18n helper. | 01:47 |
| jiaxi | What does this mean ? | 01:47 |
| *** mylu has joined #openstack-keystone | 01:47 | |
| jiaxi | What's _LW i18n helper ? | 01:48 |
| jamielennox | jiaxi: it's a translation thing | 01:48 |
| jamielennox | you import from oslo i18n | 01:48 |
| jiaxi | Oh. Thank you | 01:48 |
| jamielennox | if you do log.warning you need to do log.warning(_LW('your message')) so it can be translated | 01:49 |
| jiaxi | jamielennox, Thank you so much. | 01:50 |
| *** stevemar has joined #openstack-keystone | 01:52 | |
| *** ChanServ sets mode: +v stevemar | 01:52 | |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Convert Exceptions to failures. https://review.openstack.org/165908 | 01:52 |
| *** davechen has joined #openstack-keystone | 01:53 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Ensure database options registered for tests https://review.openstack.org/203900 | 01:54 |
| *** davechen1 has joined #openstack-keystone | 02:00 | |
| *** ankita_wagh has joined #openstack-keystone | 02:00 | |
| *** davechen has quit IRC | 02:02 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 02:04 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 02:07 |
| *** woodster_ has quit IRC | 02:12 | |
| openstackgerrit | ayoung proposed openstack/keystone: Specify ID for Project or domain creation https://review.openstack.org/203852 | 02:13 |
| openstackgerrit | Merged openstack/keystonemiddleware: Fix rst https://review.openstack.org/202659 | 02:14 |
| *** fangzhou has quit IRC | 02:14 | |
| *** browne has joined #openstack-keystone | 02:18 | |
| jamielennox | so sick of pbr... | 02:22 |
| *** ayoung has quit IRC | 02:24 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Refactor extract method for offline validation https://review.openstack.org/188650 | 02:27 |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/200512 | 02:28 |
| *** chenhong has joined #openstack-keystone | 02:28 | |
| openstackgerrit | jiaxi proposed openstack/keystone: Suppressing the request when creating endpoint with invalid urls https://review.openstack.org/200512 | 02:32 |
| jiaxi | Anyone who like to exchange review ? | 02:33 |
| *** ankita_wagh has quit IRC | 02:40 | |
| openstackgerrit | Jamie Lennox proposed openstack/python-keystoneclient: Use UUID values in v3 test fixtures https://review.openstack.org/168546 | 02:48 |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** hakimo has quit IRC | 02:55 | |
| *** mylu has quit IRC | 02:58 | |
| *** jasonsb has joined #openstack-keystone | 02:58 | |
| *** dims_ has quit IRC | 03:09 | |
| *** dims_ has joined #openstack-keystone | 03:09 | |
| *** mylu has joined #openstack-keystone | 03:13 | |
| *** lhcheng has quit IRC | 03:15 | |
| *** richm has quit IRC | 03:19 | |
| *** lhcheng has joined #openstack-keystone | 03:24 | |
| *** ChanServ sets mode: +v lhcheng | 03:24 | |
| stevemar | lhcheng: thanks :P | 03:24 |
| stevemar | i can't believe i didn't see that one... | 03:24 |
| lhcheng | stevemar: np :) I got curious about it too and started debugging. | 03:25 |
| *** dims_ has quit IRC | 03:27 | |
| *** dims_ has joined #openstack-keystone | 03:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 03:31 |
| *** krotscheck is now known as krotsche_vaca | 03:32 | |
| stevemar | finally have that one passing tests | 03:33 |
| stevemar | that has not been the easiest of switches | 03:33 |
| *** dims_ has quit IRC | 03:34 | |
| *** henriquetruta has quit IRC | 03:34 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 03:36 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add .settings/ to .gitignore https://review.openstack.org/203910 | 03:36 |
| *** ankita_wagh has joined #openstack-keystone | 03:39 | |
| *** chenhong1 has joined #openstack-keystone | 03:41 | |
| *** chenhong has quit IRC | 03:41 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 03:48 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 03:55 |
| *** lhcheng has quit IRC | 03:59 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 04:01 |
| *** dims_ has joined #openstack-keystone | 04:06 | |
| *** mylu has quit IRC | 04:06 | |
| lbragstad | marekd: I'm able to get a federated unscoped token now with the current playbooks | 04:07 |
| lbragstad | marekd: https://github.com/lbragstad/keystone-deploy/tree/federation | 04:07 |
| lbragstad | marekd: I just pushed all my changes, including the ones you mentioned early | 04:07 |
| *** mylu has joined #openstack-keystone | 04:07 | |
| lbragstad | cc dstanek and dolphm - the latest commit of keystone-deploy's federation branch should give you k2k up to scoping a federated unscoped token (still need to work that part out) | 04:09 |
| *** dims_ has quit IRC | 04:10 | |
| lbragstad | a sampple inventory might look something like http://cdn.pasteraw.com/mtntjattzpbt9165llj02g312mu8t4u - if you have two vms up | 04:10 |
| *** chenhong1 has quit IRC | 04:11 | |
| lbragstad | should be able to run the tests (nosetests test_federation_exercises.py) https://github.com/lbragstad/keystone-deploy/blob/federation/test_federation_exercises.py#L203 which is kind of an abomination at the moment | 04:11 |
| *** chenhong has joined #openstack-keystone | 04:12 | |
| *** dims_ has joined #openstack-keystone | 04:13 | |
| *** davechen1 has quit IRC | 04:13 | |
| *** davechen has joined #openstack-keystone | 04:14 | |
| *** dims_ has quit IRC | 04:18 | |
| *** mylu has quit IRC | 04:22 | |
| *** ankita_wagh has quit IRC | 04:22 | |
| *** ankita_wagh has joined #openstack-keystone | 04:22 | |
| * jamielennox found his ssl bug :) | 04:23 | |
| *** dims_ has joined #openstack-keystone | 04:27 | |
| *** rm_work is now known as rm_work|away | 04:31 | |
| *** rm_work|away is now known as rm_work | 04:33 | |
| davechen | stevemar: hi, | 04:34 |
| davechen | stevemar: Are you around? :) | 04:35 |
| *** dims_ has quit IRC | 04:35 | |
| davechen | stevemar: Just want to confirm with you, is this needed? (https://review.openstack.org/#/c/179767/) | 04:36 |
| *** lhcheng has joined #openstack-keystone | 04:38 | |
| *** ChanServ sets mode: +v lhcheng | 04:38 | |
| *** btully has joined #openstack-keystone | 04:39 | |
| davechen | I did some investigation, the referential integrity is either restricted in the driver layer or in the manager layer, there is no need to change the code logic but the restriction in the DB is not necessary. | 04:39 |
| *** topol has joined #openstack-keystone | 04:46 | |
| *** ChanServ sets mode: +v topol | 04:46 | |
| *** bradjones has quit IRC | 04:50 | |
| *** bradjones has joined #openstack-keystone | 04:52 | |
| *** bradjones has quit IRC | 04:52 | |
| *** bradjones has joined #openstack-keystone | 04:52 | |
| *** topol has quit IRC | 04:54 | |
| *** topol has joined #openstack-keystone | 04:55 | |
| *** ChanServ sets mode: +v topol | 04:55 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint_filter migrations into keystone core https://review.openstack.org/186988 | 05:00 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Move endpoint filter into keystone core https://review.openstack.org/183377 | 05:00 |
| *** dims_ has joined #openstack-keystone | 05:02 | |
| stevemar | davechen: hey hey | 05:02 |
| davechen | stevemar: hi, | 05:03 |
| stevemar | davechen: that patch has me confused because i thought we wanted to get rid of all the on_delete=CASCADE calls | 05:04 |
| davechen | stevemar: why we need to get rid of it? sorry, I didn't catch it | 05:05 |
| davechen | stevemar: does that mean we will drop all of the foreign keys in the SQL? | 05:05 |
| *** ankita_wagh has quit IRC | 05:06 | |
| *** dims_ has quit IRC | 05:06 | |
| stevemar | davechen: we can keep foreign keys, but we shouldn't enforce deletion with on_delete=CASCADE | 05:07 |
| stevemar | we should have the controller/manager perform two delete calls | 05:07 |
| davechen | stevemar: if we not enforce it, it will be `restrict` by default. | 05:07 |
| stevemar | one for the foreign key, and one for the original item | 05:08 |
| stevemar | davechen: why is restrict bad? | 05:08 |
| davechen | yes, I think the controller or manage has been cleaned. :) | 05:08 |
| davechen | stevemar: restrict is not bad, but it seems not necessary, since the logic has been enfored in manager layer or driver layer. | 05:09 |
| davechen | if we want to handle with SQL directly, the DB will refuse you to do it since it has been FK reference. | 05:09 |
| *** topol has quit IRC | 05:09 | |
| *** ankita_wagh has joined #openstack-keystone | 05:10 | |
| davechen | but I not sure if this is appropriate way to manage DB directly. | 05:10 |
| stevemar | davechen: i think what morganfainberg is worried about is that if someone is using a non-SQL backend (mongo) to store this, then the FKs may not be deleted | 05:10 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 05:11 | |
| davechen | stevemar: yep, I cleared all of the entities in the keystone, all of them is enforced either in the manager layer or in the driver layer. | 05:11 |
| stevemar | davechen: right, that's what i thought - so what's the point of 195873 ? it looks like it's introducing a new one? | 05:14 |
| stevemar | s/195873/179767 | 05:14 |
| stevemar | sorry | 05:14 |
| stevemar | it's late :) | 05:14 |
| davechen | stevemar: have a rest, sir | 05:14 |
| stevemar | davechen: nah, lets talk about https://review.openstack.org/#/c/179767 - i haven't been reviewing as much as i should | 05:15 |
| davechen | stevemar: just couple of mins | 05:16 |
| davechen | the point of that patch is just some clean up, it not introduce a new one. | 05:17 |
| stevemar | davechen: sure, so what am I not understanding :) | 05:17 |
| davechen | stevemar: the patch has a long history. | 05:18 |
| davechen | it's from one of your comment from kilo :) | 05:18 |
| *** chenhong1 has joined #openstack-keystone | 05:19 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 05:19 |
| davechen | stevemar: it's not a big deal, update it will let end user to udpate the DB without complain from the DB. | 05:19 |
| davechen | stevemar: and it should okay if we just keep it as is. | 05:19 |
| *** chenhong has quit IRC | 05:20 | |
| davechen | davechen: let me think if there is anything more we should do, if no, we can close the BP as implemented :) | 05:20 |
| stevemar | davechen: is there a bug / error when the DB is updated now? | 05:20 |
| davechen | /think/check | 05:21 |
| stevemar | davechen: think works too :) | 05:21 |
| *** spandhe has joined #openstack-keystone | 05:21 | |
| davechen | stevemar: ah, just in case that there is no one disagree we could manage DB. | 05:21 |
| davechen | :) | 05:21 |
| davechen | but I don't think so. | 05:22 |
| *** dims_ has joined #openstack-keystone | 05:22 | |
| davechen | stevemar: you should take a break, have a good dream. :) | 05:22 |
| *** topol has joined #openstack-keystone | 05:23 | |
| *** ChanServ sets mode: +v topol | 05:23 | |
| *** spandhe_ has joined #openstack-keystone | 05:24 | |
| *** spandhe has quit IRC | 05:26 | |
| *** spandhe_ is now known as spandhe | 05:26 | |
| *** dims_ has quit IRC | 05:26 | |
| *** topol has quit IRC | 05:27 | |
| *** topol has joined #openstack-keystone | 05:27 | |
| *** ChanServ sets mode: +v topol | 05:27 | |
| stevemar | davechen: thanks boss! leave comments in the patch / email if you want to chat about it | 05:31 |
| davechen | stevemar:you are kidding me :) | 05:31 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Clean up docs before creating new ones https://review.openstack.org/203925 | 05:33 |
| *** dims_ has joined #openstack-keystone | 05:36 | |
| *** topol has quit IRC | 05:38 | |
| *** markvoelker has quit IRC | 05:38 | |
| *** dims_ has quit IRC | 05:41 | |
| *** davechen has quit IRC | 05:44 | |
| *** markvoelker has joined #openstack-keystone | 05:44 | |
| *** davechen has joined #openstack-keystone | 05:45 | |
| *** spandhe has quit IRC | 05:50 | |
| *** spandhe has joined #openstack-keystone | 05:53 | |
| *** topol has joined #openstack-keystone | 05:55 | |
| *** ChanServ sets mode: +v topol | 05:55 | |
| *** topol has quit IRC | 05:56 | |
| *** topol has joined #openstack-keystone | 05:57 | |
| *** ChanServ sets mode: +v topol | 05:57 | |
| jiaxi | Anyone here ? | 05:58 |
| jiaxi | openstack trust create error . | 05:58 |
| *** topol has quit IRC | 05:59 | |
| *** hrou has quit IRC | 05:59 | |
| *** Kennan has quit IRC | 06:01 | |
| marekd | lbragstad: so, did keystone-idp work? | 06:01 |
| *** Kennan has joined #openstack-keystone | 06:02 | |
| *** topol has joined #openstack-keystone | 06:03 | |
| *** ChanServ sets mode: +v topol | 06:03 | |
| *** topol has quit IRC | 06:03 | |
| *** topol has joined #openstack-keystone | 06:03 | |
| *** ChanServ sets mode: +v topol | 06:03 | |
| *** stevemar has quit IRC | 06:03 | |
| *** topol has quit IRC | 06:08 | |
| openstackgerrit | Deepti Ramakrishna proposed openstack/keystone: Reuse token_ref fetched in AuthContextMiddleware. https://review.openstack.org/190863 | 06:13 |
| jiaxi | stevermar, openstack trust create error . did you fix it ? | 06:16 |
| lhcheng | jiaxi: what is the error? | 06:17 |
| jiaxi | I remember that you submitted a patch set to fix it | 06:17 |
| jiaxi | ERROR: openstack No user with a name or ID of '4dd2389e79bd4154869a67ee1b237f2a' exists. | 06:17 |
| jiaxi | lhcheng: openstack trust create --project 824f8b8c6ad24855b07b88766d90786c --role 26ea0ce38b6f4ce4bcf03151db2927c4 4dd2389e79bd4154869a67ee1b237f2a f1553dd09afd44d2af178dbc2847e0ff | 06:17 |
| jiaxi | the cmd | 06:17 |
| jiaxi | lhcheng: Error info say 4dd2389e79bd4154869a67ee1b237f2a didn't exist | 06:18 |
| jiaxi | That's terrible. Because it exist... | 06:18 |
| lhcheng | jiaxi: I think stevemar's patch should fix it, can you try it? | 06:19 |
| lhcheng | jiaxi: https://review.openstack.org/#/c/200646/5 | 06:19 |
| jiaxi | OK | 06:20 |
| *** dims_ has joined #openstack-keystone | 06:21 | |
| jiaxi | lhcheng, but it works fine some days ago. His patch didn't merge yet. | 06:21 |
| lhcheng | jiaxi: you can still pull the patch to test it though. :) | 06:22 |
| jiaxi | okay | 06:22 |
| jiaxi | lhcheng, Li hua Cheng https://review.openstack.org/#/c/203312/ | 06:23 |
| jiaxi | Help me review my little patch set https://review.openstack.org/#/c/203312/ | 06:23 |
| jiaxi | Thank you | 06:24 |
| jiaxi | lhcheng,You are chinese? | 06:24 |
| *** dims_ has quit IRC | 06:25 | |
| lhcheng | jiaxi: my devstack got broken atm, don't have a way to test the patch | 06:29 |
| lhcheng | jiaxi: yeah, but I don't speak mandarin :P | 06:29 |
| lhcheng | jiaxi: will look at it when my env gets going again | 06:30 |
| *** bradjones has quit IRC | 06:30 | |
| jiaxi | devstack broken ? test which patch ? | 06:30 |
| jiaxi | lhcheng: test which patch ? | 06:30 |
| lhcheng | jiaxi: your patch | 06:30 |
| jiaxi | can use quota set to test | 06:31 |
| *** pnavarro has joined #openstack-keystone | 06:31 | |
| jiaxi | lhcheng: you can use openstack cmd to test | 06:31 |
| lhcheng | jiaxi: i know, but my devstack is not running | 06:32 |
| jiaxi | lhcheng,jekins has tested it with devstack | 06:32 |
| *** bradjones has joined #openstack-keystone | 06:32 | |
| *** bradjones has quit IRC | 06:32 | |
| *** bradjones has joined #openstack-keystone | 06:32 | |
| jiaxi | lhcheng, restart, cut off some service. | 06:33 |
| jiaxi | lhcheng, I give you a local.conf | 06:34 |
| jiaxi | lhcheng: [[local|localrc]] HOST_IP=10.250.6.52 FIXED_RANGE=10.24.0.0/24 NETWORK_GATEWAY=10.24.0.1 LOGDAYS=1 LOGDIR=$DEST/logs LOGFILE=$LOGDIR/stack.sh.log SCREEN_LOGDIR=$LOGDIR/screen ADMIN_PASSWORD=quiet DATABASE_PASSWORD=$ADMIN_PASSWORD RABBIT_PASSWORD=$ADMIN_PASSWORD SERVICE_PASSWORD=$ADMIN_PASSWORD SERVICE_TOKEN=a682f596-76f3-11e3-b3b2-e716f9080d50 | 06:34 |
| marekd | lol, i bet lhcheng will be able to use this local file, esp with 10/8 subnet.... | 06:34 |
| jiaxi | lhcheng: use this mini one. Then ./stack.sh. Then devstack will run happily. | 06:35 |
| lhcheng | jiaxi: my conf is at the minimum atm, I don't think the conf will help | 06:35 |
| jiaxi | what's the error info ? | 06:36 |
| jiaxi | lhcheng, what's error report ? | 06:36 |
| lhcheng | jiaxi: it is just broken now, will look at it tom | 06:36 |
| jiaxi | I have install devstack and reinstall devstack for many times. | 06:36 |
| lhcheng | jiaxi: something with cannot import "from openstack_requirements import project" | 06:37 |
| lhcheng | jiaxi: okay, added a comment on your patch. It doesn't have a test on it. | 06:38 |
| jiaxi | miss file ? unstack.sh clean.sh then, download a new devstack from github. | 06:38 |
| jiaxi | lhcheng, fix add some test to reproduce the problem ??? | 06:39 |
| jiaxi | lhcheng, this issue is for cmd. 100% can reproduce. | 06:40 |
| jiaxi | lhcheng, what do you mean by 'ix add some test to reproduce the problem' | 06:40 |
| jiaxi | lhcheng, what do you mean by 'fix add some test to reproduce the problem' | 06:41 |
| lhcheng | jiaxi: I meant add some unit test | 06:42 |
| lhcheng | jiaxi: thanks for the advice, will try to fix the devstack tom | 06:42 |
| davechen | lhcheng: what's your time? lin :) | 06:43 |
| lhcheng | 11:40pm | 06:43 |
| davechen | lhcheng: terrible! | 06:44 |
| davechen | lhcheng: it's too late. | 06:44 |
| lhcheng | davechen: just wrapping up some stuff | 06:44 |
| jiaxi | lhcheng: You are not chinese ? | 06:45 |
| davechen | lhcheng: not easy life for SE, hope you clean those up. | 06:45 |
| davechen | jiaxi: lin is living in USA. | 06:45 |
| lhcheng | jiaxi: did a refresh on devstack repo, that seems to do the trick. hit a different problem now. thanks | 06:46 |
| lhcheng | davechen: what's SE? | 06:46 |
| marekd | soft eng | 06:46 |
| marekd | ? | 06:46 |
| davechen | marekd: yep. | 06:46 |
| jiaxi | davechen: what's SE ? | 06:46 |
| *** pnavarro has quit IRC | 06:46 | |
| davechen | soft eng. | 06:46 |
| davechen | not easy for all of us. :) | 06:47 |
| *** ankita_wagh has quit IRC | 06:47 | |
| jiaxi | lhcheng, What's the new problem ? | 06:47 |
| *** browne has quit IRC | 06:48 | |
| lhcheng | davechen: lol | 06:48 |
| lhcheng | jiaxi: failed on osc role add, I'll figure it out tom | 06:48 |
| lhcheng | okay, I'm logging off | 06:49 |
| lhcheng | davechen just reminded me how late it is | 06:49 |
| lhcheng | :P | 06:49 |
| *** spandhe has quit IRC | 06:49 | |
| davechen | lhcheng: good dreaming. | 06:49 |
| lhcheng | davechen: thanks! catch you later | 06:49 |
| lhcheng | enjoy the rest of the day | 06:49 |
| davechen | lhcheng: I will, thanks. :) | 06:50 |
| *** dims_ has joined #openstack-keystone | 06:56 | |
| *** dims_ has quit IRC | 07:00 | |
| *** stevemar has joined #openstack-keystone | 07:04 | |
| *** ChanServ sets mode: +v stevemar | 07:04 | |
| *** ankita_wagh has joined #openstack-keystone | 07:04 | |
| *** stevemar has quit IRC | 07:08 | |
| *** rletrocquer has joined #openstack-keystone | 07:10 | |
| *** amirosh has joined #openstack-keystone | 07:23 | |
| *** afazekas_ has joined #openstack-keystone | 07:24 | |
| *** ParsectiX has joined #openstack-keystone | 07:26 | |
| *** losingle has joined #openstack-keystone | 07:30 | |
| *** amirosh_ has joined #openstack-keystone | 07:32 | |
| *** btully has quit IRC | 07:34 | |
| *** amirosh has quit IRC | 07:36 | |
| *** dims_ has joined #openstack-keystone | 07:37 | |
| *** dims_ has quit IRC | 07:41 | |
| *** belmoreira has joined #openstack-keystone | 07:42 | |
| *** fhubik has joined #openstack-keystone | 07:48 | |
| *** topol has joined #openstack-keystone | 07:49 | |
| *** ChanServ sets mode: +v topol | 07:49 | |
| *** losingle has quit IRC | 07:52 | |
| *** belmoreira has quit IRC | 07:52 | |
| *** lhcheng has quit IRC | 07:52 | |
| *** topol has quit IRC | 07:54 | |
| *** jistr has joined #openstack-keystone | 07:55 | |
| *** chlong has quit IRC | 08:04 | |
| *** ankita_wagh has quit IRC | 08:06 | |
| *** cinerama has quit IRC | 08:07 | |
| jiaxi | The unit test of openstack is too different from the unit test of keystone. | 08:10 |
| *** cinerama has joined #openstack-keystone | 08:12 | |
| openstackgerrit | Ren Qiaowei proposed openstack/keystone: Add necessary executable permission https://review.openstack.org/203966 | 08:14 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adding Documentation for Mapping Combinations https://review.openstack.org/192850 | 08:17 |
| *** pnavarro has joined #openstack-keystone | 08:25 | |
| breton | good morning keystone | 08:30 |
| *** dims_ has joined #openstack-keystone | 08:31 | |
| *** henrynash has quit IRC | 08:32 | |
| *** cinerama has quit IRC | 08:33 | |
| *** henrynash has joined #openstack-keystone | 08:34 | |
| *** ChanServ sets mode: +v henrynash | 08:34 | |
| *** cinerama has joined #openstack-keystone | 08:34 | |
| *** dims_ has quit IRC | 08:36 | |
| *** henrynash has quit IRC | 08:40 | |
| *** aix has joined #openstack-keystone | 08:43 | |
| *** dims_ has joined #openstack-keystone | 08:46 | |
| *** dims_ has quit IRC | 08:51 | |
| *** stevemar has joined #openstack-keystone | 08:53 | |
| *** ChanServ sets mode: +v stevemar | 08:53 | |
| *** stevemar has quit IRC | 08:57 | |
| *** aix has quit IRC | 08:58 | |
| *** henrynash has joined #openstack-keystone | 09:02 | |
| *** ChanServ sets mode: +v henrynash | 09:02 | |
| *** piyanai has joined #openstack-keystone | 09:08 | |
| *** henrynash has quit IRC | 09:12 | |
| *** e0ne has joined #openstack-keystone | 09:15 | |
| *** geoffarn_ has joined #openstack-keystone | 09:21 | |
| *** geoffarnold has quit IRC | 09:24 | |
| *** dims_ has joined #openstack-keystone | 09:26 | |
| *** aix has joined #openstack-keystone | 09:28 | |
| *** amick has joined #openstack-keystone | 09:29 | |
| *** dims_ has quit IRC | 09:31 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Remove unused code in domain config checking https://review.openstack.org/194057 | 09:33 |
| *** ParsectiX has quit IRC | 09:34 | |
| *** dims_ has joined #openstack-keystone | 09:36 | |
| *** dims_ has quit IRC | 09:40 | |
| *** piyanai has quit IRC | 09:40 | |
| *** lhcheng has joined #openstack-keystone | 09:41 | |
| *** ChanServ sets mode: +v lhcheng | 09:41 | |
| *** lhcheng has quit IRC | 09:46 | |
| *** davechen has left #openstack-keystone | 09:47 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 09:51 |
| *** topol has joined #openstack-keystone | 09:51 | |
| *** ChanServ sets mode: +v topol | 09:51 | |
| *** ParsectiX has joined #openstack-keystone | 09:55 | |
| *** amick has left #openstack-keystone | 09:56 | |
| *** topol has quit IRC | 09:56 | |
| *** amickus has joined #openstack-keystone | 09:58 | |
| *** boris-42 has quit IRC | 10:02 | |
| *** Kennan has quit IRC | 10:02 | |
| *** Kennan has joined #openstack-keystone | 10:03 | |
| *** pnavarro has quit IRC | 10:03 | |
| *** amirosh has joined #openstack-keystone | 10:04 | |
| *** aix has quit IRC | 10:04 | |
| *** amirosh_ has quit IRC | 10:06 | |
| *** fhubik is now known as fhubik_afk | 10:10 | |
| *** fhubik_afk is now known as fhubik | 10:13 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 10:15 |
| *** aix has joined #openstack-keystone | 10:15 | |
| *** dims_ has joined #openstack-keystone | 10:16 | |
| *** pnavarro has joined #openstack-keystone | 10:18 | |
| *** ParsectiX has quit IRC | 10:19 | |
| *** chmouel_ is now known as chmouel | 10:25 | |
| *** amirosh_ has joined #openstack-keystone | 10:31 | |
| *** amirosh has quit IRC | 10:33 | |
| *** chenhong1 has quit IRC | 10:34 | |
| *** _afazekas has joined #openstack-keystone | 10:41 | |
| *** jiaxi has quit IRC | 10:41 | |
| *** stevemar has joined #openstack-keystone | 10:42 | |
| *** ChanServ sets mode: +v stevemar | 10:42 | |
| samueldmq | morning | 10:42 |
| *** afazekas has quit IRC | 10:45 | |
| *** stevemar has quit IRC | 10:47 | |
| *** ParsectiX has joined #openstack-keystone | 10:47 | |
| *** fhubik has quit IRC | 10:48 | |
| *** amirosh_ has quit IRC | 10:49 | |
| *** fhubik has joined #openstack-keystone | 11:16 | |
| *** fhubik is now known as fhubik_afk | 11:19 | |
| *** lhcheng has joined #openstack-keystone | 11:30 | |
| *** ChanServ sets mode: +v lhcheng | 11:30 | |
| *** lhcheng has quit IRC | 11:35 | |
| *** dsirrine has joined #openstack-keystone | 11:47 | |
| *** lhcheng has joined #openstack-keystone | 11:55 | |
| *** ChanServ sets mode: +v lhcheng | 11:55 | |
| *** fhubik_afk is now known as fhubik | 11:56 | |
| *** lhcheng has quit IRC | 11:59 | |
| *** uvirtbot has quit IRC | 12:01 | |
| *** uvirtbot has joined #openstack-keystone | 12:04 | |
| *** gordc has joined #openstack-keystone | 12:06 | |
| *** ankita_wagh has joined #openstack-keystone | 12:07 | |
| *** dims_ has quit IRC | 12:09 | |
| *** ankita_wagh has quit IRC | 12:11 | |
| samueldmq | morganfainberg: good morning | 12:13 |
| samueldmq | morganfainberg: there is something wrong with that solution to get the endpoint id from URL | 12:14 |
| dstanek | samueldmq: i think morganfainberg is still sleeping :-) | 12:14 |
| samueldmq | dstanek: I just called him to see if someone else like you were available | 12:14 |
| samueldmq | dstanek: it was a trap | 12:14 |
| dstanek | samueldmq: please leave your message at the beep... | 12:15 |
| samueldmq | dstanek: just kidding :) but I would appreciate if you have some minutes | 12:15 |
| samueldmq | dstanek: hehe | 12:15 |
| dstanek | samueldmq: what's up? | 12:15 |
| *** jiaxi has joined #openstack-keystone | 12:16 | |
| samueldmq | dstanek: so ... | 12:16 |
| samueldmq | dstanek: we fetch policy + do endpoint enforcement (gyee's work) based on the endpoint_id | 12:16 |
| samueldmq | dstanek: which would be discovered by URL, so far so good, right? | 12:16 |
| samueldmq | dstanek: i) it is not endpoint_id, it'd be endpoint_IDS, since a URL can match multiple ids | 12:17 |
| samueldmq | dstanek: ii) for gyee's work, he needs all the ids for that service process ... I mean, if we just specify http://nova.com and that maps to (public,admin) ids | 12:18 |
| *** chlong has joined #openstack-keystone | 12:18 | |
| samueldmq | dstanek: we would need to get the internal id somehow, which would be by the URL http://10.10.2.65 | 12:18 |
| samueldmq | dstanek: so that would need to be multiple URLs, to discover multiple IDS, I think this is just getting very complex , and bad :( | 12:19 |
| *** raildo has joined #openstack-keystone | 12:23 | |
| jiaxi | I think david is sleeping.. | 12:23 |
| dstanek | samueldmq: sorry walked away to grab breakfast...reading up | 12:25 |
| samueldmq | dstanek: did you already grab breakfast ? wow, take your time :) | 12:25 |
| jiaxi | morning in US ? | 12:25 |
| dstanek | 8:25am where i am and 5:25 on the other coast | 12:25 |
| dstanek | samueldmq: is it actually possible to hit an endpoint and have it result in multiple IDs for enforcement? | 12:26 |
| samueldmq | dstanek: just 1 hour earlier than where I am :) that's why I bug you that often | 12:27 |
| samueldmq | dstanek: you mean to fetch the endpoint ids list ? or to do the endpoint enforcement ? | 12:27 |
| jiaxi | If I want to understand keystone throughly, What's the best and most effective way ? | 12:28 |
| dstanek | samueldmq: to do the enforcement | 12:28 |
| dstanek | jiaxi: reading the code to get a feel for the structure is probably a really great step and then i'd go to the identity docs and openstack setup tutorials | 12:29 |
| samueldmq | dstanek: today we can't do that, but that's the work gyee is involved, and I confirmed with him yesterday it's needed the whole list of endpoint ids (regardless the interface type) | 12:29 |
| samueldmq | dstanek: so the endpoint id can be checked against the service catalog properly | 12:29 |
| dstanek | samueldmq: ok, your point (ii) confused me. | 12:30 |
| samueldmq | dstanek: ok let me clarify | 12:30 |
| samueldmq | dstanek: we need all the endpoint_ids that represent that service process | 12:30 |
| dstanek | samueldmq: gyee is basically running into the problem i was calling out earlier (what URL to use) | 12:31 |
| samueldmq | dstanek: let's say 3 ids (internal, public, admin) | 12:31 |
| *** stevemar has joined #openstack-keystone | 12:31 | |
| *** ChanServ sets mode: +v stevemar | 12:31 | |
| samueldmq | dstanek: we possibly can't discover those 3 ids from a single URL | 12:31 |
| samueldmq | dstanek: yeah I think that's basically the problem you called out earlier | 12:32 |
| samueldmq | dstanek: so to discover those 3 ids, we would need, let's say 2 url, the first discover (public,admin) ids and the second discovers (internal) id | 12:32 |
| samueldmq | dstanek: if that makes sense .. | 12:32 |
| dstanek | samueldmq: you could get a list of endpoints for a service right? | 12:33 |
| dstanek | samueldmq: also this makes my catalog in DNS much harder | 12:33 |
| samueldmq | dstanek: for a service type yes, but there could be too much service enpoints for, let's say, 'nova' | 12:33 |
| *** stevemar has quit IRC | 12:34 | |
| dstanek | samueldmq: too many for what? i don't see getting a large list of URLs as the problem. the problem i see is know which or the URLs are actually handled by that instance of a service (but maybe that doesn't matter) | 12:41 |
| dstanek | jiaxi: you should try to respond to each comment in a review to let reviewers know that something was done or that you disagree with a comment | 12:45 |
| dstanek | jiaxi: that's another reason why reviews don't get attention. if i have a list of 100 reviews and i can't tell if my comments were address i'll skip and move on. | 12:45 |
| jiaxi | I have responsed ... | 12:45 |
| jiaxi | dstanek, I update my code according to all your comment. | 12:46 |
| dstanek | jiaxi: you should respond to each comment. a few times i made a comment and you posted a review without addressing them. how should i know when to look? | 12:46 |
| jiaxi | dstanek, I will remmember in my note and mind. | 12:48 |
| jiaxi | dstanek: All responed one by one https://review.openstack.org/#/c/200512/ | 12:50 |
| jiaxi | I didn't tell a lie. | 12:50 |
| *** piyanai has joined #openstack-keystone | 12:51 | |
| jiaxi | dstanek: patch set 16, all responed. | 12:51 |
| dstanek | jiaxi: ok | 12:51 |
| jiaxi | I think that my code looks good this time. | 12:52 |
| lbragstad | marekd: things work, but I'm getting a 401 when I try to get a list of projects using a federated unscoped token, per raildo's write up | 12:55 |
| lbragstad | marekd: specifically https://github.com/lbragstad/keystone-deploy/blob/federation/test_federation_exercises.py#L209-L212 | 12:55 |
| samueldmq | dstanek: back | 12:57 |
| *** pawel_ has joined #openstack-keystone | 12:58 | |
| samueldmq | dstanek: basically, if we setup it as : endpoint_urls=http://nova.com:9292,http://10.10.2.16:9292 | 12:58 |
| marekd | lbragstad: sorry i didn't look into it as you eventually didn't answer whether it worked or not... | 12:59 |
| samueldmq | dstanek: it would work, because the former would discover (public,admin) endpoint ids, and the latter would discover (internal) | 12:59 |
| samueldmq | dstanek: we are considering just one URL so far, and that opens a hole in the solution | 12:59 |
| *** piyanai has quit IRC | 13:00 | |
| lbragstad | marekd: no worries | 13:00 |
| lbragstad | marekd: just got into the office | 13:00 |
| dstanek | samueldmq: that's not really discovery is you hard code the URLs in the config | 13:00 |
| samueldmq | dstanek: hmm, so when you come with http://nova.com:9292 I discover the ids for it | 13:01 |
| samueldmq | dstanek: if you come with http://10.10.2.16:9292 I discover the ids for it | 13:01 |
| samueldmq | dstanek: and I store all the ids representing me (as a service process) | 13:01 |
| lbragstad | morganfainberg: do you still want this proposed for stable? https://review.openstack.org/#/c/186376/ -- if so, I'll send out an exception on the mailing list | 13:02 |
| dstanek | samueldmq: what is 10.10.2.16 isn't in the catalog? | 13:02 |
| samueldmq | dstanek: yes it is, representing the internal interface | 13:03 |
| marekd | lbragstad: let me look slightly later. | 13:03 |
| marekd | lbragstad: wanted to finish something. | 13:03 |
| samueldmq | dstanek: and nova.com would represent the public,admin interfaces | 13:03 |
| lbragstad | marekd: no problem | 13:03 |
| dstanek | samueldmq: what if i hit it with a url that isn't in the catalog? which is entirely possible | 13:04 |
| jiaxi | anyone want to exchange a review ? https://review.openstack.org/#/c/200512/ | 13:05 |
| samueldmq | dstanek: that would fail .. I think that's gyee work, making sure you the enpoint ids in the token match the ids where you try to access | 13:05 |
| samueldmq | dstanek: if I got a token, I am supposed to access to the urls in my service catalog | 13:05 |
| samueldmq | dstanek: is that right ? | 13:05 |
| dstanek | samueldmq: i'll have to see how gyee is handling having a service that has multiple endpoints | 13:06 |
| samueldmq | dstanek: I think I got your point, if I have access to that service process, but I am using a different URL from the ones in my catalog | 13:07 |
| *** bradjones has quit IRC | 13:07 | |
| samueldmq | dstanek: I will have acccess denied, because enpoint id by my url wont't happen | 13:07 |
| dstanek | samueldmq: right, deployers can do all sorts of crazy things with proxies | 13:07 |
| samueldmq | dstanek: even though I effectivelly should have access to that serivce process | 13:07 |
| samueldmq | dstanek: hmm, that's a good point actually | 13:08 |
| *** bradjones has joined #openstack-keystone | 13:08 | |
| *** bradjones has quit IRC | 13:08 | |
| *** bradjones has joined #openstack-keystone | 13:08 | |
| samueldmq | dstanek: and based on their crazy things, only they know what they do, and then making themselves put the endpoint_ids in hte middleware config would be safe | 13:08 |
| samueldmq | dstanek: (putting UX aside) this is what would work pretty fine | 13:09 |
| *** jdandrea has joined #openstack-keystone | 13:11 | |
| samueldmq | morganfainberg: cc ^ | 13:12 |
| dstanek | samueldmq: so if we are to put restrictions like this on deployments we should document it pretty well | 13:12 |
| raildo | lbragstad: I don't know what it is, but if it's wrong, it's not my fault :P | 13:13 |
| samueldmq | dstanek: the problem isn't new deployement, but running ones which would break if try to use those features :( | 13:13 |
| lbragstad | raildo: ;) | 13:13 |
| dstanek | oh, good a brand new devstack and the py34 unit test won't run! | 13:13 |
| *** jsavak has joined #openstack-keystone | 13:16 | |
| *** markvoelker has quit IRC | 13:17 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Avoid the hard coding of admin token https://review.openstack.org/203546 | 13:17 |
| *** hrou has joined #openstack-keystone | 13:18 | |
| *** piyanai has joined #openstack-keystone | 13:19 | |
| *** bknudson has joined #openstack-keystone | 13:20 | |
| *** ChanServ sets mode: +v bknudson | 13:20 | |
| *** bdossant has joined #openstack-keystone | 13:20 | |
| jiaxi | https://review.openstack.org/#/c/200512/ | 13:23 |
| jiaxi | Good man , top coder. Help me to review my patch set. | 13:24 |
| *** mylu has joined #openstack-keystone | 13:24 | |
| marekd | dstanek: ever tried to run functional tests and pdb at the same time? :-) | 13:27 |
| *** mylu has quit IRC | 13:39 | |
| samueldmq | morganfainberg: when I see all those things, I want to fix that endpoint model .. and I wonder if that is worth it :( | 13:42 |
| samueldmq | morganfainberg: so I start thinking of Consul | 13:42 |
| dstanek | marekd: nope :-) | 13:42 |
| *** rm_work is now known as rm_work|away | 13:46 | |
| *** piyanai has quit IRC | 13:48 | |
| samueldmq | is there a way to make services register themselves ? if they did, they would know their ids :) | 13:48 |
| samueldmq | dstanek: cc ^ | 13:48 |
| *** henrynash has joined #openstack-keystone | 13:48 | |
| *** ChanServ sets mode: +v henrynash | 13:48 | |
| marekd | samueldmq: what was consul ? | 13:49 |
| *** edmondsw has joined #openstack-keystone | 13:49 | |
| samueldmq | marekd: catalog management https://www.consul.io/docs/agent/http/catalog.html | 13:49 |
| samueldmq | marekd: so services would register themselves, etc | 13:50 |
| marekd | samueldmq: it's openstackkindofthing ? | 13:50 |
| pawel_ | hi. could anyone explain me this thing: I use python client to access keystone and at this point I can list users, etc. Now, I'm using api function tokens.revoke_token. I can see a new entry in the revocation_event table in the database. I would suspect that if I delete this entry from revocation_event table, I would be able to use the token in python client but it's not the case. Could anyone explain what is happening beh | 13:50 |
| marekd | dstanek, morganfainberg ^^ | 13:51 |
| *** stevemar has joined #openstack-keystone | 13:51 | |
| *** ChanServ sets mode: +v stevemar | 13:51 | |
| *** topol has joined #openstack-keystone | 13:52 | |
| *** ChanServ sets mode: +v topol | 13:52 | |
| *** kiran-r has joined #openstack-keystone | 13:52 | |
| *** mylu has joined #openstack-keystone | 13:53 | |
| *** dims_ has joined #openstack-keystone | 13:53 | |
| samueldmq | marekd: dunno, morgan was trying to figure out more about it at the midcycle (I think) | 13:54 |
| samueldmq | marekd: I think we can do endpoint self registering at ksmiddleware level within our current openstack code (no need of external libs like consul) | 13:55 |
| samueldmq | marekd: however I don't know what's better | 13:55 |
| bknudson | dstanek: ever use py-notify or axel? | 13:57 |
| *** jsavak has quit IRC | 13:57 | |
| bknudson | or another eventing system | 13:57 |
| *** jsavak has joined #openstack-keystone | 13:57 | |
| breton | http://varlamov.me/2015/usaput6/29.jpg -- that's in front of the whitehouse | 13:57 |
| * bknudson wonders why keystone implements its own | 13:57 | |
| marekd | bknudson: any ideas for pawel_ problem? (read up) | 13:57 |
| breton | why does she hate us? | 13:57 |
| *** piyanai has joined #openstack-keystone | 13:58 | |
| stevemar | breton: probably because bknudson -1'ed her | 13:58 |
| bknudson | I put that sign there... -1ing keystone. | 13:59 |
| samueldmq | stevemar: ++ ahaha | 13:59 |
| bknudson | needs work | 13:59 |
| raildo | stevemar: lol | 13:59 |
| dstanek | bknudson: i have used py-notify and blinker (and the ones builtin to web frameworks) | 13:59 |
| *** bdossant has quit IRC | 13:59 | |
| bknudson | dstanek: does flask have a built-in eventing? | 13:59 |
| dstanek | bknudson: i tried replacing notifications with blinker, but it ended up being almost the same amount of code | 13:59 |
| dstanek | bknudson: no | 13:59 |
| *** bdossant has joined #openstack-keystone | 14:00 | |
| dstanek | bknudson: although now that i've ripped DI out of notifications that may no longer be the case | 14:00 |
| bknudson | dstanek: y, it might be easier now. | 14:00 |
| *** hrou has quit IRC | 14:00 | |
| morganfainberg | samueldmq: consul does clustering and handles the communication. I dont like reinventing the wheel doing it ourselves. | 14:02 |
| morganfainberg | samueldmq: if we are doing self registration, etc, lets use software that has solved the hard problems. | 14:03 |
| dstanek | bknudson: i could try again and see what it comes out as | 14:03 |
| morganfainberg | dstanek: worth reducing our custom code if we can. :) | 14:04 |
| *** mestery has joined #openstack-keystone | 14:04 | |
| *** amickus has quit IRC | 14:04 | |
| *** bknudson has quit IRC | 14:05 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 14:07 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 14:07 |
| *** fangzhou has joined #openstack-keystone | 14:07 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Relax newly imposed sql driver restriction for domain config https://review.openstack.org/191976 | 14:08 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 14:10 |
| dstanek | morganfainberg: i'll spike it for an hour today and see what i come up with | 14:10 |
| *** richm has joined #openstack-keystone | 14:11 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused code in domain config checking https://review.openstack.org/194057 | 14:13 |
| *** hrou has joined #openstack-keystone | 14:16 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:16 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused code in domain config checking https://review.openstack.org/194057 | 14:16 |
| *** ayoung has joined #openstack-keystone | 14:23 | |
| *** ChanServ sets mode: +v ayoung | 14:23 | |
| lbragstad | raildo: quick question on your federation writeup. Did you have any initial issues with client.fed_token_id returning 401 when you use it to list projects? | 14:25 |
| *** browne has joined #openstack-keystone | 14:27 | |
| marekd | dstanek: i think we should esuse most of the existing helper functions for funtional testssuite. | 14:27 |
| marekd | otherwise loads of code will be copy/pasta | 14:28 |
| marekd | s/esuse/reuse | 14:28 |
| *** jsavak has quit IRC | 14:28 | |
| *** alex_xu has quit IRC | 14:29 | |
| *** jecarey has joined #openstack-keystone | 14:30 | |
| *** david-lyle has quit IRC | 14:30 | |
| *** alex_xu has joined #openstack-keystone | 14:31 | |
| marekd | lbragstad: any credentials i can use to login to your sp keystone? | 14:31 |
| marekd | lbragstad: i am intersted in how mapping looks like for instance. | 14:31 |
| *** jsavak has joined #openstack-keystone | 14:32 | |
| jiaxi | stevemar: Hello, are you here | 14:32 |
| jiaxi | ? | 14:32 |
| raildo | lbragstad: i think that you want to talk with rodrigods, not with me =P | 14:33 |
| raildo | lbragstad: he is the federation guy | 14:33 |
| *** fhubik is now known as fhubik_afk | 14:33 | |
| lbragstad | raildo: ah, yes, you're right... sorry about that! | 14:33 |
| raildo | lbragstad: np :) | 14:33 |
| jiaxi | This bug can be fixed with only one line | 14:34 |
| jiaxi | Should I add unit test ? | 14:34 |
| jiaxi | https://review.openstack.org/#/c/203312/ | 14:34 |
| rodrigods | lbragstad, hmm don't remember having issues at that step | 14:35 |
| *** jsavak has quit IRC | 14:36 | |
| *** fangzhou has quit IRC | 14:36 | |
| *** jsavak has joined #openstack-keystone | 14:37 | |
| dstanek | marekd: what helper functions? | 14:39 |
| dstanek | jiaxi: yes | 14:40 |
| jiaxi | The whole test for /common/quota.py will be 100s line. | 14:41 |
| jiaxi | at least | 14:41 |
| stevemar | jiaxi: yes, i'm around | 14:41 |
| *** dguerri` is now known as dguerri | 14:42 | |
| jiaxi | stevemar, david The unit test of openstackclient is terrible different from keystone | 14:42 |
| jiaxi | I feel the unit test of openstackclient is too difficult. | 14:42 |
| *** piyanai has quit IRC | 14:42 | |
| dstanek | jiaxi: i don't doubt it's different, but i think it should be done. without it may be hard to evaluate that there was really a problem and that the fix actually fixes it | 14:43 |
| *** dguerri is now known as dguerri` | 14:43 | |
| jiaxi | stevemar: maybe, I fix the bug. The other person add unit test who have interest ? | 14:44 |
| lbragstad | tests should go in the same patch.. | 14:44 |
| dstanek | i agree. if you are not interested in providing the tests someone may pick up the patch and work on it. | 14:45 |
| jiaxi | dstanek: It's a little hard for me. I will listen to you. I will add the unit test tomorrow | 14:45 |
| stevemar | jiaxi: add one test for now? if it's exceptionally difficult we can skip it, but try adding one test for now | 14:46 |
| dstanek | jiaxi: if you disagree stevemar, dtroyer_zz could probably provide better guidance for that particular project | 14:47 |
| *** topol has quit IRC | 14:47 | |
| jiaxi | https://review.openstack.org/#/c/200512/ please have a look at my patch set . Thank you... | 14:47 |
| dstanek | jiaxi: have my comments been addressed? | 14:48 |
| jiaxi | dstanek: of course | 14:49 |
| *** jsavak has quit IRC | 14:49 | |
| jiaxi | stevemar: I will add . It's deep night in China. | 14:49 |
| *** bdossant has quit IRC | 14:50 | |
| jiaxi | stevemar: I will try to add unit test for all the common/quota.py. | 14:50 |
| *** kiran-r has quit IRC | 14:51 | |
| *** bdossant has joined #openstack-keystone | 14:51 | |
| dstanek | jiaxi: just focus on the specific case you are fixing | 14:51 |
| *** fhubik_afk is now known as fhubik | 14:52 | |
| jiaxi | dstanek: Okay. https://review.openstack.org/#/c/200512/ This patch looks good now. | 14:53 |
| *** btully has joined #openstack-keystone | 14:54 | |
| stevemar | dstanek: that patch is looking much better | 14:54 |
| *** jsavak has joined #openstack-keystone | 14:55 | |
| dstanek | stevemar: yeah, it's on my list :-) | 14:57 |
| stevemar | lbragstad: the patch is only for v2.0 | 14:57 |
| lbragstad | stevemar: right, but should we care about that behavior in v3? | 14:58 |
| stevemar | lbragstad: probably | 14:58 |
| dstanek | since v2 is dead i would want to make sure v3 is taken care of | 14:59 |
| lbragstad | dstanek: ++ | 14:59 |
| *** jsavak has quit IRC | 15:00 | |
| jiaxi | I will do it in v3 | 15:01 |
| *** jsavak has joined #openstack-keystone | 15:01 | |
| jiaxi | In next fix | 15:01 |
| lbragstad | if you want it to be done in a separate patch, I'm fine with that. But if they go in separately, we should open a bug for the v3 side so it's not lost | 15:02 |
| jiaxi | I will do it now | 15:02 |
| jiaxi | lbragstad : thank you | 15:03 |
| lbragstad | jiaxi: np | 15:03 |
| *** hrou has quit IRC | 15:04 | |
| *** gus_ has joined #openstack-keystone | 15:06 | |
| *** afazekas_ has quit IRC | 15:08 | |
| lbragstad | rodrigods: the auth_url that you use in your tests is the auth_url of the idp, right? | 15:08 |
| *** kiran-r has joined #openstack-keystone | 15:09 | |
| *** edmondsw has quit IRC | 15:09 | |
| *** chlong has quit IRC | 15:09 | |
| *** jamiec has quit IRC | 15:09 | |
| *** gus has quit IRC | 15:09 | |
| *** jamielennox has quit IRC | 15:09 | |
| *** rm_work|away has quit IRC | 15:09 | |
| *** hogepodge has quit IRC | 15:09 | |
| *** flwang has quit IRC | 15:09 | |
| *** sudorandom has quit IRC | 15:09 | |
| *** bdossant has quit IRC | 15:10 | |
| jiaxi | https://bugs.launchpad.net/keystone/+bug/1476720 | 15:14 |
| openstack | Launchpad bug 1476720 in Keystone "Openstack endpoint create with invalid url should be suppressed" [Undecided,New] | 15:14 |
| *** bknudson has joined #openstack-keystone | 15:15 | |
| *** ChanServ sets mode: +v bknudson | 15:15 | |
| *** edmondsw has joined #openstack-keystone | 15:16 | |
| *** chlong has joined #openstack-keystone | 15:16 | |
| *** zzzeek has joined #openstack-keystone | 15:16 | |
| *** kiran-r has quit IRC | 15:16 | |
| *** jiaxi has quit IRC | 15:17 | |
| *** ParsectiX has quit IRC | 15:18 | |
| *** flwang has joined #openstack-keystone | 15:19 | |
| *** diazjf has joined #openstack-keystone | 15:19 | |
| pawel_ | ayoung: Could you explain me the following thing: I use python client to access keystone and at this point I can list users, etc. Now, I'm using api function tokens.revoke_token. I can see a new entry in the revocation_event table in the database. I would suspect that if I delete this entry from revocation_event table, I would be able to use the token in python client but it's not the case. It's worth noting that I have a | 15:22 |
| ayoung | pawel_, depends on if you have revoke by ID set or not. If you do revoke by ID, then the revocation events are not used. | 15:23 |
| *** afazekas has joined #openstack-keystone | 15:25 | |
| *** bdossant has joined #openstack-keystone | 15:26 | |
| pawel_ | ayoung: I did sth like: client.tokens.get_revoked("3b5d..."). Could you give me some hints where to start investigating what happens there? | 15:27 |
| *** bdossant has quit IRC | 15:28 | |
| *** bdossant has joined #openstack-keystone | 15:35 | |
| *** jsavak has quit IRC | 15:35 | |
| *** hrou has joined #openstack-keystone | 15:36 | |
| *** david-lyle has joined #openstack-keystone | 15:38 | |
| *** jsavak has joined #openstack-keystone | 15:39 | |
| ayoung | pawel_, config file. See if you have revoke_by_id enabled | 15:42 |
| rodrigods | lbragstad, SP | 15:43 |
| *** pnavarro_ has joined #openstack-keystone | 15:43 | |
| *** jsavak has quit IRC | 15:43 | |
| *** jsavak has joined #openstack-keystone | 15:44 | |
| pawel_ | ayoung: I have commented it out, so I guess it's true by default | 15:44 |
| *** pnavarro has quit IRC | 15:47 | |
| marekd | rodrigods: in your blog post | 15:51 |
| marekd | why do you add role assign between group and domain and later scope to a projet? | 15:51 |
| marekd | some inherited roles comes to the game here? | 15:51 |
| rodrigods | marekd, for the mapping to work, right? | 15:51 |
| rodrigods | don't remember the example in the top of my head | 15:52 |
| marekd | mapping, role assignments , everything. | 15:52 |
| marekd | rodrigods: it's here: http://rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ :-) | 15:52 |
| rodrigods | marekd, hmm I think the intent was to have a inherited role assignment | 15:53 |
| marekd | rodrigods: that's what i thought. | 15:54 |
| marekd | rodrigods: so maybe you could change it and either specify that, or just create role assignment between group and project? | 15:54 |
| marekd | i suggest latter | 15:54 |
| marekd | so we don't confuse ppl even more. | 15:54 |
| *** jasonsb has quit IRC | 15:56 | |
| rodrigods | marekd, ++ will update the example | 15:57 |
| marekd | rodrigods: thanks | 15:57 |
| rodrigods | marekd, print('\nGrant role Member to group1 in domain1') | 16:00 |
| rodrigods | client.roles.grant(role1, group=group1, domain=domain1, os_inherit_extension_inherited=True) | 16:00 |
| *** jistr has quit IRC | 16:04 | |
| *** jsavak has quit IRC | 16:04 | |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| *** fhubik is now known as fhubik_afk | 16:05 | |
| *** gyee has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v gyee | 16:08 | |
| *** pnavarro_ has quit IRC | 16:12 | |
| *** _cjones_ has joined #openstack-keystone | 16:13 | |
| *** _cjones_ has quit IRC | 16:13 | |
| *** _cjones_ has joined #openstack-keystone | 16:14 | |
| *** dguerri` is now known as dguerri | 16:17 | |
| *** bknudson has quit IRC | 16:18 | |
| *** _cjones_ has quit IRC | 16:20 | |
| *** bdossant has quit IRC | 16:20 | |
| *** _cjones_ has joined #openstack-keystone | 16:24 | |
| *** bknudson has joined #openstack-keystone | 16:25 | |
| *** ChanServ sets mode: +v bknudson | 16:25 | |
| stevemar | bknudson: poke | 16:25 |
| bknudson | stevemar: what's up? | 16:25 |
| bknudson | I can't find the nova meetup | 16:25 |
| *** mgarza has joined #openstack-keystone | 16:25 | |
| bknudson | it's supposed to be around here somewhere. | 16:26 |
| stevemar | bknudson: finally got most of the tests passing, but can't seem to get the last few going, mind taking a look at the changes in keystone.tests ? | 16:26 |
| stevemar | https://review.openstack.org/#/c/195873/ | 16:26 |
| stevemar | bknudson: ask mattR where he's hulking out | 16:26 |
| stevemar | bknudson: did we set up the nova midcycle in a closet? | 16:26 |
| lbragstad | stevemar: I bet the hulk can jump from rochester to canada, watch out! | 16:27 |
| stevemar | lbragstad: not like it's all that far | 16:27 |
| bknudson | stevemar: you're getting all sorts of errors | 16:27 |
| samueldmq | ayoung: hi, I've an interesting question to you :) | 16:27 |
| raildo | bknudson: I only see this infromation about nova meetup: Where: IBM - 3605 US-52, Rochester, MN 55901 | 16:28 |
| stevemar | bknudson: pretty sure this is what's screwing me over: https://review.openstack.org/#/c/195873/20/keystone/tests/unit/ksfixtures/cache.py | 16:28 |
| stevemar | bknudson: that change to cache.REGION really hurt :P | 16:28 |
| stevemar | raildo: that's where bknudson is every day! | 16:28 |
| *** jlvillal has quit IRC | 16:29 | |
| raildo | stevemar: ops :P | 16:29 |
| samueldmq | ayoung: our work must be sincronized with gyee's one, right ? what if I use an URL that is not even registed in keystone ? how does endpoint id discovery work ? | 16:29 |
| samueldmq | ayoung: so the request will be rejected ? even if it had the right catalog, etc but the unkown URL was used ? | 16:30 |
| raildo | is there a 9 3/4 door? :P | 16:30 |
| *** jlvillal has joined #openstack-keystone | 16:32 | |
| bknudson | stevemar: does the test need to create a new region every time? | 16:33 |
| bknudson | because oslo.cache doesn't provide a way to create a new region | 16:33 |
| bknudson | the tests are probably using the wrong region then | 16:34 |
| bknudson | your decorators would still be referencing the old global cache region | 16:34 |
| *** david-lyle has quit IRC | 16:34 | |
| *** dguerri is now known as dguerri` | 16:34 | |
| *** diazjf has quit IRC | 16:38 | |
| *** bknudson has quit IRC | 16:39 | |
| *** dguerri` is now known as dguerri | 16:39 | |
| *** amick has joined #openstack-keystone | 16:40 | |
| *** roxanaghe has joined #openstack-keystone | 16:41 | |
| samueldmq | gyee: hey you around ? | 16:41 |
| ayoung | samueldmq, so if there were no endpoint_id set, it probably should get rejected if you can't map to a known endpoint id | 16:42 |
| samueldmq | ayoung: so that would be rejected, and that maybe weird, isn't it ? | 16:42 |
| ayoung | you are saying "enforce policy on this" but not providing enough information to enforce policy...default to deny | 16:42 |
| ayoung | samueldmq, using dynaamic policy thus has to be opt-in | 16:42 |
| ayoung | its what happens when this stuff is not clearly thought out at the start | 16:43 |
| samueldmq | ayoung: so you enabled dynamic policy but didn't configure properly .. it's your fault | 16:43 |
| samueldmq | ayoung: something like that .. | 16:43 |
| ayoung | yep | 16:43 |
| samueldmq | ayoung: could endpoint enforcement from gyee by done by url ? | 16:43 |
| samueldmq | ayoung: be done* | 16:43 |
| ayoung | samueldmq, we just need to provide sufficient logging to make it clear what is happening, which is why I think we want the URL resolution in middleware....although I could see us doing the URL resolution in the server, and just returning a clear error message | 16:44 |
| ayoung | either way | 16:44 |
| ayoung | samueldmq, I don't think so, I think it should probably be done by endpoint id, but I'm flexible there | 16:44 |
| samueldmq | ayoung: so you look at the url from the request, and at the urls in token's catalog, right ? | 16:44 |
| *** lhcheng has joined #openstack-keystone | 16:45 | |
| *** ChanServ sets mode: +v lhcheng | 16:45 | |
| *** e0ne has quit IRC | 16:45 | |
| samueldmq | ayoung: "who am I ? I am represented by any url who have came to me, I don't know why, but if it arrived to me, it's me" :) | 16:45 |
| *** fhubik_afk is now known as fhubik | 16:45 | |
| samueldmq | ayoung: I think that sounds sane | 16:45 |
| ayoung | samueldmq, heh. | 16:46 |
| ayoung | Not sure I am the right arbiter for what is "Sane" anymore | 16:46 |
| samueldmq | ayoung: haha | 16:46 |
| samueldmq | ayoung: I think gyee's work as well can be based on that ... just look at the url from the request and look at the catalog | 16:47 |
| *** dguerri is now known as dguerri` | 16:47 | |
| samueldmq | ayoung: taht should be all for his work | 16:47 |
| ayoung | samueldmq, URL is probably the right abstraction for binding. | 16:47 |
| *** bknudson has joined #openstack-keystone | 16:47 | |
| *** ChanServ sets mode: +v bknudson | 16:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 16:47 |
| samueldmq | ayoung: although we should allow requests coming with a different URL, but with valid catalogs | 16:47 |
| samueldmq | ayoung: seriously, I need more eyes on those things :( | 16:48 |
| *** david-lyle has joined #openstack-keystone | 16:48 | |
| bknudson | There's a lot more people at the nova meetup. | 16:49 |
| bknudson | too many | 16:49 |
| samueldmq | ayoung: btw, the config in middleware should be endpoint_URLS | 16:49 |
| *** browne has quit IRC | 16:49 | |
| samueldmq | ayoung: i.e multiple URLs, right ? | 16:49 |
| samueldmq | ayoung: so we can get all the ids from different interfaces (and probably different urls) | 16:49 |
| *** geoffarn_ has quit IRC | 16:49 | |
| samueldmq | ayoung: sounds correct ? | 16:50 |
| bknudson | I'm afraid they're going to ask me about dynamic policies | 16:50 |
| samueldmq | ayoung: cc ^ | 16:50 |
| ayoung | bknudson, I'm here for now to field questions | 16:50 |
| gyee | samueldmq, yes, reading | 16:50 |
| bknudson | ayoung: great | 16:50 |
| ayoung | bknudson, but only until 2:30 | 16:50 |
| ayoung | bknudson, where is it? | 16:51 |
| gyee | samueldmq, endpoint constraint should work with url as well | 16:51 |
| bknudson | ayoung: I see you posted your presentation | 16:51 |
| ayoung | bknudson, yep | 16:51 |
| bknudson | ayoung: it's here in rochester, mn | 16:51 |
| gyee | it basically match the flatten catalog | 16:51 |
| gyee | whatever's in there | 16:51 |
| samueldmq | gyee: nice, so no need to lookup the server, just look at the url from the request + catalog | 16:51 |
| stevemar | bknudson: why are you late? | 16:51 |
| samueldmq | gyee: agree ? | 16:51 |
| bknudson | stevemar: I work. | 16:51 |
| ayoung | gyee, yeah, binding should work with either, but the endpoint needs to know which URLs to look for when enforcing policy | 16:51 |
| gyee | samueldmq, it can lookup anything in the catalog :) | 16:51 |
| bknudson | stevemar: I don't get to just decide what I want to do. | 16:52 |
| ayoung | the fact that one server can match multiple endpoints is rally kindof yucky | 16:52 |
| gyee | service, region, url, endpoint_id, etc | 16:52 |
| ayoung | samueldmq, OK, slight change of topic: | 16:52 |
| samueldmq | gyee: nice, but ... | 16:52 |
| gyee | ayoung, its just a rule someone need to create | 16:52 |
| ayoung | need to kill global admin | 16:52 |
| samueldmq | gyee: what if one uses another url that is not registered in keystone ? | 16:52 |
| ayoung | samueldmq, DENY | 16:52 |
| samueldmq | gyee: the service can be reached and the token is valid | 16:52 |
| samueldmq | ayoung: is that acceptable ? | 16:52 |
| samueldmq | dstanek: cc ^ | 16:52 |
| gyee | samueldmq, ayoung's right, if its not in the catalog, deny access | 16:53 |
| ayoung | samueldmq, it is correct. | 16:53 |
| samueldmq | ok then, I just want to listen to you guys | 16:53 |
| samueldmq | I have no experience with deployements ;( | 16:53 |
| samueldmq | I mean real deployments | 16:53 |
| gyee | using oslo policy to enforce endpoint binding is awesome | 16:53 |
| samueldmq | that was a concern from dstanek earlier today | 16:53 |
| ayoung | samueldmq, ok, so with the patch I posted yesterday, we can scratch off the last lingering reasons to have global admin for anything that can be project scoped; | 16:53 |
| ayoung | we can recreate a delete project | 16:53 |
| gyee | next step, enhance oslo policy to allow partial matches | 16:53 |
| samueldmq | gyee: it's already doing the policy overlay (under review, spec approved) | 16:54 |
| samueldmq | gyee: it just needs to do the endpoint binding enforcement | 16:54 |
| ayoung | the real question is what to do about things that are not scoped to proejcts...cells and hypervisors in Nova, and Roles, Policy etc in Keystone | 16:54 |
| samueldmq | ayoung: nice go ahead | 16:54 |
| ayoung | so, in Keystone, we should probably scope EVERYTHING | 16:54 |
| samueldmq | ayoung: maybe that should be everywhere | 16:55 |
| bknudson | everyone has name tags here. | 16:55 |
| ayoung | we make a root domain, and everything is in some subordinate of the root domain | 16:55 |
| ayoung | bknudson, dare you to write Puddin' Tame on yours | 16:55 |
| ayoung | samueldmq, https://review.openstack.org/#/c/203852/ BTW, you should look at | 16:55 |
| ayoung | samueldmq, I think is "should" be everywhere, but that is a huge barrier...we need something we can shim on top of the current deployment to make things work | 16:56 |
| *** diazjf has joined #openstack-keystone | 16:56 | |
| ayoung | I was wondering if "scoped to endpoint" would confuse people, espcially with gyee's work; a way of saying a token is for admin tasks on an endpoint...I don't love the idea, and it would be an API change in Keystone. | 16:57 |
| ayoung | we could treat regions, services, and endpoints all as a sort of project | 16:57 |
| ayoung | and allow anything to be scoped under there...it would work nicely with the namespaced roles that henrynash was pushing for | 16:58 |
| gyee | ayoung, scoped to an endpoint is opposite of my work | 16:58 |
| samueldmq | ayoung: I don't like the idea, maybe I don't have the right usecase | 16:58 |
| ayoung | gyee, I know, that is why I was worried about confusion | 16:58 |
| samueldmq | ayoung: scoping endpoints already has its api, that's the endpoint_filtering thing | 16:58 |
| samueldmq | that's my understadning | 16:58 |
| ayoung | samueldmq, use case is "create hypervisor" | 16:59 |
| ayoung | or "upload policy" | 16:59 |
| ayoung | this is "do something that is specific to this endpoint" | 16:59 |
| ayoung | not to a resource inside a project | 16:59 |
| *** jsavak has quit IRC | 16:59 | |
| ayoung | how do we implicit scope all the calls that are out there now | 16:59 |
| samueldmq | ayoung: so get a token to an endpoint ? | 16:59 |
| samueldmq | ayoung: like scoped to an endpoint | 16:59 |
| ayoung | samueldmq, you tried writing a global policy file. Imagine you wanted to say "no gloabl admin" in that...how would you scope calls to create_cell or something | 17:00 |
| ayoung | samueldmq, yeah; scoped to the implicit admin_project for that endpoint | 17:00 |
| ayoung | and...something we can do without requiring the end users edit their policy files | 17:01 |
| *** jasonsb has joined #openstack-keystone | 17:01 | |
| samueldmq | ayoung: actually we can create a role called endpoint_admin and assign it in the (domain?) | 17:01 |
| ayoung | something to replace is_admin.... | 17:01 |
| ayoung | assign it in what domain? There is no domain or project, yet... | 17:01 |
| samueldmq | ayoung: so for the policy crud we only do RBAC check, i.e check for role:endpoint_admin | 17:01 |
| ayoung | right...we need to fix that | 17:01 |
| ayoung | samueldmq, but fixing it in Keystone ie easy. Fixing it in all the other endpoints out there is hard | 17:02 |
| gyee | bknudson, who do we need to blackmail to merge your py3 fixes? | 17:02 |
| samueldmq | ayoung: would you be ok with simply enforcing the endpoint constraint by the URL from the request against the catalog (no request to keystone)? | 17:02 |
| samueldmq | ayoung: errr, I meant gyee ^ | 17:02 |
| ayoung | samueldmq, so gyee 's constraint say "this token can only be used on this endpoint" but what I am looking for is "this token is scoped to perform administrative operations on this endpoint" | 17:03 |
| samueldmq | ayoung: yes I agree, there are too many things to be fixed in policy | 17:03 |
| ayoung | ok...let's assume we can inject the endpoint id into the policy check...somehow | 17:03 |
| *** jsavak has joined #openstack-keystone | 17:03 | |
| ayoung | we still need a scope that makes sense | 17:03 |
| ayoung | what if...we say each endpoint is implicitly a project...or at least acts like one | 17:04 |
| gyee | ayoung, it would be hard to separate out the "administrative operations" from other operations right? | 17:04 |
| ayoung | treat it as a custom resource backend | 17:04 |
| gyee | how would you distinguish them? | 17:04 |
| ayoung | gyee, so this would require a change on the projects stock policy files. | 17:04 |
| bknudson | there's a lack of understanding of hierarchical multitenancy here. | 17:05 |
| gyee | but admin operations are deployment-specific right? the scope of admin may be different from deployment to deployment | 17:05 |
| ayoung | http://git.openstack.org/cgit/openstack/nova/tree/etc/nova/policy.json#n219 | 17:05 |
| bknudson | do we have any presentations? | 17:05 |
| ayoung | bknudson, improvise. Find a white board and a marker, get someone to record and presto---instant presentation | 17:06 |
| gyee | hah | 17:06 |
| gyee | better than powerpoint | 17:07 |
| bknudson | I would have to guess since I don't know what it looks like in the token | 17:07 |
| bknudson | plus it seems to be in progress | 17:07 |
| samueldmq | ayoung: just left a review on 203852 | 17:08 |
| gyee | s/pro/di/ | 17:08 |
| samueldmq | ayoung: sounds good overall, just some small comments | 17:08 |
| ayoung | samueldmq, thanks. One thing that it makes me convinced of, however, is that we need to avoid "magic" project ids that mean someothing. We could not, say, make the root domain always have an id of "1" | 17:09 |
| samueldmq | raildo: htruta ^ do you have a presentation on HMT to let bknudson show it in nova meetup? | 17:10 |
| *** htruta_ has joined #openstack-keystone | 17:10 | |
| *** spandhe has joined #openstack-keystone | 17:10 | |
| raildo | samueldmq: I have some presentations in the google drive, I can share with him | 17:11 |
| raildo | bknudson: samueldmq or the post blog http://raildo.me/hierarchical-multitenancy-in-openstack/ | 17:11 |
| samueldmq | bknudson: raildo thanks ^ | 17:11 |
| stevemar | bknudson should rebel against the man, and decide his own work | 17:11 |
| samueldmq | ayoung: I understand your usecase and that makes sense ... but let's solve that as a separate thing :) | 17:11 |
| samueldmq | ayoung: we already have too much to deal with, and that is an independent thing | 17:12 |
| samueldmq | ayoung: if that makes sense to you | 17:12 |
| ayoung | samueldmq, so, the whole dynamic policy thing hinges on scoping everything, as that will kill global admin and solve 968696 | 17:12 |
| ayoung | its actually the more important problem to solve | 17:12 |
| ayoung | dynamic was the only way I could see to solve it in the past | 17:12 |
| samueldmq | ayoung: so why are we even doing the distribution now ? | 17:12 |
| samueldmq | :( | 17:12 |
| ayoung | samueldmq, because the distribtuion might be the only solution | 17:13 |
| ayoung | I'm still kindof convinced that to be the case | 17:13 |
| ayoung | but if we can get soemthing that works by modifying the stock policies...we will actuallyl speed up the adoption of dynamic | 17:13 |
| samueldmq | ayoung: k | 17:14 |
| bknudson | raildo: thanks | 17:14 |
| ayoung | samueldmq, this is how these things work; you realize there is a problem..you push at it, break it down to smaller problems...expose the softer and harder aspects to solve. | 17:14 |
| samueldmq | ayoung: btw, why don't we just get the policy by url ? endpoint enforcement by url, etc ? | 17:14 |
| *** ankita_wagh has joined #openstack-keystone | 17:14 | |
| samueldmq | ayoung: we don't even need the ids .. | 17:14 |
| bknudson | does the token contain the project hierarchy? | 17:14 |
| samueldmq | ayoung: that sounds like circles in my mind | 17:14 |
| bknudson | how is nova supposed to use it? | 17:14 |
| ayoung | samueldmq, heh...I'd tend to agree, but the existing tooling is all build around ids | 17:15 |
| ayoung | bknudson, token does not | 17:15 |
| ayoung | bknudson, nova has a shadow copy of it | 17:15 |
| ayoung | raildo, htruta how does the HMT hierarchy get synced to nova? | 17:15 |
| samueldmq | bknudson: ayoung it needs to ask keystone for the hierarchy I suppose, that's how quota guys are doing | 17:15 |
| samueldmq | ericksonsantos: ^ right ? | 17:16 |
| ericksonsantos | samueldmq, yes | 17:16 |
| bknudson | auth_token middleware fetches the hierarchy? | 17:16 |
| ericksonsantos | bknudson, for now it is the service | 17:16 |
| bknudson | the token doesn't even know if the project is in a hierarchy, so if you're not using it you still pay the overhead? | 17:17 |
| raildo | ayoung: the nova needs to request the hierarchy in the keystone client | 17:17 |
| ayoung | bknudson, is it in every call? | 17:17 |
| rodrigods | GET /projects?subtree_as_ids or ?parents_as_ids | 17:17 |
| ericksonsantos | ayoung, yes, it would be better if we have this info already in the token | 17:18 |
| raildo | ayoung: there is a patch to do this: https://review.openstack.org/#/c/200941/2/nova/quota.py | 17:18 |
| ayoung | ericksonsantos, heh...that is a lot of payload in each token | 17:18 |
| ayoung | should be fetched and cached... | 17:18 |
| ayoung | we need a general purpose caching strategy...but I'm not going to write it yet | 17:19 |
| rodrigods | the hierarchy with ids | 17:19 |
| rodrigods | isn't too much information | 17:19 |
| ericksonsantos | rodrigods, ++ | 17:19 |
| rodrigods | and we could use the ?nocatalog approach | 17:19 |
| rodrigods | (but... that's for M) | 17:19 |
| dstanek | rodrigods: it is if you need it in the token | 17:20 |
| *** lsmola has quit IRC | 17:20 | |
| rodrigods | dstanek, why? it is not even close to the overhead caused by the service catalog (in an average case) | 17:20 |
| bknudson | rodrigods: I agree, doesn't seem like having 2-5 ids in the token is that much. | 17:21 |
| dstanek | rodrigods: i don't think anyone would let an arbitrarily long lists of IDs get into fernet tokens | 17:21 |
| samueldmq | dstanek: you mean like .. request a token with hierarchical info if you're going to perform hierarchical operations (quotas updates?) | 17:21 |
| bknudson | you can configure the size of the hierarchy in keystone | 17:21 |
| bknudson | how about a /v3/auth/project_hierarchy? | 17:22 |
| rodrigods | I believe makes sense to discuss something for M | 17:22 |
| rodrigods | and today... nova needs to request the hierarchy via GET /projects?subtree_as_ids or ?parents_as_ids | 17:23 |
| ayoung | I think the real question is "why does nova need to know the hierarchy" | 17:23 |
| *** aix has quit IRC | 17:23 | |
| ayoung | I suspect that having it in middleware is the wrong levle\ | 17:23 |
| ayoung | level | 17:23 |
| ayoung | hierarchy should be mostly an authorization tool, and only necessary for Nova on the Quota calls | 17:24 |
| ayoung | who really owns the hierarchy? | 17:24 |
| rodrigods | a parent owns its subtree | 17:24 |
| bknudson | is that all hmt will ever be used for? | 17:24 |
| ericksonsantos | and Cinder | 17:24 |
| bknudson | quotas? | 17:24 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Dynamic Policies Fetch and Cache https://review.openstack.org/134655 | 17:24 |
| rodrigods | bknudson, there is the delete/update hierarchy side as well (in keystone) | 17:24 |
| rodrigods | but mostly quotas, I believe | 17:25 |
| raildo | bknudson: for now, i beliebe so... | 17:25 |
| samueldmq | bknudson: maybe it's the only application we see today for HMT on other services | 17:26 |
| samueldmq | bknudson: keystone side there are N advantages, like project organization, etc | 17:26 |
| bknudson | so on keystone we've got role assignments that are inherited? | 17:27 |
| samueldmq | bknudson: maybe limiting an image to be seen across a certain hierarchy in the future ? | 17:27 |
| *** piyanai has joined #openstack-keystone | 17:27 | |
| samueldmq | bknudson: yes, we already had them from domains, and now it's possible to have inherited role assignments on porjects | 17:27 |
| ayoung | there are requests to be able to list all resources in a proejct and subordinate projects | 17:28 |
| raildo | bknudson: yes, we can inherited a role assignment in a parent project to a subhierarchy | 17:28 |
| *** mylu has quit IRC | 17:28 | |
| bknudson | ok, I can probably describe this to nova folks and make it clear how it works | 17:28 |
| raildo | bknudson: thanks! | 17:29 |
| bknudson | so one question they brought up | 17:29 |
| bknudson | the change was removing the check that token.project_id matches URL project_id | 17:29 |
| bknudson | is that check now supposed to check all the projects up the hierarchy? | 17:29 |
| raildo | bknudson: we are working to don't remove this check... | 17:29 |
| bknudson | token.project_hierarchy matches URL project_id ? | 17:29 |
| *** mylu has joined #openstack-keystone | 17:30 | |
| raildo | bknudson: we are trying to create a solution to use a target project | 17:30 |
| raildo | bknudson: and we can verify if this project is a subproject for the project in the token | 17:30 |
| bknudson | nova meetup group doesn't go out to fancy lunches | 17:30 |
| *** mylu has quit IRC | 17:32 | |
| *** mylu has joined #openstack-keystone | 17:32 | |
| raildo | Can you ask for the nova folks if they like this solution? it's very similiar to other cases in nova. | 17:33 |
| raildo | bknudson: ^ | 17:33 |
| bknudson | raildo: what | 17:34 |
| bknudson | what's the other cases? | 17:34 |
| raildo | bknudson: like: /v2/{tenant_id}/os-quota-sets/{tenant_id} | 17:34 |
| raildo | the second {tenant_id} is the target project | 17:34 |
| raildo | we want to do the same to update quota to a subproject | 17:34 |
| bknudson | interesting. I'll try to steal some time to do a quick pres. | 17:35 |
| bknudson | might be tomorrow | 17:35 |
| raildo | bknudson: thanks a lot | 17:35 |
| *** browne has joined #openstack-keystone | 17:36 | |
| dstanek | raildo: do those checks against the target tenant_id happen on the client side? | 17:36 |
| *** jsavak has quit IRC | 17:36 | |
| bknudson | is there policy support for hierarchical tenants? | 17:37 |
| bknudson | maybe all the quota stuff is happening after policy | 17:37 |
| *** jsavak has joined #openstack-keystone | 17:37 | |
| rodrigods | dstanek, nova requests the base project hierarchy and checks if the target project is there | 17:38 |
| ayoung | samueldmq, what if we said that every endpoint, service, and region was a project, nested via HTM. Then, to perform an admin action, you request a token scoped to the project-for-the-endpoint | 17:39 |
| ayoung | they happen to have the same id... | 17:39 |
| dstanek | rodrigods: that URL "/v2/{tenant_id}/os-quota-sets/{tenant_id}" is that a keystone URL or nova URL? | 17:39 |
| ayoung | if you have a role on the region, you get it for the endpoints in the region via the HMT rules | 17:39 |
| rodrigods | dsirrine, nova URL | 17:39 |
| ericksonsantos | dstanek, i think it is a nova URL | 17:40 |
| samueldmq | bknudson: for now there is no hierarchical checks in the policy (like checking parents etc) if that your question | 17:40 |
| ayoung | and we use the same mechanism we are using for dynamic policy/endpoint binding to check the scope. | 17:40 |
| samueldmq | ayoung: well .. so I could create an instance in a service ? so a nova instance on glance service | 17:40 |
| dstanek | ericksonsantos: ok, then i am much more comfortable with it...i didn't want nova to be parsing keystone urls to find a tenant_id | 17:40 |
| samueldmq | ayoung: that sounds crazy | 17:40 |
| ayoung | samueldmq, it would be just another project | 17:40 |
| dstanek | samueldmq: so crazy it just may work or so crazy that ayoung needs to find a hobby? | 17:41 |
| samueldmq | ayoung: I think this is going to be very confusing :( | 17:41 |
| ayoung | just that an addition class of resources wiould be acceptable for only that project | 17:41 |
| ayoung | "anything that manages resources is a proejct" | 17:41 |
| ayoung | "anything that manages resources is a project" | 17:41 |
| raildo | bknudson: the project_id check happen here: https://github.com/openstack/nova/blob/master/nova/api/openstack/wsgi.py#L804 to every nova api call | 17:41 |
| bknudson | so you want to support setting the quotas for groups of projects? | 17:41 |
| *** pnavarro_ has joined #openstack-keystone | 17:42 | |
| samueldmq | dstanek: prefer to not answer hehe :) ayoung has too much ideas to completely change the world o/ | 17:42 |
| samueldmq | ayoung: what if there were role assignments to endpoints ? | 17:42 |
| bknudson | what's the new API for setting quota on group of projects? | 17:42 |
| *** btully has quit IRC | 17:43 | |
| samueldmq | ayoung: to perform management operations on that endpoint ? is there a case for service/region ? | 17:43 |
| samueldmq | ayoung: maybe just endpoint .. | 17:43 |
| rodrigods | bknudson, don't think so | 17:43 |
| raildo | bknudson: it's to a subproject... for each call | 17:43 |
| rodrigods | just in a single project per request | 17:43 |
| *** rletrocquer has quit IRC | 17:44 | |
| bknudson | the project and all its children | 17:44 |
| bknudson | right/ | 17:44 |
| bknudson | right/ | 17:44 |
| bknudson | right? | 17:44 |
| ericksonsantos | bknudson, yes | 17:44 |
| raildo | bknudson: yes | 17:44 |
| bknudson | so it's on the enforcing side that you need to know the hierarchy. | 17:45 |
| bknudson | the bookkeeping | 17:45 |
| ericksonsantos | bknudson, yes | 17:45 |
| rodrigods | bknudson, yes | 17:45 |
| raildo | bknudson: you're ready to implement hmt + reseller with us \o/ | 17:46 |
| *** fangzhou has joined #openstack-keystone | 17:46 | |
| ayoung | samueldmq, service /region would be just for role assignements. You would still get a token specific to the project for the endpoint you want to talk to directly | 17:46 |
| bknudson | so one of the changes was removing the check for target project_id == token project_id ; why does that need to happen? | 17:46 |
| *** diazjf has quit IRC | 17:47 | |
| *** piyanai has quit IRC | 17:47 | |
| raildo | bknudson: if this new call, we don't need to change this | 17:47 |
| bknudson | since you can set the quota on the project | 17:47 |
| samueldmq | ayoung: I was saying tokens scoped to endpoints .. so that means to perform management operations on that endpoint | 17:47 |
| ayoung | samueldmq, you are correct | 17:47 |
| samueldmq | ayoung: things puppet would do (as policy fetch ? ) | 17:47 |
| ayoung | samueldmq, only operations via and API | 17:47 |
| ayoung | samueldmq, only operations via an API | 17:48 |
| samueldmq | ayoung: so the way I was proposing it would be to explicitly request a token scoped to an endpoint, and have role assignments to it, etc | 17:48 |
| samueldmq | ayoung: in the future | 17:48 |
| samueldmq | ayoung: yes only via API (controlled by the policy, and then using the endpoint scoped token) | 17:48 |
| *** bitblt has joined #openstack-keystone | 17:48 | |
| raildo | with the current APi call for quota, we can only change the quota to the project in the context, we can't update quota to another project | 17:48 |
| raildo | bknudson: so, that's why we want to add the "target project" in the api call, and you will be able to update the quota to a subproject | 17:49 |
| raildo | with a token scoped to a parent project | 17:49 |
| ayoung | samueldmq, "this token can only be used on this endpoint" is different from "this token can only be used for administrative actions on this endpoint" gyee is weorking on the first, I want to get to the second | 17:49 |
| raildo | bknudson: and without removing this check | 17:50 |
| bknudson | I thought the API was /v2/{tenant_id}/osquota-sets/{tenant_id} | 17:50 |
| bknudson | so you can set the quota for a different project | 17:50 |
| *** mylu has quit IRC | 17:50 | |
| raildo | bknudson: it's just a example, that we want to do similiar like this | 17:51 |
| *** bitblt has quit IRC | 17:51 | |
| raildo | let me find the current call | 17:51 |
| bknudson | if you remove that check are you adding the check for project hierarchy elsewhere? | 17:51 |
| samueldmq | ayoung: yeah gyee is working on ensuring the tokens are used in the place they are supposed to | 17:51 |
| *** bitblt has joined #openstack-keystone | 17:51 | |
| rodrigods | currently it is /v2.1/os-quota-sets/{tenant_id} (in nova) | 17:51 |
| *** amakarov_away is now known as amakarov | 17:51 | |
| samueldmq | ayoung: you want tokens to perform administrative operations they're supposed to | 17:51 |
| raildo | bknudson: no, we will not change the check | 17:52 |
| samueldmq | ayoung: using that first, of course | 17:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 17:52 |
| raildo | bknudson: in the first moment we thought in remove this check, but after rethink the design, we decide to create a new api call to update a subproject (/v2.1/os-quota-sets/{project_id}/target/{subproject_id}) | 17:53 |
| bknudson | raildo: the new API sounds safer | 17:54 |
| raildo | bknudson: so, we don't need to change any nova check (or in other service) | 17:54 |
| rodrigods | bknudson, ++ | 17:54 |
| raildo | bknudson: ++ | 17:54 |
| *** geoffarnold has joined #openstack-keystone | 17:54 | |
| *** markvoelker has joined #openstack-keystone | 17:55 | |
| bknudson | but also means you're going to need new API for every HMT operation ? | 17:55 |
| henrynash | samueldmq: I fixed up a few comments etc. in https://review.openstack.org/137202 | 17:55 |
| samueldmq | henrynash: just saw .. feel free to change L817 in assignment/core.py | 17:55 |
| samueldmq | henrynash: the use of f() as a function, I agree that's confusing | 17:55 |
| samueldmq | henrynash: thanks very much! | 17:55 |
| raildo | bknudson: I don't think so... the problem here, is in the quota actions, I need to handle with a project that is not my project scoped token | 17:56 |
| rodrigods | bknudson, that is not only for HMT | 17:56 |
| raildo | rodrigods: yes, it's happen with other operations in nova, and other services like cinder | 17:57 |
| stevemar | last minute reminder to add to the keystone meeting agenda https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 17:57 |
| *** bitblt has quit IRC | 17:58 | |
| henrynash | stevemar: already sneaked one in…. | 17:58 |
| *** bitblt has joined #openstack-keystone | 17:58 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 17:58 |
| gyee | samueldmq, ayoung, and yeah, my patch is now officially depending bknudson py3 patches | 17:59 |
| dstanek | i'm not going to be in my office for the whole meeting, but i'm going to try to keep up | 17:59 |
| henrynash | samueldmq: done! | 17:59 |
| gyee | cause jenkins is broken right now for keystonemiddleware | 17:59 |
| ayoung | we meeting today? | 17:59 |
| stevemar | yep | 17:59 |
| *** mylu has joined #openstack-keystone | 17:59 | |
| ericksonsantos | raildo, yes, in cinder we have to pass the ID for the tenant for which we want to show, update, or delete quotas. | 17:59 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:00 |
| bknudson | I feel like we were meeting all last week. | 18:00 |
| ericksonsantos | maybe nova have to do that too | 18:00 |
| raildo | ericksonsantos: ++ | 18:00 |
| lbragstad | bknudson: ++ | 18:00 |
| lbragstad | week long meetings! | 18:00 |
| dstanek | bknudson: that was just an excuse for fancy lunches | 18:00 |
| samueldmq | henrynash: thanks ! :) | 18:00 |
| henrynash | we want more meetings…we live for them... | 18:00 |
| *** piyanai has joined #openstack-keystone | 18:02 | |
| *** boris-42 has joined #openstack-keystone | 18:02 | |
| *** mylu has quit IRC | 18:06 | |
| *** jsavak has quit IRC | 18:07 | |
| *** jsavak has joined #openstack-keystone | 18:08 | |
| *** mylu has joined #openstack-keystone | 18:09 | |
| openstackgerrit | Richard Megginson proposed openstack/keystone: add federation docs for mod_auth_mellon https://review.openstack.org/198083 | 18:10 |
| *** fhubik has quit IRC | 18:10 | |
| *** rm_work|away has joined #openstack-keystone | 18:12 | |
| *** rm_work|away is now known as rm_work | 18:12 | |
| *** rm_work has quit IRC | 18:12 | |
| *** rm_work has joined #openstack-keystone | 18:12 | |
| *** sudorandom has joined #openstack-keystone | 18:13 | |
| *** jamielennox has joined #openstack-keystone | 18:15 | |
| *** ChanServ sets mode: +v jamielennox | 18:15 | |
| *** htruta_ has quit IRC | 18:16 | |
| *** jamielennox is now known as jamielennox|away | 18:16 | |
| *** TheIntern has joined #openstack-keystone | 18:17 | |
| *** btully has joined #openstack-keystone | 18:19 | |
| *** diazjf has joined #openstack-keystone | 18:19 | |
| *** david-lyle has quit IRC | 18:21 | |
| *** jamielennox|away is now known as jamielennox | 18:23 | |
| bknudson | they're doing a google hangout here for remote participant | 18:23 |
| *** btully has quit IRC | 18:23 | |
| *** ayoung has quit IRC | 18:36 | |
| *** piyanai has quit IRC | 18:37 | |
| *** hogepodge has joined #openstack-keystone | 18:38 | |
| *** piyanai has joined #openstack-keystone | 18:42 | |
| *** piyanai has quit IRC | 18:42 | |
| *** amick has quit IRC | 18:44 | |
| *** mylu has quit IRC | 18:45 | |
| *** mylu has joined #openstack-keystone | 18:51 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Unified delegation spec https://review.openstack.org/189816 | 18:52 |
| *** mylu has quit IRC | 18:52 | |
| *** jecarey has quit IRC | 18:57 | |
| marekd | rodrigods: raildo samueldmq: wasn't your colleague working on puppet module for federation? | 18:59 |
| samueldmq | iurygregory: cc ^ | 18:59 |
| gyee | who sign up for devstack k2k work last week? I can't seem to remember | 19:00 |
| dolphm | lbragstad: ^ ? | 19:00 |
| iurygregory | hi marekd i'm creating a module for puppet keystone =) | 19:00 |
| *** geoffarnold has quit IRC | 19:00 | |
| samueldmq | gyee: I'll implement the getting endpoint_ids from url by looking up the catalog | 19:01 |
| gyee | samueldmq, sounds good | 19:01 |
| samueldmq | gyee: as we kindof agreed on that already at midcycle (*I think*) | 19:01 |
| morganfainberg | dstanek: so lets plan a meeting so we can plan meetings | 19:02 |
| morganfainberg | dstanek: easy, right? | 19:02 |
| gyee | tongue twister | 19:03 |
| dstanek | morganfainberg: what's wrong with that? | 19:03 |
| *** mylu has joined #openstack-keystone | 19:03 | |
| morganfainberg | dstanek: noooooothhhhhinnnng | 19:03 |
| samueldmq | morganfainberg: sounds good, we should send a ml message to schedule that first | 19:03 |
| *** tsymancz1k has left #openstack-keystone | 19:03 | |
| *** e0ne has joined #openstack-keystone | 19:04 | |
| *** bknudson has quit IRC | 19:06 | |
| lbragstad | gyee: dolphm o/ | 19:10 |
| gyee | lbragstad, sorry I have to run, lets chat about getting k2k to devstack later | 19:11 |
| *** gyee has quit IRC | 19:11 | |
| lbragstad | I don't think I signed up for anything, but marek did just help me figure out the last couple kinks in deploying K2K from source with ansible | 19:11 |
| lbragstad | aww.... he left... | 19:11 |
| dolphm | it's bedtime for him! | 19:12 |
| *** TheIntern has quit IRC | 19:13 | |
| *** ankita_wagh has quit IRC | 19:14 | |
| *** amit213 has quit IRC | 19:14 | |
| lbragstad | dolphm: ^ I did get ansible to deploy k2k federation in one shot, sets up the sp and ipd then the test_federation_exercises.py confirms you can get a SAML assertion, unscoped federated token, and then scope it | 19:14 |
| *** amit213 has joined #openstack-keystone | 19:14 | |
| lbragstad | dolphm: need to clean it up, a lot... but it works | 19:14 |
| dolphm | lbragstad: badass | 19:15 |
| *** geoffarnold has joined #openstack-keystone | 19:15 | |
| lbragstad | very.. | 19:15 |
| * lbragstad is ready for beers | 19:15 | |
| * lbragstad owes marekd plenty of beers | 19:15 | |
| *** mylu has quit IRC | 19:20 | |
| *** TheIntern has joined #openstack-keystone | 19:20 | |
| *** mylu has joined #openstack-keystone | 19:21 | |
| *** pawel__ has joined #openstack-keystone | 19:21 | |
| *** mylu has quit IRC | 19:22 | |
| *** tsymanczyk has joined #openstack-keystone | 19:24 | |
| *** mylu has joined #openstack-keystone | 19:24 | |
| *** jecarey has joined #openstack-keystone | 19:26 | |
| *** david-lyle has joined #openstack-keystone | 19:34 | |
| *** tsymanczyk is now known as Guest9302 | 19:34 | |
| *** piyanai has joined #openstack-keystone | 19:38 | |
| *** jecarey_ has joined #openstack-keystone | 19:40 | |
| *** mylu has quit IRC | 19:45 | |
| *** ayoung has joined #openstack-keystone | 19:47 | |
| *** ChanServ sets mode: +v ayoung | 19:47 | |
| *** mylu has joined #openstack-keystone | 19:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: switch to oslo.cache https://review.openstack.org/195873 | 19:48 |
| *** thedodd has joined #openstack-keystone | 19:50 | |
| *** stevemar has quit IRC | 19:51 | |
| *** jsavak has quit IRC | 19:52 | |
| *** jecarey_ has quit IRC | 19:54 | |
| *** jecarey has quit IRC | 19:54 | |
| *** jecarey has joined #openstack-keystone | 19:54 | |
| *** piyanai has quit IRC | 19:55 | |
| samueldmq | ayoung: so we get the endpoint_ids based on the requested URL (from wsgi) and in the token's catalog | 19:55 |
| *** piyanai has joined #openstack-keystone | 19:55 | |
| samueldmq | ayoung: I saw you abandoned your 'endpoint_ids from url' change | 19:56 |
| *** pnavarro_ has quit IRC | 19:57 | |
| *** pawel__ has quit IRC | 19:57 | |
| *** pauloewerton has joined #openstack-keystone | 19:58 | |
| samueldmq | henrynash: you around ? | 19:58 |
| *** bitblt has quit IRC | 19:58 | |
| samueldmq | henrynash: oh nvm, I thought your -1 in change #199844 was due to the midcycle decision | 19:59 |
| samueldmq | henrynash: which is what I am trying to learn more from :) | 19:59 |
| *** lmtaylor1 has joined #openstack-keystone | 20:02 | |
| *** lmtaylor1 has left #openstack-keystone | 20:02 | |
| *** Guest9302 has left #openstack-keystone | 20:02 | |
| *** e0ne has quit IRC | 20:02 | |
| *** tsymanczyk_ has joined #openstack-keystone | 20:03 | |
| ayoung | samueldmq, I think I made it -1 WIP | 20:03 |
| ayoung | samueldmq, and...meeting | 20:03 |
| *** mylu has quit IRC | 20:03 | |
| samueldmq | ayoung: I'd like to see what the solution to resolve ids from urls would look like | 20:04 |
| samueldmq | ayoung: as will be my next implementation step | 20:04 |
| samueldmq | ayoung: I mean the details ... what get from the catalog/server, etc. I know the general direction | 20:04 |
| *** ayoung is now known as ayoung-mtg | 20:04 | |
| ayoung-mtg | samueldmq, short answer...same approch, just calculated in the client, not server...we can do either | 20:05 |
| samueldmq | ayoung-mtg: yeah, but we can't get the whole list of ids from the clietn (based on the catalog , which may not contain all the endpoint ids) | 20:06 |
| samueldmq | ayoung-mtg: and the policy may be associated with the missing endpoint_id | 20:06 |
| samueldmq | ayoung-mtg: so we need to go to the server anyhow | 20:06 |
| *** btully has joined #openstack-keystone | 20:07 | |
| *** btully has quit IRC | 20:12 | |
| samueldmq | does regions own services ? or do service have regions ? | 20:13 |
| samueldmq | s/does/do | 20:13 |
| *** jsavak has joined #openstack-keystone | 20:14 | |
| *** TheIntern has quit IRC | 20:18 | |
| *** ankita_wagh has joined #openstack-keystone | 20:24 | |
| *** e0ne has joined #openstack-keystone | 20:27 | |
| *** jsavak has quit IRC | 20:27 | |
| *** jsavak has joined #openstack-keystone | 20:28 | |
| openstackgerrit | Paulo Ewerton Gomes Fragoso proposed openstack/keystoneauth: Fix service_type default value in url_for method https://review.openstack.org/204253 | 20:29 |
| *** amick has joined #openstack-keystone | 20:35 | |
| *** _cjones_ has quit IRC | 20:38 | |
| *** _cjones_ has joined #openstack-keystone | 20:38 | |
| *** piyanai has quit IRC | 20:39 | |
| morganfainberg | ayoung-mtg: fyi- deferred, but by next week - comments or accept or comments and accept. | 20:40 |
| ayoung-mtg | morganfainberg, thanks. | 20:40 |
| morganfainberg | ayoung-mtg: since no one said deny. | 20:40 |
| *** piyanai has joined #openstack-keystone | 20:45 | |
| *** e0ne has quit IRC | 20:48 | |
| *** diazjf has left #openstack-keystone | 20:51 | |
| *** stevemar has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v stevemar | 20:52 | |
| *** amick has left #openstack-keystone | 20:53 | |
| *** amick has joined #openstack-keystone | 20:54 | |
| *** amick is now known as amickus | 20:55 | |
| *** diazjf has joined #openstack-keystone | 20:55 | |
| *** stevemar has quit IRC | 20:55 | |
| samueldmq | morganfainberg: http://paste.openstack.org/show/397098/ | 20:56 |
| *** tsymanczyk_ is now known as tsymanczyk | 20:58 | |
| *** raildo has quit IRC | 20:58 | |
| *** diazjf has quit IRC | 20:59 | |
| *** piyanai has quit IRC | 21:04 | |
| *** e0ne has joined #openstack-keystone | 21:14 | |
| *** diazjf has joined #openstack-keystone | 21:15 | |
| *** e0ne has quit IRC | 21:15 | |
| *** e0ne has joined #openstack-keystone | 21:16 | |
| *** ayoung-mtg is now known as ayoung | 21:20 | |
| ayoung | samueldmq, if the catalog does not have enough information in it to determine the endpoint id, DENY | 21:21 |
| *** amakarov is now known as amakarov_away | 21:21 | |
| ayoung | samueldmq, http://paste.openstack.org/show/397098/ looks right on | 21:21 |
| henrynash | samueldmq: sorry, missed your question from earlier? | 21:24 |
| *** stevemar has joined #openstack-keystone | 21:25 | |
| *** ChanServ sets mode: +v stevemar | 21:25 | |
| ayoung | samueldmq, I think I have a solution | 21:28 |
| ayoung | the authtoken section of the conf file has | 21:28 |
| ayoung | admin_tenant_name = service | 21:28 |
| ayoung | now, that is v2, and v3 would have domain in there as well | 21:28 |
| ayoung | so...we can scope the tokens for cell and hypervisors etc to that | 21:28 |
| ayoung | samueldmq, the real issue is whether the config is available to enforce policy. I think it is | 21:29 |
| *** jecarey has quit IRC | 21:30 | |
| *** e0ne has quit IRC | 21:33 | |
| *** dguerri` is now known as dguerri | 21:37 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Clarify project hierachy and parent usage within the API https://review.openstack.org/200624 | 21:40 |
| *** dguerri is now known as dguerri` | 21:41 | |
| *** jsavak has quit IRC | 21:43 | |
| *** piyanai has joined #openstack-keystone | 21:44 | |
| *** stevemar has quit IRC | 21:48 | |
| *** pauloewerton has quit IRC | 21:48 | |
| *** stevemar has joined #openstack-keystone | 21:48 | |
| *** ChanServ sets mode: +v stevemar | 21:48 | |
| *** piyanai has quit IRC | 21:53 | |
| *** diazjf has quit IRC | 21:53 | |
| *** henrynash has quit IRC | 21:54 | |
| *** btully has joined #openstack-keystone | 21:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:57 | |
| *** mestery has quit IRC | 22:00 | |
| *** btully has quit IRC | 22:00 | |
| *** kragniz has quit IRC | 22:01 | |
| *** piyanai has joined #openstack-keystone | 22:01 | |
| *** dims_ has quit IRC | 22:01 | |
| *** kragniz has joined #openstack-keystone | 22:02 | |
| *** roxanaghe has quit IRC | 22:02 | |
| *** diazjf has joined #openstack-keystone | 22:02 | |
| *** dsirrine has quit IRC | 22:07 | |
| *** edmondsw has quit IRC | 22:07 | |
| *** dsirrine has joined #openstack-keystone | 22:09 | |
| *** odyssey4me has quit IRC | 22:11 | |
| *** odyssey4me has joined #openstack-keystone | 22:14 | |
| *** piyanai_ has joined #openstack-keystone | 22:22 | |
| *** piyanai has quit IRC | 22:23 | |
| *** piyanai_ is now known as piyanai | 22:23 | |
| *** mgarza has quit IRC | 22:24 | |
| *** gordc has quit IRC | 22:33 | |
| *** piyanai has quit IRC | 22:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/204300 | 23:13 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 23:13 |
| *** thedodd has quit IRC | 23:13 | |
| *** thedodd has joined #openstack-keystone | 23:14 | |
| *** thedodd has quit IRC | 23:18 | |
| *** stevemar has quit IRC | 23:20 | |
| *** stevemar has joined #openstack-keystone | 23:21 | |
| *** ChanServ sets mode: +v stevemar | 23:21 | |
| *** boris-42 has quit IRC | 23:22 | |
| *** stevemar has quit IRC | 23:25 | |
| *** david-lyle has quit IRC | 23:28 | |
| *** diazjf has quit IRC | 23:32 | |
| *** shaleh has joined #openstack-keystone | 23:48 | |
| *** jiaxi has joined #openstack-keystone | 23:48 | |
| jiaxi | dstanek, | 23:50 |
| jiaxi | dstanek, are you here ? | 23:50 |
| *** ankita_wagh has quit IRC | 23:50 | |
| *** ctracey has quit IRC | 23:53 | |
| *** gyee has joined #openstack-keystone | 23:54 | |
| *** ChanServ sets mode: +v gyee | 23:54 | |
| *** ctracey has joined #openstack-keystone | 23:55 | |
| *** ankita_wagh has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
