| *** darrenc_afk is now known as darrenc | 00:11 | |
| *** chlong has joined #openstack-keystone | 00:26 | |
| *** geoffarnold has quit IRC | 00:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/208698 | 00:45 |
|---|---|---|
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/208699 | 00:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/208700 | 00:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 00:45 |
| *** edmondsw has quit IRC | 00:45 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/208719 | 00:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf: Updated from global requirements https://review.openstack.org/208726 | 00:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/208730 | 00:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/192319 | 00:48 |
| openstackgerrit | Merged openstack/keystone: Add better user feedback when bind is not implemented https://review.openstack.org/203788 | 00:50 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/208698 | 00:53 |
| *** topol has joined #openstack-keystone | 00:55 | |
| *** ChanServ sets mode: +v topol | 00:55 | |
| *** topol has quit IRC | 01:00 | |
| *** fangzhou_ has joined #openstack-keystone | 01:01 | |
| *** fangzhou has quit IRC | 01:02 | |
| *** fangzhou_ is now known as fangzhou | 01:02 | |
| dstanek | anyone around for a sanity check? | 01:05 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/208652 | 01:08 |
| *** jiaxi_ has joined #openstack-keystone | 01:11 | |
| *** browne has quit IRC | 01:12 | |
| *** tqtran has quit IRC | 01:14 | |
| lbragstad | dstanek: I have a minute, what's up? | 01:16 |
| dstanek | lbragstad: on a phone, so it's hard to reason about, but i made a comment on the openstack-dev list about the fernet rotate script that was linked | 01:17 |
| dstanek | lbragstad: the script appears to be incorrect or at the very least confusing | 01:17 |
| lbragstad | dstanek: in the keystone/token/providers/fernet/utils.py module? | 01:17 |
| lbragstad | i'll admit, that code it's the most straight-forward | 01:18 |
| dstanek | lbragstad: no, not our cide | 01:18 |
| lbragstad | not this? https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/utils.py#L153-L226 | 01:18 |
| dstanek | someone proposed a script to automate that...jas | 01:19 |
| lbragstad | oh | 01:19 |
| dstanek | https://www.google.com | 01:19 |
| dstanek | ooops | 01:19 |
| lbragstad | good link | 01:19 |
| lbragstad | ;) | 01:19 |
| lbragstad | one of my favorites | 01:19 |
| dstanek | http://paste.openstack.org/show/406674/ | 01:19 |
| lbragstad | oh, sure | 01:19 |
| lbragstad | from the mailing list | 01:19 |
| lbragstad | so that second step isn't going to work | 01:20 |
| lbragstad | because it will never actually send the *new* primary key to node-1 | 01:20 |
| lbragstad | it will only ever send the new staged key, which doesn't actually encrypt anything until it's promoted to primary | 01:21 |
| dstanek | wiell they sync 0 to everything after a rotate - so that should be ok | 01:21 |
| dstanek | because the other two nodes will still rotate, but have the 0 key replaced by the rsync | 01:22 |
| lbragstad | oh, sure | 01:22 |
| dstanek | but sine totate happens on node-1 again it will have extra keys | 01:22 |
| dstanek | since* | 01:22 |
| dstanek | rotate* | 01:22 |
| lbragstad | yes, true | 01:22 |
| dstanek | eventually if the limit is hit and thngs pruned you might lose good keys that are on 2 and 3 right? | 01:23 |
| *** piyanai has joined #openstack-keystone | 01:23 | |
| lbragstad | yes | 01:23 |
| lbragstad | exactly | 01:23 |
| dstanek | ok, that's wht i thouht | 01:23 |
| *** davechen has joined #openstack-keystone | 01:25 | |
| lbragstad | dstanek: is the second key rotation necessary? | 01:25 |
| dstanek | so the argument that the script *isn't* overly complex is stupid because it's wrong in a hard to debug way! | 01:25 |
| lbragstad | I guess it is necessary | 01:25 |
| dstanek | they seem to to it to get 0 -> max and to prune | 01:25 |
| dstanek | instead of rsyncc | 01:25 |
| lbragstad | but if you're using rsync, | 01:25 |
| lbragstad | just rsync the entire key repository | 01:25 |
| dstanek | exactly! | 01:25 |
| lbragstad | and perform the rotation once | 01:25 |
| lbragstad | instead of using "half" of it to do a promotion? | 01:26 |
| lbragstad | well, actually | 01:26 |
| lbragstad | node-1 will rotate keys once, which means that it will have a different 0 key from node-2 and node-3 | 01:26 |
| lbragstad | right? | 01:26 |
| dstanek | yes | 01:26 |
| lbragstad | ah, I get it... yeah that's confusing | 01:27 |
| dstanek | and broken! | 01:27 |
| dstanek | ok, so i'm not crazy. i thought that i was just reading it incorrectly | 01:27 |
| *** davechen1 has joined #openstack-keystone | 01:30 | |
| lbragstad | dstanek: so, something like this would work? http://cdn.pasteraw.com/4s9nt4h64dpm06mhkg4yb1lakl62rpx | 01:31 |
| lbragstad | http://cdn.pasteraw.com/d6odnvtt1u9zsw5mg4xetzgufy1mjua | 01:31 |
| *** davechen has quit IRC | 01:31 | |
| dstanek | lbragstad: yep | 01:33 |
| lbragstad | cool | 01:33 |
| *** davechen has joined #openstack-keystone | 01:37 | |
| dstanek | hmmm....for some reason i get a bunch of test failures for test_list_group_role_assignment | 01:37 |
| *** davechen1 has quit IRC | 01:39 | |
| *** jiaxi_ has quit IRC | 01:43 | |
| *** tobe_ has joined #openstack-keystone | 01:46 | |
| *** davechen1 has joined #openstack-keystone | 01:46 | |
| *** davechen has quit IRC | 01:48 | |
| *** davechen1 is now known as davechen | 02:01 | |
| *** piyanai has quit IRC | 02:03 | |
| *** gyee has quit IRC | 02:11 | |
| *** zzzeek has quit IRC | 02:12 | |
| *** spandhe has quit IRC | 02:33 | |
| *** browne has joined #openstack-keystone | 02:41 | |
| *** kiran-r has joined #openstack-keystone | 02:52 | |
| *** hakimo has joined #openstack-keystone | 02:52 | |
| *** tobe_ has quit IRC | 02:54 | |
| *** dims has joined #openstack-keystone | 02:54 | |
| *** hakimo_ has quit IRC | 02:55 | |
| *** lhcheng has quit IRC | 03:10 | |
| *** spandhe has joined #openstack-keystone | 03:11 | |
| *** spandhe_ has joined #openstack-keystone | 03:14 | |
| *** dims has quit IRC | 03:15 | |
| *** spandhe has quit IRC | 03:16 | |
| *** spandhe_ is now known as spandhe | 03:16 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/197254 | 03:17 |
| *** lhcheng has joined #openstack-keystone | 03:19 | |
| *** ChanServ sets mode: +v lhcheng | 03:19 | |
| *** btully has quit IRC | 03:20 | |
| *** lhcheng has quit IRC | 03:20 | |
| *** lhcheng has joined #openstack-keystone | 03:20 | |
| *** ChanServ sets mode: +v lhcheng | 03:20 | |
| *** fangzhou has quit IRC | 03:28 | |
| *** ayoung has quit IRC | 03:30 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/195903 | 03:42 |
| *** lhcheng has quit IRC | 03:47 | |
| *** afazekas has joined #openstack-keystone | 03:54 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 03:55 |
| *** lhcheng has joined #openstack-keystone | 04:06 | |
| *** ChanServ sets mode: +v lhcheng | 04:06 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/208719 | 04:09 |
| *** vivekd has joined #openstack-keystone | 04:14 | |
| *** _kiran_ has joined #openstack-keystone | 04:16 | |
| *** kiran-r has quit IRC | 04:18 | |
| *** kiran-r has joined #openstack-keystone | 04:25 | |
| *** _kiran_ has quit IRC | 04:29 | |
| *** jdandrea has quit IRC | 04:30 | |
| *** richm has quit IRC | 04:32 | |
| *** kiran-r has quit IRC | 04:48 | |
| *** arunkant has quit IRC | 04:49 | |
| *** hrou has quit IRC | 04:49 | |
| *** btully has joined #openstack-keystone | 04:56 | |
| *** Nirupama has joined #openstack-keystone | 05:08 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/208652 | 05:12 |
| *** yottatsa has joined #openstack-keystone | 05:17 | |
| *** vivekd has quit IRC | 05:27 | |
| *** tobe_ has joined #openstack-keystone | 05:36 | |
| *** josecastroleon has joined #openstack-keystone | 05:43 | |
| *** zzzeek has joined #openstack-keystone | 05:48 | |
| openstackgerrit | Andrey Pavlov proposed openstack/keystonemiddleware: Adding parse of protocol v4 of AWS auth to ec2_token https://review.openstack.org/205440 | 05:49 |
| *** afazekas has quit IRC | 05:50 | |
| *** tobe_ has quit IRC | 05:50 | |
| *** vivekd has joined #openstack-keystone | 05:51 | |
| *** tobe_ has joined #openstack-keystone | 05:53 | |
| *** tobe_ has quit IRC | 05:58 | |
| *** topol has joined #openstack-keystone | 05:58 | |
| *** ChanServ sets mode: +v topol | 05:58 | |
| *** kiran-r has joined #openstack-keystone | 06:00 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Show helpful message when request body is not provided https://review.openstack.org/195903 | 06:02 |
| *** Guest72363 has quit IRC | 06:02 | |
| *** topol has quit IRC | 06:02 | |
| *** ParsectiX has joined #openstack-keystone | 06:14 | |
| *** spandhe_ has joined #openstack-keystone | 06:17 | |
| *** kiran-r has quit IRC | 06:17 | |
| *** spandhe has quit IRC | 06:18 | |
| *** spandhe_ is now known as spandhe | 06:18 | |
| *** fangzhou has joined #openstack-keystone | 06:18 | |
| *** fangzhou has quit IRC | 06:23 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/208823 | 06:23 |
| breton | wow, my script is being discussed | 06:28 |
| *** woodster_ has quit IRC | 06:30 | |
| *** belmoreira has joined #openstack-keystone | 06:31 | |
| *** josecastroleon has quit IRC | 06:56 | |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| *** h00327910__ has joined #openstack-keystone | 07:01 | |
| *** josecastroleon has quit IRC | 07:02 | |
| *** lhcheng has quit IRC | 07:11 | |
| *** ParsectiX has quit IRC | 07:12 | |
| *** josecastroleon has joined #openstack-keystone | 07:15 | |
| *** ParsectiX has joined #openstack-keystone | 07:24 | |
| *** vivekd has quit IRC | 07:24 | |
| *** kafka_ has joined #openstack-keystone | 07:25 | |
| *** fhubik has joined #openstack-keystone | 07:25 | |
| *** fhubik is now known as fhubik_afk | 07:25 | |
| kafka_ | anybody have see the bug https://bugs.launchpad.net/python-openstackclient/+bug/1479837 ?? | 07:25 |
| openstack | Launchpad bug 1479837 in Keystone "improper handling non existing identity providers " [Medium,Triaged] - Assigned to kafka (guowang) | 07:25 |
| kafka_ | need someone to join the discuss | 07:26 |
| *** fhubik_afk is now known as fhubik | 07:28 | |
| *** spandhe has quit IRC | 07:30 | |
| *** browne has quit IRC | 07:36 | |
| *** ParsectiX has quit IRC | 07:40 | |
| *** lsmola has joined #openstack-keystone | 07:42 | |
| *** btully has quit IRC | 07:44 | |
| *** vivekd has joined #openstack-keystone | 07:46 | |
| *** chlong has quit IRC | 07:47 | |
| openstackgerrit | javeme proposed openstack/keystone: Fix typos of RoleAssignmentV3._format_entity doc https://review.openstack.org/208864 | 07:49 |
| *** fhubik is now known as fhubik_afk | 07:58 | |
| *** fhubik_afk is now known as fhubik | 08:02 | |
| *** jistr has joined #openstack-keystone | 08:08 | |
| *** ParsectiX has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 08:11 |
| yottatsa | hi! | 08:13 |
| yottatsa | marekd morganfainberg could you please look at https://review.openstack.org/#/c/206921/ | 08:14 |
| *** bdossant has joined #openstack-keystone | 08:14 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Refactor: Provider._rebuild_federated_info() https://review.openstack.org/208872 | 08:17 |
| *** tobe_ has joined #openstack-keystone | 08:17 | |
| *** aix has joined #openstack-keystone | 08:18 | |
| openstackgerrit | Merged openstack/keystone: Cleanup use of iteritems https://review.openstack.org/206785 | 08:24 |
| openstackgerrit | Merged openstack/keystone: Use dict.items() rather than six.iteritems() https://review.openstack.org/200762 | 08:24 |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/208699 | 08:25 |
| *** vince_ has joined #openstack-keystone | 08:33 | |
| *** hogepodge has quit IRC | 08:35 | |
| *** crinkle has quit IRC | 08:35 | |
| *** _fortis has quit IRC | 08:35 | |
| *** Kiall has quit IRC | 08:35 | |
| *** timburke has quit IRC | 08:35 | |
| *** devananda has quit IRC | 08:35 | |
| *** rmstar has quit IRC | 08:35 | |
| *** bdossant has quit IRC | 08:36 | |
| *** hogepodge has joined #openstack-keystone | 08:37 | |
| *** crinkle has joined #openstack-keystone | 08:37 | |
| *** _fortis has joined #openstack-keystone | 08:37 | |
| *** Kiall has joined #openstack-keystone | 08:37 | |
| *** timburke has joined #openstack-keystone | 08:37 | |
| *** devananda has joined #openstack-keystone | 08:37 | |
| *** rmstar has joined #openstack-keystone | 08:37 | |
| *** bdossant has joined #openstack-keystone | 08:37 | |
| marekd | yottatsa: ok | 08:39 |
| *** bdossant has quit IRC | 08:43 | |
| *** rm_work is now known as rm_work|away | 08:43 | |
| *** bdossant has joined #openstack-keystone | 08:44 | |
| *** e0ne has joined #openstack-keystone | 08:44 | |
| vince_ | hi guys, I have federated an openstack installation with google, so if I hit the right URI I get redirected to google accounts login to authenitcate there. The point is that I would like to use the CLI instead of the browser to do e.g., "openstack container list". Is this supported? | 08:44 |
| marekd | vince_: yep. | 08:45 |
| marekd | bacically stevemar (who is asleep now) did some work with regards on implementing openid connect support in keystoneclient/keystoneauth | 08:45 |
| marekd | vince_: let me find the code for a | 08:45 |
| marekd | ya | 08:45 |
| vince_ | marekd thank you!! | 08:46 |
| marekd | vince_ https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/oidc.py#L20 | 08:46 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Add metods for checking scoped tokens https://review.openstack.org/208885 | 08:51 |
| marekd | yottatsa: i voted. | 08:56 |
| yottatsa | marekd thanks! | 08:56 |
| *** ParsectiX has quit IRC | 08:57 | |
| *** ParsectiX has joined #openstack-keystone | 08:57 | |
| *** urulama has quit IRC | 08:58 | |
| *** urulama_ has joined #openstack-keystone | 08:58 | |
| yottatsa | marekd, about your comment, I have no ideas about the hint, do you? | 08:59 |
| marekd | yottatsa: i'd probably get a little bit frustrated if i saw such message and rather thought: "okkk, so i know something is wrong with my token, but what?" | 08:59 |
| *** lhcheng has joined #openstack-keystone | 09:00 | |
| *** ChanServ sets mode: +v lhcheng | 09:00 | |
| yottatsa | okay, then I'll check token for none and for text and add some more validations | 09:00 |
| marekd | yottatsa: so how about adding a msg like "Token format is not recognized. Expected 'text'" (or something like that) | 09:00 |
| marekd | it's like i know the code base, you know it and you know what the token looks like, but most of the people don't know that and don't care whether it's text, pure binary or oranges and bananas mixed in the blender. | 09:01 |
| kafka_ | hi ,guys, anybody have see the bug https://bugs.launchpad.net/python-openstackclient/+bug/1479837 ?? need more discuss | 09:01 |
| openstack | Launchpad bug 1479837 in Keystone "improper handling non existing identity providers " [Medium,Triaged] - Assigned to kafka (guowang) | 09:01 |
| *** fhubik is now known as fhubik_afk | 09:02 | |
| *** fhubik_afk is now known as fhubik | 09:02 | |
| marekd | kafka_: your question is inappropriate | 09:02 |
| marekd | (in the bug) | 09:02 |
| marekd | and the answet is PUT was used becase you basically add a new identity provider, so you PUT it to the keystone. | 09:02 |
| *** lhcheng has quit IRC | 09:05 | |
| vince_ | marekd: the oidc plugin is not integrated yet with the client module right (e.g., in get_raw_token_from_identity_service())? | 09:11 |
| marekd | vince_: i posted code to the client | 09:12 |
| marekd | you are probably talking about cli ? | 09:12 |
| vince_ | what I mean is that I don't see OidcPassword instantiated anywhere in the current master branch, other than the unit tests | 09:13 |
| marekd | keystoneclient is a library | 09:14 |
| marekd | so you don't call it directly from your shell | 09:14 |
| marekd | what you call is openstackclient | 09:14 |
| marekd | by typing $ openstack | 09:14 |
| marekd | for instance | 09:14 |
| kafka_ | @mareked: i refer to the api docs that PUT is used for register a new identity provider , | 09:14 |
| vince_ | marekd: right, sorry for the confusion :) | 09:15 |
| marekd | kafka_: and? | 09:15 |
| marekd | kafka_: what's wrong and how is that related with the bug? | 09:15 |
| marekd | vince_: no problem :-) | 09:16 |
| marekd | vince_: use openstack, make sure you use IDENTITY API v3 | 09:16 |
| marekd | vince_: i recommend looking at options in $ openstack --help | 09:17 |
| marekd | vince_: try with that plugin https://github.com/openstack/python-keystoneclient/blob/master/setup.cfg#L37 (name v3oidcpassword) | 09:17 |
| marekd | vince_: here you have a blog post about oidc | 09:18 |
| marekd | https://developer.ibm.com/opentech/2015/06/17/use-websphere-liberty-as-an-openid-connect-provider-for-openstack/ | 09:18 |
| *** marzif_ has joined #openstack-keystone | 09:18 | |
| marekd | you may want to start with "Testing it all out!" | 09:19 |
| vince_ | marekd: yes, I was reading there :)! | 09:20 |
| vince_ | thank you so much, this is very helpful | 09:20 |
| marekd | vince_: so, you should know everything by now :-) | 09:20 |
| marekd | vince_: you are welcome. | 09:20 |
| kafka_ | marekd : not much related, just see that and feel wired that use PUT to create a new resource | 09:20 |
| marekd | kafka_: i am sorry for that :( | 09:20 |
| kafka_ | marekd: and what about your views about the bug?? | 09:21 |
| marekd | kafka_: i still think it's osc that does build wrong url | 09:21 |
| marekd | keystone simply discards ?name query_string and responds properly - with the list of identity providers | 09:22 |
| marekd | idp's id is a user defined name. | 09:24 |
| kafka_ | but see another example 'openstack user show admin ' works well, /users/?name=admin respond properly; | 09:25 |
| kafka_ | yeah , the backend store a user defined name ad idp's id .. that's reallly the problem.. only change server side can fix that, isn't it? | 09:27 |
| kafka_ | @marekd | 09:29 |
| *** boris-42 has quit IRC | 09:30 | |
| *** kafka_ has quit IRC | 09:35 | |
| *** kafka_ has joined #openstack-keystone | 09:37 | |
| *** fhubik is now known as fhubik_afk | 09:37 | |
| marekd | kafka_: can you explain me why OSC is not building a /identity_providers/<name> link in a first place? | 09:38 |
| marekd | kafka_: apparently you did some research on that. | 09:38 |
| *** marzif_ has quit IRC | 09:43 | |
| *** marzif_ has joined #openstack-keystone | 09:43 | |
| kafka_ | @marekd when excute 'openstack <cmd> show <name_id>' , the function openstack.common.utils.find_resources actually inplement | 09:47 |
| marekd | kafka_: ok, so the name is not int so it will call https://github.com/openstack/python-openstackclient/blob/master/openstackclient/common/utils.py#L65 | 09:50 |
| marekd | what next? | 09:50 |
| marekd | where is get(_ implementation ? | 09:51 |
| marekd | get() | 09:51 |
| marekd | kafka_: can you help me with that? | 09:51 |
| *** davechen has left #openstack-keystone | 09:52 | |
| kafka_ | and then build kwargs = {'name': 'itsaname'} , remember that the key is name , | 09:53 |
| marekd | kafka_: where does it come from ? | 09:53 |
| kafka_ | the use kwargs as query parameter | 09:53 |
| *** openstackgerrit_ has joined #openstack-keystone | 09:53 | |
| marekd | can you post the link ? | 09:53 |
| kafka_ | build /identity_provider?name=itaname but the backend store itsaname as ID , so can't query something name=itsname, and return all | 09:54 |
| *** dims has joined #openstack-keystone | 09:55 | |
| marekd | kafka_: can you walk me through the flow of how the kwargs are being built and post links for appropriate methods ? | 09:55 |
| kafka_ | the link https://github.com/openstack/python-openstackclient/blob/master/openstackclient/common/utils.py#L79 | 09:55 |
| kafka_ | and the docsting of function https://github.com/openstack/python-openstackclient/blob/master/openstackclient/common/utils.py#L45 | 09:55 |
| marekd | kafka_: but i am asking where is that kwargs built | 09:56 |
| openstackgerrit | Roman Bogorodskiy proposed openstack/keystone: Fix unbound error in federation _sign_assertion https://review.openstack.org/208163 | 10:01 |
| *** fhubik_afk is now known as fhubik | 10:01 | |
| kafka_ | oh, sorry, i;m late . that's all in manager.find(**kwargs) and track to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L419 | 10:10 |
| *** lxsli has quit IRC | 10:10 | |
| kafka_ | @marekd | 10:10 |
| kafka_ | you can see that find() use kwargs to build query parameters | 10:11 |
| *** fhubik is now known as fhubik_afk | 10:11 | |
| kafka_ | and actually excute _list() https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/base.py#L108 because not have body , got a GET request with query parameter | 10:13 |
| *** bjornar has quit IRC | 10:14 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 10:20 |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 10:27 |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 10:29 |
| *** zzzeek has quit IRC | 10:33 | |
| *** jaosorior has joined #openstack-keystone | 10:48 | |
| *** lhcheng has joined #openstack-keystone | 10:49 | |
| *** ChanServ sets mode: +v lhcheng | 10:49 | |
| *** urulama_ has quit IRC | 10:51 | |
| *** urulama has joined #openstack-keystone | 10:51 | |
| *** kafka_ has quit IRC | 10:51 | |
| *** lhcheng has quit IRC | 10:53 | |
| *** fhubik_afk is now known as fhubik | 10:54 | |
| *** topol has joined #openstack-keystone | 11:00 | |
| *** ChanServ sets mode: +v topol | 11:00 | |
| *** topol has quit IRC | 11:05 | |
| odyssey4me | from today's sha update I'm seeing the following errors in the keystone apache error log - is this a known issue with a known solution? http://paste.openstack.org/show/u3mIrPjsUWANe8ZJ0ksy/ | 11:24 |
| *** bdossant_ has joined #openstack-keystone | 11:27 | |
| breton | odyssey4me: what's sha? | 11:29 |
| breton | also, the error is weird. | 11:29 |
| *** bdossant has quit IRC | 11:29 | |
| odyssey4me | breton the keystone sha is 970c9ad7d444edeb922afd34874f0c48647fd53e | 11:29 |
| *** bdossant_ has quit IRC | 11:30 | |
| odyssey4me | note that I'm doing an integrated build, but all sha's have been bumped to today's latest sha's | 11:30 |
| odyssey4me | the error is weird | 11:30 |
| breton | dims: ^ | 11:30 |
| *** openstackgerrit has quit IRC | 11:31 | |
| *** openstackgerrit_ is now known as openstackgerrit | 11:31 | |
| *** openstackgerrit has quit IRC | 11:32 | |
| *** gsilvis has quit IRC | 11:32 | |
| *** openstackgerrit_ has joined #openstack-keystone | 11:32 | |
| *** openstackgerrit_ is now known as openstackgerrit | 11:32 | |
| odyssey4me | breton interestingly I get the same issue with the main projects set to liberty-2... I'm working on two build simultaneously to try and figure out the root cause here | 11:32 |
| *** openstackgerrit_ has joined #openstack-keystone | 11:33 | |
| odyssey4me | breton it appears that dispacher was last in oslo.messaging in 2.0.0 | 11:33 |
| odyssey4me | yeah, it looks like this is in oslo - lemme go bug them | 11:37 |
| samueldmq | morning guys | 11:39 |
| samueldmq | I am gonna warm up for the dynamic policy battle later today :) | 11:40 |
| marekd | samueldmq: wow, so exciting | 11:44 |
| samueldmq | marekd: :) | 11:44 |
| *** amakarov_away is now known as amakarov | 11:46 | |
| *** ParsectiX has quit IRC | 11:52 | |
| *** tobe_ has quit IRC | 11:56 | |
| *** gordc has joined #openstack-keystone | 11:58 | |
| *** topol has joined #openstack-keystone | 11:58 | |
| *** ChanServ sets mode: +v topol | 11:58 | |
| *** tobe_ has joined #openstack-keystone | 11:59 | |
| *** tobe_ has quit IRC | 12:01 | |
| *** raildo has joined #openstack-keystone | 12:15 | |
| *** openstackgerrit has quit IRC | 12:16 | |
| *** fhubik is now known as fhubik_afk | 12:17 | |
| *** openstackgerrit has joined #openstack-keystone | 12:17 | |
| *** ParsectiX has joined #openstack-keystone | 12:18 | |
| breton | what, again? | 12:19 |
| *** Nirupama has quit IRC | 12:27 | |
| *** edmondsw has joined #openstack-keystone | 12:27 | |
| *** piyanai has joined #openstack-keystone | 12:29 | |
| *** bapalm_ has joined #openstack-keystone | 12:34 | |
| *** lhcheng has joined #openstack-keystone | 12:38 | |
| *** ChanServ sets mode: +v lhcheng | 12:38 | |
| *** chlong has joined #openstack-keystone | 12:41 | |
| *** lhcheng has quit IRC | 12:42 | |
| *** nicodemos has joined #openstack-keystone | 12:43 | |
| *** nicodemos has quit IRC | 12:46 | |
| *** bknudson has joined #openstack-keystone | 12:57 | |
| *** ChanServ sets mode: +v bknudson | 12:57 | |
| *** dims_ has joined #openstack-keystone | 13:00 | |
| *** abhishekk has joined #openstack-keystone | 13:01 | |
| abhishekk | hi all, can any core reviewer review this patch | 13:02 |
| *** jdandrea has joined #openstack-keystone | 13:02 | |
| *** dims has quit IRC | 13:02 | |
| abhishekk | https://review.openstack.org/#/c/177686/, submitted stable/juno branch | 13:02 |
| abhishekk | thank you | 13:02 |
| *** tjcocozz has joined #openstack-keystone | 13:02 | |
| lbragstad | marekd: couple quick questions for you, if you have a minute. The metadata transaction/exchange between the idp and the sp is what builds the trust, right? | 13:02 |
| *** jsavak has joined #openstack-keystone | 13:03 | |
| *** dims has joined #openstack-keystone | 13:04 | |
| marekd | lbragstad: yes, for instance this is the place where public keysare published. | 13:05 |
| marekd | + some endpoints | 13:06 |
| *** dims_ has quit IRC | 13:06 | |
| lbragstad | marekd: so the metadata of the idp contains the public key of the idp? | 13:06 |
| lbragstad | and the same with the sp/ | 13:06 |
| marekd | lbragstad: yes and yes. | 13:07 |
| *** vivekd has quit IRC | 13:07 | |
| marekd | lbragstad: well, not always. usually it's the sp who wants to know all the idp's | 13:07 |
| *** browne has joined #openstack-keystone | 13:07 | |
| marekd | lbragstad: note that we don't keep public keys and metadata of trusted SPs when it comes to Keystone-IdP | 13:08 |
| lbragstad | ah, so the idp is what signs requests with it's private key, and then the sp is able to verify it because it has the idp's metadata | 13:08 |
| marekd | lbragstad: yes. | 13:08 |
| lbragstad | "we don't keep" as in the idp doesn't keep metadata from trusted service providers? | 13:08 |
| marekd | lbragstad: yes. | 13:08 |
| lbragstad | ok, why is that, I'm curious | 13:09 |
| marekd | lbragstad: in fact we probably should, but i'd then just say loudly that keystone becomes a fully fledged SAML2 IdP. | 13:09 |
| lbragstad | sure | 13:09 |
| marekd | lbragstad: why we don't keep SPs keys/metadata? | 13:09 |
| *** abhishekk has left #openstack-keystone | 13:09 | |
| openstackgerrit | Merged openstack/keystoneauth-saml2: Updated from global requirements https://review.openstack.org/208700 | 13:09 |
| lbragstad | marekd: right | 13:09 |
| *** petertr7_away is now known as petertr7 | 13:09 | |
| marekd | lbragstad: a) Kestone-IdP is not a IdP b) it's not necessary, as it's us who initiate full workflow. | 13:10 |
| lbragstad | us as in the sp? | 13:10 |
| marekd | lbragstad: look, normally you go to the SP first, and it's SP that creates a request and redirect to the IdP. Now, IdP want's to make sure the request comes from a known SP - hence it checks whether the message was signed by a trusted SP. In K2K case, you login with your password, and you are somehow authenticated and you simply go to a trusted SP as it's in your token, so it had been configured | 13:12 |
| marekd | by admin. | 13:12 |
| lbragstad | sure | 13:12 |
| marekd | lbragstad: makes sense? | 13:13 |
| lbragstad | so the metadata trust part should always (at least) go from idp to sp | 13:13 |
| lbragstad | the service provider will *always* need metadata from the identity provider | 13:13 |
| marekd | lbragstad: pretty much yes. you can probably disable it somewhere but i'd say it's super unlikely. | 13:13 |
| marekd | lbragstad: ideally both peers should have trustee's metadata | 13:14 |
| lbragstad | right, I don't think we'd want that because that would open you up for mitm attachs | 13:14 |
| lbragstad | attacks* | 13:14 |
| *** TheIntern has joined #openstack-keystone | 13:14 | |
| marekd | lbragstad: it'd be like saying "i am using SSH but simply disabled transmission encryption and keys validation" :-) | 13:15 |
| lbragstad | yep, that makes sense | 13:15 |
| marekd | i will be back in 5 minutes | 13:15 |
| lbragstad | so, in summary, the public keys live in the metadata, which can be fetched from the IDP using https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#retrieve-metadata-properties | 13:15 |
| *** marzif_ has quit IRC | 13:18 | |
| *** marzif_ has joined #openstack-keystone | 13:18 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Fix nits from Project Tree Deletion spec https://review.openstack.org/209057 | 13:20 |
| marekd | lbragstad: yes | 13:25 |
| lbragstad | sweet | 13:26 |
| marekd | the key would be valud <ns1:X509Certificate> </> | 13:26 |
| marekd | lbragstad: is there something wrong with that? | 13:26 |
| lbragstad | marekd: nope, just wanted to understand where that trust was established | 13:26 |
| marekd | lbragstad: ok! | 13:27 |
| marekd | hope i helped! | 13:27 |
| lbragstad | absolutely! thank yu | 13:27 |
| lbragstad | you* | 13:27 |
| *** piyanai has quit IRC | 13:28 | |
| lbragstad | marekd: the public key that is available in the metadata of the idp is the same public key that is used to SSL on the keystone-idp, right? | 13:29 |
| *** piyanai has joined #openstack-keystone | 13:30 | |
| marekd | lbragstad: in k2k ? | 13:30 |
| *** browne has quit IRC | 13:30 | |
| lbragstad | marekd: well, what happens in each case? | 13:30 |
| lbragstad | (k2k, and non-k2k) | 13:30 |
| marekd | lbragstad: i don't understand | 13:30 |
| marekd | lbragstad: ah | 13:31 |
| *** chlong has quit IRC | 13:31 | |
| marekd | so, in K2K case where Keystone is an IdP we set same keys by default: https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L972 | 13:31 |
| *** ayoung has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v ayoung | 13:32 | |
| marekd | when IdP is something else then who cares/knows :-) | 13:32 |
| marekd | in terms of Keystone-SP it's managed by mod_shib/mod_mellon and it's again up to you. | 13:32 |
| lbragstad | gotcha | 13:32 |
| *** dims_ has joined #openstack-keystone | 13:36 | |
| dims_ | bknudson: this look good now? (boris' ldap patch) https://review.openstack.org/#/c/207960/ - please let us know. we need a backport for it as well if it is good | 13:37 |
| *** dims has quit IRC | 13:37 | |
| *** mestery_afk is now known as mestery | 13:38 | |
| lbragstad | marekd: last noob question, when a federated user presents their information to a keystone service provider (with a protocol), that redirect happens to the IdP. | 13:46 |
| lbragstad | does the IdP return the SAML assertion to the service provider, then the service provider validates the saml assertion and exchanges it for an unscoped token? | 13:47 |
| lbragstad | (how many trips to the IdP in that case?) | 13:47 |
| lbragstad | or does the user need the SAML assertion prior to that step? | 13:48 |
| *** fhubik_afk is now known as fhubik | 13:48 | |
| *** doug-fish has quit IRC | 13:56 | |
| marekd | in a normal flow it's: client -> sp -> (HTTP 302) client -> IdP -> (HTTP 302) client -> SP -> back to the client with unscped token -> scope the token. | 13:57 |
| marekd | http://www.shapeblue.com/wp-content/uploads/2014/09/acssaml.png | 13:57 |
| marekd | lbragstad: in k2k: auth with user/pass, get Oopenstack Token, request SAML2 from your token, get assertion, send to SP, get unscoped token | 13:58 |
| lbragstad | perfect, that makes sense | 13:59 |
| marekd | i hope so :-) | 13:59 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:00 | |
| *** opilotte has joined #openstack-keystone | 14:05 | |
| *** ParsectiX has quit IRC | 14:07 | |
| *** TheIntern has quit IRC | 14:08 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/208730 | 14:12 |
| *** hrou has joined #openstack-keystone | 14:15 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/208698 | 14:15 |
| *** henrynash has quit IRC | 14:15 | |
| *** phalmos has joined #openstack-keystone | 14:20 | |
| *** piyanai has quit IRC | 14:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/209091 | 14:22 |
| *** urulama has quit IRC | 14:22 | |
| *** urulama has joined #openstack-keystone | 14:23 | |
| *** TheIntern has joined #openstack-keystone | 14:24 | |
| *** mylu has joined #openstack-keystone | 14:28 | |
| *** phalmos has quit IRC | 14:30 | |
| *** doug-fish has joined #openstack-keystone | 14:32 | |
| *** TheIntern has quit IRC | 14:32 | |
| *** jecarey has joined #openstack-keystone | 14:33 | |
| *** TheIntern has joined #openstack-keystone | 14:37 | |
| dstanek | breton: that script was more complex than you thought :-) | 14:38 |
| *** phalmos has joined #openstack-keystone | 14:40 | |
| *** dims_ has quit IRC | 14:41 | |
| *** dims has joined #openstack-keystone | 14:41 | |
| *** zzzeek has joined #openstack-keystone | 14:45 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Prevent exception due to missing id of LDAP entity https://review.openstack.org/207960 | 14:51 |
| lbragstad | marekd: if you have a service provider with multiple idps tied to it, and they all talk saml, how does horizon know where to send the request to based on the protocol? | 14:53 |
| breton | dstanek: not as complex as people suggested in the thread | 14:53 |
| doug-fish | lbragstad: unless somebody is doing something more complex than I've been working on, Horizon recognizes only one idp | 14:54 |
| doug-fish | (well, one day soon it will) | 14:54 |
| *** bradjones has joined #openstack-keystone | 14:54 | |
| *** bradjones has quit IRC | 14:54 | |
| *** bradjones has joined #openstack-keystone | 14:54 | |
| lbragstad | doug-fish: ahh, interesting | 14:54 |
| lbragstad | doug-fish: so, all 'saml2' protocol requests get mapped to a single idp endpoint. | 14:54 |
| dstanek | breton: i think that clint was right about what he said. | 14:55 |
| dstanek | breton: it was complex enough that there were hard to see bugs lurking | 14:55 |
| doug-fish | lbragstad: at the Horizon layer that's going to be hidden - the saml assertion exchange is hidden in the auth plugin | 14:55 |
| doug-fish | the outside client programming perspective is that the idp token can be used to get an unscoped token from a sp | 14:56 |
| breton | dstanek: you suggest just to rsync? | 14:56 |
| breton | dstanek: the whole directory with keys? | 14:57 |
| dstanek | breton: yeah, i like the idea of having 1 node to the rotation and sync keys out from there | 14:57 |
| dstanek | breton: yes | 14:57 |
| lbragstad | breton: dstanek I just responded to the thread with a modified version of the script. | 14:57 |
| lbragstad | dstanek: the one we worked through last night | 14:57 |
| *** yottatsa has quit IRC | 14:57 | |
| dstanek | lbragstad: nice, thx | 14:58 |
| breton | nah, you have a bug there too :p | 14:59 |
| breton | ping node-$c | 14:59 |
| breton | which should be node-$c | 15:01 |
| *** belmoreira has quit IRC | 15:01 | |
| *** opilotte has quit IRC | 15:01 | |
| *** kiran-r has joined #openstack-keystone | 15:01 | |
| *** btully has joined #openstack-keystone | 15:02 | |
| breton | anyway, I didn't expect that a script I quickly sketched will be so discussed. | 15:02 |
| lbragstad | breton: well, it does serve as a good place to discuss the flow of rotation and distribution, | 15:02 |
| lbragstad | breton: so, ++ | 15:03 |
| breton | breton@bbobrov-pc:~$ failed=true | 15:03 |
| breton | breton@bbobrov-pc:~$ if [ ( $failed ) ]; then echo 'asdf'; fi | 15:03 |
| breton | bash: syntax error near unexpected token `$failed' | 15:03 |
| gordc | for v3, are the requirements (project_id OR project_name) AND (user_domain_name OR user_domain_id) or (project_id OR (project_name AND (user_domain_name OR user_domain_id))) | 15:05 |
| openstackgerrit | David Stanek proposed openstack/keystone: Hardens the validated decorator's implementation https://review.openstack.org/209114 | 15:06 |
| *** piyanai has joined #openstack-keystone | 15:10 | |
| *** e0ne has quit IRC | 15:10 | |
| *** e0ne has joined #openstack-keystone | 15:11 | |
| *** lhcheng has joined #openstack-keystone | 15:12 | |
| *** ChanServ sets mode: +v lhcheng | 15:12 | |
| *** phalmos has quit IRC | 15:14 | |
| dstanek | breton: i was drawn to it by the argument of its simplicity and the fact that it took my a while to see what was actually happening | 15:20 |
| *** phalmos has joined #openstack-keystone | 15:22 | |
| *** geoffarnold has joined #openstack-keystone | 15:22 | |
| dstanek | lbragstad: breton: oh, and the rollback can't work as implemented | 15:24 |
| *** mylu has quit IRC | 15:24 | |
| *** petertr7 is now known as petertr7_away | 15:25 | |
| *** edmondsw has quit IRC | 15:26 | |
| *** petertr7_away is now known as petertr7 | 15:27 | |
| *** browne has joined #openstack-keystone | 15:27 | |
| *** joe___ has joined #openstack-keystone | 15:29 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 15:30 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Limit subtree and parents queries https://review.openstack.org/209132 | 15:30 |
| joe___ | Could anyone help on using keystonemiddleware? | 15:30 |
| *** mylu has joined #openstack-keystone | 15:31 | |
| *** yottatsa has joined #openstack-keystone | 15:31 | |
| *** piyanai has quit IRC | 15:31 | |
| *** fhubik is now known as fhubik_afk | 15:32 | |
| joe___ | I'm trying to build a WSGI service using paste and would like to add keystonemiddleware as authentication middleware. If not implement oslo config, how should I pass keystone_authtoken info from my api-paste.ini to keystonemiddleware? | 15:33 |
| *** mylu has quit IRC | 15:33 | |
| bknudson | joe___: there's no way to do that today as far as I know. | 15:34 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 15:34 |
| bknudson | if you come up with a way to do it then submit the change so everyone can use it. | 15:34 |
| *** mylu has joined #openstack-keystone | 15:38 | |
| *** stevemar has joined #openstack-keystone | 15:39 | |
| *** ChanServ sets mode: +v stevemar | 15:39 | |
| stevemar | bump | 15:40 |
| dstanek | stevemar: what are you bumping sir? | 15:42 |
| *** joe___ has quit IRC | 15:42 | |
| stevemar | dstanek: myself, i've been away too long | 15:42 |
| *** mylu has quit IRC | 15:43 | |
| *** vince_ has quit IRC | 15:43 | |
| bknudson | stevemar: you've been binging on the jays. | 15:43 |
| stevemar | bknudson: true, but last week i was helping bring noobies up to speed with an openstack bootcamp | 15:44 |
| bknudson | stevemar: there's more noobies... this could be your full-time job | 15:45 |
| bknudson | I hope you recorded it | 15:45 |
| dstanek | has anyone else been getting test failure recently for test_list_group_role_assignment? | 15:45 |
| stevemar | i did not record it :( | 15:45 |
| bknudson | dstanek: works for me. | 15:46 |
| *** piyanai has joined #openstack-keystone | 15:48 | |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for HTTPClient.tenant_id|name https://review.openstack.org/205710 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for HTTPClient.request methods https://review.openstack.org/205711 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Update deprecation text for Session properties https://review.openstack.org/191511 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for HTTPClient session and adapter properties https://review.openstack.org/205806 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for HTTPClient tenant_id, tenant_name parameters https://review.openstack.org/205701 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for httpclient.USER_AGENT https://review.openstack.org/205833 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for Session.get_token() https://review.openstack.org/205817 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate create HTTPClient without session https://review.openstack.org/205832 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate create v2_0 Client without session https://review.openstack.org/205820 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate create v3 Client without session https://review.openstack.org/205822 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate ServiceCatalog(region_name) https://review.openstack.org/205809 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for CredentialManager data argument https://review.openstack.org/205825 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for UserManager project argument https://review.openstack.org/205826 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate ServiceCatalog.get_urls() with no attr https://review.openstack.org/205810 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate create Discover without session https://review.openstack.org/205829 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Deprecate use of cert and key https://review.openstack.org/205813 | 15:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Proper deprecation for Session.construct() https://review.openstack.org/205812 | 15:49 |
| rodrigods | wow | 15:50 |
| *** HenryG has quit IRC | 15:51 | |
| dstanek | bknudson: i keep getting http://paste.openstack.org/show/406903/ - looks like i'll actually have to debug this today | 15:51 |
| stevemar | dstanek: remove it all and try again? | 15:52 |
| dstanek | stevemar: it showed up on my new devstack vm too | 15:52 |
| stevemar | dstanek: ruh roh | 15:52 |
| dstanek | i thought it was an issue with maybe something i was running like memcached, but that doesn't appear to be it | 15:52 |
| bknudson | dstanek: do you have a local /etc/keystone.conf ? | 15:53 |
| bknudson | try removing it | 15:53 |
| bknudson | that was something I've been meaning to look into... tests are affected by /etc/keystone.conf | 15:53 |
| dstanek | bknudson: no, only a /etc/keystone/keystone.conf.old | 15:53 |
| *** phalmos has quit IRC | 15:54 | |
| *** vivekd has joined #openstack-keystone | 15:55 | |
| *** petertr7 is now known as petertr7_away | 15:56 | |
| *** jamiec has quit IRC | 16:00 | |
| *** cinerama has quit IRC | 16:00 | |
| *** _cjones_ has joined #openstack-keystone | 16:00 | |
| *** HenryG has joined #openstack-keystone | 16:01 | |
| *** jamiec has joined #openstack-keystone | 16:01 | |
| *** cinerama has joined #openstack-keystone | 16:02 | |
| *** gyee has joined #openstack-keystone | 16:02 | |
| *** ChanServ sets mode: +v gyee | 16:02 | |
| *** phalmos has joined #openstack-keystone | 16:02 | |
| dstanek | hmmm....it looks like my assignments are coming back in a different order than what the tests expect | 16:04 |
| samueldmq | dstanek: role assignments ? | 16:04 |
| bknudson | I think there's an assertItemsEqual | 16:04 |
| dstanek | samueldmq: yes | 16:04 |
| samueldmq | dstanek: should the order matter ? | 16:05 |
| samueldmq | in that case ... | 16:05 |
| dstanek | samueldmq: not entirely sure, but i don't think we actually enforce a sort order on the query | 16:06 |
| *** gyee has quit IRC | 16:06 | |
| *** HenryG has quit IRC | 16:08 | |
| *** jistr has quit IRC | 16:09 | |
| *** vivekd has quit IRC | 16:10 | |
| *** woodster_ has joined #openstack-keystone | 16:10 | |
| *** elmiko has quit IRC | 16:13 | |
| *** hrou has quit IRC | 16:15 | |
| *** e0ne has quit IRC | 16:17 | |
| *** kiran-r has quit IRC | 16:18 | |
| *** HenryG has joined #openstack-keystone | 16:18 | |
| *** urulama has quit IRC | 16:23 | |
| *** urulama has joined #openstack-keystone | 16:24 | |
| *** tjcocozz has quit IRC | 16:25 | |
| *** yottatsa has quit IRC | 16:26 | |
| *** yottatsa has joined #openstack-keystone | 16:27 | |
| *** bapalm_ has quit IRC | 16:27 | |
| *** kiran-r has joined #openstack-keystone | 16:27 | |
| *** openstackgerrit_ has quit IRC | 16:29 | |
| dolphm | lbragstad: this might address several of the open bugs against fernet https://review.openstack.org/#/c/208021/ | 16:32 |
| lbragstad | dolphm: sweet, I'll review it today | 16:33 |
| lbragstad | dolphm: thanks! | 16:33 |
| dolphm | lbragstad: including that tempest failure - i'm going to test that today | 16:33 |
| *** gyee has joined #openstack-keystone | 16:33 | |
| *** ChanServ sets mode: +v gyee | 16:33 | |
| *** henrynash has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v henrynash | 16:35 | |
| *** fhubik_afk is now known as fhubik | 16:36 | |
| *** henrynash has quit IRC | 16:37 | |
| *** henrynash has joined #openstack-keystone | 16:39 | |
| *** ChanServ sets mode: +v henrynash | 16:39 | |
| *** HenryG has quit IRC | 16:39 | |
| stevemar | raildo: samueldmq you guys okay to talk about https://review.openstack.org/#/c/208620/ ? | 16:42 |
| stevemar | at the meeting? | 16:42 |
| *** edmondsw has joined #openstack-keystone | 16:42 | |
| raildo | stevemar: sure, no problem | 16:43 |
| samueldmq | stevemar: sure, I think tellesnobrega may be interested on talking about it | 16:43 |
| stevemar | i'll change my name on the meeting to you guys https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting#Main_Agenda | 16:43 |
| stevemar | just need to double check if it needs a spec or not | 16:44 |
| raildo | ok | 16:44 |
| *** piyanai has quit IRC | 16:44 | |
| *** _kiran_ has joined #openstack-keystone | 16:47 | |
| *** TheIntern has quit IRC | 16:48 | |
| *** henrynash has quit IRC | 16:48 | |
| *** kiran-r has quit IRC | 16:51 | |
| *** piyanai has joined #openstack-keystone | 16:53 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor domain operations in project table https://review.openstack.org/143763 | 16:55 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 16:55 |
| *** petertr7_away is now known as petertr7 | 16:55 | |
| *** cinerama has quit IRC | 16:57 | |
| *** spandhe has joined #openstack-keystone | 16:59 | |
| *** piyanai has quit IRC | 17:00 | |
| *** phalmos has quit IRC | 17:01 | |
| *** _kiran_ has quit IRC | 17:02 | |
| *** piyanai has joined #openstack-keystone | 17:04 | |
| *** e0ne has joined #openstack-keystone | 17:05 | |
| *** jsavak has quit IRC | 17:05 | |
| *** jsavak has joined #openstack-keystone | 17:06 | |
| *** samleon has joined #openstack-keystone | 17:07 | |
| *** roxanaghe has joined #openstack-keystone | 17:09 | |
| *** HenryG has joined #openstack-keystone | 17:10 | |
| *** samleon has quit IRC | 17:11 | |
| *** jasonsb has quit IRC | 17:12 | |
| *** jasonsb has joined #openstack-keystone | 17:16 | |
| *** jasonsb has quit IRC | 17:19 | |
| *** HenryG has quit IRC | 17:20 | |
| *** mylu has joined #openstack-keystone | 17:24 | |
| *** piyanai has quit IRC | 17:24 | |
| *** e0ne has quit IRC | 17:26 | |
| *** piyanai has joined #openstack-keystone | 17:26 | |
| *** fhubik has quit IRC | 17:26 | |
| *** HT_sergio has joined #openstack-keystone | 17:30 | |
| *** e0ne has joined #openstack-keystone | 17:32 | |
| *** samleon has joined #openstack-keystone | 17:33 | |
| *** kiran-r has joined #openstack-keystone | 17:34 | |
| *** mylu has quit IRC | 17:36 | |
| *** piyanai_ has joined #openstack-keystone | 17:36 | |
| *** piyanai has quit IRC | 17:39 | |
| *** piyanai_ is now known as piyanai | 17:39 | |
| *** kiran-r has quit IRC | 17:40 | |
| openstackgerrit | Merged openstack/keystone: Better error message when unable to map user https://review.openstack.org/206987 | 17:41 |
| *** marzif_ has quit IRC | 17:41 | |
| openstackgerrit | Marianne Linhares Monteiro proposed openstack/keystone: List credentials by type https://review.openstack.org/208620 | 17:41 |
| *** mylu has joined #openstack-keystone | 17:46 | |
| *** tsymanczyk has joined #openstack-keystone | 17:46 | |
| *** vivekd has joined #openstack-keystone | 17:47 | |
| *** david-lyle has quit IRC | 17:48 | |
| *** marianneLinhares has joined #openstack-keystone | 17:52 | |
| *** henrynash has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v henrynash | 17:52 | |
| marekd | lbragstad: based on the protocol? | 17:54 |
| lbragstad | marekd: yeah, | 17:54 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient-kerberos: Federated Kerberos plugin https://review.openstack.org/173558 | 17:54 |
| lbragstad | when a use logs in using horizon, they have to select a protocol id, right? | 17:54 |
| *** diegoadolfo has joined #openstack-keystone | 17:54 | |
| marekd | lbragstad: so you should configure your modules to protect something like /v3/OS-FEDERATION/identity_providers/*/protocols/saml2 for saml2 (for instance) nad /v3/OS-FEDERATION/identity_providers/*/protocols/oidc for OIDC | 17:55 |
| *** yottatsa has quit IRC | 17:55 | |
| ayoung | I'll be at the meeting, but a little late today | 17:56 |
| *** ayoung has quit IRC | 17:56 | |
| lbragstad | marekd: protocol ids must be unique right? so you can only have one idp that uses saml2, right? | 17:57 |
| marekd | no | 17:57 |
| marekd | that's why * in the URL | 17:57 |
| lbragstad | so, are all the idps listed in the service providers drop down in horizon? | 17:58 |
| henrynash | dstanek: hi…thanks for the +1 on https://review.openstack.org/#/c/200624/ - was there a reason not to +2/A ? | 17:59 |
| dstanek | henrynash: i saw that bknudson gave an earlier rev -1 and didn't get a chance to see if his stuff was addressed | 18:01 |
| marekd | lbragstad: no. | 18:01 |
| *** marianneLinhares has quit IRC | 18:01 | |
| *** qwebirc1001759 has joined #openstack-keystone | 18:01 | |
| *** aix has quit IRC | 18:03 | |
| *** jsavak has quit IRC | 18:03 | |
| *** piyanai has quit IRC | 18:04 | |
| *** TheIntern has joined #openstack-keystone | 18:05 | |
| *** jasonsb has joined #openstack-keystone | 18:05 | |
| marekd | lbragstad: uh, it's more complicated... | 18:05 |
| marekd | lbragstad: first of all horizon doesn't do any saml bits... | 18:05 |
| *** haneef_ has joined #openstack-keystone | 18:05 | |
| lbragstad | marekd: horizon just has the WEBSSO_CHOICES stuff | 18:06 |
| marekd | you dont configure saml for horizon box/vhost. | 18:06 |
| marekd | lbragstad: it doesn't | 18:06 |
| marekd | lbragstad: jamielennox|away would like to have it and it's easy to implement | 18:06 |
| marekd | but since we use apache modules that acually do protocol specific stuff we may want to use something that's called Discovery Service | 18:06 |
| marekd | for choosing IdP | 18:07 |
| *** jsavak has joined #openstack-keystone | 18:07 | |
| *** piyanai has joined #openstack-keystone | 18:07 | |
| *** stevemar has quit IRC | 18:08 | |
| *** mylu has quit IRC | 18:08 | |
| lbragstad | marekd: ok, I think the part that I'm missing is how the user specifies *which* idp they are apart of, and how we (as the keystone service provider) make that redirect | 18:09 |
| *** mylu has joined #openstack-keystone | 18:09 | |
| lhcheng | henrynash: quick question related to https://bugs.launchpad.net/keystone/+bug/1466846 | 18:09 |
| openstack | Launchpad bug 1466846 in Keystone "the function _config_to_list is not working well" [Medium,New] - Assigned to Lin Hua Cheng (lin-hua-cheng) | 18:09 |
| *** dan_ has joined #openstack-keystone | 18:09 | |
| *** dan_ is now known as Guest41574 | 18:10 | |
| lhcheng | henrynash: wanted to run by you if it is valid bug, I looked at the looked and indeed whitelisted/sensitive are always empty. https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L914-L915 | 18:10 |
| marekd | lbragstad: in CLI it's you who has to know which IdP you are going to use | 18:10 |
| henrynash | lhcheng: i need to look at it….I’ll do that | 18:10 |
| marekd | you need to know the name of IdP configured in keystone | 18:10 |
| marekd | and you need to know the url of the idp ... | 18:10 |
| *** Guest41574 is now known as dank_ | 18:12 | |
| *** qwebirc1001759 has quit IRC | 18:12 | |
| lbragstad | marekd: how is that information typically relayed to service provider horizon? typing it in? | 18:12 |
| *** phalmos has joined #openstack-keystone | 18:13 | |
| marekd | lbragstad: i will confuse you even more - websso has a separate endpoint - /v3/OS-FEDERATION/webbso/<protocol> (or something like that) | 18:14 |
| marekd | :-) | 18:14 |
| marekd | it's an endpoint for all the idp's of the federation (speaking same protocol) | 18:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/209091 | 18:15 |
| lbragstad | oh, so horizon will talk to that endpoint (/v3/OS-FEDERATION/webbso/<protocol>) after the user logging in says I want to federate with saml2? | 18:15 |
| marekd | jamielennox|away would like horizon to redirect to old links /identity_providers/<idp>/protocols/<proto>/auth and WEBSSO_CHOICES would be hardcoded to the names, and that name would be used to fill <idp> part in the link. | 18:16 |
| *** mylu has quit IRC | 18:16 | |
| *** tjcocozz has joined #openstack-keystone | 18:17 | |
| lbragstad | interesting | 18:17 |
| lbragstad | so, it'd be pretty similar to the main david chadwick sent out? | 18:17 |
| marekd | i don't know what he had sent. | 18:17 |
| marekd | and where. | 18:18 |
| lbragstad | http://lists.openstack.org/pipermail/openstack-dev/2015-August/071131.html | 18:18 |
| lbragstad | marekd: ^ | 18:18 |
| lhcheng | lbragstad: yeah, it is similar :) | 18:18 |
| *** mylu has joined #openstack-keystone | 18:18 | |
| lbragstad | ok, cool | 18:18 |
| marekd | yeah, so probably similar. | 18:18 |
| marekd | i only don't know what Type Ahead is. | 18:18 |
| marekd | i can guess | 18:19 |
| lhcheng | I've responded to that email, we kinda already have what they're proposing | 18:19 |
| lhcheng | marekd: fancier term for auto-complete :P | 18:19 |
| marekd | aha | 18:19 |
| marekd | lhcheng: so i wonder how is he going to do that. | 18:20 |
| marekd | esp since lots of info can sit in IdP. not in Keystone. | 18:20 |
| *** woodster_ has quit IRC | 18:20 | |
| lhcheng | I think he expects horizon to query keystone for the IdP. thought we don't want that? | 18:21 |
| *** hrou has joined #openstack-keystone | 18:22 | |
| *** yottatsa has joined #openstack-keystone | 18:24 | |
| *** mylu has quit IRC | 18:24 | |
| *** mylu has joined #openstack-keystone | 18:26 | |
| *** ayoung has joined #openstack-keystone | 18:26 | |
| *** ChanServ sets mode: +v ayoung | 18:26 | |
| *** rm_work|away is now known as rm_work | 18:28 | |
| *** mylu has quit IRC | 18:28 | |
| doug-fish | I was under the impression that you could only have 1 3rd party idp for each protocol, and this was a retriction of keystone. Was that true for Kilo? | 18:28 |
| *** lhcheng is now known as lhcheng_away | 18:29 | |
| lhcheng_away | doug-fish: it is the restriction specifically on how websso is implemented in keystone. it should get better with : https://review.openstack.org/#/c/199339/ | 18:31 |
| *** HenryG has joined #openstack-keystone | 18:31 | |
| lhcheng_away | you can still setup multiple idp/protocol in keystone, but not exposed all through websso | 18:32 |
| doug-fish | lhcheng_away: cool thx - though I think we've mirrored that restriction with our Horizon implementation | 18:32 |
| doug-fish | oh I see | 18:32 |
| *** HenryG has quit IRC | 18:32 | |
| *** HenryG has joined #openstack-keystone | 18:35 | |
| *** rm_work is now known as rm_work|away | 18:38 | |
| *** rm_work|away is now known as rm_work | 18:40 | |
| *** bapalm_ has joined #openstack-keystone | 18:41 | |
| *** HenryG_ has joined #openstack-keystone | 18:46 | |
| *** mylu has joined #openstack-keystone | 18:46 | |
| *** urulama has quit IRC | 18:47 | |
| *** urulama has joined #openstack-keystone | 18:47 | |
| *** HenryG has quit IRC | 18:48 | |
| *** phalmos has quit IRC | 18:50 | |
| *** boris-42 has joined #openstack-keystone | 18:53 | |
| *** yottatsa has quit IRC | 18:57 | |
| *** jsavak has quit IRC | 19:01 | |
| samueldmq | dolphm: we get the specs approved, then I come with thte sfe request | 19:02 |
| samueldmq | dolphm: next meeting we analyze the request | 19:02 |
| samueldmq | soudns a good plan ? | 19:02 |
| dstanek | samueldmq: just propose against backlog | 19:02 |
| gyee | ops midcycle is three weeks away btw | 19:02 |
| dstanek | it doesn't sound like there is a lot of interest to get this in L | 19:02 |
| samueldmq | dstanek: they are against the backlog already | 19:02 |
| gyee | so we will be long past any FFE date | 19:03 |
| samueldmq | gyee: yes we spent the whole L2 and didnt reach a decision on sfe | 19:03 |
| samueldmq | gyee: it should be ffe now :( | 19:03 |
| dstanek | samueldmq: i think you should work with gyee so he understands the vision and see if it's something HP really wants | 19:03 |
| *** jsavak has joined #openstack-keystone | 19:03 | |
| samueldmq | gyee: the 2 specs are 197980 and 134655 | 19:04 |
| samueldmq | gyee: your view on them is important, please take a look :) | 19:04 |
| samueldmq | gyee: anyway we are just enabling the fetch (we already allow the policy creation + association) | 19:04 |
| gyee | samueldmq, yes absolutely | 19:04 |
| samueldmq | gyee: as I demonstrated in the midcycle | 19:05 |
| *** ayoung has quit IRC | 19:05 | |
| *** phalmos has joined #openstack-keystone | 19:05 | |
| *** henrynash has quit IRC | 19:06 | |
| *** mylu has quit IRC | 19:06 | |
| *** stevemar has joined #openstack-keystone | 19:08 | |
| *** ChanServ sets mode: +v stevemar | 19:08 | |
| raildo | dolphm: https://blueprints.launchpad.net/keystone/+spec/list-credentials-by-type and in a few minutes, i'll send the spec | 19:09 |
| gyee | bknudson, which patch is failing about missing publicURL for alarm service? | 19:10 |
| *** piyanai has quit IRC | 19:10 | |
| *** vivekd has quit IRC | 19:10 | |
| bknudson | gyee: https://review.openstack.org/#/c/208583/ | 19:10 |
| bknudson | gyee: the gate-tempest-dsvm-neutron-src-python-keystoneclient logs have it | 19:11 |
| bknudson | gyee: also https://review.openstack.org/#/c/207267/ | 19:11 |
| gyee | bknudson, got it | 19:11 |
| *** mylu has joined #openstack-keystone | 19:12 | |
| *** stevemar has quit IRC | 19:12 | |
| *** henrynash has joined #openstack-keystone | 19:16 | |
| *** ChanServ sets mode: +v henrynash | 19:16 | |
| openstackgerrit | Diego Adolfo proposed openstack/keystone: NotificationsTestCase running in isolation https://review.openstack.org/204739 | 19:18 |
| *** TheIntern has quit IRC | 19:18 | |
| *** tqtran has joined #openstack-keystone | 19:19 | |
| *** henrynash has quit IRC | 19:19 | |
| *** piyanai has joined #openstack-keystone | 19:20 | |
| *** TheIntern has joined #openstack-keystone | 19:20 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystoneauth-saml2: Activate pep8 check that _ is imported https://review.openstack.org/209227 | 19:24 |
| *** phalmos has quit IRC | 19:24 | |
| *** piyanai has quit IRC | 19:25 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: List credentials by type https://review.openstack.org/209228 | 19:27 |
| *** gyee has quit IRC | 19:29 | |
| *** vivekd has joined #openstack-keystone | 19:32 | |
| *** ayoung has joined #openstack-keystone | 19:32 | |
| *** ChanServ sets mode: +v ayoung | 19:32 | |
| *** phalmos has joined #openstack-keystone | 19:32 | |
| *** petertr7 is now known as petertr7_away | 19:33 | |
| ayoung | dolphm, BTW, that last comment was not meant as criticsm. I tjhink it as aactually a good idea, just wonder if we should codify it: | 19:33 |
| ayoung | dolphm, so, would you say we should have a general policy of "no features are going to go in upstream until they are in active deployment somewhere?" | 19:34 |
| dolphm | ayoung: i believe i said "no" to that in the meeting already | 19:34 |
| *** vivekd has quit IRC | 19:34 | |
| dolphm | that's not what i meant at all | 19:34 |
| ayoung | dolphm, you might have, I had to drop off and missed it | 19:34 |
| ayoung | dolphm, No, I know that is not what you meant. You wanted to know if there was buy in outside of just our team. | 19:35 |
| ayoung | And it is a fair question | 19:35 |
| dolphm | stakeholder interest != deploying random patches to prod | 19:35 |
| ayoung | dolphm, so...I'm still thinkng how to answer the question. It all stems from requests that I've had from amny different people, so from that perspective, yes? | 19:35 |
| ayoung | But...no one person has put together all the dynamic policy stuff and said "I need this" | 19:35 |
| ayoung | which is why I've mostly limited myself to presentations and specs on it, to try and build consensus on the direction | 19:36 |
| ayoung | I mean, sure, bug 968696 started the design process | 19:36 |
| openstack | bug 968696 in OpenStack Compute (nova) ""admin"-ness not properly scoped" [High,Confirmed] https://launchpad.net/bugs/968696 | 19:36 |
| ayoung | and, I don;t really think we can close that withou the dynamic policy approach | 19:36 |
| ayoung | so, there are stakeholders there | 19:36 |
| ayoung | dolphm, but I can see the argument that, especially for a significant feature like dynamic policy, the upstream approach should be "prove it works in a deployment somehwere first." We are seeing that with Fernet, really, right? | 19:39 |
| ayoung | I mean, we are still shaking out issues with it. | 19:40 |
| ayoung | Actually, we are not seeing it with Fernet, but we are seeing people tryuing it and shaking out the issues before it becomes default. | 19:40 |
| ayoung | PKI tokens missed that; I'd like to avoid putting so much effort in to something only to find a critical flaw like those had | 19:41 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 19:42 |
| *** petertr7_away is now known as petertr7 | 19:44 | |
| *** piyanai has joined #openstack-keystone | 19:44 | |
| *** lsmola has quit IRC | 19:46 | |
| *** samueldmq has quit IRC | 19:46 | |
| *** samueldmq has joined #openstack-keystone | 19:47 | |
| *** mylu has quit IRC | 19:47 | |
| *** mylu has joined #openstack-keystone | 19:48 | |
| samueldmq | ayoung: so I have a plan .. | 19:55 |
| ayoung | samueldmq, did you ever watch the TVshow the A Team? | 19:55 |
| samueldmq | ayoung: spec merged as agreement in the direction, that doesn't mean granting ffe | 19:55 |
| samueldmq | ayoung: no :( | 19:55 |
| dstanek | "i love it when a plan comes together" | 19:55 |
| samueldmq | :) | 19:55 |
| *** ekarlso has quit IRC | 19:55 | |
| *** tjcocozz has quit IRC | 19:55 | |
| samueldmq | ayoung: then I am going to work with gyee + email in the operators list to see people raising their hands and saying 'yes, we want it' | 19:56 |
| samueldmq | ayoung: that will decide whether accept it as ffe or not | 19:56 |
| samueldmq | ayoung: by the time, I will have all the patches ready for review (I am working on the last one now, the one in the server) | 19:56 |
| *** tsymanczyk has quit IRC | 19:57 | |
| *** ekarlso has joined #openstack-keystone | 19:57 | |
| samueldmq | ayoung: aiming to do so until next meeting | 19:57 |
| samueldmq | that's my plan | 19:57 |
| samueldmq | the plan A | 19:57 |
| samueldmq | the B is to defer to M, which I don't like, and I suspect you don't as well | 19:58 |
| samueldmq | :-) | 19:58 |
| *** jsavak has quit IRC | 20:04 | |
| ayoung | samueldmq, sounds good | 20:04 |
| *** jsavak has joined #openstack-keystone | 20:04 | |
| samueldmq | ayoung: nice, I am gonna breathe a bit, brb | 20:05 |
| ayoung | samueldmq, I am just done tilting at windmills...for the time being. If we can't get some understanding from people that this is valuable, we'll find another approach. So, yeah, full support from me. | 20:05 |
| morganfainberg | dolphm: thanks for running the meeting | 20:05 |
| * morganfainberg just woke up. | 20:05 | |
| morganfainberg | This timezone shift is brutal | 20:05 |
| samueldmq | ayoung: ++ thanks | 20:06 |
| *** tsymanczyk has joined #openstack-keystone | 20:07 | |
| *** tsymanczyk is now known as Guest71912 | 20:07 | |
| *** mylu has quit IRC | 20:10 | |
| *** lhcheng_away is now known as lhcheng | 20:11 | |
| *** marzif_ has joined #openstack-keystone | 20:12 | |
| *** dims_ has joined #openstack-keystone | 20:21 | |
| *** dims has quit IRC | 20:22 | |
| *** mylu has joined #openstack-keystone | 20:24 | |
| *** mylu has quit IRC | 20:29 | |
| *** urulama has quit IRC | 20:30 | |
| *** urulama has joined #openstack-keystone | 20:31 | |
| *** amakarov is now known as amakarov_away | 20:36 | |
| ayoung | morganfainberg, dolphm is Icehouse stable still open for backports? | 20:44 |
| bknudson | ayoung: stable/icehouse branch was deleted a few weeks ago | 20:45 |
| *** diegoadolfo has quit IRC | 20:45 | |
| *** tsymancz1k has joined #openstack-keystone | 20:47 | |
| *** Guest71912 has quit IRC | 20:47 | |
| morganfainberg | ayoung: icehouse is EOL | 20:48 |
| *** henrynash has joined #openstack-keystone | 20:49 | |
| *** ChanServ sets mode: +v henrynash | 20:49 | |
| morganfainberg | henrynash: isn't it super late for you? | 20:52 |
| henrynash | morganfainberg: tis true, tis true | 20:52 |
| *** mylu has joined #openstack-keystone | 20:52 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for HTTPClient tenant_id, tenant_name parameters https://review.openstack.org/205701 | 20:53 |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for HTTPClient.tenant_id|name https://review.openstack.org/205710 | 20:54 |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for HTTPClient.request methods https://review.openstack.org/205711 | 20:54 |
| *** jsavak has quit IRC | 20:57 | |
| *** gyee has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v gyee | 21:00 | |
| *** tqtran is now known as tqtran-afk | 21:03 | |
| *** raildo has quit IRC | 21:04 | |
| *** david-lyle has joined #openstack-keystone | 21:07 | |
| *** bapalm_ has quit IRC | 21:07 | |
| *** petertr7 is now known as petertr7_away | 21:08 | |
| *** josecastroleon has quit IRC | 21:08 | |
| *** mylu has quit IRC | 21:09 | |
| *** josecastroleon has joined #openstack-keystone | 21:09 | |
| *** gyee has quit IRC | 21:09 | |
| *** gyee has joined #openstack-keystone | 21:15 | |
| *** ChanServ sets mode: +v gyee | 21:15 | |
| *** mylu has joined #openstack-keystone | 21:15 | |
| *** mylu has quit IRC | 21:16 | |
| *** HenryG_ is now known as HenryG | 21:17 | |
| *** henrynash has quit IRC | 21:20 | |
| *** samleon has quit IRC | 21:20 | |
| *** samleon has joined #openstack-keystone | 21:21 | |
| mtreinish | morganfainberg, bknudson: did anyone ever start looking at logging the request ids from the context in the keystone logs? | 21:22 |
| mtreinish | because when I was looking at debugging something yesterday finding my call in the keystone logs was a bit tricky | 21:23 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Prevent exception due to missing id of LDAP entity https://review.openstack.org/207960 | 21:25 |
| mtreinish | morganfainberg, bknudson: IIRC what was needed for that was to switch to using oslo.context and then oslo.log would pick it up automagically | 21:35 |
| morganfainberg | mtreinish: yes and we need to restructure our stuff to make that viable | 21:36 |
| morganfainberg | since authcontext is a special beast | 21:36 |
| mtreinish | morganfainberg: I thought it was just a dict? Although it's been a few months since I looked :) | 21:38 |
| morganfainberg | authcontext has other stuff. | 21:38 |
| morganfainberg | it's not just dict it was "make sure this all works" | 21:38 |
| morganfainberg | we did odd things | 21:38 |
| morganfainberg | it's not a drop in but not tons of work just work | 21:39 |
| mtreinish | heh, ok. Yeah I realized it wasn't just drop in, it didn't really work when I tried that :) | 21:40 |
| *** jagter has quit IRC | 21:43 | |
| *** e0ne has quit IRC | 21:44 | |
| morganfainberg | mtreinish: oh so.. question for you... | 21:44 |
| morganfainberg | mtreinish: how angry would you be if i tried to switch keystone over to uwsgi from mod_wsgi in devstack (or not in your feild of caring) | 21:45 |
| morganfainberg | s/angry/concernedorsomethingelse/ | 21:45 |
| *** tsymancz1k has quit IRC | 21:45 | |
| *** tsymanczyk has joined #openstack-keystone | 21:45 | |
| *** tsymanczyk is now known as Guest83501 | 21:46 | |
| mtreinish | morganfainberg: I'm not sure that I'd care too much one way or the other | 21:46 |
| morganfainberg | cool | 21:46 |
| mtreinish | as long as you made a decent argument for why changing it would be good | 21:46 |
| morganfainberg | squashing the "apache cant' stop" bug | 21:46 |
| morganfainberg | that still lurks around | 21:46 |
| morganfainberg | and uwsgi is generally better since it can support venvs [operator focus] | 21:47 |
| mtreinish | although I do think there were other efforts to move things to mod_wsgi so it might be good to comment on those too | 21:47 |
| mtreinish | oh, yeah venvs are nice :) | 21:47 |
| morganfainberg | mtreinish: i plan on catching thingee and talking about it | 21:47 |
| ayoung | bknudson, https://review.openstack.org/#/c/188329/2 can you re-review, as I suspect no one else will touch it until you do, and it blocks https://review.openstack.org/#/c/173558/7 | 21:47 |
| *** jagter has joined #openstack-keystone | 21:47 | |
| morganfainberg | i'd like to make uwsgi the default - but mod_wsgi -> uwsgi is easy | 21:47 |
| mtreinish | morganfainberg: I also remember dims patches for nova things too | 21:47 |
| morganfainberg | mtreinish: great i'll poke dims_ | 21:48 |
| morganfainberg | uwsgi is also ini-style config | 21:48 |
| morganfainberg | which makes it super easy to manage in devstack [less subst in apache confs] | 21:48 |
| morganfainberg | we'd still use apache | 21:48 |
| morganfainberg | just less in-process ick | 21:48 |
| bknudson | ayoung: will do. | 21:48 |
| ayoung | thanks | 21:48 |
| mtreinish | morganfainberg: ok cool, that sounds like a good thing | 21:49 |
| mtreinish | yeah I guess the big model change is to running under apache instead of as a standalone thing | 21:49 |
| morganfainberg | mtreinish: and that doesn't really change here | 21:49 |
| mtreinish | yep | 21:49 |
| morganfainberg | it's just what wsgi impl we use. | 21:49 |
| morganfainberg | and really uwsgi took me ~15mins to setup compared to the apache keystone model | 21:49 |
| morganfainberg | and that was by-hand | 21:50 |
| *** jasonsb has quit IRC | 21:50 | |
| mtreinish | ok, cool | 21:50 |
| *** phalmos has quit IRC | 21:51 | |
| mtreinish | are we going to have those strange ragnarok evoked log messages if we use it though? | 21:51 |
| *** jasonsb has joined #openstack-keystone | 21:51 | |
| mtreinish | I can't remember where I saw that but something already uses uwsgi | 21:52 |
| gyee | bknudson, the feature/keystoneauth_integration branch for python-keystoneclient seem broken as is | 21:52 |
| bknudson | gyee: how did it get that way? | 21:53 |
| gyee | bkundson, just did git clone and tox -e py27 | 21:53 |
| bknudson | master is working fine | 21:53 |
| *** doug-fish has left #openstack-keystone | 21:53 | |
| gyee | master is working fine | 21:53 |
| gyee | but not keystoneauth_integration | 21:53 |
| gyee | bknudson, and the reason for the Ceilometer failure was that it was expecting the EndpointNotFound exception from keystoneclient.openstack.common.apiclient.exceptions | 21:57 |
| gyee | with keystoneauth1, that exception got redefined | 21:57 |
| gyee | so its not backward compatible | 21:57 |
| gyee | so we have two choices: 1) fix keystoneauth1 exceptions; 2) fix everywhere else | 21:59 |
| bknudson | gyee: ahh, neat. | 22:01 |
| morganfainberg | we aren't accepting that change | 22:01 |
| bknudson | gyee: sounds like 1 is the only option | 22:02 |
| *** edmondsw has quit IRC | 22:02 | |
| gyee | bknudson, yes, I agree | 22:02 |
| bknudson | because we're not going to be able to pass tempest | 22:02 |
| morganfainberg | so there is other work to be done there | 22:02 |
| gyee | yes | 22:02 |
| morganfainberg | keystoneauth1 isn't going to get that change | 22:02 |
| bknudson | I still wonder how it got past tempest to begin with | 22:02 |
| gyee | what are we redefining those exceptions anyway | 22:02 |
| *** mylu has joined #openstack-keystone | 22:03 | |
| morganfainberg | we will put minor compat into keystoneclient | 22:03 |
| morganfainberg | not into keystoneauth | 22:03 |
| morganfainberg | if anywhere | 22:03 |
| bknudson | keystoneclient needs a compat change now | 22:03 |
| morganfainberg | the integration branch | 22:03 |
| morganfainberg | not the master | 22:03 |
| morganfainberg | sure | 22:03 |
| morganfainberg | just was pointing out putting compat changes into keystoneauth1 is a no-go | 22:04 |
| bknudson | morganfainberg: remember when I was complaining about apiclient in the x-project meeting? | 22:04 |
| morganfainberg | bknudson: yep. | 22:04 |
| morganfainberg | bknudson: can we just break everyone and the gate and force everyone to fix it rapidly | 22:04 |
| morganfainberg | sarcasm of course | 22:04 |
| gyee | hahahah | 22:04 |
| morganfainberg | in all honesty we should just fix it everywhere and break it in keystoneclient | 22:05 |
| morganfainberg | but it's a lot of work | 22:05 |
| morganfainberg | everywhere = things in gate | 22:05 |
| morganfainberg | 2.x of keystoneclient will not be adhering to the same apis etc | 22:05 |
| gyee | hey, if it ain't making a lot of noise, you ain't doing nothing yet | 22:05 |
| *** TheIntern has quit IRC | 22:05 | |
| morganfainberg | we're already remving cli from ksc 2.x | 22:06 |
| morganfainberg | but if we are doing *any* compat work, we're doing it in keystoneclient not in keystoneauth | 22:06 |
| bknudson | so we've got http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/exceptions.py?h=feature/keystoneauth_integration | 22:07 |
| *** chlong has joined #openstack-keystone | 22:07 | |
| bknudson | and I'm guessing this isn't right since EndpointNotFound = new_exceptions.EndpointNotFound | 22:07 |
| bknudson | and that needs to be using apiclient still | 22:08 |
| gyee | right | 22:08 |
| gyee | because other places are catching it from apiclient | 22:08 |
| *** rm_work is now known as rm_work|away | 22:08 | |
| bknudson | that is really f'd up. | 22:09 |
| gyee | ya thing? :) | 22:09 |
| gyee | think | 22:09 |
| bknudson | maybe we could use some kind of dual-inheritance | 22:09 |
| * morganfainberg marks another line in the sand of why oslo-incubator is bad. | 22:09 | |
| morganfainberg | bknudson: might work. | 22:09 |
| morganfainberg | haven't tried catching a dual inherited exception before | 22:10 |
| * gyee pees on that line to make sure its really visible | 22:10 | |
| bknudson | alternatively, we mess with our oslo-incubator copy | 22:12 |
| *** henrynash has joined #openstack-keystone | 22:12 | |
| *** ChanServ sets mode: +v henrynash | 22:12 | |
| bknudson | since we hate it so much, make apiclient use new exceptions, too. | 22:12 |
| bknudson | and forget about syncing | 22:12 |
| morganfainberg | bknudson: is there anything we benefit from in keeping oslo-incubator anything | 22:14 |
| *** jasonsb_ has joined #openstack-keystone | 22:14 | |
| bknudson | morganfainberg: backwards-compat | 22:14 |
| morganfainberg | no i mean break it and never sync again | 22:14 |
| morganfainberg | sorry | 22:14 |
| morganfainberg | wasn't clear | 22:14 |
| morganfainberg | for keystoneclient | 22:14 |
| bknudson | all this stuff is deprecated already | 22:14 |
| morganfainberg | ok so lets just break it, never sync it again - and work hard to make it disappear | 22:15 |
| morganfainberg | break = local changes | 22:15 |
| bknudson | I'll take a look at it. | 22:15 |
| morganfainberg | as needed. | 22:15 |
| morganfainberg | bknudson: sounds good | 22:16 |
| *** jasonsb has quit IRC | 22:16 | |
| *** haneef_ has quit IRC | 22:16 | |
| *** mylu has quit IRC | 22:16 | |
| *** mylu has joined #openstack-keystone | 22:17 | |
| gyee | you mean like fix it anywhere else? | 22:18 |
| bknudson | gyee: everywhere else will have to fix eventually, since it's deprecated | 22:18 |
| bknudson | gyee: but for now, what I'll do is make keystoneclient/openstack/common/apiclient/exceptions.py point to keystoneclient.exceptions instead of the other way around | 22:19 |
| gyee | bknudson, k, but do we need to file a bug for ceilometer to make then aware? | 22:20 |
| *** jecarey has quit IRC | 22:20 | |
| bknudson | gyee: a bug makes sense. they're using deprecated function and need to change sometime. | 22:20 |
| gyee | k | 22:21 |
| *** HT_sergio has quit IRC | 22:21 | |
| *** gordc has quit IRC | 22:22 | |
| morganfainberg | bknudson: ++ | 22:22 |
| *** spandhe_ has joined #openstack-keystone | 22:23 | |
| *** spandhe has quit IRC | 22:23 | |
| *** spandhe_ is now known as spandhe | 22:23 | |
| *** stevemar has joined #openstack-keystone | 22:24 | |
| *** ChanServ sets mode: +v stevemar | 22:24 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:25 | |
| *** Guest83501 has quit IRC | 22:36 | |
| *** tsymancz1k has joined #openstack-keystone | 22:36 | |
| *** roxanaghe has quit IRC | 22:39 | |
| *** stevemar has quit IRC | 22:39 | |
| *** boris-42 has quit IRC | 22:40 | |
| *** bknudson has quit IRC | 22:44 | |
| *** mylu has quit IRC | 22:46 | |
| *** mylu has joined #openstack-keystone | 22:47 | |
| *** henrynash has quit IRC | 22:56 | |
| *** zzzeek has quit IRC | 23:02 | |
| *** mylu has quit IRC | 23:11 | |
| *** jaosorior has quit IRC | 23:14 | |
| *** rm_work|away is now known as rm_work | 23:16 | |
| *** david-lyle has quit IRC | 23:18 | |
| *** piyanai has quit IRC | 23:19 | |
| *** dims_ has quit IRC | 23:23 | |
| *** piyanai has joined #openstack-keystone | 23:26 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for HTTPClient session and adapter properties https://review.openstack.org/205806 | 23:27 |
| *** piyanai has quit IRC | 23:32 | |
| *** boris-42 has joined #openstack-keystone | 23:37 | |
| *** topol has quit IRC | 23:39 | |
| *** dims has joined #openstack-keystone | 23:47 | |
| *** jamielennox|away is now known as jamielennox | 23:50 | |
| *** zzzeek has joined #openstack-keystone | 23:51 | |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Enforce endpoint constraint https://review.openstack.org/177661 | 23:52 |
| *** zzzeek has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
