| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Split plugin loading https://review.openstack.org/190594 | 00:10 |
|---|---|---|
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Move session loading into loading module https://review.openstack.org/209349 | 00:10 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove oslo_config from auth plugin loading https://review.openstack.org/209348 | 00:10 |
| *** r-daneel has quit IRC | 00:16 | |
| *** boris-42 has quit IRC | 00:20 | |
| *** henrynash has quit IRC | 00:20 | |
| morganfainberg | jamielennox: thats the thought, but we should be consistent | 00:22 |
| morganfainberg | jamielennox: /me looks at those ^ patches. | 00:22 |
| jamielennox | morganfainberg: i'm just moving stuff at will now, i think so long as i don't change the session or adapter interfaces then clients aren't going to notice anyway | 00:23 |
| morganfainberg | jamielennox: https://review.openstack.org/#/c/209302/ could use a quick +2/+A | 00:23 |
| morganfainberg | and then i'll approve the mirror for ksa | 00:23 |
| morganfainberg | erm integration branch | 00:23 |
| jamielennox | morganfainberg: simple +A https://review.openstack.org/#/c/168546/4 | 00:28 |
| jamielennox | morganfainberg: wait - shouldn't you be on a plane? | 00:28 |
| morganfainberg | tomorrow | 00:28 |
| morganfainberg | it's still thursday. anita was flying today | 00:28 |
| morganfainberg | s/was/is | 00:28 |
| jamielennox | it is still thursday, my days are way off | 00:28 |
| morganfainberg | hehe | 00:29 |
| morganfainberg | and I'm the one who crossed the international date line | 00:29 |
| morganfainberg | :P | 00:29 |
| jamielennox | morganfainberg: so i'm inclined to just scrap the keystoneauth_integration branch of keystoneclient, there was always the assumption there it was going to be a bridge between client and auth but if we're not doing that we can just remove stuff | 00:30 |
| jamielennox | make 2.0 a real split | 00:30 |
| morganfainberg | jamielennox: well uh. ok we could just fork that branch as is though | 00:30 |
| morganfainberg | i mean... we have put some work into it already | 00:31 |
| jamielennox | ok, sure i just mean most of what i have outstanding is like base service catalog on kestoneauth, where if that branch is to become v2 then it's just rm service_catalog | 00:31 |
| morganfainberg | well i was thinking we'd just make master = 2.0 when we were done with that branch | 00:31 |
| morganfainberg | merge that back to master and call it good(tm) | 00:32 |
| openstackgerrit | Dan Nguyen proposed openstack/keystone: Allow Domain Admin to get domain details https://review.openstack.org/208082 | 00:32 |
| morganfainberg | if you think we need to explicitly 2.0 branch instead - we can do that too | 00:32 |
| jamielennox | morganfainberg: i'm fine with the name being wrong, especially as we had to get all the requirements and test hacks in to make it work | 00:33 |
| morganfainberg | ok so lets stick with it and when we're ready merge back to master | 00:33 |
| jamielennox | i guess i should just abandon most of those patches and go chopper mode instead | 00:33 |
| morganfainberg | then we can cut the 2.x branch once the merge is done. | 00:33 |
| morganfainberg | erm, tag | 00:33 |
| morganfainberg | and we'll be in the right place | 00:34 |
| morganfainberg | and then for L i'd like to g-r bump to >2.x | 00:34 |
| morganfainberg | so [sooner is better] | 00:34 |
| jamielennox | L? | 00:34 |
| morganfainberg | liberty | 00:35 |
| morganfainberg | >=2.x | 00:35 |
| jamielennox | i thought we said <2.0 for L and >2 for M | 00:35 |
| morganfainberg | well if the interfaces work... | 00:35 |
| morganfainberg | we can do it in L ;) | 00:35 |
| morganfainberg | if they don't we can do that for M | 00:35 |
| morganfainberg | either way | 00:35 |
| jamielennox | because they are going to be incompatible | 00:35 |
| *** _cjones_ has quit IRC | 00:35 | |
| morganfainberg | ok sure | 00:35 |
| morganfainberg | we can do that then | 00:35 |
| morganfainberg | let me g-r propose that. | 00:35 |
| jamielennox | i'll be interested to see how we switch over with a big change | 00:36 |
| morganfainberg | 99% of the change is keystoneclient -> keystoneauth1 | 00:36 |
| morganfainberg | afaict | 00:36 |
| *** bapalm has joined #openstack-keystone | 00:37 | |
| jamielennox | mostly, we still need to transition anyone doing Client(username=) | 00:37 |
| jamielennox | which i hope doesn't exist but you know it will | 00:37 |
| morganfainberg | yeah | 00:37 |
| jamielennox | yea, i think we pin < 2 for liberty | 00:39 |
| *** bapalm has quit IRC | 00:39 | |
| jamielennox | the intent should be that the session from keystoneauth will be drop in replacable with keystoneclient.session in < 2 so we can even start moving people over to keystoneauth and just rip everything out of ksc first thing in M | 00:40 |
| *** gyee has quit IRC | 00:41 | |
| morganfainberg | yep | 00:41 |
| *** btully has quit IRC | 00:41 | |
| morganfainberg | jamielennox: https://review.openstack.org/209715 see how the -infra and -requirements folks respond to it | 00:43 |
| *** zzzeek has joined #openstack-keystone | 00:44 | |
| morganfainberg | we might get told "wait" but I'd much prefer to *not* wait to get the 2.x.x stuff out the door | 00:44 |
| jamielennox | morganfainberg: commented, there is a comment you might want to fix up | 00:44 |
| jamielennox | morganfainberg: i expect we'll have to wait a bit for something so fundamental but it's better to start the converstaion now | 00:45 |
| morganfainberg | right | 00:45 |
| *** mylu has joined #openstack-keystone | 00:45 | |
| *** mylu has quit IRC | 00:50 | |
| *** mylu has joined #openstack-keystone | 00:55 | |
| *** mylu has quit IRC | 00:56 | |
| *** narengan has joined #openstack-keystone | 00:58 | |
| *** jasonsb has joined #openstack-keystone | 01:01 | |
| *** mylu has joined #openstack-keystone | 01:03 | |
| *** browne has quit IRC | 01:03 | |
| *** jasonsb has quit IRC | 01:04 | |
| *** jasonsb_ has joined #openstack-keystone | 01:04 | |
| openstackgerrit | Merged openstack/keystone: Remove unnecessary ldap imports https://review.openstack.org/203402 | 01:11 |
| *** zzzeek has quit IRC | 01:16 | |
| *** mylu has quit IRC | 01:18 | |
| *** dims_ has joined #openstack-keystone | 01:21 | |
| *** dims has quit IRC | 01:22 | |
| *** roxanaghe has quit IRC | 01:37 | |
| *** jdandrea has quit IRC | 01:39 | |
| *** narengan has quit IRC | 01:42 | |
| *** narengan has joined #openstack-keystone | 01:43 | |
| *** narengan has quit IRC | 01:47 | |
| *** narengan has joined #openstack-keystone | 01:48 | |
| openstackgerrit | Merged openstack/python-keystoneclient: oslo-incubator apiclient.exceptions to keystoneclient.exceptions https://review.openstack.org/209302 | 01:50 |
| *** piyanai has joined #openstack-keystone | 01:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Move apiclient.base.Resource into keystoneclient https://review.openstack.org/209592 | 01:53 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate openstack.common.apiclient https://review.openstack.org/209609 | 01:53 |
| morganfainberg | hmm | 01:56 |
| *** dims has joined #openstack-keystone | 02:03 | |
| *** dims_ has quit IRC | 02:05 | |
| *** dims_ has joined #openstack-keystone | 02:06 | |
| *** dims has quit IRC | 02:09 | |
| *** btully has joined #openstack-keystone | 02:09 | |
| morganfainberg | dolphm, lbragstad, dstanek: wooooo keystone-deploy pull request liking incoming for uwsgi :) | 02:09 |
| * morganfainberg just got it all working and niceeeeely | 02:10 | |
| *** markvoelker has quit IRC | 02:11 | |
| *** markvoelker has joined #openstack-keystone | 02:12 | |
| *** darrenc is now known as darrenc_afk | 02:12 | |
| *** btully has quit IRC | 02:13 | |
| *** dims_ has quit IRC | 02:22 | |
| *** spandhe has quit IRC | 02:28 | |
| *** narengan has quit IRC | 02:43 | |
| *** narengan has joined #openstack-keystone | 02:43 | |
| *** lhcheng has quit IRC | 02:45 | |
| *** narengan has quit IRC | 02:48 | |
| *** stevemar has joined #openstack-keystone | 02:50 | |
| *** ChanServ sets mode: +v stevemar | 02:50 | |
| *** omkarjoshi has joined #openstack-keystone | 02:52 | |
| *** hakimo has joined #openstack-keystone | 02:52 | |
| *** hakimo_ has quit IRC | 02:55 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use UUID values in v3 test fixtures https://review.openstack.org/168546 | 02:55 |
| morganfainberg | dstanek, jamielennox: any thoughts on using a websocket instead of pure rest for token validation from middleware? | 02:56 |
| * morganfainberg is toying with ideas. | 02:56 | |
| jamielennox | morganfainberg: i would expect from a pure network performance it would be the same as now because we are doing connection pooling | 02:56 |
| morganfainberg | jamielennox: hmm... | 02:57 |
| jamielennox | morganfainberg: however depending on how you handled it on the server side you might see a boost | 02:57 |
| jamielennox | you could auth the channel once rather than per request | 02:57 |
| morganfainberg | jamielennox: that is the thought | 02:57 |
| morganfainberg | jamielennox: it would potentially lower overhead of middelware -> keystone since the channel is auth'd until it needs to reauth (fail/restart/etc) | 02:58 |
| morganfainberg | instead of needing to hold a token | 02:58 |
| morganfainberg | you'd still need an initial auth - but that is assumed (and re-auth if socket closes, etc) | 02:58 |
| morganfainberg | it would mean we don't have to process authcontext each time [we do even with pooling] | 02:59 |
| *** browne has joined #openstack-keystone | 03:01 | |
| jamielennox | morganfainberg: if we switch to x509 auth for service users and do connection pooling i'd be interested what the difference is | 03:01 |
| morganfainberg | we'd still need to process x509 cert | 03:01 |
| morganfainberg | the difference would be the same as with a token | 03:01 |
| morganfainberg | iirc | 03:01 |
| morganfainberg | or well attrs from the x509 cert | 03:02 |
| jamielennox | you'd build the AuthContext - i don't know if you'd process it each time | 03:02 |
| jamielennox | i don't know how mod_ssl handles connection pools | 03:02 |
| morganfainberg | each request has to process the attrs. | 03:02 |
| morganfainberg | yeah i don't know either | 03:02 |
| morganfainberg | i wonder how it's would look if we x509 -> websocket . | 03:03 |
| jamielennox | i'd be interested if it makes any difference in a setup with a useful cache | 03:03 |
| *** markvoelker has quit IRC | 03:04 | |
| jamielennox | also i don't know how you do websockets in mod_wsgi | 03:04 |
| morganfainberg | oh i'm looking at uwsgi | 03:04 |
| morganfainberg | we couldn't remove the ability to do REST calls | 03:04 |
| morganfainberg | but we could support [if server supports] websockets etc | 03:05 |
| *** piyanai has quit IRC | 03:05 | |
| morganfainberg | jamielennox: http://stackoverflow.com/questions/13137449/combining-websockets-and-wsgi-in-a-python-app | 03:05 |
| *** omkarjoshi has quit IRC | 03:06 | |
| jamielennox | right - that's about what i expected, you can do it with twisted, there is some support via gevent | 03:06 |
| jamielennox | but it's an entirely different process to wsgi | 03:06 |
| morganfainberg | yep | 03:06 |
| *** lhcheng has joined #openstack-keystone | 03:07 | |
| *** ChanServ sets mode: +v lhcheng | 03:07 | |
| morganfainberg | uwsgi can natively handle it as well | 03:07 |
| morganfainberg | it's an upgrade request | 03:07 |
| morganfainberg | so - by all rights doable | 03:07 |
| jamielennox | i have no real idea how uwsgi works | 03:07 |
| morganfainberg | it's a separate process manager | 03:07 |
| jamielennox | the only time ive really looked is when i was trying to run barbican and found it to be really involved but no real look at what it's doing | 03:08 |
| morganfainberg | so [apache] <---[socket]--> [uwsgi [APP]] | 03:08 |
| jamielennox | as opposed to mod_wsgi in daemon mode? | 03:08 |
| *** stevemar has quit IRC | 03:09 | |
| morganfainberg | yeah | 03:09 |
| morganfainberg | apache doesn't directly manage the workers | 03:09 |
| *** stevemar has joined #openstack-keystone | 03:09 | |
| *** ChanServ sets mode: +v stevemar | 03:09 | |
| morganfainberg | it means you have more control over them | 03:09 |
| morganfainberg | among other things | 03:10 |
| morganfainberg | oh look its stevemar ! hi stevemar | 03:11 |
| *** stevemar has quit IRC | 03:13 | |
| jamielennox | morganfainberg: it seems like something i'd build as a seperate service | 03:13 |
| jamielennox | not seperate, but do the stable binary interfaces | 03:13 |
| *** urulama has quit IRC | 03:13 | |
| *** urulama has joined #openstack-keystone | 03:14 | |
| jamielennox | and have it running either from apache or standalone in it's own service | 03:14 |
| morganfainberg | sure. | 03:14 |
| jamielennox | i don't think relying on uwsgi will help there | 03:14 |
| morganfainberg | well uwsgi can natively do the websocket part | 03:15 |
| morganfainberg | so you're just wiring the code up behind the protocol | 03:15 |
| morganfainberg | rather than needing to implement the protocol using websockets or similar lib as well as the processing code | 03:15 |
| *** davechen has joined #openstack-keystone | 03:21 | |
| *** doug-fish has quit IRC | 03:26 | |
| *** doug-fish has joined #openstack-keystone | 03:26 | |
| *** csd has quit IRC | 03:27 | |
| *** boris-42 has joined #openstack-keystone | 03:27 | |
| *** csd has joined #openstack-keystone | 03:29 | |
| *** marzif__ has joined #openstack-keystone | 03:35 | |
| *** darrenc_afk is now known as darrenc | 03:36 | |
| *** ayoung has quit IRC | 03:56 | |
| *** jamiec has quit IRC | 03:57 | |
| *** jamiec has joined #openstack-keystone | 03:58 | |
| *** jasonsb_ has quit IRC | 04:01 | |
| *** jasonsb has joined #openstack-keystone | 04:03 | |
| *** markvoelker has joined #openstack-keystone | 04:04 | |
| *** jecarey has joined #openstack-keystone | 04:06 | |
| *** markvoelker has quit IRC | 04:09 | |
| *** spandhe has joined #openstack-keystone | 04:17 | |
| *** spandhe_ has joined #openstack-keystone | 04:20 | |
| *** spandhe has quit IRC | 04:22 | |
| *** spandhe_ is now known as spandhe | 04:22 | |
| *** stevemar has joined #openstack-keystone | 04:24 | |
| *** ChanServ sets mode: +v stevemar | 04:24 | |
| dstanek | morganfainberg, jamielennox: are you thinking of a websocket connection for each user? | 04:31 |
| morganfainberg | dstanek: was thinking for each middleware | 04:32 |
| jamielennox | dstanek: not thinking of anything particular, i think morganfainberg is reading through wsgi | 04:32 |
| jamielennox | uwsgi | 04:32 |
| dstanek | ah | 04:32 |
| morganfainberg | dstanek: so 1-(N, one per process) if we started looking at it | 04:32 |
| jamielennox | but most likely per auth_token | 04:32 |
| dstanek | you'd have to be very careful multiplexing over that connection | 04:33 |
| morganfainberg | dstanek: it would be per-auth_token instance not 1 per nova | 04:33 |
| morganfainberg | so nova might have 3 instances of ATM | 04:33 |
| morganfainberg | (three workers) | 04:33 |
| dstanek | but won't you have multiple concurrent requests through each one? | 04:34 |
| morganfainberg | depend on how eventlet trampolines | 04:34 |
| dstanek | otherwise you just limited the cluster to 3 concurrent requests | 04:34 |
| morganfainberg | perhaps, but it should still all be REQ id based. | 04:34 |
| morganfainberg | doable | 04:34 |
| morganfainberg | just was pondering approaches that would be interesting | 04:35 |
| dstanek | yeah, i just don't know how the multiplexing would work with eventlet | 04:35 |
| morganfainberg | anyway /me is off to wander brisbane a bit | 04:36 |
| morganfainberg | trying to get teh sleep schedule somehow worked out for this flight tomorrow. | 04:36 |
| dstanek | have fun! | 04:36 |
| bigjools | been to South Bank? | 04:36 |
| *** vivekd has joined #openstack-keystone | 04:39 | |
| *** btully has joined #openstack-keystone | 04:54 | |
| *** yottatsa has joined #openstack-keystone | 05:01 | |
| *** ankita_wagh has joined #openstack-keystone | 05:02 | |
| *** topol has quit IRC | 05:04 | |
| *** topol has joined #openstack-keystone | 05:07 | |
| *** ChanServ sets mode: +v topol | 05:07 | |
| *** hrou has quit IRC | 05:10 | |
| morganfainberg | bigjools: a bunch. :P | 05:17 |
| bigjools | morganfainberg: I'm guessing you didn't take a swim at the city beach? :) | 05:17 |
| morganfainberg | Haha. No | 05:17 |
| morganfainberg | I was at the beach the day before I came here. Santa Monica beach > Brisbane city beach :P | 05:18 |
| bigjools | yeah but you have to travel to the coast! | 05:19 |
| morganfainberg | Its not that far. | 05:19 |
| morganfainberg | And if i don't move away from socal, ill | 05:20 |
| morganfainberg | Move back to the coast. | 05:20 |
| bigjools | The Sunshine Coast has awesome beaches | 05:20 |
| * bigjools goes back to beating Tempest into shape | 05:22 | |
| *** Nirupama has joined #openstack-keystone | 05:29 | |
| openstackgerrit | Merged openstack/keystone: Fix typos of RoleAssignmentV3._format_entity doc https://review.openstack.org/208864 | 05:31 |
| stevemar | morganfainberg: oh hai o/ | 05:32 |
| morganfainberg | Shhhhh | 05:32 |
| morganfainberg | ;) | 05:32 |
| morganfainberg | ^_^ | 05:34 |
| stevemar | morganfainberg: oh okay | 05:37 |
| stevemar | topol: oh hai o/ | 05:37 |
| morganfainberg | Whats up? | 05:37 |
| stevemar | morganfainberg: i guess i'll just chat with herr doctor | 05:38 |
| morganfainberg | Besides insomnia for you? | 05:38 |
| *** jecarey has quit IRC | 05:38 | |
| * morganfainberg is having a beer w/ | 05:38 | |
| morganfainberg | Flavio | 05:38 |
| stevemar | morganfainberg: oh i like him | 05:38 |
| topol | hi stevemar | 05:38 |
| stevemar | topol: pm'ing you! | 05:38 |
| morganfainberg | topol: teh doctor is in? | 05:38 |
| topol | I am here. what time is it | 05:38 |
| morganfainberg | 1539 by my clock | 05:39 |
| morganfainberg | So early. | 05:39 |
| morganfainberg | Or late. Or is is tomorrow? | 05:40 |
| *** lsmola has joined #openstack-keystone | 05:43 | |
| *** omkarjoshi has joined #openstack-keystone | 05:44 | |
| *** omkarjoshi has quit IRC | 05:44 | |
| *** urulama has quit IRC | 05:47 | |
| *** urulama has joined #openstack-keystone | 05:47 | |
| *** markvoelker has joined #openstack-keystone | 05:51 | |
| *** josecastroleon has joined #openstack-keystone | 05:55 | |
| *** markvoelker has quit IRC | 05:56 | |
| *** sileht has joined #openstack-keystone | 06:01 | |
| *** yottatsa has quit IRC | 06:01 | |
| *** dims has joined #openstack-keystone | 06:03 | |
| *** dims has quit IRC | 06:09 | |
| *** topol has quit IRC | 06:12 | |
| *** ParsectiX has joined #openstack-keystone | 06:18 | |
| openstackgerrit | Edgar Magana proposed openstack/keystone: Replace / by proper syntax that was not in the original fix https://review.openstack.org/209768 | 06:19 |
| *** boris-42 has quit IRC | 06:20 | |
| *** e0ne has joined #openstack-keystone | 06:21 | |
| *** vivekd has quit IRC | 06:24 | |
| *** vivekd has joined #openstack-keystone | 06:24 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Transifex https://review.openstack.org/208823 | 06:28 |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 06:37 |
| *** afazekas_ has joined #openstack-keystone | 06:37 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 06:39 |
| *** marzif__ has quit IRC | 06:39 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 06:39 |
| openstackgerrit | Edgar Magana proposed openstack/keystone: Replace / by proper syntax that was not in the original fix https://review.openstack.org/209768 | 06:40 |
| *** stevemar has quit IRC | 06:42 | |
| openstackgerrit | Merged openstack/keystone: Fix unbound error in federation _sign_assertion https://review.openstack.org/208163 | 06:45 |
| *** lhcheng has quit IRC | 06:49 | |
| *** belmoreira has joined #openstack-keystone | 06:52 | |
| *** e0ne has quit IRC | 07:00 | |
| *** blogan has quit IRC | 07:03 | |
| *** ankita_wagh has quit IRC | 07:04 | |
| *** blogan has joined #openstack-keystone | 07:04 | |
| *** e0ne has joined #openstack-keystone | 07:11 | |
| *** spandhe has quit IRC | 07:16 | |
| *** spandhe has joined #openstack-keystone | 07:17 | |
| *** e0ne has quit IRC | 07:26 | |
| *** browne has quit IRC | 07:27 | |
| *** btully has quit IRC | 07:30 | |
| *** spandhe has quit IRC | 07:31 | |
| *** henrynash has joined #openstack-keystone | 07:37 | |
| *** ChanServ sets mode: +v henrynash | 07:37 | |
| morganfainberg | Hey henrynash how goes? | 07:42 |
| henrynash | morganfainberg: excellent…you? Back in the USA? | 07:43 |
| morganfainberg | Nah tomorrow | 07:43 |
| morganfainberg | Still in the wonderful land of Brisbane | 07:44 |
| *** yottatsa has joined #openstack-keystone | 07:44 | |
| morganfainberg | Long %^# flight ensues at 1030a tomorroe and i land at 0630a tomorrow. :P | 07:44 |
| *** yottatsa has quit IRC | 07:48 | |
| *** markvoelker has joined #openstack-keystone | 07:52 | |
| *** markvoelker has quit IRC | 07:56 | |
| *** fhubik has joined #openstack-keystone | 07:57 | |
| *** spandhe has joined #openstack-keystone | 07:58 | |
| *** RA_ has quit IRC | 08:04 | |
| *** kiran-r has joined #openstack-keystone | 08:10 | |
| *** jistr has joined #openstack-keystone | 08:14 | |
| *** e0ne has joined #openstack-keystone | 08:22 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 08:26 |
| *** fhubik is now known as fhubik_afk | 08:30 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 08:33 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 08:35 |
| morganfainberg | jamielennox: holy crap Guilty Rogue nachos. It's not often the food wins for spicy as heck. | 08:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 08:36 |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 08:37 |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 08:37 |
| *** lhcheng has joined #openstack-keystone | 08:38 | |
| *** ChanServ sets mode: +v lhcheng | 08:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 08:39 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 08:39 |
| *** fhubik_afk is now known as fhubik | 08:40 | |
| *** e0ne has quit IRC | 08:41 | |
| *** lhcheng has quit IRC | 08:43 | |
| jamielennox | morganfainberg: really? i don't think i've ever eaten there | 08:50 |
| *** fhubik is now known as fhubik_afk | 08:50 | |
| morganfainberg | Yeah was super tasty too | 08:52 |
| morganfainberg | But dear god. Spicy | 08:52 |
| *** marzif__ has joined #openstack-keystone | 08:54 | |
| *** fhubik_afk is now known as fhubik | 08:55 | |
| *** fhubik is now known as fhubik_afk | 08:55 | |
| jamielennox | morganfainberg: have you figured out the plan for staying awake all night? | 08:57 |
| morganfainberg | Lots and lots and lots and lots and lots and lots and lots and lots and lots and lots and lots of coffee | 08:58 |
| *** e0ne has joined #openstack-keystone | 08:58 | |
| morganfainberg | Or well do what I do most nights and get lost reading into cool | 08:59 |
| morganfainberg | Technology | 08:59 |
| morganfainberg | As long as I'm | 08:59 |
| morganfainberg | Tired enough to sleep from bne -> lax I'm happy | 08:59 |
| jamielennox | it's a long flight, i'm pretty sure you will | 09:03 |
| *** fhubik_afk is now known as fhubik | 09:08 | |
| *** yottatsa has joined #openstack-keystone | 09:14 | |
| *** btully has joined #openstack-keystone | 09:17 | |
| *** btully has quit IRC | 09:22 | |
| *** yottatsa has quit IRC | 09:25 | |
| *** bdossant has joined #openstack-keystone | 09:25 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Transifex https://review.openstack.org/208823 | 09:29 |
| *** yottatsa has joined #openstack-keystone | 09:36 | |
| *** vince_ has joined #openstack-keystone | 09:39 | |
| *** vince_ has quit IRC | 09:40 | |
| *** vincep has joined #openstack-keystone | 09:40 | |
| *** yottatsa has quit IRC | 09:41 | |
| *** e0ne has quit IRC | 09:43 | |
| *** yottatsa has joined #openstack-keystone | 09:43 | |
| *** yottatsa has quit IRC | 09:48 | |
| *** dims has joined #openstack-keystone | 09:49 | |
| *** yottatsa has joined #openstack-keystone | 09:49 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Raises exception if domain_id not specified in create call https://review.openstack.org/209848 | 09:51 |
| *** markvoelker has joined #openstack-keystone | 09:53 | |
| *** davechen has left #openstack-keystone | 09:53 | |
| *** markvoelker has quit IRC | 09:57 | |
| dims | jamielennox: hi | 09:58 |
| jamielennox | dims: hello | 09:58 |
| *** hakimo has quit IRC | 09:58 | |
| *** e0ne has joined #openstack-keystone | 09:59 | |
| *** hakimo has joined #openstack-keystone | 09:59 | |
| dims | jamielennox: in Nova's neutronv2/api.py we use the keystonemiddleware v2 auth plugin, so one cannot use keystone v3 url it seems | 10:00 |
| dims | jamielennox: https://bugs.launchpad.net/nova/+bug/1481872 | 10:01 |
| openstack | Launchpad bug 1481872 in OpenStack Compute (nova) "[neutron]admin_auth_url does not support keystone v3 API" [Undecided,New] | 10:01 |
| dims | jamielennox: i tried to use generic.Password - https://review.openstack.org/#/c/209599/4/nova/network/neutronv2/api.py,cm | 10:01 |
| dims | jamielennox: but when i specify v3 api in devstack (https://review.openstack.org/#/c/209566/) - it still fails | 10:02 |
| dims | jamielennox: example - http://logs.openstack.org/66/209566/2/check/gate-tempest-dsvm-neutron-full/4213a0f/logs/screen-n-api.txt.gz?level=ERROR | 10:02 |
| dims | any ideas? | 10:03 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Move endpoint catalog filtering to default driver https://review.openstack.org/167675 | 10:04 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Remove services with no endpoints from catalog https://review.openstack.org/176383 | 10:04 |
| *** yottatsa has quit IRC | 10:04 | |
| jamielennox | dims: in and out cooking dinner, i'm guessing it was quicker to make the old options work than to do this properly accepting any plugin | 10:06 |
| dims | jamielennox: ack, y, no one looked at it for a year :) | 10:07 |
| dims | jamielennox: thanks, no hurries as such, if you get some time tomorrow you can take a look and let me know | 10:07 |
| jamielennox | dims: so the real solution is not to use generic, but to look at loading any plugin from conf | 10:08 |
| jamielennox | and deprecating all those old arguments | 10:08 |
| dims | jamielennox: has any projedt done this right? so i can look at how they did it? | 10:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 10:11 |
| jamielennox | dims: almost eveyone hacks this is some way for backwards compat | 10:12 |
| jamielennox | including auth_token which would otherwise be the one to show | 10:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 10:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 10:13 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 10:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 10:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 10:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 10:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 10:14 |
| jamielennox | dims: i would have to look and find something, in general we don't want services doing there own auth so there isn't that much | 10:14 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 10:14 |
| dims | jamielennox: ack. fwiw, i am trying to find gaps where v2 is currently used and should be switched to v3 | 10:15 |
| jamielennox | dims: that's awesome - i've been doing the same thing | 10:16 |
| jamielennox | i'm currently trying to get glance_store passing so that we can have a real gate job for it | 10:16 |
| dims | got a bug jamielennox? so i can subscribe | 10:17 |
| *** btully has joined #openstack-keystone | 10:18 | |
| *** spandhe has quit IRC | 10:19 | |
| breton | dims: I've found this: https://review.openstack.org/#/c/113735/2 | 10:19 |
| breton | dims: it seems to be doint the same thing you are tryin to do | 10:19 |
| jamielennox | dims: not a global bug, i've been pushing it via gate jobs | 10:22 |
| jamielennox | so we have | 10:22 |
| dims | @breton - good find! | 10:22 |
| dims | jamielennox: ack | 10:22 |
| *** btully has quit IRC | 10:22 | |
| jamielennox | i haven't looked at this part for ages | 10:23 |
| jamielennox | dims: so if you look at https://review.openstack.org/#/c/209351/ there is a gate job called gate-tempest-dsvm-neutron-identity-v3-only-full in check-experimental | 10:23 |
| jamielennox | dims: that actually turns off v2 authentication, but currently devstack doesn't complete | 10:24 |
| jamielennox | dims: that patch i *think* is the last one that is required | 10:24 |
| dims | jamielennox: ack looking | 10:24 |
| jamielennox | once we can get tempest running we should get a good idea of everything that is failing from v2 | 10:24 |
| *** yottatsa has joined #openstack-keystone | 10:25 | |
| *** eandersson has joined #openstack-keystone | 10:26 | |
| dims | jamielennox: gotcha | 10:26 |
| jamielennox | dims: that patch is what i'm playing with right now, just trying to find out what's failing in swiftclient because it works in my devstack | 10:27 |
| dims | ha! cool | 10:27 |
| *** lhcheng has joined #openstack-keystone | 10:27 | |
| *** ChanServ sets mode: +v lhcheng | 10:27 | |
| *** fhubik is now known as fhubik_brb | 10:30 | |
| *** lhcheng has quit IRC | 10:32 | |
| sileht | jamielennox, hi, what do you think of https://review.openstack.org/#/c/208965/ , aodh and gnocchi doesn't use oslo.config global object and relies on terrible hack to make keystonemiddleware working, I try to find a clean solution to fix the issue | 10:35 |
| *** josecastroleon has quit IRC | 10:36 | |
| jamielennox | sileht: hmm, i had a long way around to getting to that point | 10:37 |
| jamielennox | but it was a really long way | 10:37 |
| jamielennox | sileht: how would i use this, it doesn't seem obvious | 10:37 |
| openstackgerrit | David Charles Kennedy proposed openstack/keystone: Omit services with no endpoint from token response https://review.openstack.org/176383 | 10:38 |
| sileht | jamielennox, for example I don't want to merge this: https://review.openstack.org/#/c/208632/ | 10:42 |
| sileht | jamielennox, instead I would like to do https://review.openstack.org/#/c/208989/ with this keystonemiddleware change: https://review.openstack.org/#/c/208965/ | 10:42 |
| jamielennox | sileht: so i don't want to merge that either | 10:43 |
| dims | jamielennox: breton: i added info what we talked about https://etherpad.openstack.org/p/keystone-v3-adoption-barriers in case it helps track things | 10:44 |
| sileht | jamielennox, you means the ugly hack ? | 10:44 |
| jamielennox | let me look quickly what aodh is, and why it's different to every other service | 10:44 |
| jamielennox | sileht: no, the aodh thing, i can see no reason why it has to do it's own variable registration | 10:44 |
| sileht | jamielennox, because it doesn't setup/use cfg.CONF | 10:44 |
| jamielennox | at al? | 10:45 |
| jamielennox | at all? | 10:45 |
| sileht | at all | 10:45 |
| sileht | jamielennox, keystonemiddleware just don't work wihtout cfg.CONF | 10:45 |
| jamielennox | right - it's not really designed to | 10:45 |
| jamielennox | so swift is the only other project i've heard of that doesn't use oslo.config | 10:45 |
| jamielennox | and i argue that it just should, but whatever | 10:45 |
| sileht | jamielennox, aodh use oslo.config but not cfg.CONF, it creates its own cfg.ConfigOpts() object | 10:46 |
| jamielennox | umm, | 10:47 |
| jamielennox | does it work to do AuthProtocol(app, dict(cfg['keystone_authtoken'])) | 10:47 |
| jamielennox | i think zaqar does something like that | 10:47 |
| sileht | jamielennox, yes but you can't do than if you use pastedeploy | 10:47 |
| jamielennox | ... | 10:48 |
| jamielennox | umm, so if you configure authtoken in the paste config in the authtoken section that will work | 10:49 |
| jamielennox | though we do consider that old behavoiur | 10:49 |
| sileht | yes, sure, but that deprecated so | 10:49 |
| jamielennox | sileht: so i don't disagree with wanting to pass a config object if you are creating the AuthProtocol object directly | 10:50 |
| jamielennox | i'm not sure i want to have an override section from config | 10:50 |
| jamielennox | because you are still reading your options from config | 10:50 |
| *** dims_ has joined #openstack-keystone | 10:51 | |
| breton | I thought there is already a patch that removes requirement to use CONF | 10:51 |
| sileht | I don't want to create the AuthProtocol object manually, we use paste-deploy to allows people to remove it | 10:51 |
| *** lhcheng has joined #openstack-keystone | 10:51 | |
| *** ChanServ sets mode: +v lhcheng | 10:51 | |
| *** e0ne has quit IRC | 10:52 | |
| jamielennox | breton: flavio had one wa while ago | 10:52 |
| jamielennox | sileht: right | 10:52 |
| jamielennox | umm, how do you construct the cfg.Conf object that isn't global from paste? | 10:52 |
| sileht | the flavio one doesn't fix the same issue | 10:52 |
| breton | https://review.openstack.org/#/c/143063/ | 10:52 |
| jamielennox | yea | 10:52 |
| breton | oh, ok | 10:53 |
| sileht | jamielennox, that was https://review.openstack.org/#/c/208965/ do | 10:53 |
| *** dims has quit IRC | 10:53 | |
| *** markvoelker has joined #openstack-keystone | 10:54 | |
| jamielennox | sileht: so i think it's something we should allow to pass your own oslo.config object, i don't want to support changing the keystone_authtoken section name | 10:54 |
| sileht | jamielennox, if pass the 'oslo_config_project' to a cfg.ConfigOpts() object that find and load the application configuration file magically | 10:54 |
| jamielennox | i think | 10:54 |
| *** e0ne has joined #openstack-keystone | 10:54 | |
| jamielennox | i don't see why we'd support changing that unless you want to run multiple auth_token middleware's in the same process - which i don't htink makes sense | 10:55 |
| sileht | jamielennox, we don't change the keystone_authtoken, we just want the middleware read the configuration itself | 10:55 |
| *** lhcheng has quit IRC | 10:56 | |
| sileht | jamielennox, fyi not just keystonemiddleware have this issue, but also many oslo.middleware middlewares | 10:56 |
| jamielennox | sileht: right - for better or worse we generally assume that oslo.config is global | 10:57 |
| sileht | global are just worse | 10:57 |
| jamielennox | i had this argument, maybe 18 months ago, gave up on that | 10:58 |
| *** markvoelker has quit IRC | 10:58 | |
| jamielennox | sileht: so is there a reaon you have to specify another whole file just to avoid the global issue? | 10:59 |
| jamielennox | is there a reason why you would want to have multiple values for this | 10:59 |
| sileht | jamielennox, the file path is optional, it's just in case deployer doesn't use one of the discoverable location that oslo.config look for | 11:01 |
| sileht | jamielennox, at this end, the application and the middleware will read the same file with my change | 11:01 |
| jamielennox | sileht: so if we could figure out some way of letting you manage the Config objects and have it passed in that would be acceptable | 11:02 |
| jamielennox | i would prefer to decrease our reliance on oslo.config rather than increase it | 11:02 |
| sileht | jamielennox, with paste-deploy 'passed in' a python object is just not possible | 11:02 |
| sileht | that why the middleware have to create it | 11:03 |
| jamielennox | sileht: i'll have to think about it but i'm not a fan | 11:04 |
| *** fhubik_brb is now known as fhubik | 11:04 | |
| jamielennox | the advantage of oslo.config being global is that we can rely on it and don't have to worry about configuring things via paste options | 11:05 |
| jamielennox | if we don't have global config then we don't have config at paste time and you have to supply options via paste | 11:05 |
| jamielennox | this is some weird hybrid where we would construct the conf, and the reconstruct it later | 11:06 |
| sileht | jamielennox, I really don't to see aodh the only application that doesn't use paste for config option | 11:06 |
| sileht | don't/don't want | 11:06 |
| sileht | rephrase, I really don't want to see aodh the only application that use paste for config option | 11:07 |
| jamielennox | many things don't use conf, aodh is the first thing i've seen that wants to use paste - but not want to use paste for config | 11:07 |
| jamielennox | it kind of defeats the purpose of middleware that is independant of the app | 11:07 |
| openstackgerrit | Vivek Dhayaal proposed openstack/keystone: Stable Keystone Driver Interfaces https://review.openstack.org/209524 | 11:07 |
| *** josecastroleon has joined #openstack-keystone | 11:09 | |
| sileht | jamielennox, your are currently strongly dependent of the setup BY the application of the global cfg.CONF | 11:09 |
| sileht | jamielennox, my change removes this deps by making keystone middleware reading its config from an olso.config object (global or not) by its own | 11:10 |
| sileht | keystonemiddleware config via paste config is the past, using the global cfg.CONF is the past too | 11:11 |
| jamielennox | i'm inclined to think you should use paste's inbuilt config, or handle constructing the middleware yourself | 11:13 |
| sileht | I don't this deployer will like that ... | 11:14 |
| sileht | anyways, jamielennox thx for your times, I will try to write something on the ML about this, because many other middlewares have this issue | 11:15 |
| jamielennox | sileht: yea, do the ML, and bring it up at the keystone meeting as well if you don't find enough info | 11:16 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin for hierarchical models https://review.openstack.org/198418 | 11:25 |
| *** gordc has joined #openstack-keystone | 11:28 | |
| *** eandersson has quit IRC | 11:35 | |
| *** eandersson has joined #openstack-keystone | 11:36 | |
| *** fhubik is now known as fhubik_brb | 11:38 | |
| *** e0ne has quit IRC | 11:41 | |
| *** fhubik_brb is now known as fhubik | 11:42 | |
| samueldmq | dstanek: hi, just saw your message from yesterday | 11:42 |
| samueldmq | btw, morning :) | 11:42 |
| samueldmq | dstanek: so we control the cache on both sides, server defines the freshness, and middleware properly honor the cache values | 11:42 |
| samueldmq | dstanek: instead of implementing the cache control client side in ksmiddleware, we then decided to add such support with ksclient | 11:44 |
| *** e0ne has joined #openstack-keystone | 11:44 | |
| samueldmq | dstanek: your message was : "why do you need to do client side freshness at all?" | 11:44 |
| *** vivekd has quit IRC | 12:08 | |
| *** henrynash has quit IRC | 12:12 | |
| *** henrynash has joined #openstack-keystone | 12:14 | |
| *** ChanServ sets mode: +v henrynash | 12:14 | |
| *** henrynash has quit IRC | 12:15 | |
| *** markvoelker has joined #openstack-keystone | 12:16 | |
| *** dims has joined #openstack-keystone | 12:24 | |
| *** dims_ has quit IRC | 12:27 | |
| *** jdandrea has joined #openstack-keystone | 12:30 | |
| *** jungler has quit IRC | 12:31 | |
| *** edmondsw has joined #openstack-keystone | 12:36 | |
| *** raildo has joined #openstack-keystone | 12:39 | |
| *** bapalm has joined #openstack-keystone | 12:44 | |
| *** afazekas_ has quit IRC | 12:50 | |
| *** marzif__ has quit IRC | 12:53 | |
| *** marzif__ has joined #openstack-keystone | 12:54 | |
| *** diazjf has joined #openstack-keystone | 12:56 | |
| *** Nirupama has quit IRC | 12:57 | |
| *** diazjf1 has joined #openstack-keystone | 13:03 | |
| *** diazjf has quit IRC | 13:05 | |
| *** kiran-r has quit IRC | 13:11 | |
| *** browne has joined #openstack-keystone | 13:15 | |
| *** yottatsa has quit IRC | 13:19 | |
| *** hrou has joined #openstack-keystone | 13:21 | |
| *** yottatsa has joined #openstack-keystone | 13:26 | |
| *** TheIntern has joined #openstack-keystone | 13:29 | |
| *** btully has joined #openstack-keystone | 13:29 | |
| *** vinsh has quit IRC | 13:29 | |
| *** petertr7_away is now known as petertr7 | 13:31 | |
| *** mestery has quit IRC | 13:32 | |
| *** davidckennedy has joined #openstack-keystone | 13:33 | |
| *** davidckennedy has quit IRC | 13:36 | |
| *** mestery has joined #openstack-keystone | 13:38 | |
| *** ayoung has joined #openstack-keystone | 13:39 | |
| *** ChanServ sets mode: +v ayoung | 13:40 | |
| *** davidckennedy has joined #openstack-keystone | 13:40 | |
| *** zzzeek has joined #openstack-keystone | 13:40 | |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/208726 | 13:44 |
| *** bknudson has joined #openstack-keystone | 13:44 | |
| *** ChanServ sets mode: +v bknudson | 13:44 | |
| davidckennedy | Hello there, looking for reviews on bug fix reviews for #1410543 and the follow up #1436704 That's moving endpoint filtering to default driver and omitting services with no endpoints from the token response https://review.openstack.org/#/c/167675/25 and https://review.openstack.org/#/c/176383/ be nice to get them merged :) | 13:45 |
| *** diazjf has joined #openstack-keystone | 13:45 | |
| *** edmondsw has quit IRC | 13:46 | |
| *** diazjf1 has quit IRC | 13:47 | |
| *** yottatsa has quit IRC | 13:49 | |
| *** vincep has quit IRC | 13:50 | |
| lbragstad | morganfainberg: around? | 13:52 |
| lbragstad | https://github.com/openstack/keystone/blob/4a5a12c19f9be7e09f544d7264d496268ca0a851/keystone/token/provider.py#L370-L377 I have a question on that stuff | 13:53 |
| lbragstad | where do the 'invalidate' parts get implemented? | 13:53 |
| *** jecarey has joined #openstack-keystone | 13:54 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:55 | |
| lbragstad | morganfainberg: because with https://review.openstack.org/#/c/196877/16 I'm not sure we really need to have https://github.com/openstack/keystone/blob/4a5a12c19f9be7e09f544d7264d496268ca0a851/keystone/token/provider.py#L264-L266 anymore? | 13:55 |
| marekd | lbragstad: i think he's on a plane now | 13:55 |
| lbragstad | ^ or anyone who has input on the token provider stuff, | 13:55 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Whitelist IdPs https://review.openstack.org/209941 | 13:55 |
| lbragstad | marekd: yeah, I figured he might be out (he was in AUS?) | 13:55 |
| marekd | yes | 13:56 |
| *** diazjf1 has joined #openstack-keystone | 13:56 | |
| lbragstad | that would be a fun trip | 13:56 |
| marekd | in business class - maybe | 13:56 |
| lbragstad | marekd: that's how morganfainberg rolls | 13:56 |
| marekd | lbragstad: really? | 13:56 |
| *** diazjf has quit IRC | 13:56 | |
| marekd | so now i am officially jealous | 13:56 |
| * lbragstad has no idea | 13:56 | |
| lbragstad | but props to morganfainberg if he is in business class | 13:57 |
| marekd | props to HP :P | 13:57 |
| lbragstad | lol, good point | 13:57 |
| *** vincep has joined #openstack-keystone | 13:57 | |
| *** yottatsa has joined #openstack-keystone | 13:59 | |
| *** diazjf has joined #openstack-keystone | 13:59 | |
| *** TheIntern is now known as TheIntern_awa | 14:00 | |
| *** diazjf1 has quit IRC | 14:00 | |
| *** r-daneel has joined #openstack-keystone | 14:01 | |
| ayoung | lbragstad, let me look, I should be more up on that than I am.... | 14:01 |
| lbragstad | ayoung: thanks! | 14:01 |
| ayoung | lbragstad, so, one hack you could do is run the coverage tests and see if anything calls that function.... | 14:02 |
| lbragstad | ayoung: I'm just trying to piece together this code path consolidation thing, and it seems like have have a bunch of validate_token(), validate_v3_token(), _validate_token(), etc... | 14:02 |
| *** ParsectiX has quit IRC | 14:02 | |
| lbragstad | ayoung: running it now | 14:03 |
| ayoung | lbragstad, yeah. The issue is that we were, at some point, using the body of the PKI tokens to validate them | 14:03 |
| ayoung | and UUID token stored the whole body in the DB | 14:03 |
| lbragstad | ah, right | 14:03 |
| *** fhubik has quit IRC | 14:03 | |
| *** diazjf1 has joined #openstack-keystone | 14:03 | |
| ayoung | lbragstad, actually, a pretty good hack would be to change the UUID token to store the body of what you get from a Fernet token | 14:03 |
| ayoung | then treat everything else the same | 14:04 |
| marekd | ayoung: what would be win for fernet? | 14:04 |
| ayoung | marekd, none | 14:04 |
| ayoung | marekd, the win would be for UUID | 14:04 |
| lbragstad | ayoung: so then we only pass the id or the token around, versus the entire "token_ref" | 14:04 |
| ayoung | and getting rid of multiple code paths | 14:04 |
| marekd | ayoung: thought you don't care about uuid | 14:04 |
| *** diazjf has quit IRC | 14:05 | |
| ayoung | marekd, I don't care about anything | 14:05 |
| *** TheIntern_awa has quit IRC | 14:05 | |
| marekd | ayoung: wise | 14:05 |
| ayoung | marekd, nah, I was meaning that we could get rid of the duplicate paths. UUID, Fernet, and PKI should all have the same core. | 14:05 |
| lbragstad | ++ | 14:06 |
| ayoung | PKI can't, obviously, today, but we could, in the future, replace the Sym crypto with asym. | 14:06 |
| marekd | ayoung: preferably alons with refactoring token related code. | 14:06 |
| lbragstad | that would be awesome because then we could start consolidating all the test code, too | 14:06 |
| marekd | it's really a pain to read it. | 14:06 |
| ayoung | alonsy! | 14:06 |
| *** diazjf has joined #openstack-keystone | 14:06 | |
| marekd | along | 14:06 |
| ayoung | alongy! | 14:06 |
| marekd | alongy! | 14:06 |
| dolphm | ayoung, that would be an interesting experiment... but still use UUID strings as the token IDs? | 14:07 |
| lbragstad | ayoung: do you need a coffee? | 14:07 |
| ayoung | dolphm, yeah, still use UUID strings | 14:07 |
| * lbragstad hands ayoung more coffee | 14:07 | |
| ayoung | lbragstad, I've had one cup. Dunkins Donut. Decent coffee, but served in styrofoam. | 14:07 |
| ayoung | Maybe time for a second. | 14:07 |
| *** diazjf1 has quit IRC | 14:08 | |
| lbragstad | ayoung: it doesn't matter what you drink it out of as long as it isn't scotch out of a paper cup (#fail) | 14:08 |
| ayoung | lbragstad, paper is still preferabl to styrofoam to my palate | 14:08 |
| *** diazjf1 has joined #openstack-keystone | 14:09 | |
| ayoung | its not the paper that is the problem, but the wax they put on it. | 14:09 |
| ayoung | I carved a couple wooden cups, which, while nicely accentuate the flavor of scotch, tend to get drieds out and crack from the alcohol. Its sad when i happens: loud pop, followed by a frantically trying to keep from losing the rest of the scotch. | 14:09 |
| *** chris_19 has joined #openstack-keystone | 14:10 | |
| *** diazjf has quit IRC | 14:11 | |
| *** diazjf has joined #openstack-keystone | 14:11 | |
| ayoung | dolphm, in order to do the uuid via fernet bodies, we should probably get tehe externial token format indicator back on the fernet tokens. That got dropeed, I learend at the midcycle, in favor of putting the format inside the signed body. I understand the rationale, but we really should make the format exteranlly readable without decrypting | 14:11 |
| lbragstad | did our coverage recently drop? | 14:12 |
| *** diazjf1 has quit IRC | 14:13 | |
| openstackgerrit | Doug Fish proposed openstack/keystoneauth: Update k2k plugin with related code comments https://review.openstack.org/209671 | 14:13 |
| *** diazjf1 has joined #openstack-keystone | 14:13 | |
| lbragstad | ayoung: dolphm yeah https://github.com/openstack/keystone/blob/4a5a12c19f9be7e09f544d7264d496268ca0a851/keystone/token/provider.py#L264-L266 isn't actually tested | 14:13 |
| ayoung | lbragstad, yank it! | 14:14 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 14:15 |
| *** diazjf has quit IRC | 14:15 | |
| ayoung | marekd, do we have trust tokens still with Fernet? | 14:16 |
| *** diazjf has joined #openstack-keystone | 14:16 | |
| marekd | ayoung: i think so? | 14:16 |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L111 | 14:17 |
| ayoung | marekd, cool. Thanks | 14:17 |
| *** diazjf1 has quit IRC | 14:17 | |
| lbragstad | yeah, i'm going to pull it and run tests... | 14:18 |
| marekd | lbragstad: you have some machines with federation configured somewhere? | 14:18 |
| marekd | mine must boot. | 14:18 |
| marekd | and i destroyed them yesterday | 14:18 |
| lbragstad | marekd: yes sir, I can deploy federation for you *instantly* | 14:18 |
| *** diazjf1 has joined #openstack-keystone | 14:18 | |
| * lbragstad is really proud of that | 14:18 | |
| marekd | lbragstad: wow, must be that famous western technology! :-) | 14:19 |
| lbragstad | marekd: lol | 14:19 |
| *** piyanai has joined #openstack-keystone | 14:19 | |
| *** elmiko has joined #openstack-keystone | 14:20 | |
| elmiko | hey keystoners /me giggles | 14:20 |
| *** diazjf has quit IRC | 14:20 | |
| elmiko | i'm messing with Session based clients, i'm curious what the thoughts are on manually setting user_id and project_id in my client objects | 14:21 |
| *** diazjf has joined #openstack-keystone | 14:21 | |
| elmiko | is this permitted, advisable, verboten, etc? | 14:21 |
| marekd | lbragstad: dolphm my thought experiment exposes some minor problem with fernet and federation token. A mapping rule can spcify a id and the name of the ephemeral user. And this will be reflected in the JSON response of the *unscoped* token, whereas later, when the response of the *scoped* token is built based on fernet payload (where we keep only user_id), it will be basically user_id and old, | 14:21 |
| marekd | custom user_name will not be preserverd. | 14:21 |
| *** topol has joined #openstack-keystone | 14:21 | |
| *** ChanServ sets mode: +v topol | 14:21 | |
| marekd | How about we disable setting custom user names? | 14:21 |
| elmiko | i can see that user_id and project_id will accept changes, tenant_id not so much, are there any plans to make user_id and project_id read-only? | 14:22 |
| *** diazjf2 has joined #openstack-keystone | 14:22 | |
| *** diazjf1 has quit IRC | 14:23 | |
| *** urulama has quit IRC | 14:23 | |
| ayoung | elmiko, make everything read only | 14:23 |
| openstackgerrit | Doug Fish proposed openstack/python-keystoneclient: Add Keystone2Keystone auth plugin for K2K https://review.openstack.org/207585 | 14:23 |
| *** urulama has joined #openstack-keystone | 14:23 | |
| elmiko | ayoung, is that a future plan for Client objects? | 14:23 |
| ayoung | elmiko, do it now | 14:23 |
| ayoung | LDAP is already assumed to be read only | 14:24 |
| petertr7 | Hi! I'm using python-keystone client v2. I was wondering if anyone could help illuminate some issues I've encountered. | 14:24 |
| ayoung | well, I assume it is | 14:24 |
| elmiko | ayoung, no no, i don't want to. i want to set user_id and project_id for Session/Auth based clients since they don't get set | 14:24 |
| elmiko | ayoung, so, i make a client with Client(session=Session, auth=Auth), now user_id isn't set | 14:24 |
| elmiko | ayoung, and apparently i can only determine it with the Auth object | 14:25 |
| *** diazjf has quit IRC | 14:25 | |
| elmiko | ayoung, so, should i be passing Auth objects around instead of Client objects when i need to know a user_id? | 14:25 |
| ayoung | Auth object doesn't refetch token unless it needs to, and sets, internally the Auth context, which includes the user name | 14:25 |
| *** dims has quit IRC | 14:25 | |
| ayoung | elmiko, accodrind to jamielennox you should be. jamielennox is smart. I'd listen to him | 14:26 |
| elmiko | ayoung, ok, so pass Auth plugin objects around, and only get a Client when needed? | 14:26 |
| *** dims has joined #openstack-keystone | 14:26 | |
| *** diazjf has joined #openstack-keystone | 14:26 | |
| elmiko | ayoung, +1 about jamielennox == smart | 14:26 |
| ayoung | elmiko, yep. Even better, passaround sessions | 14:26 |
| *** diazjf2 has quit IRC | 14:26 | |
| elmiko | ayoung, but i want to separate Sessions from Auths | 14:27 |
| ayoung | elmiko, let me restart: if possible, pass around sessions | 14:27 |
| elmiko | ayoung, fair | 14:27 |
| ayoung | elmiko, I'm closer to swarthy, but have not been out in the sun enough the summer to really justify the term | 14:27 |
| *** afazekas_ has joined #openstack-keystone | 14:27 | |
| elmiko | ayoung, arrr ? | 14:28 |
| * elmiko makes pirate face | 14:28 | |
| *** edmondsw has joined #openstack-keystone | 14:28 | |
| ayoung | elmiko, yeah, but I'm from New England. Around here, pirates say aaaaaahhhh. | 14:28 |
| elmiko | ayoung, lol, ahh that poor R | 14:28 |
| elmiko | ayoung, need to go bucaneering to get it back ;) | 14:29 |
| elmiko | ayoung, thanks for the advice | 14:29 |
| *** diazjf1 has joined #openstack-keystone | 14:30 | |
| *** diazjf has quit IRC | 14:31 | |
| samueldmq | are there any integration tests for osclient -> ksclient ? | 14:31 |
| *** stevemar has joined #openstack-keystone | 14:31 | |
| *** ChanServ sets mode: +v stevemar | 14:31 | |
| *** yottatsa has quit IRC | 14:33 | |
| *** diazjf has joined #openstack-keystone | 14:33 | |
| *** diazjf1 has quit IRC | 14:34 | |
| stevemar | dstanek: dolphm morganfainberg lbragstad ayoung marekd: need a non-ibmer on this one: https://review.openstack.org/#/c/168521/ | 14:35 |
| marekd | stevemar: let me check | 14:35 |
| *** yottatsa has joined #openstack-keystone | 14:35 | |
| *** diazjf1 has joined #openstack-keystone | 14:36 | |
| dstanek | stevemar: i love the test there | 14:38 |
| *** diazjf has quit IRC | 14:38 | |
| *** jasondot_ is now known as jasondotstar | 14:38 | |
| stevemar | dstanek: i love it because only bknudson would add a test for docs <3 | 14:39 |
| marekd | stevemar: so why are _grant_resources used the way they are used? :-) | 14:39 |
| *** diazjf has joined #openstack-keystone | 14:40 | |
| breton | https://review.openstack.org/#/c/102958/ -- why was audit middleware merged to stable/juno after release, but to stable/juno branch? Was ksm juno out of sync with other juno components? | 14:40 |
| breton | *was merged after release, but to stable/juno branch? | 14:41 |
| *** diazjf1 has quit IRC | 14:41 | |
| *** phalmos has joined #openstack-keystone | 14:41 | |
| breton | gordc: | 14:41 |
| gordc | breton: i don't get it. your link points to master | 14:43 |
| *** marzif__ has quit IRC | 14:43 | |
| *** diazjf1 has joined #openstack-keystone | 14:43 | |
| *** afazekas_ has quit IRC | 14:43 | |
| breton | it is to master. But audit.py is included in stable/juno. | 14:44 |
| *** marzif__ has joined #openstack-keystone | 14:44 | |
| *** diazjf has quit IRC | 14:44 | |
| breton | by that commit | 14:45 |
| *** kiran-r has joined #openstack-keystone | 14:45 | |
| *** diazjf has joined #openstack-keystone | 14:47 | |
| *** diazjf1 has quit IRC | 14:48 | |
| *** tqtran-afk has joined #openstack-keystone | 14:49 | |
| *** dsirrine has quit IRC | 14:49 | |
| breton | juno was released in october. The merge happened in december to master, however the change is still in stable/juno. How could that happen? | 14:49 |
| bknudson | stevemar: dstanek: you can write a test for anything | 14:50 |
| dstanek | damn... marekd beat me to it :-( | 14:51 |
| breton | you can even write a test for a test. | 14:51 |
| dstanek | breton: i actually just did something like that...actually a test for the test setUp | 14:51 |
| *** diazjf1 has joined #openstack-keystone | 14:52 | |
| gordc | breton: i assume it's because the requirements for juno are capped beyond the keystonemiddleware release which includes audit | 14:52 |
| *** e0ne has quit IRC | 14:52 | |
| *** TheIntern has joined #openstack-keystone | 14:53 | |
| *** diazjf has quit IRC | 14:54 | |
| bknudson | jamielennox: got a minute? https://review.openstack.org/#/c/168546/ for keystoneauth | 14:55 |
| *** diazjf has joined #openstack-keystone | 14:55 | |
| *** diazjf1 has quit IRC | 14:56 | |
| *** e0ne has joined #openstack-keystone | 14:57 | |
| *** r-daneel has quit IRC | 14:58 | |
| *** tqtran-afk is now known as tqtran | 14:59 | |
| *** kiran-r has quit IRC | 14:59 | |
| *** bapalm_ has joined #openstack-keystone | 15:00 | |
| *** narengan has joined #openstack-keystone | 15:00 | |
| *** r-daneel has joined #openstack-keystone | 15:01 | |
| *** bapalm has quit IRC | 15:01 | |
| *** diazjf has quit IRC | 15:01 | |
| *** diazjf has joined #openstack-keystone | 15:01 | |
| *** phalmos has quit IRC | 15:01 | |
| *** mylu has joined #openstack-keystone | 15:04 | |
| *** narengan has quit IRC | 15:07 | |
| *** spandhe has joined #openstack-keystone | 15:07 | |
| *** narengan has joined #openstack-keystone | 15:07 | |
| *** diazjf1 has joined #openstack-keystone | 15:08 | |
| *** diazjf has quit IRC | 15:09 | |
| marekd | dstanek: btw, how are functional tests going? :-) | 15:09 |
| marekd | dstanek: i must confess i haven't worked much recently on that | 15:09 |
| marekd | tomorrow maybe ? | 15:10 |
| *** phalmos has joined #openstack-keystone | 15:10 | |
| *** spandhe_ has joined #openstack-keystone | 15:10 | |
| dstanek | marekd: i only have a tiny bit...been distracted with other things | 15:10 |
| *** narengan has quit IRC | 15:12 | |
| *** spandhe has quit IRC | 15:12 | |
| *** spandhe_ is now known as spandhe | 15:12 | |
| *** diazjf has joined #openstack-keystone | 15:12 | |
| *** diazjf1 has quit IRC | 15:12 | |
| *** narengan has joined #openstack-keystone | 15:13 | |
| *** gyee has joined #openstack-keystone | 15:14 | |
| *** ChanServ sets mode: +v gyee | 15:14 | |
| *** narengan has quit IRC | 15:15 | |
| *** narengan has joined #openstack-keystone | 15:16 | |
| *** narengan_ has joined #openstack-keystone | 15:17 | |
| *** yottatsa has quit IRC | 15:18 | |
| *** diazjf1 has joined #openstack-keystone | 15:19 | |
| *** diazjf has quit IRC | 15:19 | |
| *** narengan has quit IRC | 15:21 | |
| *** diazjf has joined #openstack-keystone | 15:23 | |
| *** diazjf1 has quit IRC | 15:25 | |
| *** chris_19 has left #openstack-keystone | 15:26 | |
| *** diazjf1 has joined #openstack-keystone | 15:29 | |
| *** roxanaghe has joined #openstack-keystone | 15:29 | |
| *** diazjf has quit IRC | 15:29 | |
| *** diazjf has joined #openstack-keystone | 15:31 | |
| *** diazjf1 has quit IRC | 15:33 | |
| *** diazjf1 has joined #openstack-keystone | 15:34 | |
| *** diazjf has quit IRC | 15:35 | |
| stevemar | marekd: dstaneki have also been distracted | 15:40 |
| *** kiran-r has joined #openstack-keystone | 15:40 | |
| stevemar | i'll help tomorrow if were all doing something | 15:40 |
| marekd | stevemar: would be cool | 15:40 |
| *** mylu has quit IRC | 15:42 | |
| *** diazjf has joined #openstack-keystone | 15:42 | |
| *** mylu has joined #openstack-keystone | 15:42 | |
| *** diazjf1 has quit IRC | 15:43 | |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Update .gitignore https://review.openstack.org/209996 | 15:45 |
| stevemar | bknudson: sorry about the twins | 15:46 |
| *** diazjf1 has joined #openstack-keystone | 15:46 | |
| bknudson | stevemar: I don't think it's fair to bring in a bunch of ringers just before the series. | 15:47 |
| stevemar | bknudson: its probably not, but i'm too selfish to care | 15:47 |
| stevemar | we really need them for the yanks on thursday, the series against the twins was to warm them up | 15:48 |
| *** diazjf has quit IRC | 15:48 | |
| *** diazjf has joined #openstack-keystone | 15:49 | |
| *** dguerri` is now known as dguerri | 15:50 | |
| *** btully has quit IRC | 15:50 | |
| openstackgerrit | Edgar Magana proposed openstack/keystone: Replace / by proper syntax that was not in the original fix https://review.openstack.org/209768 | 15:50 |
| *** mylu has quit IRC | 15:51 | |
| *** diazjf1 has quit IRC | 15:51 | |
| *** TheIntern has quit IRC | 15:51 | |
| *** urulama has quit IRC | 15:52 | |
| *** mylu has joined #openstack-keystone | 15:52 | |
| *** petertr7 is now known as petertr7_away | 15:52 | |
| *** urulama has joined #openstack-keystone | 15:52 | |
| *** diazjf1 has joined #openstack-keystone | 15:52 | |
| *** phalmos has quit IRC | 15:53 | |
| *** diazjf has quit IRC | 15:53 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Make application initialization a critical section https://review.openstack.org/210001 | 15:54 |
| *** _cjones_ has joined #openstack-keystone | 15:55 | |
| *** diazjf has joined #openstack-keystone | 15:55 | |
| *** diazjf1 has quit IRC | 15:57 | |
| bknudson | stevemar: looks like there's other changes missing from keystoneauth that were made to keystoneclient fixtures... | 15:58 |
| *** diazjf1 has joined #openstack-keystone | 15:58 | |
| bknudson | stevemar: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/fixture/v3.py#n408 -- that stuff is in keystoneclient but not in keystoneauth | 15:59 |
| bknudson | so when we switch to keystoneauth we're going to lose a bunch of fixes. | 15:59 |
| *** TheIntern has joined #openstack-keystone | 15:59 | |
| *** diazjf has quit IRC | 16:00 | |
| *** diazjf has joined #openstack-keystone | 16:01 | |
| *** rm_work is now known as rm_work|away | 16:02 | |
| *** marzif__ has quit IRC | 16:03 | |
| stevemar | bknudson: i think that was a while ago... | 16:03 |
| *** diazjf1 has quit IRC | 16:03 | |
| *** belmoreira has quit IRC | 16:03 | |
| *** diazjf1 has joined #openstack-keystone | 16:04 | |
| *** phalmos has joined #openstack-keystone | 16:04 | |
| *** ParsectiX has joined #openstack-keystone | 16:05 | |
| *** vincep has quit IRC | 16:05 | |
| *** diazjf has quit IRC | 16:06 | |
| *** hogepodge has quit IRC | 16:06 | |
| *** hogepodge has joined #openstack-keystone | 16:07 | |
| openstackgerrit | Edgar Magana proposed openstack/keystone: Fix explicit line joining with backslash https://review.openstack.org/209768 | 16:09 |
| *** geoffarnold has joined #openstack-keystone | 16:09 | |
| openstackgerrit | Merged openstack/keystone: Document policy target for operation https://review.openstack.org/168521 | 16:11 |
| *** diazjf has joined #openstack-keystone | 16:11 | |
| *** jistr has quit IRC | 16:12 | |
| *** kiran-r has quit IRC | 16:12 | |
| *** ParsectiX has quit IRC | 16:12 | |
| *** diazjf1 has quit IRC | 16:13 | |
| *** TheIntern has quit IRC | 16:15 | |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Add role_ids, role_names to v3 fixture https://review.openstack.org/210010 | 16:16 |
| *** diazjf1 has joined #openstack-keystone | 16:16 | |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Add role_ids, role_names to v3 fixture https://review.openstack.org/210010 | 16:17 |
| *** diazjf has quit IRC | 16:18 | |
| *** diazjf has joined #openstack-keystone | 16:19 | |
| *** spandhe has quit IRC | 16:19 | |
| *** diazjf1 has quit IRC | 16:21 | |
| *** phalmos has quit IRC | 16:27 | |
| *** lhcheng has joined #openstack-keystone | 16:32 | |
| *** ChanServ sets mode: +v lhcheng | 16:32 | |
| *** vivekd has joined #openstack-keystone | 16:33 | |
| *** davidckennedy has quit IRC | 16:37 | |
| *** jdandrea has quit IRC | 16:38 | |
| *** jdandrea has joined #openstack-keystone | 16:39 | |
| *** dguerri is now known as dguerri` | 16:40 | |
| *** bdossant has quit IRC | 16:41 | |
| *** phalmos has joined #openstack-keystone | 16:43 | |
| *** iamjarvo has joined #openstack-keystone | 16:43 | |
| gyee | amakarov, left you some comment on the materialized path patch, see if they make sense | 16:44 |
| *** mylu has quit IRC | 16:44 | |
| *** mylu has joined #openstack-keystone | 16:45 | |
| *** mylu has quit IRC | 16:47 | |
| amakarov | gyee, hi! You've stated the very same concerns I have :) I | 16:47 |
| amakarov | I'll explain now in the comments | 16:47 |
| *** diazjf1 has joined #openstack-keystone | 16:47 | |
| *** diazjf has quit IRC | 16:47 | |
| *** btully has joined #openstack-keystone | 16:48 | |
| *** diazjf1 has left #openstack-keystone | 16:48 | |
| *** ParsectiX has joined #openstack-keystone | 16:48 | |
| gyee | amakarov, and this patch https://review.openstack.org/#/c/210001/1 | 16:49 |
| openstackgerrit | Arun Kant proposed openstack/pycadf: Adding barbican specific base resources. https://review.openstack.org/210023 | 16:49 |
| *** mylu has joined #openstack-keystone | 16:49 | |
| gyee | do you actually use multithreading instead of multiprocess when running in Apache? | 16:50 |
| gyee | I am not sure what benefits we get out of multithreading | 16:50 |
| *** urulama has quit IRC | 16:50 | |
| *** urulama has joined #openstack-keystone | 16:50 | |
| amakarov | gyee, yes, and I don't like it too, but we still use persistent tokens, so we have to use token storage backend | 16:51 |
| openstackgerrit | Arun Kant proposed openstack/pycadf: Adding barbican specific base resources. https://review.openstack.org/210023 | 16:51 |
| amakarov | to reduce failover time memcache pool must be shared | 16:51 |
| *** btully has quit IRC | 16:52 | |
| amakarov | gyee, if we run keystone in several processes, every process keeps it's own information of memcached servers availability | 16:53 |
| openstackgerrit | Vivek Dhayaal proposed openstack/keystone: Stable Keystone Driver Interfaces https://review.openstack.org/209524 | 16:53 |
| *** spandhe has joined #openstack-keystone | 16:54 | |
| gyee | amakarov, memcached is shared right? only in-process cache is not | 16:54 |
| amakarov | gyee, so it's possible that process1 places a token in memcached1 while process2, which is asked to validate that token, looks for it on memcache3 | 16:54 |
| *** ankita_wagh has joined #openstack-keystone | 16:55 | |
| amakarov | gyee, the cache itself - yes | 16:55 |
| amakarov | the information about which memcached servers are down - no | 16:55 |
| amakarov | gyee, HA suffers a lot | 16:56 |
| *** iamjarvo has quit IRC | 16:56 | |
| *** josecastroleon has quit IRC | 16:56 | |
| gyee | amakarov, yeah, we don't use memcached for token persistence, we use mongo | 16:56 |
| *** phalmos has quit IRC | 16:56 | |
| gyee | which replicates | 16:56 |
| gyee | but yeah, I can see how memcache suffers | 16:57 |
| amakarov | gyee, that's risky | 16:57 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Inhrerit roles project calls on keystoneclient v3 https://review.openstack.org/167613 | 16:57 |
| amakarov | gyee, but not riskier than memcache though :) | 16:58 |
| htruta_ | hey lhcheng, looks like we had some rebase problems and the patch could not be merged: https://review.openstack.org/167613 | 16:58 |
| htruta_ | could you workflow it again? | 16:58 |
| lhcheng | htruta_: sure | 16:58 |
| htruta_ | lhcheng: cool. thanks | 16:59 |
| lhcheng | htruta_: np | 16:59 |
| *** htruta has quit IRC | 17:00 | |
| *** htruta_ has quit IRC | 17:00 | |
| *** htruta has joined #openstack-keystone | 17:01 | |
| *** bapalm_ has quit IRC | 17:01 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fernet 'expires' value loses 'ms' after validation https://review.openstack.org/210037 | 17:05 |
| *** gyee has quit IRC | 17:05 | |
| *** piyanai has quit IRC | 17:05 | |
| *** petertr7_away is now known as petertr7 | 17:08 | |
| *** piyanai has joined #openstack-keystone | 17:09 | |
| *** vivekd has quit IRC | 17:10 | |
| *** ParsectiX has quit IRC | 17:10 | |
| *** ParsectiX has joined #openstack-keystone | 17:12 | |
| *** chlong has quit IRC | 17:14 | |
| *** iamjarvo has joined #openstack-keystone | 17:18 | |
| *** yottatsa has joined #openstack-keystone | 17:21 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fernet 'expires' value loses 'ms' after validation https://review.openstack.org/210037 | 17:21 |
| *** ParsectiX has quit IRC | 17:21 | |
| *** piyanai_ has joined #openstack-keystone | 17:25 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test the claimed expires_at & created_at timestamps for Fernet https://review.openstack.org/208021 | 17:27 |
| *** piyanai has quit IRC | 17:28 | |
| *** piyanai_ is now known as piyanai | 17:28 | |
| *** iamjarvo has quit IRC | 17:28 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test the claimed expires_at & created_at timestamps for Fernet https://review.openstack.org/210049 | 17:28 |
| *** samleon has quit IRC | 17:30 | |
| *** samleon has joined #openstack-keystone | 17:31 | |
| breton | samleon: ping | 17:31 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Validate domain ownership for v2 tokens https://review.openstack.org/208069 | 17:32 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Fix the claimed expires_at & created_at timestamps for Fernet https://review.openstack.org/208021 | 17:32 |
| samleon | breton: how's going? | 17:33 |
| breton | samleon: cool! I'm testing the x.509 stuff now and ran into an issue | 17:34 |
| breton | default devstack + x.509 patch | 17:34 |
| breton | http://paste.openstack.org/show/411219/ -- apache config | 17:34 |
| *** petertr7 is now known as petertr7_away | 17:34 | |
| samleon | breton: looking | 17:35 |
| *** petertr7_away is now known as petertr7 | 17:35 | |
| notmyname | may I have some review love on https://review.openstack.org/#/c/179777/. It's affecting some customers and I'd like to see it land soon | 17:35 |
| *** henrynash has joined #openstack-keystone | 17:35 | |
| *** ChanServ sets mode: +v henrynash | 17:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 17:36 |
| breton | when I create an idp I get http://paste.openstack.org/show/411221/ | 17:36 |
| breton | in keystone log there is this: http://paste.openstack.org/show/411222/ | 17:37 |
| samleon | breton: looks like you using v2 api, only v3 supports it | 17:37 |
| breton | samleon: I put OS_IDENTITY_API_VERSION=3 there. And even if I set OS_AUTH_URL to /v3/, it still fails. | 17:38 |
| samleon | is it the sam message? | 17:39 |
| breton | WARNING: keystoneclient.auth.identity.base Failed to contact the endpoint at http://10.0.2.15:35357/v2.0 for discovery. Fallback to using that endpoint as the base url. | 17:40 |
| breton | ERROR: openstack Bad Request (HTTP 400) | 17:40 |
| breton | yes, the same | 17:40 |
| samleon | what request did you make? | 17:40 |
| breton | OS_AUTH_URL=https://localhost:35357/v3/ OS_IDENTITY_API_VERSION=3 openstack --insecure identity provider create --description "IdP for x.509 fixed" --enable ab4908e6bb4950dd99f1d715d1a7bc723e01d138920219e96027c73141f06986 | 17:40 |
| samleon | ok, so you are trying to create a idp | 17:41 |
| breton | yes, and I did "source openrc admin admin" before it. | 17:42 |
| breton | oooh! | 17:43 |
| breton | samleon: I know! | 17:43 |
| *** markvoelker has quit IRC | 17:44 | |
| *** mylu has quit IRC | 17:44 | |
| * lhcheng waiting for the answer :) | 17:44 | |
| samleon | breton, that did not work, you can try just using curl, that's what i use | 17:44 |
| breton | samleon: https://review.openstack.org/#/c/156870/48/keystone/middleware/core.py | 17:44 |
| lhcheng | breton: what's the issue? :) | 17:44 |
| breton | when I try to authenticate with my username/password, I don't have AUTH_TOKEN_HEADER yet | 17:45 |
| *** roxanaghe has quit IRC | 17:46 | |
| lhcheng | breton: not sure if that is related.. | 17:46 |
| lhcheng | breton: did you set your public_endpoint in the keystone.conf to point to https://../v3? | 17:47 |
| *** eandersson has quit IRC | 17:47 | |
| breton | nope, I didn't. I'll do that now... | 17:47 |
| samleon | breton, yeah, that' still not x509 related yet. but you will need to get your token with your username/password before you can validate a subject_auth token | 17:47 |
| lhcheng | I think the issue you hit is something in the internal discovery code of ksc | 17:47 |
| breton | lhcheng: #public_endpoint = <None> | 17:48 |
| breton | should I change it? | 17:48 |
| *** urulama has quit IRC | 17:48 | |
| *** urulama has joined #openstack-keystone | 17:48 | |
| *** TheIntern has joined #openstack-keystone | 17:49 | |
| lhcheng | breton: yeah, see if it helps | 17:49 |
| lhcheng | breton: I've also used straight up curl when I created the IdP | 17:49 |
| breton | lhcheng: how did you auth to create an idp? | 17:49 |
| breton | http://paste.openstack.org/show/411224/ -- this are the headers right before the check | 17:51 |
| breton | *these | 17:51 |
| lhcheng | breton: http://paste.openstack.org/show/411226/ | 17:52 |
| breton | lhcheng: yes. X-Auth-Token:$admin_token. | 17:52 |
| breton | lhcheng: and I try to do it with admin account | 17:52 |
| samleon | breton: i would suggest to just use curl, it will give you better cure if any issues | 17:52 |
| openstackgerrit | henry-nash proposed openstack/keystone: Improve List Role Assignments Filters Performance https://review.openstack.org/137202 | 17:53 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for data-driven backend assignment testing https://review.openstack.org/149178 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for effective & inherited mode in data driven tests https://review.openstack.org/151623 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add support for group membership to data driven assignment tests https://review.openstack.org/151962 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Broaden domain-group testing of list_role_assignments https://review.openstack.org/154302 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Test list_role_assignment in standard inheritance tests https://review.openstack.org/153897 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Support project hierarchies in data driver tests https://review.openstack.org/154485 | 17:54 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove manager-driver assignment metadata construct https://review.openstack.org/148995 | 17:54 |
| breton | folks, it is impossible to get a token by credentials, because AUTH_TOKEN_HEADER is not in the env when user sends his username and password. Look, the token is not headers: http://paste.openstack.org/show/411224/. And there is a check that says "if the token is there, build a context with it. If not, check that x.509 is enabled. If not, tell him to go away" | 17:55 |
| *** mylu has joined #openstack-keystone | 17:56 | |
| *** mylu has quit IRC | 17:57 | |
| samleon | breton: i have some curl commands to create idp, protocol and mapping here, it may help http://paste.openstack.org/show/411227/ | 17:57 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Removed WIP tests for Fernet https://review.openstack.org/210068 | 17:57 |
| breton | samleon: try to authenticate a user by username/password with your patch. | 17:59 |
| lbragstad | dolphm: I can run that ^ locally and get past those two failures | 17:59 |
| lbragstad | looks likethe fernet provider is successfully passing those tests new | 17:59 |
| lbragstad | now* | 17:59 |
| *** narengan_ has quit IRC | 18:00 | |
| samleon | breton: you suppose don't need to user username/password to authenticate with my patch | 18:00 |
| *** narengan has joined #openstack-keystone | 18:00 | |
| samleon | breton: the user case would be: 1. client user uses username/password to authenticate to get a token like the general case | 18:01 |
| henrynash | dstanek: thanks for your comments on https://review.openstack.org/#/c/137202/ , I answered for fixed them…see my note on testing…and whether you are happy with that plan… | 18:02 |
| samleon | breton: 2. you try to verify this token with the provided client certificate | 18:03 |
| *** bapalm has joined #openstack-keystone | 18:04 | |
| samleon | breton: let me send you the curl command i use for token validation | 18:04 |
| *** narengan has quit IRC | 18:05 | |
| *** markvoelker has joined #openstack-keystone | 18:05 | |
| *** phalmos has joined #openstack-keystone | 18:06 | |
| breton | hm. | 18:06 |
| breton | I think you are right. | 18:06 |
| *** mylu has joined #openstack-keystone | 18:06 | |
| breton | sorry about the hassle. | 18:06 |
| henrynash | stevemar, lbragstad: gentle nudge if you have any time to look at: https://review.openstack.org/#/c/137202/ , trying to get this in to unblock other things…. | 18:07 |
| breton | I guess this is indeed something weird with osc discovery. | 18:08 |
| samleon | breton: here are some examples to get the client token, validate the token with a general way and with a x509 way, http://paste.openstack.org/show/411228/ | 18:08 |
| samleon | breton: hope this helps | 18:08 |
| breton | samleon: thank you! | 18:09 |
| samleon | breton: you are welcome! | 18:09 |
| lbragstad | henrynash: sounds good, thanks! | 18:09 |
| samleon | lhcheng: are you still reviewing my patch ;-)? | 18:10 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Materialized path mixin for hierarchical models https://review.openstack.org/198418 | 18:11 |
| lhcheng | samleon: I haven't got the chance to review it again, internal work getting in the way :-) | 18:12 |
| samleon | lhcheng: no problem. appreciate for your time when you have a chance again ;-) | 18:13 |
| lhcheng | samleon: I've looked at the core code seems pretty close, just haven't gone through the tests. | 18:13 |
| samleon | lhcheng: or i will come over to your office to bug you, haha ;-) | 18:13 |
| dstanek | henrynash: cool, looking now | 18:15 |
| lhcheng | samleon: lol | 18:15 |
| henrynash | dstanek: thx | 18:15 |
| *** yottatsa_ has joined #openstack-keystone | 18:16 | |
| *** phalmos has quit IRC | 18:16 | |
| dstanek | henrynash: for that domain_id comment. should be raise an exception saying domain role assignments are now supported? otherwise you'd never know and think the empty list is correct | 18:17 |
| *** phalmos has joined #openstack-keystone | 18:17 | |
| *** yottatsa has quit IRC | 18:19 | |
| henrynash | dstanek: domain assignments are still not support (with the LDAP backend)….and an empty list is what you woudl get today with the filtering in the controller…so we were trying to keep it the same | 18:19 |
| dstanek | henrynash: ah, i see. fair enough | 18:19 |
| *** amakarov is now known as amakarov_away | 18:22 | |
| *** josecastroleon has joined #openstack-keystone | 18:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 18:24 |
| *** narengan has joined #openstack-keystone | 18:24 | |
| *** narengan has quit IRC | 18:24 | |
| *** narengan has joined #openstack-keystone | 18:25 | |
| dstanek | henrynash: there appears to be logic removed from the controller (lots of stuff with OS-INHERIT) - was that not needed anymore | 18:27 |
| henrynash | dstanek: that has all moved to the manager | 18:27 |
| *** tqtran has quit IRC | 18:27 | |
| henrynash | dstanek: the old logic was….get me all the assignmenst in teh system, then post process them to filter what you want | 18:28 |
| henrynash | dstanek: the new logic (in the manager) is: only ask the DB for those assignmnets that could affect the output based on the filters specified…and then exapand any of those | 18:28 |
| *** narengan has quit IRC | 18:29 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Raises exception if domain_id not specified in create call https://review.openstack.org/209848 | 18:30 |
| dstanek | henrynash: i don't see any os-inherit stuff in core at all. | 18:31 |
| henrynash | dstanek: so teh OS-INHERIT extension is about to move to core…but not sure that is your question..doyou mean in the new code you dont see where this is handled? | 18:32 |
| *** ayoung has quit IRC | 18:34 | |
| henrynash | dstanek: in the new patch, the controller still formats the response (for instance putting in links to the OS-INHERIT api), but the manager does the filtering logic | 18:34 |
| dstanek | henrynash: in the old code it's looking for OS-INHERIT:inherited_to in the scope and then expands the project_ids. is that in the new code hidden somewhere? | 18:36 |
| *** btully has joined #openstack-keystone | 18:36 | |
| *** e0ne has quit IRC | 18:37 | |
| *** mtreinish has quit IRC | 18:37 | |
| dolphm | is Roxana Gherle in IRC? | 18:39 |
| henrynash | dstanek: so in terms of the filter specified, we still process that (see line 617 on controller) | 18:39 |
| lbragstad | dolphm: I thought they were in here earlier, but I can't seem to find the nick | 18:39 |
| *** mtreinish has joined #openstack-keystone | 18:39 | |
| *** jasonsb has quit IRC | 18:40 | |
| *** btully has quit IRC | 18:40 | |
| *** gyee has joined #openstack-keystone | 18:40 | |
| *** ChanServ sets mode: +v gyee | 18:40 | |
| *** jasonsb has joined #openstack-keystone | 18:40 | |
| henrynash | dstanek:and the formating part in the old controller code was “sefl generated”…i.e. format_entity irst processed the lsit from the manager, and then expand_indiertect_assignments() used that formatting | 18:43 |
| henrynash | dtsaneK: nipping off line, be back on later | 18:43 |
| dstanek | henrynash: ok, coverage running now | 18:43 |
| henrynash | dstanek: and take a look at all teh data driven test patches that follow to beef up the maanger level testing | 18:44 |
| *** jasonsb has quit IRC | 18:45 | |
| *** iamjarvo has joined #openstack-keystone | 18:46 | |
| *** navid__ has joined #openstack-keystone | 18:47 | |
| dstanek | henrynash: will do | 18:49 |
| *** narengan has joined #openstack-keystone | 18:52 | |
| lbragstad | dolphm: curious what your thoughts are on the last comment I left here. https://review.openstack.org/#/c/210049/ | 18:52 |
| *** josecastroleon has quit IRC | 18:53 | |
| *** phalmos has quit IRC | 18:53 | |
| *** harlowja has quit IRC | 18:56 | |
| *** narengan_ has joined #openstack-keystone | 18:59 | |
| dstanek | lbragstad: s/comment/dissertation/ | 19:00 |
| dolphm | lbragstad, "When we validate, we are using the creation timestamp that is created by cryptography, which might be ever so slightly different." why could it be different? | 19:00 |
| dolphm | lbragstad, the creation timestamp persisted into the token by cryptography should be exactly what we're using everywhere | 19:01 |
| *** narengan has quit IRC | 19:01 | |
| *** phalmos has joined #openstack-keystone | 19:02 | |
| lbragstad | dolphm: cryptography runs https://github.com/pyca/cryptography/blob/master/src/cryptography/fernet.py#L49 at a different time than we do, | 19:03 |
| lbragstad | they also cast it to an integer | 19:03 |
| lbragstad | which is where we lose the microsecond precision | 19:03 |
| lbragstad | we do this: https://github.com/openstack/keystone/blob/74575a66f1113ac0452da9982b345dec18ec0f32/keystone/token/providers/common.py#L415 | 19:03 |
| dolphm | lbragstad, ah, i see what you mean. we should pull that timestamp out and use that | 19:03 |
| dolphm | lbragstad, otherwise, we have a transient error | 19:03 |
| bknudson | good catch, lbragstad! | 19:04 |
| dolphm | lbragstad, I COULD NOT FIND THAT LINE OF CODE the other day UGH. i saw the behavior occurring but could not find it. | 19:04 |
| *** roxanaghe has joined #openstack-keystone | 19:04 | |
| *** iamjarvo has quit IRC | 19:04 | |
| lbragstad | so, I think we have to go with least common denominator; | 19:04 |
| dolphm | lbragstad, that line is an infuriating bug lol | 19:04 |
| lbragstad | dolphm: :) | 19:05 |
| lbragstad | bknudson: thanks! | 19:05 |
| *** narengan_ has quit IRC | 19:05 | |
| lbragstad | so because we rely on validating (and re-inflating) the creation time from the fernet token, we have to be fine with microsecond precision loss | 19:05 |
| *** narengan has joined #openstack-keystone | 19:05 | |
| dolphm | lbragstad, agree, but Roxana made a comment that i want to investigate.. she said that although the fernet creation timestamp is an integer, we're putting a float expiration in the token. so creation must be .00000Z but expiration could be a non-zero microsecond | 19:07 |
| stevemar | lhcheng: osc meeting if you want :) | 19:07 |
| lhcheng | stevemar: thanks for the reminder! | 19:08 |
| lbragstad | dolphm: yeah, for expiration that would work, we could maintain microsecond precision because we have control over it | 19:09 |
| lbragstad | but for issued at, we don't | 19:09 |
| *** piyanai has quit IRC | 19:09 | |
| dolphm | lbragstad, but is that statement true? we store a float in the payload for expiration | 19:09 |
| *** piyanai has joined #openstack-keystone | 19:09 | |
| dolphm | lbragstad, that would explain why her fix works, i believe | 19:10 |
| samueldmq | next-review; echo $? | 19:10 |
| samueldmq | 195 | 19:10 |
| samueldmq | omb | 19:10 |
| samueldmq | omg* | 19:10 |
| dstanek | hmmm... somehow keystone.db is back | 19:11 |
| dstanek | and these ldap tests *always* fail for me! | 19:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes an issue with data ordering in the tests https://review.openstack.org/210086 | 19:12 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds backend check to setup of LDAP tests https://review.openstack.org/210087 | 19:12 |
| openstackgerrit | David Stanek proposed openstack/keystone: Creates a fixture representing as LDAP database https://review.openstack.org/210088 | 19:12 |
| dstanek | forgot to push those up yesterday... | 19:12 |
| *** piyanai has quit IRC | 19:12 | |
| dolphm | samueldmq, :) | 19:13 |
| dolphm | dstanek, really? | 19:13 |
| samueldmq | stevemar, henrynash, lhcheng : I'd appreciate your eyes on 2 osclient patches related to inherited roles (https://review.openstack.org/#/c/209980/ and https://review.openstack.org/#/c/122179/) | 19:13 |
| dstanek | yep | 19:13 |
| * bknudson wonders what else dstanek has hiding in his local repos. | 19:14 | |
| lbragstad | dolphm: after roxana's patch we will store a float in the fernet payload | 19:14 |
| dstanek | dolphm: that data ordering patch shows what i'm experiencing | 19:14 |
| lbragstad | bknudson: you should look at his git stash repo sometime... | 19:14 |
| samueldmq | dolphm: yeah, there's a ton of reviews to be done, I need to dust my reviewer hat and start reviewing again | 19:14 |
| samueldmq | :) | 19:14 |
| *** iamjarvo has joined #openstack-keystone | 19:15 | |
| lbragstad | dolphm: I think one of the issues is that we calculate the issued at time in keystone, but then we rely on fernet for the issued_at time when we validate the token. | 19:15 |
| dstanek | lbragstad: it's not that bad | 19:16 |
| lbragstad | I think it's what causes the inconsistency between microsecond precision when validating a token | 19:17 |
| * lhcheng samueldmq adding to my review list | 19:17 | |
| samueldmq | lhcheng: appreciate, thanks | 19:17 |
| *** ankita_w_ has joined #openstack-keystone | 19:17 | |
| dstanek | lbragstad: i have probably 50 things stashed on this VM, not sure about my other two | 19:17 |
| bknudson | 50 patches and keystone is back to being perfect. | 19:19 |
| dolphm | morganfainberg, i know you're in a crazy timezone, but if you get this... i saw you comment the other day that you wished auth was not tied to the API versioning... i have some questions about that, when you have time. primarily: do you consider token validation to be part of "auth" that you wished was version-less? | 19:19 |
| dolphm | bknudson, link? ;) | 19:19 |
| bknudson | dolphm: they're stashed in dstanek's git repo | 19:19 |
| dolphm | oh dstanek's stuff lol | 19:19 |
| bknudson | maybe you can wring them out of him | 19:19 |
| morganfainberg | Zzz so the way I see it validation would also ask for the form | 19:20 |
| dolphm | samueldmq, how do you find next-review? i actually stopped using it because i find myself more closely focused on a subset of reviews, for better or worse | 19:20 |
| samueldmq | dolphm: on that conversation, I think we can infer the token version based on its format, so we can validate it | 19:20 |
| *** ankita_w_ has quit IRC | 19:20 | |
| dstanek | bknudson: i wish it was only 50 patches away from being perfect | 19:20 |
| *** ankita_wagh has quit IRC | 19:20 | |
| morganfainberg | Eg: I want this token validated as v2 or v3. If not specified whatever the default is | 19:20 |
| *** ankita_wagh has joined #openstack-keystone | 19:20 | |
| morganfainberg | We should never remove a form of auth validation (except v2, cause... $reasons) | 19:21 |
| samueldmq | dolphm: actually, I get to a change and then look at the related in the chain, when a chain is done, next-review again, if that makes sense | 19:21 |
| morganfainberg | dolphm: will be in non crazy timezone in about 19hrs | 19:21 |
| *** piyanai has joined #openstack-keystone | 19:21 | |
| *** mylu has quit IRC | 19:21 | |
| dolphm | samueldmq: so you go up the chain and review from there? | 19:22 |
| samueldmq | dolphm: although if time's short, we can just prioritize ourselves and get the subset of reviews that is more convenient at the time | 19:22 |
| *** jasonsb has joined #openstack-keystone | 19:22 | |
| dolphm | morganfainberg: then if you're busy (or dead tired) now, consider it food for thought later | 19:22 |
| samueldmq | dolphm: yeah, so if next-review supported that would be nice, i.e always start at the beggining of the chain, and next will give the next one in the chain, if not reviewed yet | 19:22 |
| dolphm | samueldmq: do you star reviews that you're interested in? or consider priority | 19:23 |
| *** yottatsa_ has quit IRC | 19:23 | |
| morganfainberg | dolphm: read up in the backscroll. I think I answered your question. But yes validation is part of auth | 19:23 |
| samueldmq | dolphm: no I don't star reviews .. but look to be a good thing | 19:24 |
| *** e0ne has joined #openstack-keystone | 19:24 | |
| * samueldmq is sharing his thoughts, he hasn't been being a great reviewer in the last couple of weeks ... | 19:24 | |
| *** lhcheng is now known as lhcheng_away | 19:24 | |
| *** mylu has joined #openstack-keystone | 19:25 | |
| dolphm | morganfainberg: the major difference between v2 and v3 token validation is whether the token is included in the URL (and thus logged everywhere) or is included as a header, so the calls are inherently different before ever making the request... without versioning, would you just proposing introduce a second parallel API? | 19:26 |
| samueldmq | I wonder if gerrit allowed us to create 'packages' of reviews, i.e we approve the whole chain and they get merged together, maybe that's possible with topic + depends-on | 19:27 |
| samueldmq | so we don't get partial-things being merged | 19:27 |
| morganfainberg | This would all be under the new /auth api (not versioned) | 19:27 |
| samueldmq | I heard horizon was suffering of this the last times ... cc lhcheng_away | 19:27 |
| morganfainberg | Vs /v3/auth or /v2/token/<id> | 19:27 |
| dolphm | morganfainberg: so, introduce a third API to avoid versioning? | 19:27 |
| morganfainberg | since the spec says all auth would be broken out from the crud interfaces, validation is part of that | 19:28 |
| dolphm | morganfainberg: wait, there's a spec written for this? /me goes to gerrit | 19:28 |
| morganfainberg | On the backlog | 19:28 |
| morganfainberg | At specs.openstack.org | 19:29 |
| lbragstad | https://github.com/openstack/keystone-specs/blob/master/specs/backlog/decouple-auth-from-api-version.rst | 19:29 |
| lbragstad | dolphm: ^ | 19:29 |
| morganfainberg | http://specs.openstack.org/openstack/keystone-specs/specs/backlog/decouple-auth-from-api-version.html | 19:29 |
| lbragstad | morganfainberg: so, token validation would included an attribute in the post body that would specify what version the token is? | 19:35 |
| lbragstad | so if I have a v2.0 token, I have to tell keystone to validate it as a v2.0 token? | 19:35 |
| dolphm | i... don't see any benefit here. i'm also not sure how seriously to take the spec when the second sentence has a glaring mistake, and then follows by asserting that the newly introduced API is versioned in a unique manner and thus doubles the existing API complexity, in addition to adding an unversioned "default" response, making everything a surprise to the client. | 19:37 |
| *** boris-42 has joined #openstack-keystone | 19:39 | |
| *** fifieldt_ has joined #openstack-keystone | 19:39 | |
| lbragstad | dolphm: " This means that we use /v3/auth and /v2.0/tokens as the respective locations for authentication." ? | 19:39 |
| lbragstad | that's true isn't it? | 19:40 |
| *** narengan has quit IRC | 19:40 | |
| dolphm | /v3/auth isn't a resource | 19:40 |
| *** narengan has joined #openstack-keystone | 19:40 | |
| lbragstad | oh, v3/tokens | 19:40 |
| dolphm | or if it is, it's not documented in the API spec | 19:40 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/auth/routers.py#L25 | 19:41 |
| dolphm | right, /v3/auth/tokens is the API I assume it's intending to compare against /v2.0/tokens | 19:42 |
| morganfainberg | In all honesty i wrote the spec expecting more commentary before it was approved | 19:42 |
| *** fifieldt has quit IRC | 19:42 | |
| lbragstad | i have a feeling a whole lotta "filgtm" went on there | 19:43 |
| dolphm | there's not a proposed API doc impact anyway, so there's not much to comment on | 19:43 |
| morganfainberg | The api doc was explicitly left off with a note since I did not want to lock in. This is a backlog spec | 19:43 |
| morganfainberg | Meaning, it needs to be fleshed out before work is done | 19:44 |
| openstackgerrit | Edgar Magana proposed openstack/keystone: Fix explicit line joining with backslash https://review.openstack.org/209768 | 19:44 |
| lbragstad | dolphm: are you thinking we should amend the spec and implement it? | 19:44 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Stop using .keys() on dicts where not needed https://review.openstack.org/194894 | 19:44 |
| *** iamjarvo has quit IRC | 19:44 | |
| morganfainberg | It is strictly an idea that can be picked up | 19:44 |
| dstanek | i gave that a +2 because in concept we need to something and it seemed reasonable enough to backlog | 19:44 |
| morganfainberg | But it isn't "final". It is a concept only | 19:44 |
| morganfainberg | As are all backlog specs | 19:44 |
| dstanek | the bar to backlog is much lower than if it was proposed against a release | 19:45 |
| lbragstad | dstanek: ++ | 19:45 |
| dolphm | morganfainberg: so what's the difference between backlog/ and WIP? | 19:45 |
| morganfainberg | Backlog isn't in gerrit waiting for someone to approve. It is somethig the core team likes the idea of | 19:45 |
| morganfainberg | So a contributor knows it is worth time spending on. | 19:45 |
| morganfainberg | It still needs work usually, but it is not going to end (in most cases) with "that's not even worth talking about" | 19:46 |
| morganfainberg | Then again, I greatly dislike the whole spec process in OpenStack at this point personally and would kill it in keystone for everything tracked in bugs if we had a single extra "approved" status in LP | 19:47 |
| dstanek | if we were doing kanban putting something in backlog is like putting a card on the wall - a wip is like asking if it's good enough to get on the wall | 19:47 |
| morganfainberg | dstanek: ++ | 19:47 |
| dolphm | morganfainberg: how did storyboard die? | 19:47 |
| morganfainberg | No contributors among other things | 19:48 |
| morganfainberg | But the simple lack of people working on it mostly did it in. | 19:48 |
| dolphm | morganfainberg: well that's a simple enough problem | 19:49 |
| *** ayoung has joined #openstack-keystone | 19:49 | |
| *** ChanServ sets mode: +v ayoung | 19:49 | |
| dolphm | morganfainberg: what were the other things, if you're aware of them? | 19:49 |
| morganfainberg | I know there were other things. But that is the one I heard the most about | 19:50 |
| morganfainberg | It was 2-3 people from | 19:50 |
| morganfainberg | Hp working on it. Then 1 person. Then none | 19:50 |
| *** topol has quit IRC | 19:50 | |
| *** ankita_wagh has quit IRC | 19:51 | |
| morganfainberg | The other bit is there are a lot of bug trackers out there. | 19:51 |
| morganfainberg | Why reinvent the wheel | 19:51 |
| dolphm | because we're dependent on a broken, dieing, unsupported bug tracker today | 19:52 |
| *** urulama has quit IRC | 19:52 | |
| morganfainberg | So pick one that is supported. Implement it | 19:53 |
| *** urulama has joined #openstack-keystone | 19:53 | |
| morganfainberg | Vs try to build one from scratch | 19:53 |
| morganfainberg | I wasn't saying we should stick with LP. | 19:53 |
| dolphm | i think we did option 1 and there were no alternatives | 19:53 |
| morganfainberg | There were no "perfect" alternatives | 19:53 |
| dolphm | nothing integrates the way we want it to or has the feature set we need | 19:54 |
| morganfainberg | They (infra/tc) I think are reevaluating now | 19:54 |
| morganfainberg | The problem with volunteer work is things like storyboard sometimes don't get the volunteers | 19:54 |
| dstanek | is there a lost of integrations that are needed? maybe hacking on something like roundup is good enough | 19:54 |
| morganfainberg | And open source is volunteer work | 19:54 |
| morganfainberg | Even if OpenStack is not normal open source | 19:55 |
| dolphm | dstanek: what's roundup? | 19:55 |
| morganfainberg | dstanek: I think that is the kind of idea | 19:55 |
| morganfainberg | dolphm: a weed killer by Monsanto? | 19:55 |
| morganfainberg | :P | 19:56 |
| dolphm | http://roundup.sourceforge.net/ | 19:56 |
| morganfainberg | dstanek: I don't know where the evaluation is at now. But iirc something like that is being looked at last I heard. | 19:57 |
| dstanek | roundup is what Python uses - http://bugs.python.org/ | 19:57 |
| *** ankita_wagh has joined #openstack-keystone | 19:58 | |
| *** TheIntern has quit IRC | 20:00 | |
| bknudson | I've heard talk of phabricator | 20:00 |
| dolphm | dstanek: ah, i hate that UI ;) | 20:05 |
| dolphm | dstanek: definitely UI-by-programmer | 20:06 |
| dstanek | yeah, but that's easier to fix than writing a bug tracker | 20:06 |
| bknudson | http://phabricator.org/ | 20:07 |
| dolphm | is the bug tracking portion of github open source? | 20:08 |
| dolphm | considering that's the only bug tracker i've ever seen where people are obsessively passionate about it, i'd start there | 20:08 |
| *** _hrou_ has joined #openstack-keystone | 20:09 | |
| rodrigods | bknudson, gstreamer is migrating to phabricator | 20:09 |
| dstanek | i doubt it - that's a part of their enterprise offereing; gitlab is opensource | 20:09 |
| bknudson | gitlab has issue tracking | 20:10 |
| * lbragstad just deployed a gitlab server | 20:10 | |
| *** daemontool_ has joined #openstack-keystone | 20:10 | |
| bknudson | lbragstad: why didn't you use phabricator? | 20:11 |
| *** raildo has quit IRC | 20:11 | |
| *** raildo has joined #openstack-keystone | 20:11 | |
| lbragstad | bknudson: I didn't know about it | 20:11 |
| *** hrou has quit IRC | 20:12 | |
| *** marzif has quit IRC | 20:12 | |
| *** piyanai has quit IRC | 20:13 | |
| *** spandhe has quit IRC | 20:14 | |
| *** mylu has quit IRC | 20:15 | |
| *** iamjarvo has joined #openstack-keystone | 20:16 | |
| lbragstad | dolphm: any idea what you want to do about the versionless auth spec? | 20:16 |
| lbragstad | dolphm: or were you thinking about using that as a way to fix some of the fernet/token bugs in general? | 20:17 |
| *** marzif has joined #openstack-keystone | 20:17 | |
| *** mylu has joined #openstack-keystone | 20:23 | |
| *** dguerri` is now known as dguerri | 20:23 | |
| *** dims_ has joined #openstack-keystone | 20:23 | |
| *** dims_ has quit IRC | 20:24 | |
| *** btully has joined #openstack-keystone | 20:24 | |
| *** e0ne has quit IRC | 20:24 | |
| *** dims_ has joined #openstack-keystone | 20:25 | |
| *** dims has quit IRC | 20:26 | |
| *** piyanai has joined #openstack-keystone | 20:26 | |
| *** mylu has quit IRC | 20:27 | |
| dolphm | lbragstad: wasn't looking at it as a solution, but was hoping to solve a related problem soon | 20:28 |
| *** maanak has joined #openstack-keystone | 20:28 | |
| *** btully has quit IRC | 20:28 | |
| *** rm_work|away is now known as rm_work | 20:28 | |
| dolphm | roxanaghe: o/ | 20:30 |
| dolphm | roxanaghe: just replied to you on LP https://bugs.launchpad.net/keystone/+bug/1459790/comments/13 | 20:31 |
| openstack | Launchpad bug 1459790 in Keystone "With fernet tokens, validate token loses the ms on 'expires' value " [Low,In progress] - Assigned to Dolph Mathews (dolph) | 20:31 |
| *** maanak has quit IRC | 20:32 | |
| *** piyanai has quit IRC | 20:32 | |
| roxanaghe | dolphm, hi, thanks :) I am investigating the failures now | 20:33 |
| dolphm | roxanaghe: lbragstad replied in your review as well | 20:33 |
| roxanaghe | can I just remove the @wip directives for the Fernet tests in my patch? | 20:33 |
| *** jecarey has quit IRC | 20:34 | |
| dolphm | roxanaghe: on the tests that are overridden by the child class? | 20:34 |
| roxanaghe | @dolphm, yes, I saw that - I think we have another problem with issued_at microseconds | 20:34 |
| dolphm | roxanaghe: you can just delete them, actually. they're only overridden to be marked as WIP | 20:34 |
| roxanaghe | dolphm, yes | 20:34 |
| roxanaghe | oh I see, so they will be ran with the Fernet setup as well if we remove them. got it | 20:35 |
| dolphm | roxanaghe: the only gotcha is that you might need to include my change from L265, which looks like a bad test to me https://review.openstack.org/#/c/210049/1/keystone/tests/unit/test_v3_auth.py,unified | 20:35 |
| dolphm | roxanaghe: correct | 20:35 |
| *** maanakgupta has joined #openstack-keystone | 20:36 | |
| roxanaghe | @dolphm, right let me try including that | 20:37 |
| *** maanakgupta has quit IRC | 20:38 | |
| lbragstad | roxanaghe: I'm working on a patch now that might help you with a couple of the failing assertions | 20:42 |
| *** piyanai has joined #openstack-keystone | 20:43 | |
| *** mylu has joined #openstack-keystone | 20:44 | |
| *** atiwari has joined #openstack-keystone | 20:46 | |
| *** narengan has quit IRC | 20:47 | |
| dolphm | lbragstad: the last patch you uploaded didn't pass py27 ;) | 20:47 |
| *** narengan has joined #openstack-keystone | 20:48 | |
| dolphm | lbragstad: be thorough before you upload new patchsets for other authors! | 20:48 |
| *** bapalm has quit IRC | 20:50 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use token creation ts from Fernet https://review.openstack.org/210068 | 20:50 |
| *** spandhe has joined #openstack-keystone | 20:50 | |
| roxanaghe | lbragstad: so if you put Depends-On tag it runs the tests on top of my patch? | 20:50 |
| *** dguerri is now known as dguerri` | 20:51 | |
| *** narengan has quit IRC | 20:52 | |
| lbragstad | roxanaghe: I'm not exactly sure how the depends-on tag works, but if I propose a patch set that is dependent on your, the tests will run with your changes as well as mine. | 20:52 |
| roxanaghe | lbragstad: uh, cool | 20:53 |
| dolphm | roxanaghe: Depends-On is primarily design to test patches together *across projects* | 20:55 |
| dolphm | roxanaghe: so a change to a client could Depend-On a corresponding new API patch in the service | 20:56 |
| dolphm | lbragstad: roxanaghe: within a single project, you only need to rebase one patch onto another | 20:56 |
| dolphm | (to have the second tested with the first) | 20:57 |
| *** raildo has quit IRC | 20:57 | |
| roxanaghe | dolphm, understood, thanks | 20:59 |
| *** generic has joined #openstack-keystone | 21:00 | |
| *** generic is now known as opiotte | 21:00 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use token creation ts from Fernet https://review.openstack.org/210068 | 21:01 |
| *** ankita_w_ has joined #openstack-keystone | 21:01 | |
| opiotte | question about Federation | 21:01 |
| lbragstad | dolphm: that failed on the issued_at assertion, which should be fixed in the latest patch that I just pushed, I can run all the test_v3_auth.py and fernet unit tests locally without them failing | 21:01 |
| opiotte | i'm trying to map multiple groups to different domains | 21:01 |
| opiotte | basically, the IdP would return a list of groups on different domains | 21:02 |
| opiotte | is that possible? | 21:02 |
| lbragstad | dolphm: your failures here look to be ts related -- https://review.openstack.org/#/c/210049/ | 21:03 |
| *** ankita_wagh has quit IRC | 21:04 | |
| *** mylu has quit IRC | 21:06 | |
| *** lhcheng_away has quit IRC | 21:06 | |
| *** spandhe has quit IRC | 21:06 | |
| *** petertr7 is now known as petertr7_away | 21:06 | |
| dolphm | lbragstad: as in, my tests are bad? | 21:07 |
| *** rm_work is now known as rm_work|away | 21:07 | |
| *** e0ne has joined #openstack-keystone | 21:09 | |
| lbragstad | dolphm: I don't think so, I think it's just because of the issued_at assertions | 21:11 |
| *** ayoung has quit IRC | 21:11 | |
| lbragstad | and the subsecond precision | 21:11 |
| lbragstad | dolphm: you only removed the wip decorators in your patch and the overridden tests. so, worst case, it's just showing that patches prior to your patch don't quite address everything | 21:12 |
| lbragstad | from a test coverage perspective | 21:12 |
| dolphm | lbragstad: i only saw one failure when i ran those tests against roxanaghe's patch... now there's several failures | 21:13 |
| lbragstad | dolphm: you ran locally, right? | 21:14 |
| lbragstad | looks like Jenkins failed on about 14 of them | 21:14 |
| lbragstad | dolphm: did you run the keystone/tests/unit/token/test_fernet_provider.py unit tests? | 21:15 |
| lbragstad | because I think you're missing this: https://review.openstack.org/#/c/210068/3/keystone/tests/unit/token/test_fernet_provider.py | 21:15 |
| *** e0ne has quit IRC | 21:16 | |
| *** ankita_wagh has joined #openstack-keystone | 21:16 | |
| *** iamjarvo has quit IRC | 21:18 | |
| *** piyanai has quit IRC | 21:19 | |
| *** ankita_w_ has quit IRC | 21:20 | |
| dolphm | lbragstad: yes, locally. i definitely didn't run with that patch | 21:20 |
| openstackgerrit | Merged openstack/python-keystoneclient: Inhrerit roles project calls on keystoneclient v3 https://review.openstack.org/167613 | 21:20 |
| lbragstad | dolphm: you did run the unit tests in keystone/tests/unit/token/test_fernet_provider.py? | 21:21 |
| lbragstad | or just the functional tests in test_v3_auth.py? | 21:21 |
| dolphm | lbragstad: for your change in https://review.openstack.org/#/c/210068/3/keystone/token/providers/common.py,unified -- i think the fernet provider should override the parent class' issue_v3_token() to manipulate token_data['token']['issued_at'] | 21:22 |
| dolphm | lbragstad: basically, the common class should be oblivious to the behaviors of the individual implementations | 21:22 |
| dolphm | lbragstad: and yeah, i ran test_v3_auth, actually, because that's the only place i touched tests | 21:22 |
| *** markvoelker has quit IRC | 21:22 | |
| lbragstad | dolphm: so, pull the issue_v3_token method back out | 21:22 |
| dolphm | lbragstad: not the whole thing, just wrap it | 21:22 |
| dolphm | result = super(); result[expires] = new expires; return result | 21:23 |
| lbragstad | ok, I can do that | 21:23 |
| lbragstad | dolphm: btw, I just ran tox with the latest everything (including my patch) and everything passed | 21:23 |
| * lbragstad shrug | 21:23 | |
| roxanaghe | lbragstad, so I guess I need this https://review.openstack.org/#/c/210068/3/keystone/tests/unit/token/test_fernet_provider.py for my patch as well? because I think a lot of the failures for y patch are exactly about that? | 21:23 |
| lbragstad | roxanaghe: yep, I think so | 21:24 |
| dolphm | roxanaghe: i think so | 21:24 |
| dolphm | lbragstad: roxanaghe: despite proposing subsequent commits to share code, i'd like to see roxanaghe's patch have the complete solution & test cases | 21:24 |
| roxanaghe | lbragstad, dolphm: so what's the process? I am confused... | 21:25 |
| lbragstad | dolphm: I agree, | 21:25 |
| dolphm | (i'd rather abandon my patch) | 21:25 |
| lbragstad | same here.. | 21:25 |
| *** btully has joined #openstack-keystone | 21:25 | |
| dolphm | roxanaghe: i'm just sharing code using gerrit to discuss your patch - let's ensure your patch is sufficient to be marked as Closes-Bug! steal whatever you need from our commits | 21:26 |
| *** dguerri` is now known as dguerri | 21:26 | |
| lbragstad | ++ | 21:26 |
| *** lhcheng_away has joined #openstack-keystone | 21:27 | |
| roxanaghe | dolphm, ok let me steal some code then :) | 21:27 |
| *** lhcheng_away has quit IRC | 21:27 | |
| *** lhcheng_away has joined #openstack-keystone | 21:27 | |
| *** lhcheng_away is now known as lhcheng | 21:28 | |
| *** ChanServ sets mode: +v lhcheng | 21:28 | |
| *** dguerri is now known as dguerri` | 21:28 | |
| roxanaghe | lbragstad: hm, I will need the issued_at fix as well, do you want me to mark that wip and let your patch fix it? | 21:28 |
| *** ankita_wagh has quit IRC | 21:28 | |
| *** ankita_w_ has joined #openstack-keystone | 21:28 | |
| dolphm | roxanaghe: what timezone are you in, btw? | 21:29 |
| dolphm | roxanaghe: this bit? https://review.openstack.org/#/c/210068/3/keystone/token/providers/fernet/core.py | 21:29 |
| *** btully has quit IRC | 21:29 | |
| roxanaghe | dolphm, Pacific TZ | 21:30 |
| roxanaghe | lbragstad, yes. | 21:31 |
| roxanaghe | dolphm, actually ^^ yes, that bit | 21:32 |
| *** ankita_w_ has quit IRC | 21:32 | |
| *** ankita_wagh has joined #openstack-keystone | 21:32 | |
| dolphm | roxanaghe: that solves in for v2, but you also need the v3 fix here https://review.openstack.org/#/c/210068/3/keystone/token/providers/common.py ... and i think the v3 fix needs to be moved into the fernet provider, rather than being an edge case in the common module | 21:34 |
| *** phalmos has quit IRC | 21:34 | |
| *** harlowja has joined #openstack-keystone | 21:34 | |
| dolphm | roxanaghe: so, if you scroll back 10 minutes ago or so, that was my suggestion to wrap issue_v3_token() in the fernet provider with something like "result = super(); result[expires] = new expires; return result" | 21:35 |
| *** belmoreira has joined #openstack-keystone | 21:35 | |
| roxanaghe | dolphm, ok - I agree | 21:39 |
| *** harlowja has quit IRC | 21:39 | |
| *** harlowja has joined #openstack-keystone | 21:39 | |
| *** mylu has joined #openstack-keystone | 21:40 | |
| lbragstad | working on that now | 21:41 |
| *** opiotte has quit IRC | 21:41 | |
| dolphm | lbragstad: work with roxanaghe :) | 21:43 |
| lbragstad | roxanaghe: here is a diff of what I've done if you'd like it: http://cdn.pasteraw.com/ju8q7jrx4ufvbmg1nnj8e3m8j1vm8ri | 21:44 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use token creation ts from Fernet https://review.openstack.org/210068 | 21:47 |
| *** jecarey has joined #openstack-keystone | 21:48 | |
| *** mylu has quit IRC | 21:49 | |
| *** mylu has joined #openstack-keystone | 21:49 | |
| *** mylu has quit IRC | 21:49 | |
| dolphm | lbragstad: the "If..." comment is no longer conditional lol https://review.openstack.org/#/c/210068/4/keystone/token/providers/fernet/core.py,unified | 21:50 |
| openstackgerrit | Joshua Harlow proposed openstack/oslo.policy: Have the enforcer have its own file cache https://review.openstack.org/209656 | 21:50 |
| roxanaghe | lbragstad, thanks! looking at it :) | 21:54 |
| *** piyanai has joined #openstack-keystone | 21:56 | |
| *** piyanai has quit IRC | 21:57 | |
| *** piyanai has joined #openstack-keystone | 21:58 | |
| dstanek | do we have a way to add optional features to ksc? i don't believe the lib has it's own config or anything like that | 22:02 |
| *** marzif has quit IRC | 22:07 | |
| *** gordc has quit IRC | 22:08 | |
| bknudson | dstanek: monkey-patch it | 22:09 |
| dstanek | bknudson: i added the feature, but i was trying to find a pattern in there for turning things on and off | 22:11 |
| *** ankita_wagh has quit IRC | 22:11 | |
| dstanek | i don't see anything relevant | 22:11 |
| *** ankita_wagh has joined #openstack-keystone | 22:11 | |
| *** henrynash has quit IRC | 22:15 | |
| *** edmondsw has quit IRC | 22:20 | |
| jamielennox | bknudson: have you seen today's ML thread about middleware? | 22:23 |
| *** bknudson has quit IRC | 22:23 | |
| dolphm | dstanek: besides auth plugins? what's the integration point you're looking for | 22:24 |
| *** jecarey has quit IRC | 22:25 | |
| dolphm | jamielennox: sdague, annegentle and i were also discussing your nova->cinder and nova->neutron work in #openstack-dev an hour or two ago. | 22:25 |
| dstanek | dolphm: yeah, i've made some changes to enable http caching | 22:25 |
| dolphm | dstanek: why would that be optional? | 22:25 |
| dolphm | dstanek: cache all the things in all the places plzkthx | 22:25 |
| dstanek | dolphm: i would consider it experimental and some things should probably be configurable | 22:25 |
| dstanek | big one being the file system directory | 22:26 |
| jamielennox | dolphm: looking but anything in particular? | 22:26 |
| dolphm | dstanek: ~/.cache/keystoneclient/ or something? | 22:26 |
| jamielennox | dolphm: i haven't looked at those for a while as i was stuck on a glance_store issue for v3 | 22:26 |
| dolphm | dstanek: or /tmp ? | 22:26 |
| dolphm | jamielennox: specifically discussing "volumev2" -> "volume", a path towards dropping versioned endpoints in keystone's catalog, and a path towards dropping endpoint_template overrides in nova.conf for cinder, neutron and glance in favor of something centralized into keystone's catalog in the short term | 22:27 |
| jamielennox | dolphm: so lots of things | 22:28 |
| dolphm | jamielennox: do you have a patch you can put up as WIP for glance? | 22:28 |
| jamielennox | :) | 22:28 |
| dolphm | jamielennox: for nova->glance* | 22:28 |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove confusing deprecation comment from token_to_cms https://review.openstack.org/191510 | 22:28 |
| jamielennox | dolphm: i had one WIP for nova->glance but i think that's where the glance_store patch was required | 22:28 |
| jamielennox | i can't remember if i posted it or was just testing it | 22:29 |
| dolphm | jamielennox: if it's something you need, send me a link | 22:29 |
| dolphm | jamielennox: ** if it's in gerrit | 22:29 |
| jamielennox | dolphm: it appears not, i'll see if i still have the VM around - but it wasn't a difficult patch | 22:29 |
| jamielennox | dolphm: oh - that's right, it requires session in glanceclient which has merged now but has not been released | 22:31 |
| dolphm | jamielennox: when was the last glanceclient release? | 22:31 |
| jamielennox | 2015-07-16 | 22:32 |
| dolphm | jamielennox: link to your patch? | 22:32 |
| jamielennox | dolphm: yea, it's not up | 22:32 |
| dolphm | jamielennox: i mean the patch that merged to glanceclient | 22:32 |
| jamielennox | oh | 22:32 |
| jamielennox | dolphm: https://review.openstack.org/#/c/141994/ | 22:32 |
| jamielennox | jun 12 | 22:33 |
| dstanek | dolphm: i could just pick one, but i thought making it configurable would be nice | 22:33 |
| jamielennox | ... maybe it is out | 22:33 |
| *** stevemar has quit IRC | 22:33 | |
| dolphm | jamielennox: wait, but that wasn't included in the 7/16 release? | 22:33 |
| dolphm | jamielennox: oh, okay | 22:33 |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fernet 'expires' value loses 'ms' after validation https://review.openstack.org/210037 | 22:35 |
| dolphm | lbragstad: ^ | 22:35 |
| jamielennox | pip install glanceclient tells me it downloaded 0.19, but session is not there | 22:36 |
| roxanaghe | dolphm, lbragstad : all changes together ^^ | 22:36 |
| *** HT_sergio has quit IRC | 22:37 | |
| jamielennox | dolphm: ok, i don't know what happened but even though the session would have merged prior to release the tagged 0.19 doesn't contain the session patches | 22:37 |
| jamielennox | https://github.com/openstack/python-glanceclient/tree/0.19.0/glanceclient | 22:37 |
| jamielennox | pip says the latest version is 0.17.2 | 22:38 |
| jamielennox | someone made a mess | 22:38 |
| dolphm | jamielennox: 0.19.0 was made on june 10, actually | 22:39 |
| jamielennox | dolphm: yea, i pinched that from https://pypi.python.org/pypi/python-glanceclient | 22:40 |
| dolphm | jamielennox: so i'm really confused | 22:40 |
| jamielennox | which doesn't show 0.19 at all | 22:40 |
| *** _hrou_ has quit IRC | 22:41 | |
| jamielennox | they must have backported to 0.17 on 16/7 | 22:41 |
| jamielennox | dolphm: either way we need a release, which works out well because i'm currently pressuring flavio to release glance_store for me | 22:41 |
| dstanek | 0.19 is still listed in PyPI | 22:42 |
| *** marzif has joined #openstack-keystone | 22:42 | |
| dolphm | sigmavirus24: o/ | 22:42 |
| dstanek | https://pypi.python.org/simple/python-glanceclient/ | 22:42 |
| sigmavirus24 | hello | 22:42 |
| sigmavirus24 | what's up? | 22:43 |
| jamielennox | dstanek: why doesn't that show as the newest version on https://pypi.python.org/pypi/python-glanceclient | 22:43 |
| dolphm | sigmavirus24: any idea why pypi/python-glanceclient would show that 0.17.2 was released on july 16, when git shows that 0.19.0 was tagged on june 10? | 22:43 |
| jamielennox | dstanek: or becaues 0.17.2 was release after 0.19 pypi decides that 0.17.2 is more important | 22:43 |
| dstanek | jamielennox: not sure. maybe they tried to delete it | 22:43 |
| dolphm | dstanek: 0.19 is in pypi? | 22:43 |
| dstanek | jamielennox: that could be | 22:43 |
| dstanek | dobson: yeah, see my link above | 22:44 |
| dstanek | errr....not dobson i meant dolphm | 22:44 |
| dolphm | dstanek: i'm over here | 22:44 |
| dstanek | i no good at typey typey | 22:44 |
| dolphm | sigmavirus24: is pypi showing 0.17.2 as the latest by date, rather than by semver? | 22:45 |
| *** ankita_wagh has quit IRC | 22:46 | |
| *** stevemar has joined #openstack-keystone | 22:47 | |
| *** ChanServ sets mode: +v stevemar | 22:47 | |
| lhcheng | samueldmq: horizon uses ksc under the hood for authentication, if keystone move to version-less auth and keystoneauth exposes that, should be an easy transition for horizon. | 22:47 |
| jamielennox | dolphm: anyway i'll find that patch or write it again, but we need the glanceclient release | 22:48 |
| sigmavirus24 | dolphm: that's plausible | 22:48 |
| jamielennox | i found yesterday that Depends-On doesn't work for clients | 22:48 |
| dolphm | jamielennox: wtf | 22:48 |
| *** iamjarvo has joined #openstack-keystone | 22:48 | |
| lhcheng | samueldmq: or we're you asking about patch dependency? ping me again when you're back :) | 22:49 |
| jamielennox | something, something dependencies etc | 22:49 |
| dolphm | jamielennox: you can't depend on a patch to a service? | 22:49 |
| dolphm | jamielennox: it should work across any two projects | 22:49 |
| jamielennox | dolphm: i can depend on a patch to a service, there's no way i can gate a patch on a client library that isn't on pypi | 22:49 |
| samueldmq | lhcheng: hey I was talking about patch dependency | 22:49 |
| samueldmq | lhcheng: :) | 22:50 |
| *** dims_ has quit IRC | 22:50 | |
| *** markvoelker has joined #openstack-keystone | 22:50 | |
| lhcheng | samueldmq: ah okay, I'm not sure if there is really an issue for horizon. everyone have to go through rebase if they have patch dependency. just people complaining more rather than following the process :) | 22:53 |
| dolphm | roxanaghe: LGTM! | 22:54 |
| samueldmq | lhcheng: yeah, but I think one guy from my team (pauloewerton) had mentioned that people there were complaining about partial-features being merged | 22:56 |
| samueldmq | lhcheng: when the rest would take long to merge | 22:56 |
| samueldmq | lhcheng: maybe I misunderstood :-) | 22:56 |
| *** Ephur has quit IRC | 22:57 | |
| lhcheng | samueldmq: yeah, something like that :-) | 22:58 |
| roxanaghe | dolphm, thanks. agreed for the comment :D I'll upload a new patch | 22:59 |
| dolphm | roxanaghe: i'll keep an eye out! | 23:00 |
| *** marzif has quit IRC | 23:01 | |
| *** dims_ has joined #openstack-keystone | 23:10 | |
| *** topol has joined #openstack-keystone | 23:12 | |
| *** ChanServ sets mode: +v topol | 23:12 | |
| *** btully has joined #openstack-keystone | 23:13 | |
| *** ankita_wagh has joined #openstack-keystone | 23:14 | |
| *** vmbrasseur has joined #openstack-keystone | 23:16 | |
| *** r-daneel has quit IRC | 23:17 | |
| *** topol has quit IRC | 23:17 | |
| *** btully has quit IRC | 23:17 | |
| lbragstad | roxanaghe: great work combining the patches | 23:23 |
| roxanaghe | dolphm, lbragstad: so with this new patch we will have the issued_at value missing microseconds for both creation and validation | 23:23 |
| *** drjones has joined #openstack-keystone | 23:24 | |
| lbragstad | roxanaghe: I think the microseconds will be there, but they will be .000000Z (give or take a 0) | 23:24 |
| *** stevemar has quit IRC | 23:25 | |
| roxanaghe | so are we ok with that? it wil be something like: 2015-08-07T00:16:38.000000Z | 23:25 |
| *** Daviey has quit IRC | 23:25 | |
| *** _cjones_ has quit IRC | 23:25 | |
| roxanaghe | lbragstad, shoudl we include microseconds at all then? | 23:25 |
| roxanaghe | since they will be always empty | 23:26 |
| *** Daviey has joined #openstack-keystone | 23:26 | |
| lbragstad | roxanaghe: I'd probably defer that to dolphm | 23:26 |
| lbragstad | roxanaghe: I think there is some requirements in defcore that *require* microseconds in the timestamp | 23:26 |
| lbragstad | if so, then we'll have to keep it | 23:27 |
| lbragstad | I know dolphm is more familiar with that than I am though, (cc: morganfainberg is, too!) | 23:27 |
| roxanaghe | ok, I see and so there is no way to get them from the Fernet token format? should I play with that more? | 23:28 |
| lbragstad | roxanaghe: unfortunately, not at the moment. here is the cryptography code | 23:28 |
| * lbragstad digs | 23:28 | |
| *** drjones has quit IRC | 23:28 | |
| dolphm | roxanaghe: to make it easier for clients to consistently have a single format to decipher: yes | 23:28 |
| *** samleon has quit IRC | 23:28 | |
| dolphm | roxanaghe: as soon as the format changes, i consider that an API change (hence tempest is failing against Fernet, because the kilo+fernet is an API change vs juno+uuid) | 23:29 |
| dolphm | lbragstad: morganfainberg is on a flight home, i believe | 23:29 |
| lbragstad | dolphm: i figured, i know he was doing some traveling | 23:30 |
| dolphm | roxanaghe: fernet only includes second-level precision, not microsecond-level | 23:30 |
| morganfainberg | Soon | 23:30 |
| dolphm | roxanaghe: for creation timestamps | 23:30 |
| lbragstad | roxanaghe: here is where we call into the cryptography package -- https://github.com/openstack/keystone/blob/74575a66f1113ac0452da9982b345dec18ec0f32/keystone/token/providers/fernet/token_formatters.py#L70 | 23:30 |
| dolphm | morganfainberg: shh, i'm trying to cover for you | 23:30 |
| lbragstad | dolphm: busted! | 23:31 |
| lbragstad | roxanaghe: here are the bits in cryptography that generated the timestamp - https://github.com/pyca/cryptography/blob/master/src/cryptography/fernet.py#L49 | 23:31 |
| * morganfainberg isnt really here. Just a robot. | 23:31 | |
| *** morganfainberg is now known as morgan_503 | 23:31 | |
| lbragstad | roxanaghe: there doesn't seem to be a way to pass in a creation time to that methods. | 23:32 |
| lbragstad | s/methods/method/ | 23:32 |
| dolphm | lbragstad: but this is how we get the creation timestamp out of a fernet token (not the payload) https://github.com/openstack/keystone/blob/74575a66f1113ac0452da9982b345dec18ec0f32/keystone/token/providers/fernet/token_formatters.py#L82-L105 | 23:32 |
| dolphm | roxanaghe: ^ | 23:32 |
| lbragstad | oh... | 23:32 |
| lbragstad | sure | 23:32 |
| dolphm | lbragstad: oh, right. you can't pass it in. even the ttl is passed in on validation | 23:32 |
| dolphm | morgan_503: ++ | 23:32 |
| lbragstad | dolphm: hm, we could do surgery on the token after it's created | 23:33 |
| lbragstad | but we would still hit this - https://github.com/pyca/cryptography/blob/master/src/cryptography/fernet.py#L77 | 23:33 |
| lbragstad | where the cryptography packages puts it back into an int on decrypt | 23:33 |
| dolphm | lbragstad: please no :( | 23:33 |
| roxanaghe | https://github.com/openstack/keystone/blob/74575a66f1113ac0452da9982b345dec18ec0f32/keystone/token/providers/fernet/token_formatters.py#L100 if we can get here the microseconds as well it would be cool | 23:34 |
| lbragstad | if we really want to have the subsecond accuracy, out best bet would be to put it in the payload | 23:34 |
| dolphm | roxanaghe: but we don't control the datasource there | 23:34 |
| dolphm | roxanaghe: the structure we're unpacking is owned by pypi/cryptography and/or github.com/fernet | 23:35 |
| *** bknudson has joined #openstack-keystone | 23:35 | |
| *** ChanServ sets mode: +v bknudson | 23:35 | |
| roxanaghe | dolphm, ok, so it's just not stored in the Fernet format including microseconds? I just want to make sure that it's not when we read the data that we are converting it into int | 23:36 |
| dolphm | roxanaghe: correct. the creation timestamp is stored by fernet in fernet as an integer | 23:36 |
| lbragstad | roxanaghe: it looks like the creation time is converted to an int in cryptography | 23:36 |
| roxanaghe | oh yes: current_time = int(time.time()) damn | 23:37 |
| dolphm | roxanaghe: conversely, we store the expiration timestamp in the payload (and i think you said that was a float, not an integer as i remembered) | 23:37 |
| lbragstad | roxanaghe: yep, ++ | 23:37 |
| lbragstad | so, we can have microsecond precision in both the issued at and expires at times, but only the issued at will always be 000000Z (or something) | 23:38 |
| roxanaghe | dolphm, yes that's correct: expiration is a float | 23:38 |
| dolphm | lbragstad: ++ | 23:39 |
| * dolphm heads to food | 23:39 | |
| *** btully has joined #openstack-keystone | 23:41 | |
| lbragstad | dolphm: o/ | 23:42 |
| lbragstad | roxanaghe: i'll keep an eye out for another revision, until then +2 on the one you have | 23:45 |
| roxanaghe | lbragstad, dolphm - cool thanks for your help on this | 23:47 |
| *** iamjarvo has quit IRC | 23:47 | |
| lbragstad | roxanaghe: thanks for putting everything together! | 23:47 |
| lbragstad | roxanaghe: thanks for the tip on microseconds with floats, too.. i wasn't aware of that | 23:48 |
| roxanaghe | lbragstad - sure, my pleasure: sometimes it's an advantage to not know the code cause then you test every possibility :) | 23:49 |
| lbragstad | roxanaghe: ++ | 23:49 |
| *** HT_sergio has joined #openstack-keystone | 23:52 | |
| jamielennox | the federated login ML has completely broken zimbra's threading view, i've no idea what's happening any more or who said what | 23:58 |
| *** jasonsb has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!