| *** jasonsb has joined #openstack-keystone | 00:06 | |
| *** dims_ has quit IRC | 00:12 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** mylu has quit IRC | 00:23 | |
| *** dramakri has left #openstack-keystone | 00:26 | |
| *** dramakri has quit IRC | 00:26 | |
| *** mylu has joined #openstack-keystone | 00:34 | |
| *** fangzhou has joined #openstack-keystone | 00:34 | |
| *** _cjones_ has quit IRC | 00:47 | |
| *** richm has quit IRC | 01:01 | |
| *** zzzeek has joined #openstack-keystone | 01:03 | |
| *** dims has joined #openstack-keystone | 01:04 | |
| *** qiaowei has joined #openstack-keystone | 01:04 | |
| *** shoutm has joined #openstack-keystone | 01:08 | |
| *** bapalm has quit IRC | 01:12 | |
| *** lhcheng has quit IRC | 01:14 | |
| *** bapalm has joined #openstack-keystone | 01:14 | |
| *** browne has quit IRC | 01:18 | |
| *** bapalm has quit IRC | 01:21 | |
| *** zzzeek has quit IRC | 01:29 | |
| *** dave-mccowan has quit IRC | 01:32 | |
| *** bapalm has joined #openstack-keystone | 01:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/213898 | 01:37 |
|---|---|---|
| *** bapalm has quit IRC | 01:38 | |
| *** mylu has quit IRC | 01:41 | |
| *** bapalm has joined #openstack-keystone | 01:44 | |
| *** davechen has joined #openstack-keystone | 01:44 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: Remove references to keystone.openstack.common https://review.openstack.org/215337 | 01:50 |
| *** bapalm has quit IRC | 01:51 | |
| *** topol has quit IRC | 01:52 | |
| *** topol has joined #openstack-keystone | 01:52 | |
| *** ChanServ sets mode: +v topol | 01:52 | |
| *** bapalm has joined #openstack-keystone | 01:56 | |
| *** ankita_w_ has quit IRC | 01:58 | |
| *** mylu has joined #openstack-keystone | 02:01 | |
| *** bapalm has quit IRC | 02:03 | |
| *** piyanai has joined #openstack-keystone | 02:05 | |
| *** bknudson has left #openstack-keystone | 02:05 | |
| *** bapalm has joined #openstack-keystone | 02:10 | |
| *** ankita_wagh has joined #openstack-keystone | 02:14 | |
| *** tonyb has joined #openstack-keystone | 02:15 | |
| *** bapalm has quit IRC | 02:15 | |
| tonyb | jamielennox: ping? | 02:15 |
| *** ankita_wagh has quit IRC | 02:15 | |
| *** ankita_wagh has joined #openstack-keystone | 02:16 | |
| openstackgerrit | Merged openstack/keystone: Enhance tests for saml2 signing exception logging https://review.openstack.org/212845 | 02:16 |
| *** ankita_wagh has quit IRC | 02:18 | |
| qiaowei | can anyone help review the patch https://review.openstack.org/#/c/203966/? it have gotten one "+2". | 02:18 |
| *** ankita_wagh has joined #openstack-keystone | 02:19 | |
| *** mylu has quit IRC | 02:21 | |
| *** mylu has joined #openstack-keystone | 02:21 | |
| *** bapalm has joined #openstack-keystone | 02:23 | |
| *** mylu has quit IRC | 02:26 | |
| *** bapalm has quit IRC | 02:30 | |
| *** bapalm has joined #openstack-keystone | 02:33 | |
| *** mylu has joined #openstack-keystone | 02:37 | |
| openstackgerrit | Merged openstack/keystone: Update 'doc/source/setup.rst'. https://review.openstack.org/213979 | 02:39 |
| *** bapalm has quit IRC | 02:40 | |
| *** piyanai has quit IRC | 02:42 | |
| *** bapalm has joined #openstack-keystone | 02:42 | |
| *** nkinder has joined #openstack-keystone | 02:45 | |
| *** ankita_w_ has joined #openstack-keystone | 02:47 | |
| *** ankita_wagh has quit IRC | 02:50 | |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** bapalm has quit IRC | 02:52 | |
| *** hakimo has quit IRC | 02:54 | |
| *** bapalm has joined #openstack-keystone | 02:55 | |
| *** dims has quit IRC | 02:55 | |
| *** woodster_ has quit IRC | 02:59 | |
| *** bapalm has quit IRC | 03:04 | |
| *** gyee has quit IRC | 03:09 | |
| *** bapalm has joined #openstack-keystone | 03:10 | |
| jamielennox | tonyb: hey | 03:10 |
| *** shoutm_ has joined #openstack-keystone | 03:11 | |
| *** dave-mccowan has joined #openstack-keystone | 03:11 | |
| tonyb | jamielennox: So ar Pycon you gave a lighning talk about using client sessions rather than hand rolled auth (exucse me if I get the jargon wrong) | 03:11 |
| *** shoutm has quit IRC | 03:12 | |
| jamielennox | tonyb: yep | 03:12 |
| tonyb | jamielennox: Is that in anyway dpenedant on v3? | 03:12 |
| tonyb | jamielennox: all the examples I see use v3 but that's not the same thing? | 03:12 |
| jamielennox | tonyb: no, v2 works just fine that way, the idea is then that we can swap out the plugin without changing the code | 03:12 |
| *** samleon has quit IRC | 03:12 | |
| jamielennox | i use v3 examples just because we want to get people over to v3 | 03:12 |
| jamielennox | the examples would generally show a v3.Password object, if you use v2.Password that's essentially the standard auth most people use now | 03:14 |
| tonyb | jamielennox: So if I took the code from http://docs.openstack.org/developer/python-keystoneclient/using-sessions.html and s,v3,v2, that would be valid and an improvment over keystone_client.Client() with all the options? | 03:14 |
| tonyb | https://review.openstack.org/#/c/184537/15/nova/cmd/manage.py,cm is the change I'm looking at | 03:14 |
| tonyb | clearly I'm not a keystone guy but if I can make things suck less then that's a thing I shoudl do | 03:15 |
| jamielennox | tonyb: the options change a bit between v2 and v3, because they have to https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/identity/v2.py#L130 | 03:15 |
| *** lhcheng has joined #openstack-keystone | 03:15 | |
| *** ChanServ sets mode: +v lhcheng | 03:15 | |
| *** qiaowei has left #openstack-keystone | 03:16 | |
| jamielennox | but otherwise yes, that applies | 03:16 |
| jamielennox | i'm not sure what this @args syntax is relying upon, but if it was argparse we have helpers for CLI https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/auth/cli.py#L21 | 03:17 |
| jamielennox | so that it registers all the options it expects, and you just get a plugin out that you can use | 03:17 |
| jamielennox | and that way the user can supply there own auth info with whatever version makes sense for them | 03:17 |
| tonyb | jamielennox: Cool thanks. I'll make some grubling on that review. I may get told to pull my head in but we'll see | 03:20 |
| jamielennox | tonyb: that would be great, as with all these things eventually everything will need to be cleaned up, but anything we can fix now we don't have to worry about deprecating later | 03:21 |
| tonyb | jamielennox: Cool. I might try to get some time with you and a few others in Tokyo to see what is reasonable to get into Mitaka by way of cleanups etc | 03:22 |
| tonyb | .... I mean into (nova) Mitaka just for clarity | 03:22 |
| jamielennox | tonyb: that would be awesome, people look at what nova does for precendence in these things | 03:23 |
| tonyb | jamielennox: Well nova is the best ;P | 03:23 |
| jamielennox | tonyb: that's the word i'd have used too | 03:24 |
| tonyb | jamielennox: LOL | 03:24 |
| *** tiny-hands has quit IRC | 03:25 | |
| *** browne has joined #openstack-keystone | 03:26 | |
| *** fangzhou has quit IRC | 03:31 | |
| *** dave-mcc_ has joined #openstack-keystone | 03:43 | |
| *** piyanai has joined #openstack-keystone | 03:44 | |
| *** dave-mccowan has quit IRC | 03:45 | |
| *** piyanai has quit IRC | 03:50 | |
| *** shoutm has joined #openstack-keystone | 03:52 | |
| *** shoutm_ has quit IRC | 03:54 | |
| *** shoutm_ has joined #openstack-keystone | 03:55 | |
| *** shoutm has quit IRC | 03:57 | |
| *** shoutm has joined #openstack-keystone | 03:58 | |
| *** shoutm_ has quit IRC | 03:59 | |
| *** dave-mccowan has joined #openstack-keystone | 04:11 | |
| *** dave-mcc_ has quit IRC | 04:13 | |
| *** rm_work|away is now known as rm_work | 04:14 | |
| *** ankita_w_ has quit IRC | 04:15 | |
| *** ankita_wagh has joined #openstack-keystone | 04:16 | |
| *** ankita_wagh has quit IRC | 04:17 | |
| *** dave-mccowan has quit IRC | 04:18 | |
| *** ankita_wagh has joined #openstack-keystone | 04:18 | |
| *** ayoung has quit IRC | 04:22 | |
| *** shoutm_ has joined #openstack-keystone | 04:39 | |
| *** bapalm has quit IRC | 04:39 | |
| *** shoutm has quit IRC | 04:41 | |
| *** bapalm has joined #openstack-keystone | 04:41 | |
| *** mylu has quit IRC | 04:41 | |
| *** jdennis has quit IRC | 04:45 | |
| *** bapalm has quit IRC | 04:46 | |
| *** bapalm has joined #openstack-keystone | 04:47 | |
| *** bapalm has quit IRC | 04:54 | |
| *** bapalm has joined #openstack-keystone | 04:56 | |
| *** jdennis has joined #openstack-keystone | 05:00 | |
| *** bapalm has quit IRC | 05:03 | |
| *** jdennis has quit IRC | 05:05 | |
| *** kiran-r has joined #openstack-keystone | 05:05 | |
| *** bapalm has joined #openstack-keystone | 05:07 | |
| *** kiran-r has quit IRC | 05:07 | |
| *** geoffarnold has joined #openstack-keystone | 05:09 | |
| *** geoffarnold is now known as geoffarnoldX | 05:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 05:09 |
| *** geoffarnoldX is now known as geoffarnold | 05:10 | |
| *** ajayaa has joined #openstack-keystone | 05:10 | |
| openstackgerrit | Gang Wei proposed openstack/keystone-specs: fix a simple typo "ì" -> "i" https://review.openstack.org/215444 | 05:13 |
| *** geoffarnold has quit IRC | 05:15 | |
| *** bapalm has quit IRC | 05:16 | |
| *** geoffarnold has joined #openstack-keystone | 05:16 | |
| *** urulama has joined #openstack-keystone | 05:18 | |
| *** bapalm has joined #openstack-keystone | 05:20 | |
| *** jdennis has joined #openstack-keystone | 05:20 | |
| *** bapalm has quit IRC | 05:34 | |
| *** bapalm has joined #openstack-keystone | 05:35 | |
| *** mylu has joined #openstack-keystone | 05:42 | |
| *** bapalm has quit IRC | 05:44 | |
| *** lhcheng has quit IRC | 05:46 | |
| *** dims has joined #openstack-keystone | 05:47 | |
| *** mylu has quit IRC | 05:47 | |
| *** dims has quit IRC | 05:52 | |
| *** bapalm has joined #openstack-keystone | 05:56 | |
| *** topol has quit IRC | 05:59 | |
| *** dims has joined #openstack-keystone | 06:01 | |
| *** rm_work is now known as rm_work|away | 06:01 | |
| *** Nirupama has joined #openstack-keystone | 06:02 | |
| *** rm_work|away is now known as rm_work | 06:05 | |
| *** dims has quit IRC | 06:05 | |
| *** vivekd has joined #openstack-keystone | 06:11 | |
| *** urulama has quit IRC | 06:12 | |
| *** urulama has joined #openstack-keystone | 06:12 | |
| *** bapalm has quit IRC | 06:15 | |
| *** browne has quit IRC | 06:15 | |
| *** bapalm has joined #openstack-keystone | 06:16 | |
| *** bapalm has quit IRC | 06:20 | |
| *** ankita_wagh has quit IRC | 06:24 | |
| *** sateesh has joined #openstack-keystone | 06:27 | |
| *** Charlie has joined #openstack-keystone | 06:32 | |
| Charlie | Hello everyone. | 06:33 |
| Charlie | i recently tried to install the kilo in a VM. but we are facing some issues at keystone config. | 06:34 |
| Charlie | is anyone here who would help us out? | 06:34 |
| Charlie | curl http://git.openstack.org/cgit/openstack/keystone/plain/httpd/keystone.py?h=stable/kilo \ | tee /var/www/cgi-bin/keystone/main /var/www/cgi-bin/keystone/admin | 06:35 |
| Charlie | this was the command in the official documentation [kilo installation in ubuntu 14.04] | 06:35 |
| *** afazekas has joined #openstack-keystone | 06:35 | |
| Charlie | but the output we get as "network unreachable". | 06:36 |
| *** vivekd has quit IRC | 06:38 | |
| *** vivekd has joined #openstack-keystone | 06:41 | |
| *** mflobo has left #openstack-keystone | 06:48 | |
| *** lhcheng has joined #openstack-keystone | 06:52 | |
| *** ChanServ sets mode: +v lhcheng | 06:52 | |
| davechen | Charlie: You can just copy from that file from the git repo. | 06:54 |
| davechen | Charlie: I tried the command you use, it's okay for me, I suspect it's the issue of your network. | 06:55 |
| *** lhcheng has quit IRC | 06:56 | |
| Charlie | we opened the page and it was a python script. so we just need to copy that script ? | 06:58 |
| Charlie | to davechen | 06:58 |
| davechen | Charlie: yes, just that file. | 06:58 |
| davechen | Charlie: keystone.py | 06:59 |
| openstackgerrit | Andrey Pavlov proposed openstack/keystone: Add S3 signature v4 checking https://review.openstack.org/215481 | 06:59 |
| Charlie | okay. so where should i place it? | 06:59 |
| davechen | Charlie: copy that file and put that file to the place where your httpd config is located. | 07:00 |
| *** hrou has quit IRC | 07:00 | |
| Charlie | we dont need to run that script.. do we? | 07:01 |
| davechen | Charlie: no, when keystone service is started, this file need to be readed. | 07:02 |
| Charlie | okay. | 07:02 |
| davechen | Charlie: automatically, needn't run it manually. | 07:02 |
| davechen | Charlie: which doc are you refer? | 07:03 |
| Charlie | :davechen Thanks for the help dave. | 07:03 |
| davechen | http://docs.openstack.org/developer/keystone/apache-httpd.html?? | 07:03 |
| davechen | this one? | 07:03 |
| *** shoutm has joined #openstack-keystone | 07:03 | |
| *** shoutm_ has quit IRC | 07:05 | |
| davechen | Charlie: np, pls mind the dir is not necessary /var/www/cgi-bin/, but varies from your deployment. | 07:05 |
| Charlie | ok | 07:06 |
| Charlie | its this link i am trying. http://docs.openstack.org/kilo/install-guide/install/apt/content/keystone-install.html | 07:07 |
| Charlie | under identity service --> install and configure --> WSGI components | 07:09 |
| davechen | Charlie: I saw that, thanks. Good luck! :) | 07:12 |
| *** henrynash has joined #openstack-keystone | 07:14 | |
| *** ChanServ sets mode: +v henrynash | 07:14 | |
| marekd | Good morning. | 07:18 |
| *** Charlie has quit IRC | 07:19 | |
| davechen | marekd: Good afternoon. :) | 07:23 |
| marekd | :-) | 07:25 |
| davechen | henrynash: Just answer your quesiton about the show idp, currently, OSC doesn't support to show IDP by optional arguments. | 07:26 |
| henrynash | davechen: although can you specify for osc, on an entity-by-entity basis, which attribute “show” uses? | 07:27 |
| davechen | That means the url for show idp is GET /identity_providers. so, there will be no issue with list command in the OSC. | 07:28 |
| davechen | henrynash: yes, show users is supported with some filter, but idp doesn't support any filter. | 07:28 |
| henrynash | davechen: so we could get show to user ID as a filter, if we supported that? | 07:29 |
| *** shoutm has quit IRC | 07:29 | |
| henrynash | (show to use ID as a filter…) | 07:30 |
| davechen | henrynash: but there is only three attribute in the IDP (enable, id, and desc) | 07:30 |
| *** lsmola has joined #openstack-keystone | 07:31 | |
| henrynash | davechen: yeah, it’s back to my original point….IDP entities don’t look standard. So IF we can configure osc so that for show IDP it filter on ID (instead of name), AND we add support for filtering IDPs by ID, then it woudl work….It’s a bit convoluted, however | 07:32 |
| henrynash | davechen: seems to me we must have a discussion about what the expectations are between osc and the entities it can interface with…i.e. must there always be a name? Or just some attribute you can filter on to geta unique object, etc? | 07:34 |
| davechen | henrynash: yes, I agree, this should be have wider discussion. | 07:34 |
| davechen | henrynash: fiter by ID is okay with list command, but still not work with show command. | 07:36 |
| henrynash | davechen: well it woudl be ok if ID is unque (which I assume it is) | 07:36 |
| davechen | henrynash: I am working on adding the support in the IDP in the service side since IDP currently doesn't support filtering at all. | 07:36 |
| davechen | henrynash: I will prepare some materials about this, and would you pls help to cover me to talk a little bit about it in our meeting? | 07:37 |
| henrynash | sure | 07:38 |
| henrynash | davechen: sure | 07:38 |
| davechen | henrynash: get some commetns from others and how to handle this both in osc and service side. | 07:38 |
| davechen | henrynash: thanks a lot! just beacuse the timeslot is so bad for me :( | 07:39 |
| henrynash | davechen: np | 07:39 |
| *** mylu has joined #openstack-keystone | 07:43 | |
| *** mylu has quit IRC | 07:48 | |
| *** shoutm has joined #openstack-keystone | 07:48 | |
| *** ajayaa has quit IRC | 07:51 | |
| *** LukeHinds has joined #openstack-keystone | 07:55 | |
| *** pnavarro has joined #openstack-keystone | 07:55 | |
| *** fhubik has joined #openstack-keystone | 07:55 | |
| *** shoutm_ has joined #openstack-keystone | 08:11 | |
| *** shoutm has quit IRC | 08:13 | |
| *** doug-fish has joined #openstack-keystone | 08:18 | |
| *** fhubik is now known as fhubik_brb | 08:19 | |
| *** fhubik_brb is now known as fhubik | 08:19 | |
| *** doug-fish has quit IRC | 08:23 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 08:24 |
| *** jistr has joined #openstack-keystone | 08:30 | |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth-saml2: Depend on keystoneauth https://review.openstack.org/186854 | 08:34 |
| openstackgerrit | Marek Denis proposed openstack/keystoneauth-saml2: Standardize federated auth token scoping https://review.openstack.org/177227 | 08:35 |
| *** ajayaa has joined #openstack-keystone | 08:35 | |
| *** shoutm_ has quit IRC | 08:40 | |
| *** lhcheng has joined #openstack-keystone | 08:41 | |
| *** ChanServ sets mode: +v lhcheng | 08:41 | |
| *** lhcheng has quit IRC | 08:46 | |
| davechen | henrynash, marekd, hi, | 08:55 |
| davechen | henrynash, marekd, I have a trouble to share the google doc, so just use paste instead. (http://paste.openstack.org/show/423236/) | 08:55 |
| henrynash | davechen: hi | 08:55 |
| marekd | hi | 08:55 |
| davechen | henrynash: my explaination is not correct enough, what i meant is list command instead of show command, idp list command doest support any optional arguments as the filter. | 08:57 |
| marekd | davechen: henrynash is the problem constained only to federation entities? | 08:57 |
| marekd | or it also exists somewhere else? | 08:57 |
| marekd | i found it for idps but maybe there are other places like that? | 08:57 |
| davechen | yes, it's not limited to idp. | 08:58 |
| davechen | this is why i ask the question to henry to potionally change the design a little bit. | 08:58 |
| henrynash | davechen, marekd: so first up we need to decide if all first class entities need to have a name atttribute. This used to be the requirement. This needs a keystone-wide discussion | 08:58 |
| davechen | henrynash: other table donest have 'name' column, such as service_provider . | 08:59 |
| marekd | henrynash: used to be a req? So it no longer is? | 08:59 |
| henrynash | davechen, marked: If the answe to teh above is NO, then we need to chaneg the design of osc to allow the “show attrbute” to be specified on an entity-by-entity basis | 08:59 |
| henrynash | marked: I thought it still was…but I think we kinda of forgot this was a requirement!!! | 09:00 |
| marekd | henrynash: uh | 09:00 |
| marekd | henrynash: since idp,protocol, mapping have user specified id | 09:00 |
| davechen | henrynash: agree, entity-by-entity basis sound good. | 09:01 |
| marekd | henrynash: we can only duplicate data | 09:01 |
| henrynash | davechen, marekd: the issue about what happens if you specify an unsupported filter to a list command is totally separate…and should be discussion outside of the context of this issue (I actually liek the current fucntionality, but could be persuaded to support a different view!) | 09:02 |
| davechen | marekd, the table schema is designed by you? | 09:02 |
| marekd | davechen: it was, but with quorum from rest of keystone team. | 09:02 |
| marekd | davechen: afair it was not my idea to put id as user defined. | 09:02 |
| marekd | davechen: have you discussed it on the keystone meeting? (i missed last two) | 09:03 |
| davechen | marekd: i saw steve's comment about this, seems like this is a agreed design. | 09:03 |
| davechen | marekd: sorry, no. | 09:03 |
| henrynash | marekd: yeah, that’s what I mean we kind of forgot about this…traditioanlly teh ID was generted and the name was the user defined thing (often unique) | 09:03 |
| marekd | henrynash: so i am pretty sure for this case it was done on purpose (not skipping name column, rather user defined id) | 09:04 |
| henrynash | marekd, davechen: we’re all equally guilty! | 09:04 |
| davechen | marekd: henry may help talk about this in the coming meeting. | 09:04 |
| davechen | :) I am not guilty. | 09:06 |
| davechen | henrynash, marekd, thanks both (boss), let's see what others will say about this. | 09:07 |
| marekd | davechen: yeah | 09:07 |
| henrynash | davechen: true, I’ll give you that! | 09:07 |
| davechen | henrynash, marekd: my weekend is coming, and happy weekend to you! :) | 09:08 |
| henrynash | davechen: u2 | 09:08 |
| marekd | davechen: sure, have a nice weekend! | 09:08 |
| *** davechen has left #openstack-keystone | 09:13 | |
| *** lhinds_ has joined #openstack-keystone | 09:14 | |
| *** urulama has quit IRC | 09:15 | |
| *** urulama has joined #openstack-keystone | 09:16 | |
| *** aix has joined #openstack-keystone | 09:19 | |
| *** shoutm has joined #openstack-keystone | 09:30 | |
| *** fhubik is now known as fhubik_brb | 09:44 | |
| *** shoutm has quit IRC | 09:45 | |
| *** fhubik_brb is now known as fhubik | 09:45 | |
| *** fhubik is now known as fhubik_brb | 09:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 09:48 |
| openstackgerrit | Merged openstack/keystone: Add necessary executable permission https://review.openstack.org/203966 | 09:57 |
| *** dims has joined #openstack-keystone | 10:05 | |
| *** aix has quit IRC | 10:10 | |
| *** yottatsa has joined #openstack-keystone | 10:12 | |
| *** yottatsa has quit IRC | 10:12 | |
| *** aix has joined #openstack-keystone | 10:22 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Relax newly imposed sql driver restriction for domain config https://review.openstack.org/191976 | 10:24 |
| openstackgerrit | henry-nash proposed openstack/keystone: Remove unused code in domain config checking https://review.openstack.org/194057 | 10:24 |
| *** sateesh has quit IRC | 10:26 | |
| *** lhcheng has joined #openstack-keystone | 10:30 | |
| *** ChanServ sets mode: +v lhcheng | 10:30 | |
| marekd | opilotte: hi, i think your patch is fine, but i would like to ask you for proper documentation update, and then we will approve both. For doc update you should work on https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst ) | 10:33 |
| *** lhcheng has quit IRC | 10:34 | |
| *** henrynash has quit IRC | 10:41 | |
| *** yottatsa has joined #openstack-keystone | 10:42 | |
| *** fhubik_brb is now known as fhubik | 10:43 | |
| *** lhcheng has joined #openstack-keystone | 10:53 | |
| *** ChanServ sets mode: +v lhcheng | 10:53 | |
| *** piyanai has joined #openstack-keystone | 10:55 | |
| *** lhcheng has quit IRC | 10:58 | |
| *** LukeHinds has quit IRC | 11:14 | |
| *** yottatsa_ has joined #openstack-keystone | 11:22 | |
| *** yottatsa has quit IRC | 11:23 | |
| *** yottatsa has joined #openstack-keystone | 11:41 | |
| *** yottatsa has quit IRC | 11:42 | |
| *** mylu has joined #openstack-keystone | 11:44 | |
| *** yottatsa_ has quit IRC | 11:44 | |
| openstackgerrit | Vivek Dhayaal proposed openstack/keystone: Stable Keystone Driver Interfaces https://review.openstack.org/209524 | 11:48 |
| *** mylu has quit IRC | 11:49 | |
| *** yottatsa has joined #openstack-keystone | 11:54 | |
| *** ChanServ sets mode: +o dolphm | 11:55 | |
| *** yottatsa has quit IRC | 12:05 | |
| *** Nirupama has quit IRC | 12:08 | |
| *** yottatsa has joined #openstack-keystone | 12:10 | |
| *** yottatsa has quit IRC | 12:10 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 12:11 | |
| *** claudiub has joined #openstack-keystone | 12:11 | |
| *** petertr7_away is now known as petertr7 | 12:12 | |
| *** yottatsa has joined #openstack-keystone | 12:15 | |
| *** yottatsa has quit IRC | 12:17 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 12:18 | |
| *** yottatsa has joined #openstack-keystone | 12:19 | |
| *** alejandrito has joined #openstack-keystone | 12:20 | |
| dolphm | mfisch: ping me when you have a minute | 12:22 |
| *** vivekd has quit IRC | 12:26 | |
| *** kiran-r has joined #openstack-keystone | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:31 | |
| *** piyanai has quit IRC | 12:36 | |
| gordc | dolphm: if for some reason you feel passionate about wsgi middleware: https://review.openstack.org/#/c/208965/ | 12:39 |
| dolphm | gordc: =) | 12:40 |
| gordc | dolphm: different strokes. who am i to judge. | 12:41 |
| *** tjcocozz__ has joined #openstack-keystone | 12:43 | |
| *** abhirc has joined #openstack-keystone | 12:44 | |
| *** kiran-r has quit IRC | 12:49 | |
| *** kiran-r has joined #openstack-keystone | 12:50 | |
| *** piyanai has joined #openstack-keystone | 12:52 | |
| *** tiny-hands has joined #openstack-keystone | 12:54 | |
| *** chlong has joined #openstack-keystone | 12:58 | |
| *** tiny-hands has quit IRC | 13:00 | |
| samueldmq | morning | 13:00 |
| *** yottatsa has quit IRC | 13:02 | |
| *** yottatsa has joined #openstack-keystone | 13:03 | |
| *** yottatsa has quit IRC | 13:04 | |
| *** yottatsa has joined #openstack-keystone | 13:04 | |
| *** tjcocozz_ has joined #openstack-keystone | 13:04 | |
| *** jecarey has joined #openstack-keystone | 13:06 | |
| *** yottatsa has quit IRC | 13:06 | |
| *** chlong has quit IRC | 13:07 | |
| *** tjcocozz__ has quit IRC | 13:07 | |
| *** dave-mccowan has joined #openstack-keystone | 13:08 | |
| *** shoutm has joined #openstack-keystone | 13:08 | |
| *** nkinder has quit IRC | 13:09 | |
| *** yottatsa has joined #openstack-keystone | 13:10 | |
| *** jecarey has quit IRC | 13:12 | |
| *** doug-fish has joined #openstack-keystone | 13:12 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Respect federated user name in tokens. https://review.openstack.org/211093 | 13:14 |
| *** dims has quit IRC | 13:16 | |
| *** dims has joined #openstack-keystone | 13:17 | |
| *** richm has joined #openstack-keystone | 13:18 | |
| *** doug-fish has quit IRC | 13:19 | |
| marekd | lbragstad: re: https://review.openstack.org/#/c/211093/ so you had some question on why i removed parse.unquote() operation . I answered it, however now i made a chain of patches so it should be all even more clear. Can you revisit the patch (as well as underlying) and vote again? | 13:19 |
| *** yottatsa has quit IRC | 13:19 | |
| lbragstad | marekd: sure thing, thanks for respinning! | 13:19 |
| *** petertr7 is now known as petertr7_away | 13:21 | |
| *** hrou has joined #openstack-keystone | 13:21 | |
| marekd | dolphm: lbragstad: what happens if the optional field is empty - is it going to still going to use a space in the fernet payload? | 13:23 |
| *** _kiran_ has joined #openstack-keystone | 13:24 | |
| *** urulama has quit IRC | 13:24 | |
| *** urulama has joined #openstack-keystone | 13:25 | |
| *** kiran-r has quit IRC | 13:26 | |
| *** _kiran_ has quit IRC | 13:29 | |
| samueldmq | dstanek, you around ? | 13:33 |
| dstanek | samueldmq: does the sun shine? | 13:33 |
| samueldmq | dstanek, does that imply in a "sure" ? :-) | 13:34 |
| dstanek | samueldmq: more of an "of course"! | 13:34 |
| samueldmq | dstanek, hehe | 13:35 |
| samueldmq | dstanek, did you see a couple of messages I left to you yesterday ? | 13:35 |
| samueldmq | dstanek, regarding the policy distribution thing | 13:35 |
| *** piyanai has quit IRC | 13:36 | |
| *** piyanai has joined #openstack-keystone | 13:37 | |
| lbragstad | marekd: I believe so, but I'd have to double check | 13:37 |
| dstanek | samueldmq: pms? | 13:37 |
| marekd | lbragstad: i read the log from irc meeting when the bug https://bugs.launchpad.net/keystone/+bug/1482701 was discussed. | 13:38 |
| openstack | Launchpad bug 1482701 in Keystone "Federation: user's name in rules not respected" [Medium,In progress] - Assigned to Marek Denis (marek-denis) | 13:38 |
| *** piyanai has quit IRC | 13:39 | |
| marekd | lbragstad: so i am gonna fix this eventually but may do some optimizations wherever possible. Also, I am wondering if there is any contract saying user must have id and name specified. cc/ dolphm morgan_2549 | 13:39 |
| samueldmq | dstanek, no, basically I am tending to agree that starting simple, and accept small inconsistencies when updating policies would be ok | 13:39 |
| samueldmq | dstanek, at least for starting .. if they ask for improvements, we know how to do it already | 13:40 |
| dolphm | marekd: absolutely, all resources in v3 have an ID, and names are required attributes of users: https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#users-v3users | 13:41 |
| marekd | dolphm: ok, that explains everything. | 13:42 |
| marekd | so i am starting to work on a patch for names and fernet. | 13:42 |
| dolphm | marekd: that sounds like no fun | 13:42 |
| marekd | increasing fernet payload size is not fun at all. | 13:43 |
| dstanek | samueldmq: what gave you the change in heart? | 13:43 |
| dolphm | marekd: you can't hang a reference to that off the mapping table? | 13:43 |
| dolphm | marekd: the users themselves don't need to be non-persistent | 13:43 |
| dolphm | marekd: err, sorry not federation mapping table... the user-domain mapping table | 13:44 |
| samueldmq | dstanek, honestly, this test https://review.openstack.org/#/c/209695/13/keystone/tests/unit/test_backend_endpoint_policy.py | 13:44 |
| *** jecarey has joined #openstack-keystone | 13:44 | |
| samueldmq | dstanek, we would need to put the 'valid_to' in the endpoint table, because we are distributing based in endpointds, so the validity should be stored there | 13:44 |
| marekd | dolphm: so local users are local users - then we issue standard fernet tokens and don't bother with groups, names etc. | 13:45 |
| marekd | strictrly federated tokens are (as of now) ephemeral users. | 13:45 |
| samueldmq | dstanek, we'd be adding this 'valid_to' in the endpoint table + a new table for copies, I think this is kind of messing our model up for making keystone do a task that it isn't designed for | 13:46 |
| samueldmq | dstanek, i.e, be a cms | 13:46 |
| marekd | dolphm: which table are you referring now, btw? | 13:46 |
| dolphm | marekd: the one that maps user IDs to domains | 13:46 |
| samueldmq | dstanek, or something like that .. that's why I think we could start simpler, and make improvements later if requested | 13:46 |
| dolphm | marekd: maybe it's time to investigate the consequences of not having a user identity in openstack at all? what services would break if there was no X_USER_ID X_USER_NAME header presented to them, etc? | 13:47 |
| dolphm | marekd: are there ways around those cases, etc | 13:47 |
| samueldmq | dstanek, if you are looking at the test code, what I said is related to the @wip there | 13:47 |
| marekd | dolphm: probably most of the service would survive without user_name, whereas none would be fine without user_id | 13:48 |
| dolphm | marekd: i think there's value in "reducing" the identity of a user to be merely a token -- however, that's difficult when you're using bearer tokens, because you're "identity" is trivial to outright steal | 13:48 |
| marekd | dolphm: what about billing and security areas? | 13:48 |
| dolphm | marekd: those are the good questions :) | 13:48 |
| *** yottatsa has joined #openstack-keystone | 13:49 | |
| *** browne has joined #openstack-keystone | 13:49 | |
| dolphm | marekd: auditing comes back to keystone, i don't think other services have any real need for user IDs for security purposes (if they do, i'd love to know about it). billing should come back to tenancy, not individual users | 13:49 |
| marekd | dolphm: well, unless there is something i am missing (like some tables i am not aware of) i think as a bug fix i can only extend (once again) fernet payload with the users name and start investigaing ideas you just presented. | 13:50 |
| dstanek | samueldmq: why would you put caching data in our entity models? it should be separate concerns | 13:50 |
| *** abhirc has quit IRC | 13:50 | |
| marekd | dolphm: so you'd like to see tokens with just a set of roles and scoped project? | 13:51 |
| marekd | withou identity part? | 13:51 |
| samueldmq | dstanek, in the case of policy (the implemeted solution today) we need a copy to make the distribution consistent | 13:51 |
| dstanek | samueldmq: i totally agree. do the bare minimum needed by HP public cloud to deploy to production | 13:51 |
| dstanek | samueldmq: any copies for caching purposes should not change our existing models | 13:52 |
| samueldmq | dstanek, and we then need a validity (cache control?) to realize if the copy is expired | 13:52 |
| samueldmq | dstanek, if we accept the small incosistency, we won't have changes in the model at all | 13:52 |
| samueldmq | dstanek, yes, I will check with gyee the minimum needed for them | 13:53 |
| dstanek | samueldmq: and get the % likely hood that they'll deploy it. he should get a commitment from those folks too. i don't want to rush something through if nobody is going to use it anyway | 13:54 |
| samueldmq | dstanek, it shouldn't be a silver-bullet, and can't | 13:54 |
| dstanek | samueldmq: once you decide you want to cache stuff then you have to accept some level of eventual consistency. that's just how it is | 13:54 |
| dolphm | marekd: i think it'd be a super interesting experiment, yes | 13:55 |
| samueldmq | dstanek, yes, and trying to reduce it as much as we could with that solution isn't worth it (at least for now) | 13:55 |
| *** Kiall has left #openstack-keystone | 13:56 | |
| dolphm | marekd: if it truly can't be done, i'd like to know why (i'm not aware of any hard technical blockers, just preconceptions and conventions that must be broken) | 13:57 |
| *** thiagop_afk has joined #openstack-keystone | 13:59 | |
| *** thiagop_afk is now known as thiagop | 13:59 | |
| *** fhubik has quit IRC | 13:59 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/keystonemiddleware: Allow to use oslo.config without global CONF https://review.openstack.org/208965 | 13:59 |
| samueldmq | dolphm, quick question .. what's the advantage of a token with some information in comparison to uuid tokens ? | 13:59 |
| samueldmq | dolphm, if one needs to check the token's validity against keystone anyway | 14:00 |
| marekd | samueldmq: like fernet vs uuid ? | 14:00 |
| marekd | samueldmq: you don't need to query potentially huge token tables | 14:00 |
| samueldmq | marekd, yeah, anyone vs uuid | 14:00 |
| marekd | so my understanding is that it;s still better to rebuild the identity by quering user/project/domain/roles (fernet case) table rather than humongous token tables (uuid case). dolphm correct me if i am wrong. | 14:01 |
| lbragstad | marekd: correct, and you also have to think about replication issues with uuid tokens if you have a distributed keystone deployment | 14:02 |
| marekd | lbragstad: another good reason. | 14:03 |
| samueldmq | and how does validation occur ? | 14:03 |
| marekd | I think it was Ken Savich giving a numbers of reqs/minut. It was roughly 1 user change per minute to 10s or 100s of token related reqs/minute. | 14:03 |
| lbragstad | as long as you do your fernet key rotation properly, you'll always have zero wait time validating tokens across regions | 14:03 |
| samueldmq | in the uuid case, it looks in the table | 14:03 |
| samueldmq | for fernet, it checks using the fernet keys ? | 14:04 |
| lbragstad | samueldmq: when keystone gets a fernet token, it uses a set of keys to decrypt the payload | 14:04 |
| dolphm | samueldmq: never having to make a write when you issue a token | 14:04 |
| lbragstad | samueldmq: then the payload is reconstructed to build token data | 14:04 |
| lbragstad | ^ yet another good reason | 14:04 |
| samueldmq | sounds like N-birds with a single stone | 14:05 |
| dolphm | samueldmq: it's quite similar to PKI, but having learned the lessons of PKI, they're as small as possible | 14:05 |
| dolphm | samueldmq: validation is a matter of verifying & unpacking the fernet token, rebuilding the authorization context from scratch, verifying the revocation state, and you're done | 14:06 |
| dolphm | samueldmq: whereas with UUID, it's a single read from the database. "does this token exist?" if so, you've got the authorization context and you know it hasn't been revoked | 14:07 |
| dolphm | samueldmq: with PKI[z], it's verifying & unpacking the token, verifying the revocation state, and returning the unpacked contents | 14:08 |
| samueldmq | dolphm, verifying & unpacking implies on the tokne is valid (usign the proper keys to do so), after that, check is it's revoked, that's all right | 14:08 |
| dolphm | samueldmq: so, both UUID and PKI[z] are faster to validate... but we're hoping to minimize the difference by optimizing our cache usage | 14:08 |
| openstackgerrit | Nikita Konovalov proposed openstack/python-keystoneclient: Fix logging of binary contentent in request https://review.openstack.org/183514 | 14:09 |
| lbragstad | dolphm: speaking of the cache thing, I dug into that last night | 14:09 |
| lbragstad | specifically the roles part | 14:10 |
| samueldmq | dolphm, lbragstad do fernet tokens contain identity information ? | 14:10 |
| marekd | samueldmq: yes | 14:11 |
| samueldmq | hmm, so identity info would only be needed for authn in the identity crud (user/group), but that's in keystone anyway, and we could retrieve that easily (I think) | 14:12 |
| marekd | https://github.com/openstack/keystone/blob/master/keystone/token/providers/fernet/token_formatters.py#L107 | 14:12 |
| samueldmq | for example, one can only update user if it is himself | 14:12 |
| *** geoffarnold has quit IRC | 14:15 | |
| dolphm | lbragstad: ooh, yes? | 14:15 |
| *** petertr7_away is now known as petertr7 | 14:15 | |
| marekd | dolphm: i am thinking about what you had proposed and -in the end it doesn't really matter if I steal your token with attribute "user_id: dolph" present in the token or not. Eventually you will pay for that as i will be utiliing your resources. | 14:21 |
| marekd | dolphm: now i am thinking about keeping the same level of traceability - here some kind of link between a token and a cadf event (or notification) would be required. | 14:22 |
| marekd | dolphm: cause even as a manager who runs some workloads on public cloud i want to be able to trace who in my team spinned so many VMs so i need to pay for this no". | 14:22 |
| marekd | now. | 14:23 |
| marekd | probably we could then swtich from 'identity' part to 'audit_id' and that could be a link and a way to determine ownership | 14:24 |
| *** topol has joined #openstack-keystone | 14:25 | |
| *** ChanServ sets mode: +v topol | 14:25 | |
| samueldmq | dolphm, lbragstad no db read, but it needs to read the keys form the disk anyway, right ? | 14:28 |
| *** mylu has joined #openstack-keystone | 14:28 | |
| dolphm | samueldmq: no db read when? | 14:29 |
| samueldmq | dolphm, token validation | 14:29 |
| samueldmq | dolphm, still talking about fernet :) | 14:29 |
| dolphm | marekd: and yes, we read keys from disk on every validate. i wrote a patch to keep them in memory but there was no performance difference, and the difference in behavior isn't totally desirable during live rotation | 14:29 |
| dolphm | samueldmq: in what scenario are you asking about no db reads? | 14:29 |
| samueldmq | dolphm, fernet token validation (as you said above) | 14:30 |
| dolphm | samueldmq: there are plenty of db reads during validation | 14:30 |
| dolphm | marekd: ++ | 14:30 |
| lbragstad | dolphm: yeah, (got distracted) | 14:30 |
| dolphm | lbragstad: squirrel! | 14:30 |
| lbragstad | dolphm: exactly | 14:30 |
| dolphm | lbragstad: what's the scoop on role assignment caching? | 14:31 |
| dims | folks, fyi, fuel folks were working on moving from keystone+eventlet (in stable/juno) to keystone+apache (in stable/kilo) and we had to run a bunch of test scenarios to find the right configuration that would work for us. summary email is on the dev list - http://markmail.org/message/q4jl2ptrghycsz2j | 14:31 |
| lbragstad | dolphm: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L260 | 14:31 |
| lbragstad | dolphm: from the token provider API, we call get_roles_for_user_and_domain and get_roles_for_user_and_project | 14:32 |
| samueldmq | dolphm, what if we stored a keystone-manage generated hash_key in the bd, and the fernet keys would be generated based on that, so even ha installations would have keystones generating the same keys, without the need to get them from disk | 14:32 |
| lbragstad | I'm not sure where we call the get_user_roles methods with all the kwargs we talked about yesterday | 14:32 |
| samueldmq | dolphm, if that makes sense | 14:32 |
| lbragstad | dolphm: regardless, I put caching on those two calls and a bunch of stuff broke | 14:32 |
| rodrigods | easy review for anyone with review slots available https://review.openstack.org/#/c/215167/ | 14:33 |
| dolphm | lbragstad: broken implementation, or broken tests? | 14:33 |
| lbragstad | dolphm: broken tests | 14:33 |
| *** mylu has quit IRC | 14:33 | |
| *** piyanai has joined #openstack-keystone | 14:33 | |
| dolphm | lbragstad: disable caching in the tests? | 14:33 |
| dolphm | lbragstad: you can do it just for assignments | 14:34 |
| lbragstad | dolphm: which I assume is because we don't do .invalidate() calls on role assignments | 14:34 |
| dolphm | [assignments] should_cache = false or something | 14:34 |
| lbragstad | dolphm: I added a utility for tests here - https://review.openstack.org/#/c/215212/ | 14:34 |
| dolphm | samueldmq: you want to store the source of encryption keys that are used for creating and validating tokens, in plaintext in the database? | 14:35 |
| *** mylu has joined #openstack-keystone | 14:35 | |
| samueldmq | dolphm, how is that today ? isn't the database expected to be "safe" ? | 14:36 |
| dolphm | samueldmq: ha | 14:36 |
| dolphm | samueldmq: i think anyone who watches the news will tell you that no information stored in a database is safe | 14:36 |
| samueldmq | dolphm, :( | 14:38 |
| samueldmq | dolphm, but if it was the case, that would be a good improvement, wouldn't it ? | 14:38 |
| *** mylu has quit IRC | 14:38 | |
| dolphm | samueldmq: an improvement on what problem, exactly? | 14:39 |
| *** piyanai has quit IRC | 14:39 | |
| samueldmq | dolphm, avoiding to read the keys from disk | 14:39 |
| dolphm | samueldmq: why is that a problem? | 14:39 |
| samueldmq | dolphm, hmm, I'm problem mixing disk hit vs db hit concerns | 14:40 |
| samueldmq | dolphm, disk hit isn't expensive, db hit is | 14:41 |
| samueldmq | is that right ? | 14:41 |
| dolphm | samueldmq: they are magnitudes different, yes | 14:41 |
| *** piyanai has joined #openstack-keystone | 14:42 | |
| samueldmq | dolphm, cool, I was solving a problem that doesn't exist | 14:42 |
| dolphm | samueldmq: if we were talking about a scenario with zero database reads, a disk read *might* end up being your most expensive I/O, but we're far from that situation in this case | 14:42 |
| *** piyanai has quit IRC | 14:43 | |
| samueldmq | dolphm, k so what db hits we do in a token validation, for example | 14:43 |
| dolphm | samueldmq: and then throw in solid state storage with 350-3000+ MB/s read throughput, and it's even less of a problem | 14:44 |
| dolphm | samueldmq: gathering the list of roles that belong in a token, for example | 14:44 |
| samueldmq | dolphm, do we need to re-check the role assignments ? if keystone encrypted and decrypted, that could be taken as something true, i.e no need to check in the db again if it was me that generated | 14:44 |
| samueldmq | dolphm, if a role assignment was deleted in the meantime, just wait the token to expire | 14:45 |
| *** mylu has joined #openstack-keystone | 14:45 | |
| dolphm | samueldmq: you're welcome to convince users that's how it should work, but token revocation events solve that problem quite elegantly | 14:45 |
| samueldmq | dolphm, like : "I am giving you this token and it's valid until it's expiry date" :) | 14:46 |
| samueldmq | its expiration date* | 14:46 |
| dolphm | samueldmq: "but i deleted the role assignment, why is the token still valid? this is a security vulnerability. what if i'm being attacked by a malicious user? how do i mitigate?" | 14:47 |
| samueldmq | dolphm, kill him | 14:48 |
| *** mylu has quit IRC | 14:48 | |
| samueldmq | :-) | 14:48 |
| lbragstad | dolphm: this is the path that I was on yesterday with the role caching - http://cdn.pasteraw.com/eehj4xfbngezfgf1plf25vzs1ayrynh | 14:49 |
| dolphm | lbragstad: ++ | 14:49 |
| dolphm | lbragstad: you also need to invalidate get_roles_for_user_and_domain and get_roles_for_user_and_project directly | 14:50 |
| samueldmq | dolphm, yes and revocation events are in db.. but we don't hit db for both i) role assignment checking & ii) revocation events check, do we ? | 14:52 |
| lbragstad | dolphm: AttributeError: 'function' object has no attribute 'invalidate' | 14:52 |
| *** mylu has joined #openstack-keystone | 14:52 | |
| samueldmq | dolphm, I'd expect to only do ii) revocation events check, since role assignment deletion should generate a recocation event already | 14:52 |
| dolphm | samueldmq: revocation events are cached today | 14:53 |
| dolphm | lbragstad: ? but you memoized it... | 14:53 |
| *** piyanai has joined #openstack-keystone | 14:53 | |
| lbragstad | http://cdn.pasteraw.com/gsajudazf9wl9xyf0piaj54zm7kmpel -- dolphm | 14:54 |
| lbragstad | dolphm: yeah, looks like some ground work might be missing for grants to use .invalidate? | 14:54 |
| * lbragstad is a cache noob | 14:54 | |
| *** mylu has quit IRC | 14:54 | |
| dolphm | lbragstad: if domain_id: self.get_roles_for_user_and_domain.invalidate(self, user_id, domain_id) | 14:55 |
| dolphm | lbragstad: if user_id and domain_id: ** | 14:55 |
| *** jorge_munoz has joined #openstack-keystone | 14:55 | |
| *** mylu has joined #openstack-keystone | 14:55 | |
| samueldmq | dolphm, nice, thanks for the explanations | 14:55 |
| samueldmq | dolphm, too many things to learn in keystone | 14:55 |
| dolphm | samueldmq: it's complicated :( | 14:55 |
| samueldmq | dolphm, no fun if it was easy (implies in solving easy problems) | 14:56 |
| *** zzzeek has joined #openstack-keystone | 14:57 | |
| *** mylu_ has joined #openstack-keystone | 14:58 | |
| *** mylu_ has quit IRC | 14:59 | |
| *** mylu has quit IRC | 14:59 | |
| *** henrynash has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +v henrynash | 15:00 | |
| *** geoffarnold has joined #openstack-keystone | 15:00 | |
| *** petertr7 is now known as petertr7_away | 15:02 | |
| *** r-daneel has joined #openstack-keystone | 15:02 | |
| lbragstad | dolphm: ok, so for reference, with @memoize (in the diff I just pasted), I get 41 failed tests, rerunning the with lines you suggested above | 15:02 |
| *** e0ne has joined #openstack-keystone | 15:03 | |
| *** samueldmq has quit IRC | 15:03 | |
| dolphm | lbragstad: fwiw, anything you wrap with @MEMOIZE will try to hit a cache keyed by that function and those arguments. so whenever you do something that affects the state of the database (or whatever the source of truth is), you have to invalidate *all* applicable caches (which gets super convoluted very quickly if you're caching all the things. | 15:04 |
| dolphm | ) | 15:04 |
| lbragstad | ahh, yeah.. I can see that. | 15:04 |
| lbragstad | dolphm: running tests against http://cdn.pasteraw.com/chh8ytbnnnw3wha09rpy9db8qebgs1o to see how much it helps my 41 failed tests. | 15:05 |
| dolphm | lbragstad: https://twitter.com/codinghorror/status/506010907021828096 | 15:06 |
| marekd | ++ | 15:06 |
| dolphm | "There are only two hard problems in distributed systems: 2. Exactly-once delivery 1. Guaranteed order of messages 2. Exactly-once delivery" -- Mathias Verraes | 15:07 |
| lbragstad | ++ | 15:07 |
| *** e0ne has quit IRC | 15:07 | |
| lbragstad | dolphm: 41 fails went to 38 fails #progress | 15:07 |
| *** narengan has joined #openstack-keystone | 15:08 | |
| *** e0ne has joined #openstack-keystone | 15:08 | |
| *** pgbridge has quit IRC | 15:08 | |
| dolphm | lbragstad: if we actually run with caching enabled everywhere in tests, we must have pretty good cache invalidation right now | 15:08 |
| lbragstad | dolphm: actually, i think that breaks tests? http://cdn.pasteraw.com/iyzdvhxbgsluv9ble6ky4twdhvdfoff | 15:10 |
| lbragstad | just digging into one of the arbitrary errors https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_auth.py | 15:11 |
| dolphm | lbragstad: "role not found" is broken speak for "role assignment not found" btw | 15:11 |
| lbragstad | oh, that's good to know | 15:12 |
| lbragstad | that makes sense, since i'm invalidating grants | 15:12 |
| dolphm | lbragstad: the exception RoleNotFound is overloaded for both uses | 15:12 |
| *** csoukup has joined #openstack-keystone | 15:12 | |
| *** geoffarnold is now known as geoffarnoldX | 15:13 | |
| *** geoffarnoldX has quit IRC | 15:14 | |
| lbragstad | dolphm: hmm, so the strange part is that test fails *before* the delete_grant call happens | 15:14 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 15:16 |
| *** geoffarnold has joined #openstack-keystone | 15:17 | |
| dolphm | lbragstad: then you probably need to invalidate the cache somewhere else, too | 15:17 |
| dolphm | lbragstad: what's it calling earlier that would affect the results of the newly cached calls? | 15:18 |
| dolphm | lbragstad: debug by removing one of the @MEMOIZE at a time | 15:18 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Respect federated user name in tokens. https://review.openstack.org/211093 | 15:18 |
| marekd | lbragstad: ^^ for ya | 15:18 |
| lbragstad | marekd: first patch looks good, thanks for the quick turn around | 15:19 |
| marekd | lbragstad: sure | 15:19 |
| *** ngupta has joined #openstack-keystone | 15:19 | |
| lbragstad | dolphm: there must be something in the trust chain that invalidates it | 15:20 |
| *** ngupta has quit IRC | 15:20 | |
| *** urulama has quit IRC | 15:20 | |
| *** urulama has joined #openstack-keystone | 15:21 | |
| marekd | dstanek: https://review.openstack.org/#/c/215221/ - care for a review? I feel you may have something to say in that matter (esp. implementation) | 15:21 |
| *** bapalm has joined #openstack-keystone | 15:21 | |
| marekd | dolphm: lbragstad BTW - where dis magic upper boundary for fernet size - 255 bytes comes from? | 15:22 |
| dolphm | marekd: experience | 15:23 |
| *** ngupta has joined #openstack-keystone | 15:23 | |
| marekd | + the closest power of 2 (well, almost 256) ? :-) | 15:23 |
| *** mylu has joined #openstack-keystone | 15:25 | |
| * dolphm ahh, the smell of pizza at 10:25am | 15:25 | |
| *** geoffarnold is now known as geoffarnoldX | 15:26 | |
| *** geoffarnoldX is now known as geoffarnold | 15:26 | |
| *** geoffarnold has quit IRC | 15:26 | |
| *** petertr7_away is now known as petertr7 | 15:28 | |
| *** e0ne has quit IRC | 15:29 | |
| dstanek | marekd: shore | 15:31 |
| dolphm | marekd: dstanek: i helped too | 15:31 |
| dstanek | dolphm: don't cry :-) | 15:33 |
| lbragstad | dolphm: pizza?! | 15:37 |
| lbragstad | dolphm: are you at castle!? | 15:37 |
| dolphm | lbragstad: no lol | 15:37 |
| *** ankita_wagh has joined #openstack-keystone | 15:38 | |
| dstanek | lbragstad: pizza? food truck pizza? | 15:42 |
| lbragstad | dstanek: food truck bbq | 15:42 |
| lbragstad | dstanek: I've been thinking about bbq since about 9... | 15:42 |
| dolphm | lbragstad: i did that chopped brisket sandwich on tuesday... | 15:43 |
| lbragstad | dstanek: I feel like pavlov's dog, but for bbq, | 15:43 |
| dstanek | lbragstad: i love that pizza truck! | 15:43 |
| lbragstad | dolphm: I tried that for the first time last week (glorious) | 15:43 |
| *** mestery has joined #openstack-keystone | 15:43 | |
| *** mestery is now known as mestery_afk | 15:44 | |
| *** pnavarro has quit IRC | 15:45 | |
| *** gyee has joined #openstack-keystone | 15:46 | |
| *** ChanServ sets mode: +v gyee | 15:46 | |
| lbragstad | dstanek: don't you get in this week? | 15:47 |
| *** _cjones_ has joined #openstack-keystone | 15:47 | |
| *** _cjones_ has quit IRC | 15:47 | |
| *** lhcheng has joined #openstack-keystone | 15:47 | |
| *** ChanServ sets mode: +v lhcheng | 15:47 | |
| *** _cjones_ has joined #openstack-keystone | 15:47 | |
| *** yottatsa has quit IRC | 15:52 | |
| dstanek | lbragstad: the 30th i think | 15:53 |
| lbragstad | dstanek: sweet | 15:53 |
| *** geoffarnold has joined #openstack-keystone | 15:54 | |
| lbragstad | dolphm: so caching user/project role assignments is what breaks that test, (I removed the caching and invalidation and the test passed) - digging into the trust stuff | 15:54 |
| *** abhirc has joined #openstack-keystone | 15:55 | |
| *** narengan_ has joined #openstack-keystone | 15:55 | |
| *** narengan has quit IRC | 15:58 | |
| lbragstad | dolphm: and here is where the caching happens - https://github.com/openstack/keystone/blob/master/keystone/trust/controllers.py#L183 | 15:58 |
| *** yottatsa has joined #openstack-keystone | 16:00 | |
| *** yottatsa has quit IRC | 16:01 | |
| *** jistr has quit IRC | 16:05 | |
| *** yottatsa has joined #openstack-keystone | 16:05 | |
| *** petertr7 is now known as petertr7_away | 16:07 | |
| *** yottatsa has quit IRC | 16:08 | |
| *** yottatsa has joined #openstack-keystone | 16:10 | |
| *** ankita_wagh has quit IRC | 16:11 | |
| *** thiagop_ has joined #openstack-keystone | 16:12 | |
| *** shaleh has joined #openstack-keystone | 16:13 | |
| *** kiran-r has joined #openstack-keystone | 16:15 | |
| *** kiran-r has quit IRC | 16:15 | |
| _cjones_ | Question for the keystone folks. How do you get the keystone password to become redacted during oslo_cfg time? | 16:16 |
| *** esp has left #openstack-keystone | 16:17 | |
| *** henrynash has quit IRC | 16:18 | |
| *** urulama has quit IRC | 16:19 | |
| morgan_2549 | In the log? And ... Is it not? | 16:20 |
| *** roxanaghe has joined #openstack-keystone | 16:21 | |
| _cjones_ | morgan_2549 Correct. In the log, and yes it is. I'm just trying to figure out *how* you did it? | 16:23 |
| morgan_2549 | There is an argument "secret" in the option definition (i think) | 16:23 |
| morgan_2549 | It happens at opt definition time for sure. | 16:23 |
| *** yottatsa has quit IRC | 16:24 | |
| _cjones_ | morgan_2549: Awesome. Quick git grep pulls it up. Thanks. | 16:26 |
| morgan_2549 | :) | 16:26 |
| morgan_2549 | Happy to help! | 16:26 |
| *** dims is now known as dimsum__ | 16:26 | |
| *** yottatsa has joined #openstack-keystone | 16:27 | |
| *** browne has quit IRC | 16:29 | |
| *** yottatsa has quit IRC | 16:29 | |
| *** yottatsa has joined #openstack-keystone | 16:30 | |
| *** browne has joined #openstack-keystone | 16:32 | |
| *** thiagop_ has quit IRC | 16:36 | |
| *** yottatsa has quit IRC | 16:40 | |
| *** browne has quit IRC | 16:41 | |
| *** AlexeyElagin has quit IRC | 16:41 | |
| *** yottatsa has joined #openstack-keystone | 16:42 | |
| *** ankita_wagh has joined #openstack-keystone | 16:42 | |
| *** woodster_ has joined #openstack-keystone | 16:43 | |
| *** narengan_ has quit IRC | 16:43 | |
| *** baffle__ has joined #openstack-keystone | 16:48 | |
| *** baffle__ has quit IRC | 16:48 | |
| *** ankita_wagh has quit IRC | 16:49 | |
| *** ankita_wagh has joined #openstack-keystone | 16:50 | |
| *** jecarey has quit IRC | 16:52 | |
| *** piyanai has quit IRC | 16:53 | |
| *** ankita_wagh has quit IRC | 16:54 | |
| *** tjcocozz_ has quit IRC | 16:58 | |
| *** esp has joined #openstack-keystone | 16:59 | |
| *** kiran-r has joined #openstack-keystone | 17:02 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystone: Add region_id filter for List Endpoints API https://review.openstack.org/215378 | 17:03 |
| *** abhirc has quit IRC | 17:06 | |
| *** shoutm has quit IRC | 17:08 | |
| *** ankita_wagh has joined #openstack-keystone | 17:08 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add caching to role assignments https://review.openstack.org/215715 | 17:08 |
| *** yottatsa has quit IRC | 17:09 | |
| *** ankita_wagh has quit IRC | 17:09 | |
| *** piyanai has joined #openstack-keystone | 17:11 | |
| *** lsmola has quit IRC | 17:13 | |
| *** ankita_wagh has joined #openstack-keystone | 17:15 | |
| *** piyanai has quit IRC | 17:21 | |
| *** piyanai has joined #openstack-keystone | 17:24 | |
| *** browne has joined #openstack-keystone | 17:26 | |
| *** albertom has quit IRC | 17:26 | |
| *** mylu has quit IRC | 17:27 | |
| *** mylu has joined #openstack-keystone | 17:28 | |
| *** albertom has joined #openstack-keystone | 17:29 | |
| *** vivekd has joined #openstack-keystone | 17:30 | |
| *** abhirc has joined #openstack-keystone | 17:30 | |
| *** piyanai has quit IRC | 17:32 | |
| *** mylu has quit IRC | 17:32 | |
| *** mylu_ has joined #openstack-keystone | 17:33 | |
| *** piyanai has joined #openstack-keystone | 17:34 | |
| *** bradjones has quit IRC | 17:37 | |
| *** bradjones has joined #openstack-keystone | 17:38 | |
| *** bradjones has quit IRC | 17:38 | |
| *** bradjones has joined #openstack-keystone | 17:38 | |
| *** vivekd has quit IRC | 17:43 | |
| *** aix has quit IRC | 17:49 | |
| *** annasort has joined #openstack-keystone | 17:53 | |
| *** tjcocozz_ has joined #openstack-keystone | 17:54 | |
| *** ayoung has joined #openstack-keystone | 18:03 | |
| *** ChanServ sets mode: +v ayoung | 18:03 | |
| *** jeffDeville has joined #openstack-keystone | 18:04 | |
| *** ankita_wagh has quit IRC | 18:08 | |
| *** petertr7_away is now known as petertr7 | 18:12 | |
| *** albertom has quit IRC | 18:18 | |
| *** boris-42 has quit IRC | 18:20 | |
| *** albertom has joined #openstack-keystone | 18:22 | |
| *** pgbridge has joined #openstack-keystone | 18:22 | |
| morgan_2549 | Mmm friday | 18:32 |
| *** stevemar has joined #openstack-keystone | 18:38 | |
| *** ChanServ sets mode: +v stevemar | 18:38 | |
| *** stevemar has quit IRC | 18:38 | |
| *** albertom has quit IRC | 18:39 | |
| *** kiran-r has quit IRC | 18:39 | |
| *** stevemar has joined #openstack-keystone | 18:41 | |
| *** ChanServ sets mode: +v stevemar | 18:41 | |
| *** e0ne has joined #openstack-keystone | 18:43 | |
| *** albertom has joined #openstack-keystone | 18:46 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:49 |
| *** mpmsimo has joined #openstack-keystone | 18:52 | |
| *** ankita_wagh has joined #openstack-keystone | 18:53 | |
| dstanek | this channel has been dead... | 18:53 |
| *** henrynash has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v henrynash | 18:54 | |
| *** abhirc has quit IRC | 18:55 | |
| raildo | dstanek: :( | 18:57 |
| *** tsymanczyk has quit IRC | 19:02 | |
| *** tsymanczyk has joined #openstack-keystone | 19:04 | |
| *** tsymanczyk is now known as Guest27567 | 19:04 | |
| *** ngupta has quit IRC | 19:08 | |
| * morgan_2549 dies in the channel | 19:10 | |
| * morgan_2549 stinks up the place decomposing. | 19:10 | |
| *** mpmsimo has quit IRC | 19:10 | |
| roxanaghe | :)) | 19:10 |
| raildo | let's make a party! \o/ | 19:12 |
| htruta | raildo: go home, you're drunk | 19:13 |
| raildo | htruta: haha unfortunately, i'm not... | 19:13 |
| *** raildo is now known as raildo-afk | 19:15 | |
| *** e0ne has quit IRC | 19:18 | |
| *** richm has quit IRC | 19:21 | |
| *** e0ne has joined #openstack-keystone | 19:42 | |
| *** alejandrito has quit IRC | 19:48 | |
| dolphm | dstanek: that's because it's national poets day | 19:51 |
| *** e0ne has quit IRC | 19:53 | |
| *** raildo-afk is now known as raildo | 19:53 | |
| *** mylu_ has quit IRC | 19:55 | |
| dstanek | there one was a man from nantucket | 19:55 |
| dstanek | oh wait that a nsfw lymerick... | 19:56 |
| *** ankita_w_ has joined #openstack-keystone | 19:56 | |
| *** mylu has joined #openstack-keystone | 19:56 | |
| *** mylu has quit IRC | 19:56 | |
| *** ankita_w_ has quit IRC | 19:56 | |
| *** ankita_w_ has joined #openstack-keystone | 19:57 | |
| *** mylu has joined #openstack-keystone | 19:57 | |
| *** Guest27567 has quit IRC | 19:57 | |
| *** ankita_w_ has quit IRC | 19:57 | |
| *** ankita_w_ has joined #openstack-keystone | 19:58 | |
| *** boris-42 has joined #openstack-keystone | 19:58 | |
| *** ankita_w_ has quit IRC | 19:58 | |
| *** ankita_w_ has joined #openstack-keystone | 19:59 | |
| *** ankita_wagh has quit IRC | 19:59 | |
| *** ankita_w_ has quit IRC | 19:59 | |
| *** ankita_wagh has joined #openstack-keystone | 19:59 | |
| *** narengan has joined #openstack-keystone | 20:01 | |
| *** iurygregory has quit IRC | 20:03 | |
| *** petertr7 is now known as petertr7_away | 20:05 | |
| *** kiran-r has joined #openstack-keystone | 20:06 | |
| *** lhcheng has quit IRC | 20:14 | |
| *** tsymanczyk has joined #openstack-keystone | 20:20 | |
| *** tsymanczyk is now known as Guest58012 | 20:20 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Unit tests for is_domain field in project's table https://review.openstack.org/212045 | 20:23 |
| htruta | henrynash: here you go | 20:24 |
| htruta | ^ | 20:24 |
| *** richm has joined #openstack-keystone | 20:26 | |
| htruta | henrynash: did you know that rodrigods left us? :( | 20:27 |
| *** iurygregory has joined #openstack-keystone | 20:27 | |
| _cjones_ | dstanek: Who kept all his cash in a bucket. | 20:27 |
| *** Guest58012 has quit IRC | 20:31 | |
| stevemar | rodrigods: https://bugs.launchpad.net/python-keystoneclient/+bug/1487600 | 20:33 |
| openstack | Launchpad bug 1487600 in python-openstackclient "add support for 'is_domain' for keystone projects" [Undecided,New] | 20:33 |
| *** albertom has quit IRC | 20:34 | |
| htruta | stevemar: cool. this was in my todo list | 20:34 |
| htruta | stevemar: btw, is this a bug? | 20:34 |
| htruta | ps: rodrigods is not working with is_domain related stuff anymore :/ | 20:35 |
| stevemar | htruta: i had to open it because it was breaking the osc gate :) | 20:35 |
| stevemar | nooooo | 20:35 |
| stevemar | well, i didn't want to open blueprints for both ksc and osc | 20:35 |
| stevemar | where is linnnnn | 20:36 |
| stevemar | lhcheng nooo | 20:36 |
| *** tsymancz1k has joined #openstack-keystone | 20:36 | |
| htruta | stevemar: but how does it break the gate? we don't allow the creation os is_domain=True projects | 20:37 |
| htruta | not through the api | 20:37 |
| stevemar | https://review.openstack.org/#/c/209654/ and | 20:37 |
| stevemar | http://logs.openstack.org/54/209654/8/check/gate-osc-dsvm-functional/fbd18e7/console.html#_2015-08-21_19_26_23_317 | 20:37 |
| stevemar | it still gets printed when you return a project | 20:37 |
| stevemar | "show" | 20:38 |
| stevemar | probably in list too | 20:38 |
| htruta | stevemar: hm. got it | 20:38 |
| stevemar | you guys aren't filtering it out | 20:38 |
| stevemar | wait a tick, rodrigods left?! | 20:38 |
| stevemar | where? | 20:38 |
| htruta | rodrigods won't work with openstack anymore | 20:38 |
| htruta | today was his last day | 20:39 |
| iurygregory | sad day for us htruta =/ | 20:39 |
| stevemar | oh noes | 20:39 |
| *** lhcheng has joined #openstack-keystone | 20:39 | |
| *** ChanServ sets mode: +v lhcheng | 20:39 | |
| stevemar | sad day for us all :( | 20:39 |
| iurygregory | :'( | 20:39 |
| stevemar | he graduate? | 20:39 |
| htruta | stevemar: not that sad... we asked him if he'd miss us... and he said he won't | 20:39 |
| stevemar | lol | 20:40 |
| stevemar | "screw you all" | 20:40 |
| htruta | lol | 20:40 |
| raildo | :'( | 20:40 |
| htruta | he was already graduated | 20:40 |
| htruta | he was just tired of us all heh | 20:41 |
| iurygregory | he was promoted | 20:41 |
| raildo | It's not easy work with htruta haha | 20:41 |
| *** albertom has joined #openstack-keystone | 20:42 | |
| iurygregory | raildo, ++ | 20:42 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for projects acting as domains https://review.openstack.org/213448 | 20:42 |
| htruta | stevemar: so, any is_domain/reseller stuff, you can address to me | 20:44 |
| htruta | cc henrynash | 20:44 |
| raildo | htruta: to us :) | 20:44 |
| htruta | yep :-) | 20:44 |
| stevemar | heeh | 20:45 |
| stevemar | you guys are funny :P | 20:45 |
| stevemar | i'm outta here for now, going to hide offline | 20:45 |
| *** stevemar has left #openstack-keystone | 20:45 | |
| *** stevemar has quit IRC | 20:45 | |
| *** _kiran_ has joined #openstack-keystone | 20:47 | |
| *** kiran-r has quit IRC | 20:48 | |
| *** ankita_wagh has quit IRC | 20:48 | |
| *** _kiran_ is now known as kiran-r | 20:49 | |
| *** ankita_wagh has joined #openstack-keystone | 20:49 | |
| *** ankita_w_ has joined #openstack-keystone | 20:50 | |
| *** ankita_wagh has quit IRC | 20:50 | |
| *** thiagop has quit IRC | 20:53 | |
| *** topol has quit IRC | 20:55 | |
| *** topol has joined #openstack-keystone | 20:57 | |
| *** ChanServ sets mode: +v topol | 20:57 | |
| *** pnavarro has joined #openstack-keystone | 20:58 | |
| *** mylu has quit IRC | 21:00 | |
| *** topol has quit IRC | 21:01 | |
| *** raildo is now known as raildo-afk | 21:01 | |
| *** pnavarro has quit IRC | 21:03 | |
| *** jeffDeville has quit IRC | 21:12 | |
| *** piyanai has quit IRC | 21:15 | |
| *** pnavarro has joined #openstack-keystone | 21:16 | |
| *** piyanai has joined #openstack-keystone | 21:16 | |
| *** mylu has joined #openstack-keystone | 21:28 | |
| *** Raildo has joined #openstack-keystone | 21:29 | |
| morgan_2549 | dstanek: I think I have a pass [running tests etc] to move away from needing FakeLDAP | 21:32 |
| morgan_2549 | dstanek: unfortunatly it replaces the need for the python code with py4j | 21:32 |
| *** annasort has quit IRC | 21:33 | |
| morgan_2549 | dstanek: but that isn't awful it does mean tests need java runtime, but end of the world hardly and our LDAP code will be tested against an enforcing backend | 21:33 |
| morgan_2549 | ooooor not | 21:34 |
| morgan_2549 | wow | 21:34 |
| *** edmondsw has quit IRC | 21:34 | |
| morgan_2549 | spaaaaamy | 21:34 |
| *** tsymancz1k has quit IRC | 21:34 | |
| *** narengan has quit IRC | 21:36 | |
| *** tsymanczyk has joined #openstack-keystone | 21:38 | |
| *** tsymanczyk is now known as Guest57068 | 21:38 | |
| *** piyanai has quit IRC | 21:38 | |
| *** henrynash has quit IRC | 21:38 | |
| lhcheng | gyee: should we trigger cadf notification whenever tokenless x509 is used too? similar to what we have whenever a user authenticates. | 21:40 |
| *** r-daneel has quit IRC | 21:42 | |
| *** bradjones has quit IRC | 21:42 | |
| *** bradjones has joined #openstack-keystone | 21:43 | |
| *** bradjones has quit IRC | 21:43 | |
| *** bradjones has joined #openstack-keystone | 21:43 | |
| *** btully has joined #openstack-keystone | 21:44 | |
| *** abhirc has joined #openstack-keystone | 21:45 | |
| *** csoukup has quit IRC | 21:49 | |
| *** piyanai has joined #openstack-keystone | 21:49 | |
| *** ankita_wagh has joined #openstack-keystone | 21:51 | |
| *** ankita_w_ has quit IRC | 21:51 | |
| *** csoukup has joined #openstack-keystone | 21:52 | |
| gyee | lhcheng, yes we should, talking to Sam, he mentioned we've done it during mapping validation | 21:53 |
| gyee | I am not sure if we need to emit multiple CADF and aggregate them into a single event | 21:54 |
| *** hrou has quit IRC | 21:54 | |
| gyee | I need to pick the brains of our enterprise security folks to see how CADF is utilized in the field | 21:55 |
| *** geoffarnold is now known as geoffarnoldX | 21:56 | |
| *** gordc has quit IRC | 21:58 | |
| *** ajayaa has quit IRC | 22:01 | |
| *** Raildo has quit IRC | 22:02 | |
| *** zzzeek has quit IRC | 22:02 | |
| *** kiran-r has quit IRC | 22:07 | |
| *** geoffarnoldX is now known as geoffarnold | 22:14 | |
| *** ngupta has joined #openstack-keystone | 22:19 | |
| *** piyanai has quit IRC | 22:20 | |
| *** ngupta has quit IRC | 22:21 | |
| *** ngupta has joined #openstack-keystone | 22:21 | |
| *** pnavarro has quit IRC | 22:22 | |
| *** tjcocozz_ has quit IRC | 22:23 | |
| *** _cjones_ has quit IRC | 22:30 | |
| *** ankita_w_ has joined #openstack-keystone | 22:31 | |
| *** ankita_wagh has quit IRC | 22:34 | |
| *** csoukup has quit IRC | 22:35 | |
| *** ngupta has quit IRC | 22:42 | |
| *** alejandrito has joined #openstack-keystone | 22:46 | |
| *** jasonsb has quit IRC | 22:49 | |
| *** mylu has quit IRC | 22:53 | |
| *** mylu has joined #openstack-keystone | 22:54 | |
| *** mylu has quit IRC | 22:58 | |
| *** Guest57068 has quit IRC | 23:00 | |
| lhcheng | gyee: cool. we can check with stevemar too when he's around. | 23:04 |
| *** woodster_ has quit IRC | 23:09 | |
| *** abhirc has quit IRC | 23:12 | |
| *** shaleh has quit IRC | 23:17 | |
| *** abhirc has joined #openstack-keystone | 23:24 | |
| *** lhcheng has quit IRC | 23:25 | |
| *** ankita_w_ has quit IRC | 23:27 | |
| *** lhcheng has joined #openstack-keystone | 23:31 | |
| *** ChanServ sets mode: +v lhcheng | 23:31 | |
| *** claudiub has quit IRC | 23:31 | |
| *** lhcheng has quit IRC | 23:31 | |
| *** lhcheng has joined #openstack-keystone | 23:32 | |
| *** ChanServ sets mode: +v lhcheng | 23:32 | |
| *** ankita_wagh has joined #openstack-keystone | 23:34 | |
| *** mpmsimo has joined #openstack-keystone | 23:36 | |
| *** mylu has joined #openstack-keystone | 23:36 | |
| *** tsymanczyk has joined #openstack-keystone | 23:40 | |
| *** tsymanczyk is now known as Guest39233 | 23:41 | |
| *** geoffarnold has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!