| gyee | we are using a real LDAP server for the func tests right? like OpenLDAP? | 00:00 |
|---|---|---|
| morgan | we wont actually have to if we don't want | 00:00 |
| morgan | can use ldap_test library | 00:00 |
| morgan | we *can* use OpenLDAP | 00:00 |
| *** rm_work is now known as rm_work|away | 00:01 | |
| gyee | I have a script to automagically install OpenLDAP and populate it with some data | 00:01 |
| gyee | only works on Ubuntu though | 00:01 |
| morgan | with ldap_test you can do it all in python code | 00:01 |
| *** _cjones_ has quit IRC | 00:01 | |
| morgan | it's an in-mem LDAP spec server | 00:01 |
| morgan | it requires a jre, but that isn't the end of the world | 00:01 |
| gyee | I dunno man, ORCL's lawyers are ready to pounce :) | 00:02 |
| morgan | not my problem | 00:02 |
| morgan | :P | 00:02 |
| morgan | they can pounce on the upstream library | 00:02 |
| morgan | and we can pivot | 00:02 |
| morgan | since we're just using ldap-interface | 00:03 |
| gyee | hah, jre's not our problem | 00:03 |
| morgan | this is such a bs way of doing tests: | 00:04 |
| morgan | def test_configurable_forbidden_create_existing_user(self): | 00:05 |
| morgan | conf = self.get_config(CONF.identity.default_domain_id) | 00:05 |
| morgan | conf.ldap.user_allow_create = False | 00:05 |
| morgan | self.reload_backends(CONF.identity.default_domain_id) | 00:05 |
| morgan | do .setup then reload backends | 00:05 |
| morgan | rather than properly handling setup | 00:05 |
| *** samueldmq has quit IRC | 00:14 | |
| dstanek | gyee: ! | 00:14 |
| gyee | dstanek, yes sir | 00:18 |
| dstanek | got time for some easy reviews? | 00:18 |
| gyee | sure | 00:18 |
| dstanek | https://review.openstack.org/#/c/214346/ | 00:19 |
| dstanek | https://review.openstack.org/#/c/210478/ | 00:19 |
| gyee | oh, my favorite tempDir, now I need to update the patch on keystonemiddleware | 00:20 |
| dstanek | i've got plenty more where that came from | 00:20 |
| dstanek | https://review.openstack.org/#/c/199343/ | 00:22 |
| *** tellesnobrega_ has joined #openstack-keystone | 00:22 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** tellesnobrega_ has quit IRC | 00:23 | |
| *** tellesnobrega_ has joined #openstack-keystone | 00:23 | |
| *** tellesnobrega_ has quit IRC | 00:24 | |
| gyee | dstanek, for https://review.openstack.org/#/c/210478/5, can't we be a bit more forgiving? | 00:27 |
| gyee | like inspect the callback and ignore the self param? | 00:27 |
| dstanek | gyee: you mean allow unbound methods? | 00:28 |
| gyee | right | 00:28 |
| gyee | but I am fine with the error as well | 00:28 |
| dstanek | gyee: what would you pass in for self? | 00:28 |
| dstanek | also this is only a test showing the current behavior | 00:29 |
| dstanek | there was a small debate about whether or not it was possible and to win i wrote a test to show my position | 00:29 |
| *** topol has quit IRC | 00:30 | |
| gyee | k | 00:30 |
| gyee | dang it! colorizer used to be fun | 00:31 |
| gyee | oh well | 00:32 |
| dstanek | without some significant rework we don't know what instance to use anyway | 00:32 |
| dstanek | gyee: thx! | 00:33 |
| *** topol has joined #openstack-keystone | 00:33 | |
| *** ChanServ sets mode: +v topol | 00:33 | |
| gyee | dstanek, np | 00:34 |
| *** lhcheng is now known as lhcheng_away | 00:38 | |
| gyee | morgan, our LDAP group membership resolution code doesn't appear to support posixGroup. Would the be a bug or new feature? | 00:39 |
| morgan | uhmm | 00:39 |
| morgan | bug probably | 00:39 |
| gyee | k, let me file a bug and get it fix | 00:39 |
| gyee | what about nested group resolution? | 00:39 |
| *** mylu has quit IRC | 00:40 | |
| *** mylu has joined #openstack-keystone | 00:41 | |
| morgan | gyee: uh | 00:41 |
| morgan | feature i would think | 00:41 |
| morgan | gyee, dstanek: going to have a fairly easy review going up soon | 00:42 |
| dstanek | morgan: i'll be here | 00:42 |
| *** shoutm_ has joined #openstack-keystone | 00:43 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No More .reload_backends() or .reload_backend() https://review.openstack.org/216473 | 00:43 |
| morgan | ^^ | 00:43 |
| morgan | better test isolation | 00:44 |
| morgan | no more "RELOAD THE THINGS" just to load a config option | 00:44 |
| morgan | it was sloppy at best | 00:44 |
| *** mylu has quit IRC | 00:45 | |
| *** shoutm has quit IRC | 00:45 | |
| gyee | much cleaner code | 00:47 |
| morgan | finally rid of that awful "reload backend" magic stuff with that patch | 00:47 |
| morgan | that should help limit the impact of moving away from the FakeLDAP to something that really validates ldap semantics | 00:48 |
| morgan | before we move to full functionaly | 00:48 |
| morgan | delete all the lines of code: +45, -71 | 00:49 |
| morgan | ok not that many... but still | 00:50 |
| morgan | gyee: also https://review.openstack.org/#/c/210087 and the follow up patch should be easy | 00:51 |
| gyee | k | 00:53 |
| dstanek | morgan: should you be doing something like what config_figure was doing so the test state gets reset? | 00:54 |
| dstanek | gyee: check out these two https://review.openstack.org/#/c/210087/ | 01:00 |
| gyee | dstanek, yeah, looking at them, just trying to understand what you did there | 01:01 |
| *** ankita_w_ has quit IRC | 01:02 | |
| *** ankita_wagh has joined #openstack-keystone | 01:02 | |
| dstanek | gyee: the _assert_backends was sorta funky | 01:02 |
| *** shoutm_ has quit IRC | 01:03 | |
| gyee | dstanek, clever, you are basically checking the entry point against what's being loaded? | 01:07 |
| *** piyanai has joined #openstack-keystone | 01:07 | |
| *** ankita_wagh has quit IRC | 01:07 | |
| *** browne has quit IRC | 01:07 | |
| gyee | dstanek, don't you need to check to make sure the domain-specific backend flag is enabled as well? | 01:07 |
| *** geoffarnold is now known as geoffarnoldX | 01:07 | |
| *** shoutm has joined #openstack-keystone | 01:08 | |
| dstanek | gyee: yes, exactly. i wanted to make sure that the loaded driver was correct. when i was hacking on tests i accidentally make all backends sql and the ldap tests were passing :-) | 01:09 |
| dstanek | gyee: no, i just assume your setup knows and will pass in a dict as the identity value | 01:09 |
| gyee | ah, you are using manager.domain_configs to get the driver name | 01:10 |
| gyee | should be fine | 01:10 |
| gyee | dstanek, https://review.openstack.org/#/c/210087/2/keystone/tests/unit/test_backend_ldap.py, line 106 | 01:12 |
| gyee | , instead of % | 01:12 |
| gyee | :) | 01:12 |
| dstanek | gyee: that's only for logging :-P | 01:12 |
| gyee | oh k | 01:13 |
| *** hrou has joined #openstack-keystone | 01:15 | |
| dstanek | gyee: is this the thing you were talking about fixing? | 01:15 |
| dstanek | https://review.openstack.org/#/c/177661/27/keystonemiddleware/tests/unit/utils.py | 01:15 |
| gyee | dstanek, yes | 01:16 |
| gyee | I'll have to do the same there | 01:16 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Keep a consistent logger name for keystoneauth https://review.openstack.org/212602 | 01:16 |
| morgan | ok lets see that moves us to a fixture... | 01:17 |
| morgan | and cleans up the "reload" thing... | 01:18 |
| morgan | hmmm... | 01:18 |
| gyee | dstanek, actually I want tempfile, not TempDir | 01:28 |
| gyee | doesn't appear fixtures have TempFile | 01:28 |
| gyee | anyway, dinner bell ringing, kids singing, time to card out | 01:29 |
| *** gyee has quit IRC | 01:29 | |
| *** davechen has joined #openstack-keystone | 01:30 | |
| *** asd112z has joined #openstack-keystone | 01:35 | |
| *** topol has quit IRC | 01:46 | |
| *** topol has joined #openstack-keystone | 01:52 | |
| *** ChanServ sets mode: +v topol | 01:52 | |
| *** topol has quit IRC | 01:54 | |
| *** dims__ has quit IRC | 01:55 | |
| *** dave-mccowan has quit IRC | 01:56 | |
| *** shoutm_ has joined #openstack-keystone | 02:01 | |
| *** ngupta has joined #openstack-keystone | 02:01 | |
| *** shoutm has quit IRC | 02:03 | |
| *** mylu has joined #openstack-keystone | 02:04 | |
| *** mylu has quit IRC | 02:08 | |
| *** richm has quit IRC | 02:16 | |
| *** lhcheng_away is now known as lhcheng | 02:17 | |
| *** _hrou_ has joined #openstack-keystone | 02:20 | |
| *** hrou has quit IRC | 02:23 | |
| *** mylu has joined #openstack-keystone | 02:25 | |
| *** mylu has quit IRC | 02:32 | |
| *** mylu has joined #openstack-keystone | 02:33 | |
| *** mylu has quit IRC | 02:35 | |
| *** mylu has joined #openstack-keystone | 02:36 | |
| *** Ephur has joined #openstack-keystone | 02:41 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/python-keystoneclient: Use region_id filter for List Endpoints https://review.openstack.org/216501 | 02:43 |
| *** mylu has quit IRC | 02:45 | |
| *** ngupta has quit IRC | 02:47 | |
| *** ngupta has joined #openstack-keystone | 02:47 | |
| *** mylu has joined #openstack-keystone | 02:47 | |
| *** browne has joined #openstack-keystone | 02:49 | |
| *** dikonoor has joined #openstack-keystone | 02:52 | |
| *** hakimo_ has joined #openstack-keystone | 02:52 | |
| *** mylu has quit IRC | 02:53 | |
| *** hakimo has quit IRC | 02:55 | |
| *** lhcheng has quit IRC | 03:00 | |
| *** ankita_wagh has joined #openstack-keystone | 03:02 | |
| *** Ephur has quit IRC | 03:02 | |
| *** ngupta has quit IRC | 03:07 | |
| *** ngupta has joined #openstack-keystone | 03:08 | |
| *** fangzhou has quit IRC | 03:10 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Fix v2 plugin loaders to not have V2 prefix https://review.openstack.org/216510 | 03:16 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Fix plugin loading tests https://review.openstack.org/216511 | 03:16 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Remove plugin.load_from_conf_options and argparse https://review.openstack.org/216512 | 03:16 |
| jamielennox | morgan: ugh ^ | 03:16 |
| morgan | Yes | 03:16 |
| *** links has joined #openstack-keystone | 03:24 | |
| *** asd112z has quit IRC | 03:31 | |
| openstackgerrit | Merged openstack/keystoneauth: Keep a consistent logger name for keystoneauth https://review.openstack.org/212602 | 03:35 |
| *** ngupta has quit IRC | 03:40 | |
| *** piyanai has quit IRC | 03:44 | |
| *** shoutm_ has quit IRC | 03:48 | |
| *** ankita_w_ has joined #openstack-keystone | 03:52 | |
| *** ankita_wagh has quit IRC | 03:52 | |
| *** shoutm has joined #openstack-keystone | 03:59 | |
| *** mylu has joined #openstack-keystone | 04:00 | |
| *** lhcheng has joined #openstack-keystone | 04:04 | |
| *** ChanServ sets mode: +v lhcheng | 04:04 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/python-keystoneclient: Use region_id filter for List Endpoints https://review.openstack.org/216501 | 04:11 |
| *** mylu has quit IRC | 04:15 | |
| *** mylu has joined #openstack-keystone | 04:15 | |
| *** mylu has quit IRC | 04:20 | |
| *** stevemar has joined #openstack-keystone | 04:23 | |
| *** ChanServ sets mode: +v stevemar | 04:23 | |
| morgan | jamielennox: i hope we can land 1.0 of ksa this week. | 04:28 |
| jamielennox | morgan: what's left on the list? | 04:36 |
| *** abhirc has quit IRC | 04:37 | |
| *** abhirc has joined #openstack-keystone | 04:38 | |
| *** abhirc has quit IRC | 04:42 | |
| morgan | The ones you just posted and if any of the -1 ones we want. | 04:45 |
| morgan | But the list is short. | 04:45 |
| *** abhirc has joined #openstack-keystone | 04:47 | |
| *** abhirc has quit IRC | 04:48 | |
| *** abhirc has joined #openstack-keystone | 04:48 | |
| *** woodster_ has quit IRC | 04:49 | |
| *** mylu has joined #openstack-keystone | 04:58 | |
| *** mylu has quit IRC | 04:59 | |
| *** rm_work|away is now known as rm_work | 05:03 | |
| *** abhirc has quit IRC | 05:04 | |
| davechen | lhcheng: ping? | 05:12 |
| lhcheng | davechen: pong | 05:12 |
| davechen | lhcheng: why the kwargs is region=region_id in your patch (https://review.openstack.org/#/c/216501)? | 05:13 |
| morgan | lhcheng: oh hai! | 05:13 |
| davechen | lhcheng: is that should be region_id=region_id | 05:13 |
| davechen | ? | 05:13 |
| lhcheng | morgan: hello! | 05:14 |
| lhcheng | morgan: just watch the openstack seattle video, good job! | 05:14 |
| morgan | lhcheng: up late eh? | 05:14 |
| morgan | Glad you liked it! | 05:14 |
| lhcheng | morgan: we now have a "flock" :) | 05:14 |
| morgan | It was a fun talk to give. | 05:14 |
| lhcheng | morgan: glad to talk non-keystone some time? :P | 05:15 |
| morgan | Going to try and clean it up a little and use it again at a couple confs. | 05:15 |
| davechen | lhcheng, morgan: where is the link? | 05:15 |
| morgan | Sec | 05:15 |
| morgan | https://m.youtube.com/watch?v=VpVOlwW2l5w | 05:15 |
| morgan | lhcheng: yah. | 05:16 |
| lhcheng | davechen: ah, I didn't want to change the interface of the list() method | 05:16 |
| morgan | Going to compress it down for a lightning talk for one of the conferences. | 05:16 |
| lhcheng | region is already used by OSC | 05:16 |
| davechen | morgan: cool, you looks so young. :) | 05:16 |
| lhcheng | davechen: ++ | 05:17 |
| morgan | davechen: im only 34! ;) (soon 35) | 05:17 |
| davechen | morgan: where is your beard? | 05:17 |
| * lhcheng almost didn't recognize morgan in ops midcycle | 05:17 | |
| morgan | Lost it :P | 05:17 |
| morgan | Got board of having one for ~10yrs | 05:17 |
| lhcheng | davechen: yeah, I was looking for the beard | 05:17 |
| davechen | morgan: looks more handsome. :) | 05:17 |
| morgan | lhcheng: also no glasses (RIP) | 05:18 |
| morgan | Though i have glasses again now. | 05:18 |
| morgan | Also finally | 05:18 |
| morgan | Moving to NYC | 05:19 |
| morgan | in the next couple | 05:19 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Reject rule if assertion type unset https://review.openstack.org/216088 | 05:19 |
| morgan | Months :) | 05:19 |
| lhcheng | woah, nice! :D | 05:19 |
| lhcheng | morgan: how's your training going? | 05:19 |
| morgan | lhcheng: post ptl itll pick up | 05:19 |
| morgan | Took the day off due to migrane yesterday :( | 05:19 |
| lhcheng | cool, but... where would you bike in NYC? | 05:20 |
| morgan | That and new bike will be ready tomorrow. | 05:20 |
| lhcheng | central park seems too small | 05:20 |
| morgan | All over. Nyc is a seriously bike friendly city | 05:20 |
| morgan | Have a bike path around all of manhtattan | 05:20 |
| morgan | Also can ride out the length of long island (100mi each way) | 05:21 |
| lhcheng | ah there you go :) | 05:21 |
| lhcheng | perfect | 05:21 |
| morgan | Yah. Plus buying a trainer | 05:21 |
| morgan | So can "ride" during the winter. | 05:21 |
| davechen | Nyc means New York? | 05:21 |
| morgan | davechen: nyc = new york city | 05:22 |
| lhcheng | ugh.. winter is coming.. :) | 05:22 |
| morgan | Vs new york state | 05:22 |
| morgan | lhcheng: no game of thrones jokes :P | 05:22 |
| *** Ephur has joined #openstack-keystone | 05:22 | |
| morgan | Also.. Do you even notice winter has happened in SV? | 05:23 |
| lhcheng | morgan: not last season, there weren't much snow in Tahoe. | 05:23 |
| morgan | Yah i know :( | 05:23 |
| davechen | lhcheng: i meant in your testcase, is that should be ...expected_query=expected_query, region_id=region_id? | 05:26 |
| davechen | lhcheng: region id is the filter passed into keystone server, right? | 05:26 |
| *** ankita_w_ has quit IRC | 05:28 | |
| lhcheng | expected_query is the query passed to keystone, the second one is the argument pass to the list() method. | 05:29 |
| * lhcheng had to dig into the test_list() code to figure that out. | 05:30 | |
| lhcheng | davechen: ^ | 05:30 |
| davechen | lhcheng: yes, I agree, but I am doubt that your scond argument is correct. | 05:31 |
| *** asd112z has joined #openstack-keystone | 05:32 | |
| davechen | lhcheng: I think it should be the filter passed into the keystone server, (https://github.com/openstack/keystone/blob/master/keystone/catalog/controllers.py#L318-L319) | 05:33 |
| davechen | the code you just modified. | 05:33 |
| stevemar | morgan: hurry up and get to the good time zone | 05:33 |
| *** yottatsa has joined #openstack-keystone | 05:36 | |
| openstackgerrit | Merged openstack/keystoneauth: Fix v2 plugin loaders to not have V2 prefix https://review.openstack.org/216510 | 05:37 |
| jamielennox | stevemar: as you're here i put a test on https://review.openstack.org/#/c/216088/ | 05:38 |
| jamielennox | i'd like marekd to review as well, but it would get me out of a spot if we could merge it quickly | 05:38 |
| *** henrynash has joined #openstack-keystone | 05:40 | |
| *** ChanServ sets mode: +v henrynash | 05:40 | |
| *** ankita_wagh has joined #openstack-keystone | 05:42 | |
| lhcheng | davechen: the test I have is correct, the reason is 'region=region_id' is used here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/unit/v3/utils.py#L268 | 05:45 |
| jamielennox | lhcheng: what are we discussing? | 05:45 |
| lhcheng | davechen: while the expected_query is used here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/unit/v3/utils.py#L268 | 05:45 |
| lhcheng | jamielennox: this patch: https://review.openstack.org/#/c/216501/ :) | 05:46 |
| lhcheng | jamielennox: you can review it too if you get the chance | 05:46 |
| jamielennox | hmm | 05:47 |
| jamielennox | lhcheng: that may be an issue, because for most people passing region= i'd expect that to be region_name and not region_id | 05:47 |
| davechen | lhcheng: thanks you. :) | 05:48 |
| *** ajayaa has joined #openstack-keystone | 05:48 | |
| lhcheng | jamielennox: hmm the old one didn't work, we didn't support a region filter in the List Endpoints API | 05:49 |
| davechen | lhcheng: your two link is identical. | 05:49 |
| jamielennox | lhcheng: lol/:( | 05:49 |
| lhcheng | davechen: sorry :P - while the expected_query is used here: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/unit/v3/utils.py#L273-L275 | 05:50 |
| davechen | lhcheng: I was thing that filter_kwargs passed in self.manager.list(**filter_kwargs) is just the the filter we use, but I am not sure now, I will debug into it and see how it works. | 05:51 |
| davechen | s/thing/thinking | 05:51 |
| *** asd112z has quit IRC | 05:51 | |
| openstackgerrit | Merged openstack/keystone: Refactor: use fixtures.TempDir more https://review.openstack.org/214346 | 05:55 |
| *** links has quit IRC | 05:57 | |
| *** exploreshaifali has joined #openstack-keystone | 05:58 | |
| lhcheng | jamielennox: about the IdP specific websso, not sure if we can get it into DOA in time. I think the release team prefer to lock the requirements two weeks before the end of milestone to stabilize. | 05:58 |
| jamielennox | lhcheng: damn, that'd be a shame - as a library it can't go in a new version and still make L | 05:59 |
| jamielennox | then again, i'm almost just tempted to leave it till next cycle | 05:59 |
| jamielennox | it's not much code change, but i haven't managed to even get a full environment up to give it a proper test yet | 05:59 |
| *** links has joined #openstack-keystone | 06:00 | |
| *** jaosorior has joined #openstack-keystone | 06:01 | |
| lhcheng | jamielennox: yup, my setup is using google oidc, have to figure out how to add another IdP (which is easy to setup) | 06:01 |
| davechen | lhcheng: just put a comment on that patch, correct me pls. | 06:03 |
| *** Nirupama has joined #openstack-keystone | 06:05 | |
| *** stevemar has quit IRC | 06:11 | |
| *** boris-42 has quit IRC | 06:12 | |
| *** serverascode has quit IRC | 06:12 | |
| *** ramishra has quit IRC | 06:12 | |
| *** jaosorior has quit IRC | 06:12 | |
| *** vivekd has joined #openstack-keystone | 06:14 | |
| *** ramishra has joined #openstack-keystone | 06:15 | |
| *** jaosorior has joined #openstack-keystone | 06:16 | |
| *** serverascode has joined #openstack-keystone | 06:17 | |
| *** boris-42 has joined #openstack-keystone | 06:17 | |
| *** ankita_wagh has quit IRC | 06:20 | |
| *** _hrou_ has quit IRC | 06:34 | |
| *** Nirupama has quit IRC | 06:36 | |
| *** exploreshaifali has quit IRC | 06:40 | |
| *** yottatsa has quit IRC | 06:42 | |
| *** topol has joined #openstack-keystone | 06:46 | |
| *** ChanServ sets mode: +v topol | 06:46 | |
| *** shoutm has quit IRC | 06:49 | |
| *** vivekd_ has joined #openstack-keystone | 06:50 | |
| *** shoutm has joined #openstack-keystone | 06:51 | |
| *** vivekd__ has joined #openstack-keystone | 06:52 | |
| *** vivekd has quit IRC | 06:53 | |
| *** vivekd__ is now known as vivekd | 06:53 | |
| *** vivekd_ has quit IRC | 06:55 | |
| *** urulama__ is now known as urulama | 07:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 07:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/213894 | 07:07 |
| *** yottatsa has joined #openstack-keystone | 07:14 | |
| *** yottatsa has quit IRC | 07:15 | |
| *** topol has quit IRC | 07:21 | |
| *** browne has quit IRC | 07:21 | |
| *** lhcheng has quit IRC | 07:22 | |
| *** topol has joined #openstack-keystone | 07:23 | |
| *** ChanServ sets mode: +v topol | 07:23 | |
| *** topol has quit IRC | 07:23 | |
| *** topol has joined #openstack-keystone | 07:25 | |
| *** ChanServ sets mode: +v topol | 07:25 | |
| *** topol has quit IRC | 07:25 | |
| *** topol has joined #openstack-keystone | 07:26 | |
| *** ChanServ sets mode: +v topol | 07:26 | |
| *** topol has quit IRC | 07:26 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Allow specifying a region name to auth_token https://review.openstack.org/216579 | 07:31 |
| openstackgerrit | Merged openstack/keystone: Remove all traces of oslo incubator https://review.openstack.org/199343 | 07:32 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 07:35 |
| *** topol has joined #openstack-keystone | 07:41 | |
| *** ChanServ sets mode: +v topol | 07:41 | |
| *** ajayaa has quit IRC | 07:50 | |
| *** ajayaa has joined #openstack-keystone | 07:51 | |
| *** henrynash has quit IRC | 07:55 | |
| *** fhubik has joined #openstack-keystone | 07:56 | |
| *** shoutm has quit IRC | 08:03 | |
| *** asd112z has joined #openstack-keystone | 08:03 | |
| *** jaosorior has quit IRC | 08:05 | |
| *** shoutm has joined #openstack-keystone | 08:05 | |
| *** asd112z has quit IRC | 08:08 | |
| *** urulama has quit IRC | 08:09 | |
| *** urulama has joined #openstack-keystone | 08:10 | |
| *** exploreshaifali has joined #openstack-keystone | 08:10 | |
| openstackgerrit | Merged openstack/keystone: Adds backend check to setup of LDAP tests https://review.openstack.org/210087 | 08:11 |
| openstackgerrit | Merged openstack/keystone: Creates a fixture representing as LDAP database https://review.openstack.org/210088 | 08:11 |
| *** jistr has joined #openstack-keystone | 08:12 | |
| *** e0ne has joined #openstack-keystone | 08:17 | |
| *** pnavarro has joined #openstack-keystone | 08:24 | |
| *** Nirupama has joined #openstack-keystone | 08:29 | |
| *** vivekd has quit IRC | 08:45 | |
| *** vivekd has joined #openstack-keystone | 08:48 | |
| *** exploreshaifali has quit IRC | 08:52 | |
| *** jaosorior has joined #openstack-keystone | 08:59 | |
| *** btully has quit IRC | 09:00 | |
| *** claudiub has joined #openstack-keystone | 09:01 | |
| *** katkapilatova has joined #openstack-keystone | 09:14 | |
| *** marzif has joined #openstack-keystone | 09:21 | |
| *** marzif has quit IRC | 09:31 | |
| *** marzif has joined #openstack-keystone | 09:31 | |
| *** shoutm has quit IRC | 09:41 | |
| *** fhubik is now known as fhubik_brb | 09:46 | |
| *** dims__ has joined #openstack-keystone | 09:48 | |
| *** dims__ has quit IRC | 09:48 | |
| *** dims__ has joined #openstack-keystone | 09:49 | |
| *** aix has joined #openstack-keystone | 09:50 | |
| *** btully has joined #openstack-keystone | 09:51 | |
| *** aix has quit IRC | 09:52 | |
| *** aix has joined #openstack-keystone | 09:53 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** btully has quit IRC | 09:55 | |
| *** exploreshaifali has joined #openstack-keystone | 10:03 | |
| *** fhubik_brb is now known as fhubik | 10:04 | |
| *** exploreshaifali has quit IRC | 10:15 | |
| *** exploreshaifali has joined #openstack-keystone | 10:16 | |
| *** vivekd has quit IRC | 10:22 | |
| *** vivekd_ has joined #openstack-keystone | 10:22 | |
| *** vivekd_ is now known as vivekd | 10:22 | |
| *** dave-mcc_ has joined #openstack-keystone | 10:23 | |
| *** eandersson has joined #openstack-keystone | 10:29 | |
| *** fhubik is now known as fhubik_brb | 10:30 | |
| *** urulama_ has joined #openstack-keystone | 10:54 | |
| *** urulama has quit IRC | 10:54 | |
| *** asd112z has joined #openstack-keystone | 11:03 | |
| *** asd112z has quit IRC | 11:08 | |
| *** vivekd has quit IRC | 11:08 | |
| *** ajayaa has quit IRC | 11:09 | |
| *** piyanai has joined #openstack-keystone | 11:16 | |
| *** ajayaa has joined #openstack-keystone | 11:23 | |
| *** fhubik_brb is now known as fhubik | 11:24 | |
| *** vivekd has joined #openstack-keystone | 11:35 | |
| *** exploreshaifali has quit IRC | 11:36 | |
| *** topol has quit IRC | 11:39 | |
| *** topol has joined #openstack-keystone | 11:39 | |
| *** ChanServ sets mode: +v topol | 11:39 | |
| *** topol has quit IRC | 11:39 | |
| *** topol has joined #openstack-keystone | 11:40 | |
| *** ChanServ sets mode: +v topol | 11:40 | |
| *** topol has quit IRC | 11:40 | |
| *** vivekd has quit IRC | 11:40 | |
| *** exploreshaifali has joined #openstack-keystone | 11:41 | |
| *** gordc has joined #openstack-keystone | 11:42 | |
| *** piyanai has quit IRC | 11:44 | |
| *** vivekd_ has joined #openstack-keystone | 11:47 | |
| *** vivekd_ is now known as vivekd | 11:51 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 11:53 |
| *** ChanServ sets mode: +o dolphm | 11:56 | |
| *** shoutm has joined #openstack-keystone | 12:02 | |
| *** piyanai has joined #openstack-keystone | 12:04 | |
| *** urulama_ has quit IRC | 12:05 | |
| *** urulama has joined #openstack-keystone | 12:05 | |
| *** samueldmq has joined #openstack-keystone | 12:09 | |
| samueldmq | morning | 12:09 |
| *** petertr7_away is now known as petertr7 | 12:11 | |
| *** piyanai has quit IRC | 12:19 | |
| *** greystart has joined #openstack-keystone | 12:19 | |
| *** fhubik is now known as fhubik_brb | 12:22 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:22 | |
| *** fhubik_brb is now known as fhubik | 12:22 | |
| *** fhubik is now known as fhubik_brb | 12:23 | |
| *** petertr7 is now known as petertr7_away | 12:33 | |
| *** petertr7_away is now known as petertr7 | 12:35 | |
| *** ajayaa has quit IRC | 12:35 | |
| *** edmondsw has joined #openstack-keystone | 12:36 | |
| *** iurygregory has quit IRC | 12:45 | |
| *** vivekd has quit IRC | 12:48 | |
| *** iurygregory has joined #openstack-keystone | 12:48 | |
| *** nicodemos has joined #openstack-keystone | 12:48 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/214509 | 12:52 |
| *** doug-fish has joined #openstack-keystone | 12:54 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Show that unscoped tokens are revoked when deleting role assignments https://review.openstack.org/216391 | 12:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Handle tokens created and quickly revoked with insufficient timestamp precision https://review.openstack.org/216236 | 12:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Do not revoke all of a user's tokens when a role assignment is deleted https://review.openstack.org/216367 | 12:59 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:00 | |
| *** nicodemos has quit IRC | 13:00 | |
| *** iurygregory has quit IRC | 13:01 | |
| *** nicodemos has joined #openstack-keystone | 13:03 | |
| *** Nirupama has quit IRC | 13:03 | |
| *** geoffarnoldX is now known as geoffarnold | 13:06 | |
| *** browne has joined #openstack-keystone | 13:10 | |
| *** jsavak has joined #openstack-keystone | 13:11 | |
| *** raildo-afk is now known as raildo | 13:13 | |
| *** richm has joined #openstack-keystone | 13:15 | |
| *** pgbridge has joined #openstack-keystone | 13:20 | |
| *** doug-fish has quit IRC | 13:20 | |
| *** doug-fish has joined #openstack-keystone | 13:21 | |
| *** doug-fis_ has joined #openstack-keystone | 13:22 | |
| *** links has quit IRC | 13:23 | |
| *** dims__ has quit IRC | 13:24 | |
| *** doug-fi__ has joined #openstack-keystone | 13:24 | |
| *** dims__ has joined #openstack-keystone | 13:25 | |
| *** ajayaa has joined #openstack-keystone | 13:25 | |
| *** doug-fish has quit IRC | 13:26 | |
| *** doug-fis_ has quit IRC | 13:26 | |
| *** doug-fish has joined #openstack-keystone | 13:27 | |
| marekd | dolphm: Hi. I am curious what's your opinion on https://review.openstack.org/#/c/215221/5/keystone/auth/plugins/mapped.py esp the "avoid double encoding bit". | 13:28 |
| *** btully has joined #openstack-keystone | 13:28 | |
| *** hrou has joined #openstack-keystone | 13:29 | |
| *** doug-fi__ has quit IRC | 13:29 | |
| *** thiagop has joined #openstack-keystone | 13:29 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: rename Fernet's unscoped federated payload https://review.openstack.org/202190 | 13:30 |
| dolphm | marekd: i'd much rather have consistency -- but why do usernames need to be URL safe? | 13:31 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor: Provider._rebuild_federated_info() https://review.openstack.org/208872 | 13:31 |
| dolphm | marekd: oh, user IDs. i'm blind. | 13:31 |
| marekd | dolphm: ++ user_id | 13:31 |
| dolphm | marekd: why would they already be quoted? | 13:31 |
| marekd | dolphm: you may pass it from assertion. | 13:32 |
| marekd | maybe some idp issues urlencoded stuff. | 13:32 |
| dolphm | marekd: maybe? or they do | 13:32 |
| marekd | maybe | 13:32 |
| *** btully has quit IRC | 13:32 | |
| dolphm | marekd: i'd rather wait for a bug report to verify the "maybe" then | 13:33 |
| dolphm | marekd: so, assume they're never encoded | 13:33 |
| marekd | dolphm: hm, o | 13:33 |
| marekd | ok | 13:33 |
| marekd | so i am going to rework this patch | 13:33 |
| dolphm | marekd: and then *always* encode what we're given to ensure it's URL safe | 13:33 |
| marekd | dolphm: sure | 13:33 |
| marekd | dolphm: thanks | 13:34 |
| *** claudiub has quit IRC | 13:34 | |
| *** jecarey has joined #openstack-keystone | 13:34 | |
| *** dims has joined #openstack-keystone | 13:36 | |
| *** dims__ has quit IRC | 13:36 | |
| *** doug-fish has quit IRC | 13:38 | |
| *** doug-fish has joined #openstack-keystone | 13:39 | |
| *** dims_ has joined #openstack-keystone | 13:39 | |
| *** doug-fish has quit IRC | 13:39 | |
| *** doug-fish has joined #openstack-keystone | 13:39 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 13:40 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Fernet payloads for federated scoped tokens. https://review.openstack.org/202176 | 13:40 |
| *** topol has joined #openstack-keystone | 13:40 | |
| *** ChanServ sets mode: +v topol | 13:40 | |
| *** dims__ has joined #openstack-keystone | 13:41 | |
| *** dims has quit IRC | 13:42 | |
| *** bapalm has quit IRC | 13:44 | |
| *** topol has quit IRC | 13:44 | |
| *** dims_ has quit IRC | 13:45 | |
| *** mpmsimo has joined #openstack-keystone | 13:49 | |
| *** fhubik_brb is now known as fhubik | 13:51 | |
| *** bapalm_ is now known as bapalm | 13:51 | |
| dolphm | there's no way to filter a gerrit query to remove changes where you've already reviewed the latest patchset, is there? | 13:54 |
| *** ngupta has joined #openstack-keystone | 13:58 | |
| *** petertr7 is now known as petertr7_away | 14:00 | |
| lbragstad | dolphm: doesn't next-review do that for you? | 14:02 |
| dolphm | lbragstad: it does, but i'm poking at gerrit directly | 14:04 |
| dolphm | lbragstad: http://cdn.pasteraw.com/oke3hfa4pjipkkr0l0j3wasbtnavars | 14:05 |
| *** iurygregory has joined #openstack-keystone | 14:08 | |
| *** btully has joined #openstack-keystone | 14:11 | |
| *** tonytan4ever has joined #openstack-keystone | 14:11 | |
| lbragstad | dolphm: oh, interesting... | 14:12 |
| lbragstad | that's a good question. | 14:12 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/213894 | 14:12 |
| *** petertr7_away is now known as petertr7 | 14:13 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a notification testcase for unbound methods https://review.openstack.org/210478 | 14:13 |
| *** piyanai has joined #openstack-keystone | 14:13 | |
| *** mpmsimo has quit IRC | 14:15 | |
| *** raildo is now known as raildo-afk | 14:16 | |
| *** mpmsimo has joined #openstack-keystone | 14:16 | |
| *** raildo-afk is now known as raildo | 14:17 | |
| dstanek | dolphm: try "NOT label:Code-Review<=-1,self NOT label:Code-Review>=1,self NOT owner:self" | 14:18 |
| dolphm | dstanek: ooooh | 14:19 |
| dolphm | dstanek: holy crap, thanks | 14:20 |
| dstanek | dolphm: np, it's a part of my dashboard | 14:20 |
| dstanek | http://bit.ly/dstanek-review | 14:21 |
| *** annasort_ has joined #openstack-keystone | 14:21 | |
| lbragstad | dstanek: wow, nice | 14:21 |
| dstanek | some queries in there are not perfect, but i've been gradually making them better | 14:22 |
| dolphm | dstanek: foreach just applies to all of them? | 14:23 |
| dstanek | yes | 14:23 |
| *** annasort has quit IRC | 14:24 | |
| *** annasort_ is now known as annasort | 14:24 | |
| dstanek | i need to write down what i'm doing there so others can benefit | 14:24 |
| dolphm | dstanek: i'm going to dissect your queries | 14:25 |
| marekd | dstanek: definitely | 14:27 |
| dstanek | dolphm: i can do you +1000 better - http://paste.openstack.org/show/427105/ | 14:27 |
| dstanek | using http://git.openstack.org/cgit/stackforge/gerrit-dash-creator/ | 14:27 |
| dstanek | openstack already has an answer for everything | 14:27 |
| dolphm | dstanek: don't you have to upload that to gerrit? | 14:28 |
| *** bknudson has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v bknudson | 14:28 | |
| dstanek | dolphm: no, it creates the URL out of the INI | 14:29 |
| dstanek | then i just created a bit.ly for mine | 14:29 |
| *** annasort has quit IRC | 14:30 | |
| dstanek | dolphm: i just ran this: .tox/py27/bin/gerrit-dash-creator --template-directory=templates/ dashboards/dstanek.dash | 14:31 |
| *** asd112z has joined #openstack-keystone | 14:32 | |
| *** asd112z has quit IRC | 14:33 | |
| *** asd112z has joined #openstack-keystone | 14:33 | |
| *** asd112z has quit IRC | 14:34 | |
| *** asd112z has joined #openstack-keystone | 14:34 | |
| *** katkapilatova has left #openstack-keystone | 14:35 | |
| dolphm | dstanek: can you search by dependencies? | 14:39 |
| *** petertr7 is now known as petertr7_away | 14:41 | |
| *** afaranha has joined #openstack-keystone | 14:41 | |
| *** afaranha has left #openstack-keystone | 14:41 | |
| *** petertr7_away is now known as petertr7 | 14:42 | |
| lbragstad | dstanek: re; http://paste.openstack.org/show/427105/ -- there isn't a way to add a dashbaord is there? | 14:42 |
| *** topol has joined #openstack-keystone | 14:42 | |
| *** ChanServ sets mode: +v topol | 14:42 | |
| *** links has joined #openstack-keystone | 14:43 | |
| lbragstad | dstanek: nvm, figured it out | 14:44 |
| dstanek | lbragstad: add a dashboard? | 14:44 |
| dstanek | dolphm: search for reviews based on the dependent review? | 14:45 |
| *** topol_ has joined #openstack-keystone | 14:45 | |
| *** ChanServ sets mode: +v topol_ | 14:45 | |
| *** topol has quit IRC | 14:46 | |
| *** topol_ has quit IRC | 14:48 | |
| *** diazjf has joined #openstack-keystone | 14:51 | |
| *** doug-fish has quit IRC | 14:52 | |
| *** shoutm has quit IRC | 14:52 | |
| *** doug-fish has joined #openstack-keystone | 14:54 | |
| *** claudiub has joined #openstack-keystone | 14:58 | |
| *** exploreshaifali has quit IRC | 14:59 | |
| claudiub | hi. Can anyone please review this bugfix? https://review.openstack.org/#/c/211686/ | 14:59 |
| *** zzzeek has joined #openstack-keystone | 14:59 | |
| *** lhcheng has joined #openstack-keystone | 15:00 | |
| *** ChanServ sets mode: +v lhcheng | 15:00 | |
| *** vivekd has joined #openstack-keystone | 15:00 | |
| *** nicodemos has quit IRC | 15:03 | |
| morgan | Dont think so | 15:04 |
| *** thedodd has joined #openstack-keystone | 15:04 | |
| morgan | dolphm: ^ (my response was to you) | 15:05 |
| morgan | claudiub: that will also need to be proposed to keystoneauth | 15:06 |
| dolphm | dstanek: like, search for reviews with no parent review, or which ultimately depend on a specific change-id | 15:07 |
| *** vivekd has quit IRC | 15:07 | |
| *** annasort has joined #openstack-keystone | 15:09 | |
| breton_ | dstanek: where do you put it? | 15:11 |
| breton_ | I mean, the config | 15:12 |
| *** lhcheng has quit IRC | 15:12 | |
| *** dave-mcc_ has quit IRC | 15:12 | |
| *** annasort_ has joined #openstack-keystone | 15:12 | |
| breton_ | oh, got it, nevermind | 15:13 |
| *** annasort has quit IRC | 15:14 | |
| *** annasort_ is now known as annasort | 15:14 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Refactor: Don't hard code the error code https://review.openstack.org/198623 | 15:16 |
| dstanek | claudiub: is that true that you can't launch Windows instances? why is ksc running in Windows in that case? | 15:20 |
| *** rm_work is now known as rm_work|away | 15:24 | |
| *** dave-mcc_ has joined #openstack-keystone | 15:26 | |
| claudiub | dstanek: can't launch hyper-v instances, yes. It tries to use neutron client to fetch network related info. and it needs to authenticate first: http://paste.openstack.org/show/tUb4rXXtmV9Nafw10GzL/ | 15:27 |
| lbragstad | morgan: since the SPFE was granted, should we merge this in? https://review.openstack.org/#/c/199339/ | 15:27 |
| morgan | Sure | 15:27 |
| lbragstad | morgan: cool I'll let you pull the trigger since I uploaded a couple patches | 15:28 |
| claudiub | dstanek: it seems that just having that patch, nova-compute continues to work properly and instances are spawned corectly. | 15:28 |
| morgan | lbragstad: please reference the vote (link to it jn the comment) and go ahead and +a it | 15:28 |
| *** amg__ has joined #openstack-keystone | 15:29 | |
| dstanek | claudiub: interesting. what's actually running on the windows machine? | 15:30 |
| claudiub | dstanek: hm, can you be more specific? we run nova-compute, neutron-hyperv-agent and ceilometer-agent-compute, if that's what you want to know | 15:30 |
| amg__ | Has anyone had success using Heat with an AD ident service in Keystone? Running into issues with Kilo on Cent7. Keep getting the error: "ERROR (heat-keystone-setup-domain:124) User 'cs-os-users' is not authorized to perform this operation, please try with other OS_USERNAME setting." | 15:31 |
| amg__ | I'm using a user that has admin level privs. | 15:31 |
| claudiub | dstanek: needed for Hyper-V compute nodes, in order to deploy Hyper-V instances. | 15:31 |
| amg__ | But no joy | 15:31 |
| claudiub | dstanek: as for packages, the dependencies those projects need, defined in their requirements.txt | 15:32 |
| dstanek | claudiub: there is something running on Windows that is using keystoneclient. i'm wondering what that is | 15:32 |
| claudiub | dstanek: nova-compute | 15:33 |
| dstanek | claudiub: i didn't realize that it could run on Windows | 15:33 |
| amg__ | There was some issue with the previous version of the heat-keystone-setup-domain but they supposedly resolved it and pushed it out. I'm thinking that there is something going awry when the user (even though the privs are right) tries to auth and the MySQL assignment DB isn't playing along. | 15:34 |
| claudiub | dstanek: well, hyper-v has been in nova for a few years.. | 15:34 |
| amg__ | I'd like to avid it, but its been suggested that multiple backends might fix this? Not sure thats the direction I want to go, but if we must... | 15:34 |
| openstackgerrit | Merged openstack/keystone-specs: IDP specific websso https://review.openstack.org/199339 | 15:35 |
| dstanek | claudiub: i'm just surprised that nova doesn't call it out with a trove classifier | 15:35 |
| claudiub | dstanek: well, i don't think that can change on the nova side any time soon, since it's very close to freeze. | 15:37 |
| dstanek | claudiub: i'm not saying to change nova. the classifiers are how you advertise support for a platform | 15:38 |
| *** mpmsimo has quit IRC | 15:39 | |
| claudiub | dstanek: ah, I see what you mean | 15:39 |
| claudiub | dstanek: yeah, it might a good idea to update that in the future | 15:40 |
| *** amg__ has quit IRC | 15:42 | |
| *** lsmola has quit IRC | 15:44 | |
| *** links has quit IRC | 15:44 | |
| *** mpmsimo has joined #openstack-keystone | 15:44 | |
| dstanek | claudiub: so basically the problem with sigmavirus24's suggestion is that requests uses socket.setsockopt instead of sock.ioctl? | 15:49 |
| sigmavirus24 | dstanek: yeah, I'm working on a way to allow people to use ioctl in urllib3 | 15:49 |
| sigmavirus24 | That said, it won't be ready in time for that patch to land | 15:50 |
| sigmavirus24 | Which means windows consumers get wildly different (although functional) behaviour | 15:50 |
| dstanek | sigmavirus24: i'm OK with that since we don't advertise official Windows support :-) | 15:50 |
| *** vivekd has joined #openstack-keystone | 15:52 | |
| sigmavirus24 | dstanek: warning, by accepting patches to fix something on a platform, you're implicitly supporting it | 15:52 |
| sigmavirus24 | Which translates into official support =P | 15:52 |
| dstanek | sigmavirus24: by wildly different .... it's just using the TCP defaults for the Windows installation right? | 15:52 |
| claudiub | dstanek: yeah, for SIO_KEEPALIVE_VALS, sock.ioctl must be used. And yeah, I'd say it's better to have it working, rather than not at all. | 15:52 |
| sigmavirus24 | Right which will be much much longer | 15:52 |
| sigmavirus24 | Still it will hang for less than forever | 15:53 |
| sigmavirus24 | But it'll hang for probably on the order of hours | 15:53 |
| sigmavirus24 | dstanek: if only I had a way of not having to spend all my free time working on fixes for things upstream of openstack | 15:53 |
| dstanek | sigmavirus24: i thought you loved it! | 15:54 |
| dstanek | i'm actually surprised that we don't have other broken things on windows | 15:54 |
| dstanek | morgan, dolphm: what has been the traditional level of support for running clients on Windows? i've never seen anyone ask about it until this bug | 15:56 |
| morgan | Cygwin i think | 15:56 |
| morgan | But not sure. | 15:56 |
| *** piyanai has quit IRC | 15:57 | |
| morgan | I assume things mostly work | 15:57 |
| claudiub | cygwin is quite inefficient... | 15:57 |
| *** petertr7 is now known as petertr7_away | 15:58 | |
| morgan | Even without cygwin. Mostly work. But i havent heard a lot about this being run on windows directly without cygwib | 15:58 |
| dstanek | morgan: likely because ksc doesn't work | 15:59 |
| *** doug-fish has quit IRC | 15:59 | |
| morgan | Sure | 15:59 |
| *** pnavarro has quit IRC | 16:00 | |
| *** dikonoor has quit IRC | 16:00 | |
| *** doug-fish has joined #openstack-keystone | 16:01 | |
| *** _cjones_ has joined #openstack-keystone | 16:03 | |
| *** djc_ has joined #openstack-keystone | 16:03 | |
| dstanek | claudiub: i'm going to leave it at a medium since nobody else has complained about it, which seems weird if we broke an official hypervisor implementation | 16:04 |
| djc_ | Has anyone used dual identity backends for keystone? AD and mysql? | 16:04 |
| *** amg__ has joined #openstack-keystone | 16:04 | |
| dstanek | claudiub: besides you have a patch that you have to convince people to approve. at this point the priority doesn't much matter | 16:05 |
| amg__ | good question djc_ | 16:05 |
| claudiub | dstanek: it's because it's broken on the current master. When Liberty will be released / stable, there will be many more users for it | 16:05 |
| amg__ | It seems I've never found much on it, but never really looked that hard. | 16:05 |
| dstanek | claudiub: there weren't using ksc before? | 16:05 |
| amg__ | Anyone have a good doc for multiple ident services for keystone? | 16:05 |
| claudiub | dstanek: and then there will be more complaints. :) | 16:06 |
| claudiub | dstanek: ksc? | 16:06 |
| claudiub | keystone client? | 16:06 |
| dstanek | clayton: yes | 16:06 |
| dstanek | it would seem that any release using the newest version would fail | 16:06 |
| claudiub | yeah, it was, but I think those socket options are new | 16:06 |
| *** mylu has joined #openstack-keystone | 16:06 | |
| claudiub | dstanek: https://github.com/openstack/python-keystoneclient/blob/stable/kilo/keystoneclient/session.py#L852 this is in stable/kilo | 16:08 |
| *** aix has quit IRC | 16:08 | |
| claudiub | dstanek: only TCP_NODELAY and SO_KEEPALIVE are there, which are fine | 16:08 |
| *** marzif has quit IRC | 16:12 | |
| *** vivekd has quit IRC | 16:16 | |
| *** djc_ has quit IRC | 16:17 | |
| *** jistr has quit IRC | 16:17 | |
| *** tellesnobrega_af is now known as tellesnobrega | 16:18 | |
| *** tonytan4ever has quit IRC | 16:20 | |
| *** e0ne has quit IRC | 16:20 | |
| *** amg__ has quit IRC | 16:20 | |
| *** mylu has quit IRC | 16:22 | |
| *** vivekd has joined #openstack-keystone | 16:25 | |
| *** tonytan4ever has joined #openstack-keystone | 16:26 | |
| *** exploreshaifali has joined #openstack-keystone | 16:27 | |
| *** marzif has joined #openstack-keystone | 16:28 | |
| *** fhubik is now known as fhubik_brb | 16:30 | |
| *** mylu has joined #openstack-keystone | 16:31 | |
| *** fhubik_brb is now known as fhubik | 16:32 | |
| *** urulama has quit IRC | 16:33 | |
| *** urulama has joined #openstack-keystone | 16:34 | |
| *** jdennis has quit IRC | 16:41 | |
| *** __TheDodd__ has joined #openstack-keystone | 16:42 | |
| *** gyee has joined #openstack-keystone | 16:43 | |
| *** ChanServ sets mode: +v gyee | 16:43 | |
| *** thedodd has quit IRC | 16:43 | |
| *** fhubik has quit IRC | 16:43 | |
| *** ankita_wagh has joined #openstack-keystone | 16:45 | |
| alextricity | So i was trying to set up keystone with AD, and used the service token to update assignments and such. But now i'm getting: | 16:51 |
| alextricity | ERROR: openstack An unexpected error prevented the server from fulfilling your request: badly formed hexadecimal UUID string (Disable debug mode to suppress these details.) (HTTP 500) (Request-ID: req-e1469ab5-9d7a-4edd-9507-b69c5afde644) | 16:51 |
| alextricity | Anybody seen this? | 16:51 |
| ekarlso | is authlib in soon ? | 16:51 |
| *** csoukup has joined #openstack-keystone | 16:52 | |
| *** ankita_w_ has joined #openstack-keystone | 16:55 | |
| *** roxanaghe has joined #openstack-keystone | 16:56 | |
| *** ankita_wagh has quit IRC | 16:58 | |
| *** errr has joined #openstack-keystone | 16:58 | |
| *** piyanai has joined #openstack-keystone | 17:00 | |
| raildo | n | 17:01 |
| *** josdotso has joined #openstack-keystone | 17:06 | |
| josdotso | In Kilo, using federation, does user mapping mean that a trusted foreign user need not have a user record in the local Keystone/mysql? | 17:07 |
| josdotso | Or is there a user record inserted locally whenever a truster user accesses a foreign Openstack? | 17:08 |
| *** e0ne has joined #openstack-keystone | 17:08 | |
| josdotso | *inserted at the foreign system whenever... | 17:09 |
| josdotso | Re: http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo/ | 17:10 |
| *** mestery has quit IRC | 17:14 | |
| *** djc_ has joined #openstack-keystone | 17:15 | |
| *** jaosorior has quit IRC | 17:15 | |
| djc_ | is it possible to have a hybrid identity backend for keystone (AD & mysql)? | 17:15 |
| morgan | djc_: what do you mean by hybrid? | 17:16 |
| morgan | josdotso: in kilo you can have either a local record or an ephemeral user that federation maps to | 17:17 |
| josdotso | morgan: thanks! | 17:17 |
| morgan | josdotso: it depends on which method you prefer | 17:17 |
| dstanek | browne: i think you want to take off a 0 there | 17:17 |
| morgan | And it is based on the mapping rules. | 17:17 |
| djc_ | morgan: we were using AD as the backend to keystone. This worked until we tried to install and configure heat orchestration. Heat does not play well with AD. We changed the backend to mysql and were able to complete the installation. Would it be possible to have service accounts like heat, glance nova in mysql and user accounts in AD? | 17:17 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use min and max on IntOpt option types https://review.openstack.org/212373 | 17:18 |
| morgan | djc_: yes. That is the per-domain-backends | 17:18 |
| *** lhcheng has joined #openstack-keystone | 17:18 | |
| *** ChanServ sets mode: +v lhcheng | 17:18 | |
| morgan | djc_: the idea is that you put the service users in one domain (sql) and the non-service users in another domain (backed by AD) | 17:18 |
| morgan | This does require using keystone v3 however | 17:19 |
| djc_ | morgan: is there any documentation on this you could point me towards? I've been googling to no avail. Maybe using wrong search terms. | 17:19 |
| browne | dstanek: so 100000 instead of 1000000? | 17:19 |
| *** petertr7_away is now known as petertr7 | 17:20 | |
| dstanek | browne: yeah, 9 seconds is way to long for a single operation like that | 17:20 |
| morgan | djc_: there is but i'll need to find it. In our docs (configuratiob) look for per-domain identity | 17:20 |
| browne | dstanek: 1000000 is about 0m1.918s. 100000 is 0m0.335s | 17:20 |
| djc_ | morgan: and this would be in the keystone.conf file correct? | 17:21 |
| dstanek | browne: actually i read it wrong....but i still think 100k | 17:21 |
| morgan | djc_: here is a great post on it http://www.ibm.com/developerworks/cloud/library/cl-configure-keystone-ldap-and-active-directory/index.html | 17:21 |
| morgan | That post is written by henrynash. He wrote the code for per-domain backends | 17:21 |
| *** doug-fish has quit IRC | 17:21 | |
| browne | dstanek: sure i can make 100k | 17:22 |
| dstanek | dolphm, lbragstad: didn't you guys have some performance numbers based on the number of rounds for fernet? | 17:22 |
| djc_ | morgan: thanks. I really appreciate it. I will read the post. | 17:22 |
| lbragstad | dstanek: yeah, it was buried in a review from long long ago | 17:22 |
| morgan | djc_: and http://docs.openstack.org/developer/keystone/configuration.html#domain-specific-drivers is our internal docs | 17:22 |
| morgan | Rounds for fernet? | 17:22 |
| djc_ | morgan: Even better. Thanks. | 17:23 |
| morgan | Fernet iirc doesnt use "rounds" directly | 17:23 |
| lbragstad | dstanek: are you referring to the password crypt strength? | 17:23 |
| morgan | djc_: the blog post will be more in depth | 17:23 |
| dstanek | lbragstad: yes | 17:23 |
| morgan | dstanek: fernet doesnt use rounds like the password hashing does. | 17:23 |
| *** mestery has joined #openstack-keystone | 17:23 | |
| morgan | Since fernet is a signature and real encryption not one way hashing | 17:24 |
| dstanek | morgan: when we were bench marking fernet we were tuning the # of rounds to get performance statistics | 17:25 |
| morgan | Rounds are strictly password afaik | 17:25 |
| morgan | It can affect how fast password validation is | 17:26 |
| dolphm | dstanek: yeah, not for fernet, it was just password hashing on auth | 17:26 |
| morgan | But the crypt strength in the keystone.conf has nothing to do with the fernet token itself | 17:26 |
| *** mpmsimo has quit IRC | 17:27 | |
| dolphm | fernet crypt "strength" is fixed at 128-bit AES CBC | 17:27 |
| *** jecarey has quit IRC | 17:29 | |
| dstanek | right... miss type ... i meant when we were looking into performance when fernet was being implemented ... it wasn't a fernet issue, but i think that's when we found it | 17:29 |
| morgan | dolphm: ++ | 17:30 |
| dstanek | i want to check out the numbers and compare them to browne's. if we are going to advertise a max rounds, i don't want it to be unusable | 17:32 |
| *** jasonsb has quit IRC | 17:33 | |
| lbragstad | dstanek: https://github.com/openstack/keystone/commit/67e0ba5ee2108731050e26f7b4dd6c8d3dab118d | 17:33 |
| lbragstad | I think that was the one | 17:33 |
| *** jasonsb has joined #openstack-keystone | 17:34 | |
| lbragstad | dstanek: https://review.openstack.org/#/c/165295/ | 17:34 |
| *** piyanai has quit IRC | 17:35 | |
| dstanek | lbragstad: that's it. thx | 17:37 |
| *** ajayaa has quit IRC | 17:37 | |
| *** jasonsb has quit IRC | 17:38 | |
| *** mylu has quit IRC | 17:38 | |
| dstanek | browne: ^ check out those links for why 40k was too high | 17:39 |
| browne | dstanek: ok, i'll take a look | 17:39 |
| *** exploreshaifali has quit IRC | 17:40 | |
| *** mylu has joined #openstack-keystone | 17:44 | |
| *** djc_ has quit IRC | 17:48 | |
| *** piyanai has joined #openstack-keystone | 17:51 | |
| samueldmq | hmm, lbragstad just updated the meeting page, needed to do a rebase -i | 17:53 |
| samueldmq | :) | 17:53 |
| *** urulama has quit IRC | 17:54 | |
| vivekd | dstanek: hi | 17:54 |
| lbragstad | samueldmq: oh really? conflict? | 17:54 |
| lbragstad | samueldmq: sorry about that | 17:54 |
| vivekd | dstanek last week you had said that you would bring up the stable driver interfaces in today's meeting but i see that you have not added it in the agenda @ https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting | 17:54 |
| *** urulama has joined #openstack-keystone | 17:55 | |
| browne | dstanek: is 100k a fair max? that allows for growth in speed of cpus in the future. 40k was too high for a default if i read correctly, but not necessarily as a max | 17:56 |
| samueldmq | lbragstad, haha np, just because I updated the whole agenda (due to indentation) | 17:56 |
| *** ngupta has quit IRC | 17:56 | |
| samueldmq | vivekd, hi, feel free to do so, anyone can add topics to the agenda | 17:57 |
| samueldmq | vivekd, just to let you know :) | 17:57 |
| *** tqtran has joined #openstack-keystone | 17:57 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Use min and max on IntOpt option types https://review.openstack.org/212373 | 17:58 |
| vivekd | samueldmq: ok. but it was dstanek who wanted to discuss. is it ok if i add it on his behalf? | 17:58 |
| dstanek | vivekd: hi. did i say i would do that? | 17:58 |
| *** samleon has quit IRC | 17:58 | |
| dstanek | vivekd: we had a good discussion on in yesterday in irc so it may not be necessary anymore | 17:58 |
| *** henrynash has joined #openstack-keystone | 17:59 | |
| *** ChanServ sets mode: +v henrynash | 17:59 | |
| *** mpmsimo has joined #openstack-keystone | 18:00 | |
| vivekd | yes dstanek | 18:00 |
| vivekd | dstanek: ok | 18:00 |
| *** doug-fish has joined #openstack-keystone | 18:01 | |
| *** mpmsimo has quit IRC | 18:03 | |
| *** mpmsimo has joined #openstack-keystone | 18:03 | |
| josdotso | Would it be possible to create a broker Keystone (tier a) with Federated trusts to a tier (b) that already has external trusts to another tier (c)? Such that the broker tier (a) contains no users, but maps users from the all of tier c, via b? :) | 18:06 |
| *** browne has quit IRC | 18:06 | |
| *** ngupta has joined #openstack-keystone | 18:07 | |
| *** amg__ has joined #openstack-keystone | 18:10 | |
| *** piyanai has quit IRC | 18:10 | |
| *** marzif has quit IRC | 18:11 | |
| *** jasonsb has joined #openstack-keystone | 18:12 | |
| *** tonytan4ever has quit IRC | 18:14 | |
| *** urulama_ has joined #openstack-keystone | 18:14 | |
| *** ksavich has joined #openstack-keystone | 18:15 | |
| *** lhcheng_ has joined #openstack-keystone | 18:15 | |
| *** _sigmavirus24 has joined #openstack-keystone | 18:16 | |
| *** lhcheng has quit IRC | 18:17 | |
| *** urulama has quit IRC | 18:17 | |
| *** sigmavirus24 has quit IRC | 18:17 | |
| *** Qlawy has quit IRC | 18:17 | |
| *** Qlawy has joined #openstack-keystone | 18:18 | |
| *** Qlawy has joined #openstack-keystone | 18:18 | |
| *** _sigmavirus24 is now known as sigmavirus24 | 18:20 | |
| *** sigmavirus24 has joined #openstack-keystone | 18:20 | |
| *** doug-fish has quit IRC | 18:23 | |
| *** jecarey has joined #openstack-keystone | 18:27 | |
| *** doug-fish has joined #openstack-keystone | 18:29 | |
| *** tonytan4ever has joined #openstack-keystone | 18:31 | |
| *** jsavak has quit IRC | 18:40 | |
| *** henrynash has quit IRC | 18:42 | |
| dstanek | if you can subvert the TLS cert then you can subvert the policy signing cert! | 18:42 |
| lhcheng_ | that's a good argument | 18:43 |
| morgan | josdotso: i am not sure i can parse that question... But possibly? | 18:45 |
| josdotso | morgan: sorry for the confusion. I guess it's keystone trusting keystone trusting keystone | 18:45 |
| morgan | Keystone can federate to other keystones ... So likely but i havent tried it. | 18:45 |
| morgan | It would mean a lot of sso-handoff-auth to get from b to c | 18:46 |
| morgan | Auth with b, sso auth to a, sso auth to c | 18:46 |
| josdotso | Thanks for your help. That makes sense to me. | 18:47 |
| gyee | dstanek, its not just about TLS, its about checking to make sure the file downloaded is the same as the one at the server, that's all | 18:48 |
| dstanek | gyee: what's the case where it won't be? | 18:49 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:49 |
| *** csoukup has quit IRC | 18:51 | |
| lhcheng_ | gyee: have you heard back from security guys if we want pycadf notifications for ^ | 18:52 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:52 |
| *** jasonsb has quit IRC | 18:52 | |
| *** marzif has joined #openstack-keystone | 18:52 | |
| *** jasonsb has joined #openstack-keystone | 18:53 | |
| *** mylu has quit IRC | 18:53 | |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:53 |
| *** urulama_ has quit IRC | 18:54 | |
| *** urulama has joined #openstack-keystone | 18:54 | |
| openstackgerrit | Roxana Gherle proposed openstack/python-keystoneclient: Deprecate default admin endpoint type for v3 client https://review.openstack.org/185200 | 18:54 |
| openstackgerrit | Sam Leong proposed openstack/keystone: Tokenless authz with X.509 SSL client certificate https://review.openstack.org/156870 | 18:56 |
| gyee | lhcheng_, yes, we need CADF on auth, but my understanding is that mapping validation already produce CADF, no? | 18:57 |
| roxanaghe | bknudson, for the "default endpoint type switched to public" patch did you suggest adding that to feature/keystoneauth_integration branch or somewhere else? | 18:57 |
| gyee | dstanek, dunno, you never downloaded anything corrupted before? | 18:57 |
| *** spandhe has joined #openstack-keystone | 18:58 | |
| roxanaghe | bknudson, this is the review that I uploaded https://review.openstack.org/#/c/215261/, but dstanek was asking if it's the right place.. | 18:58 |
| bknudson | roxanaghe: the feature branch is the right place since that will be ksc 2.0 | 18:58 |
| roxanaghe | bknudson, ok thx | 18:58 |
| *** mylu has joined #openstack-keystone | 19:02 | |
| lhcheng_ | gyee: idk if mapping emits a pycadf notification, I don't recall seeing a pycadf resource related to mapping validation | 19:03 |
| gyee | lhcheung_, k, in that case, we need to add it | 19:05 |
| *** mylu has quit IRC | 19:05 | |
| *** mylu has joined #openstack-keystone | 19:06 | |
| raildo | maybe we I think that we can approve this | 19:07 |
| raildo | maybe we can approve this patch* https://review.openstack.org/#/c/189366/ | 19:07 |
| lhcheng_ | gyee: I'll check with stevemar when I catch him online. | 19:08 |
| *** lhcheng_ is now known as lhcheng_away | 19:08 | |
| *** ksavich has quit IRC | 19:16 | |
| *** claudiub has quit IRC | 19:16 | |
| *** tqtran has quit IRC | 19:21 | |
| *** jlk has joined #openstack-keystone | 19:21 | |
| *** jasonsb has quit IRC | 19:21 | |
| jlk | hey all, I'm in need of tracing through keystonemiddleware, and how it interacts with python requests. I've got a bug where when I supply a certs file requests barfs on it, and I'd like to trace through that. (this is through swift proxy too). Are there any helpful hints for making this work, because I can't seem to get it to either use pdb or epdb to get me an interactive session | 19:22 |
| *** rm_work|away is now known as rm_work | 19:23 | |
| *** jdennis has joined #openstack-keystone | 19:23 | |
| gyee | jlk, what do you mean "barfs on it"? | 19:25 |
| *** ngupta has quit IRC | 19:25 | |
| gyee | openssl cli is your best friend in debugging SSL issues | 19:25 |
| *** dims__ has quit IRC | 19:25 | |
| jlk | yeah, I think I'm going ot have to go there, but requests is reporting an error of no such file when referencing the cert | 19:26 |
| *** dims has joined #openstack-keystone | 19:26 | |
| jlk | well, crap something just changed, hold. | 19:26 |
| *** exploreshaifali has joined #openstack-keystone | 19:27 | |
| *** rm_work is now known as rm_work|away | 19:27 | |
| *** jdennis has quit IRC | 19:28 | |
| *** csoukup has joined #openstack-keystone | 19:29 | |
| dstanek | jlk: can you make a small testcase outside of middleware to debug? | 19:32 |
| jlk | I'm trying | 19:32 |
| dstanek | jlk: also i've used rpdb against keystone so i'm assuming it would work against swift | 19:34 |
| jlk | ugh, finally got it to start up again. | 19:34 |
| jlk | https://gist.github.com/j2sol/d190eab86f9499aef6d9 is the error I get | 19:35 |
| jlk | the file exists, the swift user is able to read it | 19:35 |
| jlk | I'm not sure what options to openssl command line would be appropriate to validate it's format | 19:35 |
| *** jasonsb has joined #openstack-keystone | 19:36 | |
| gyee | looks like it doesn't like the double quotes in the path | 19:37 |
| *** jdennis has joined #openstack-keystone | 19:37 | |
| gyee | '"..."' | 19:37 |
| jlk | ..... | 19:37 |
| dstanek | marekd: you still hanging out in here? | 19:38 |
| gyee | [Errno bad ca_certs: '"/etc/ssl/certs/ca-certificates.crt"'] | 19:38 |
| gyee | [('system library', 'fopen', 'No such file or directory'), | 19:38 |
| jlk | yeah I can't believe I overlooked the quotes. | 19:38 |
| jlk | holy crap that was it. That's so silly | 19:38 |
| dstanek | jlk: you seem to have extra doubles | 19:38 |
| gyee | yeah, it happens :) | 19:39 |
| * dstanek is always late to the party | 19:39 | |
| jlk | no, the config file only has single doubles. | 19:39 |
| jlk | I took out all quotes and it works | 19:39 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Centralized Policies Distribution Mechanism https://review.openstack.org/216851 | 19:41 |
| jlk | changing config in this way makes it work: cafile = "/etc/ssl/certs/ca-certificates.crt" -> cafile = /etc/ssl/certs/ca-certificates.crt | 19:41 |
| gyee | food time | 19:42 |
| *** gyee has quit IRC | 19:42 | |
| *** greystart has quit IRC | 19:43 | |
| *** ankita_w_ has quit IRC | 19:43 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Ensure ephemeral user's user_id is url-safe https://review.openstack.org/215221 | 19:43 |
| jlk | Feels like something that's kinda broken in either keystone middleware config parsing, or swift parsing of those options sending them to keystone middleware. | 19:44 |
| dstanek | ^ federation review that should be ready to merge! | 19:44 |
| *** marzif_ has joined #openstack-keystone | 19:44 | |
| *** marzif has quit IRC | 19:46 | |
| *** ankita_wagh has joined #openstack-keystone | 19:47 | |
| *** samueldmq has quit IRC | 19:48 | |
| *** ngupta has joined #openstack-keystone | 19:50 | |
| *** ngupta has quit IRC | 19:52 | |
| *** ngupta has joined #openstack-keystone | 19:52 | |
| *** dtroyer has joined #openstack-keystone | 19:55 | |
| *** jasonsb has quit IRC | 20:02 | |
| *** jasonsb has joined #openstack-keystone | 20:03 | |
| *** browne has joined #openstack-keystone | 20:05 | |
| *** tonytan4ever has quit IRC | 20:06 | |
| *** petertr7 is now known as petertr7_away | 20:11 | |
| *** mylu has quit IRC | 20:17 | |
| *** exploreshaifali has quit IRC | 20:17 | |
| *** amg__ has quit IRC | 20:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Additional documentation for services https://review.openstack.org/211184 | 20:18 |
| *** mylu has joined #openstack-keystone | 20:19 | |
| *** mpmsimo has quit IRC | 20:25 | |
| *** mpmsimo has joined #openstack-keystone | 20:26 | |
| *** tqtran has joined #openstack-keystone | 20:32 | |
| *** ngupta has quit IRC | 20:33 | |
| *** lhcheng_away is now known as lhcheng | 20:34 | |
| *** ChanServ sets mode: +v lhcheng | 20:34 | |
| *** ngupta has joined #openstack-keystone | 20:34 | |
| morgan | jlk: it's a config processor but since swift loads in from paste-ini (iirc) there is little we can do | 20:34 |
| morgan | jlk: if they loaded with oslo.config it is a bit easier | 20:34 |
| *** e0ne has quit IRC | 20:35 | |
| *** gyee has joined #openstack-keystone | 20:41 | |
| *** ChanServ sets mode: +v gyee | 20:41 | |
| *** ngupta__ has joined #openstack-keystone | 20:44 | |
| openstackgerrit | Merged openstack/keystone: Update Httpd configuration docs for sites-available/enabled https://review.openstack.org/208025 | 20:44 |
| *** henrynash has joined #openstack-keystone | 20:45 | |
| *** ChanServ sets mode: +v henrynash | 20:45 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No More .reload_backends() or .reload_backend() https://review.openstack.org/216473 | 20:45 |
| *** henrynash has quit IRC | 20:51 | |
| *** samleon has joined #openstack-keystone | 20:57 | |
| *** pnavarro has joined #openstack-keystone | 20:58 | |
| *** thiagop has quit IRC | 20:59 | |
| *** josdotso has quit IRC | 21:00 | |
| *** raildo is now known as raildo-afk | 21:03 | |
| *** tqtran has quit IRC | 21:06 | |
| *** pnavarro has quit IRC | 21:06 | |
| *** geoffarnold is now known as geoffarnoldX | 21:09 | |
| *** geoffarnoldX is now known as geoffarnold | 21:09 | |
| *** geoffarnold is now known as geoffarnoldX | 21:09 | |
| *** doug-fish has quit IRC | 21:12 | |
| morgan | dstanek: I cc'd you on an email re summit space, please let me know if it looks out of whack | 21:13 |
| morgan | dstanek: i'll bug stevemar about it as well when he's back | 21:13 |
| *** hrou has quit IRC | 21:14 | |
| *** doug-fish has joined #openstack-keystone | 21:16 | |
| *** doug-fis_ has joined #openstack-keystone | 21:17 | |
| *** jecarey has quit IRC | 21:18 | |
| *** doug-fis_ has quit IRC | 21:18 | |
| *** doug-fis_ has joined #openstack-keystone | 21:19 | |
| *** doug-fish has quit IRC | 21:20 | |
| *** dave-mcc_ has quit IRC | 21:21 | |
| *** jecarey has joined #openstack-keystone | 21:21 | |
| *** pnavarro has joined #openstack-keystone | 21:23 | |
| *** exploreshaifali has joined #openstack-keystone | 21:26 | |
| jlk | morgan: thanks. I'll see if I can chase up a bug to file on the swift side. | 21:33 |
| morgan | jlk: you wont win that argument | 21:33 |
| morgan | swift doesn't use oslo_* packages | 21:33 |
| jlk | depends on who I argue with | 21:33 |
| jlk | if they don't use them, then it's certainly a bug in their own parser | 21:34 |
| morgan | well except this is parsed out of paste-ini i think | 21:34 |
| jlk | if not a bug in the parser, then a bug in the documentation for their config files. | 21:34 |
| morgan | which is apaste-ism | 21:34 |
| morgan | not really a bug | 21:34 |
| morgan | just the way paste pulls the item in, if it has quotes, it has quotes (literal) and when converted to a string it maintains the quotes | 21:34 |
| morgan | now a bug in documentation, sure | 21:35 |
| *** pnavarro has quit IRC | 21:36 | |
| jlk | further fun, they embed their own keystone middleware it seems. | 21:37 |
| *** mylu has quit IRC | 21:37 | |
| *** urulama has quit IRC | 21:38 | |
| *** urulama has joined #openstack-keystone | 21:38 | |
| *** annasort has quit IRC | 21:39 | |
| jlk | well they have it, but don't necessarily use it | 21:41 |
| *** bknudson has quit IRC | 21:42 | |
| *** mylu has joined #openstack-keystone | 21:44 | |
| *** ngupta has quit IRC | 21:44 | |
| *** ngupta__ has quit IRC | 21:44 | |
| *** doug-fis_ has quit IRC | 21:44 | |
| *** tonytan4ever has joined #openstack-keystone | 21:47 | |
| *** e0ne has joined #openstack-keystone | 21:48 | |
| *** diazjf has left #openstack-keystone | 21:49 | |
| *** jecarey has quit IRC | 21:50 | |
| *** claudiub has joined #openstack-keystone | 21:57 | |
| *** geoffarnoldX is now known as geoffarnold | 21:57 | |
| *** pgbridge has quit IRC | 21:57 | |
| *** samueldmq has joined #openstack-keystone | 21:58 | |
| *** edmondsw has quit IRC | 21:58 | |
| openstackgerrit | Merged openstack/keystoneauth: Fix plugin loading tests https://review.openstack.org/216511 | 21:59 |
| *** mpmsimo has left #openstack-keystone | 22:00 | |
| morgan | jlk: yah | 22:01 |
| *** lhcheng has quit IRC | 22:01 | |
| openstackgerrit | Claudiu Belu proposed openstack/python-keystoneclient: Fixes missing socket attribute error during init_poolmanager https://review.openstack.org/211686 | 22:07 |
| *** aix has joined #openstack-keystone | 22:07 | |
| openstackgerrit | Vivek Dhayaal proposed openstack/keystone: Stable Keystone Driver Interfaces https://review.openstack.org/209524 | 22:09 |
| morgan | dstanek: any value in enforcing .load_backends is called only ones? | 22:14 |
| morgan | once* | 22:14 |
| morgan | dstanek: load_fixtures should be for sure only called once. | 22:15 |
| *** e0ne has quit IRC | 22:16 | |
| openstackgerrit | Terry Howe proposed openstack/keystoneauth: Raise exception for v2 with domain scope https://review.openstack.org/216883 | 22:17 |
| *** lhcheng has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v lhcheng | 22:20 | |
| *** mylu has quit IRC | 22:20 | |
| *** a2hill has joined #openstack-keystone | 22:21 | |
| *** a2hill has left #openstack-keystone | 22:23 | |
| openstackgerrit | Merged openstack/keystone-specs: fix a simple typo "ì" -> "i" https://review.openstack.org/215444 | 22:25 |
| morgan | really we had an ì in the specs :P | 22:25 |
| morgan | heheh | 22:26 |
| jlk | cute. | 22:28 |
| jlk | morgan: almost as fun as finding languages in which "tolower" and "toupper" have ambiguous meaning, and can crash software. | 22:28 |
| morgan | jlk: SIGSEGV | 22:28 |
| dstanek | morgan: if it stops the stupid, then it's a good idea | 22:28 |
| morgan | dstanek: load_fixtures... putting a simple enforce in so it is only ever called once... 1780 failed tests | 22:29 |
| morgan | all ldap | 22:29 |
| morgan | because ... it was easier to just reload/re-populate things than split tests apart | 22:29 |
| morgan | dstanek: at least it is easy to fix. just ... ugh. | 22:29 |
| morgan | once this is done it'll be easier to not need a "clean" LDAP for functional tests | 22:29 |
| *** tonytan4ever has quit IRC | 22:29 | |
| dstanek | morgan: yeah, some tests do it accidentally since their setup does it and some parent's too... others explicitly do it | 22:29 |
| morgan | this is more explicit | 22:30 |
| morgan | "load thing slike you normally one, then muck with configs, then reload things" | 22:30 |
| * morgan wonders why it isn't "muck with configs then load stuff in" | 22:30 | |
| morgan | I think I'm going to add a couple calls to enforce .config_overrides is called once | 22:30 |
| morgan | (and is always called) | 22:30 |
| morgan | and i am debating if load_fixtures should always be called or not | 22:31 |
| *** mylu has joined #openstack-keystone | 22:31 | |
| *** samleon has quit IRC | 22:32 | |
| *** csoukup has quit IRC | 22:32 | |
| openstackgerrit | gordon chung proposed openstack/keystonemiddleware: use the same context across a request https://review.openstack.org/216889 | 22:35 |
| dstanek | morgan: extracurricular activities https://pypi.python.org/pypi/tox-run-command | 22:39 |
| morgan | ooo | 22:39 |
| dstanek | was trying to make a better version of with_venv.sh that integrates better with our dev tools | 22:42 |
| gyee | dstanek, morgan, https://review.openstack.org/#/c/209524/ | 22:42 |
| gyee | just want to make sure we are on the same page | 22:43 |
| *** tqtran has joined #openstack-keystone | 22:43 | |
| dstanek | gyee: not really. i like the idea of just having a subclass per version | 22:44 |
| dstanek | we can deprecate classes, remove them when they are unsupported, etc | 22:45 |
| gyee | dstanek, you mean Compatiblizer? | 22:45 |
| morgan | dstanek: yes subclass per version | 22:46 |
| gyee | you mean like Kilodriver, LibertyDriver, etc? | 22:46 |
| morgan | gyee: use numbers but yes. | 22:46 |
| morgan | because if liberty doesn't change the interface | 22:47 |
| morgan | we don't need to increment | 22:47 |
| morgan | for example | 22:47 |
| gyee | some some subclass may just be a "pass" if there are no new interfaces | 22:47 |
| dstanek | gyee: yep, like morgan said, with numbers | 22:47 |
| dstanek | no magic meta classes needed | 22:47 |
| gyee | like Driver12, Driver13, | 22:47 |
| dstanek | gyee: ++ yep, then it's explicit that there are no changes | 22:48 |
| dstanek | ok, gotta run. be back in a hour | 22:48 |
| morgan | dstanek: i would argue if there are no changes, don't increment/make a new class | 22:48 |
| *** spandhe_ has joined #openstack-keystone | 22:48 | |
| gyee | morgan, like the way we handle sql migration? | 22:49 |
| morgan | basically yes | 22:49 |
| *** spandhe has quit IRC | 22:49 | |
| *** spandhe_ is now known as spandhe | 22:49 | |
| morgan | if you make a change create the new driver | 22:49 |
| gyee | k | 22:49 |
| morgan | if we lock the interface at the milestone, then after the <marker> we would create a new interface *if* a change occurs | 22:50 |
| gyee | k | 22:50 |
| gyee | vivekd, ^^^ | 22:50 |
| *** dsirrine has quit IRC | 22:50 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: No More .reload_backends() or .reload_backend() https://review.openstack.org/216473 | 22:53 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enforce .config_overrides is called exactly once https://review.openstack.org/216892 | 22:53 |
| morgan | ARGH | 22:53 |
| morgan | why did it do that... | 22:53 |
| * morgan glares angrily at git-review | 22:55 | |
| gyee | dependency fail? :) | 22:55 |
| *** asd112z has quit IRC | 22:59 | |
| *** shoutm has joined #openstack-keystone | 23:01 | |
| vivekd | gyee: subclassing is ok whenever we create a new interface. | 23:02 |
| vivekd | gyee: but we want to warn the user when he;s running a older driver implemenation against a newer interface. | 23:02 |
| vivekd | gyee: the metaclass serves that purpose | 23:02 |
| gyee | vivekd, you can do it with subclass too right? | 23:03 |
| gyee | just check the parent to see which version it is implementing | 23:03 |
| *** dsirrine has joined #openstack-keystone | 23:03 | |
| vivekd | gyee: that parent check logic again has to be placed inside a metaclass na? | 23:04 |
| *** __TheDodd__ has quit IRC | 23:08 | |
| gyee | vivekd, actually, you don't have to do parent check at all | 23:08 |
| vivekd | gyee: say we've driver11, 12, interfaces and "driver11impl" implementing driver11 interface. | 23:08 |
| gyee | as each class would still define INTERFACE_VERSION | 23:08 |
| gyee | so your code still works | 23:08 |
| vivekd | gyee: inside metaclass we can check that driver11impl is not implementing the latest(driver12) and so warn the user | 23:10 |
| vivekd | gyee: ok | 23:10 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate ServiceCatalog.get_urls() with no attr https://review.openstack.org/205810 | 23:12 |
| gyee | vivekd, if I understand morgan and dstanek correctly, it's a small change from your current patch | 23:13 |
| gyee | something like | 23:13 |
| gyee | class Driver12(Driver): | 23:13 |
| gyee | interface_version = manager.LIBERTY | 23:13 |
| vivekd | gyee: ok. u mean this Driver12 class needs to be added in all core.py files containing Driver interfaces? | 23:15 |
| gyee | vivekd, right | 23:16 |
| gyee | and have the backends implement that class | 23:17 |
| *** gordc has quit IRC | 23:17 | |
| gyee | interface | 23:17 |
| *** mylu has quit IRC | 23:17 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for Session.construct() https://review.openstack.org/205812 | 23:17 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate use of cert and key https://review.openstack.org/205813 | 23:18 |
| *** mylu has joined #openstack-keystone | 23:18 | |
| vivekd | gyee: ok then shall i add those two lines in all core.py files and modify all implementations to inherit this new class Driver12 and resubmit the patch now? | 23:20 |
| vivekd | gyee: will u be available to review it now? | 23:21 |
| gyee | vivekd, right | 23:21 |
| gyee | morgan, dstanek, does that sound right? | 23:21 |
| *** mylu has quit IRC | 23:22 | |
| *** bitblt has joined #openstack-keystone | 23:28 | |
| *** bitblt has quit IRC | 23:28 | |
| *** mylu has joined #openstack-keystone | 23:29 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Proper deprecation for Session.get_token() https://review.openstack.org/205817 | 23:29 |
| *** marzif_ has quit IRC | 23:29 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate create v2_0 Client without session https://review.openstack.org/205820 | 23:31 |
| openstackgerrit | Merged openstack/python-keystoneclient: Deprecate create v3 Client without session https://review.openstack.org/205822 | 23:32 |
| *** mylu has quit IRC | 23:33 | |
| *** vivekd_ has joined #openstack-keystone | 23:35 | |
| *** vivekd has quit IRC | 23:36 | |
| *** vivekd_ is now known as vivekd | 23:36 | |
| *** annasort has joined #openstack-keystone | 23:40 | |
| *** annasort has quit IRC | 23:41 | |
| *** zzzeek has quit IRC | 23:45 | |
| *** zzzeek has joined #openstack-keystone | 23:49 | |
| *** dave-mccowan has joined #openstack-keystone | 23:49 | |
| dstanek | morgan: gyee: vivekd: i have to read up, but the reason i like 1 version per release (even if no changes are made) makes it very easy for developers to know what the current version is | 23:50 |
| dstanek | it's not 5 the identity, 2 for assignment and 10 to tokens | 23:50 |
| gyee | dstanek, that's fine | 23:50 |
| gyee | no disagreement here | 23:50 |
| dstanek | gyee: vivekd: it's much easier than what you are thinking. a driver sublclasses identity.DriverV1, when DriverV2 is published we add the deprecated decorator to DriverV1.__init__ | 23:53 |
| *** zzzeek has quit IRC | 23:53 | |
| gyee | dstanek, but you don't want to deprecated if no new interfaces are added right? | 23:54 |
| dstanek | gyee: then you just make the decision for that driver not to deprecate it. it can be done driver by driver. | 23:56 |
| gyee | dstanek, yeah, make sense | 23:56 |
| gyee | that way, we don't need to do any version check | 23:56 |
| gyee | great idea! | 23:56 |
| dstanek | it's very simple and takes advantage of what we are already doing so there is less to learn | 23:57 |
| dstanek | i'll document some of my thoughts and push up a review | 23:58 |
| gyee | dstanek, ++ | 23:58 |
| dstanek | need to get some of these other patches mergable first | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!