| *** geoffarnold has quit IRC | 00:00 | |
| *** dsirrine has quit IRC | 00:08 | |
| *** mylu has joined #openstack-keystone | 00:16 | |
| *** gildub has joined #openstack-keystone | 00:16 | |
| lhcheng | jamielennox: does KSM do any caching of the service token? | 00:19 |
|---|---|---|
| jamielennox | lhcheng: yes and no | 00:19 |
| lhcheng | jamielennox: we talked about this morning, and wasn't sure about the current state. | 00:19 |
| jamielennox | lhcheng: per thread the token is maintained for the lifetime of the token so you only authenticate the service user once per timeout period per thread | 00:20 |
| *** geoffarn_ has quit IRC | 00:20 | |
| jamielennox | but there is currently no cross-thread or cross-process caching | 00:20 |
| *** geoffarnold has joined #openstack-keystone | 00:21 | |
| jamielennox | we added a change recently to put a lock in that should allow cross-thread service token sharing | 00:21 |
| jamielennox | (when g-r catches up) | 00:21 |
| jamielennox | but it doesn't go to memcache or anything | 00:21 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/230464 | 00:21 |
| *** mylu has quit IRC | 00:22 | |
| jamielennox | actually it may take some more time to get per-process caching because of the paste conf options - would need to test that out | 00:22 |
| *** roxanagh_ has quit IRC | 00:23 | |
| *** shadower has quit IRC | 00:23 | |
| *** mylu has joined #openstack-keystone | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| lhcheng | jamielennox: so the caching of per timeout period per thread happens because of the use of Session object ? | 00:24 |
| jamielennox | it does, but auth_token has always done that | 00:24 |
| lhcheng | if we don't have cross-thread service token sharing yet, so this patch then is not useful? https://review.openstack.org/#/c/229361/ | 00:26 |
| boris-42 | SpamapS: heh so | 00:26 |
| boris-42 | SpamapS: someday we can rename that stuff | 00:26 |
| lhcheng | jamielennox: ^^ | 00:26 |
| lhcheng | jamielennox: do we still want to backport that? | 00:27 |
| jamielennox | lhcheng: so that is the change i was refering to that would allow per-process | 00:27 |
| jamielennox | lhcheng: in this case the target is not auth_token middleware but the nova service user | 00:27 |
| *** mylu has quit IRC | 00:27 | |
| jamielennox | or nova admin user | 00:27 |
| jamielennox | basically they want to do exactly that, to allow per-process token caching | 00:28 |
| jamielennox | at the moment they do that but it's got a reauthentication problem | 00:28 |
| jamielennox | i'm not sure personally on whether we backport that | 00:29 |
| jamielennox | because the fix that would require it didn't get into nova in liberty | 00:29 |
| jamielennox | afaik | 00:29 |
| lhcheng | jamielennox: I see | 00:30 |
| lhcheng | jamielennox: let's just not backport it then. | 00:30 |
| jamielennox | i wouldn't mind seeing what dimms wants it for | 00:30 |
| lhcheng | jamielennox: actually we weren't sure if it was still useful, I saw it was abandoned this morning then asked him why it got abandoned. | 00:32 |
| lhcheng | told dims I'll follow with you to confirm if we really do want it for backport | 00:32 |
| lhcheng | *follow-up | 00:32 |
| jamielennox | i'm not sure what they came up with as a fix on the nova side, i think we abandon the back-port and solve the problem properly in mitake | 00:32 |
| jamielennox | mitaka | 00:33 |
| jamielennox | have to get used to typing that | 00:33 |
| lhcheng | jamielennox: probably the fix didn't make it, and dims forgot about the reason for abandoning that backport. | 00:36 |
| *** ayoung has quit IRC | 00:37 | |
| *** _hrou_ has joined #openstack-keystone | 00:38 | |
| *** hrou has quit IRC | 00:41 | |
| *** geoffarn_ has joined #openstack-keystone | 00:42 | |
| *** geoffarnold has quit IRC | 00:46 | |
| *** gildub has quit IRC | 00:46 | |
| *** mylu has joined #openstack-keystone | 00:48 | |
| *** dims_ has joined #openstack-keystone | 00:50 | |
| *** Ephur has quit IRC | 00:52 | |
| *** mylu has quit IRC | 00:53 | |
| *** _cjones_ has quit IRC | 00:55 | |
| *** dims_ has quit IRC | 00:55 | |
| *** gyee has quit IRC | 00:57 | |
| *** browne has quit IRC | 00:57 | |
| *** dims_ has joined #openstack-keystone | 00:58 | |
| *** su_zhang_ has quit IRC | 00:59 | |
| openstackgerrit | Merged openstack/keystone: Use deepcopy of mapping fixtures in tests https://review.openstack.org/229714 | 00:59 |
| *** agireud has quit IRC | 01:01 | |
| *** topol has joined #openstack-keystone | 01:02 | |
| *** ChanServ sets mode: +v topol | 01:02 | |
| openstackgerrit | Merged openstack/keystoneauth: auto-generate release history https://review.openstack.org/227657 | 01:02 |
| *** geoffarn_ has quit IRC | 01:03 | |
| *** geoffarnold has joined #openstack-keystone | 01:03 | |
| *** ayoung has joined #openstack-keystone | 01:05 | |
| *** ChanServ sets mode: +v ayoung | 01:05 | |
| *** dsirrine has joined #openstack-keystone | 01:06 | |
| *** topol has quit IRC | 01:07 | |
| *** tqtran_ has quit IRC | 01:16 | |
| *** jbell8 has quit IRC | 01:17 | |
| *** geoffarnold has quit IRC | 01:24 | |
| *** geoffarnold has joined #openstack-keystone | 01:24 | |
| *** markvoelker has quit IRC | 01:28 | |
| *** dims_ has quit IRC | 01:30 | |
| *** btully has quit IRC | 01:41 | |
| *** geoffarn_ has joined #openstack-keystone | 01:46 | |
| *** geoffarnold has quit IRC | 01:46 | |
| openstackgerrit | Merged openstack/keystone: Ensure token validation works irrespective of padding https://review.openstack.org/221786 | 01:48 |
| *** stevemar_ has quit IRC | 01:59 | |
| *** stevemar_ has joined #openstack-keystone | 02:00 | |
| *** ChanServ sets mode: +o stevemar_ | 02:00 | |
| jamielennox | stevemar_: can you +A https://review.openstack.org/#/c/230232/ - stable/kilo, has 2 +2 | 02:06 |
| *** geoffarn_ has quit IRC | 02:07 | |
| stevemar_ | jamielennox: aye aye | 02:07 |
| *** geoffarnold has joined #openstack-keystone | 02:07 | |
| *** mylu has joined #openstack-keystone | 02:12 | |
| *** lhcheng has quit IRC | 02:14 | |
| *** mylu has quit IRC | 02:14 | |
| *** mylu has joined #openstack-keystone | 02:15 | |
| *** csoukup has joined #openstack-keystone | 02:18 | |
| *** csoukup has quit IRC | 02:22 | |
| *** mylu has quit IRC | 02:23 | |
| *** gildub has joined #openstack-keystone | 02:25 | |
| *** geoffarnold has quit IRC | 02:26 | |
| *** browne has joined #openstack-keystone | 02:26 | |
| *** geoffarnold has joined #openstack-keystone | 02:28 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 02:33 |
| *** dsirrine has quit IRC | 02:34 | |
| *** topol has joined #openstack-keystone | 02:35 | |
| *** ChanServ sets mode: +v topol | 02:35 | |
| *** mylu has joined #openstack-keystone | 02:37 | |
| *** richm has joined #openstack-keystone | 02:37 | |
| *** mylu has quit IRC | 02:40 | |
| stevemar_ | jamielennox: thoughts on the latest comments from https://review.openstack.org/#/c/177227/ | 02:41 |
| *** stevemar_ has quit IRC | 02:41 | |
| *** stevemar_ has joined #openstack-keystone | 02:42 | |
| *** ChanServ sets mode: +o stevemar_ | 02:42 | |
| *** alextricity has quit IRC | 02:43 | |
| *** stevemar_ has quit IRC | 02:43 | |
| *** stevemar_ has joined #openstack-keystone | 02:43 | |
| *** ChanServ sets mode: +o stevemar_ | 02:43 | |
| *** mylu has joined #openstack-keystone | 02:49 | |
| *** sdake has joined #openstack-keystone | 02:49 | |
| *** richm has quit IRC | 02:50 | |
| *** jamielennox has quit IRC | 02:51 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 02:52 |
| *** btully has joined #openstack-keystone | 02:55 | |
| *** lhcheng has joined #openstack-keystone | 02:56 | |
| *** ChanServ sets mode: +v lhcheng | 02:56 | |
| *** agireud has joined #openstack-keystone | 02:57 | |
| *** ayoung has quit IRC | 02:58 | |
| *** lhcheng_ has joined #openstack-keystone | 02:58 | |
| *** topol has quit IRC | 02:58 | |
| *** ngupta has joined #openstack-keystone | 02:59 | |
| *** btully has quit IRC | 03:00 | |
| *** lhcheng has quit IRC | 03:01 | |
| openstackgerrit | Merged openstack/keystone: Trivial fix of some typos found https://review.openstack.org/231189 | 03:03 |
| *** markvoelker_ has joined #openstack-keystone | 03:05 | |
| *** sdake has quit IRC | 03:09 | |
| *** sdake has joined #openstack-keystone | 03:10 | |
| *** geoffarn_ has joined #openstack-keystone | 03:11 | |
| *** geoffarnold has quit IRC | 03:12 | |
| *** jamielennox has joined #openstack-keystone | 03:13 | |
| *** ChanServ sets mode: +v jamielennox | 03:13 | |
| *** sdake has quit IRC | 03:13 | |
| *** stevemar_ has quit IRC | 03:21 | |
| *** markvoelker has joined #openstack-keystone | 03:22 | |
| *** stevemar_ has joined #openstack-keystone | 03:22 | |
| *** ChanServ sets mode: +o stevemar_ | 03:22 | |
| *** roxanagh_ has joined #openstack-keystone | 03:22 | |
| *** markvoelker_ has quit IRC | 03:25 | |
| *** markvoelker_ has joined #openstack-keystone | 03:26 | |
| *** su_zhang_ has joined #openstack-keystone | 03:27 | |
| *** su_zhang_ has quit IRC | 03:27 | |
| *** markvoelker has quit IRC | 03:28 | |
| *** su_zhang_ has joined #openstack-keystone | 03:28 | |
| *** roxanagh_ has quit IRC | 03:29 | |
| *** sdake has joined #openstack-keystone | 03:33 | |
| *** lhcheng has joined #openstack-keystone | 03:48 | |
| *** ChanServ sets mode: +v lhcheng | 03:48 | |
| *** lhcheng_ has quit IRC | 03:48 | |
| *** links has joined #openstack-keystone | 03:48 | |
| *** topol has joined #openstack-keystone | 03:51 | |
| *** ChanServ sets mode: +v topol | 03:51 | |
| *** geoffarn_ has quit IRC | 03:53 | |
| *** geoffarnold has joined #openstack-keystone | 03:53 | |
| *** topol has quit IRC | 04:05 | |
| *** topol has joined #openstack-keystone | 04:06 | |
| *** ChanServ sets mode: +v topol | 04:06 | |
| *** ngupta has quit IRC | 04:07 | |
| *** mylu has quit IRC | 04:13 | |
| *** geoffarnold has quit IRC | 04:14 | |
| *** geoffarnold has joined #openstack-keystone | 04:15 | |
| stevemar_ | lhcheng: around? | 04:30 |
| lhcheng | stevemar_: hey | 04:30 |
| stevemar_ | lhcheng: in https://review.openstack.org/#/c/222469/4/openstackclient/api/object_store_v1.py you mention escaping stuff | 04:31 |
| stevemar_ | what do you mean? | 04:31 |
| *** browne has quit IRC | 04:32 | |
| stevemar_ | lhcheng: unicode characters? | 04:32 |
| *** browne has joined #openstack-keystone | 04:32 | |
| lhcheng | I am wondering if it could be a potential security attack by using this value. | 04:34 |
| lhcheng | 'X-Object-Meta-%s' % k | 04:34 |
| lhcheng | k = "test:value;<malicous header/value>;test1" | 04:34 |
| lhcheng | the answer would depends on how the headers are passed by the create() method | 04:35 |
| *** _hrou_ has quit IRC | 04:35 | |
| *** geoffarn_ has joined #openstack-keystone | 04:36 | |
| lhcheng | dunno if swift would be vulnerable to: http://dunnesec.com/category/attacks-defence/http-header-injection/ | 04:38 |
| *** btully has joined #openstack-keystone | 04:39 | |
| *** jaosorior has joined #openstack-keystone | 04:39 | |
| *** su_zhang_ has quit IRC | 04:40 | |
| *** geoffarnold has quit IRC | 04:40 | |
| stevemar_ | lhcheng: ah okay... i wonder if there's a library that already does that checking | 04:46 |
| *** dims_ has joined #openstack-keystone | 04:46 | |
| lhcheng | looking at the code, it leverages the session object and internally just use the request object | 04:47 |
| stevemar_ | i think i just have to check if \r or \n are present | 04:51 |
| stevemar_ | hmm | 04:51 |
| stevemar_ | open a bug | 04:51 |
| stevemar_ | we can fix it in another patch i think | 04:51 |
| lhcheng | hmm it is just fine | 04:51 |
| stevemar_ | if you're okay with that | 04:52 |
| lhcheng | I'm not sure either if there's security issue, the headers are passed to the requests anyway | 04:52 |
| lhcheng | yeah, that was just a comment. we can look at it if needed. | 04:53 |
| lhcheng | stevemar_: the -1 is for not escaping the string used in the url | 04:54 |
| stevemar_ | lhcheng: cool cool | 04:54 |
| stevemar_ | new patch coming up anyway | 04:54 |
| lhcheng | great | 04:54 |
| stevemar_ | lhcheng: do you have an opinion on showing the properties? | 04:55 |
| stevemar_ | should we remove the 'x-metadata-container-%s'? | 04:55 |
| *** geoffarn_ has quit IRC | 04:57 | |
| *** geoffarnold has joined #openstack-keystone | 04:57 | |
| lhcheng | thought we just remove "x-container-", similar to what you did for: | 05:00 |
| lhcheng | 'meta-owner': response.headers.get('x-container-meta-owner', None), | 05:00 |
| *** _fortis has quit IRC | 05:02 | |
| *** charz has quit IRC | 05:02 | |
| *** morgan has quit IRC | 05:02 | |
| *** redrobot has quit IRC | 05:03 | |
| *** atiwari1 has joined #openstack-keystone | 05:03 | |
| *** atiwari has quit IRC | 05:03 | |
| *** mfisch has quit IRC | 05:03 | |
| *** baffle has quit IRC | 05:03 | |
| *** amakarov_away has quit IRC | 05:03 | |
| *** baffle has joined #openstack-keystone | 05:04 | |
| *** tristanC has quit IRC | 05:04 | |
| *** tristanC has joined #openstack-keystone | 05:05 | |
| *** mfisch has joined #openstack-keystone | 05:06 | |
| *** mfisch is now known as Guest83454 | 05:06 | |
| *** morgan has joined #openstack-keystone | 05:06 | |
| *** ChanServ sets mode: +v morgan | 05:06 | |
| *** redrobot has joined #openstack-keystone | 05:08 | |
| *** redrobot is now known as Guest28678 | 05:09 | |
| *** charz has joined #openstack-keystone | 05:09 | |
| *** amakarov_away has joined #openstack-keystone | 05:09 | |
| *** sdake_ has joined #openstack-keystone | 05:09 | |
| *** geoffarnold has quit IRC | 05:11 | |
| *** sdake has quit IRC | 05:13 | |
| *** _fortis has joined #openstack-keystone | 05:15 | |
| stevemar_ | lhcheng: i think i'm going to postpone that one, i think dtroyer will have an opinion on it | 05:15 |
| lhcheng | stevemar_: sure, we can followup on thurs | 05:16 |
| stevemar_ | lhcheng: oh noes, i forgot about this chain of patches! https://review.openstack.org/#/c/226749/6 | 05:16 |
| *** lhcheng_ has joined #openstack-keystone | 05:18 | |
| *** topol has quit IRC | 05:19 | |
| *** geoffarnold has joined #openstack-keystone | 05:19 | |
| *** lhcheng has quit IRC | 05:21 | |
| lhcheng_ | stevemar_: oops, there's still one more day | 05:22 |
| lhcheng_ | stevemar_: two more (I thought it is already Tuesday) | 05:23 |
| lhcheng_ | stevemar_: I'll help on moving some of the patches forward, I'll look at some tomorrow | 05:23 |
| *** lhcheng has joined #openstack-keystone | 05:24 | |
| *** ChanServ sets mode: +v lhcheng | 05:24 | |
| stevemar_ | \o/ | 05:26 |
| stevemar_ | lhcheng_: it'll be neat to have some of these extra swift and glance commands in osc for liberty :P | 05:26 |
| *** lhcheng_ has quit IRC | 05:27 | |
| stevemar_ | lhcheng_: helping someone use OSC 1.0.3 is so very frustrating | 05:28 |
| stevemar_ | damn packaging policy | 05:29 |
| * lhcheng have to scroll through OSC releases to find 1.0.3 :( | 05:29 | |
| lhcheng | that's ancient? | 05:30 |
| stevemar_ | lhcheng: yep | 05:32 |
| stevemar_ | lhcheng: it's what ubuntu 14.04 has as it's latest update http://packages.ubuntu.com/search?keywords=openstackclient&searchon=names&suite=all§ion=all | 05:33 |
| lhcheng | stevemar_: how do we enable the plugins in OSC? | 05:33 |
| stevemar_ | wee 15.05 | 05:33 |
| stevemar_ | lhcheng: whatcha mean? which plugins? auth plugins? | 05:33 |
| lhcheng | stevemar_: I'm interested particularly in ironic plugins: https://github.com/openstack/python-openstackclient/blob/master/doc/source/plugins.rst | 05:33 |
| stevemar_ | lhcheng: pip install the latest version and it'll automatically be detected by osc | 05:34 |
| lhcheng | whoa! | 05:34 |
| lhcheng | sweet! | 05:34 |
| stevemar_ | i'll do it now, too | 05:34 |
| stevemar_ | just to test | 05:34 |
| stevemar_ | stevemar@ubuntu:/opt/stack/python-openstackclient$ sudo pip install python-ironicclient | 05:35 |
| stevemar_ | stevemar@ubuntu:/opt/stack/python-openstackclient$ openstack baremetal list | 05:35 |
| stevemar_ | lhcheng: whammo ^ | 05:35 |
| stevemar_ | i got a service not found, but that was expected :) | 05:36 |
| lhcheng | \o/ | 05:36 |
| lhcheng | we haven't started using OSC, but will try to push it more on our next upgrade | 05:36 |
| lhcheng | the ironic plugin is a great selling point | 05:37 |
| stevemar_ | lhcheng: how so? | 05:37 |
| *** sdake_ has quit IRC | 05:38 | |
| stevemar_ | lhcheng: i'm happy to hear that, but i'm just confused as to why it makes a difference for ironic | 05:38 |
| stevemar_ | lhcheng: looks like barbicanclient needs a release | 05:39 |
| lhcheng | if OSC didn't have ironic plugin, we can't standardize on just using OSC | 05:40 |
| stevemar_ | lhcheng: we == yahoo? | 05:43 |
| lhcheng | yeah | 05:43 |
| stevemar_ | lhcheng: gotcha! | 05:43 |
| stevemar_ | that took me too long to figure out | 05:43 |
| lhcheng | sorry, wasn't clear there. I was wearing my ops hat :P | 05:44 |
| stevemar_ | lhcheng: i imagine that ironic support is pretty bleh, but they will probably happily accept patches | 05:44 |
| stevemar_ | hehe | 05:44 |
| stevemar_ | it's all good | 05:44 |
| lhcheng | stevemar_: not sure if you've already seen this: https://etherpad.openstack.org/p/operator-local-patches | 05:46 |
| lhcheng | minimal local keystone patches | 05:46 |
| lhcheng | \o/ | 05:46 |
| stevemar_ | i have not seen this | 05:47 |
| jamielennox | stevemar_: what is this on meeting agenda: For auth plugins in keystoneauth: Separate repo or use setuptools "extras"? | 05:47 |
| stevemar_ | lhcheng: nice, very minimal | 05:49 |
| stevemar_ | jamielennox: thoughts on the latest comments from https://review.openstack.org/#/c/177227/ | 05:49 |
| stevemar_ | jamielennox: ^ | 05:49 |
| lhcheng | stevemar_: yeah, that means we're doing things mostly right :P | 05:49 |
| lhcheng | lol | 05:49 |
| stevemar_ | jamielennox: basically why have seperate repos for saml2? because we don't want to have lxml in requirements? well use "extras" in pbr/setuptools | 05:50 |
| stevemar_ | jamielennox: https://bugs.launchpad.net/keystone/+bug/1479962 | 05:50 |
| openstack | Launchpad bug 1479962 in Keystone "Use extras for deployment-specific package requirements" [Low,In progress] - Assigned to Brant Knudson (blk-u) | 05:50 |
| stevemar_ | like ^ but with keystoneauth[saml2] | 05:51 |
| stevemar_ | it sounds sane enough to work! | 05:51 |
| jamielennox | stevemar_: yea, i'd be fine with [extras] | 05:51 |
| lhcheng | stevemar_: there's one perf concern on keystone in: https://etherpad.openstack.org/p/openstack-performance-issues sounds related to catalog caching discussion earlier in the day. | 05:52 |
| jamielennox | it was purely dependencies that caused a problem | 05:52 |
| stevemar_ | jamielennox: damn | 05:52 |
| stevemar_ | so we can remove the entire keystoneauth-saml2 project | 05:52 |
| jamielennox | it could be confusing because when you do --os-auth-type they will all be there | 05:52 |
| stevemar_ | marekd - i'm sorry :( | 05:52 |
| stevemar_ | hmm | 05:52 |
| stevemar_ | true... | 05:53 |
| jamielennox | so it's not like with most things where you know ahead of time what features you will use | 05:53 |
| jamielennox | but if there was some way we could protect against that i would be happy to roll them together | 05:53 |
| jamielennox | stevemar_: if that's all it is then i don't have to get up for tomorrow's meeting | 05:54 |
| jamielennox | stevemar_: with federation i shouldn't need to specify a user_id right? | 05:55 |
| jamielennox | mapping | 05:56 |
| jamielennox | i thought i specified name and it generated id based on something + idp_id | 05:56 |
| stevemar_ | right | 05:56 |
| jamielennox | String length exceeded.The length of string 'neutron/openstack.jamielennox.oslab.test%40JAMIELENNOX.OSLAB.TEST' exceeded the limit of column user_id(CHAR(64)). | 05:56 |
| stevemar_ | thats interesting | 05:57 |
| stevemar_ | jamielennox: you're federating things i assume? | 05:58 |
| jamielennox | yes | 05:58 |
| jamielennox | mapping http://paste.openstack.org/show/475399/ | 05:58 |
| jamielennox | and i'm not sure why it's doing things with user_id | 05:59 |
| *** geoffarnold has quit IRC | 06:00 | |
| *** geoffarnold has joined #openstack-keystone | 06:01 | |
| openstackgerrit | Merged openstack/keystone: Improving domain_id update tests https://review.openstack.org/230042 | 06:01 |
| stevemar_ | jamielennox: i would think it sends off an audit request, and potentially shoves the user_id in the token | 06:04 |
| jamielennox | i don't think this is audit, seems to be SQL related | 06:08 |
| *** Nirupama has joined #openstack-keystone | 06:12 | |
| stevemar_ | jamielennox: is it storing the token? | 06:12 |
| jamielennox | stevemar_: i think that's where the problem is coming from | 06:12 |
| jamielennox | it's trying to create a tokenmodel | 06:13 |
| jamielennox | but why is the id that... | 06:13 |
| stevemar_ | jamielennox: looks like it should just be remote_user | 06:14 |
| stevemar_ | is that what remote_user is? | 06:14 |
| jamielennox | yes, that's remote_user | 06:14 |
| *** topol has joined #openstack-keystone | 06:15 | |
| *** ChanServ sets mode: +v topol | 06:15 | |
| jamielennox | stevemar_: but i don't set the remote_user as name, not id | 06:16 |
| stevemar_ | jamielennox: part of the token contract is to have a user ID | 06:17 |
| stevemar_ | so if one is not supplied, we URL encode the name | 06:17 |
| jamielennox | stevemar_: i thought we generated one | 06:17 |
| jamielennox | bagh | 06:18 |
| jamielennox | so i'm pretty much stuffed | 06:18 |
| stevemar_ | jamielennox: https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/mapped.py#L217-L222 | 06:19 |
| *** topol has quit IRC | 06:19 | |
| jamielennox | what happend to hash(username) + domain_id | 06:19 |
| stevemar_ | jamielennox: what domain would we use in this case? | 06:20 |
| stevemar_ | maybe idp_id? | 06:20 |
| jamielennox | sorry, that's what i meant | 06:20 |
| jamielennox | we were going to create super long user ids that mean you could identify what idp a user came from | 06:21 |
| stevemar_ | jamielennox: the idp is in the token anyway, so having it in the user ID wasn't gaining us much | 06:21 |
| jamielennox | i think it was for uniqueness | 06:21 |
| jamielennox | and for like tagging resource ownership | 06:22 |
| *** e0ne has joined #openstack-keystone | 06:22 | |
| jamielennox | was one of henry's ideas, adam was arguing about something | 06:22 |
| *** markvoelker_ has quit IRC | 06:24 | |
| stevemar_ | jamielennox: i do not recall :( | 06:27 |
| *** ParsectiX has joined #openstack-keystone | 06:27 | |
| stevemar_ | jamielennox: are you doing an experiment now? | 06:27 |
| jamielennox | yea, playing with it now | 06:28 |
| jamielennox | looks like its failing when adding user_id to token model | 06:28 |
| stevemar_ | jamielennox: maybe we need a case where if user ID is greater than 64 then we do something different | 06:28 |
| stevemar_ | is the user_name itself shorter? | 06:28 |
| jamielennox | that's kind of it | 06:28 |
| jamielennox | it's kerberos format | 06:29 |
| jamielennox | service/host@domain | 06:29 |
| stevemar_ | jamielennox: also, you can set the user ID in the mapping | 06:29 |
| jamielennox | but to what.. | 06:29 |
| stevemar_ | jamielennox: ... you could use some dumb value now, as a workaround | 06:29 |
| stevemar_ | i'm just shooting from the hip here | 06:30 |
| *** e0ne has quit IRC | 06:30 | |
| stevemar_ | i seem to have broken my osc | 06:31 |
| jamielennox | oh, that happens | 06:31 |
| jamielennox | alright - that's annoying, will need to think on that one | 06:34 |
| jamielennox | i want to make mapping optional | 06:34 |
| stevemar_ | jamielennox: and use what instead? | 06:35 |
| jamielennox | python | 06:35 |
| stevemar_ | ? | 06:35 |
| *** markvoelker has joined #openstack-keystone | 06:35 | |
| jamielennox | either configure a script directly in httpd so you manipulate the env and then do keystone.token_issue(stuff, that, i, know) | 06:36 |
| jamielennox | or instead of mapping have an entry point | 06:36 |
| jamielennox | that returns similar stuff to mapping | 06:36 |
| jamielennox | but the first one | 06:36 |
| jamielennox | then i could just do sha256(name) | 06:36 |
| stevemar_ | possible | 06:37 |
| jamielennox | it's a scheme i've been thinking about, will tell you in tokyo | 06:37 |
| stevemar_ | jamielennox: coolio | 06:38 |
| stevemar_ | bed time for this guy | 06:38 |
| jamielennox | stevemar_: night | 06:38 |
| stevemar_ | see you in ~12 hrs for the meeting | 06:38 |
| jamielennox | stevemar_: mayb | 06:38 |
| stevemar_ | of course | 06:38 |
| jamielennox | not much that i really need to be a part of in agenda | 06:38 |
| *** stevemar_ has quit IRC | 06:38 | |
| *** markvoelker has quit IRC | 06:40 | |
| *** jamielennox is now known as jamielennox|away | 06:41 | |
| *** geoffarnold has quit IRC | 06:43 | |
| *** geoffarnold has joined #openstack-keystone | 06:43 | |
| *** markvoelker has joined #openstack-keystone | 06:45 | |
| *** gildub has quit IRC | 06:48 | |
| *** woodster_ has quit IRC | 06:49 | |
| *** markvoelker has quit IRC | 06:50 | |
| *** henrynash has joined #openstack-keystone | 06:52 | |
| *** ChanServ sets mode: +v henrynash | 06:52 | |
| *** lhcheng has quit IRC | 06:52 | |
| *** lhcheng has joined #openstack-keystone | 06:53 | |
| *** ChanServ sets mode: +v lhcheng | 06:53 | |
| *** lhcheng has quit IRC | 06:57 | |
| *** ekarlso has quit IRC | 06:58 | |
| *** markvoelker has joined #openstack-keystone | 07:00 | |
| *** geoffarnold has quit IRC | 07:04 | |
| *** markvoelker has quit IRC | 07:04 | |
| *** geoffarnold has joined #openstack-keystone | 07:04 | |
| *** lhcheng has joined #openstack-keystone | 07:09 | |
| *** ChanServ sets mode: +v lhcheng | 07:09 | |
| *** jbell8 has joined #openstack-keystone | 07:12 | |
| *** dikonoor has joined #openstack-keystone | 07:13 | |
| *** jbell8 has quit IRC | 07:13 | |
| marekd | jamielennox|away: one of the ways for mapping engine v2 is to start embedding PYthon code as a mapping rules instead of some sort of 'language' we have today. | 07:13 |
| *** markvoelker has joined #openstack-keystone | 07:14 | |
| *** jbell8 has joined #openstack-keystone | 07:14 | |
| *** btully has quit IRC | 07:16 | |
| *** markvoelker has quit IRC | 07:19 | |
| *** ekarlso has joined #openstack-keystone | 07:25 | |
| *** browne has quit IRC | 07:26 | |
| *** markvoelker has joined #openstack-keystone | 07:29 | |
| *** lhcheng has quit IRC | 07:32 | |
| *** markvoelker has quit IRC | 07:33 | |
| openstackgerrit | Divya K Konoor proposed openstack/pycadf: Change ceilometer endpoint name from telemetry to metering https://review.openstack.org/231343 | 07:36 |
| *** markvoelker has joined #openstack-keystone | 07:43 | |
| *** jbell8 has quit IRC | 07:45 | |
| *** jbell8 has joined #openstack-keystone | 07:46 | |
| *** geoffarn_ has joined #openstack-keystone | 07:46 | |
| *** markvoelker has quit IRC | 07:48 | |
| *** geoffarnold has quit IRC | 07:50 | |
| *** fhubik has joined #openstack-keystone | 07:53 | |
| *** ParsectiX has quit IRC | 07:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 07:55 |
| marekd | morgan: impressive that you managed to get a irc handle being just your name... | 07:58 |
| *** markvoelker has joined #openstack-keystone | 07:58 | |
| *** ParsectiX has joined #openstack-keystone | 07:58 | |
| *** markvoelker has quit IRC | 08:02 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 08:07 |
| *** geoffarn_ has quit IRC | 08:07 | |
| *** geoffarnold has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 08:08 |
| *** btully has joined #openstack-keystone | 08:08 | |
| *** markvoelker has joined #openstack-keystone | 08:13 | |
| *** btully has quit IRC | 08:13 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 08:13 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 08:14 |
| *** itlinux has joined #openstack-keystone | 08:17 | |
| *** markvoelker has quit IRC | 08:18 | |
| *** jbell8 has quit IRC | 08:20 | |
| *** jbell8 has joined #openstack-keystone | 08:21 | |
| *** jistr has joined #openstack-keystone | 08:25 | |
| *** pnavarro has joined #openstack-keystone | 08:27 | |
| *** markvoelker has joined #openstack-keystone | 08:27 | |
| *** geoffarnold has quit IRC | 08:29 | |
| *** geoffarnold has joined #openstack-keystone | 08:29 | |
| *** mjb has quit IRC | 08:30 | |
| *** mjb has joined #openstack-keystone | 08:30 | |
| *** markvoelker has quit IRC | 08:32 | |
| *** jbell8 has quit IRC | 08:32 | |
| *** jbell8 has joined #openstack-keystone | 08:33 | |
| *** blackjack1 has left #openstack-keystone | 08:34 | |
| *** markvoelker has joined #openstack-keystone | 08:42 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Enable listing of role assignments in a project hierarchy https://review.openstack.org/208152 | 08:43 |
| openstackgerrit | henry-nash proposed openstack/keystone: Rationalize list role assignment routing https://review.openstack.org/220335 | 08:45 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add API route for list role assignments for tree https://review.openstack.org/220452 | 08:45 |
| *** markvoelker has quit IRC | 08:47 | |
| *** aix has quit IRC | 08:48 | |
| *** yottatsa has joined #openstack-keystone | 08:48 | |
| *** jaosorior has quit IRC | 08:48 | |
| *** jaosorior has joined #openstack-keystone | 08:49 | |
| *** geoffarnold has quit IRC | 08:50 | |
| *** geoffarnold has joined #openstack-keystone | 08:50 | |
| *** markvoelker has joined #openstack-keystone | 08:56 | |
| *** markvoelker has quit IRC | 09:01 | |
| *** aix has joined #openstack-keystone | 09:06 | |
| *** markvoelker has joined #openstack-keystone | 09:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/231371 | 09:06 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 09:08 |
| *** markvoelker has quit IRC | 09:10 | |
| *** geoffarnold has quit IRC | 09:11 | |
| *** askb has joined #openstack-keystone | 09:11 | |
| *** geoffarnold has joined #openstack-keystone | 09:12 | |
| *** markvoelker has joined #openstack-keystone | 09:13 | |
| *** askb has quit IRC | 09:15 | |
| *** markvoelker has quit IRC | 09:18 | |
| *** markvoelker has joined #openstack-keystone | 09:22 | |
| *** markvoelker has quit IRC | 09:26 | |
| *** markvoelker has joined #openstack-keystone | 09:32 | |
| *** geoffarnold has quit IRC | 09:33 | |
| *** geoffarn_ has joined #openstack-keystone | 09:33 | |
| *** yottatsa has left #openstack-keystone | 09:37 | |
| *** markvoelker has quit IRC | 09:39 | |
| *** aix has quit IRC | 09:45 | |
| *** gildub has joined #openstack-keystone | 09:46 | |
| *** markvoelker has joined #openstack-keystone | 09:46 | |
| *** markvoelker has quit IRC | 09:50 | |
| *** exploreshaifali has joined #openstack-keystone | 09:52 | |
| *** geoffarn_ has quit IRC | 09:54 | |
| *** geoffarnold has joined #openstack-keystone | 09:54 | |
| *** aix has joined #openstack-keystone | 09:57 | |
| *** markvoelker has joined #openstack-keystone | 10:01 | |
| *** e0ne has joined #openstack-keystone | 10:03 | |
| *** markvoelker has quit IRC | 10:05 | |
| *** markvoelker has joined #openstack-keystone | 10:11 | |
| *** jamielennox|away is now known as jamielennox | 10:14 | |
| *** pnavarro has quit IRC | 10:14 | |
| *** geoffarnold has quit IRC | 10:15 | |
| *** markvoelker has quit IRC | 10:16 | |
| *** geoffarnold has joined #openstack-keystone | 10:16 | |
| *** markvoelker has joined #openstack-keystone | 10:17 | |
| *** pnavarro has joined #openstack-keystone | 10:18 | |
| *** amakarov_away is now known as amakarov | 10:19 | |
| *** yottatsa has joined #openstack-keystone | 10:21 | |
| *** markvoelker has quit IRC | 10:22 | |
| *** yottatsa has quit IRC | 10:23 | |
| *** markvoelker has joined #openstack-keystone | 10:26 | |
| *** rudolfvriend has joined #openstack-keystone | 10:26 | |
| *** jbell8 has quit IRC | 10:28 | |
| *** rudolfvriend has quit IRC | 10:29 | |
| *** itlinux has quit IRC | 10:30 | |
| *** rudolfvriend has joined #openstack-keystone | 10:30 | |
| *** yottatsa has joined #openstack-keystone | 10:31 | |
| *** markvoelker has quit IRC | 10:34 | |
| *** geoffarnold has quit IRC | 10:36 | |
| *** geoffarnold has joined #openstack-keystone | 10:37 | |
| *** fhubik is now known as fhubik_afk | 10:46 | |
| *** itlinux has joined #openstack-keystone | 10:50 | |
| *** topol has joined #openstack-keystone | 10:50 | |
| *** ChanServ sets mode: +v topol | 10:50 | |
| *** sdake has joined #openstack-keystone | 10:52 | |
| *** markvoelker has joined #openstack-keystone | 10:55 | |
| *** geoffarnold has quit IRC | 10:58 | |
| *** geoffarnold has joined #openstack-keystone | 10:58 | |
| *** markvoelker has quit IRC | 11:01 | |
| *** markvoelker has joined #openstack-keystone | 11:05 | |
| *** gildub has quit IRC | 11:08 | |
| *** markvoelker has quit IRC | 11:10 | |
| *** pnavarro is now known as pnavarro|lunch | 11:18 | |
| *** markvoelker has joined #openstack-keystone | 11:19 | |
| *** geoffarn_ has joined #openstack-keystone | 11:20 | |
| *** geoffarnold has quit IRC | 11:23 | |
| *** markvoelker has quit IRC | 11:24 | |
| *** gildub has joined #openstack-keystone | 11:24 | |
| samueldmq | morning | 11:25 |
| samueldmq | henrynash: ping - looking at list role assignments subtree | 11:32 |
| samueldmq | henrynash: and have some questions | 11:32 |
| *** markvoelker has joined #openstack-keystone | 11:34 | |
| *** richm has joined #openstack-keystone | 11:35 | |
| *** yottatsa has quit IRC | 11:38 | |
| *** markvoelker has quit IRC | 11:38 | |
| *** yottatsa has joined #openstack-keystone | 11:38 | |
| *** richm has quit IRC | 11:42 | |
| *** fhubik_afk is now known as fhubik | 11:43 | |
| *** gordc has joined #openstack-keystone | 11:46 | |
| *** markvoelker has joined #openstack-keystone | 11:48 | |
| henrynash | samueldmq: hi | 11:49 |
| *** yottatsa_ has joined #openstack-keystone | 11:53 | |
| *** markvoelker has quit IRC | 11:53 | |
| samueldmq | henrynash: hi | 11:55 |
| samueldmq | henrynash: so ... I am looking at the first patch in the chain, the one for manager changes | 11:55 |
| henrynash | ok | 11:56 |
| samueldmq | henrynash: include_subtree is only intended to work for projects, right ? | 11:56 |
| henrynash | correct | 11:56 |
| samueldmq | henrynash: so I can't pass a domain_id and request include_subtree | 11:56 |
| *** yottatsa has quit IRC | 11:56 | |
| henrynash | no…but once we make projects act as domains….then you can! | 11:56 |
| samueldmq | henrynash: ok so once reseller goes in, we will be able t odo so | 11:57 |
| henrynash | yep | 11:57 |
| samueldmq | interesting .. so it will be able to use it with both domain_id or project_id | 11:57 |
| henrynash | yes (since in that case domain_id will be a project_id) | 11:58 |
| samueldmq | ++ | 11:58 |
| samueldmq | henrynash: include_subtree is independent of effective, right? | 11:58 |
| henrynash | that’s way I did it this way, to make it more generic | 11:58 |
| henrynash | yes | 11:58 |
| samueldmq | henrynash: okay makes sense, we will just need to take care in the case we have subdomains, where the role assignments aren't propagated | 12:00 |
| samueldmq | henrynash: that means, using include_subtree for a domain won't include assignments for a subdomain, even with reseller | 12:00 |
| samueldmq | henrynash: is that right ? so that we keep the domain isolation | 12:00 |
| *** markvoelker has joined #openstack-keystone | 12:03 | |
| *** markvoelker has quit IRC | 12:07 | |
| *** yottatsa_ has quit IRC | 12:09 | |
| *** sdake has quit IRC | 12:09 | |
| *** sdake has joined #openstack-keystone | 12:10 | |
| henrynash | (sorry, back) | 12:10 |
| samueldmq | henrynash: np | 12:10 |
| henrynash | samuledmq: agreed, it should only be possible for “leaf domains” | 12:11 |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| samueldmq | henrynash: no, it can be for non-leaf domains, but in that case, it won't include any domain-project or their subprojects | 12:16 |
| samueldmq | henrynash: only the non-domain project subtrees of the non-leaf domains if that makes sense | 12:16 |
| *** exploreshaifali has quit IRC | 12:17 | |
| *** richm has joined #openstack-keystone | 12:17 | |
| samueldmq | henrynash: look at this https://etherpad.openstack.org/p/19MqVTBbRZ | 12:17 |
| henrynash | samueldmq: I’m just not sure of the advantacge (over the confusion) of allowing this on anything than a refular project or a lead domain-project | 12:17 |
| samueldmq | henrynash: there is just a single rule, domains are isolated, that means that role assignments don't pass the domain borders, neither for reading (list) nor writting (creating inherited assignments) | 12:19 |
| *** markvoelker has quit IRC | 12:19 | |
| samueldmq | henrynash: does that make sense ? Even though I sold you part of my cloud, I am able to use include_subtree in my domain, so that I can control my own use | 12:20 |
| henrynash | I’m not sure…seems like a recipe for consuftion to me | 12:21 |
| *** richm has quit IRC | 12:22 | |
| *** pnavarro|lunch is now known as pnavarro | 12:22 | |
| *** richm has joined #openstack-keystone | 12:23 | |
| *** geoffarnold has joined #openstack-keystone | 12:23 | |
| henrynash | samueldmq: ah, Ok, sorry, now I get what you are saying | 12:24 |
| *** geoffarn_ has quit IRC | 12:24 | |
| samueldmq | henrynash: does that make sense now ? :) | 12:24 |
| henrynash | (i thought B and C were domains in your example) | 12:24 |
| *** hrou has joined #openstack-keystone | 12:25 | |
| samueldmq | henrynash: C is domain, B isn't | 12:25 |
| samueldmq | henrynash: the idea is, projects under a domain are isolated, it doesn't matter if the domains have some relationship (hierarchical) or not (top level domains) | 12:27 |
| samueldmq | projects under different domains are isolated* | 12:27 |
| samueldmq | henrynash: that's exactly how inherited role assignmetns will behave, they will be expanded for the non-domain subtrees | 12:28 |
| *** markvoelker has joined #openstack-keystone | 12:29 | |
| henrynash | samueldmq: Ok…I *think* I agree with you :-) | 12:29 |
| *** roxanagh_ has joined #openstack-keystone | 12:30 | |
| samueldmq | henrynash: cool, hehe | 12:30 |
| samueldmq | henrynash: I am trying to review as much as I can, I am reviwing that chain right now | 12:31 |
| samueldmq | henrynash: and will look at reseller later in the week | 12:31 |
| henrynash | great | 12:31 |
| *** roxanagh_ has quit IRC | 12:34 | |
| *** markvoelker has quit IRC | 12:36 | |
| *** ekarlso has quit IRC | 12:38 | |
| *** markvoelker has joined #openstack-keystone | 12:44 | |
| *** geoffarn_ has joined #openstack-keystone | 12:45 | |
| *** geoffarnold has quit IRC | 12:45 | |
| *** edmondsw has joined #openstack-keystone | 12:45 | |
| *** fhubik is now known as fhubik_afk | 12:46 | |
| *** markvoelker has quit IRC | 12:48 | |
| *** ekarlso has joined #openstack-keystone | 12:56 | |
| openstackgerrit | Merged openstack/pycadf: Change ceilometer endpoint name from telemetry to metering https://review.openstack.org/231343 | 12:58 |
| *** markvoelker has joined #openstack-keystone | 12:58 | |
| *** markvoelker has quit IRC | 12:59 | |
| *** markvoelker has joined #openstack-keystone | 12:59 | |
| *** markvoelker_ has joined #openstack-keystone | 13:01 | |
| *** fhubik_afk is now known as fhubik | 13:01 | |
| *** markvoelker has quit IRC | 13:03 | |
| *** dsirrine has joined #openstack-keystone | 13:05 | |
| *** yottatsa has joined #openstack-keystone | 13:05 | |
| *** geoffarn_ has quit IRC | 13:06 | |
| *** markvoelker has joined #openstack-keystone | 13:06 | |
| *** geoffarnold has joined #openstack-keystone | 13:06 | |
| openstackgerrit | Merged openstack/pycadf: No need for Oslo Incubator Sync https://review.openstack.org/230851 | 13:08 |
| *** sdake has quit IRC | 13:09 | |
| *** markvoelker_ has quit IRC | 13:10 | |
| *** sdake has joined #openstack-keystone | 13:10 | |
| *** fhubik is now known as fhubik_afk | 13:11 | |
| *** EinstCrazy has joined #openstack-keystone | 13:11 | |
| lbragstad | dolphm: wondering if https://review.openstack.org/#/c/221799/ can be looked at again since the first patch has merged to master; it's also required to get https://review.openstack.org/#/c/231057/ pass on stable/kilo | 13:12 |
| *** sdake_ has joined #openstack-keystone | 13:13 | |
| *** sdake has quit IRC | 13:14 | |
| *** EinstCrazy has quit IRC | 13:14 | |
| *** raildo-afk is now known as raildo | 13:15 | |
| *** markvoelker has quit IRC | 13:17 | |
| *** fhubik_afk is now known as fhubik | 13:17 | |
| *** yottatsa has quit IRC | 13:17 | |
| *** markvoelker has joined #openstack-keystone | 13:17 | |
| *** wwwjfy_ has quit IRC | 13:19 | |
| *** yottatsa has joined #openstack-keystone | 13:19 | |
| *** gildub has quit IRC | 13:21 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone: Accepts Group IDs from the IdP without domain https://review.openstack.org/210581 | 13:23 |
| *** itlinux_ has joined #openstack-keystone | 13:24 | |
| *** itlinux has quit IRC | 13:25 | |
| *** woodster_ has joined #openstack-keystone | 13:25 | |
| openstackgerrit | Merged openstack/pycadf: Document and update existing hacking violations https://review.openstack.org/230255 | 13:25 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Expose method list inconsistency in federation api https://review.openstack.org/229125 | 13:26 |
| *** thiagop has joined #openstack-keystone | 13:27 | |
| *** geoffarnold has quit IRC | 13:27 | |
| *** geoffarnold has joined #openstack-keystone | 13:27 | |
| *** wwwjfy_ has joined #openstack-keystone | 13:28 | |
| *** Nirupama has quit IRC | 13:28 | |
| *** ParsectiX has quit IRC | 13:29 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Documentation for other services https://review.openstack.org/204801 | 13:31 |
| *** itlinux has joined #openstack-keystone | 13:36 | |
| *** itlinux_ has quit IRC | 13:36 | |
| samueldmq | henrynash: the new code for the assignments logic looks great, doesnt it ? :) | 13:41 |
| henrynash | samueldmq: which bit? | 13:42 |
| samueldmq | henrynash: all the code of expansion, effective, etc, as we've refactored | 13:43 |
| henrynash | samueldmq: so, it works well…and adding the subtree was pretty easy | 13:44 |
| samueldmq | henrynash: yes, that' what I nticed too | 13:46 |
| samueldmq | ehnI am finishing the review, just doing another tet :) | 13:46 |
| *** ParsectiX has joined #openstack-keystone | 13:46 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable try_except_pass Bandit test https://review.openstack.org/225738 | 13:50 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable subprocess_without_shell_equals_true Bandit test https://review.openstack.org/225692 | 13:50 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable hardcoded_bind_all_interfaces Bandit test https://review.openstack.org/225690 | 13:50 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Enable password_config_option_not_marked_secret Bandit test https://review.openstack.org/225691 | 13:50 |
| *** itlinux has quit IRC | 13:52 | |
| marekd | dstanek: re https://review.openstack.org/#/c/203142/14/tox.ini i see what you are doing here but to me it still doesn't really work. | 13:53 |
| marekd | dstanek: did it for ya? | 13:53 |
| dstanek | marekd: yes, you don't get your env vars? | 13:54 |
| marekd | dstanek: not reallly, i fact i copies passenv values to [debug] env cause i want to breakpoint | 13:55 |
| marekd | i am http://cdn.pasteraw.com/rl2l05qcgs9qj56xg0e4lt5owgv82f9 | 13:55 |
| marekd | this is my env when running tests | 13:55 |
| dstanek | marekd: and what is in your environment? | 13:56 |
| marekd | in a standard shell ? | 13:56 |
| dstanek | marekd: yes, that's where those come from | 13:56 |
| *** ParsectiX has quit IRC | 13:58 | |
| *** henrynash has quit IRC | 13:58 | |
| dstanek | marekd: when i ran 'KSSTEST_PUBLIC_URL=http://xxx tox -e functional' i get failures because it couldn't resolve xxx as a name | 13:58 |
| *** ParsectiX has joined #openstack-keystone | 13:58 | |
| lbragstad | have we released rc2 yet? | 13:59 |
| marekd | oups, it worked now. I basically rebuild everything again, removed pyc files by hand and executed in new terminal. | 13:59 |
| marekd | dstanek: sorry for a hassle. | 14:00 |
| marekd | dstanek: anyways, i remember some convos about cleaning data once the tests are executer - tearDown() was a way to do so ? | 14:01 |
| dstanek | marekd: no hassle :-) | 14:01 |
| dstanek | marekd: i don't think it will really be feasible to cleanup after these tests | 14:01 |
| marekd | dstanek: from the jenkins jobs it doesn't matter, but for me, testing stuff on some devstack beforehand...people will maintain some scripts either way. | 14:02 |
| marekd | i was thnking about switch in the env | 14:03 |
| openstackgerrit | Merged openstack/keystone: Filters is_domain=True in v2 get_project_by_name https://review.openstack.org/224842 | 14:03 |
| marekd | by default it's false, but keystone can clean after itself if you want him to do so. | 14:03 |
| dstanek | marekd: i don't think it's worth the effect. just against a database that you can trash and recreate | 14:03 |
| marekd | dstanek: OK | 14:04 |
| *** ParsectiX has quit IRC | 14:04 | |
| openstackgerrit | Merged openstack/oslo.policy: Fix coverage configuration and execution https://review.openstack.org/229968 | 14:04 |
| dstanek | consider a call the /blah that makes records in 4 tables; you tests will have to know about all of the records; if someone changes that in include more records the test is unlikely to get updated because it will still work. | 14:04 |
| marekd | tearDown() is executed after every test ? | 14:05 |
| *** chao_li has joined #openstack-keystone | 14:06 | |
| marekd | dstanek: i was rather thinking about something more brutal, at least for CRUD tests - just clean all the entities afterwards (i.e. identity providers, mappng, protocols) | 14:06 |
| chao_li | Hi, Just wonder does anyone who has integrated CADF with swift before? | 14:07 |
| marekd | dstanek: so nothing like 'remembering on what was added' | 14:07 |
| dstanek | at that point your just creating a new database anyway | 14:09 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:10 | |
| *** ngupta has joined #openstack-keystone | 14:13 | |
| *** Guest28678 is now known as redrobot | 14:13 | |
| *** ayoung has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +v ayoung | 14:19 | |
| *** Guest83454 is now known as mfisch | 14:19 | |
| *** mfisch is now known as Guest94490 | 14:20 | |
| *** tonytan4ever has joined #openstack-keystone | 14:27 | |
| *** stevemar_ has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +o stevemar_ | 14:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:28 | |
| *** geoffarnold has quit IRC | 14:29 | |
| *** geoffarnold has joined #openstack-keystone | 14:30 | |
| *** chao_li has quit IRC | 14:30 | |
| *** markvoelker_ has joined #openstack-keystone | 14:32 | |
| *** roxanagh_ has joined #openstack-keystone | 14:33 | |
| *** roxanagh_ has quit IRC | 14:33 | |
| *** roxanagh_ has joined #openstack-keystone | 14:33 | |
| *** yottatsa has quit IRC | 14:35 | |
| *** markvoelker has quit IRC | 14:36 | |
| *** markvoelker_ has quit IRC | 14:38 | |
| *** jaosorior has quit IRC | 14:39 | |
| *** jaosorior has joined #openstack-keystone | 14:39 | |
| stevemar_ | dun dun dunnnnnnnnnn | 14:41 |
| stevemar_ | RC2!!!!!!!!!!!!!!!! | 14:41 |
| *** yottatsa has joined #openstack-keystone | 14:41 | |
| samueldmq | stevemar_: o/ | 14:42 |
| stevemar_ | samueldmq: /o | 14:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Common arguments for fernet payloads assembly https://review.openstack.org/230165 | 14:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Normalize fernet payload disassembly https://review.openstack.org/230181 | 14:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: De-duplicate fernet payload tests https://review.openstack.org/230193 | 14:42 |
| *** yottatsa has quit IRC | 14:43 | |
| dstanek | stevemar_: woot! | 14:45 |
| *** slberger has joined #openstack-keystone | 14:46 | |
| *** daemontool_ has quit IRC | 14:49 | |
| *** ngupta has quit IRC | 14:50 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Adds a base class for functional tests https://review.openstack.org/203142 | 14:50 |
| *** pnavarro is now known as pnavarro|afk | 14:50 | |
| *** geoffarnold has quit IRC | 14:50 | |
| *** geoffarnold has joined #openstack-keystone | 14:51 | |
| *** yottatsa has joined #openstack-keystone | 14:54 | |
| *** yottatsa has left #openstack-keystone | 14:54 | |
| *** markvoelker has joined #openstack-keystone | 14:55 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Federation Identity Provider functional tests https://review.openstack.org/203258 | 14:57 |
| *** browne has joined #openstack-keystone | 14:57 | |
| *** phalmos has joined #openstack-keystone | 14:57 | |
| morgan | stevemar_: nicely done | 15:00 |
| *** ngupta has joined #openstack-keystone | 15:02 | |
| *** csoukup has joined #openstack-keystone | 15:03 | |
| marekd | ++ | 15:04 |
| stevemar_ | \o/ | 15:05 |
| *** david-ly_ is now known as david-lyle | 15:06 | |
| *** itlinux has joined #openstack-keystone | 15:06 | |
| *** zzzeek has joined #openstack-keystone | 15:07 | |
| openstackgerrit | Olivier Pilotte proposed openstack/keystone: Accepts Group IDs from the IdP without domain https://review.openstack.org/210581 | 15:08 |
| *** geoffarnold has quit IRC | 15:11 | |
| *** geoffarnold has joined #openstack-keystone | 15:12 | |
| *** diazjf has joined #openstack-keystone | 15:12 | |
| *** itlinux has quit IRC | 15:12 | |
| *** tonytan4ever has quit IRC | 15:15 | |
| dims_ | stevemar_: yay! | 15:15 |
| stevemar_ | dims_: :) | 15:15 |
| stevemar_ | dims_: question for you, whens the next nova meeting | 15:15 |
| * bknudson can't wait for rc3! | 15:16 | |
| stevemar_ | bknudson: don't say such bad things | 15:16 |
| marekd | bknudson: you can easily make it - just do some reviews. | 15:17 |
| *** diazjf has quit IRC | 15:22 | |
| *** sdake_ is now known as sdake | 15:23 | |
| stevemar_ | marekd: don't encourage him | 15:24 |
| marekd | yes sir | 15:25 |
| stevemar_ | hehe | 15:25 |
| *** wasmum has quit IRC | 15:25 | |
| *** dims_ has quit IRC | 15:27 | |
| *** Daviey_ has quit IRC | 15:30 | |
| *** Daviey has joined #openstack-keystone | 15:30 | |
| *** dims_ has joined #openstack-keystone | 15:32 | |
| *** geoffarnold has quit IRC | 15:33 | |
| *** geoffarnold has joined #openstack-keystone | 15:34 | |
| dolphm | lbragstad: SpamapS: more performance improvement potential for token validation https://bugs.launchpad.net/keystone/+bug/1503312 | 15:41 |
| openstack | Launchpad bug 1503312 in Keystone "Optimization: Don't rebuild revoke-tree in each validate-token call" [Undecided,New] - Assigned to Sonali (sonali-pitre) | 15:41 |
| *** links has quit IRC | 15:42 | |
| *** alextricity has joined #openstack-keystone | 15:44 | |
| *** geoffarnold is now known as geoffarnoldX | 15:45 | |
| *** kbringard has joined #openstack-keystone | 15:47 | |
| kbringard | hey guys, question about fernet_tokens | 15:48 |
| kbringard | I've run keystone-manage fernet_setup with the user and group who should own my tokens. I see the tokens get created in /etc/keystone/fernet-tokens | 15:48 |
| *** phalmos has quit IRC | 15:48 | |
| *** jistr_ has joined #openstack-keystone | 15:48 | |
| kbringard | keystone can access them, but every time I try to issue a token it tells me no encryption keys found | 15:48 |
| *** lsmola_ has joined #openstack-keystone | 15:48 | |
| kbringard | and to run setup to bootstrap one | 15:49 |
| *** aix_ has joined #openstack-keystone | 15:49 | |
| kbringard | this is with Kilo (2015.1.0) | 15:49 |
| *** jistr has quit IRC | 15:50 | |
| *** fhubik has quit IRC | 15:50 | |
| *** fhubik has joined #openstack-keystone | 15:50 | |
| lbragstad | kbringard: so you do have keys in your /etc/keystone/fernet-keys/ directory, right? | 15:51 |
| kbringard | yeppers | 15:51 |
| kbringard | and I verified the keystone user can access them | 15:51 |
| dstanek | kbringard: how did you verify that? | 15:51 |
| kbringard | http://paste.openstack.org/show/475490/ | 15:52 |
| *** lsmola has quit IRC | 15:52 | |
| kbringard | the parent dir is 777 because I was fiddling with perms to double make sure | 15:52 |
| *** aix has quit IRC | 15:52 | |
| *** lsmola_ has quit IRC | 15:53 | |
| *** aix_ has quit IRC | 15:53 | |
| *** jistr_ has quit IRC | 15:53 | |
| lbragstad | kbringard: how come key 2 has different permissions than the rest of the keys? manually testing things? | 15:53 |
| lbragstad | kbringard: you didn't happen to change the key_repository config option in between adding the keys and running keystone, did you? | 15:54 |
| kbringard | yea, I'd 777'd the whole dir | 15:54 |
| kbringard | then did a rotate to see if I needed more keys | 15:54 |
| kbringard | I did not change any config options, no | 15:54 |
| *** geoffarnoldX has quit IRC | 15:54 | |
| dstanek | kbringard: do you have debug logging on? | 15:54 |
| kbringard | I do | 15:54 |
| kbringard | wanna see the paste? | 15:54 |
| dstanek | sure | 15:55 |
| kbringard | kk, one sec | 15:55 |
| *** geoffarnold has joined #openstack-keystone | 15:55 | |
| kbringard | http://paste.openstack.org/show/b3jUfrY3nFIrQ8VDHYwn/ | 15:56 |
| kbringard | server and client | 15:56 |
| *** topol has quit IRC | 15:56 | |
| kbringard | and in the [fernet_tokens] sections of the keystone.conf I have: | 15:57 |
| kbringard | # Directory containing Fernet token keys. (string value) | 15:57 |
| kbringard | key_repository = /etc/keystone/fernet-keys/ | 15:57 |
| kbringard | I uncommented it just to make sure there wasn't something missing in the default | 15:57 |
| lbragstad | kbringard: makes sense, that should wokr | 15:58 |
| lbragstad | work* | 15:58 |
| kbringard | indeed | 15:58 |
| kbringard | hence my confusion | 15:58 |
| kbringard | I'd imagine it should ignore the token persistence driver in this case, so that value in the config shouldn't matter | 15:59 |
| kbringard | (I have nothing set, but it's using sql.Token as the default) | 15:59 |
| dstanek | definitely looks like a permissions issue of some sort | 16:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/230564 | 16:00 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/230464 | 16:00 |
| kbringard | yea, that's what I thought, but I couldn't figure out how | 16:00 |
| kbringard | oh, I wonder if selinux is somehow messing me up | 16:00 |
| lbragstad | kbringard: yeah, it should bypass the persistence stuff | 16:00 |
| kbringard | let me disable that nonsense | 16:01 |
| *** phalmos has joined #openstack-keystone | 16:01 | |
| dstanek | kbringard: this appears to be where it's failing http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/fernet/utils.py#n28 | 16:01 |
| kbringard | funny | 16:02 |
| kbringard | ensure the key repository isn't world-readable | 16:02 |
| kbringard | maybe setting to 777 messed me up | 16:02 |
| lbragstad | dstanek: kbringard here is the diff between master and stable/kilo wrt that file dstanek just linked - http://cdn.pasteraw.com/bxtnndaz7fez6i45z17qm7edg2kux8m | 16:02 |
| lbragstad | I don't think there was any specific "permission" issues backported to stable/kilo that would have an issue with this. | 16:02 |
| dstanek | kbringard: world readable means insecure! | 16:03 |
| kbringard | well right | 16:03 |
| lbragstad | kbringard: i have an idea | 16:03 |
| kbringard | this is just a test setup | 16:03 |
| kbringard | and I only changed the perms when it wasn't working | 16:03 |
| kbringard | I changed it all back, same issue | 16:04 |
| dstanek | kbringard: if it's just a test delete it and let keystone recreate with the perms that it expects | 16:04 |
| kbringard | I'm going to disable selinux and see if that helps | 16:04 |
| *** rudolfvriend has quit IRC | 16:05 | |
| dstanek | kbringard: also the manage command should be run by the same user that runs keystone or maybe chown all the things? | 16:05 |
| *** aix_ has joined #openstack-keystone | 16:05 | |
| *** wasmum has joined #openstack-keystone | 16:06 | |
| *** lsmola_ has joined #openstack-keystone | 16:06 | |
| kbringard | kk, I blasted the dir and ran | 16:06 |
| kbringard | keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone | 16:06 |
| kbringard | drwx------. 2 keystone keystone 4096 Oct 6 16:05 fernet-keys | 16:06 |
| lbragstad | that looks ok | 16:06 |
| kbringard | yea, and it recreated the keys | 16:06 |
| kbringard | but still same error | 16:06 |
| *** jistr_ has joined #openstack-keystone | 16:06 | |
| dstanek | kbringard: are you running apache or keystone-all? | 16:06 |
| kbringard | trying to issue a token | 16:06 |
| lbragstad | odyssey4me: what permissions does OSA use for the fernet key repository again? | 16:06 |
| kbringard | keystone-all | 16:06 |
| kbringard | didn't want to add complication before I had it working | 16:07 |
| dstanek | hmm...running as keystone is assume | 16:07 |
| odyssey4me | lbragstad as I recall, it's 2750 - lemme look it up quickly | 16:07 |
| *** e0ne has quit IRC | 16:08 | |
| kbringard | yea, running as keystone | 16:08 |
| lbragstad | kbringard: you could give that a shot, that is what OpenStack Ansible deploys with | 16:08 |
| *** topol has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v topol | 16:08 | |
| lbragstad | odyssey4me: perfect, thank you. I always lose those bits :) | 16:08 |
| kbringard | kk, let me try one sec | 16:08 |
| odyssey4me | lbragstad https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/tasks/keystone_pre_install.yml#L73 | 16:08 |
| kbringard | everything in there, or just the dir? | 16:08 |
| lbragstad | odyssey4me: pre_install.yml! | 16:08 |
| lbragstad | kbringard: do it on the directory and everything below | 16:09 |
| kbringard | kk, I just rm'd everything in the dir, fixed the perms, then did fernet_setup again | 16:09 |
| lbragstad | kbringard: ok | 16:10 |
| kbringard | same error :-/ | 16:10 |
| marekd | dstanek: AFAIK setUp() is executet every time *before* the actual test is executed. Can we use __init__ as a couterpart for class-wise setUp()? I am ok creating the user once per class | 16:11 |
| marekd | class object | 16:11 |
| dstanek | kbringard: i would debug by openign interactive python and checking the access | 16:11 |
| dstanek | marekd: https://docs.python.org/2/library/unittest.html#setupclass-and-teardownclass | 16:12 |
| *** gyee has joined #openstack-keystone | 16:12 | |
| *** ChanServ sets mode: +v gyee | 16:12 | |
| lbragstad | kbringard: yeah, and you're running keystone-all from the keystone user, right? | 16:12 |
| kbringard | dstanek, lbragstad, it's selinux | 16:13 |
| kbringard | :-/ | 16:13 |
| kbringard | I set it to permissive and suddenly it works | 16:13 |
| kbringard | :smh | 16:13 |
| lbragstad | hmmm | 16:13 |
| dstanek | odyssey4me: why the setgid bit? | 16:13 |
| marekd | dstanek: ok | 16:13 |
| kbringard | this was on a fresh install of RHEL7, so I need to dig into why it's hating on that dir | 16:14 |
| *** nicodemos has joined #openstack-keystone | 16:14 | |
| lbragstad | kbringard: interesting | 16:14 |
| odyssey4me | dstanek dunno, maybe cloudnull can answer - lemme get him in here | 16:14 |
| kbringard | I had a similar issue with bind, where it didn't like the default zones dir | 16:14 |
| dstanek | odyssey4me: i wouldn't think we are executing scripts out of there | 16:14 |
| *** cloudnull has joined #openstack-keystone | 16:14 | |
| cloudnull | o/ | 16:14 |
| dstanek | cloudnull: : why the setgid bit on the fernet dir? | 16:15 |
| kbringard | thanks for the help, I'll sort out why this is broken and either open a BZ with redhat or maybe submit a doc update | 16:15 |
| odyssey4me | cloudnull fyi - https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/tasks/keystone_pre_install.yml#L73 | 16:15 |
| dstanek | cloudnull: : i wouldn't think we are executing scripts out of there | 16:15 |
| SpamapS | dolphm: oh yeah very interesting. | 16:15 |
| SpamapS | dolphm: I don't see a patch associated with bug #1503312 | 16:15 |
| openstack | bug 1503312 in Keystone "Optimization: Don't rebuild revoke-tree in each validate-token call" [Medium,Triaged] https://launchpad.net/bugs/1503312 - Assigned to Sonali (sonali-pitre) | 16:15 |
| lbragstad | kbringard: that would be perfect, if we can update docs that would be awesome. let us know if there is anything else you need | 16:15 |
| odyssey4me | dstanek that may just have been based on something we saw in an environment, rather than an intentional specific for a reason - if it's not needed then it's an easy patch :) | 16:16 |
| *** geoffarnold has quit IRC | 16:16 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Functional tests for federation mapping CRUD https://review.openstack.org/231574 | 16:16 |
| *** geoffarnold has joined #openstack-keystone | 16:16 | |
| kbringard | lbragstad: will do, thanks again | 16:16 |
| dstanek | selinux ftw again! | 16:16 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Functional tests for federation mapping CRUD https://review.openstack.org/231574 | 16:16 |
| cloudnull | dstanek: we're setting the bit so that the directory is group / user owned by keystone and that the group does not change. | 16:17 |
| *** topol has quit IRC | 16:17 | |
| lbragstad | kbringard: np | 16:17 |
| cloudnull | the rotate script is in /opt | 16:17 |
| cloudnull | and forces a user change to keystone | 16:17 |
| *** Guest94490 is now known as mfisch | 16:17 | |
| cloudnull | the general idea is to make sure that if anything ever happens in a rotate that keystone is still able to read the files. | 16:18 |
| *** mfisch is now known as Guest62625 | 16:18 | |
| cloudnull | this is the rotate script https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/os_keystone/templates/keystone-fernet-rotate.sh.j2 | 16:18 |
| cloudnull | dstanek: why is there something up with that ? should we change it ? | 16:19 |
| dstanek | cloudnull: no, i've never seen setguid used like that before. | 16:19 |
| cloudnull | we're using it simply as a way to enforce ownership which should help protect the system from its users . | 16:21 |
| cloudnull | :) | 16:21 |
| dstanek | cloudnull: i'm assuming this is because the user running the scripts could be a different user | 16:21 |
| cloudnull | it could be | 16:21 |
| dstanek | cloudnull: thx | 16:22 |
| *** links has joined #openstack-keystone | 16:23 | |
| cloudnull | anytime | 16:23 |
| *** jistr_ has quit IRC | 16:23 | |
| dstanek | 1.install Fedora; 2. install LXC; 3. expect it to work; 4. nope. must google to find the right blog posts | 16:28 |
| kbringard | dstanek: so I created a custom policy to allow it and now it works with selinux set to enforcing | 16:31 |
| kbringard | I'm going to open a case with redhat to get this added… I don't think we should have to do anything on the OS side to work around selinux | 16:31 |
| dstanek | kbringard: i'm just getting used to selinux and i now love the audit2policy thing | 16:32 |
| *** jbell8 has joined #openstack-keystone | 16:32 | |
| kbringard | yea, that's exactly how I did it | 16:32 |
| kbringard | althugh I did audit2allow | 16:32 |
| *** _cjones_ has joined #openstack-keystone | 16:33 | |
| kbringard | http://paste.openstack.org/show/475496/ | 16:35 |
| kbringard | dstanek: ^^ | 16:37 |
| *** geoffarnold has quit IRC | 16:37 | |
| *** dims_ has quit IRC | 16:37 | |
| *** geoffarnold has joined #openstack-keystone | 16:38 | |
| dstanek | kbringard: will that work when you start running under apache? | 16:39 |
| bknudson | we should have audit2policy for keystone policy.json | 16:39 |
| kbringard | unsure, I've not tested that yet | 16:40 |
| *** dims_ has joined #openstack-keystone | 16:41 | |
| *** dims_ has quit IRC | 16:41 | |
| *** dims_ has joined #openstack-keystone | 16:42 | |
| *** fhubik has quit IRC | 16:42 | |
| *** dims__ has joined #openstack-keystone | 16:44 | |
| *** btully has joined #openstack-keystone | 16:44 | |
| dstanek | bknudson: that would be pretty neat | 16:44 |
| *** dims_ has quit IRC | 16:45 | |
| *** lhcheng_ has joined #openstack-keystone | 16:47 | |
| *** jaosorior has quit IRC | 16:51 | |
| *** jaosorior has joined #openstack-keystone | 16:52 | |
| *** dikonoor has quit IRC | 16:53 | |
| stevemar_ | bknudson: audit2policy? | 16:54 |
| *** geoffarnold has quit IRC | 16:58 | |
| *** geoffarnold has joined #openstack-keystone | 16:59 | |
| *** mylu has joined #openstack-keystone | 17:00 | |
| *** sdake has quit IRC | 17:03 | |
| *** gyee has quit IRC | 17:05 | |
| *** sdake has joined #openstack-keystone | 17:05 | |
| *** tonytan4ever has joined #openstack-keystone | 17:06 | |
| *** itlinux has joined #openstack-keystone | 17:06 | |
| dstanek | stevemar_: when selinux blocks something it writes to an audit log; then there's tools that can take a log entry and write a policy around allowing that action | 17:08 |
| *** browne has quit IRC | 17:11 | |
| *** phalmos has quit IRC | 17:16 | |
| *** e0ne has joined #openstack-keystone | 17:16 | |
| *** aix_ has quit IRC | 17:17 | |
| openstackgerrit | Merged openstack/keystoneauth: Make RST section delineation length match title https://review.openstack.org/231096 | 17:20 |
| *** geoffarn_ has joined #openstack-keystone | 17:20 | |
| *** david-ly_ has joined #openstack-keystone | 17:21 | |
| *** david-lyle has quit IRC | 17:21 | |
| *** david-ly_ is now known as david-lyle | 17:22 | |
| *** geoffarnold has quit IRC | 17:24 | |
| *** harlowja has quit IRC | 17:25 | |
| *** raildo is now known as raildo-afk | 17:26 | |
| *** topol has joined #openstack-keystone | 17:28 | |
| *** ChanServ sets mode: +v topol | 17:28 | |
| *** Ephur has joined #openstack-keystone | 17:28 | |
| *** dims_ has joined #openstack-keystone | 17:29 | |
| *** dims__ has quit IRC | 17:32 | |
| *** harlowja has joined #openstack-keystone | 17:35 | |
| ayoung | Damnit Henrynash where are you?!?! | 17:37 |
| *** mylu has quit IRC | 17:38 | |
| *** su_zhang has joined #openstack-keystone | 17:40 | |
| *** geoffarn_ has quit IRC | 17:41 | |
| *** geoffarnold has joined #openstack-keystone | 17:41 | |
| *** fawadkhaliq has quit IRC | 17:42 | |
| stevemar_ | ayoung: he's not online on our messaging system either | 17:42 |
| stevemar_ | probably eating tea and crumpets | 17:42 |
| *** fawadkhaliq has joined #openstack-keystone | 17:43 | |
| ayoung | stevemar_, at this time of night I'm guessing he's not drinking caffeine | 17:43 |
| *** raildo-afk is now known as raildo | 17:43 | |
| stevemar_ | ayoung: a pint at the pub instead? | 17:45 |
| ayoung | stevemar_, I sure hope so, although as I reacll he was more a Red Wine drinker | 17:45 |
| stevemar_ | i think you're right | 17:46 |
| ayoung | stevemar_, I'm reading his Virtual Roles spec. I think it can be mostly implemented with my implied roles spec; mine is a subset of the behavior he describes | 17:47 |
| ayoung | I want to hash that out so we can get the specs approved at the summit, and actually make progress next cycle. This is big | 17:48 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update test modules passing on py34 https://review.openstack.org/231635 | 17:48 |
| *** mylu has joined #openstack-keystone | 17:49 | |
| *** mylu has quit IRC | 17:49 | |
| *** exploreshaifali has joined #openstack-keystone | 17:50 | |
| *** pnavarro|afk has quit IRC | 17:52 | |
| *** dims_ has quit IRC | 17:53 | |
| bknudson | py34 fails on keystone.tests.unit.token.test_fernet_provider.TestPayloads.test_time_string_to_int_conversions with '2015-10-06T17:52:21.729385Z' != '2015-10-06T17:52:21.729384Z' | 17:53 |
| bknudson | how odd is that | 17:53 |
| bknudson | I thought we decided that fernet didn't use subsecond precision anyways. | 17:53 |
| stevemar_ | 0.000001s off | 17:53 |
| *** browne has joined #openstack-keystone | 17:55 | |
| morgan | That is an amazing resolution miscalculation | 17:56 |
| bknudson | probably due to heisenberg uncertainty principle. | 17:57 |
| *** su_zhang_ has joined #openstack-keystone | 17:58 | |
| *** henrynash has joined #openstack-keystone | 18:01 | |
| *** ChanServ sets mode: +v henrynash | 18:01 | |
| *** dims_ has joined #openstack-keystone | 18:01 | |
| *** samleon_ has joined #openstack-keystone | 18:02 | |
| *** su_zhang has quit IRC | 18:02 | |
| *** geoffarnold has quit IRC | 18:02 | |
| *** geoffarnold has joined #openstack-keystone | 18:03 | |
| *** timcline has joined #openstack-keystone | 18:04 | |
| *** samleon_ has quit IRC | 18:04 | |
| *** dims_ has quit IRC | 18:05 | |
| *** dims_ has joined #openstack-keystone | 18:06 | |
| *** timcline has quit IRC | 18:07 | |
| *** timcline has joined #openstack-keystone | 18:07 | |
| *** su_zhang_ has quit IRC | 18:09 | |
| *** su_zhang has joined #openstack-keystone | 18:10 | |
| *** itlinux has quit IRC | 18:10 | |
| *** diazjf has joined #openstack-keystone | 18:11 | |
| *** links has quit IRC | 18:13 | |
| *** itlinux has joined #openstack-keystone | 18:15 | |
| *** gyee has joined #openstack-keystone | 18:16 | |
| *** ChanServ sets mode: +v gyee | 18:16 | |
| samueldmq | henrynash: I actually wonder if it woudln't be clearer if we had: list_role_assignments?tree=<root_project_id>, instead of having to define project_id=<project_id>&include_subtree | 18:19 |
| samueldmq | henrynash: I know the bp has been approved already .. I am just sharing to make sure we have thought about this possibility too | 18:20 |
| henrynash | samueldmq: so we could do it that way, it just seemed logic to add it as a wualifier to teh current sigle project version... | 18:21 |
| dolphm | ayoung: we could put something in the release notes about PKI "pending deprecation in the next release" ? that's something i'd want to communicate as early as possible | 18:24 |
| *** geoffarn_ has joined #openstack-keystone | 18:24 | |
| *** ayoung_ has joined #openstack-keystone | 18:24 | |
| *** geoffarnold has quit IRC | 18:25 | |
| samueldmq | dolphm: ++ | 18:28 |
| lbragstad | dolphm: ++ | 18:29 |
| samueldmq | henrynash: I am not against that .. have you thought about that and you have opted for the current implementation ? | 18:31 |
| morgan | dolphm: if fernet is the default in devstack I think it would be fair to say "PKI tokens are being evaluated for deprecation in favor of fernet in the next release" | 18:33 |
| dolphm | we're still a few patches away from that being possible, though | 18:34 |
| dolphm | (fernet being the default in devstack) | 18:34 |
| henrynash | samueldmq: my gut feel was for the one I suggested, and I think it still is | 18:34 |
| morgan | dolphm: exactly | 18:35 |
| morgan | I would hold off on adding that verbiage until we are confident fernet is the default | 18:35 |
| *** geoffarn_ is now known as geoffarnold | 18:37 | |
| *** su_zhang has quit IRC | 18:38 | |
| *** topol has quit IRC | 18:40 | |
| *** su_zhang has joined #openstack-keystone | 18:41 | |
| *** diazjf has left #openstack-keystone | 18:42 | |
| *** geoffarnold has quit IRC | 18:45 | |
| *** geoffarnold has joined #openstack-keystone | 18:45 | |
| *** itlinux has quit IRC | 18:46 | |
| *** itlinux has joined #openstack-keystone | 18:46 | |
| *** itlinux has quit IRC | 18:46 | |
| *** _cjones_ has quit IRC | 18:51 | |
| *** _cjones_ has joined #openstack-keystone | 18:52 | |
| *** su_zhang has quit IRC | 18:52 | |
| *** topol has joined #openstack-keystone | 18:55 | |
| *** ChanServ sets mode: +v topol | 18:55 | |
| *** fawadkhaliq has quit IRC | 18:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:58 | |
| ayoung_ | thanks guys. more optimistic than I have been in a while about this | 18:59 |
| *** jaosorior has quit IRC | 19:00 | |
| *** jaosorior has joined #openstack-keystone | 19:01 | |
| dstanek | consider ayoung_ ... pacified | 19:01 |
| henrynash | ayoung_: I still worry abour complexity, we need to work together to make sure it’s as sobvious to sue as posibe; | 19:01 |
| gyee | who's ready for some fugu?!!! | 19:01 |
| dstanek | gyee: pass | 19:01 |
| *** nicodemos has quit IRC | 19:02 | |
| bknudson | gyee is really into the fugu | 19:02 |
| gyee | either that or bungee jumping | 19:02 |
| bknudson | gyee might be trying to poison us. | 19:02 |
| gyee | hah | 19:03 |
| dstanek | just watched a video on fugu. not sure i want to eat a poisonous fish | 19:03 |
| *** nicodemos has joined #openstack-keystone | 19:04 | |
| morgan | I wont be eating it. shrug. Not my idea of exciting. /me goes to get adrenaline rush riding downhill on a bicycle | 19:04 |
| dstanek | i like being shot out of a cannon | 19:05 |
| *** csd has quit IRC | 19:06 | |
| *** csd has joined #openstack-keystone | 19:07 | |
| bknudson | I just submit a change to keystone. | 19:08 |
| morgan | bknudson: your definition of exciting is wildly different than mine :P | 19:09 |
| stevemar_ | morgan: depends on how much the patch changes | 19:12 |
| *** nicodemos has quit IRC | 19:13 | |
| *** amakarov is now known as amakarov_away | 19:14 | |
| openstackgerrit | Corey Bryant proposed openstack/python-keystoneclient: Iterate over copy of session.adapters keys in Python2/3 https://review.openstack.org/231667 | 19:17 |
| *** nicodemos has joined #openstack-keystone | 19:18 | |
| *** e0ne has quit IRC | 19:23 | |
| *** henrynash has quit IRC | 19:24 | |
| *** chao_li has joined #openstack-keystone | 19:30 | |
| *** e0ne has joined #openstack-keystone | 19:32 | |
| ayoung_ | dstanek, is your apporach using URI records likethis: https://tools.ietf.org/html/rfc7553#page-4 | 19:34 |
| dstanek | ayoung_: yes | 19:35 |
| dstanek | i wanted to have something tangible to show for the summit | 19:35 |
| *** ayoung has quit IRC | 19:36 | |
| *** ayoung_ is now known as ayoung | 19:37 | |
| *** exploreshaifali has quit IRC | 19:40 | |
| *** timcline_ has joined #openstack-keystone | 19:42 | |
| *** timcline has quit IRC | 19:45 | |
| *** geoffarnold has quit IRC | 19:48 | |
| *** geoffarnold has joined #openstack-keystone | 19:48 | |
| *** timcline_ has quit IRC | 19:49 | |
| *** timcline has joined #openstack-keystone | 19:49 | |
| *** roxanagh_ has quit IRC | 19:50 | |
| *** fawadkhaliq has quit IRC | 19:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:54 | |
| bknudson | why is token_formatters using six when it doesn't even have python3 test support. | 19:56 |
| *** chao_li has quit IRC | 19:57 | |
| *** timcline_ has joined #openstack-keystone | 19:57 | |
| *** nicodemos has quit IRC | 19:58 | |
| *** timcline has quit IRC | 20:01 | |
| *** mylu has joined #openstack-keystone | 20:02 | |
| *** ayoung has quit IRC | 20:06 | |
| *** geoffarnold is now known as geoffarnoldX | 20:07 | |
| *** su_zhang has joined #openstack-keystone | 20:08 | |
| *** su_zhang has quit IRC | 20:08 | |
| *** su_zhang has joined #openstack-keystone | 20:08 | |
| *** geoffarnoldX has quit IRC | 20:09 | |
| *** geoffarnold has joined #openstack-keystone | 20:10 | |
| *** akanksha_ has joined #openstack-keystone | 20:14 | |
| *** timcline_ has quit IRC | 20:16 | |
| *** timcline has joined #openstack-keystone | 20:17 | |
| *** mylu has quit IRC | 20:18 | |
| *** ayoung has joined #openstack-keystone | 20:21 | |
| *** ChanServ sets mode: +v ayoung | 20:21 | |
| *** pnavarro|afk has joined #openstack-keystone | 20:26 | |
| *** njohnston has joined #openstack-keystone | 20:27 | |
| *** sdake has quit IRC | 20:27 | |
| *** sdake has joined #openstack-keystone | 20:28 | |
| *** fawadkhaliq has quit IRC | 20:29 | |
| *** hrou has quit IRC | 20:35 | |
| *** mtaylor has joined #openstack-keystone | 20:38 | |
| *** wolsen has quit IRC | 20:39 | |
| *** Nakato has quit IRC | 20:39 | |
| *** wolsen has joined #openstack-keystone | 20:40 | |
| *** Nakato has joined #openstack-keystone | 20:40 | |
| *** mordred has quit IRC | 20:42 | |
| *** mtaylor is now known as mordred | 20:42 | |
| *** Ephur has quit IRC | 20:43 | |
| *** lhcheng_ has quit IRC | 20:43 | |
| *** wwwjfy_ has quit IRC | 20:43 | |
| *** richm has quit IRC | 20:43 | |
| *** mjb has quit IRC | 20:43 | |
| *** jamielennox has quit IRC | 20:43 | |
| *** flwang has quit IRC | 20:43 | |
| *** zigo has quit IRC | 20:43 | |
| *** amit213 has quit IRC | 20:43 | |
| *** tonyb has quit IRC | 20:43 | |
| *** krotscheck has quit IRC | 20:43 | |
| *** rharwood has quit IRC | 20:43 | |
| *** gus has quit IRC | 20:43 | |
| *** sigmavirus24 has quit IRC | 20:43 | |
| *** eglute has quit IRC | 20:43 | |
| *** d34dh0r53 has quit IRC | 20:43 | |
| *** cloudnull has quit IRC | 20:43 | |
| *** serverascode has quit IRC | 20:43 | |
| *** jraim has quit IRC | 20:43 | |
| *** dolphm has quit IRC | 20:43 | |
| *** lbragstad has quit IRC | 20:43 | |
| *** comstud has quit IRC | 20:43 | |
| *** jacorob has quit IRC | 20:43 | |
| *** hockeynut has quit IRC | 20:43 | |
| *** Guest68187 has quit IRC | 20:43 | |
| *** pkarikh has quit IRC | 20:43 | |
| *** dtroyer has quit IRC | 20:43 | |
| *** sudorandom has quit IRC | 20:43 | |
| *** mgagne has quit IRC | 20:43 | |
| *** breton has quit IRC | 20:43 | |
| *** phalmos has joined #openstack-keystone | 20:46 | |
| *** Ephur has joined #openstack-keystone | 20:46 | |
| *** lhcheng_ has joined #openstack-keystone | 20:46 | |
| *** cloudnull has joined #openstack-keystone | 20:46 | |
| *** wwwjfy_ has joined #openstack-keystone | 20:46 | |
| *** richm has joined #openstack-keystone | 20:46 | |
| *** mjb has joined #openstack-keystone | 20:46 | |
| *** jamielennox has joined #openstack-keystone | 20:46 | |
| *** flwang has joined #openstack-keystone | 20:46 | |
| *** zigo has joined #openstack-keystone | 20:46 | |
| *** amit213 has joined #openstack-keystone | 20:46 | |
| *** tonyb has joined #openstack-keystone | 20:46 | |
| *** krotscheck has joined #openstack-keystone | 20:46 | |
| *** rharwood has joined #openstack-keystone | 20:46 | |
| *** gus has joined #openstack-keystone | 20:46 | |
| *** sigmavirus24 has joined #openstack-keystone | 20:46 | |
| *** eglute has joined #openstack-keystone | 20:46 | |
| *** d34dh0r53 has joined #openstack-keystone | 20:46 | |
| *** serverascode has joined #openstack-keystone | 20:46 | |
| *** jraim has joined #openstack-keystone | 20:46 | |
| *** dolphm has joined #openstack-keystone | 20:46 | |
| *** lbragstad has joined #openstack-keystone | 20:46 | |
| *** comstud has joined #openstack-keystone | 20:46 | |
| *** jacorob has joined #openstack-keystone | 20:46 | |
| *** hockeynut has joined #openstack-keystone | 20:46 | |
| *** Guest68187 has joined #openstack-keystone | 20:46 | |
| *** pkarikh has joined #openstack-keystone | 20:46 | |
| *** dtroyer has joined #openstack-keystone | 20:46 | |
| *** mgagne has joined #openstack-keystone | 20:46 | |
| *** sudorandom has joined #openstack-keystone | 20:46 | |
| *** breton has joined #openstack-keystone | 20:46 | |
| *** cameron.freenode.net sets mode: +vo jamielennox dolphm | 20:46 | |
| *** serverascode has quit IRC | 20:46 | |
| *** pnavarro|afk has quit IRC | 20:47 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Handle 16-char non-uuid user IDs in payload https://review.openstack.org/226121 | 20:47 |
| *** gildub has joined #openstack-keystone | 20:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 20:48 | |
| *** trey has quit IRC | 20:48 | |
| njohnston | Hi! I am trying to experiment with Keystone, using Devstack. When I am in Devstack and I would like to restart Keystone so I can update it's configuration (/etc/keystone/keystone.conf), what is the proper method to accomplish that? | 20:50 |
| bknudson | njohnston: restart apache | 20:50 |
| *** trey has joined #openstack-keystone | 20:51 | |
| njohnston | Thanks! | 20:51 |
| *** geoffarnold has quit IRC | 20:52 | |
| *** morgan has quit IRC | 20:52 | |
| *** morgan has joined #openstack-keystone | 20:52 | |
| *** ChanServ sets mode: +v morgan | 20:52 | |
| *** geoffarnold has joined #openstack-keystone | 20:52 | |
| *** sdake has quit IRC | 20:53 | |
| *** serverascode has joined #openstack-keystone | 20:58 | |
| *** sdake has joined #openstack-keystone | 20:58 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet key writing for python 3 https://review.openstack.org/231710 | 20:59 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix fernet padding for python 3 https://review.openstack.org/231711 | 20:59 |
| *** pnavarro|afk has joined #openstack-keystone | 21:00 | |
| *** topol_ has joined #openstack-keystone | 21:00 | |
| *** ChanServ sets mode: +v topol_ | 21:00 | |
| *** gyee has quit IRC | 21:01 | |
| *** topol has quit IRC | 21:02 | |
| *** phalmos has quit IRC | 21:02 | |
| *** fawadkhaliq has quit IRC | 21:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 21:08 | |
| *** raildo is now known as raildo-afk | 21:09 | |
| *** geoffarnold has quit IRC | 21:13 | |
| *** geoffarnold has joined #openstack-keystone | 21:14 | |
| *** edmondsw has quit IRC | 21:14 | |
| *** fawadk has joined #openstack-keystone | 21:18 | |
| *** fawadkhaliq has quit IRC | 21:22 | |
| *** e0ne has quit IRC | 21:24 | |
| ayoung | marekd, stevemar_ bknudson, do you know if the Federation code uses the id_mapping backend? Is there something special we need to do to tell Federation to map the IDs? | 21:25 |
| stevemar_ | ayoung: it does not use the id_mapping backend, AFAIK that is only used by the multi domain stuff | 21:26 |
| stevemar_ | map the user ID the same way you map the user Name in the mapping | 21:26 |
| bknudson | ayoung: what would it use it for? | 21:26 |
| dstanek | i love watching the x-project meeting; gives me time to unwind and nap :-) | 21:27 |
| ayoung | bknudson, if we had two protocols that needed to map to existing users, and one was a preexisint database... | 21:27 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fix direct paths inside filter_factory https://review.openstack.org/231722 | 21:28 |
| *** hrou has joined #openstack-keystone | 21:33 | |
| *** pnavarro|afk has quit IRC | 21:34 | |
| *** geoffarnold has quit IRC | 21:35 | |
| *** geoffarnold has joined #openstack-keystone | 21:35 | |
| *** su_zhang has quit IRC | 21:36 | |
| *** henrynash has joined #openstack-keystone | 21:40 | |
| *** ChanServ sets mode: +v henrynash | 21:40 | |
| *** ayoung has quit IRC | 21:43 | |
| *** jbell8 has quit IRC | 21:43 | |
| *** topol_ has quit IRC | 21:44 | |
| *** gyee has joined #openstack-keystone | 21:45 | |
| *** ChanServ sets mode: +v gyee | 21:45 | |
| *** harlowja has quit IRC | 21:46 | |
| bknudson | looks like the py3 time format issue might have to do with rounding | 21:46 |
| bknudson | because I saw it pass once | 21:46 |
| *** topol has joined #openstack-keystone | 21:46 | |
| *** ChanServ sets mode: +v topol | 21:46 | |
| bknudson | the fernet code all says it's converting time strings to ints but they're actually floats. | 21:47 |
| bknudson | are they really supposed to be ints? | 21:48 |
| dolphm | bknudson: are they calling float() ? | 21:48 |
| dolphm | bknudson: floats would preserve the subsecond precision of the expiration date's timestamp, and we have tests for that, so the method names would be wrong | 21:49 |
| *** samleon has quit IRC | 21:49 | |
| bknudson | not really, maybe it's just the way it's getting called in the tests. | 21:49 |
| dolphm | unless it actually is an int and it's multiplying those floats by 100000 to preserve accuracy lol | 21:50 |
| bknudson | I bet it would return an int if the timestamp passed in was only accurate to the second, but the test is doing utils.isotime(subsecond=True) | 21:50 |
| dolphm | nope, definitely a float: 1442487859.843989 came out of a real token | 21:50 |
| dolphm | bknudson: scroll down to the last example of the raw fernet payload, and scroll over to the right -- http://dolphm.com/inside-openstack-keystone-fernet-token-payloads/ | 21:51 |
| *** topol has quit IRC | 21:51 | |
| dolphm | bknudson: second to last field is the expiration | 21:51 |
| bknudson | the blog also has "2015-09-17T11:04:19.843989Z" | 21:52 |
| bknudson | what I'm looking at is http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/providers/fernet/token_formatters.py#n325 | 21:55 |
| bknudson | _convert_time_string_to_int and _convert_int_to_time_string(cls, time_int): | 21:55 |
| bknudson | which this is really working with floats | 21:55 |
| *** stevemar_ has quit IRC | 21:55 | |
| *** stevemar_ has joined #openstack-keystone | 21:56 | |
| *** ChanServ sets mode: +o stevemar_ | 21:56 | |
| *** harlowja has joined #openstack-keystone | 21:57 | |
| bknudson | here's one test that's using subsecond precision: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/token/test_fernet_provider.py#n130 | 21:57 |
| bknudson | test_time_string_to_int_conversions | 21:57 |
| dolphm | bknudson: needs a rename! :( | 21:58 |
| *** stevemar_ has quit IRC | 21:58 | |
| dolphm | lbragstad: ^ | 21:58 |
| bknudson | dolphm: unless it's really supposed to be int? I thought fernet only supported second precision | 21:59 |
| *** richm has quit IRC | 21:59 | |
| bknudson | I also thought that expiration time wasn't in the token data | 21:59 |
| dolphm | bknudson: for the creation date, yes, because we're handicapped by the spec | 21:59 |
| *** gordc has quit IRC | 22:00 | |
| dolphm | bknudson: and although fernet also supports a TTL, it's from a client config perspective, not something that's encoded into the token, and so morgan wanted it encoded into the token separately. so we added a floaty int to the payload. | 22:00 |
| dolphm | bknudson: there was no expiration encoded into fernet until pretty late in the game | 22:01 |
| *** fawadk has quit IRC | 22:01 | |
| *** kbringard has quit IRC | 22:02 | |
| *** tonytan4ever has quit IRC | 22:03 | |
| bknudson | ok, I'll update the names | 22:03 |
| bknudson | less confusing | 22:03 |
| bknudson | then I also have to figure out what's going on with py3 and the odd timestamp differences. | 22:04 |
| bknudson | (or how to work around it) | 22:05 |
| *** stevemar_ has joined #openstack-keystone | 22:07 | |
| *** ChanServ sets mode: +o stevemar_ | 22:07 | |
| *** boris-42 has quit IRC | 22:09 | |
| *** henrynash has quit IRC | 22:13 | |
| *** geoffarnold has quit IRC | 22:17 | |
| *** geoffarn_ has joined #openstack-keystone | 22:18 | |
| *** su_zhang has joined #openstack-keystone | 22:25 | |
| *** mylu has joined #openstack-keystone | 22:25 | |
| *** csoukup has quit IRC | 22:26 | |
| *** timcline has quit IRC | 22:27 | |
| *** ngupta has quit IRC | 22:31 | |
| *** su_zhang has quit IRC | 22:34 | |
| *** geoffarn_ is now known as geoffarnoldX | 22:37 | |
| *** Ephur has quit IRC | 22:38 | |
| *** geoffarnoldX has quit IRC | 22:38 | |
| *** geoffarnold has joined #openstack-keystone | 22:39 | |
| *** stevemar_ has quit IRC | 22:43 | |
| *** stevemar_ has joined #openstack-keystone | 22:43 | |
| *** ChanServ sets mode: +o stevemar_ | 22:43 | |
| *** stevemar_ has quit IRC | 22:46 | |
| *** mylu has quit IRC | 22:47 | |
| *** mylu has joined #openstack-keystone | 22:48 | |
| *** boris-42 has joined #openstack-keystone | 22:53 | |
| openstackgerrit | Haneef Ali proposed openstack/python-keystoneclient: Remove hardcoded endpoint filter for update password https://review.openstack.org/231749 | 22:56 |
| *** geoffarnold has quit IRC | 23:00 | |
| *** geoffarnold has joined #openstack-keystone | 23:00 | |
| *** chlong has quit IRC | 23:06 | |
| *** su_zhang has joined #openstack-keystone | 23:07 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:16 | |
| *** geoffarnold has quit IRC | 23:21 | |
| *** geoffarnold has joined #openstack-keystone | 23:21 | |
| *** roxanagh_ has joined #openstack-keystone | 23:24 | |
| notmyname | bknudson: in the meeting today you were talking about how the tenant_id is in the token from keystone | 23:28 |
| notmyname | is that true for UUID tokens? PKI tokens? fernet tokens? | 23:28 |
| notmyname | this is in relation to the cross-project tenant_id-ectomy spec | 23:31 |
| *** agireud has quit IRC | 23:32 | |
| *** uiyice has joined #openstack-keystone | 23:33 | |
| *** dsirrine has quit IRC | 23:35 | |
| *** uiyice has quit IRC | 23:40 | |
| *** uiyice has joined #openstack-keystone | 23:40 | |
| *** sdake_ has joined #openstack-keystone | 23:41 | |
| *** sdake has quit IRC | 23:43 | |
| *** geoffarn_ has joined #openstack-keystone | 23:43 | |
| *** geoffarnold has quit IRC | 23:46 | |
| *** roxanagh_ has quit IRC | 23:48 | |
| *** stevemar_ has joined #openstack-keystone | 23:50 | |
| *** ChanServ sets mode: +o stevemar_ | 23:50 | |
| *** darrenc is now known as darrenc_afk | 23:51 | |
| *** dsirrine has joined #openstack-keystone | 23:52 | |
| *** sdake_ has quit IRC | 23:52 | |
| *** slberger has left #openstack-keystone | 23:53 | |
| *** mylu has quit IRC | 23:55 | |
| *** mestery has quit IRC | 23:56 | |
| *** mestery has joined #openstack-keystone | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!