Tuesday, 2015-10-13

openstackgerritJamie Lennox proposed openstack/python-keystoneclient: Make tests run against original client and session  https://review.openstack.org/11708900:03
*** opal has joined #openstack-keystone00:04
*** btully has quit IRC00:07
*** geoffarnold has quit IRC00:08
*** geoffarn_ has joined #openstack-keystone00:08
*** hrou has joined #openstack-keystone00:09
*** _hrou_ has quit IRC00:11
*** dikonoor has joined #openstack-keystone00:12
*** _hrou_ has joined #openstack-keystone00:13
*** EinstCrazy has quit IRC00:14
*** exploreshaifali has quit IRC00:16
*** hrou has quit IRC00:16
*** opal has left #openstack-keystone00:18
*** wwwjfy has joined #openstack-keystone00:19
*** shadower has quit IRC00:23
*** shadower has joined #openstack-keystone00:23
*** stevemar_ has quit IRC00:25
*** geoffarn_ has quit IRC00:28
*** geoffarnold has joined #openstack-keystone00:29
*** stevemar_ has joined #openstack-keystone00:29
*** ChanServ sets mode: +o stevemar_00:29
*** gyee has quit IRC00:31
*** omkarjoshi has joined #openstack-keystone00:32
*** su_zhang has quit IRC00:34
*** lhcheng has quit IRC00:37
*** annasort has quit IRC00:42
jamielennoxstevemar_: super simple: https://review.openstack.org/#/c/224407/00:43
*** omkarjoshi has quit IRC00:45
stevemar_jamielennox: how did you know i'm on :O00:46
jamielennoxstevemar_: experience00:47
stevemar_jamielennox: true that00:48
*** tobe has joined #openstack-keystone00:49
*** csoukup has joined #openstack-keystone00:49
*** geoffarnold has quit IRC00:50
*** geoffarnold has joined #openstack-keystone00:50
*** pumaranikar has joined #openstack-keystone00:51
openstackgerritOpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements  https://review.openstack.org/23382000:52
openstackgerritOpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements  https://review.openstack.org/23387600:52
openstackgerritOpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements  https://review.openstack.org/23382100:53
*** gildub has quit IRC00:53
*** csoukup has quit IRC00:54
*** yuwen has joined #openstack-keystone00:58
*** EinstCrazy has joined #openstack-keystone00:59
*** btully has joined #openstack-keystone01:01
openstackgerritOpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements  https://review.openstack.org/23388601:02
*** btully has quit IRC01:05
*** woodster_ has quit IRC01:09
*** browne has quit IRC01:10
*** hrou has joined #openstack-keystone01:10
*** wwwjfy_ has joined #openstack-keystone01:10
*** wwwjfy has quit IRC01:11
*** geoffarn_ has joined #openstack-keystone01:11
*** geoffarnold has quit IRC01:12
*** _hrou_ has quit IRC01:13
*** gildub has joined #openstack-keystone01:27
*** su_zhang has joined #openstack-keystone01:32
*** geoffarn_ has quit IRC01:33
*** geoffarnold has joined #openstack-keystone01:33
yuwenI config the keystone as IDP with idp_sso_endpoint= ,  but it returns  {"error": {"message": "\u627e\u4e0d\u5230\u8be5\u8d44\u6e90\u3002", "code": 404, "title": "Not Found"}}01:43
*** davechen has joined #openstack-keystone01:45
*** omkarjoshi has joined #openstack-keystone01:46
*** jasonsb_ has quit IRC01:47
*** omkarjoshi has quit IRC01:50
*** stevemar_ has quit IRC01:53
*** john5223 is now known as zz_john522301:55
morganstevemar_: cause ptl things. That is how jamielennox knew01:56
*** yuwen has quit IRC01:56
*** wwwjfy_ has quit IRC02:08
*** iurygregory has quit IRC02:10
*** iurygregory has joined #openstack-keystone02:10
*** yuwen has joined #openstack-keystone02:15
*** geoffarnold has quit IRC02:15
*** geoffarnold has joined #openstack-keystone02:15
*** lhcheng has joined #openstack-keystone02:22
*** ChanServ sets mode: +v lhcheng02:22
davechenlhcheng: hey, are you here?02:22
lhchengdavechen: hey02:23
lhchengjust pm'd you :)02:23
*** browne has joined #openstack-keystone02:26
*** links has joined #openstack-keystone02:28
*** dims_ has quit IRC02:28
*** ngupta has joined #openstack-keystone02:30
*** geoffarnold has quit IRC02:36
*** su_zhang has quit IRC02:36
*** geoffarnold has joined #openstack-keystone02:36
*** dims__ has joined #openstack-keystone02:41
*** stevemar_ has joined #openstack-keystone02:42
*** ChanServ sets mode: +o stevemar_02:42
*** btully has joined #openstack-keystone02:49
*** richm has quit IRC02:50
*** btully has quit IRC02:53
*** geoffarnold has quit IRC02:57
*** geoffarnold has joined #openstack-keystone02:58
*** dims__ has quit IRC02:59
davechenrodrigods: hey, are you here?03:00
*** hrou has quit IRC03:03
*** wwwjfy_ has joined #openstack-keystone03:12
stevemar_bknudson: still around?03:26
openstackgerritSteve Martinelli proposed openstack/keystone: switch to oslo.cache  https://review.openstack.org/19587303:31
*** jasonsb_ has joined #openstack-keystone03:31
stevemar_jamielennox: payback! https://review.openstack.org/#/c/195873/03:34
davechenstevemar_, jamielennox: help me pls,03:34
jamielennoxstevemar_: they are not equivalent!03:34
stevemar_davechen: whats up?03:34
stevemar_jamielennox: yeah :(03:34
davechenstevemar_, jamielennox: I am trying to enable k-k federation.03:34
davechenbut i persistent encounter this exception "Could not find Identity Provider identifier in environment"03:35
stevemar_jamielennox: this one is a bit of a doozy, but it's just a lot of ripping things out03:35
davechenseem like it looks for "Shib-Identity-Provider::keystone-idp"  in the assertion.03:35
davechenbut Shib-Identity-Provider is missing in the assertion, how can i do the trouble shooting?03:36
stevemar_davechen: what value do you have under [federation] remote_id_attribute (in keystone.conf)03:38
davechenlet me check03:38
davechenremote_id_attribute = Shib-Identity-Provider03:38
stevemar_and in your remote keystone, you created the identity provider and set remote-id = keystone-idp?03:39
stevemar_davechen: try adding something like this to your configs: https://gist.github.com/stevemart/585f932a5c526c375396#file-liberty_and_keystone-sh-L16603:39
*** roxanaghe has quit IRC03:39
*** spandhe has quit IRC03:39
*** lhcheng has quit IRC03:40
davechenstevemar_: i saw there might some issue in my shibboleth2.xml03:40
stevemar_but for you it would be osmething like `SetEnv Shib-Identity-Provider keystone-idp`03:40
*** dikonoor has quit IRC03:41
davechenstevemar_: does this line in the shibboleth2.xml matter? "<ApplicationOverride id="keystone-idp" entityID="">"03:43
davechennot sure what the value i should give for entityID field here03:43
davechendo you have a workable shibboleth2.xml?03:44
stevemar_davechen: i dont think that value matters in shibboleth2.xml03:47
stevemar_davechen: not at the moment :(03:47
stevemar_davechen: try setting those env. vars. in apache config, i think that might get you a bit farther03:48
*** ngupta has quit IRC03:50
davechenstevemar_: if i set entityID  in apache config, how should i set it?03:51
davechenstevemar_: i am get a litter farther, the excetpion is " Incoming identity provider identifier not included among the accepted identifiers" :)03:53
davechenlet me digging into this.03:53
davechenstevemar_: could you pls take a loot at this (http://paste.openstack.org/show/476081/)?03:53
davecheni just define my sp id as "keystone-sp", is it acceptable?03:54
davechenjust got confused about so many id / entity id in the conf.03:55
stevemar_davechen: yeah, it's definitely not easy to track03:55
stevemar_davechen: that looks fine to me03:55
davechensomewhere it says it a url while other place it says it is a ID.03:55
jamielennoxstevemar_: basic comment: https://review.openstack.org/#/c/195873/03:55
stevemar_jamielennox: maintain it because it was listed as a driver https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L32603:58
*** links has quit IRC03:58
*** dims__ has joined #openstack-keystone03:59
stevemar_jamielennox: ready for 3 more? hehe04:00
stevemar_sadly, none are easy breezy04:01
jamielennoxstevemar_: oh, yea - i misread, thought common was from openstack.common04:01
stevemar_but all are non-contentious04:01
jamielennoxth other was the point though, should create a keystone.common create_memoize thing04:01
openstackgerritMerged openstack/keystonemiddleware: Updated from global requirements  https://review.openstack.org/23382104:01
stevemar_jamielennox: yeah, i'll post it as a follow on soon when i have time again04:02
jamielennoxstevemar_: is oslo cache going to be useful for auth_token?04:02
stevemar_jamielennox: i think so, the nova folks added some other bcakends04:03
jamielennoxi'm mostly worried about the CONF tie in04:03
*** su_zhang has joined #openstack-keystone04:03
stevemar_jamielennox: i think https://github.com/openstack/oslo.cache/blob/master/oslo_cache/backends/dictionary.py and https://github.com/openstack/keystonemiddleware/blob/aba3846d8cec3eeff03c7996e7afe81315f4a4d0/keystonemiddleware/openstack/common/memorycache.py are analogous04:04
stevemar_jamielennox: if you're brave enough: https://review.openstack.org/#/c/214775/ i followed your lead there04:04
jamielennoxstevemar_: i am _not_ replacing memorycache, i'm killing it as fast as i can04:04
davechenIt's "Could not map user while setting ephemeral user identity", anyway the previous issue has gone :-D04:05
davechenstevemar_, thanks a lot!04:05
jamielennoxoh, nice04:05
stevemar_jamielennox: theres this last one too: https://review.openstack.org/#/c/231123/04:05
*** dims__ has quit IRC04:06
stevemar_davechen: i'd ask you to review too, but you are deep in federation code :)04:06
stevemar_you might not ever emerge :O04:06
davechenwill continue my investiagtion after lunch. stevemar_, jamielennox ^^04:06
stevemar_davechen: good luck! enjoy lunch :)04:06
davechenstevemar_: sure, i will read your code then.04:07
davechenmust be fun and learn more from it.04:07
stevemar_davechen: take your time, mine is boring and just moving things around :P04:07
davechenstevemar_: nah, the reason behind it is not boring. :)04:09
*** davechen is now known as davechen_afk04:09
openstackgerritMerged openstack/python-keystoneclient: Updated from global requirements  https://review.openstack.org/23388604:09
openstackgerritMerged openstack/keystoneauth: Updated from global requirements  https://review.openstack.org/23387604:12
*** jaosorior has joined #openstack-keystone04:15
*** opal has joined #openstack-keystone04:18
*** jasonsb_ has quit IRC04:19
jamielennoxstevemar_: you're missing migrations from the federation one04:19
*** geoffarn_ has joined #openstack-keystone04:23
*** geoffarnold has quit IRC04:24
*** lhcheng has joined #openstack-keystone04:27
*** ChanServ sets mode: +v lhcheng04:27
*** dobson has quit IRC04:30
stevemar_jamielennox: was going to do that in another patch? isn't that how you did the endpoint policy one?04:30
*** opal has left #openstack-keystone04:30
jamielennoxstevemar_: yea i did i just didn't see it as a dep04:31
openstackgerritSteve Martinelli proposed openstack/keystone: Remove bas64utils and tests  https://review.openstack.org/23392904:34
*** jaosorior has quit IRC04:34
stevemar_jamielennox: i can whip that up, didn't think it was a show stopper04:34
stevemar_jamielennox: i promise, an easy one this time: https://review.openstack.org/#/c/233929/04:35
*** dobson has joined #openstack-keystone04:36
jamielennoxstevemar_: i've been out of this code too long04:37
jamielennoxwtf is an initiator04:37
stevemar_jamielennox: its all good, you can skip that one ;P04:37
stevemar_jamielennox: dstanek and lbragstad can handle it04:38
*** btully has joined #openstack-keystone04:38
*** urulama_ has joined #openstack-keystone04:39
openstackgerritSteve Martinelli proposed openstack/keystone: Move federation extension into keystone core  https://review.openstack.org/21477504:40
*** urulama has quit IRC04:41
stevemar_gerrit is so slow today04:41
*** jaosorior has joined #openstack-keystone04:42
*** roxanaghe has joined #openstack-keystone04:43
*** geoffarnold has joined #openstack-keystone04:44
*** geoffarn_ has quit IRC04:44
*** roxanaghe has quit IRC04:56
*** links has joined #openstack-keystone05:06
*** su_zhang has quit IRC05:06
*** jaosorior has quit IRC05:10
*** jaosorior has joined #openstack-keystone05:10
*** su_zhang has joined #openstack-keystone05:11
stevemar_morgan: eventually i want your opinion on https://bugs.launchpad.net/keystone/+bug/150468605:14
openstackLaunchpad bug 1504686 in Keystone "Keystone errors on token requests for users in recreated tenants when using memcache" [Undecided,New]05:14
*** urulama_ is now known as urulama05:18
*** geoffarnold has quit IRC05:19
*** geoffarnold has joined #openstack-keystone05:19
morganRecreated tenant = new id, all tokens are for the oldnid05:21
morganOld id*05:21
morganDeletion of a tenant should trigger a cache invalidate05:22
morganBut the memcache has to be shared05:22
openstackgerritSteve Martinelli proposed openstack/keystone: add placeholder migrations for liberty  https://review.openstack.org/23394305:23
morganYou can't have split cache and assume one keystone can invalidate another keystone's cache05:23
*** davechen_afk is now known as davechen05:23
stevemar_morgan: ^05:23
stevemar_morgan: ahh05:23
morganHow does keystone "a" know how to invalidate keystone "b"'s independent memcache05:24
stevemar_i figured you knew the answer :)05:24
morganMemcache is assumed to be a shared reaource. There are ways around it but it's going to be icccccky05:24
stevemar_morgan: are you going to write that in the bug, or want me to do it?05:25
morganI am not going to tonight ;)05:25
morganFeel free to paraphrase or remind me tomorrow05:25
morganEither works for me05:26
stevemar_i'll paraphrase and include you on the report05:26
morganSounds good05:26
*** su_zhang has quit IRC05:26
*** Nirupama has joined #openstack-keystone05:31
stevemar_morgan: lol at jamielennox's last comment here: https://review.openstack.org/#/c/171916/1305:32
*** lhcheng has quit IRC05:33
morganI dont see a comment from jamielennox ?05:34
morganAh nvm05:34
*** lhcheng has joined #openstack-keystone05:34
*** ChanServ sets mode: +v lhcheng05:34
morganBad render05:34
jamielennoxstevemar_: ugh05:36
jamielennoxsaving for mitaka was probably an ok strategy05:37
jamielennoxalthough it looks like i wrote the first one not long after liberyu05:37
stevemar_jamielennox: we'll get them all in this time :P05:38
stevemar_jamielennox: https://review.openstack.org/233943 needs to go in first, then we can get your patch in05:38
morganstevemar_: ooooooooooooh snaaaaaaaap. Migration placeholders05:38
* morgan might be a little punchy05:39
*** wwwjfy_ has quit IRC05:39
* morgan also does the "i get a new bicycle tomorrow" dance05:39
stevemar_jamielennox: morgan for something that has >1 migration, like federation, do we just create one script to create the equivalent of 006 or 007 of the extension migration?05:39
*** tobe has quit IRC05:39
*** geoffarnold has quit IRC05:40
stevemar_morgan: i'll allow it05:40
morganstevemar_: i think so05:40
*** geoffarnold has joined #openstack-keystone05:40
stevemar_morgan: does this new bike cost as much as a down payment on a house again?05:40
* stevemar_ jokes05:41
jamielennoxstevemar_: approved05:42
jamielennoxmorgan: oo, bike05:42
morganstevemar_: $2800 USD or so05:42
morganMaybe it was $250005:43
morganIt is a gravel/fire trail/light off road bike05:43
morgan(No suspension) vs a xc MTB05:43
morganI'll get an xc/full suspension mtb next year sometime05:44
morganBut the trails I want to ride, less fun on an MTB (read: less adrenaline/boring)05:45
stevemar_jamielennox: morgan ty!05:46
stevemar_jamielennox: morgan d'oh our gate it still busted until we release ksc and ksm05:46
*** pumaranikar has quit IRC05:46
morganSo release em tomorrow!05:46
stevemar_morgan: your biking frightens me, do not crash into things05:46
stevemar_morgan: patches are already in flight, just need approval! https://review.openstack.org/#/c/233761/ and https://review.openstack.org/#/c/233763/05:47
morganLet slip the hogs... And to the races we go. Bet everything on snake eyes, and spin red05:48
morganOr uh.. Maybe a car metaphor instead?05:48
morganstevemar_: i got a cyclocross bike ;)05:49
morganNow have a road bike, tri bike, cx. Just need a MTB and then a second road bike (for training duh) to have a complete stable :P05:50
jamielennoxstevemar_: tricycle05:54
morganstevemar_: ^ as an example05:56
morganTriathlon bike05:56
morganThat one is way cooler than mine though.05:56
morganCause Felt > other bike makers.05:56
stevemar_morgan: jamielennox i'm glad it's not http://i.imgur.com/LqIySh4.jpg06:00
stevemar_apparently there are adult versions?!06:01
stevemar_i would avoid those too06:02
stevemar_my battery is about to die, so gn morgan and jamielennox06:02
stevemar_see you on the flip side tomorrow06:02
*** stevemar_ has quit IRC06:03
jamielennoxstevemar_: good night06:03
*** dims__ has joined #openstack-keystone06:03
*** jtomasek has joined #openstack-keystone06:06
*** dims__ has quit IRC06:09
*** links has quit IRC06:20
*** wwwjfy_ has joined #openstack-keystone06:20
*** openstack has joined #openstack-keystone06:27
*** tsufiev has joined #openstack-keystone06:29
*** StoneZhang has joined #openstack-keystone06:29
*** ParsectiX has joined #openstack-keystone06:42
*** geoffarnold has quit IRC06:44
*** geoffarnold has joined #openstack-keystone06:44
*** gildub has quit IRC06:46
*** tsymancz4k has quit IRC06:49
*** e0ne has joined #openstack-keystone06:58
*** e0ne has quit IRC06:59
*** wwwjfy_ has quit IRC07:00
*** wwwjfy_ has joined #openstack-keystone07:01
*** dims__ has joined #openstack-keystone07:05
openstackgerritMerged openstack/keystonemiddleware: Remove unused group parameter from tests  https://review.openstack.org/22367907:09
*** omkarjoshi has joined #openstack-keystone07:10
*** dims__ has quit IRC07:10
*** exploreshaifali has joined #openstack-keystone07:11
*** omkarjoshi has quit IRC07:11
*** links has joined #openstack-keystone07:13
*** e0ne has joined #openstack-keystone07:16
*** btully has quit IRC07:16
*** tsymanczyk has joined #openstack-keystone07:18
*** tsymanczyk is now known as Guest481607:18
*** exploreshaifali has quit IRC07:20
*** geoffarn_ has joined #openstack-keystone07:27
*** geoffarnold has quit IRC07:31
yuwendoes keystone support oauth2 ?07:41
yuwenI find the project https://github.com/ging/keystone-oauth2-extension.git07:42
*** henrynash has quit IRC07:43
*** e0ne has quit IRC07:44
*** fhubik has joined #openstack-keystone07:44
*** henrynash has joined #openstack-keystone07:46
*** ChanServ sets mode: +v henrynash07:46
*** henrynash has quit IRC07:48
*** henrynash has joined #openstack-keystone07:48
*** geoffarn_ has quit IRC07:48
*** ChanServ sets mode: +v henrynash07:48
*** geoffarnold has joined #openstack-keystone07:48
*** henrynash has quit IRC07:50
*** browne has quit IRC07:50
*** jistr has joined #openstack-keystone08:03
*** btully has joined #openstack-keystone08:04
davechenyuwen: no idea, just saw auth1 from code base, didn't notice something about auth2.08:05
*** dims__ has joined #openstack-keystone08:06
*** links has quit IRC08:08
*** geoffarnold has quit IRC08:09
*** btully has quit IRC08:09
*** geoffarnold has joined #openstack-keystone08:10
*** dims__ has quit IRC08:11
*** lsmola_ has joined #openstack-keystone08:11
*** links has joined #openstack-keystone08:17
*** svasheka has joined #openstack-keystone08:18
*** links has quit IRC08:24
yuwendavechen: do you try k2k federation with saml?08:24
marekdyuwen: k2k is only with saml208:24
yuwenoh, yes, saml208:25
yuwenbut, i config the idp_sso_endpoint =  , when sp calls the url, it return 40408:26
marekdyuwen: k2k is not a fully fledged IdP08:26
marekdit's not a replacement for Shiboleth IdP or Microsoft ADFS08:26
marekdit's scope is somehow limited08:26
yuwenyou mean  we can't use keystone as a web sso IDP?08:29
marekdyuwen: for instance.08:29
davechenyuwen: i am still trying... sigh!08:30
yuwenI have a java sp, and i want to use keystone as IDP to LDAP,  how to integrate the java SP to keystone IDP08:31
davechenmarekd: hi, expert of federation08:31
marekddavechen: #FederationPTL :D08:31
marekddavechen: what's up?08:31
davechenmarekd: totally agree!08:31
marekddavechen: totally not true :-)08:31
*** links has joined #openstack-keystone08:31
davechenmarekd: i think i am a jurk08:31
marekdim too young to die in the oceans of PTLism.08:32
marekddavechen: what's wrong?08:32
davechenmarked: still have some issue with enable k-k federation.08:32
davechenbut i think i am quite close.08:32
marekddavechen: yes, where did you stuck ?08:32
davechenblocked by this, "Could not map user while setting ephemeral user identity"08:33
davecheni am followed by the guide, and seems the configuration is oaky now.08:33
marekddavechen: this is error from the SP, right?08:33
marekddavechen: what are your mapping rules?08:34
davechensimilar as this,08:34
davechen    "mapping": {08:34
davechen        "rules": [08:34
davechen            {08:34
*** davechen has quit IRC08:34
*** openstack has joined #openstack-keystone08:46
*** cameron.freenode.net sets mode: +ns 08:46
*** cameron.freenode.net sets mode: -o openstack08:47
-cameron.freenode.net- *** Notice -- TS for #openstack-keystone changed from 1444725985 to 137738402408:47
*** cameron.freenode.net sets mode: +cgt-s 08:47
*** links has joined #openstack-keystone08:47
*** hideme_ has joined #openstack-keystone08:47
*** pumaranikar has joined #openstack-keystone08:47
*** davechen has joined #openstack-keystone08:47
*** svasheka has joined #openstack-keystone08:47
*** lsmola_ has joined #openstack-keystone08:47
*** geoffarnold has joined #openstack-keystone08:47
*** jistr has joined #openstack-keystone08:47
*** fhubik has joined #openstack-keystone08:47
*** Guest4816 has joined #openstack-keystone08:47
*** wwwjfy_ has joined #openstack-keystone08:47
*** ParsectiX has joined #openstack-keystone08:47
*** StoneZhang has joined #openstack-keystone08:47
*** tsufiev has joined #openstack-keystone08:47
*** urulama has joined #openstack-keystone08:47
*** nkinder has joined #openstack-keystone08:47
*** jimbaker has joined #openstack-keystone08:47
*** telemonster has joined #openstack-keystone08:47
*** alex_xu has joined #openstack-keystone08:47
*** zzzeek has joined #openstack-keystone08:47
*** daemontool_ has joined #openstack-keystone08:47
*** jtomasek has joined #openstack-keystone08:47
*** Nirupama has joined #openstack-keystone08:47
*** jaosorior has joined #openstack-keystone08:47
*** dobson has joined #openstack-keystone08:47
*** yuwen has joined #openstack-keystone08:47
*** iurygregory has joined #openstack-keystone08:47
*** EinstCrazy has joined #openstack-keystone08:47
*** shadower has joined #openstack-keystone08:47
*** tsymancz2k has joined #openstack-keystone08:47
*** david-lyle has joined #openstack-keystone08:47
*** briancurtin has joined #openstack-keystone08:47
*** zhiyan has joined #openstack-keystone08:47
*** serverascode has joined #openstack-keystone08:47
*** ctracey has joined #openstack-keystone08:47
*** jraim has joined #openstack-keystone08:47
*** nzeer has joined #openstack-keystone08:47
*** harlowja has joined #openstack-keystone08:47
*** arunkant has joined #openstack-keystone08:47
*** chrisshattuck has joined #openstack-keystone08:47
*** amit213 has joined #openstack-keystone08:47
*** BAKfr has joined #openstack-keystone08:47
*** breton has joined #openstack-keystone08:47
*** krotscheck has joined #openstack-keystone08:47
*** brad[] has joined #openstack-keystone08:47
*** alexpro has joined #openstack-keystone08:47
*** rha has joined #openstack-keystone08:47
*** markvoelker has joined #openstack-keystone08:47
*** Daviey has joined #openstack-keystone08:47
*** andreykurilin has joined #openstack-keystone08:47
*** chlong has joined #openstack-keystone08:47
*** kurtrao has joined #openstack-keystone08:47
*** rm_work has joined #openstack-keystone08:47
*** mjb has joined #openstack-keystone08:47
*** tsufiev_ has joined #openstack-keystone08:47
*** amakarov_away has joined #openstack-keystone08:47
*** ayoung has joined #openstack-keystone08:47
*** afazekas has joined #openstack-keystone08:47
*** mordred has joined #openstack-keystone08:47
*** pkarikh has joined #openstack-keystone08:47
*** lifeless has joined #openstack-keystone08:47
*** akscram has joined #openstack-keystone08:47
*** chmouel has joined #openstack-keystone08:47
*** jdennis has joined #openstack-keystone08:47
*** Kennan2 has joined #openstack-keystone08:47
*** jamielennox has joined #openstack-keystone08:47
*** hogepodge has joined #openstack-keystone08:47
*** cburgess has joined #openstack-keystone08:47
*** mancdaz has joined #openstack-keystone08:47
*** errr has joined #openstack-keystone08:47
*** SamYaple has joined #openstack-keystone08:47
*** bknudson has joined #openstack-keystone08:47
*** blogan has joined #openstack-keystone08:47
*** andreaf has joined #openstack-keystone08:47
*** arif-ali has joined #openstack-keystone08:47
*** HenryG has joined #openstack-keystone08:47
*** boris-42 has joined #openstack-keystone08:47
*** flaper87 has joined #openstack-keystone08:47
*** d0ugal has joined #openstack-keystone08:47
*** kragniz has joined #openstack-keystone08:47
*** boltR has joined #openstack-keystone08:47
*** marekd has joined #openstack-keystone08:47
*** mitz_ has joined #openstack-keystone08:47
*** david8hu has joined #openstack-keystone08:47
*** miguelgrinberg has joined #openstack-keystone08:47
*** mfisch has joined #openstack-keystone08:47
*** thiagop has joined #openstack-keystone08:47
*** florianf|away has joined #openstack-keystone08:47
*** jrist has joined #openstack-keystone08:47
*** ericksonsantos has joined #openstack-keystone08:47
*** cameron.freenode.net sets mode: +vvv ayoung jamielennox bknudson08:47
*** jlk has joined #openstack-keystone08:47
*** agireud has joined #openstack-keystone08:47
*** njohnston has joined #openstack-keystone08:47
*** mtreinish has joined #openstack-keystone08:47
*** uiyice has joined #openstack-keystone08:47
*** morgan has joined #openstack-keystone08:47
*** tristanC has joined #openstack-keystone08:47
*** haneef__ has joined #openstack-keystone08:47
*** gsilvis has joined #openstack-keystone08:47
*** freerunner has joined #openstack-keystone08:47
*** openstackgerrit has joined #openstack-keystone08:47
*** andrewbogott has joined #openstack-keystone08:47
*** jamiec has joined #openstack-keystone08:47
*** dhellmann has joined #openstack-keystone08:47
*** x58 has joined #openstack-keystone08:47
*** petertr7_away has joined #openstack-keystone08:47
*** martinus__ has joined #openstack-keystone08:47
*** jbonjean has joined #openstack-keystone08:47
*** trey has joined #openstack-keystone08:47
*** sudorandom has joined #openstack-keystone08:47
*** mgagne has joined #openstack-keystone08:47
*** dtroyer has joined #openstack-keystone08:47
*** Guest68187 has joined #openstack-keystone08:47
*** hockeynut has joined #openstack-keystone08:47
*** jacorob has joined #openstack-keystone08:47
*** comstud has joined #openstack-keystone08:47
*** lbragstad has joined #openstack-keystone08:47
*** dolphm has joined #openstack-keystone08:47
*** d34dh0r53 has joined #openstack-keystone08:47
*** eglute has joined #openstack-keystone08:47
*** sigmavirus24_awa has joined #openstack-keystone08:47
*** gus has joined #openstack-keystone08:47
*** rharwood has joined #openstack-keystone08:47
*** tonyb has joined #openstack-keystone08:47
*** zigo has joined #openstack-keystone08:47
*** cloudnull has joined #openstack-keystone08:47
*** Nakato has joined #openstack-keystone08:47
*** wolsen has joined #openstack-keystone08:47
*** wasmum has joined #openstack-keystone08:47
*** ekarlso has joined #openstack-keystone08:47
*** _fortis has joined #openstack-keystone08:47
*** charz has joined #openstack-keystone08:47
*** redrobot has joined #openstack-keystone08:47
*** baffle has joined #openstack-keystone08:47
*** SpamapS has joined #openstack-keystone08:47
*** cameron.freenode.net sets mode: +vo morgan dolphm08:47
*** Madkiss has joined #openstack-keystone08:47
*** jmccrory has joined #openstack-keystone08:47
*** raildo-afk has joined #openstack-keystone08:47
*** zeus has joined #openstack-keystone08:47
*** dgonzalez has joined #openstack-keystone08:47
*** Dave has joined #openstack-keystone08:47
*** rdo has joined #openstack-keystone08:47
*** clayton has joined #openstack-keystone08:47
*** odyssey4me has joined #openstack-keystone08:47
*** pgbridge has joined #openstack-keystone08:47
*** ChanServ has joined #openstack-keystone08:47
*** hughsaunders has joined #openstack-keystone08:47
*** toddnni has joined #openstack-keystone08:47
*** crinkle has joined #openstack-keystone08:47
*** med_ has joined #openstack-keystone08:47
*** tellesnobrega_af has joined #openstack-keystone08:47
*** zz_john5223 has joined #openstack-keystone08:47
*** jlvillal has joined #openstack-keystone08:47
*** sileht has joined #openstack-keystone08:47
*** grantbow has joined #openstack-keystone08:47
*** esp has joined #openstack-keystone08:47
*** tjcocozz has joined #openstack-keystone08:47
*** htruta has joined #openstack-keystone08:47
*** mhu has joined #openstack-keystone08:47
*** bapalm has joined #openstack-keystone08:47
*** BrAsS_mO- has joined #openstack-keystone08:47
*** sirushti has joined #openstack-keystone08:47
*** jgriffith has joined #openstack-keystone08:47
*** rvba has joined #openstack-keystone08:47
*** darrenc has joined #openstack-keystone08:47
*** timburke has joined #openstack-keystone08:47
*** samueldmq has joined #openstack-keystone08:47
*** ramishra has joined #openstack-keystone08:47
*** josecastroleon has joined #openstack-keystone08:47
*** anteaya has joined #openstack-keystone08:47
*** gerhardqux has joined #openstack-keystone08:47
*** bigjools has joined #openstack-keystone08:47
*** opilotte has joined #openstack-keystone08:47
*** EmilienM has joined #openstack-keystone08:47
*** goodygum has joined #openstack-keystone08:47
*** notmyname has joined #openstack-keystone08:47
*** raginbajin has joined #openstack-keystone08:47
*** rmstar has joined #openstack-keystone08:47
*** lars1 has joined #openstack-keystone08:47
*** rodrigods has joined #openstack-keystone08:47
*** cameron.freenode.net sets mode: +o ChanServ08:47
*** hugokuo has joined #openstack-keystone08:47
*** kfjohnson has joined #openstack-keystone08:47
*** pc-pothole has joined #openstack-keystone08:47
*** nonameentername has joined #openstack-keystone08:47
*** jasondotstar has joined #openstack-keystone08:47
*** mkoderer has joined #openstack-keystone08:47
*** evrardjp has joined #openstack-keystone08:47
*** dstanek has joined #openstack-keystone08:47
*** cameron.freenode.net sets mode: +v dstanek08:47
*** cameron.freenode.net sets mode: +b *!awrbgh@
*** cameron.freenode.net sets mode: +qq uvirtbot!*@* uvirbot!*@*08:47
*** cameron.freenode.net changes topic to "Liberty RC2 is Out | Mitaka Development Cycle Open | Great Job Everyone"08:47
*** kiran-r has joined #openstack-keystone08:47
yuwendavechen, do you success08:47
samueldmqdavechen:  :)08:49
davechenyuwen: close.08:49
*** flaper87 has quit IRC08:51
*** flaper87 has joined #openstack-keystone08:51
*** geoffarn_ has joined #openstack-keystone08:52
yuwendavechen,whats your keystone IDP config steps?08:53
yuwenjust follow this guide?08:53
*** hideme_ has quit IRC08:54
*** hideme_ has joined #openstack-keystone08:54
*** links has quit IRC08:54
*** links has joined #openstack-keystone08:54
davechenyou may refer to marekd's scripts.08:54
davechenbut i am sorry to tell you, it's still fail in my side. :(08:54
marekddavechen: where eactly?08:54
davechenmarekd: the same, just say "Could not map user while setting ephemeral user identity"08:55
marekdyou sure you changed the correct mapping?08:55
marekdtry debugging the code with rpdb08:56
davechenlet me past for you.08:56
yuwenshould we install Shiboleth module on the keystone IDP host,or keystone IDP need run in apache?08:56
davechenmarekd: i have pdb it for a long time. :(08:57
*** geoffarnold has quit IRC08:57
davechenmarekd: if you don't mind, pls let me paste what i did somewhere, and take you couples of mins to have a look?08:57
*** marzif has joined #openstack-keystone08:57
davechenmarekd: i think there is something in my side but i missed it.08:58
davechensomething wrong*08:58
marekddavechen: sure.09:00
*** exploreshaifali has joined #openstack-keystone09:03
*** dims__ has joined #openstack-keystone09:08
*** dims__ has quit IRC09:13
*** geoffarn_ has quit IRC09:13
*** geoffarnold has joined #openstack-keystone09:13
*** links has quit IRC09:15
davechenmarekd: http://paste.openstack.org/show/476097/09:16
davechensome steps i am not quite sure.09:16
davechenother is okay.09:16
*** fhubik has quit IRC09:17
davechenyuwen: i think Shiboleth should run on the SP host.09:18
davechenand keystone IDP need run in apache.09:18
yuwendavechen do your idp_sso_endpoint like this  : http://your-keystone-ip:5000/v3/OS-FEDERATION/saml2/sso09:22
*** pnavarro|off has joined #openstack-keystone09:23
davechenyuwen: where you get this?09:23
yuwenand then, if you curl http://your-keystone-ip:5000/v3/OS-FEDERATION/saml2/sso  in browser , it will return "error": {"message": "\u627e\u4e0d\u5230\u8be5\u8d44\u6e90\u3002", "code": 404, "title": "Not Found"}}09:24
davechenyuwen: i am not do it via brower :)09:24
* davechen need do more homework tonight09:26
*** geoffarnold has quit IRC09:34
*** geoffarnold has joined #openstack-keystone09:35
*** EinstCrazy has quit IRC09:35
*** openstackstatus has joined #openstack-keystone09:38
*** ChanServ sets mode: +v openstackstatus09:38
yuwendavechen, if i integrate a java SP to keystone IDP, I need access via ECP, not via browser?09:42
-openstackstatus- NOTICE: gerrit is undergoing an emergency restart to investigate load issues09:42
*** ChanServ changes topic to "gerrit is undergoing an emergency restart to investigate load issues"09:42
davechenyuwen: i am just want to try this feature, so i think we have different purpose, pls don't follow me. :)09:43
davechenyuwen: i will let you know once i get it done.09:43
yuwenmany thks09:44
samueldmqnote: keystone master tests don't pass the gate because of requirements conflicts, I am investigating the issue09:44
samueldmqI reproduced the same issue locally09:44
yuwenbut i have tried k2k some times, maybe you will get my issue , wish you success tonight09:46
samueldmqjamielennox: you around ?09:48
*** dims__ has joined #openstack-keystone09:49
*** marzif has quit IRC09:50
*** marzif has joined #openstack-keystone09:51
jamielennoxsamueldmq: not really09:55
openstackgerritDave Chen proposed openstack/keystone: Fix some nits in `configure_federation.rst`  https://review.openstack.org/23409109:55
*** geoffarnold has quit IRC09:56
*** davechen has left #openstack-keystone09:56
*** geoffarnold has joined #openstack-keystone09:56
samueldmqjamielennox: so, our master is breaking in the gate09:57
samueldmqjamielennox: the reason is that our version of 'requests' from ksclient is imcompatible with the version keystone wants09:58
jamielennoxsamueldmq: something to do with requests 2.809:58
*** e0ne has joined #openstack-keystone09:58
samueldmqjamielennox: I don't know what to do to solve that, maybe a new release of ksclient ?09:58
jamielennoxit's caused problems for a bunch of projects09:59
samueldmqjamielennox: yes, ksserver wnts >=2.5.2!=2.8.009:59
samueldmqjamielennox: but we require ksclient 2.6, which in turn wants requests>=2.5.2 (without !=2.8.0)09:59
samueldmqjamielennox: 2.8.0 happens to be instlled from ksclient reqs, and break the world around it10:00
jamielennoxsamueldmq: https://review.openstack.org/#/c/232893/ is the fix for ksc reqs10:00
jamielennoxsamueldmq: there needs to be a ksc release to fix it, which i think was being planned for tomorrow10:01
jamielennoxfor now i'd just recommend blacklisting it10:01
samueldmqjamielennox: exactly, we need a new release + update requirements for other projs10:01
*** openstackgerrit has quit IRC10:01
*** aix has joined #openstack-keystone10:01
*** openstackgerrit has joined #openstack-keystone10:02
jamielennoxthat's not something we control any more, it's gotta go via some release process10:02
jamielennoxi'm leaving that up to stevemar, but it's a known issue and will be fixed soon10:02
samueldmqjamielennox: nice, wanted to confirm it was a known issue10:03
samueldmqjamielennox: did we release keystone already ? we will probably need to backport it in tht case, otherwise we could be breaking people who just update the server and no the client10:04
samueldmqjamielennox: anyway I can talk to stevemar later on this, thanks :)10:04
jamielennoxsamueldmq: we don't really need to release keystone server10:05
jamielennoxumm, not sure what the policy on backporting requirements are10:05
jamielennoxi think the requirements should be pinned already10:06
samueldmqjamielennox: https://github.com/openstack/keystone/blob/
*** wwwjfy_ has quit IRC10:06
samueldmqjamielennox: we need a way to update tht in our last rc once ksclient is released, you agree?10:06
*** marzif has quit IRC10:10
*** yuwen has quit IRC10:11
*** marzif has joined #openstack-keystone10:11
*** tyagiprince2010 has joined #openstack-keystone10:13
tyagiprince2010Hi I need some help with keystone.10:13
openstackgerritBoris Bobrov proposed openstack/keystone: Make @truncated common for all backends  https://review.openstack.org/23306910:15
openstackgerritBoris Bobrov proposed openstack/keystone: Use @truncated in ldap  https://review.openstack.org/23307010:15
bretontyagiprince2010: ask away10:15
openstackgerritDaisuke Fujita proposed openstack/oslo.policy: Fix a typo in policy.py  https://review.openstack.org/23411010:16
tyagiprince2010I need some info on how keystone is working on the backend. Could you just forward me a link to some page with as much info on keystone as possible.10:16
*** geoffarn_ has joined #openstack-keystone10:17
tyagiprince2010<breton> and also what is keystone-federation.10:18
*** dims__ is now known as dims10:18
* tyagiprince2010 slaps breton around a bit with a large fishbot10:19
tyagiprince2010sorry for that breton. MISTAKE10:19
bretonkeystone federation: http://docs.openstack.org/developer/keystone/configure_federation.html10:20
bretonkeystone backends: http://docs.openstack.org/developer/keystone/architecture.html10:20
tyagiprince2010thanks for that breton.10:21
*** geoffarnold has quit IRC10:21
jamielennoxsamueldmq: interesting, when it goes stable they generally have upper bounds - it shouldnt matter because the requirements will be managed by keystoneclient10:25
*** urulama is now known as urulama|afk10:28
*** tyagiprince2010 has quit IRC10:29
*** aix has quit IRC10:30
samueldmqjamielennox: sorry, not sure I follow .. you mean capping the requests requirement ? how would tht change anything ?10:31
*** urulama|afk is now known as urulama10:32
jamielennoxsamueldmq: i thought they capped everything in stable now and that keystone would just pick it up with everything else10:36
jamielennoxsamueldmq: i'm not exactly sure how we handle that in stable10:36
*** geoffarn_ has quit IRC10:38
*** geoffarnold has joined #openstack-keystone10:38
samueldmqjamielennox: kk I am not familiar with that too :(10:39
samueldmqjamielennox: will take a look later with stevemar, it might be late for you, and I don't want to disturb :)10:39
*** aix has joined #openstack-keystone10:42
*** kiran-r has quit IRC10:43
*** jvarlamova has joined #openstack-keystone10:50
*** wasmum has quit IRC10:52
*** edmondsw has joined #openstack-keystone10:52
*** edmondsw has quit IRC10:52
*** geoffarnold has quit IRC10:59
*** geoffarnold has joined #openstack-keystone11:00
openstackgerritOpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements  https://review.openstack.org/23382011:00
openstackgerritOpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements  https://review.openstack.org/23413011:00
*** StoneZhang has quit IRC11:01
*** marzif has quit IRC11:01
*** marzif has joined #openstack-keystone11:02
openstackgerritOpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements  https://review.openstack.org/23414011:04
*** ChanServ changes topic to "Liberty RC2 is Out | Mitaka Development Cycle Open | Great Job Everyone"11:17
-openstackstatus- NOTICE: Gerrit has been restarted and is responding to normal load again.11:17
*** urulama has quit IRC11:17
*** urulama has joined #openstack-keystone11:18
*** wwwjfy_ has joined #openstack-keystone11:18
*** geoffarnold has quit IRC11:21
*** geoffarnold has joined #openstack-keystone11:21
*** doug-fish has joined #openstack-keystone11:22
*** marzif has quit IRC11:29
*** exploreshaifali has quit IRC11:32
*** jistr is now known as jistr|biab11:32
*** gordc has joined #openstack-keystone11:36
*** geoffarnold has quit IRC11:42
*** wwwjfy_ has quit IRC11:43
*** geoffarnold has joined #openstack-keystone11:43
*** dims has quit IRC11:47
*** dims has joined #openstack-keystone11:48
*** wwwjfy_ has joined #openstack-keystone11:52
*** fhubik has joined #openstack-keystone12:00
*** amakarov_away is now known as amakarov12:00
*** e0ne has quit IRC12:00
*** fhubik is now known as fhubik_brb12:00
openstackgerritSonali proposed openstack/keystone: Do not rebuild revoke_tree on each validate-token  https://review.openstack.org/23271512:01
*** geoffarnold has quit IRC12:03
*** fhubik_brb is now known as fhubik12:04
*** geoffarnold has joined #openstack-keystone12:04
*** tyagiprince2010 has joined #openstack-keystone12:05
tyagiprince2010Hey i just started working with keystone. Please tell me where do I start. Also If I can use any middleware to check whats going on behind keystone.12:06
tyagiprince2010Keystone uses tokens for authorization and authentication. I need to use PKI for the same. How do I do that12:07
tyagiprince2010Please provide me some documentation on keystone which covers everything from basics.12:07
*** su_zhang has joined #openstack-keystone12:13
*** urulama has quit IRC12:21
*** urulama has joined #openstack-keystone12:22
*** raildo-afk is now known as raildo12:24
tyagiprince2010[17:36] <tyagiprince2010> Hey i just started working with keystone. Please tell me where do I start. Also If I can use any middleware to check whats going on behind keystone. [17:37] <tyagiprince2010> Keystone uses tokens for authorization and authentication. I need to use PKI for the same. How do I do that [17:37] <tyagiprince2010> Please provide me some documentation on keystone which covers everything from basic12:24
*** geoffarnold has quit IRC12:24
tyagiprince2010Please help me in exploring whole keystone. Atleast put me on the right track.12:25
*** geoffarnold has joined #openstack-keystone12:25
*** nicodemos has joined #openstack-keystone12:31
*** edmondsw has joined #openstack-keystone12:31
*** pauloewerton has joined #openstack-keystone12:40
*** EinstCrazy has joined #openstack-keystone12:40
*** e0ne has joined #openstack-keystone12:46
*** geoffarnold has quit IRC12:46
*** hrou has joined #openstack-keystone12:46
*** geoffarnold has joined #openstack-keystone12:46
*** Nirupama has quit IRC12:50
*** jaosorior has quit IRC12:51
*** jaosorior has joined #openstack-keystone12:51
*** fhubik is now known as fhubik_brb12:54
*** rvba has quit IRC12:55
*** rvba has joined #openstack-keystone12:58
*** rvba has quit IRC12:58
*** rvba has joined #openstack-keystone12:58
samueldmqtyagiprince2010: hi12:59
samueldmqtyagiprince2010: http://docs.openstack.org/developer/keystone/ is the main entrypoint for the keystone documentation12:59
samueldmqtyagiprince2010: feel free to ask whatever questions you have here, people will reply as they are available13:00
samueldmqtyagiprince2010: as we have people with different timezones working all over the world, someone will eventually see your question and reply you13:00
*** tyagiprince2010 has quit IRC13:02
*** jistr|biab is now known as jistr13:03
*** tellesnobrega_af is now known as tellesnobrega13:05
*** richm has joined #openstack-keystone13:07
*** geoffarn_ has joined #openstack-keystone13:08
*** geoffarnold has quit IRC13:08
*** wwwjfy_ has quit IRC13:08
*** alejandrito has joined #openstack-keystone13:09
*** wwwjfy_ has joined #openstack-keystone13:14
*** andrewbogott has left #openstack-keystone13:15
*** stevemar_ has joined #openstack-keystone13:20
*** ChanServ sets mode: +o stevemar_13:20
*** wwwjfy_ has quit IRC13:24
*** wwwjfy_ has joined #openstack-keystone13:25
ayoungHey samueldmq did you see: https://review.openstack.org/#/c/233480/313:29
*** geoffarn_ has quit IRC13:29
*** geoffarnold has joined #openstack-keystone13:29
*** jsavak has joined #openstack-keystone13:29
samueldmqayoung: hi, I took a glance .. looking better now13:31
samueldmqlbragstad: ping - you around ? I have a question about https://review.openstack.org/#/c/21571513:33
ayoungsamueldmq, so, new thought on Dynamic policy based on that13:33
ayoungwe leave the existing policy files as is13:33
ayoungthose are the basis for the scope checks13:33
ayoungthey should not be checking any role other than admin13:34
ayoungThe various projects can clean up their policy files over time, to make the scope checks more accurate, but they will be no worse than things are now13:34
ayoungthe dynamic policy part can be done in middleware, done based on a URL/URI  and only check that the role matches13:35
*** pumaranikar has quit IRC13:38
*** ngupta has joined #openstack-keystone13:39
*** jsavak has quit IRC13:39
*** jsavak has joined #openstack-keystone13:40
*** petertr7_away is now known as petertr713:43
*** yuwen has joined #openstack-keystone13:44
*** zz_john5223 is now known as john522313:46
samueldmqayoung: so ... I was finishing up a review ..13:50
*** geoffarnold has quit IRC13:50
*** geoffarnold has joined #openstack-keystone13:50
samueldmqayoung: so we leave the current policies as they are, and add the role check at middleware level ?13:50
samueldmqayoung: that way we would be checking roles twice (at least for admin) ? and deployers would have to separate their existing policies, even without services having properly separated them ?13:51
*** pumaranikar has joined #openstack-keystone13:51
samueldmqayoung: that doesn't seem an easy adoption that way ... do you agree?13:51
*** r-daneel has joined #openstack-keystone13:55
*** phalmos has joined #openstack-keystone13:55
stevemar_reminder to add to the meeting agenda: https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting#Main_Agenda14:00
openstackgerritBoris Bobrov proposed openstack/keystone: Use search_ext_s instead of search_s in ldap  https://review.openstack.org/23299514:01
openstackgerritBoris Bobrov proposed openstack/keystone: Make @truncated common for all backends  https://review.openstack.org/23306914:01
openstackgerritBoris Bobrov proposed openstack/keystone: Use @truncated in ldap  https://review.openstack.org/23307014:01
openstackgerritBoris Bobrov proposed openstack/keystone: Fix exposition of bug about limiting with ldap  https://review.openstack.org/23422614:01
dstanekmarekd: why would be not start reviewing and coding functional tests?14:01
*** sigmavirus24_awa is now known as sigmavirus2414:01
marekddstanek: sorry ?14:02
marekddstanek: why not coding and reviewing functional tests?14:02
dstanekmarekd: your topic for the meeting today14:02
marekddstanek: erm, last time bknudson said it's generally wrong according to someone + he also said he doesn't really understand why adding functional tests while existing are not running. He didn't clarify what he'd meant.14:03
stevemar_dstanek: marekd it'll be nice to bring it up again as a general topic14:04
marekddstanek: i don't feel adding a chain of patches, spend some time and get -1 saying "it's all wrong"14:04
marekdstevemar_: dstanek i am happy removing this from the agenda if you prmise to take a look at what i have now and at least assure that we are headed good direction :-)14:05
marekdhttps://review.openstack.org/#/c/203258/ and up14:05
dstanekwe can talk about it at the meeting, but i don't think we are doing anything "wrong" i think some other group(s) feel that things should also be looked up directly in the database14:05
marekddstanek: yes. but eventually we will ask for jenkins jobs and some "groups" may say "you are doing it wrong, you get nothing"14:06
*** nicodemos has left #openstack-keystone14:06
dstanekimo, that's wrong. if it can't be checked in an API it isn't part of these tests14:06
marekddstanek: i share your opinions14:07
stevemar_dstanek: marekd checking the backend is just one of the things we "need" to get in place to get functional tests up and running14:07
dstanekit would violate my entire premise of writing a single test that runs against any environment :-( and would make functional tests just as useless as v3 tests14:08
stevemar_the patches you've put up will still be needed, regardless of us checking backends14:08
dstanekstevemar_: why?14:08
*** btully has joined #openstack-keystone14:08
marekdstevemar_: ok then, i will carry on with what i have now. I will addd service providers which should be last part of the easy stuff. Authentication will be worse.14:09
ayoungsamueldmq, look at the existing policies (cloud sample being the exception) no one does a role check14:09
ayoungexcept for Admin14:09
*** ParsectiX has quit IRC14:09
ayoungso this is the easiest path to adoption14:09
stevemar_dstanek: why what?14:09
dstanekstevemar_: if we have to check the backend directly then these tests are no different than v3 tests14:10
marekdstevemar_: i think dstanek's point is if you explicitely check database you will not be able to easily switch backends.14:10
marekdbe back in 30 mins14:11
dstanekstevemar_: the whole point is REST API call to modify data and REST API call to check it - who cares how it is stored....14:11
dstanekmarekd: exactly14:11
*** geoffarnold has quit IRC14:11
stevemar_then let's chat about it today, we can ask mtreinish to attend14:11
stevemar_right, i agree14:11
*** geoffarnold has joined #openstack-keystone14:12
mtreinishstevemar_: I see yellow, what's up?14:12
stevemar_ayoung: got a review request for ya: https://review.openstack.org/#/c/232715/314:12
stevemar_mtreinish: we're talking about functional tests14:13
stevemar_mtreinish: i think it was you who chimed in last time, the need to check backends for a functional test?14:13
mtreinishstevemar_: I don't think I've said that before14:14
ayoungstevemar_, really?  That was how it was origianlly designed.14:14
mtreinishstevemar_: my argument is in tree functional tests shouldn't require a full deployment and only black box test it14:14
mtreinishbecause that's what tempest does14:15
mtreinishin tree functional tests should be more tightly coupled to the project because you have the advantage of being able to keep up with code changes14:15
stevemar_mtreinish: full deployment meaning?14:15
bretonfull devstack deployment I guess14:15
mtreinishin some cases that might mean checking the backend, but it doesn't have to14:15
mtreinishbreton: any deployment, I guess in the keystone case its just keystone14:16
stevemar_mtreinish: checking the http response should be sufficient?14:16
stevemar_mtreinish: gotcha regarding deployment, just keystone is probably enough for most of our functional tests14:16
stevemar_that would be a real quick devstack setup :)14:17
*** dikonoor has joined #openstack-keystone14:17
mtreinishstevemar_: it can be, it's all about what you as a project want to verify. The example I always use is nova (which is probably where the backend idea came up) has api tests which test a negative request and ensure the db doesn't contain anything14:17
dstanekmtreinish: right now that's the intent of the keystone functional tests; only need keystone (and maybe other things Keystone depends on)14:17
stevemar_mtreinish: ahhh14:18
mtreinishstevemar_: and all those tests spin up are nova api and the db14:18
stevemar_that seems like slight overkill, and starts creeping onto unit test territory14:18
dstanekmtreinish: my goal is to have everything test through the API so that the same tests can run against any backend14:18
mtreinishwhich is done dynamically14:18
samueldmqayoung: brb - lunch time, we can talk a bit more on policies this afternoon14:18
stevemar_dstanek: so i think mtreinish is saying that there is enough leeway in how to set things up that we as a project should decide what to verify14:19
dstanekyep, that's perfect14:19
mtreinishstevemar_: yes, it's a project level decision, I can provide some guidance and examples if you'd like14:19
stevemar_mtreinish: ++ on examples14:19
stevemar_and your input is always valued, it cleared up this issue in 2 minutes14:20
mtreinishlike I think depending on an existing deployment and only doing black box api driven is a mistake, because that's what tempest does14:20
bknudsonso we should put our black box tests in tempest instead14:21
stevemar_mtreinish: i think we're more interested in different configurations, rather than just dsvm-full14:21
dstaneki only want to do black box testing because we do other testing in our unit tests14:21
mtreinishbknudson: yes, that's what I'd recommend it also gives you the advantage of better "social coverage" (which is what I call defcore stuff and people running tests against real deployments)14:22
mtreinishstevemar_: sure, I'd recommend taking a look at neutron's full stack testing14:22
dstanekmtreinish: i thought the idea was tempest would only do the integration testing where the tests covered more than one project14:23
dstanekmtreinish: my general idea for functional testing is a single set of tests that run across any and all backends; and then some specialized tests (like federation) that require certain additional setup14:24
*** pumaranikar has quit IRC14:24
mtreinishdstanek: that's the primary goal, but there is also a lot of functional api testing in tempest which gets used a ton of places because it's centralized and easy to point at a deployment14:24
*** pumaranikar has joined #openstack-keystone14:25
samueldmqmtreinish: and then we would vary the configuration/backends/etc by adding new gates/checks ?14:26
dstanekmtreinish: so is keeping these tests in our repo the right thing?14:26
*** timcline has joined #openstack-keystone14:26
mtreinishsamueldmq, dstanek: so for in tree tests my recommendation would be for the tests to own the configuration/deployment to a certain degree you want the tests in tree to be deterministic and easy to setup for a dev14:27
samueldmqdstanek: ++14:27
mtreinishand not depend on having an existing deployment configured just right14:27
dstaneka sub-goal or side benefit would be the ability of a backend writer to run the tests against their backend to see if they are compiant14:27
*** phalmos has quit IRC14:28
*** Ephur has joined #openstack-keystone14:28
*** slberger has joined #openstack-keystone14:28
mtreinishdstanek: for example from neutron: http://docs.openstack.org/developer/neutron/devref/fullstack_testing.html#full-stack-testing (which I don't have much experience with but the docs are kinda what I'm getting at)14:28
dstanekso it sounds like we're going down the right path in what we want to do14:29
mtreinishand let me show how nova's functional tests use fixtures to spin up nova services on demand14:29
openstackgerritHenrique Truta proposed openstack/keystone: Tests for projects acting as domains  https://review.openstack.org/21121914:30
openstackgerritHenrique Truta proposed openstack/keystone: Manager support for projects acting as domains  https://review.openstack.org/21344814:30
openstackgerritHenrique Truta proposed openstack/keystone: Removes project.domain_id FK  https://review.openstack.org/23327414:30
openstackgerritHenrique Truta proposed openstack/keystone: Change project name constraints  https://review.openstack.org/15837214:30
openstackgerritHenrique Truta proposed openstack/keystone: Add is_domain parameter to get_project_by_name  https://review.openstack.org/21060014:30
dstanekright now the plan it to have the functional tests depend on an environment already existing somewhere. we configure this using environment vars14:30
dstanekactually standing up an environment is out of the scope of the tests although we are working on a framework to build the environments using devstack14:31
mtreinishdstanek: so how does this differ from tempest? if it's api only and depends on a pre-existing environment that you configure the tests to run against?14:31
dstanekmtreinish: it doesn't all that much :-) other than we don't depend on any other projects14:32
mtreinishneither does tempest14:32
mtreinishyou just tell it that keystone is the only available service14:32
*** geoffarn_ has joined #openstack-keystone14:33
mtreinishwell actually you just tell it that none of the other services are available, keystone is the only hard service dep14:33
*** geoffarnold has quit IRC14:33
mtreinishnothing works without14:33
dstanekmtreinish: i keep hearing that we should move  functional tests out of tempest, so i would expect what we are doing to look very similar to the tempest functional tests14:33
dstanekmtreinish: are you saying that functional tests should be in tempest?14:33
*** pumaranikar has quit IRC14:34
samueldmqmtreinish: so should functional tests belong to tempest ? in that case our functional tests should be written there, is that right ?14:34
ayoungmtreinish, tempest is the wrong place.  We've been here before, we've seen this room and we've walked this floor14:34
samueldmqdstanek: yes, that's the question14:34
ayoungIt is a case of abuse.  Only we really know how to abuse Keystone14:34
*** jsavak has quit IRC14:34
dstanekmtreinish: also we're trying not to use the client for these tests14:35
mtreinishayoung: honestly no one ever shows up to write tests so how can you say that?14:35
mtreinishdstanek: tempest has it's own clients14:35
mtreinishdstanek: it just feels like the gap you're trying to fill with what your calling functional tests is what already exists with tempest14:35
mtreinishdstanek: and other projects which have more tempest tests are trying to fill the middle ground between that and unit tests14:36
bknudsontempest doesn't have federation tests14:36
*** jsavak has joined #openstack-keystone14:36
bknudsonor tests for heirarchical multitenancy14:36
mtreinishbknudson: tempest barely has any keystone tests, but yes there aren't any14:37
mtreinishbknudson: but what is stopping you from adding them?14:37
*** dsirrine has joined #openstack-keystone14:37
bknudsonthere's no devstack setup for it.14:37
bknudsonis that required?14:37
dstanekmtreinish: so is the new plan to keep functional tests in tempest? and what the other projects are doing is something different?14:38
bknudsonthink we could get a gate job that only sets up keystone with federation?14:38
mtreinishbknudson: the tests need to run in a ci (either infra or 3rd party, periodic/experimental is fine too) to land14:38
*** derosenet has joined #openstack-keystone14:38
mtreinishdstanek: I think the term functional is just overloaded here, which is leading to the confusion14:38
mtreinishdstanek: projects still contribute tests to tempest, but they also have in tree tests14:39
mtreinishthere isn't a bright line between what belongs where14:39
* marekd is back14:39
dstanekmtreinish: so it sounds like we should continue down our path so that we test keystone to our satisfaction and worry about moving stuff to tempest later if at all14:40
bknudsonwhy don't we have a tempest-first mindset instead of tempest-maybe-later?14:41
*** browne has joined #openstack-keystone14:41
dstanekmtreinish: i think this comment http://paste.openstack.org/show/476146/ from this post http://lists.openstack.org/pipermail/openstack-dev/2014-July/041057.html kicked off the discussions that this was based on14:41
mtreinishdstanek: I really don't think having a one off essentially duplicate tempest in tree is the right path, but like I said before you can set your own direction14:41
bknudsonoh, so it can be landed along with the patch14:42
dstanekbknudson: yes, plus it gives us the control to get tests in faster without waiting for cores from another project to approve14:43
mtreinishdstanek: so there is context there, keystone doesn't really have any direct testing in tempest, that was a reaction to projects that were doing all of their testing in tempest instead of owning things in tree14:43
mtreinishdstanek: which is what I was saying before about how most projects are trying to fill that middle ground with functional testing14:43
dstanekmtreinish: exactly, so at least for right now there is not duplication :-)14:43
yuwenhelp: if I want to use java SP to integrate keystone IDP,  should I need to implement it via ECP ,just like k2k, the keystone SP use shibboleth ECP14:44
mtreinishdstanek: but I'm saying that's a problem, because we need better coverage for keystone in tempest since keystone is a core component of any openstack cloud14:44
mtreinishthere are defcore implications as well as deployment testing advantages with having good coverage in tempest14:45
*** dsirrine_ has joined #openstack-keystone14:45
*** jsavak has quit IRC14:45
openstackgerritgordon chung proposed openstack/keystonemiddleware: drop use of norm_ns  https://review.openstack.org/23426514:46
*** jsavak has joined #openstack-keystone14:46
*** geoffarn_ is now known as geoffarnoldX14:47
*** timcline has quit IRC14:47
*** derosenet has quit IRC14:48
*** rderose has joined #openstack-keystone14:49
marekdyuwen: what is java SP?14:50
marekdjava sevice provider?14:50
yuwenyes, a java application as service provider14:51
dstanekmtreinish: so i think what neutron is doing is very similar to what we'll be doing. the big difference is that i have separated the actual tests from the configuration setup14:51
mtreinishdstanek: which is an important distinction14:52
*** ngupta has quit IRC14:52
bknudsonmaybe we need to learn more about how tempest works... e.g., demo it with a keystone-only setup.14:52
mtreinishdstanek: I also feel that you want any in-tree tests to just work for a dev and depending on an existing setup isn't really conducive for that14:53
bknudsonand at least look into what it would take to get federation tests in there14:53
dstanekmtreinish: i haven't looked at how they implemented, but i' sure they are doing some separation too in order to run the same tests against different configuration14:53
*** rderose has quit IRC14:53
mtreinishbknudson: yes, I think that's a good idea, I'd be willing to help you with that14:53
*** iurygregory is now known as iury_gregory14:54
*** iury_gregory is now known as iurygregory14:54
dstanekmtreinish: how would be do things like setup multiple keystones for k2k or sp/idps for federation using tempest?14:54
*** derosenet has joined #openstack-keystone14:55
*** jsavak has quit IRC14:55
*** derosenet has quit IRC14:55
bknudsonmtreinish: I've run tempest against keystone before but I think I only had it run specific tests since I couldn't figure out how to run the right ones... I didn't spend too much time looking at it. So maybe a short doc in keystone dev docs, which hopefully won't get too out of date.14:56
*** jsavak has joined #openstack-keystone14:56
mtreinishdstanek: well tempest is only api driven so for multiple keystones we'll probably just need to add support and options for talking to a second keystone14:56
*** rderose has joined #openstack-keystone14:56
lbragstadbknudson fwiw, i have a doc for standing up devstack and running tempest against fernet14:57
mtreinishdstanek: for the identity providers we'd have to leverage devstack or something else to set that all up14:57
marekdmtreinish: talking  only ? For federation we need proper configuration of both keystone or even 3rd party software before we launch tests14:57
mtreinishmarekd: tempest assumes there is a deployment already setup and you tell it how to talk to things14:58
marekdmtreinish: ok, so we still need some kind of work that will setup whole env.14:58
mtreinishbknudson: well to say only run keystone you would just set everything to false except for keystone in: http://docs.openstack.org/developer/tempest/configuration.html#configuring-available-services14:59
mtreinish(although there isn't actually a keystone flag in that config section because it's a hard dep for tempest)14:59
bknudsonit will be interesting to see how many tests run in keystone-only15:00
bknudsoncan't do much15:00
*** ngupta has joined #openstack-keystone15:00
dstanekmtreinish: when you get a sec take a look at http://specs.openstack.org/openstack/keystone-specs/specs/liberty/functional-testing.html and http://specs.openstack.org/openstack/keystone-specs/specs/backlog/functional-testing-setup.html15:00
dstanekmtreinish: those document how i think about functional testing15:00
*** petertr7 is now known as petertr7_away15:01
*** rderose has left #openstack-keystone15:01
mtreinishbknudson: it'll probably just be: http://paste.openstack.org/show/476148/15:02
*** petertr7_away is now known as petertr715:02
ayoungmtreinish, not true.  We have a slew of "unit" tests in the Keystone tests dir that are more properly integration tests.15:02
mtreinishthose are all the tests marked as talking directly to keystone for the test code itself15:02
*** ankurgupta has joined #openstack-keystone15:02
bknudsonthat's not too bad... I was worried it would just be get a token and validate a token15:03
dstanekbknudson: wasn't there also talk of moving the existing keystone functional tests our of keystone and into tree?15:03
bknudsonyou can probably get rid of the "JSON".15:03
ayoungdstanek, we need to id the tests that can go from /unit to /functional15:03
dstanekayoung: every *v3* test15:03
mtreinishbknudson: heh, yeah that's a simple cleanup15:03
bknudsondstanek: well, we need to figure out how we want our "unit" tests to work.15:03
bknudsonor be structured15:04
ayoungdstanek, yep...although be aware that there are many code paths only tested via those tests.15:04
dstanekthey all use an in-process server, but if we are going to put tests into tempest we may want to keep those as-is15:04
marekdbknudson: everything that needs anything else than keystone itself should be functional, rest can stay as is today.15:04
bknudsonI think we want our "unit" tests to only test a specific class/function. And then have a smallish number of "scenario" tests that test using the rest interface.15:05
marekdbknudson: federation needs idps, k2k needs two keystones -> go to functionals15:05
ayoungplus ça change, plus c'est la même chose15:05
bknudsonwe can have functional tests but they have to run on every change, and it has to be possible for developers to run them.15:05
dstanekmarekd: not true, functional testing is black box testing. doesn't matter what the dependencies are15:05
marekddstanek: so when i run today tox -epy27 i am not talking with keystone?15:06
*** derosenet has joined #openstack-keystone15:06
ayoungdstanek, how much more black could the box be, you ask, and the answer is none.  None more black15:06
dstanekmarekd: the v3 tests do15:06
*** derosenet has quit IRC15:07
ayoungdstanek, we need an IdP for true functional testing15:07
bknudsonis there an open source idp?15:08
dstanekayoung: for testing the federation bits yes15:08
marekdbknudson: shibboleth is opensource15:08
*** rderose has joined #openstack-keystone15:08
marekdbknudson: but for now we will probably leverage on pysaml as it's python15:08
ayoungThere are others, too15:08
marekdayoung: ++15:08
ayoungI want to do FreeIPA + Ipsilon as it gets more than just SAML15:09
bknudsonI assume devstack could set up freeipa or something15:09
marekdbknudson: dstanek has patches for that.15:09
ayoungIt will get us Kerberos SSSD, X509, and SAML.15:09
ayoungOpenID in the future.15:09
marekdayoung: cool15:09
*** diazjf has joined #openstack-keystone15:09
ayoungbknudson, It should be possible. I'll have a demo with me,15:09
ayoungwe have in ansibleized15:09
*** rderose has quit IRC15:09
dstanekayoung: i don't want to overcomplicate this yet. we can't even agree where stuff goes :-(15:09
*** jsavak has quit IRC15:10
* ayoung should try an Ubuntu VM with IPA...15:10
*** jsavak has joined #openstack-keystone15:10
ayoungdstanek, going with IPA is the simpler path15:10
ayoungits the less "NIH" path15:10
*** rderose has joined #openstack-keystone15:10
dstanekayoung: why less "NIH"?15:10
bknudsonH stands for RedHat15:10
*** alex_xu has quit IRC15:10
dstaneki would think it's more if you work at redhat :-)15:10
bknudsonhe he15:10
ayoungdstanek, Because you have to configure a hell of a lot less15:10
ayoungbknudson, MIT Kerberos, BIND DNS15:11
ayoungLDAp is 389...was origianlly Netsacpe, but yeah, that is RH now15:11
ayoungas is Dogtag15:11
ayoungdstanek, show me a comparable other that gets us all the technololgies?15:11
ayoungEver try to set up Kerberos by hand?15:11
bknudsonas long as it talks the standard protocols should be good enough to validate.15:12
dstanekayoung: right now we only have the drive for federation so i'd rather not complicate things until we have to15:12
ayoungdstanek, Tell you what...Let me spin up an Ubuntu VM on Dreamhost and see what it takes to get IPA on it15:12
bknudsonI would like to see sssd / mapping used for ldap. then we can deprecate identity ldap, too.15:13
dstanekayoung: i was unsuccessful :-( and once i moved to fedora nothing worked by default :-( :-(15:13
*** tecn1z has joined #openstack-keystone15:14
*** fhubik_brb is now known as fhubik15:14
ayoungmtreinish, dstanek, what is the target Distro for Gate?  Ubuntu 12.04 or 14.04?15:14
mtreinishayoung: ubuntu 14.04 is what's used now15:15
*** geoffarnoldX has quit IRC15:15
mtreinishayoung: it's always the latest lts release15:15
*** geoffarnold has joined #openstack-keystone15:15
*** ankurgupta has quit IRC15:16
*** rderose has quit IRC15:16
*** topol has joined #openstack-keystone15:19
*** ChanServ sets mode: +v topol15:19
openstackgerritBrant Knudson proposed openstack/oslo.policy: Add cover test requirement  https://review.openstack.org/23428915:21
*** wwwjfy_ has quit IRC15:21
*** urulama has quit IRC15:22
*** jsavak has quit IRC15:23
*** urulama has joined #openstack-keystone15:23
*** jsavak has joined #openstack-keystone15:23
*** wwwjfy_ has joined #openstack-keystone15:26
*** phalmos has joined #openstack-keystone15:30
*** su_zhang has quit IRC15:32
openstackgerritBrant Knudson proposed openstack/oslo.policy: Add test for invalid JSON  https://review.openstack.org/23429715:33
*** geoffarnold has quit IRC15:36
*** geoffarnold has joined #openstack-keystone15:37
openstackgerritBoris Bobrov proposed openstack/keystone: Refactor LimitTests  https://review.openstack.org/23430015:38
*** su_zhang has joined #openstack-keystone15:38
*** su_zhang has quit IRC15:46
openstackgerritSean Dague proposed openstack/keystone: Correct typo in copyright  https://review.openstack.org/23252815:49
*** gyee has joined #openstack-keystone15:55
*** ChanServ sets mode: +v gyee15:55
*** e0ne has quit IRC15:56
*** geoffarnold has quit IRC15:57
*** fawadkhaliq has joined #openstack-keystone15:57
*** geoffarnold has joined #openstack-keystone15:58
*** jasonsb has joined #openstack-keystone15:58
*** petertr7 is now known as petertr7_away16:01
openstackgerritBrant Knudson proposed openstack/oslo.policy: Add test for raising default exception  https://review.openstack.org/23430916:03
openstackgerritBrant Knudson proposed openstack/oslo.policy: Add test for enforce with rule doesn't exist  https://review.openstack.org/23431016:03
openstackgerritHenrique Truta proposed openstack/keystone: Remove domain table references  https://review.openstack.org/16593616:04
openstackgerritHenrique Truta proposed openstack/keystone: Projects acting as domains  https://review.openstack.org/23128916:04
*** mriedem has joined #openstack-keystone16:04
mriedembknudson: stevemar_: btw, https://review.openstack.org/#/c/233763/ breaks keystone right now,16:04
mriedemwe are going to land https://review.openstack.org/#/c/233857/ and once that syncs to keystonemiddlware and is merged, we'll need to release 2.4.116:05
*** _cjones_ has joined #openstack-keystone16:05
*** _cjones_ has quit IRC16:05
bknudsonmriedem: keystone is already broken due to requests 2.8.016:05
*** _cjones_ has joined #openstack-keystone16:05
bknudsonI haven't had a chance to see if webob change breaks keystone16:06
mriedemthe webob thing is causing a conflict with uncapped keystone since https://review.openstack.org/#/c/233820/ isn't merged16:06
mriedembut the webob thing is temporary anyway, so once we revert that and sync to middleware we have to release that as 2.4.116:07
bknudsonmriedem: we can't merge that because keystone doesn't work with the requests in keystoneclient / keystonemiddleware16:07
mriedemthat being the keystone g-r sync right?16:08
mriedemi saw the unit test failures16:08
bknudsonmriedem: right, nothing can merge, including https://review.openstack.org/#/c/233820/16:08
mriedemcool, well, you can't cap requestes in g-r apparently16:10
mriedemso good luck!16:10
*** phalmos_ has joined #openstack-keystone16:10
*** chrisshattuck has quit IRC16:10
bknudsonit will probably take a while to dig out from this one.16:10
mriedembknudson: if this is just a unit test thing, you could hack around this in tox.ini for keystone16:11
bknudsonhmm... maybe that's easier.16:11
mriedembut i don't fully understand what's going on with keystone and requests 2.8.016:11
bknudsonmriedem: actually, the failures in https://review.openstack.org/#/c/233820/ are because of the oslo.policy release and not requests... wonder how that changed.16:12
*** phalmos has quit IRC16:13
mriedembknudson: oslo did a mass release party yesterday16:13
bknudsonthe proposed change for that is https://review.openstack.org/#/c/233800/ ... maybe need to merge those 2 reviews16:13
mriedemyeah you probably need to squash the changes if they are co-dependent16:14
*** tecn1z has quit IRC16:14
dimsbknudson: found that last week for neutron - https://bugs.launchpad.net/neutron/+bug/150389016:14
openstackLaunchpad bug 1503890 in neutron "test_policy assumes oslo.policy internal implementationd details" [Medium,Fix committed] - Assigned to Kevin Benton (kevinbenton)16:14
*** tecn1z has joined #openstack-keystone16:15
dimsmriedem: bknudson: unit tests dependent on internal implementation details16:15
mriedemthose are always fun16:15
mriedemsomeone should report a bug against oslo.policy that they changed their internal impl16:15
dimsmriedem: see bug above16:16
dimsmriedem: y we should freeze oslo code and not release anything anymore :)16:16
mriedemjust move it all back to oslo-incubator16:16
mriedemlike i said16:16
dimshaha +++16:16
dimsmriedem: you are way ahead of me in thinking16:17
openstackgerritMerged openstack/python-keystoneclient: Updated from global requirements  https://review.openstack.org/23414016:17
*** geoffarnold has quit IRC16:18
*** geoffarnold has joined #openstack-keystone16:19
*** wwwjfy_ has quit IRC16:20
bknudson    pkg_resources.ContextualVersionConflict: (WebOb 1.5.0 (/opt/stack/keystone/.tox/py27/lib/python2.7/site-packages), Requirement.parse('WebOb<1.5.0,>=1.2.3'), set(['keystonemiddleware']))16:20
bknudsonyep, keystone unit tests are broken16:21
mriedemnot just keystone i don't think16:21
*** ankurgupta has joined #openstack-keystone16:21
bknudsonit wasn't failing that way yesterday16:21
mriedemb/c middleware had the webob g-r sync and released as 2.4.0 since yesterday16:21
mriedemthat's why i was saying about reverting the webob thing and releasing as 2.4.116:22
bknudsoncan we have ksm not match global-requirements? I thought that would fail a gate test16:23
*** yuwen has quit IRC16:25
openstackgerritHenrique Truta proposed openstack/keystone: Bye Bye Domain Table  https://review.openstack.org/16185416:25
*** wwwjfy_ has joined #openstack-keystone16:26
*** phalmos_ has quit IRC16:30
*** jistr has quit IRC16:31
mriedembknudson: you can, you'd have to remove it from projects.txt in the requirements repo16:34
*** jsavak has quit IRC16:34
mriedembut, probably not a great idea16:34
mriedemb/c if ksm caps or uncaps some dep and something depends on ksm with  the opposite caps/uncaps, we get wedged16:34
mriedemb/c pip sucks16:35
*** lhcheng has joined #openstack-keystone16:35
*** ChanServ sets mode: +v lhcheng16:35
*** jsavak has joined #openstack-keystone16:37
*** wwwjfy_ has quit IRC16:40
*** geoffarn_ has joined #openstack-keystone16:40
*** geoffarnold has quit IRC16:44
*** john5223 is now known as zz_john522316:48
dhellmannbknudson: if you're working on things blocking master, can you coordinate with us in #openstack-relmgr-office and using https://etherpad.openstack.org/p/liberty-release-gate-race please?16:48
*** petertr7_away is now known as petertr716:53
*** fhubik has quit IRC16:54
*** henrynash has joined #openstack-keystone16:57
*** ChanServ sets mode: +v henrynash16:57
*** pnavarro|off has quit IRC16:59
*** shaleh has joined #openstack-keystone17:04
*** doug-fis_ has joined #openstack-keystone17:04
*** amakarov is now known as amakarov_away17:04
*** doug-fis_ is now known as doug-fish_17:05
*** doug-fish has quit IRC17:07
*** petertr7 is now known as petertr7_away17:08
*** jsavak has quit IRC17:09
*** jsavak has joined #openstack-keystone17:10
*** browne has quit IRC17:11
*** diazjf has quit IRC17:12
*** su_zhang has joined #openstack-keystone17:12
*** gordc has quit IRC17:14
*** urulama has quit IRC17:15
*** roxanaghe has joined #openstack-keystone17:15
*** urulama has joined #openstack-keystone17:15
stevemar_really bknudson "exemplar"17:15
*** geoffarn_ has quit IRC17:16
*** geoffarnold has joined #openstack-keystone17:18
openstackgerritLin Hua Cheng proposed openstack/keystone: Validate user exist when assigning roles in V2  https://review.openstack.org/9398217:21
*** aix has quit IRC17:22
*** phalmos has joined #openstack-keystone17:29
*** geoffarnold has quit IRC17:39
*** geoffarnold has joined #openstack-keystone17:39
*** petertr7_away is now known as petertr717:41
*** gordc has joined #openstack-keystone17:41
*** Guest4816 is now known as tsymanczyk17:47
bknudsondhellmann: ok.17:51
*** browne has joined #openstack-keystone17:54
*** fawadkhaliq has quit IRC17:58
*** mylu has joined #openstack-keystone17:59
*** jbell8 has joined #openstack-keystone17:59
*** geoffarnold has quit IRC18:00
*** geoffarnold has joined #openstack-keystone18:00
*** ankurgupta has left #openstack-keystone18:01
*** rderose has joined #openstack-keystone18:01
*** jdennis has quit IRC18:02
*** mylu has quit IRC18:02
*** dikonoor has quit IRC18:03
*** mylu has joined #openstack-keystone18:03
*** mylu has quit IRC18:04
*** mylu has joined #openstack-keystone18:04
*** diazjf has joined #openstack-keystone18:05
*** Alexander has joined #openstack-keystone18:06
*** fawadkhaliq has joined #openstack-keystone18:07
*** jsavak has quit IRC18:08
*** jsavak has joined #openstack-keystone18:09
*** jdennis has joined #openstack-keystone18:13
*** woodster_ has joined #openstack-keystone18:13
openstackgerritLin Hua Cheng proposed openstack/keystone: Validate user exist when assigning roles in V2  https://review.openstack.org/9398218:14
*** henrynash has quit IRC18:16
*** e0ne has joined #openstack-keystone18:17
*** mriedem has quit IRC18:18
*** csoukup has joined #openstack-keystone18:19
*** fawadkhaliq has quit IRC18:21
*** mriedem has joined #openstack-keystone18:21
*** fawadkhaliq has joined #openstack-keystone18:21
*** geoffarn_ has joined #openstack-keystone18:22
*** fawadkhaliq has quit IRC18:24
*** fawadkhaliq has joined #openstack-keystone18:24
*** phalmos has quit IRC18:25
*** geoffarnold has quit IRC18:26
*** jaosorior has quit IRC18:28
*** e0ne has quit IRC18:30
openstackgerritgordon chung proposed openstack/keystonemiddleware: drop use of norm_ns  https://review.openstack.org/23426518:34
*** su_zhang_ has joined #openstack-keystone18:38
*** su_zhang has quit IRC18:39
*** jsavak has quit IRC18:42
*** geoffarnold has joined #openstack-keystone18:43
*** geoffarn_ has quit IRC18:43
*** jdennis has quit IRC18:43
*** jsavak has joined #openstack-keystone18:44
*** wwwjfy_ has joined #openstack-keystone18:45
*** wwwjfy_ has quit IRC18:46
*** phalmos has joined #openstack-keystone18:53
bretonI wonder18:55
bretonmarekd: dstanek: why can't we use the same keystone for k2k?18:55
dstanekbreton: ?18:56
*** jsavak has quit IRC18:56
bretonuse the same keystone instance as idp and sp at the same time18:56
bretonwe need to sp in idp and idp in sp anyway18:56
dstaneki'm not sure that it would work and even it if did i don't know that it would be a fair test18:56
dstaneksince uses would be in the database already we could make things work on accident18:57
marekdbreton: i said we should be able to use one keystone18:57
marekdbreton: i just mentioned i have never tested such configuration18:57
marekddstanek: ++18:58
*** jsavak has joined #openstack-keystone18:58
marekddstanek: breton IMHO we should build test environments that are similar to what will land one day in production18:58
bretonoh, I see, it was discussed18:58
*** su_zhang_ has quit IRC18:58
bretonthere is no cross-dependency in sp and idp code afaik18:59
marekdbreton: there is not18:59
*** amakarov has joined #openstack-keystone19:00
edmondswopened https://bugs.launchpad.net/keystone/+bug/1505777 for the extras issue we were discussing19:00
openstackLaunchpad bug 1505777 in Keystone "inconsistent support for optional dependencies" [Undecided,New]19:00
ayoungdstanek, it ensrues all the pieces work. so long as we don;'t special case it...why not?19:00
*** tonytan4ever has joined #openstack-keystone19:00
*** mriedem has left #openstack-keystone19:01
gyeemarekd, you can put both SP and IDP on the same Keystone instance19:01
gyeejust make sure the have different set of certs and keys19:01
bretonsomebody needs to try that19:01
gyeebreton, did19:01
bretonoh, cool.19:02
ayoungdavid8hu, so,  tokenless authN is the future, but we will still need to do AuthZ19:02
gyeeayoung, how does Horizon query the admin project?19:02
ayoungand so X509 will just bypass the token piece, not the list-roles19:02
ayounggyee, it does not need to19:02
gyeedon't they want to lock it down as well?19:03
ayounggyee, horizon will see that the user gets the admin role based on project selected19:03
ayoungHorizon should not have to change at all19:03
dstanekayoung: i worry that things will accidentally work because we share the same database19:03
gyeeayoung, so whoever have role assignment perm can still assign the admin role to whatever, but they won't get it unless its admin project19:03
*** mylu has quit IRC19:04
ayounggyee, right19:04
*** geoffarnold has quit IRC19:04
*** geoffarnold has joined #openstack-keystone19:04
ayounggyee, as a follow on check, we can prevent people from assigning admin on non-admin projects as we want for better UX19:04
*** rderose has quit IRC19:05
gyeeayoung, sure19:05
gyeeayoung, I am fine with the idea, not a long term solution, but enough to get us by for now19:05
gyeeayoung, that would make the admin project immutable19:06
gyeeplenty of doc as bknudson said19:06
gyeedstanek, btw, you have a good weekend :)19:06
dstanekgyee: do you have a long term solution in mind?19:06
gyeethe freaking Browns beat up on the Ravens!!!!!!!!19:07
dstanekgyee: record breaking, in fact19:07
gyee8 years of frustration19:07
gyeedstanek, long term solution is proper authorization APIs19:08
dstanekwho would have thought you could take a scrub QB, give him a bunch or shorty receivers and expect a win19:08
ayoungdstanek, it won't work accidentally.  The test has to go through token to SAML and then SAML to token19:08
*** jsheeren has joined #openstack-keystone19:09
dstanekayoung: but can tokens get objects without SAML by hitting the IdP?19:09
dstanekayoung: the edge cases are my concern19:09
*** diazjf has quit IRC19:09
ayoungdstanek, If we go through the client code, we might fool ourselves, but if we make the API calls directly, we will not.  I think19:10
ayoungdstanek, anyway, testing with a single server K2K is a good first step, and we can solve multi next19:10
jsheerenhi, i have a question about keystone and https19:11
ayoungjsheeren, fire away19:11
jsheereni'm setting up a kilo environment, with haproxy as ssl endpoint19:11
jsheereni configured everything and it is working up untill the creation of the credentials files19:11
shalehwhy not just fire up two devstack instances and test it like it will actually run?19:12
jsheerenif I use the temporary token, i can do everythgin19:12
jsheerenif i source the credentials file; i get an http auth url in my response from keystone19:12
jsheerenso, auth_url = https - i do a request with --debug and it shows me an http auth url19:13
shalehdstanek: why not just fire up two devstack instances and test it like it will actually run?19:13
ayoungjsheeren, but the service catalog endpoint is not the https one19:13
jsheerenas a result, no commands can be excecuted19:13
ayoungso you can;t make anuy other calls19:13
jsheerenwhen i created the endpoints for keystone, they were all https19:14
jsheerenis there somewhere else i need to define the auth url to be the https one?19:14
ayoungjsheeren, inside the database?19:14
ayoungYou sure?19:14
jsheereni haven't checked the database yet.  i would like to not mess around in there :)19:15
*** mylu has joined #openstack-keystone19:15
dstanekshaleh: infra has a new feature for doing just that19:17
jsheerenif i do this request: curl -g -i --insecure -X GET https://servername:35357/v3 -H "Accept: application/json" -H "User-Agent: python-keystoneclient"         i get following href response: {"version": {"status": "stable", "updated": "2015-03-30T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.4", "links": [{"href": "http://servername:35357/v3/",19:17
jsheeren"rel": "self"}]}}19:17
jsheerenso, request to https, repsone gives back http19:18
shalehdstanek: I have been doing my fed testing using devstack and ansible to coordinate the federation19:18
shalehdstanek: since doing it within devstack was a little messy since each needs to talk to the other19:18
jamielennoxjsheeren: i think you've got public_endpoint and admin_endpoint set in keystone.conf19:18
jamielennoxjsheeren: that or you've got a load balancer in front19:19
*** e0ne has joined #openstack-keystone19:19
ayoungsmirking gun19:19
*** petertr7 is now known as petertr7_away19:19
jsheerenyeah i have an haproxy load balancer in front19:19
ayoungdamn , I shoulhd have said smirking girn19:19
jamielennoxjsheeren: ok, so what happens there is that keystone is filling in the url with the info it knows - which in this case is http19:19
ayoungjsheeren, you need those to be https.  THat is from, the service catalog19:19
*** alejandrito has quit IRC19:20
jamielennoxjsheeren: the easy way to fix it is to set public_endpoint in keystone.conf to be the https url which will override keystone figuring it out itself19:20
ayoungOh...wait, yeah, that is just the discovery page...taht comes from conf file19:20
jsheerenok, i checked my keystone.conf and i have not set an explicit public/admin endpoint there19:20
jsheerenok, so set the public endpoint explicit in the keystone to be https?19:20
ayoungjsheeren, do a catalog list and you would see it, but you probably can't19:21
ayoungbecause the endpoint is wrong in your catalog19:21
jsheereni'll try that19:21
ayounggo look in your databnase19:21
ayoungthe userid and password is in your keystone.conf file19:21
jamielennoxjsheeren: there is another setting that will let you pass the protocol from a load balancer which is useful if you have multiple URLs that all point to the same keystone, but if you've only got one just set public_endpoint and admin_endpoint to the https address19:21
*** petertr7_away is now known as petertr719:22
*** alejandrito has joined #openstack-keystone19:22
ayoungmorgan, thinking multistropt is the least surprising for admin_project_id19:22
jsheerenjamielennox: i was setting up a public url on the public network and an internal and admin url for the internal network; do you mean that? or something else?19:23
morganayoung: sure19:23
*** diazjf has joined #openstack-keystone19:23
jamielennoxjsheeren: are they actually different URLs?19:24
gyeejamielennox, jsheeren, you need to do two things19:24
jsheerenjamielennox: yes, url on the public network is different than on internal network.19:25
gyee1) configure secure_proxy_ssl_header in HAProxy19:25
jamielennoxjsheeren: so there is an option in keystone secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO19:25
gyee2) set in keystone.conf, see https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L21119:25
gyeeotherwise, the hrefs in version discovery will not work19:25
*** geoffarn_ has joined #openstack-keystone19:26
jamielennoxjsheeren: i think HTTP_X_FORWARDED_PROTO is the standard for haproxy so it will use the value in there instead of http19:26
gyeeversion discovery is generally broken when deploying with proxies19:26
jsheerenok, so i will set the secure_proxy_ssl_header in keystone and the other HTTP_X_FORWARDED_PROTO in haproxy19:26
jsheerenthanks for the tips!!19:26
jamielennoxgyee: public/admin split is fine, internal is tricky19:26
gyeejamielennox, I had to write custom code to get around that19:27
gyeewill push a patch upstream when I find the time19:27
jamielennoxgyee: i said we should just always use relative links, people complained19:28
jamielennoxgyee: granted i have no idea if that actually works today19:28
gyeejamielennox, relative links?19:28
*** amakarov has quit IRC19:28
jamielennoxgyee: well this is only a problem because you have the service trying to figure out its own hostname and protocol19:29
jamielennoxgyee: we should just return the path and assume that it's relative to the current url19:29
*** su_zhang has joined #openstack-keystone19:29
*** jdennis has joined #openstack-keystone19:29
gyeeoh I see19:29
*** geoffarnold has quit IRC19:29
gyeejamielennox, I like the idea!19:29
gyeeplus, we can't expose internal hosts/ports19:30
jamielennoxi would have to see how keystoneclient/auth actually handled that19:30
*** amakarov has joined #openstack-keystone19:31
*** amakarov has quit IRC19:31
*** alejandrito has quit IRC19:32
jsheerenjamielennox: gyee: just wanted to let you know, setting secure_proxy_ssl_header = HTTP_X_FORWARDED_PROTO in my keystone.conf fixed it.  i alread had set reqadd X-Forwarded-Proto:\ https in my haproxy config19:34
*** su_zhang has quit IRC19:34
gyeejsheeren, excellent19:35
*** petertr7 is now known as petertr7_away19:36
*** gyee has quit IRC19:37
*** marzif has joined #openstack-keystone19:39
*** rderose has joined #openstack-keystone19:41
*** e0ne has quit IRC19:43
*** petertr7_away is now known as petertr719:43
*** jsheeren has quit IRC19:44
*** su_zhang has joined #openstack-keystone19:46
*** c_soukup has joined #openstack-keystone19:46
*** geoffarn_ has quit IRC19:47
*** csoukup has quit IRC19:50
openstackgerritayoung proposed openstack/keystone: Strip admin roles from non-admin projects and domains  https://review.openstack.org/23348019:51
*** mylu has quit IRC19:53
*** mylu has joined #openstack-keystone19:53
*** tyagiprince2010 has joined #openstack-keystone19:54
*** mylu has quit IRC19:54
*** rickyrem has joined #openstack-keystone19:54
*** marzif has quit IRC19:54
*** rickyrem has left #openstack-keystone19:55
lbragstaddolphm if we do version 0x81 of fernet, is that something you should be able to leverage via the api? from keystone for example?19:57
*** jsavak has quit IRC19:58
*** jsavak has joined #openstack-keystone19:58
*** roxanaghe has quit IRC19:59
*** diazjf has quit IRC19:59
*** mylu has joined #openstack-keystone20:00
*** mylu has quit IRC20:00
*** geoffarnold has joined #openstack-keystone20:02
*** diazjf has joined #openstack-keystone20:02
*** rderose has quit IRC20:05
*** roxanaghe has joined #openstack-keystone20:05
*** geoffarnold has quit IRC20:08
*** geoffarnold has joined #openstack-keystone20:08
openstackgerritBrant Knudson proposed openstack/oslo.policy: Use JSON generator  https://review.openstack.org/23442120:08
*** csoukup_ has joined #openstack-keystone20:10
*** mylu has joined #openstack-keystone20:13
*** c_soukup has quit IRC20:13
*** jmccrory has quit IRC20:17
*** jmccrory has joined #openstack-keystone20:19
brownecould someone please review https://review.openstack.org/#/c/226121/20:20
brownefix for a high priority bug20:20
*** e0ne has joined #openstack-keystone20:22
dolphmlbragstad: morgan: ^20:28
*** geoffarnold has quit IRC20:29
*** geoffarnold has joined #openstack-keystone20:30
*** marzif has joined #openstack-keystone20:30
morganSo if the userid is hex and 16 bytes we assume uuid. (I guess that is a safe assumption)20:31
*** e0ne has quit IRC20:35
*** mylu has quit IRC20:38
openstackgerritBrant Knudson proposed openstack/keystone: More info in RequestContext  https://review.openstack.org/21359520:43
*** topol has quit IRC20:45
*** _hrou_ has joined #openstack-keystone20:48
*** hrou has quit IRC20:49
*** geoffarnold has quit IRC20:50
*** phalmos has quit IRC20:51
*** geoffarnold has joined #openstack-keystone20:51
*** exploreshaifali has joined #openstack-keystone20:55
*** diazjf has quit IRC20:56
*** thiagop has quit IRC20:58
*** raildo is now known as raildo-afk21:00
*** pushkaru has joined #openstack-keystone21:01
*** pumaranikar has joined #openstack-keystone21:01
*** diazjf has joined #openstack-keystone21:02
*** petertr7 is now known as petertr7_away21:04
*** tyagiprince2010 has quit IRC21:07
*** jsavak has quit IRC21:12
*** geoffarnold has quit IRC21:12
*** geoffarnold has joined #openstack-keystone21:12
*** gildub has joined #openstack-keystone21:18
*** njohnston is now known as nate_gone21:20
stevemar_bknudson: why set tenant instead of project?21:28
stevemar_"request_context.tenant = auth_context.get('project_id')"21:28
bknudsonstevemar_: that's what the field is in oslo_context RequestContext. :(21:28
stevemar_bknudson: sadness :(21:28
bknudsonstevemar_: http://git.openstack.org/cgit/openstack/oslo.context/tree/oslo_context/context.py#n5421:29
bknudsonI need to deprecate that old garbage!21:29
stevemar_bknudson: JFDI21:29
stevemar_bknudson: https://bugs.launchpad.net/oslo.context/+bug/150582721:31
openstackLaunchpad bug 1505827 in oslo.context "use project instead of tenant" [Undecided,New]21:31
stevemar_add project to args, self.tenant = tenant or project, if tenant: log.deprecation blah21:32
*** _hrou_ has quit IRC21:33
*** hrou has joined #openstack-keystone21:33
*** geoffarn_ has joined #openstack-keystone21:33
*** roxanaghe has quit IRC21:33
*** geoffarnold has quit IRC21:34
stevemar_blah, all the other spots21:34
*** urulama has quit IRC21:36
*** urulama has joined #openstack-keystone21:36
*** hrou has quit IRC21:37
*** hrou has joined #openstack-keystone21:38
*** hrou has quit IRC21:42
*** hrou has joined #openstack-keystone21:42
*** pauloewerton has quit IRC21:42
*** pgbridge has quit IRC21:43
*** hrou has quit IRC21:44
*** hrou has joined #openstack-keystone21:44
lbragstaddolphm thanks, looking21:45
lbragstaddolphm also, i added another comment here - √21:46
lbragstads/√/ https://review.openstack.org/#/c/231191/ /21:46
*** pumarani__ has joined #openstack-keystone21:47
*** gordc has quit IRC21:47
*** pumarani__ has quit IRC21:47
stevemar_lbragstad: √√√√21:47
*** diazjf has left #openstack-keystone21:51
*** geoffarn_ has quit IRC21:54
*** geoffarnold has joined #openstack-keystone21:55
*** pgbridge has joined #openstack-keystone21:57
*** exploreshaifali has quit IRC21:59
*** pumaranikar has quit IRC22:03
*** pushkaru has quit IRC22:04
*** mylu has joined #openstack-keystone22:07
*** sigmavirus24 is now known as sigmavirus24_awa22:08
*** jasonsb has quit IRC22:08
*** jasonsb has joined #openstack-keystone22:09
*** slberger has left #openstack-keystone22:09
*** david-lyle has quit IRC22:10
*** tecn1z has quit IRC22:10
*** mylu has quit IRC22:11
*** mylu has joined #openstack-keystone22:11
*** david-lyle has joined #openstack-keystone22:12
*** tonytan4ever has quit IRC22:13
*** ngupta has quit IRC22:15
*** geoffarnold has quit IRC22:15
*** mylu has quit IRC22:16
*** geoffarnold has joined #openstack-keystone22:16
*** pgbridge has quit IRC22:20
*** pgbridge has joined #openstack-keystone22:21
*** hrou has quit IRC22:23
openstackgerritSteve Martinelli proposed openstack/keystone: Move endpoint_policy migrations into keystone core  https://review.openstack.org/17191622:31
*** edmondsw has quit IRC22:33
*** darrenc is now known as darrenc_afk22:35
openstackgerritSteve Martinelli proposed openstack/keystone: Move endpoint_policy migrations into keystone core  https://review.openstack.org/17191622:36
openstackgerritSteve Martinelli proposed openstack/keystone: Move federation extension into keystone core  https://review.openstack.org/21477522:36
*** mylu has joined #openstack-keystone22:36
*** geoffarnold has quit IRC22:37
*** geoffarnold has joined #openstack-keystone22:37
*** marzif has quit IRC22:41
*** marzif has joined #openstack-keystone22:41
*** jbell8 has quit IRC22:41
*** wwwjfy_ has joined #openstack-keystone22:47
*** mylu has quit IRC22:48
*** mylu has joined #openstack-keystone22:49
*** wwwjfy_ has quit IRC22:49
*** mylu_ has joined #openstack-keystone22:50
*** mylu has quit IRC22:53
anteayastevemar_: you seen this? http://www.cbc.ca/news/politics/elections-canada-says-3-6-million-votes-cast-during-advance-polls-1.326939322:58
*** geoffarn_ has joined #openstack-keystone22:59
*** chlong has quit IRC22:59
*** geoffarnold has quit IRC23:03
*** gyee has joined #openstack-keystone23:07
*** ChanServ sets mode: +v gyee23:07
*** lhcheng has quit IRC23:11
*** lhcheng has joined #openstack-keystone23:13
*** ChanServ sets mode: +v lhcheng23:13
*** lhcheng_ has joined #openstack-keystone23:17
*** geoffarn_ has quit IRC23:18
*** lhcheng has quit IRC23:19
*** geoffarnold has joined #openstack-keystone23:20
*** stevemar_ has quit IRC23:23
*** stevemar_ has joined #openstack-keystone23:24
*** ChanServ sets mode: +o stevemar_23:24
*** mylu_ has quit IRC23:28
*** mylu has joined #openstack-keystone23:29
openstackgerritLin Hua Cheng proposed openstack/keystone: Validate user exist when assigning roles in V2  https://review.openstack.org/9398223:30
*** mylu has quit IRC23:34
stevemar_anteaya: i have heard it was an insane number, that's huge23:36
stevemar_anteaya: i am waiting until until the actual day, since the polling station is in the building i live in :)23:37
*** mylu has joined #openstack-keystone23:40
shalehwhat is the expected turn out?23:41
*** dims has quit IRC23:41
*** dims has joined #openstack-keystone23:42
*** r-daneel has quit IRC23:43
stevemar_shaleh: its up 70% from 201123:44
stevemar_this is just advanced polling, the main day always has a big turn out23:44
* shaleh waits for his country, the "Leader" of the free world to come to its senses and make voting that easy23:45
stevemar_shaleh: it's in case you are traveling or busy the day of :)23:56
*** hrou has joined #openstack-keystone23:57

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!