| *** stevemar_ has joined #openstack-keystone | 00:00 | |
| *** ChanServ sets mode: +o stevemar_ | 00:00 | |
| *** jasonsb has joined #openstack-keystone | 00:02 | |
| *** stevemar_ has quit IRC | 00:04 | |
| *** shaleh has quit IRC | 00:09 | |
| *** krotscheck has quit IRC | 00:11 | |
| *** EinstCrazy has quit IRC | 00:13 | |
| *** EinstCrazy has joined #openstack-keystone | 00:13 | |
| *** breton has joined #openstack-keystone | 00:14 | |
| *** EinstCrazy has quit IRC | 00:18 | |
| *** breton has quit IRC | 00:19 | |
| *** krotscheck has joined #openstack-keystone | 00:19 | |
| *** shadower has quit IRC | 00:23 | |
| *** shadower has joined #openstack-keystone | 00:23 | |
| *** NM has joined #openstack-keystone | 00:26 | |
| *** pumaranikar has joined #openstack-keystone | 00:30 | |
| *** NM has quit IRC | 00:34 | |
| *** pumaranikar has quit IRC | 00:35 | |
| *** topol has joined #openstack-keystone | 00:36 | |
| *** ChanServ sets mode: +v topol | 00:36 | |
| *** breton has joined #openstack-keystone | 00:44 | |
| *** breton has quit IRC | 00:48 | |
| *** EinstCrazy has joined #openstack-keystone | 00:55 | |
| openstackgerrit | Merged openstack/keystone: Explain default domain in docs for other services https://review.openstack.org/232098 | 00:58 |
|---|---|---|
| *** boris-42 has quit IRC | 00:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/236807 | 01:01 |
| *** markvoelker has joined #openstack-keystone | 01:02 | |
| *** jasonsb has quit IRC | 01:03 | |
| *** pumaranikar has joined #openstack-keystone | 01:04 | |
| *** breton has joined #openstack-keystone | 01:08 | |
| *** tsymanczyk has quit IRC | 01:09 | |
| *** tsymancz2k has quit IRC | 01:09 | |
| *** breton has quit IRC | 01:13 | |
| *** richm has quit IRC | 01:13 | |
| *** gyee has quit IRC | 01:15 | |
| *** breton has joined #openstack-keystone | 01:18 | |
| *** ayoung has quit IRC | 01:21 | |
| *** ayoung has joined #openstack-keystone | 01:21 | |
| *** ChanServ sets mode: +v ayoung | 01:21 | |
| *** josecastroleon has joined #openstack-keystone | 01:22 | |
| *** breton has quit IRC | 01:23 | |
| *** dims has quit IRC | 01:34 | |
| *** bill_az has quit IRC | 01:39 | |
| *** crinkle has quit IRC | 01:49 | |
| *** crinkle has joined #openstack-keystone | 01:51 | |
| *** josecastroleon has quit IRC | 01:52 | |
| *** breton has joined #openstack-keystone | 01:53 | |
| *** pumaranikar has quit IRC | 01:55 | |
| *** breton has quit IRC | 01:58 | |
| *** lhcheng has quit IRC | 01:59 | |
| *** stevemar_ has joined #openstack-keystone | 02:02 | |
| *** ChanServ sets mode: +o stevemar_ | 02:02 | |
| *** jasonsb has joined #openstack-keystone | 02:13 | |
| *** browne has quit IRC | 02:14 | |
| *** browne has joined #openstack-keystone | 02:15 | |
| *** pumaranikar has joined #openstack-keystone | 02:15 | |
| *** topol has quit IRC | 02:16 | |
| *** browne has quit IRC | 02:18 | |
| *** jbell8 has joined #openstack-keystone | 02:28 | |
| *** boris-42 has joined #openstack-keystone | 02:30 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth-saml2: Split ADFS and SAML2 plugins https://review.openstack.org/237853 | 02:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth-saml2: Update requests_mock syntax https://review.openstack.org/237854 | 02:39 |
| jamielennox | stevemar_: hey, can we do a release of ksc-kerberos | 02:41 |
| stevemar_ | jamielennox: does that just have auth plugins? | 02:42 |
| jamielennox | yea | 02:42 |
| *** markvoelker has quit IRC | 02:42 | |
| jamielennox | but it's been released before so we may as well update regardless of ksa decisions | 02:42 |
| jamielennox | stevemar_: also maybe you can tell me, for ECP is that first GET on the SP_URL always a get, or is it just that the keystone route is a GET? | 02:44 |
| jamielennox | i _think_ the SP XML response should come back either way | 02:44 |
| *** pumaranikar has quit IRC | 02:50 | |
| *** morgan has quit IRC | 03:00 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/236807 | 03:05 |
| stevemar_ | jamielennox: looking at a line of code in particular? | 03:08 |
| *** jimbaker has quit IRC | 03:12 | |
| stevemar_ | jamielennox: poke | 03:16 |
| stevemar_ | jamielennox: do you know of a clever way to test this: https://review.openstack.org/#/c/171916/19/keystone/tests/unit/test_sql_upgrade.py | 03:16 |
| jamielennox | stevemar_: that should be almost trivial | 03:18 |
| jamielennox | stevemar_: with the extension move we don't rename the tables or anything | 03:18 |
| jamielennox | but i guess you delete the old code | 03:18 |
| *** lhcheng has joined #openstack-keystone | 03:19 | |
| *** ChanServ sets mode: +v lhcheng | 03:19 | |
| jamielennox | i guess you want to create the table in the test - and check that if the table exists before the migration nothing happens | 03:19 |
| jamielennox | or looking at the migration more, set the extension_version = 1 and then ensure that nothing happens | 03:20 |
| jamielennox | table doesn't get created | 03:21 |
| stevemar_ | jamielennox: i do that in test_sql_migrate_extensions | 03:21 |
| stevemar_ | this is the case where the user actually had the tables from the migration, and then is running 083 (or whatever) | 03:22 |
| jamielennox | stevemar_: re the ECP thing it turns out i currently can't access my SAML setup so that i'm going to have to leave that | 03:22 |
| jamielennox | stevemar_: yep | 03:22 |
| jamielennox | so set extension_version = 1 | 03:22 |
| jamielennox | upgrade(081) | 03:22 |
| jamielennox | assert table doesn't exist | 03:22 |
| jamielennox | or otherwise that nothing happened | 03:22 |
| *** mylu has joined #openstack-keystone | 03:24 | |
| *** mylu has quit IRC | 03:25 | |
| *** mylu has joined #openstack-keystone | 03:26 | |
| *** pumaranikar has joined #openstack-keystone | 03:36 | |
| *** topol has joined #openstack-keystone | 03:38 | |
| *** ChanServ sets mode: +v topol | 03:38 | |
| *** breton has joined #openstack-keystone | 03:40 | |
| *** topol has quit IRC | 03:43 | |
| *** jbell8 has quit IRC | 03:44 | |
| *** jbell8 has joined #openstack-keystone | 03:44 | |
| *** breton has quit IRC | 03:45 | |
| *** ajaya has joined #openstack-keystone | 03:46 | |
| *** gildub has quit IRC | 03:47 | |
| *** ajaya has quit IRC | 03:54 | |
| *** pumaranikar has quit IRC | 03:57 | |
| *** pumaranikar has joined #openstack-keystone | 03:57 | |
| *** Nirupama has joined #openstack-keystone | 04:08 | |
| *** links has joined #openstack-keystone | 04:11 | |
| *** jbell8 has quit IRC | 04:15 | |
| *** jbell8 has joined #openstack-keystone | 04:16 | |
| *** jbell8 has quit IRC | 04:18 | |
| *** jbell8 has joined #openstack-keystone | 04:18 | |
| *** breton has joined #openstack-keystone | 04:22 | |
| *** breton has quit IRC | 04:28 | |
| *** jbell8 has quit IRC | 04:32 | |
| *** lhcheng has quit IRC | 04:39 | |
| *** mylu has quit IRC | 04:46 | |
| *** mylu has joined #openstack-keystone | 04:46 | |
| *** jaosorior has quit IRC | 04:48 | |
| *** jaosorior has joined #openstack-keystone | 04:48 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: [WIP] Use keystoneauth https://review.openstack.org/235090 | 04:49 |
| *** ajaya has joined #openstack-keystone | 04:50 | |
| *** mylu has quit IRC | 04:50 | |
| *** mylu has joined #openstack-keystone | 04:53 | |
| *** pumaranikar has quit IRC | 04:54 | |
| stevemar_ | jamielennox: what's wrong with the keystoneclient references in keystone? | 04:59 |
| stevemar_ | seems like it's just used for cms and ec2 | 04:59 |
| jamielennox | stevemar_: i'm not sure what's wrong with that | 04:59 |
| jamielennox | what are you referring to | 04:59 |
| stevemar_ | jamielennox: someone said in the meeting today that keystone wasn't even using keystoneauth properly? | 05:00 |
| jamielennox | oh, i think that was in regard to using keystonemiddleware in front of keystone | 05:00 |
| jamielennox | if we do that then there is really no need for cms to exist in keystoneclient | 05:00 |
| jamielennox | it'd live in keystonemiddleware | 05:01 |
| jamielennox | i don't think it's a big deal, we'll always have a dependency on keystoneclient from keystonemiddleware | 05:01 |
| *** topol has joined #openstack-keystone | 05:02 | |
| *** ChanServ sets mode: +v topol | 05:02 | |
| stevemar_ | jamielennox: why's that, shouldn't it just be keystoneauth (except for the cms bits...) | 05:02 |
| *** roxanagh_ has joined #openstack-keystone | 05:04 | |
| *** lhcheng has joined #openstack-keystone | 05:04 | |
| *** ChanServ sets mode: +v lhcheng | 05:04 | |
| *** pumaranikar has joined #openstack-keystone | 05:05 | |
| *** mylu has quit IRC | 05:09 | |
| *** mylu has joined #openstack-keystone | 05:09 | |
| jamielennox | stevemar_: no, you should still have keystoneclient handling things like: fetch revocation lists, validate token, fetch certs.. etc | 05:10 |
| jamielennox | ksa will just be the transport layer, ksc should still handle things that are keystone REST calls | 05:10 |
| *** mylu has quit IRC | 05:13 | |
| *** tyagiprince2010 has joined #openstack-keystone | 05:15 | |
| *** topol has quit IRC | 05:15 | |
| tyagiprince2010 | hey need help... I installed keystone. now when i run any command like keystone user-list, it asks me for the os-username. | 05:15 |
| tyagiprince2010 | need to know what do i add to my credentials file which ill have to source. | 05:16 |
| tyagiprince2010 | i already have this in my credentials file. | 05:16 |
| *** openstackgerrit has quit IRC | 05:16 | |
| *** morgan has joined #openstack-keystone | 05:16 | |
| *** ChanServ sets mode: +v morgan | 05:16 | |
| tyagiprince2010 | export OS_SERVICE_TOKEN=9377a7d91c1bedf2bad5 export OS_SERVICE_ENDPPOINT=http://localhost:35357/v2.0 | 05:16 |
| *** openstackgerrit has joined #openstack-keystone | 05:17 | |
| jamielennox | tyagiprince2010: you're getting your CLIs confused unfortunately. those ENVs work in openstackclient but not in keystone cli | 05:17 |
| jamielennox | so that should work in openstack user list, but not keystone user-list | 05:18 |
| *** stevemar_ has quit IRC | 05:19 | |
| *** stevemar_ has joined #openstack-keystone | 05:19 | |
| *** ChanServ sets mode: +o stevemar_ | 05:19 | |
| *** hidekazu has joined #openstack-keystone | 05:21 | |
| *** roxanagh_ has quit IRC | 05:21 | |
| tyagiprince2010 | <+jamielennox> : I ran the command openstack user list.. it gives me this error... ERROR: cliff.app You must provide a username via either --os-username or env[OS_USERNAME] | 05:21 |
| tyagiprince2010 | I guess i need to add something to my credentials file... | 05:22 |
| jamielennox | stevemar_: that's your ^ | 05:22 |
| jamielennox | are the OSC options not OS_SERVICE_* | 05:22 |
| *** stevemar_ has quit IRC | 05:22 | |
| tyagiprince2010 | when i add this to my command --os-username admin, it asks me for the password... | 05:22 |
| tyagiprince2010 | I dont understand which password it is asking. | 05:23 |
| jamielennox | tyagiprince2010: it's ignoring the OS_SERVICE_TOKEN/ENDPOINT and telling you you need to add a username/password to authenticate | 05:23 |
| jamielennox | just need to see why it's ignoring that | 05:23 |
| jamielennox | tyagiprince2010: try just OS_TOKEN OS_URL instead | 05:24 |
| jamielennox | i don't see any reference to OS_SERVICE_X in openstackclient, and i don't remember it from keystoneclient | 05:25 |
| tyagiprince2010 | ok i guess it worked.. I changed the credentials file and now it is giving a different error..INFO: urllib3.connectionpool Starting new HTTP connection (1): localhost | 05:26 |
| jamielennox | that's not an error | 05:27 |
| jamielennox | i'm not sure why you're specifying a token in env anyway, why not just auth with user/pass | 05:27 |
| tyagiprince2010 | what i need is a basic setup of keystone... and then have it configured with mysql database and make it use pki token instead of uuid | 05:28 |
| tyagiprince2010 | how do i do the auth with user/pass | 05:28 |
| jamielennox | from memory OS_AUTH_URL OS_USERNAME OS_PASSWORD OS_PROJECT_NAME | 05:29 |
| jamielennox | but this would be documented somewhere | 05:29 |
| jamielennox | in many places | 05:29 |
| tyagiprince2010 | I'll try that.. | 05:34 |
| tyagiprince2010 | could you tell me what should i look for.. | 05:34 |
| tyagiprince2010 | there is pki mechanism i need to configure | 05:35 |
| tyagiprince2010 | and second is i have to make poc for every authentication and authorization model | 05:35 |
| jamielennox | have you tried setting this up with devstack or something first? it produces an accrc with all the information you need | 05:35 |
| tyagiprince2010 | and cant find any documentation for that | 05:35 |
| tyagiprince2010 | I have devstack as well. | 05:36 |
| jamielennox | pki requires some certs and an option in keystone, i'd worry about that after you have the basics working | 05:36 |
| jamielennox | umm POC for every authn/z is really jumping in the deep end | 05:37 |
| jamielennox | i'm not even sure we have a list of them | 05:37 |
| jamielennox | i guess it's mostly looking at the different backends | 05:38 |
| jamielennox | guess there's not that many | 05:39 |
| tyagiprince2010 | for the authorization mechanisms, i just need to look at pki and uuid.. and for the initial authentication, i guess i have to look at different ways possible there. | 05:42 |
| *** breton has joined #openstack-keystone | 05:42 | |
| tyagiprince2010 | which document should i look at.. being a beginner dont know much about it.. | 05:42 |
| *** lhcheng has quit IRC | 05:44 | |
| *** morgan has quit IRC | 05:45 | |
| *** roxanagh_ has joined #openstack-keystone | 05:47 | |
| *** breton has quit IRC | 05:47 | |
| *** breton has joined #openstack-keystone | 05:50 | |
| *** roxanagh_ has quit IRC | 05:51 | |
| *** pumaranikar has quit IRC | 05:52 | |
| *** breton has quit IRC | 05:54 | |
| *** grantbow has quit IRC | 06:00 | |
| *** jaosorior has quit IRC | 06:00 | |
| *** jaosorior has joined #openstack-keystone | 06:01 | |
| *** morgan has joined #openstack-keystone | 06:01 | |
| *** ChanServ sets mode: +v morgan | 06:01 | |
| *** josecastroleon has joined #openstack-keystone | 06:06 | |
| *** su_zhang has quit IRC | 06:08 | |
| *** mylu has joined #openstack-keystone | 06:10 | |
| jamielennox | Sorry, on my phone so bit hard to look stuff up. | 06:10 |
| jamielennox | If you stay away from federation mostly it's just SQL or LDAP. I don't know the docs off the top of my head | 06:13 |
| *** ParsectiX has joined #openstack-keystone | 06:15 | |
| *** mylu has quit IRC | 06:15 | |
| *** zqfan_afk has joined #openstack-keystone | 06:19 | |
| *** browne has joined #openstack-keystone | 06:25 | |
| *** pumaranikar has joined #openstack-keystone | 06:31 | |
| *** e0ne has joined #openstack-keystone | 06:32 | |
| *** lsmola_ has quit IRC | 06:33 | |
| *** pnavarro|off has joined #openstack-keystone | 06:34 | |
| *** breton has joined #openstack-keystone | 06:34 | |
| *** pumaranikar has quit IRC | 06:35 | |
| *** jamielennox is now known as jamielennox|away | 06:37 | |
| *** breton has quit IRC | 06:39 | |
| *** pnavarro|off has quit IRC | 06:40 | |
| *** e0ne has quit IRC | 06:42 | |
| *** josecastroleon has quit IRC | 06:46 | |
| *** lsmola_ has joined #openstack-keystone | 06:46 | |
| *** e0ne has joined #openstack-keystone | 06:47 | |
| *** jaosorior has quit IRC | 06:47 | |
| *** jaosorior has joined #openstack-keystone | 06:48 | |
| *** roxanagh_ has joined #openstack-keystone | 06:48 | |
| *** roxanagh_ has quit IRC | 06:53 | |
| *** pumaranikar has joined #openstack-keystone | 06:53 | |
| *** tyagiprince2010 has quit IRC | 06:58 | |
| *** pumaranikar has quit IRC | 06:58 | |
| *** josecastroleon has joined #openstack-keystone | 07:00 | |
| *** jaosorior has quit IRC | 07:16 | |
| *** urulama is now known as urulama|afk | 07:20 | |
| *** e0ne has quit IRC | 07:27 | |
| *** jongchoi has joined #openstack-keystone | 07:30 | |
| *** e0ne has joined #openstack-keystone | 07:31 | |
| *** jaosorior has joined #openstack-keystone | 07:35 | |
| *** jaosorior has quit IRC | 07:37 | |
| *** jaosorior has joined #openstack-keystone | 07:37 | |
| *** EinstCrazy has quit IRC | 07:42 | |
| *** EinstCrazy has joined #openstack-keystone | 07:43 | |
| *** breton has joined #openstack-keystone | 07:43 | |
| *** fhubik has joined #openstack-keystone | 07:45 | |
| *** urulama|afk has quit IRC | 07:45 | |
| *** urulama|afk has joined #openstack-keystone | 07:45 | |
| *** tyagiprince2010 has joined #openstack-keystone | 07:48 | |
| *** breton has quit IRC | 07:48 | |
| *** ParsectiX has quit IRC | 07:49 | |
| *** roxanagh_ has joined #openstack-keystone | 07:49 | |
| *** browne has quit IRC | 07:51 | |
| *** jsheeren has joined #openstack-keystone | 07:54 | |
| *** lhcheng has joined #openstack-keystone | 07:55 | |
| *** ChanServ sets mode: +v lhcheng | 07:55 | |
| *** roxanagh_ has quit IRC | 07:55 | |
| *** urulama|afk is now known as urulama | 07:58 | |
| *** browne has joined #openstack-keystone | 07:58 | |
| *** dims has joined #openstack-keystone | 07:58 | |
| *** ParsectiX has joined #openstack-keystone | 07:59 | |
| *** lhcheng has quit IRC | 07:59 | |
| *** ParsectiX has quit IRC | 08:00 | |
| *** EinstCrazy has quit IRC | 08:01 | |
| *** EinstCrazy has joined #openstack-keystone | 08:02 | |
| *** breton has joined #openstack-keystone | 08:02 | |
| *** browne has quit IRC | 08:02 | |
| *** dims has quit IRC | 08:05 | |
| *** breton has quit IRC | 08:07 | |
| *** pnavarro|off has joined #openstack-keystone | 08:10 | |
| *** josecastroleon has quit IRC | 08:11 | |
| *** Harsh has joined #openstack-keystone | 08:13 | |
| *** jsheeren has quit IRC | 08:14 | |
| Harsh | Hi guys | 08:14 |
| *** Harsh is now known as Guest52835 | 08:14 | |
| Guest52835 | need help on SSO implementation of Openstack KILO | 08:14 |
| Guest52835 | has anybody done this | 08:15 |
| *** josecastroleon has joined #openstack-keystone | 08:20 | |
| *** jistr has joined #openstack-keystone | 08:23 | |
| *** davechen has joined #openstack-keystone | 08:24 | |
| mordred | jamielennox|away: remind me at some point to talk to you about making a keystoneauth1.session from an existing session | 08:26 |
| *** davechen1 has joined #openstack-keystone | 08:27 | |
| *** ParsectiX has joined #openstack-keystone | 08:27 | |
| *** davechen has quit IRC | 08:29 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:31 | |
| *** davechen has joined #openstack-keystone | 08:35 | |
| *** davechen1 has quit IRC | 08:37 | |
| *** e0ne has quit IRC | 08:37 | |
| *** zqfan_afk is now known as zqfan | 08:37 | |
| *** Guest52835 has quit IRC | 08:40 | |
| *** jongchoi has quit IRC | 08:48 | |
| *** roxanagh_ has joined #openstack-keystone | 08:52 | |
| tyagiprince2010 | hey i am unable to run this pip command : pip install -r requirements.txt | 08:53 |
| tyagiprince2010 | it gives me an exception "Expected ',' or end-of-list in",line,"at",line[p:] ValueError: ("Expected ',' or end-of-list in", "Routes!=2.0,!=2.1,>=1.12.3;python_version=='2.7'", 'at', ";python_version=='2.7'") | 08:55 |
| *** ParsectiX has quit IRC | 08:56 | |
| *** roxanagh_ has quit IRC | 08:57 | |
| *** links has quit IRC | 09:00 | |
| *** openstackgerrit has quit IRC | 09:01 | |
| *** openstackgerrit has joined #openstack-keystone | 09:02 | |
| tyagiprince2010 | got it right.. after commenting out the Routes requirement.. | 09:02 |
| *** akanksha_ has joined #openstack-keystone | 09:07 | |
| *** ajaya has quit IRC | 09:14 | |
| *** links has joined #openstack-keystone | 09:15 | |
| *** e0ne has joined #openstack-keystone | 09:17 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: No request body or empty resource acceptable in the validation https://review.openstack.org/237448 | 09:19 |
| *** ParsectiX has joined #openstack-keystone | 09:20 | |
| *** urulama has quit IRC | 09:20 | |
| *** urulama has joined #openstack-keystone | 09:21 | |
| *** aix has joined #openstack-keystone | 09:21 | |
| zqfan | hi, good afternoon, need help for this: https://bugs.launchpad.net/python-keystoneclient/+bug/1508374 | 09:22 |
| openstack | Launchpad bug 1508374 in python-keystoneclient "using session construct client will miss service_catalog property" [Undecided,New] | 09:22 |
| *** breton has joined #openstack-keystone | 09:26 | |
| *** openstackgerrit has quit IRC | 09:31 | |
| *** ajaya has joined #openstack-keystone | 09:31 | |
| *** openstackgerrit has joined #openstack-keystone | 09:32 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Using the right format to render the docstring correctly https://review.openstack.org/226225 | 09:33 |
| *** nisha has joined #openstack-keystone | 09:34 | |
| *** davechen has left #openstack-keystone | 09:37 | |
| *** breton has quit IRC | 09:39 | |
| *** ParsectiX has quit IRC | 09:40 | |
| *** exploreshaifali has joined #openstack-keystone | 09:43 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Policy rule name spacing via catalog https://review.openstack.org/237743 | 09:49 |
| *** nisha has quit IRC | 09:52 | |
| *** fawadkhaliq has quit IRC | 09:53 | |
| *** roxanagh_ has joined #openstack-keystone | 09:54 | |
| *** roxanagh_ has quit IRC | 09:58 | |
| *** bigjools has quit IRC | 10:04 | |
| *** lhcheng has joined #openstack-keystone | 10:07 | |
| *** ChanServ sets mode: +v lhcheng | 10:07 | |
| *** fhubik is now known as fhubik_brb | 10:08 | |
| *** lhcheng has quit IRC | 10:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:13 | |
| *** mylu has joined #openstack-keystone | 10:13 | |
| *** bigjools has joined #openstack-keystone | 10:16 | |
| *** bigjools has quit IRC | 10:16 | |
| *** bigjools has joined #openstack-keystone | 10:16 | |
| *** mylu has quit IRC | 10:17 | |
| *** flaper87 has quit IRC | 10:29 | |
| *** ajaya has quit IRC | 10:30 | |
| *** EinstCrazy has quit IRC | 10:33 | |
| *** dims has joined #openstack-keystone | 10:34 | |
| *** EinstCrazy has joined #openstack-keystone | 10:34 | |
| *** flaper87 has joined #openstack-keystone | 10:35 | |
| *** flaper87 has quit IRC | 10:35 | |
| *** flaper87 has joined #openstack-keystone | 10:35 | |
| *** fawadkhaliq has quit IRC | 10:35 | |
| *** stevemar_ has joined #openstack-keystone | 10:35 | |
| *** ChanServ sets mode: +o stevemar_ | 10:35 | |
| *** stevemar_ has quit IRC | 10:38 | |
| *** topol has joined #openstack-keystone | 10:41 | |
| *** ChanServ sets mode: +v topol | 10:41 | |
| *** links has quit IRC | 10:41 | |
| *** topol has quit IRC | 10:45 | |
| *** topol has joined #openstack-keystone | 10:45 | |
| *** ChanServ sets mode: +v topol | 10:45 | |
| *** roxanagh_ has joined #openstack-keystone | 10:55 | |
| *** roxanagh_ has quit IRC | 10:59 | |
| *** links has joined #openstack-keystone | 10:59 | |
| *** tyagiprince2010 has quit IRC | 11:00 | |
| *** breton has joined #openstack-keystone | 11:03 | |
| samueldmq | morning | 11:05 |
| *** ajaya has joined #openstack-keystone | 11:05 | |
| *** tyagiprince2010 has joined #openstack-keystone | 11:06 | |
| *** fhubik_brb is now known as fhubik | 11:10 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:10 | |
| *** henrynash has quit IRC | 11:16 | |
| *** EinstCrazy has quit IRC | 11:16 | |
| *** ajaya has quit IRC | 11:16 | |
| *** tyagiprince2010 has quit IRC | 11:19 | |
| *** doug-fish has joined #openstack-keystone | 11:20 | |
| *** aix has quit IRC | 11:24 | |
| *** pnavarro|off has quit IRC | 11:25 | |
| *** ajaya has joined #openstack-keystone | 11:30 | |
| *** e0ne has quit IRC | 11:37 | |
| *** exploreshaifali has quit IRC | 11:38 | |
| *** fawadkhaliq has quit IRC | 11:40 | |
| *** EinstCrazy has joined #openstack-keystone | 11:42 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/python-keystoneclient: Fix token lock race condition https://review.openstack.org/238001 | 11:42 |
| *** gordc has joined #openstack-keystone | 11:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:50 | |
| *** breton has quit IRC | 11:50 | |
| *** amakarov_away is now known as amakarov | 11:51 | |
| *** ParsectiX has joined #openstack-keystone | 11:52 | |
| *** Nirupama has quit IRC | 11:52 | |
| *** e0ne has joined #openstack-keystone | 11:54 | |
| *** roxanagh_ has joined #openstack-keystone | 11:55 | |
| *** fawadkhaliq has quit IRC | 11:55 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:56 | |
| *** dikonoor has joined #openstack-keystone | 11:57 | |
| *** arunkant has quit IRC | 11:57 | |
| *** ajaya has quit IRC | 11:58 | |
| *** EinstCrazy has quit IRC | 11:59 | |
| *** roxanagh_ has quit IRC | 11:59 | |
| *** aix has joined #openstack-keystone | 12:01 | |
| *** bdossant has joined #openstack-keystone | 12:01 | |
| *** Ephur has joined #openstack-keystone | 12:01 | |
| *** ajaya has joined #openstack-keystone | 12:02 | |
| odyssey4me | hmm, has anyone noticed that the 'project source' link on http://docs.openstack.org/developer/keystone/ has an extra '/p' in the URL | 12:04 |
| *** fawadkhaliq has quit IRC | 12:04 | |
| *** Ephur has quit IRC | 12:06 | |
| openstackgerrit | Mehdi Abaakouk (sileht) proposed openstack/python-keystoneclient: Fix token lock race condition https://review.openstack.org/238001 | 12:07 |
| *** breton has joined #openstack-keystone | 12:14 | |
| *** openstackgerrit has quit IRC | 12:16 | |
| *** openstackgerrit has joined #openstack-keystone | 12:17 | |
| *** arunkant has joined #openstack-keystone | 12:28 | |
| *** pnavarro|off has joined #openstack-keystone | 12:31 | |
| *** NM has joined #openstack-keystone | 12:33 | |
| *** markvoelker has joined #openstack-keystone | 12:35 | |
| *** edmondsw has joined #openstack-keystone | 12:35 | |
| *** breton has quit IRC | 12:38 | |
| *** boris-42 has quit IRC | 12:38 | |
| samueldmq | odyssey4me: hey | 12:40 |
| odyssey4me | hiya samueldmq | 12:40 |
| samueldmq | odyssey4me: yes that's true | 12:41 |
| samueldmq | odyssey4me: wanna fix ? | 12:41 |
| odyssey4me | samueldmq sure - it seems to be a problem for all projects | 12:41 |
| samueldmq | odyssey4me: hm something from the template ? | 12:41 |
| *** henrynash has joined #openstack-keystone | 12:41 | |
| *** ChanServ sets mode: +v henrynash | 12:41 | |
| odyssey4me | samueldmq yep, but the only template I can find is the new one for docs: https://github.com/openstack/openstackdocstheme | 12:42 |
| odyssey4me | it's the one for the manuals, which I'm not sure that the projects can use | 12:42 |
| samueldmq | odyssey4me: http://lists.openstack.org/pipermail/openstack-dev/2015-October/077229.html | 12:44 |
| odyssey4me | samueldmq nice find! | 12:46 |
| odyssey4me | samueldmq ah, it looks like it merged yesterday: https://review.openstack.org/#36091 | 12:49 |
| odyssey4me | whoops: https://review.openstack.org/236091 | 12:49 |
| *** ajaya has quit IRC | 12:49 | |
| samueldmq | odyssey4me: yes :) | 12:50 |
| samueldmq | odyssey4me: that looks to add a new option to let individual projetcs to set their link | 12:50 |
| odyssey4me | samueldmq yep, lemme smash up a review | 12:51 |
| samueldmq | odyssey4me: ++ | 12:51 |
| *** richm has joined #openstack-keystone | 12:53 | |
| *** roxanagh_ has joined #openstack-keystone | 12:56 | |
| openstackgerrit | Jesse Pretorius proposed openstack/keystone: Add theme fix for browsable source code https://review.openstack.org/238047 | 12:59 |
| odyssey4me | samueldmq ^ | 13:00 |
| *** roxanagh_ has quit IRC | 13:01 | |
| samueldmq | odyssey4me: nice, I wonder why we keep guessing, if it's wrong for most of projects ? | 13:02 |
| odyssey4me | samueldmq it doesn't seem to work in a local build - looks like it needs more work | 13:02 |
| samueldmq | dhellmann: ping - about https://review.openstack.org/#/c/236091/ | 13:03 |
| *** breton has joined #openstack-keystone | 13:03 | |
| *** stevemar_ has joined #openstack-keystone | 13:03 | |
| *** ChanServ sets mode: +o stevemar_ | 13:03 | |
| *** petertr7_away is now known as petertr7 | 13:04 | |
| odyssey4me | samueldmq oh, it seems that the local build renders differently | 13:05 |
| odyssey4me | see https://review.openstack.org/238042 as an example | 13:05 |
| odyssey4me | maybe it's my tox venv | 13:06 |
| *** stevemar_ has quit IRC | 13:07 | |
| samueldmq | odyssey4me: try tox with -r to recreate it | 13:07 |
| *** stevemar_ has joined #openstack-keystone | 13:09 | |
| *** ChanServ sets mode: +o stevemar_ | 13:09 | |
| samueldmq | odyssey4me: I am trying it too | 13:09 |
| *** stevemar_ has quit IRC | 13:12 | |
| samueldmq | odyssey4me: that's weird, now it's linking to http://git.openstack.org/cgit/openstack/keystone.git | 13:17 |
| *** stevemar_ has joined #openstack-keystone | 13:17 | |
| *** ChanServ sets mode: +o stevemar_ | 13:17 | |
| samueldmq | odyssey4me: I don't know where that .git came from | 13:17 |
| odyssey4me | hmm, odd | 13:18 |
| *** kiran-r has joined #openstack-keystone | 13:21 | |
| *** nisha has joined #openstack-keystone | 13:22 | |
| *** ParsectiX has quit IRC | 13:25 | |
| openstackgerrit | Jesse Pretorius proposed openstack/keystone: Add theme fix for browsable source code https://review.openstack.org/238047 | 13:28 |
| *** kiran-r has quit IRC | 13:30 | |
| *** bill_az has joined #openstack-keystone | 13:30 | |
| marekd | dolphm: LOL, don't scare stevemar_ and let him do his thing :P | 13:40 |
| stevemar_ | marekd: uh oh? | 13:40 |
| marekd | stevemar_: nothing :-) | 13:40 |
| dolphm | stevemar_: don't worry about it | 13:41 |
| stevemar_ | dolphm: you scamp | 13:41 |
| dolphm | stevemar_: gate breaking critical bug, no biggie | 13:41 |
| lbragstad | stevemar_ move along, nothing to see here... move along | 13:41 |
| stevemar_ | lbragstad: dolphm keynote starts in 20 minutes, plenty of time | 13:42 |
| marekd | stevemar_: where are you keynoting? | 13:42 |
| stevemar_ | marekd: i'm at the last row watching the keynote | 13:42 |
| odyssey4me | samueldmq I dunno if you saw the -infra discussion | 13:42 |
| stevemar_ | hiding in the back like an outcast | 13:42 |
| marekd | stevemar_: what's the conf ? | 13:43 |
| odyssey4me | the fix is not yet in a tagged version of oslosphinx, so this should work right once the next tag is done | 13:43 |
| dolphm | Enterprise Risk Management for Corporate Counsel conference? it's the only one i can find in toronto today | 13:43 |
| stevemar_ | marekd: small local one, mostly ibm'ers, only 100 or so folk | 13:43 |
| samueldmq | odyssey4me: nice, so once it's released we should be okay with tht | 13:43 |
| odyssey4me | samueldmq yep | 13:43 |
| samueldmq | odyssey4me: will that remove the .git at the end ? or fix everything automatically , | 13:44 |
| *** ParsectiX has joined #openstack-keystone | 13:44 | |
| samueldmq | odyssey4me: ? | 13:44 |
| odyssey4me | samueldmq it'll set it to the configured URL - whatever that value is... | 13:44 |
| odyssey4me | what you're seeing is the 'guesswork' | 13:44 |
| dolphm | stevemar_: that just sounds like a meeting | 13:44 |
| stevemar_ | dolphm: lol | 13:44 |
| samueldmq | odyssey4me: I am still not convinced why we can't just guess right .. where the guess fits most of the projects | 13:44 |
| stevemar_ | dolphm: most of our meetings are <100 :P | 13:45 |
| lbragstad | "most" | 13:45 |
| dolphm | lbragstad: ++ | 13:45 |
| *** dims has quit IRC | 13:45 | |
| *** ParsectiX has quit IRC | 13:46 | |
| *** dims has joined #openstack-keystone | 13:46 | |
| *** ParsectiX has joined #openstack-keystone | 13:46 | |
| *** nisha_ has joined #openstack-keystone | 13:46 | |
| *** petertr7 is now known as petertr7_away | 13:46 | |
| *** nisha has quit IRC | 13:47 | |
| *** nisha_ is now known as nisha | 13:47 | |
| odyssey4me | samueldmq you'll see in the review that fungi suggested some additional changes which would likely work, but the review was pushed through | 13:47 |
| *** jsavak has joined #openstack-keystone | 13:48 | |
| *** erhudy has joined #openstack-keystone | 13:48 | |
| samueldmq | odyssey4me: okay, it'd be nicer if we could fix eveyone in a shot :) | 13:50 |
| amakarov | bknudson, hi! Can you please suggest me what to do with this test? https://review.openstack.org/#/c/222173/6/keystone/tests/unit/test_kvs.py,cm | 13:53 |
| samueldmq | amakarov: oh gerrit ahs a new interface now o/ | 13:54 |
| *** stevemar_ has quit IRC | 13:54 | |
| *** petertr7_away is now known as petertr7 | 13:54 | |
| amakarov | I don't know any simple way to expose a race condition and I'm stuck with a question "if there is a need for this test?" | 13:54 |
| samueldmq | amakarov: ah no, it was just the ,cm at the end :) | 13:55 |
| amakarov | samueldmq, :) | 13:55 |
| samueldmq | amakarov: you going to attend the summit , | 13:55 |
| amakarov | samueldmq, what tests do you usually provide to expose a race condition? | 13:55 |
| amakarov | sudorandom, yes | 13:56 |
| amakarov | samueldmq, yes | 13:56 |
| amakarov | sudorandom, sorry, tab failed me :) | 13:56 |
| *** roxanagh_ has joined #openstack-keystone | 13:57 | |
| samueldmq | amakarov:I think in that case bknudson is suggesting you to remove the if statement | 13:57 |
| samueldmq | amakarov: and assertFalse(store.is_configured) before pursuing with the test | 13:58 |
| amakarov | samueldmq, that I understand, but the test itself is weird :) | 13:58 |
| amakarov | its result doesn't depend on the fact the issue was fixed | 13:59 |
| amakarov | samueldmq, it just shows what happens in race condition - a comment about it is enough | 14:00 |
| amakarov | samueldmq, I'm not sure this test is worthy to remain there | 14:00 |
| *** roxanagh_ has quit IRC | 14:01 | |
| *** henrynash has quit IRC | 14:01 | |
| *** zqfan is now known as zqfan_afk | 14:02 | |
| dstanek | dolphm: our use of locking at all there seem hokey | 14:02 |
| *** e0ne has quit IRC | 14:03 | |
| *** tristanC has quit IRC | 14:07 | |
| *** jongchoi has joined #openstack-keystone | 14:08 | |
| *** ParsectiX has quit IRC | 14:09 | |
| samueldmq | amakarov: so that kvs.get_key_value_store('token-driver') returns the same obj for both threads | 14:10 |
| samueldmq | amakarov: but configure can only be called once, that's why the lock there, right ? | 14:10 |
| amakarov | samueldmq, right | 14:10 |
| *** pumaranikar has joined #openstack-keystone | 14:13 | |
| *** henrynash has joined #openstack-keystone | 14:14 | |
| *** ChanServ sets mode: +v henrynash | 14:14 | |
| *** nkinder has quit IRC | 14:14 | |
| *** csoukup has joined #openstack-keystone | 14:16 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move region configuration to a critical section https://review.openstack.org/222173 | 14:18 |
| amakarov | samueldmq, ^^ | 14:18 |
| amakarov | samueldmq, have you ment something like this? | 14:19 |
| *** diazjf has joined #openstack-keystone | 14:19 | |
| samueldmq | amakarov: yep | 14:20 |
| amakarov | samueldmq, will you be in Tokyo? | 14:21 |
| samueldmq | amakarov: yep, travelling tomorrow night, arriving Saturady afternoon | 14:22 |
| samueldmq | amakarov: long travel | 14:22 |
| amakarov | samueldmq, very long | 14:23 |
| *** raildo-afk is now known as raildo | 14:26 | |
| *** tonytan4ever has joined #openstack-keystone | 14:27 | |
| samueldmq | amakarov: so .. in a single patch you wanna expose the race condition and fix it | 14:28 |
| samueldmq | amakarov: one of both will fail: your fix or your test :) | 14:28 |
| *** jongchoi has quit IRC | 14:28 | |
| *** ankurgupta has joined #openstack-keystone | 14:28 | |
| samueldmq | gotta run now, will be back soon | 14:28 |
| samueldmq | amakarov: nvm, you called get_key_value_store directly | 14:30 |
| *** njohnston is now known as nate_gone | 14:32 | |
| *** nate_gone is now known as njohnston | 14:34 | |
| *** sseago has quit IRC | 14:36 | |
| *** su_zhang has joined #openstack-keystone | 14:37 | |
| dolphm | dstanek: agree with your comment on https://review.openstack.org/#/c/238001/ but did you see the (brief) explanation in the commit message? | 14:38 |
| *** slberger has joined #openstack-keystone | 14:39 | |
| *** phalmos has joined #openstack-keystone | 14:41 | |
| *** su_zhang has quit IRC | 14:42 | |
| dstanek | dolphm: yes, im trying to look for what the side effects might be of doing this | 14:45 |
| dolphm | dstanek: i'm looking for an easy refactor to let it release the lock between retries - perhaps raise an exception somewhere and break out of the context manager | 14:47 |
| dstanek | dolphm: for example, is the 401 retry thing mentioned in the commit message bounded and are there other cases where the recursion can now happen | 14:47 |
| dolphm | ah | 14:47 |
| *** jaosorior has quit IRC | 14:47 | |
| dolphm | dstanek: where recursion can now happen *because* the lock is reentrant? | 14:48 |
| *** jaosorior has joined #openstack-keystone | 14:48 | |
| dstanek | the lock originally said "only do this once" and with a single character change we've changed to code semantics; add in the multithreading aspect and you have me nervous | 14:48 |
| dstanek | dolphm: even if your refactor didn't release the lock, if it just cut down the recursion | 14:50 |
| *** links has quit IRC | 14:50 | |
| dstanek | dolphm: it seems there isn't good layering here; what should be the most inner layer (doing the auth) is calling the out layer (the thing doing the orchestration | 14:51 |
| dstanek | feels like the abstraction is either messed up or missing | 14:51 |
| dolphm | dstanek: .... yes. | 14:51 |
| dolphm | that. | 14:51 |
| dstanek | dolphm: are you working on a refactor patch as a replacement for that one? | 14:51 |
| dolphm | dstanek: just shopping for one right now | 14:52 |
| *** pnavarro|off has quit IRC | 14:52 | |
| *** petertr7 is now known as petertr7_away | 14:53 | |
| *** stevemar_ has joined #openstack-keystone | 14:55 | |
| *** ChanServ sets mode: +o stevemar_ | 14:55 | |
| *** stevemar_ has quit IRC | 14:56 | |
| *** e0ne has joined #openstack-keystone | 14:56 | |
| *** roxanagh_ has joined #openstack-keystone | 14:58 | |
| *** su_zhang has joined #openstack-keystone | 14:58 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:58 | |
| *** stevemar_ has joined #openstack-keystone | 14:59 | |
| *** ChanServ sets mode: +o stevemar_ | 14:59 | |
| *** alejandrito has joined #openstack-keystone | 15:01 | |
| *** nisha has quit IRC | 15:02 | |
| *** alejandrito has quit IRC | 15:02 | |
| *** alejandrito has joined #openstack-keystone | 15:02 | |
| *** roxanagh_ has quit IRC | 15:02 | |
| *** f13o has joined #openstack-keystone | 15:03 | |
| *** phalmos has quit IRC | 15:04 | |
| *** fawadkhaliq has quit IRC | 15:04 | |
| *** roxanagh_ has joined #openstack-keystone | 15:12 | |
| *** tirc has joined #openstack-keystone | 15:12 | |
| *** stevema__ has joined #openstack-keystone | 15:13 | |
| *** ChanServ sets mode: +o stevema__ | 15:13 | |
| *** phalmos has joined #openstack-keystone | 15:14 | |
| *** stevemar_ has quit IRC | 15:16 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:17 | |
| *** EinstCrazy has joined #openstack-keystone | 15:17 | |
| *** fawadkhaliq has quit IRC | 15:17 | |
| *** Ephur has joined #openstack-keystone | 15:17 | |
| *** urulama has quit IRC | 15:21 | |
| *** urulama has joined #openstack-keystone | 15:22 | |
| *** bdossant has quit IRC | 15:23 | |
| *** roxanagh_ has quit IRC | 15:27 | |
| *** dims_ has joined #openstack-keystone | 15:31 | |
| *** annasort has joined #openstack-keystone | 15:32 | |
| *** lhcheng has joined #openstack-keystone | 15:33 | |
| *** ChanServ sets mode: +v lhcheng | 15:33 | |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: pass on @abc.abstractmethods https://review.openstack.org/238142 | 15:33 |
| *** dims has quit IRC | 15:35 | |
| openstackgerrit | Dolph Mathews proposed openstack/python-keystoneclient: Docstring spelling and function-vs-method fixes https://review.openstack.org/238144 | 15:39 |
| dolphm | dstanek: poke me if you have a patch - i tossed up the random crap i came across and am moving on ^ | 15:42 |
| *** EinstCrazy has quit IRC | 15:42 | |
| dolphm | (i'm fine with RLock unless plugins are doing something crazy) | 15:43 |
| *** jsavak has quit IRC | 15:46 | |
| dstanek | dolphm: i've been poking at it, but i'm not sure how i can test it yet. | 15:46 |
| *** jsavak has joined #openstack-keystone | 15:47 | |
| dolphm | dstanek: that too. i'm not sure it's reasonable to demand a test as part of this patch, considering there aren't any tests for lcoks already. | 15:48 |
| *** petertr7_away is now known as petertr7 | 15:50 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:53 | |
| *** EinstCrazy has joined #openstack-keystone | 15:53 | |
| *** fawadk has joined #openstack-keystone | 15:55 | |
| *** fawadkhaliq has quit IRC | 15:56 | |
| *** stevema__ has quit IRC | 16:00 | |
| *** sseago has joined #openstack-keystone | 16:01 | |
| *** fhubik has quit IRC | 16:01 | |
| *** exploreshaifali has joined #openstack-keystone | 16:05 | |
| *** jistr has quit IRC | 16:08 | |
| *** john5223 is now known as zz_john5223 | 16:09 | |
| *** EinstCrazy has quit IRC | 16:11 | |
| *** petertr7 is now known as petertr7_away | 16:13 | |
| *** tirc` has joined #openstack-keystone | 16:13 | |
| *** tirc has quit IRC | 16:13 | |
| *** e0ne has quit IRC | 16:16 | |
| ayoung | dolphm, You originally wrote this; still think it is the right approach? https://blueprints.launchpad.net/keystone/+spec/service-scoped-tokens | 16:16 |
| *** e0ne has joined #openstack-keystone | 16:17 | |
| *** su_zhang has quit IRC | 16:17 | |
| *** sseago has quit IRC | 16:17 | |
| *** slberger has quit IRC | 16:17 | |
| *** dikonoor has quit IRC | 16:17 | |
| *** sseago has joined #openstack-keystone | 16:17 | |
| *** EinstCrazy has joined #openstack-keystone | 16:18 | |
| *** slberger has joined #openstack-keystone | 16:21 | |
| dolphm | ayoung: kind of. depends on how you define a "service", or the boundaries between similar "services" | 16:24 |
| *** sseago has quit IRC | 16:24 | |
| dolphm | ayoung: i.e. does having a role on "compute" mean you have a role on "compute" in both regions of a deployment? does having a role on "compute" mean you can consume that role on both the public endpoint and the admin endpoint? what if you have two versions of the same service deployed? | 16:25 |
| dolphm | etc | 16:25 |
| ayoung | dolphm, HMT based on the service catalog would let us vary | 16:25 |
| ayoung | dolphm, I would assume the simple case is assign role to user on "catalog" gets everything. For more real production deplioyments, assign role on the endpoints | 16:26 |
| dolphm | if you do role assignments on service IDs, i think you give the deployer a lot of flexibility in how they structure their catalog and how they assign service roles, but *shrug* | 16:26 |
| ayoung | I think role on compute is the same for public and admin | 16:26 |
| dolphm | ayoung: then that's a role on the service, not the endpoint? | 16:27 |
| *** petertr7_away is now known as petertr7 | 16:27 | |
| ayoung | dolphm, right...use the same rules as we do for HMT now, with catalog->services->endpoints | 16:27 |
| dolphm | i haven't followed HMT enough to know what you're talking about at all :-/ | 16:28 |
| ayoung | so you *could* do it all the way to the endpoint if that makes sense: dev team can destroy their own Nova and neutron servers, | 16:28 |
| ayoung | dolphm, on a role assignment, you specify if it is to be inherited. If it is, you can get a token scoped to any of the child nodes | 16:28 |
| ayoung | so if proj1 has childred p2 and p3 and p2 has p4 etc | 16:29 |
| ayoung | _member_ on proj1 means _member on p2, p3 ,p4 | 16:29 |
| ayoung | You still need to ask for a token scoped to p2 to get that role | 16:30 |
| *** sseago has joined #openstack-keystone | 16:31 | |
| bknudson | in what case does session.post() call BaseIdentityPlugin.invalidate()? | 16:31 |
| ayoung | dolphm, so, there are two ways we could implement this. One is that we add a new set of targets in the role assignment table. The other is that we treat the service catalog as a "read-only" backend for "resource" | 16:31 |
| *** jasonsb has quit IRC | 16:32 | |
| ayoung | essentially, saying that "if you create a service or endpoint, you are creating a project with the same id" | 16:32 |
| ayoung | pros and cons to each method | 16:32 |
| ayoung | I think the "every catalog item is a project" approach breaks fewer things. | 16:32 |
| bknudson | maybe there's something we can do to reset the session auth first rather than have to make the lock reentrant | 16:33 |
| *** c_soukup has joined #openstack-keystone | 16:34 | |
| *** dims_ has quit IRC | 16:36 | |
| *** stevemar_ has joined #openstack-keystone | 16:36 | |
| *** ChanServ sets mode: +o stevemar_ | 16:36 | |
| *** dims has joined #openstack-keystone | 16:36 | |
| dolphm | ayoung: i don't think we should be conflating services with projects | 16:38 |
| *** exploreshaifali has quit IRC | 16:38 | |
| *** csoukup has quit IRC | 16:38 | |
| *** doug-fish has quit IRC | 16:40 | |
| *** doug-fish has joined #openstack-keystone | 16:41 | |
| *** stevemar_ has quit IRC | 16:41 | |
| *** EinstCrazy has quit IRC | 16:41 | |
| *** roxanagh_ has joined #openstack-keystone | 16:42 | |
| *** gyee has joined #openstack-keystone | 16:45 | |
| *** ChanServ sets mode: +v gyee | 16:45 | |
| *** doug-fish has quit IRC | 16:45 | |
| *** roxanagh_ has quit IRC | 16:46 | |
| openstackgerrit | Kent Wang proposed openstack/keystone: Add schema validation to fix v2 code error returns https://review.openstack.org/238160 | 16:47 |
| *** roxanagh_ has joined #openstack-keystone | 16:48 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Address hacking check H405. https://review.openstack.org/238161 | 16:49 |
| *** jaosorior has quit IRC | 16:50 | |
| *** jaosorior has joined #openstack-keystone | 16:50 | |
| *** diazjf has quit IRC | 16:50 | |
| *** petertr7 is now known as petertr7_away | 16:52 | |
| *** doug-fish has joined #openstack-keystone | 16:56 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation migration https://review.openstack.org/237047 | 16:56 |
| *** tirc` has quit IRC | 16:57 | |
| *** zigo_ has quit IRC | 16:59 | |
| *** zigo has joined #openstack-keystone | 17:00 | |
| *** jsavak has quit IRC | 17:01 | |
| *** tsymanczyk has joined #openstack-keystone | 17:04 | |
| *** tsymanczyk is now known as Guest16451 | 17:04 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Unified delegation spec https://review.openstack.org/189816 | 17:06 |
| *** tsymancz4k has joined #openstack-keystone | 17:09 | |
| *** su_zhang has joined #openstack-keystone | 17:12 | |
| *** tirc` has joined #openstack-keystone | 17:17 | |
| *** haneef has quit IRC | 17:18 | |
| *** shaleh has joined #openstack-keystone | 17:22 | |
| *** tirc` has quit IRC | 17:23 | |
| *** kfox1111 has quit IRC | 17:25 | |
| *** kfox1111 has joined #openstack-keystone | 17:26 | |
| *** ajaya has joined #openstack-keystone | 17:27 | |
| *** jasonsb has joined #openstack-keystone | 17:28 | |
| *** sseago has quit IRC | 17:29 | |
| *** shadower has quit IRC | 17:29 | |
| *** ajaya has quit IRC | 17:32 | |
| *** stevemar_ has joined #openstack-keystone | 17:32 | |
| *** ChanServ sets mode: +o stevemar_ | 17:32 | |
| *** njohnston is now known as nate_gone | 17:34 | |
| *** henrynash has quit IRC | 17:37 | |
| *** exploreshaifali has joined #openstack-keystone | 17:40 | |
| *** zqfan_afk is now known as zqfan | 17:42 | |
| morgan | dolphm: I agree, I don't like project <-> service conflation | 17:43 |
| *** nate_gone is now known as njohnston | 17:45 | |
| *** brad[] has quit IRC | 17:48 | |
| *** brad[] has joined #openstack-keystone | 17:48 | |
| *** e0ne has quit IRC | 17:49 | |
| *** roxanag__ has joined #openstack-keystone | 17:50 | |
| *** roxanagh_ has quit IRC | 17:50 | |
| ayoung | morgan, no one is allowed to say "No" to my suggestions without at least offering an alternative. | 17:52 |
| *** exploreshaifali has quit IRC | 17:53 | |
| ayoung | Otherwise, we suffer gridlock | 17:53 |
| ayoung | so...please tell me what you would prefer. Otherwise I can't make progress. | 17:53 |
| ayoung | morgan, dolphm are you saying you would rather have endpoint as a scope in tokens? | 17:54 |
| ayoung | We can do that, it just requires more work. It changes Horizon and all the client calls as well as authtoken, and the remote service policy files | 17:54 |
| dolphm | ayoung: i don't always know the solution to a problem | 17:55 |
| ayoung | dolphm, I thought you had a good start ion it with the BP | 17:55 |
| ayoung | dolphm, sorry to come across so harsh. I know you are working lots of different issues. | 17:56 |
| dolphm | ayoung: it's still only a potential solution meant for discussion, and it's not completely thought through, obviously | 17:57 |
| *** harlowja has quit IRC | 17:57 | |
| morgan | ayoung: I am not saying "no" I was saying I don't like it | 17:57 |
| ayoung | dolphm, I kindof like the abstraction that "everything is a project" | 17:57 |
| morgan | ayoung: if that is the best option, I wouldn't block it | 17:57 |
| ayoung | it means that we use the same name of things for all remote labels. | 17:57 |
| ayoung | er | 17:57 |
| ayoung | remote resources | 17:57 |
| ayoung | local ones too, except for domains | 17:57 |
| *** stevemar_ has quit IRC | 17:58 | |
| ayoung | It does have some weirdness, in that you could then use catalog item-backed projects to do things other than service level operations. jamielennox|away was commenting on that the other night. | 17:58 |
| shaleh | running projects a long way from tenants and user expectations are you? | 17:58 |
| ayoung | shaleh, me? | 17:59 |
| ayoung | I am actually trying to go along with admins expectations here. This is "the path of least resisitance" approach | 17:59 |
| dolphm | ayoung: but a project has been traditionally defined as a container for tenant-owned resources. services have never been owned by tenants, they're owned by the operator and serve multiple tenants | 17:59 |
| shaleh | ++ dolphm | 18:00 |
| ayoung | dolphm, right. The origianly view of roles is that they were global. I did some git tracing to see when that changed, and I think it was before they started committing to the python Keystone git repo. Scoped roles are in Keystone Light | 18:00 |
| *** diazjf has joined #openstack-keystone | 18:01 | |
| ayoung | dolphm, and operations on services were expected to use that unscoped admin role. | 18:01 |
| morgan | non-scoped (global) roles did have a comment at one point saying "no we don't do this" | 18:01 |
| morgan | but it wasn't clear why that choice was made | 18:01 |
| morgan | we could easily support a global role again if desired. | 18:01 |
| *** harlowja has joined #openstack-keystone | 18:02 | |
| *** slberger has quit IRC | 18:02 | |
| morgan | and I think the impact to horizon here would be minimal | 18:02 |
| * morgan shrugs. | 18:02 | |
| *** slberger has joined #openstack-keystone | 18:02 | |
| ayoung | morgan, not sure that is true. Getting horizon to deal with Domains was already painful | 18:02 |
| *** dims has quit IRC | 18:03 | |
| morgan | ayoung: nah, i don't think a global role would be a hard change. domains are much further reaching | 18:03 |
| ayoung | morgan, is that the direction you want to go? | 18:04 |
| morgan | but like i said, i wouldn't block service-is-a-project if we don't have another option. I would prefer another option | 18:04 |
| ayoung | Or are you just brainstorming? | 18:04 |
| morgan | but I don't have a solid answer.. more brainstorming | 18:04 |
| *** dims has joined #openstack-keystone | 18:04 | |
| bknudson | I wasn't able to recreate https://bugs.launchpad.net/python-keystoneclient/+bug/1508424 in a unit test using any of our plugins. | 18:04 |
| openstack | Launchpad bug 1508424 in python-keystoneclient "BaseIdentityPlugin.get_access hang" [High,In progress] - Assigned to Mehdi Abaakouk (sileht) | 18:04 |
| shaleh | so now i need to glue multiple projects together to get nova + neutron + cinder working? | 18:05 |
| shaleh | why are you not using regions for this? | 18:05 |
| ayoung | morgan, so project or not, I think we want to scope the role assignments to catalog items. That meets gyee 's repeated request to be able to distinguish between admins for different services and endpoints | 18:05 |
| ayoung | shaleh, regions are service catalog constructs and are also available as things that can have roles assigned under this proposal | 18:06 |
| ayoung | shaleh, so, yes, regions, too, just need to be clear on the ordering between regions and services in the hierarchy | 18:06 |
| shaleh | so why push all the way to project == service? | 18:06 |
| shaleh | regions with proper endpoint filtering (once all of the movement settles) seems to get you there | 18:06 |
| *** lsmola_ has quit IRC | 18:07 | |
| ayoung | shaleh, so you are suggesting limiting it to regionw <-> project? | 18:07 |
| ayoung | Endpoints don't kniow what region they are in right now | 18:07 |
| ayoung | All an endpoint knows is its URL, and even that is somewhat problematic | 18:08 |
| ayoung | we need to map from URL to endpoint id. Region would be an additional layer of mapping. Possible, though | 18:08 |
| shaleh | then why are all of the unit tests embedding regions in the endpoint refs? | 18:08 |
| *** henrynash has joined #openstack-keystone | 18:08 | |
| *** ChanServ sets mode: +v henrynash | 18:08 | |
| shaleh | clearly something knows the mapping | 18:08 |
| *** stevephone has joined #openstack-keystone | 18:08 | |
| ayoung | shaleh, unit tests are different from services deployed | 18:08 |
| stevephone | o/ | 18:09 |
| ayoung | shaleh, so, the test code knows the mapping | 18:09 |
| shaleh | OSC does too, I say endpoint --region foo | 18:09 |
| bknudson | stevephone: still no znc? | 18:09 |
| *** tqtran has joined #openstack-keystone | 18:10 | |
| ayoung | shaleh, so...this is one reason I would say l;ets map things to projects. It keeps us from having to update everything when we decide to use yet another abstraction as a scope for RBAC | 18:11 |
| openstackgerrit | Merged openstack/python-keystoneclient: pass on @abc.abstractmethods https://review.openstack.org/238142 | 18:11 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation driver https://review.openstack.org/209600 | 18:12 |
| ayoung | right now, the only scope Nova has to worry about is project scope. We could add an endpoint scope on there, and a project, and a region, and so on, but think what the policy to enforce that would look like | 18:12 |
| shaleh | but multiple projects could be using the same endpoint right? | 18:12 |
| *** aix has quit IRC | 18:12 | |
| ayoung | shaleh, ah...not for this...let me clarify | 18:12 |
| stevephone | bknudson, not yet, part way through the configuration | 18:12 |
| ayoung | shaleh, this is only for endpoint scoped operations. Not for projects that end users work with. | 18:13 |
| shaleh | what is "endpoint scoped"? | 18:13 |
| ayoung | shaleh, I wrote it up clearer here: http://adam.younglogic.com/2015/10/admin/ | 18:13 |
| ayoung | Its on the mailing list, too | 18:13 |
| *** henrynash has quit IRC | 18:13 | |
| shaleh | k, I have not drank from the firehouse this morning :-) | 18:13 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation driver https://review.openstack.org/209600 | 18:15 |
| *** topol has quit IRC | 18:15 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Limit subtree and parents queries https://review.openstack.org/209132 | 18:16 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restrict inherited role assignments to subdomains https://review.openstack.org/164180 | 18:16 |
| *** petertr7_away is now known as petertr7 | 18:16 | |
| gyee | ayoung, I am all for endpoint scoping and admin segregations, no argument here :) | 18:17 |
| ayoung | gyee, yeah. Did you get a chance to read that? Any thought on how to expose the catalog information in the token? | 18:18 |
| gyee | you don't need to | 18:19 |
| shaleh | I like admin segration for sure. | 18:19 |
| shaleh | just not sold on the other part | 18:19 |
| gyee | GET /v3/auth/tokens?endpoint_id=xxx | 18:19 |
| gyee | if token is not scoped to the given endpoint, reject it | 18:19 |
| shaleh | So as an admin I would need to auth to each service I wanted to work on? | 18:20 |
| shaleh | Would there be a way to let me admin nova + cinder simulatenously but not neutron? | 18:20 |
| ayoung | gyee, " token is not scoped to the given endpoint" | 18:21 |
| ayoung | shaleh, not in the first pass. You could have role assignments for each, but the token would be scoped to the endpoint | 18:22 |
| ayoung | shaleh, why would you need a token scoped to both nova and cinder for an admin operation? | 18:22 |
| raildo | ayoung: whereas v2 will be deprecated, keystone still accepting bug fixes only to v2 or they are considered "invalid"? | 18:22 |
| gyee | ayoung, so there are two ways we can enforce endpoint binding | 18:22 |
| shaleh | why would i want to auth twice and switch between tokens? | 18:23 |
| ayoung | raildo, depends on how serious | 18:23 |
| gyee | 1) at the middleware by examing the SC | 18:23 |
| gyee | 2) at the server during token validation | 18:23 |
| ayoung | gyee, not binding | 18:23 |
| morgan | raildo: v2 bug fixes for security issues: absolutely accepted | 18:23 |
| ayoung | this is separate from "this token can only be used on the endpoiitn" | 18:23 |
| morgan | raildo: v2 minor issues - nope | 18:23 |
| ayoung | this means "this token is for admin operations on the endpoint" | 18:23 |
| ayoung | your binding stuff would still be usable by normal users | 18:23 |
| raildo | morgan: ayoung, ok, got it, thanks :) | 18:23 |
| morgan | raildo: even fairly major-non-security issues with v2 would probably be passed on for v2 | 18:23 |
| * morgan makes a non-binding resolution for binding that is binding for normal users via binding. | 18:24 | |
| * morgan goes to get breakfast or is it lunch... | 18:24 | |
| gyee | ayoung, right, so there are two checks, 1) can the given token even allowed for the given endpoint, and 2) can the given token allow to perform admin operations for the given service | 18:25 |
| shaleh | ayoung: I need a token to talk to the endpoint. If I am working on debuging/fixing a problem I might need to access both nova and cinder. Switching back and forth between two tokens seems like another level of annoyance. | 18:25 |
| ayoung | gyee, right | 18:25 |
| ayoung | shaleh, so lets assume that we made a common "admin" project across the two. How would we communicate what that project_id is to the two services? | 18:26 |
| dstanek | bknudson: i also ran into a wall writing a test case | 18:27 |
| gyee | shaleh, nothing says you can't scope to multiple endpoints at once | 18:27 |
| shaleh | ayoung: why do we need to? Once I auth and bind, my token will be accepted. Isn't that the point of role assignment? | 18:27 |
| raildo | morgan: I was think in inavlidate this bug: https://bugs.launchpad.net/keystone/+bug/1455298 since they are only modifying the error message in v2, and on v3 this is already checked. | 18:27 |
| openstack | Launchpad bug 1455298 in Keystone "unreasonable error message returned when an empty body was posted to POST request" [Low,In progress] - Assigned to Kent Wang (k.wang) | 18:27 |
| bknudson | dstanek: could probably write a custom auth plugin that doesn't pass authenticated=False? | 18:27 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: List projects filtering by is_domain flag https://review.openstack.org/158398 | 18:28 |
| *** lhcheng has quit IRC | 18:28 | |
| bknudson | but that wouldn't be a valid auth plugin. | 18:28 |
| dstanek | bknudson: do you think that's what they were doing? | 18:28 |
| dstanek | the client code is very hard to read | 18:28 |
| *** lhcheng has joined #openstack-keystone | 18:29 | |
| *** ChanServ sets mode: +v lhcheng | 18:29 | |
| bknudson | dstanek: that's the only way I can think of the reentry would happen. | 18:29 |
| ayoung | gyee, we need a way to communicate the acceptable scope of the token to the endpoints. | 18:29 |
| gyee | dstanek, its easier to read in a debugger :) | 18:29 |
| bknudson | so maybe one of our auth plugins isn't passing authenticated=False or maybe they've got their own. | 18:29 |
| ayoung | It can be endpoint ID. We could also have the policy check query the catalog, and allow tokens scoped wider than just a single endpoint | 18:29 |
| *** lhcheng has quit IRC | 18:30 | |
| shaleh | ayoung: why is definning "vm_admin" and assigning "vm_admin" to the endpoint(s) not sufficient? | 18:30 |
| gyee | ayoung, that's essentially what endpoint filter and endpoint groups are for, restrict access to a set of endpoints | 18:30 |
| shaleh | exactly | 18:30 |
| *** exploreshaifali has joined #openstack-keystone | 18:31 | |
| shaleh | if we just made it easier to define admin roles it seems like all of the other pieces are in play right now | 18:31 |
| ayoung | shaleh, what do you mean by 'assigning "vm_admin" to the endpoint' | 18:31 |
| *** zqfan is now known as zqfan_afk | 18:31 | |
| ayoung | shaleh, devil is in the details. Walk it through from role assignmnet, to token request and issue, to token validation | 18:32 |
| ayoung | the issue is that for many policy checks 'admin' is not scoped to anything. | 18:32 |
| *** tonytan4ever has quit IRC | 18:32 | |
| ayoung | but in other cases it is | 18:32 |
| ayoung | the cases where it is not scoped are things like "add hypervisor" | 18:33 |
| ayoung | service wide. | 18:33 |
| ayoung | THe cases where it is scoped are things like "set quota" | 18:33 |
| ayoung | so we need to distinguish between these two cases | 18:33 |
| shaleh | ayoung: we need to be better about defining "admin"ness. Customers are asking for more fine grained definitions of "read only admin", "vm admin", etc. | 18:33 |
| *** tonytan4ever has joined #openstack-keystone | 18:33 | |
| ayoung | shaleh, I know. | 18:33 |
| shaleh | if we stick to your suggestion of a "admin project" that I bind a token to, my user is then part of the role assignment | 18:34 |
| ayoung | shaleh, that is solvable,l too | 18:34 |
| ayoung | shaleh, yes | 18:34 |
| shaleh | endpoint asks "does this token have perms?" | 18:34 |
| shaleh | what am I mssing? | 18:34 |
| ayoung | shaleh, what is in the token validation response for the scope of the token? | 18:35 |
| ayoung | project_id for the admin proejct, right? | 18:35 |
| ayoung | how did we communicate this ID to the endpoint? | 18:35 |
| *** amakarov is now known as amakarov_away | 18:36 | |
| shaleh | the code should be asking "is this action ok by policy for this token" | 18:36 |
| shaleh | no, I am not asking for dynamic policy here. | 18:36 |
| ayoung | shaleh, and how will policy be able to say yes or no to that? | 18:36 |
| gyee | ayoung, when are you arriving tokyo? lets grab a drink and have a pre conf talk, what say you? | 18:37 |
| ayoung | gyee, I show up on Monday....let me see the time | 18:37 |
| ayoung | gyee, 5:05pm | 18:38 |
| shaleh | gyee: don't we have an HP meet and greet Monday night? | 18:38 |
| dstanek | bknudson: i couldn't find one that didn't explicitly pass authenticated=False; even our contrib SAML stuff does | 18:38 |
| ayoung | gyee, what hotel are you in? | 18:39 |
| bknudson | dstanek: a backtrace in the bug report would sure help here. | 18:39 |
| ayoung | I'm in Shinagawa Prince Hotel | 18:39 |
| gyee | ayoung, the Grant Prince | 18:39 |
| bknudson | we should just have the design conference in the hotel lobby | 18:40 |
| stevephone | dolphm, what ended up happening with that ksc bug? | 18:40 |
| dstanek | stevephone: not enough info to reproduce | 18:40 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Mark abstractmethod bodies with nocover https://review.openstack.org/238209 | 18:40 |
| stevephone | bknudson needs easy access to booze to listen to our wacky keystone ideas | 18:41 |
| *** tsymancz4k is now known as tsymanczyk | 18:41 | |
| gyee | bknudson, at a bar in the hotel lobby :) | 18:41 |
| stevephone | dstanek, kk thx :) | 18:41 |
| shaleh | gyee: ++ | 18:41 |
| gyee | can't do any design when thirsty | 18:41 |
| shaleh | ayoung: so you are saying policy cannot take a valid token and an endpoint and return up/down for the user accessing it? | 18:42 |
| dstanek | lobby hacking sounds great - lbragstad and i land at 4:00 on Sunday | 18:42 |
| shaleh | I can be around Sunday night for sure | 18:43 |
| bknudson | dstanek lbragstad: through MSP ? | 18:43 |
| dstanek | yep | 18:43 |
| bknudson | we'll all be on the same flight | 18:43 |
| dstanek | are you on that flight too? | 18:43 |
| ayoung | shaleh, right now? No, it can't. For two reasons. 1. There is no way to scope a token to an endpoint and two policy does not know the endpoint id anyway. BUt both of those are solvable problems | 18:43 |
| dstanek | nice | 18:43 |
| bknudson | that'll be a long day for you guys. | 18:44 |
| ayoung | shaleh, so we could do one of two things for " way to scope a token to an endpoint" | 18:44 |
| shaleh | HP folk are flying in Sat night. | 18:44 |
| shaleh | so Sunday evening is open for business | 18:44 |
| ayoung | either we add a new target in the token for scope; endpoint. Or, we map the endpoint to an admin project. Both hae pros/cons | 18:44 |
| dolphm | shaleh: do you work for HP, btw? | 18:45 |
| ayoung | shaleh, either way, we can use the same mechanism as gyee was building for endpoint binding of tokens; basically look up the endpoint ID from the service catalog based on the URL | 18:45 |
| shaleh | dolphm: I do, I work right next to Guang | 18:45 |
| lbragstad | bknudson yep | 18:45 |
| dolphm | shaleh: oh cool, good to know i have another path to poking gyee | 18:45 |
| shaleh | dolphm: for sure :-) | 18:46 |
| lbragstad | dolphm ++ | 18:46 |
| gyee | hahahah | 18:46 |
| gyee | dolphm, just don't ask him to throw stuff at me | 18:46 |
| lbragstad | shaleh do you have access to Nerf guns? | 18:46 |
| shaleh | nah the office dynamics are not Nerf gun friendly | 18:46 |
| lbragstad | ahhh | 18:46 |
| shaleh | lbragstad: I was typing that before you posted it :-) | 18:46 |
| bknudson | lbragstad: they're not in texas | 18:46 |
| lbragstad | lol, Nerf gun ban? | 18:47 |
| bknudson | can't just open carry nerf guns there | 18:47 |
| shaleh | too straight laced for that. Not a startup | 18:47 |
| dolphm | shaleh: can you throw things at gyee right now, btw? gyee needs a good throwing-at every now and then to keep him on his toes | 18:47 |
| lbragstad | hold on, i need a silencer for my nerf guns | 18:47 |
| dolphm | lbragstad: use the pipe at my desk | 18:47 |
| shaleh | dolphm: no, we are both at home | 18:47 |
| dolphm | shaleh: this is an unfortunate colocation arrangement | 18:48 |
| lbragstad | dolphm do we have to fill out paper work for that class III? | 18:48 |
| shaleh | dolphm: :-) I see him two days a week. He likes to hide. | 18:48 |
| dolphm | shaleh: regardless, please optimize for throwing distance and report back | 18:48 |
| shaleh | dolphm: ++ | 18:48 |
| *** jbell8 has joined #openstack-keystone | 18:49 | |
| shaleh | on the plus side, in my experience the more Nerf guns the more likely the company will tank | 18:50 |
| *** wwwjfy has quit IRC | 18:52 | |
| *** roxanag__ has quit IRC | 18:54 | |
| *** su_zhang has quit IRC | 18:55 | |
| *** sseago has joined #openstack-keystone | 18:56 | |
| *** petertr7 is now known as petertr7_away | 18:56 | |
| stevephone | dolphm dont endorse nerf based violence | 18:57 |
| *** gordc has quit IRC | 18:57 | |
| shaleh | stevephone: tennis balls then? :-) | 18:57 |
| odyssey4me | dolphm dstanek is devstack gating on all keystone v3 yet? | 18:58 |
| lbragstad | shaleh rubber-band wars | 18:59 |
| *** roxanagh_ has joined #openstack-keystone | 19:00 | |
| *** sseago has quit IRC | 19:00 | |
| stevephone | odyssey4me i believe it is | 19:02 |
| odyssey4me | stevephone the reason I ask is that we're looking to set openstack-ansible for Liberty to default to v3 only | 19:02 |
| odyssey4me | we've not had much success until these last moments... and still heat is a bit of an issue | 19:03 |
| *** ericksonsantos_ has joined #openstack-keystone | 19:03 | |
| *** jasonsb has quit IRC | 19:04 | |
| bknudson | heat only works with v3 due to creating users in the non-default domain | 19:05 |
| *** stevemar_ has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +o stevemar_ | 19:07 | |
| *** lhcheng has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v lhcheng | 19:07 | |
| *** lhcheng_ has joined #openstack-keystone | 19:08 | |
| *** jasonsb has joined #openstack-keystone | 19:11 | |
| *** roxanagh_ has quit IRC | 19:11 | |
| *** bill_az has quit IRC | 19:12 | |
| *** lhcheng has quit IRC | 19:12 | |
| *** stevemar_ has quit IRC | 19:15 | |
| *** stevemar_ has joined #openstack-keystone | 19:16 | |
| *** ChanServ sets mode: +o stevemar_ | 19:16 | |
| *** mylu has joined #openstack-keystone | 19:16 | |
| dstanek | odyssey4me: is heat your only issue? | 19:17 |
| odyssey4me | heat's keystone configuration is somewhat fragmented https://review.openstack.org/235978 | 19:17 |
| odyssey4me | there is the keystone_authtoken bit | 19:18 |
| odyssey4me | then there's the trustee bit, and the clients bit | 19:18 |
| odyssey4me | and if you don't populate one, it uses old config entries from another | 19:18 |
| odyssey4me | hence the keytsone_authtoken nonsense in here: http://docs.openstack.org/liberty/install-guide-ubuntu/heat-install.html#install-and-configure-components | 19:19 |
| odyssey4me | miguelgrinberg is ferreting the right config out for us :) | 19:19 |
| bknudson | odyssey4me: keystone_authtoken is the config for the auth_token middleware -- it should be the same for heat as it is for every service. | 19:20 |
| odyssey4me | but dstanek https://review.openstack.org/205192 passed for the first time in months not long ago | 19:20 |
| *** stevemar_ has quit IRC | 19:20 | |
| odyssey4me | bknudson the trouble is that other parts of heat use that config as a back-stop | 19:20 |
| bknudson | it's broken if applications are using keystone_authtoken for their own config. | 19:20 |
| miguelgrinberg | bknudson: yes, it was broken. We tried to fix it not long ago. | 19:20 |
| odyssey4me | bknudson that's exactly right, and they're on their way to fix it | 19:21 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Update middlewarearchitecture for paste config https://review.openstack.org/238217 | 19:22 |
| dstanek | odyssey4me: miguelgrinberg: as a back-stop for what? | 19:22 |
| miguelgrinberg | dstanek: heat managed its own domain users using the creds in keystone_authtoken. | 19:23 |
| odyssey4me | dstanek http://i.imgur.com/fTTBLia.gif | 19:23 |
| dstanek | miguelgrinberg: ah, i see | 19:24 |
| miguelgrinberg | dstanek: we now put a separate config for that, called [trustee] | 19:24 |
| *** fifieldt_ has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add is_domain in token response https://review.openstack.org/197331 | 19:26 |
| *** stevephone has quit IRC | 19:27 | |
| *** fifieldt has quit IRC | 19:29 | |
| *** fawadkhaliq has joined #openstack-keystone | 19:31 | |
| *** fawadk has quit IRC | 19:32 | |
| openstackgerrit | Kent Wang proposed openstack/keystone: Add schema validation to fix v2 code error returns https://review.openstack.org/238160 | 19:34 |
| *** mylu has quit IRC | 19:37 | |
| *** fawadk has joined #openstack-keystone | 19:40 | |
| *** mylu has joined #openstack-keystone | 19:41 | |
| *** fawadkhaliq has quit IRC | 19:43 | |
| *** su_zhang has joined #openstack-keystone | 19:43 | |
| *** petertr7_away is now known as petertr7 | 19:45 | |
| *** harlowja has quit IRC | 19:50 | |
| *** pumaranikar has quit IRC | 19:50 | |
| *** mylu has quit IRC | 19:59 | |
| *** mylu has joined #openstack-keystone | 19:59 | |
| *** mylu has quit IRC | 20:04 | |
| *** ericksonsantos_ has quit IRC | 20:05 | |
| *** ankurgupta has quit IRC | 20:05 | |
| *** openstackstatus has joined #openstack-keystone | 20:07 | |
| *** ChanServ sets mode: +v openstackstatus | 20:07 | |
| *** browne has joined #openstack-keystone | 20:15 | |
| *** dims has quit IRC | 20:18 | |
| *** dims has joined #openstack-keystone | 20:18 | |
| *** fawadk has quit IRC | 20:20 | |
| openstackgerrit | Raildo Mascena de Sousa Filho proposed openstack/keystone-specs: Adding 'domain_id' filter to list_user_projects(). https://review.openstack.org/182915 | 20:25 |
| *** ankurgupta has joined #openstack-keystone | 20:36 | |
| *** harlowja has joined #openstack-keystone | 20:39 | |
| *** harlowja_ has joined #openstack-keystone | 20:40 | |
| *** alejandrito has quit IRC | 20:42 | |
| *** browne has quit IRC | 20:44 | |
| *** harlowja has quit IRC | 20:44 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Restricting domain_id update https://review.openstack.org/207218 | 20:46 |
| *** doug-fis_ has joined #openstack-keystone | 20:50 | |
| *** doug-fi__ has joined #openstack-keystone | 20:50 | |
| *** doug-fi__ has quit IRC | 20:51 | |
| *** doug-fi__ has joined #openstack-keystone | 20:51 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Docstring spelling and function-vs-method fixes https://review.openstack.org/238144 | 20:52 |
| *** doug-fish has quit IRC | 20:53 | |
| *** raildo is now known as raildo-afk | 20:54 | |
| *** pnavarro has joined #openstack-keystone | 20:54 | |
| *** doug-fis_ has quit IRC | 20:54 | |
| *** pnavarro has quit IRC | 21:03 | |
| *** annasort has quit IRC | 21:06 | |
| *** roxanagh_ has joined #openstack-keystone | 21:07 | |
| *** jongchoi_ has joined #openstack-keystone | 21:10 | |
| *** stevemar_ has joined #openstack-keystone | 21:11 | |
| *** ChanServ sets mode: +o stevemar_ | 21:11 | |
| *** ankurgupta has left #openstack-keystone | 21:13 | |
| *** darrenc is now known as darrenc_afk | 21:17 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystonemiddleware: Address hacking check H405. https://review.openstack.org/238161 | 21:21 |
| *** petertr7 is now known as petertr7_away | 21:23 | |
| *** zz_john5223 has quit IRC | 21:31 | |
| *** doug-fi__ has quit IRC | 21:32 | |
| *** doug-fish has joined #openstack-keystone | 21:33 | |
| *** zz_john5223 has joined #openstack-keystone | 21:33 | |
| *** doug-fis_ has joined #openstack-keystone | 21:34 | |
| *** henrynash has joined #openstack-keystone | 21:35 | |
| *** ChanServ sets mode: +v henrynash | 21:35 | |
| *** doug-fish has quit IRC | 21:37 | |
| *** doug-fish has joined #openstack-keystone | 21:38 | |
| *** diazjf has quit IRC | 21:39 | |
| *** doug-fis_ has quit IRC | 21:39 | |
| *** darrenc_afk is now known as darrenc | 21:39 | |
| *** doug-fish has quit IRC | 21:42 | |
| *** jbell8 has quit IRC | 21:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/238264 | 21:49 |
| *** doug-fish has joined #openstack-keystone | 21:50 | |
| *** su_zhang has quit IRC | 21:53 | |
| *** doug-fish has quit IRC | 21:54 | |
| *** tqtran has quit IRC | 21:54 | |
| *** su_zhang has joined #openstack-keystone | 21:54 | |
| *** su_zhang has quit IRC | 21:55 | |
| *** jongchoi_ has quit IRC | 22:02 | |
| *** jongchoi_ has joined #openstack-keystone | 22:05 | |
| *** jamielennox|away is now known as jamielennox | 22:07 | |
| *** c_soukup has quit IRC | 22:09 | |
| *** jongchoi_ has quit IRC | 22:10 | |
| *** lhcheng_ has quit IRC | 22:17 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use keystoneauth https://review.openstack.org/235090 | 22:21 |
| *** jbell8 has joined #openstack-keystone | 22:23 | |
| *** urulama has quit IRC | 22:25 | |
| *** urulama has joined #openstack-keystone | 22:25 | |
| *** r-daneel has joined #openstack-keystone | 22:26 | |
| *** jbell8 has quit IRC | 22:27 | |
| *** pgbridge has quit IRC | 22:28 | |
| *** jbell8 has joined #openstack-keystone | 22:30 | |
| *** phalmos has quit IRC | 22:30 | |
| *** slberger has left #openstack-keystone | 22:31 | |
| *** lhcheng has joined #openstack-keystone | 22:33 | |
| *** ChanServ sets mode: +v lhcheng | 22:33 | |
| *** jasonsb has quit IRC | 22:37 | |
| *** su_zhang has joined #openstack-keystone | 22:39 | |
| *** pgbridge has joined #openstack-keystone | 22:39 | |
| *** jbell8 has quit IRC | 22:40 | |
| *** jbell8 has joined #openstack-keystone | 22:41 | |
| *** jasonsb has joined #openstack-keystone | 22:42 | |
| jamielennox | laptop cleanup day: [ $[ $RANDOM % 6] == 0 ] && rm -rf / l l echo Click | 22:45 |
| gyee | you need secure wipe :) | 22:47 |
| *** jaosorior has quit IRC | 22:48 | |
| *** jaosorior has joined #openstack-keystone | 22:48 | |
| *** annasort has joined #openstack-keystone | 22:48 | |
| *** jbell8 has quit IRC | 22:53 | |
| *** jbell8 has joined #openstack-keystone | 22:54 | |
| *** hrou has joined #openstack-keystone | 22:54 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_endpoint_ref consistently https://review.openstack.org/237758 | 22:55 |
| *** urulama has quit IRC | 22:57 | |
| *** urulama has joined #openstack-keystone | 22:57 | |
| *** markvoelker has quit IRC | 23:08 | |
| *** diegows has joined #openstack-keystone | 23:23 | |
| *** dims_ has joined #openstack-keystone | 23:29 | |
| *** erhudy has quit IRC | 23:29 | |
| *** dims__ has joined #openstack-keystone | 23:31 | |
| *** dims has quit IRC | 23:31 | |
| *** harlowja_ has quit IRC | 23:33 | |
| *** dims_ has quit IRC | 23:34 | |
| *** harlowja has joined #openstack-keystone | 23:37 | |
| *** exploreshaifali has quit IRC | 23:38 | |
| *** gildub has joined #openstack-keystone | 23:41 | |
| *** harlowja_ has joined #openstack-keystone | 23:45 | |
| *** topol has joined #openstack-keystone | 23:48 | |
| *** ChanServ sets mode: +v topol | 23:48 | |
| *** harlowja has quit IRC | 23:49 | |
| *** topol has quit IRC | 23:53 | |
| shaleh | my review just failed gate-tempest-dsvm-postgres-full. It does not look like my unit test only changes should be the culprit. Anyone else see problems? | 23:57 |
| *** su_zhang has quit IRC | 23:58 | |
| *** tonytan4ever has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
