| jamielennox | PUT /projects/{project_id}/groups/{group_id}/roles/{role_id}/inherited is an ugly url | 00:00 |
|---|---|---|
| *** hrou has joined #openstack-keystone | 00:04 | |
| *** mylu has joined #openstack-keystone | 00:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Switch saml2 from lxml to built-in xml https://review.openstack.org/242512 | 00:08 |
| *** tqtran is now known as tqtran-afk | 00:10 | |
| *** lhcheng_ has joined #openstack-keystone | 00:13 | |
| *** lhcheng has quit IRC | 00:14 | |
| *** lars1 has quit IRC | 00:15 | |
| roxanaghe | stevemar_, lhcheng for WebSSO using oidc - I have the situation where only one user can login at once. Is there a special config for auth_openidc apache module to allow multiple user sessions? | 00:17 |
| roxanaghe | stevemar_, lhcheng it seems strange to me that only one user can login, but all the other attempts get a 401. have you seen that before? | 00:18 |
| *** EinstCrazy has quit IRC | 00:19 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_user_ref consistently https://review.openstack.org/243877 | 00:20 |
| *** lars1 has joined #openstack-keystone | 00:29 | |
| *** agireud has quit IRC | 00:37 | |
| *** gildub_ has quit IRC | 00:38 | |
| *** jerrygb has quit IRC | 00:40 | |
| *** jerrygb has joined #openstack-keystone | 00:42 | |
| *** jerrygb has quit IRC | 00:42 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add testcases to check cache invalidation in endpoint filter extension https://review.openstack.org/245633 | 00:48 |
| jamielennox | lbragstad: https://review.openstack.org/#/c/245629/ <-- the common policy spec | 00:48 |
| stevemar_ | roxanaghe: that's interesting... | 00:50 |
| stevemar_ | can you paste details about the mapping you used, and any log output? | 00:50 |
| stevemar_ | i think lhcheng_ and i had a setup where we both logged in at once | 00:50 |
| stevemar_ | bknudson_: regarding https://review.openstack.org/#/c/245633/ - should we wait until we are calling the driver and not making REST calls? | 00:52 |
| bknudson_ | stevemar_: I don't think we should wait. | 00:52 |
| bknudson_ | that's going to be a pretty major overhaul | 00:53 |
| stevemar_ | bknudson_: cool, i'll +A then, it looked fine otherwise | 00:53 |
| stevemar_ | bknudson_: while i have you around... https://review.openstack.org/#/c/245549/ (backport) | 00:54 |
| stevemar_ | bknudson_: i was gonna start making the liberty release notes with reno | 00:55 |
| stevemar_ | looks like it's one release note per BP | 00:55 |
| openstackgerrit | Brant Knudson proposed openstack/keystonemiddleware: Update middlewarearchitecture for paste config https://review.openstack.org/238217 | 00:55 |
| stevemar_ | nice patch ^ | 00:56 |
| bknudson_ | we already wrote liberty release notes | 00:57 |
| *** aginwala has joined #openstack-keystone | 00:57 | |
| roxanaghe | stevemar_ http://paste.openstack.org/show/479073/ | 01:00 |
| roxanaghe | stevemar_ I need to take off, I will bug you and lhcheng tomorrow again if I can't figure it out | 01:01 |
| lhcheng_ | roxanaghe: I think that is expected.. horizon only supports one user per browser session | 01:03 |
| shaleh | lhcheng_, but it failed from multiple hosts | 01:04 |
| *** EinstCrazy has joined #openstack-keystone | 01:04 | |
| shaleh | lhcheng_, I did not get a chance to dig into roxanaghe's config though | 01:04 |
| lhcheng_ | shaleh: hmm probably horizon is not configured to share user session between hosts. | 01:04 |
| roxanaghe | yes, multiple hosts and trying with different users | 01:04 |
| shaleh | lhcheng_, that was my suspicion as well | 01:05 |
| roxanaghe | is that a config option in horizon? | 01:05 |
| roxanaghe | lhcheng_ ^^ | 01:05 |
| lhcheng_ | roxanaghe: http://docs.openstack.org/developer/horizon/topics/deployment.html#database | 01:06 |
| lhcheng_ | either memcache or database should work | 01:06 |
| roxanaghe | lhcheng ok thx will try it tomorrow :) | 01:08 |
| stevemar_ | lhcheng_: oh that's weird | 01:08 |
| roxanaghe | I am a little bit surprised such a capability is not enabled by default | 01:09 |
| lhcheng_ | the default config is more developer friendly rather than production friendly :P | 01:10 |
| lhcheng_ | roxanaghe: sure, good luck | 01:10 |
| jamielennox | lhcheng_, stevemar_: https://bugs.launchpad.net/keystoneauth/+bug/1516840 | 01:17 |
| openstack | Launchpad bug 1516840 in keystoneauth "Cookies persists between all calls through a session" [Undecided,New] | 01:17 |
| jamielennox | i made it public security as i don't think there is any problem yet | 01:18 |
| jamielennox | lhcheng_: does it affect horizon if i just remove all cookie handling | 01:18 |
| jamielennox | ? | 01:18 |
| *** aginwala has quit IRC | 01:19 | |
| *** aginwala has joined #openstack-keystone | 01:20 | |
| lhcheng_ | jamielennox: horizon does not depend on any cookie value when using the python-clients | 01:20 |
| jamielennox | lhcheng_: right - i didn't think it would | 01:20 |
| jamielennox | because all the cookies horizon is using are between user/horizon | 01:21 |
| *** X-Istence is now known as x58 | 01:21 | |
| lhcheng_ | django has it own session and request objects.. horizon should be fine. | 01:22 |
| lhcheng_ | I can test out the patch when you have it ready | 01:22 |
| stevemar_ | lhcheng_: so by default, horizon can't handle any multiple users being logged in? | 01:23 |
| lhcheng_ | stevemar_: it can, but not multiple user on the same browser instance | 01:23 |
| *** aginwala has quit IRC | 01:25 | |
| lhcheng_ | jamielennox: sadly, regression on the python-clients can be catched until it is released, our gate doesn't catch that. :( | 01:25 |
| lhcheng_ | can -> **can't | 01:25 |
| lhcheng_ | I'll have to manually patch local horizon to consume the new code to test it out. | 01:26 |
| jamielennox | lhcheng_: yea - i think it will be fine, it's only when you are communicating with the services that you use session | 01:26 |
| lhcheng_ | yup | 01:26 |
| *** mylu has quit IRC | 01:33 | |
| stevemar_ | bknudson_: not sure why the release notes are going into current release | 01:33 |
| *** mylu has joined #openstack-keystone | 01:33 | |
| *** ninag has joined #openstack-keystone | 01:33 | |
| *** mylu has quit IRC | 01:34 | |
| *** mylu has joined #openstack-keystone | 01:34 | |
| *** aginwala has joined #openstack-keystone | 01:36 | |
| stevemar_ | bknudson_: i think it might be a weird thing when it's built in dev env. | 01:36 |
| bknudson_ | I sure hope it is. | 01:36 |
| stevemar_ | bknudson_: neutron seems to do it fine: https://review.openstack.org/#/c/242223/ and https://review.openstack.org/#/c/243256/ | 01:36 |
| stevemar_ | and it's here: http://docs.openstack.org/releasenotes/neutron/liberty.html | 01:37 |
| *** markvoelker has joined #openstack-keystone | 01:37 | |
| *** shaleh has quit IRC | 01:38 | |
| *** ninag has quit IRC | 01:38 | |
| stevemar_ | bknudson_: i'll put up a patch with the release notes and see what the generated build says | 01:38 |
| *** roxanaghe has quit IRC | 01:38 | |
| stevemar_ | lhcheng_: if you have a second, it's already 2x+2 https://review.openstack.org/#/c/244343/ | 01:39 |
| lhcheng_ | stevemar_: sure, checking.. | 01:41 |
| *** mylu has quit IRC | 01:44 | |
| *** aix has quit IRC | 01:46 | |
| *** yangyapeng has joined #openstack-keystone | 01:49 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Implied Roles https://review.openstack.org/125704 | 01:53 |
| *** btully has quit IRC | 01:53 | |
| *** richm has quit IRC | 01:54 | |
| *** gyee has quit IRC | 01:55 | |
| *** jmccrory has joined #openstack-keystone | 02:05 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:05 | |
| ayoung | jamielennox, got a moment to talk https://review.openstack.org/#/c/245588/ ? | 02:07 |
| *** alejandrito has joined #openstack-keystone | 02:08 | |
| *** alejandrito has quit IRC | 02:08 | |
| *** alejandrito has joined #openstack-keystone | 02:08 | |
| *** pece has quit IRC | 02:10 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/243925 | 02:11 |
| *** alejandrito has quit IRC | 02:21 | |
| *** alejandrito has joined #openstack-keystone | 02:33 | |
| jamielennox | ayoung: yea i'm here | 02:35 |
| ayoung | jamielennox, OK, so, the idea is this: | 02:39 |
| ayoung | If we do federation somehwere, we need some way of getting the post-mapped roles. This is not just for Nova, but also for the overcloud | 02:40 |
| *** aginwala has quit IRC | 02:40 | |
| ayoung | The services can configure for Federation, but they don't know the Keystone part. THat is really the mapping. So, either we pass the mapping to the remote services, or we marshall the pre-mapped values to Keystone. | 02:41 |
| *** aginwala has joined #openstack-keystone | 02:41 | |
| ayoung | I had been thinking "fetch and cache" of the mapping data for so long, but, since we are doing Fernet, I started thinking along the lines of "how can we keep things down to a single call" | 02:41 |
| ayoung | It was based on a request from someone in the field, asking about Kerberos in front of services, and it kicked off the whole thought process | 02:42 |
| ayoung | jamielennox, It also would let us standardize how to do "I have REMOTE_USER for Idp=AD, Protocol =kerberos. Tell me what my User_ID would be. | 02:43 |
| jamielennox | i'm just not sure if you were going to go to the hassle of doing an externally authenticated cloud like that whether you'd even bother with putting keystone in th emix | 02:44 |
| *** aginwala has quit IRC | 02:44 | |
| *** tqtran-afk has quit IRC | 02:44 | |
| *** aginwala has joined #openstack-keystone | 02:44 | |
| ayoung | jamielennox, Heh, well, I'm all for killing Keystone, but we still need something to serve out the service catalog | 02:45 |
| *** mylu has joined #openstack-keystone | 02:45 | |
| jamielennox | i'm just not sure you want it | 02:46 |
| jamielennox | like ok, tokenless auth | 02:46 |
| jamielennox | but do i want my tokenless auth to back via federation? | 02:46 |
| jamielennox | SSL/kerberos/whatever can be made to provide an ID without too much trouble | 02:46 |
| ayoung | I've long thought that Federation should be the only way to do Auth In Keystone systems. Expanding it to other services seems to make sense | 02:47 |
| jamielennox | hmm, doesn't work with the shadow users thing | 02:47 |
| jamielennox | ayoung: right, but you generally want to push out things like your id then | 02:47 |
| ayoung | So, let the services confirm authN via whatever, but then hand what it gets over to Keystone to do the last mile | 02:47 |
| jamielennox | like i'd be fine with just doing the entire of openstack as a per-service saml or oauth or whatever system | 02:47 |
| jamielennox | but then you definitely push that data | 02:47 |
| ayoung | jamielennox, is your primary object the amorphous form of the attributes sent to Keystone? | 02:48 |
| *** aginwala has quit IRC | 02:48 | |
| jamielennox | objection? | 02:48 |
| ayoung | "I am still good with passing the combination of user_id, project_id/domain_id/trust_id and getting back a token but i'm not a fan of passing the ENV around." from your review | 02:49 |
| ayoung | yeah, objection | 02:49 |
| jamielennox | no i was thinking of the service token thing where we were saying you should be able to use service-token, user_id, project_id rather than the user token | 02:49 |
| *** woodster_ has quit IRC | 02:49 | |
| jamielennox | so at the point of user_id - things that keystone understand | 02:49 |
| jamielennox | i've gotten over it | 02:50 |
| jamielennox | i'm not sure i want to pass apache ENV vars through post | 02:50 |
| *** btully has joined #openstack-keystone | 02:50 | |
| *** aginwala has joined #openstack-keystone | 02:51 | |
| *** agireud has joined #openstack-keystone | 02:52 | |
| ayoung | I think it really is the better option. It lets the service do the crypo-authN, and then asks Keystone :"OK, I know who this Bozo is. What can he do?" | 02:53 |
| ayoung | its really no different than Kerberos + LDAP | 02:53 |
| ayoung | WIth Keystone playing the role of LDAP. I think Keystone would play that role in drag.... | 02:54 |
| jamielennox | so i can see that you essentially turn keystone into middleware | 02:54 |
| ayoung | jamielennox, yes. | 02:55 |
| jamielennox | like middleware -> sssd does mapping etc -> returns something that makes it look like auth_token | 02:55 |
| *** btully has quit IRC | 02:55 | |
| ayoung | jamielennox, and in doing so, makes Keystone's reach much, much wider | 02:55 |
| ayoung | Exactly | 02:55 |
| jamielennox | well it makes keysotne mod_auth_identity | 02:55 |
| ayoung | yes it does | 02:58 |
| jamielennox | lookup_identity | 02:58 |
| ayoung | I am not origianal | 02:58 |
| jamielennox | i'm just not sure i'd bother putting keystone in that mix | 02:58 |
| ayoung | Well, we already have it in the mix for OpenStack. | 02:59 |
| *** gildub_ has joined #openstack-keystone | 03:00 | |
| ayoung | But we could do a mod_lookup_identity call to Keystone. | 03:00 |
| ayoung | jamielennox, you really dead set against it? | 03:00 |
| jamielennox | i don't know if it would work with the shadow user thing, but if you could generate the user_id from apache module that would be fine | 03:00 |
| jamielennox | ayoung: not really, i would need to think through it some more | 03:01 |
| *** spandhe has quit IRC | 03:01 | |
| jamielennox | it just feels wrong | 03:01 |
| ayoung | the shadow user would be generated by Keystone and returned after the mapping | 03:01 |
| jamielennox | like i get why you need it, but you're exposing the ENV directly to keystone | 03:01 |
| ayoung | Not secrets or keys, just REMOTE_USER and REMOTE_GROUP type values | 03:02 |
| jamielennox | right, but it means you can't figure out the id from middleware cause there is no relation there | 03:02 |
| ayoung | jamielennox, that is really the crux of the whole thing. THe same is true from Keystone itself. Once you map, you need to record that mapping | 03:04 |
| ayoung | It why I am alittle worried about the shadow user approach. If we do it wrong, the accounts will not be easily linkable | 03:05 |
| *** bapalm has quit IRC | 03:06 | |
| *** tellesnobrega is now known as tellesnobrega_af | 03:06 | |
| jamielennox | i'm not sure that's a big problem | 03:07 |
| *** tjcocozz_ has quit IRC | 03:07 | |
| ayoung | jamielennox, let me see if I can find the discussion. I have it in a hardcover book | 03:07 |
| ayoung | jamielennox, I can't do it justicem, but, the example is: a person comes in to the hospital unconscious. Who are they? Do you start a new user record for them? What happ[ens if you identify them as Joe Snuffy? SHould you link the observations tyou make to the origianl Joe Snuffy's records? | 03:10 |
| ayoung | and so on...what if you realize it is the wrong Joe Snuffy....which observations go where... | 03:11 |
| ayoung | Now, that is life or death, but we have similar issues with "linking two different auth methods implicitly" | 03:11 |
| *** EinstCrazy has quit IRC | 03:11 | |
| jamielennox | i got the theory, and if you link there is the user_id change | 03:11 |
| *** EinstCrazy has joined #openstack-keystone | 03:12 | |
| jamielennox | i don't think i have a real care about the link case though | 03:12 |
| jamielennox | i'm very happy with make federation user a local user | 03:12 |
| ayoung | I'm not saying it is impossible, just that it is tough to do right. Not sure if dolphm realizes what he has bitten off there. | 03:12 |
| *** EinstCra_ has joined #openstack-keystone | 03:12 | |
| ayoung | I need the simpler case, where we can force Password, Kerberos, and SAML to all have the same identifier | 03:12 |
| *** mylu has quit IRC | 03:15 | |
| *** EinstCrazy has quit IRC | 03:16 | |
| *** jasonsb has joined #openstack-keystone | 03:18 | |
| *** jasonsb has quit IRC | 03:18 | |
| *** jasonsb has joined #openstack-keystone | 03:18 | |
| *** haneef has quit IRC | 03:18 | |
| *** albertom has quit IRC | 03:18 | |
| *** arunkant has quit IRC | 03:18 | |
| *** haneef has joined #openstack-keystone | 03:19 | |
| *** arunkant has joined #openstack-keystone | 03:19 | |
| openstackgerrit | Lin Hua Cheng proposed openstack/keystoneauth: Address hacking check H405 https://review.openstack.org/243889 | 03:19 |
| *** mylu has joined #openstack-keystone | 03:22 | |
| *** lhcheng_ has quit IRC | 03:23 | |
| *** albertom has joined #openstack-keystone | 03:23 | |
| ayoung | jamielennox, can you not -1 it, then,but leave an actionable comment? I'd like to get the discussion started, and a -1 effectively says "I don't want this to go forward." | 03:26 |
| ayoung | I'll see if I can get a better set of use cases together | 03:27 |
| jamielennox | ayoung: done | 03:27 |
| ayoung | jamielennox, cool. This is a Noname or Ortiz Spec anyway...just want to get the discussion started. I think that the part you brought up (Service user + user ID for internal validations) would need to happen first for this to be viable. Can't work without tokens without that | 03:31 |
| *** aginwala has quit IRC | 03:31 | |
| *** aginwala has joined #openstack-keystone | 03:32 | |
| *** aginwala has quit IRC | 03:36 | |
| *** btully has joined #openstack-keystone | 03:51 | |
| * notmorgan has internet again | 03:53 | |
| *** davechen has joined #openstack-keystone | 03:53 | |
| *** davechen1 has joined #openstack-keystone | 04:02 | |
| *** davechen has quit IRC | 04:05 | |
| *** dims has quit IRC | 04:06 | |
| *** mylu has quit IRC | 04:14 | |
| *** alejandrito has quit IRC | 04:16 | |
| *** topol has quit IRC | 04:17 | |
| *** topol has joined #openstack-keystone | 04:18 | |
| *** ChanServ sets mode: +v topol | 04:18 | |
| *** mylu has joined #openstack-keystone | 04:20 | |
| *** lhcheng has joined #openstack-keystone | 04:23 | |
| *** ChanServ sets mode: +v lhcheng | 04:23 | |
| *** davechen1 has left #openstack-keystone | 04:28 | |
| *** spandhe has joined #openstack-keystone | 04:38 | |
| *** woodster_ has joined #openstack-keystone | 04:40 | |
| *** spandhe_ has joined #openstack-keystone | 04:41 | |
| *** spandhe has quit IRC | 04:42 | |
| *** spandhe_ is now known as spandhe | 04:42 | |
| *** dave-mccowan has quit IRC | 04:45 | |
| *** lhcheng has quit IRC | 04:48 | |
| *** Nakato_ has joined #openstack-keystone | 04:55 | |
| *** baffle has joined #openstack-keystone | 04:55 | |
| *** telemons1er has joined #openstack-keystone | 04:57 | |
| *** sshen_ has joined #openstack-keystone | 04:57 | |
| *** hrou has quit IRC | 04:57 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 04:57 | |
| *** ayoung_ has joined #openstack-keystone | 04:58 | |
| *** cburgess_ has joined #openstack-keystone | 04:59 | |
| *** rm_work has quit IRC | 05:00 | |
| *** charz has quit IRC | 05:00 | |
| *** dtroyer_zz has quit IRC | 05:00 | |
| *** ryanpetrello has quit IRC | 05:00 | |
| *** dolphm has quit IRC | 05:00 | |
| *** serverascode has quit IRC | 05:00 | |
| *** flaper87 has quit IRC | 05:00 | |
| *** redrobot has quit IRC | 05:00 | |
| *** cloudnull has quit IRC | 05:00 | |
| *** cburgess has quit IRC | 05:00 | |
| *** baffle_ has quit IRC | 05:00 | |
| *** sshen has quit IRC | 05:00 | |
| *** Ephur has quit IRC | 05:00 | |
| *** ayoung has quit IRC | 05:00 | |
| *** d34dh0r53 has quit IRC | 05:00 | |
| *** Nakato has quit IRC | 05:00 | |
| *** jamielennox has quit IRC | 05:00 | |
| *** mgagne has quit IRC | 05:00 | |
| *** wasmum has quit IRC | 05:00 | |
| *** hideme_ has quit IRC | 05:00 | |
| *** afazekas has quit IRC | 05:00 | |
| *** nonameentername has quit IRC | 05:00 | |
| *** david8hu has quit IRC | 05:00 | |
| *** notmyname has quit IRC | 05:00 | |
| *** telemonster has quit IRC | 05:00 | |
| *** stevemar_ has quit IRC | 05:00 | |
| *** david8hu has joined #openstack-keystone | 05:00 | |
| *** rm_work has joined #openstack-keystone | 05:00 | |
| *** wasmum- has joined #openstack-keystone | 05:00 | |
| *** mgagne has joined #openstack-keystone | 05:00 | |
| *** dolphm has joined #openstack-keystone | 05:01 | |
| *** ryanpetrello has joined #openstack-keystone | 05:01 | |
| *** flaper87 has joined #openstack-keystone | 05:01 | |
| *** dtroyer has joined #openstack-keystone | 05:01 | |
| *** jamielennox has joined #openstack-keystone | 05:01 | |
| *** ChanServ sets mode: +v jamielennox | 05:01 | |
| *** redrobot has joined #openstack-keystone | 05:01 | |
| *** jerrygb has joined #openstack-keystone | 05:01 | |
| *** redrobot is now known as Guest26177 | 05:01 | |
| *** nonameentername has joined #openstack-keystone | 05:02 | |
| *** afazekas has joined #openstack-keystone | 05:02 | |
| *** Guest86181 has joined #openstack-keystone | 05:02 | |
| *** hideme has joined #openstack-keystone | 05:02 | |
| *** bill_az has quit IRC | 05:02 | |
| *** notmyname has joined #openstack-keystone | 05:03 | |
| *** charz has joined #openstack-keystone | 05:03 | |
| *** jamielennox is now known as jamielennox|away | 05:06 | |
| *** serverascode has joined #openstack-keystone | 05:06 | |
| *** Guest86181 is now known as cloudkiller | 05:08 | |
| *** topol_ has joined #openstack-keystone | 05:16 | |
| *** ChanServ sets mode: +v topol_ | 05:16 | |
| *** mylu has quit IRC | 05:17 | |
| *** annasort_ has joined #openstack-keystone | 05:17 | |
| *** zqfan_AFK_ has joined #openstack-keystone | 05:18 | |
| *** lhcheng has joined #openstack-keystone | 05:22 | |
| *** ChanServ sets mode: +v lhcheng | 05:22 | |
| *** sirushti_ has joined #openstack-keystone | 05:24 | |
| *** electrichead has joined #openstack-keystone | 05:24 | |
| openstackgerrit | Sachi King proposed openstack/keystone: Add -constraints for CI jobs https://review.openstack.org/238289 | 05:24 |
| *** Guest26177 has quit IRC | 05:25 | |
| *** topol has quit IRC | 05:25 | |
| *** arunkant has quit IRC | 05:25 | |
| *** lars1 has quit IRC | 05:25 | |
| *** samueldmq has quit IRC | 05:25 | |
| *** annasort has quit IRC | 05:25 | |
| *** DuncanT has quit IRC | 05:25 | |
| *** andrewbogott has quit IRC | 05:25 | |
| *** zqfan_AFK has quit IRC | 05:25 | |
| *** sirushti has quit IRC | 05:25 | |
| *** sirushti_ is now known as sirushti | 05:25 | |
| *** zqfan_AFK_ is now known as zqfan_AFK | 05:25 | |
| *** DuncanT has joined #openstack-keystone | 05:26 | |
| *** samueldmq has joined #openstack-keystone | 05:27 | |
| *** lars1 has joined #openstack-keystone | 05:27 | |
| *** bill_az has joined #openstack-keystone | 05:28 | |
| *** arunkant has joined #openstack-keystone | 05:29 | |
| *** andrewbogott has joined #openstack-keystone | 05:29 | |
| *** aj_ has joined #openstack-keystone | 05:33 | |
| *** gus has quit IRC | 05:33 | |
| *** gus has joined #openstack-keystone | 05:34 | |
| *** ajaya has joined #openstack-keystone | 05:34 | |
| *** aj_ has quit IRC | 05:36 | |
| *** jerrygb has quit IRC | 05:38 | |
| *** jmccrory has quit IRC | 05:48 | |
| *** jaosorior has joined #openstack-keystone | 05:50 | |
| *** jmccrory has joined #openstack-keystone | 05:51 | |
| *** mylu has joined #openstack-keystone | 05:54 | |
| *** lhcheng has quit IRC | 05:54 | |
| *** aswadr has joined #openstack-keystone | 05:54 | |
| *** lhcheng has joined #openstack-keystone | 05:55 | |
| *** ChanServ sets mode: +v lhcheng | 05:55 | |
| *** mylu has quit IRC | 05:55 | |
| *** mylu has joined #openstack-keystone | 05:56 | |
| *** yangyapeng has quit IRC | 05:59 | |
| *** NM has joined #openstack-keystone | 06:01 | |
| *** topol_ has quit IRC | 06:05 | |
| openstackgerrit | Merged openstack/keystone: Use new_service_ref instead of manually created dict https://review.openstack.org/244499 | 06:05 |
| *** topol has joined #openstack-keystone | 06:05 | |
| *** ChanServ sets mode: +v topol | 06:05 | |
| *** topol_ has joined #openstack-keystone | 06:06 | |
| *** ChanServ sets mode: +v topol_ | 06:06 | |
| *** ajaya has quit IRC | 06:08 | |
| *** topol has quit IRC | 06:10 | |
| *** topol_ has quit IRC | 06:11 | |
| *** sirushti has quit IRC | 06:11 | |
| *** sirushti has joined #openstack-keystone | 06:11 | |
| openstackgerrit | Merged openstack/keystone: Make K2K Mapping Attribute Examples more visible https://review.openstack.org/242639 | 06:11 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 06:15 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 06:18 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 06:19 |
| *** ajaya has joined #openstack-keystone | 06:22 | |
| *** rcernin has joined #openstack-keystone | 06:22 | |
| *** aginwala has joined #openstack-keystone | 06:24 | |
| *** zqfan_AFK is now known as zqfan | 06:26 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/246206 | 06:29 |
| *** aginwala_ has joined #openstack-keystone | 06:30 | |
| *** aginwala has quit IRC | 06:32 | |
| *** spandhe has quit IRC | 06:33 | |
| *** aginwala_ has quit IRC | 06:35 | |
| *** aginwala has joined #openstack-keystone | 06:36 | |
| *** jerrygb has joined #openstack-keystone | 06:39 | |
| *** jerrygb has quit IRC | 06:45 | |
| *** bill_az has quit IRC | 06:47 | |
| *** woodster_ has quit IRC | 06:49 | |
| *** sileht has joined #openstack-keystone | 06:50 | |
| *** josecastroleon has joined #openstack-keystone | 06:50 | |
| *** aswadr has quit IRC | 06:55 | |
| *** gildub_ has quit IRC | 07:00 | |
| *** dhellmann has quit IRC | 07:01 | |
| *** urulama has quit IRC | 07:01 | |
| *** urulama has joined #openstack-keystone | 07:01 | |
| *** mylu has quit IRC | 07:02 | |
| *** dhellmann has joined #openstack-keystone | 07:02 | |
| *** mylu has joined #openstack-keystone | 07:03 | |
| *** jasonsb has quit IRC | 07:04 | |
| *** mylu has quit IRC | 07:07 | |
| *** jaosorior has quit IRC | 07:10 | |
| *** jaosorior has joined #openstack-keystone | 07:10 | |
| *** jaosorior has quit IRC | 07:13 | |
| *** jaosorior has joined #openstack-keystone | 07:14 | |
| *** btully has quit IRC | 07:30 | |
| *** jasonsb has joined #openstack-keystone | 07:35 | |
| *** jasonsb has quit IRC | 07:40 | |
| *** aginwala has quit IRC | 07:45 | |
| *** aginwala has joined #openstack-keystone | 07:49 | |
| *** henrynash has joined #openstack-keystone | 07:56 | |
| *** ChanServ sets mode: +v henrynash | 07:56 | |
| *** swebb has quit IRC | 08:06 | |
| *** ninag has joined #openstack-keystone | 08:08 | |
| *** ninag has quit IRC | 08:14 | |
| openstackgerrit | Merged openstack/keystone: Document release notes process https://review.openstack.org/244343 | 08:20 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 08:23 |
| *** pnavarro has joined #openstack-keystone | 08:40 | |
| *** jerrygb has joined #openstack-keystone | 08:40 | |
| openstackgerrit | Merged openstack/keystone: Add S3 signature v4 checking https://review.openstack.org/215481 | 08:45 |
| *** jerrygb has quit IRC | 08:46 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: Remove Python 2.6 classifier https://review.openstack.org/246259 | 08:49 |
| *** lhcheng has quit IRC | 09:00 | |
| *** exploreshaifali has joined #openstack-keystone | 09:02 | |
| *** xek has joined #openstack-keystone | 09:03 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/pycadf: Remove Python 2.6 classifier https://review.openstack.org/246265 | 09:06 |
| *** btully has joined #openstack-keystone | 09:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 09:16 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 09:17 |
| *** ekarlso has quit IRC | 09:22 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 09:24 |
| *** bdossant has joined #openstack-keystone | 09:28 | |
| *** openstackgerrit has quit IRC | 09:31 | |
| *** openstackgerrit has joined #openstack-keystone | 09:32 | |
| *** gb21_ has quit IRC | 09:33 | |
| *** aginwala has quit IRC | 09:34 | |
| *** ajaya has quit IRC | 09:36 | |
| *** ekarlso has joined #openstack-keystone | 09:37 | |
| *** ekarlso has quit IRC | 09:38 | |
| *** ekarlso has joined #openstack-keystone | 09:38 | |
| *** exploreshaifali has quit IRC | 09:47 | |
| *** e0ne has joined #openstack-keystone | 09:48 | |
| *** ajaya has joined #openstack-keystone | 09:49 | |
| *** belmoreira has joined #openstack-keystone | 09:52 | |
| *** ekarlso has quit IRC | 09:57 | |
| *** tobasco has joined #openstack-keystone | 09:57 | |
| tobasco | hitting the error in keystone/middleware/core.py on line 310 when running "openstack user list" what does it mean? | 09:58 |
| tobasco | i just upgraded from kilo to liberty btw | 09:58 |
| *** markvoelker has quit IRC | 10:05 | |
| *** e0ne has quit IRC | 10:07 | |
| *** daemontool has joined #openstack-keystone | 10:12 | |
| *** daemontool has quit IRC | 10:14 | |
| *** daemontool has joined #openstack-keystone | 10:15 | |
| *** EinstCra_ has quit IRC | 10:18 | |
| *** exploreshaifali has joined #openstack-keystone | 10:27 | |
| *** openstackgerrit has quit IRC | 10:31 | |
| *** openstackgerrit has joined #openstack-keystone | 10:32 | |
| *** ekarlso has joined #openstack-keystone | 10:36 | |
| *** pnavarro has quit IRC | 10:37 | |
| *** ekarlso has quit IRC | 10:39 | |
| *** btully has quit IRC | 10:40 | |
| *** jerrygb has joined #openstack-keystone | 10:43 | |
| *** jerrygb has quit IRC | 10:47 | |
| *** lhcheng has joined #openstack-keystone | 10:48 | |
| *** ChanServ sets mode: +v lhcheng | 10:48 | |
| *** topol has joined #openstack-keystone | 10:53 | |
| *** ChanServ sets mode: +v topol | 10:53 | |
| *** lhcheng has quit IRC | 10:54 | |
| *** e0ne has joined #openstack-keystone | 10:57 | |
| *** topol has quit IRC | 10:57 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/246093 | 10:58 |
| *** tyagiprince has joined #openstack-keystone | 10:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 11:03 |
| *** markvoelker has joined #openstack-keystone | 11:06 | |
| *** dims has joined #openstack-keystone | 11:08 | |
| *** henrynash has quit IRC | 11:09 | |
| *** daemontool has quit IRC | 11:11 | |
| *** markvoelker has quit IRC | 11:11 | |
| *** daemontool has joined #openstack-keystone | 11:11 | |
| *** gildub_ has joined #openstack-keystone | 11:16 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:21 | |
| *** daemontool has quit IRC | 11:23 | |
| *** gildub_ has quit IRC | 11:23 | |
| *** EinstCrazy has joined #openstack-keystone | 11:23 | |
| *** daemontool has joined #openstack-keystone | 11:24 | |
| *** daemontool has quit IRC | 11:25 | |
| *** daemontool has joined #openstack-keystone | 11:26 | |
| *** flaper87 has quit IRC | 11:27 | |
| *** flaper87 has joined #openstack-keystone | 11:27 | |
| *** josecastroleon has quit IRC | 11:36 | |
| *** tyagiprince has quit IRC | 11:39 | |
| *** tyagiprince has joined #openstack-keystone | 11:40 | |
| samueldmq | morning keystoners | 11:42 |
| *** Guest72509 is now known as amakarov | 11:43 | |
| *** NM has quit IRC | 11:47 | |
| *** tellesnobrega has quit IRC | 12:01 | |
| *** tellesnobrega has joined #openstack-keystone | 12:02 | |
| *** stevemar_ has joined #openstack-keystone | 12:06 | |
| *** ChanServ sets mode: +o stevemar_ | 12:06 | |
| *** josecastroleon has joined #openstack-keystone | 12:07 | |
| *** links has joined #openstack-keystone | 12:12 | |
| *** links has quit IRC | 12:12 | |
| *** ajaya has quit IRC | 12:17 | |
| *** henrynash has joined #openstack-keystone | 12:22 | |
| *** ChanServ sets mode: +v henrynash | 12:22 | |
| *** fawadkhaliq has quit IRC | 12:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 12:27 | |
| *** NM has joined #openstack-keystone | 12:28 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 12:29 |
| *** fawadkhaliq has quit IRC | 12:31 | |
| *** jerrygb has joined #openstack-keystone | 12:31 | |
| openstackgerrit | Merged openstack/oslo.policy: Remove python 2.6 and cleanup tox.ini https://review.openstack.org/245482 | 12:37 |
| *** markvoelker has joined #openstack-keystone | 12:37 | |
| *** lhcheng has joined #openstack-keystone | 12:37 | |
| *** ChanServ sets mode: +v lhcheng | 12:37 | |
| *** markvoelker has quit IRC | 12:42 | |
| *** lhcheng has quit IRC | 12:42 | |
| *** alejandrito has joined #openstack-keystone | 12:42 | |
| openstackgerrit | Merged openstack/oslo.policy: Remove Python 2.6 classifier https://review.openstack.org/246259 | 12:45 |
| *** pauloewerton has joined #openstack-keystone | 12:46 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Enable retrieval of default values of domain config options https://review.openstack.org/185650 | 12:50 |
| *** exploreshaifali has quit IRC | 12:59 | |
| *** tyagiprince has quit IRC | 12:59 | |
| *** tyagiprince has joined #openstack-keystone | 12:59 | |
| *** ayoung_ has quit IRC | 13:01 | |
| *** doug-fish has joined #openstack-keystone | 13:02 | |
| *** lhcheng has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +v lhcheng | 13:02 | |
| openstackgerrit | Julien Danjou proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 13:05 |
| *** lhcheng has quit IRC | 13:07 | |
| *** pnavarro has joined #openstack-keystone | 13:08 | |
| *** csoukup has joined #openstack-keystone | 13:11 | |
| *** dave-mccowan has joined #openstack-keystone | 13:12 | |
| *** gordc has joined #openstack-keystone | 13:16 | |
| *** ff has joined #openstack-keystone | 13:17 | |
| *** ff has quit IRC | 13:18 | |
| *** cloudkiller is now known as cloudnull | 13:26 | |
| *** topol has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v topol | 13:27 | |
| *** markvoelker has joined #openstack-keystone | 13:27 | |
| *** raildo-afk is now known as raildo | 13:28 | |
| *** peter-hamilton has joined #openstack-keystone | 13:29 | |
| *** ninag has joined #openstack-keystone | 13:29 | |
| *** csoukup has quit IRC | 13:31 | |
| *** jdennis has quit IRC | 13:40 | |
| *** jdennis has joined #openstack-keystone | 13:40 | |
| *** diegows has joined #openstack-keystone | 13:49 | |
| *** bill_az has joined #openstack-keystone | 13:52 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 14:00 |
| *** ekarlso has joined #openstack-keystone | 14:01 | |
| *** mylu has joined #openstack-keystone | 14:03 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve Development Environment Docs https://review.openstack.org/246400 | 14:04 |
| *** tjcocozz has joined #openstack-keystone | 14:05 | |
| *** richm has joined #openstack-keystone | 14:05 | |
| samueldmq | dstanek: bknudson_ this is a first attemp to improve that documentation | 14:05 |
| samueldmq | ^^ | 14:06 |
| samueldmq | I'd appreciate your feedbacks on that | 14:06 |
| dstanek | samueldmq: nice, i'll take a look in a bit | 14:06 |
| samueldmq | henrynash: you too if you have some time :) ^ | 14:06 |
| samueldmq | dstanek: nice, thanks! | 14:07 |
| *** mylu has quit IRC | 14:08 | |
| henrynash | samueldmq: sure | 14:12 |
| *** thiagop has joined #openstack-keystone | 14:12 | |
| henrynash | dstanek: oh, and while you’re in review mode, could I ask that you take a look at: https://review.openstack.org/#/c/242853/14 since I’d like to get your view of how I’m creating a new versioned drive | 14:13 |
| *** tjcocozz has quit IRC | 14:15 | |
| *** tjcocozz has joined #openstack-keystone | 14:15 | |
| *** swebb has joined #openstack-keystone | 14:19 | |
| *** richm has quit IRC | 14:21 | |
| *** tjcocozz has quit IRC | 14:23 | |
| *** tjcocozz has joined #openstack-keystone | 14:24 | |
| dstanek | henrynash: will do | 14:25 |
| henrynash | dtsanek: thx | 14:26 |
| *** tyagiprince has quit IRC | 14:26 | |
| *** tjcocozz has quit IRC | 14:26 | |
| *** tjcocozz has joined #openstack-keystone | 14:27 | |
| *** tjcocozz has quit IRC | 14:27 | |
| *** tjcocozz has joined #openstack-keystone | 14:29 | |
| *** ayoung_ has joined #openstack-keystone | 14:33 | |
| *** hrou has joined #openstack-keystone | 14:33 | |
| *** breitz has quit IRC | 14:36 | |
| *** breitz has joined #openstack-keystone | 14:36 | |
| *** ekarlso has quit IRC | 14:40 | |
| *** henrynash has quit IRC | 14:41 | |
| *** doug-fish has quit IRC | 14:42 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/246206 | 14:47 |
| *** fawadkhaliq has joined #openstack-keystone | 14:48 | |
| *** ajaya has joined #openstack-keystone | 14:50 | |
| *** doug-fish has joined #openstack-keystone | 14:54 | |
| *** doug-fish has quit IRC | 14:57 | |
| *** richm has joined #openstack-keystone | 14:58 | |
| *** slberger has joined #openstack-keystone | 14:58 | |
| *** doug-fish has joined #openstack-keystone | 14:59 | |
| *** doug-fish has quit IRC | 14:59 | |
| *** doug-fish has joined #openstack-keystone | 15:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 15:00 |
| *** doug-fish has quit IRC | 15:01 | |
| openstackgerrit | Merged openstack/keystone: Exclude old Shibboleth options from docs https://review.openstack.org/241863 | 15:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/246197 | 15:09 |
| *** jaosorior has quit IRC | 15:10 | |
| *** jaosorior has joined #openstack-keystone | 15:11 | |
| *** pumaranikar has joined #openstack-keystone | 15:15 | |
| *** Guest80875 is now known as mfisch | 15:16 | |
| *** mfisch is now known as Guest20594 | 15:17 | |
| *** akanksha_ has joined #openstack-keystone | 15:17 | |
| *** btully has joined #openstack-keystone | 15:17 | |
| *** Guest20594 is now known as mfisch | 15:18 | |
| *** mfisch has quit IRC | 15:18 | |
| *** mfisch has joined #openstack-keystone | 15:18 | |
| *** doug-fish has joined #openstack-keystone | 15:21 | |
| *** adelia has joined #openstack-keystone | 15:21 | |
| *** urulama has quit IRC | 15:23 | |
| *** urulama has joined #openstack-keystone | 15:23 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Implied Roles https://review.openstack.org/125704 | 15:24 |
| *** davechen has joined #openstack-keystone | 15:24 | |
| *** davechen has quit IRC | 15:26 | |
| *** tonytan4ever has joined #openstack-keystone | 15:28 | |
| *** doug-fish has quit IRC | 15:29 | |
| *** doug-fish has joined #openstack-keystone | 15:30 | |
| *** davechen has joined #openstack-keystone | 15:30 | |
| *** doug-fis_ has joined #openstack-keystone | 15:31 | |
| *** davechen has quit IRC | 15:31 | |
| *** timcline has joined #openstack-keystone | 15:32 | |
| *** doug-fi__ has joined #openstack-keystone | 15:33 | |
| *** doug-fi__ has quit IRC | 15:33 | |
| *** doug-fi__ has joined #openstack-keystone | 15:34 | |
| *** doug-fish has quit IRC | 15:34 | |
| *** daemontool has quit IRC | 15:34 | |
| *** tjcocozz has quit IRC | 15:35 | |
| *** doug-fis_ has quit IRC | 15:36 | |
| *** tjcocozz has joined #openstack-keystone | 15:40 | |
| *** bill_az has quit IRC | 15:44 | |
| *** henrynash has joined #openstack-keystone | 15:45 | |
| *** ChanServ sets mode: +v henrynash | 15:45 | |
| *** opilotte has joined #openstack-keystone | 15:47 | |
| *** aj1 has joined #openstack-keystone | 15:47 | |
| *** diegows has quit IRC | 15:51 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Improve Development Environment Docs https://review.openstack.org/246400 | 15:56 |
| *** daemontool has joined #openstack-keystone | 15:57 | |
| samueldmq | mordred: thanks for your comments there ! just submitted another patch ^ | 15:57 |
| *** EinstCrazy has quit IRC | 15:57 | |
| aj1 | Hi guys. Can I take this patch up? https://review.openstack.org/#/c/127433 | 15:57 |
| samueldmq | mordred: hopefully that doc looks better now :) | 15:58 |
| aj1 | It seems that no one is working on this patch anymore. It needs addressing of bknudson's comments. | 15:58 |
| mordred | what did I do? | 15:59 |
| *** daemontool has quit IRC | 15:59 | |
| mordred | samueldmq: neat! | 15:59 |
| *** daemontool has joined #openstack-keystone | 15:59 | |
| *** davechen has joined #openstack-keystone | 16:03 | |
| *** diegows has joined #openstack-keystone | 16:04 | |
| *** rcernin has quit IRC | 16:04 | |
| *** diegows has quit IRC | 16:04 | |
| *** aj1 has quit IRC | 16:07 | |
| *** belmoreira has quit IRC | 16:13 | |
| lbragstad | dolphm spec related to a discussion we had at the summit - https://review.openstack.org/#/c/244694/ | 16:15 |
| *** ajaya has quit IRC | 16:17 | |
| lbragstad | dstanek ayoung_ samueldmq have I addressed your comments here - https://review.openstack.org/#/c/215715/ ? | 16:21 |
| *** _d34dh0r53_ is now known as d34dh0r53 | 16:22 | |
| ayoung_ | lbragstad, I +2ed that already. So ..... sure! | 16:23 |
| *** zqfan has quit IRC | 16:26 | |
| lbragstad | ayoung_ thanks! | 16:27 |
| *** ayoung_ is now known as ayoung | 16:29 | |
| Anticimex | who owns the "auth_plugin" that neutron requires, on my nova-api node's nova.conf's [neutron] section? (kilo) | 16:32 |
| Anticimex | 5 min into googlign and finding nothing of value in terms of reference docs or even examples :] | 16:32 |
| Anticimex | ah.. python-keystoneclient? | 16:33 |
| samueldmq | lbragstad: I will take another look on that | 16:33 |
| *** josecastroleon has quit IRC | 16:33 | |
| samueldmq | lbragstad: still today, thanks for updating | 16:33 |
| lbragstad | samueldmq ok | 16:34 |
| *** gokrokve has joined #openstack-keystone | 16:35 | |
| *** jbell8 has joined #openstack-keystone | 16:40 | |
| *** e0ne has quit IRC | 16:41 | |
| *** browne has joined #openstack-keystone | 16:42 | |
| davechen | stevemar_: Got a chance to see your book, I am wondering why I cannot find the price anywhere from the book. :) | 16:42 |
| *** jasonsb has joined #openstack-keystone | 16:43 | |
| *** doug-fi__ is now known as doug-fish | 16:43 | |
| openstackgerrit | Merged openstack/pycadf: Remove python 2.6 and cleanup tox.ini https://review.openstack.org/245492 | 16:45 |
| *** jaosorior has quit IRC | 16:46 | |
| *** jbell8 has quit IRC | 16:46 | |
| *** jaosorior has joined #openstack-keystone | 16:47 | |
| *** jasonsb has quit IRC | 16:48 | |
| *** e0ne has joined #openstack-keystone | 16:53 | |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v gyee | 16:55 | |
| *** jbell8 has joined #openstack-keystone | 16:56 | |
| *** topol has quit IRC | 17:03 | |
| *** topol has joined #openstack-keystone | 17:03 | |
| *** ChanServ sets mode: +v topol | 17:03 | |
| *** daemontool has quit IRC | 17:04 | |
| *** ayoung has quit IRC | 17:04 | |
| *** daemontool has joined #openstack-keystone | 17:04 | |
| Anticimex | best doc found this far is http://superuser.openstack.org/articles/how-to-use-keystoneclient-sessions-150b5992-f17e-4ece-9008-1e4eac068fd2 | 17:08 |
| Anticimex | it's a bit confusing why nova should have hardcoded passwords, i obviously want the neutron api calls nova executes on behalf of a user to be guided by the endusers authz | 17:10 |
| Anticimex | including project and domain, since that will vary | 17:10 |
| Anticimex | but my assumption may be wrong of course, maybe users can have nova do things with network on their behalf w/o having the authz themselves | 17:11 |
| Anticimex | but then nova needs to be able to create things regardless of what domain the user is in | 17:13 |
| *** e0ne has quit IRC | 17:13 | |
| *** topol has quit IRC | 17:13 | |
| *** topol has joined #openstack-keystone | 17:14 | |
| *** ChanServ sets mode: +v topol | 17:14 | |
| *** bdossant has quit IRC | 17:19 | |
| *** topol has quit IRC | 17:19 | |
| *** ayoung has joined #openstack-keystone | 17:20 | |
| *** ChanServ sets mode: +v ayoung | 17:20 | |
| *** e0ne has joined #openstack-keystone | 17:21 | |
| *** rcernin has joined #openstack-keystone | 17:36 | |
| openstackgerrit | Marian Horban proposed openstack/python-keystoneclient: Remove lock object from BaseIdentityPlugin https://review.openstack.org/246521 | 17:38 |
| *** zqfan has joined #openstack-keystone | 17:38 | |
| *** zqfan is now known as zqfan_AFK | 17:38 | |
| *** petertr7 is now known as petertr7_away | 17:39 | |
| *** tjcocozz has quit IRC | 17:40 | |
| *** jmccrory has quit IRC | 17:44 | |
| *** mylu has joined #openstack-keystone | 17:45 | |
| *** e0ne has quit IRC | 17:46 | |
| *** browne has quit IRC | 17:47 | |
| *** e0ne has joined #openstack-keystone | 17:49 | |
| *** urulama has quit IRC | 17:50 | |
| *** urulama has joined #openstack-keystone | 17:50 | |
| *** mylu has quit IRC | 17:51 | |
| *** lhcheng has joined #openstack-keystone | 17:52 | |
| *** ChanServ sets mode: +v lhcheng | 17:52 | |
| *** mylu has joined #openstack-keystone | 17:55 | |
| *** markvoelker_ has joined #openstack-keystone | 17:57 | |
| *** urulama_ has joined #openstack-keystone | 17:57 | |
| *** jmccrory has joined #openstack-keystone | 17:58 | |
| stevemar_ | reminder that the keystone meeting time has changed for those of you that observe day light savings | 17:59 |
| *** baffle has quit IRC | 17:59 | |
| stevemar_ | as in ... it's starting now | 17:59 |
| *** richm has quit IRC | 17:59 | |
| *** urulama has quit IRC | 17:59 | |
| *** agireud has quit IRC | 17:59 | |
| stevemar_ | courtesy ping for ajayaa, amakarov, ayoung, breton, browne, davechen, david8hu, dolphm, dstanek, ericksonsantos, geoffarnold, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, lbragstad, lhcheng, marekd, morganfainberg, nkinder, raildo, rodrigods, roxanaghe, samueldmq, shaleh, stevemar, tsymanczyk, topol, vivekd, wanghong, claudiub, rderose, samleon, xek | 17:59 |
| *** markvoelker has quit IRC | 18:00 | |
| *** BAKfr has quit IRC | 18:00 | |
| *** xek has quit IRC | 18:00 | |
| *** shaleh has joined #openstack-keystone | 18:00 | |
| *** baffle has joined #openstack-keystone | 18:00 | |
| *** mylu has quit IRC | 18:01 | |
| *** BAKfr has joined #openstack-keystone | 18:02 | |
| *** xek has joined #openstack-keystone | 18:03 | |
| *** agireud has joined #openstack-keystone | 18:05 | |
| *** richm has joined #openstack-keystone | 18:09 | |
| *** topol has joined #openstack-keystone | 18:15 | |
| *** ChanServ sets mode: +v topol | 18:15 | |
| *** mylu has joined #openstack-keystone | 18:17 | |
| *** tonytan4ever has quit IRC | 18:19 | |
| *** mylu has quit IRC | 18:20 | |
| *** mylu has joined #openstack-keystone | 18:20 | |
| *** mylu has quit IRC | 18:21 | |
| *** mylu has joined #openstack-keystone | 18:21 | |
| *** mylu has quit IRC | 18:24 | |
| *** mylu has joined #openstack-keystone | 18:25 | |
| *** fawadkhaliq has quit IRC | 18:26 | |
| *** mylu has quit IRC | 18:28 | |
| *** mylu has joined #openstack-keystone | 18:29 | |
| *** mylu has quit IRC | 18:31 | |
| *** spandhe has joined #openstack-keystone | 18:31 | |
| *** mylu has joined #openstack-keystone | 18:32 | |
| *** ayoung has quit IRC | 18:32 | |
| *** jaosorior has quit IRC | 18:34 | |
| *** tjcocozz has joined #openstack-keystone | 18:35 | |
| *** aj2 has joined #openstack-keystone | 18:36 | |
| *** tyagiprince has joined #openstack-keystone | 18:37 | |
| *** dims has quit IRC | 18:37 | |
| *** daemontool_ has quit IRC | 18:37 | |
| *** jasonsb has joined #openstack-keystone | 18:38 | |
| openstackgerrit | Ajaya Agrawal proposed openstack/keystone: remove assignments when deleting a domain https://review.openstack.org/127433 | 18:38 |
| *** gokrokve has quit IRC | 18:40 | |
| *** browne has joined #openstack-keystone | 18:40 | |
| *** dims has joined #openstack-keystone | 18:40 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project delete cascade https://review.openstack.org/244149 | 18:40 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 18:40 |
| *** tonytan4ever has joined #openstack-keystone | 18:41 | |
| *** mylu has quit IRC | 18:41 | |
| *** petertr7_away is now known as petertr7 | 18:41 | |
| *** mylu has joined #openstack-keystone | 18:41 | |
| *** e0ne has quit IRC | 18:43 | |
| *** pnavarro has quit IRC | 18:43 | |
| *** daemontool has quit IRC | 18:44 | |
| *** tqtran-afk has joined #openstack-keystone | 18:44 | |
| *** ayoung has joined #openstack-keystone | 18:45 | |
| *** ChanServ sets mode: +v ayoung | 18:45 | |
| *** mylu has quit IRC | 18:46 | |
| *** RichardRaseley has joined #openstack-keystone | 18:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone-specs: Make keystone fully fledged SAML2 Service Provider https://review.openstack.org/244694 | 18:46 |
| *** boris-42 has quit IRC | 18:48 | |
| *** EinstCrazy has joined #openstack-keystone | 18:49 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 18:51 |
| *** roxanaghe has joined #openstack-keystone | 18:52 | |
| *** tjcocozz_ has joined #openstack-keystone | 18:56 | |
| *** EinstCrazy has quit IRC | 18:56 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_user_ref consistently https://review.openstack.org/243877 | 18:57 |
| *** gokrokve has joined #openstack-keystone | 18:57 | |
| *** tjcocozz has quit IRC | 18:58 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Roles https://review.openstack.org/226661 | 18:59 |
| *** gokrokve has quit IRC | 19:02 | |
| *** aj2 has quit IRC | 19:03 | |
| stevemar_ | davechen: you're in SAT now? since when? | 19:03 |
| stevemar_ | davechen: ah, since this? http://www.siliconhillsnews.com/2015/09/10/rackspace-and-intel-open-the-openstack-innovation-center/ ? | 19:04 |
| *** diegoadolfo_ has joined #openstack-keystone | 19:04 | |
| samueldmq | have we considered adding microversions support for keystone ? | 19:06 |
| samueldmq | as we do have in nova | 19:06 |
| *** mylu has joined #openstack-keystone | 19:06 | |
| samueldmq | http://docs.openstack.org/developer/nova/api_microversions.html | 19:06 |
| samueldmq | stevemar_: henrynash: bknudson_: dstanek cc ^ | 19:06 |
| davechen | stevemar_: you are sooooo clever. | 19:07 |
| *** mylu has quit IRC | 19:07 | |
| shaleh | samueldmq, sdague explained how there can be at least 3 round trips to properly determine the current version of the API for nova | 19:07 |
| * davechen go for lunch | 19:08 | |
| shaleh | not sure we want that complexity personally | 19:08 |
| *** davechen is now known as davechen_afk | 19:08 | |
| *** mylu has joined #openstack-keystone | 19:08 | |
| samueldmq | shaleh: maybe I should catch more details on that, but could be simpler in keystone ? since we are a simpler project ? | 19:09 |
| *** andrewbogott has quit IRC | 19:09 | |
| *** andrewbogott has joined #openstack-keystone | 19:09 | |
| samueldmq | shaleh: or you mean the negotiation between server - client before using the api effectively ? | 19:09 |
| bknudson_ | I don't think anyone's given a compelling reason for microversions | 19:09 |
| shaleh | samueldmq, yes, that is before the API can be used. | 19:10 |
| bknudson_ | I'd rather we implemented JSONHome or swagger better | 19:10 |
| shaleh | bknudson_, yeah | 19:10 |
| bknudson_ | or HATEOS or whatever you want to call it | 19:10 |
| shaleh | HATEOS is a concept. JSONHome and swagger build on it | 19:11 |
| dstanek | bknudson_: ++ | 19:11 |
| samueldmq | for example, for inherited role assignments, we are about to change its beahvior | 19:11 |
| samueldmq | because it will now need to apply to the project itself too | 19:11 |
| dstanek | samueldmq: that's the key. existing things should work the same | 19:12 |
| samueldmq | for that we will be having a new config option to determine what behavior the API will have | 19:12 |
| samueldmq | if we were doing microersions, that would be a new version of the inherited grants api | 19:12 |
| *** mylu_ has joined #openstack-keystone | 19:12 | |
| samueldmq | and that's all ? | 19:12 |
| *** mylu has quit IRC | 19:12 | |
| dstanek | config options that change the API behavior are not great because that makes providers incompatible | 19:12 |
| shaleh | samueldmq, what about the people using client code written before microversions? | 19:12 |
| samueldmq | dstanek: yep, need to cehck with henrynash ? ^ | 19:14 |
| samueldmq | shaleh: we should keep the current api as default for some cycles | 19:14 |
| samueldmq | shaleh: similarly to what we do when deprecating things ? | 19:14 |
| samueldmq | shaleh: so people will have time to update their tooling | 19:15 |
| samueldmq | shaleh: makes sense? | 19:15 |
| shaleh | samueldmq, wouldn't we need to bump the major, then implement micros? | 19:15 |
| *** gokrokve has joined #openstack-keystone | 19:15 | |
| *** jvarlamova has quit IRC | 19:15 | |
| *** jasonsb has quit IRC | 19:15 | |
| samueldmq | shaleh: you mean like creating a v4? | 19:15 |
| *** pushkaru has joined #openstack-keystone | 19:16 | |
| shaleh | samueldmq, either that or it has to work with code ignorant of microversions | 19:16 |
| samueldmq | shaleh: yes, tht goes in the default version | 19:16 |
| *** pumaranikar has quit IRC | 19:16 | |
| samueldmq | shaleh: that would be the present version ? as we current do ? | 19:17 |
| samueldmq | shaleh: we just need to ensure the policies for working with microversions don't affect people that don't know about it, or at least have previous warning for when we will be removing support of things (deprecations) | 19:17 |
| *** gildub_ has joined #openstack-keystone | 19:20 | |
| *** gokrokve has quit IRC | 19:20 | |
| lbragstad | stevemar_ want me to start addressing comments on these? https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:bp/move-extensions,n,z | 19:20 |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_user_ref consistently https://review.openstack.org/243877 | 19:20 |
| *** mylu_ has quit IRC | 19:21 | |
| stevemar_ | lbragstad: i was gonna do them now! | 19:21 |
| stevemar_ | let me feel useful! | 19:21 |
| lbragstad | stevemar_ :) go for it! | 19:21 |
| *** mylu has joined #openstack-keystone | 19:21 | |
| shaleh | samueldmq, perhaps. I remain unconvinced. More complexity is almost always a bad thing. Many people talk to keystone without using the Python client API. We are placing a burden on all of them. | 19:22 |
| *** ekarlso has joined #openstack-keystone | 19:24 | |
| samueldmq | shaleh: and I am not conviced either way yet | 19:24 |
| samueldmq | shaleh: just would like to catch some opinions and think about it | 19:24 |
| samueldmq | shaleh: perhaps I need to read more, and mull it a bit more too | 19:24 |
| samueldmq | :) | 19:24 |
| shaleh | samueldmq, I am of a similar mind. | 19:25 |
| *** urulama_ has quit IRC | 19:25 | |
| *** mylu has quit IRC | 19:25 | |
| samueldmq | shaleh: ++ | 19:26 |
| *** petertr7 is now known as petertr7_away | 19:27 | |
| *** e0ne has joined #openstack-keystone | 19:27 | |
| shaleh | it would be nice if gerrit had a way to show patchset N _AND_ its comments instead of needing to click click click each file. | 19:28 |
| stevemar_ | lbragstad: like 3 changes for 15 comments :P | 19:29 |
| *** mylu has joined #openstack-keystone | 19:30 | |
| *** davechen_afk is now known as davechen | 19:30 | |
| *** electrichead is now known as redrobot | 19:31 | |
| *** redrobot is now known as Guest97404 | 19:31 | |
| stevemar_ | lbragstad: bknudson_ marekd i'll make release notes for all the extension moving at the end of the patch chain | 19:32 |
| *** Guest97404 is now known as redrobot | 19:32 | |
| *** tyagiprince has quit IRC | 19:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move federation extension into keystone core https://review.openstack.org/214775 | 19:33 |
| davechen | stevemar_: start it again :) | 19:33 |
| *** petertr7_away is now known as petertr7 | 19:33 | |
| *** josecastroleon has joined #openstack-keystone | 19:34 | |
| *** mylu has quit IRC | 19:34 | |
| *** josecastroleon has quit IRC | 19:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move federation sql migrations to common https://review.openstack.org/234537 | 19:39 |
| stevemar_ | lbragstad: ^ | 19:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move oauth1 extension into core https://review.openstack.org/234598 | 19:41 |
| *** aginwala has joined #openstack-keystone | 19:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move oauth1 sql migrations to common https://review.openstack.org/235121 | 19:44 |
| *** jamielennox|away is now known as jamielennox | 19:45 | |
| *** exploreshaifali has joined #openstack-keystone | 19:47 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke extension into core https://review.openstack.org/235704 | 19:49 |
| *** mylu has joined #openstack-keystone | 19:49 | |
| *** e0ne has quit IRC | 19:50 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 19:50 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 19:50 |
| bknudson_ | stevemar_: mind if I just update the liberty release notes with the `` for formatting? | 19:51 |
| *** jamielennox is now known as jamielennox|away | 19:52 | |
| *** mylu has quit IRC | 19:53 | |
| stevemar_ | bknudson_: sure go ahead | 19:53 |
| stevemar_ | i swear i tried that last night and it didn't work for me | 19:53 |
| stevemar_ | * definitely doesn't work | 19:54 |
| stevemar_ | for Boldness | 19:54 |
| stevemar_ | i'm rebasing a bunch of things, so if you update the patch, i'd appreciate it | 19:54 |
| *** doug-fis_ has joined #openstack-keystone | 19:57 | |
| *** aginwala has quit IRC | 20:00 | |
| *** doug-fish has quit IRC | 20:00 | |
| *** doug-fis_ has quit IRC | 20:01 | |
| *** adelia_ has joined #openstack-keystone | 20:01 | |
| *** doug-fish has joined #openstack-keystone | 20:01 | |
| *** adelia has quit IRC | 20:05 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Use unit.new_project_ref consistently https://review.openstack.org/244523 | 20:05 |
| *** davechen has quit IRC | 20:07 | |
| *** davechen has joined #openstack-keystone | 20:08 | |
| *** jamielennox|away is now known as jamielennox | 20:09 | |
| *** aginwala has joined #openstack-keystone | 20:10 | |
| *** shaleh is now known as shaleh|AFK | 20:10 | |
| *** doug-fish has quit IRC | 20:12 | |
| *** doug-fish has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke extension into core https://review.openstack.org/235704 | 20:16 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 20:16 |
| stevemar_ | lbragstad: we should be good! ^ | 20:16 |
| stevemar_ | marekd: bknudson_ ^ i think i caught everything, at least for federation/oauth/revoke | 20:17 |
| marekd | stevemar_: thaks, let me check it out tomorrow! | 20:18 |
| stevemar_ | marekd: cool! | 20:18 |
| stevemar_ | bknudson_: how did you decide to use > in the notes? | 20:18 |
| bknudson_ | stevemar_: I put that there when the build failed | 20:18 |
| stevemar_ | bknudson_: then magic? | 20:19 |
| bknudson_ | stevemar_: y, I just tried random stuff and this worked. | 20:19 |
| bknudson_ | http://www.yaml.org/spec/1.2/spec.html#id2760844 | 20:19 |
| *** mylu has joined #openstack-keystone | 20:20 | |
| bknudson_ | you use ** for bold, * is emphasis | 20:20 |
| *** tqtran-afk is now known as tqtran | 20:21 | |
| stevemar_ | ah | 20:22 |
| *** petertr7 is now known as petertr7_away | 20:26 | |
| *** aginwala has quit IRC | 20:26 | |
| *** doug-fish has quit IRC | 20:27 | |
| *** doug-fish has joined #openstack-keystone | 20:28 | |
| *** petertr7_away is now known as petertr7 | 20:30 | |
| *** ayoung has quit IRC | 20:33 | |
| *** jasonsb has joined #openstack-keystone | 20:37 | |
| *** xek has quit IRC | 20:38 | |
| *** peter-hamilton has quit IRC | 20:41 | |
| *** doug-fish has quit IRC | 20:41 | |
| *** pnavarro has joined #openstack-keystone | 20:41 | |
| *** doug-fish has joined #openstack-keystone | 20:42 | |
| *** davechen has left #openstack-keystone | 20:44 | |
| *** e0ne has joined #openstack-keystone | 20:44 | |
| *** doug-fish has quit IRC | 20:46 | |
| *** e0ne has quit IRC | 20:47 | |
| *** tonytan4ever has quit IRC | 20:50 | |
| *** shaleh|AFK is now known as shaleh | 20:52 | |
| *** pauloewerton has quit IRC | 20:58 | |
| *** dims_ has joined #openstack-keystone | 21:00 | |
| *** aginwala has joined #openstack-keystone | 21:02 | |
| *** dims has quit IRC | 21:02 | |
| *** adelia_ has quit IRC | 21:04 | |
| *** thiagop has quit IRC | 21:04 | |
| *** adelia has joined #openstack-keystone | 21:05 | |
| lhcheng | stevemar_: do we have a deadline set for the bp proposal? | 21:05 |
| lhcheng | like do we need to get bp approved by M-1 to get the code into M release.. | 21:05 |
| lhcheng | bp/specs | 21:05 |
| *** doug-fish has joined #openstack-keystone | 21:06 | |
| *** pnavarro has quit IRC | 21:06 | |
| *** mylu has quit IRC | 21:06 | |
| *** mylu has joined #openstack-keystone | 21:06 | |
| *** mylu_ has joined #openstack-keystone | 21:09 | |
| *** mylu has quit IRC | 21:09 | |
| stevemar_ | lhcheng: i'll be sending out that info soon | 21:10 |
| stevemar_ | we're still a few weeks away i think | 21:10 |
| stevemar_ | we used to do: BP/Spec in by M1, and code by M2, | 21:11 |
| stevemar_ | but i wonder how effective that was given the 'ask for exception' | 21:11 |
| *** NM has quit IRC | 21:12 | |
| dolphm | stevemar_: poke | 21:16 |
| stevemar_ | dolphm: poke back | 21:16 |
| lhcheng | hmm I think that's fine, it discourages people from doing everything at milestone 3. :P | 21:16 |
| lhcheng | it would be chaos | 21:16 |
| *** Nakato_ is now known as Nakato | 21:16 | |
| *** mylu_ has quit IRC | 21:20 | |
| *** mylu has joined #openstack-keystone | 21:21 | |
| henrynash | dstanek, samueldmq: for new inheritance rules, we are not using a config to change behaviour - it is a new API….assignments made with the old (extension) APi will work the old way, assignments made using the new (core) API will work with new way... | 21:22 |
| *** mylu has quit IRC | 21:23 | |
| *** mylu has joined #openstack-keystone | 21:24 | |
| *** mylu has quit IRC | 21:24 | |
| *** mylu has joined #openstack-keystone | 21:24 | |
| *** aginwala has quit IRC | 21:29 | |
| *** mylu has quit IRC | 21:33 | |
| *** mylu has joined #openstack-keystone | 21:34 | |
| *** mylu has quit IRC | 21:35 | |
| *** mylu has joined #openstack-keystone | 21:35 | |
| *** timcline has quit IRC | 21:36 | |
| *** tonytan4ever has joined #openstack-keystone | 21:37 | |
| *** aginwala has joined #openstack-keystone | 21:42 | |
| *** pushkaru has quit IRC | 21:42 | |
| *** pushkaru has joined #openstack-keystone | 21:42 | |
| openstackgerrit | Sam Leong proposed openstack/python-keystoneclient: Auth plugin for X.509 tokenless authz https://review.openstack.org/246615 | 21:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use [] where a field is required https://review.openstack.org/246617 | 21:45 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use [] where a field is required https://review.openstack.org/246617 | 21:48 |
| *** dims_ has quit IRC | 21:51 | |
| shaleh | would someone please +A my new_user_ref() review --> https://review.openstack.org/#/c/243877/ | 21:53 |
| *** opilotte has quit IRC | 21:53 | |
| *** dims has joined #openstack-keystone | 21:57 | |
| *** hrou has quit IRC | 21:59 | |
| *** akanksha_ has quit IRC | 22:10 | |
| *** akanksha_ has joined #openstack-keystone | 22:11 | |
| *** tjcocozz_ has quit IRC | 22:11 | |
| *** lhcheng has quit IRC | 22:14 | |
| *** timcline has joined #openstack-keystone | 22:14 | |
| *** timcline has quit IRC | 22:15 | |
| *** timcline has joined #openstack-keystone | 22:16 | |
| *** lhcheng has joined #openstack-keystone | 22:16 | |
| *** ChanServ sets mode: +v lhcheng | 22:16 | |
| *** rcernin has quit IRC | 22:21 | |
| *** petertr7 is now known as petertr7_away | 22:22 | |
| *** ayoung has joined #openstack-keystone | 22:23 | |
| *** ChanServ sets mode: +v ayoung | 22:23 | |
| *** browne has quit IRC | 22:27 | |
| ayoung | https://review.openstack.org/#/c/125704/ gyee marekd care to double down and help me actually get this thing merged? | 22:29 |
| *** petertr7_away is now known as petertr7 | 22:31 | |
| shaleh | ayoung: did something happen to the commit message? | 22:32 |
| ayoung | shaleh, on https://review.openstack.org/#/c/125704 ? | 22:33 |
| shaleh | ayoung: yes | 22:33 |
| ayoung | Its a spec...commit messages there are usually short | 22:33 |
| shaleh | it looks clipped or something. | 22:33 |
| gyee | ayoung, looking | 22:35 |
| *** ninag has quit IRC | 22:37 | |
| *** gordc has quit IRC | 22:40 | |
| *** topol has quit IRC | 22:41 | |
| openstackgerrit | Dan Nguyen proposed openstack/python-keystoneclient: Add include_subtree to role_list_assignments call https://review.openstack.org/188184 | 22:45 |
| *** mylu has quit IRC | 22:46 | |
| *** mylu has joined #openstack-keystone | 22:47 | |
| *** slberger has left #openstack-keystone | 22:49 | |
| *** aginwala has quit IRC | 22:49 | |
| *** mylu has quit IRC | 22:52 | |
| *** jasonsb_ has joined #openstack-keystone | 22:53 | |
| *** jasonsb has quit IRC | 22:54 | |
| *** aginwala has joined #openstack-keystone | 22:54 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix inaccurate debug mode response https://review.openstack.org/238636 | 22:54 |
| *** mylu has joined #openstack-keystone | 22:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke extension into core https://review.openstack.org/235704 | 22:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move revoke sql migrations to common https://review.openstack.org/235712 | 22:59 |
| *** dims has quit IRC | 23:00 | |
| stevemar_ | ayoung: don't rush to merge the specs, please | 23:00 |
| *** dims has joined #openstack-keystone | 23:01 | |
| *** timcline has quit IRC | 23:01 | |
| gyee | +1.5 | 23:01 |
| stevemar_ | gyee: help shaleh out https://review.openstack.org/#/c/243877/ | 23:01 |
| samueldmq | henrynash: nice, thnaks for clarifying :) | 23:02 |
| gyee | stevemar_, I can do A+ right? | 23:02 |
| gyee | since we both from the same organization, that the rule? | 23:02 |
| stevemar_ | gyee: for shaleh's patch? sure, why not? | 23:02 |
| gyee | our paycheck signed by the same employer | 23:02 |
| stevemar_ | gyee: yeah, the rule only applies if: author, reviewer and approver are all same org | 23:02 |
| stevemar_ | last i checked, i don't work for hpe | 23:03 |
| gyee | stevemar_, alrighty then, thanks for the clarification | 23:03 |
| *** dims_ has joined #openstack-keystone | 23:04 | |
| *** aginwala_ has joined #openstack-keystone | 23:05 | |
| *** dims has quit IRC | 23:07 | |
| *** aginwala has quit IRC | 23:08 | |
| *** aginwala_ has quit IRC | 23:09 | |
| *** aginwala has joined #openstack-keystone | 23:09 | |
| *** exploreshaifali has quit IRC | 23:10 | |
| *** gokrokve has joined #openstack-keystone | 23:11 | |
| ayoung | stevemar_, define rush? | 23:11 |
| stevemar_ | ayoung: i'd like at least half the keystone-specs-core at least be *aware* of the patch | 23:12 |
| ayoung | stevemar_, have I ever been accused of undercommunicating? | 23:12 |
| stevemar_ | ayoung: nope, but unfortunately, i can't force people to review :( | 23:13 |
| ayoung | stevemar_, implied roles was origianlly submitteed Oct 2, 2014 12:38 PM. That is not even hasty by Ent standards | 23:13 |
| stevemar_ | i wish i could | 23:13 |
| stevemar_ | ayoung: also, it's targeted to backlog :) | 23:14 |
| *** tonytan4ever has quit IRC | 23:14 | |
| ayoung | stevemar_, plus, it is only submitted for backlog right now. Still need another to move it to Mitaka | 23:14 |
| *** gokrokve has quit IRC | 23:15 | |
| stevemar_ | ayoung: i'll be reviewing the specs soon (again) | 23:15 |
| ayoung | stevemar_, I have a working patch that implements it, but I don't want to rewrite it again until we have the spec at least somewhat approved. henrynash and I were the prime discussants on this, but there have been input from most of the team. Henry gave it jhs blessing, and he has a spec that depends on it , too. | 23:15 |
| shaleh | it matches what we talked about at the summit | 23:15 |
| shaleh | like mr. nash, I am not certain of the one user, one role rule | 23:16 |
| ayoung | shaleh, it needs to be "possible" not "required" to do that | 23:16 |
| shaleh | ayoung: not how the spec reads currently | 23:16 |
| ayoung | TYes it does...reread it | 23:16 |
| stevemar_ | i just want consensus from the core team, but that is looking hard to get | 23:16 |
| ayoung | I wrote that very deliberately | 23:16 |
| ayoung | "To minimize the burden on the adminstators, users' explicit role assignments must be limitable to one role per user per project." | 23:17 |
| ayoung | With the current setup, you can't say that a user may have only one role on a project and still have fine grained control | 23:18 |
| ayoung | Not that the system has to enforce that a user cannot be assigned multiple roles | 23:18 |
| shaleh | ayoung: the implication is this spec moves to the one user, one role. | 23:18 |
| shaleh | ayoung: because the rest of the text says what must happen | 23:19 |
| ayoung | shaleh, that will be the normal set up. This spec allows for it | 23:19 |
| *** gokrokve has joined #openstack-keystone | 23:19 | |
| ayoung | One explicit role: you get made a manager, or a release engineer, whatever | 23:19 |
| ayoung | That is what henrynash is pushing towards with his domain specific roles: | 23:19 |
| ayoung | the role you get is organizationally specific | 23:20 |
| shaleh | ayoung: I get the purpose, just not sold on the language. | 23:20 |
| gyee | ayoung, the spec is very close, just a couple of questions | 23:20 |
| shaleh | ayoung: I have dealt with too many rule lawyers in my day :-) | 23:20 |
| gyee | what does revocation look like if one of them implied roles in the chain has changed | 23:21 |
| *** mylu has quit IRC | 23:24 | |
| *** mylu has joined #openstack-keystone | 23:24 | |
| *** lhcheng has quit IRC | 23:25 | |
| *** wuhg has joined #openstack-keystone | 23:26 | |
| *** lhcheng has joined #openstack-keystone | 23:27 | |
| *** ChanServ sets mode: +v lhcheng | 23:27 | |
| *** doug-fish has quit IRC | 23:30 | |
| *** aginwala_ has joined #openstack-keystone | 23:31 | |
| *** alejandrito has quit IRC | 23:31 | |
| *** aginwal__ has joined #openstack-keystone | 23:32 | |
| *** petertr7 is now known as petertr7_away | 23:32 | |
| *** aginwala has quit IRC | 23:34 | |
| *** aginwala_ has quit IRC | 23:35 | |
| ayoung | gyee, it actually does not matter with Fernet. Remeber that discussion? We are over-revoking. | 23:36 |
| ayoung | gyee, if an inference rule changes, only PKI tokens would have bad data. For a UUID token, we should rebuild the role set on each validation anyway | 23:37 |
| ayoung | I wish that all the effort we put in to specs was somehow translated to end-user documentation | 23:38 |
| *** EinstCrazy has joined #openstack-keystone | 23:39 | |
| gyee | ayoung, yeah, with fernet, we may not have to worry about role assignment changes | 23:43 |
| *** josecastroleon has joined #openstack-keystone | 23:45 | |
| *** EinstCrazy has quit IRC | 23:48 | |
| *** gokrokve has quit IRC | 23:51 | |
| ayoung | gyee, since PKI does not work with the revocation events, I think it is a non issue. | 23:51 |
| gyee | agreed | 23:51 |
| *** adelia has quit IRC | 23:53 | |
| ayoung | gyee, I do think we need to rework UUID tokens to be consistant with Fernet: rebuild the token every time | 23:53 |
| *** adelia has joined #openstack-keystone | 23:54 | |
| ayoung | Wow...I just fuigured out Spell chcking in emacs...they put the word at the top of the page...I never even thought to look there. Time to start drinking | 23:55 |
| gyee | ayoung, yeah, reason we didn't rebuild was to optimize performance | 23:55 |
| ayoung | gyee, as I recall, you origianlly did rebuild, and termie got on your case for it | 23:55 |
| *** adelia has quit IRC | 23:55 | |
| ayoung | turns out you were right.... | 23:55 |
| *** adelia has joined #openstack-keystone | 23:55 | |
| gyee | but since we do client-side caching, that argument may not hold much value | 23:56 |
| gyee | with dogpile enabled, we are really not gaining anything anymore | 23:58 |
| shaleh | ayoung: I use flyspell. Incorrect words are flag inline. | 23:58 |
| shaleh | ayoung: way more sensible UX for spell checking. It now works like most other modern text engines. | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!