| bknudson_ | I think the reason ksa is failing is because deprecated_opts in config is supposed to be cfg.DeprecatedOpt , not a cfg.Opt. | 00:00 |
|---|---|---|
| *** spzala has joined #openstack-keystone | 00:02 | |
| *** ninag has joined #openstack-keystone | 00:03 | |
| openstackgerrit | Timothy Symanczyk proposed openstack/oslo.policy: Don't crash on RoleCheck when roles not present https://review.openstack.org/262329 | 00:04 |
| *** spzala has quit IRC | 00:06 | |
| *** dims_ has quit IRC | 00:07 | |
| bknudson_ | jamielennox: you around? | 00:08 |
| *** ninag has quit IRC | 00:08 | |
| *** itlinux has quit IRC | 00:10 | |
| *** itlinux has joined #openstack-keystone | 00:11 | |
| bknudson_ | jamielennox: is it intentional that ksa1.loading.Opt()'s deprecated= parameter takes a list of ksa1.loading.Opt? | 00:12 |
| bknudson_ | I'm asking because oslo_config's Opt takes a list of oslo_config.cfg.DeprecatedOpt, not a list of Opt. | 00:14 |
| jamielennox | bknudson_: i'm here | 00:15 |
| jamielennox | yea, but we don't have access to oslo_config from ksa, so Opt is really our only choice | 00:16 |
| jamielennox | i guess we could have made a ksa.DeprecatedOpt, but it's the same without a type | 00:16 |
| bknudson_ | DeprecatedOpt is nothing like Opt | 00:16 |
| jamielennox | the register_conf stuff converts correctly from Opt to DeprecatedOpt | 00:16 |
| jamielennox | bknudson_: is it causing problems or just a strange conversion? | 00:18 |
| bknudson_ | the only references to DeprecatedOpt is in docstrings. | 00:18 |
| bknudson_ | jamielennox: it is causing problems -- http://logs.openstack.org/48/264348/1/check/gate-tempest-dsvm-neutron-src-keystoneauth/ef820ee/logs/screen-g-api.txt.gz | 00:19 |
| openstackgerrit | Merged openstack/keystone: Add `type' filter for list_credentials_for_user https://review.openstack.org/235214 | 00:21 |
| bknudson_ | hmm... DeprecatedOpt is referenced in test_deprecated. | 00:21 |
| bknudson_ | but it's not referenced in any of the non-test code | 00:21 |
| *** fangxu has quit IRC | 00:22 | |
| jamielennox | bknudson_: that seems wrong | 00:22 |
| jamielennox | bknudson_: that whole patch | 00:22 |
| jamielennox | a ksa.Opt is not a oslo_config.Opt - they are different objects and they aren't supposed to be interchangable | 00:23 |
| jamielennox | i don't want the headache of trying to keep ksa up to date with oslo.config | 00:23 |
| bknudson_ | here's hte change in master: https://review.openstack.org/#/c/253825/ | 00:23 |
| bknudson_ | I thought when we talked about this earlier there was going to be a new project or something. | 00:24 |
| jamielennox | yea, i mean the change to master as well | 00:24 |
| bknudson_ | oh, but that was built on the original change... | 00:24 |
| jamielennox | the only reason i can see that they came across this problem is they were trying to register ksa Opts directly into oslo_config | 00:24 |
| jamielennox | bknudson_: the conversion function does the right thing: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/opts.py#L100 | 00:26 |
| *** doug-fish has quit IRC | 00:26 | |
| bknudson_ | oh... when was that changed? | 00:26 |
| bknudson_ | you fixed it! https://github.com/openstack/keystoneauth/commit/54c0c6abe618c8fa3f2e7ce95811a2b8346c7c8d | 00:27 |
| bknudson_ | we need that in stable/liberty | 00:27 |
| jamielennox | i didn't know there was a stable/liberty of ksa | 00:27 |
| bknudson_ | although we have to squash both... I'll propose that since that should fix it. | 00:28 |
| bknudson_ | we made a stable/liberty even though nobody was using it. | 00:28 |
| bknudson_ | now it's broken. | 00:28 |
| jamielennox | i'd quite like to revert that original patch - it seems to be masking a bigger issue | 00:28 |
| jamielennox | mordred, notmorgan: do you know where this stemed from? | 00:29 |
| notmorgan | jamielennox: huh? | 00:30 |
| jamielennox | https://review.openstack.org/#/c/253825/ | 00:30 |
| jamielennox | there's a function for converting ksa->oslo_config opts: https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/conf.py#L45 | 00:30 |
| notmorgan | right | 00:31 |
| jamielennox | we really should not be registering ksa.Opt directly as an oslo_config Opt | 00:31 |
| notmorgan | isn't that what the .to_oslo or whatever that was? | 00:31 |
| jamielennox | that's a private function on the Opt, we could probably make it public but i didn't see why people would use it directly | 00:32 |
| notmorgan | there is a stable liberty of ksa? | 00:33 |
| * notmorgan feels like i should know that. | 00:33 | |
| bknudson_ | we can see if this passes: https://review.openstack.org/#/c/264485/ | 00:33 |
| notmorgan | well ksa is not becoming dependant on oslo.config | 00:33 |
| bknudson_ | I was able to recreate locally and those changes fixed it, so should work. | 00:33 |
| notmorgan | so, we need a way around this issue | 00:34 |
| notmorgan | jamielennox: ^ | 00:35 |
| notmorgan | reverting may or may not be the riht answer either | 00:35 |
| jamielennox | notmorgan: it's fine how it is, it doesn't have a dep and won't get one | 00:35 |
| notmorgan | rightr | 00:36 |
| jamielennox | notmorgan: but the fact that mordred hit that issue means he was misusing the ksa Opts | 00:36 |
| notmorgan | jamielennox: right | 00:36 |
| jamielennox | notmorgan: i thought you might have known how/what/where | 00:36 |
| notmorgan | not sure | 00:36 |
| notmorgan | off the top of my head | 00:36 |
| jamielennox | was it in a release? | 00:37 |
| jamielennox | there should be an easy way to answer that question without trolling logs | 00:37 |
| jamielennox | trawling ? | 00:37 |
| jamielennox | bah - specifically that commit was tagged as 2.1.0 | 00:38 |
| bknudson_ | write something better and then we can deprecate the old stuff | 00:39 |
| bknudson_ | then get rid of it in keystoneauth2 | 00:39 |
| bknudson_ | in 2020 | 00:40 |
| jamielennox | lol, keystoneauth2 | 00:40 |
| bknudson_ | I thought mordred's change was before jamielennox's, turns out jamielennox made the deprecated fix first: https://review.openstack.org/#/c/264485/ | 00:45 |
| bknudson_ | I don't know if we need both to get stable/liberty passing. we'll see. | 00:46 |
| jamielennox | bknudson_: ideally if i propose the revert at least we'd see where the misuse was | 00:46 |
| bknudson_ | it was glance-api that failed to start due to the deprecatedOpt issue | 00:47 |
| *** shoutm_ has joined #openstack-keystone | 00:48 | |
| bknudson_ | so I'd suggest starting there | 00:48 |
| *** shoutm has quit IRC | 00:50 | |
| *** gyee has quit IRC | 00:54 | |
| *** dims has joined #openstack-keystone | 00:56 | |
| *** spzala has joined #openstack-keystone | 00:56 | |
| *** spzala has quit IRC | 01:00 | |
| *** spzala has joined #openstack-keystone | 01:06 | |
| *** EinstCrazy has joined #openstack-keystone | 01:07 | |
| *** boris-42 has quit IRC | 01:13 | |
| *** _zouyee has joined #openstack-keystone | 01:14 | |
| *** _cjones_ has quit IRC | 01:18 | |
| *** shoutm_ has quit IRC | 01:21 | |
| *** shoutm has joined #openstack-keystone | 01:22 | |
| stevemar | back online now | 01:26 |
| stevemar | bknudson_: just read the scroll back on the ksa issue | 01:27 |
| stevemar | i dont have much to add :( | 01:27 |
| stevemar | bknudson_: oh a new error | 01:33 |
| stevemar | AttributeError: 'AccessInfoV3' object has no attribute 'bind' | 01:33 |
| stevemar | maybe we need https://review.openstack.org/#/c/179676/14 or https://review.openstack.org/#/c/180817/9 | 01:34 |
| *** itlinux has quit IRC | 01:35 | |
| stevemar | err *this* one: https://review.openstack.org/#/c/235107/ | 01:35 |
| mnaser | well, we're finally integrating keystone with our billing system for auth with openid connect. in our billing system, we have the tenant ID of each user stored. if we extend our openid info to include that, will I be able to use the mappings to map to a specific tenant id? -- http://docs.openstack.org/developer/keystone/mapping_combinations.html are pretty .. difficult to read | 01:36 |
| mnaser | or will we have to re-engineer or stuff at our side to expose the user_id and map that directly? | 01:37 |
| stevemar | mnaser: the mappings only map to a specific group, which could have a role to a specific tenant | 01:37 |
| mnaser | hmm | 01:37 |
| stevemar | so you can't say "everyone who has X open id connect property has a role on this tenant/project" | 01:38 |
| stevemar | *but* | 01:38 |
| stevemar | you can say "everyone who has X open id connect property is a member of group Y in keytone" | 01:38 |
| stevemar | and make group Y have a role on a tenant/project | 01:38 |
| stevemar | the reasoning is, identity stuff should map to identity stuff | 01:39 |
| mnaser | so id have to create a group for every single tenant | 01:39 |
| stevemar | mnaser: i think it's gonna depend on how you want it setup | 01:41 |
| *** _zouyee has quit IRC | 01:41 | |
| mnaser | i mean if we're going to do all these changes, i dont mind "doing it right", so if it means leaving our current single user assigned to single tenant per user, then we'll do that | 01:42 |
| *** spzala has quit IRC | 01:42 | |
| mnaser | we'll just have to make sure we can do that without breaking existing behaviour | 01:42 |
| *** spzala has joined #openstack-keystone | 01:54 | |
| *** jasonsb has joined #openstack-keystone | 02:08 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/264454 | 02:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Perform middleware tests with webtest https://review.openstack.org/244440 | 02:16 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Make AuthContext depend on auth_token middleware https://review.openstack.org/255686 | 02:16 |
| *** shoutm has quit IRC | 02:18 | |
| *** lhcheng_ has quit IRC | 02:23 | |
| *** shoutm has joined #openstack-keystone | 02:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:28 | |
| *** shoutm has quit IRC | 02:30 | |
| *** shoutm has joined #openstack-keystone | 02:35 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/264427 | 02:35 |
| openstackgerrit | Merged openstack/keystone: Deprecated tox -downloadcache option removed https://review.openstack.org/256599 | 02:44 |
| openstackgerrit | Merged openstack/keystone: Cleanup tox.ini py34 test list https://review.openstack.org/260231 | 02:52 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/264428 | 02:55 |
| openstackgerrit | Merged openstack/pycadf: Updated from global requirements https://review.openstack.org/264461 | 02:57 |
| stevemar | man there were a lot of merges today | 02:57 |
| *** dims has quit IRC | 02:58 | |
| *** spandhe has quit IRC | 03:02 | |
| openstackgerrit | Merged openstack/keystone: remove irrelevant parenthesis https://review.openstack.org/263415 | 03:02 |
| *** boris-42 has joined #openstack-keystone | 03:03 | |
| openstackgerrit | Merged openstack/keystone: Remove comments on enforcing endpoints for trust https://review.openstack.org/255305 | 03:05 |
| openstackgerrit | Einst Crazy proposed openstack/pycadf: Fix wrong use of comma https://review.openstack.org/264526 | 03:06 |
| *** links has joined #openstack-keystone | 03:10 | |
| *** links has quit IRC | 03:10 | |
| *** edmondsw has quit IRC | 03:12 | |
| *** links has joined #openstack-keystone | 03:12 | |
| notmorgan | stevemar: yeah | 03:14 |
| stevemar | notmorgan: ahoy matey | 03:14 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Make project.domain_id column nullable https://review.openstack.org/264533 | 03:34 |
| *** richm has quit IRC | 03:48 | |
| *** fawadkhaliq has quit IRC | 03:49 | |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Opt-out certain Keystone Notifications https://review.openstack.org/253780 | 03:49 |
| openstackgerrit | Merged openstack/python-keystoneclient: Support `truncated` flag returned by keystone https://review.openstack.org/250473 | 03:59 |
| *** shoutm has quit IRC | 04:02 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Change project unique constraint https://review.openstack.org/158372 | 04:06 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Removes project.domain_id FK https://review.openstack.org/233274 | 04:09 |
| *** shoutm has joined #openstack-keystone | 04:10 | |
| stevemar | bknudson_: aroundish? i think i finally figured out the chain of patches necessary for stable/liberty of ksa | 04:11 |
| stevemar | bknudson_: check out https://review.openstack.org/#/c/264525/ when you get a chance, and the string of patches it has | 04:12 |
| *** _zouyee has joined #openstack-keystone | 04:28 | |
| *** topol has joined #openstack-keystone | 04:30 | |
| *** ChanServ sets mode: +v topol | 04:30 | |
| *** topol has quit IRC | 04:35 | |
| *** jaosorior has joined #openstack-keystone | 04:45 | |
| *** dave-mccowan has quit IRC | 04:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/264426 | 04:53 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/264462 | 04:57 |
| *** shoutm_ has joined #openstack-keystone | 05:03 | |
| *** shoutm has quit IRC | 05:04 | |
| *** teju has joined #openstack-keystone | 05:13 | |
| *** EinstCrazy has quit IRC | 05:14 | |
| *** EinstCrazy has joined #openstack-keystone | 05:14 | |
| teju | Hi, I changed the token expiration in [token] section of keystone.conf file. What is the command to restart keystone in Kilo for RHEL? | 05:15 |
| jamielennox | teju: it depends if you're running via apache or eventlet, | 05:16 |
| jamielennox | it'll either be systemctl restart httpd or systemctl restart openstack-keystone respectively | 05:16 |
| teju | +jamielennox : ok, is there a way to find whether I am running apache or eventlet, I am not sure because I am installing RHEL OpenStack Platform 7 for the first time | 05:17 |
| jamielennox | teju: normally just ps aux | grep keystone will give you info | 05:18 |
| jamielennox | either you'll see a keystone-all bin, or likely the apache server is using the keystone user so you'll see that | 05:19 |
| teju | keystone 23763 0.7 0.0 347712 69692 ? Ss Jan04 31:41 /usr/bin/python /usr/bin/keystone-all | 05:19 |
| jamielennox | ok, that's eventlet | 05:20 |
| *** EinstCra_ has joined #openstack-keystone | 05:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:20 | |
| *** jdennis has joined #openstack-keystone | 05:21 | |
| teju | +jamielennox : ok, is there a way to know the keystone token expiration value other than from conf file? | 05:21 |
| jamielennox | teju: you will be able to test it from the expiry that is in the token data | 05:22 |
| *** jdennis1 has quit IRC | 05:22 | |
| *** EinstCrazy has quit IRC | 05:23 | |
| teju | +jamielennox : expires : 2016-01-07T09:22:45Z | 05:24 |
| teju | +jamielennox : my system time is Thu Jan 7 00:22:49 EST 2016 | 05:24 |
| teju | +jamielennox : from the above two outputs, is the token expiration time 9 hours? | 05:25 |
| jamielennox | looks like | 05:26 |
| teju | +jamielennox : however, the expiration value in conf file is 14400 = 4 hours | 05:27 |
| *** jasonsb has quit IRC | 05:28 | |
| jamielennox | teju: actually it's not | 05:29 |
| jamielennox | your system time is in EST and expires will always be in UTC | 05:30 |
| jamielennox | (i don't know if that gives 4 hours) | 05:30 |
| jamielennox | current utc is 05:30 so it is 4 hours | 05:31 |
| *** shoutm has joined #openstack-keystone | 05:33 | |
| teju | +jamielennox : thanks , UTC = EST + 5hours | 05:33 |
| *** shoutm_ has quit IRC | 05:34 | |
| teju | +jamielennox: so, token expiration = 9-5 = 4; that makes sense....thanks | 05:34 |
| *** shoutm_ has joined #openstack-keystone | 05:37 | |
| *** GB21 has joined #openstack-keystone | 05:38 | |
| *** shoutm has quit IRC | 05:38 | |
| lbragstad | henrynash around? | 05:44 |
| *** henrynash has quit IRC | 05:50 | |
| *** shoutm_ has quit IRC | 06:00 | |
| *** shoutm has joined #openstack-keystone | 06:03 | |
| *** jasonsb has joined #openstack-keystone | 06:04 | |
| *** jasonsb has quit IRC | 06:09 | |
| *** markvoelker has quit IRC | 06:11 | |
| *** ankit_ag has joined #openstack-keystone | 06:24 | |
| ankit_ag | Hii all, Can someone please help reviewing https://review.openstack.org/#/c/263158/ and to add opinion about separating unit test cases from the bug fix | 06:25 |
| ankit_ag | Thanks | 06:25 |
| *** shoutm_ has joined #openstack-keystone | 06:30 | |
| *** shoutm has quit IRC | 06:30 | |
| *** agireud has quit IRC | 06:38 | |
| *** PsionTheory has quit IRC | 06:38 | |
| *** agireud has joined #openstack-keystone | 06:44 | |
| *** vgridnev has joined #openstack-keystone | 06:48 | |
| *** shoutm has joined #openstack-keystone | 06:58 | |
| *** shoutm_ has quit IRC | 07:01 | |
| openstackgerrit | Ankit Agrawal proposed openstack/keystone: Replace unicode with six.text_type https://review.openstack.org/261253 | 07:02 |
| *** ankit_ag has quit IRC | 07:10 | |
| *** EinstCrazy has joined #openstack-keystone | 07:11 | |
| *** EinstCra_ has quit IRC | 07:11 | |
| *** markvoelker has joined #openstack-keystone | 07:11 | |
| *** ankit_ag has joined #openstack-keystone | 07:15 | |
| *** markvoelker has quit IRC | 07:16 | |
| *** belmoreira has joined #openstack-keystone | 07:26 | |
| *** EinstCrazy has quit IRC | 07:29 | |
| *** EinstCrazy has joined #openstack-keystone | 07:29 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Set deprecated_reason on deprecated options https://review.openstack.org/264475 | 07:42 |
| *** ninag has joined #openstack-keystone | 07:42 | |
| *** ninag has quit IRC | 07:47 | |
| *** fawadkhaliq has quit IRC | 08:00 | |
| *** GB21 has quit IRC | 08:01 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Update man pages with Mitaka version and dates https://review.openstack.org/264658 | 08:14 |
| openstackgerrit | lei zhang proposed openstack/keystone: Remove some unnecessary https://review.openstack.org/264663 | 08:28 |
| openstackgerrit | Merged openstack/keystone: Some small improvements on fernet uuid handling https://review.openstack.org/235082 | 08:33 |
| *** browne has quit IRC | 08:34 | |
| *** fhubik has joined #openstack-keystone | 08:59 | |
| *** GB21 has joined #openstack-keystone | 08:59 | |
| *** vgridnev has quit IRC | 09:06 | |
| *** markvoelker has joined #openstack-keystone | 09:12 | |
| *** markvoelker has quit IRC | 09:17 | |
| *** jaosorior has quit IRC | 09:17 | |
| *** fhubik is now known as fhubik_brb | 09:19 | |
| *** vgridnev has joined #openstack-keystone | 09:20 | |
| *** vgridnev has quit IRC | 09:25 | |
| *** browne has joined #openstack-keystone | 09:25 | |
| *** fhubik_brb is now known as fhubik | 09:26 | |
| *** browne has quit IRC | 09:28 | |
| *** GB21 has quit IRC | 09:30 | |
| *** GB21 has joined #openstack-keystone | 09:31 | |
| *** oomichi has quit IRC | 09:32 | |
| *** jaosorior has joined #openstack-keystone | 09:32 | |
| *** daemontool has joined #openstack-keystone | 09:32 | |
| *** jistr has joined #openstack-keystone | 09:41 | |
| *** mhickey has joined #openstack-keystone | 09:43 | |
| samueldmq | morning keystoners | 09:47 |
| *** GB21 has quit IRC | 09:54 | |
| *** GB21 has joined #openstack-keystone | 09:57 | |
| *** EinstCrazy has quit IRC | 10:07 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:16 | |
| *** ankit_ag has quit IRC | 10:19 | |
| *** jaosorior has quit IRC | 10:34 | |
| *** jaosorior has joined #openstack-keystone | 10:34 | |
| *** GB21 has quit IRC | 10:50 | |
| *** GB21 has joined #openstack-keystone | 10:53 | |
| *** GB21 has quit IRC | 11:00 | |
| *** GB21 has joined #openstack-keystone | 11:02 | |
| *** lhcheng has joined #openstack-keystone | 11:07 | |
| *** ChanServ sets mode: +v lhcheng | 11:07 | |
| *** dims has joined #openstack-keystone | 11:10 | |
| *** GB21 has quit IRC | 11:10 | |
| *** GB21 has joined #openstack-keystone | 11:12 | |
| *** markvoelker has joined #openstack-keystone | 11:13 | |
| *** GB21 has quit IRC | 11:16 | |
| *** markvoelker has quit IRC | 11:18 | |
| marekd | stevemar: so PUT operation should result in 201 OK or 204 No Content? | 11:28 |
| *** GB21 has joined #openstack-keystone | 11:35 | |
| *** fhubik is now known as fhubik_brb | 11:46 | |
| *** ankit_ag has joined #openstack-keystone | 11:58 | |
| *** pauloewerton has joined #openstack-keystone | 12:02 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| *** GB21 has quit IRC | 12:15 | |
| *** peter-hamilton has joined #openstack-keystone | 12:15 | |
| *** markvoelker has quit IRC | 12:18 | |
| *** peter-hamilton has quit IRC | 12:21 | |
| *** fhubik_brb is now known as fhubik | 12:30 | |
| *** gordc has joined #openstack-keystone | 12:31 | |
| *** shoutm_ has joined #openstack-keystone | 12:33 | |
| *** raildo has joined #openstack-keystone | 12:35 | |
| *** shoutm has quit IRC | 12:35 | |
| *** doug-fish has joined #openstack-keystone | 12:38 | |
| *** ninag has joined #openstack-keystone | 12:48 | |
| *** ninag has quit IRC | 12:48 | |
| *** ninag has joined #openstack-keystone | 12:48 | |
| *** ninag has quit IRC | 12:48 | |
| openstackgerrit | Merged openstack/oslo.policy: Don't crash on RoleCheck when roles not present https://review.openstack.org/262329 | 12:50 |
| *** shoutm_ has quit IRC | 12:51 | |
| *** woodster_ has joined #openstack-keystone | 12:54 | |
| samueldmq | dstanek: morning, you around ? | 12:55 |
| *** dave-mccowan has joined #openstack-keystone | 12:56 | |
| *** peter-hamilton has joined #openstack-keystone | 12:56 | |
| *** shoutm has joined #openstack-keystone | 12:57 | |
| *** fawadkhaliq has quit IRC | 13:05 | |
| *** doug-fish has quit IRC | 13:05 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:05 | |
| samueldmq | dstanek: I would appreciate your view on "" | 13:07 |
| samueldmq | WIP: Add cache layer on the top of manager | 13:07 |
| *** shoutm_ has joined #openstack-keystone | 13:07 | |
| *** fhubik is now known as fhubik_brb | 13:07 | |
| samueldmq | dstanek: https://review.openstack.org/#/c/263933/ | 13:07 |
| samueldmq | dstanek: before I put more effort on it :) | 13:07 |
| *** shoutm has quit IRC | 13:07 | |
| *** links has quit IRC | 13:07 | |
| *** fhubik_brb is now known as fhubik | 13:09 | |
| *** fawadkhaliq has quit IRC | 13:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:16 | |
| *** Madkiss has quit IRC | 13:17 | |
| *** Madkiss has joined #openstack-keystone | 13:17 | |
| *** Madkiss has quit IRC | 13:17 | |
| *** Madkiss has joined #openstack-keystone | 13:17 | |
| *** markvoelker has joined #openstack-keystone | 13:18 | |
| *** fawadk has joined #openstack-keystone | 13:19 | |
| *** fawadkhaliq has quit IRC | 13:21 | |
| *** edmondsw has joined #openstack-keystone | 13:22 | |
| *** doug-fish has joined #openstack-keystone | 13:24 | |
| *** ninag has joined #openstack-keystone | 13:41 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Use oslo_config choices support https://review.openstack.org/160031 | 13:46 |
| openstackgerrit | Ankit Agrawal proposed openstack/keystone: Expose defect in users_in_group, groups_for_user exact filters https://review.openstack.org/264779 | 13:52 |
| *** doug-fis_ has joined #openstack-keystone | 13:53 | |
| *** wanghua has quit IRC | 13:53 | |
| *** doug-fish has quit IRC | 13:55 | |
| *** richm has joined #openstack-keystone | 13:55 | |
| *** fhubik is now known as fhubik_brb | 13:56 | |
| *** fhubik_brb is now known as fhubik | 13:57 | |
| *** _zouyee has quit IRC | 13:57 | |
| *** fhubik is now known as fhubik_brb | 13:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/264426 | 14:00 |
| *** EinstCrazy has joined #openstack-keystone | 14:01 | |
| *** ankit_ag has quit IRC | 14:02 | |
| *** GB21 has joined #openstack-keystone | 14:04 | |
| *** fhubik_brb is now known as fhubik | 14:07 | |
| *** EinstCrazy has quit IRC | 14:09 | |
| dstanek | samueldmq: sure | 14:09 |
| *** fawadk has quit IRC | 14:10 | |
| samueldmq | dstanek: thanks sir, really appreciated :) | 14:10 |
| openstackgerrit | Ankit Agrawal proposed openstack/keystone: Fix users in group and groups for user exact filters https://review.openstack.org/263158 | 14:11 |
| dstanek | samueldmq: i actually don't know if it's clearer to separate it that way | 14:12 |
| dstanek | samueldmq: and i'm not sure it would work correctly. for instance, you deleted some code from delete_project and i think you were making the assumption that that call to the memiozer call to delete_project in _delete_domain_contents will invoke it in the new location | 14:14 |
| *** jdennis1 has joined #openstack-keystone | 14:14 | |
| dstanek | samueldmq: but if delete_project is called directly that code will not be invoked | 14:14 |
| samueldmq | dstanek: yes | 14:16 |
| samueldmq | dstanek: I tried implementing __getattribute__ to forward calls from manager to memoizer | 14:16 |
| *** jdennis has quit IRC | 14:17 | |
| samueldmq | dstanek: as also suggested by notmorgan , but it easily got too complext when I was handling with __getattribute__ and __getattr__ at the manager | 14:17 |
| *** vgridnev has joined #openstack-keystone | 14:17 | |
| dstanek | samueldmq: if you did want to refactor this i think the decorator pattern would be the best approach imo | 14:17 |
| *** shoutm has joined #openstack-keystone | 14:18 | |
| notmorgan | dstanek: which is mostl what we are doing now. changing it to a decorator breaks the invalidates | 14:18 |
| notmorgan | dstanek: there is a reason i put the original caching into the manager logic. the alternative was to do like dogpile does and add a "proxy" construct. | 14:19 |
| notmorgan | samueldmq: ^ cc | 14:19 |
| dstanek | notmorgan: how would it break invalidates? | 14:19 |
| notmorgan | dstanek: the caching logic needs to invalidate in very specific places/times | 14:20 |
| samueldmq | notmorgan: proxy on the top of manager ? that's basically what I want to do I think | 14:20 |
| notmorgan | during updates | 14:20 |
| notmorgan | etc | 14:20 |
| samueldmq | notmorgan: and sometimes crossmemoizers, eg you delete a domain and invalidate role assignment cache | 14:20 |
| notmorgan | yes | 14:20 |
| dstanek | notmorgan: if that's truly the case then really there wouldn't be any way to refactor that would make it clearer | 14:21 |
| notmorgan | dstanek: you could do it under the manager but... it's not easy | 14:21 |
| *** shoutm_ has quit IRC | 14:22 | |
| notmorgan | i wouldn't try and do it over the manager. | 14:22 |
| notmorgan | caching is hard | 14:22 |
| samueldmq | dstanek: notmorgan: my initial motivation was '' https://review.openstack.org/#/c/215715/ | 14:23 |
| samueldmq | Add caching to role assignments | 14:23 |
| samueldmq | I find it bad to put invalidation logic of assignments on, let's say, the resource manager | 14:24 |
| samueldmq | so for me having another layer to treat of caching/invalidation only would make it clearer | 14:24 |
| notmorgan | samueldmq: this is the internall callback stuff. | 14:24 |
| notmorgan | as well | 14:24 |
| notmorgan | cross manager invalidation is no different than cross manager communication | 14:25 |
| samueldmq | except that we don't mix business logic with cache handling | 14:25 |
| notmorgan | all *_api communication happens at the manager layer, a while ago we did a lot of work to push that upwards. | 14:25 |
| dstanek | samueldmq: my knee jerk reaction would be that we are using the wrong abstractions or maybe we are missing some and that's why the cross manager stuff exists | 14:26 |
| *** jimbaker has joined #openstack-keystone | 14:26 | |
| notmorgan | there were drivers that did direct driver calls | 14:26 |
| dstanek | notmorgan: right, we've had a lot of work to move that stuff up the layers | 14:26 |
| dstanek | samueldmq: we're made an explicit design choice to allow managers to communicate | 14:27 |
| samueldmq | dstanek: and we aren't removing that right ? just making the *_api calls pass in the memoizer prior to getting into Manager | 14:29 |
| notmorgan | samueldmq: but the point is that it doesn't really make it more clear | 14:29 |
| notmorgan | especially since you now have manager -> memoizer -> manager -> memoizer type traces | 14:30 |
| notmorgan | since manager calls through to itself | 14:30 |
| *** EinstCrazy has joined #openstack-keystone | 14:30 | |
| dstanek | notmorgan: also as i mentioned the patch in question doesn't yet implement all of the invalidation | 14:31 |
| notmorgan | i think it makes it more complex and harder to understand. | 14:31 |
| samueldmq | notmorgan: I agree this case is very confusing | 14:31 |
| notmorgan | dstanek: i didn't even get that far | 14:31 |
| notmorgan | samueldmq: so, like i said, caching is hard | 14:31 |
| samueldmq | notmorgan: maybe just improving the way we do it (perhaps some invalidations can just use annotations?) is the better way to go | 14:32 |
| *** jsavak has joined #openstack-keystone | 14:32 | |
| notmorgan | samueldmq: explain how the annoation works for invalidation | 14:32 |
| notmorgan | or what you mean | 14:32 |
| samueldmq | @invalidate(assignment_api.get_user_roles, assignment_api.get_group_roles?? | 14:33 |
| notmorgan | doesn't work like that | 14:33 |
| samueldmq | def delete_domain(...): | 14:33 |
| samueldmq | and would invalidate upon success on deletion | 14:33 |
| notmorgan | you need in some cases to invalidate mid manager logic | 14:33 |
| dstanek | samueldmq: if you have to invalidate based on state in the method you'll have to do it in the method | 14:33 |
| notmorgan | decorators can only work before/after | 14:33 |
| *** daemontool_ has joined #openstack-keystone | 14:33 | |
| notmorgan | this is the same issue we have with policy decorators | 14:33 |
| notmorgan | it makes things insanely complex | 14:33 |
| notmorgan | we also over-use decorators | 14:34 |
| samueldmq | notmorgan: I can't think of an example of mid manager logic invalidation | 14:34 |
| samueldmq | hey decorators are nice :-) | 14:34 |
| *** daemontool has quit IRC | 14:34 | |
| notmorgan | samueldmq: i really dislike the decorator pattern | 14:34 |
| notmorgan | it makes it hard to know what is going on in a method | 14:34 |
| dstanek | samueldmq: i'm on recording saying they are evil | 14:34 |
| dstanek | notmorgan: i like the decorator pattern, but python decorators are not that | 14:35 |
| notmorgan | @memoize @invalidate @enforce @thing @whatever | 14:35 |
| samueldmq | too much is bad, yes | 14:35 |
| notmorgan | what happenes when you stack all of those together | 14:35 |
| samueldmq | I got it | 14:35 |
| notmorgan | memoize is one of the very few cases decorators are correct | 14:36 |
| samueldmq | dstanek: notmorgan: so perhaps we all feel something smells bad ? | 14:36 |
| breton | decorators are good, if you don't overuse them | 14:36 |
| samueldmq | just don't know if something may be improved to make code clearer | 14:36 |
| lbragstad | navidp I updated the bug report with our conversation from yesterday - https://bugs.launchpad.net/keystone/+bug/1522616 | 14:37 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 14:37 |
| notmorgan | samueldmq: so assume cross manager communication is fine. | 14:37 |
| notmorgan | samueldmq: this means cross manager invalidation *can* exist. | 14:37 |
| notmorgan | managers can inter-depend | 14:37 |
| lbragstad | cc stevemar ^ | 14:37 |
| notmorgan | if you're adding caching to roles, add it in the current model. refactoring the whole caching system is a big ordeal and i think needs more baking/thought | 14:38 |
| dstanek | breton: i only like decorators for annotating functions and not for really business performing logic | 14:38 |
| *** jasonsb has joined #openstack-keystone | 14:38 | |
| *** topol has joined #openstack-keystone | 14:38 | |
| *** ChanServ sets mode: +v topol | 14:38 | |
| notmorgan | it seems that refactoring caching is going to make life a lot harder and shouldn't block real improvements | 14:38 |
| notmorgan | breton: what dstanek said | 14:38 |
| breton | yep | 14:39 |
| notmorgan | dstanek: as much as i don't want to work on server, i think i'm going to break the policy enforce decorator today | 14:39 |
| notmorgan | dstanek: as it'll greatly improve understanding enforcement | 14:39 |
| *** EinstCrazy has quit IRC | 14:40 | |
| breton | dstanek: how's the work on dependency injection going btw? | 14:40 |
| * samueldmq is looking forward, making popcorn | 14:40 | |
| notmorgan | dstanek: so we're back to directly calling enforce. the enforce decorator should just be something like @ensure_enforcement, which will error [dev time test] if enforcement didn't occur where it should | 14:40 |
| notmorgan | or just bake that into the controller? | 14:40 |
| notmorgan | for all router->controller methods | 14:41 |
| * notmorgan keeps looking at the long list of tech debt. | 14:41 | |
| dstanek | notmorgan: that'll be interesting to see | 14:42 |
| samueldmq | this keystone is harder than my weekend project, arrgh | 14:42 |
| *** jasonsb has quit IRC | 14:43 | |
| samueldmq | :-) | 14:43 |
| dims | samueldmq : LOL :) | 14:43 |
| dstanek | breton: i have so many patches i'm working on now it's hard to keep up. ask me on Monday :-) | 14:43 |
| *** petertr7_away is now known as petertr7 | 14:43 | |
| samueldmq | dims: but also allows me to learn, so I am fine :) | 14:43 |
| notmorgan | dstanek: so i think break enforcer, make controller ensure enforcement on annotated methods? or make the annotation directly ensure enforcement? | 14:43 |
| *** slberger has joined #openstack-keystone | 14:44 | |
| samueldmq | dstanek: my list is fine now after abandoning all dynamic-crazy-policy stuff | 14:44 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 14:47 |
| dstanek | notmorgan: it would be nice for the controller to not care about enforcement. it would know just about taking web-stuff and calling api stuff | 14:47 |
| *** fawadkhaliq has joined #openstack-keystone | 14:47 | |
| notmorgan | dstanek: right. but we need enforcement somewhere | 14:48 |
| notmorgan | dstanek: and enforcement needs to happen based upon ownership in some cases. | 14:48 |
| notmorgan | so we need to do "get item" then enforce("on item") | 14:49 |
| dstanek | notmorgan: yeah, i'd actually love to have an enforcement later, but i don't think that would be possible here | 14:49 |
| notmorgan | dstanek: i could push enforcement down to the end before return, but i think that breaks our general desire for "fail fast" | 14:50 |
| notmorgan | the design question is... should we ever enforce early? | 14:50 |
| notmorgan | if the answe is no, then it becomes easy. | 14:51 |
| *** shoutm has quit IRC | 14:51 | |
| notmorgan | i can bake a little logic into the controller baseclass that enforces based upon what is in policy but we may incur extra overhead | 14:51 |
| *** jsavak has quit IRC | 14:51 | |
| notmorgan | because we'll make calls to the backend. | 14:51 |
| ayoung | notmorgan, so...you ar not a-priori against TOTP, right, just that this was attempting to munge TOTP and MFA into a single auth plugin, and they are really separate issues? | 14:52 |
| notmorgan | even after a point we could bail out due to enforce failure | 14:52 |
| notmorgan | ayoung: correct. | 14:52 |
| ayoung | notmorgan, OK,....I think I got 2/3rds of the way there in that last edit. | 14:52 |
| notmorgan | ayoung: i am fine with a TOTP auth method as long as we cover imortant things like secerts, totp implementation [google auth?], etc | 14:53 |
| ayoung | notmorgan, I think I want to go back, drop the password plugin, and add the password value to the TOTP auth plugin and it should be acceptable | 14:53 |
| * ayoung goes back to edit | 14:53 | |
| notmorgan | ayoung: if we say encryption is happening, outline the basics for what that means you know, the standard cover the bases on what is being put together | 14:54 |
| notmorgan | ayoung: also we should be clear that this is meant to be used in lieu of password vs in combination [until we solve the MFA issues that this spec doesn't solve] | 14:54 |
| notmorgan | ayoung: but that is a doc thing. | 14:54 |
| ayoung | notmorgan, So...I think that this is a couple specs. One is saying "we will support a TOTP interface for auth plugins, and it will have the following fields." | 14:54 |
| notmorgan | ayoung: hopefully that is fairly straightforward :) | 14:55 |
| ayoung | notmorgan, the second would be "google TOTP implementation" or alternative? | 14:55 |
| *** petertr7 is now known as petertr7_away | 14:55 | |
| *** zqfan has joined #openstack-keystone | 14:55 | |
| notmorgan | ayoung: ok let me read your spec so i understand what that first one is. the first one sounds like a meta-spec again? | 14:56 |
| ayoung | notmorgan, wait one | 14:56 |
| ayoung | notmorgan, I'm doing an additional edit. | 14:56 |
| ayoung | I am dropping the password plugin from the example | 14:56 |
| notmorgan | ayoung: or is it "put scafolding in for totp within password / other plugins?" | 14:56 |
| dstanek | notmorgan: is the only benefit of early enforcement to save CPU? | 14:56 |
| notmorgan | dstanek: CPU, db queries, etc | 14:57 |
| notmorgan | ayoung: so if it's just adding a totp plugin, i think you can merge "support totp and impl" | 14:59 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 14:59 |
| notmorgan | ayoung: because totp is no different than any other plugin, unless you're talking about doing something more generic and a keystone will only support a specific totp plugin at a time | 15:00 |
| *** GB21 has quit IRC | 15:01 | |
| *** GB21 has joined #openstack-keystone | 15:01 | |
| ayoung | notmorgan, so, I can see a need for a couple different TOTP plugin implementations. My one concern is that, as Keystone is now written, it can only support a single one. | 15:02 |
| notmorgan | ayoung: right | 15:02 |
| notmorgan | ayoung: and from a strict interop perspective.... maybe it should only support one? | 15:02 |
| ayoung | notmorgan, we really should do one plugin per idp. But I don't want to do this kind of code in python unless we absoposilutletly have to | 15:03 |
| *** dslev has joined #openstack-keystone | 15:03 | |
| notmorgan | ayoung: ah but idp should handle that. | 15:03 |
| ayoung | notmorgan, what if....we say TOTP is a protocol, and we have to use Federation for it. | 15:03 |
| notmorgan | we shouldn't need a plugin. the IDP that does auth should unless you're back into token bind | 15:04 |
| *** rderose has joined #openstack-keystone | 15:04 | |
| notmorgan | free ipa hould handle totp when authing for example. | 15:04 |
| notmorgan | as it does | 15:04 |
| notmorgan | keystone shouldn't care about totp in that case | 15:05 |
| ayoung | Then make a middleware piece that can do the TOTP validation, and have a separate paste pipeline for that IdP | 15:05 |
| ayoung | I realize that sucks because reboot, but, no different than we have today with config changes anyway | 15:05 |
| notmorgan | i'm not clear what totp is meant to do here. | 15:05 |
| notmorgan | it seems like something that keystone shouldn't care about based upon what you just said | 15:05 |
| *** woodster_ has quit IRC | 15:06 | |
| ayoung | notmorgan, yes, if you have an apache module that can do TOTP, we can do this today. | 15:06 |
| notmorgan | no, why are we doing totp at all in keystone? | 15:07 |
| notmorgan | if the idp is meant to handle totp, we have nothing to do | 15:07 |
| *** mserngawy_ has joined #openstack-keystone | 15:07 | |
| ayoung | notmorgan, Because if the only tool you have is Duck tape, everything looks like a Duck. | 15:07 |
| notmorgan | if this is meant to be totp as an alternative to password, it is a simple auth plugin | 15:07 |
| ayoung | right...that is how I rewrote the spec | 15:07 |
| notmorgan | if this is totp like MFA in google apps for example, it is part of the password plugin | 15:08 |
| notmorgan | so if it is a simple auth plugin, call it by the implementation or say keystone supports one and only one totp option for internal auth | 15:09 |
| *** teju has quit IRC | 15:09 | |
| *** jsavak has joined #openstack-keystone | 15:09 | |
| notmorgan | so either "google totp" or "totp" in the latter case, if another impl is used, you pick if you support google or other impl | 15:09 |
| *** doug-fis_ is now known as doug-fish | 15:11 | |
| notmorgan | if that makes sense | 15:11 |
| *** shoutm has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Merged openstack/pycadf: Fix wrong use of comma https://review.openstack.org/264526 | 15:13 |
| *** topol_ has joined #openstack-keystone | 15:14 | |
| *** ChanServ sets mode: +v topol_ | 15:14 | |
| ayoung | notmorgan, I think we need to say that TOTP is a separate mechanism if-and-only-if it has to be implemented in python and deployed in a system that has to continue to use the existing password plugin | 15:15 |
| *** jasonsb has joined #openstack-keystone | 15:15 | |
| notmorgan | ayoung: i don'tthink that makes it more clear to me. | 15:16 |
| *** topol has quit IRC | 15:17 | |
| notmorgan | ayoung: so totp is in addition to <other plugin> or in lieu of <other plugin>? | 15:17 |
| ayoung | I think that totp is in addition to password. | 15:18 |
| ayoung | notmorgan, note, I do not have a dog in this race | 15:18 |
| ayoung | I don't even have a dog | 15:18 |
| ayoung | A dog would be nice, if only it was asleep on the floow and I could warm my feet under her. | 15:18 |
| notmorgan | ayoung: right you and i both. I am just trying to make sure we don't end up with some useless boondoggle of code. | 15:18 |
| ayoung | It is cold in Mass today | 15:18 |
| notmorgan | ayoung: and that is my concern with the previous proposal. | 15:19 |
| ayoung | notmorgan, so, I want the v3/auth stuff to go away, and only use the federation paths | 15:19 |
| bknudson_ | 99% of keystone is useless boondoggle | 15:19 |
| notmorgan | ayoung: i'ts not that cold in PDX today. mid 30s. | 15:19 |
| notmorgan | bknudson_: rm -rf all of it | 15:19 |
| ayoung | notmorgan, I work in the basement of my house. MOstly comforatble, but it is a thin carpet over concrete, and my feet get cold. | 15:20 |
| *** med_ has quit IRC | 15:20 | |
| *** med_` has joined #openstack-keystone | 15:20 | |
| * notmorgan looks at weird wifi lag spikes when firefox is running [not when a page is loaded] | 15:20 | |
| bknudson_ | ayoung: http://www.redsgear.com/flambeau-heated-socks-kit.html?gclid=Cj0KEQiAtri0BRDLoaCF95e7o_sBEiQA_pgRQ2zqeYtrr3ZLlfWs_7OkLeuQWpFqEdDkPC1X1vamEMYaAvBV8P8HAQ | 15:21 |
| *** timcline has joined #openstack-keystone | 15:23 | |
| notmorgan | ayoung: so i think... we just add a hook into the auth plugins to accept any form of MFA. we implement a google auth totp example one. | 15:23 |
| ayoung | bknudson_, I had battery operated socks one, back in the 80s. | 15:24 |
| notmorgan | ayoung: and we pass down "is_totp_authed" if it passes. we can then just do a normal enforce on "require_MFA" and hook into that for the "this domain needs mfa" type construct | 15:25 |
| ayoung | notmorgan, I think I want to kill it. THe /auth approch is making us reimplement things that should be done at the web layer. | 15:25 |
| ayoung | The issue is for things that need to be done in python; | 15:25 |
| notmorgan | ayoung: my suggestion is going with the supposition that we need MFA in keystone | 15:25 |
| ayoung | and there...I want multiple paste pipelines, or something like it, that can then have a custom middleware | 15:25 |
| notmorgan | ayoung: no. please don't make paste more involved :( | 15:26 |
| notmorgan | it's already awful | 15:26 |
| ayoung | notmorgan, then remove it 100% | 15:26 |
| notmorgan | we are headed that way | 15:26 |
| ayoung | don;t leave us stuck with something in the middle that sucks but is required | 15:26 |
| notmorgan | almost all of keystone is in one entry now afaict | 15:26 |
| ayoung | but, I stnd by the concept of some configurable path with a way to set REMOTE_USER from python code | 15:27 |
| notmorgan | paste is code not config as far as i am concerned | 15:27 |
| ayoung | heh, it certainly is the way we use it | 15:27 |
| notmorgan | which is why we've been moving towards making it less relevant | 15:28 |
| ayoung | but I was talking about using it actually as config. | 15:28 |
| notmorgan | lets not encourage that | 15:28 |
| ayoung | whatever...we can do it in the config file, I don't care. Or using henry's db config if that makes sense. | 15:28 |
| notmorgan | fwiw, there is a google auth apache module last i looked (or something like it) | 15:28 |
| ayoung | bottom line is we need a way to say "POST /id/x/protocol/y/ executes this code to set REMOTE_USER | 15:29 |
| ayoung | https://code.google.com/p/google-authenticator-apache-module/ | 15:29 |
| *** tonytan4ever has joined #openstack-keystone | 15:29 | |
| *** breitz has quit IRC | 15:30 | |
| notmorgan | only looks like it works with HTTP auth | 15:30 |
| ayoung | https://github.com/google/google-authenticator | 15:30 |
| *** breitz has joined #openstack-keystone | 15:30 | |
| notmorgan | ok. so back to where we are today | 15:32 |
| notmorgan | vs. where we would like to be | 15:32 |
| notmorgan | is TOTP just an alternative auth mech to password? | 15:32 |
| notmorgan | is that all we care about today? | 15:32 |
| notmorgan | because that is waht gyee was pushing for | 15:32 |
| notmorgan | or is it something we hook into for our auth code paths when issuing a token? - going down the path of the REMOTE_USER thing is separate and wont solve today issues / the reason MFA keeps coming up | 15:34 |
| *** dims_ has joined #openstack-keystone | 15:35 | |
| ayoung | notmorgan, Iff he needs it, then yes. Alternative to password, to be able to distinguish between the two on a request | 15:35 |
| ayoung | notmorgan, so...I say we drop MFA as a standa lone topic. | 15:35 |
| ayoung | TOTP, while it is an MFA approach, is a single mechanism | 15:36 |
| notmorgan | ayoung: he doesn't need it, he just sees it as a means to get MFA baked in - but imo auth plugins are poorly implemented in keystone server atm and it's the wrong approach to just add another form. | 15:36 |
| ayoung | we don't want to have to wire together "password + this-other-method" at the Keystone level | 15:36 |
| *** dims has quit IRC | 15:36 | |
| *** nonameentername has quit IRC | 15:36 | |
| ayoung | keep the -2...if we resurrect, it should be along the lines I wrote up there. Deal? | 15:36 |
| notmorgan | ayoung: sounds good. will hold the -2 for now and we can discuss rest of this week/next meeting | 15:37 |
| *** nonameentername has joined #openstack-keystone | 15:38 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:42 | |
| *** henrynash has joined #openstack-keystone | 15:43 | |
| *** ChanServ sets mode: +v henrynash | 15:43 | |
| *** itlinux has joined #openstack-keystone | 15:50 | |
| *** jimbaker has quit IRC | 15:51 | |
| *** jimbaker has joined #openstack-keystone | 15:52 | |
| *** shoutm has quit IRC | 15:52 | |
| *** jimbaker has quit IRC | 15:52 | |
| *** jimbaker has joined #openstack-keystone | 15:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 15:56 |
| *** phalmos has joined #openstack-keystone | 15:58 | |
| *** shoutm has joined #openstack-keystone | 16:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity https://review.openstack.org/262045 | 16:01 |
| *** tsymanczyk has quit IRC | 16:03 | |
| *** shoutm has quit IRC | 16:04 | |
| *** itlinux has quit IRC | 16:05 | |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 16:06 |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 16:06 |
| *** itlinux has joined #openstack-keystone | 16:07 | |
| ayoung | there is something wonky with the rebase logic on new Gerrit. | 16:11 |
| *** woodster_ has joined #openstack-keystone | 16:13 | |
| openstackgerrit | ayoung proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 16:13 |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 16:13 |
| ayoung | Guys, can we at least get https://review.openstack.org/#/c/264259/ in so the rebase hell can settle down? | 16:15 |
| bknudson_ | stevemar: https://review.openstack.org/#/c/264525/ -- I squashed the 3 changes, so should pass. | 16:16 |
| *** topol has joined #openstack-keystone | 16:16 | |
| *** ChanServ sets mode: +v topol | 16:16 | |
| *** topol_ has quit IRC | 16:18 | |
| *** csoukup has joined #openstack-keystone | 16:18 | |
| *** fhubik has quit IRC | 16:19 | |
| *** itlinux has quit IRC | 16:22 | |
| *** tonytan4ever has quit IRC | 16:24 | |
| *** itlinux has joined #openstack-keystone | 16:25 | |
| *** tonytan_brb has joined #openstack-keystone | 16:26 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 16:26 |
| stevemar | bknudson_: thanks for squashing the changes | 16:26 |
| stevemar | i didn't want to trample on your patch | 16:27 |
| *** rderose has quit IRC | 16:27 | |
| *** rderose has joined #openstack-keystone | 16:28 | |
| *** rderose has quit IRC | 16:33 | |
| *** belmoreira has quit IRC | 16:34 | |
| *** med_` is now known as med_ | 16:39 | |
| *** med_ has quit IRC | 16:39 | |
| *** med_ has joined #openstack-keystone | 16:39 | |
| *** med_ is now known as med | 16:40 | |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 16:40 |
| *** med is now known as med_ | 16:40 | |
| *** thiagop has quit IRC | 16:44 | |
| *** diazjf has joined #openstack-keystone | 16:44 | |
| *** thiagop has joined #openstack-keystone | 16:45 | |
| *** thiagop has left #openstack-keystone | 16:45 | |
| *** dslev has quit IRC | 16:47 | |
| *** KarthikB has joined #openstack-keystone | 16:47 | |
| *** lhinds has joined #openstack-keystone | 16:49 | |
| *** itlinux has quit IRC | 16:52 | |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v gyee | 16:55 | |
| *** itlinux has joined #openstack-keystone | 16:57 | |
| *** dims has joined #openstack-keystone | 16:59 | |
| *** _cjones_ has joined #openstack-keystone | 17:00 | |
| htruta | jamielennox: are you around? | 17:01 |
| *** dims_ has quit IRC | 17:02 | |
| *** phalmos has quit IRC | 17:03 | |
| *** tsymanczyk has joined #openstack-keystone | 17:04 | |
| *** tsymanczyk is now known as Guest26209 | 17:05 | |
| *** rderose has joined #openstack-keystone | 17:06 | |
| *** daemontool_ has quit IRC | 17:06 | |
| openstackgerrit | Harshada Mangesh Kakad proposed openstack/keystone: Replace deprecated library function os.popen() with subprocess https://review.openstack.org/262731 | 17:08 |
| *** jsavak has quit IRC | 17:08 | |
| *** spzala has quit IRC | 17:09 | |
| *** itlinux has quit IRC | 17:10 | |
| *** jsavak has joined #openstack-keystone | 17:10 | |
| *** GB21 has quit IRC | 17:11 | |
| *** itlinux has joined #openstack-keystone | 17:11 | |
| lbragstad | navidp ping (re - https://bugs.launchpad.net/keystone/+bug/1522616 ) | 17:12 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 17:12 |
| lbragstad | navidp I tried to summarize the outcomes of the discussion yesterday | 17:12 |
| lbragstad | and from my perspective, they boiled down to two options | 17:13 |
| navidp | lbragstad, | 17:13 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 17:17 |
| lbragstad | navidp i think either of those options would close out the bug | 17:17 |
| navidp | lbragstad, second option as "re-enable the default domain, and this would have to live within the keystone-manage functionality." | 17:18 |
| navidp | can be added to keystone-manage https://github.com/openstack/keystone/blob/master/keystone/cmd/cli.py#L123-L124 | 17:20 |
| navidp | lbragstad, somethiing like get_default_domian re_enable it | 17:20 |
| lbragstad | navidp yes | 17:21 |
| *** rderose has quit IRC | 17:22 | |
| *** fellypefca has joined #openstack-keystone | 17:23 | |
| notmorgan | navidp: that seems reasonable | 17:25 |
| lbragstad | navidp then the logic of that command would just check to ensure that the domain is enabled in the backend | 17:26 |
| notmorgan | i don't like this needing keystone-manage to fix it. | 17:26 |
| navidp | notmorgan, suggestions? | 17:26 |
| navidp | lbragstad, YES | 17:27 |
| notmorgan | i would make it impossible to disable default domain | 17:27 |
| notmorgan | via the api | 17:27 |
| notmorgan | and make the internal get_default_domain re-enable it | 17:27 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:27 | |
| lbragstad | notmorgan so you would be in favor of the first option detailed in the comment i left on the bug https://bugs.launchpad.net/keystone/+bug/1522616 | 17:27 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 17:27 |
| notmorgan | lbragstad: yes | 17:28 |
| fellypefca | Hey | 17:28 |
| navidp | notmorgan, then https://review.openstack.org/#/c/260067/ | 17:28 |
| notmorgan | requiring an out of band command to "fix" an issue that we cant run w/o is incorrect | 17:29 |
| lbragstad | notmorgan so you'd rather see that then what henrynash was describing yesterday? | 17:29 |
| lbragstad | or gyee ? | 17:29 |
| notmorgan | what was henrynash or gyee describing? | 17:30 |
| *** jsavak has quit IRC | 17:30 | |
| notmorgan | if we can't run with the default domain disabled, we prevent it being disabled | 17:30 |
| lbragstad | notmorgan the out of band process involving keystone-manage | 17:30 |
| notmorgan | simple | 17:30 |
| *** browne has joined #openstack-keystone | 17:30 | |
| notmorgan | default domain is magic | 17:30 |
| notmorgan | so much magic | 17:30 |
| *** jsavak has joined #openstack-keystone | 17:30 | |
| notmorgan | out of band to "fix" something that breaks keystone fundamentally, is not a good approach | 17:31 |
| *** diazjf has quit IRC | 17:32 | |
| navidp | notmorgan, so basically 1. dont let it be disabled 2. use keystone-manage to re-enable it, you support (1) ? | 17:32 |
| notmorgan | yes | 17:32 |
| navidp | notmorgan, ok then what should i do get this https://review.openstack.org/#/c/260067/ which does #1 to be accepted? | 17:33 |
| notmorgan | convince gyee that the default domain is magic enough to justify it | 17:33 |
| notmorgan | gyee: ^ the default domain is magic, this is fine to continue the magic until v2 goes away (never?) | 17:34 |
| notmorgan | stevemar: ^ cc | 17:34 |
| navidp | notmorgan, the main issue is that DEFAULT DOMAIN IS MAGIC OR NOT ? | 17:35 |
| stevemar | navidp: you've been on a mission to fix default domain :) | 17:35 |
| navidp | stevemar, so far yes !! :) | 17:36 |
| navidp | stevemar, trying to fix the MAGIC | 17:36 |
| stevemar | true true | 17:36 |
| stevemar | just might be one of those situations where `if it ain't broke, don't fix it` | 17:37 |
| stevemar | it's dicey cause of how intertwined things are | 17:37 |
| notmorgan | put a +2 on the "don't allow default domain to be disabled" patch | 17:37 |
| notmorgan | fwiw | 17:37 |
| notmorgan | and commented on why | 17:38 |
| notmorgan | i don't think the admin user argument is relevant | 17:38 |
| notmorgan | actually | 17:38 |
| *** diazjf has joined #openstack-keystone | 17:39 | |
| notmorgan | i think disabling the default domain is just a bad idea in general | 17:39 |
| navidp | notmorgan, thanks | 17:39 |
| openstackgerrit | Ankit Agrawal proposed openstack/keystone: Expose defect in users_in_group, groups_for_user exact filters https://review.openstack.org/264779 | 17:39 |
| notmorgan | if you disable the domain the admin user is in... that is an edit the DB to fix things or find another admin user | 17:39 |
| notmorgan | but that is separate from default domain being disabled. | 17:39 |
| navidp | notmorgan, which breaks v2 api | 17:40 |
| notmorgan | exactly | 17:40 |
| ayoung | henrynash, gyee https://review.openstack.org/#/c/264259/ can we please put this one to bed? Its a race with other migrations for 087. | 17:40 |
| fellypefca | Hey I'm new in the openstack, i want solve this bug ( https://bugs.launchpad.net/openstack-manuals/+bug/1385025 ) Is the solution in the bug description updated? | 17:40 |
| openstack | Launchpad bug 1385025 in openstack-manuals "Document how to configure Keystone v3 api" [Medium,In progress] | 17:40 |
| ayoung | notmorgan, default domain is only necessary for V2 to v3 interop | 17:41 |
| ayoung | perhaps instead we should say "always keep at least one domain enabled" | 17:41 |
| notmorgan | ayoung: and since default is already magic, lets keep the magic contained | 17:42 |
| ayoung | fellypefca, so...I think instead of asking if it is update..try it, figure it out, and decide yourself | 17:42 |
| *** afaranha has joined #openstack-keystone | 17:42 | |
| ayoung | fellypefca, the real answer is more complicated | 17:42 |
| *** breton has quit IRC | 17:44 | |
| fellypefca | Did you know where i can find the solution? | 17:44 |
| gyee | notmorgan, I disagree that default domain is magic | 17:44 |
| gyee | anything is magic if we don't do it right | 17:44 |
| notmorgan | gyee: oh it's a large amount of magic | 17:44 |
| notmorgan | the v2 v3 interop and a ton of code around that | 17:45 |
| notmorgan | it is magic | 17:45 |
| notmorgan | we could have avoided the need for v3 if we had done some stuff differently | 17:45 |
| gyee | if someone wants to disable something, its their choice | 17:45 |
| *** itlinux has quit IRC | 17:45 | |
| *** itlinux_ has joined #openstack-keystone | 17:45 | |
| *** jistr has quit IRC | 17:45 | |
| notmorgan | yeah but all of v2 breaks w/o the default domain | 17:45 |
| gyee | that's their choice | 17:46 |
| notmorgan | so my answer is we shouldn't allow that to be disabled until v2 goes away | 17:46 |
| notmorgan | default domain is magic. hell it is created in a sql migration | 17:46 |
| gyee | I disagree, I don't think there's anything special about the default domain | 17:47 |
| gyee | it is for migration purposes | 17:47 |
| gyee | disabling a domain is a workflow in production systems | 17:47 |
| notmorgan | gyee: if we rely on it for operation [and v2 does and a lot of things are broken w/o it] i will say no this is not something that can be disabled | 17:47 |
| gyee | if you change nova user password in keystone without update the auth_token section, nova will stop working | 17:48 |
| gyee | are we going to disable nova user from changing password? | 17:48 |
| notmorgan | gyee: no. keystone cannot run correctly w/o default domain | 17:48 |
| notmorgan | i don't care about nova's external user | 17:49 |
| notmorgan | i care that things that keystone relies on can be broken in ugly ways | 17:49 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/264462 | 17:50 |
| notmorgan | internal things keystone needs is different than "what nova needs" or things that depend on keystone. | 17:50 |
| gyee | keystone will run fine | 17:50 |
| notmorgan | v2 is part of defcore. | 17:51 |
| gyee | v2 APIs will happily return a 401 as expected | 17:51 |
| gyee | that's by design | 17:51 |
| notmorgan | gyee: so you're not going to convince me that the default domain isn't magic and should be disable-able | 17:51 |
| notmorgan | gyee: we'll have to agree to disagree | 17:51 |
| *** spandhe has joined #openstack-keystone | 17:52 | |
| gyee | goal is to get away from "magic" | 17:53 |
| *** breton has joined #openstack-keystone | 17:53 | |
| notmorgan | my goal is to contain the magic | 17:53 |
| notmorgan | until v2 dies i don't think we can remove the magic | 17:54 |
| gyee | we can't prevent someone from shooting themselves in the foot | 17:55 |
| gyee | oh, lets sell guns with a disabled trigger :) | 17:55 |
| notmorgan | gyee: we can guard against this is a terrible idea and we know it and it breaks how kestone works | 17:55 |
| gyee | lets ban McDonald toys | 17:55 |
| notmorgan | if a provider doesn't want v2, don't use it. | 17:55 |
| lhinds | exit | 17:55 |
| notmorgan | gyee: strawman argument | 17:55 |
| lhinds | woops, sorry wrong term | 17:56 |
| *** lhinds has quit IRC | 17:56 | |
| notmorgan | gyee: again, we shall agree to disagree | 17:56 |
| gyee | why would someone want to disable the default domain to begin with? accident? | 17:56 |
| bknudson_ | who keeps disabling the default domain? | 17:56 |
| *** can8dnSix has joined #openstack-keystone | 17:56 | |
| bknudson_ | is this a common problem? | 17:57 |
| gyee | don't think so | 17:57 |
| gyee | like I said, disabling a domain in production is usually a workflow | 17:57 |
| *** can8dnSix has quit IRC | 17:58 | |
| *** breton has quit IRC | 18:01 | |
| ayoung | I never agreed to defcore. | 18:01 |
| *** breton has joined #openstack-keystone | 18:01 | |
| ayoung | Keystone already has enough cruft....let the bad ideas die | 18:02 |
| *** htruta has left #openstack-keystone | 18:03 | |
| *** htruta has joined #openstack-keystone | 18:03 | |
| stevemar | notmorgan: bknudson_ squashed the changes to fix up ksa https://review.openstack.org/#/c/264525/3 | 18:04 |
| stevemar | notmorgan: err also: https://review.openstack.org/#/c/261706/ | 18:04 |
| notmorgan | stevemar: ok cool. | 18:04 |
| notmorgan | looking | 18:04 |
| stevemar | that should fix all our stable branches :) | 18:04 |
| *** mhickey has quit IRC | 18:06 | |
| *** itlinux_ has quit IRC | 18:06 | |
| *** KarthikB has quit IRC | 18:06 | |
| notmorgan | stevemar: 2/a | 18:06 |
| browne | disabling the default domain (at least for one customer I know) happened as a result of pressing the big disable button in horizon. | 18:08 |
| ayoung | gyee, so...TOTP. Any reason not to use the Apache module? https://github.com/google/google-authenticator | 18:08 |
| browne | user error | 18:08 |
| lbragstad | browne oops | 18:09 |
| * lbragstad wonders what that button does | 18:09 | |
| *** rderose has joined #openstack-keystone | 18:09 | |
| browne | exactly as promised, horizon allows a user to shoot themselves in the foot my disabling the default domain if they like | 18:10 |
| gyee | ayoung, yes, you can do it via apache | 18:10 |
| gyee | and do it via REMOTE_USER | 18:11 |
| browne | sorry checkbox, not button | 18:11 |
| *** itlinux has joined #openstack-keystone | 18:12 | |
| *** spzala has joined #openstack-keystone | 18:12 | |
| *** topol_ has joined #openstack-keystone | 18:12 | |
| *** ChanServ sets mode: +v topol_ | 18:12 | |
| openstackgerrit | Ankit Agrawal proposed openstack/keystone: Fix users in group and groups for user exact filters https://review.openstack.org/263158 | 18:13 |
| gyee | lbragstad, to launch a nuclear weapon, that button? | 18:13 |
| lbragstad | :) | 18:13 |
| *** topol has quit IRC | 18:14 | |
| *** markvoelker has quit IRC | 18:14 | |
| browne | here's what they did in horizon: click Domains - click Manage Members on Default - | 18:15 |
| browne | click Domain Information | 18:15 |
| browne | uncheck Enabled | 18:15 |
| lhcheng | browne: the policy file allows that, even if it is hidden in horizon the user can still disable the default domain through api. :) | 18:17 |
| browne | lhcheng: yeah, i don't disagree. its just that some users don't realize unchecking that box for the Default domain affects everything. feels like Horizon needs a warning label on it | 18:19 |
| lhcheng | browne: only admin should be able to do that - not any users. Adding the warning msg should be easy to add in horizon. | 18:20 |
| gyee | browne, some user, you mean like a super admin user? | 18:21 |
| *** tonytan_brb has quit IRC | 18:21 | |
| gyee | if super admin user don't know wtf he/she's doing, we have a bigger problem than that | 18:21 |
| browne | lhcheng: yep its user error and i'm sure they learn their lesson after trying it. its just that horizon makes it easy for an uninformed user to shoot themselves in the foot | 18:21 |
| lhcheng | gyee: only admin (v2) or cloud_admin (v3) have access to identity panels in horizon | 18:22 |
| *** ajayaa has joined #openstack-keystone | 18:22 | |
| browne | gyee: yes admin user. some are new to openstack. some are doing PoCs, etc | 18:23 |
| *** e0ne has joined #openstack-keystone | 18:23 | |
| gyee | domain is not even visible if v3 is not enable | 18:23 |
| lhcheng | gyee: ah right.. so only cloud_admin then | 18:23 |
| gyee | maybe Horizon can pop up a warning diaglog, like do you REALLY REALLY want to delete something? :-) | 18:24 |
| *** itlinux has quit IRC | 18:28 | |
| lhcheng | yeah, or just prevent disabling default domain? | 18:28 |
| gyee | no, I mean a confirmation screen for deleting anything | 18:29 |
| gyee | not just domains | 18:29 |
| lhcheng | gyee: there are already confirmation for deleting any records in horizon | 18:29 |
| browne | in this case disabling | 18:30 |
| lhcheng | *confirmation msg | 18:30 |
| *** rderose has quit IRC | 18:30 | |
| *** KarthikB has joined #openstack-keystone | 18:30 | |
| gyee | sorry, I mean disabling | 18:30 |
| *** itlinux has joined #openstack-keystone | 18:30 | |
| *** rderose has joined #openstack-keystone | 18:30 | |
| *** fellypefca has left #openstack-keystone | 18:31 | |
| gyee | sorry I have to run, lets talk later | 18:31 |
| *** gyee has quit IRC | 18:31 | |
| lhcheng | gyee: yeah, that's doable | 18:31 |
| browne | or better yet if horizon would just detect disabling the only or last domain would prevent any authentication | 18:31 |
| browne | and pop up a stern warning | 18:32 |
| lhcheng | browne: horizon knows the default domain, there is a config stored in horizon. Could just validate that disabling default domain is not allowed. | 18:34 |
| *** jaosorior has quit IRC | 18:34 | |
| *** jaosorior has joined #openstack-keystone | 18:35 | |
| *** harlowja has quit IRC | 18:35 | |
| browne | lhcheng: i don't think horizon treats the default domain any differently than any domain | 18:36 |
| *** harlowja has joined #openstack-keystone | 18:36 | |
| lhcheng | browne: not yet, we could add that :) | 18:37 |
| browne | is there an easy workaround where the policy.json can be tweaked to not allow changes on a domain named Default? | 18:37 |
| lhcheng | browne: the v3 policy file have the default_domain_id, its possible to prevent updates on default domain by updating the policy file. But this would prevent any updates, not just the 'enabled' attribute. | 18:39 |
| *** edmondsw has quit IRC | 18:39 | |
| *** jsavak has quit IRC | 18:40 | |
| *** jsavak has joined #openstack-keystone | 18:40 | |
| *** itlinux has quit IRC | 18:43 | |
| lhcheng | browne: something like: "identity:update_domain": "rule:cloud_admin and not <admin_domain_id>: %(target.domain.id)s" | 18:43 |
| *** afaranha has left #openstack-keystone | 18:43 | |
| *** topol_ has quit IRC | 18:44 | |
| browne | lhcheng: but i guess they still might need to update the members or groups of the default domain | 18:44 |
| *** edmondsw has joined #openstack-keystone | 18:44 | |
| browne | probably the easiest fix is to have horizon just warn | 18:45 |
| *** ayoung has quit IRC | 18:46 | |
| *** ayoung has joined #openstack-keystone | 18:46 | |
| *** ChanServ sets mode: +v ayoung | 18:46 | |
| lhcheng | browne: or just prevent user disabling the domain the user currently scoped to.. | 18:48 |
| browne | lhcheng: yep that would be good too | 18:48 |
| *** tonytan4ever has joined #openstack-keystone | 18:48 | |
| lhcheng | the user needs to be scoped to the default domain to be able to update domains, so the effect would be same as preventing default domain from being disabled. | 18:49 |
| lhcheng | browne: file a bug in horizon, I'll work on it. | 18:50 |
| browne | ok will do | 18:50 |
| browne | lhcheng: what about the current patch and bug in keystone? | 18:52 |
| browne | https://review.openstack.org/#/c/260067/ | 18:52 |
| browne | https://bugs.launchpad.net/keystone/+bug/1522616 | 18:52 |
| openstack | Launchpad bug 1522616 in OpenStack Identity (keystone) "It's possible to disable the default domain through domain update API" [Medium,In progress] - Assigned to Navid Pustchi (npustchi) | 18:53 |
| *** itlinux has joined #openstack-keystone | 18:54 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:54 | |
| *** phalmos has joined #openstack-keystone | 18:59 | |
| *** markvoelker has joined #openstack-keystone | 19:03 | |
| *** jsavak has quit IRC | 19:04 | |
| *** markvoelker_ has joined #openstack-keystone | 19:05 | |
| *** jsavak has joined #openstack-keystone | 19:06 | |
| *** jasonsb has quit IRC | 19:06 | |
| *** spzala has quit IRC | 19:06 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 19:08 |
| *** e0ne has quit IRC | 19:08 | |
| *** markvoelker has quit IRC | 19:09 | |
| *** itlinux_ has joined #openstack-keystone | 19:13 | |
| *** ajayaa has quit IRC | 19:13 | |
| *** markvoelker has joined #openstack-keystone | 19:14 | |
| *** itlinux has quit IRC | 19:14 | |
| *** fawadkhaliq has quit IRC | 19:16 | |
| stevemar | lhcheng: poke: also: https://review.openstack.org/#/c/261706 | 19:16 |
| *** markvoelker_ has quit IRC | 19:17 | |
| *** petertr7_away is now known as petertr7 | 19:20 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Allow '_' character in id_string parameter type https://review.openstack.org/264937 | 19:21 |
| *** KarthikB has quit IRC | 19:22 | |
| *** phalmos has quit IRC | 19:23 | |
| *** itlinux has joined #openstack-keystone | 19:25 | |
| *** phalmos has joined #openstack-keystone | 19:26 | |
| lhcheng | stevemar: would putting an upper constraint on pycadf also fix the issue on KSM (liberty)? | 19:27 |
| *** itlinux_ has quit IRC | 19:28 | |
| *** c_soukup has joined #openstack-keystone | 19:29 | |
| *** timcline_ has joined #openstack-keystone | 19:29 | |
| *** vgridnev_ has joined #openstack-keystone | 19:29 | |
| *** spandhe_ has joined #openstack-keystone | 19:31 | |
| *** breton_ has joined #openstack-keystone | 19:31 | |
| *** jraim_ has joined #openstack-keystone | 19:32 | |
| *** dims_ has joined #openstack-keystone | 19:33 | |
| henrynash | ayoung: on https://review.openstack.org/#/c/264259/ if we add calls to does_fk_exist() in your tets case, it gets a +2 from me | 19:33 |
| *** dims has quit IRC | 19:34 | |
| *** wasmum- has joined #openstack-keystone | 19:35 | |
| *** itlinux has quit IRC | 19:35 | |
| *** powerbsd has joined #openstack-keystone | 19:36 | |
| *** bradjones_ has joined #openstack-keystone | 19:37 | |
| *** bradjones_ has quit IRC | 19:37 | |
| *** bradjones_ has joined #openstack-keystone | 19:37 | |
| *** stevemar_znc has joined #openstack-keystone | 19:37 | |
| *** itlinux has joined #openstack-keystone | 19:38 | |
| henrynash | browne, gyee: the domain name IS in the token, so you could write a policy rule for update domain that prevented it working for teh default domain | 19:38 |
| *** breton has quit IRC | 19:38 | |
| *** spandhe has quit IRC | 19:38 | |
| *** csoukup has quit IRC | 19:38 | |
| *** timcline has quit IRC | 19:38 | |
| *** mserngawy_ has quit IRC | 19:38 | |
| *** zqfan has quit IRC | 19:38 | |
| *** vgridnev has quit IRC | 19:38 | |
| *** bradjones has quit IRC | 19:38 | |
| *** nkinder has quit IRC | 19:38 | |
| *** jorge_munoz has quit IRC | 19:38 | |
| *** alexpro has quit IRC | 19:38 | |
| *** albertom has quit IRC | 19:38 | |
| *** briancurtin has quit IRC | 19:38 | |
| *** sileht has quit IRC | 19:38 | |
| *** wasmum has quit IRC | 19:38 | |
| *** stevemar has quit IRC | 19:38 | |
| *** jraim has quit IRC | 19:38 | |
| *** bradjones_ is now known as bradjones | 19:38 | |
| *** powerbsd is now known as albertom | 19:38 | |
| dolphm | marekd: around? | 19:38 |
| *** spandhe_ is now known as spandhe | 19:39 | |
| *** spzala_ has joined #openstack-keystone | 19:39 | |
| *** stevemar_znc is now known as stevemar | 19:40 | |
| *** ChanServ sets mode: +o stevemar | 19:40 | |
| *** nkinder has joined #openstack-keystone | 19:40 | |
| *** lhcheng_ has joined #openstack-keystone | 19:40 | |
| *** jraim_ is now known as jraim | 19:40 | |
| *** stevemar changes topic to "MidCycle: https://wiki.openstack.org/wiki/Sprints/KeystoneMitakaSprint | Mitaka-2: https://launchpad.net/keystone/+milestone/mitaka-2" | 19:40 | |
| *** mserngawy_ has joined #openstack-keystone | 19:41 | |
| *** sileht has joined #openstack-keystone | 19:42 | |
| *** lhcheng has quit IRC | 19:43 | |
| *** tqtran has joined #openstack-keystone | 19:45 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:45 | |
| *** zqfan has joined #openstack-keystone | 19:45 | |
| *** briancurtin has joined #openstack-keystone | 19:46 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:48 | |
| *** itlinux has quit IRC | 19:53 | |
| ayoung | henrynash, roger. will fix | 19:54 |
| henrynash | ayoung: I await your every key stroke…. | 19:54 |
| *** jasonsb has joined #openstack-keystone | 19:54 | |
| *** dims_ has quit IRC | 20:00 | |
| *** itlinux has joined #openstack-keystone | 20:03 | |
| *** diazjf1 has joined #openstack-keystone | 20:04 | |
| *** diazjf has quit IRC | 20:04 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fix py34 problems in test_middleware https://review.openstack.org/264947 | 20:06 |
| *** phalmos has quit IRC | 20:07 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Fix py34 problems in test_middleware https://review.openstack.org/264947 | 20:10 |
| *** KarthikB has joined #openstack-keystone | 20:10 | |
| *** dhellmann has quit IRC | 20:11 | |
| *** c_soukup has quit IRC | 20:12 | |
| *** topol has joined #openstack-keystone | 20:12 | |
| *** ChanServ sets mode: +v topol | 20:12 | |
| *** dims has joined #openstack-keystone | 20:12 | |
| openstackgerrit | ayoung proposed openstack/keystone: SQL migrations for implied roles https://review.openstack.org/264259 | 20:14 |
| *** tsymanczyk has joined #openstack-keystone | 20:16 | |
| *** tsymanczyk is now known as Guest74940 | 20:17 | |
| *** ayoung has quit IRC | 20:19 | |
| *** dims has quit IRC | 20:19 | |
| *** Guest26209 has quit IRC | 20:20 | |
| *** Guest74940 has quit IRC | 20:21 | |
| *** dims has joined #openstack-keystone | 20:22 | |
| *** adam_g has joined #openstack-keystone | 20:22 | |
| *** phalmos has joined #openstack-keystone | 20:23 | |
| *** openstackgerrit has quit IRC | 20:23 | |
| *** dims has quit IRC | 20:23 | |
| *** openstackgerrit has joined #openstack-keystone | 20:24 | |
| *** jasonsb has quit IRC | 20:25 | |
| *** timcline_ has quit IRC | 20:26 | |
| *** jsavak has quit IRC | 20:27 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Correct docstrings for federation driver interface https://review.openstack.org/264068 | 20:28 |
| *** jsavak has joined #openstack-keystone | 20:30 | |
| *** slberger1 has joined #openstack-keystone | 20:33 | |
| *** timcline has joined #openstack-keystone | 20:34 | |
| *** slberger has quit IRC | 20:36 | |
| *** ayoung has joined #openstack-keystone | 20:39 | |
| *** ChanServ sets mode: +v ayoung | 20:39 | |
| *** dims has joined #openstack-keystone | 20:39 | |
| ayoung | dstanek, can you please pull the trigger on https://review.openstack.org/#/c/264259/ as i am trying to avoid a rebase due to the sql alchemy naming convention for upgrades | 20:41 |
| openstackgerrit | ayoung proposed openstack/keystone: backend for implied roles https://review.openstack.org/264260 | 20:41 |
| *** itlinux has quit IRC | 20:42 | |
| dstanek | ayoung: sure, i look in jas | 20:42 |
| ayoung | TYVM dstanek | 20:42 |
| navidp | stevemar, | 20:44 |
| stevemar | navidp: o/ just replied to your email | 20:44 |
| navidp | \0/ thanks | 20:44 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Reference driver methods through the Manager https://review.openstack.org/264958 | 20:44 |
| *** ninag has quit IRC | 20:45 | |
| bknudson_ | lbragstad: https://review.openstack.org/#/c/207226/ was merged with only 1 +2? | 20:47 |
| *** petertr7 is now known as petertr7_away | 20:48 | |
| *** c_soukup has joined #openstack-keystone | 20:50 | |
| *** petertr7_away is now known as petertr7 | 20:51 | |
| *** zqfan has quit IRC | 20:51 | |
| *** itlinux has joined #openstack-keystone | 20:52 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use assertIn to check if collection contains value https://review.openstack.org/264959 | 20:53 |
| stevemar | bknudson_: considering lbragstad +A'ed, he probably meant to +2, but #gerritUI | 20:53 |
| lbragstad | yes | 20:53 |
| lbragstad | sorry about that | 20:53 |
| lbragstad | #gerritUI #fail | 20:53 |
| stevemar | :) | 20:53 |
| bknudson_ | ok, no surprise the gerrit ui is weird | 20:54 |
| bknudson_ | it changes the text when you hover or something | 20:54 |
| stevemar | bknudson_: the only guy that complains when his stuff is merged | 20:54 |
| bknudson_ | y, the text changes when you hover over the bullet | 20:54 |
| lbragstad | bknudson_ that's strange. i noticed that earlier | 20:55 |
| stevemar | it is very weird | 20:55 |
| stevemar | it's unusable on a phone now | 20:55 |
| *** jasonsb has joined #openstack-keystone | 20:55 | |
| stevemar | the old UI wasn't great, but it was usable on a phone | 20:55 |
| lbragstad | stevemar just get a bigger phone :) | 20:55 |
| stevemar | now i can't even comment | 20:55 |
| lbragstad | everything is usable with a bigger phone | 20:55 |
| stevemar | lbragstad: nah, i can't even leave a comment with the "reply" button now | 20:56 |
| bknudson_ | http://www.sharenator.com/image/82882/ | 20:56 |
| lbragstad | ++ | 20:57 |
| notmorgan | dstanek: what was the result of our convo re enforcement | 20:58 |
| notmorgan | dstanek: do we care about early bail out? | 20:58 |
| notmorgan | bknudson_, stevemar: looking to remove the @protected decorator and the complexity so we call .enforce directly. Should we just enforce at the end when we have all the data or should we exit early when we can enforce at the start and save CPU/etc? | 21:00 |
| bknudson_ | I agree the decorator isn't helping much when it's gotten as complicated as it has. | 21:00 |
| bknudson_ | we should enforce early to save cpu | 21:01 |
| bknudson_ | otherwise it's a denial-of-service | 21:01 |
| notmorgan | bknudson_: ok so we should do like nova and call enforce in the method itself. | 21:01 |
| notmorgan | not try and be clever | 21:01 |
| bknudson_ | clever isn't helpful | 21:01 |
| stevemar | i don't really see the harm in the current implementation | 21:01 |
| notmorgan | i am planning on still using a decorator to annotate a method should enforce and if it doesn't enforce we will throw an error | 21:01 |
| notmorgan | stevemar: the callback thing is hard to follow and we're using it more and more. | 21:02 |
| stevemar | it is hard to follow, i'll grant you that | 21:02 |
| notmorgan | stevemar: the whole reason we have the callback thing is cause we can't enforce at the start/end easily | 21:02 |
| notmorgan | so i think we should simplify | 21:02 |
| bknudson_ | y, the callback makes it hard to follow | 21:02 |
| notmorgan | and it forces extra re-implementations all over | 21:02 |
| notmorgan | since the callback has to do all the same work as the @protected thing | 21:03 |
| bknudson_ | it would help to see an example where @protected is removed | 21:03 |
| *** raildo is now known as raildo-afk | 21:04 | |
| notmorgan | bknudson_: the logic will just become a method on the controller and you'll call self.enforce() | 21:04 |
| *** petertr7 is now known as petertr7_away | 21:04 | |
| *** rdo has quit IRC | 21:04 | |
| notmorgan | it will look like nova's implementation | 21:04 |
| *** petertr7_away is now known as petertr7 | 21:05 | |
| *** rdo has joined #openstack-keystone | 21:06 | |
| dstanek | notmorgan: i like the idea of bailing early | 21:08 |
| stevemar | dstanek: don't we bail early now? | 21:08 |
| dstanek | stevemar: yes, but we were discussing options early | 21:08 |
| *** itlinux has quit IRC | 21:09 | |
| dstanek | ayoung: not sure if you saw, but i did the review | 21:09 |
| stevemar | dstanek: thanks for reviewing ayoung's, it was next on my list | 21:10 |
| *** itlinux has joined #openstack-keystone | 21:10 | |
| bknudson_ | if (hasattr(self, 'get_member_from_driver') and -- spooky action at a distance | 21:10 |
| ayoung | dstanek, thanks | 21:11 |
| dstanek | stevemar: ayoung: my pleasure | 21:11 |
| notmorgan | bknudson_: and just go look at the role assignment stuff with the callbacks | 21:15 |
| stevemar | lhcheng_: heads up that gordc replied to you here: https://review.openstack.org/#/c/261706/ | 21:15 |
| notmorgan | bknudson_: even spookier | 21:15 |
| stevemar | bknudson_: thanks for rebasing | 21:15 |
| bknudson_ | stevemar: I'm trying to figure out why things keep failing | 21:15 |
| lhcheng_ | stevemar: thanks, checking | 21:15 |
| stevemar | bknudson_: refer to that cross project spec for backwards compat | 21:16 |
| notmorgan | what is the right way to lookup class/method name from a f in a decorator? | 21:16 |
| stevemar | heads up everyone, i'll be tagging stable releases for our libraries, ksa, ksc, ksm, and a stable release of keystone itself for liberty. get your backports in!!! dolphm ayoung dstanek henrynash lhcheng_ marekd notmorgan lbragstad gyee_needs_a_bouncer jamielennox | 21:19 |
| notmorgan | seriously gyee_needs_a_bouncer | 21:19 |
| stevemar | tjcocozz: hey tom, anyway you can squash these 2 commits? https://review.openstack.org/#/c/261253/ and https://review.openstack.org/#/c/264947/ -- add yourself as a co-author | 21:20 |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: Switch saml2 from lxml to built-in xml https://review.openstack.org/242512 | 21:21 |
| tjcocozz | stevemar, what should i do? | 21:21 |
| tjcocozz | stevemar, just put them into 1 commit? | 21:22 |
| stevemar | tjcocozz: checkout ankit's change, and add yours into them | 21:22 |
| stevemar | yep | 21:22 |
| stevemar | tjcocozz: you coming to midcycle too right? | 21:22 |
| stevemar | did we get you approval? | 21:22 |
| tjcocozz | stevemar, sounds g. Doing it now. Yes i will be there :) | 21:22 |
| stevemar | tjcocozz: yippie! | 21:22 |
| lbragstad | can we bbq? | 21:23 |
| tjcocozz | stevemar, I am excited! | 21:23 |
| stevemar | lbragstad: we can definitely bbq | 21:23 |
| stevemar | tjcocozz: glad to hear that :) | 21:23 |
| *** slberger1 has quit IRC | 21:25 | |
| *** slberger has joined #openstack-keystone | 21:25 | |
| notmorgan | is .__name__ python3 compat? | 21:29 |
| stevemar | it looks like we'll be getting lunches served to us during the midcycle :) | 21:30 |
| notmorgan | for like type(self).__name__ or is there a better way to get the classname? | 21:30 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Replace unicode with six.text_type https://review.openstack.org/261253 | 21:33 |
| *** topol has quit IRC | 21:34 | |
| tjcocozz | stevemar, hold off on a vote, i am booting up a different vm to run py34 | 21:34 |
| dstanek | notmorgan: that's the way i do in for py2 and py3 | 21:38 |
| *** peter-hamilton has quit IRC | 21:40 | |
| tjcocozz | stevemar, yea it passes py34 | 21:41 |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Replace unicode with six.text_type https://review.openstack.org/261253 | 21:41 |
| notmorgan | dstanek: so self.__name__ and f.__name__ should be sufficient? | 21:41 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: De-duplicate fernet payload tests https://review.openstack.org/230193 | 21:44 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implement manager and backend changes for implied roles https://review.openstack.org/264260 | 21:44 |
| dstanek | notmorgan: i usually get the type using obj.__class__ though | 21:46 |
| openstackgerrit | henry-nash proposed openstack/keystone: Implied Roles API https://review.openstack.org/242614 | 21:46 |
| dstanek | self.__class__.__name__ | 21:47 |
| notmorgan | dstanek: yeah. | 21:47 |
| notmorgan | dstanek: thnx | 21:47 |
| dstanek | notmorgan: np | 21:47 |
| *** itlinux has quit IRC | 21:48 | |
| anteaya | stevemar: oh you are at the ibm offices in austin, I suggest you make sure they have wifi | 21:49 |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Delete checks for default domain delete https://review.openstack.org/264342 | 21:49 |
| anteaya | last year for cinder sprint they didn't | 21:49 |
| anteaya | 3 days of everyone tethering from phones | 21:50 |
| *** phalmos has quit IRC | 21:50 | |
| *** mserngawy_ has quit IRC | 21:50 | |
| *** wasmum- has quit IRC | 21:50 | |
| *** jaosorior has quit IRC | 21:50 | |
| *** boris-42 has quit IRC | 21:50 | |
| *** gsilvis has quit IRC | 21:50 | |
| *** phalmos has joined #openstack-keystone | 21:51 | |
| *** mserngawy_ has joined #openstack-keystone | 21:51 | |
| *** wasmum- has joined #openstack-keystone | 21:51 | |
| *** jaosorior has joined #openstack-keystone | 21:51 | |
| *** boris-42 has joined #openstack-keystone | 21:51 | |
| *** gsilvis has joined #openstack-keystone | 21:51 | |
| *** itlinux has joined #openstack-keystone | 21:57 | |
| *** ayoung has quit IRC | 21:58 | |
| stevemar | anteaya: yep, got that taken care of | 22:02 |
| stevemar | anteaya: we'll be in the actual visitor area, they have good quality guest wifi | 22:04 |
| anteaya | yay | 22:05 |
| anteaya | good call | 22:05 |
| notmorgan | bknudson_: ok this is a sign i this decorator needs to go, it's damn near impossible to follow and I'm familiar with it. wow this is doing too much stuff | 22:06 |
| *** vgridnev_ has quit IRC | 22:07 | |
| *** rderose has quit IRC | 22:08 | |
| *** gsilvis has quit IRC | 22:09 | |
| *** gsilvis has joined #openstack-keystone | 22:10 | |
| *** jsavak has quit IRC | 22:12 | |
| *** itlinux has quit IRC | 22:14 | |
| *** diazjf1 has quit IRC | 22:19 | |
| *** petertr7 is now known as petertr7_away | 22:22 | |
| bknudson_ | I like how nova is removing the ec2 API stuff ... we should do the same in keystone. | 22:23 |
| stevemar | bknudson_: in lieu of ec2apiutils or something right? | 22:24 |
| jamielennox | bknudson_: as i understand it our ec2 is actually being used | 22:24 |
| *** timcline has quit IRC | 22:24 | |
| bknudson_ | t, there's a separate project | 22:24 |
| jamielennox | everyone who didn't want to do trusts realized that the ec2 interface essentially gave you long run logins without a password | 22:25 |
| *** diazjf has joined #openstack-keystone | 22:25 | |
| bknudson_ | https://pypi.python.org/pypi/ec2-api/1.0.0 | 22:25 |
| bknudson_ | looks like they're having rst problems. | 22:26 |
| bknudson_ | it's still openstack it's just not in their tree | 22:27 |
| slberger | Jan 07 22:20:19 oc-mon01-sie-keystone-0 systemd[1]: Reloading The Apache HTTP Server. | 22:28 |
| slberger | Jan 07 22:20:19 oc-mon01-sie-keystone-0 httpd[25575]: httpd: Syntax error on line 353 of /etc/httpd/conf/httpd.conf: Syntax error on line 1 of /etc/httpd/conf.d/keystone.conf: Cannot load /usr/lib64/httpd/modules/mod_auth_openidc.so into server: /usr/lib64/httpd/modules/mod_auth_openidc.so: cannot open shared object file: No such file or directory | 22:28 |
| slberger | Jan 07 22:20:19 oc-mon01-sie-keystone-0 systemd[1]: httpd.service: control process exited, code=exited status=1 | 22:28 |
| slberger | Jan 07 22:20:19 oc-mon01-sie-keystone-0 systemd[1]: Reload failed for The Apache HTTP Server. | 22:28 |
| bknudson_ | proposed gate job to run keystone under uwsgi rather than eventlet: https://review.openstack.org/#/c/264991/2 | 22:31 |
| *** itlinux has joined #openstack-keystone | 22:31 | |
| bknudson_ | and here's the devstack change to run keystone under uwsgi : https://review.openstack.org/#/c/257571 | 22:31 |
| *** itlinux has quit IRC | 22:33 | |
| notmorgan | bknudson_: nice | 22:36 |
| *** itlinux has joined #openstack-keystone | 22:36 | |
| *** gyee has joined #openstack-keystone | 22:36 | |
| *** ChanServ sets mode: +v gyee | 22:36 | |
| slberger | sorry wrong chat | 22:37 |
| *** spzala_ has quit IRC | 22:37 | |
| *** spandhe has quit IRC | 22:39 | |
| *** spandhe has joined #openstack-keystone | 22:41 | |
| *** tonytan4ever has quit IRC | 22:42 | |
| *** itlinux has quit IRC | 22:43 | |
| *** spzala has joined #openstack-keystone | 22:47 | |
| *** lhcheng_ has quit IRC | 22:48 | |
| *** spzala_ has joined #openstack-keystone | 22:48 | |
| notmorgan | stevemar, bknudson_: so looks like https://review.openstack.org/#/c/208069/ actually broke folks in production | 22:49 |
| notmorgan | stevemar, bknudson_: while it is a "security-ish" issue, we may want to revert it for master, kilo, and liberty | 22:49 |
| bknudson_ | we backported it? | 22:50 |
| notmorgan | they were, unfortunately, relying on the behavior of getting a v2 token for a v3 user in a non-default domain | 22:50 |
| notmorgan | bknudson_: yes, to kilo | 22:50 |
| *** jsavak has joined #openstack-keystone | 22:50 | |
| notmorgan | bknudson_: and the liberty rollout broke folks. | 22:50 |
| * notmorgan tries to think if reverting it really exposes a lot. | 22:50 | |
| *** spzala has quit IRC | 22:51 | |
| bknudson_ | "v2 not seeing non-default domain objects" leads to weird behavior | 22:51 |
| notmorgan | it does. | 22:51 |
| notmorgan | i'm just not sure if it is a security flaw. | 22:52 |
| notmorgan | maybe we can just ban v2 actions on keystone without blocking token issuance | 22:52 |
| notmorgan | for non-default domain users. | 22:52 |
| *** diazjf has quit IRC | 22:53 | |
| *** spzala_ has quit IRC | 22:53 | |
| bknudson_ | I don't see any security issue mentioned in the bugs. | 22:53 |
| notmorgan | there was some limited mention but it was classifed as no-OSSA | 22:54 |
| notmorgan | so i'm not super worried about a revert | 22:54 |
| *** jsavak has quit IRC | 22:55 | |
| bknudson_ | notmorgan: just checking -- it's not because they have auth_token middleware configured for v2? | 22:55 |
| notmorgan | bknudson_: no this is a user authing to get a token from keystone | 22:56 |
| notmorgan | and then using that info to talk to swift | 22:56 |
| *** jsavak has joined #openstack-keystone | 22:56 | |
| notmorgan | but they are authing a non-default-domain user against v2 auth | 22:56 |
| bknudson_ | they must be getting the token by user ID | 22:56 |
| notmorgan | yes they are using user_id and tenant_id | 22:56 |
| bknudson_ | it was an oversight and a bug but I can't see any security issue | 22:57 |
| bknudson_ | the token info returned isn't going to be correct | 22:57 |
| bknudson_ | which might confuse someone's obscure policy.json if they were relying on domain IDs | 22:58 |
| *** c_soukup has quit IRC | 22:58 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Revert "Validate domain ownership for v2 tokens" https://review.openstack.org/265002 | 22:59 |
| notmorgan | bknudson_: ^ | 22:59 |
| notmorgan | bknudson_: yeah. | 22:59 |
| notmorgan | bknudson_: but scope is pretty well protected. | 22:59 |
| bknudson_ | can we make it a config option? | 23:00 |
| notmorgan | we can for master | 23:00 |
| notmorgan | we can't for stable/* | 23:00 |
| notmorgan | which is important to revert as well. | 23:00 |
| *** spandhe has quit IRC | 23:00 | |
| *** dims_ has joined #openstack-keystone | 23:00 | |
| notmorgan | so maybe revert it all, and then revert the revert with the added config? | 23:00 |
| *** dims has quit IRC | 23:01 | |
| bknudson_ | https://review.openstack.org/#/c/265002/ says "Cannot merge" for some reason... weird | 23:01 |
| notmorgan | bknudson_: huh | 23:01 |
| notmorgan | let me pull it down. | 23:01 |
| notmorgan | ah new gerrit revert botton is weird | 23:02 |
| notmorgan | ok this needs some other fixing in the tests | 23:02 |
| bknudson_ | here we go with more gerrit ui weirdness | 23:02 |
| notmorgan | yah | 23:02 |
| *** jorge_munoz has joined #openstack-keystone | 23:03 | |
| bknudson_ | it's funny we had specific tests that says it works to validate non-default users using v2. | 23:03 |
| notmorgan | yah right? | 23:03 |
| notmorgan | expected behavior | 23:03 |
| notmorgan | *facepalm* | 23:03 |
| bknudson_ | didn't we always reject validating a token that wasn't in the default domain using v2? | 23:05 |
| bknudson_ | I thought I ran into this with auth_token middleware when it was using v2 | 23:05 |
| notmorgan | bknudson_: aparantly not | 23:05 |
| *** nkinder has quit IRC | 23:09 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:12 | |
| *** tonytan4ever has joined #openstack-keystone | 23:14 | |
| *** tonytan4ever has quit IRC | 23:18 | |
| stevemar | notmorgan: related bug: https://bugs.launchpad.net/keystone/+bug/1527759 | 23:18 |
| openstack | Launchpad bug 1527759 in OpenStack Identity (keystone) "Default domain no longer lets keystone tenant-list work" [Undecided,New] | 23:18 |
| *** phalmos has quit IRC | 23:18 | |
| notmorgan | this is an ugly revert fwiw | 23:19 |
| notmorgan | because so much has changed. | 23:20 |
| bknudson_ | add a config option and default to the old behavior | 23:23 |
| *** jasonsb has quit IRC | 23:23 | |
| notmorgan | bknudson_: i am disinclined to even offer it as an option. most (all?) deployments don't really flip those types of opt-in things | 23:23 |
| notmorgan | and it's cruft we have to carry. | 23:25 |
| *** gordc has quit IRC | 23:28 | |
| *** spandhe has joined #openstack-keystone | 23:32 | |
| *** spandhe has quit IRC | 23:32 | |
| *** spandhe has joined #openstack-keystone | 23:38 | |
| *** dims_ has quit IRC | 23:39 | |
| *** doug-fish has quit IRC | 23:41 | |
| notmorgan | bknudson_: omg http://paste.openstack.org/show/483286/ our tests don't actually test what we want. | 23:44 |
| *** dims_ has joined #openstack-keystone | 23:45 | |
| notmorgan | bknudson_: oh wait nvm | 23:46 |
| notmorgan | i was mis-reading the test | 23:46 |
| *** ayoung has joined #openstack-keystone | 23:48 | |
| *** ChanServ sets mode: +v ayoung | 23:48 | |
| *** jsavak has quit IRC | 23:48 | |
| *** shoutm has joined #openstack-keystone | 23:48 | |
| *** dims_ has quit IRC | 23:50 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Replace tenant for project in resource files https://review.openstack.org/248295 | 23:50 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Create V9 version of resource driver interface https://review.openstack.org/262082 | 23:50 |
| *** shoutm has quit IRC | 23:53 | |
| *** spandhe has quit IRC | 23:54 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Revert "Validate domain ownership for v2 tokens" https://review.openstack.org/265002 | 23:55 |
| *** shoutm has joined #openstack-keystone | 23:56 | |
| *** KarthikB has quit IRC | 23:57 | |
| notmorgan | bknudson_: ^ | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!