| *** chlong has quit IRC | 00:01 | |
| *** dims_ has joined #openstack-keystone | 00:02 | |
| *** dims has quit IRC | 00:05 | |
| *** alejandrito has quit IRC | 00:05 | |
| *** tpeoples has quit IRC | 00:08 | |
| *** tpeoples has joined #openstack-keystone | 00:10 | |
| *** roxanaghe has joined #openstack-keystone | 00:11 | |
| *** DuncanT has quit IRC | 00:15 | |
| *** DuncanT has joined #openstack-keystone | 00:16 | |
| *** chlong has joined #openstack-keystone | 00:17 | |
| *** roxanaghe has quit IRC | 00:17 | |
| *** su_zhang has joined #openstack-keystone | 00:17 | |
| *** shoutm_ has joined #openstack-keystone | 00:35 | |
| *** woodster_ has quit IRC | 00:36 | |
| *** shoutm has quit IRC | 00:38 | |
| *** Anticimex has quit IRC | 00:44 | |
| *** markvoelker has joined #openstack-keystone | 00:46 | |
| bigjools | notmorgan: I'm getting 404s using keystoneclient without a version in the auth URL, is this a bug given what you said a few days ago? | 00:46 |
|---|---|---|
| *** Anticimex has joined #openstack-keystone | 00:48 | |
| jamielennox | bigjools: what do the __init__ params look like? | 00:50 |
| bigjools | I'm just filing a bug with gory details, one sec | 00:50 |
| *** markvoelker has quit IRC | 00:50 | |
| bigjools | jamielennox: https://bugs.launchpad.net/python-keystoneclient/+bug/1540180 | 00:51 |
| openstack | Launchpad bug 1540180 in python-keystoneclient "404 from server unless version is in URL" [Undecided,New] | 00:51 |
| bigjools | I am probably doing something wrong... | 00:51 |
| bigjools | but not the only one to get this | 00:51 |
| jamielennox | bigjools: so there are generic and versioned plugins | 00:52 |
| jamielennox | in ksc they're ksc.auth.identity.Password vs ksc.auth.identity.V3Password | 00:52 |
| notmorgan | jamielennox: ++ | 00:53 |
| jamielennox | in the generic plugins they will do version discovery and figure out what version you should use | 00:53 |
| bigjools | aha | 00:53 |
| jamielennox | so :5000/ works | 00:53 |
| jamielennox | v3.X will expect a v3 url | 00:53 |
| notmorgan | jamielennox: we have a similar issue that's hitting Shrews in shade i think. | 00:53 |
| notmorgan | jamielennox: fwiw. | 00:53 |
| jamielennox | notmorgan: i've been off for a bit | 00:54 |
| notmorgan | jamielennox: no worries i'm digging through it. | 00:54 |
| bigjools | is it just safest to leave the version in the url so both code paths work? | 00:54 |
| notmorgan | bigjools: just don't add more entries with versions | 00:54 |
| notmorgan | bigjools: also is this using keystone cli or as a lib | 00:54 |
| notmorgan | because if it's the CLI, don't do that | 00:55 |
| notmorgan | bigjools: use openstackclient | 00:55 |
| bigjools | I'm trying to get Rally to work | 00:55 |
| jamielennox | bigjools: what i'd prefer is that you used the loading mechanisms | 00:55 |
| notmorgan | jamielennox: i'll bet rally is just broken | 00:55 |
| jamielennox | ah, then you're stuck with what rally offers | 00:55 |
| notmorgan | jamielennox: horribly | 00:55 |
| bigjools | quite :/ | 00:55 |
| notmorgan | jamielennox: like usual. | 00:55 |
| notmorgan | bigjools: this might be a bug in rally then | 00:55 |
| bigjools | I was just trying to recreate a basic scenario and work out what I need to chnge in Rally code | 00:55 |
| notmorgan | bigjools: where it uses the wrong loader(s) | 00:56 |
| jamielennox | i did see there was a way to make rally work with v3 auth, but it's very much using there own way | 00:56 |
| bigjools | notmorgan: I'm shocked :) | 00:56 |
| notmorgan | bigjools: yeah figured. | 00:56 |
| *** hogepodge has quit IRC | 00:56 | |
| bigjools | Dave passes his regards BTW | 00:56 |
| notmorgan | bigjools: i very much dislike dealing with Rally because it's alwways "do something totally different than anywhere else" | 00:56 |
| notmorgan | bigjools: dave? | 00:56 |
| jamielennox | notmorgan: i think i kind of gave up after http://boris-42.me/the-simplest-way-to-use-openstack-python-clients/ | 00:56 |
| bigjools | Dave L | 00:56 |
| notmorgan | oh hah | 00:57 |
| notmorgan | yeah have a drink with him for me | 00:57 |
| jamielennox | notmorgan: basically, ignore the shipped clients and use the rally clients | 00:57 |
| notmorgan | jamielennox: *facepalm* | 00:57 |
| notmorgan | Seriously?!. ok this makes me want to write rally off even more now. | 00:57 |
| bigjools | jamielennox: by loading mechanism you mean use the generic identity and client? | 00:57 |
| jamielennox | bigjools: i've only recently started playing with rally, but i'd love it ifsomeone fixed there auth loading | 00:58 |
| notmorgan | jamielennox: i'll tack it onto my backlog of fixing insane things | 00:58 |
| notmorgan | jamielennox: we need them on OCC/KSA anyway | 00:58 |
| jamielennox | bigjools: no i mean, ksc gives a very specific mechanism for loading any authentication mechanism that the clients specify | 00:58 |
| notmorgan | jamielennox: so, i can justify doing that work. | 00:58 |
| bigjools | I started writing my own test harness to DTRT.... took a back burner for now | 00:58 |
| jamielennox | bigjools: as opposed to just assuming that we're going to want to use a password and it's either v2 or v3 | 00:58 |
| *** hogepodge has joined #openstack-keystone | 00:59 | |
| jamielennox | bigjools: http://www.jamielennox.net/blog/2015/02/17/loading-authentication-plugins/ | 00:59 |
| notmorgan | jamielennox: you're not stale core are you? | 00:59 |
| notmorgan | jamielennox: stable* | 00:59 |
| jamielennox | rally uses it's own configuration format, but the actual loaders are ~15 lines and rally could use the same concept to do it's own loader from whatever format is uses | 01:00 |
| jamielennox | notmorgan: no | 01:00 |
| bigjools | jamielennox: super, thanks | 01:00 |
| notmorgan | jamielennox: darn, trying to get a patch into stable/<something> | 01:00 |
| notmorgan | bigjools: i promise i'll get around to working on rally things when i have a few other things cleaned up | 01:01 |
| notmorgan | bigjools: unless you want to take a stab at fixing their awful auth loader | 01:01 |
| bigjools | notmorgan: it's a depressing area | 01:01 |
| notmorgan | which case, jamielennox and I will review it | 01:01 |
| jamielennox | yea, i loaded up rally the other day and found this for the first time | 01:01 |
| notmorgan | [see i tossed jamielennox under the bus for that] | 01:01 |
| bigjools | haha | 01:01 |
| jamielennox | so it's on my list too | 01:01 |
| notmorgan | jamielennox: oh i do need you to review something tomorrow | 01:01 |
| notmorgan | sec | 01:01 |
| notmorgan | jamielennox: https://review.openstack.org/#/c/253793/ need you to toss a +1, we corrected your -1 issue | 01:02 |
| bigjools | it's fairly high priority for me to get this working so I'll get on it soon once I work out exactly what to change, I'm not that familiar with rally code | 01:02 |
| notmorgan | bigjools: the rough part is... not many are | 01:02 |
| bigjools | well ChrisStP is core dev so.... | 01:02 |
| jamielennox | bigjools: in a just make it work way, you can definetly use v3 auth in rally like https://github.com/openstack/rally/blob/master/samples/deployments/existing-keystone-v3.json | 01:02 |
| jamielennox | i have no idea what will/wont work there though | 01:03 |
| bigjools | jamielennox: I think I was getting 404 for that because our catalog URLs are versionless | 01:03 |
| bigjools | let me try again | 01:03 |
| notmorgan | jamielennox: also.. https://review.openstack.org/#/c/274085/5/keystone/common/manager.py <--- scary extra tracing debug stuff | 01:03 |
| jamielennox | bigjools: ah, i have no idea then what rally is using for version discovery | 01:04 |
| bigjools | indeed | 01:04 |
| jamielennox | bigjools: i would almost bet that it's not the standard tools | 01:04 |
| *** dims_ has quit IRC | 01:04 | |
| bigjools | I think it's doing what I did in the bug above | 01:04 |
| bigjools | or similar | 01:04 |
| *** fpatwa has joined #openstack-keystone | 01:04 | |
| jamielennox | notmorgan: what was my -1? | 01:04 |
| bigjools | I traced the code through and it ends up with a url without the version at the POST | 01:05 |
| notmorgan | jamielennox: using a private interface | 01:05 |
| notmorgan | jamielennox: in opt handling | 01:05 |
| jamielennox | oh, yea - that was an easy one | 01:05 |
| notmorgan | yah | 01:05 |
| notmorgan | jamielennox: the patch hasn't changed much since | 01:05 |
| notmorgan | just a bunch of rebase hell | 01:05 |
| bigjools | jamielennox: oh I just noticed that example config URL has v3 in it | 01:07 |
| jamielennox | notmorgan: for future, my comment on https://review.openstack.org/#/c/253793/22/nova/network/neutronv2/api.py | 01:09 |
| *** davechen has joined #openstack-keystone | 01:12 | |
| notmorgan | jamielennox: yeah we figured that out | 01:14 |
| *** fpatwa has quit IRC | 01:23 | |
| *** fpatwa has joined #openstack-keystone | 01:23 | |
| bigjools | http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html#authenticating-using-sessions | 01:28 |
| bigjools | I think that example is wrong | 01:28 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate simple_cert extension https://review.openstack.org/274479 | 01:30 |
| notmorgan | stevemar: ^ more deprecations OMG. | 01:32 |
| stevemar | notmorgan: we gotta deprecate all the pki crap from middleware | 01:37 |
| notmorgan | stevemar: ksm != server ;) | 01:37 |
| notmorgan | stevemar: but yes | 01:37 |
| *** shoutm_ has quit IRC | 01:40 | |
| *** shoutm has joined #openstack-keystone | 01:42 | |
| *** davechen1 has joined #openstack-keystone | 01:45 | |
| *** markvoelker has joined #openstack-keystone | 01:47 | |
| *** davechen has quit IRC | 01:47 | |
| *** henrynash has quit IRC | 01:48 | |
| stevemar | notmorgan: hehe, yeah, i was just looking at ksm and was like... ughh... stupid pki args | 01:49 |
| stevemar | rather, config opt | 01:49 |
| stevemar | s | 01:49 |
| *** EinstCrazy has quit IRC | 01:50 | |
| notmorgan | stevemar: going to have another couple "make things not extensions" patches going up | 01:51 |
| notmorgan | stevemar: in a few minutes. | 01:51 |
| notmorgan | stevemar: as a heads up | 01:51 |
| *** shoutm has quit IRC | 01:52 | |
| notmorgan | stevemar: because i want to smush in our authcontext stuff into the main Service entrie | 01:52 |
| *** markvoelker has quit IRC | 01:52 | |
| notmorgan | so we can kill this horrible horrible horrible horrible test | 01:52 |
| notmorgan | LookupError: No section 'ec2_extension_extension' (prefixed by 'filter') found in config /home/notmorgan/keystone/etc/keystone-paste.ini | 01:52 |
| stevemar | ec2_extension_extension | 01:53 |
| stevemar | awesome | 01:53 |
| *** boris-42 has quit IRC | 01:53 | |
| notmorgan | yeah doing admin/user_crud | 01:54 |
| notmorgan | then will hit S3 and then Ec2 | 01:54 |
| stevemar | those last 2 will be tricky | 01:54 |
| notmorgan | then compress in AuthContext, JsonBody, etc | 01:54 |
| notmorgan | nah | 01:54 |
| notmorgan | wont be hard | 01:54 |
| notmorgan | :) | 01:54 |
| stevemar | notmorgan: i'm glad you're working on keystone server again :) | 01:54 |
| stevemar | deprecating and removing stuff is the fun part :) | 01:54 |
| notmorgan | stevemar: i wish i could just rm -rf v2 things | 01:55 |
| stevemar | first step is done | 01:55 |
| notmorgan | hm. how do i unstage just one file... | 01:55 |
| notmorgan | ugh | 01:55 |
| notmorgan | oh well this patch will be slightly bigger than expected | 01:55 |
| *** davechen has joined #openstack-keystone | 01:57 | |
| *** henrynash has joined #openstack-keystone | 01:57 | |
| *** ChanServ sets mode: +v henrynash | 01:57 | |
| *** shoutm has joined #openstack-keystone | 01:58 | |
| notmorgan | stevemar: and then i'll wander back off into trying to fix other projects too | 01:58 |
| notmorgan | stevemar: land. | 01:58 |
| *** roxanaghe has joined #openstack-keystone | 01:59 | |
| stevemar | notmorgan: update https://github.com/openstack/keystone/blob/master/releasenotes/notes/extensions-to-core-a0d270d216d47276.yaml for simple cert | 02:00 |
| *** davechen1 has quit IRC | 02:00 | |
| notmorgan | stevemar: mind if i do it as a followup for all of these? | 02:00 |
| *** tonytan4ever has joined #openstack-keystone | 02:00 | |
| stevemar | sure | 02:00 |
| * notmorgan is a bit deep in the chain atm. | 02:00 | |
| stevemar | just a reminder | 02:00 |
| notmorgan | stevemar: fwiw TRACE debugger is proposed, please poke at it | 02:01 |
| notmorgan | stevemar: and i think we've resolved all the outstanding issues on the Cacher | 02:01 |
| stevemar | notmorgan: *nod* | 02:01 |
| notmorgan | stevemar: and the revert for token things on stable/kilo needs another stable core | 02:01 |
| notmorgan | stevemar: i pushed the liberty one since brant's -1 was a comment fix he fixed | 02:02 |
| notmorgan | and it had your +2 and then his. | 02:02 |
| notmorgan | split across a comment-fix patch | 02:02 |
| *** dims has joined #openstack-keystone | 02:02 | |
| stevemar | notmorgan: thanks for that, there are 5 more stable patches that can be punted through | 02:03 |
| stevemar | https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:stable/liberty | 02:03 |
| stevemar | then i will finally be able to release a new liberty version! | 02:03 |
| stevemar | notmorgan: also, the revert... https://review.openstack.org/#/c/265019/ | 02:04 |
| notmorgan | i'll smack the ksm options and such for pki once i'm done with ec2 ick | 02:04 |
| notmorgan | stevemar: you know what is exciting... | 02:04 |
| stevemar | notmorgan: i'll work on that tonight | 02:04 |
| stevemar | notmorgan: nope, what? | 02:04 |
| notmorgan | stevemar: if i can get everything behind a single API host... | 02:05 |
| notmorgan | EC2 middleware can do 100% of the auth for the request | 02:05 |
| notmorgan | no need to EC2 -> token -> request | 02:05 |
| *** roxanaghe has quit IRC | 02:06 | |
| notmorgan | as in.. we can just verify EC2 things and cleanup the ksm ec2 thing | 02:06 |
| notmorgan | a lot | 02:06 |
| *** shoutm_ has joined #openstack-keystone | 02:07 | |
| *** shoutm has quit IRC | 02:08 | |
| stevemar | yeah, if the ec2 middleware even works :\ | 02:08 |
| *** fpatwa has quit IRC | 02:09 | |
| *** shoutm has joined #openstack-keystone | 02:11 | |
| *** shoutm_ has quit IRC | 02:11 | |
| *** dims has quit IRC | 02:12 | |
| *** tonytan4ever has quit IRC | 02:12 | |
| *** dims has joined #openstack-keystone | 02:12 | |
| *** tonytan4ever has joined #openstack-keystone | 02:13 | |
| *** dims has quit IRC | 02:13 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate simple_cert extension https://review.openstack.org/274479 | 02:14 |
| notmorgan | crap. | 02:16 |
| notmorgan | i need to unstage that and re-stage it... ugggghhhhh | 02:16 |
| *** tonytan4ever has quit IRC | 02:18 | |
| *** tonytan4ever has joined #openstack-keystone | 02:18 | |
| *** tonytan4ever has joined #openstack-keystone | 02:19 | |
| *** fpatwa has joined #openstack-keystone | 02:20 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Deprecate simple_cert extension https://review.openstack.org/274479 | 02:26 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Move user and admin crud to core https://review.openstack.org/274489 | 02:26 |
| *** Nirupama has joined #openstack-keystone | 02:32 | |
| *** tonytan4ever has quit IRC | 02:37 | |
| *** boris-42 has joined #openstack-keystone | 02:38 | |
| *** su_zhang has quit IRC | 02:55 | |
| *** fpatwa has quit IRC | 02:57 | |
| *** shoutm has quit IRC | 03:13 | |
| *** LZ has quit IRC | 03:15 | |
| *** shoutm has joined #openstack-keystone | 03:22 | |
| *** roxanaghe has joined #openstack-keystone | 03:31 | |
| *** roxanaghe has quit IRC | 03:37 | |
| *** links has joined #openstack-keystone | 03:46 | |
| *** markvoelker has joined #openstack-keystone | 03:47 | |
| *** EinstCrazy has joined #openstack-keystone | 03:51 | |
| *** markvoelker has quit IRC | 03:52 | |
| *** EinstCrazy has quit IRC | 03:58 | |
| *** shoutm_ has joined #openstack-keystone | 04:03 | |
| *** shoutm has quit IRC | 04:03 | |
| *** roxanaghe has joined #openstack-keystone | 04:06 | |
| *** links has quit IRC | 04:19 | |
| *** roxanaghe has quit IRC | 04:40 | |
| *** fpatwa has joined #openstack-keystone | 04:49 | |
| *** links has joined #openstack-keystone | 04:53 | |
| *** chlong has quit IRC | 05:05 | |
| *** roxanaghe has joined #openstack-keystone | 05:16 | |
| *** chlong has joined #openstack-keystone | 05:17 | |
| *** jasonsb has joined #openstack-keystone | 05:21 | |
| *** chlong has quit IRC | 05:25 | |
| *** jasonsb has quit IRC | 05:25 | |
| *** jasonsb has joined #openstack-keystone | 05:29 | |
| *** shoutm_ has quit IRC | 05:29 | |
| *** Nirupama has quit IRC | 05:30 | |
| *** chlong has joined #openstack-keystone | 05:38 | |
| *** josecastroleon1 has joined #openstack-keystone | 05:41 | |
| *** DuncanT_ has joined #openstack-keystone | 05:42 | |
| *** darrenc_ has joined #openstack-keystone | 05:43 | |
| *** fpatwa_ has joined #openstack-keystone | 05:43 | |
| *** Tridde_ has joined #openstack-keystone | 05:44 | |
| *** Nakato_ has joined #openstack-keystone | 05:44 | |
| *** gus_ has joined #openstack-keystone | 05:45 | |
| *** Anticime1 has joined #openstack-keystone | 05:45 | |
| *** lifeless_ has joined #openstack-keystone | 05:45 | |
| *** tobasco_ has joined #openstack-keystone | 05:47 | |
| *** davechen1 has joined #openstack-keystone | 05:48 | |
| *** markvoelker has joined #openstack-keystone | 05:48 | |
| *** med_ has joined #openstack-keystone | 05:48 | |
| *** med_ is now known as Guest80711 | 05:49 | |
| *** fpatwa has quit IRC | 05:49 | |
| *** davechen has quit IRC | 05:49 | |
| *** Anticimex has quit IRC | 05:49 | |
| *** DuncanT has quit IRC | 05:49 | |
| *** _fortis has quit IRC | 05:49 | |
| *** lifeless has quit IRC | 05:49 | |
| *** mgagne has quit IRC | 05:49 | |
| *** agireud has quit IRC | 05:49 | |
| *** dtroyer has quit IRC | 05:49 | |
| *** Guest65103 has quit IRC | 05:49 | |
| *** errr_ has quit IRC | 05:49 | |
| *** josecastroleon has quit IRC | 05:49 | |
| *** tobasco has quit IRC | 05:49 | |
| *** john5223 has quit IRC | 05:49 | |
| *** comstud has quit IRC | 05:49 | |
| *** Tridde has quit IRC | 05:49 | |
| *** gus has quit IRC | 05:49 | |
| *** jamielennox has quit IRC | 05:49 | |
| *** Nakato has quit IRC | 05:49 | |
| *** darrenc has quit IRC | 05:49 | |
| *** d34dh0r53 has quit IRC | 05:49 | |
| *** dolphm has quit IRC | 05:49 | |
| *** eglute has quit IRC | 05:49 | |
| *** cloudnull has quit IRC | 05:49 | |
| *** sigmavirus24_awa has quit IRC | 05:49 | |
| *** mgagne_ has joined #openstack-keystone | 05:49 | |
| *** dolphm has joined #openstack-keystone | 05:50 | |
| *** dtroyer has joined #openstack-keystone | 05:50 | |
| *** DuncanT_ is now known as DuncanT | 05:51 | |
| *** agireud has joined #openstack-keystone | 05:51 | |
| *** d34dh0r53 has joined #openstack-keystone | 05:52 | |
| *** tobasco_ has quit IRC | 05:52 | |
| *** comstud has joined #openstack-keystone | 05:52 | |
| *** tobasco has joined #openstack-keystone | 05:52 | |
| *** markvoelker has quit IRC | 05:53 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 05:55 | |
| *** eglute has joined #openstack-keystone | 05:55 | |
| *** _fortis_ has joined #openstack-keystone | 05:55 | |
| *** errr_ has joined #openstack-keystone | 05:57 | |
| *** shoutm has joined #openstack-keystone | 06:05 | |
| *** jamielennox|away has joined #openstack-keystone | 06:07 | |
| *** jamielennox|away is now known as jamielennox | 06:07 | |
| *** ChanServ sets mode: +v jamielennox | 06:07 | |
| *** _fortis_ is now known as _fortis | 06:07 | |
| *** jasonsb has quit IRC | 06:08 | |
| *** su_zhang has joined #openstack-keystone | 06:09 | |
| *** davechen1 is now known as davechen | 06:10 | |
| stevemar | notmorgan: why am i not seeing the trace logs :\ | 06:15 |
| *** roxanaghe has quit IRC | 06:23 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 06:36 |
| *** cloudnul- has joined #openstack-keystone | 06:39 | |
| *** Nakato_ has quit IRC | 06:40 | |
| *** chlong has quit IRC | 06:41 | |
| *** Nirupama has joined #openstack-keystone | 06:42 | |
| *** Nakato has joined #openstack-keystone | 06:42 | |
| *** shoutm has quit IRC | 06:43 | |
| *** chlong has joined #openstack-keystone | 06:46 | |
| *** jasonsb has joined #openstack-keystone | 06:47 | |
| *** cloudnul- is now known as cloudnull | 06:51 | |
| *** fpatwa_ has quit IRC | 06:52 | |
| *** EinstCrazy has joined #openstack-keystone | 06:56 | |
| openstackgerrit | Ren Qiaowei proposed openstack/keystone: Replace exit() by sys.exit() https://review.openstack.org/274519 | 06:58 |
| *** gildub has quit IRC | 07:01 | |
| *** Nirupama has quit IRC | 07:01 | |
| *** EinstCrazy has quit IRC | 07:03 | |
| *** jasonsb has quit IRC | 07:08 | |
| *** shoutm has joined #openstack-keystone | 07:16 | |
| *** shoutm has quit IRC | 07:18 | |
| *** richm has joined #openstack-keystone | 07:20 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Use extras for memcache, messaging and crypto dependencies https://review.openstack.org/274400 | 07:25 |
| *** jaosorior has joined #openstack-keystone | 07:26 | |
| *** jaosorior has quit IRC | 07:26 | |
| *** jaosorior has joined #openstack-keystone | 07:27 | |
| notmorgan | stevemar: did you enable Trace level in keystone? | 07:29 |
| notmorgan | stevemar: if you don't specifically set log levels to trace you wont see em | 07:30 |
| stevemar | notmorgan: probably not :O | 07:30 |
| stevemar | notmorgan: in the oslo.log setting? | 07:30 |
| notmorgan | stevemar: trace is < Debug | 07:30 |
| stevemar | notmorgan: yeah | 07:30 |
| notmorgan | so you'll need to set the logger levels to Trace then. | 07:30 |
| notmorgan | i also expect that trace logging to slow everything down massively | 07:30 |
| notmorgan | as trace logging is want to do | 07:30 |
| stevemar | notmorgan: i could have figured it out, just wanted to complain that there is no docs :P | 07:31 |
| notmorgan | docs are hard. | 07:31 |
| notmorgan | i have code to rip out/deprecate :P | 07:31 |
| stevemar | docs are fun! | 07:32 |
| stevemar | i have 4 people sending me emails about federation | 07:32 |
| * notmorgan lets stevemar write all the docs | 07:32 | |
| stevemar | one is even a follow up | 07:32 |
| * stevemar feels like replying with https://twitter.com/stevebot/status/667444931141718018 | 07:33 | |
| *** shoutm has joined #openstack-keystone | 07:34 | |
| notmorgan | stevemar: HTTP 402 | 07:35 |
| notmorgan | stevemar: so.. while i don't like that it's not IANA recognized... and IIS specific... https://en.wikipedia.org/wiki/HTTP_403#403_substatus_error_codes_for_IIS | 07:36 |
| notmorgan | stevemar: having something defined semi-like that would be nice for our errors where we can [not security issue] | 07:36 |
| stevemar | sub error codes? | 07:38 |
| notmorgan | just well defined error code that are included with the HTTP ones | 07:38 |
| * stevemar gives morgan a crazy look | 07:38 | |
| stevemar | okay that's different :P | 07:38 |
| stevemar | defined error codes are OK | 07:38 |
| notmorgan | it's IIS' way of doing that | 07:38 |
| stevemar | fictional http codes ... | 07:38 |
| stevemar | :) | 07:38 |
| notmorgan | and communicating it to the client | 07:39 |
| stevemar | i'm just teasing you, it's not terrible, but probably something that needs x-project approval | 07:41 |
| *** jaosorior has quit IRC | 07:41 | |
| notmorgan | or we just start defining our errors | 07:41 |
| stevemar | notmorgan: oh oh, liberty backports if you have a few minutes... https://review.openstack.org/#/q/project:openstack/keystone+branch:stable/liberty+status:open hoping to get that and ksm out early this week | 07:41 |
| notmorgan | ugh i can't get on corp VPN :( | 07:42 |
| stevemar | or i can bug dolph | 07:42 |
| * notmorgan glares at ubuntu... | 07:42 | |
| *** RA_ has quit IRC | 07:44 | |
| notmorgan | stevemar: translations? | 07:44 |
| notmorgan | i'd just single-core those | 07:44 |
| notmorgan | fwiw | 07:44 |
| notmorgan | stevemar: in fact... i try to always just single core those through | 07:44 |
| notmorgan | guess i missed the liberty ones | 07:44 |
| stevemar | notmorgan: yeah, wasn | 07:45 |
| stevemar | notmorgan: wasn't 100% on what the policy was for backporting translation | 07:45 |
| stevemar | looks like it's open season | 07:45 |
| notmorgan | have i mentioned what a trainwreck the new gerrit interface is? | 07:45 |
| notmorgan | stevemar: nah, zanata does that now for loiberty | 07:45 |
| notmorgan | was a deliberate choice iirc | 07:46 |
| *** chlong has quit IRC | 07:46 | |
| notmorgan | but meh, if the bot posted it we can always revert it. | 07:46 |
| notmorgan | if it was an individual posting it i'd have squashed it and said no | 07:46 |
| notmorgan | i hate our LDAP code.. | 07:48 |
| *** markvoelker has joined #openstack-keystone | 07:49 | |
| notmorgan | stevemar: i don't see a point to https://review.openstack.org/#/c/274140/1/keystone/tests/unit/test_validation.py | 07:50 |
| notmorgan | backporting just tests seems odd | 07:51 |
| stevemar | notmorgan: it has a dependent patch | 07:51 |
| stevemar | notmorgan: just easier to backport that one too, instead of all the conflicts | 07:51 |
| stevemar | notmorgan: the conflicts were ... problematic | 07:52 |
| stevemar | notmorgan: bknudson and i decided to just backport the patch that fixed up the tests | 07:52 |
| notmorgan | meh | 07:53 |
| notmorgan | ok | 07:53 |
| *** markvoelker has quit IRC | 07:54 | |
| stevemar | and now i need to sleep | 07:54 |
| stevemar | i'll get to this mountain of work tomorrow | 07:54 |
| *** belmoreira has joined #openstack-keystone | 07:55 | |
| *** sinese has joined #openstack-keystone | 08:09 | |
| *** gildub has joined #openstack-keystone | 08:09 | |
| *** mkoderer has quit IRC | 08:14 | |
| *** su_zhang has quit IRC | 08:23 | |
| *** rcernin has joined #openstack-keystone | 08:26 | |
| *** shoutm has quit IRC | 08:28 | |
| *** d0ugal_ has quit IRC | 08:30 | |
| *** d0ugal has joined #openstack-keystone | 08:30 | |
| *** Nirupama has joined #openstack-keystone | 08:31 | |
| *** richm has quit IRC | 08:51 | |
| *** richm has joined #openstack-keystone | 08:52 | |
| *** fpatwa has joined #openstack-keystone | 08:53 | |
| *** davechen has left #openstack-keystone | 08:56 | |
| *** fpatwa has quit IRC | 08:57 | |
| *** fhubik has joined #openstack-keystone | 08:59 | |
| *** fhubik has quit IRC | 09:08 | |
| *** richm has quit IRC | 09:20 | |
| *** jistr has joined #openstack-keystone | 09:20 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 09:23 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 09:24 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 09:25 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 09:26 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 09:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 09:27 |
| *** fhubik has joined #openstack-keystone | 09:35 | |
| *** richm has joined #openstack-keystone | 09:37 | |
| *** fhubik is now known as fhubik_brb | 09:41 | |
| *** fhubik_brb is now known as fhubik | 09:41 | |
| *** markvoelker has joined #openstack-keystone | 09:50 | |
| *** ramishra_ is now known as ramishra | 09:53 | |
| *** mhickey has joined #openstack-keystone | 09:53 | |
| *** markvoelker has quit IRC | 09:54 | |
| *** gpaz has joined #openstack-keystone | 09:56 | |
| *** shoutm has joined #openstack-keystone | 10:00 | |
| *** vgridnev has joined #openstack-keystone | 10:02 | |
| *** openstackgerrit has quit IRC | 10:02 | |
| *** openstackgerrit_ has joined #openstack-keystone | 10:02 | |
| *** openstackgerrit_ has quit IRC | 10:03 | |
| gpaz | Hi guys, I m working on a different project but I m seeing some strange behavior of keystone endpoint-list . I m installing Murano with puppet and as part of the installation Murano is registering as a service & endpoint on Keystone. I do see the record in the endpoint DB but column legacy_endpoint_id is NULL and as result when I m doing endpoint-list the endpoint not returned (Login with postman to OS do return the endpoin | 10:04 |
| *** EinstCrazy has joined #openstack-keystone | 10:04 | |
| *** richm has quit IRC | 10:06 | |
| *** mkoderer__ has joined #openstack-keystone | 10:21 | |
| *** daemontool_ has joined #openstack-keystone | 10:25 | |
| *** daemontool has quit IRC | 10:28 | |
| *** marekd has quit IRC | 10:34 | |
| *** gildub has quit IRC | 10:36 | |
| *** marekd has joined #openstack-keystone | 10:42 | |
| *** asimov.freenode.net sets mode: +v marekd | 10:42 | |
| *** fpatwa has joined #openstack-keystone | 10:54 | |
| *** fhubik is now known as fhubik_brb | 10:56 | |
| *** fpatwa has quit IRC | 10:59 | |
| *** fhubik_brb is now known as fhubik | 11:03 | |
| *** su_zhang has joined #openstack-keystone | 11:03 | |
| *** richm has joined #openstack-keystone | 11:07 | |
| *** su_zhang has quit IRC | 11:08 | |
| *** dims has joined #openstack-keystone | 11:09 | |
| *** mhickey has quit IRC | 11:15 | |
| *** davechen has joined #openstack-keystone | 11:15 | |
| *** lifeless_ is now known as lifeless | 11:17 | |
| *** RA_ has joined #openstack-keystone | 11:19 | |
| *** fhubik is now known as fhubik_brb | 11:21 | |
| *** davechen has quit IRC | 11:25 | |
| *** davechen has joined #openstack-keystone | 11:29 | |
| *** mhickey has joined #openstack-keystone | 11:30 | |
| *** mvk has quit IRC | 11:32 | |
| *** jaosorior has joined #openstack-keystone | 11:36 | |
| *** clenimar has joined #openstack-keystone | 11:37 | |
| *** mvk has joined #openstack-keystone | 11:49 | |
| *** john5223 has joined #openstack-keystone | 11:50 | |
| *** markvoelker has joined #openstack-keystone | 11:50 | |
| *** fpatwa has joined #openstack-keystone | 11:53 | |
| *** openstackgerrit has joined #openstack-keystone | 11:53 | |
| *** iurygregory has joined #openstack-keystone | 11:53 | |
| *** openstackgerrit has quit IRC | 11:54 | |
| *** openstackgerrit_ has joined #openstack-keystone | 11:54 | |
| *** openstackgerrit_ is now known as openstackgerrit | 11:55 | |
| *** markvoelker has quit IRC | 11:55 | |
| *** fpatwa has quit IRC | 11:55 | |
| *** davechen has quit IRC | 11:56 | |
| *** davechen has joined #openstack-keystone | 11:56 | |
| *** openstackgerrit has quit IRC | 11:59 | |
| *** davechen has left #openstack-keystone | 12:01 | |
| *** raildo-afk is now known as raildo | 12:05 | |
| *** openstackgerrit has joined #openstack-keystone | 12:07 | |
| *** pauloewerton has joined #openstack-keystone | 12:11 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:12 | |
| *** tellesnobrega has left #openstack-keystone | 12:13 | |
| *** rodrigods has quit IRC | 12:13 | |
| *** rodrigods has joined #openstack-keystone | 12:13 | |
| *** gordc has joined #openstack-keystone | 12:16 | |
| *** fpatwa has joined #openstack-keystone | 12:18 | |
| *** jaosorior has quit IRC | 12:21 | |
| *** jaosorior has joined #openstack-keystone | 12:21 | |
| *** fhubik_brb is now known as fhubik | 12:36 | |
| *** doug-fish has joined #openstack-keystone | 12:42 | |
| gpaz | someone can advise please ? | 12:43 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 12:51 |
| *** markvoelker has joined #openstack-keystone | 12:51 | |
| *** markvoelker has quit IRC | 12:56 | |
| *** Anticime1 is now known as Anticimex | 12:58 | |
| *** fpatwa has quit IRC | 13:00 | |
| *** jaosorior has quit IRC | 13:00 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 13:05 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 13:05 |
| *** dims has quit IRC | 13:06 | |
| *** dims has joined #openstack-keystone | 13:09 | |
| *** xek__ is now known as xek | 13:12 | |
| *** markvoelker has joined #openstack-keystone | 13:14 | |
| *** pauloewerton has quit IRC | 13:14 | |
| *** pauloewerton has joined #openstack-keystone | 13:15 | |
| *** edmondsw has joined #openstack-keystone | 13:15 | |
| *** fhubik is now known as fhubik_brb | 13:19 | |
| *** fhubik_brb is now known as fhubik | 13:21 | |
| *** fhubik has quit IRC | 13:21 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 13:23 |
| *** sinese has quit IRC | 13:29 | |
| *** sinese has joined #openstack-keystone | 13:31 | |
| *** mvk has quit IRC | 13:32 | |
| *** sinese has quit IRC | 13:37 | |
| *** sinese has joined #openstack-keystone | 13:37 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Raise more precise exception on keyword mapping errors https://review.openstack.org/175980 | 13:42 |
| *** ninag has joined #openstack-keystone | 13:44 | |
| *** mvk has joined #openstack-keystone | 13:46 | |
| *** su_zhang has joined #openstack-keystone | 13:51 | |
| *** bill_az has joined #openstack-keystone | 14:04 | |
| *** ayoung has joined #openstack-keystone | 14:06 | |
| *** ChanServ sets mode: +v ayoung | 14:06 | |
| ayoung | dstanek, notmorgan henrynash, can you +2 the Implied Role API please? I won't https://review.openstack.org/#/c/242614/ Its time. 73 revisions is quite a lot. | 14:08 |
| ayoung | Since Nov 6...3 months on this effort. | 14:09 |
| *** amakarov has joined #openstack-keystone | 14:12 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:17 | |
| marekd | stevemar: bknudson dstanek: so i am writing an db upgrade script where i would like to add a FK to an existing table that was added on earlier upgrade script. Right now I get an error: "sqlalchemy.exc.NoReferencedTableError: Foreign key associated with column 'service_providers_group_members.service_provider_id' could not find table 'service_provider' with which to generate a foreign key to | 14:17 |
| marekd | target column 'id' | 14:17 |
| marekd | " | 14:17 |
| *** fawadkhaliq has quit IRC | 14:18 | |
| marekd | any idea on how to make my migration script aware of that table? | 14:18 |
| bknudson | what database are you using? mysql? | 14:18 |
| *** fawadkhaliq has joined #openstack-keystone | 14:20 | |
| amakarov | stevemar, ayoung: hi! I'm about to submit a summit presentation as a preview to unified delegations. Is there any, or somebody may be willing to join? | 14:20 |
| marekd | uh, 20 minutes of code search, a question to you and 5 secs later i found it | 14:21 |
| marekd | sp_table = sql.Table('service_provider', meta, autoload=True) <--- something like that will be enough | 14:21 |
| *** Nirupama has quit IRC | 14:28 | |
| *** jsavak has joined #openstack-keystone | 14:31 | |
| *** Ephur has joined #openstack-keystone | 14:34 | |
| *** Ephur has quit IRC | 14:34 | |
| *** Ephur has joined #openstack-keystone | 14:36 | |
| *** RA_ has quit IRC | 14:40 | |
| *** Ephur has quit IRC | 14:41 | |
| *** AJaeger has joined #openstack-keystone | 14:44 | |
| AJaeger | notmorgan: are you around to discuss https://review.openstack.org/270370 ? | 14:45 |
| AJaeger | Is there any keystoneclient core that can review and approve https://review.openstack.org/#/c/273510/ , please? This is part of a translation setup consolidation | 14:46 |
| *** daemontool has joined #openstack-keystone | 14:47 | |
| *** daemontool_ has quit IRC | 14:47 | |
| *** daemontool has quit IRC | 14:53 | |
| *** csoukup_ has quit IRC | 14:53 | |
| ayoung | amakarov, I'd be happy to join | 14:54 |
| ayoung | amakarov, I think today is the deadline, so make it fast. I have an account there already | 14:54 |
| notmorgan | AJaeger: hey | 14:54 |
| amakarov | ayoung, already doing ) | 14:54 |
| *** mvk has quit IRC | 14:55 | |
| ayoung | amakarov, cool. That will be great to have | 14:55 |
| notmorgan | AJaeger: yea happy to approve that | 14:55 |
| AJaeger | hey, notmorgan. could you reconsider your -1, please? We're not gating on argparse anymore and python 2.6 has been removed from that repository already some time ago | 14:55 |
| amakarov | ayoung, what's you email there? | 14:55 |
| AJaeger | notmorgan: 270370 or 273510 - or both? ;) | 14:56 |
| notmorgan | AJaeger: the argparse one was a soft -1 | 14:56 |
| *** fpatwa has joined #openstack-keystone | 14:56 | |
| notmorgan | AJaeger: and i am ok with that going through | 14:56 |
| ayoung | amakarov, ayoung@redhat.com | 14:56 |
| notmorgan | the other one is easy | 14:56 |
| amakarov | ayoung, ack | 14:56 |
| AJaeger | thanks, notmorgan ! | 14:56 |
| ayoung | amakarov, https://www.openstack.org/summit/austin-2016/call-for-speakers/manage/6873/speakers | 14:56 |
| notmorgan | AJaeger: done and sone | 14:57 |
| AJaeger | thanks, notmorgan | 14:58 |
| *** KarthikB has joined #openstack-keystone | 14:58 | |
| ayoung | amakarov, I need to plus up that submission on "Why we are killing the PKI token format" if I want it seriously considered. | 14:58 |
| ayoung | I might just drop that if you are putting in a better one on RBAC | 14:59 |
| ayoung | er...unified delegation. | 14:59 |
| * notmorgan is actually fairly happy to not have any pending talks this time around [again] | 14:59 | |
| *** daemontool has joined #openstack-keystone | 14:59 | |
| *** rderose has joined #openstack-keystone | 14:59 | |
| amakarov | ayoung, I soppose the talk description will be editable for some time :) | 15:00 |
| ayoung | amakarov, send me a link when you have it in, and I can provide some feedback | 15:00 |
| notmorgan | omg | 15:06 |
| notmorgan | nova now uses ksa not ksc!! | 15:06 |
| notmorgan | finally bloody landed | 15:06 |
| * notmorgan is happy! | 15:06 | |
| *** mvk has joined #openstack-keystone | 15:07 | |
| *** shoutm has quit IRC | 15:08 | |
| *** KarthikB has quit IRC | 15:08 | |
| amakarov | ayoung, https://www.openstack.org/summit/austin-2016/call-for-speakers/manage/8201/ | 15:08 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:09 | |
| amakarov | ayoung, can you see it? | 15:09 |
| amakarov | Link should be working, and I haven't submitted it yet | 15:09 |
| *** ChanServ sets mode: +o dolphm | 15:10 | |
| ayoung | amakarov, "You can't edit this presentation" so it is there but I can't see it | 15:10 |
| ayoung | amakarov, submit it, and there will be an option to edit the speakres list | 15:11 |
| amakarov | ayoung, right: I see the same for yours | 15:11 |
| ayoung | you can then continue to edit the presentation up until the end of the day today (I assume) | 15:11 |
| amakarov | I've already added you | 15:11 |
| amakarov | ayoung, https://etherpad.openstack.org/p/unified-delegation-austin-presentation | 15:16 |
| *** woodster_ has joined #openstack-keystone | 15:16 | |
| amakarov | ayoung, let's do it this way ) | 15:16 |
| *** alejandrito has joined #openstack-keystone | 15:17 | |
| ayoung | amakarov, focus on getting the presentation submitted on the link. THere are a lot of fields there now | 15:18 |
| amakarov | ayoung, it says an email is sent to you | 15:19 |
| ayoung | amakarov, looking | 15:19 |
| amakarov | ayoung, well, it's still editable | 15:19 |
| lbragstad | notmorgan ping | 15:22 |
| lbragstad | notmorgan wondering you if you could double check something for me? | 15:22 |
| *** slberger has joined #openstack-keystone | 15:24 | |
| *** AJaeger has left #openstack-keystone | 15:24 | |
| *** links has quit IRC | 15:24 | |
| ayoung | amakarov, I made some quick changes, take a look. I need to head to the city for a meeting, but I'll check back in in a few. | 15:26 |
| amakarov | ayoung, got it | 15:26 |
| *** csoukup_ has joined #openstack-keystone | 15:28 | |
| *** timcline has joined #openstack-keystone | 15:28 | |
| *** jorge_munoz has joined #openstack-keystone | 15:29 | |
| *** ayoung has quit IRC | 15:30 | |
| *** fpatwa has quit IRC | 15:32 | |
| *** richm has quit IRC | 15:33 | |
| *** fpatwa_ has joined #openstack-keystone | 15:34 | |
| dolphm | ooh, at some point testr grew an --until-failure option, to loop the test suite until you trigger a transient failure | 15:37 |
| notmorgan | lbragstad: yeah | 15:41 |
| notmorgan | lbragstad: what ya need? | 15:42 |
| lbragstad | token provider stuff | 15:43 |
| lbragstad | notmorgan so - i'm tracing the call paths for both v2 and v3 validate token | 15:43 |
| notmorgan | lbragstad: and? | 15:44 |
| notmorgan | besides the insanity that we've slooooowly been cleaning up | 15:44 |
| lbragstad | v2 validate starts in keystone/token/routers.py -> keystone/token/controllers.py:validate_token() -> keystone/token/provider.py:validate_v2_token() | 15:44 |
| lbragstad | yeah | 15:45 |
| lbragstad | and then v3 goes like: | 15:45 |
| lbragstad | keystone/auth/routers.py -> keystone/auth/controllers.py:validate_token() -> keystone/token/provider.py:validate_v3_token() | 15:46 |
| dolphm | mgagne_: would love to hear your feedback on https://review.openstack.org/#/c/272007/ - it should eliminate *all* redundant sql queries | 15:46 |
| lbragstad | so, from a v2 and v3 validate token path, it doens't look like https://github.com/openstack/keystone/blob/c5ed8bd81e776746c7ea2d0df6c8b40409097706/keystone/token/provider.py#L204-L211 is used at all? | 15:47 |
| notmorgan | dolphm: not on list queries and only things we currently cache (not 100% coverage) | 15:47 |
| notmorgan | mgagne_: ^ cc | 15:47 |
| notmorgan | lbragstad: looking | 15:47 |
| lbragstad | ^ that method looks like it's only purpose it to be able to pass a uuid token to it - and it will validate it regardless of it being v2 or v3 format | 15:48 |
| dolphm | notmorgan: with the exception of service providers, we should never list things more than once though, ever... right? | 15:48 |
| notmorgan | dolphm: i would hope so, it should be list from an end user request | 15:48 |
| dolphm | and service providers is an exception because the federation code just does something wonky trying to populate the token | 15:48 |
| notmorgan | also... i have a patch proposed to dogpile.cache that will allow us to cache with kwargs | 15:48 |
| notmorgan | vs always positional... which will let us cleanup stuff/make it easier. | 15:49 |
| dolphm | notmorgan: you also mispelled requst in the commit summary *shrug* | 15:49 |
| notmorgan | dolphm: lol. typo =/ | 15:49 |
| *** mgarza_ has joined #openstack-keystone | 15:49 | |
| notmorgan | lbragstad: so... let me check this is where i start needing to do grep. because ... ugh | 15:49 |
| lbragstad | notmorgan yeah - i had to whiteboard it :-/ | 15:50 |
| notmorgan | oh i need to stash these changes.. have a change that is 90% done to deprecate admin_token_auth | 15:50 |
| dolphm | notmorgan: i'm also considering this for backporting to stable/liberty -- it does not apply cleanly, and you've got a Depends-On which does not seem critical (more like a related change-id ?) | 15:50 |
| *** richm has joined #openstack-keystone | 15:51 | |
| lbragstad | I *think* I have an idea of what's going on - it looks like self.token_provider_api.validate_token() was introduced to replace the validate_v3_token and validate_v2_token stuff | 15:51 |
| dolphm | notmorgan: otherwise, i can't think of a reason not to backport. thoughts? | 15:51 |
| notmorgan | dolphm: it wont apply cleanly, but it is possible to backport | 15:51 |
| notmorgan | dolphm: and the dependson was specifically to ensure testing was against a full cache stack | 15:51 |
| notmorgan | memcache both endpoints and in keystone | 15:52 |
| notmorgan | so it can be dropped for backport purposes | 15:52 |
| dolphm | notmorgan: but it's totally useful without the devstack patch | 15:52 |
| dolphm | in prod | 15:52 |
| dolphm | notmorgan: worth putting a comment in the backported commit message about why the Depends-On was dropped | 15:52 |
| *** daemontool_ has joined #openstack-keystone | 15:52 | |
| notmorgan | dolphm: it is. this was because i had 3 variations going | 15:53 |
| notmorgan | the dependson could have been dropped anyway | 15:53 |
| notmorgan | lbragstad: ok still chasing this... wow... i can't wait for this to be cleaned up | 15:54 |
| *** daemontool has quit IRC | 15:54 | |
| lbragstad | notmorgan yeah | 15:54 |
| lbragstad | notmorgan i think we can get there soon though | 15:54 |
| notmorgan | lbragstad: uh | 15:55 |
| notmorgan | lbragstad: looks like it's used in the auth plugin | 15:55 |
| lbragstad | notmorgan exactly - that and in the federated controller | 15:55 |
| *** Ephur has joined #openstack-keystone | 15:55 | |
| notmorgan | yep | 15:55 |
| notmorgan | and mapped auth plugin | 15:55 |
| lbragstad | the federated controller should just use self.token_provider_api.validate_v3_token() | 15:56 |
| lbragstad | right? | 15:56 |
| lbragstad | or... | 15:56 |
| *** browne has joined #openstack-keystone | 15:56 | |
| notmorgan | _build_policy_check_credentials in keystone.common.controller | 15:56 |
| notmorgan | keystone.contrib.user_crud.core.UserController.set_user_password | 15:56 |
| lbragstad | notmorgan the issue with that design and fernet is that token_provider_api.validate_token relies on the fact the token is persisted somewhere | 15:57 |
| notmorgan | federation controller | 15:57 |
| notmorgan | lbragstad: right. | 15:57 |
| lbragstad | notmorgan so - could we add a kwarg to that method? | 15:57 |
| notmorgan | what would the kwarg do? | 15:57 |
| lbragstad | token_provider_api.validate_token(version=None) | 15:57 |
| lbragstad | where we can pass in V2 or V3? | 15:57 |
| lbragstad | from all of these different places? | 15:58 |
| notmorgan | well federation is easy, move it to always use the v3 version | 15:58 |
| *** rcernin has quit IRC | 15:58 | |
| lbragstad | notmorgan wasn't the goal of token_provider_api.validate_token() to remove calling validate_v*_token directly? | 15:58 |
| lbragstad | that way we only end up with a since validate_token call? | 15:59 |
| notmorgan | lbragstad: originally i think so. | 15:59 |
| lbragstad | notmorgan ah | 15:59 |
| notmorgan | lbragstad: but adding kwargs feels like a dodge | 15:59 |
| lbragstad | notmorgan yeah | 15:59 |
| lbragstad | notmorgan do you think we'll always have a dodge as long as we support v2 token types? | 15:59 |
| *** richm has quit IRC | 15:59 | |
| notmorgan | trying to think what the fall out of adding a kwarg ends up being | 16:00 |
| notmorgan | i really want to avoid encoding a "use X version of the token" | 16:00 |
| lbragstad | true | 16:00 |
| notmorgan | so, lets step back | 16:00 |
| notmorgan | internally we don't care what the token version is | 16:00 |
| notmorgan | so lets always validate to v3 - and in the specific cases we need to, we have a v3->v2 method, we can translate. | 16:02 |
| *** jsavak has quit IRC | 16:02 | |
| lbragstad | notmorgan so - change everything to use token_provider_api.validate_v3_token? | 16:02 |
| notmorgan | the controller is in charge of "rendering" | 16:02 |
| *** ninag has quit IRC | 16:02 | |
| *** jsavak has joined #openstack-keystone | 16:03 | |
| *** ninag has joined #openstack-keystone | 16:03 | |
| notmorgan | or just make .validate always use v3 and stop using .validate_vX_token | 16:03 |
| *** fawadkhaliq has quit IRC | 16:03 | |
| notmorgan | .validate is in charge of collecting the raw token data, controller is in charge of rendering | 16:03 |
| lbragstad | so - token_provider_api.validate_token is just a wrapper for validate_v3_token | 16:03 |
| notmorgan | basically | 16:03 |
| lbragstad | hmm ok | 16:04 |
| notmorgan | and we make the validate_v2_token do validate_v3 + translate | 16:04 |
| notmorgan | and deprecate it | 16:04 |
| notmorgan | long term: validate to a plain data format and then "render" to the version | 16:05 |
| lbragstad | ok | 16:05 |
| *** ninag has quit IRC | 16:05 | |
| lbragstad | now i'm wondering if this needs to be done before the rest of the fernet consolidation? | 16:05 |
| *** ninag has joined #openstack-keystone | 16:06 | |
| notmorgan | i'd consolidate and call the .validate_VX methods | 16:06 |
| notmorgan | then continue with the cleanup | 16:06 |
| notmorgan | move to fernet is more important than internal cleanup that we've been living with | 16:06 |
| lbragstad | ok | 16:06 |
| notmorgan | restructuring code and how we handle tokens internally is going to be more work and conflict with lots of things | 16:07 |
| *** vgridnev has quit IRC | 16:07 | |
| notmorgan | lbragstad: be sure to put some TODOs and NOTEs in when you change it over | 16:08 |
| tpeoples | I have a service that is trying to instantiate a number of clients (nova, neutron, keystone, etc.). I was trying to use keystoneauth1.loading to load a session from my service's keystone_auth CONF group, but keep running into duplicate opt errors. Should I instead be using keystoneclient's auth / session libraries? | 16:08 |
| openstackgerrit | Merged openstack/keystoneauth: Remove argparse from requirements https://review.openstack.org/270370 | 16:08 |
| lbragstad | notmorgan will do | 16:08 |
| lbragstad | notmorgan the consolidation of v2 token validate is the only patch not passing | 16:09 |
| notmorgan | lbragstad: cool. | 16:09 |
| lbragstad | consolidation of validate v3 and issue v2 are passing | 16:09 |
| lbragstad | and ready for review | 16:09 |
| *** belmoreira has quit IRC | 16:10 | |
| *** sinese has quit IRC | 16:11 | |
| *** alexvictorchan has quit IRC | 16:12 | |
| *** henrynash has quit IRC | 16:14 | |
| *** richm has joined #openstack-keystone | 16:16 | |
| *** esp has quit IRC | 16:16 | |
| *** samueldmq has quit IRC | 16:18 | |
| *** anteaya has quit IRC | 16:18 | |
| dolphm | nonameentername: if you're not working on a revision to the totp spec at the moment, i'd be happy to address the outstanding concerns https://review.openstack.org/#/c/130376/ | 16:24 |
| *** diazjf has joined #openstack-keystone | 16:25 | |
| *** mvk has quit IRC | 16:26 | |
| *** diazjf has quit IRC | 16:30 | |
| *** jistr has quit IRC | 16:33 | |
| *** diazjf has joined #openstack-keystone | 16:34 | |
| openstackgerrit | Dolph Mathews proposed openstack/pycadf: Add docstring validation https://review.openstack.org/230257 | 16:36 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:39 | |
| *** rcernin has joined #openstack-keystone | 16:40 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:41 | |
| *** daemontool has joined #openstack-keystone | 16:42 | |
| *** pushkaru has joined #openstack-keystone | 16:42 | |
| *** daemontool_ has quit IRC | 16:44 | |
| *** mhickey has quit IRC | 16:45 | |
| *** fpatwa_ has quit IRC | 16:46 | |
| *** henrynash has joined #openstack-keystone | 16:53 | |
| *** ChanServ sets mode: +v henrynash | 16:53 | |
| stevemar | dolphm: please do | 16:54 |
| *** alexvictorchan has joined #openstack-keystone | 16:55 | |
| *** jasonsb has joined #openstack-keystone | 16:57 | |
| dolphm | stevemar: just wanted to make sure i'm not doing work in parallel with him | 16:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Test revocation race conditions https://review.openstack.org/227995 | 16:59 |
| stevemar | dolphm: ack | 16:59 |
| dolphm | lbragstad: notmorgan: do we still need / want this after last week? https://review.openstack.org/#/c/227995/ | 16:59 |
| *** EinstCrazy has quit IRC | 16:59 | |
| lbragstad | dolphm that and https://review.openstack.org/#/c/243742/ | 17:00 |
| dolphm | lbragstad: so, yes? | 17:00 |
| stevemar | dolphm: in my mind, the other spec directories should be for things like: removing CLI support, adding a new middleware, not just adding support to our server side bits | 17:00 |
| dolphm | stevemar: fair enough - but it doesn't seem like anyone knows where the line is | 17:01 |
| lbragstad | dolphm I think both of those are conditional based on notmorgan's discussion with mtreinish | 17:01 |
| stevemar | dolphm: yeah, i'll admit it isn't clear | 17:02 |
| notmorgan | and mtreinish is at LCA | 17:02 |
| *** diazjf has quit IRC | 17:02 | |
| *** rcernin has quit IRC | 17:02 | |
| *** richm has quit IRC | 17:02 | |
| lbragstad | notmorgan so - he's about 17 hours ahead of me and 15 hours ahead of you | 17:03 |
| notmorgan | yeah | 17:03 |
| *** diazjf has joined #openstack-keystone | 17:03 | |
| openstackgerrit | Merged openstack/keystone: Raise more precise exception on keyword mapping errors https://review.openstack.org/175980 | 17:03 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 17:04 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 17:04 |
| *** EinstCrazy has joined #openstack-keystone | 17:04 | |
| lbragstad | notmorgan so maybe at 2 - 3 your time he will be on | 17:05 |
| lbragstad | 2 - 3 pm | 17:05 |
| *** vgridnev has joined #openstack-keystone | 17:05 | |
| *** browne has quit IRC | 17:10 | |
| *** jgriffith_away is now known as jgriffith | 17:16 | |
| *** su_zhang has quit IRC | 17:16 | |
| *** gyee has joined #openstack-keystone | 17:17 | |
| *** ChanServ sets mode: +v gyee | 17:17 | |
| *** richm has joined #openstack-keystone | 17:19 | |
| *** _cjones_ has joined #openstack-keystone | 17:20 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 17:25 |
| dolphm | lbragstad: nonameentername: stevemar: ^ | 17:27 |
| dolphm | added a new paragraph to the problem description to better illustrate the spec vs the new MFA spec, but otherwise it's just small fixes as requested | 17:27 |
| *** diazjf has quit IRC | 17:28 | |
| *** mgagne_ has quit IRC | 17:32 | |
| *** mgagne_ has joined #openstack-keystone | 17:32 | |
| *** diazjf has joined #openstack-keystone | 17:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:33 |
| *** sinese has joined #openstack-keystone | 17:33 | |
| *** mgagne_ is now known as mgagne | 17:34 | |
| lbragstad | dolphm spec failed tests - one line was too long | 17:36 |
| *** Guest70118 is now known as tsymanczyk | 17:37 | |
| *** diazjf has quit IRC | 17:37 | |
| *** itlinux has joined #openstack-keystone | 17:46 | |
| *** diazjf has joined #openstack-keystone | 17:51 | |
| *** jgriffith is now known as jgriffith_away | 17:51 | |
| gyee | mordred, notmorgan, when will be expecting a os-client-config release now that the domain-scoped token issue is fixed? | 17:52 |
| *** esp has joined #openstack-keystone | 17:58 | |
| *** ninag has quit IRC | 17:59 | |
| *** ninag has joined #openstack-keystone | 17:59 | |
| *** browne has joined #openstack-keystone | 18:00 | |
| *** ninag_ has joined #openstack-keystone | 18:01 | |
| *** ninag has quit IRC | 18:04 | |
| *** jaosorior has joined #openstack-keystone | 18:05 | |
| *** esp has quit IRC | 18:05 | |
| *** ninag_ has quit IRC | 18:09 | |
| *** jasonsb has quit IRC | 18:09 | |
| *** ninag has joined #openstack-keystone | 18:09 | |
| *** ninag has quit IRC | 18:10 | |
| *** ninag has joined #openstack-keystone | 18:10 | |
| *** ninag has quit IRC | 18:10 | |
| *** ninag has joined #openstack-keystone | 18:11 | |
| *** richm has quit IRC | 18:11 | |
| *** esp has joined #openstack-keystone | 18:11 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 18:12 |
| dolphm | lbragstad: fixeded ^ | 18:12 |
| lbragstad | dolphm awesome - thanks | 18:13 |
| lbragstad | dolphm nonameentername +2 my comments were addressed. | 18:13 |
| *** ninag has quit IRC | 18:15 | |
| *** esp has quit IRC | 18:15 | |
| *** thebloggu has joined #openstack-keystone | 18:16 | |
| *** roxanaghe has joined #openstack-keystone | 18:19 | |
| *** shaleh has joined #openstack-keystone | 18:20 | |
| *** ebalduf has joined #openstack-keystone | 18:20 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 18:21 |
| *** dims_ has joined #openstack-keystone | 18:21 | |
| *** dims has quit IRC | 18:22 | |
| openstackgerrit | Merged openstack/keystone-specs: Time-based One-time Password https://review.openstack.org/130376 | 18:23 |
| *** jistr has joined #openstack-keystone | 18:23 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone-specs: Fix cascade operations documentation https://review.openstack.org/274836 | 18:24 |
| lbragstad | notmorgan still working through the consolidation stuff - we seem to support trusts on v2 with uuid, but we don't support v2 trusts with fernet - https://github.com/openstack/keystone/blob/836dbfca4200a1573c722809710cd7f0fa13f2d7/keystone/token/providers/fernet/core.py#L215-L218 | 18:25 |
| lbragstad | notmorgan thoughts/ | 18:25 |
| lbragstad | can we just kill v2 trusts all together? | 18:25 |
| notmorgan | lbragstad: v2 had trusts? | 18:26 |
| raildo | lbragstad: ++ | 18:26 |
| dolphm | lbragstad: what happens if you drop support? (gate failures or anything?) | 18:26 |
| dolphm | "support" | 18:26 |
| notmorgan | dolphm: ++ that is the way i'd look at it | 18:26 |
| notmorgan | let me check something | 18:26 |
| lbragstad | notmorgan dolphm raildo I assume so - because : https://github.com/openstack/keystone/blob/836dbfca4200a1573c722809710cd7f0fa13f2d7/keystone/token/providers/common.py#L63-L70 | 18:27 |
| notmorgan | we don't have APIs for trusts | 18:27 |
| notmorgan | in v2 | 18:27 |
| notmorgan | fwiw | 18:27 |
| lbragstad | in that method we actually *convert* from v3 trust to a v2 trust... | 18:27 |
| notmorgan | right but it's an auth-only thing | 18:27 |
| lbragstad | i've removed that logic and replaced it with an unauthorized exception - running tests now | 18:27 |
| dolphm | lbragstad: propose a delete and see what happens | 18:27 |
| notmorgan | lbragstad: sure | 18:28 |
| lbragstad | notmorgan what do you mean "auth-only" | 18:28 |
| notmorgan | dolphm: do we always provide a www-authenticate [or whatever it is?] when we 401? | 18:28 |
| notmorgan | cause.... | 18:28 |
| notmorgan | lbragstad: you cannot make a trust via V2 | 18:28 |
| lbragstad | true | 18:28 |
| notmorgan | you can only make them in v3, you might have a trust scope during auth | 18:29 |
| openstackgerrit | Henrique Truta proposed openstack/python-keystoneclient: Adds is_domain field in create project https://review.openstack.org/239832 | 18:29 |
| notmorgan | but i am unsure how [or if it would work] | 18:29 |
| *** spandhe has joined #openstack-keystone | 18:29 | |
| *** su_zhang has joined #openstack-keystone | 18:30 | |
| *** thebloggu has quit IRC | 18:31 | |
| notmorgan | dolphm: https://bitbucket.org/zzzeek/dogpile.cache/pull-requests/46/add-a-key-word-arg-aware-cache-key/diff kwarg enabled keygenerator for dogpile not sure if we need/want this. | 18:31 |
| notmorgan | dolphm: or if it would make keystone easier. | 18:32 |
| raildo | lbragstad: notmorgan we consume this trust information on the v2 token https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L148 | 18:32 |
| dolphm | notmorgan: www-authenticate only comes from auth_token afaik | 18:32 |
| dolphm | on 401 | 18:32 |
| notmorgan | dolphm: right. we might need to revisit that in keystone too | 18:32 |
| *** doug-fish has quit IRC | 18:32 | |
| lbragstad | raildo hmm | 18:33 |
| notmorgan | to be "correct". | 18:33 |
| notmorgan | raildo: in authenticate possibly | 18:33 |
| dstanek | notmorgan: that would make it so that we don't have to for code not to use kwargs | 18:33 |
| raildo | notmorgan: yes | 18:33 |
| notmorgan | dstanek: yeah. eyes on that would be nice. i can pull it to oslo.cache, but will need to chat w/ zzzeek on if it's appropriate for dogpile.cache | 18:34 |
| notmorgan | dstanek: there are questions on how much we want in dogpile.cache vs being more of just a pattern of use. vs lots of dispirate backends etc | 18:34 |
| *** jsavak has quit IRC | 18:35 | |
| *** jsavak has joined #openstack-keystone | 18:35 | |
| notmorgan | dstanek: so it would be easy to add it to oslo.cache | 18:36 |
| *** doug-fish has joined #openstack-keystone | 18:36 | |
| notmorgan | dstanek: but it has a lot of overhead compared to the normal keygen | 18:37 |
| dstanek | notmorgan: i'll go through it in more detail a little later. i have a *long* meeting soon | 18:37 |
| notmorgan | dstanek: hah. | 18:37 |
| notmorgan | dstanek: good luck on the long meeting | 18:38 |
| *** doug-fis_ has joined #openstack-keystone | 18:40 | |
| *** doug-fish has quit IRC | 18:41 | |
| *** doug-fis_ has quit IRC | 18:41 | |
| *** doug-fish has joined #openstack-keystone | 18:41 | |
| *** jaosorior has quit IRC | 18:41 | |
| *** timcline has quit IRC | 18:44 | |
| *** timcline has joined #openstack-keystone | 18:45 | |
| *** doug-fish has quit IRC | 18:45 | |
| *** fpatwa has joined #openstack-keystone | 18:46 | |
| *** jgriffith_away is now known as jgriffith | 18:48 | |
| *** edmondsw has quit IRC | 18:49 | |
| *** esp has joined #openstack-keystone | 18:50 | |
| *** jistr has quit IRC | 18:51 | |
| *** fpatwa has quit IRC | 18:51 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust redelegation tests https://review.openstack.org/273232 | 18:55 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Add tests for trust using impersonation https://review.openstack.org/273279 | 18:55 |
| *** rderose has quit IRC | 18:57 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 18:58 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove validate_v2_token from Fernet provider https://review.openstack.org/274852 | 18:58 |
| *** richm has joined #openstack-keystone | 18:59 | |
| lbragstad | notmorgan dolphm ^ | 18:59 |
| notmorgan | lbragstad: cool | 18:59 |
| notmorgan | lets see how it shakes out | 18:59 |
| lbragstad | that passes locally for me | 18:59 |
| *** jgriffith is now known as jgriffith_away | 19:00 | |
| *** doug-fish has joined #openstack-keystone | 19:01 | |
| *** su_zhang has quit IRC | 19:01 | |
| *** jbell8 has joined #openstack-keystone | 19:01 | |
| *** su_zhang has joined #openstack-keystone | 19:01 | |
| *** richm has quit IRC | 19:03 | |
| *** doug-fis_ has joined #openstack-keystone | 19:04 | |
| *** ninag has joined #openstack-keystone | 19:04 | |
| *** doug-fis_ has quit IRC | 19:04 | |
| *** doug-fis_ has joined #openstack-keystone | 19:04 | |
| *** doug-fish has quit IRC | 19:05 | |
| *** ninag has quit IRC | 19:06 | |
| *** ninag has joined #openstack-keystone | 19:06 | |
| notmorgan | cool | 19:09 |
| notmorgan | lbragstad, dolphm, stevemar: your eyes on https://bitbucket.org/zzzeek/dogpile.cache/pull-requests/46/add-a-key-word-arg-aware-cache-key/diff would be super helpful too. | 19:10 |
| notmorgan | i really want to make sure i didn't make a stupid assumption. | 19:10 |
| *** browne has quit IRC | 19:14 | |
| *** su_zhang has quit IRC | 19:19 | |
| *** su_zhang has joined #openstack-keystone | 19:19 | |
| *** marekd has quit IRC | 19:21 | |
| *** browne has joined #openstack-keystone | 19:22 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Add subjectAltName to generated ssl cert https://review.openstack.org/154074 | 19:23 |
| shaleh | dstanek: ^^ that is what we were talking about on Friday | 19:24 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 19:29 |
| shaleh | stevemar: I asked dstanek before I made that commit. He thought it was being used for devstack / developer stuff. Is this no longer the case? | 19:31 |
| shaleh | stevemar: I am fine if the code is dead. But the bugs were not updated to reflect this either. | 19:32 |
| *** marekd has joined #openstack-keystone | 19:32 | |
| *** asimov.freenode.net sets mode: +v marekd | 19:32 | |
| *** edmondsw has joined #openstack-keystone | 19:33 | |
| *** ebalduf has quit IRC | 19:33 | |
| *** jbell8 has quit IRC | 19:33 | |
| notmorgan | stevemar: haha i -1'd the same thing with roughtly the same question | 19:33 |
| *** jbell8 has joined #openstack-keystone | 19:34 | |
| *** jsavak has quit IRC | 19:35 | |
| *** jbell8 has quit IRC | 19:35 | |
| *** jsavak has joined #openstack-keystone | 19:35 | |
| *** srini_ has joined #openstack-keystone | 19:37 | |
| shaleh | good to see Bug Friday continues to be a waste of time | 19:37 |
| *** jbell8 has joined #openstack-keystone | 19:37 | |
| *** diazjf has quit IRC | 19:38 | |
| notmorgan | shaleh: the PKI bit is the only bit i'm worried about, the addition to the SSL block if we are continuing to use it would be good. | 19:38 |
| shaleh | most tickets I look at after some amount of investigation turn out to be either dead or using abandoned stuff somewhere | 19:39 |
| shaleh | notmorgan: well, stevemar removed all exercise of the SSL bits and the SSL in his patch. What are we still using the PKI bits for now that PKI token is also dead? | 19:40 |
| notmorgan | shaleh: PKI tokens are deprecated with "we're ditching this down the line" because fernet is the direction we're going | 19:40 |
| notmorgan | shaleh: like i said, happy to continue with the SSL stuff if it makes sense / continues to be useful [i'll defer on that] | 19:41 |
| notmorgan | shaleh: and the altnames makes a lot of sense on that front | 19:41 |
| shaleh | notmorgan: but if this code only exists for eventlet and pki tokens it appears to be the last polar bear on an ice flow | 19:41 |
| notmorgan | shaleh: ah right that is veyr mcuh eventlet | 19:42 |
| notmorgan | derp | 19:42 |
| notmorgan | sorry i'm elbow deep in looking at dogpile stuff/discussing bits for that | 19:42 |
| shaleh | notmorgan: no worries | 19:42 |
| notmorgan | getting the fixes we need for dogpile lined up upstream | 19:42 |
| *** henrynash has quit IRC | 19:43 | |
| shaleh | oh well, I learned that using the cryptography package to parse x509 certs is pretty trivial. caveat the usual x509 boneheadedness that is always there and has nothing to do with Python | 19:46 |
| *** ninag has quit IRC | 19:48 | |
| *** amakarov has quit IRC | 19:48 | |
| *** jbell8 has quit IRC | 19:48 | |
| *** jbell8 has joined #openstack-keystone | 19:48 | |
| *** srini_ has quit IRC | 19:51 | |
| notmorgan | shaleh: yep | 19:51 |
| notmorgan | shaleh: sadly | 19:51 |
| shaleh | What are the steps to take over the review so I can abandon it? Since I was updating an existing one I do not have the option to abandon currently. | 19:52 |
| *** diazjf has joined #openstack-keystone | 19:52 | |
| notmorgan | shaleh: ask a core to do it | 19:54 |
| notmorgan | you can't "take over" a review | 19:55 |
| notmorgan | the owner is always the same | 19:55 |
| notmorgan | happy to abandon it if you want | 19:55 |
| shaleh | notmorgan: If the consensus is it is a polar bear, no sense wasting people's time on it | 19:55 |
| notmorgan | shaleh: i can always restore it | 19:55 |
| notmorgan | so if you're content for an abandon - i'll do that now and then we restore it if needed | 19:56 |
| shaleh | notmorgan: someone also needs to deal with the bug that led to the patch | 19:56 |
| shaleh | notmorgan: abandon it | 19:56 |
| *** jgriffith_away is now known as jgriffith | 19:56 | |
| notmorgan | i'll poke the bug too | 19:56 |
| stevemar | sorry - on a call :[ | 19:56 |
| *** jsavak has quit IRC | 19:59 | |
| *** jsavak has joined #openstack-keystone | 20:00 | |
| *** maxabidi has joined #openstack-keystone | 20:00 | |
| notmorgan | shaleh: done and bug closed | 20:00 |
| shaleh | notmorgan: thanks | 20:00 |
| *** ninag has joined #openstack-keystone | 20:01 | |
| shaleh | well, I closed the bug...... | 20:01 |
| shaleh | take one down, pass it around, 101 bugs on the wall | 20:01 |
| notmorgan | i did a massive pass on bug closing a cycle or so ago | 20:01 |
| notmorgan | i might block off a week or two and do the same thing again. | 20:01 |
| notmorgan | anyway... | 20:02 |
| notmorgan | i need to book a hotel for seattle this week | 20:02 |
| notmorgan | lets see if the VPN works again *yet* | 20:02 |
| notmorgan | cause... i've been unable to access it or OWA for the last 3 days | 20:03 |
| *** ninag has quit IRC | 20:05 | |
| *** shaleh is now known as shaleh|away | 20:06 | |
| *** henrynash has joined #openstack-keystone | 20:08 | |
| *** ChanServ sets mode: +v henrynash | 20:08 | |
| *** henrynash has quit IRC | 20:13 | |
| *** jbell8 has quit IRC | 20:13 | |
| *** rderose has joined #openstack-keystone | 20:14 | |
| breton | I thought we postpone totp to another cycle | 20:14 |
| *** mhickey has joined #openstack-keystone | 20:18 | |
| stevemar | reminds everyone to add to the agenda: https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting#Main_Agenda | 20:19 |
| stevemar | breton: there was desire from a lot of people to give it an exemption | 20:20 |
| notmorgan | breton: we posponed the MFA stuff, the totp as a simple auth-type is easy to land | 20:20 |
| stevemar | breton: they have until friday to post some code | 20:21 |
| notmorgan | dolphm: ^ is nonameentername going to post code cause... | 20:21 |
| notmorgan | if not, i'll write up an auth plugin tonight | 20:21 |
| notmorgan | it'll be very rough but it'll be easy to iterate on | 20:21 |
| *** jsavak has quit IRC | 20:22 | |
| *** ctracey has joined #openstack-keystone | 20:23 | |
| *** jsavak has joined #openstack-keystone | 20:23 | |
| *** su_zhang has quit IRC | 20:23 | |
| *** maxabidi has quit IRC | 20:34 | |
| *** jsavak has quit IRC | 20:35 | |
| *** jsavak has joined #openstack-keystone | 20:36 | |
| dolphm | notmorgan: we're in a long meeting at the moment, but i believe so | 20:46 |
| notmorgan | dolphm: ok chase him down post "long meeting of doom, doom I say"(tm) | 20:46 |
| *** fpatwa has joined #openstack-keystone | 20:47 | |
| *** doug-fis_ has quit IRC | 20:47 | |
| *** ayoung has joined #openstack-keystone | 20:47 | |
| *** ChanServ sets mode: +v ayoung | 20:47 | |
| *** doug-fish has joined #openstack-keystone | 20:48 | |
| *** ninag has joined #openstack-keystone | 20:48 | |
| *** lhcheng has joined #openstack-keystone | 20:49 | |
| *** ChanServ sets mode: +v lhcheng | 20:49 | |
| *** fpatwa has quit IRC | 20:51 | |
| *** diazjf1 has joined #openstack-keystone | 20:55 | |
| *** slberger1 has joined #openstack-keystone | 20:56 | |
| *** shaleh|away is now known as shaleh | 20:56 | |
| *** diazjf has quit IRC | 20:57 | |
| *** tsymanczyk has quit IRC | 20:57 | |
| *** ngupta has quit IRC | 20:58 | |
| *** ebalduf has joined #openstack-keystone | 20:58 | |
| *** slberger has quit IRC | 20:58 | |
| *** ngupta has joined #openstack-keystone | 21:00 | |
| *** fpatwa has joined #openstack-keystone | 21:01 | |
| *** dims has joined #openstack-keystone | 21:02 | |
| *** dims_ has quit IRC | 21:03 | |
| *** clenimar has quit IRC | 21:04 | |
| *** ebalduf has quit IRC | 21:06 | |
| *** vivekd has joined #openstack-keystone | 21:06 | |
| *** jsavak has quit IRC | 21:06 | |
| *** doug-fish has quit IRC | 21:06 | |
| *** jsavak has joined #openstack-keystone | 21:07 | |
| *** doug-fish has joined #openstack-keystone | 21:07 | |
| *** doug-fis_ has joined #openstack-keystone | 21:09 | |
| notmorgan | lbragstad: SO CLOSE on the remove validate_v2. | 21:10 |
| *** doug-fi__ has joined #openstack-keystone | 21:11 | |
| *** doug-fish has quit IRC | 21:11 | |
| *** timcline has quit IRC | 21:13 | |
| *** timcline has joined #openstack-keystone | 21:13 | |
| *** fpatwa has quit IRC | 21:13 | |
| *** doug-fis_ has quit IRC | 21:13 | |
| ayoung | notmorgan, I'd be happy to see that go | 21:14 |
| *** doug-fi__ has quit IRC | 21:15 | |
| *** mgarza_ has quit IRC | 21:16 | |
| *** fpatwa_ has joined #openstack-keystone | 21:18 | |
| *** rcernin has joined #openstack-keystone | 21:19 | |
| *** erlarese has joined #openstack-keystone | 21:19 | |
| *** darrenc_ is now known as darrenc | 21:19 | |
| openstackgerrit | Merged openstack/keystone-specs: Unified delegation https://review.openstack.org/189816 | 21:20 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct docstrings https://review.openstack.org/274895 | 21:23 |
| *** doug-fish has joined #openstack-keystone | 21:23 | |
| *** sinese has quit IRC | 21:24 | |
| *** pauloewerton has quit IRC | 21:24 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 21:24 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 21:26 |
| *** jsavak has quit IRC | 21:26 | |
| *** jsavak has joined #openstack-keystone | 21:27 | |
| *** raildo is now known as raildo-afk | 21:27 | |
| *** doug-fis_ has joined #openstack-keystone | 21:27 | |
| *** doug-fish has quit IRC | 21:28 | |
| *** su_zhang has joined #openstack-keystone | 21:30 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Do not allow creating redelegated trust when using impersonated token. https://review.openstack.org/274250 | 21:31 |
| *** doug-fis_ has quit IRC | 21:32 | |
| ayoung | lookin jorge_munoz | 21:32 |
| jorge_munoz | o/, Hey, whats up/ | 21:32 |
| *** doug-fish has joined #openstack-keystone | 21:33 | |
| ayoung | jorge_munoz, if trust['trustor_user_id'] == original_trust['trustor_user_id']: looks strange | 21:33 |
| ayoung | jorge_munoz, what is your logic there? | 21:33 |
| notmorgan | ayoung: right?! | 21:34 |
| ayoung | the first check looks good | 21:34 |
| ayoung | but the second one is, I think, going to far | 21:34 |
| notmorgan | stevemar: almost done moving s3 to core, then just need to move ec2 | 21:34 |
| *** fpatwa_ has quit IRC | 21:34 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 21:34 |
| jorge_munoz | ayoung: So, this is we a user uses impersonation and passes the trustor’s id matching the original trustor. | 21:34 |
| *** su_zhang has quit IRC | 21:34 | |
| jorge_munoz | Meaning they user bypass the policy file check. | 21:35 |
| jorge_munoz | the* | 21:35 |
| ayoung | jorge_munoz, the check looks wrong...seems to me that it should be | 21:35 |
| ayoung | jorge_munoz, is that check inside the redelegation check? | 21:36 |
| *** mhickey_ has joined #openstack-keystone | 21:37 | |
| jorge_munoz | No, its a check when impersonating. | 21:37 |
| jorge_munoz | It is a check on a delegated auth. | 21:37 |
| ayoung | jorge_munoz, I think what you are trying to say is that if the user is authenticated via trust, limit them to redelegation, not creating a new trust | 21:37 |
| lbragstad | notmorgan I know - just a couple more steps | 21:38 |
| *** mhickey has quit IRC | 21:39 | |
| jorge_munoz | We should not allow a user to create a trust using impersonation, if he is trying to by pass policy check by passing the original’s trustor id on the newly created trust. | 21:39 |
| ayoung | jorge_munoz, I think the way you wrote it will prevent trust redelegation for the impersonation case | 21:40 |
| ayoung | redelegated_trust_id=self.trust['id'] | 21:40 |
| ayoung | redelegation that way should be allowed, but if there is no redelegation, if it is a new trust, it should be forbidden | 21:41 |
| jorge_munoz | right and i think that is correct. A redelegated trust should never allow creating a trust with impersonation. | 21:41 |
| ayoung | and you catch that above | 21:41 |
| ayoung | why not? | 21:41 |
| ayoung | it should not allow a new trust with an expanded set of roles | 21:42 |
| ayoung | it should allow you to redelegate the existing trust, or a subset of the roles on the exising trust, but continue to impersonate. | 21:42 |
| ayoung | I really think you will break things with this patch | 21:42 |
| jorge_munoz | Allows trusted users to creat new trust with impersonation would grant them the ability to give premission on behave of another users. | 21:43 |
| jorge_munoz | It doesn’t seem right | 21:43 |
| *** rcernin has quit IRC | 21:44 | |
| *** pgbridge_ has quit IRC | 21:46 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider issue_v2_token() https://review.openstack.org/197647 | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove validate_v2_token from Fernet provider https://review.openstack.org/274852 | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 21:48 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 21:48 |
| *** fpatwa has joined #openstack-keystone | 21:50 | |
| *** edmondsw has quit IRC | 21:50 | |
| *** fpatwa has quit IRC | 21:50 | |
| lbragstad | jorge_munoz ayoung so - if jorge_munoz wanted to create a trust with impersonation set to True and then I went to create a trust - that trust would be create between me and whoever I wanted to create that trust with. | 21:53 |
| lbragstad | To me, that doesn't seem like redelegation | 21:54 |
| lbragstad | and that is the current behavior in master | 21:54 |
| lbragstad | correct: that trust would be created between jorge_munoz and whoever *I* wanted to create that trust with.. that's the part that doesn't seem like redelegation | 21:55 |
| lbragstad | correction* I can't type today... | 21:55 |
| ayoung | lbragstad, If I create a trust (trustor=ayoung, delegation=true, trustee=lbragstad) and then you use that trust to get a token, and then create a new trust, that is wrong. But if It is a redelegation from you to jorge_munoz of the original trust, it should be (trustor=ayoung, redelegation=true, trustee= jorge_munoz ) | 21:56 |
| ayoung | the new trust should point to the original trust, and, if I revoke the original, the redelegate trust should be invalid | 21:57 |
| lbragstad | ayoung ok - so what happens if you add impersonation to that mix? | 21:57 |
| ayoung | lbragstad, I did...that example was with impersonation set to true | 21:58 |
| lbragstad | ayoung that example was with redelegation set to True | 21:58 |
| ayoung | lbragstad, I set this all up and pass it to Mistral. Mistral will then call heat. Heat will then call Barbican | 21:58 |
| ayoung | yes, only ith redelegation | 21:58 |
| ayoung | redelegation and impoersonation are not mutually exclusive | 21:59 |
| lbragstad | ayoung is the following behavior intended | 21:59 |
| *** pgbridge has joined #openstack-keystone | 22:00 | |
| lbragstad | I create a trust (trustor=lbragstad, impersonation=True, trustee=jorge_munoz) and then jorge_munoz goes to create a trust between himself and you (trustor=jorge_munoz, trustee=ayoung). That results in a trust looking like (trustor=lbragstad, trustee=ayoung)... Should that be allowed? | 22:01 |
| ayoung | lbragstad, so, uyes, but within limits. WHen a trust is redelegated, it is techncioally a new trust chained to the old trust | 22:02 |
| jorge_munoz | lbragstad: ayoung Yes, thats the case I’m trying to cover. | 22:02 |
| ayoung | (trustor=lbragstad, impersonation=True, trustee=jorge_munoz, redelegatio0n=true, roles=[r1, r2,r3]) | 22:02 |
| ayoung | that is our original trust | 22:02 |
| ayoung | now this gets and ID | 22:03 |
| ayoung | we'll call that T1 | 22:03 |
| ayoung | this should be allowed: | 22:03 |
| lbragstad | sure | 22:03 |
| ayoung | (trustor=lbragstad, impersonation=True, trustee=ayoung, redelegatio0n=true, roles=[r1, r2,r3], original_trust=T1) | 22:03 |
| ayoung | but only that | 22:03 |
| ayoung | turning off impersonation...sure, that could be done | 22:04 |
| *** su_zhang has joined #openstack-keystone | 22:04 | |
| ayoung | removing some of the roles is OK, too | 22:04 |
| ayoung | cannot add roles, and cannot work without the original_trust=T1 | 22:04 |
| ayoung | whatever the key is... | 22:04 |
| jorge_munoz | It don’t seem rigth to have impersonation and redelegation both true. How would you redelegate a trust with an impersonated token? | 22:05 |
| jorge_munoz | ayoung: lbragstad ^ | 22:06 |
| lbragstad | when impersonation and redelegation are both set to true - you can't get a redelegated trust, right? | 22:07 |
| ayoung | jorge_munoz, If I have a workflow where impersonation is needed, I might not be able to delegate that directly to the final executor | 22:07 |
| lbragstad | what's the workflow? | 22:07 |
| ayoung | I might delegate to msitral, but then mistral has to delegate to heat | 22:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 22:07 |
| ayoung | lbragstad, right now, the issue is Barbican, where secrets are owned by a person | 22:07 |
| ayoung | not a project | 22:07 |
| jorge_munoz | ayoung: and in that case you need to impersonate the user? | 22:08 |
| *** su_zhang has quit IRC | 22:08 | |
| ayoung | jorge_munoz, yes | 22:09 |
| lbragstad | does that flow require both impersonation and redelegation on the same trust? | 22:09 |
| *** su_zhang has joined #openstack-keystone | 22:09 | |
| *** vgridnev has quit IRC | 22:09 | |
| ayoung | jorge_munoz, it needs to be possible until we can kill impersonation, but I think that won't happen | 22:09 |
| lbragstad | can't that just be done with impersonation? | 22:09 |
| ayoung | lbragstad, yes | 22:09 |
| ayoung | nope | 22:09 |
| ayoung | lbragstad, the executor is the heat service user, that does not exist when the origianl trust is created | 22:09 |
| *** su_zhang has quit IRC | 22:10 | |
| *** chlong has joined #openstack-keystone | 22:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users: unified identity - Shadow federated users https://review.openstack.org/274761 | 22:10 |
| *** su_zhang has joined #openstack-keystone | 22:10 | |
| *** erlarese has quit IRC | 22:13 | |
| jorge_munoz | ayoung: Well if that is the intended behavior, then I can change it. But it seems that granting a trustee user a the ablility to create trust with impersonation set to true, is giving too many permission to the trustee. | 22:15 |
| ayoung | jorge_munoz, is it a new trust or a redelegation of an existing trust? THat is the essential, and currently allowed, distinction | 22:16 |
| jorge_munoz | If impersonation is used, it would be a new trust. | 22:16 |
| jorge_munoz | I was thinkg that if a trust is created with impersonation you can’t redelegate that trust. | 22:17 |
| ayoung | nope | 22:17 |
| ayoung | jorge_munoz, ok. lets look at the datastructure.... | 22:18 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/sql/migrate_repo/versions/044_icehouse.py#n124 | 22:18 |
| ayoung | jorge_munoz, we don;'t chain the trust ids? | 22:20 |
| jorge_munoz | Yes, they are linked by the redelegated_trust_id | 22:21 |
| ayoung | so commit 0b89e8b2a414ac1c5b0c32974fbf741bd775c1c0 added the redelegation...let's see | 22:22 |
| ayoung | jorge_munoz, did all the variations on the trust table get merged to the main repo, or is it still in an extension? | 22:23 |
| notmorgan | stevemar, dstanek soooooo found a test case that isn't run at all | 22:23 |
| notmorgan | ever | 22:23 |
| notmorgan | ... | 22:23 |
| stevemar | notmorgan: nice | 22:23 |
| ayoung | redelegated_trust_id | 22:24 |
| ayoung | where is that defined... | 22:24 |
| jorge_munoz | ayoung: it should be on the main migration repo | 22:26 |
| ayoung | jorge_munoz, it is not recorded | 22:26 |
| *** mhickey_ has quit IRC | 22:26 | |
| ayoung | it is not part of the database schema, AFAICT | 22:27 |
| ayoung | jorge_munoz, did we lose that when the trust extension got merged into main? | 22:27 |
| jorge_munoz | I don’t know, but if it does not define we need to add it. | 22:28 |
| *** RA_ has joined #openstack-keystone | 22:28 | |
| ayoung | trusts was never an out of tree extension for migrations...it predated that | 22:29 |
| ayoung | jorge_munoz, yeah, trying to see what happened | 22:29 |
| *** alejandrito has quit IRC | 22:30 | |
| ayoung | keystone/trust/schema.py | 22:30 |
| ayoung | what is that... | 22:30 |
| ayoung | jorge_munoz, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/trust/backends/sql.py does not have it in the backend either | 22:31 |
| *** timcline has quit IRC | 22:31 | |
| *** timcline has joined #openstack-keystone | 22:32 | |
| notmorgan | lbragstad: we win | 22:32 |
| notmorgan | lbragstad: kill subsecond everywhere in keystone | 22:32 |
| notmorgan | mtreinish: ^ cc | 22:32 |
| lbragstad | ZOMG! | 22:32 |
| notmorgan | lbragstad: mtreinish wants it consistent | 22:32 |
| notmorgan | not "osme backends are subsecond some are not" | 22:33 |
| *** ninag has quit IRC | 22:33 | |
| notmorgan | pick a side, drive that direction to make it consistent | 22:33 |
| jorge_munoz | Ok, yes. The schema seems to be missing those attributes. Those attributes were on the docuemenation for trust. | 22:33 |
| jorge_munoz | ayoung: ^ | 22:33 |
| notmorgan | squash subsecond down to second, and make sure to handle the case subsecond exists and truncate to second level precision [aka old data] | 22:33 |
| lbragstad | notmorgan we can abandon this then - https://review.openstack.org/#/c/243742/ | 22:33 |
| notmorgan | lbragstad: ++ yes | 22:33 |
| *** ninag has joined #openstack-keystone | 22:33 | |
| lbragstad | \o/ | 22:33 |
| ayoung | jorge_munoz, um that is bad | 22:33 |
| notmorgan | lbragstad: :) | 22:33 |
| lbragstad | cc: dolphm ^ | 22:33 |
| ayoung | jorge_munoz, I'm going to try a test here. | 22:34 |
| ayoung | jorge_munoz, I can't help but feel we are missing something | 22:35 |
| openstackgerrit | Brant Knudson proposed openstack/keystoneauth: DOC TEST DONT MERGE https://review.openstack.org/274913 | 22:35 |
| ayoung | jorge_munoz, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n3234 | 22:35 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n3369 | 22:36 |
| mtreinish | notmorgan, lbragstad: I'd also like to see a doc that clarifies that second resolution is all that's expected from the api even if subsecond timestamps are returned | 22:37 |
| notmorgan | mtreinish: 100% | 22:37 |
| notmorgan | lbragstad: lets put that in the developer docs | 22:37 |
| mtreinish | just to cover cases with older clouds | 22:37 |
| jorge_munoz | ayoung: Yes, I feel the same way. So the test were setup to do impersonation with redelegation. The change I made was to set impersonation to false and allow redelegation. | 22:38 |
| *** ninag has quit IRC | 22:38 | |
| ayoung | jorge_munoz, but those tests look bonkers | 22:38 |
| *** diazjf1 has quit IRC | 22:38 | |
| ayoung | jorge_munoz, http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n3374 says Verify the two remaining trust have been deleted but then calls delete on them | 22:39 |
| ayoung | let me change that to a GET which is what they should be doing | 22:39 |
| *** daemontool has quit IRC | 22:39 | |
| notmorgan | mtreinish: yep. makes sense to me | 22:40 |
| jorge_munoz | ayoung: ok, yea I did not change behavior of the test thou. That is what it was doing before, except not check the chain, but only the last one. | 22:40 |
| *** rderose has quit IRC | 22:41 | |
| ayoung | jorge_munoz, right, I was more worried about it already being broken. I still suspect that it is | 22:42 |
| ayoung | but if I change this delete call to a get, the test still passes http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_v3_auth.py#n3382 | 22:42 |
| ayoung | I wonder ,though, if that is due to policy and not due to the trust being deleted | 22:43 |
| *** lhcheng has quit IRC | 22:44 | |
| jorge_munoz | ayoung: delete trust loops to all redeleaged trust and deletes them. | 22:44 |
| ayoung | jorge_munoz, how? | 22:44 |
| *** lhcheng has joined #openstack-keystone | 22:44 | |
| *** ChanServ sets mode: +v lhcheng | 22:44 | |
| dolphm | nonameentername: ping - meant to ask you about the otp implementation today | 22:44 |
| jorge_munoz | https://github.com/openstack/keystone/blob/master/keystone/trust/core.py#L102 | 22:44 |
| jorge_munoz | ayoung: by the redelegated_trust_id | 22:45 |
| ayoung | ah...ahdn;t looked in core, just the driver... | 22:45 |
| ayoung | jorge_munoz, let me see if that is in the database... | 22:45 |
| openstackgerrit | Merged openstack/python-keystoneclient: Update translation setup https://review.openstack.org/273510 | 22:46 |
| jorge_munoz | ayoung: currently redelegated_trust_id is stored in extras. | 22:47 |
| ayoung | ah | 22:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/272825 | 22:47 |
| dolphm | nonameentername: just noticed the spec merged :) https://review.openstack.org/#/c/130376/ | 22:47 |
| ayoung | jorge_munoz, I must not have reviewed that patch. THat is grounds for a beating in my book | 22:47 |
| ayoung | jorge_munoz, just glad I don't have to file the CVE | 22:48 |
| ayoung | jorge_munoz, OK, so, with that intact, yes, redelegation of a token with impersonation set is allowed | 22:49 |
| *** su_zhang has quit IRC | 22:50 | |
| *** su_zhang has joined #openstack-keystone | 22:50 | |
| notmorgan | stevemar: ping - need your view. do i delete this test or try and wire it up? | 22:52 |
| notmorgan | stevemar: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_singular_plural.py#L24 | 22:53 |
| notmorgan | stevemar: cause..... it isn't run at all | 22:53 |
| lbragstad | ayoung wasn't this the original implementation of redelegation? https://review.openstack.org/#/c/126897/31 | 22:53 |
| jorge_munoz | ayoung: So is the next step define the redeleaged_trust_id? | 22:53 |
| jorge_munoz | and making it part of the schema | 22:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 22:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 22:55 |
| *** timcline has quit IRC | 22:59 | |
| *** jsavak has quit IRC | 23:00 | |
| notmorgan | dolphm: ^ see the link i made for steve... i think we just delete it | 23:00 |
| notmorgan | it's been... uh... | 23:00 |
| notmorgan | untouched since like 2012 | 23:00 |
| notmorgan | i think it's a dead test. | 23:00 |
| *** RA_ has quit IRC | 23:02 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove un-used test code https://review.openstack.org/274929 | 23:06 |
| *** slberger1 has left #openstack-keystone | 23:06 | |
| *** henrynash has joined #openstack-keystone | 23:10 | |
| *** ChanServ sets mode: +v henrynash | 23:10 | |
| *** david-lyle has quit IRC | 23:15 | |
| *** RA has joined #openstack-keystone | 23:19 | |
| *** RA is now known as Guest51478 | 23:20 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:22 | |
| *** vivekd has quit IRC | 23:27 | |
| *** henrynash has quit IRC | 23:27 | |
| *** henrynash has joined #openstack-keystone | 23:32 | |
| *** ChanServ sets mode: +v henrynash | 23:32 | |
| *** csoukup_ has quit IRC | 23:34 | |
| *** csoukup_ has joined #openstack-keystone | 23:34 | |
| *** gordc has quit IRC | 23:36 | |
| *** gildub has joined #openstack-keystone | 23:36 | |
| *** jamielennox is now known as jamielennox|away | 23:36 | |
| *** kragniz_ is now known as kragniz | 23:38 | |
| *** csoukup_ has quit IRC | 23:40 | |
| *** markvoelker has quit IRC | 23:41 | |
| *** shoutm has joined #openstack-keystone | 23:50 | |
| *** henrynash has quit IRC | 23:50 | |
| *** fpatwa has joined #openstack-keystone | 23:51 | |
| *** amakarov has joined #openstack-keystone | 23:53 | |
| *** nkinder has quit IRC | 23:54 | |
| openstackgerrit | Merged openstack/keystone: Replace unicode with six.text_type https://review.openstack.org/261253 | 23:54 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 23:56 |
| *** fpatwa has quit IRC | 23:56 | |
| amakarov | ayoung: what do you want me to add about PKI removal to the presentation? | 23:56 |
| amakarov | ayoung: aha, I see your changes... | 23:57 |
| *** jrist has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!