| *** ninag has quit IRC | 00:02 | |
| *** jasonsb has joined #openstack-keystone | 00:16 | |
| *** PsionTheory has quit IRC | 00:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 00:21 |
|---|---|---|
| *** r-daneel has joined #openstack-keystone | 00:23 | |
| *** bill_az has quit IRC | 00:31 | |
| *** spzala has joined #openstack-keystone | 00:34 | |
| *** cburgess_ has quit IRC | 00:39 | |
| *** chlong has joined #openstack-keystone | 00:40 | |
| *** cburgess has joined #openstack-keystone | 00:42 | |
| *** jbell8 has joined #openstack-keystone | 00:43 | |
| *** daemontool has joined #openstack-keystone | 00:47 | |
| *** daemontool_ has quit IRC | 00:48 | |
| *** jbell8 has quit IRC | 00:48 | |
| *** jbell8 has joined #openstack-keystone | 00:48 | |
| *** jamielennox is now known as jamielennox|away | 01:01 | |
| *** diazjf has joined #openstack-keystone | 01:06 | |
| *** jbell8 has quit IRC | 01:07 | |
| *** mylu has quit IRC | 01:19 | |
| *** gildub_ has joined #openstack-keystone | 01:24 | |
| *** esp has quit IRC | 01:25 | |
| *** mylu has joined #openstack-keystone | 01:26 | |
| *** gildub has quit IRC | 01:27 | |
| *** gildub_ has quit IRC | 01:27 | |
| *** gildub has joined #openstack-keystone | 01:27 | |
| *** crinkle_ has joined #openstack-keystone | 01:30 | |
| *** crinkle has quit IRC | 01:31 | |
| *** mylu has quit IRC | 01:31 | |
| *** spzala has quit IRC | 01:31 | |
| *** crinkle_ is now known as crinkle | 01:31 | |
| *** fpatwa has joined #openstack-keystone | 01:33 | |
| *** Ephur has quit IRC | 01:40 | |
| *** r-daneel has quit IRC | 01:41 | |
| *** _cjones_ has quit IRC | 01:49 | |
| *** phalmos has joined #openstack-keystone | 01:49 | |
| *** ericksonsantos has quit IRC | 01:50 | |
| *** mgarza_ has joined #openstack-keystone | 01:55 | |
| *** mylu has joined #openstack-keystone | 01:57 | |
| *** spzala has joined #openstack-keystone | 01:58 | |
| *** ericksonsantos has joined #openstack-keystone | 01:59 | |
| *** browne has quit IRC | 01:59 | |
| *** spzala has quit IRC | 02:00 | |
| *** spzala has joined #openstack-keystone | 02:00 | |
| *** davechen has joined #openstack-keystone | 02:05 | |
| *** spandhe has quit IRC | 02:05 | |
| *** erlarese has joined #openstack-keystone | 02:07 | |
| *** su_zhang has quit IRC | 02:09 | |
| *** fpatwa has quit IRC | 02:10 | |
| *** diazjf has quit IRC | 02:14 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update keyring requirements https://review.openstack.org/274435 | 02:16 |
| openstackgerrit | Merged openstack/python-keystoneclient: Remove python 2.5 workaround https://review.openstack.org/274436 | 02:16 |
| *** __zouyee has joined #openstack-keystone | 02:16 | |
| *** alejandrito has joined #openstack-keystone | 02:20 | |
| *** jorge_munoz has left #openstack-keystone | 02:28 | |
| *** Dave has quit IRC | 02:30 | |
| *** jamielennox|away is now known as jamielennox | 02:32 | |
| *** jed56 has quit IRC | 02:33 | |
| *** ChanServ sets mode: +v topol_ | 02:39 | |
| *** topol_ is now known as topol | 02:39 | |
| *** spandhe has joined #openstack-keystone | 02:42 | |
| *** roxanagh_ has quit IRC | 02:51 | |
| *** jamielennox is now known as jamielennox|away | 03:06 | |
| *** phalmos has quit IRC | 03:06 | |
| *** jamielennox|away is now known as jamielennox | 03:11 | |
| *** alejandrito has quit IRC | 03:17 | |
| stevemar | andrewbogott: i'm assuming you opened a bunch of keystone bugs? | 03:21 |
| stevemar | andrewbogott: if so, thank you :] | 03:26 |
| *** woodster_ has quit IRC | 03:26 | |
| *** dims has joined #openstack-keystone | 03:37 | |
| *** erlarese has quit IRC | 03:41 | |
| openstackgerrit | Merged openstack/keystone: Add schema for OAuth1 consumer API https://review.openstack.org/266791 | 03:43 |
| *** woodster_ has joined #openstack-keystone | 03:44 | |
| *** browne has joined #openstack-keystone | 03:44 | |
| *** __zouyee has quit IRC | 03:45 | |
| notmorgan | stevemar: back post drive and dinner | 03:46 |
| *** daemontool has quit IRC | 03:46 | |
| *** daemontool has joined #openstack-keystone | 03:46 | |
| notmorgan | dolphm: ++ on the billion roles thing. | 03:47 |
| *** links has joined #openstack-keystone | 03:49 | |
| openstackgerrit | Merged openstack/keystone: Create neutron service in sample_data.sh https://review.openstack.org/208215 | 03:50 |
| openstackgerrit | Merged openstack/keystone: Do not assign admin to service users https://review.openstack.org/275335 | 03:50 |
| *** vivekd has joined #openstack-keystone | 03:52 | |
| *** dims has quit IRC | 03:53 | |
| *** browne has quit IRC | 03:53 | |
| *** browne has joined #openstack-keystone | 03:56 | |
| notmorgan | DinaBelova: I am still a hard -1 or -2 for profiling enabled by default ftr. | 03:56 |
| notmorgan | Profiling needs to be opt in especially since osprofiler can leak sensitive data due to its deep hook points. | 03:57 |
| *** fpatwa has joined #openstack-keystone | 03:57 | |
| notmorgan | It was one of the core requirements I had for backing down from my original -2 | 03:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:58 |
| *** vivekd has quit IRC | 03:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 03:59 |
| *** fpatwa has quit IRC | 04:00 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 04:00 |
| *** mgarza_ has quit IRC | 04:06 | |
| *** su_zhang has joined #openstack-keystone | 04:07 | |
| *** jasonsb has quit IRC | 04:09 | |
| *** jasonsb has joined #openstack-keystone | 04:10 | |
| *** boris-42 has quit IRC | 04:11 | |
| *** ryanpetrello has quit IRC | 04:11 | |
| *** briancurtin has quit IRC | 04:11 | |
| *** dtroyer has quit IRC | 04:12 | |
| *** ctracey has quit IRC | 04:12 | |
| *** andrewbogott has quit IRC | 04:12 | |
| *** jamielennox is now known as jamielennox|away | 04:12 | |
| *** comstud has quit IRC | 04:12 | |
| *** tpeoples has quit IRC | 04:12 | |
| *** BlackDex has quit IRC | 04:12 | |
| *** Nakato has quit IRC | 04:12 | |
| *** eglute has quit IRC | 04:13 | |
| *** sigmavirus24_awa has quit IRC | 04:13 | |
| *** g2` has quit IRC | 04:13 | |
| *** BlackDex has joined #openstack-keystone | 04:13 | |
| *** dtroyer has joined #openstack-keystone | 04:13 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 04:13 | |
| *** gus has quit IRC | 04:13 | |
| *** chlong has quit IRC | 04:13 | |
| *** Nakato has joined #openstack-keystone | 04:13 | |
| *** ryanpetrello has joined #openstack-keystone | 04:14 | |
| *** comstud has joined #openstack-keystone | 04:14 | |
| *** gus has joined #openstack-keystone | 04:14 | |
| *** mylu has quit IRC | 04:14 | |
| *** eglute has joined #openstack-keystone | 04:14 | |
| *** EinstCrazy has joined #openstack-keystone | 04:14 | |
| *** jimbaker has quit IRC | 04:15 | |
| *** jasonsb has quit IRC | 04:15 | |
| *** spzala has quit IRC | 04:15 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 04:16 | |
| *** spzala has joined #openstack-keystone | 04:16 | |
| *** jasonsb has joined #openstack-keystone | 04:16 | |
| *** tpeoples has joined #openstack-keystone | 04:16 | |
| *** mylu has joined #openstack-keystone | 04:17 | |
| *** ctracey has joined #openstack-keystone | 04:18 | |
| *** xek_ has joined #openstack-keystone | 04:18 | |
| *** jimbaker has joined #openstack-keystone | 04:18 | |
| *** boris-42 has joined #openstack-keystone | 04:18 | |
| *** jimbaker has quit IRC | 04:18 | |
| *** jimbaker has joined #openstack-keystone | 04:18 | |
| *** amit213 has quit IRC | 04:19 | |
| *** bradjones has quit IRC | 04:19 | |
| *** BAKfr has quit IRC | 04:19 | |
| *** tristanC has quit IRC | 04:19 | |
| *** boltR has quit IRC | 04:19 | |
| *** smcginnis has quit IRC | 04:19 | |
| *** Daviey has quit IRC | 04:19 | |
| *** tristanC has joined #openstack-keystone | 04:19 | |
| *** Daviey has joined #openstack-keystone | 04:19 | |
| *** xek has quit IRC | 04:19 | |
| *** jrist has quit IRC | 04:19 | |
| *** boltR has joined #openstack-keystone | 04:20 | |
| *** BAKfr has joined #openstack-keystone | 04:20 | |
| *** briancurtin has joined #openstack-keystone | 04:20 | |
| *** spzala has quit IRC | 04:20 | |
| *** jrist has joined #openstack-keystone | 04:20 | |
| *** smcginnis has joined #openstack-keystone | 04:20 | |
| *** bradjones has joined #openstack-keystone | 04:21 | |
| *** bradjones has quit IRC | 04:21 | |
| *** bradjones has joined #openstack-keystone | 04:21 | |
| *** andrewbogott has joined #openstack-keystone | 04:23 | |
| *** chlong has joined #openstack-keystone | 04:28 | |
| *** Nirupama has joined #openstack-keystone | 04:35 | |
| *** vivekd has joined #openstack-keystone | 04:35 | |
| *** diazjf has joined #openstack-keystone | 04:38 | |
| *** fpatwa has joined #openstack-keystone | 04:38 | |
| *** fpatwa has quit IRC | 04:41 | |
| *** vivekd has quit IRC | 04:48 | |
| stevemar | notmorgan: o hai | 04:58 |
| notmorgan | stevemar: hehe | 04:59 |
| notmorgan | heyya | 04:59 |
| notmorgan | hotel wifi... fun | 04:59 |
| notmorgan | was a nice rainy drive to seattle though | 04:59 |
| *** esp has joined #openstack-keystone | 04:59 | |
| notmorgan | only ~3hrs | 04:59 |
| notmorgan | not too bad | 04:59 |
| *** Nirupama has quit IRC | 05:03 | |
| *** vivekd has joined #openstack-keystone | 05:11 | |
| *** boris-42 has quit IRC | 05:13 | |
| *** jbell8 has joined #openstack-keystone | 05:14 | |
| *** jbell8 has quit IRC | 05:16 | |
| *** jbell8 has joined #openstack-keystone | 05:17 | |
| *** jbell8 has quit IRC | 05:19 | |
| *** jbell8 has joined #openstack-keystone | 05:20 | |
| *** esp has quit IRC | 05:21 | |
| *** spandhe_ has joined #openstack-keystone | 05:23 | |
| *** spandhe has quit IRC | 05:24 | |
| *** spandhe_ is now known as spandhe | 05:24 | |
| *** Nirupama has joined #openstack-keystone | 05:24 | |
| stevemar | notmorgan: oh right | 05:30 |
| stevemar | say hi to craig, jesse and paul for me | 05:30 |
| notmorgan | will do | 05:30 |
| *** andrewbogott has quit IRC | 05:31 | |
| *** andrewbogott has joined #openstack-keystone | 05:31 | |
| *** csoukup_ has quit IRC | 05:31 | |
| *** csoukup_ has joined #openstack-keystone | 05:32 | |
| *** fpatwa has joined #openstack-keystone | 05:32 | |
| *** markvoelker_ has quit IRC | 05:34 | |
| *** __zouyee has joined #openstack-keystone | 05:37 | |
| *** spzala has joined #openstack-keystone | 05:46 | |
| *** lhcheng_ has quit IRC | 05:47 | |
| *** fpatwa has quit IRC | 05:50 | |
| *** vgridnev has joined #openstack-keystone | 05:51 | |
| *** spzala has quit IRC | 05:52 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 05:53 |
| *** roxanagh_ has joined #openstack-keystone | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/275517 | 06:04 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate pki_setup and ssl_setup from keystone-manage https://review.openstack.org/276052 | 06:10 |
| stevemar | davechen: ^ easy one :O | 06:11 |
| *** vivekd_ has joined #openstack-keystone | 06:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate pki_setup and ssl_setup from keystone-manage https://review.openstack.org/276052 | 06:11 |
| *** vivekd has quit IRC | 06:12 | |
| *** vivekd_ is now known as vivekd | 06:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: WIP: migrate to keystoneauth https://review.openstack.org/276055 | 06:14 |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Opt-out certain Keystone Notifications https://review.openstack.org/253780 | 06:25 |
| *** mylu has quit IRC | 06:26 | |
| davechen | stevemar: looking... | 06:32 |
| *** richm has joined #openstack-keystone | 06:33 | |
| *** markvoelker has joined #openstack-keystone | 06:35 | |
| davechen | stevemar: maybe change 'O' to 'O release'. | 06:36 |
| openstackgerrit | Fernando Diaz proposed openstack/keystone: Opt-out certain Keystone Notifications https://review.openstack.org/253780 | 06:36 |
| *** woodster_ has quit IRC | 06:36 | |
| stevemar | davechen: feel free to make the change using the edit button and +2'ing it :P | 06:37 |
| stevemar | i'm knee deep in squashing migrations | 06:37 |
| davechen | stevemar: okay, okay. | 06:38 |
| *** henrynash has joined #openstack-keystone | 06:39 | |
| *** ChanServ sets mode: +v henrynash | 06:39 | |
| davechen | if these commands are gone, how to get the CA certifiate from federation? | 06:39 |
| *** markvoelker has quit IRC | 06:39 | |
| *** vivekd has quit IRC | 06:40 | |
| davechen | stevemar: keystone federation depends on `keystone-manage pki_setup` to get the certificates. | 06:40 |
| stevemar | davechen: hmm, it really shouldn't be getting it from there... | 06:40 |
| davechen | stevemar: yep, it's not for production, and maybe document it on how to generate one self-sign certificate? | 06:41 |
| *** mylu has joined #openstack-keystone | 06:41 | |
| davechen | s/production/product | 06:41 |
| stevemar | davechen: yeah, we should... i dont know if our tests will fail | 06:42 |
| davechen | stevemar: let's do this at first. | 06:42 |
| *** diazjf has quit IRC | 06:42 | |
| stevemar | davechen: the [saml] options just specify we need to point to a cert for signing stuff | 06:43 |
| openstackgerrit | Dave Chen proposed openstack/keystone: deprecate pki_setup and ssl_setup from keystone-manage https://review.openstack.org/276052 | 06:43 |
| *** tyagiprince has joined #openstack-keystone | 06:45 | |
| davechen | stevemar: yep, some change should be made since i saw from somewhere that suggest to use `keystone-manage pki_setup` to generate the cert. | 06:46 |
| davechen | hmm, it's here. https://review.openstack.org/#/c/234531/2/keystone/common/config.py | 06:47 |
| *** spzala has joined #openstack-keystone | 06:49 | |
| davechen | the help message of [saml]/certfile. | 06:49 |
| *** spzala has quit IRC | 06:53 | |
| *** tyagiprince has quit IRC | 06:54 | |
| *** spandhe has quit IRC | 06:54 | |
| *** tyagiprince has joined #openstack-keystone | 06:58 | |
| *** rha has quit IRC | 07:00 | |
| *** roxanagh_ has quit IRC | 07:01 | |
| *** belmoreira has joined #openstack-keystone | 07:02 | |
| *** spandhe has joined #openstack-keystone | 07:03 | |
| *** su_zhang has quit IRC | 07:03 | |
| *** roxanagh_ has joined #openstack-keystone | 07:03 | |
| *** roxanagh_ has quit IRC | 07:08 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: deprecate pki_setup and ssl_setup from keystone-manage https://review.openstack.org/276052 | 07:13 |
| davechen | stevemar: fixed pep8, +2ed. | 07:15 |
| *** richm has quit IRC | 07:24 | |
| tyagiprince | Hii everyone.. | 07:27 |
| tyagiprince | Can I use multiple identity backends in keystone? | 07:28 |
| tyagiprince | I want the groups to be stored in mysql and users are coming from LDAP. | 07:28 |
| *** rha has joined #openstack-keystone | 07:31 | |
| *** rha has quit IRC | 07:31 | |
| *** rha has joined #openstack-keystone | 07:31 | |
| *** mylu has quit IRC | 07:32 | |
| *** spandhe has quit IRC | 07:34 | |
| *** spandhe_ has joined #openstack-keystone | 07:34 | |
| *** markvoelker has joined #openstack-keystone | 07:36 | |
| *** markvoelker has quit IRC | 07:41 | |
| *** richm has joined #openstack-keystone | 07:42 | |
| *** spzala has joined #openstack-keystone | 07:49 | |
| *** fhubik has joined #openstack-keystone | 07:49 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: squash migrations - kilo https://review.openstack.org/276079 | 07:52 |
| *** gyee has quit IRC | 07:53 | |
| *** spzala has quit IRC | 07:54 | |
| *** mvk_ has quit IRC | 07:57 | |
| *** roxanagh_ has joined #openstack-keystone | 08:04 | |
| *** sinese has joined #openstack-keystone | 08:05 | |
| *** vgridnev has quit IRC | 08:08 | |
| *** roxanagh_ has quit IRC | 08:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: squash migrations - kilo https://review.openstack.org/276079 | 08:09 |
| *** Nirupama has quit IRC | 08:09 | |
| stevemar | anyone feel like debugging a weird test failure for the migration squash :) | 08:11 |
| *** spandhe_ has quit IRC | 08:12 | |
| *** jbell8 has quit IRC | 08:12 | |
| *** jbell8 has joined #openstack-keystone | 08:13 | |
| *** tyagiprince has quit IRC | 08:15 | |
| *** pnavarro has joined #openstack-keystone | 08:21 | |
| *** browne has quit IRC | 08:21 | |
| *** Nirupama has joined #openstack-keystone | 08:22 | |
| *** vgridnev has joined #openstack-keystone | 08:25 | |
| *** browne has joined #openstack-keystone | 08:26 | |
| *** mvk_ has joined #openstack-keystone | 08:26 | |
| *** jistr has joined #openstack-keystone | 08:29 | |
| *** jaosorior has joined #openstack-keystone | 08:31 | |
| *** _cjones_ has joined #openstack-keystone | 08:41 | |
| *** _cjones_ has quit IRC | 08:42 | |
| *** _cjones_ has joined #openstack-keystone | 08:43 | |
| *** vgridnev has quit IRC | 08:46 | |
| *** mhickey_ has joined #openstack-keystone | 08:50 | |
| *** spzala has joined #openstack-keystone | 08:50 | |
| *** spzala has quit IRC | 08:55 | |
| *** _cjones_ has quit IRC | 09:00 | |
| *** tyagiprince has joined #openstack-keystone | 09:04 | |
| *** roxanagh_ has joined #openstack-keystone | 09:05 | |
| *** mhickey has joined #openstack-keystone | 09:07 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 09:07 |
| *** mhickey_ has quit IRC | 09:08 | |
| *** roxanagh_ has quit IRC | 09:10 | |
| *** tyagiprince has quit IRC | 09:11 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 09:14 |
| *** jistr has quit IRC | 09:16 | |
| *** openstackgerrit has quit IRC | 09:17 | |
| *** openstackgerrit has joined #openstack-keystone | 09:17 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 09:21 |
| *** browne has quit IRC | 09:23 | |
| *** Dave has joined #openstack-keystone | 09:33 | |
| *** gildub has quit IRC | 09:36 | |
| *** markvoelker has joined #openstack-keystone | 09:37 | |
| *** markvoelker has quit IRC | 09:41 | |
| *** spzala has joined #openstack-keystone | 09:51 | |
| *** spzala has quit IRC | 09:56 | |
| *** davechen has left #openstack-keystone | 09:57 | |
| *** roxanagh_ has joined #openstack-keystone | 10:06 | |
| *** roxanagh_ has quit IRC | 10:10 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 10:11 |
| *** e0ne has joined #openstack-keystone | 10:14 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 10:18 |
| *** esp has joined #openstack-keystone | 10:20 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 10:20 |
| *** esp has quit IRC | 10:24 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 10:27 |
| *** x58 has quit IRC | 10:40 | |
| *** __zouyee has quit IRC | 10:48 | |
| *** nkinder has joined #openstack-keystone | 10:49 | |
| *** x58 has joined #openstack-keystone | 10:51 | |
| *** spzala has joined #openstack-keystone | 10:52 | |
| *** spzala has quit IRC | 10:56 | |
| *** bdossant has joined #openstack-keystone | 11:00 | |
| *** jaosorior has quit IRC | 11:01 | |
| *** roxanagh_ has joined #openstack-keystone | 11:07 | |
| *** jbell8 has quit IRC | 11:11 | |
| *** dims has joined #openstack-keystone | 11:12 | |
| *** jbell8 has joined #openstack-keystone | 11:12 | |
| *** roxanagh_ has quit IRC | 11:13 | |
| *** nkinder has quit IRC | 11:19 | |
| *** rodrigods has quit IRC | 11:24 | |
| *** rodrigods has joined #openstack-keystone | 11:24 | |
| *** jbell8 has quit IRC | 11:26 | |
| *** jbell8 has joined #openstack-keystone | 11:26 | |
| *** markvoelker has joined #openstack-keystone | 11:38 | |
| *** samueldmq has joined #openstack-keystone | 11:42 | |
| *** markvoelker has quit IRC | 11:43 | |
| *** spzala has joined #openstack-keystone | 11:53 | |
| *** samueldmq has quit IRC | 11:54 | |
| *** jaosorior has joined #openstack-keystone | 11:55 | |
| *** jistr has joined #openstack-keystone | 11:56 | |
| *** spzala has quit IRC | 11:57 | |
| *** cdent has joined #openstack-keystone | 12:00 | |
| *** rvba has quit IRC | 12:01 | |
| *** rvba has joined #openstack-keystone | 12:03 | |
| *** rvba has quit IRC | 12:04 | |
| *** rvba has joined #openstack-keystone | 12:04 | |
| *** xek_ is now known as xek | 12:08 | |
| *** roxanagh_ has joined #openstack-keystone | 12:09 | |
| *** vgridnev has joined #openstack-keystone | 12:13 | |
| *** roxanagh_ has quit IRC | 12:14 | |
| *** jbell8 has quit IRC | 12:16 | |
| *** EinstCrazy has quit IRC | 12:19 | |
| *** EinstCrazy has joined #openstack-keystone | 12:20 | |
| *** nkinder has joined #openstack-keystone | 12:21 | |
| *** raildo-afk is now known as raildo | 12:23 | |
| *** rk4n has joined #openstack-keystone | 12:24 | |
| *** rk4n has quit IRC | 12:29 | |
| *** su_zhang has joined #openstack-keystone | 12:38 | |
| *** su_zhang_ has joined #openstack-keystone | 12:39 | |
| *** su_zhang has quit IRC | 12:42 | |
| *** iurygregory has joined #openstack-keystone | 12:44 | |
| *** bdossant has quit IRC | 12:45 | |
| *** su_zhang_ has quit IRC | 12:47 | |
| *** davechen has joined #openstack-keystone | 12:47 | |
| *** davechen is now known as davechen_afk | 12:47 | |
| *** daemontool_ has joined #openstack-keystone | 12:48 | |
| *** spzala has joined #openstack-keystone | 12:53 | |
| *** daemontool has quit IRC | 12:53 | |
| *** jimbaker has quit IRC | 12:53 | |
| *** topol has quit IRC | 12:53 | |
| *** markvoelker has joined #openstack-keystone | 12:53 | |
| *** mc_nair has quit IRC | 12:54 | |
| *** jimbaker has joined #openstack-keystone | 12:54 | |
| *** jimbaker has quit IRC | 12:54 | |
| *** jimbaker has joined #openstack-keystone | 12:54 | |
| *** topol_ has joined #openstack-keystone | 12:55 | |
| *** mc_nair has joined #openstack-keystone | 12:57 | |
| *** daemontool_ has quit IRC | 12:58 | |
| *** markvoelker has quit IRC | 12:58 | |
| *** spzala has quit IRC | 12:58 | |
| *** pauloewerton has joined #openstack-keystone | 13:03 | |
| *** bdossant has joined #openstack-keystone | 13:05 | |
| *** bdossant has quit IRC | 13:10 | |
| *** bdossant has joined #openstack-keystone | 13:10 | |
| *** markvoelker has joined #openstack-keystone | 13:11 | |
| *** roxanagh_ has joined #openstack-keystone | 13:11 | |
| *** roxanagh_ has quit IRC | 13:17 | |
| *** gordc has joined #openstack-keystone | 13:22 | |
| *** nkinder has quit IRC | 13:24 | |
| *** sinese has quit IRC | 13:28 | |
| *** sinese has joined #openstack-keystone | 13:29 | |
| *** sinese has quit IRC | 13:29 | |
| *** erlarese has joined #openstack-keystone | 13:30 | |
| *** edmondsw has joined #openstack-keystone | 13:31 | |
| *** cdent has quit IRC | 13:33 | |
| *** petertr7_away is now known as petertr7 | 13:34 | |
| *** Nirupama has quit IRC | 13:36 | |
| *** nkinder has joined #openstack-keystone | 13:36 | |
| *** david-lyle has quit IRC | 13:38 | |
| *** mylu has joined #openstack-keystone | 13:39 | |
| *** pnavarro has quit IRC | 13:42 | |
| *** mylu has quit IRC | 13:43 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:51 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 13:52 | |
| *** lennyb has joined #openstack-keystone | 13:53 | |
| *** spzala has joined #openstack-keystone | 13:54 | |
| *** pnavarro has joined #openstack-keystone | 13:55 | |
| *** ninag has joined #openstack-keystone | 13:56 | |
| *** links has quit IRC | 13:56 | |
| lennyb | Hello, how can I lower debug level of /var/log/apache2/keystone.log ? I am using devstack. | 13:59 |
| *** spzala has quit IRC | 13:59 | |
| *** spzala has joined #openstack-keystone | 14:00 | |
| *** ayoung has quit IRC | 14:01 | |
| raildo | lennyb: you can use ./rejoin_stack.sh to see what is happen on the services | 14:01 |
| raildo | lennyb: http://www.sebastien-han.fr/blog/2013/08/08/devstack-in-1-minute/ | 14:02 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 14:06 |
| *** bdossant_ has joined #openstack-keystone | 14:07 | |
| *** ChanServ sets mode: +v topol_ | 14:07 | |
| *** topol_ is now known as topol | 14:07 | |
| *** daemontool has joined #openstack-keystone | 14:09 | |
| *** bdossant has quit IRC | 14:10 | |
| *** dims_ has joined #openstack-keystone | 14:10 | |
| lennyb | raildo: thanks, but my desire is to lower log level in /opt/stack/keystone/httpd/wsgi-keystone.conf , so /var/log/apache2/keystone.log will not take so much of the storage. currently it show DEBUG messages that I dont need | 14:12 |
| *** dims has quit IRC | 14:12 | |
| *** roxanagh_ has joined #openstack-keystone | 14:13 | |
| *** nkinder has quit IRC | 14:14 | |
| *** bdossant_ has quit IRC | 14:15 | |
| *** su_zhang has joined #openstack-keystone | 14:16 | |
| *** bdossant has joined #openstack-keystone | 14:16 | |
| *** su_zhang_ has joined #openstack-keystone | 14:17 | |
| *** roxanagh_ has quit IRC | 14:18 | |
| *** davechen_afk has left #openstack-keystone | 14:19 | |
| *** su_zhang has quit IRC | 14:20 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 14:22 |
| *** mylu has joined #openstack-keystone | 14:23 | |
| *** jsavak has joined #openstack-keystone | 14:35 | |
| *** nkinder has joined #openstack-keystone | 14:37 | |
| *** mylu has quit IRC | 14:40 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 14:40 |
| *** nileshg4444 has joined #openstack-keystone | 14:40 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules in the v3 policy sample for domain specifc roles https://review.openstack.org/262078 | 14:41 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify implied roles to honor domain specific roles https://review.openstack.org/263064 | 14:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Modify rules for domain specific role assignments https://review.openstack.org/263549 | 14:42 |
| *** mylu has joined #openstack-keystone | 14:43 | |
| *** shoutm has quit IRC | 14:46 | |
| *** ayoung has joined #openstack-keystone | 14:47 | |
| *** ChanServ sets mode: +v ayoung | 14:47 | |
| *** hk135 has joined #openstack-keystone | 14:50 | |
| *** spzala has quit IRC | 14:54 | |
| htruta | bknudson_: hey. what would you expect to get if you call a delete_list() method passing an empty list? | 15:00 |
| bknudson_ | typically I'd expect it to just do nothing. | 15:00 |
| htruta | should it bypass silently or raise a NotFound? | 15:00 |
| bknudson_ | the docstring for the function should say what it does. | 15:01 |
| *** esp has joined #openstack-keystone | 15:01 | |
| htruta | bknudson_: I thought of making it do nothing too. will put at the docstring. thanks | 15:01 |
| *** pushkaru has joined #openstack-keystone | 15:03 | |
| *** doug-fish has joined #openstack-keystone | 15:03 | |
| *** samueldmq has joined #openstack-keystone | 15:05 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:06 | |
| *** ninag_ has joined #openstack-keystone | 15:07 | |
| *** ninag has quit IRC | 15:08 | |
| *** esp has quit IRC | 15:10 | |
| *** samueldmq has quit IRC | 15:10 | |
| *** timcline has joined #openstack-keystone | 15:25 | |
| *** spzala has joined #openstack-keystone | 15:26 | |
| *** spzala_ has joined #openstack-keystone | 15:28 | |
| *** mgarza has joined #openstack-keystone | 15:29 | |
| *** woodster_ has joined #openstack-keystone | 15:29 | |
| *** e0ne has quit IRC | 15:29 | |
| *** hk135 has quit IRC | 15:29 | |
| *** esp has joined #openstack-keystone | 15:30 | |
| *** e0ne has joined #openstack-keystone | 15:30 | |
| *** spzala has quit IRC | 15:31 | |
| *** phalmos has joined #openstack-keystone | 15:31 | |
| *** vgridnev has quit IRC | 15:32 | |
| *** mylu has quit IRC | 15:36 | |
| *** mylu has joined #openstack-keystone | 15:39 | |
| *** hughsaunders has quit IRC | 15:44 | |
| *** hughsaunders has joined #openstack-keystone | 15:45 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service providers groups associations https://review.openstack.org/275636 | 15:49 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers Group CRUD operations. https://review.openstack.org/273438 | 15:49 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Create V9 version of catalog driver interface https://review.openstack.org/269455 | 15:49 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Service Providers and Projects associations https://review.openstack.org/264854 | 15:49 |
| *** hughsaunders has quit IRC | 15:49 | |
| *** hughsaunders has joined #openstack-keystone | 15:49 | |
| *** hughsaunders has quit IRC | 15:50 | |
| *** slberger has joined #openstack-keystone | 15:51 | |
| *** hughsaunders has joined #openstack-keystone | 15:51 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: keystone: provide an error message if downgrading schema https://review.openstack.org/276296 | 15:56 |
| stevemar | tjcocozz: http://specs.openstack.org/openstack/openstack-specs/specs/cors-support.html | 16:00 |
| *** jorge_munoz has joined #openstack-keystone | 16:00 | |
| tjcocozz | stevemar, http://docs.openstack.org/developer/swift/cors.html#test-cors-page | 16:01 |
| *** petertr7 is now known as petertr7_away | 16:01 | |
| *** mylu has quit IRC | 16:02 | |
| *** petertr7_away is now known as petertr7 | 16:03 | |
| *** csoukup_ has quit IRC | 16:04 | |
| *** nkinder has quit IRC | 16:04 | |
| *** r-daneel has joined #openstack-keystone | 16:04 | |
| *** nkinder has joined #openstack-keystone | 16:06 | |
| *** jbell8 has joined #openstack-keystone | 16:06 | |
| stevemar | tjcocozz: saml2 auth link: http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html#authenticating | 16:08 |
| *** richm has quit IRC | 16:08 | |
| *** jed56 has joined #openstack-keystone | 16:09 | |
| *** hughsaunders has quit IRC | 16:13 | |
| *** jbell8 has quit IRC | 16:13 | |
| *** hughsaunders has joined #openstack-keystone | 16:15 | |
| *** jbell8 has joined #openstack-keystone | 16:16 | |
| *** jbell8 has quit IRC | 16:16 | |
| ayoung | iurygregory, So, here's what I'm trying to do: | 16:20 |
| *** richm has joined #openstack-keystone | 16:20 | |
| ayoung | I have a setup where I need to register an up-and-running Keystone server with an IdP (Keycloak and Ipsilon both fall into this category) | 16:21 |
| ayoung | So I need to add an entry for /etc/httpd/conf.d etc | 16:21 |
| *** mylu has joined #openstack-keystone | 16:21 | |
| ayoung | as well as the keystone client calls to register the IdP, etc. It looks like you did most of the heavy lifting here | 16:22 |
| ayoung | but I think you were focused on the K2K use case instead of general Federation, right? | 16:22 |
| iurygregory | ayoung, yeah my focus was on configure keystone and apache for K2K | 16:23 |
| iurygregory | the spec approved was considering openid and mellon too | 16:24 |
| ayoung | iurygregory, yeah, this is all a grat starting point for what we need. Most of the work is the same | 16:24 |
| *** david-lyle has joined #openstack-keystone | 16:24 | |
| ayoung | what needs to be done is, for the most part, IdP specific | 16:24 |
| ayoung | iurygregory, for example, here is the Ansible playbook we used for setting up Keystone with Ipsilon: | 16:25 |
| iurygregory | ayoung, if you can point what are the steps to setup idp with mellon i can update ;) | 16:25 |
| ayoung | iurygregory, https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/keystone-ipsilon.yml | 16:25 |
| ayoung | that is the keystone client steps | 16:25 |
| ayoung | which should be just about the same as what you've done | 16:26 |
| ayoung | and thenthe httpd stuff is | 16:26 |
| iurygregory | oh you need the support for the openstack cli to add idp right? | 16:26 |
| * ayoung still looking | 16:26 | |
| ayoung | iurygregory, here is the httpd config https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/keystone.yml | 16:27 |
| ayoung | iurygregory, and this does not need to fall on your shoulders | 16:28 |
| ayoung | iurygregory, I thikn the openstack c;li idp call is there now | 16:28 |
| ayoung | iurygregory, that was submitted (I think) after you did you work | 16:28 |
| *** diazjf has joined #openstack-keystone | 16:28 | |
| iurygregory | ayoung, nice, i'll talk with the people in puppet =) | 16:28 |
| ayoung | iurygregory, I've been conspiring with richm on this already | 16:29 |
| ayoung | iurygregory, the issue we've uncoverd is that registering the HTTPD instance with the IdP is very different from IdP to IdP. | 16:29 |
| ayoung | iurygregory, so I think we will end up with a Python based helper script to make that call. | 16:30 |
| iurygregory | humm i understand | 16:30 |
| ayoung | this is not a Keystone specific issue, either | 16:30 |
| ayoung | it will be for anything that tries to do SAML | 16:30 |
| *** pnavarro is now known as pnavarro|afk | 16:30 | |
| ayoung | iurygregory, for instance make metadata https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/keystone.yml#L117 | 16:30 |
| *** fhubik has quit IRC | 16:31 | |
| ayoung | that is what is in bug report re keystone-manage | 16:31 |
| *** clenimar has joined #openstack-keystone | 16:32 | |
| ayoung | https://github.com/admiyo/rippowam/blob/master/roles/packstack/tasks/keystone.yml#L66 is the ipsilon specific call. We needto find a way to abstract that. Shib, Ipsilon, and Keycloak all need that step, and all do it differently. I suspect ADFS has yet another way to do it, too | 16:32 |
| ayoung | iurygregory, if you can update the bug with any details you feel will ease developmen here, I'd much appreciate it. | 16:33 |
| iurygregory | ayoung, i agree, maybe a flag about what is the user wants (ipsilon, shib..) | 16:33 |
| ayoung | iurygregory, right. | 16:34 |
| iurygregory | i'll do my best to update the identity_provider class to consider mellon =) | 16:34 |
| *** belmoreira has quit IRC | 16:34 | |
| iurygregory | but the part about the cli i can't help very much | 16:35 |
| iurygregory | ayoung, I will carefully look at the link you passed | 16:35 |
| ayoung | iurygregory, that is OK, we have someone working on it already | 16:36 |
| iurygregory | ayoung, this person will send a patch? i'll be happy to review it =) | 16:37 |
| *** mvk_ has quit IRC | 16:37 | |
| *** mylu has quit IRC | 16:42 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 16:42 |
| *** vgridnev has joined #openstack-keystone | 16:43 | |
| *** mylu has joined #openstack-keystone | 16:43 | |
| *** jbell8 has joined #openstack-keystone | 16:43 | |
| *** mylu has quit IRC | 16:46 | |
| *** petertr7 is now known as petertr7_away | 16:46 | |
| *** mylu has joined #openstack-keystone | 16:47 | |
| *** mylu has quit IRC | 16:50 | |
| *** spzala_ has quit IRC | 16:51 | |
| *** mylu has joined #openstack-keystone | 16:51 | |
| dims_ | stevemar : am seeing some issues in the gate with "/usr/local/bin/keystone-manage db_sync" | 16:52 |
| dims_ | stevemar : http://logs.openstack.org/55/271755/2/gate/gate-grenade-dsvm-neutron/4fabdb7/logs/grenade.sh.txt.gz#_2016-02-04_16_48_28_416 | 16:52 |
| dims_ | stevemar : http://logs.openstack.org/57/273957/1/gate/gate-neutron-dsvm-api/90c9d31/logs/devstacklog.txt.gz#_2016-02-04_16_40_52_317 | 16:52 |
| *** jaosorior has quit IRC | 16:52 | |
| dims_ | a couple of more logs as well | 16:52 |
| *** spandhe has joined #openstack-keystone | 16:53 | |
| *** mylu has quit IRC | 16:54 | |
| ayoung | dims_, 2016-02-04 16:48:28.416 | pkg_resources.ContextualVersionConflict: (fixtures 1.2.0 (/usr/local/lib/python2.7/dist-packages), Requirement.parse('fixtures>=1.3.0'), set(['testtools'])) | 16:57 |
| ayoung | same thing in both | 16:57 |
| ayoung | looks like a package conflict | 16:57 |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 16:57 |
| *** jgriffith is now known as jgriffith_away | 16:58 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Verify project unique constraints for projects acting as domains https://review.openstack.org/158372 | 16:58 |
| *** petertr7_away is now known as petertr7 | 16:59 | |
| ayoung | dims_, is something locking fixtures to a lower value? | 16:59 |
| dims_ | ayoung : stevemar just pointed out that those are logs from stable/kilo. so master may be ok | 16:59 |
| *** e0ne has quit IRC | 16:59 | |
| *** browne has joined #openstack-keystone | 17:00 | |
| *** diazjf has quit IRC | 17:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 17:00 |
| *** mylu has joined #openstack-keystone | 17:02 | |
| *** gyee has joined #openstack-keystone | 17:02 | |
| *** ChanServ sets mode: +v gyee | 17:02 | |
| *** jistr has quit IRC | 17:02 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 17:02 |
| *** diazjf has joined #openstack-keystone | 17:04 | |
| *** bdossant_ has joined #openstack-keystone | 17:04 | |
| *** bdossant_ has quit IRC | 17:07 | |
| *** samueldmq has joined #openstack-keystone | 17:07 | |
| samueldmq | henrynash: hi | 17:07 |
| henrynash | samueldmq: hi | 17:08 |
| *** bdossant has quit IRC | 17:08 | |
| samueldmq | henrynash: I was thinking about our yesterday's discussion on policies | 17:08 |
| henrynash | samueldmq: ok | 17:08 |
| *** jaosorior_ has joined #openstack-keystone | 17:08 | |
| samueldmq | henrynash: perhaps an intermediate approach could be (for now) just split the policy between RBAC vs scope checks | 17:08 |
| *** jaosorior_ is now known as jaosorior | 17:09 | |
| samueldmq | henrynash: the scope check policy reflects what is in the code and deployers receive warnings if they're changing the default | 17:09 |
| henrynash | samueldmq: could you give me an example of how that would look? | 17:09 |
| samueldmq | henrynash: the RBAC policy may be customized as they want | 17:09 |
| samueldmq | henrynash: sure | 17:10 |
| * ayoung totally not snooping | 17:10 | |
| *** ninag_ has quit IRC | 17:10 | |
| samueldmq | henrynash: 2 files, 1 for RBAC, 1 for scope check | 17:10 |
| samueldmq | ayoung: hey :-) | 17:10 |
| * ayoung not here...carry on | 17:10 | |
| samueldmq | ehhe | 17:10 |
| jorge_munoz | stevemar: Hey Steve, I have an item I want to add to the meeting agenda for next week. Is it ok if i clear it or would you like to do it? | 17:10 |
| samueldmq | henrynash: so, scope is hardcoded in python code AND in the scope policy | 17:11 |
| samueldmq | henrynash: deployers can still customize scope check, but they will receive warnings (kind of what nova proposed a few months ago) | 17:11 |
| *** ninag has joined #openstack-keystone | 17:11 | |
| henrynash | samueldmq: hmm….perhaps…don;t liek that we might have misisng lines etc….. | 17:11 |
| samueldmq | RBAC policy contains only roles checks (and can eventually be enforced in the middleware cc ayoung) | 17:12 |
| henrynash | samueldmq: is there anyway we can just let teh policy line override what is in code | 17:12 |
| samueldmq | henrynash: yes, you can override the scope check that is in the code with the scope_policy.json | 17:12 |
| henrynash | samueldmq: splitting it is hard, since one of my concerns is taht you need to match up specific roles and specific scope checks | 17:12 |
| henrynash | (I meant without having two files) | 17:13 |
| samueldmq | yeah, but the idea would be to have 2 files | 17:13 |
| samueldmq | because: | 17:13 |
| samueldmq | 1) policy_rbac may be enforced at middleware later, so it'd be easier | 17:13 |
| samueldmq | 2) if (after a survey) we discover nobody customizes scope checks, we may just remove support for scope_policy.json | 17:14 |
| samueldmq | and just use what's in the code | 17:14 |
| *** petertr7 is now known as petertr7_away | 17:14 | |
| samueldmq | this would result in what I was proposing to you yesterday, but won't remove the ability to customize scope checks if people want it | 17:15 |
| henrynash | samueldmq: so I can tell you 100% IBM will use specific scope checks…and if you enforced it in code, we wold endup forking keystone | 17:15 |
| henrynash | to remove that | 17:15 |
| henrynash | it’s that cut and dried for me | 17:15 |
| samueldmq | henrynash: not if you can still override that in scope_policy.json right? | 17:15 |
| *** ninag has quit IRC | 17:15 | |
| *** jistr has joined #openstack-keystone | 17:16 | |
| henrynash | what I a syaing is there is no way you can remove that capability wihout a disaster for us | 17:16 |
| ayoung | henrynash, BTW, for the admin override (cloud_admin, unscoped) we duplicate that check in both policy files/ role check and scope | 17:16 |
| ayoung | henrynash, so, it is nova looking for policy in cod | 17:17 |
| ayoung | e | 17:17 |
| henrynash | if I could wave the wand I would absoluely do all teh checks in one file (scope and role) and take it all OUT of code across all projcets | 17:17 |
| ayoung | henrynash, um...well, grab the dynamic policy code that samueldmq did last summer and you can do exactly that | 17:18 |
| *** jistr has quit IRC | 17:18 | |
| ayoung | henrynash, but, the issue for most of openstack is that the role check is pretty static | 17:18 |
| henrynash | so this is going, imho, in teh wrong direction…but if everything thinks it’s teh right way to go, well ahve to take our wounds and patch/fork where required | 17:18 |
| samueldmq | default in the code is just the default. they should still be able to customize in policy file anyways | 17:18 |
| henrynash | ayoung: not for us, they’re not | 17:19 |
| henrynash | we modify every line of every pociy file | 17:19 |
| ayoung | henrynash, what are you matching on that needs to be custom? Is it something generalizable? | 17:19 |
| samueldmq | henrynash: good to know | 17:19 |
| notmorgan | henrynash: scope check in policy seems like the wrong direction fwiw | 17:19 |
| henrynash | ok, not every line, but most | 17:19 |
| samueldmq | :) | 17:19 |
| notmorgan | since that requires a resource to be loaded after the "are you allowed to call X API" check | 17:20 |
| samueldmq | yeah, this isn't just authz (rbac) | 17:20 |
| ayoung | henrynash, specifically: this custome scope check you are doing. Does it have to be done based on the resource being looked up in the database, or is there enough information in the request itself? | 17:20 |
| notmorgan | henrynash: what are y... what ayoung just asked | 17:20 |
| ayoung | :) | 17:20 |
| henrynash | ayoung: let me think about that | 17:20 |
| notmorgan | ayoung: damn it.. you're typing faster than i am today | 17:20 |
| *** richm has quit IRC | 17:20 | |
| *** nkinder has quit IRC | 17:21 | |
| ayoung | notmorgan, I'm still on a high from ImpliedRoles merging nad Keystone HTTPD passing Tripleo CI | 17:21 |
| ayoung | those are like my major tasks for this release | 17:21 |
| henrynash | ayoung: so for keystone it probably does, for most of the other services you can do it from the request (I thnk) | 17:21 |
| ayoung | henrynash, so, if it can be done from the request, we would put it into the role check side of policy | 17:22 |
| ayoung | Keystone we can always one-off. We always do... | 17:22 |
| *** mylu has quit IRC | 17:22 | |
| henrynash | ayoung: so today that’s probably OK….i’m still very uneasy about this direction, but hey | 17:23 |
| ayoung | henrynash, the goal here is to get something that can vary from deployment to deployment. | 17:23 |
| ayoung | henrynash, would you ever want to remove the scope checks that Nova or Neutron code in? | 17:23 |
| ayoung | Additive checks done this way are easy. | 17:23 |
| ayoung | its the removal of checks that is going to make things difficult for you. | 17:23 |
| henrynash | ayoung: to be clear, we expect multple, radically different, keystone policy files to be in play across diffent deployemnts, where we could NOT do scope checks in code (without changing keystoen for each one) | 17:24 |
| notmorgan | henrynash: can you give a real example of one of these cases? | 17:25 |
| mc_nair | hey there - two questions... 1) If you do a "list_projects" as cloud admin, do you get *all* projects that exist in Keystone? 2) Can there be multiple users with the cloud_admin role? | 17:25 |
| notmorgan | i'm trying to avoid the abstract of "we can't", well what was the limitation :) | 17:25 |
| henrynash | ayoung: ideally, in some case, we would bypass thsoe checks yes, but we can work round them | 17:25 |
| notmorgan | maybe it's something we can fix. | 17:25 |
| notmorgan | without needing to depart drastically / force your forking | 17:25 |
| samueldmq | notmorgan:++ | 17:26 |
| *** _cjones_ has joined #openstack-keystone | 17:26 | |
| henrynash | notmorgan: so oslo.policy allows you do use external Polciy Decisions Points (PDPs)….where some other system is making all or part of the go/no-go deciions…you can do that today with oslo policy, I don’t really want it to go away | 17:27 |
| henrynash | mc_nair: i general, list_projects() without a domain_id filter will list all the projects | 17:28 |
| notmorgan | henrynash: you're going to hate me, but ... user story, please. concrete example of what is being solved. | 17:28 |
| *** mhickey has quit IRC | 17:28 | |
| notmorgan | henrynash: it really does help us all end up on the same page. | 17:29 |
| mc_nair | henrynash: perfect thanks. Any exceptions to that (other than passing domain_id / user_id)? | 17:30 |
| ayoung | notmorgan, I'm kindof with you here: "It breaks our secret sauce" is not something that makes me want to cooperate | 17:31 |
| notmorgan | ayoung: i also have assurances from people in IBM that it shouldn't be "secret sauce" | 17:32 |
| ayoung | henrynash, so, we are willing to work with you, but you need to give us some veggies for our stone soup here. Note that this policy thing is bigger than Keystone | 17:32 |
| notmorgan | ayoung: and i am willing to believe it. | 17:33 |
| ayoung | notmorgan, really, I am so surprised | 17:33 |
| henrynash | notmorgan: so maybe the policy deicsion involves state that exists in other systems - e.g. maybe your application has not just openstack services, but other higher level services (sorry, I can’t share the specifics) and that higher level service is in charge of overall application resource allocation | 17:33 |
| *** jsavak has quit IRC | 17:33 | |
| ayoung | henrynash, are you just asking that we not diable the http check? | 17:34 |
| ayoung | disable | 17:34 |
| ayoung | diablo | 17:34 |
| henrynash | ayoung: I’m asking not to discable http check (or teh abiity add new oslo polcicy plugins) that has access to both the scope and role ifo that they have today | 17:34 |
| ayoung | henrynash, I can accept that; for example, I could see doing an LDAP query at that point for ownership of the VM itself prior to destroying it | 17:35 |
| henrynash | ayoung: that’s a good enough example | 17:35 |
| ayoung | henrynash, so , splitting the check would work for you, but not coding the policy check in Python, because we need to allow for a remote PDP call based on the contract we've set out | 17:36 |
| ayoung | I think that is fair | 17:36 |
| ayoung | samueldmq, what if... | 17:37 |
| ayoung | the scoped policy check is hardcoded, but also allows a scope-policy.json file for additional checks | 17:37 |
| notmorgan | ayoung: i think that is always going to be the case | 17:37 |
| notmorgan | to be honest | 17:37 |
| samueldmq | ayoung: that's what i was saying | 17:37 |
| ayoung | and an option there to say..."only use the policy.json version for this check, not the default" | 17:37 |
| notmorgan | i don't care if nova hard-codes a scope chck | 17:37 |
| samueldmq | and scope-policy.json can override what's in the code | 17:38 |
| notmorgan | we'll always be able to do the normal policyu.json thing | 17:38 |
| samueldmq | and only scope checks are in the code (hardcoded) | 17:38 |
| notmorgan | which could include external checks | 17:38 |
| notmorgan | right now if your scope doesn't match tenant for example, nova rejects it [in code] | 17:38 |
| ayoung | So...we would have a range of options. | 17:38 |
| notmorgan | not in policy.json | 17:38 |
| *** spandhe_ has joined #openstack-keystone | 17:38 | |
| notmorgan | that wont ever preclude using an external <thing> too | 17:39 |
| samueldmq | notmorgan: yes that's true | 17:39 |
| ayoung | lets say this lands in ... what was O called again? Ocelot? | 17:39 |
| notmorgan | otaka i think? | 17:39 |
| openstackgerrit | Merged openstack/keystone: Deprecate simple_cert extension https://review.openstack.org/274479 | 17:39 |
| samueldmq | notmorgan: what I argue is that we should be able to customize what's in the code by default | 17:39 |
| samueldmq | with a scope-policy.json :) | 17:39 |
| notmorgan | samueldmq: i'll argue against that | 17:39 |
| *** spandhe has quit IRC | 17:39 | |
| *** spandhe_ is now known as spandhe | 17:39 | |
| ayoung | If you upgrade from Newton to Ottawa and you make no changes, the existing policy.json file will work just fine | 17:39 |
| ayoung | stage 2 | 17:39 |
| notmorgan | until i have a clear example of where it's needed. | 17:39 |
| notmorgan | i wont argue for removing external check things | 17:40 |
| samueldmq | notmorgan: remove flexibility then ? and just leave the hardcoded checks ? | 17:40 |
| notmorgan | or take away functionality | 17:40 |
| ayoung | if you deploy new, or run an upgrade script of some form, the policy will be split by default | 17:40 |
| notmorgan | they can still do it in the normla policy stuff | 17:40 |
| notmorgan | we will maintain it | 17:40 |
| notmorgan | just move away from it being the default | 17:40 |
| notmorgan | scope check in nova, keystone, etc will continue to be coded. | 17:40 |
| ayoung | the changes will be, I think minimal | 17:40 |
| notmorgan | same as today. | 17:40 |
| notmorgan | just more focused on splitting them | 17:40 |
| samueldmq | my usecase for splitting policies is that almost eveyone runs on defaults, and when they customize, most of them customize the roles | 17:41 |
| notmorgan | right | 17:41 |
| henrynash | notmorgan: we do scope checks in code in keystone today? | 17:41 |
| notmorgan | so.. we move devstack towards role check only. | 17:41 |
| notmorgan | henrynash: we do. | 17:41 |
| ayoung | we will change the policy.json file with default-scope-policy.json | 17:41 |
| notmorgan | henrynash: every project does | 17:41 |
| ayoung | and add in the check for default-rbac.json in the middleware layer | 17:41 |
| notmorgan | henrynash: it's the callback things in the @protected decorator | 17:41 |
| notmorgan | it's horribly confusing and hard to follow, but it ends up being a coded-scope check | 17:42 |
| ayoung | default-scope-policy will come along with an extension to oslo-policy which allows for "ignore hardcoded check" | 17:42 |
| notmorgan | for ownership. not always in policy.json | 17:42 |
| samueldmq | ayoung: so policy.json becomes rbac-policy.json and scope-policy.json | 17:42 |
| ayoung | samueldmq, yes | 17:42 |
| ayoung | I think so | 17:42 |
| samueldmq | ayoung: rbac-policy.json can be enforced in middleware | 17:42 |
| notmorgan | samueldmq: again, please don't do that :( | 17:42 |
| henrynash | notmorgan: I don’t think so….it just loads more taget objects and hands them to oslo policy | 17:42 |
| ayoung | notmorgan, well, scope-policy.json would be empty by default | 17:42 |
| samueldmq | notmorgan: why not? we're just making it easier to understand, and rbac-policy would be true rbac :/ | 17:42 |
| notmorgan | henrynash: oslo-polciy does the hit, but it is a hardcoded "is this in scope?" | 17:43 |
| notmorgan | henrynash: not "policy.json" loaded | 17:43 |
| ayoung | notmorgan, yeah... | 17:43 |
| ayoung | notmorgan, you have the option to override, but the default is to use the logic in the python code | 17:43 |
| henrynash | notmorgan: I need to check that….since that sure as hell wasn’t how I wrote it orginally (sorry, it was me) | 17:43 |
| notmorgan | henrynash: next week i'm breaking the decorators apart completely | 17:44 |
| ayoung | henrynash, that is fine. THis requirement, to keep the remote PDP check, is new to me. But understandable | 17:44 |
| notmorgan | henrynash: so i'll be able to be more certain | 17:44 |
| notmorgan | it's impossible to know what is happening atm with the levels of indirection :( | 17:44 |
| ayoung | and it is also, I think, not on the radar for the folksin Nova that are tacklingthis, which is your real risk here | 17:44 |
| samueldmq | ayoung: actually the default could be exactly the same what is in the python code, so can be easily seen by deloyers | 17:44 |
| notmorgan | henrynash: and not your fault you hit exactly what was asked of you | 17:44 |
| samueldmq | ayoung: the default of scope-policy ..; | 17:44 |
| ayoung | samueldmq, yeah...we can do it either way: have the polic in the jso or in code | 17:45 |
| *** jsavak has joined #openstack-keystone | 17:45 | |
| notmorgan | ayoung: i'm still going to beg for a better user-story than "we might want an external PDP". | 17:45 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 17:45 |
| ayoung | and the json could be a documentation of what the code does, but I would worry that they would get out of sync | 17:45 |
| notmorgan | ayoung: before we march down this path. so i'd like henry to really lock in the cases he's solving | 17:45 |
| samueldmq | ayoung: do both, and json overrides the code; this way we loose no flexibility | 17:45 |
| henrynash | ayoung: so we get round it by giving everyone a basic role on all projects…and then this is never looked at in the polciy checks…it just gets us through the tenant check | 17:45 |
| ayoung | notmorgan, how about "We don't likethe scope chekcs that neutron is ddoing for sharing networks, they don't match our approach" | 17:46 |
| notmorgan | so we know what we are solving for. a clear specification | 17:46 |
| samueldmq | notmorgan: that makes sense | 17:46 |
| ayoung | they do some weirdness | 17:46 |
| notmorgan | ayoung: no. | 17:46 |
| notmorgan | ayoung: that is not a user story | 17:46 |
| notmorgan | that is a "i want a thing and am not telling you what but it's not what you're doing" | 17:46 |
| ayoung | notmorgan, have you looked at neutron's policy.json? | 17:47 |
| notmorgan | it's insane | 17:47 |
| ayoung | Its weeeeeeiiieieieierd | 17:47 |
| ayoung | notmorgan, so, if they leave it in JSON, we're fine | 17:47 |
| notmorgan | doesn't mean it helps us hit a target cleanly othwerwise | 17:47 |
| ayoung | its only the cae where they code that into Python, and the deployer really does not want it, that I think we would be rescuing here | 17:47 |
| notmorgan | so, before we split this. i am a hard -2 on that split until we define the usecase we're solving for | 17:48 |
| notmorgan | thats all | 17:48 |
| notmorgan | define a couple concrete stories so we make sure we hit them | 17:48 |
| ayoung | notmorgan, but, agree, would like to know what the external checks are | 17:48 |
| ayoung | ++ | 17:48 |
| notmorgan | and then i'll 100% support moving down that path :) | 17:48 |
| ayoung | notmorgan, so, today...could we limit it to an optional, role only policy check that is done in middleware, for keystone only? | 17:48 |
| ayoung | prrof of concept like? | 17:48 |
| notmorgan | i'm just going to be a real stickler for this because i want to make sure we're not engineering for a very very very narrow one off case that could be solved elsewhere | 17:49 |
| notmorgan | ayoung: again, define the concrete user story, i'm happy to support engineering/pocing/etc after that | 17:49 |
| ayoung | notmorgan, and...we can tell people that they should be using the v3 cloud sample by default, and maybe rename it? | 17:49 |
| notmorgan | ayoung: i'm not going to be super picky about the result as long as we know what the target is | 17:49 |
| notmorgan | and make sure it isn't tyring to just be flexible for the sake of flexible | 17:50 |
| notmorgan | ayoung: sure we can do that - all of it - just lets make sure we have a super clear target to hit | 17:50 |
| ayoung | notmorgan, I wonder if the external PDP check could be a single config value instead of in each line of a policy file | 17:51 |
| notmorgan | it might be | 17:51 |
| samueldmq | notmorgan: but we maybe need to keep flexible just for backwards compat | 17:51 |
| notmorgan | that might be the right choice. | 17:51 |
| notmorgan | samueldmq: we will always support "today" workflow | 17:51 |
| notmorgan | that wont break | 17:51 |
| samueldmq | where flexible == customize scope checks | 17:51 |
| ayoung | samueldmq, yeah, that was my thinking | 17:51 |
| notmorgan | even if we change directions | 17:51 |
| notmorgan | but we can't know how to stay reverse compat w/o having a target to hit/evaluate if it can be reverse compat | 17:52 |
| ayoung | samueldmq, can you start a spec with the "split keystone policy" title or something that let's us capture the first step? | 17:52 |
| notmorgan | samueldmq: just like the convo yesterday on how we get user->svc and svc->svc to change, but would still maintain "working" as it does today | 17:52 |
| notmorgan | ayoung: ++ | 17:52 |
| ayoung | lets not try to solve thisfor all of openstack until we have a clear way it will work in a single service | 17:52 |
| notmorgan | ayoung: wfm. | 17:53 |
| *** ninag has joined #openstack-keystone | 17:53 | |
| ayoung | now is a goodtime to start thinking about the specs we are going to need to implement in Newton. | 17:53 |
| notmorgan | samueldmq: and please focus on the "problem description" and what we're trying to solve / the concrete use case | 17:53 |
| samueldmq | notmorgan: yeah, and will be great if these two convos can go in parallel | 17:53 |
| ayoung | OK, lunch | 17:53 |
| notmorgan | the API things and security impact, etc isn't as important as having the clear target of what we're solving | 17:53 |
| samueldmq | notmorgan: even if they're orthogonal | 17:53 |
| notmorgan | samueldmq: yep | 17:53 |
| samueldmq | ayoung: notmorgan: yes, I will give a first try, and will work together with you and henrynash to make it good/well defined enough | 17:54 |
| notmorgan | ++ | 17:54 |
| henrynash | ayoung: and I want to understand the drive for that…..we seem chizophrenic about this….we say nobody is changing policy files, so we think we need to fix them by removing teh current ability, while we think (at least some of us do) that the future is more coustomization of policy | 17:55 |
| notmorgan | also ayoung knows what i am looking for | 17:55 |
| *** amit213 has joined #openstack-keystone | 17:55 | |
| notmorgan | so use him too as a resource | 17:55 |
| samueldmq | ++ | 17:55 |
| *** timcline has quit IRC | 17:55 | |
| *** amit213 has quit IRC | 17:55 | |
| notmorgan | henrynash: honestly part of openstack's issue is it is not opinionated enough - it is everything to everyone for everyreason - so a lot of implmeentation details leak out the APIs to the end users | 17:56 |
| notmorgan | henrynash: so the solution is to tighten that up. | 17:56 |
| samueldmq | henrynash: I think we want people to customize, and that's why we are trying to make customization an easier task | 17:56 |
| notmorgan | henrynash: regardless of how. | 17:56 |
| henrynash | notmorgan: and unfortunately you and I have opposite views on this…I do NOT want us yto be opinionated here, and I know that you think we should be | 17:56 |
| notmorgan | henrynash: so if we're changing things - we want clear targets. | 17:56 |
| *** amit213 has joined #openstack-keystone | 17:56 | |
| notmorgan | henrynash: we should abolutely be opinionated here. | 17:56 |
| notmorgan | henrynash: making sure we are opinionated enough to not leak implementation details | 17:57 |
| notmorgan | that is how far we need to move the needle | 17:57 |
| notmorgan | right now we leak a bunch of details in all ways | 17:57 |
| *** ayoung has quit IRC | 17:58 | |
| notmorgan | so, if we're changing it, define the cases we need to ensure work, then work on making it so we don't leak backend. | 17:58 |
| notmorgan | and the end user experience is the same if an external PDP is used or the simple policy.json | 17:58 |
| notmorgan | they get the same results for the same accept/deny cases | 17:58 |
| notmorgan | *and* make sure we test it | 17:58 |
| notmorgan | because in openstack if we don't test it, it is broken | 17:59 |
| henrynash | notmorgan: so agree with the not leaking part….I’m just not sure I’d describe the solution as being opionated, we may have different views of WHAT we need to be opionated about | 17:59 |
| notmorgan | opinionated = it works like X in all cases, regardless of backend | 17:59 |
| henrynash | notmogran: and I agree with all those last 5 points | 17:59 |
| notmorgan | which means you cater to a specific workflow | 17:59 |
| henrynash | notmorgan: so when you see opionated, I hear “we lock down your options and you can only do it this way" | 18:00 |
| notmorgan | if the backend can't support the workflow, we either did a bad job of speccing it out or the backend is solving something the workflow doesn't need | 18:00 |
| notmorgan | henrynash: it does lock down a lot of options | 18:00 |
| notmorgan | heck i would love to be more opinionated about somethings and drop pgsql | 18:00 |
| notmorgan | from "officially supported" | 18:00 |
| *** spzala has joined #openstack-keystone | 18:01 | |
| notmorgan | it doesn't mean another db backend can't work, it means you might need to put work into it so it does | 18:02 |
| notmorgan | and might need to test it yourself. | 18:02 |
| henrynash | notmorgan: I don’t see it that way (not pgsql), but I agree with your comment taht we have to build our backends so you can’t tell (at the API level) which implemtation options are being used under the hood | 18:02 |
| notmorgan | aka db2 right now | 18:02 |
| notmorgan | so, we need to be more opinionated of our workflows and what we're solving | 18:02 |
| notmorgan | having a blob of "oh do things in .json and it just works and can do anything i want" | 18:02 |
| notmorgan | opens the doors for a lot of bugs, edge cases, etc | 18:03 |
| notmorgan | since we're changing things, document the clear workflow how it needs to happen, the user story, the problem space and then we have a target | 18:03 |
| notmorgan | yes it limites the options | 18:03 |
| notmorgan | but it also gives a clear supported scope | 18:03 |
| *** jsavak has quit IRC | 18:04 | |
| notmorgan | so when someone says "i did X and it didn't work" we can clearly say "bug, it should" or "whoa.... that is never going to work because it isn't designed to work like that, and we need to consider if that is something we're solving for" | 18:04 |
| notmorgan | henrynash: so to be clear, i'm saying don't change anything today until we know what we're solving for, not just harping on your needs | 18:05 |
| notmorgan | henrynash: and we have a clearly defined target | 18:05 |
| *** lhcheng_ has joined #openstack-keystone | 18:05 | |
| henrynash | notmorgan: so certainly agee with “if we gonna chaneg what we have, be clear of what we are chaing it for" | 18:05 |
| notmorgan | if we hard-code a scope check, we better know what our design for doing that is. so we can justify it where needed when asked. | 18:05 |
| notmorgan | in the process we will lock down/lock out some options. | 18:06 |
| notmorgan | but we will know what the workflow ends up being | 18:06 |
| notmorgan | and how it should look. | 18:06 |
| notmorgan | henrynash: so.. work with samueldmq and get the concrete uses defined then we can make sure new system works without leaking backend and we aren't trying to be everything for everyone, solving for the real problems (heck some of your problem statements may be super easy as part of the baseline) | 18:08 |
| notmorgan | it's something we've been bad at in keystone [and openstack in general], very concrete problem statements and use-case definitions. it's why we get weird apis and strange felxibilyt that leaks details | 18:09 |
| samueldmq | notmorgan: I understand your "be opinionated" as, get a list of use cases, and make our implementation works for them VS trying to do something too generic that solves every usecase plus something else that may come in the future | 18:09 |
| notmorgan | samueldmq: yep | 18:09 |
| notmorgan | spot on | 18:09 |
| samueldmq | notmorgan: ++ | 18:09 |
| samueldmq | henrynash: I will draft a spec, and we can work together on putting more clarity/details and use-cases on it | 18:10 |
| samueldmq | henrynash: sounds a good plan? | 18:10 |
| *** samueldmq has quit IRC | 18:12 | |
| *** samueldmq has joined #openstack-keystone | 18:16 | |
| *** browne has quit IRC | 18:20 | |
| *** jimbaker has left #openstack-keystone | 18:25 | |
| *** diazjf has quit IRC | 18:26 | |
| *** timcline has joined #openstack-keystone | 18:26 | |
| *** e0ne has joined #openstack-keystone | 18:28 | |
| *** timcline has quit IRC | 18:30 | |
| *** spzala has quit IRC | 18:31 | |
| *** spzala has joined #openstack-keystone | 18:32 | |
| *** spzala_ has joined #openstack-keystone | 18:34 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Remove bandit tox environment https://review.openstack.org/269260 | 18:36 |
| *** spzala has quit IRC | 18:36 | |
| *** samueldmq has quit IRC | 18:39 | |
| *** spzala_ has quit IRC | 18:39 | |
| *** pnavarro|afk has quit IRC | 18:39 | |
| *** diazjf has joined #openstack-keystone | 18:41 | |
| *** petertr7_away is now known as petertr7 | 18:47 | |
| openstackgerrit | Merged openstack/keystone: Consolidate the fernet provider validate_v3_token() https://review.openstack.org/196877 | 18:48 |
| *** jsavak has joined #openstack-keystone | 18:51 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/272790 | 18:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/276393 | 18:55 |
| *** clenimar has quit IRC | 18:58 | |
| *** browne has joined #openstack-keystone | 18:59 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/272825 | 18:59 |
| *** jasonsb has quit IRC | 19:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 19:03 |
| *** jsavak has quit IRC | 19:03 | |
| *** dansmith has quit IRC | 19:05 | |
| *** dansmith has joined #openstack-keystone | 19:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: AuthContextMiddleware admin token handling https://review.openstack.org/198931 | 19:06 |
| *** diazjf has quit IRC | 19:07 | |
| *** diazjf has joined #openstack-keystone | 19:09 | |
| *** timcline has joined #openstack-keystone | 19:10 | |
| *** david-lyle has quit IRC | 19:11 | |
| *** ayoung has joined #openstack-keystone | 19:13 | |
| *** ChanServ sets mode: +v ayoung | 19:13 | |
| *** spzala has joined #openstack-keystone | 19:13 | |
| *** spzala has quit IRC | 19:15 | |
| *** spzala has joined #openstack-keystone | 19:15 | |
| *** jbell8 has quit IRC | 19:18 | |
| *** csoukup has joined #openstack-keystone | 19:18 | |
| *** jaosorior has quit IRC | 19:19 | |
| *** jbell8 has joined #openstack-keystone | 19:19 | |
| *** jorge_munoz has quit IRC | 19:33 | |
| *** jsavak has joined #openstack-keystone | 19:37 | |
| ayoung | lbragstad, are you doing development inside of a Docker container? | 19:41 |
| lbragstad | ayoung nope | 19:41 |
| *** jsavak has quit IRC | 19:46 | |
| *** jsavak has joined #openstack-keystone | 19:47 | |
| bknudson_ | docker docker docker! | 19:51 |
| *** diazjf has quit IRC | 19:52 | |
| *** diazjf has joined #openstack-keystone | 19:55 | |
| *** topol has quit IRC | 19:56 | |
| *** stevemar has quit IRC | 19:56 | |
| *** jorge_munoz has joined #openstack-keystone | 20:03 | |
| *** ayoung has quit IRC | 20:04 | |
| notmorgan | bknudson_: shhh | 20:04 |
| openstackgerrit | guang-yee proposed openstack/keystone: wsgi: fix base_url finding https://review.openstack.org/226464 | 20:05 |
| *** gyee has quit IRC | 20:05 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Provide an error message if downgrading schema https://review.openstack.org/276296 | 20:10 |
| *** vgridnev has quit IRC | 20:11 | |
| *** diazjf has quit IRC | 20:15 | |
| *** jgriffith_away is now known as jgriffith | 20:19 | |
| *** jbell8 has quit IRC | 20:21 | |
| *** pnavarro|afk has joined #openstack-keystone | 20:21 | |
| *** jbell8 has joined #openstack-keystone | 20:22 | |
| *** slberger has quit IRC | 20:26 | |
| *** spzala has quit IRC | 20:30 | |
| *** cdcasey has quit IRC | 20:31 | |
| *** mylu has joined #openstack-keystone | 20:31 | |
| *** diazjf has joined #openstack-keystone | 20:31 | |
| *** jgriffith is now known as jgriffith_away | 20:31 | |
| *** ninag has quit IRC | 20:32 | |
| *** ninag has joined #openstack-keystone | 20:32 | |
| *** slberger has joined #openstack-keystone | 20:33 | |
| *** stevemar has joined #openstack-keystone | 20:36 | |
| *** ChanServ sets mode: +o stevemar | 20:36 | |
| *** su_zhang_ has quit IRC | 20:36 | |
| *** phalmos_ has joined #openstack-keystone | 20:38 | |
| *** ninag has quit IRC | 20:38 | |
| *** BrAsS_mO- has joined #openstack-keystone | 20:40 | |
| *** jed56_ has joined #openstack-keystone | 20:41 | |
| *** wolsen_ has joined #openstack-keystone | 20:41 | |
| *** rvba` has joined #openstack-keystone | 20:42 | |
| *** vgridnev has joined #openstack-keystone | 20:45 | |
| *** briancurtin_ has joined #openstack-keystone | 20:45 | |
| *** jbell8 has quit IRC | 20:46 | |
| *** jbell8 has joined #openstack-keystone | 20:47 | |
| *** diazjf has quit IRC | 20:47 | |
| *** jed56 has quit IRC | 20:47 | |
| *** phalmos has quit IRC | 20:47 | |
| *** rvba has quit IRC | 20:47 | |
| *** briancurtin has quit IRC | 20:47 | |
| *** BrAsS_mOnKeY has quit IRC | 20:47 | |
| *** crinkle has quit IRC | 20:47 | |
| *** lennyb has quit IRC | 20:47 | |
| *** dulek has quit IRC | 20:47 | |
| *** wolsen has quit IRC | 20:47 | |
| *** jed56_ is now known as jed56 | 20:48 | |
| *** lennyb has joined #openstack-keystone | 20:48 | |
| *** briancurtin_ is now known as briancurtin | 20:48 | |
| *** mylu has quit IRC | 20:49 | |
| *** diazjf has joined #openstack-keystone | 20:49 | |
| *** crinkle has joined #openstack-keystone | 20:49 | |
| *** dulek has joined #openstack-keystone | 20:49 | |
| *** crinkle has quit IRC | 20:49 | |
| *** dulek has quit IRC | 20:50 | |
| *** mylu has joined #openstack-keystone | 20:50 | |
| *** diazjf has quit IRC | 20:50 | |
| *** stevemar has quit IRC | 20:52 | |
| *** mylu has quit IRC | 20:52 | |
| *** gordc has quit IRC | 20:52 | |
| *** mylu has joined #openstack-keystone | 20:54 | |
| *** jbell8 has quit IRC | 20:54 | |
| *** ninag has joined #openstack-keystone | 20:54 | |
| *** jbell8 has joined #openstack-keystone | 20:54 | |
| *** ninag has quit IRC | 20:59 | |
| *** ninag has joined #openstack-keystone | 21:01 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Allow no s3 package https://review.openstack.org/276444 | 21:02 |
| *** e0ne has quit IRC | 21:04 | |
| *** diazjf has joined #openstack-keystone | 21:05 | |
| *** raildo is now known as raildo-afk | 21:06 | |
| *** ninag has quit IRC | 21:06 | |
| *** mylu has quit IRC | 21:07 | |
| *** ericvw has joined #openstack-keystone | 21:08 | |
| *** ericvw has left #openstack-keystone | 21:10 | |
| *** esp_ has joined #openstack-keystone | 21:10 | |
| *** mylu has joined #openstack-keystone | 21:11 | |
| *** pnavarro|afk has quit IRC | 21:13 | |
| *** mylu has quit IRC | 21:13 | |
| edmondsw | henrynash, notmorgan... late to the party, but I tried skimming over the earlier conversation on scope checks. I'd like to be in the loop there. It's crazy to me that we don't have more hardcoded scope checks, at least as a basis that you can then add on top of | 21:13 |
| edmondsw | e.g. it would NEVER be a good idea to let someone with a token scoped to one project see things that are scoped to another project. Like what nova and cinder allow with their all_tenants stuff | 21:14 |
| *** esp_ has quit IRC | 21:14 | |
| *** slberger has quit IRC | 21:16 | |
| *** spzala has joined #openstack-keystone | 21:17 | |
| *** mvk has joined #openstack-keystone | 21:22 | |
| *** pauloewerton has quit IRC | 21:29 | |
| *** slberger has joined #openstack-keystone | 21:35 | |
| notmorgan | edmondsw: did you see my response to auth_token_+admin thing | 21:36 |
| edmondsw | did you see mine? | 21:36 |
| notmorgan | and if bootstrap doesn't meet your needs that is what we want to improve | 21:37 |
| *** su_zhang has joined #openstack-keystone | 21:37 | |
| notmorgan | edmondsw: i'll look in a bit just getting into a meeting | 21:38 |
| notmorgan | edmondsw: so will respond again soon | 21:38 |
| edmondsw | notmorgan, tx. It definitely doesn't seem to have been designed to do what I need, but at a glance it looked like it might work, anyway. I'd have to try it, and I don't have a real easy way to do that atm | 21:38 |
| *** su_zhang_ has joined #openstack-keystone | 21:38 | |
| notmorgan | yeah | 21:38 |
| edmondsw | notmorgan, besides that, there was my comment on the releasenotes for you to look at... tx | 21:39 |
| notmorgan | right thnx! | 21:39 |
| *** su_zhang has quit IRC | 21:42 | |
| *** ninag has joined #openstack-keystone | 21:42 | |
| *** gordc has joined #openstack-keystone | 21:49 | |
| *** mylu has joined #openstack-keystone | 21:51 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 21:54 |
| *** mylu has quit IRC | 21:56 | |
| lbragstad | jorge_munoz https://github.com/openstack/keystone/blob/master/keystone/trust/schema.py | 21:57 |
| *** mylu has joined #openstack-keystone | 21:57 | |
| *** mylu has quit IRC | 21:58 | |
| *** jed56 has quit IRC | 22:03 | |
| notmorgan | dolphm: LOL at the typo'd channel | 22:05 |
| *** clenimar has joined #openstack-keystone | 22:06 | |
| *** clenimar has quit IRC | 22:07 | |
| *** clenimar has joined #openstack-keystone | 22:07 | |
| *** jamielennox|away is now known as jamielennox | 22:10 | |
| notmorgan | bknudson_, topol: S3 and Ec2, use policy.json | 22:10 |
| notmorgan | bknudson_: make it a deny rule for any/all scopes | 22:10 |
| bknudson_ | lawyers told us we needed to remove the code entirely | 22:10 |
| notmorgan | wtf. | 22:10 |
| notmorgan | seriously?! | 22:10 |
| notmorgan | this is why i wanted to make this defcore | 22:10 |
| notmorgan | required | 22:11 |
| bknudson_ | then we wouldn't be compliant | 22:11 |
| notmorgan | and you'd need to have it and 403 it | 22:11 |
| *** henrynash has quit IRC | 22:11 | |
| notmorgan | that was sprecifically what i was trying to do | 22:11 |
| notmorgan | it is impossible for end users to develop sanely against a cloud if some APIs return 404 because they were removed instead of blocked | 22:12 |
| bknudson_ | in this case they're developing against AWS and not openstack | 22:13 |
| openstackgerrit | Ronald Bradford proposed openstack/keystone: Use oslo.log specified method to set log levels https://review.openstack.org/254253 | 22:13 |
| bknudson_ | not sure how always getting 403 is that much worse than 404. | 22:13 |
| notmorgan | bknudson_: because you know the API is telling you fly a kite vs "was the resource missing or was the api removed?" | 22:14 |
| notmorgan | bknudson_: then we should rm-rf it | 22:14 |
| notmorgan | bknudson_: and make it out of tree | 22:14 |
| * notmorgan is uncaring which way we go | 22:14 | |
| bknudson_ | I would like to see aws out of tree | 22:14 |
| notmorgan | but i am adamantly against "optional" apis | 22:15 |
| bknudson_ | but I wouldn't sign up to do the work since I don't want to be associated with it | 22:15 |
| *** petertr7 is now known as petertr7_away | 22:15 | |
| bknudson_ | nova moved their ec2 compat layer out of tree | 22:16 |
| notmorgan | yes | 22:16 |
| notmorgan | also doesn't heat require EC2 in keystone for some things? | 22:17 |
| notmorgan | but not on the nova side | 22:17 |
| *** vgridnev has quit IRC | 22:17 | |
| notmorgan | so, like i said, i am adamantly against optional APIs. if this means we need to punt it out, we punt it out. but that is where i draw the line | 22:17 |
| bknudson_ | I'm all for punting it out | 22:18 |
| notmorgan | bknudson_: make the folks doing the EC2 API | 22:18 |
| *** timcline has quit IRC | 22:18 | |
| bknudson_ | I can't make anybody do anything | 22:19 |
| notmorgan | so, we need to figure this out. | 22:19 |
| notmorgan | we should not carry any apis that are optional | 22:20 |
| notmorgan | at all | 22:20 |
| notmorgan | i don't care how we resolve it. | 22:20 |
| *** clenimar has quit IRC | 22:21 | |
| *** clenimar has joined #openstack-keystone | 22:21 | |
| *** jbell8 has quit IRC | 22:21 | |
| notmorgan | also looks like we had a massive netsplit | 22:21 |
| notmorgan | cause steve, topol and a bunch of tothers are not on irc | 22:21 |
| bknudson_ | their znc servers went down. | 22:21 |
| notmorgan | ah | 22:21 |
| bknudson_ | maybe we can deprecate aws in keystone and somebody will pick it up and move it into another service before it goes away | 22:23 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Move redelegated_trust_id out of extras https://review.openstack.org/276474 | 22:23 |
| notmorgan | works for me. and in this case i'd lazy import | 22:24 |
| notmorgan | if it's absolutely deprecated | 22:24 |
| notmorgan | with no plans for replacement | 22:24 |
| notmorgan | but i'll say i know a lot of people *like* EC2 key-pairs [to be honest i wish we used it instead of bearer tokens] | 22:25 |
| *** crinkle has joined #openstack-keystone | 22:25 | |
| bknudson_ | it would be nice if it wasn't a proprietary api | 22:26 |
| notmorgan | yeh | 22:26 |
| bknudson_ | https://www.eff.org/cases/oracle-v-google -- still not resolved | 22:27 |
| notmorgan | bknudson_: so pitch it as deprecated and i'm ok to lazy import | 22:29 |
| bknudson_ | alright, I can work on that. | 22:29 |
| notmorgan | bknudson_: i just refuse to budge on "optional apis" we are supporting longterm | 22:29 |
| notmorgan | bknudson_: if that makes sense. and deprecated 100% behind | 22:29 |
| notmorgan | without question :) | 22:29 |
| notmorgan | (i'd rather deprecate it if we don't want to support it, totally not invested in keeping it around or antyhign) | 22:30 |
| notmorgan | bknudson_: feel free to update my patch with that too | 22:30 |
| bknudson_ | if oracle v google goes the way of google then I expect the lawyers would allow it back in. | 22:31 |
| *** ninag has quit IRC | 22:44 | |
| *** mylu has joined #openstack-keystone | 22:44 | |
| openstackgerrit | Tom Cocozzello proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 22:46 |
| *** spzala has quit IRC | 22:47 | |
| *** david-lyle has joined #openstack-keystone | 22:48 | |
| *** gyee has joined #openstack-keystone | 22:48 | |
| *** ChanServ sets mode: +v gyee | 22:48 | |
| *** david-lyle has quit IRC | 22:52 | |
| *** diazjf has quit IRC | 22:57 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/276393 | 22:58 |
| *** mylu has quit IRC | 23:01 | |
| *** daemontool has quit IRC | 23:01 | |
| *** slberger has left #openstack-keystone | 23:01 | |
| *** ayoung has joined #openstack-keystone | 23:02 | |
| *** ChanServ sets mode: +v ayoung | 23:02 | |
| *** ayoung_ has joined #openstack-keystone | 23:03 | |
| *** phalmos_ has quit IRC | 23:04 | |
| *** mylu has joined #openstack-keystone | 23:06 | |
| *** clenimar is now known as clenimar_ | 23:07 | |
| *** clenimar_ is now known as clenimar | 23:08 | |
| *** erlarese has quit IRC | 23:12 | |
| *** clenimar has quit IRC | 23:25 | |
| *** aginwala has joined #openstack-keystone | 23:27 | |
| *** mgarza has quit IRC | 23:27 | |
| *** gordc has quit IRC | 23:28 | |
| *** chlong has quit IRC | 23:30 | |
| bigjools | hey guys, am I supposed to be able to override the client.Client with a version regardless of the URL passed in? | 23:31 |
| bigjools | http://pastebin.ubuntu.com/14883441/ | 23:31 |
| *** dims_ has quit IRC | 23:31 | |
| *** jamielennox is now known as jamielennox|away | 23:31 | |
| bigjools | because if I use a v3 URL and pass version=2, it goes boom | 23:31 |
| *** dims has joined #openstack-keystone | 23:32 | |
| *** spzala has joined #openstack-keystone | 23:33 | |
| *** csoukup has quit IRC | 23:33 | |
| *** spzala has quit IRC | 23:34 | |
| *** spzala_ has joined #openstack-keystone | 23:34 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:35 | |
| edmondsw | notmorgan, I vote rm-rf ec2/s3 | 23:46 |
| *** aginwala has quit IRC | 23:51 | |
| notmorgan | edmondsw: thats fine | 23:52 |
| notmorgan | edmondsw: i don't care either way :) | 23:53 |
| notmorgan | edmondsw: but supported API = on imo. | 23:53 |
| notmorgan | edmondsw: if that makes sense. | 23:53 |
| notmorgan | it could totally be something completely out of tree | 23:53 |
| notmorgan | and then not my problem :) | 23:53 |
| ayoung_ | bigjools, I'd expecct that | 23:53 |
| *** shoutm has joined #openstack-keystone | 23:54 | |
| bigjools | hey ayoung_ | 23:54 |
| bigjools | what's the recommended way to override the version it returns? | 23:54 |
| ayoung_ | bigjools, I think that the logic is the force of the version is only effective if you give it a versionless URL | 23:54 |
| bigjools | ah ok | 23:54 |
| * bigjools tries | 23:54 | |
| ayoung_ | bigjools, I sense you want to use V2 | 23:54 |
| bigjools | heh not me | 23:55 |
| bigjools | Rally :/ | 23:55 |
| ayoung_ | Ugh | 23:55 |
| notmorgan | Rally does their own very broken thing | 23:55 |
| ayoung_ | notmorgan, they don | 23:55 |
| bigjools | well hopefully not for much longer, I am currently in the middle of a long review to make it work rught | 23:55 |
| notmorgan | there is a way they support v2.. or v3.. or something but it's like they wend and just re-implemented their own thing | 23:55 |
| ayoung_ | 't use KSA right? | 23:55 |
| notmorgan | ayoung_: nope, they like just wholesale implemented their own way of authing | 23:55 |
| *** aginwala has joined #openstack-keystone | 23:56 | |
| bigjools | https://review.openstack.org/#/c/274977 is my change | 23:56 |
| ayoung_ | notmorgan, so...I'm finally learning Docker. Trying to get a dev setup. And...not sure if the mysql DB is supposed to be in the same container or a different. What would be more Pythonic er...Dockertastic? | 23:57 |
| notmorgan | ayoung_: one process per container | 23:57 |
| notmorgan | ayoung_: that is the general "thing" | 23:57 |
| notmorgan | or so i hear | 23:57 |
| ayoung_ | notmorgan, then do I need Kubernetes os something for multie container work? | 23:57 |
| bigjools | ayoung_: cool, removing version in url does the trick, thanks | 23:57 |
| notmorgan | docker swarm | 23:57 |
| notmorgan | kube | 23:58 |
| notmorgan | something like that | 23:58 |
| *** jsavak has quit IRC | 23:58 | |
| notmorgan | i haven't played much with it | 23:58 |
| notmorgan | just guessing based upon my limited knowledge | 23:58 |
| ayoung_ | notmorgan, its like venv, but for native code! | 23:58 |
| notmorgan | and also "not new technology" | 23:58 |
| notmorgan | :P | 23:58 |
| ayoung_ | notmorgan, ewindish had a devstack in docker hack: dockenstack | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!