| *** mylu has quit IRC | 00:02 | |
| *** jbell8 has quit IRC | 00:03 | |
| *** rm_work has quit IRC | 00:04 | |
| *** diazjf has joined #openstack-keystone | 00:05 | |
| *** agireud has quit IRC | 00:06 | |
| *** mylu has joined #openstack-keystone | 00:07 | |
| *** agireud has joined #openstack-keystone | 00:08 | |
| *** rm_work has joined #openstack-keystone | 00:09 | |
| *** mylu has quit IRC | 00:10 | |
| *** mylu has joined #openstack-keystone | 00:12 | |
| *** shoutm_ has joined #openstack-keystone | 00:15 | |
| *** shoutm has quit IRC | 00:17 | |
| bigjools | dstanek: how hard would it be to convert that stuff in ksfixtures to a standalone module that could go in oslotest? | 00:18 |
|---|---|---|
| bigjools | or anywhere, if that's not appropriate | 00:18 |
| *** e0ne has quit IRC | 00:18 | |
| *** notmorgan has left #openstack-keystone | 00:20 | |
| *** mylu has quit IRC | 00:20 | |
| *** notmorgan has joined #openstack-keystone | 00:23 | |
| *** ChanServ sets mode: +v notmorgan | 00:23 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/278163 | 00:31 |
| dstanek | bigjools: is any of if really usable beyond keystone? | 00:34 |
| bigjools | dstanek: I'd certainly find it useful to make a fixture in rally | 00:34 |
| bigjools | "make it and they will come" :) | 00:35 |
| *** aginwala has quit IRC | 00:53 | |
| *** aginwala has joined #openstack-keystone | 00:57 | |
| *** mylu has joined #openstack-keystone | 00:58 | |
| *** markvoelker has joined #openstack-keystone | 01:01 | |
| *** mylu has quit IRC | 01:02 | |
| *** mylu has joined #openstack-keystone | 01:04 | |
| *** gokrokve has joined #openstack-keystone | 01:05 | |
| *** gildub has joined #openstack-keystone | 01:06 | |
| dstanek | bigjools: i can see making a fixture in rally, but i'm not sure about using ours | 01:09 |
| bigjools | oh, any particular reason? | 01:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Disable the ipv6 tests in py34 https://review.openstack.org/278147 | 01:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Uses open context manager for templated catalogs https://review.openstack.org/278053 | 01:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 01:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 01:11 |
| dstanek | bigjools: i think they are pretty specific to the way we run tests. probably not all of them, but most of them | 01:12 |
| bigjools | fair enough | 01:12 |
| bigjools | I still think there's worth in a generic KeystoneFixture | 01:13 |
| bigjools | could even be a separate project | 01:13 |
| dstanek | bigjools: only if you make the unit tests a separate project, otherwise it wouldn't make sense | 01:13 |
| dstanek | i think the only generic one we have is temporaryfile and we should probably push that upstream | 01:14 |
| bigjools | not at all - for example https://pypi.python.org/pypi/rabbitfixture/0.3.6 | 01:14 |
| dstanek | bigjools: that is designed to be used by project to mock out rabbit. we don't have that | 01:15 |
| dstanek | our fixtures setup our database, cache, etc. | 01:15 |
| bigjools | it's not mocking rabbit, it runs rabbit | 01:15 |
| *** nekrodesk has joined #openstack-keystone | 01:16 | |
| bigjools | but I see why your particular fixture is no generic use | 01:16 |
| *** diazjf has quit IRC | 01:16 | |
| bigjools | I'm just saying I see value in something like that rabbit fixture which runs up an actual instance | 01:16 |
| dstanek | misspoke. i meant setup. in keystone we are really doing our mocking/faking in fixtures | 01:17 |
| *** gokrokve has quit IRC | 01:17 | |
| bigjools | ok | 01:17 |
| dstanek | bigjools: it may be useful for things that depend on keystone | 01:17 |
| bigjools | yes exactly :) | 01:17 |
| openstackgerrit | guang-yee proposed openstack/keystone: Use the right driver to get limits https://review.openstack.org/266989 | 01:18 |
| bigjools | If i had more spare time I'd give it a go myself, but sadly 4 kids and a chronic health issue eat it all | 01:18 |
| dstanek | bigjools: ouch. i'm sorry to hear that | 01:19 |
| bigjools | I know, 4 kids right | 01:20 |
| dstanek | bigjools: i have the same :-) | 01:20 |
| bigjools | :) | 01:20 |
| dstanek | bigjools: something like that would be terribly slow. what would you expect it to be used for? functional tests for other projects? | 01:21 |
| bigjools | yes pretty much | 01:22 |
| bigjools | it'll only be slow for setup | 01:22 |
| bigjools | so you can just make a FixtureResource or something | 01:22 |
| dstanek | bigjools: it would be slow for each test. the setup runs for every test method | 01:23 |
| bigjools | not if it's a fixtureresource | 01:23 |
| bigjools | they exist across tests | 01:23 |
| bigjools | that's why we made the rabbitfixture, it's not quick to set up at all but if used as a resource it's great | 01:24 |
| dstanek | so it woudl basically be slow across test classes right? | 01:24 |
| bigjools | yes | 01:24 |
| bigjools | you would have to group all tests that need it in as few test classes as possible | 01:24 |
| dstanek | at that point is it better to have the test infrastructure setup an instance? | 01:25 |
| bigjools | always a consideration, yes | 01:25 |
| bigjools | there's tradeoffs | 01:25 |
| dstanek | i'm trying to visualize what i would want to do if i needed this for some other project | 01:27 |
| bigjools | I would absolutely start with a self-contained keystonefixture | 01:28 |
| dstanek | bigjools: looking over the rabbit code now | 01:28 |
| bigjools | which may consist of other fixtures | 01:29 |
| dstanek | bigjools: it looks like that is just a regular fixture. what's the magic that makes it load once per class? | 01:30 |
| bigjools | for the lazy: http://bazaar.launchpad.net/~lazr-developers/rabbitfixture/trunk/view/head:/rabbitfixture/server.py | 01:30 |
| *** mylu has quit IRC | 01:31 | |
| dstanek | that's just doing the normal setUp. i'm assuming you would self.useFixture it in the test class setUp | 01:31 |
| dstanek | hmmm...is it maybe caching the server process in a global? | 01:32 |
| *** mylu has joined #openstack-keystone | 01:35 | |
| *** _cjones_ has quit IRC | 01:36 | |
| bigjools | dstanek: testresources.FixtureResource | 01:36 |
| bigjools | you can use a fixture as a test resource | 01:37 |
| dstanek | bigjools: how is that typically used? in a setUpClass? | 01:38 |
| bigjools | dstanek: you define a class variable called 'resources', from memory | 01:40 |
| bigjools | which defines class vars as fixtures | 01:40 |
| bigjools | as long as you are using testtools.TestCase | 01:42 |
| *** mylu has quit IRC | 01:44 | |
| dstanek | i just took a look at the testresources code. i've never seen FixtureResource used before. | 01:45 |
| *** darrenc is now known as darrenc_afk | 01:47 | |
| bigjools | it's pretty neat | 01:48 |
| *** jasonsb has joined #openstack-keystone | 01:52 | |
| *** gyee has quit IRC | 01:53 | |
| *** mylu has joined #openstack-keystone | 01:55 | |
| *** mylu has quit IRC | 01:58 | |
| *** darrenc_afk is now known as darrenc | 01:59 | |
| stevemar | what the heck happened to our py34 tests :( | 02:05 |
| notmorgan | stevemar: dstanek "fixed" it to be blacklist? | 02:05 |
| dstanek | notmorgan: stevemar: no, eventlet 0.18.2 | 02:05 |
| notmorgan | oh that | 02:05 |
| stevemar | notmorgan: i don't think so, last merge was long ago | 02:05 |
| notmorgan | pypi screwup | 02:06 |
| notmorgan | can we ditch eventlet yet? ;) | 02:06 |
| stevemar | dstanek: know if theres a patch to skip that? | 02:06 |
| dstanek | https://review.openstack.org/#/c/278147/ | 02:06 |
| notmorgan | they removed 0.18.1 from pypi | 02:06 |
| notmorgan | that is the issue | 02:06 |
| notmorgan | or an issue | 02:06 |
| notmorgan | as well | 02:06 |
| dstanek | 0.18.2 has a bug and g-r was updated | 02:07 |
| notmorgan | wonderful | 02:07 |
| dstanek | nova shit itself too https://review.openstack.org/277912 | 02:07 |
| *** diazjf has joined #openstack-keystone | 02:07 | |
| notmorgan | yeah | 02:07 |
| notmorgan | basically eventlet did stupid | 02:07 |
| dstanek | if jenkins would give me some love then we can merge that in | 02:08 |
| stevemar | dstanek: i think we'll just need to wait til that eventlet release is blocked in requirements | 02:08 |
| notmorgan | yep | 02:08 |
| *** aginwala has quit IRC | 02:09 | |
| stevemar | is there no patch up to block 0.18.1 and 0.18.2 yet | 02:09 |
| stevemar | ? | 02:09 |
| dstanek | stevemar: to my knowledge they are riding out 0.18.2 | 02:11 |
| dstanek | stevemar: http://lists.openstack.org/pipermail/openstack-dev/2016-February/086180.html | 02:13 |
| *** Ephur has quit IRC | 02:13 | |
| stevemar | dstanek: "riding things out" really? | 02:13 |
| dstanek | stevemar: i don't think anyone else felt any pain, but i have no idea | 02:14 |
| dstanek | i'd love to just stay on 0.17.4 where things "worked" | 02:14 |
| dstanek | dims_: may know more | 02:14 |
| dims_ | stevemar : only reports i have so far is nova and keystone, nova fixed up their unit tests | 02:15 |
| dims_ | stevemar : my earlier suggestion was to skip tests tonight and request haypo for help in the AM since some of the eventlet/wsgi/py3 stuff was from him (in eventlet) | 02:16 |
| stevemar | great, who gives a damn about keystone :] | 02:16 |
| *** spandhe has quit IRC | 02:16 | |
| stevemar | eventlet support is deprecated, this just encourages us to remove it | 02:16 |
| dstanek | my "fix" has about 45 mins left in the check queue and then it can be merged | 02:16 |
| stevemar | dstanek: skip the ipv6 tests? | 02:17 |
| dims_ | stevemar : not true :) | 02:17 |
| dstanek | dims_: true for us | 02:17 |
| dims_ | dstanek : why do you feel so? (want to understand) | 02:17 |
| stevemar | feelin like the unwanted step child =\ | 02:18 |
| dstanek | dims_: we've deprecated eventlet in keystone so it's on the roadmap to be deleted | 02:18 |
| stevemar | dstanek: i just gotta fix 4 failing tests here: https://review.openstack.org/#/c/249486/ | 02:18 |
| dims_ | stevemar : if you feel we need to throw up a 0.18.2 block, please do! | 02:19 |
| *** aginwala has joined #openstack-keystone | 02:20 | |
| dims_ | stevemar : dstanek : before making any oslo release, i run py27 and py34 of oslo.* from master :) | 02:20 |
| dims_ | against keystone that is | 02:20 |
| *** spandhe has joined #openstack-keystone | 02:21 | |
| stevemar | dims_: i'll see how stanek's fix goes, and will toss up a block of eventlet if we cant get around it | 02:21 |
| dims_ | stevemar : +1, if you have a bug, please point me to it as well | 02:21 |
| dims_ | i'll ping haypo when i wake up | 02:22 |
| *** diazjf has quit IRC | 02:22 | |
| dstanek | stevemar: 40 mins left and already passed all of our unit tests...now just waiting on tempest and grenade tests | 02:22 |
| *** diazjf has joined #openstack-keystone | 02:23 | |
| *** browne has quit IRC | 02:24 | |
| stevemar | dstanek: i'll +2/W it right away | 02:25 |
| *** alex_xu has quit IRC | 02:28 | |
| *** mylu has joined #openstack-keystone | 02:30 | |
| *** alex_xu has joined #openstack-keystone | 02:30 | |
| *** spandhe_ has joined #openstack-keystone | 02:31 | |
| *** spandhe_ has left #openstack-keystone | 02:31 | |
| *** aginwala has quit IRC | 02:31 | |
| dstanek | i know it's an irrational fear, but i don't want to push any more code until that gets checked | 02:32 |
| *** spandhe has quit IRC | 02:33 | |
| *** spandhe has joined #openstack-keystone | 02:37 | |
| *** su_zhang has quit IRC | 02:41 | |
| *** Guest12840 has quit IRC | 02:41 | |
| *** dims_ has quit IRC | 02:45 | |
| *** alex_xu has quit IRC | 02:49 | |
| *** tsymanczyk has joined #openstack-keystone | 02:51 | |
| *** alex_xu has joined #openstack-keystone | 02:52 | |
| *** tsymanczyk is now known as Guest83959 | 02:52 | |
| stevemar | dstanek: it's a bit irrational :) | 02:54 |
| *** dan_nguyen has quit IRC | 02:56 | |
| *** darrenc is now known as darrenc_afk | 02:58 | |
| *** links has joined #openstack-keystone | 03:00 | |
| *** lhcheng has quit IRC | 03:10 | |
| *** darrenc_afk is now known as darrenc | 03:11 | |
| *** Nirupama has joined #openstack-keystone | 03:11 | |
| *** diazjf has quit IRC | 03:12 | |
| *** mylu has quit IRC | 03:15 | |
| *** mylu has joined #openstack-keystone | 03:16 | |
| openstackgerrit | Tin Lam proposed openstack/keystone: H405 violations: multi line docstring summary not separated with an empty line https://review.openstack.org/278190 | 03:16 |
| *** mylu has quit IRC | 03:26 | |
| *** Guest83959 has quit IRC | 03:26 | |
| *** dims has joined #openstack-keystone | 03:27 | |
| *** browne has joined #openstack-keystone | 03:27 | |
| *** mylu has joined #openstack-keystone | 03:29 | |
| *** woodster_ has joined #openstack-keystone | 03:32 | |
| *** dims has quit IRC | 03:37 | |
| *** gokrokve has joined #openstack-keystone | 03:37 | |
| stevemar | dstanek: my isp went down, did your tests pass locally? | 03:38 |
| dstanek | stevemar: they passed jenkins too | 03:38 |
| *** mylu has quit IRC | 03:38 | |
| dstanek | stevemar: https://review.openstack.org/#/c/278147/ | 03:38 |
| stevemar | dstanek: +2 / +A | 03:39 |
| *** mylu has joined #openstack-keystone | 03:39 | |
| *** gokrokve_ has joined #openstack-keystone | 03:43 | |
| *** gokrokve has quit IRC | 03:45 | |
| *** gokrokve has joined #openstack-keystone | 03:48 | |
| *** gokrokve_ has quit IRC | 03:48 | |
| *** bill_az has quit IRC | 03:49 | |
| *** edmondsw has quit IRC | 03:49 | |
| *** tsymanczyk has joined #openstack-keystone | 03:51 | |
| *** tsymanczyk is now known as Guest53252 | 03:52 | |
| *** gokrokve has quit IRC | 03:53 | |
| *** gokrokve has joined #openstack-keystone | 03:53 | |
| *** su_zhang has joined #openstack-keystone | 03:54 | |
| *** kalaswan has joined #openstack-keystone | 04:01 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:02 | |
| *** lhcheng has joined #openstack-keystone | 04:02 | |
| *** ChanServ sets mode: +v lhcheng | 04:02 | |
| *** lhcheng_ has joined #openstack-keystone | 04:05 | |
| *** lhcheng has quit IRC | 04:08 | |
| *** mylu has quit IRC | 04:15 | |
| *** markvoelker has quit IRC | 04:15 | |
| *** markvoelker has joined #openstack-keystone | 04:16 | |
| *** spandhe_ has joined #openstack-keystone | 04:20 | |
| *** spandhe has quit IRC | 04:21 | |
| *** spandhe_ is now known as spandhe | 04:21 | |
| *** mylu has joined #openstack-keystone | 04:25 | |
| *** mylu has quit IRC | 04:26 | |
| *** lhcheng_ has quit IRC | 04:33 | |
| *** mylu has joined #openstack-keystone | 04:44 | |
| *** aginwala has joined #openstack-keystone | 04:45 | |
| *** kalaswan has quit IRC | 04:55 | |
| *** aginwala has quit IRC | 04:55 | |
| *** kalaswan has joined #openstack-keystone | 04:57 | |
| *** spandhe has quit IRC | 05:04 | |
| *** gokrokve_ has joined #openstack-keystone | 05:05 | |
| *** gokrokve has quit IRC | 05:06 | |
| *** spandhe has joined #openstack-keystone | 05:08 | |
| *** jbell8 has joined #openstack-keystone | 05:17 | |
| jamielennox | notmorgan: https://review.openstack.org/#/c/268553/ | 05:25 |
| *** fawadkhaliq has quit IRC | 05:27 | |
| *** dave-mccowan has quit IRC | 05:33 | |
| *** woodster_ has quit IRC | 05:36 | |
| *** mylu has quit IRC | 05:41 | |
| *** roxanaghe has joined #openstack-keystone | 05:42 | |
| *** gokrokve_ has quit IRC | 05:42 | |
| *** diazjf has joined #openstack-keystone | 05:45 | |
| *** gokrokve has joined #openstack-keystone | 05:45 | |
| *** mylu has joined #openstack-keystone | 05:46 | |
| *** gokrokve has quit IRC | 05:48 | |
| *** gokrokve_ has joined #openstack-keystone | 05:48 | |
| *** diazjf1 has joined #openstack-keystone | 05:48 | |
| *** diazjf has quit IRC | 05:51 | |
| *** henrynash has joined #openstack-keystone | 05:57 | |
| *** ChanServ sets mode: +v henrynash | 05:57 | |
| *** daemontool_ has joined #openstack-keystone | 05:58 | |
| *** jasonsb has quit IRC | 06:01 | |
| *** daemontool has quit IRC | 06:02 | |
| *** jasonsb has joined #openstack-keystone | 06:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:04 | |
| *** jasonsb has quit IRC | 06:04 | |
| *** mylu has quit IRC | 06:04 | |
| *** mylu has joined #openstack-keystone | 06:05 | |
| *** jasonsb has joined #openstack-keystone | 06:05 | |
| *** gokrokve_ has quit IRC | 06:06 | |
| *** roxanaghe has quit IRC | 06:06 | |
| *** mylu has quit IRC | 06:12 | |
| *** mylu has joined #openstack-keystone | 06:13 | |
| *** gildub has quit IRC | 06:16 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 06:18 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 06:20 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 06:20 |
| *** jsheeren has joined #openstack-keystone | 06:23 | |
| *** aginwala has joined #openstack-keystone | 06:23 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 06:40 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 06:46 |
| *** spandhe has quit IRC | 06:47 | |
| *** gildub has joined #openstack-keystone | 06:50 | |
| *** roxanaghe has joined #openstack-keystone | 06:57 | |
| *** roxanaghe has quit IRC | 06:57 | |
| *** aginwala_ has joined #openstack-keystone | 06:58 | |
| *** aginwal__ has joined #openstack-keystone | 06:59 | |
| *** henrynash has quit IRC | 06:59 | |
| *** nkinder has quit IRC | 07:00 | |
| *** aginwala has quit IRC | 07:02 | |
| *** aginwala_ has quit IRC | 07:03 | |
| *** richm has joined #openstack-keystone | 07:03 | |
| *** gokrokve has joined #openstack-keystone | 07:06 | |
| *** su_zhang has quit IRC | 07:07 | |
| *** richm has quit IRC | 07:08 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 07:08 |
| *** jsheeren has quit IRC | 07:10 | |
| *** su_zhang has joined #openstack-keystone | 07:11 | |
| *** mylu has quit IRC | 07:13 | |
| *** belmoreira has joined #openstack-keystone | 07:13 | |
| *** gokrokve has quit IRC | 07:14 | |
| *** rcernin has joined #openstack-keystone | 07:14 | |
| *** lhcheng has joined #openstack-keystone | 07:14 | |
| *** ChanServ sets mode: +v lhcheng | 07:14 | |
| *** rudolfvriend has joined #openstack-keystone | 07:17 | |
| *** diazjf1 has quit IRC | 07:18 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 07:21 |
| stevemar | that took way to long to unwind | 07:21 |
| stevemar | bknudson_: ^ take a look if you can | 07:22 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 07:26 |
| *** richm has joined #openstack-keystone | 07:26 | |
| *** su_zhang has quit IRC | 07:36 | |
| *** jbell8 has quit IRC | 07:38 | |
| *** jbell8 has joined #openstack-keystone | 07:40 | |
| *** jsheeren has joined #openstack-keystone | 07:46 | |
| *** shoutm_ has quit IRC | 07:46 | |
| *** shoutm has joined #openstack-keystone | 07:46 | |
| *** openstackgerrit has quit IRC | 07:47 | |
| *** openstackgerrit has joined #openstack-keystone | 07:47 | |
| *** shoutm has quit IRC | 07:50 | |
| *** jbell8 has quit IRC | 07:51 | |
| *** nkinder has joined #openstack-keystone | 07:51 | |
| *** jbell8 has joined #openstack-keystone | 07:52 | |
| *** rcernin has quit IRC | 07:52 | |
| *** lhcheng has quit IRC | 07:53 | |
| openstackgerrit | Kalaswan Datta proposed openstack/keystone: Clear the project ID from user information https://review.openstack.org/277707 | 07:57 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 07:57 |
| *** roxanaghe has joined #openstack-keystone | 07:58 | |
| *** e0ne has joined #openstack-keystone | 07:58 | |
| *** aginwala has joined #openstack-keystone | 08:01 | |
| *** roxanaghe has quit IRC | 08:02 | |
| *** aginwal__ has quit IRC | 08:04 | |
| openstackgerrit | Merged openstack/keystone: Disable the ipv6 tests in py34 https://review.openstack.org/278147 | 08:12 |
| *** rcernin has joined #openstack-keystone | 08:15 | |
| *** sinese_ has joined #openstack-keystone | 08:17 | |
| *** d0ugal has joined #openstack-keystone | 08:17 | |
| *** jistr|doc has joined #openstack-keystone | 08:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 08:22 |
| *** e0ne has quit IRC | 08:39 | |
| *** gokrokve has joined #openstack-keystone | 08:40 | |
| *** pnavarro has joined #openstack-keystone | 08:42 | |
| *** gokrokve has quit IRC | 08:44 | |
| *** jaosorior has joined #openstack-keystone | 08:48 | |
| *** browne has quit IRC | 08:53 | |
| *** fhubik has joined #openstack-keystone | 08:55 | |
| *** browne has joined #openstack-keystone | 08:56 | |
| *** roxanaghe has joined #openstack-keystone | 08:59 | |
| *** browne has quit IRC | 09:03 | |
| *** roxanaghe has quit IRC | 09:04 | |
| *** aginwala has quit IRC | 09:05 | |
| *** aginwala has joined #openstack-keystone | 09:07 | |
| *** aginwala has quit IRC | 09:17 | |
| *** mhickey has joined #openstack-keystone | 09:17 | |
| *** fawadkhaliq has quit IRC | 09:19 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:19 | |
| *** notmorgan has left #openstack-keystone | 09:23 | |
| *** kalaswan has quit IRC | 09:26 | |
| *** jbell8 has quit IRC | 09:32 | |
| *** jbell8 has joined #openstack-keystone | 09:33 | |
| *** jbell8 has quit IRC | 09:35 | |
| *** jbell8 has joined #openstack-keystone | 09:39 | |
| *** fhubik has quit IRC | 09:39 | |
| *** gokrokve has joined #openstack-keystone | 09:41 | |
| *** jistr|doc has quit IRC | 09:46 | |
| *** gokrokve has quit IRC | 09:48 | |
| *** mvk has joined #openstack-keystone | 09:52 | |
| *** mvk has quit IRC | 09:56 | |
| *** roxanaghe has joined #openstack-keystone | 10:01 | |
| *** roxanaghe has quit IRC | 10:06 | |
| *** e0ne has joined #openstack-keystone | 10:07 | |
| *** mvk has joined #openstack-keystone | 10:16 | |
| *** sinese_ has quit IRC | 10:16 | |
| *** jaosorior has quit IRC | 10:21 | |
| *** fawadkhaliq has quit IRC | 10:32 | |
| *** fhubik has joined #openstack-keystone | 10:35 | |
| *** dims has joined #openstack-keystone | 10:48 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:51 | |
| *** fawadkhaliq has quit IRC | 10:54 | |
| *** fawadkhaliq has joined #openstack-keystone | 10:55 | |
| *** roxanaghe has joined #openstack-keystone | 11:03 | |
| *** mhickey has quit IRC | 11:04 | |
| *** roxanaghe has quit IRC | 11:07 | |
| *** mhickey has joined #openstack-keystone | 11:19 | |
| *** fawadkhaliq has quit IRC | 11:22 | |
| *** fawadkhaliq has joined #openstack-keystone | 11:23 | |
| *** akscram has quit IRC | 11:25 | |
| *** akscram has joined #openstack-keystone | 11:25 | |
| *** alexpro has joined #openstack-keystone | 11:26 | |
| *** fhubik is now known as fhubik_brb | 11:34 | |
| openstackgerrit | Tony Wang proposed openstack/keystone: improve credential tests https://review.openstack.org/265610 | 11:40 |
| *** peter-hamilton has joined #openstack-keystone | 11:49 | |
| *** sinese_ has joined #openstack-keystone | 11:49 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: TEST: PLS DON'T REVIEW ME https://review.openstack.org/262364 | 11:52 |
| *** xek has quit IRC | 11:53 | |
| *** permalac has joined #openstack-keystone | 11:55 | |
| *** links has quit IRC | 11:56 | |
| samueldmq | morning all | 11:58 |
| *** fhubik_brb is now known as fhubik | 11:58 | |
| samueldmq | lbragstad: is there something to be done in bug #1473567 yet ? | 11:58 |
| openstack | bug 1473567 in OpenStack Identity (keystone) "Fernet tokens fail tempest runs" [High,In progress] https://launchpad.net/bugs/1473567 - Assigned to Lance Bragstad (lbragstad) | 11:58 |
| *** fawadkhaliq has quit IRC | 11:59 | |
| *** mvk has quit IRC | 12:00 | |
| *** daemontool_ has quit IRC | 12:00 | |
| *** mvk has joined #openstack-keystone | 12:02 | |
| *** pnavarro has quit IRC | 12:03 | |
| *** daemontool_ has joined #openstack-keystone | 12:16 | |
| *** mhickey has quit IRC | 12:17 | |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 12:20 |
| *** alexpro has quit IRC | 12:21 | |
| *** gildub has quit IRC | 12:23 | |
| *** sinese_ has quit IRC | 12:25 | |
| *** sinese_ has joined #openstack-keystone | 12:27 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** mhickey has joined #openstack-keystone | 12:30 | |
| *** links has joined #openstack-keystone | 12:36 | |
| dstanek | any cores have a min? simple one to get through https://review.openstack.org/#/c/278053/ | 12:36 |
| openstackgerrit | David Stanek proposed openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 12:38 |
| openstackgerrit | David Stanek proposed openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 12:38 |
| *** krotscheck_dcm is now known as krotscheck | 12:38 | |
| *** vgridnev has joined #openstack-keystone | 12:45 | |
| *** alexpro has joined #openstack-keystone | 12:54 | |
| *** nekrodesk has quit IRC | 13:00 | |
| *** roxanaghe has joined #openstack-keystone | 13:04 | |
| *** roxanaghe has quit IRC | 13:08 | |
| *** e0ne has quit IRC | 13:09 | |
| *** vgridnev has quit IRC | 13:09 | |
| *** e0ne has joined #openstack-keystone | 13:09 | |
| *** edmondsw has quit IRC | 13:11 | |
| *** jed56 has quit IRC | 13:13 | |
| *** pnavarro has joined #openstack-keystone | 13:17 | |
| *** gordc has joined #openstack-keystone | 13:19 | |
| *** vgridnev has joined #openstack-keystone | 13:19 | |
| *** vgridnev has quit IRC | 13:21 | |
| *** pnavarro has quit IRC | 13:22 | |
| *** e0ne has quit IRC | 13:24 | |
| *** e0ne has joined #openstack-keystone | 13:25 | |
| marekd | dstanek: done | 13:28 |
| *** vgridnev has joined #openstack-keystone | 13:28 | |
| dstanek | marekd: thx! | 13:31 |
| marekd | yw | 13:31 |
| *** pnavarro has joined #openstack-keystone | 13:34 | |
| *** Nirupama has quit IRC | 13:35 | |
| *** xek has joined #openstack-keystone | 13:38 | |
| *** permalac has quit IRC | 13:39 | |
| *** rk4n has joined #openstack-keystone | 13:41 | |
| *** jsavak has joined #openstack-keystone | 13:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:42 | |
| *** fhubik is now known as fhubik_brb | 13:45 | |
| *** fhubik_brb is now known as fhubik | 13:46 | |
| *** jed56 has joined #openstack-keystone | 13:46 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Deprecate Saml2 auth plugin https://review.openstack.org/275438 | 13:47 |
| *** su_zhang has joined #openstack-keystone | 13:48 | |
| *** gokrokve has joined #openstack-keystone | 13:49 | |
| *** dave-mccowan has joined #openstack-keystone | 13:51 | |
| *** gokrokve has quit IRC | 13:53 | |
| *** ninag has joined #openstack-keystone | 13:55 | |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added CORS support to Keystone https://review.openstack.org/241317 | 14:00 |
| *** petertr7_away is now known as petertr7 | 14:06 | |
| *** roxanaghe has joined #openstack-keystone | 14:06 | |
| dstanek | grrrr... i can reproduce the failure here: https://review.openstack.org/#/c/278054/ | 14:08 |
| *** roxanaghe has quit IRC | 14:10 | |
| marekd | dstanek: ooh | 14:11 |
| marekd | what is this facadeengine for actually? | 14:12 |
| *** jamie_h has joined #openstack-keystone | 14:16 | |
| jamie_h | is there a way to see the activity for a specific token based on its audit id? | 14:17 |
| jamie_h | like a frontend API where you pass in the id | 14:17 |
| marekd | jamie_h: like a lifecycle of the user? | 14:17 |
| jamie_h | marekd: something like that. anything that can provide some kind of security auditing | 14:18 |
| marekd | jamie_h: even if possible i'd say it's up to the sevice consumin CADF events | 14:18 |
| marekd | so surely not keystone | 14:18 |
| marekd | topol: or stevemar may know a little bit more. | 14:18 |
| jamie_h | keystone provides audit_ids for each token though, right? | 14:18 |
| jamie_h | once those audit_ids have been issued, does it aggregate token activity according to the ID? | 14:19 |
| marekd | jamie_h: i am not sure | 14:19 |
| *** permalac has joined #openstack-keystone | 14:22 | |
| *** rk4n has quit IRC | 14:25 | |
| *** links has quit IRC | 14:27 | |
| bknudson_ | dstanek: when I removed /etc/keystone/policy.json the tests failed | 14:30 |
| bknudson_ | I think there's a bug for this already? | 14:30 |
| dstanek | bknudson_: really? mine didn't | 14:30 |
| bknudson_ | I'll look into it some more... maybe it's looking elsewhere, too. | 14:31 |
| bknudson_ | also want to try on py27 | 14:31 |
| dstanek | jamie_h: i don't think we record what is done with a token. we do issue CADF events though | 14:32 |
| *** bill_az has joined #openstack-keystone | 14:33 | |
| jamie_h | dstanek: are those CADF events generated for activity on every openstack service or just keystone? | 14:34 |
| dstanek | jamie_h: is there something specific you are trying to do? | 14:34 |
| jamie_h | dstanek: security auditing | 14:34 |
| dstanek | jamie_h: not sure which services emit events | 14:34 |
| *** peter-hamilton has quit IRC | 14:34 | |
| bknudson_ | as far as I know cadf is only on keystone. You'd have to ask the nova, etc., folks if they implemented it | 14:34 |
| dstanek | bknudson_: ok, i got the failure now! | 14:39 |
| bknudson_ | dstanek: it fails the same way on py27 and py34, but some earlier test must be affecting it on py27 so it doesn't fail | 14:40 |
| dims | dstanek : bknudson_ : stevemar : report back from eventlet-land, haypo is working on it https://github.com/eventlet/eventlet/issues/296 | 14:40 |
| bknudson_ | there must be a bug for this. | 14:40 |
| dstanek | bknudson_: it only fails in isolation for me. should be a quick fix | 14:41 |
| jamie_h | why was CADF events added if it wasn't guaranteed that other services would log user activity? | 14:41 |
| bknudson_ | dstanek: https://bugs.launchpad.net/keystone/+bug/1520383 | 14:41 |
| openstack | Launchpad bug 1520383 in OpenStack Identity (keystone) "Tests that need policy.json can never find it if run in isolation" [Undecided,New] | 14:41 |
| dstanek | bknudson_: thx. i just took it over | 14:42 |
| bknudson_ | dims: neat, thanks! | 14:44 |
| lbragstad | samueldmq no - we should be passing tempest tests with fernet | 14:44 |
| bknudson_ | I assumed it was something keystone tests were doing wrong. | 14:44 |
| lbragstad | samueldmq at least with those patches that have gone into tempest | 14:44 |
| dstanek | dims: awesome | 14:44 |
| dims | dstanek : hope you feel the love now :) | 14:45 |
| dstanek | dims: :-) | 14:49 |
| *** daemontool_ has quit IRC | 14:49 | |
| *** gokrokve has joined #openstack-keystone | 14:50 | |
| *** daemontool_ has joined #openstack-keystone | 14:50 | |
| *** daemontool__ has joined #openstack-keystone | 14:51 | |
| dstanek | bknudson_: for the record i am complete against globals | 14:52 |
| *** daemontool__ is now known as daemontool | 14:52 | |
| *** daemontool_ has quit IRC | 14:55 | |
| *** gokrokve has quit IRC | 14:56 | |
| bknudson_ | dstanek: noted | 14:57 |
| *** gokrokve has joined #openstack-keystone | 14:58 | |
| *** spzala has joined #openstack-keystone | 15:01 | |
| *** fhubik is now known as fhubik_brb | 15:03 | |
| *** roxanaghe has joined #openstack-keystone | 15:07 | |
| *** esp has joined #openstack-keystone | 15:09 | |
| *** vgridnev has quit IRC | 15:09 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Switch to configless bandit https://review.openstack.org/278136 | 15:10 |
| *** vgridnev has joined #openstack-keystone | 15:11 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/278163 | 15:11 |
| *** roxanaghe has quit IRC | 15:12 | |
| *** jsheeren has quit IRC | 15:12 | |
| *** permalac has quit IRC | 15:13 | |
| *** esp has quit IRC | 15:13 | |
| topol | jamie_h did you have questions on CADF? | 15:16 |
| *** pnavarro has quit IRC | 15:16 | |
| * topol loving this irc bouncer stevemar and notmorgan got me for my birthday | 15:16 | |
| *** vgridnev has quit IRC | 15:17 | |
| *** su_zhang has quit IRC | 15:18 | |
| *** gokrokve has quit IRC | 15:19 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:19 | |
| *** woodster_ has joined #openstack-keystone | 15:23 | |
| *** jaosorior has joined #openstack-keystone | 15:24 | |
| *** jsavak has quit IRC | 15:27 | |
| marekd | topol: he was not sure whether audit_id value is kept for all actions executed for a given token. | 15:28 |
| topol | marekd define kept? | 15:28 |
| topol | I think it is | 15:28 |
| marekd | say i reuse token and do actions. will I get some commmon value for CADF events so I can later connect the points. | 15:28 |
| marekd | and recreate users's actions | 15:28 |
| *** mvk has quit IRC | 15:29 | |
| *** mvk has joined #openstack-keystone | 15:29 | |
| *** mvk has quit IRC | 15:30 | |
| *** jsavak has joined #openstack-keystone | 15:31 | |
| *** mvk has joined #openstack-keystone | 15:31 | |
| *** pnavarro has joined #openstack-keystone | 15:31 | |
| *** su_zhang has joined #openstack-keystone | 15:31 | |
| *** rcernin has quit IRC | 15:33 | |
| *** vgridnev has joined #openstack-keystone | 15:33 | |
| marekd | topol: ^ | 15:33 |
| topol | marekd across projects or just within Keystone? | 15:34 |
| *** e0ne has quit IRC | 15:34 | |
| marekd | topol: within keystone. | 15:34 |
| topol | marekd I'll double check with stevemar but I believe so | 15:35 |
| marekd | topol: sure. thanks. | 15:35 |
| marekd | jamie_h: ^^ | 15:35 |
| *** e0ne has joined #openstack-keystone | 15:35 | |
| *** jaosorior has quit IRC | 15:36 | |
| *** jorge_munoz1 has joined #openstack-keystone | 15:42 | |
| topol | henrynash what does None:%(target.role.domain_id)s mean in a policy file? do we document the policy file syntax and semantics somewhere? | 15:42 |
| *** jaosorior has joined #openstack-keystone | 15:42 | |
| *** jorge_munoz1 has left #openstack-keystone | 15:42 | |
| *** gokrokve has joined #openstack-keystone | 15:43 | |
| *** dikonoor has joined #openstack-keystone | 15:43 | |
| *** dikonoor has quit IRC | 15:43 | |
| *** vgridnev has quit IRC | 15:45 | |
| *** vgridnev has joined #openstack-keystone | 15:45 | |
| *** dancn has left #openstack-keystone | 15:46 | |
| *** gokrokve has quit IRC | 15:47 | |
| *** jorge_munoz1 has joined #openstack-keystone | 15:52 | |
| *** su_zhang has quit IRC | 15:52 | |
| *** richm has quit IRC | 15:53 | |
| *** richm has joined #openstack-keystone | 15:54 | |
| *** richm has quit IRC | 15:59 | |
| *** rcernin has joined #openstack-keystone | 16:01 | |
| *** fhubik_brb is now known as fhubik | 16:01 | |
| *** jsavak has quit IRC | 16:01 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Tokens with subset of catalog https://review.openstack.org/266137 | 16:03 |
| *** esp has joined #openstack-keystone | 16:04 | |
| *** samueldmq1 has joined #openstack-keystone | 16:04 | |
| *** gokrokve has joined #openstack-keystone | 16:04 | |
| *** slberger has joined #openstack-keystone | 16:05 | |
| *** phalmos has joined #openstack-keystone | 16:07 | |
| *** roxanaghe has joined #openstack-keystone | 16:08 | |
| *** fhubik has quit IRC | 16:08 | |
| *** jaosorior_ has joined #openstack-keystone | 16:09 | |
| *** henrynash has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v henrynash | 16:09 | |
| *** esp has quit IRC | 16:11 | |
| *** nekrodesk has joined #openstack-keystone | 16:11 | |
| *** nekrodesk has quit IRC | 16:11 | |
| *** samueldmq1 has quit IRC | 16:11 | |
| *** richm has joined #openstack-keystone | 16:12 | |
| *** jsavak has joined #openstack-keystone | 16:13 | |
| *** roxanaghe has quit IRC | 16:13 | |
| *** rudolfvriend has quit IRC | 16:15 | |
| *** esp has joined #openstack-keystone | 16:17 | |
| *** nekrodesk has joined #openstack-keystone | 16:18 | |
| *** csoukup has joined #openstack-keystone | 16:18 | |
| stevemar | bknudson_: any suggestions on what to do with the eventlet patch? | 16:22 |
| stevemar | redefine them in keystone.conf? | 16:22 |
| bknudson_ | stevemar: probably easiest to leave the eventlet options that are substitutable around for now | 16:23 |
| bknudson_ | deprecate them in a separate patch | 16:23 |
| bknudson_ | I mean deprecate the substitution in a separate patch. | 16:23 |
| bknudson_ | I think we wanted to do this anyways | 16:24 |
| bknudson_ | might want to check what devstack uses. | 16:24 |
| *** rcernin has quit IRC | 16:24 | |
| *** esp has quit IRC | 16:24 | |
| *** browne has joined #openstack-keystone | 16:27 | |
| bknudson_ | topol: http://docs.openstack.org/developer/keystone/configuration.html#keystone-api-protection-with-role-based-access-control-rbac | 16:27 |
| *** raildo-afk is now known as raildo | 16:29 | |
| topol | bknudson, Thanks! You always make my life easier. | 16:29 |
| henrynash | topol: thx for comments on domain specific roles patches….the inability to add comments to a polcy json file is a real pain….both bknudson and I have independently tried to fix this, and not been successful1 | 16:29 |
| bknudson_ | henrynash: I'm going to see if it's easy to support yaml. yaml supports comments | 16:30 |
| henrynash | bknudson_: agreed…I think that is probably the right approach | 16:30 |
| topol | henrynash, bknudson, I know. And Im gonna review what bknudson just sent me. My gut tells me your new domain_admin roles and rules would benefit from docs that specifically explain those new one | 16:31 |
| topol | s | 16:31 |
| henrynash | topol: agreed. no question. | 16:31 |
| topol | henrynash, bknudson Im gonna play guinea pig and read what bknudson sent me and then see if I can decipher the new roles | 16:31 |
| *** roxanaghe has joined #openstack-keystone | 16:31 | |
| henrynash | topol, bknduson_: alternatively (to yaml) I will write up a .rst that explains what our v3cloudsample defines as policy rules sfor each API….so someone can really understand what is going on (and can then adapt as needed) | 16:32 |
| topol | henrynash,bknudson it was when I read domain_admin_matches_filter_on_list_domain_roles that is when I broke down and started crying :-) | 16:33 |
| henrynash | topol: I know….i can’t resist the temptation to spell it out | 16:33 |
| *** boris-42 has quit IRC | 16:33 | |
| bknudson_ | docs are good. might take a while to do the whole switch to yaml. | 16:34 |
| topol | henrynah the .rst that explains the v3cloudsample and focuses on the domain stuff would be a huge help. I'm willing to remove my -1 with a promise to add that doc and reference it in the release note | 16:35 |
| *** Ephur has joined #openstack-keystone | 16:35 | |
| topol | henrynash ^ | 16:35 |
| *** ninag has quit IRC | 16:35 | |
| *** ninag has joined #openstack-keystone | 16:36 | |
| henrynash | topol: I’ll do that anyway…although there are some doc changes I shoudl add to the patch (e.g. add target.role.domain_id to configuration.rst where it talks about policy target attributes) | 16:36 |
| *** vgridnev has quit IRC | 16:36 | |
| *** clenimar has joined #openstack-keystone | 16:36 | |
| *** jsavak has quit IRC | 16:36 | |
| topol | henrynash I do like your temptation to spell it out. It at least gave me some bread crumbs to deciper. So dont stop doing that | 16:37 |
| *** jgriffith_away is now known as jgriffith | 16:37 | |
| henrynash | topol: after 34 years of spelling things out, unlikely to stop now :-) | 16:37 |
| topol | henrynash, the rst enhancements will be a huge help. | 16:38 |
| topol | henryansh, so_glad_to_hear_that_and_please_dont_chage_on_my_account | 16:38 |
| henrynash | topol: yep, I’ll add (If I can make gerrit work…which seems broekn for me right now) | 16:38 |
| topol | henrynash. Sounds great thanks | 16:39 |
| henrynash | topol: not_on_your_life_boyoh | 16:39 |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use the right driver to get limits https://review.openstack.org/266989 | 16:39 |
| *** doug-fish has quit IRC | 16:40 | |
| *** belmoreira has quit IRC | 16:41 | |
| *** doug-fish has joined #openstack-keystone | 16:41 | |
| *** clenimar has quit IRC | 16:41 | |
| *** jsavak has joined #openstack-keystone | 16:42 | |
| *** clenimar has joined #openstack-keystone | 16:43 | |
| *** doug-fish has quit IRC | 16:45 | |
| *** jbell8 has quit IRC | 16:46 | |
| *** browne has quit IRC | 16:47 | |
| *** jbell8 has joined #openstack-keystone | 16:47 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Use the right driver to get limits https://review.openstack.org/266989 | 16:49 |
| *** doug-fish has joined #openstack-keystone | 16:51 | |
| *** pnavarro has quit IRC | 16:53 | |
| *** diazjf has joined #openstack-keystone | 16:53 | |
| *** fhubik has joined #openstack-keystone | 16:53 | |
| *** nekrodesk has quit IRC | 16:53 | |
| *** jamie_h has quit IRC | 16:54 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Support policy file in YAML https://review.openstack.org/278513 | 16:55 |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v gyee | 16:55 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:55 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:56 | |
| *** dikonoor has joined #openstack-keystone | 16:56 | |
| *** fhubik has quit IRC | 16:57 | |
| *** doug-fish has quit IRC | 16:57 | |
| *** _cjones_ has joined #openstack-keystone | 16:58 | |
| *** jaosorior_ has quit IRC | 16:58 | |
| *** spzala has quit IRC | 16:59 | |
| *** spzala has joined #openstack-keystone | 16:59 | |
| *** jaosorior_ has joined #openstack-keystone | 17:00 | |
| *** jsavak has quit IRC | 17:02 | |
| *** jsavak has joined #openstack-keystone | 17:02 | |
| ayoung | henrynash, I started the day with the intention of reviewing your patches... | 17:03 |
| ayoung | road to hell and all that | 17:03 |
| henrynash | ayoung: :-) | 17:04 |
| ayoung | henrynash, policy question | 17:04 |
| *** spzala has quit IRC | 17:04 | |
| henrynash | ayoung: just about to post a new version of teh CRUD for domain specific roles | 17:04 |
| henrynash | ayoung: sure, shorrt | 17:04 |
| ayoung | when creing a DSR, are we going to have a different policy check than an impolied role | 17:04 |
| henrynash | shoot (even) | 17:04 |
| ayoung | ? | 17:04 |
| ayoung | when creating a DSR, are we going to have a different policy check than an implied role? | 17:04 |
| henrynash | ayoung: for the creation of the role or assigning it? | 17:05 |
| ayoung | creation | 17:05 |
| ayoung | henrynash, DSR should be more permissive | 17:05 |
| ayoung | an implied role is a global admin thing, but a DSR should be a scope check for the right role on the domain. | 17:05 |
| henrynash | ayoung: so a domain_admin can create a DSR (in their domain), while they cannot create a global roe | 17:05 |
| henrynash | role | 17:05 |
| ayoung | henrynash, that is what I was looking for. Can you point me at the logic for that? | 17:06 |
| *** pnavarro has joined #openstack-keystone | 17:06 | |
| henrynash | ayoung: it’s those funcky policy rules… | 17:06 |
| henrynash | ayoung: let me get you teh patch hold on | 17:06 |
| henrynash | ayoung: https://review.openstack.org/#/c/262078/16 | 17:07 |
| *** e0ne has quit IRC | 17:08 | |
| *** spandhe has joined #openstack-keystone | 17:08 | |
| breton | gyee: sorry for taking it so long. I've uploaded patch with tests | 17:08 |
| gyee | breton, no worries, but looks like you overwritten some of my changes in patch #2 | 17:10 |
| gyee | breton, for example, the hints are created after the list limit, that won't work, you have to create it prior | 17:11 |
| openstackgerrit | henry-nash proposed openstack/keystone: Add CRUD support for domain specific roles https://review.openstack.org/261870 | 17:12 |
| *** daemontool has quit IRC | 17:13 | |
| ayoung | henrynash, what do you think of the idea of making those two different policy checks? | 17:13 |
| breton | gyee: they are not created after list limit | 17:13 |
| breton | gyee: list_users doesn't always limit | 17:14 |
| henrynash | ayoung: hmm, interesting idea…. | 17:14 |
| henrynash | ayoung: thinking | 17:14 |
| breton | gyee: it limits only when hints are passed with set list_limit | 17:14 |
| ayoung | henrynash, yeah, they are fundamentally differnt paths. The policy itself should be separated, so you can't mess it up in the dynamic side | 17:14 |
| breton | gyee: before my patch limits were set before everything, in a decorator | 17:14 |
| *** nkinder has quit IRC | 17:15 | |
| breton | gyee: now before everything, except domain info fetching | 17:15 |
| henrynash | ayoung: let me look at that, don’t *think* i have any obejction to that….and would make the policy rules simpler for wure | 17:15 |
| henrynash | sure | 17:15 |
| *** vgridnev has joined #openstack-keystone | 17:16 | |
| ayoung | henrynash, thanks. | 17:16 |
| breton | gyee: if no hints are passed, users should not be limited, regardless of values in config | 17:17 |
| gyee | breton, https://review.openstack.org/#/c/266989/4/keystone/identity/core.py, line 820 on the right, you return if hints is not created | 17:17 |
| openstackgerrit | David Stanek proposed openstack/keystone: Moves policy setup into a fixture. https://review.openstack.org/278528 | 17:17 |
| *** pushkaru has joined #openstack-keystone | 17:18 | |
| dstanek | bigjools: ^ a new fixture to solve your bug! | 17:18 |
| gyee | breton, line 902, hints are created after | 17:18 |
| gyee | that won't work | 17:18 |
| dstanek | stevemar: bknudson_: ^ that fixes the policy.json bug that we are seeing in py34 | 17:18 |
| breton | gyee: right, because hints must always exist. Sometimes they are empty. | 17:18 |
| breton | if you call _set_list_limit_in_hints after creating hints in core.py, users will always be limited | 17:19 |
| breton | even when you call identity_api.list_users() without any arguments | 17:19 |
| breton | which is not what we want to happen | 17:19 |
| henrynash | ayoung: what would be the argument for havinig seperate paths for global vs dom specific crud, but common path for assigning global vs domain specific roles | 17:19 |
| *** aginwala has joined #openstack-keystone | 17:20 | |
| ayoung | henrynash, assigning is scoped to the project always | 17:20 |
| ayoung | defining an implied role is a global operation | 17:20 |
| ayoung | defining a DSR is a scoped operation | 17:20 |
| gyee | breton, you don't set the limit till its configured right? so it doesn't matter if hints exist or not | 17:20 |
| lbragstad | stevemar when making a reno - we only commit what we are changing. right? | 17:20 |
| breton | gyee: list_users must return truncated response only if hints were passed from the controller | 17:21 |
| stevemar | dstanek: i thought davechen had a fix for this | 17:21 |
| lbragstad | stevemar as in - i shouldn't have to worry about the prelude section? | 17:21 |
| breton | gyee: in all other cases it should be the full list | 17:21 |
| henrynash | ayoung: ok, I see the distinction you are making…. | 17:21 |
| breton | gyee: controller creates hints | 17:21 |
| *** dan_nguyen has joined #openstack-keystone | 17:21 | |
| ayoung | henrynash, so I want to avoid having an accidental elevation of privs | 17:21 |
| stevemar | lbragstad: yeah, don't fill in prelude, it formats terribly | 17:21 |
| lbragstad | stevemar for the trust reno - i should only change "fixes" | 17:21 |
| stevemar | lbragstad: whats the change? | 17:22 |
| dstanek | stevemar: maybe? not on the bug though | 17:22 |
| breton | gyee: that's what I emulate in tests -- a call from controller | 17:22 |
| lbragstad | stevemar https://review.openstack.org/#/c/274850/5 | 17:22 |
| ayoung | henrynash, if I could assign a DSR from Dom1 to a user on a project in DOm2, we'd have the same risk; its the coupling of the namespace to assignment that makes it safe | 17:22 |
| * breton afk for 30 minutes | 17:22 | |
| henrynash | ayoung: that does mean we have to hvae 5 new paths for domain specific roles crud, I assume | 17:22 |
| ayoung | henrynash, I would say instead to make it policy enforcement points | 17:23 |
| gyee | breton, let me go over the code again, I don't think we should truncate if limit is not set | 17:23 |
| stevemar | lbragstad: i'd go with the "other" section, it's not a "fix" | 17:23 |
| ayoung | the crud can be the same path | 17:23 |
| lbragstad | stevemar ok | 17:23 |
| henrynash | ayoung;: same API, sure | 17:23 |
| lbragstad | stevemar an I can remove everything else | 17:23 |
| lbragstad | ? | 17:23 |
| *** _cjones_ has quit IRC | 17:23 | |
| ayoung | henrynash, chew it over, but I think it is the right distinction | 17:23 |
| henrynash | ayoung: ok, thx | 17:23 |
| ayoung | henrynash, I'll comment on the review so we have a record | 17:24 |
| henrynash | ayoung: great | 17:24 |
| ayoung | henrynash, I am 2/3 of the way through https://review.openstack.org/#/c/261870/18 | 17:25 |
| stevemar | lbragstad: yep | 17:25 |
| ayoung | henrynash, but is 19 coming? | 17:25 |
| dstanek | stevemar: he doesn't have any related open reviews | 17:26 |
| henrynash | ayoung: I uploaded a new patch for samuels comments (it’s already up there), no fucntional changes, mainly (reasonable) test nits etc. | 17:26 |
| ayoung | henrynash, OK | 17:26 |
| *** _cjones_ has joined #openstack-keystone | 17:27 | |
| raildo | lbragstad: ping, about what was discussed yesterday related to fernet+v2+trust. Is there anything that I can help? btw I intend dig into this bug: https://bugs.launchpad.net/keystone/+bug/1533794 | 17:27 |
| openstack | Launchpad bug 1533794 in OpenStack Identity (keystone) "Fernet v2 token response doesn't match v2 uuid token responses" [Medium,Triaged] | 17:27 |
| *** browne has joined #openstack-keystone | 17:27 | |
| *** aginwala has quit IRC | 17:27 | |
| *** jaosorior_ has quit IRC | 17:28 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Enables token_data_helper tests for Python3 https://review.openstack.org/278055 | 17:28 |
| openstackgerrit | David Stanek proposed openstack/keystone: Stop using nose as a Python3 test runner https://review.openstack.org/278054 | 17:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 17:29 |
| *** doug-fish has joined #openstack-keystone | 17:29 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 17:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove support for trusts in v2.0 https://review.openstack.org/274850 | 17:29 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consolidate the fernet provider validate_v2_token() https://review.openstack.org/274851 | 17:29 |
| lbragstad | raildo ^ | 17:29 |
| *** nekrodesk has joined #openstack-keystone | 17:30 | |
| *** nekrodesk has quit IRC | 17:30 | |
| *** mylu has joined #openstack-keystone | 17:31 | |
| ayoung | henrynash, do you need the override for list roles, or can we just replace the original list_roles with the logic in your wrapper? Why do we need to keep the original? | 17:31 |
| ayoung | https://review.openstack.org/#/c/261870/19/keystone/assignment/controllers.py | 17:31 |
| henrynash | ayoung: becuase (i this version) you need to set up teh domain id filter BEFORE you call polciy enforncement | 17:32 |
| ayoung | henrynash, So if we modified the policy check decorator it would have the same effect? | 17:33 |
| henrynash | ayoung: sure | 17:33 |
| ayoung | something like | 17:33 |
| ayoung | henrynash, I think that would be cleaner. I don't like messing around with the logic in the routers | 17:33 |
| ayoung | But I understand why you are. | 17:33 |
| ayoung | let me look at it for a few more minutes. | 17:33 |
| henrynash | ayoung: there are a few places we do that | 17:33 |
| ayoung | modify the decorator? | 17:34 |
| *** nekrodesk has joined #openstack-keystone | 17:34 | |
| *** nekrodesk has quit IRC | 17:34 | |
| henrynash | ayoung: no, have to have a wrapper to get code executed before we call the method we have a poliy rule on | 17:34 |
| *** dolphm_ has joined #openstack-keystone | 17:34 | |
| ayoung | henrynash, So..that is fine, but we've not done it in the router before. Why in the router now? | 17:35 |
| henrynash | ayoung: the changes in the router where just to make it easy to allow us to use the standard router mappings for v3 while overriding one method…teh alternative was to remove using the v3router and insert all the routes manually…whcih seemed worse | 17:36 |
| ayoung | Ah | 17:37 |
| *** lhcheng has joined #openstack-keystone | 17:37 | |
| *** ChanServ sets mode: +v lhcheng | 17:37 | |
| *** mhickey has quit IRC | 17:37 | |
| henrynash | ayoung: so there is no specific logic added to teh routwer, just the ability to rename a mthod for a given action (from the standard list_<entity>, get_<entity> etc.) | 17:38 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 17:38 |
| *** rk4n has joined #openstack-keystone | 17:39 | |
| *** boris-42 has joined #openstack-keystone | 17:39 | |
| ayoung | henrynash, right. This makes sense, but I wonder if the patterns of "hereis how you do it for global versus scoped" is something we want to generalize | 17:39 |
| ayoung | We don;t allow nested domains, so we wouldnt have ti there | 17:39 |
| *** nekrodesk has joined #openstack-keystone | 17:40 | |
| *** nekrodesk has quit IRC | 17:40 | |
| raildo | lbragstad: you're the guy! | 17:40 |
| ayoung | I could see maybe for catalog filter | 17:40 |
| ayoung | lbragstad, did you see the responses on trusts V2 on the mailing list? | 17:40 |
| raildo | lbragstad: do you have some tips related to the other bug? Anything to help me to start on it? | 17:40 |
| henrynash | ayoung: well, the specifics of this wrpper are just to allow teh defualt of only returning global roles if you don’t provide a filter (for backward compatibiity reasons) | 17:40 |
| ayoung | lbragstad, what would it take to continue to honor it? | 17:40 |
| henrynash | ayoung: but as a general point, maybe there are cases | 17:41 |
| ayoung | henrynash, right. And it is not horrible | 17:41 |
| henrynash | ayoung: for instance, I think we will need domain specific mappig rules | 17:41 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 17:41 |
| henrynash | ayoung: (not in mitaka) | 17:41 |
| ayoung | but since we are talking about splitting the policy enforcement along these lines now anyway, perhaps should address it now | 17:42 |
| lbragstad | ayoung we'd have to introduce trust support for v2.0 fernet tokens | 17:42 |
| ayoung | lbragstad, could that be done in a follow on patch? | 17:42 |
| ayoung | lbragstad, ie: we know we broke it, but we are adding it back? | 17:42 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Convert policy to yaml https://review.openstack.org/278542 | 17:43 |
| *** jed56 has quit IRC | 17:43 | |
| *** nkinder has joined #openstack-keystone | 17:43 | |
| *** nekrodesk has joined #openstack-keystone | 17:44 | |
| *** nekrodesk has quit IRC | 17:44 | |
| lbragstad | ayoung I was going on the consensus of the comments in the review | 17:44 |
| lbragstad | ayoung and it seemed like people were fine removing that from v2.0 | 17:44 |
| ayoung | lbragstad, yeah. I am willing to drive on with this approach, provided we can unfuck ourselves later | 17:44 |
| ayoung | sorry, technical term | 17:44 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 17:45 |
| lbragstad | ayoung so you want to remove support for using trusts against v2.0 and then re-add it back in? | 17:45 |
| ayoung | lbragstad, yes I do | 17:45 |
| henrynash | ayoung: should that be un or de ? | 17:45 |
| ayoung | henrynash, it should be unde | 17:45 |
| ayoung | antidis | 17:45 |
| ayoung | lbragstad, I just want the risk mitigation laid out | 17:45 |
| ayoung | if we have broken everyone, how bad is it to add back in? | 17:46 |
| ayoung | once we have fernet the default | 17:46 |
| ayoung | or should we just bite the bullet and do that now | 17:46 |
| *** nekrodesk has joined #openstack-keystone | 17:47 | |
| *** nekrodesk has quit IRC | 17:47 | |
| *** ChanServ sets mode: +o dolphm_ | 17:47 | |
| lbragstad | ayoung that's why i brought it up in the meeting yesterday | 17:48 |
| *** ninag has quit IRC | 17:48 | |
| ayoung | lbragstad, yes, but getting a new feature in needs to be done pre M3 | 17:48 |
| ayoung | A bug fix can be done after | 17:48 |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 17:49 |
| krotscheck | Is it possible to get another core review pass on https://review.openstack.org/#/c/241317/ ? I've answered all the questions and made requested changes (and it's passing the gate, whee!) | 17:51 |
| *** roxanaghe has quit IRC | 17:52 | |
| *** rcernin has joined #openstack-keystone | 17:52 | |
| lbragstad | ayoung it would take refactoring to allow trusts back into fernet | 17:52 |
| lbragstad | and testing | 17:53 |
| ayoung | lbragstad, in V3 how does Fernet handle trusts? | 17:53 |
| *** nekrodesk has joined #openstack-keystone | 17:53 | |
| lbragstad | it packs the trust id into the token | 17:53 |
| lbragstad | and handles it as an explicit trust scoped token | 17:54 |
| *** petertr7 is now known as petertr7_away | 17:54 | |
| samueldmq | henrynash: hi | 17:56 |
| samueldmq | henrynash: left a couple of review on the domain-roles thing | 17:56 |
| henrynash | samueldmq: hi | 17:56 |
| samueldmq | henrynash: it's looking pretty good, just a few things to adjust/nits :) | 17:56 |
| samueldmq | henrynash: should be an easy approval | 17:56 |
| henrynash | samueldmq: i fixed upa bunch of the ones you mentioned….was there more on top, or just those | 17:56 |
| *** aginwala has joined #openstack-keystone | 17:57 | |
| henrynash | samueldmq: I think we do need the controller wrapper, see me reply to yours | 17:57 |
| *** mvk has quit IRC | 17:59 | |
| *** dolphm has quit IRC | 17:59 | |
| *** dolphm_ is now known as dolphm | 17:59 | |
| stevemar | samueldmq: easy approval? sign me up | 18:00 |
| *** Guest53252 has quit IRC | 18:01 | |
| samueldmq | stevemar: domain-roles is pretty good already :) | 18:01 |
| *** tsymanczyk has joined #openstack-keystone | 18:01 | |
| samueldmq | henrynash: looking t your reply | 18:02 |
| stevemar | samueldmq: obviously, it's henry nash! | 18:02 |
| *** tsymanczyk has quit IRC | 18:02 | |
| stevemar | :P | 18:02 |
| henrynash | stevemar: I’ll pay you later | 18:02 |
| ayoung | lbragstad, and how does Fernet handle V2 ? | 18:03 |
| samueldmq | stevemar: ++ | 18:03 |
| *** nkinder has quit IRC | 18:03 | |
| *** aginwala has quit IRC | 18:06 | |
| *** richm has quit IRC | 18:06 | |
| *** jaosorior has quit IRC | 18:09 | |
| *** pnavarro has quit IRC | 18:09 | |
| *** itlinux has quit IRC | 18:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove eventlet support https://review.openstack.org/249486 | 18:13 |
| stevemar | henrynash: i accept payment in check or cash | 18:13 |
| stevemar | bknudson_: ^ fixed it up, kept the options | 18:14 |
| *** aginwala has joined #openstack-keystone | 18:14 | |
| henrynash | stevemar: a checked shirt on its way | 18:14 |
| *** mylu has quit IRC | 18:16 | |
| *** tsymanczyk has joined #openstack-keystone | 18:16 | |
| *** mylu has joined #openstack-keystone | 18:17 | |
| *** tsymanczyk is now known as Guest52385 | 18:17 | |
| *** e0ne has joined #openstack-keystone | 18:20 | |
| samueldmq | henrynash: so, about that domain_id=None filter | 18:24 |
| henrynash | samueldmq: indeed… | 18:24 |
| samueldmq | henrynash: hmm, I think I just got your point | 18:24 |
| henrynash | samueldmq: the key is you have to do it BEFORE you do the policy check…since the policy check may want to look at the filter | 18:24 |
| samueldmq | henrynash: if I don't provide a filter for attribute_x, it doesn't mean that attribute_x=None would have the same result | 18:25 |
| samueldmq | henrynash: it actually would filter on attribute_x where it corresponds to None | 18:25 |
| lbragstad | ayoung it tells you to go to v3 if you want to get a trust scoped token | 18:25 |
| henrynash | samueldmq: yes, it would filter on that (and return only global roles) | 18:25 |
| lbragstad | ayoung https://github.com/openstack/keystone/blob/7a0874f6f69852584061fa384f75dfb0d5f1c229/keystone/token/providers/fernet/core.py#L165-L168 | 18:25 |
| *** spzala has joined #openstack-keystone | 18:26 | |
| *** igornsa_ has joined #openstack-keystone | 18:26 | |
| samueldmq | henrynash: so /roles and /roles?domain_id=None are equivalent | 18:26 |
| samueldmq | ? | 18:26 |
| henrynash | samuedlmq: yes | 18:27 |
| henrynash | i.e. global roles by default, for backward compatibility | 18:27 |
| samueldmq | henrynash: if we returne both, it didn't mean we weren't backwards compatible | 18:28 |
| *** mylu has quit IRC | 18:28 | |
| samueldmq | henrynash: because there were no domain-specific roles before ... | 18:28 |
| henrynash | samueldmq: indeed, and the name of a domain specific role may be the same as an existing global role, so we want clienst to have to ask explicitley and hence know how to handle the results | 18:29 |
| samueldmq | henrynash: fair point | 18:31 |
| lbragstad | raildo to get a start on https://bugs.launchpad.net/keystone/+bug/1533794 I think we need to consolidate the fernet and uuid token providers | 18:31 |
| openstack | Launchpad bug 1533794 in OpenStack Identity (keystone) "Fernet v2 token response doesn't match v2 uuid token responses" [Medium,Triaged] | 18:31 |
| lbragstad | raildo once that is done, there is less room for data creep | 18:31 |
| samueldmq | henrynash: perhaps domain-specific roles could have their names prepended with domain_name | 18:31 |
| lbragstad | between token providers | 18:31 |
| *** su_zhang has joined #openstack-keystone | 18:31 | |
| raildo | lbragstad: makes sense | 18:31 |
| samueldmq | henrynash: I think you have thought about all this, I am just making sure :) | 18:31 |
| henrynash | samueldmq: they could, but from a domain admin point of view that would suck! | 18:31 |
| *** spzala has quit IRC | 18:32 | |
| henrynash | samuedlmq: since they can ONLY create dsrs in their own domain | 18:32 |
| samueldmq | so they only can /roles?domain_id=xx | 18:32 |
| *** spzala has joined #openstack-keystone | 18:32 | |
| ayoung | lbragstad, OK, walk me through it. I really don't see what the problem is here. | 18:32 |
| samueldmq | the only difference would be that a cloud admin would be able to see all the roles in the cloud | 18:32 |
| lbragstad | ayoung I'm not seeing your email | 18:32 |
| samueldmq | henrynash: perhaps another special call for that if we need it in the future ? | 18:33 |
| ayoung | lbragstad, ? | 18:33 |
| ayoung | a particular one, or any? | 18:33 |
| lbragstad | ayoung ah - I misread your message | 18:33 |
| lbragstad | nevermind | 18:33 |
| henrynash | samueldmq: yes cloud admin can see them all | 18:33 |
| samueldmq | henrynash: like ?include_domain_specific_roles_yes_it_is_too_big_for_a_query_param | 18:33 |
| samueldmq | henrynash: but not in a single call right ? | 18:33 |
| henrynash | samueldmq: or maybe a longer parameter if we can think of one | 18:34 |
| ayoung | lbragstad, the fernet payload holds the version of the token? | 18:34 |
| samueldmq | henrynash: anyway, cloud admin isn't supposed to manage domain roles | 18:34 |
| henrynash | samueldmq: not in the usual case, no | 18:35 |
| samueldmq | henrynash: he takes care of global roles, and each domain_admin creates his own abstractions that maps better for their domain | 18:35 |
| henrynash | samueldmq: yep | 18:35 |
| lbragstad | ayoung no | 18:35 |
| lbragstad | ayoung the fernet payload just holds things about the token | 18:35 |
| ayoung | lbragstad, then why would calling validate V2 with a trust ID be a problem? | 18:35 |
| lbragstad | ayoung it doesn't know if the token was v2 or v3 | 18:35 |
| ayoung | lbragstad, I know. It just knows that a trust was in there, right? | 18:36 |
| lbragstad | ayoung yes | 18:36 |
| ayoung | but if we call validate on the v2 api, and there is a trustid in the token, why is this a problem? | 18:37 |
| lbragstad | ayoung let me code it up quick and post for review | 18:37 |
| ayoung | OK | 18:37 |
| *** spzala has quit IRC | 18:37 | |
| *** aginwala has quit IRC | 18:39 | |
| samueldmq | henrynash: +2'ed , only left a comment regarding a new test case that could be added | 18:39 |
| samueldmq | henrynash: but shoudn't block the change | 18:39 |
| *** pnavarro has joined #openstack-keystone | 18:39 | |
| henrynash | samuedlmq: thx…happy to come back in and add more tests….. | 18:41 |
| *** aginwala has joined #openstack-keystone | 18:42 | |
| samueldmq | henrynash: :) | 18:43 |
| *** jsavak has quit IRC | 18:44 | |
| ayoung | henrynash, so...should create DSR be a different API call? It does not feel like it should. | 18:44 |
| ayoung | But the policy should be different | 18:44 |
| ayoung | and the wrapper seems strange | 18:44 |
| henrynash | ayoung: agreed…same API call | 18:44 |
| ayoung | ok, so long as we can split the policy itself, we can always refactor the internals | 18:44 |
| ayoung | its a controller, and the API foer that is private | 18:45 |
| henrynash | ayoung: IF we want to givem the separate policy endpoints, then need a kind of wrapper for each API, whcih checks to see if it is a domain specific role…and if so calls one policy endpoint method, if not a different one | 18:45 |
| henrynash | I’m modify the follow on patch (that change sthe polci file) to try this out…will post it and see what we think | 18:46 |
| samueldmq | htruta: raildo: hey, what's missing for reseller phase 1 ? | 18:46 |
| samueldmq | htruta: raildo: I still see it as an open bp targeted to m3 https://blueprints.launchpad.net/keystone/+spec/reseller | 18:47 |
| *** pnavarro has quit IRC | 18:47 | |
| henrynash | ayoung: so I think the base patch is OK as is - if we go the seperate policy endpoint route in the follow on patch, then I’ll be modify the list_wrapper | 18:48 |
| ayoung | henrynash, works for me | 18:48 |
| samueldmq | henrynash: btw, looks like w eneed a docimpact tag there ? | 18:49 |
| henrynash | samuedlmq: yep, agreed | 18:49 |
| samueldmq | henrynash: since all docs refering to roles need to be clear on global roles vs dsr | 18:49 |
| bknudson_ | dstanek: there's several references to rules.reset(), e.g., in test_v3_protection | 18:50 |
| dstanek | bknudson_: hmmm...let's see | 18:51 |
| bknudson_ | keystone/tests/unit/rest.py | 18:51 |
| bknudson_ | keystone/tests/unit/test_policy.py | 18:51 |
| bknudson_ | maybe could pass in the policy file name to config_overrides() | 18:51 |
| *** petertr7_away is now known as petertr7 | 18:52 | |
| *** roxanaghe has joined #openstack-keystone | 18:53 | |
| bknudson_ | or could save the fixture and provide a method to switch to a different policy | 18:53 |
| ayoung | henrynash, +2A on https://review.openstack.org/#/c/261870/19 | 18:53 |
| henrynash | ayoung: thx | 18:53 |
| bknudson_ | seems like we should be defaulting to policy.v3cloudsample.json at some point | 18:53 |
| ayoung | bknudson_, once you finish porting it to yaml | 18:54 |
| *** mylu has joined #openstack-keystone | 18:54 | |
| ayoung | then we can do policy.yml with the new rules | 18:54 |
| ayoung | cna put a note that policy.json is old and deprecated | 18:54 |
| samueldmq | henrynash: ayoung: nice, domain-roles approved ! :) | 18:55 |
| bknudson_ | ayoung: good idea | 18:55 |
| henrynash | (does little rain dance) | 18:55 |
| samueldmq | hehe | 18:55 |
| ayoung | samueldmq, yeah, but we really do need to split the policy for DSR from global | 18:55 |
| dstanek | bknudson_: what do you think is better. defining a class variable POLICY_FILE and override in that class or add a method to the fixture to load/reset? | 18:55 |
| samueldmq | ayoung: separate entried in the policy file ? | 18:55 |
| ayoung | samueldmq, yes | 18:56 |
| samueldmq | ayoung: like it was 2 APIs? | 18:56 |
| dstanek | bknudson_: adding the method to the fixture just means the the policy setup happens twice | 18:56 |
| *** aginwala has quit IRC | 18:56 | |
| samueldmq | like 2 endpoints ? | 18:56 |
| ayoung | samueldmq, global needs one policy, DSR a separate policy | 18:56 |
| bknudson_ | dstanek: I'm pretty sure it was happening already that the policy setup happens twice. | 18:56 |
| ayoung | to make it clear that you should not let a domain admin write global policy, | 18:56 |
| bknudson_ | dstanek: do we have any tests that set the policy just for the test and not for all the tests in the class? | 18:57 |
| samueldmq | ayoung: yeah I know, global roles are managed by cloud admin | 18:57 |
| samueldmq | ayoung: domain admins map global roles as they want | 18:57 |
| dstanek | bknudson_: it shouldn't with this change, generally speaking. | 18:57 |
| dstanek | bknudson_: not that i know of | 18:57 |
| ayoung | samueldmq, so we'll get that split in a follow on patch | 18:57 |
| bknudson_ | dstanek: a class variable makes sense then. we can always change it. | 18:57 |
| samueldmq | ayoung: how would that be in the policy ? something like identity:list_roles and identity:list_domain_roles ? | 18:58 |
| htruta | samueldmq: we miss code reviews | 18:58 |
| ayoung | samueldmq, I don't care for list | 18:58 |
| samueldmq | htruta: so here I am | 18:58 |
| ayoung | I care for create and modify | 18:58 |
| ayoung | but yes | 18:58 |
| samueldmq | ayoung: hm, can't we control by checking the provided entity contains a domain_id | 18:58 |
| samueldmq | ayoung: like create_role:domain_admin and role.domain_id | 18:59 |
| ayoung | samueldmq, it makes the policy quite complex. And since we want policy to be editable, it makes it fragile | 18:59 |
| samueldmq | ayoung: so put part of that in the code? | 18:59 |
| samueldmq | ayoung: but we don't do that so far right ? | 18:59 |
| htruta | samueldmq: the 3 first patches of the chain are good to go, henrynash has made a lot of work at them. And the other ones need some rebase | 18:59 |
| *** su_zhang has quit IRC | 18:59 | |
| *** aginwala has joined #openstack-keystone | 19:00 | |
| samueldmq | htruta: could you provide me a link? | 19:00 |
| ayoung | samueldmq, right now, we are OK since we don't really have a fix for 968696 in the default anyway | 19:00 |
| *** aginwala has quit IRC | 19:00 | |
| htruta | samueldmq: sure. you can start from this one: https://review.openstack.org/#/c/264533/23 | 19:00 |
| samueldmq | htruta: k I will look at them after project tree disable/delete | 19:01 |
| *** petertr7 is now known as petertr7_away | 19:01 | |
| htruta | samueldmq: awesome | 19:01 |
| *** doug-fis_ has joined #openstack-keystone | 19:02 | |
| *** nekrodesk has quit IRC | 19:04 | |
| *** daemontool has joined #openstack-keystone | 19:04 | |
| *** doug-fi__ has joined #openstack-keystone | 19:04 | |
| *** igornsa_ has quit IRC | 19:04 | |
| openstackgerrit | Trevor McKay proposed openstack/python-keystoneclient: Handle exception on UnicodeDecodError in logging of request https://review.openstack.org/278027 | 19:04 |
| *** aginwala has joined #openstack-keystone | 19:05 | |
| *** doug-fish has quit IRC | 19:05 | |
| *** doug-fis_ has quit IRC | 19:06 | |
| *** henrynash has quit IRC | 19:07 | |
| dstanek | bknudson_: what do you think about a pattern like: http://paste.openstack.org/show/486612/ | 19:07 |
| *** spzala has joined #openstack-keystone | 19:07 | |
| *** jsavak has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 19:08 |
| *** doug-fi__ has quit IRC | 19:09 | |
| *** c_soukup has joined #openstack-keystone | 19:09 | |
| *** spzala has quit IRC | 19:09 | |
| *** spzala has joined #openstack-keystone | 19:09 | |
| openstackgerrit | ayoung proposed openstack/keystone: Make fernet work with oauth1 authentication https://review.openstack.org/267781 | 19:10 |
| *** mylu_ has joined #openstack-keystone | 19:11 | |
| openstackgerrit | ayoung proposed openstack/keystone: Make fernet default token provider https://review.openstack.org/258650 | 19:13 |
| *** csoukup has quit IRC | 19:13 | |
| ayoung | lbragstad, just cleaned up the commit messages. | 19:13 |
| lbragstad | ayoung thanks | 19:13 |
| ayoung | lbragstad, please make sure you do a git review -d before making any more changes to keep the edits. | 19:14 |
| *** mylu has quit IRC | 19:15 | |
| *** aginwala has quit IRC | 19:16 | |
| *** aginwala has joined #openstack-keystone | 19:17 | |
| *** mylu_ has quit IRC | 19:19 | |
| *** c_soukup has quit IRC | 19:19 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Add backend support for deleting a projects list https://review.openstack.org/245916 | 19:20 |
| htruta | samueldmq, stevemar: just addressed your comments in here ^ | 19:21 |
| *** mylu has joined #openstack-keystone | 19:21 | |
| samueldmq | htruta: thanks | 19:23 |
| samueldmq | krotscheck: hi, about https://review.openstack.org/#/c/241317 | 19:23 |
| *** mylu has quit IRC | 19:23 | |
| samueldmq | krotscheck: why aren't the headers for tokenless auth needed anymore | 19:23 |
| samueldmq | ? | 19:23 |
| samueldmq | krotscheck: just saw they were removed from patchset 9 to 10 | 19:24 |
| *** mylu has joined #openstack-keystone | 19:24 | |
| *** su_zhang has joined #openstack-keystone | 19:25 | |
| *** csoukup has joined #openstack-keystone | 19:26 | |
| *** mylu has quit IRC | 19:27 | |
| krotscheck | samueldmq: I was under the impression, from the discussion on PS8, that they were headers added by the keystone middleware once a token had been parsed. Ergo, not actually part of the external API. | 19:28 |
| *** petertr7_away is now known as petertr7 | 19:28 | |
| *** nekrodesk has joined #openstack-keystone | 19:28 | |
| *** nekrodesk has quit IRC | 19:28 | |
| *** jasonsb has quit IRC | 19:28 | |
| *** jsavak has quit IRC | 19:28 | |
| *** jasonsb has joined #openstack-keystone | 19:29 | |
| *** mylu has joined #openstack-keystone | 19:30 | |
| *** mylu has quit IRC | 19:31 | |
| samueldmq | krotscheck: so not something coming form the clients and that needed to be added to latent_allow_headers and latent_expose_headers | 19:32 |
| samueldmq | krotscheck: I need to check that | 19:32 |
| krotscheck | Yep | 19:32 |
| krotscheck | That was my assumption, anyway | 19:32 |
| samueldmq | gyee: hi, I have a question about tokenless auth | 19:33 |
| *** jsavak has joined #openstack-keystone | 19:33 | |
| krotscheck | Given that x509 authentication is a public standard, and the bits I removed were custom headers | 19:33 |
| samueldmq | gyee: (I am assuming you are aware of howthat works :)) | 19:33 |
| gyee | samueldmq, sure, I 'll try :) | 19:34 |
| samueldmq | krotscheck: yes, but I thought the user needed to pass the headers himself, as to provide the needed info to authenticate | 19:34 |
| *** jasonsb has quit IRC | 19:34 | |
| samueldmq | gyee: these headers https://github.com/openstack/keystone/blob/af399474b2e67b023225a8abffe8933af40c1548/doc/source/configure_tokenless_x509.rst#scope-information | 19:34 |
| gyee | right, we need to headers to convey the scope information | 19:35 |
| samueldmq | gyee: are they provided by the user right ? | 19:35 |
| gyee | correct | 19:35 |
| krotscheck | Really? | 19:35 |
| samueldmq | gyee: perfect, and x509 certs is just about the way we encrypt/decrypt the info | 19:35 |
| *** mylu has joined #openstack-keystone | 19:35 | |
| krotscheck | Tokenless auth isn't a W3C spec, it's all done via X-?? headers? | 19:35 |
| gyee | the cert conveys identity while the headers convey the scope | 19:36 |
| samueldmq | krotscheck: we need that info to a user get a token, so I understand x509 is just about identity security | 19:36 |
| *** jorge_munoz1 has quit IRC | 19:37 | |
| *** mylu has quit IRC | 19:37 | |
| samueldmq | gyee: exactly, so the certs avoid username/password, but we still need info to where scope to | 19:37 |
| samueldmq | krotscheck: ^ | 19:37 |
| gyee | that was done with other auth mechanisms in mind (i.e. kerberos) | 19:37 |
| krotscheck | oookay | 19:37 |
| krotscheck | Alright, I'll add them back in | 19:37 |
| gyee | krotscheck, why not make them configurable? | 19:38 |
| *** daemontool has quit IRC | 19:38 | |
| krotscheck | gyee: They are. | 19:38 |
| gyee | great! | 19:38 |
| krotscheck | gyee: You can add them manually in keystone.conf. | 19:38 |
| krotscheck | gyee: This is just to make sure that an operator doesn't have to know to add those. | 19:38 |
| gyee | nice, I like it | 19:38 |
| krotscheck | I'll do it in a separate patch so we can argue whether it makes sense to include them. Will that work samueldmq ? | 19:39 |
| gyee | sounds like a plan | 19:39 |
| *** nekrodesk has joined #openstack-keystone | 19:40 | |
| krotscheck | gyee: Just to clarify: Those headers are incoming only, the API doesn't return them, yes? | 19:40 |
| samueldmq | krotscheck: add the headers in a follwoon patch ? or just make them configurable , | 19:40 |
| samueldmq | ? | 19:40 |
| krotscheck | samueldmq: Followup patch | 19:41 |
| gyee | krotscheck, yes, incoming only | 19:41 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Fix trust chain/redelegation tests https://review.openstack.org/278163 | 19:41 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Added tokenless auth headers to CORS middleware https://review.openstack.org/278580 | 19:42 |
| krotscheck | gyee, samueldmq ^^ | 19:42 |
| gyee | thank, will take a look | 19:42 |
| gyee | thanks | 19:42 |
| samueldmq | krotscheck: works for me | 19:42 |
| *** mylu has joined #openstack-keystone | 19:42 | |
| *** doug-fish has joined #openstack-keystone | 19:43 | |
| *** jbell8 has quit IRC | 19:43 | |
| *** mylu has quit IRC | 19:43 | |
| *** jbell8 has joined #openstack-keystone | 19:45 | |
| samueldmq | tjcocozz: about https://review.openstack.org/#/c/241317 | 19:45 |
| *** dikonoor has quit IRC | 19:45 | |
| samueldmq | tjcocozz: krotscheck is now addressing tokenless auth headers in a followup patch https://review.openstack.org/#/c/278580 | 19:45 |
| samueldmq | tjcocozz: that's why I changed my score there | 19:46 |
| ayoung | gyee, so this will work for you: https://review.openstack.org/#/c/266137/ in general? I thought you wanted a shared token cache? | 19:46 |
| krotscheck | tjcocozz: I also commented with a temporary way of enabling those headers. | 19:46 |
| ayoung | Oh wait | 19:46 |
| ayoung | wrong patch | 19:47 |
| tjcocozz | krotscheck, awesome! I will set up a devstack with your new patch. | 19:47 |
| tjcocozz | samueldmq, ^^ | 19:47 |
| krotscheck | And, well, the reason I added a new patch is because the gate is rather full right now | 19:47 |
| krotscheck | Anyway | 19:47 |
| * krotscheck shifts into daycare mode. | 19:47 | |
| *** krotscheck is now known as krotscheck_dcm | 19:47 | |
| gyee | ayoung, you mean the endpoint checking at the server side? that definitely will work for me | 19:47 |
| samueldmq | tjcocozz: nice, make sure to review -d the followup patch, so you get the same as it was in patchset 9 | 19:48 |
| ayoung | gyee,OK | 19:48 |
| ayoung | that is great | 19:48 |
| krotscheck_dcm | I'll get any questions you have, just might respond to them in a delayed manner. | 19:48 |
| ayoung | we can work with that | 19:48 |
| samueldmq | tjcocozz: that's great you test it :) | 19:48 |
| gyee | ayoung, I love that proposal because 1) we don't have to change the catalog; and 2) no middleware needed | 19:48 |
| ayoung | it is far more efficient, I think. But it will be problematic if people share the cache between serives | 19:48 |
| samueldmq | tjcocozz: thanks for doing so | 19:48 |
| tjcocozz | samueldmq, there should be a dependency in his commit message | 19:48 |
| ayoung | I need to see it that will screw up all-in-one deploys | 19:48 |
| ayoung | gyee, but, I think its ok | 19:49 |
| tjcocozz | samueldmq, i think he is offline now. | 19:49 |
| gyee | ayoung, I don't think its a problem, this is no different from how we cache invalid tokens today | 19:49 |
| gyee | ayoung, it will work, thanks for putting together the spec | 19:49 |
| ayoung | gyee, if we go with fineer graine policy, the two things will be complementary | 19:49 |
| openstackgerrit | Merged openstack/keystone: Uses open context manager for templated catalogs https://review.openstack.org/278053 | 19:49 |
| ayoung | gyee, it was based on a convo with morgan | 19:49 |
| ayoung | his -1 was looking out for you, but it was his idea, too | 19:49 |
| gyee | that's good, I think we have a path forward | 19:50 |
| ayoung | gyee, do we have a "default filter" for catalog? | 19:50 |
| gyee | we don't deprecate the APIs to setup the endpoint-project relationship and we do the enforcement at the server side during token validation | 19:50 |
| samueldmq | tjcocozz: the commits are dependant already aren't they ? | 19:50 |
| ayoung | a way to say "this is what people get by default that is not the entire catalog"? | 19:51 |
| gyee | ayoung, agreed, that's what we have now I think | 19:51 |
| samueldmq | tjcocozz: https://review.openstack.org/#/c/278580 's parent is 55b056fa9e5d776b00b666ca74fa56461f2b4dfc | 19:52 |
| gyee | like either allow all or deny all if project-endpoint relationship doesn't exist | 19:52 |
| samueldmq | tjcocozz: which is https://review.openstack.org/#/c/241317 | 19:52 |
| *** jorge_munoz1 has joined #openstack-keystone | 19:52 | |
| samueldmq | tjcocozz: I don't know other way to look at dependency tree in the new gerrit ui | 19:52 |
| samueldmq | :( | 19:52 |
| * tjcocozz is looking now | 19:53 | |
| *** su_zhang has quit IRC | 19:53 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Tokens with subset of catalog https://review.openstack.org/266137 | 19:55 |
| tjcocozz | samueldmq, it is very confusing how it is setup now. I think your right, he set up the depencenies correctly. | 19:55 |
| *** rk4n has quit IRC | 19:55 | |
| *** doug-fish has quit IRC | 19:55 | |
| *** jbell8 has quit IRC | 19:55 | |
| roxanaghe | lhcheng, you here? I have a question about the keystone url used by horizon for websso authentication | 19:56 |
| *** jbell8 has joined #openstack-keystone | 19:56 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Tokens with subset of catalog https://review.openstack.org/266137 | 19:57 |
| roxanaghe | lhcheng, in fact it's more like a proposal - I would like to have an OPENSTACK_WEBSSO_KEYSTONE_URL config setting | 19:57 |
| *** jgriffith is now known as jgriffith_away | 19:57 | |
| ayoung | gyee, Feel free to take that spec and run with it | 19:57 |
| gyee | ayoung, sure will do | 19:57 |
| ayoung | gyee, what did you mean by <endpoint_filter> though, in the request? | 19:57 |
| ayoung | We don;t want to have to edit the remote config files | 19:57 |
| samueldmq | tjcocozz: yes, I really don't like the way the dependencies are shown there :/ | 19:58 |
| ayoung | so I was figuring the service would figure out its Hostname and port and send those to keystone | 19:58 |
| ayoung | based on requests that come it, or a config option | 19:58 |
| gyee | ayoung, its the same filter we support at the client side | 19:58 |
| ayoung | that was what we had agreed on in the past, so what would the filter look like? | 19:58 |
| tjcocozz | samueldmq, maybe the next release of gerrit | 19:59 |
| gyee | ?server=xyz,region=abc,interface=public | 19:59 |
| *** jbell8 has quit IRC | 19:59 | |
| gyee | same set of filters supported by the Session I think | 19:59 |
| ayoung | gyee, OK. Can you modify the api in that spec to show that? | 20:00 |
| *** jbell8 has joined #openstack-keystone | 20:00 | |
| gyee | ayoung, yes, on my todo list | 20:00 |
| ayoung | excellent | 20:00 |
| samueldmq | tjcocozz: yeah, I am crossing my fingers | 20:00 |
| *** aginwala has quit IRC | 20:01 | |
| *** mylu has joined #openstack-keystone | 20:01 | |
| *** AJaeger has joined #openstack-keystone | 20:02 | |
| lhcheng | hey roxanaghe | 20:02 |
| *** doug-fish has joined #openstack-keystone | 20:02 | |
| *** aginwala has joined #openstack-keystone | 20:03 | |
| roxanaghe | hey lhcheng | 20:03 |
| *** aginwala has quit IRC | 20:03 | |
| *** aginwala has joined #openstack-keystone | 20:04 | |
| lhcheng | if we have OPENSTACK_WEBSSO_KEYSTONE_URL, we can only make WEBSSO to work with one endpoint | 20:05 |
| roxanaghe | lhcheng, so I want to put up a patch in Horizon to add a config setting OPENSTACK_WEBSSO_KEYSTONE_URL because in our environments we use an internal VIP to communicate with Keystone for the keystone credentials authentication but that does not work for websso | 20:06 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Make pep8 *the* linting interface https://review.openstack.org/278591 | 20:07 |
| roxanaghe | lhcheng, can you expand on that? | 20:07 |
| AJaeger | keystone cores, I'm sorry: We have to go back to pep8 since that's the documented requested interface ^ | 20:07 |
| stevemar | AJaeger: :( its all good | 20:07 |
| * AJaeger just made a bit of work for himself ;( | 20:08 | |
| bknudson_ | I was starting to wonder when everyone else would switch to linters. | 20:08 |
| *** daemontool has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Henrique Truta proposed openstack/keystone: Manager support for project cascade delete https://review.openstack.org/244149 | 20:08 |
| AJaeger | bknudson_: I learned today what it means to switch everyone - and that's more than I can chew right now ;( | 20:09 |
| lhcheng | roxanaghe: hmm let me think about that, can I get back to you later? | 20:09 |
| bknudson_ | AJaeger: how about switch the infra jobs to pep8 and then just remove linters? | 20:09 |
| bknudson_ | rather than 2 commits in keystone | 20:09 |
| AJaeger | bknudson_: good idea - we left pep8 in... | 20:10 |
| AJaeger | thanks, will do... | 20:10 |
| *** haneef has joined #openstack-keystone | 20:10 | |
| stevemar | AJaeger: do we need to split pep8 back into pep8 and bandit? | 20:10 |
| roxanaghe | lhcheng, sure | 20:10 |
| AJaeger | stevemar: not at all, pep8 and linters have the same meaning - general linting | 20:12 |
| dstanek | AJaeger: that's unfortunate | 20:13 |
| AJaeger | dstanek: if somebody wants to change the PTI and all official projects, then go for it - but I figured out what I started and cannot finish that. | 20:14 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 20:15 |
| AJaeger | https://review.openstack.org/278593 is the infra change | 20:16 |
| *** doug-fish has quit IRC | 20:18 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystonemiddleware: Make pep8 *the* linting interface https://review.openstack.org/278599 | 20:18 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Make pep8 *the* linting interface https://review.openstack.org/278591 | 20:19 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/269479 | 20:19 |
| *** doug-fish has joined #openstack-keystone | 20:20 | |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Make pep8 *the* linting interface https://review.openstack.org/278602 | 20:21 |
| AJaeger | stevemar: could you +1 the infra change 278593 , please? | 20:21 |
| *** jgriffith_away is now known as jgriffith | 20:22 | |
| *** dave-mcc_ has joined #openstack-keystone | 20:22 | |
| *** dave-mccowan has quit IRC | 20:22 | |
| *** dave-mccowan has joined #openstack-keystone | 20:23 | |
| *** dolphm has quit IRC | 20:24 | |
| *** dave-mcc_ has quit IRC | 20:26 | |
| haneef | stevemar: What is the purpose of user-deleted audit event?. It has user-id, but the user is gone from db, No way to figure out who got deleted | 20:27 |
| *** su_zhang has joined #openstack-keystone | 20:27 | |
| stevemar | haneef: i thought we added username and domain name? | 20:29 |
| stevemar | AJaeger: done | 20:30 |
| haneef | stevemar: Thanks let me check once again | 20:31 |
| AJaeger | thanks, stevemar | 20:31 |
| *** jsavak has quit IRC | 20:32 | |
| *** su_zhang has quit IRC | 20:32 | |
| *** e0ne has quit IRC | 20:32 | |
| lbragstad | ayoung do trusts not use revocation events? | 20:33 |
| *** jsavak has joined #openstack-keystone | 20:33 | |
| *** dims has quit IRC | 20:34 | |
| *** fawadkhaliq has quit IRC | 20:34 | |
| *** mhickey has joined #openstack-keystone | 20:34 | |
| ayoung | lbragstad, um...I think you are missing somethiung in there | 20:34 |
| ayoung | trusts are used to create a token | 20:34 |
| ayoung | if the trust goes away, the token is invalid | 20:34 |
| stevemar | haneef: it's entirely possible they don't include name, i'm going from memory | 20:34 |
| ayoung | lbragstad, I thought there was a revoke by trust ID in there? | 20:34 |
| lbragstad | ayoung hmm | 20:35 |
| *** dims has joined #openstack-keystone | 20:35 | |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/revoke/model.py#n21 first one | 20:35 |
| lbragstad | ayoung http://cdn.pasteraw.com/gkk9xzi7commrfvrp9bp7ig3lryx6oz | 20:35 |
| ayoung | lbragstad, now, we can remove that, if we check the existance of the trust upon validation instead | 20:35 |
| lbragstad | ayoung that second test is failing for me | 20:36 |
| lbragstad | test_delete_trust_revokes_token | 20:36 |
| ayoung | lbragstad, I wonder if the problem is the matching of the code | 20:36 |
| ayoung | the trustID in the v2 token? | 20:36 |
| ayoung | lbragstad, but, really, the check should be done inside the code anyway, and not in revoke evetns | 20:36 |
| ayoung | events | 20:36 |
| ayoung | we can drop most of those | 20:37 |
| ayoung | file it as abug and assign to me, with that code attached | 20:37 |
| gyee | stevemar, looking at the code, I don't see where we populate the user domain and user name in CADF | 20:38 |
| stevemar | gyee: do we do that for project name and project domain name? | 20:39 |
| *** gokrokve has quit IRC | 20:40 | |
| stevemar | gyee: i was getting confused with the initiator's project id and domain id | 20:41 |
| gyee | stevemar, doesn't look like it, I am going by the code at this point, haven't setup the transport to actually look at it | 20:41 |
| gyee | we have info for the initiator | 20:41 |
| *** nekrodesk has quit IRC | 20:41 | |
| stevemar | gyee: so, we're going to have the same problem for all the delete operations | 20:42 |
| gyee | stevemar, afraid so | 20:42 |
| stevemar | gyee: at the manager level,where the notification kicks off, we just have the ID | 20:42 |
| *** petertr7 is now known as petertr7_away | 20:42 | |
| gyee | stevemar, I think we talked about this awhile back, we actually do need a resource life-cycle management framework | 20:43 |
| gyee | like be able to transition from deleted to purged state | 20:43 |
| gyee | deleted does not wipe it from DB, but merely marking it as deleted | 20:44 |
| gyee | purge will do the actually deletion so we can preserve the data according to data retention policy | 20:44 |
| stevemar | gyee: i could dig that... a config option that says "purge_on_delete=true/false", and maybe a keystone-manage call to actually purge all items | 20:45 |
| gyee | right, that's work | 20:45 |
| *** jgriffith is now known as jgriffith_away | 20:45 | |
| *** gildub has joined #openstack-keystone | 20:46 | |
| stevemar | gyee: so for the immediate case, you need to know the name of user/project you deleted eh | 20:46 |
| stevemar | can't you look it up, based on the ID from when it was created? | 20:46 |
| gyee | stevemar, we need to be able to generate a report on what's being deleted | 20:47 |
| lbragstad | ayoung the original test is this - https://github.com/openstack/keystone/blob/ed67079d2b20811b551d78cc1aa72305f8278777/keystone/tests/unit/test_auth.py#L1150-L1165 | 20:47 |
| *** AJaeger has left #openstack-keystone | 20:47 | |
| stevemar | zigo: around to talk about eventlet in keystone? | 20:47 |
| lbragstad | ayoung which looks like delete_trust does something to clean up old tokens in the backend | 20:48 |
| stevemar | gyee: we could fetch from the DB before deleting, so we can get the name | 20:48 |
| gyee | alternative would be to look it up from the backup, assuming creation was done since the last backup | 20:48 |
| raildo | lbragstad: we are missing a check regarding federation_token and v2_token... in the current code, this line is called: https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L231 | 20:48 |
| raildo | lbragstad: and then will test this: https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L659 | 20:49 |
| raildo | lbragstad: we are not calling this on the fernet case here: https://review.openstack.org/#/c/274851/6/keystone/token/provider.py | 20:50 |
| * dims peeks at dstanek's reviews from yesterday | 20:50 | |
| dims | stevemar : bknudson_ : dstanek : looks like https://review.openstack.org/#/c/278054/ and https://review.openstack.org/#/c/278528/ are ready and would help me unblock my periodic job (against oslo.* master) | 20:51 |
| bknudson_ | I don't think https://review.openstack.org/#/c/278528/1 is ready | 20:52 |
| bknudson_ | dstanek: were you working on https://review.openstack.org/#/c/278528/1 ? | 20:52 |
| lbragstad | raildo I don't think we need the check ther e | 20:52 |
| dims | bknudson_ : ah, i saw all green and a +2 | 20:52 |
| lbragstad | raildo the validate_non_persistent_token() method assumes a v3 token | 20:53 |
| *** e0ne has joined #openstack-keystone | 20:53 | |
| raildo | lbragstad: so, there is some tests that wait a 404 but actually it a 200 https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_federation.py#L2414 | 20:53 |
| lbragstad | raildo we actually end up calling v2_token_data_helper.v3_to_v2_token(v3_token_ref) | 20:53 |
| *** petertr7_away is now known as petertr7 | 20:53 | |
| dstanek | bknudson_: i have some changes that get rid of all of the policy stuff. right now it passed 27 and the 34 tests are running. it could be a followup if that's desirned | 20:53 |
| bknudson_ | dstanek: how long do the py34 tests take to run? | 20:53 |
| raildo | lbragstad: so, we need change this tests to validade with v3? | 20:54 |
| *** jbell8 has quit IRC | 20:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Make pep8 *the* linting interface https://review.openstack.org/278591 | 20:54 |
| dstanek | bknudson_: hopefully just a few minutes more. until the nose fix they run serially ] | 20:54 |
| lbragstad | raildo the v3_to_v2_token() method here should check for invalid cases https://review.openstack.org/#/c/274851/6/keystone/token/providers/common.py | 20:54 |
| *** jbell8 has joined #openstack-keystone | 20:54 | |
| lbragstad | raildo if a v3 federated token is passed in for example | 20:54 |
| lbragstad | it should fail | 20:55 |
| lbragstad | raildo we might also have issues in our tests with timing too. Those would be caused by the subsecond issues with fernet and mysql | 20:55 |
| lbragstad | raildo notmorgan has ways to fix that | 20:56 |
| navidp | jamielennox, o/ | 20:56 |
| dstanek | stevemar: the Depends-on will ignore the +A until the other project's fix is merged, right? | 20:56 |
| raildo | lbragstad: I remember that you had mentioned that before | 20:56 |
| stevemar | dstanek: yes | 20:56 |
| dstanek | lbragstad: i love that our tests run *so fast* that is causes us problems. usually the opposite is true | 20:57 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate trust tests into a single class https://review.openstack.org/278628 | 20:57 |
| dstanek | stevemar: cool, thjx | 20:57 |
| lbragstad | dstanek right | 20:57 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying py27/34 with oslo-master https://review.openstack.org/277648 | 20:57 |
| *** aginwala has quit IRC | 20:58 | |
| ayoung | lbragstad, at a minuimum it should still be doing revoke_by_trust_id too, though | 20:59 |
| raildo | lbragstad: so, when we got a v2 token we convert in av 3 token, following this v2_token_data_helper.v3_to_v2_token(v3_token_ref) method. So, on the tests that are using a v2 token, and it is not expected to be converted to a v3 token, what should we do? | 21:00 |
| openstackgerrit | David Stanek proposed openstack/keystone: Moves policy setup into a fixture. https://review.openstack.org/278528 | 21:00 |
| raildo | lbragstad: change the expected return? | 21:01 |
| *** dolphm has joined #openstack-keystone | 21:01 | |
| *** ChanServ sets mode: +o dolphm | 21:01 | |
| dstanek | bknudson_: a bit more complicated now. you're welcome! ^ | 21:01 |
| lbragstad | raildo we should be expecting that v3_to_v2_token throws an exception | 21:01 |
| *** jorge_munoz1 has left #openstack-keystone | 21:02 | |
| raildo | lbragstad: got it :) thanks for the explanation | 21:02 |
| lbragstad | raildo np | 21:03 |
| *** c_soukup has joined #openstack-keystone | 21:03 | |
| raildo | lbragstad: so, I suggest add this on the v3_to_v2_token https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L619-L622 | 21:04 |
| raildo | lbragstad: since v2 doesn't support federation on this context | 21:04 |
| *** sinese_ has quit IRC | 21:04 | |
| lbragstad | raildo yeah - that would make sense | 21:04 |
| bknudson_ | dstanek: the test code sure was working hard to use the policy file. | 21:06 |
| *** csoukup has quit IRC | 21:06 | |
| *** daemontool has quit IRC | 21:07 | |
| *** jorge_munoz2 has joined #openstack-keystone | 21:08 | |
| *** dolphm has quit IRC | 21:08 | |
| *** jorge_munoz2 has quit IRC | 21:08 | |
| *** aginwala has joined #openstack-keystone | 21:08 | |
| *** dolphm has joined #openstack-keystone | 21:08 | |
| *** ChanServ sets mode: +o dolphm | 21:08 | |
| raildo | lbragstad: I can add a comment about it on the patch, or if you agree with this case I can send a patch set | 21:09 |
| *** e0ne has quit IRC | 21:09 | |
| lbragstad | raildo on https://review.openstack.org/#/c/258650/22 ? | 21:10 |
| lbragstad | raildo which patch? | 21:10 |
| raildo | lbragstad: this is more related to this patch: https://review.openstack.org/#/c/274851, but it was already merged | 21:12 |
| raildo | lbragstad: I can send in the https://review.openstack.org/#/c/258650/22 | 21:12 |
| lbragstad | raildo you can make it a separate patch if you want | 21:13 |
| jamielennox | navidp: morning | 21:13 |
| navidp | jamielennox, morning | 21:13 |
| raildo | lbragstad: but I have to make "Make fernet default token provider" depends for this patch =/ | 21:13 |
| raildo | since the tests on it that are breaking... | 21:14 |
| navidp | jamielennox, have a question about plugin loading in ksa vs ksc | 21:14 |
| *** jsavak has quit IRC | 21:15 | |
| jamielennox | sure | 21:15 |
| *** daemontool has joined #openstack-keystone | 21:15 | |
| lbragstad | raildo if you want to incorporate your change into https://review.openstack.org/#/c/258650/18 would you be able to address dolphm's comment too? | 21:15 |
| lbragstad | raildo i just saw them come through and I don't want them to get lost in revisions | 21:16 |
| dolphm | outdated link ^ | 21:16 |
| navidp | jamielennox, this is how i load plugins for options list https://review.openstack.org/#/c/276350/6/openstackclient/api/auth.py | 21:16 |
| dolphm | https://review.openstack.org/#/c/258650/ | 21:16 |
| lbragstad | dolphm thanks | 21:16 |
| raildo | lbragstad: great, so I'll do that :) | 21:16 |
| samueldmq | lbragstad: left a comment on https://review.openstack.org/#/c/274850/ | 21:16 |
| samueldmq | lbragstad: let me know if that makes sense so I can submit a quick fix ? | 21:17 |
| *** jsavak has joined #openstack-keystone | 21:18 | |
| raildo | samueldmq: he already fixed it: https://review.openstack.org/#/c/258650/19..21 | 21:18 |
| navidp | jamielennox, for token-endpoint get this error http://paste.openstack.org/show/486626/ | 21:18 |
| lbragstad | samueldmq sure | 21:18 |
| navidp | jamielennox, what is plugin loading process in keystoneauth | 21:19 |
| samueldmq | raildo: the release note , | 21:19 |
| samueldmq | ? | 21:19 |
| raildo | samueldmq: https://review.openstack.org/#/c/258650/19..21/releasenotes/notes/make-fernet-the-default-token-provider-5060d445e2ebf1bd.yaml | 21:20 |
| *** nekrodesk has joined #openstack-keystone | 21:21 | |
| *** nekrodesk has quit IRC | 21:21 | |
| samueldmq | raildo: I am talking about another thing | 21:22 |
| samueldmq | raildo: | 21:23 |
| samueldmq | Remove support for trusts in v2.0 | 21:23 |
| samueldmq | raildo: see my comment in https://review.openstack.org/#/c/274850 | 21:23 |
| jamielennox | navidp: so for whatever reason we renamed token_endpoint to admin_token in keystoneauth | 21:25 |
| jamielennox | it otherwised clashed with some stuff that OSC had | 21:25 |
| jamielennox | navidp: i don't think there is a token_endpoint plugin registered in the keystoneauth entry point | 21:25 |
| raildo | samueldmq: I'm looking and there is just a "as noticed by Dave, this needs a release note" that why I sent the link, but np we can add something related to this :) | 21:26 |
| jamielennox | and i don't want OSC to provide one/any | 21:26 |
| *** aginwala has quit IRC | 21:27 | |
| navidp | jamielennox, if i understand correclty, we should drop token_endpoint in osc in favor of ksa token_endpoint | 21:27 |
| jamielennox | navidp: also you shouldn't need to use the entrypoint directly, keystoneauth1.loading has get_available_plugin_loaders() that will return you everything on the system | 21:28 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying py27/34 with oslo-master https://review.openstack.org/277648 | 21:28 |
| *** gildub has quit IRC | 21:28 | |
| *** gildub has joined #openstack-keystone | 21:28 | |
| jamielennox | navidp: ah, so https://review.openstack.org/#/c/276350/6/setup.cfg is where it is finding token_ednpoint | 21:29 |
| *** jgriffith_away is now known as jgriffith | 21:29 | |
| jamielennox | navidp: if possible (it's possible but a bit of reorganization) i don't want OSC to provide any keystoneauth plugins | 21:29 |
| jamielennox | it shouldn't need them | 21:30 |
| *** nekrodesk has joined #openstack-keystone | 21:30 | |
| jamielennox | and by publishing them like that they become available to every other user on the system | 21:30 |
| *** pushkaru has quit IRC | 21:30 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix release note of removal of v2.0 trusts support https://review.openstack.org/278647 | 21:31 |
| *** su_zhang has joined #openstack-keystone | 21:31 | |
| stevemar | gyee: do we need X-User-ID, and X-User-Name here too? https://review.openstack.org/#/c/278580/1 | 21:31 |
| navidp | jamielennox, no password or token plugins in osc, interresting , doesnt it cause incossitency? | 21:32 |
| stevemar | gyee: nevermind, according to http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html#scope-information we don't | 21:32 |
| jamielennox | navidp: i don't think they should need to provide their own at all, but if you do for consistency you can create the plugin directly | 21:33 |
| jamielennox | there's no reason to use setuptools and entrypoints when you know exactly the thing you want to instantiate | 21:33 |
| jamielennox | just create the class | 21:33 |
| jamielennox | that way they can use it without being able to do things like nova --auth-type osc_password | 21:34 |
| samueldmq | stevemar: lbragstad: raildo: https://review.openstack.org/#/c/278647/ | 21:34 |
| * samueldmq : brb | 21:35 | |
| *** su_zhang has quit IRC | 21:35 | |
| bknudson_ | suhani gupta is a nut. | 21:36 |
| raildo | lol | 21:36 |
| *** clenimar_ has joined #openstack-keystone | 21:38 | |
| navidp | jamielennox, ok | 21:38 |
| navidp | jamielennox, thanks | 21:38 |
| *** csoukup_ has joined #openstack-keystone | 21:39 | |
| *** phalmos_ has joined #openstack-keystone | 21:39 | |
| *** dave-mcc_ has joined #openstack-keystone | 21:39 | |
| *** bknudson has joined #openstack-keystone | 21:40 | |
| *** ChanServ sets mode: +v bknudson | 21:40 | |
| *** nonameentername has joined #openstack-keystone | 21:40 | |
| *** BAKfr_ has joined #openstack-keystone | 21:41 | |
| *** charz_ has joined #openstack-keystone | 21:41 | |
| *** crinkle_ has joined #openstack-keystone | 21:41 | |
| lbragstad | dolphm with https://review.openstack.org/#/c/274850/6 we can also remove/refactor all of https://github.com/openstack/keystone/blob/ed67079d2b20811b551d78cc1aa72305f8278777/keystone/tests/unit/test_auth.py#L844-L1278 too - right? | 21:42 |
| *** skoude has joined #openstack-keystone | 21:43 | |
| *** Dave_____ has joined #openstack-keystone | 21:43 | |
| *** spzala_ has joined #openstack-keystone | 21:44 | |
| *** smcginni1 has joined #openstack-keystone | 21:44 | |
| *** wolsen has joined #openstack-keystone | 21:44 | |
| *** aginwala has joined #openstack-keystone | 21:44 | |
| *** bill_az_ has joined #openstack-keystone | 21:44 | |
| *** aginwala has quit IRC | 21:45 | |
| *** aginwala has joined #openstack-keystone | 21:46 | |
| *** crinkle has quit IRC | 21:47 | |
| *** crinkle_ is now known as crinkle | 21:47 | |
| *** raildo is now known as raildo-afk | 21:47 | |
| dolphm | jamielennox: "i don't think they should need to provide their own at all" you mean OSC can instantiate it's own plugins? | 21:47 |
| *** bknudson has quit IRC | 21:48 | |
| *** c_soukup has quit IRC | 21:48 | |
| *** dave-mccowan has quit IRC | 21:48 | |
| *** spzala has quit IRC | 21:48 | |
| *** phalmos has quit IRC | 21:48 | |
| *** bill_az has quit IRC | 21:48 | |
| *** jgriffith has quit IRC | 21:48 | |
| *** BAKfr has quit IRC | 21:48 | |
| *** miguelgrinberg has quit IRC | 21:48 | |
| *** wolsen_ has quit IRC | 21:48 | |
| *** Dave has quit IRC | 21:48 | |
| *** smcginnis has quit IRC | 21:48 | |
| *** jrist has quit IRC | 21:48 | |
| *** charz has quit IRC | 21:48 | |
| *** bknudson_ has quit IRC | 21:48 | |
| *** _nonameentername has quit IRC | 21:48 | |
| *** skoude_ has quit IRC | 21:48 | |
| *** dhellmann has quit IRC | 21:48 | |
| *** ramishra has quit IRC | 21:48 | |
| *** mariusv has quit IRC | 21:48 | |
| *** yarkot has quit IRC | 21:48 | |
| *** hockeynut has quit IRC | 21:48 | |
| *** zeus has quit IRC | 21:48 | |
| *** BAKfr_ is now known as BAKfr | 21:48 | |
| *** miguelgrinberg_ has joined #openstack-keystone | 21:48 | |
| *** nekrodesk has quit IRC | 21:48 | |
| *** miguelgrinberg_ is now known as miguelgrinberg | 21:48 | |
| *** bknudson has joined #openstack-keystone | 21:49 | |
| *** ChanServ sets mode: +v bknudson | 21:49 | |
| *** zeus has joined #openstack-keystone | 21:49 | |
| *** hockeynut has joined #openstack-keystone | 21:49 | |
| *** yarkot has joined #openstack-keystone | 21:49 | |
| *** dhellmann has joined #openstack-keystone | 21:49 | |
| *** zeus is now known as Guest57497 | 21:49 | |
| dolphm | jamielennox: navidp: so, deprecate the existing plugins in OSC, leaving the entrypoints alone for now. ensure OSC is using keystoneauth plugin instead of it's own. and eventually remove the plugins from OSC? | 21:49 |
| *** mhickey has quit IRC | 21:50 | |
| *** jgriffith has joined #openstack-keystone | 21:51 | |
| dolphm | jamielennox: no one should be using OSC's auth plugins besides itself, right? | 21:51 |
| stevemar | dolphm: correct | 21:52 |
| stevemar | bknudson: ++ | 21:52 |
| dolphm | stevemar: jamielennox: bknudson: navidp: so remove the entry points immediately or leave them alone and deprecate the plugins for now? | 21:52 |
| *** smcginni1 is now known as smcginnis | 21:52 | |
| *** clenimar_ has quit IRC | 21:53 | |
| dolphm | lbragstad: that all looks like it's testing v2? | 21:53 |
| lbragstad | dolphm yeah | 21:53 |
| dolphm | navidp: https://github.com/openstack/oslo.log/blob/master/oslo_log/versionutils.py#L52 | 21:53 |
| dolphm | lbragstad: then yeah - remove it in the same patch? how do those tests still pass | 21:53 |
| lbragstad | dolphm i have a follow on patch coming... | 21:54 |
| dolphm | lbragstad: should it be one patch? | 21:54 |
| stevemar | bknudson: that account has now been disabled | 21:54 |
| dolphm | lbragstad: ah, that's already +A'd | 21:54 |
| *** jrist has joined #openstack-keystone | 21:54 | |
| jamielennox | dolphm: so the plugin loader is just an indirect way of creating the plugin class right | 21:55 |
| lbragstad | ayoung https://review.openstack.org/#/c/278693/1 | 21:55 |
| lbragstad | ayoung that's what I came up with | 21:56 |
| jamielennox | dolphm: so OSC is providing an osc_password plugin in setup.cfg which keeps compatibility with it's old options | 21:56 |
| ayoung | lbragstad, good. I think that, so long as we have a WIP we can move ahead | 21:56 |
| ayoung | I'll look it over | 21:56 |
| *** ramishra has joined #openstack-keystone | 21:56 | |
| dolphm | jamielennox: so osc_password != any other password plugin in ksa or ksc | 21:56 |
| ayoung | jamielennox, It looks like the Nova folks panicked something over the change to KSA | 21:56 |
| jamielennox | dolphm: but the way it does it is to load_from_argparse('osc_password'). if you're not taking that string from the user it may as well just call OscPassword(...) directly | 21:56 |
| ayoung | is that what you are discussing? | 21:57 |
| lbragstad | ayoung dolphm i'm going to propose another patch to remove issuing v2 trust scoped tokens and refactor the tests | 21:57 |
| ayoung | jamielennox, cuz it lead to this https://review.openstack.org/278490 | 21:57 |
| jamielennox | it can absolutely provide its own plugin if it needs to handle the arguments, i'm just saying there's no reason for it to be an entrypoint | 21:57 |
| ayoung | lbragstad, do what you need. You have my support. I'll review what you post | 21:57 |
| dolphm | jamielennox: ah, gotcha. | 21:58 |
| jamielennox | ayoung: i haven't seen any problems regarding the nova/ksa change yet | 21:58 |
| *** vgridnev has quit IRC | 21:58 | |
| ayoung | jamielennox, https://github.com/openstack/puppet-nova/commit/d09868a59c451932d67c66101b725182d7066a14 | 21:58 |
| ayoung | they did that | 21:58 |
| dolphm | jamielennox: so then - can OSC use KSA plugins today? | 21:58 |
| ayoung | jamielennox, and hardcoded the pluging to the v3 version | 21:58 |
| jamielennox | dolphm: it can't yet, the entrypoint namespaces were purposefully changed between ksc and ksa so you can't get them confused | 21:59 |
| jamielennox | so OSC is looking for ksc plugins specifically | 21:59 |
| jamielennox | ayoung: interesting - but as i understood it it was always going to be a bit of a problem for puppet and auth plugins | 22:00 |
| *** aginwala has quit IRC | 22:01 | |
| jamielennox | ayoung: because say you subsitute 'kerberos' there for 'v3password' puppet wouldn't know the parameters that the kerberos plugin accepted | 22:01 |
| jamielennox | in ansible's case (and i don't think OSA has done this) i think you can just take a hash of auth values | 22:02 |
| jamielennox | and just with_dict those into the config file | 22:02 |
| jamielennox | but i don't know if there's the equivalent in puppet | 22:02 |
| *** mylu has quit IRC | 22:06 | |
| *** rcernin has quit IRC | 22:07 | |
| *** phalmos_ has quit IRC | 22:08 | |
| *** petertr7 is now known as petertr7_away | 22:08 | |
| ayoung | jamielennox, so, are they doing the right thing then? | 22:09 |
| jamielennox | ayoung: it seems that nova is doing the right thing, i don't know enough puppet to know if there is a better way to handle that | 22:09 |
| ayoung | OK | 22:09 |
| ayoung | I have a todo in the patch | 22:09 |
| jamielennox | ayoung: i know richm and i had spoken about it and he was going to look into the problem | 22:09 |
| jamielennox | i don't know if he got anywhere with it | 22:10 |
| *** Guest15678 has joined #openstack-keystone | 22:10 | |
| *** jbell8 has quit IRC | 22:12 | |
| *** jbell8 has joined #openstack-keystone | 22:12 | |
| *** daemontool has quit IRC | 22:13 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add a test that uses trusts and implies roles https://review.openstack.org/277319 | 22:16 |
| *** boris-42_ has joined #openstack-keystone | 22:17 | |
| *** petertr7z has joined #openstack-keystone | 22:18 | |
| *** petertr7z is now known as petertr7 | 22:18 | |
| *** bknudson_ has joined #openstack-keystone | 22:19 | |
| *** ChanServ sets mode: +v bknudson_ | 22:19 | |
| *** bknudson_ has quit IRC | 22:19 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Move redelegated_trust_id out of extras https://review.openstack.org/276474 | 22:20 |
| *** bknudson_ has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v bknudson_ | 22:20 | |
| *** henrynash has joined #openstack-keystone | 22:20 | |
| *** ChanServ sets mode: +v henrynash | 22:20 | |
| *** woodster__ has joined #openstack-keystone | 22:22 | |
| *** chlong_ has joined #openstack-keystone | 22:22 | |
| *** boris-42 has quit IRC | 22:22 | |
| *** petertr7_away has quit IRC | 22:22 | |
| *** dhellmann has quit IRC | 22:22 | |
| *** bknudson has quit IRC | 22:22 | |
| *** chlong has quit IRC | 22:22 | |
| *** woodster_ has quit IRC | 22:22 | |
| *** dhellmann has joined #openstack-keystone | 22:23 | |
| *** woodster__ is now known as woodster_ | 22:23 | |
| *** boris-42_ is now known as boris-42 | 22:24 | |
| *** nekrodesk has joined #openstack-keystone | 22:26 | |
| *** henrynash has quit IRC | 22:30 | |
| *** su_zhang has joined #openstack-keystone | 22:30 | |
| *** aginwala has joined #openstack-keystone | 22:31 | |
| *** aginwala has quit IRC | 22:32 | |
| *** aginwala has joined #openstack-keystone | 22:32 | |
| *** diazjf has quit IRC | 22:34 | |
| lbragstad | ayoung this wasn't v2 specific was it? | 22:38 |
| lbragstad | https://github.com/openstack/keystone/blob/ed67079d2b20811b551d78cc1aa72305f8278777/keystone/tests/unit/test_auth.py#L1140-L1148 | 22:38 |
| *** lhcheng has quit IRC | 22:40 | |
| *** mylu has joined #openstack-keystone | 22:42 | |
| *** aginwala has quit IRC | 22:44 | |
| *** jgriffith is now known as jgriffith_away | 22:46 | |
| *** mylu has quit IRC | 22:48 | |
| *** alex_xu has quit IRC | 22:52 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:53 | |
| *** alex_xu has joined #openstack-keystone | 22:55 | |
| *** mylu has joined #openstack-keystone | 22:57 | |
| *** doug-fish has quit IRC | 22:59 | |
| *** aginwala has joined #openstack-keystone | 23:00 | |
| *** doug-fish has joined #openstack-keystone | 23:00 | |
| *** aginwala has quit IRC | 23:01 | |
| *** aginwala has joined #openstack-keystone | 23:01 | |
| *** jgriffith_away is now known as jgriffith | 23:02 | |
| lbragstad | ayoung i just hooked https://github.com/openstack/keystone/blob/ed67079d2b20811b551d78cc1aa72305f8278777/keystone/tests/unit/test_auth.py#L1140-L1148 up using v3 and it has an inconsistent behavior with v2 | 23:05 |
| *** doug-fish has quit IRC | 23:05 | |
| lbragstad | ayoung not sure how you want to handle these http://cdn.pasteraw.com/e3hadt7pdw6mq2fxv0r4n4w2ffurbs9 | 23:05 |
| *** lhcheng has joined #openstack-keystone | 23:06 | |
| *** ChanServ sets mode: +v lhcheng | 23:06 | |
| *** doug-fis_ has joined #openstack-keystone | 23:08 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Deprecate admin_token_auth https://review.openstack.org/275443 | 23:10 |
| *** doug-fis_ has quit IRC | 23:10 | |
| *** doug-fis_ has joined #openstack-keystone | 23:11 | |
| ayoung | lbragstad, was it allowing you to create a trust using a trust? And redelgation was not set? | 23:11 |
| lbragstad | ayoung no - one gives me an Unauthorized and another gives me a Forbidden | 23:11 |
| ayoung | lbragstad, It soujnds like one is on token validation and the other is on the operation. What does the V3 API spec say it should be? | 23:12 |
| ayoung | Forbidden right? | 23:12 |
| lbragstad | v2.0 was giving me Unauthorized | 23:13 |
| lbragstad | v3 was giving me a Forbidden | 23:13 |
| ayoung | lbragstad, I think the v3 response is more correct | 23:13 |
| ayoung | and I suspect that the error handling is irrelevant | 23:14 |
| ayoung | its going to be ! Success. | 23:14 |
| ayoung | So, while it is a risk, I suspect you want to make v2 return Forbidden | 23:14 |
| ayoung | and, if that is what you want to do, becauyse is cleans up the code, do it | 23:14 |
| *** daemontool has joined #openstack-keystone | 23:15 | |
| lbragstad | ok | 23:16 |
| ayoung | lbragstad, normally I would say "don't change the return code" but I assume you want to change it so that the same code is executed for both? | 23:16 |
| *** mylu has quit IRC | 23:16 | |
| lbragstad | ayoung i'm putting together a patch to remove support for getting v2.0 trust-scoped tokens | 23:16 |
| lbragstad | which is exactly the opposite of the patch I did earlier | 23:17 |
| lbragstad | that way we can look at them | 23:17 |
| *** mylu has joined #openstack-keystone | 23:19 | |
| *** mylu has quit IRC | 23:21 | |
| *** mylu has joined #openstack-keystone | 23:21 | |
| *** mylu has quit IRC | 23:23 | |
| *** mylu has joined #openstack-keystone | 23:24 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix default LDAP attribute for user name https://review.openstack.org/278791 | 23:25 |
| samueldmq | ayoung: stevemar: ^ is this something we can/want to do ? | 23:25 |
| ayoung | samueldmq, massive breakage | 23:26 |
| samueldmq | ayoung: yeah, that's what I expected | 23:26 |
| ayoung | samueldmq, TBH, I suspect you could make that happen | 23:26 |
| *** roxanaghe has quit IRC | 23:26 | |
| bknudson_ | we're using cn for the user ID attribute. | 23:26 |
| ayoung | most people doing LDAP would explicitly set that field. I'd almost be more prone to drop the defaults and complain | 23:27 |
| bknudson_ | so I don't think ti would work to use cn for both the ID and the name... what happens if you update the name? | 23:27 |
| ayoung | bknudson_, LDAP is read only. THat could happen on you anyway | 23:27 |
| ayoung | if you go to the LDAP backend and change the UID or the CN or anyother field that Keystone was using, Keystone will show the change | 23:28 |
| ayoung | in the Case of the userid field, it would mean that the user lost all their resources | 23:28 |
| samueldmq | and I suspect changing defaults on *config* files shouldn't break people ? | 23:28 |
| samueldmq | deployers are expected to customize/adapt config files according to their deployments/needs | 23:29 |
| bknudson_ | if ldap is read-only why do we have http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/ldap.py#n103 ? | 23:29 |
| samueldmq | that's the same of updating policy, isn't it , | 23:29 |
| bknudson_ | it's deprecated, but that doesn't mean you can't continue using it | 23:29 |
| bknudson_ | changing defaults of config files breaks people | 23:30 |
| samueldmq | bknudson_: aren't deployers supposed to analyze and merge upstream configs with theirs ? | 23:31 |
| *** roxanaghe has joined #openstack-keystone | 23:31 | |
| samueldmq | or is it that lots of people just run on defaults anyways ? | 23:31 |
| bknudson_ | they did, and if they used the defaults they break when the default changes. | 23:32 |
| *** doug-fis_ has quit IRC | 23:33 | |
| *** edmondsw has joined #openstack-keystone | 23:34 | |
| samueldmq | ayoung: bknudson_: so looks like it'd be better to just update our configuration.rst docs | 23:35 |
| ayoung | samueldmq, the norm is that LDAP is read only. I thiknk we said we were deprecating writabel LDAP | 23:35 |
| ayoung | it really does not suit anyone | 23:36 |
| bknudson_ | the docs might be more accurate. | 23:36 |
| bknudson_ | hopefully the docs say to not use writable ldap | 23:39 |
| *** gordc has quit IRC | 23:41 | |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Support policy file in YAML https://review.openstack.org/278513 | 23:42 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Fix configuration docs for username LDAP attribute https://review.openstack.org/278791 | 23:43 |
| samueldmq | bknudson_: ayoung: fixing docs (I think it's the best thing to do for now) ^ | 23:44 |
| ayoung | samueldmq, ++ | 23:44 |
| *** chlong_ has quit IRC | 23:46 | |
| *** mylu has quit IRC | 23:47 | |
| *** csoukup_ has quit IRC | 23:50 | |
| *** aginwala has quit IRC | 23:50 | |
| *** aginwala has joined #openstack-keystone | 23:51 | |
| bigjools | hey guys, devstack sets up catalog urls with v3 at the end, should that be fixed? | 23:54 |
| *** spzala_ has quit IRC | 23:54 | |
| *** spzala has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!