| *** clenimar_ has joined #openstack-keystone | 00:00 | |
| *** aginwala has joined #openstack-keystone | 00:00 | |
| arunkant | dims_ : If I add set of properties for transport configuration on audit middleware (if someone wants to override it). Will that work? | 00:02 |
|---|---|---|
| *** roxanaghe has quit IRC | 00:03 | |
| *** lhcheng_ has joined #openstack-keystone | 00:20 | |
| *** clenimar_ has quit IRC | 00:21 | |
| *** lhcheng has quit IRC | 00:23 | |
| dims_ | arunkant : yes, let's add it. more importantly test it | 00:24 |
| *** clenimar_ has joined #openstack-keystone | 00:25 | |
| openstackgerrit | Arun Kant proposed openstack/keystonemiddleware: Adding audit middleware specific notification driver conf https://review.openstack.org/279828 | 00:27 |
| openstackgerrit | Merged openstack/keystone: Add tests in preparation of projects acting as a domain https://review.openstack.org/272369 | 00:27 |
| arunkant | dims_. Okay..will add that in next patch. Just added release notes in new patch. Thanks. | 00:27 |
| *** RA__ has joined #openstack-keystone | 00:38 | |
| *** rcernin has quit IRC | 00:46 | |
| *** rk4n has joined #openstack-keystone | 00:47 | |
| *** jasonsb has joined #openstack-keystone | 00:50 | |
| *** rk4n has quit IRC | 01:01 | |
| *** sdake_ is now known as sdake | 01:05 | |
| *** spandhe has quit IRC | 01:08 | |
| *** doug-fish has joined #openstack-keystone | 01:08 | |
| *** daemontool__ has joined #openstack-keystone | 01:11 | |
| *** doug-fish has quit IRC | 01:11 | |
| *** annasort has joined #openstack-keystone | 01:14 | |
| *** EinstCrazy has joined #openstack-keystone | 01:17 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 01:20 |
| *** Guest8151 has quit IRC | 01:22 | |
| *** x58 has joined #openstack-keystone | 01:22 | |
| *** diazjf has joined #openstack-keystone | 01:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 01:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 01:27 |
| openstackgerrit | Merged openstack/keystone: Add list_limit to the white list for configs in db https://review.openstack.org/281360 | 01:29 |
| openstackgerrit | Merged openstack/keystone: Fallback to list_limit from default config https://review.openstack.org/280804 | 01:29 |
| openstackgerrit | Merged openstack/keystone: Enable support for posixGroups in LDAP https://review.openstack.org/258528 | 01:30 |
| openstackgerrit | Merged openstack/keystone: Add is_domain filter to v3 list_projects https://review.openstack.org/158398 | 01:30 |
| *** diazjf has quit IRC | 01:32 | |
| *** ebalduf has joined #openstack-keystone | 01:33 | |
| *** sdake has quit IRC | 01:34 | |
| openstackgerrit | Merged openstack/keystone: encode user id for notifications https://review.openstack.org/280542 | 01:35 |
| *** ebalduf has quit IRC | 01:38 | |
| *** davechen has joined #openstack-keystone | 01:39 | |
| *** jbell8 has joined #openstack-keystone | 01:44 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/281601 | 01:47 |
| *** davechen1 has joined #openstack-keystone | 01:48 | |
| *** davechen has quit IRC | 01:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 01:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 01:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 01:58 |
| *** sdake has joined #openstack-keystone | 02:03 | |
| *** sdake has joined #openstack-keystone | 02:04 | |
| *** su_zhang has quit IRC | 02:04 | |
| *** aginwala has quit IRC | 02:06 | |
| *** doug-fish has joined #openstack-keystone | 02:08 | |
| *** davechen has joined #openstack-keystone | 02:08 | |
| *** doug-fish has quit IRC | 02:08 | |
| *** aginwala has joined #openstack-keystone | 02:09 | |
| *** aginwala has quit IRC | 02:09 | |
| *** aginwala has joined #openstack-keystone | 02:10 | |
| *** davechen1 has quit IRC | 02:10 | |
| *** annasort has quit IRC | 02:11 | |
| *** mylu has joined #openstack-keystone | 02:14 | |
| ayoung | jamielennox, question on client functional tests. How is the test supposed to create a client? This test is failing on first call to the server: http://logs.openstack.org/83/280983/4/check/gate-keystoneclient-dsvm-functional/28fb153/console.html | 02:15 |
| ayoung | https://review.openstack.org/#/c/280983/4/keystoneclient/tests/functional/v3/test_implied_roles.py | 02:16 |
| patchbot | ayoung: patch 280983 - python-keystoneclient - Implied Roles | 02:16 |
| ayoung | in the setup | 02:16 |
| jamielennox | ayoung: i haven't touched those in a while | 02:16 |
| ayoung | jamielennox, no one has | 02:16 |
| ayoung | jamielennox, IT IS TIME! | 02:17 |
| jamielennox | ayoung: i don't know if all that info is being passed into the test | 02:17 |
| ayoung | jamielennox, looking at the test_auth file, it is similar | 02:17 |
| *** EinstCrazy has quit IRC | 02:17 | |
| ayoung | jamielennox, but there are no other V3 tests | 02:18 |
| *** EinstCrazy has joined #openstack-keystone | 02:18 | |
| ayoung | jamielennox, but since this works: http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/tests/functional/test_access.py#n28 | 02:18 |
| ayoung | it has to be similar | 02:18 |
| ayoung | jamielennox, maybe it is ID versus Name for the env vars | 02:19 |
| jamielennox | ayoung: what i mean is that here: http://logs.openstack.org/83/280983/4/check/gate-keystoneclient-dsvm-functional/28fb153/console.html#_2016-02-17_23_26_39_806 | 02:19 |
| samueldmq | jamielennox: ayoung: the way I introduced base classes for use in ksclient funcitonal tests | 02:19 |
| ayoung | I used what Kolla does, which may not match | 02:19 |
| jamielennox | it looks like the information in the environment is not v3 | 02:19 |
| jamielennox | so your envs won't work | 02:19 |
| samueldmq | is instantiating the client via os-client-config | 02:19 |
| jamielennox | ayoung: i would definetly recommend using samueldmq's base stuff | 02:20 |
| ayoung | samueldmq, link? | 02:20 |
| samueldmq | jamielennox: ++ | 02:20 |
| samueldmq | ayoung: gimme a sec | 02:20 |
| samueldmq | ayoung: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/base.py | 02:21 |
| samueldmq | ayoung: and https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/test_base.py as an example of use | 02:21 |
| ayoung | samueldmq, OK, let me test that | 02:21 |
| ayoung | samueldmq, is get_client() gonna give me a V3 CLient? | 02:22 |
| samueldmq | ayoung: yes, if your class inherits from V3ClientTestCase | 02:23 |
| samueldmq | ayoung: what do you want to do with funtional tests in ksclient ? | 02:26 |
| samueldmq | ayoung: I want to write a set of initial tests for our client, based on that base classes | 02:27 |
| ayoung | samueldmq, https://review.openstack.org/#/c/280983/ | 02:27 |
| patchbot | ayoung: patch 280983 - python-keystoneclient - Implied Roles | 02:27 |
| samueldmq | ayoung: it's on my todo for this cycle, but I wanted to focus on review for now | 02:27 |
| ayoung | samueldmq, that is ok. I think you al;ready wrote what I need | 02:28 |
| samueldmq | ayoung: yeah, just inherit from it and use self.client | 02:28 |
| samueldmq | ayoung: in the setup it already does self.client = get_client() | 02:28 |
| *** jbell8 has quit IRC | 02:30 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Implied Roles https://review.openstack.org/280983 | 02:31 |
| ayoung | rock on sam. It works with Kolla | 02:32 |
| dstanek | samueldmq: it's sorta late for you, isn't it? | 02:32 |
| samueldmq | ayoung: glad to hear :) | 02:34 |
| samueldmq | dstanek: 11:34pm; very quiet here | 02:34 |
| samueldmq | dstanek: I am willing to write some tests for ksclient | 02:35 |
| ayoung | samueldmq, start by tearing ^^ apart | 02:36 |
| ayoung | samueldmq, I'm going to put out the call to people wanting to get involved in OpenStack to backfill those tests | 02:37 |
| ayoung | lets crowdsource that | 02:37 |
| *** browne has quit IRC | 02:38 | |
| samueldmq | ayoung: it'd be nice if we got more people to help on the tests | 02:39 |
| samueldmq | ayoung: I want to, at least, have some tests for the basic scenarios (CRUD of things on client) | 02:40 |
| ayoung | samueldmq, to start, all KC reviews need functional tests | 02:40 |
| *** aginwala has quit IRC | 02:40 | |
| ayoung | lets get others writing them first | 02:40 |
| samueldmq | ayoung: yes, moking things isn't enough | 02:41 |
| samueldmq | ayoung: and one of the goals is to have them to serve to improve our backward compatibility for client libraries | 02:41 |
| samueldmq | ayoung: there is an ongoing effort ( see https://review.openstack.org/#/c/226157 ) | 02:42 |
| *** annasort has joined #openstack-keystone | 02:45 | |
| *** clenimar_ has quit IRC | 02:51 | |
| *** wanghua has joined #openstack-keystone | 02:58 | |
| *** dan_nguyen has quit IRC | 03:02 | |
| *** doug-fish has joined #openstack-keystone | 03:04 | |
| samueldmq | okay, I need some sleep, have a good night all | 03:07 |
| *** doug-fish has quit IRC | 03:09 | |
| *** gildub has quit IRC | 03:11 | |
| *** david_cu has joined #openstack-keystone | 03:15 | |
| *** sdake has quit IRC | 03:20 | |
| *** browne has joined #openstack-keystone | 03:22 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Implied Roles https://review.openstack.org/280983 | 03:23 |
| *** mylu has quit IRC | 03:24 | |
| stevemar | gnite samueldmq | 03:25 |
| *** timcline has quit IRC | 03:25 | |
| ayoung | stevemar, jamielennox think there might be something wrong with discovery in the functional test, which is going to be necessary for v2 and v3 to both test side by side | 03:28 |
| ayoung | test runs OK when url has /v3 at the end | 03:28 |
| ayoung | but not without | 03:28 |
| ayoung | curl $OS_AUTH_URL | 03:28 |
| ayoung | {"versions": {"values": [{"status": "stable", "updated": "2015-09-15T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}], "id": "v3.5", "links": [{"href": "http://10.0.0.13:35357/v3/", "rel": "self"}]}, {"status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v2.0+json"}], "i | 03:28 |
| ayoung | d": "v2.0", "links": [{"href": "http://10.0.0.13:35357/v2.0/", "rel": "self"}, {"href": "http://docs.openstack.org/", "type": "text/html", "rel": "describedby"}]}]}} | 03:28 |
| ayoung | echo $OS_AUTH_URL | 03:28 |
| ayoung | http://10.0.0.13:35357 | 03:28 |
| ayoung | http://paste.openstack.org/show/487361/ | 03:29 |
| *** dims_ has quit IRC | 03:30 | |
| ayoung | even setting export OS_AUTH_TYPE=v3password | 03:31 |
| ayoung | does not do it...maybe the discovery plugin .. | 03:31 |
| ayoung | yep | 03:31 |
| *** dims has joined #openstack-keystone | 03:32 | |
| ayoung | but the v2 tests still fail... | 03:32 |
| *** john5223 has joined #openstack-keystone | 03:33 | |
| *** mylu has joined #openstack-keystone | 03:35 | |
| *** gildub has joined #openstack-keystone | 03:35 | |
| *** woodster_ has quit IRC | 03:36 | |
| jamielennox | ayoung: did you figure it out | 03:39 |
| ayoung | jamielennox, not quite | 03:40 |
| ayoung | jamielennox, I can't get the existing v2 tests to run no matter what, though | 03:40 |
| jamielennox | ayoung: failing at discovery? | 03:41 |
| ayoung | jamielennox, so, even if I bypass discovery, a lot of them fail | 03:41 |
| ayoung | wondering if there is sample data not set up by Kolla | 03:42 |
| ayoung | let me see if I can find one that passes, and try discover on that one... | 03:42 |
| *** lhcheng_ has quit IRC | 03:42 | |
| ayoung | tox -efunctional -- keystoneclient.tests.functional.test_auth runs OK without discovery... | 03:43 |
| ayoung | jamielennox, nah, discovery seems OK. | 03:44 |
| ayoung | jamielennox, test_auth works...ah but that does not use the client... | 03:44 |
| ayoung | hmmm | 03:44 |
| *** timcline has joined #openstack-keystone | 03:45 | |
| ayoung | but that runs the keystone cli, and I don't care about that... | 03:46 |
| ayoung | maybe we are good. Let's see if my test passes CI | 03:47 |
| *** EinstCra_ has joined #openstack-keystone | 03:49 | |
| *** dan_nguyen has joined #openstack-keystone | 03:51 | |
| *** EinstCrazy has quit IRC | 03:52 | |
| *** EinstCrazy has joined #openstack-keystone | 04:01 | |
| *** shoutm_ has joined #openstack-keystone | 04:03 | |
| *** EinstCra_ has quit IRC | 04:04 | |
| *** shoutm has quit IRC | 04:05 | |
| *** davechen1 has joined #openstack-keystone | 04:12 | |
| *** davechen has quit IRC | 04:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 04:17 |
| *** lhcheng has joined #openstack-keystone | 04:27 | |
| *** ChanServ sets mode: +v lhcheng | 04:27 | |
| *** richm has quit IRC | 04:30 | |
| *** slogan_r has joined #openstack-keystone | 04:32 | |
| *** RA__ has quit IRC | 04:37 | |
| *** shoutm_ has quit IRC | 04:49 | |
| *** dan_nguyen has quit IRC | 04:51 | |
| *** dims_ has joined #openstack-keystone | 04:53 | |
| *** shoutm has joined #openstack-keystone | 04:53 | |
| *** dims has quit IRC | 04:55 | |
| *** shoutm has quit IRC | 04:58 | |
| *** diazjf has joined #openstack-keystone | 05:00 | |
| *** dims_ has quit IRC | 05:00 | |
| *** diazjf has quit IRC | 05:01 | |
| *** dims has joined #openstack-keystone | 05:02 | |
| *** dims has quit IRC | 05:02 | |
| *** shoutm has joined #openstack-keystone | 05:02 | |
| *** roxanaghe has joined #openstack-keystone | 05:09 | |
| *** diazjf has joined #openstack-keystone | 05:19 | |
| *** dan_nguyen has joined #openstack-keystone | 05:33 | |
| *** roxanaghe has quit IRC | 05:34 | |
| *** gyee has quit IRC | 05:35 | |
| openstackgerrit | Pandiyan proposed openstack/keystone: Add driver details in architecture doc https://review.openstack.org/280802 | 05:35 |
| *** dave-mccowan has quit IRC | 05:38 | |
| *** Nirupama has joined #openstack-keystone | 05:42 | |
| *** shoutm_ has joined #openstack-keystone | 05:44 | |
| *** shoutm has quit IRC | 05:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 05:44 |
| *** mylu has quit IRC | 05:49 | |
| *** jidar has quit IRC | 06:06 | |
| *** jidar has joined #openstack-keystone | 06:07 | |
| *** gildub has quit IRC | 06:13 | |
| *** jaosorior has quit IRC | 06:23 | |
| *** aginwala has joined #openstack-keystone | 06:24 | |
| *** jaosorior has joined #openstack-keystone | 06:24 | |
| *** GB21 has joined #openstack-keystone | 06:26 | |
| *** haneef_ has quit IRC | 06:37 | |
| *** mvk has joined #openstack-keystone | 06:49 | |
| stevemar | quiet night tonight | 06:50 |
| *** diazjf has quit IRC | 06:55 | |
| *** josecastroleon has joined #openstack-keystone | 06:58 | |
| *** su_zhang has joined #openstack-keystone | 07:02 | |
| breton | morning | 07:06 |
| *** jbell8 has joined #openstack-keystone | 07:06 | |
| davechen1 | good morning, breton! | 07:10 |
| stevemar | breton: i am reviewing your final truncated patch! | 07:10 |
| *** jbell8 has quit IRC | 07:10 | |
| *** jbell8 has joined #openstack-keystone | 07:11 | |
| breton | stevemar: yay | 07:13 |
| * breton will pay back with reviews | 07:13 | |
| stevemar | breton: oh please do, just a few more bugs left | 07:14 |
| stevemar | breton: https://review.openstack.org/#/c/231289/52, https://review.openstack.org/#/c/243585/, https://review.openstack.org/#/c/244248/ are BP related (and shadow users) | 07:14 |
| patchbot | stevemar: patch 231289 - keystone - Projects acting as domains | 07:14 |
| patchbot | stevemar: patch 243585 - keystone - API support for project cascade update | 07:14 |
| patchbot | stevemar: patch 244248 - keystone - API support for project cascade delete | 07:14 |
| breton | hm | 07:15 |
| breton | no totp in the list | 07:15 |
| stevemar | breton: bugs: https://review.openstack.org/#/c/281078/, https://bugs.launchpad.net/keystone/+bug/1546562, https://review.openstack.org/#/c/277436/ | 07:16 |
| openstack | Launchpad bug 1546562 in OpenStack Identity (keystone) "deleting role with implied role fails" [Critical,Triaged] | 07:16 |
| patchbot | stevemar: patch 281078 - keystone - validate domain specific config option values | 07:16 |
| patchbot | stevemar: patch 277436 - keystone - Return 404 instead of 401 for tokens w/o roles | 07:16 |
| stevemar | breton: dstanek and i took a swing at TOTP | 07:17 |
| stevemar | its actually in decent shape now, gyee and dstanek helped a lot | 07:17 |
| stevemar | i'm less worried about it | 07:17 |
| breton | I am worried about it. | 07:17 |
| stevemar | i'm still worried, just less worried now :) | 07:18 |
| stevemar | if you're feeling brave... https://bugs.launchpad.net/keystone/+bug/1546562 | 07:18 |
| openstack | Launchpad bug 1546562 in OpenStack Identity (keystone) "deleting role with implied role fails" [Critical,Triaged] | 07:18 |
| breton | the issue I mentioned in https://review.openstack.org/#/c/274901/8/keystone/auth/plugins/totp.py is pretty serious | 07:18 |
| patchbot | breton: patch 274901 - keystone - Time-based One-time Password | 07:18 |
| breton | and it will be very hard to debug it, if someone runs into it | 07:19 |
| stevemar | breton: true | 07:19 |
| breton | and I don't see a quick way to fix it | 07:19 |
| stevemar | breton: it'll return the limit after the filtering right? | 07:20 |
| breton | well, one could hack up a new method in credential_api... | 07:20 |
| breton | stevemar: in case of SQL it will be a `LIMIT N` in query | 07:21 |
| stevemar | breton: also, i'm OK if there is a limitation, as long as we document and tell folks how to get around it | 07:22 |
| breton | frankly, after working with list_limit for so long, I'm starting to dislike it | 07:22 |
| *** jbell8 has quit IRC | 07:23 | |
| *** jbell8 has joined #openstack-keystone | 07:23 | |
| stevemar | breton: commented on the issue | 07:24 |
| stevemar | breton: that's why we were to pro-filtering for so long | 07:24 |
| stevemar | dolphm: when you wake up, can you comment on https://bugs.launchpad.net/keystone/+bug/1473567 -- there's a lot of history there and i'm unsure what to make of it, i think the issue has been resolved? | 07:29 |
| openstack | Launchpad bug 1473567 in OpenStack Identity (keystone) "Fernet tokens fail tempest runs" [High,In progress] - Assigned to Lance Bragstad (lbragstad) | 07:29 |
| *** ianw has quit IRC | 07:30 | |
| *** ianw has joined #openstack-keystone | 07:31 | |
| *** shoutm has joined #openstack-keystone | 07:35 | |
| *** jbell8 has quit IRC | 07:35 | |
| *** shoutm_ has quit IRC | 07:35 | |
| *** jbell8 has joined #openstack-keystone | 07:36 | |
| *** GB21 has quit IRC | 07:40 | |
| *** e0ne has joined #openstack-keystone | 07:41 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: Add back a bandit tox job https://review.openstack.org/281549 | 07:44 |
| *** davechen1 is now known as davechen | 07:46 | |
| davechen | stevemar: yep, let's see what bknudson_ want to say. | 07:49 |
| davechen | stevemar: it won't be merged without +A though. | 07:49 |
| *** rcernin has joined #openstack-keystone | 07:51 | |
| *** EinstCra_ has joined #openstack-keystone | 07:55 | |
| *** shoutm has quit IRC | 07:57 | |
| *** shoutm_ has joined #openstack-keystone | 07:57 | |
| *** e0ne has quit IRC | 07:58 | |
| *** EinstCrazy has quit IRC | 07:59 | |
| stevemar | davechen: yep, no worries | 08:01 |
| *** pcaruana has joined #openstack-keystone | 08:05 | |
| stevemar | breton: why did you have to change https://review.openstack.org/#/c/266989/6/keystone/tests/unit/test_cli.py ? | 08:05 |
| patchbot | stevemar: patch 266989 - keystone - Use the driver to get limits | 08:05 |
| *** GB21 has joined #openstack-keystone | 08:06 | |
| *** su_zhang has quit IRC | 08:08 | |
| *** lhcheng has quit IRC | 08:10 | |
| breton | stevemar: yes. It compared domainN_config with the one uploaded from config_files/ | 08:13 |
| stevemar | breton: nice | 08:15 |
| *** pnavarro has joined #openstack-keystone | 08:20 | |
| *** shoutm_ has quit IRC | 08:23 | |
| *** shoutm has joined #openstack-keystone | 08:30 | |
| *** belmoreira has joined #openstack-keystone | 08:34 | |
| *** josecastroleon has quit IRC | 08:35 | |
| *** fhubik has joined #openstack-keystone | 08:53 | |
| *** fhubik is now known as fhubik_brb | 08:53 | |
| *** fhubik_brb is now known as fhubik | 08:56 | |
| *** josecastroleon has joined #openstack-keystone | 09:01 | |
| *** fhubik is now known as fhubik_brb | 09:01 | |
| *** fhubik_brb is now known as fhubik | 09:14 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Create notification when invalid user name provided https://review.openstack.org/280994 | 09:16 |
| *** browne has quit IRC | 09:17 | |
| *** EinstCrazy has joined #openstack-keystone | 09:19 | |
| *** EinstCra_ has quit IRC | 09:21 | |
| *** rudolfvriend has joined #openstack-keystone | 09:29 | |
| openstackgerrit | Merged openstack/keystone: Use the driver to get limits https://review.openstack.org/266989 | 09:32 |
| *** aginwala has quit IRC | 09:33 | |
| *** e0ne has joined #openstack-keystone | 09:35 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/281605 | 09:35 |
| *** fhubik is now known as fhubik_brb | 09:38 | |
| *** doug-fish has joined #openstack-keystone | 09:40 | |
| *** mhickey has joined #openstack-keystone | 09:41 | |
| *** shoutm_ has joined #openstack-keystone | 09:44 | |
| *** doug-fish has quit IRC | 09:44 | |
| *** shoutm has quit IRC | 09:45 | |
| *** lhcheng has joined #openstack-keystone | 09:53 | |
| *** ChanServ sets mode: +v lhcheng | 09:53 | |
| *** davechen has left #openstack-keystone | 09:55 | |
| *** fhubik_brb is now known as fhubik | 09:57 | |
| *** mvk has quit IRC | 09:57 | |
| *** lhcheng has quit IRC | 09:58 | |
| *** openstackgerrit has quit IRC | 10:02 | |
| *** openstackgerrit has joined #openstack-keystone | 10:02 | |
| *** EinstCrazy has quit IRC | 10:03 | |
| *** mvk has joined #openstack-keystone | 10:06 | |
| openstackgerrit | Konstantin Maximov proposed openstack/keystone: Add test for domains list filtering and limiting https://review.openstack.org/207456 | 10:08 |
| *** rk4n has joined #openstack-keystone | 10:11 | |
| *** lhcheng has joined #openstack-keystone | 10:14 | |
| *** ChanServ sets mode: +v lhcheng | 10:14 | |
| *** fhubik is now known as fhubik_brb | 10:16 | |
| *** jbell8 has quit IRC | 10:25 | |
| *** fhubik_brb is now known as fhubik | 10:31 | |
| *** Nirupama has quit IRC | 10:37 | |
| *** shoutm_ has quit IRC | 10:38 | |
| *** Nirupama has joined #openstack-keystone | 10:40 | |
| *** doug-fish has joined #openstack-keystone | 10:41 | |
| *** daemontool__ has quit IRC | 10:41 | |
| *** daemontool has joined #openstack-keystone | 10:41 | |
| *** fhubik is now known as fhubik_brb | 10:41 | |
| *** daemontool has quit IRC | 10:43 | |
| *** daemontool_ has joined #openstack-keystone | 10:43 | |
| *** shoutm has joined #openstack-keystone | 10:45 | |
| *** doug-fish has quit IRC | 10:46 | |
| *** daemontool has joined #openstack-keystone | 10:49 | |
| *** daemontool_ has quit IRC | 10:50 | |
| openstackgerrit | Rudolf Vriend proposed openstack/keystone: Adds user_description_attribute mapping support to the LDAP backend https://review.openstack.org/276873 | 10:54 |
| *** jed56 has joined #openstack-keystone | 10:54 | |
| *** dims has joined #openstack-keystone | 10:59 | |
| *** daemontool has quit IRC | 11:04 | |
| *** daemontool has joined #openstack-keystone | 11:04 | |
| *** tobe has joined #openstack-keystone | 11:11 | |
| *** jbell8 has joined #openstack-keystone | 11:14 | |
| *** lhcheng has quit IRC | 11:20 | |
| *** dims_ has joined #openstack-keystone | 11:30 | |
| *** dims has quit IRC | 11:31 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 11:35 |
| *** henrynash has quit IRC | 11:47 | |
| *** fhubik_brb is now known as fhubik | 11:49 | |
| *** EinstCrazy has joined #openstack-keystone | 11:59 | |
| *** raildo-afk is now known as raildo | 12:09 | |
| *** fpatwa has joined #openstack-keystone | 12:09 | |
| openstackgerrit | Sergey Nikitin proposed openstack/keystone: Added .idea to the .gitignore https://review.openstack.org/281796 | 12:11 |
| *** GB21 has quit IRC | 12:14 | |
| samueldmq | morning all | 12:17 |
| samueldmq | I see great progress in https://launchpad.net/keystone/+milestone/mitaka-3 | 12:17 |
| samueldmq | which is nice! | 12:17 |
| dstanek | breton: stevemar: nonameentername: i'll have another patch in a few minutes addressing most of the comments. been working on tests and that'll come later todau (re: totp) | 12:20 |
| dstanek | breton: what worries do you have with totp? | 12:21 |
| samueldmq | ayoung: you around ? | 12:23 |
| samueldmq | ayoung: you working on bug 1546562 ? | 12:23 |
| openstack | bug 1546562 in OpenStack Identity (keystone) "deleting role with implied role fails" [Critical,Triaged] https://launchpad.net/bugs/1546562 | 12:23 |
| *** dave-mccowan has joined #openstack-keystone | 12:26 | |
| *** fhubik is now known as fhubik_brb | 12:27 | |
| *** fhubik_brb is now known as fhubik | 12:28 | |
| *** fpatwa has quit IRC | 12:36 | |
| *** daemontool has quit IRC | 12:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 12:39 |
| *** fpatwa has joined #openstack-keystone | 12:48 | |
| samueldmq | bknudson_: hi, regarding change 277512 | 12:50 |
| samueldmq | bknudson_: would you be fine with updating the docs to say it returns an ordered representation of the tree ? | 12:50 |
| *** fpatwa has quit IRC | 12:51 | |
| *** dikonoor has joined #openstack-keystone | 12:52 | |
| *** ninag has joined #openstack-keystone | 12:54 | |
| *** doug-fish has joined #openstack-keystone | 12:54 | |
| *** fhubik is now known as fhubik_brb | 13:02 | |
| *** rodrigods has quit IRC | 13:04 | |
| *** rodrigods has joined #openstack-keystone | 13:04 | |
| breton | dstanek: https://review.openstack.org/#/c/274901/8/keystone/auth/plugins/totp.py | 13:05 |
| patchbot | breton: patch 274901 - keystone - Time-based One-time Password | 13:05 |
| *** fhubik_brb is now known as fhubik | 13:05 | |
| dstanek | breton: just the list limit thing? | 13:06 |
| breton | yep | 13:07 |
| *** EinstCrazy has quit IRC | 13:09 | |
| dstanek | i don't see that as a big issue. we could either just say 'we only support storing {list_limit} totp credential' or fix the decorator to not be so overbearing | 13:09 |
| *** EinstCrazy has joined #openstack-keystone | 13:09 | |
| breton | I see another way: new method in credentials api | 13:11 |
| dstanek | a credential specific methon? | 13:11 |
| dstanek | err...method | 13:11 |
| *** gordc has joined #openstack-keystone | 13:12 | |
| *** e0ne has quit IRC | 13:13 | |
| *** e0ne has joined #openstack-keystone | 13:14 | |
| dstanek | if i saw someone trying to do that i'd -2 it. it's not very OO and causes backend disruption only because we have issues in other places in our code | 13:14 |
| *** mylu has joined #openstack-keystone | 13:27 | |
| *** mylu has quit IRC | 13:29 | |
| breton | in credentials all methods are credential-specific. Such as delete_credentials_for_project or delete_credentials_for_user. | 13:29 |
| dstanek | breton: no, those are context specific. you use the same one for password, s3, totp, etc right? | 13:33 |
| dstanek | breton: are you suggesting 'list_without_limits_because_other_code_is_broken()' ? | 13:34 |
| *** shoutm has quit IRC | 13:35 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 13:36 |
| *** edmondsw has joined #openstack-keystone | 13:39 | |
| *** sdake has joined #openstack-keystone | 13:41 | |
| *** edmondsw has quit IRC | 13:41 | |
| *** edmondsw has joined #openstack-keystone | 13:42 | |
| *** GB21 has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone-specs: Clarify projects subtree as list option docs https://review.openstack.org/281863 | 13:46 |
| samueldmq | tjcocozz: bknudson_: ^ | 13:46 |
| tjcocozz | samueldmq, hey I was thinking it would be good to add a docstring to list_projects_in_subtree() aswell | 13:46 |
| tjcocozz | samueldmq, about Rodrigo's comment https://review.openstack.org/#/c/277512/4/keystone/tests/unit/test_backend.py | 13:47 |
| patchbot | tjcocozz: patch 277512 - keystone - Test list project hierarchy is correct for a large... | 13:47 |
| tjcocozz | samueldmq, isn't it required to be admin to list_projects_in_subtree | 13:48 |
| samueldmq | tjcocozz: yes, bknudson_ also refered to manager method docs | 13:51 |
| samueldmq | tjcocozz: but you can add it in your patch, that is in openstack/keystone | 13:51 |
| samueldmq | tjcocozz: this one is keystone-specs | 13:52 |
| samueldmq | tjcocozz: sounds good ? | 13:52 |
| *** mylu has joined #openstack-keystone | 13:53 | |
| * tjcocozz is reading it now | 13:53 | |
| *** Nirupama has quit IRC | 13:55 | |
| *** richm has joined #openstack-keystone | 13:56 | |
| tjcocozz | samueldmq, i don't think that is a depth first search | 13:59 |
| *** mylu has quit IRC | 14:01 | |
| samueldmq | tjcocozz: no ? | 14:01 |
| tjcocozz | depth-first search exhausts its children before it continues onto the next subtree | 14:02 |
| tjcocozz | samueldmq, as the search tree is deepened as much as possible on each child before going to the next sibling. -wiki | 14:03 |
| tjcocozz | samueldmq, it is a Breadth-first search | 14:03 |
| *** petertr7_away is now known as petertr7 | 14:04 | |
| samueldmq | tjcocozz: looking at the code | 14:04 |
| samueldmq | tjcocozz: it isn't bfs either I think | 14:04 |
| samueldmq | tjcocozz: yes it is :) | 14:05 |
| samueldmq | tjcocozz: you're correct | 14:05 |
| tjcocozz | samueldmq, :p | 14:06 |
| samueldmq | tjcocozz: good catch | 14:06 |
| tjcocozz | samueldmq, should i add a docstring to list_project_subtree() still? | 14:07 |
| breton | dstanek: funny thing | 14:07 |
| breton | dstanek: there is already a method I'm suggesting | 14:07 |
| breton | ! | 14:07 |
| samueldmq | tjcocozz: just submitted another version | 14:07 |
| tjcocozz | samueldmq, voted L) | 14:07 |
| samueldmq | tjcocozz: which curiously didn't show up here i nthe channel, ist the bot broken? | 14:07 |
| tjcocozz | samueldmq, I think they have a time so people don't blow up the channel with a bunch of reviews | 14:08 |
| tjcocozz | samueldmq, atleast they were talking about it yesturday. | 14:09 |
| *** dave-mccowan has quit IRC | 14:09 | |
| *** dave-mccowan has joined #openstack-keystone | 14:10 | |
| samueldmq | tjcocozz: ++ | 14:10 |
| marekd | stevemar: ping. | 14:12 |
| *** su_zhang has joined #openstack-keystone | 14:21 | |
| *** dikonoor has quit IRC | 14:22 | |
| *** archers has joined #openstack-keystone | 14:22 | |
| *** jaosorior has quit IRC | 14:24 | |
| *** jaosorior has joined #openstack-keystone | 14:25 | |
| *** mylu has joined #openstack-keystone | 14:30 | |
| ayoung | samueldmq, I hadn't started on it yet | 14:30 |
| *** jsavak has joined #openstack-keystone | 14:31 | |
| *** knikolla has joined #openstack-keystone | 14:34 | |
| *** mvk has quit IRC | 14:38 | |
| *** mvk has joined #openstack-keystone | 14:39 | |
| *** esp has joined #openstack-keystone | 14:39 | |
| *** jsavak has quit IRC | 14:42 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 14:42 |
| *** fhubik is now known as fhubik_brb | 14:43 | |
| *** jsavak has joined #openstack-keystone | 14:44 | |
| *** fhubik_brb is now known as fhubik | 14:46 | |
| *** esp has quit IRC | 14:46 | |
| *** mylu has quit IRC | 14:46 | |
| *** mylu has joined #openstack-keystone | 14:48 | |
| *** dave-mccowan has quit IRC | 14:48 | |
| *** fpatwa has joined #openstack-keystone | 14:52 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Constraint to prevent duplicate endpoints https://review.openstack.org/134095 | 14:53 |
| *** fpatwa has quit IRC | 14:56 | |
| *** tobe has quit IRC | 14:57 | |
| *** jaosorior has quit IRC | 14:58 | |
| *** jaosorior has joined #openstack-keystone | 14:59 | |
| *** belmoreira has quit IRC | 14:59 | |
| *** belmorei_ has joined #openstack-keystone | 14:59 | |
| *** mvk has quit IRC | 15:00 | |
| *** dave-mccowan has joined #openstack-keystone | 15:02 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:05 | |
| *** sdake has quit IRC | 15:05 | |
| *** sdake has joined #openstack-keystone | 15:08 | |
| *** mylu has quit IRC | 15:12 | |
| *** henrynash has joined #openstack-keystone | 15:12 | |
| *** ChanServ sets mode: +v henrynash | 15:12 | |
| *** archers has quit IRC | 15:14 | |
| *** slberger has joined #openstack-keystone | 15:15 | |
| *** mylu has joined #openstack-keystone | 15:19 | |
| *** GB21 has quit IRC | 15:19 | |
| *** timcline has quit IRC | 15:30 | |
| ayoung | henrynash, htruta, what is burning in the review queue? And has gyee given up on totp? | 15:32 |
| notmorgan | dstanek: test. [ignor this] | 15:33 |
| henrynash | ayoung: i’m about to post a new project-as-a-domain patch (but we’re still waiting on cinder before it can pass tempest) | 15:33 |
| amakarov_away | ayoung, hi! Is anybody fixing this bug? https://bugs.launchpad.net/keystone/+bug/1546562 | 15:35 |
| openstack | Launchpad bug 1546562 in OpenStack Identity (keystone) "deleting role with implied role fails" [Critical,Triaged] | 15:35 |
| *** amakarov_away is now known as amakarov | 15:35 | |
| ayoung | henrynash, sounds good. Also, can you look at the Client review for Implied ROles to make sure it looks good to you? https://review.openstack.org/#/c/280983/ | 15:36 |
| patchbot | ayoung: patch 280983 - python-keystoneclient - Implied Roles | 15:36 |
| henrynash | ayoung: will do | 15:36 |
| mnaser | i've done some reading (but i don't believe a solution for this exists) but is there a way to setup an equiv of instance profiles with keystone: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html | 15:36 |
| ayoung | amakarov, I have not started on it. samueldmq asked about it earlier. Either of you are welcome to work on it. Just take it in Launchpad | 15:37 |
| ayoung | mnaser, can you give the summary? | 15:37 |
| mnaser | ayoung: you can deploy a new instance and assign it a role, the instance then can use api credentials assigned to it to make api requests | 15:37 |
| ayoung | mnaser, upon a quick read, I would say it sounds like Trusts | 15:37 |
| ayoung | mnaser, so, in order to do that, you would need to be able to create a "service" user for that instance | 15:38 |
| mnaser | example: create a role to be able to kill the vm itself, assign it to that vm, app can pull credentials from inside the vm and use them to call the openstack api | 15:38 |
| * mnaser goes to read about trusts | 15:38 | |
| *** spzala has joined #openstack-keystone | 15:39 | |
| ayoung | mnaser, so, IN the past, I toyed with the idea of using Nova as a Federation IdP. Each VM would be a user. | 15:39 |
| mnaser | basically the use case here is that our client wants the an instance to be able to terminate itself for example | 15:39 |
| ayoung | But I don't think a VM knows its own Identity. There would have to be some work | 15:39 |
| *** woodster_ has joined #openstack-keystone | 15:39 | |
| mnaser | yes, ideally they should have something to kill the instance from outside, but, i can see value in other things similar to this (access to swift from nova instances?) | 15:40 |
| ayoung | mnaser, 1 create a service user, 2. create a trust. 3 service user on VM uses trust to execute the call | 15:40 |
| *** pushkaru has joined #openstack-keystone | 15:40 | |
| mnaser | i'll do more reading on trusts | 15:40 |
| *** tobe has joined #openstack-keystone | 15:40 | |
| ayoung | I think I will write up a spec for Nova as a Federated Identity Provider for the VMs. | 15:41 |
| mnaser | it would be nice if the openstack project policies could be sitting in keystone | 15:41 |
| mnaser | making trusts far more flexible, than us having to write up roles in our policy.json and advising customers to use them | 15:42 |
| *** timcline has joined #openstack-keystone | 15:43 | |
| amakarov | ayoung, if I want to change index on the table, should I create a ne migration or just change the existing one? I'm about 087_implied_roles | 15:44 |
| *** phalmos has joined #openstack-keystone | 15:44 | |
| ayoung | amakarov, new migration | 15:44 |
| amakarov | ayoung, ack | 15:45 |
| *** clenimar has quit IRC | 15:48 | |
| *** iurygregory has quit IRC | 15:51 | |
| *** EinstCrazy has quit IRC | 15:51 | |
| *** phalmos has quit IRC | 15:54 | |
| *** dikonoor has joined #openstack-keystone | 15:54 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 15:55 |
| *** iurygregory has joined #openstack-keystone | 15:57 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: WIP/DNM Implied roles index with cascading update/delete https://review.openstack.org/281921 | 15:57 |
| amakarov | ayoung, ^ | 15:58 |
| *** jsavak has quit IRC | 15:58 | |
| *** jsavak has joined #openstack-keystone | 15:59 | |
| *** krotscheck_dcm is now known as krotscheck | 16:00 | |
| *** raildo is now known as raildo-afk | 16:02 | |
| *** phalmos has joined #openstack-keystone | 16:02 | |
| *** belmorei_ has quit IRC | 16:03 | |
| *** belmoreira has joined #openstack-keystone | 16:03 | |
| *** zigo has quit IRC | 16:03 | |
| *** zigo has joined #openstack-keystone | 16:05 | |
| *** mylu has quit IRC | 16:14 | |
| *** pcaruana has quit IRC | 16:15 | |
| *** raildo-afk is now known as raildo | 16:17 | |
| *** rcernin has quit IRC | 16:17 | |
| *** mylu has joined #openstack-keystone | 16:18 | |
| *** mylu has quit IRC | 16:20 | |
| *** timcline_ has joined #openstack-keystone | 16:21 | |
| *** mylu has joined #openstack-keystone | 16:22 | |
| *** dikonoor has quit IRC | 16:23 | |
| *** roxanaghe has joined #openstack-keystone | 16:23 | |
| *** timcline_ has quit IRC | 16:25 | |
| *** josecastroleon has quit IRC | 16:33 | |
| *** rudolfvriend has quit IRC | 16:33 | |
| tjcocozz | edmondsw, https://bugs.launchpad.net/python-openstackclient/+bug/1546663 | 16:34 |
| openstack | Launchpad bug 1546663 in python-openstackclient "should not pass kwargs to get" [Undecided,In progress] - Assigned to Tom Cocozzello (tjcocozz) | 16:34 |
| *** clenimar has joined #openstack-keystone | 16:34 | |
| *** belmoreira has quit IRC | 16:34 | |
| *** josecastroleon has joined #openstack-keystone | 16:35 | |
| *** timcline_ has joined #openstack-keystone | 16:41 | |
| *** timcline_ has quit IRC | 16:42 | |
| tjcocozz | edmondsw, read the second bullet point :-) http://specs.openstack.org/openstack/api-wg/guidelines/evaluating_api_changes.html#guidance | 16:44 |
| *** spzala has quit IRC | 16:44 | |
| edmondsw | tjcocozz, yep, exactly... tx for the ammo :) | 16:45 |
| tjcocozz | edmondsw, lol no problem | 16:45 |
| *** spzala has joined #openstack-keystone | 16:45 | |
| *** spzala_ has joined #openstack-keystone | 16:46 | |
| *** browne has joined #openstack-keystone | 16:48 | |
| *** phalmos has quit IRC | 16:48 | |
| *** spzala has quit IRC | 16:50 | |
| *** dims has joined #openstack-keystone | 16:50 | |
| *** spzala_ has quit IRC | 16:50 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 16:51 |
| *** aginwala has joined #openstack-keystone | 16:51 | |
| *** dims_ has quit IRC | 16:51 | |
| *** rderose has joined #openstack-keystone | 16:51 | |
| *** fpatwa has joined #openstack-keystone | 16:53 | |
| amakarov | stevemar, ayoung This bug has no fix while marked as "in progress": https://bugs.launchpad.net/keystone/+bug/1545789 | 16:55 |
| openstack | Launchpad bug 1545789 in OpenStack Identity (keystone) "keystone ADMIN_TOKEN set by default can lead to default insecure deployment" [Medium,In progress] - Assigned to Adam Young (ayoung) | 16:55 |
| amakarov | https://review.openstack.org/280329 addresses it as "partial-bug" | 16:56 |
| ayoung | amakarov, there is another that is marked as fixes... | 16:56 |
| dolphm | rderose: going to have a patchset ready for review today? | 16:56 |
| rderose | Working on finishing up a patch for "Shadow users - Separate user identities" based on our discussion. I should have that done today. | 16:56 |
| rderose | One thing I did change was the table names. Decided to use 'user' instead. The name matches better with the names used in the sql backend | 16:56 |
| rderose | implementation e.g. User model, create_user, get_user_list... | 16:56 |
| rderose | And less refactoring needed | 16:57 |
| rderose | user -> local_user | 16:57 |
| rderose | -> federated_user | 16:57 |
| rderose | -> ldap_user... | 16:57 |
| rderose | One user table to rule them all :) | 16:57 |
| *** diazjf has joined #openstack-keystone | 16:57 | |
| *** fpatwa has quit IRC | 16:57 | |
| amakarov | ayoung, which one? | 16:58 |
| ayoung | https://review.openstack.org/#/c/280467/ | 16:58 |
| patchbot | ayoung: patch 280467 - keystone - Disable Admin tokens set to None (MERGED) | 16:58 |
| rderose | but yes dolphm, patch should be ready today | 16:58 |
| ayoung | amakarov, ^^ | 16:58 |
| amakarov | ayoung, thank you | 16:58 |
| ayoung | rderose, is that in your latest review? | 16:59 |
| *** e0ne has quit IRC | 16:59 | |
| dolphm | rderose: lol so the "user" table remains, just with a few dropped columns? | 17:00 |
| rderose | ayoung review not ready yet, still Work in progress, but 278570 is the latest so far | 17:00 |
| rderose | dolphm yes | 17:00 |
| ayoung | rderose, I'm going to look | 17:00 |
| rderose | ayoung be gentle :) | 17:00 |
| ayoung | that raises the hairs on the back of myh neck | 17:00 |
| ayoung | rderose, I suspect we can get by with one table and an additional colum,n | 17:01 |
| ayoung | looking | 17:01 |
| ayoung | rderose, why separate tables? | 17:01 |
| *** gyee has joined #openstack-keystone | 17:01 | |
| *** ChanServ sets mode: +v gyee | 17:01 | |
| rderose | separate tables for user and local_user because we want to separate the locally managed date from the identity | 17:01 |
| *** su_zhang has quit IRC | 17:02 | |
| rderose | local_user and local_user_password to support future use cases around passwords | 17:02 |
| rderose | *data not date | 17:02 |
| ayoung | rderose, ok...that sounds really suspect. I'm not going to derail it, but it should be one table, with passwords external | 17:03 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 17:03 |
| ayoung | and even that is probably optional | 17:03 |
| *** spzala has joined #openstack-keystone | 17:04 | |
| stevemar | rderose: looking forward to reviewing it :) | 17:04 |
| ayoung | rderose, and I even suspect the password could end up in the credentials backend | 17:04 |
| *** josecastroleon has quit IRC | 17:04 | |
| *** jsavak has quit IRC | 17:04 | |
| rderose | okay ayoung let me finish up the changes based on conversations with dolphm, dstanek, and stevemar | 17:04 |
| *** jsavak has joined #openstack-keystone | 17:05 | |
| ayoung | rderose, so long as is works, I'll let it go forward. We can clean it up post Mitaka, or maybe even post M3 if it is all internal | 17:05 |
| *** josecastroleon has joined #openstack-keystone | 17:05 | |
| *** fhubik has quit IRC | 17:05 | |
| *** aginwala has quit IRC | 17:07 | |
| *** ChanServ sets mode: +v marekd | 17:07 | |
| *** spzala has quit IRC | 17:08 | |
| notmorgan | oh that is annoying... | 17:09 |
| notmorgan | weechat changed all the colors for the nicks i was used to :( | 17:09 |
| *** ericksonsantos has joined #openstack-keystone | 17:11 | |
| *** dmsimard is now known as rdobot | 17:11 | |
| *** rdobot is now known as dmsimard | 17:13 | |
| *** tobe has quit IRC | 17:13 | |
| *** mhickey has quit IRC | 17:13 | |
| stevemar | notmorgan: what color am i now? | 17:17 |
| dtroyer | stevemar: you are #99ccff here | 17:18 |
| *** spzala has joined #openstack-keystone | 17:19 | |
| *** mylu has quit IRC | 17:21 | |
| *** yarkot has joined #openstack-keystone | 17:23 | |
| *** spzala has quit IRC | 17:23 | |
| *** rk4n has quit IRC | 17:24 | |
| stevemar | dtroyer: thats a good color | 17:24 |
| *** rk4n has joined #openstack-keystone | 17:25 | |
| *** spzala has joined #openstack-keystone | 17:25 | |
| *** krotscheck is now known as krotscheck_dr | 17:27 | |
| *** spzala has quit IRC | 17:29 | |
| *** spzala has joined #openstack-keystone | 17:31 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 17:31 |
| *** spzala has quit IRC | 17:35 | |
| *** josecastroleon has quit IRC | 17:35 | |
| *** josecastroleon has joined #openstack-keystone | 17:36 | |
| *** rcernin has joined #openstack-keystone | 17:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 17:50 |
| *** su_zhang has joined #openstack-keystone | 17:53 | |
| *** browne has quit IRC | 17:58 | |
| *** mylu has joined #openstack-keystone | 17:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Separate user identities https://review.openstack.org/278570 | 18:01 |
| *** lhcheng has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +v lhcheng | 18:02 | |
| *** spzala has joined #openstack-keystone | 18:03 | |
| *** pnavarro has quit IRC | 18:05 | |
| *** e0ne has joined #openstack-keystone | 18:07 | |
| *** cburgess has quit IRC | 18:07 | |
| *** Ephur has quit IRC | 18:08 | |
| *** cburgess has joined #openstack-keystone | 18:08 | |
| *** josecastroleon has quit IRC | 18:09 | |
| *** raildo is now known as raildo-afk | 18:10 | |
| *** josecastroleon has joined #openstack-keystone | 18:11 | |
| *** stevemar sets mode: +v samueldmq | 18:12 | |
| *** aginwala has joined #openstack-keystone | 18:13 | |
| *** samueldmq has quit IRC | 18:14 | |
| *** samueldmq has joined #openstack-keystone | 18:15 | |
| *** e0ne has quit IRC | 18:16 | |
| *** dmsimard has left #openstack-keystone | 18:17 | |
| *** mylu has quit IRC | 18:18 | |
| *** raildo-afk is now known as raildo | 18:22 | |
| *** stevemar sets mode: +v samueldmq | 18:22 | |
| *** notmorgan has quit IRC | 18:22 | |
| *** notmorgan has joined #openstack-keystone | 18:23 | |
| *** notmorgan has joined #openstack-keystone | 18:23 | |
| *** ChanServ sets mode: +o notmorgan | 18:23 | |
| *** aginwala has quit IRC | 18:23 | |
| *** jed56 has quit IRC | 18:23 | |
| *** ChanServ sets mode: +v samueldmq | 18:24 | |
| *** spzala has quit IRC | 18:26 | |
| *** samueldmq has quit IRC | 18:26 | |
| *** samueldmq has joined #openstack-keystone | 18:26 | |
| *** aginwala has joined #openstack-keystone | 18:27 | |
| *** ChanServ sets mode: +v samueldmq | 18:27 | |
| *** spzala has joined #openstack-keystone | 18:28 | |
| notmorgan | samueldmq: you can also now change topic if you want with a /msg to chanserv | 18:28 |
| samueldmq | notmorgan: /msg chanserv new-topic | 18:29 |
| notmorgan | topic | 18:29 |
| notmorgan | or topicappend | 18:29 |
| notmorgan | /msg chanserv help | 18:29 |
| samueldmq | notmorgan: perfect, thanks | 18:29 |
| notmorgan | and look at it there | 18:29 |
| *** e0ne has joined #openstack-keystone | 18:30 | |
| *** vivekd has joined #openstack-keystone | 18:31 | |
| *** rk4n has quit IRC | 18:32 | |
| *** rk4n has joined #openstack-keystone | 18:32 | |
| *** petertr7 is now known as petertr7_away | 18:34 | |
| *** tsymancz1k has quit IRC | 18:35 | |
| *** mvk has joined #openstack-keystone | 18:38 | |
| *** josecastroleon has quit IRC | 18:40 | |
| *** josecastroleon has joined #openstack-keystone | 18:41 | |
| *** browne has joined #openstack-keystone | 18:42 | |
| *** gyee has quit IRC | 18:44 | |
| *** tsymancz1k has joined #openstack-keystone | 18:45 | |
| *** phalmos has joined #openstack-keystone | 18:51 | |
| *** fpatwa has joined #openstack-keystone | 18:54 | |
| edmondsw | rodrigods, re: https://review.openstack.org/#/c/281381/1 | 18:55 |
| patchbot | edmondsw: patch 281381 - keystone - Update default domain's description | 18:55 |
| edmondsw | The default domain is the only domain that is used for v2, but it is not specific to v2. Since the domain itself is not specific to v2, its description should not be specific to v2. | 18:55 |
| edmondsw | annasort ^ | 18:55 |
| rodrigods | edmondsw, agree... maybe rephrase but not removing the reference to v2? | 18:56 |
| edmondsw | rodrigods having a reference to v2 is confusing on v3-only deployments | 18:57 |
| edmondsw | as anna pointed out | 18:57 |
| edmondsw | And it's not actually necessary correct, either... you can configure which domain you want to be the default | 18:57 |
| edmondsw | the default default is default, but you can change it :) | 18:57 |
| *** fpatwa has quit IRC | 18:58 | |
| rodrigods | edmondsw, there is a reason for the default domain to exist, right? | 18:58 |
| edmondsw | yes, multiple reasons. Only one of them has anything to do with v2 | 18:59 |
| edmondsw | e.g. bootstrapping | 18:59 |
| samueldmq | htruta: raildo: could we please get https://review.openstack.org/#/c/244248 updated ? | 18:59 |
| *** spzala has quit IRC | 18:59 | |
| edmondsw | you have to have a domain in order to have users in order to do anything | 18:59 |
| rodrigods | ok... so rephrase to give examples of its usages? | 18:59 |
| edmondsw | rodrigods keystone-manage bootstrap | 19:00 |
| *** clenimar has quit IRC | 19:01 | |
| edmondsw | rodrigods that clear, or you're still looking for me to explain? | 19:02 |
| rodrigods | edmondsw, it is clear, but saying "The default domain" is not helpful either | 19:02 |
| rodrigods | rephrase so you can give examples of its usages | 19:02 |
| rodrigods | like you just gave | 19:03 |
| edmondsw | rodrigods, sorry, I'm not following... are you asking for another example besides bootstrapping? | 19:03 |
| *** spzala has joined #openstack-keystone | 19:03 | |
| raildo | samueldmq: I'll make it depend on https://review.openstack.org/#/c/243585/ and the change will be smaller | 19:03 |
| patchbot | raildo: patch 243585 - keystone - API support for project cascade update | 19:03 |
| rodrigods | edmondsw, in the patch | 19:03 |
| edmondsw | ah, ok... annasort ^ | 19:04 |
| edmondsw | rodrigods do you have something in mind? | 19:04 |
| *** jaosorior has quit IRC | 19:04 | |
| notmorgan | edmondsw: i probably wouldn't change the default domain description at runtime in a production cloud. | 19:04 |
| notmorgan | edmondsw: just generally speaking as an upgrade it seems ... odd? | 19:05 |
| edmondsw | not sure what would be clearer than simply saying it's the default | 19:05 |
| bknudson_ | tjcocozz: btw -- check this out -- https://review.openstack.org/#/c/202760/ -- I was looking into this same issue a few months ago, just never had time to fix it. | 19:05 |
| patchbot | bknudson_: patch 202760 - python-openstackclient - Same exception handling for gets() in find_resource | 19:05 |
| notmorgan | for new clouds i could see it being changed and making sense | 19:05 |
| notmorgan | but if it's something already running, it could be updated via the API too | 19:05 |
| samueldmq | rodrigods: perfect, I am reviewing that one right now | 19:05 |
| notmorgan | edmondsw: feel free to explain why we should change the name in an upgrade and the benefit and i'm happy to support it, just triggers an odd "eh, is this needed" feeling in my head | 19:06 |
| samueldmq | rodrigods: oops, meant raildo ^ | 19:06 |
| rodrigods | :) | 19:06 |
| edmondsw | notmorgan, shouldn't matter, really. But let's say it did... are you suggesting that keystone-manage bootstrap not use migration_helpers.get_default_domain? | 19:06 |
| raildo | samueldmq: thanks | 19:06 |
| rodrigods | edmondsw, no better suggestions :( | 19:06 |
| notmorgan | edmondsw: ah wait man i misread that | 19:06 |
| notmorgan | edmondsw: sigh | 19:06 |
| notmorgan | edmondsw: brain is context switching | 19:06 |
| notmorgan | edmondsw: ignore my comments :P | 19:07 |
| edmondsw | :) | 19:07 |
| notmorgan | though i would probably still keep that is is meant to hold v2 users and projects for compat in there. | 19:07 |
| notmorgan | edmondsw: also remember default domain can be changed via a config option | 19:08 |
| *** spzala has quit IRC | 19:08 | |
| edmondsw | notmorgan, well, as I was saying above, that's not necessarily true... you can configure which domain is used for that CONF.identity.default_domain_id | 19:08 |
| edmondsw | could be a different domain and not this one | 19:08 |
| notmorgan | yep | 19:08 |
| samueldmq | raildo: left a comment in https://review.openstack.org/#/c/243585/ | 19:08 |
| patchbot | samueldmq: patch 243585 - keystone - API support for project cascade update | 19:08 |
| samueldmq | raildo: I am a +2 after that (mostly nits) | 19:08 |
| notmorgan | which i never really liked as a concept. but i get why we did it. | 19:08 |
| notmorgan | fwiw | 19:08 |
| edmondsw | notmorgan, I had to change default_domain_id for the last year or so in our product, so I for one am glad it was changeable :) | 19:09 |
| raildo | samueldmq: fixing now | 19:09 |
| notmorgan | edmondsw: oh like i said i get it, i don't like that it's changable - there could have been other solutions to the problem. but this was an easy fix [it did cause some weird bugs though, and it's not well exercised code wise] | 19:10 |
| *** josecastroleon has quit IRC | 19:11 | |
| edmondsw | notmorgan rodrigods I'm not coming up with any better description than simply saying "The default domain", or maybe just leaving it blank entirely... | 19:11 |
| *** josecastroleon has joined #openstack-keystone | 19:12 | |
| notmorgan | edmondsw: "Default domain for v3 api compatiblity containing users and projects acted upon via the v2.0 API" ? or something like that | 19:12 |
| rodrigods | notmorgan, good one! | 19:13 |
| notmorgan | edmondsw: verbiage needing some massaging. | 19:13 |
| notmorgan | clearly | 19:13 |
| edmondsw | notmorgan, that doesn't solve the problem... that a) it's talking about v2 even in v3-only deployments and b) even in v2 deployments another domain may be configured with default_domain_id and that would be totally inaccurate | 19:14 |
| edmondsw | we need to KISS here | 19:14 |
| notmorgan | no that is saying it is the default | 19:14 |
| notmorgan | for that | 19:14 |
| edmondsw | notmorgan, that's confusing | 19:15 |
| notmorgan | edmondsw: i would encourage you/deployers to deleete "default" domain in the case you just outlined | 19:15 |
| notmorgan | :P | 19:15 |
| notmorgan | or redescribe it at least at runtime | 19:15 |
| notmorgan | via the API | 19:15 |
| edmondsw | notmorgan can't... been using it for years, would break backward compat | 19:16 |
| bknudson_ | is there some way we could have an option to not create the default domain? | 19:16 |
| bknudson_ | it must be created by keystone-manage db_sync | 19:16 |
| notmorgan | bknudson_: we could change it now if we move to bootstrap only | 19:16 |
| edmondsw | we could change the description, I guess... but why make each deployer do that? | 19:16 |
| edmondsw | bknudson_ bootstrap creates it | 19:17 |
| bknudson_ | notmorgan: the problem is if the deployment had v2 users they need to be put in a domain | 19:17 |
| bknudson_ | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/sql/migrate_repo/versions/067_kilo.py#n323 | 19:17 |
| notmorgan | bknudson_: right. we could make it not auto-created in the SQL migration | 19:18 |
| bknudson_ | bootstrap will create a domain for the admin user | 19:18 |
| edmondsw | yes... that is this domain | 19:18 |
| bknudson_ | notmorgan: or only create it if there's a user? | 19:18 |
| notmorgan | bknudson_: possibly. | 19:18 |
| notmorgan | i mean, i always disliked injecting data into the DB like the default domain, i actually wanted the default domain to just be a code construct :( | 19:19 |
| bknudson_ | we actually don't migrate users anymore, that code is too old | 19:19 |
| notmorgan | that is really virtual strictly for the v2/v3 compat stuff. | 19:19 |
| bknudson_ | so we don't need db_sync to create the domain | 19:19 |
| notmorgan | bknudson_: correct we could do away with it and only create it if really needed at runtime | 19:19 |
| bknudson_ | and we can leave it up to bootstrap | 19:19 |
| notmorgan | or via bootstrap | 19:20 |
| notmorgan | which is easier to enhance to make for alternative default domain configs/values | 19:20 |
| bknudson_ | if created by bootstrap it can use a different description | 19:20 |
| notmorgan | yep | 19:20 |
| *** jasonsb has quit IRC | 19:20 | |
| notmorgan | ayoung: i am still not convinced we should be warning if admin_token_auth is in the pipeline but maybe when its configured and in the pipeline? or when it authorizes a user? | 19:21 |
| notmorgan | ayoung: just a thought since we have docs still pending. | 19:22 |
| edmondsw | bknudson_ you volunteering to go make the changes you were just talking about? :) | 19:22 |
| notmorgan | bknudson_: the only thing to consider is some folks may still use admin_token_auth to bootstrap, so we'd need the default domain. | 19:22 |
| notmorgan | but i *think* we also create it at runtime if needed | 19:22 |
| ayoung | notmorgan, I think having it there at startup is appropriate. | 19:22 |
| edmondsw | notmorgan does admin_token_auth really need a domain to exist? | 19:22 |
| edmondsw | I didn't think so | 19:23 |
| bknudson_ | edmondsw: I'll work on those changes now if nobody else is. | 19:23 |
| notmorgan | edmondsw: well because bootstrapping doesn't say you must create a domain. | 19:23 |
| bknudson_ | if you create a user using v2 you're going to need a default domain | 19:23 |
| edmondsw | this all started from such a simple change: https://review.openstack.org/#/c/281381/1 | 19:23 |
| patchbot | edmondsw: patch 281381 - keystone - Update default domain's description | 19:23 |
| notmorgan | ayoung: except again we're shipping a default thing that yells at a deployer even if it's not "turned on" due to config | 19:23 |
| notmorgan | ayoung: which i'm against since RDO for example treates paste-ini as non-editable | 19:24 |
| ayoung | notmorgan, ah, you mean my argument that paste is not config, so people can't remove it and edit it? | 19:24 |
| notmorgan | ayoung: pretty much. :( | 19:24 |
| notmorgan | ayoung: it's somewhat config | 19:24 |
| edmondsw | those silly RedHat guys... am I right, ayoung? ;) | 19:24 |
| ayoung | notmorgan, hmm. OK. So if admin_token is set to None, we should shut off the warning? | 19:25 |
| notmorgan | ayoung: so i think we need to not warn unless it's enabled/configured. heck i'd make it warn on everyn auth ;) | 19:25 |
| ayoung | I'll buy that | 19:25 |
| *** aginwala has quit IRC | 19:25 | |
| notmorgan | ayoung: make it really nosiy :P OMG INSECURE AUTH OMG :P | 19:25 |
| bknudson_ | if they set an admin token password then make their /etc/passwd available because they obviously don't care about security. | 19:26 |
| notmorgan | ayoung: yeah that is my only concern. otherwise i'm pretty happy with the changes. i'm also inclined to say we merge admin_token_auth into auth_context and then the deprecation becomes code removal once folks don't need it [newton?] - and we can revisit removing the stub from the pipeline | 19:26 |
| openstackgerrit | henry-nash proposed openstack/python-keystoneclient: Support creation of domain specific roles https://review.openstack.org/282017 | 19:26 |
| notmorgan | not newton removal of code, but newton merge of the things | 19:26 |
| ayoung | notmorgan, ++ | 19:27 |
| ayoung | notmorgan, "I like this plan. I'm proud to be a part of it!" | 19:28 |
| ayoung | https://www.youtube.com/watch?v=PVhTDNlbsSc | 19:28 |
| *** spzala has joined #openstack-keystone | 19:28 | |
| *** spzala has quit IRC | 19:28 | |
| *** spzala has joined #openstack-keystone | 19:28 | |
| ayoung | NOt sure if I am really the Venkman of Keystone, though | 19:28 |
| notmorgan | lol | 19:29 |
| *** d0ugal has quit IRC | 19:29 | |
| *** d0ugal has joined #openstack-keystone | 19:30 | |
| *** d0ugal has quit IRC | 19:30 | |
| *** d0ugal has joined #openstack-keystone | 19:30 | |
| *** su_zhang has quit IRC | 19:31 | |
| ayoung | Actually, I am fairly certain I'm Spangler | 19:33 |
| *** jsavak has quit IRC | 19:34 | |
| *** jsavak has joined #openstack-keystone | 19:35 | |
| *** aginwala has joined #openstack-keystone | 19:38 | |
| *** daemontool has joined #openstack-keystone | 19:39 | |
| notmorgan | heh | 19:41 |
| *** josecastroleon has quit IRC | 19:42 | |
| *** josecastroleon has joined #openstack-keystone | 19:43 | |
| stevemar | can i be Stantz? | 19:49 |
| notmorgan | stevemar: Ray, when someone asks you if you're a god, you say "YES"! | 19:51 |
| stevemar | uh oh, we got our first "annoying warning" about the session/client deprecation that happened in keystoneclient | 19:54 |
| notmorgan | stevemar: oh where? | 19:54 |
| samueldmq | is it okay to use ?option for POSTing at an API ? | 19:54 |
| samueldmq | notmorgan: ^ | 19:54 |
| stevemar | notmorgan: check mailing list | 19:55 |
| *** rcernin has quit IRC | 19:55 | |
| stevemar | samueldmq: sounds weird | 19:55 |
| notmorgan | samueldmq: it is. but it looks weird. | 19:55 |
| notmorgan | stevemar: hmm... what was the title? i'm not seeing it yt | 19:55 |
| notmorgan | yet* | 19:55 |
| stevemar | notmorgan: "annoying warning" no tag | 19:56 |
| samueldmq | stevemar: notmorgan: same weirdness for PATCH right ? | 19:56 |
| samueldmq | PATCH /projects/{project_id}?cascade | 19:56 |
| notmorgan | samueldmq: yep | 19:56 |
| stevemar | notmorgan: not on -dev | 19:56 |
| notmorgan | stevemar: ahh | 19:56 |
| samueldmq | notmorgan: cool, I argue it to be as POST /v3/users/{user_id}/password | 19:56 |
| samueldmq | notmorgan: PATCH /projects/{project_id}/cascade | 19:56 |
| notmorgan | stevemar: oh that, that is something about their config | 19:57 |
| notmorgan | samueldmq: i don't think that is the same thing, we've warned on that for a looong time | 19:57 |
| notmorgan | samueldmq: sorry stevemar ^ | 19:57 |
| *** daemontool has quit IRC | 19:57 | |
| *** gyee has joined #openstack-keystone | 19:58 | |
| *** ChanServ sets mode: +v gyee | 19:58 | |
| notmorgan | stevemar: that is ksm warning | 19:58 |
| stevemar | notmorgan: tru tru | 19:58 |
| stevemar | notmorgan: i jumped too soon | 19:58 |
| notmorgan | stevemar: don't worry you'll get that email soon enough | 19:58 |
| stevemar | for sure | 19:59 |
| stevemar | waiting for people to upgrade their ksc | 19:59 |
| samueldmq | raildo: htruta: ^ | 19:59 |
| notmorgan | it's going to be the same as urllib3 complaining when using requests and verify=False | 19:59 |
| samueldmq | raildo: htruta: why not PATCH /projects/{project_id}/cascade rather than PATCH /projects/{project_id}?cascade | 19:59 |
| notmorgan | stevemar: basically turn logging off for ksc.session.Session >.> | 20:00 |
| notmorgan | stevemar: :P | 20:00 |
| *** rderose has quit IRC | 20:00 | |
| samueldmq | the delete one is using slash, so should be okay | 20:00 |
| *** daemontool has joined #openstack-keystone | 20:00 | |
| raildo | samueldmq: we discussed this a lot of times here... we never reached an agreement | 20:01 |
| raildo | samueldmq: we implemented in the first way, and the people asked us to change for query string | 20:01 |
| htruta | samueldmq: the delete one will be rebased to use the query filter too. Most people we discussed in here agreed on the query, that's why we decided | 20:01 |
| samueldmq | htruta: raildo: I was just discussing it with notmorgan and stevemar, PATCH using a query string sounds weird | 20:02 |
| tjcocozz | I keep coming accross this term 'roll grants' are they the same as role assignments? | 20:03 |
| samueldmq | tjcocozz: role grants yes | 20:03 |
| tjcocozz | samueldmq, thanks! | 20:03 |
| samueldmq | tjcocozz: assignments came in when we implemented lsit_role_assignmetns | 20:03 |
| samueldmq | tjcocozz: which has a different and more complete return than /roles | 20:04 |
| samueldmq | tjcocozz: then a new API was created for backward compat | 20:04 |
| bknudson_ | I thought changing the migration to not create the default domain would cause all sorts of tests to fail but there was only 1 failure. | 20:04 |
| samueldmq | tjcocozz: I believe there was another ways to do it, but well, that's it :) | 20:04 |
| tjcocozz | samueldmq, okay that makes sense. | 20:05 |
| samueldmq | ayoung: ping, you around ? re: /cascade or ?cascade | 20:05 |
| samueldmq | ayoung: I saw you had a comment in https://review.openstack.org/#/c/244248/11/doc/source/policy_mapping.rst | 20:05 |
| patchbot | samueldmq: patch 244248 - keystone - API support for project cascade delete | 20:05 |
| htruta | samueldmq: ayoung is frying bigger fishes | 20:05 |
| raildo | lol | 20:05 |
| ayoung | samueldmq, cascading means all of the included projects | 20:05 |
| samueldmq | htruta: ? | 20:06 |
| ayoung | so if P1->P2 and P2->P2 P2->P4 and so on you check policy against all of those | 20:06 |
| samueldmq | ayoung: it means make the API apply in the subtree as well | 20:06 |
| htruta | samueldmq: both of the alternatives make sense, following what we already have in keystone. I tend to go with the ?cascade | 20:07 |
| samueldmq | htruta: exactly the opposite | 20:07 |
| samueldmq | htruta: we have ? for query params in GET calls | 20:07 |
| *** henrynash_ has joined #openstack-keystone | 20:07 | |
| *** ChanServ sets mode: +v henrynash_ | 20:07 | |
| samueldmq | htruta: and / for POST | 20:07 |
| *** annasort_ has joined #openstack-keystone | 20:07 | |
| *** markvoelker_ has joined #openstack-keystone | 20:07 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 20:08 |
| samueldmq | htruta: like POST /v3/users/{user_id}/password | 20:09 |
| *** petertr7z has joined #openstack-keystone | 20:09 | |
| *** petertr7z is now known as petertr7 | 20:09 | |
| *** notmorga1 has joined #openstack-keystone | 20:09 | |
| *** notmorga1 has quit IRC | 20:09 | |
| *** notmorga1 has joined #openstack-keystone | 20:10 | |
| htruta | samueldmq: one thing to consider is that we shouldn't add endpoints to every single subset operation | 20:10 |
| htruta | of operation* | 20:10 |
| samueldmq | htruta: raildo: /inherited_to_projects when granting role assignments is also a good example | 20:11 |
| *** tjcocozz_ has joined #openstack-keystone | 20:11 | |
| *** annasort has quit IRC | 20:12 | |
| *** john5223 has quit IRC | 20:12 | |
| *** henrynash has quit IRC | 20:12 | |
| *** petertr7_away has quit IRC | 20:12 | |
| *** notmorgan has quit IRC | 20:12 | |
| *** markvoelker has quit IRC | 20:12 | |
| *** henrynash_ is now known as henrynash | 20:12 | |
| *** tjcocozz has quit IRC | 20:12 | |
| *** kevinbenton has quit IRC | 20:12 | |
| *** BAKfr has quit IRC | 20:12 | |
| *** stevemar has quit IRC | 20:12 | |
| *** tristanC has quit IRC | 20:12 | |
| samueldmq | we do /users/x/proejcts/y/roles/r/inherited to projects rather than ?inherited_to_projects | 20:12 |
| *** annasort_ is now known as annasort | 20:12 | |
| htruta | samueldmq: as I said, I'm ok with both approaches, but we decided to go with ?cascade because it had better acceptance | 20:12 |
| samueldmq | henrynash: hi, you around ? need your view on something | 20:12 |
| *** vivekd has quit IRC | 20:12 | |
| samueldmq | htruta: who accept it better ? :p | 20:12 |
| *** josecastroleon has quit IRC | 20:12 | |
| *** kevinbenton has joined #openstack-keystone | 20:12 | |
| *** tristanC has joined #openstack-keystone | 20:13 | |
| samueldmq | htruta: for me it sounds very weird, and notmorgan and stevemar as I said | 20:13 |
| *** stevemar has joined #openstack-keystone | 20:13 | |
| samueldmq | I'd like to get henrynash's view on it | 20:13 |
| htruta | samueldmq: AFAIR, henrynash, ayoung, gyee | 20:13 |
| raildo | samueldmq: I'm not in favor or agains any of this options, as I said, we had discussed this like 5 times, and we didn't have any agreement or any RFC pattern to make this clear or something like that... | 20:13 |
| *** BAKfr has joined #openstack-keystone | 20:13 | |
| *** ChanServ sets mode: +o stevemar | 20:13 | |
| *** josecastroleon has joined #openstack-keystone | 20:13 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: db_sync doesn't create default domain https://review.openstack.org/282042 | 20:15 |
| *** daemontool has quit IRC | 20:16 | |
| *** boris-42 has quit IRC | 20:16 | |
| *** aginwala has quit IRC | 20:16 | |
| htruta | raildo: ++ | 20:16 |
| *** boris-42 has joined #openstack-keystone | 20:18 | |
| *** daemontool has joined #openstack-keystone | 20:19 | |
| *** jsavak has quit IRC | 20:20 | |
| *** daemontool has quit IRC | 20:21 | |
| *** boris-42 has quit IRC | 20:24 | |
| *** aginwala has joined #openstack-keystone | 20:27 | |
| *** jsavak has joined #openstack-keystone | 20:28 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove migration_helpers.get_default_domain https://review.openstack.org/282049 | 20:31 |
| notmorga1 | bknudson_: wooo | 20:34 |
| *** amakarov is now known as amakarov_away | 20:35 | |
| bknudson_ | notmorga1: I want to try this out but I don't think bootstrap would create the default domain correctly... | 20:36 |
| bknudson_ | see http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/sql/migration_helpers.py#n47 | 20:36 |
| notmorga1 | bknudson_: really? i tried it and it seemed to work. | 20:37 |
| samueldmq | notmorga1: stevemar: so I'd argue it to be POST /projects/{id}/cascade | 20:37 |
| bknudson_ | and it's used http://git.openstack.org/cgit/openstack/keystone/tree/keystone/cmd/cli.py#n132 | 20:37 |
| samueldmq | notmorga1: stevemar: I was looking at https://specs.openstack.org/openstack/api-wg/guidelines/http.html | 20:37 |
| samueldmq | and PATCH things are for single entities | 20:37 |
| bknudson_ | it's going to have all this "extra" junk? | 20:37 |
| notmorga1 | bknudson_: ah. hm. | 20:38 |
| samueldmq | notmorga1: stevemar: and POST for changing server states somehow, so a POST would be more appropriate | 20:38 |
| bknudson_ | or can you actually do a create with extra: and it gets loaded right? | 20:38 |
| *** notmorga1 is now known as notmorgan | 20:38 | |
| htruta | samueldmq: that's an update. It is a PATCH | 20:38 |
| samueldmq | htruta: no always | 20:38 |
| samueldmq | not* | 20:38 |
| stevemar | samueldmq: hmm | 20:38 |
| *** notmorgan is now known as Guest8046 | 20:38 | |
| samueldmq | and update in a *single* entity is a PATCH | 20:38 |
| samueldmq | htruta: ^ | 20:38 |
| * Guest8046 kicks nickserv | 20:39 | |
| samueldmq | stevemar: I was discussing it with sdague | 20:39 |
| stevemar | samueldmq: whats the API wg say? | 20:39 |
| *** Guest8046 is now known as morganfainberg | 20:39 | |
| *** morganfainberg is now known as Guest99464 | 20:40 | |
| samueldmq | stevemar: I can't talk for all the api-wg, but sdague (who is a member) told me exaclty what I said above | 20:40 |
| *** Guest99464 is now known as maelfius | 20:40 | |
| *** maelfius is now known as notmorgan1 | 20:40 | |
| notmorgan1 | ... | 20:41 |
| samueldmq | stevemar: PATCH is for a single entity, so it always ends with /{id} | 20:41 |
| stevemar | samueldmq: http://stackoverflow.com/questions/28596688/rest-api-bulk-create-or-update-in-single-request | 20:41 |
| * samueldmq 's looking | 20:41 | |
| stevemar | samueldmq: POST seems weird | 20:42 |
| htruta | samueldmq, stevemar: using POST to create AND to bulk update is not user friendly for me | 20:42 |
| samueldmq | stevemar: htruta: have a moment to go to #openstack-sdks ? | 20:43 |
| *** josecastroleon has quit IRC | 20:43 | |
| samueldmq | we could talk to some guys from api-wg there and get some guidance | 20:43 |
| stevemar | always there | 20:43 |
| *** pnavarro has joined #openstack-keystone | 20:43 | |
| * htruta is going | 20:44 | |
| *** notmorgan1 is now known as notmorgan | 20:44 | |
| *** notmorgan has quit IRC | 20:44 | |
| *** notmorgan has joined #openstack-keystone | 20:44 | |
| *** ChanServ sets mode: +o notmorgan | 20:44 | |
| *** josecastroleon has joined #openstack-keystone | 20:44 | |
| *** notmorgan is now known as morgan | 20:44 | |
| *** morgan is now known as notmorgan | 20:45 | |
| *** e0ne has quit IRC | 20:45 | |
| *** e0ne has joined #openstack-keystone | 20:45 | |
| *** notmorgan is now known as captainmorgan | 20:46 | |
| *** captainmorgan is now known as notmorgan | 20:46 | |
| *** notmorgan is now known as needscoffee | 20:46 | |
| *** e0ne has quit IRC | 20:46 | |
| *** needscoffee is now known as notmorgan | 20:47 | |
| * notmorgan fixes irc nicks... | 20:47 | |
| bknudson_ | notmorgan: the domain created by bootstrap doesn't have a description as far as I can tell from this devstack test. | 20:50 |
| bknudson_ | notmorgan: with https://review.openstack.org/#/c/282049/ it's got a description | 20:53 |
| patchbot | bknudson_: patch 282049 - keystone - Remove migration_helpers.get_default_domain | 20:53 |
| notmorgan | bknudson_: oh no it doesn't | 20:53 |
| notmorgan | because the only reason bootstrap does that is sqlite in tests doesn't run migrate :P | 20:53 |
| notmorgan | it does model.reflection_create [not actual method] | 20:54 |
| dstanek | has anyone had any luck mounting a cloud node's filesystem to a local machine? | 20:54 |
| *** fpatwa has joined #openstack-keystone | 20:54 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Remove migration_helpers.get_default_domain https://review.openstack.org/282049 | 20:57 |
| notmorgan | dstanek: uhm... explain what you're trying to do? | 20:57 |
| notmorgan | dstanek: a VM -> hypervisor? | 20:57 |
| dstanek | notmorgan: VM -> MacBook Air | 20:58 |
| notmorgan | like under say virtualbox? | 20:58 |
| notmorgan | while the VM is running or just as a "loopback so i can muck with things" | 20:58 |
| *** esp has joined #openstack-keystone | 20:59 | |
| dstanek | notmorgan: except i want to mount a VM; sshfs is slow as hell and the fuse driver i was trying to use seems broken now | 20:59 |
| * notmorgan has done both, but the former is NFS or SMB or AFP share only. | 20:59 | |
| *** fpatwa has quit IRC | 20:59 | |
| notmorgan | i used NFS except OS X sucks at nfs now. | 20:59 |
| dstanek | notmorgan: the VM is in the Rax public cloud | 20:59 |
| notmorgan | oh. | 20:59 |
| notmorgan | dstanek: OH. | 20:59 |
| notmorgan | so i'd use NFS TCP tunneled over the SSH connection | 21:00 |
| notmorgan | or openvpn. | 21:00 |
| notmorgan | sshfs was ... wonky :( | 21:00 |
| notmorgan | especially on OS X | 21:00 |
| dstanek | wonky is an understatement; i had this working OK on fedora back in the day, but my OSX setup is not loving it | 21:01 |
| notmorgan | and chances are tunneled NFS will be about as fast/reliable as FUSE sshfs | 21:01 |
| notmorgan | the issue is sshfs is fuse and fuse sucks on OS X | 21:01 |
| *** samueldmq1 has joined #openstack-keystone | 21:01 | |
| notmorgan | dstanek: so easiest/least problematic would prob. be openvpn | 21:02 |
| notmorgan | dstanek: and then NFS or SMB or AFP | 21:02 |
| dstanek | i'll give that a try. thx notmorgan | 21:03 |
| notmorgan | dstanek: or alternative, you could do VM on OS X that does sshfs that re-exports to the local machine | 21:03 |
| *** tsymancz2k has joined #openstack-keystone | 21:03 | |
| notmorgan | gosh that is a lot of moving parts. | 21:03 |
| dstanek | i with i could mount over mosh | 21:03 |
| *** tsymancz2k has quit IRC | 21:03 | |
| *** tsymanczyk has quit IRC | 21:03 | |
| *** tsymancz1k has quit IRC | 21:03 | |
| dstanek | notmorgan: not terrible because i already have a vpn between my lappy and another cloud node that i can test with | 21:03 |
| notmorgan | well, you could mount over mosh with a bit of custom code, a application on the remote end and a FUSE driver locally | 21:03 |
| notmorgan | but it's custom code. | 21:04 |
| * notmorgan really wants to have mosh-friendly daemons like that at some point | 21:04 | |
| notmorgan | maybe i'll start writing them ;) | 21:04 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 21:04 |
| notmorgan | but i would guess mosh would make the atomicity of a file operation very difficult | 21:04 |
| *** jsavak has quit IRC | 21:05 | |
| *** esp has quit IRC | 21:05 | |
| *** jsavak has joined #openstack-keystone | 21:05 | |
| *** roxanaghe has quit IRC | 21:06 | |
| *** raildo is now known as raildo-afk | 21:06 | |
| *** roxanaghe has joined #openstack-keystone | 21:06 | |
| *** samueldmq1 has quit IRC | 21:07 | |
| *** tsymanczyk has joined #openstack-keystone | 21:08 | |
| *** tsymancz1k has joined #openstack-keystone | 21:08 | |
| *** tsymanczyk is now known as Guest86751 | 21:08 | |
| *** dstanek has quit IRC | 21:09 | |
| *** dstanek has joined #openstack-keystone | 21:10 | |
| *** ChanServ sets mode: +v dstanek | 21:10 | |
| *** josecastroleon has quit IRC | 21:14 | |
| *** josecastroleon has joined #openstack-keystone | 21:15 | |
| *** rk4n has quit IRC | 21:21 | |
| *** rk4n has joined #openstack-keystone | 21:21 | |
| *** josdotso has joined #openstack-keystone | 21:27 | |
| josdotso | Hi folks. with-env.sh is gone it seems. how to start keystone-all for development.. re: https://github.com/openstack/keystone/blob/master/doc/source/developing.rst#running-keystone | 21:28 |
| josdotso | *? | 21:29 |
| *** tsymancz2k has joined #openstack-keystone | 21:35 | |
| *** tsymancz1k has quit IRC | 21:35 | |
| *** Guest86751 has quit IRC | 21:35 | |
| *** e0ne has joined #openstack-keystone | 21:38 | |
| stevemar | dolphm: around? | 21:44 |
| dolphm | stevemar: sort of | 21:44 |
| *** pgbridge has quit IRC | 21:44 | |
| *** josecastroleon has quit IRC | 21:45 | |
| *** josecastroleon has joined #openstack-keystone | 21:46 | |
| stevemar | dolphm: should be quick... | 21:47 |
| dolphm | stevemar: i'm packing up now... | 21:48 |
| stevemar | dolphm: dammit | 21:48 |
| stevemar | dolphm: https://bugs.launchpad.net/keystone/+bug/1473567 | 21:48 |
| openstack | Launchpad bug 1473567 in OpenStack Identity (keystone) "Fernet tokens fail tempest runs" [High,In progress] - Assigned to Lance Bragstad (lbragstad) | 21:48 |
| *** gildub has joined #openstack-keystone | 21:48 | |
| stevemar | dolphm: oh nvm, notmorgan put up a patch to close it | 21:48 |
| stevemar | my bad | 21:48 |
| dolphm | stevemar: yay | 21:48 |
| dolphm | notmorgan: thanks for things | 21:48 |
| notmorgan | dolphm: :) | 21:48 |
| stevemar | notmorgan: mark the keystone part of the bug as invalid? | 21:49 |
| stevemar | since we're not going to fix the subsecond issue? | 21:49 |
| openstackgerrit | Brant Knudson proposed openstack/python-keystoneclient: Get revocation list with only audit ids https://review.openstack.org/260196 | 21:50 |
| notmorgan | stevemar: uhm. | 21:52 |
| notmorgan | stevemar: "wont fix" | 21:52 |
| stevemar | notmorgan: thank you! | 21:53 |
| notmorgan | stevemar: since it's not that it's an invalid bug, just that it's not the thing we're fixing | 21:53 |
| stevemar | true | 21:53 |
| stevemar | 1 less bug, woo hoo | 21:53 |
| notmorgan | maybe i should do another pass of "cloes all the bugs" | 21:53 |
| notmorgan | see if we can smash down the total open number another 20-30 | 21:53 |
| notmorgan | like a couple weeks ago | 21:53 |
| notmorgan | i had 1 false positive in the smash bugs... so i felt good about that | 21:54 |
| notmorgan | :P | 21:54 |
| stevemar | notmorgan: i am referring to the ones targeting mitaka-3 | 21:54 |
| stevemar | https://launchpad.net/keystone/+milestone/mitaka-3 | 21:54 |
| notmorgan | stevemar: right, i look at all the bugs when i do it. sometimes it closes bugs targeting a release. | 21:54 |
| *** rk4n has quit IRC | 21:55 | |
| *** rk4n has joined #openstack-keystone | 21:55 | |
| *** su_zhang has joined #openstack-keystone | 21:57 | |
| *** chlong has quit IRC | 21:57 | |
| *** chlong_ has joined #openstack-keystone | 21:58 | |
| notmorgan | stevemar: i just tossed you under the buss on the ML to look into the annoying warning more | 21:58 |
| notmorgan | sorry | 21:58 |
| notmorgan | :P | 21:58 |
| notmorgan | #sorrynotsorry | 21:58 |
| stevemar | notmorgan: gdi | 21:58 |
| stevemar | notmorgan: apparently someone really wants better policy | 21:59 |
| notmorgan | stevemar: i saw. | 21:59 |
| stevemar | mention domain and implied roles? | 21:59 |
| samueldmq | stevemar: have a link to the ML thread ? | 21:59 |
| notmorgan | stevemar: implied ... maybe, but point at the spec dolphm and jamielennox are championing first | 21:59 |
| stevemar | samueldmq: http://lists.openstack.org/pipermail/openstack/2016-February/015268.html | 22:00 |
| notmorgan | stevemar: that plus implied might get you there. | 22:00 |
| *** pgbridge has joined #openstack-keystone | 22:00 | |
| notmorgan | stevemar: but i'd be wary about talking about implied roles until it's baked a little more, it's still pretty early on | 22:00 |
| stevemar | yeah | 22:00 |
| notmorgan | stevemar: i would def. not talk about domain-specific-roles yet. | 22:00 |
| stevemar | yep | 22:01 |
| stevemar | too much info will just muddy the water | 22:01 |
| jamielennox | i'm coming more to the view that you don't need it, if the provider used a really fine grained policy file then domain admins can decide who to give what roles to | 22:01 |
| notmorgan | i think the billion-roles spec will get them ~80% of the way there, implied is anothr 10-15% and dsr may or may not even cover anything more | 22:02 |
| jamielennox | with implied roles you can make those fine grained roles easier to use | 22:02 |
| notmorgan | jamielennox: that is generally my view | 22:02 |
| bknudson_ | the name of that blueprint should have been "a billion roles" | 22:02 |
| jamielennox | per-domain roles is just implied roles that are domain only | 22:02 |
| notmorgan | jamielennox: but i get that some folks are asking for remix roles like implied roles that logically make sense for my little corner of the cloud | 22:02 |
| jamielennox | i think people over estimate what policy should do | 22:03 |
| notmorgan | jamielennox: so i get that there is some usability features there. i'm inclined to say it's pretty edge case usability | 22:03 |
| notmorgan | jamielennox: but we wont know until implied gets some more drive time | 22:03 |
| *** josdotso has quit IRC | 22:03 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Use ldap3 for DN comparison https://review.openstack.org/260721 | 22:03 |
| notmorgan | bknudson_: ++ | 22:03 |
| notmorgan | bknudson_: also yay ldap3! | 22:03 |
| jamielennox | i think we should say that policy files are capabilities and use implied-roles to build actual roles | 22:03 |
| jamielennox | and hopefully people will confuse them less | 22:04 |
| bknudson_ | notmorgan: that is step 1 of a much larger change that I'm not working on currently. | 22:04 |
| notmorgan | jamielennox: ++ actually i need to propose a change to oslo_policy to make any API an implict role that can be created | 22:04 |
| notmorgan | bknudson_: very happy to see it though, that one is a big step in the right direction | 22:04 |
| bknudson_ | notmorgan: we looked at pyldap since it supposedly has py3 support now but ldappool is still broken. | 22:04 |
| notmorgan | ldap3 is the best option, it does everything right and really works in a more pythonic way imo | 22:04 |
| bknudson_ | maybe it would be easier to cleanup ldappool | 22:05 |
| samueldmq | stevemar: thx | 22:05 |
| bknudson_ | notmorgan: that's my opinion, pyldap and the C ldap library are turds | 22:05 |
| notmorgan | since it uses dicts vs dicts in *some* cases and lists of tuples in others | 22:05 |
| *** tsymanczyk has joined #openstack-keystone | 22:05 | |
| notmorgan | bknudson_: drive towards ldap3, i'll commit to helping to review as long as i have time to do so, i think it's a much much much better approach | 22:05 |
| *** tsymanczyk is now known as Guest49413 | 22:05 | |
| notmorgan | bknudson_: but i also think we can isolate all the ldap code out of keystone.common into the driver itself | 22:05 |
| notmorgan | w/ ldap3 since we ditched assignment and role and resource | 22:06 |
| notmorgan | so i am also a fan of "new ldap driver that isn't silly" | 22:06 |
| notmorgan | but will support either direction you go | 22:06 |
| bknudson_ | notmorgan: that makes sense, no need for common ldap since there is only 1. | 22:06 |
| notmorgan | bknudson_: exactly | 22:06 |
| bknudson_ | I also am liking that... our ldap3 driver is read-only | 22:06 |
| notmorgan | yep | 22:06 |
| bknudson_ | if you want read-write use the deprecated one and forget about py3 support. | 22:07 |
| notmorgan | yep | 22:07 |
| notmorgan | annnnnd | 22:07 |
| *** petertr7 is now known as petertr7_away | 22:07 | |
| notmorgan | as long as new driver works [and produces same data for idneitty] we cna just say "use this instead, and it'll be the py3 way forward] | 22:08 |
| notmorgan | it also means we don't carry silly behaviors to be cross-backend friendly forward. | 22:08 |
| bknudson_ | that sounds like less work than trying to get all our existing code changed over. | 22:08 |
| *** spzala has quit IRC | 22:08 | |
| notmorgan | and in O (or p cycle) keystone.common.ldap gets rm -rf'd | 22:08 |
| *** knikolla has quit IRC | 22:09 | |
| bknudson_ | we might be able to move keystone.common.ldap to keystone.identity.ldap already? | 22:09 |
| notmorgan | probably. | 22:09 |
| notmorgan | but not sure if that is worth it | 22:09 |
| notmorgan | it's a lot of code shuffle and still need stubs laying around for compat for a couple cycles | 22:10 |
| notmorgan | but i defer to you since you're working on it :) | 22:10 |
| notmorgan | the only downside is we need a new "extras" install, ldap3? since "[ldap]" is already consumed by py2-crappy-version | 22:10 |
| notmorgan | or we could just make ldap3 a hard-requirement since it's pure python | 22:11 |
| openstackgerrit | Merged openstack/keystonemiddleware: Add back a bandit tox job https://review.openstack.org/281548 | 22:11 |
| bknudson_ | notmorgan: y, it'll probably be ldap3 | 22:11 |
| bknudson_ | or ldap-the-next-generation | 22:11 |
| stevemar | bknudson_: everything is TNG | 22:12 |
| stevemar | keystone TNG | 22:12 |
| notmorgan | stevemar: API V4! | 22:13 |
| stevemar | no! only TNG | 22:13 |
| notmorgan | stevemar: API vTNG screw SEMVER! | 22:13 |
| stevemar | and the TNNG | 22:13 |
| stevemar | TNNNG | 22:13 |
| stevemar | TNNNNNG | 22:13 |
| *** jsavak has quit IRC | 22:13 | |
| *** aginwala has quit IRC | 22:14 | |
| *** doug-fis_ has joined #openstack-keystone | 22:15 | |
| stevemar | notmorgan: whats the policy on modifying migration files? | 22:15 |
| notmorgan | stevemar: don't. | 22:15 |
| stevemar | if we haven't shipped | 22:15 |
| notmorgan | stevemar: oh | 22:15 |
| notmorgan | uh | 22:15 |
| notmorgan | well still | 22:15 |
| notmorgan | dont | 22:15 |
| stevemar | in case folks are runinng from master | 22:15 |
| notmorgan | yep | 22:15 |
| *** josecastroleon has quit IRC | 22:15 | |
| stevemar | alrighty | 22:15 |
| notmorgan | people chase master, make a new migration | 22:15 |
| stevemar | i figured that was the case ) | 22:16 |
| stevemar | :) | 22:16 |
| notmorgan | you can fix the old one and make a new one idempotent | 22:16 |
| notmorgan | to catch the minority of people doing close-to-cd-like-things | 22:16 |
| *** aginwala has joined #openstack-keystone | 22:16 | |
| notmorgan | but... | 22:16 |
| notmorgan | if itsn't breaking people to get that migration a subsequent one is a lot less work | 22:16 |
| *** josecastroleon has joined #openstack-keystone | 22:17 | |
| *** doug-fish has quit IRC | 22:18 | |
| stevemar | true day | 22:18 |
| stevemar | dat | 22:18 |
| *** doug-fis_ has quit IRC | 22:19 | |
| *** mylu has joined #openstack-keystone | 22:21 | |
| dstanek | stevemar: so i'm not liking the extra code added in to ensure base32 on the password. i think that should be enforced when storing credentials and not on validation. thoughts? | 22:21 |
| dstanek | i don't think we have a good generic way of doing that yet | 22:22 |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Allow user list without specifying domain https://review.openstack.org/282080 | 22:24 |
| *** dave-mccowan has quit IRC | 22:26 | |
| *** diazjf has quit IRC | 22:31 | |
| *** mylu has quit IRC | 22:33 | |
| notmorgan | dstanek: base32 on the password? | 22:34 |
| notmorgan | dstanek: what are you looking at, i'm very intrigued by this new code thing | 22:35 |
| dstanek | notmorgan: https://review.openstack.org/#/c/274901/13/keystone/auth/plugins/totp.py _get_totp_token | 22:35 |
| patchbot | dstanek: patch 274901 - keystone - Time-based One-time Password | 22:35 |
| bknudson_ | base32 encrypt the password | 22:36 |
| dstanek | notmorgan: cryptography craps itself when the secret isn't quite right | 22:36 |
| notmorgan | so i would enforce on store, if we are managing the storage not through the generic credential API | 22:37 |
| dstanek | bknudson_: that's what i was thinking, but when creating the record | 22:37 |
| notmorgan | if we're using the generic credential API we *should* provide some level of validation | 22:37 |
| notmorgan | when consuming it | 22:37 |
| notmorgan | *cough* "encrypt" *cough* | 22:38 |
| notmorgan | dstanek: but we're not adding an API to generate/upload a validated TOTP secret | 22:38 |
| dstanek | so i was thinking though, if we screw with it when it's being saved that the shared secret is no longer shared and the client may not be able to properly generate a passcode | 22:38 |
| notmorgan | it's just a blob someone is responsible for doing it. | 22:38 |
| *** mylu has joined #openstack-keystone | 22:39 | |
| notmorgan | so.. the question becomes: does our credendial api becomes smart enough to handle this | 22:40 |
| dstanek | notmorgan: i was actually thinking that maybe we need a type based validator on create/update | 22:40 |
| notmorgan | sure. i'm ok with that | 22:40 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Deprecate load_json() in favor of load() https://review.openstack.org/280373 | 22:40 |
| openstackgerrit | Brant Knudson proposed openstack/oslo.policy: Change default behavior for YAML https://review.openstack.org/280384 | 22:40 |
| notmorgan | dstanek: so just register a hook to tell credential API "validate type as X" and that is a method? maybe a stevedore entry? | 22:43 |
| notmorgan | dstanek: and if there is nothing to load for that type, it's stored as given? | 22:43 |
| stevemar | bknudson_: list of projects that are using load_json http://codesearch.openstack.org/?q=policy.Rules.load_json&i=nope&files=&repos= | 22:43 |
| dstanek | notmorgan: maybe. not sure we need to get that fancy yet | 22:43 |
| notmorgan | would open the door to easily do full encryption down the line [future proof] | 22:43 |
| *** mylu has quit IRC | 22:44 | |
| dstanek | notmorgan: yes, if it's not there then just store like we do today | 22:44 |
| notmorgan | dstanek: or at least leave the architecutre open to something like that down the line, even if it doesn't do it | 22:44 |
| notmorgan | today | 22:44 |
| dstanek | notmorgan: yeah, i don't think i can prevent it even if i wanted to :-), but i don't want to give anyone the ability to override the totp validation | 22:45 |
| notmorgan | dstanek: yeah i like that better than the "base32" mucking in the plugin on every load/validate | 22:45 |
| *** mylu has joined #openstack-keystone | 22:45 | |
| bknudson_ | stevemar: neat... that's handy | 22:46 |
| *** josecastroleon has quit IRC | 22:46 | |
| stevemar | bknudson_: you broke my sarcasm detector | 22:46 |
| dstanek | lol | 22:47 |
| bknudson_ | oh, should have that's REAL handy | 22:47 |
| bknudson_ | (: | 22:47 |
| *** josecastroleon has joined #openstack-keystone | 22:47 | |
| bknudson_ | I think upside-down happy face is sarcasm indicator. | 22:47 |
| *** edmondsw has quit IRC | 22:49 | |
| notmorgan | bknudson_: what not using an "⸮" [warning UTF-8 needed!] for it | 22:49 |
| *** pnavarro has quit IRC | 22:50 | |
| bknudson_ | the kids probably have an emoji | 22:51 |
| stevemar | notmorgan: no, we dont support storing that in openstack | 22:51 |
| stevemar | refer to the x-project spec | 22:51 |
| notmorgan | stevemar: awww. right utf-8-4-byte-character | 22:51 |
| notmorgan | stevemar: dude, but i want to call my project <poo emojii> | 22:52 |
| stevemar | notmorgan: totally a legit use case | 22:52 |
| stevemar | that's the one issue i keep hearing that customers want | 22:52 |
| stevemar | more support for emojis | 22:52 |
| notmorgan | stevemar: wow, mosh/my terminal doesn't support it :( | 22:52 |
| notmorgan | 💩 | 22:52 |
| notmorgan | ah just my terminal | 22:53 |
| notmorgan | the weechat android client sees that just fine *facepalm* | 22:53 |
| *** fpatwa has joined #openstack-keystone | 22:55 | |
| dstanek | stevemar: when you say 'corrupt credential' here: https://review.openstack.org/#/c/274901/12/keystone/tests/unit/test_v3_auth.py ; what are you thinking? | 22:58 |
| patchbot | dstanek: patch 274901 - keystone - Time-based One-time Password | 22:58 |
| *** gildub has quit IRC | 22:59 | |
| stevemar | dstanek: beats me, i was wondering why that was added in the first place | 22:59 |
| stevemar | dstanek: i was just correcting the spelling | 22:59 |
| *** fpatwa has quit IRC | 22:59 | |
| dstanek | stevemar: the padding was added because we are expecting base32 encoded secrets with the padding stripped | 23:00 |
| stevemar | dstanek: oh, i am referring to: like 51 https://review.openstack.org/#/c/274901/12/keystone/auth/plugins/totp.py | 23:00 |
| patchbot | stevemar: patch 274901 - keystone - Time-based One-time Password | 23:00 |
| stevemar | err 52 | 23:00 |
| dstanek | stevemar: ah, hmmmm... i'll figure out how to trigger it and get it tested. this module will be 100% covered, including whatever cases i can think of | 23:02 |
| *** aginwala has quit IRC | 23:02 | |
| stevemar | dstanek: looking at https://review.openstack.org/#/c/274901/2/keystone/auth/plugins/totp.py | 23:02 |
| patchbot | stevemar: patch 274901 - keystone - Time-based One-time Password | 23:02 |
| stevemar | it looks like a catch was introduced incase the json.loads failed? | 23:03 |
| stevemar | and it somehow made its way outside and around the iterator for the list? | 23:03 |
| stevemar | dstanek: it looks like we were doing a json loads before, and now we're not :\ | 23:05 |
| *** e0ne has quit IRC | 23:06 | |
| stevemar | dstanek: i want to say we don't need the try/except there, but i wanted the author to point that out :) | 23:06 |
| *** gordc has quit IRC | 23:06 | |
| *** aginwala has joined #openstack-keystone | 23:06 | |
| dstanek | stevemar: i didn't even notice that. i'll take a close look after dinner. going to push now, but ignore it because i have not run the tests to see if it works :-) | 23:07 |
| *** henrynash has quit IRC | 23:07 | |
| stevemar | dstanek: cool beans | 23:08 |
| stevemar | dstanek: i'm also good if this won't play nice with list limit, i don't see that as a blocker | 23:08 |
| stevemar | if you include that limitation in the docs and release note, then i'm good | 23:09 |
| stevemar | we can tell folks to increase the limit | 23:09 |
| stevemar | and work on adding a function for the credentials backend next cycle | 23:09 |
| notmorgan | stevemar: ++ | 23:10 |
| stevemar | notmorgan: -- | 23:11 |
| notmorgan | stevemar: http://cdn.onegreenplanet.org/wp-content/uploads/2010/10//2014/08/fox1.jpg | 23:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 23:11 |
| stevemar | hehe | 23:11 |
| dstanek | dinner time! | 23:11 |
| stevemar | dstanek: running time! | 23:12 |
| *** timcline has quit IRC | 23:12 | |
| *** pushkaru has quit IRC | 23:13 | |
| *** josecastroleon has quit IRC | 23:17 | |
| *** jbell8 has joined #openstack-keystone | 23:17 | |
| *** slberger has left #openstack-keystone | 23:18 | |
| *** josecastroleon has joined #openstack-keystone | 23:18 | |
| *** jamielennox is now known as jamielennox|away | 23:20 | |
| *** tobe has joined #openstack-keystone | 23:28 | |
| *** nkinder has quit IRC | 23:28 | |
| *** timcline has joined #openstack-keystone | 23:31 | |
| *** ninag has quit IRC | 23:32 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Implied roles index with cascading update/delete https://review.openstack.org/281921 | 23:33 |
| stevemar | amakarov_away: i fixed this up a bit, it could still use some work ^ | 23:33 |
| stevemar | ayoung: this is up your alley | 23:34 |
| stevemar | ayoung: ^ | 23:34 |
| ayoung | stevemar, did you test against mysql? | 23:34 |
| notmorgan | stevemar: can they really clobber each other? | 23:34 |
| stevemar | ayoung: not yet | 23:35 |
| stevemar | notmorgan: they did in sqlite | 23:35 |
| ayoung | stevemar, Sqlite does not enforce. Meaningless. | 23:35 |
| stevemar | notmorgan: i ran it and listed the consrtaints and only 1 was there | 23:35 |
| stevemar | ayoung: i did it more so to add a test and make it pass jenkins | 23:35 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Time-based One-time Password https://review.openstack.org/274901 | 23:35 |
| ayoung | stevemar, ++ | 23:35 |
| *** tobe has quit IRC | 23:35 | |
| ayoung | stevemar, I'll test in a bit | 23:36 |
| *** dims_ has joined #openstack-keystone | 23:36 | |
| stevemar | alright | 23:36 |
| ayoung | I'm elbow deep in Puppet ATM | 23:36 |
| notmorgan | stevemar: SQLite != real FK | 23:37 |
| *** dims has quit IRC | 23:38 | |
| notmorgan | it really shouldn't be possible for FK changes to clobber eachother..but this is more sane | 23:38 |
| *** dave-mccowan has joined #openstack-keystone | 23:41 | |
| *** slogan_r has left #openstack-keystone | 23:41 | |
| *** openstackgerrit has quit IRC | 23:47 | |
| *** openstackgerrit_ is now known as openstackgerrit | 23:47 | |
| *** openstackgerrit_ has joined #openstack-keystone | 23:47 | |
| *** josecastroleon has quit IRC | 23:48 | |
| *** openstackgerrit_ is now known as openstackgerrit | 23:48 | |
| *** openstackgerrit_ has joined #openstack-keystone | 23:48 | |
| *** josecastroleon has joined #openstack-keystone | 23:49 | |
| *** tobe has joined #openstack-keystone | 23:49 | |
| *** gildub has joined #openstack-keystone | 23:50 | |
| *** chlong_ has quit IRC | 23:52 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 23:53 | |
| *** mylu has quit IRC | 23:55 | |
| *** openstackgerrit_ has quit IRC | 23:55 | |
| *** phalmos has quit IRC | 23:55 | |
| *** openstackgerrit_ has joined #openstack-keystone | 23:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: deprecate using the ADMIN_TOKEN https://review.openstack.org/282104 | 23:58 |
| stevemar | notmorgan: ayoung ^ | 23:59 |
| *** shoutm has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
