| gyee | dstanek, correct, we only care about the HMAC for token part | 00:00 |
|---|---|---|
| gyee | let the 3rd party middleware deal with the protocol-specific part | 00:00 |
| dstanek | gyee: so if you wanted to remove ec2 for legal reasons you have to delete a bunch of keystone stuff and also keystone client stuff. that means any machine that uses openstack and not just the handful of keystone servers | 00:01 |
| gyee | dstanek, today, yes | 00:01 |
| gyee | but if we make them self-contained, they become truly optional for deployers | 00:02 |
| *** su_zhang has quit IRC | 00:02 | |
| *** su_zhang has joined #openstack-keystone | 00:03 | |
| *** su_zhang has quit IRC | 00:03 | |
| dstanek | gyee: it we want it optional it has be in separate installable packages. it's not sustainable to support people deleting things out of the project | 00:04 |
| *** su_zhang has joined #openstack-keystone | 00:04 | |
| *** sdake has quit IRC | 00:04 | |
| gyee | dstanek, only HMAC for token belongs in Keystone | 00:04 |
| gyee | everything else is 3rd party package | 00:04 |
| dstanek | ec2? | 00:05 |
| gyee | 3rd party | 00:05 |
| *** su_zhang has quit IRC | 00:05 | |
| *** darrenc_afk is now known as darrenc | 00:05 | |
| *** su_zhang has joined #openstack-keystone | 00:05 | |
| *** vilobhmm11 has joined #openstack-keystone | 00:06 | |
| dstanek | gyee: so what is your argument for deleting auth plugin code? | 00:06 |
| *** su_zhang has quit IRC | 00:06 | |
| gyee | dstanek, one word, 'plugin' | 00:06 |
| *** su_zhang has joined #openstack-keystone | 00:07 | |
| dstanek | gyee: you are so confusing :-) | 00:07 |
| gyee | plugin, by definition, is optional | 00:07 |
| dstanek | gyee: deleting the plugin doesn't delete the source of the algorithm. | 00:08 |
| dstanek | gyee: if you don't want a plugin enabled, then you don't enable it. what is the usecase for actually deleting it? | 00:08 |
| gyee | dstanek, what's the reason for deleting s3? | 00:09 |
| dstanek | yes | 00:09 |
| *** rderose has quit IRC | 00:10 | |
| gyee | now you are confusing me :-) | 00:10 |
| *** EinstCrazy has joined #openstack-keystone | 00:10 | |
| *** rk4n has joined #openstack-keystone | 00:11 | |
| dstanek | gyee: you said you wanted all totp related code in the plugin module so that it can be deleted by a deployer. you've not said what the business case is for deleting anything. | 00:11 |
| gyee | for some legal reasons, like S3 | 00:12 |
| dstanek | gyee: i think i see the plugin design differently. i see if as more of an adapter that allow the auth system to use the logic provided by something else. | 00:13 |
| dstanek | gyee: examples of that are our current oauth and mapped plugins | 00:13 |
| *** EinstCrazy has quit IRC | 00:14 | |
| dstanek | gyee: there is no totp code that you'd need to remove from keystone. if the algorithm we used is deemed patented (or whatever) then it would have to be deleted from cryptography - all our code does is call that | 00:14 |
| gyee | they were meant to be self-contained, like PAM or mod_xyz | 00:14 |
| *** markvoelker has quit IRC | 00:15 | |
| dstanek | gyee: from a design perspective that doesn't make sense | 00:15 |
| samueldmq | dolphm: ping, re: github dotfiles repo | 00:15 |
| samueldmq | dolphm: if I do "git clone --recursive https://github.com/dolph/dotfiles.git ~/dotfiles", for vim the symlink should look like | 00:16 |
| gyee | dstanek, the keystoneauth1 plugins are designed that way too | 00:16 |
| samueldmq | dstanek: ln -s ~/.vim ~/dotfiles/vim | 00:16 |
| dstanek | samueldmq: you should never take someones dotfiles verbatim. you should read though and steal what works for you | 00:17 |
| dstanek | gyee: keystone auth plugins don't really do anything | 00:17 |
| dstanek | gyee: what is the design principle for them being self contained? | 00:18 |
| samueldmq | dstanek: makes sense | 00:18 |
| samueldmq | dstanek: my plan was to start with that, as adjust to my needs/preferences as I go | 00:18 |
| samueldmq | :) | 00:18 |
| *** spandhe has quit IRC | 00:19 | |
| *** vilobhmm11 has quit IRC | 00:19 | |
| *** vilobhmm11 has joined #openstack-keystone | 00:20 | |
| gyee | dstanek, optional, on-demand, keep the lawyers happen :-) | 00:20 |
| dstanek | gyee: in my mind this boils down to cohesion. oauth stuff belongs in keystone.oauth1, mapping stuff in keystone.federation, etc. the auth plugins could also live in those packages, but i don't see that as strictly necessary | 00:20 |
| *** vilobhmm11 has quit IRC | 00:21 | |
| dstanek | gyee: optional and on-demand doesn't translate to delete | 00:21 |
| samueldmq | dstanek: but looks like building my own dev env looks more fun | 00:21 |
| *** vilobhmm11 has joined #openstack-keystone | 00:21 | |
| gyee | dstanek, optional is the same as delete | 00:21 |
| samueldmq | dstanek: I want to use NERDTree + some python plugin | 00:21 |
| dstanek | samueldmq: the problem with starting from someone else's is that you don't know what is actually happening | 00:22 |
| *** vilobhmm11 has joined #openstack-keystone | 00:22 | |
| samueldmq | dstanek: I agree, so hard to fix something when you need | 00:22 |
| gyee | samueldmq like adventure :-) | 00:22 |
| dstanek | samueldmq: "why is this mapped to that?" | 00:23 |
| dstanek | samueldmq: i no longer use the tree stuff and just use unite | 00:23 |
| dstanek | gyee: optional means that you don't have to use it. or if you want you can delete the plugin, but deleting the library code is hard. | 00:24 |
| dstanek | gyee: i don't think we should design for people deleting our code | 00:24 |
| gyee | optional means I don't have to ship it and deal with the lawyers | 00:24 |
| dstanek | gyee: that means it should be in a separate package | 00:25 |
| gyee | dstanek, it could | 00:27 |
| *** spandhe has joined #openstack-keystone | 00:28 | |
| *** rk4n has quit IRC | 00:41 | |
| *** rk4n has joined #openstack-keystone | 00:42 | |
| *** markvoelker has joined #openstack-keystone | 00:46 | |
| *** timcline_ has joined #openstack-keystone | 00:52 | |
| *** fpatwa_ has joined #openstack-keystone | 00:53 | |
| *** timcline_ has quit IRC | 00:56 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystone: Fix incorrect assumption when deleting assignments https://review.openstack.org/282696 | 01:07 |
| *** su_zhang has quit IRC | 01:07 | |
| *** su_zhang has joined #openstack-keystone | 01:07 | |
| *** su_zhang has quit IRC | 01:08 | |
| *** su_zhang has joined #openstack-keystone | 01:08 | |
| *** fpatwa_ has quit IRC | 01:08 | |
| *** mylu has quit IRC | 01:17 | |
| *** su_zhang has quit IRC | 01:28 | |
| *** su_zhang has joined #openstack-keystone | 01:29 | |
| *** spandhe has quit IRC | 01:31 | |
| *** su_zhang has quit IRC | 01:33 | |
| *** spandhe has joined #openstack-keystone | 01:33 | |
| *** lhcheng has quit IRC | 01:39 | |
| *** lhcheng has joined #openstack-keystone | 01:40 | |
| *** ChanServ sets mode: +v lhcheng | 01:40 | |
| *** gyee has quit IRC | 01:46 | |
| *** gyee has joined #openstack-keystone | 01:46 | |
| *** ChanServ sets mode: +v gyee | 01:46 | |
| *** fpatwa_ has joined #openstack-keystone | 01:47 | |
| *** fpatwa_ has quit IRC | 01:47 | |
| *** sdake has joined #openstack-keystone | 01:51 | |
| *** timcline_ has joined #openstack-keystone | 01:53 | |
| *** timcline has quit IRC | 01:53 | |
| openstackgerrit | Fangzhou Xu proposed openstack/keystone: Make getting token revocation list 9x faster on Mysql https://review.openstack.org/283902 | 01:55 |
| *** rk4n has quit IRC | 01:55 | |
| *** sdake_ has joined #openstack-keystone | 01:55 | |
| *** fangxu has joined #openstack-keystone | 01:55 | |
| *** sdake has quit IRC | 01:56 | |
| *** rk4n has joined #openstack-keystone | 01:56 | |
| *** timcline_ has quit IRC | 01:57 | |
| *** dims has quit IRC | 01:59 | |
| *** vilobhmm11 has quit IRC | 01:59 | |
| *** fpatwa_ has joined #openstack-keystone | 02:00 | |
| *** spandhe has quit IRC | 02:01 | |
| *** rk4n has quit IRC | 02:02 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:03 | |
| *** vilobhmm11 has quit IRC | 02:03 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:03 | |
| *** rk4n has joined #openstack-keystone | 02:05 | |
| *** pcaruana has quit IRC | 02:07 | |
| openstackgerrit | Sam Leong proposed openstack/keystoneauth: Auth plugin for X.509 tokenless authz https://review.openstack.org/283905 | 02:08 |
| *** fpatwa_ has quit IRC | 02:08 | |
| *** sdake_ has quit IRC | 02:10 | |
| *** timcline has joined #openstack-keystone | 02:11 | |
| *** vilobhmm11 has quit IRC | 02:12 | |
| *** browne has quit IRC | 02:16 | |
| *** pcaruana has joined #openstack-keystone | 02:19 | |
| *** sdake has joined #openstack-keystone | 02:20 | |
| *** jasonsb has joined #openstack-keystone | 02:25 | |
| *** diazjf has joined #openstack-keystone | 02:30 | |
| *** diazjf1 has joined #openstack-keystone | 02:33 | |
| *** diazjf has quit IRC | 02:35 | |
| *** dan_nguyen has quit IRC | 02:36 | |
| *** sdake has quit IRC | 02:43 | |
| *** fangxu has quit IRC | 02:45 | |
| *** timcline_ has joined #openstack-keystone | 02:53 | |
| *** rk4n has quit IRC | 02:54 | |
| *** timcline_ has quit IRC | 02:58 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:59 | |
| *** pcaruana has quit IRC | 03:01 | |
| *** browne has joined #openstack-keystone | 03:09 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystone: Fix incorrect assumption when deleting assignments https://review.openstack.org/282696 | 03:11 |
| *** lhcheng has quit IRC | 03:12 | |
| *** sdake has joined #openstack-keystone | 03:13 | |
| *** dims has joined #openstack-keystone | 03:13 | |
| *** pcaruana has joined #openstack-keystone | 03:16 | |
| *** sdake_ has joined #openstack-keystone | 03:16 | |
| *** sdake has quit IRC | 03:18 | |
| *** fpatwa_ has joined #openstack-keystone | 03:23 | |
| openstackgerrit | Merged openstack/keystone: Fixes a bug when setting a user's password to null https://review.openstack.org/283746 | 03:26 |
| openstackgerrit | Merged openstack/keystone: Renamed TOTP passcode generation function https://review.openstack.org/283521 | 03:28 |
| *** Nirupama has joined #openstack-keystone | 03:34 | |
| *** mylu has joined #openstack-keystone | 03:36 | |
| *** gyee has quit IRC | 03:37 | |
| openstackgerrit | Merged openstack/keystone: Fix project-related forbidden response messages https://review.openstack.org/283325 | 03:42 |
| *** links has joined #openstack-keystone | 03:46 | |
| *** boris-42 has quit IRC | 03:54 | |
| *** timcline_ has joined #openstack-keystone | 03:54 | |
| *** timcline_ has quit IRC | 03:58 | |
| *** pcaruana has quit IRC | 04:01 | |
| *** sdake_ has quit IRC | 04:01 | |
| *** mylu has quit IRC | 04:02 | |
| *** fpatwa_ has quit IRC | 04:03 | |
| *** vilobhmm11 has quit IRC | 04:04 | |
| *** mylu has joined #openstack-keystone | 04:06 | |
| *** mylu has quit IRC | 04:12 | |
| *** lhcheng has joined #openstack-keystone | 04:15 | |
| *** ChanServ sets mode: +v lhcheng | 04:15 | |
| *** pcaruana has joined #openstack-keystone | 04:15 | |
| *** mylu has joined #openstack-keystone | 04:16 | |
| *** richm has quit IRC | 04:20 | |
| *** mylu has quit IRC | 04:25 | |
| *** fangxu has joined #openstack-keystone | 04:35 | |
| *** spzala has joined #openstack-keystone | 04:37 | |
| *** mylu has joined #openstack-keystone | 04:38 | |
| openstackgerrit | Merged openstack/keystone: Implied roles index with cascading delete https://review.openstack.org/281921 | 04:40 |
| *** jamielennox is now known as jamielennox|away | 04:54 | |
| *** timcline_ has joined #openstack-keystone | 04:55 | |
| *** fpatwa_ has joined #openstack-keystone | 04:57 | |
| *** timcline_ has quit IRC | 04:59 | |
| *** sdake has joined #openstack-keystone | 04:59 | |
| *** spzala has quit IRC | 05:09 | |
| *** sdake has quit IRC | 05:14 | |
| *** zqfan has joined #openstack-keystone | 05:20 | |
| *** fpatwa_ has quit IRC | 05:25 | |
| *** diazjf1 has quit IRC | 05:26 | |
| *** phalmos has joined #openstack-keystone | 05:30 | |
| *** mylu has quit IRC | 05:37 | |
| *** pcaruana has quit IRC | 05:38 | |
| *** mylu has joined #openstack-keystone | 05:39 | |
| *** phalmos has quit IRC | 05:43 | |
| *** mylu has quit IRC | 05:45 | |
| *** dims has quit IRC | 05:48 | |
| *** pcaruana has joined #openstack-keystone | 05:53 | |
| *** timcline_ has joined #openstack-keystone | 05:56 | |
| *** timcline_ has quit IRC | 06:00 | |
| *** vilobhmm11 has joined #openstack-keystone | 06:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:15 | |
| *** openstack has joined #openstack-keystone | 13:20 | |
| *** openstackstatus has joined #openstack-keystone | 13:21 | |
| *** ChanServ sets mode: +v openstackstatus | 13:21 | |
| *** jsavak has joined #openstack-keystone | 13:22 | |
| *** subscope has quit IRC | 13:24 | |
| *** edmondsw has joined #openstack-keystone | 13:27 | |
| *** lhcheng has joined #openstack-keystone | 13:28 | |
| *** ChanServ sets mode: +v lhcheng | 13:28 | |
| *** admin0 has joined #openstack-keystone | 13:30 | |
| *** lhcheng has quit IRC | 13:32 | |
| *** ninag has joined #openstack-keystone | 13:34 | |
| *** ninag has quit IRC | 13:37 | |
| *** ninag has joined #openstack-keystone | 13:38 | |
| *** ninag has quit IRC | 13:39 | |
| *** dims has joined #openstack-keystone | 13:40 | |
| *** ninag has joined #openstack-keystone | 13:40 | |
| *** ninag has quit IRC | 13:44 | |
| *** ninag has joined #openstack-keystone | 13:44 | |
| *** EinstCrazy has joined #openstack-keystone | 13:47 | |
| *** porunov has joined #openstack-keystone | 13:47 | |
| *** timcline_ has joined #openstack-keystone | 13:49 | |
| porunov | Hello everyone, I am novice and I am trying to pass tutorial "http://docs.openstack.org/liberty/install-guide-rdo/keystone-services.html" but without success. I have always the error on this step: "openstack service create --name keystone --description "OpenStack Identity" identity" "An unexpected error prevent the server from fulfilling your request. (HTTP 500) (Request-ID: req-12dc5717-71b4-4311-87e9-b0cfd4e90837)". Can somebody help me, please? | 13:51 |
| *** timcline_ has quit IRC | 13:53 | |
| *** gordc has joined #openstack-keystone | 13:55 | |
| dstanek | porunov: what's in your log file? | 13:56 |
| porunov | First lines INFO about "wsgi" and then a lot of lines ERROR about keystone.common.wsgi. Can I put all log file in chan? | 14:00 |
| dstanek | stevemar: backward compatibility may be hard https://review.openstack.org/#/c/231289/55/keystone/resource/core.py . am i missing something? | 14:00 |
| patchbot | dstanek: patch 231289 - keystone - Projects acting as domains | 14:00 |
| amakarov | dstanek, hi! What do you think about using rally for functional testing? | 14:00 |
| porunov | *chat* | 14:00 |
| dstanek | porunov: no, use paste.openstack.org | 14:01 |
| dstanek | amakarov: why would we do that? | 14:01 |
| amakarov | dstanek, right now it looks like the only gate job that runs in devstack env AND runs the code we can submit in the keystone project itself (as a plugin) | 14:02 |
| porunov | dstanek: there is my keystone.log "http://paste.openstack.org/show/488023/" | 14:04 |
| dstanek | amakarov: we can get a gate job as soon as we have functional tests to run | 14:04 |
| *** ayoung has quit IRC | 14:04 | |
| dstanek | amakarov: actually i want to bring it up at the QA meeting this week so maybe by friday | 14:05 |
| dstanek | porunov: your mysql credentials don't work | 14:05 |
| dstanek | porunov: did you create the user and give it access to the database? | 14:06 |
| *** Nirupama has quit IRC | 14:06 | |
| amakarov | dstanek, so will it be a gate job that runs tests.functional.* in devstack env? | 14:06 |
| dstanek | amakarov: yes | 14:07 |
| *** petertr7_away is now known as petertr7 | 14:11 | |
| porunov | dstanek: Yes I have created keystone user and gave him all privileges like in tutorial: "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'KEYSTONE_DBPASS'; GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'KEYSTONE_DBPASS';" | 14:12 |
| dstanek | porunov: try granting using the host from the error message | 14:13 |
| *** sdake has joined #openstack-keystone | 14:15 | |
| *** jaosorior has quit IRC | 14:18 | |
| *** jaosorior has joined #openstack-keystone | 14:19 | |
| *** woodster_ has joined #openstack-keystone | 14:20 | |
| porunov | dstanek: now it returns this: [root@controller ~]# openstack service create --name keystone --description "OpenStack Identity" identity Missing parameter(s): Set a username with --os-username, OS_USERNAME, or auth.username Set an authentication URL, with --os-auth-url, OS_AUTH_URL or auth.auth_url Set a scope, such as a project or domain, set a project scope with --os-project-name, OS_PROJECT_NAME or auth.project_name, set a domain scope with --os- | 14:21 |
| porunov | domain-name, OS_DOMAIN_NAME or auth.domain_name | 14:21 |
| porunov | Log file is the same | 14:22 |
| dancn | Hello, I am still trying to debug the local tox -r -e py27 failure, due to pkg_resources.ContextualVersionConflict: (fixtures 1.2.0 [...]. This was also reproduced by dolphm in: http://cdn.pasteraw.com/lmvqwv78a8s96ur87a1lnvueurtj9qb The periodic-keystone-python27-kilo jobs does not seems to be affected by the problem, see: http://logs.openstack.org/periodic-stable/periodic-keystone-python27-kilo/a993507/console.html Since the outup of | 14:26 |
| dancn | "py27 installed" is the same in the local and gate, maybe the difference is in some env variable or configuration? Any suggestion on how to spot the differences or to run tox the same way that is run in the gate? TIA | 14:26 |
| dstanek | dancn: are you trying to debug to fix or just run the tests to work on something else? | 14:28 |
| dstanek | porunov: do you have the environment vars setup or a clouds.yml? | 14:28 |
| dancn | dstanek: both, well for the second I have the workaround, that is to place the testtools line into requirements.txt instaead of test-requirements.txt, but I am aslo interested to find a proper fix | 14:29 |
| dstanek | dancn: i can't reproduce | 14:30 |
| dstanek | what OS are you running? | 14:30 |
| dancn | dstanek: Ubuntu 14.04.4 LTS | 14:31 |
| dstanek | dancn: are you running on a devstack or just a keystone clone? | 14:31 |
| dancn | dstanek: just a keystone clone | 14:32 |
| dstanek | dancn: ok, let me fire up a VM | 14:32 |
| dolphm | dstanek: dancn: i'm running it again after nuking .tox/ and .testrepository/ | 14:33 |
| dolphm | aaand repro'd | 14:33 |
| dstanek | dolphm: did the venv get created? | 14:34 |
| dstanek | dancn: you said that 'tox -e py27 --notest' worked, but 'tox -e py27' didn't? | 14:34 |
| dancn | dstanek: yes! | 14:34 |
| marekd | dolphm: o/ | 14:34 |
| *** EinstCrazy has quit IRC | 14:35 | |
| porunov | dstanek: yes, like in tutorial: "export OS_TOKEN=ADMIN_TOKEN" "export OS_URL=http://controller:35357/v3" "export OS_IDENTITY_API_VERSION=3" | 14:35 |
| marekd | dolphm: I cannot see Ron online so I thought I'd ask you - so what value is going to be used as a user_id value in a token in patch: https://review.openstack.org/#/c/279162/44/keystone/identity/backends/sql.py | 14:35 |
| patchbot | marekd: patch 279162 - keystone - Shadow users - Shadow federated users | 14:35 |
| dancn | dstanek: thanks for the effort with the vm, my idea was to share a small script to reproduce the problem in a vm, instead of asking other to do manually all the steps... In fact on a bare vm you need to install the dependencies, if you need I have the list here | 14:35 |
| dolphm | marekd: the top level ID in the plain "user" table | 14:37 |
| dolphm | marekd: all the other IDs (federated unique ID, and the auto inc integers are internal only) | 14:38 |
| dolphm | dstanek: dancn: --notest doesn't actually install anything does it? it's a total dry run | 14:40 |
| marekd | dolphm: so local_user will be local users, federateD_users well...federated users and table user will be used as a union of local and federated users? | 14:40 |
| dstanek | dolphm: it creates the venv and just doesn't run the test command | 14:40 |
| dstanek | dolphm: but it looks like the test command here is failing | 14:41 |
| dolphm | marekd: not "local" as in local_user, but local as in the real "user" table, yes | 14:41 |
| marekd | dolphm: yy, didn't get it. So whenever I will login with a federed access for the first time a new entry will be created in a federated_user table only? | 14:42 |
| dstanek | dancn: i have an ansible role that i just dusted off that should do everything i need | 14:43 |
| *** rderose has joined #openstack-keystone | 14:43 | |
| dancn | dolphm: running tox -r -e py27 --notest install a lot of packages, leaving out the -r seems a no-op, the list in "PlanMeeting" seems the same | 14:43 |
| dolphm | marekd: you'll get a record in the "user" table (your real user ID that appears in the API), along with a federated_user record | 14:43 |
| dolphm | but no local_user (with a local username) and no local user password | 14:44 |
| *** richm has joined #openstack-keystone | 14:44 | |
| dancn | dstanek: nice, I hope that the ansible stuff do not do some magic :-) | 14:44 |
| dancn | dolphm: /PlanMeeting/py27 installed/, sorry | 14:45 |
| *** ayoung has joined #openstack-keystone | 14:46 | |
| *** ChanServ sets mode: +v ayoung | 14:46 | |
| marekd | dolphm: ok, so say keystone is validating token for user_id:'abc'. It query 'user' table for user_id:'abc' and if some more info needed it will do some joins with either local_user or federated_user tables. | 14:48 |
| *** timcline_ has joined #openstack-keystone | 14:49 | |
| *** roxanaghe has joined #openstack-keystone | 14:51 | |
| *** timcline_ has quit IRC | 14:54 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:58 | |
| *** ayoung has quit IRC | 14:59 | |
| *** roxanaghe has quit IRC | 15:00 | |
| *** jsavak has quit IRC | 15:00 | |
| *** jsavak has joined #openstack-keystone | 15:02 | |
| dstanek | dancn: what verison of tox are you running? | 15:02 |
| *** LZ has quit IRC | 15:02 | |
| dancn | dstanek: 2.3.1 | 15:02 |
| samueldmq | raildo: htruta: this solves the issues in current code for ?cascade | 15:03 |
| samueldmq | https://review.openstack.org/#/c/283145/3 | 15:03 |
| patchbot | samueldmq: patch 283145 - keystone - Fix/refactor policy check for cascade operations | 15:03 |
| dancn | dstanek: I start tox from a minimal virtualenv | 15:03 |
| samueldmq | at least for project scoped tokens, still need to look into other formats | 15:03 |
| dstanek | dancn: you run tox from within a venv? | 15:03 |
| samueldmq | I will send a new patchset for cascade projects updating them with this ^ | 15:04 |
| samueldmq | raildo: htruta: okay? | 15:04 |
| dancn | dstanek: yes, is this a problem? | 15:04 |
| dstanek | dancn: not sure. but maybe | 15:04 |
| *** gema has joined #openstack-keystone | 15:05 | |
| dancn | dstanek, well, I will try a run with the system tox: python-tox (1.6.0-1ubuntu1) | 15:06 |
| *** henrynash has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v henrynash | 15:06 | |
| dstanek | dancn: with the system tox i have no issues. the tests are currently running | 15:09 |
| dancn | dstanek: the system vs virtualenv tox makes no difference, the error is the same for me! | 15:10 |
| dstanek | dancn: can you reproduce this on a VM and i can jump on? | 15:10 |
| dolphm | marekd: yes, that's basically it | 15:11 |
| dancn | dstanek: it may be possible to allow remote access, but it may involve some bureaucracy on my side, if you can wait, no problem | 15:13 |
| samueldmq | henrynash: hi! | 15:13 |
| dolphm | anyone know what's up with: /home/dolph/openstack/keystone/.tox/py34/lib/python3.4/site-packages/oslo_db/sqlalchemy/enginefacade | 15:13 |
| dolphm | .py:1056: OsloDBDeprecationWarning: EngineFacade is deprecated; please use oslo_db.sqlalchemy.enginefacade | 15:13 |
| henrynash | samueldmq: hi | 15:13 |
| dancn | dstanek: I have an half done Vagrantfile that should build a vm with the issue, but I can work on a more generic script | 15:13 |
| samueldmq | henrynash: I fixed the thing for cascade operations | 15:13 |
| samueldmq | henrynash: see https://review.openstack.org/#/c/283145 | 15:13 |
| samueldmq | henrynash: new tests I added are now passing | 15:14 |
| dstanek | dancn: i'll take the vagrant file if you have it | 15:14 |
| samueldmq | henrynash: however we still need to think about federated and trust tokens, I wanted you to think with me about that | 15:14 |
| henrynash | samueldmq: is this patch what you will base the update/delete patch on? | 15:14 |
| samueldmq | henrynash: (after you take a look at that patch) | 15:14 |
| samueldmq | henrynash: I will merge this into them after I have a complete solution | 15:15 |
| samueldmq | henrynash: so I just update them once :) | 15:15 |
| dancn | dstanek: ok, will share the Vagrantfile in an hour or so, thanks for your effort | 15:15 |
| henrynash | samueldmq: ok, got it…looking now | 15:15 |
| dstanek | dancn: np | 15:15 |
| *** slberger has joined #openstack-keystone | 15:16 | |
| dstanek | henrynash: did you see my latest comment about the projects as domains review? | 15:25 |
| henrynash | dtsanek: yes…. | 15:25 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:25 |
| henrynash | dtsanek: and this is something I had worried about | 15:25 |
| henrynash | dstanek: do you think we need to effectivey “map manager calls for projects acting as domains back on to teh legacy domain driver calls"? | 15:26 |
| dstanek | henrynash: i think that patch has several backward incompatibilities for third-party drivers | 15:26 |
| dstanek | henrynash: it depends on if we care about backward compat. i was just pointing out that there are issues there | 15:27 |
| henrynash | dtsanek: so is_domain as attribute already existed in the previous release | 15:27 |
| henrynash | dstanek: but we didn’t use it for anything | 15:27 |
| dstanek | henrynash: morgan is more passionate about it than i am :-) | 15:28 |
| dstanek | henrynash: i'm not as worried about the data as i am that the calls are now incorrect | 15:28 |
| morgan | dstanek: don't pull me into this:P | 15:28 |
| henrynash | dtsanek: where what I have done breaks down is that it would work if they migrated their old data to their project table | 15:28 |
| *** dims has quit IRC | 15:29 | |
| morgan | and at this point, i'm not willing to battle it, it's fine if other cores think it is fine | 15:29 |
| henrynash | dstanek: but if they don’t (and, say, their domain calls refence some totally differnt system ot where theystore projects)…it breaks | 15:29 |
| henrynash | morgan, dtsanek: it’s a valid concern | 15:29 |
| *** dims has joined #openstack-keystone | 15:30 | |
| henrynash | morgan, dstanek: the solution (which I did think about) is to map the project calls for projects acting as a domain back into domain driver calls all inside teh wrapper | 15:30 |
| *** jsavak has quit IRC | 15:31 | |
| *** annasort has quit IRC | 15:31 | |
| dstanek | henrynash: thinking about this problem makes me wonder if most of this code should have been in the driver | 15:31 |
| *** jsavak has joined #openstack-keystone | 15:32 | |
| dstanek | henrynash: i think at the minimum we need to document why we would expect driver writers to do. | 15:32 |
| *** timcline has quit IRC | 15:32 | |
| dstanek | henrynash: does this code pass the legacy drivers tests? | 15:32 |
| henrynash | dtsanek: yes | 15:32 |
| dstanek | henrynash: hmmm...i would not have expect it to since create_domain isn't called | 15:33 |
| henrynash | dstanek: but the wrapper is still “storeing the domain in a project entity”, so just reads it back from tehre | 15:34 |
| *** ninag has quit IRC | 15:34 | |
| morgan | dolphm: yes, the legacyfacade the way we're using it is/was a poor choice: https://review.openstack.org/#/c/257458/ is the long-term fix but there is a shorter term how to get the legacyfacade in a non-deprecated way fix too | 15:34 |
| patchbot | morgan: patch 257458 - keystone - Use the new enginefacade from oslo.db | 15:34 |
| *** dims has quit IRC | 15:34 | |
| morgan | dolphm: that patch also allows [afaik] split reader/writer config ^ | 15:35 |
| dolphm | morgan: cool, thanks | 15:35 |
| morgan | dolphm: and while that patch is beastly, it is *mostly* good. maybe some massaging and a rebase and it'll be landable. | 15:36 |
| henrynash | dstanek, morgan: I might have a crack at the making the legacy wrapper re-map teh calls to the domin driver calls….whcih is, I think, the correct solution | 15:37 |
| dolphm | morgan: possible to land this for m3? | 15:37 |
| morgan | dolphm: maybe? might have to ask stevemar | 15:37 |
| morgan | dolphm: i don't see a reason why it wouldn't be besides that it is a beastly patch ;) | 15:38 |
| stevemar | morning! | 15:38 |
| morgan | stevemar: morning to you as well | 15:40 |
| stevemar | dolphm: i'd love to land it in m3 | 15:40 |
| dstanek | henrynash: i'd definitely be interesting in at least seeing it | 15:40 |
| stevemar | dolphm: but as morgan said, it's a beast of a patch | 15:40 |
| morgan | dolphm: looks like there are a couple cleanup comments, pass jenkins, and rebase - if that can be done, woot | 15:40 |
| stevemar | i originally wanted to land it in m3, but no one was actively working on it + i checked with the oslo team and the deprecated bits won't be removed in M | 15:40 |
| *** timcline has joined #openstack-keystone | 15:45 | |
| *** pushkaru has joined #openstack-keystone | 15:46 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 15:47 |
| samueldmq | raildo: henrynash ^ updated first patch | 15:47 |
| admin0 | anyone here that can provide some guidiance :) | 15:48 |
| dancn | dstanek: running the "vagrant up | tee output" to ensure the repoducibility and save the log I was hit by another bug... UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 36: ordinal not in range(128) during pip install! What a fragile env... now trying without tee, hopefully the current try will end soon | 15:48 |
| admin0 | i need to upgrade only keystone from icehouse -> liberty .. is there just some .sql files i need to use for db-sync | 15:48 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 15:48 |
| admin0 | without going through the whole install upgrade cycle of the whole packages | 15:48 |
| *** petertr7 is now known as petertr7_away | 15:50 | |
| dolphm | stevemar: keystone is throwing at least 3 deprecation warnings - we really shouldn't knowingly ship mitaka with deprecation warnings that deployers cannot address | 15:50 |
| stevemar | dolphm: we were throwing that same facade deprecation warning since kilo | 15:51 |
| morgan | dolphm: ++ | 15:51 |
| stevemar | dolphm: but yeah, i would love it if we didn't throw any! | 15:51 |
| dolphm | stevemar: and it's super annoying | 15:51 |
| stevemar | dolphm: have a paste of the other 2 ? | 15:51 |
| dolphm | it must not use the versionutils deprecator | 15:52 |
| dolphm | stevemar: http://cdn.pasteraw.com/h1w7vl11hvvpueiw3fdv63ldghe7gs8 | 15:52 |
| morgan | dolphm: i'm trying to rebase that patch now. | 15:52 |
| dolphm | stevemar: i'm generating another one with py27 | 15:52 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade delete https://review.openstack.org/244248 | 15:52 |
| dolphm | morgan: does dogpile cache to disk somewhere? | 15:53 |
| morgan | dolphm: it can | 15:53 |
| dolphm | morgan: i'm getting an error running py27 after running py34 that dogpile can't find gdbm | 15:54 |
| morgan | dolphm: if you use a DBM or custom file cache | 15:54 |
| dolphm | morgan: in keystone, by default, outside tox | 15:54 |
| dolphm | *when run with tox* | 15:54 |
| morgan | dolphm: uhm... maybe an issue with the python lib? | 15:54 |
| dolphm | morgan: http://cdn.pasteraw.com/ikn22952390f21s4hmjwg4st98dbds9 | 15:54 |
| morgan | we're not failing gate on everything ... soo *shrug* | 15:55 |
| morgan | but yes, dogpile can cache to disk | 15:55 |
| *** jaosorior has quit IRC | 15:55 | |
| morgan | oh | 15:55 |
| morgan | THAT bug | 15:55 |
| morgan | thats testrepository | 15:55 |
| dolphm | lol? | 15:55 |
| dolphm | oh, so delete it? | 15:55 |
| morgan | yep and tox -epy34 -r | 15:55 |
| morgan | i think i needed to rebuild my venv too | 15:55 |
| *** petertr7_away is now known as petertr7 | 15:57 | |
| *** daemontool has quit IRC | 15:57 | |
| samueldmq | henrynash: abandoned https://review.openstack.org/#/c/283145/ in favor of putting the logic in the patch implementing the functionality | 15:57 |
| patchbot | samueldmq: patch 283145 - keystone - Fix/refactor policy check for cascade operations (ABANDONED) | 15:57 |
| henrynash | sauedlmq: ok…looking at teh combined patch now | 15:58 |
| samueldmq | henrynash: but I replied your comments there before abandoning, please take a look at my replies | 15:58 |
| samueldmq | henrynash: ^ | 15:58 |
| dolphm | stevemar: also, sampleconfig is failing with a bunch of sqlalchemy warnings | 15:58 |
| dolphm | err, genconfig whatever it's called | 15:58 |
| *** admin0 has quit IRC | 15:59 | |
| samueldmq | henrynash: we still need tests for domain scoped tokens; and to think about trusts and federated authz | 16:00 |
| *** daemontool has joined #openstack-keystone | 16:02 | |
| morgan | dolphm: ok almost done rebasing that enginefacade change. | 16:02 |
| morgan | dolphm: will push an update as soon as it's done. | 16:02 |
| morgan | dolphm: hopefully it can pass gate, if so we can make stevemar review it and +2 it ;) | 16:02 |
| *** dims has joined #openstack-keystone | 16:03 | |
| henrynash | samuedlmq: just added the comment abour domain scoped tokens! | 16:03 |
| stevemar | dolphm: it worked a week ago... | 16:03 |
| morgan | stevemar: i hope it's just a rebase. | 16:03 |
| *** tomoiaga has quit IRC | 16:03 | |
| morgan | stevemar: but... we'll see. | 16:03 |
| morgan | ~10 merge conflicts | 16:04 |
| dolphm | morgan: oh sweet | 16:04 |
| *** phalmos has joined #openstack-keystone | 16:05 | |
| samueldmq | henrynash: replying my view in a bit | 16:05 |
| stevemar | dolphm: i ran tox -e genconfig from a cloned master and no issue | 16:06 |
| stevemar | dolphm: you trying to scare me? | 16:06 |
| samueldmq | henrynash: replied, I agree with you | 16:07 |
| samueldmq | henrynash: what about federated tokens and/or trust scoped tokens? | 16:07 |
| *** phalmos has quit IRC | 16:08 | |
| *** browne has joined #openstack-keystone | 16:08 | |
| henrynash | samueldmq: hmm, that’s harder! | 16:08 |
| samueldmq | henrynash: yes, but .. | 16:09 |
| samueldmq | henrynash: I based that logic for building creds on https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L59 | 16:10 |
| stevemar | samueldmq: henrynash you guys talking about reseller or proejct delete? | 16:10 |
| henrynash | samuedlqm: wouldn’t a trust just be the same as a regula token? | 16:10 |
| henrynash | stevemar: prject delete | 16:10 |
| samueldmq | henrynash: for trusts should just copy https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L82-L86 | 16:10 |
| samueldmq | stevemar: cascade | 16:10 |
| samueldmq | henrynash: that's easy, it's basically to build the creds from the exisitng info, based on the method token_to_auth_context | 16:11 |
| samueldmq | henrynash: I mean, should be easy | 16:11 |
| samueldmq | stevemar: https://review.openstack.org/#/c/243585/23/keystone/common/controller.py | 16:11 |
| patchbot | samueldmq: patch 243585 - keystone - API support for project cascade update | 16:11 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 16:11 |
| morgan | dolphm: need to run tox a second time through, but otherwise this looks good. | 16:12 |
| samueldmq | stevemar: it's now truly enforcing policy for each subproject in the tree | 16:12 |
| stevemar | henrynash: samueldmq why would federation and trusts affect project cascade | 16:12 |
| morgan | dolphm: and fixing 2-3 minor test failures | 16:12 |
| samueldmq | stevemar: we just need to make sure trust and federated tokens work too | 16:12 |
| samueldmq | stevemar: because in my current proposal, I only took care about regular proj scoped tokens | 16:12 |
| samueldmq | stevemar: and then I built creds similarly | 16:12 |
| henrynash | samuedlmq: hmm…maybe not, can’t a trust delegage just some of the roles a trustor has on a given project….we couldn’t then assume they can have ALL the roles on a subproject | 16:13 |
| samueldmq | henrynash: hmm, you're correct, if you have a trust scoped token in projet X | 16:13 |
| samueldmq | it doesn't mean you can have a trust scoped token in the children | 16:14 |
| *** annasort has joined #openstack-keystone | 16:14 | |
| samueldmq | henrynash: so maybe we should just look for regular assignments (as we're doing today?) | 16:14 |
| morgan | dolphm: related to testrepository, i am surprised it uses a shared .testrepository location across python versions =/ it probably should isolate | 16:14 |
| *** annasort_ has joined #openstack-keystone | 16:15 | |
| henrynash | samueldmq: I *could* argue the case that, in the limit, what we are doing for regular projects is too much…e.g. what if I build an auth plugin that did MFA for different projects or levels of teh hierarchy... | 16:15 |
| samueldmq | henrynash: yeah, maybe we can't guess what kind of auth can be done in the children | 16:16 |
| samueldmq | henrynash: maybe a new policy entry could be the simpler solution? we need to think a bit more carefully about this | 16:17 |
| henrynash | samueldmq: i.e. teh assumtion that if I can get a scoped token to project X, that I could therfore get a token to a sibproject of X (with all the existing role assignments) may not be sound | 16:17 |
| samueldmq | henrynash: stevemar: sorry I need to go afk for a bit | 16:17 |
| samueldmq | catch on you later | 16:17 |
| henrynash | samuedlmq: ok | 16:18 |
| *** spandhe has joined #openstack-keystone | 16:18 | |
| stevemar | samueldmq: see ya | 16:18 |
| *** annasort has quit IRC | 16:19 | |
| *** annasort_ is now known as annasort | 16:19 | |
| *** ayoung has joined #openstack-keystone | 16:20 | |
| *** ChanServ sets mode: +v ayoung | 16:20 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use the new enginefacade from oslo.db https://review.openstack.org/257458 | 16:20 |
| morgan | dolphm, stevemar: ^ | 16:20 |
| morgan | rebase and removed the "unrelated" changes | 16:20 |
| *** spandhe has quit IRC | 16:22 | |
| dolphm | stevemar: output from my py27 run btw http://cdn.pasteraw.com/kszk6dye3zolws01npnrmisly6m147a | 16:27 |
| dolphm | morgan: sweet | 16:27 |
| *** dan_nguyen has joined #openstack-keystone | 16:28 | |
| *** belmoreira has quit IRC | 16:31 | |
| *** bjornar__ has joined #openstack-keystone | 16:32 | |
| *** jsavak has quit IRC | 16:34 | |
| *** jsavak has joined #openstack-keystone | 16:34 | |
| *** v1k0d3n has joined #openstack-keystone | 16:36 | |
| stevemar | dolphm: for another message: https://review.openstack.org/#/c/284242/ | 16:37 |
| patchbot | stevemar: patch 284242 - oslo.log - use log.warning instead of log.warn | 16:37 |
| *** petertr7 is now known as petertr7_away | 16:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:38 | |
| stevemar | dolphm: don't know how to fix that oslo_middleware.ssl warning... | 16:38 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move admin_token_auth before build_auth_context in sample paste.ini https://review.openstack.org/281372 | 16:38 |
| morgan | stevemar: is that the urllib one? | 16:39 |
| *** jsavak has quit IRC | 16:39 | |
| *** afred312 has joined #openstack-keystone | 16:39 | |
| morgan | basically you can monkeypatch | 16:39 |
| morgan | there is an infra lib to help with it...but,.. | 16:39 |
| *** jsavak has joined #openstack-keystone | 16:39 | |
| morgan | uh | 16:39 |
| morgan | ugh | 16:39 |
| stevemar | morgan: nope | 16:40 |
| stevemar | morgan: oslo_middleware/ssl.py:28: Deprecation[30;43mWarn[0ming: The 'oslo_middleware.ssl' module usage is deprecated, please use oslo_middleware.http_proxy_to_wsgi | 16:40 |
| morgan | oh | 16:40 |
| morgan | joy | 16:41 |
| stevemar | but i don't see where we're using that... | 16:41 |
| morgan | remove oslo.middleware things form keystone ;) | 16:41 |
| morgan | request_id? | 16:41 |
| stevemar | possibly | 16:41 |
| morgan | size_limit middleware? | 16:41 |
| stevemar | we only have it in size limit and request id | 16:41 |
| stevemar | dhellmann / dims ^ know where that comes from? | 16:41 |
| *** 32NAAC6RR has quit IRC | 16:42 | |
| stevemar | i guess i could use codesearch :) | 16:42 |
| morgan | stevemar: yep | 16:42 |
| stevemar | maybe its coming from something else | 16:42 |
| morgan | codesearch ++ | 16:42 |
| *** gyee has joined #openstack-keystone | 16:43 | |
| *** ChanServ sets mode: +v gyee | 16:43 | |
| *** diazjf has joined #openstack-keystone | 16:44 | |
| *** lbragstad_ has joined #openstack-keystone | 16:45 | |
| *** jistr has quit IRC | 16:45 | |
| stevemar | morgan: i think it's coming from init.py? | 16:45 |
| *** petertr7_away is now known as petertr7 | 16:45 | |
| *** vilobhmm11 has joined #openstack-keystone | 16:46 | |
| *** lbragstad_ has quit IRC | 16:47 | |
| *** timcline_ has joined #openstack-keystone | 16:51 | |
| *** timcline_ has quit IRC | 16:55 | |
| *** Guest51435 is now known as mgagne | 16:56 | |
| *** mgagne has quit IRC | 16:56 | |
| *** mgagne has joined #openstack-keystone | 16:56 | |
| *** lbragstad has quit IRC | 16:58 | |
| *** lbragstad_ has joined #openstack-keystone | 16:58 | |
| *** lbragstad_ has left #openstack-keystone | 16:59 | |
| *** lbragstad_ has joined #openstack-keystone | 16:59 | |
| *** dims has quit IRC | 17:00 | |
| *** lbragstad_ has quit IRC | 17:00 | |
| *** lbragstad has joined #openstack-keystone | 17:02 | |
| *** ninag has joined #openstack-keystone | 17:02 | |
| *** dims has joined #openstack-keystone | 17:03 | |
| *** petertr7 is now known as petertr7_away | 17:04 | |
| *** jsavak has quit IRC | 17:05 | |
| *** jsavak has joined #openstack-keystone | 17:06 | |
| *** belmoreira has joined #openstack-keystone | 17:06 | |
| arunkant | dims: ping | 17:07 |
| *** jorge_munoz has joined #openstack-keystone | 17:07 | |
| dims | arunkant : pong | 17:07 |
| arunkant | dims: Hi..can you please look into review: https://review.openstack.org/#/c/279828/ . I have made the changes as per earlier discussion and tested them. | 17:08 |
| patchbot | arunkant: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 17:08 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 17:11 |
| dims | arunkant : almost there, some minor tweaks | 17:16 |
| arunkant | dims: thanks. I will make those changes. | 17:17 |
| *** mvk has quit IRC | 17:22 | |
| *** edmondsw has quit IRC | 17:23 | |
| arunkant | dims: One clarification around topic. Do we need to have topics as there is only one notification driver..Notifier api only takes one topic http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/notify/notifier.py#n146 | 17:23 |
| *** gyee has quit IRC | 17:25 | |
| dims | arunkant : i believe it kicks in here - http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/notify/messaging.py#n44 | 17:26 |
| morgan | stevemar: i think the sql facade is going to pass. | 17:27 |
| stevemar | morgan: probably, i don't think that was the complete fix to remove all the deprecation warnings though | 17:27 |
| morgan | but it paves the way to eliminate the sql ones | 17:28 |
| morgan | at the very least very close comparatively | 17:28 |
| *** admin0 has joined #openstack-keystone | 17:31 | |
| *** spandhe has joined #openstack-keystone | 17:34 | |
| *** josecastroleon1 has quit IRC | 17:34 | |
| *** jasonsb has quit IRC | 17:39 | |
| *** admin0 has quit IRC | 17:39 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Reference config values at runtime https://review.openstack.org/283842 | 17:40 |
| *** spzala has quit IRC | 17:42 | |
| *** spzala has joined #openstack-keystone | 17:42 | |
| *** spzala has quit IRC | 17:43 | |
| morgan | stevemar: want to hold on the +A on the enginefacade change when it passes or push it through? | 17:43 |
| *** spzala has joined #openstack-keystone | 17:43 | |
| openstackgerrit | Arun Kant proposed openstack/keystonemiddleware: Adding audit middleware specific notification driver conf https://review.openstack.org/279828 | 17:43 |
| *** petertr7_away is now known as petertr7 | 17:45 | |
| *** nllrte has joined #openstack-keystone | 17:46 | |
| stevemar | morgan: lemme see | 17:46 |
| morgan | stevemar: it's a big change but it touches enough that rebase is not going to be friendly | 17:47 |
| *** edmondsw has joined #openstack-keystone | 17:47 | |
| nllrte | hi, does keystone store LDAP names somewhere in it's database when using LDAP as the auth backend?? | 17:47 |
| morgan | and it should remove the enginefacase deprecation warnings. | 17:47 |
| stevemar | nllrte: nope, gets it from backend | 17:48 |
| *** admin0 has joined #openstack-keystone | 17:48 | |
| stevemar | morgan: let me look over it once again | 17:48 |
| nllrte | stevemar: so each time I do openstack user show and it return the name field, it's banging on LDAP for that info? | 17:48 |
| morgan | nllrte: yep, unless you have caching enabled, which it'll use cached values. | 17:49 |
| morgan | nllrte: enabled+configured that is | 17:49 |
| stevemar | nllrte: i believe so, its recommended to use caching and ldappool for better performance | 17:49 |
| *** admin0 has quit IRC | 17:50 | |
| nllrte | hmm...that would explain why our LDAP cluster is constantly overwelmed with requests coming from keystone | 17:51 |
| openstackgerrit | Arun Kant proposed openstack/keystonemiddleware: Adding audit middleware specific notification driver conf https://review.openstack.org/279828 | 17:51 |
| nllrte | thanks stevemar and morgan | 17:51 |
| *** timcline_ has joined #openstack-keystone | 17:52 | |
| *** knikolla has joined #openstack-keystone | 17:52 | |
| stevemar | morgan: so we just rebased that change, we didn't make any of the changes that zzzeek suggested, right? | 17:52 |
| stevemar | morgan: i assume you are of the opinion that those can be fixed up later? | 17:52 |
| morgan | stevemar: correct | 17:52 |
| stevemar | and getting rid of deprecation warnings is more important at this point | 17:53 |
| stevemar | okay | 17:53 |
| stevemar | i can dig it | 17:53 |
| arunkant | dims: Notifier expects single topic as per http://git.openstack.org/cgit/openstack/oslo.messaging/tree/oslo_messaging/notify/notifier.py#n178 . So does not look like I can use list opt for topic. | 17:53 |
| *** lhcheng has joined #openstack-keystone | 17:55 | |
| *** ChanServ sets mode: +v lhcheng | 17:55 | |
| *** petertr7 is now known as petertr7_away | 17:55 | |
| dancn | dstanek: well now I have a completely different error... I am almost lost... Anyway in the virtualenv the tests run correcly. Here is my Vagrantfile: http://paste.openstack.org/show/488065/ the head of the output at http://paste.openstack.org/show/488068/ (see the new error at 18:46:49) I will go home in a few mins, if you have some early question please ask, if not see you tomorrow and thanks again | 17:55 |
| *** timcline_ has quit IRC | 17:56 | |
| *** gyee has joined #openstack-keystone | 17:58 | |
| *** ChanServ sets mode: +v gyee | 17:58 | |
| *** admin0 has joined #openstack-keystone | 17:59 | |
| *** henrynash has quit IRC | 17:59 | |
| dims | arunkant : looks like we have to fix oslo_messaging | 18:01 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:01 | |
| *** admin0 has quit IRC | 18:02 | |
| arunkant | dims: yes. I have made changes as per review comments. Please check. | 18:02 |
| dstanek | dancn: that timestamp isn't in the paste | 18:03 |
| morgan | stevemar: you should poke devstack folks to land https://review.openstack.org/#/c/283231/1 so we can drop eventlet | 18:03 |
| patchbot | morgan: patch 283231 - openstack-dev/devstack - Fix uwsgi keystone | 18:03 |
| morgan | stevemar: since that looks to be the fix for our uwsgi job | 18:03 |
| dancn | dstanek: let me check if all the output is there | 18:04 |
| *** diazjf has quit IRC | 18:04 | |
| dancn | dstanek: it was cut... not sure why, let me upload the next part | 18:05 |
| *** fangxu has quit IRC | 18:05 | |
| stevemar | morgan: i think i'll drop eventlet in N, too late at this point | 18:06 |
| stevemar | :( | 18:06 |
| morgan | stevemar: well you could drop the non-vote job at least cause... it's the slowest part of keystone's check queue ;) | 18:06 |
| morgan | if uwsgi is running | 18:06 |
| morgan | that is | 18:06 |
| *** porunov has quit IRC | 18:07 | |
| morgan | stevemar, dolphm, dstanek: db enginefacade is gating | 18:10 |
| dstanek | morgan: nice | 18:11 |
| morgan | rderose: sorry for the rebase ick coming your way :( | 18:11 |
| morgan | rderose: ^ cc | 18:11 |
| dancn | dstanek: after few paste of partial output (without any warning from the site) the interesting part is at: http://paste.openstack.org/show/488072/ error is at "18:46:49 O: ==> default: ERROR: py27: could not install deps" and few lines the tox in the venv starts correcly | 18:12 |
| dancn | dstanek: also now also finished correcly | 18:14 |
| dstanek | dancn: the docutils thing is sort of interesting, but it looks like no conflict | 18:15 |
| dims | arunkant : will this work for you? https://review.openstack.org/#/c/284330/1/oslo_messaging/notify/notifier.py | 18:16 |
| patchbot | dims: patch 284330 - oslo.messaging - Allow Notifier to have multiple topics | 18:16 |
| dancn | dstanek: sure, that is the reason of my surprise, no more conflict but another problem... tomorrow I will try to diff again the 'py installed' output, best | 18:17 |
| dstanek | dancn: looks like it actually created the venv and ran the test though | 18:18 |
| daemontool | stevemar or anyone can I have some help with http://paste.openstack.org/show/488073/ | 18:19 |
| daemontool | getting issues with saml2 federation, mellon and mappings | 18:19 |
| dancn | dstanek: yes, the system tox fails with the docutils problem (where I was expecting the conflict), the tox in the venv run correcly (where I was expecting the same conflict) | 18:19 |
| daemontool | stevemar, this is the json mapping http://paste.openstack.org/show/488074/ | 18:20 |
| dstanek | dancn: it may be that the system tox is just too old. so when you run with a modern tox all is good? | 18:20 |
| dancn | dstanek: in this newborn vm seems so | 18:21 |
| daemontool | stevemar, saml xml response with attributes only> http://paste.openstack.org/show/488075/ | 18:22 |
| dstanek | dancn: i suspected it was just an issue with your other vm. so now you can just go ahead and develop :-) | 18:22 |
| dancn | dstanek: I can not think of some resonable cause for the different error in the older vm, since the setup was made in the same way... anywhay yes, let's move on! Thanks again | 18:23 |
| *** belmoreira has quit IRC | 18:23 | |
| *** jsavak has quit IRC | 18:23 | |
| *** fhubik has joined #openstack-keystone | 18:23 | |
| *** jsavak has joined #openstack-keystone | 18:24 | |
| stevemar | daemontool: looks like you need a group to dump all your federated users into | 18:24 |
| stevemar | dstanek: we were just holding off to see what jenkins said about the enginefacade patch | 18:25 |
| *** fhubik has quit IRC | 18:25 | |
| stevemar | morgan: dstanek dolphm we sure that fixed the deprecation warnings? http://logs.openstack.org/58/257458/5/check/gate-keystone-python34/a339e4d/console.html seeing a lot of them here | 18:26 |
| daemontool | stevemar, ok | 18:26 |
| daemontool | ty | 18:26 |
| stevemar | daemontool: we have a few examples here: http://docs.openstack.org/developer/keystone/mapping_combinations.html#mappings-examples | 18:27 |
| *** diazjf has joined #openstack-keystone | 18:27 | |
| morgan | stevemar: we may need to make something lazy, but it's 100 hits in that file fwiw | 18:27 |
| stevemar | generally speaking, you need a group to dump all your federated users into | 18:27 |
| morgan | stevemar: so, it is likely isolated and test specific | 18:27 |
| stevemar | morgan: 100? i saw 600+ | 18:28 |
| morgan | ah misread the search | 18:28 |
| stevemar | "EngineFacade is deprecated; please use oslo_db.sqlalchemy" | 18:28 |
| morgan | yeah | 18:28 |
| dims | LOL | 18:28 |
| morgan | this was required anyway. | 18:28 |
| morgan | stevemar: couldn't fix that error w/o this change anyway | 18:28 |
| stevemar | yep | 18:28 |
| stevemar | i get that | 18:29 |
| stevemar | morgan: do you know where this new one is coming from? i can post a quick patch | 18:29 |
| morgan | looking | 18:29 |
| morgan | stevemar: that might be from oslo.db itself | 18:30 |
| stevemar | wut | 18:30 |
| morgan | aha | 18:32 |
| morgan | wtf.. | 18:32 |
| morgan | found it | 18:32 |
| stevemar | hehe | 18:32 |
| stevemar | dont leave me in suspense | 18:32 |
| morgan | stevemar: look for keystone.common.sql.[core.].get_engine and .get_session | 18:33 |
| morgan | those are the legacy facades | 18:33 |
| morgan | it's used in _sync_common_repo, _sync_extension_repo, get_db_version | 18:33 |
| morgan | and in the database fixture | 18:33 |
| morgan | and uh 2 tests in test_sql_upgrade | 18:33 |
| morgan | the database fixture is the bulk of the issue | 18:34 |
| stevemar | bknudson: i'll never this funny ever again on twitter | 18:34 |
| bknudson | stevemar: the expectations are now very high | 18:34 |
| stevemar | bknudson: gorram reavers | 18:34 |
| stevemar | bknudson: i've peaked | 18:34 |
| stevemar | i can't top it | 18:35 |
| morgan | stevemar: so fix test_sql_upgrade and the DB fixture and the warnings go away | 18:36 |
| morgan | stevemar: this only affects our unit tests | 18:36 |
| morgan | stevemar: so we solved the "run in production" warnings | 18:36 |
| stevemar | \o/ | 18:36 |
| stevemar | let me poke around then | 18:37 |
| morgan | in ~25 mins it should land btw | 18:37 |
| *** jsavak has quit IRC | 18:37 | |
| *** jsavak has joined #openstack-keystone | 18:38 | |
| *** josecastroleon has joined #openstack-keystone | 18:39 | |
| stevemar | yep | 18:39 |
| daemontool | stevemar, I've added the groups, but I'm getting the same error http://paste.openstack.org/show/488077/ | 18:41 |
| daemontool | quite stuck on this :( | 18:41 |
| daemontool | stevemar, solved :) | 18:42 |
| stevemar | daemontool: woo hoo | 18:42 |
| stevemar | daemontool: i was just opening all your links | 18:42 |
| stevemar | daemontool: a slight mapping change? | 18:43 |
| daemontool | stevemar, http://paste.openstack.org/show/488078/ remote type changed to MELLON_id | 18:44 |
| daemontool | that var is taken from mellon, it's an env var | 18:44 |
| *** mylu has joined #openstack-keystone | 18:44 | |
| daemontool | I've been 2 days on this.... | 18:45 |
| daemontool | ty anyway :) | 18:45 |
| stevemar | daemontool: it's pretty common for the apache plugins to prefix things :| | 18:45 |
| daemontool | mellon add MELLON_ prefix to all the fields that came from the assertion data | 18:45 |
| daemontool | well good to know :) | 18:46 |
| daemontool | that needs to be added to the mappings | 18:46 |
| daemontool | on remote | 18:46 |
| *** spzala has quit IRC | 18:46 | |
| *** spzala has joined #openstack-keystone | 18:46 | |
| *** fangxu has joined #openstack-keystone | 18:48 | |
| daemontool | and now I'm going home, bye :P | 18:50 |
| *** timcline_ has joined #openstack-keystone | 18:52 | |
| stevemar | daemontool: see ya | 18:54 |
| *** sdake has quit IRC | 18:55 | |
| *** daemontool has quit IRC | 18:55 | |
| *** timcline_ has quit IRC | 18:56 | |
| *** jsavak has quit IRC | 18:58 | |
| *** ninag has quit IRC | 18:59 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update default domain's description https://review.openstack.org/281381 | 18:59 |
| *** ninag has joined #openstack-keystone | 19:00 | |
| dims | sileht : dhellmann : this look ok? https://review.openstack.org/#/c/284330/ i can add tests if its worth it. it was noticed by arunkant in https://review.openstack.org/#/c/279828/ over in keystone channel | 19:00 |
| patchbot | dims: patch 284330 - oslo.messaging - Allow Notifier to have multiple topics | 19:00 |
| patchbot | dims: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 19:00 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Update default domain's description https://review.openstack.org/281381 | 19:01 |
| *** josecastroleon has quit IRC | 19:09 | |
| *** sdake has joined #openstack-keystone | 19:09 | |
| dolphm | rderose: dstanek: do we have a test suite somewhere where we could show that you can assign roles and group memberships to shadowed federated users? | 19:11 |
| *** browne has quit IRC | 19:11 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:11 | |
| *** petertr7_away is now known as petertr7 | 19:12 | |
| openstackgerrit | Merged openstack/keystone: Use the new enginefacade from oslo.db https://review.openstack.org/257458 | 19:14 |
| rderose | dolphm: no, currently not and that's something I wanted to talk to you about | 19:15 |
| *** rodrigods has quit IRC | 19:16 | |
| lbragstad | morgan you had a string of patches around for the request local caching stuff, right? | 19:16 |
| *** rodrigods has joined #openstack-keystone | 19:16 | |
| lbragstad | morgan or did that merge? | 19:16 |
| morgan | lbragstad: they need to be rebased | 19:16 |
| morgan | lbragstad: https://review.openstack.org/#/c/272007/ and https://review.openstack.org/#/c/277198/ but that second one needs to work like | 19:17 |
| patchbot | morgan: patch 272007 - keystone - Use requst local in-process cache per request | 19:17 |
| patchbot | morgan: patch 277198 - keystone - Default caching to on for request-local caching. | 19:17 |
| morgan | lbragstad: the new oslo_config thing | 19:17 |
| ayoung | Does anyone actually understand our logging setup? | 19:17 |
| rderose | dolphm: allowing concrete role assignments for federated users, I have planned in a separate patch. But again, wanted to discuss with you first. | 19:18 |
| lbragstad | morgan ok - is that something we want to land before m-3? | 19:18 |
| morgan | lbragstad: sec | 19:18 |
| dolphm | rderose: i haven't totally reviewed this patch yet - is that not supported yet? | 19:18 |
| rderose | dolphm: would you have time to meet on shadow users tomorrow? | 19:18 |
| dolphm | rderose: let's talk now | 19:18 |
| rderose | dolphm: okay | 19:18 |
| ayoung | Just got a downstream bug reported, and it seems to be something people are hitting upstream, but no one has reported it. Not sure if it is Keystone or oslo.config: | 19:18 |
| ayoung | /bin/sh -c "keystone-manage db_sync" keystone | 19:19 |
| ayoung | We get error | 19:19 |
| ayoung | No handlers could be found for logger "oslo_config.cfg" | 19:19 |
| ayoung | then workaround seems to be setting verbose = False in the config file | 19:19 |
| rderose | dolphm: in this patch, I'm only shadowing federated users. I haven't refactored the code to support concrete role assignments. | 19:19 |
| *** ninag has quit IRC | 19:19 | |
| rderose | dolphm: was thinking that could be a separate patch | 19:20 |
| *** belmoreira has joined #openstack-keystone | 19:20 | |
| rderose | dolphm: and I'm thinking that this might be a good stopping point for mitaka3 | 19:21 |
| ayoung | dolphm, rderose, who decides if it is OK to link two credentials to the same user? And what happens if a user gets deactivated? | 19:21 |
| dolphm | rderose: what is left to do to support role assignments? | 19:22 |
| dolphm | rderose: also agree on scope for mitaka | 19:22 |
| *** jsavak has joined #openstack-keystone | 19:22 | |
| ayoung | for example, lets say I have an account from saml.redhat.com on RAX. Then, I log in from home using Google credentials. I assume that the two accounts are going to be kept separate. | 19:23 |
| stevemar | review request for https://review.openstack.org/#/c/281381/4 | 19:23 |
| patchbot | stevemar: patch 281381 - keystone - Update default domain's description | 19:23 |
| stevemar | dolphm: rderose i agree, that is a good stopping point for mitaka | 19:24 |
| rderose | dolphm: regarding what's left, let me research this some more and get back to you. as I recall they were several places where emphmeral was being checked and likely need some refactoring in each case. | 19:25 |
| dolphm | rderose: ah, hrm. can you start with a functional test? | 19:26 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 19:26 |
| rderose | ayoung: if a user gets deactivated, then they shouldn't be able to access via federation | 19:27 |
| rderose | dolphm: hrm?? | 19:27 |
| dolphm | rderose: lol, "hrm" as in a surprised "hmm" | 19:28 |
| dolphm | http://www.urbandictionary.com/define.php?term=hrm | 19:28 |
| rderose | dolphm: :) sure I can start with a test (and you mean a unit test, right?) | 19:28 |
| dolphm | rderose: i'd just prefer as close to the HTTP API as possible as this is the basic use case we're chasing | 19:29 |
| rderose | dolphm: ah, so changing the API? | 19:30 |
| dolphm | rderose: no no, just exercising it with a new use case | 19:30 |
| lbragstad | bknudson I know you just opened https://bugs.launchpad.net/keystone/+bug/1549371 and it says "In Progress". | 19:32 |
| openstack | Launchpad bug 1549371 in OpenStack Identity (keystone) "Deprecation message when using default keystone-paste.ini" [Medium,In progress] - Assigned to Brant Knudson (blk-u) | 19:32 |
| rderose | dolphm: sorry, you mean to create a functional test as close to the HTTP API as possible | 19:32 |
| *** jsavak has quit IRC | 19:33 | |
| lbragstad | bknudson it's also targeted to m-3, you don't have a patch up for review yet do you (if so, I was going to review it)? | 19:33 |
| bknudson | lbragstad: I do have a patch up. | 19:33 |
| bknudson | I thought there was a bot that updated the bug? | 19:33 |
| lbragstad | bknudson ah - strange. it wasn't linked in the bug report | 19:33 |
| bknudson | lbragstad: https://review.openstack.org/#/c/281372/ | 19:34 |
| patchbot | bknudson: patch 281372 - keystone - Move admin_token_auth before build_auth_context in... | 19:34 |
| dolphm | rderose: yes | 19:34 |
| rderose | dolphm: got it | 19:35 |
| dolphm | rderose: i don't know what our tests look like around federation though - we certainly don't stand up mod_shib and pass it saml docs in our own test suite, but that'd be the ultimate test (assigning roles to the resulting identity). | 19:35 |
| *** browne has joined #openstack-keystone | 19:37 | |
| dolphm | rderose: authenticate via saml -> get back a user ID -> have an admin user directly assign that user a role in a project -> have the federated user get a token for the project -> show that it's a regular, non-federated token that contains the assigned tenant + role pair | 19:37 |
| lbragstad | bknudson admin_token_auth is deprecated regardless of it being before or after build_auth_context, right? | 19:37 |
| bknudson | lbragstad: admin_token_auth is deprecated? | 19:38 |
| dolphm | i think it was just undeprecated | 19:38 |
| bknudson | I don't get a message saying admin_token_auth is deprecated when I start keystone using devstack | 19:38 |
| lbragstad | bknudson ah - nevermind.. I read that wrong | 19:38 |
| bknudson | I get a message saying it's unsafe to use admin_token_auth | 19:39 |
| lbragstad | I missed this part "Update keystone-paste.ini so that admin_token_auth is before build_auth_context in the paste pipelines." | 19:39 |
| lbragstad | the entire deprecation message is kind of misleading. Only because it seems to suggest two different things. | 19:39 |
| rderose | dolphm: sounds good. and just so we are on the same page, this would be in the next patch for create concrete role assignments, correct? | 19:39 |
| rderose | *creating | 19:40 |
| bknudson | lbragstad: hrm, maybe it can be cleaned up | 19:40 |
| lbragstad | bknudson as an operator should I remove admin_token_auth or should I just move it in the pipeline? | 19:40 |
| bknudson | I guess we say hrm now. | 19:40 |
| dolphm | rderose: you can work it in a separate patch, but i'm also not clear on how much extra work is involved to make the test pass. if it's not much, we can decide to merge it into one patch later | 19:40 |
| *** fawadkhaliq has quit IRC | 19:40 | |
| rderose | dolphm: sounds good | 19:40 |
| bknudson | lbragstad: you might not be able to remove admin_token_auth because your apps use it | 19:40 |
| lbragstad | bknudson hm - so then this would scare me " Deprecated: Auth context checking for the admin token is deprecated as of the Mitaka release and will be removed in the O release." | 19:41 |
| dolphm | rderose: i'd also be hesitant to merge the current patch without such a test passing in at least a subsequent commit | 19:41 |
| dolphm | rderose: happy to see the current patch stabilize though - less churn is better there at this point :P | 19:41 |
| bknudson | lbragstad: y, probably, since you're probably not aware what auth context is and how it's different from admin_token_auth... | 19:42 |
| lbragstad | bknudson right | 19:42 |
| rderose | dolphm: thanks, me too. let me investigate how much work is needed and get back to you. | 19:42 |
| rderose | ayoung: I haven't thought through all of the account linking scenarios, but if a user is deactivated (enabled == false), then authentication should fail | 19:42 |
| lbragstad | bknudson unless the term "admin token" is referring to something other than "admin_token_auth"? | 19:43 |
| bknudson | lbragstad: but the instructions for how to fix it are clear? | 19:43 |
| rderose | ayoung: the current implementation would support this | 19:43 |
| ayoung | rderose, who can decide to link two accounts? | 19:43 |
| bknudson | lbragstad: yes, admin token is different from admin_token_auth | 19:43 |
| dolphm | ayoung: question for newton :P | 19:43 |
| ayoung | rderose, are we not supporting that in Mitaka? | 19:43 |
| rderose | ayoung: no | 19:43 |
| dolphm | ayoung: correct, not at all in mitaka | 19:43 |
| ayoung | dolphm, rderose ok. I think there might be some trickiness there, glad to have time to sort it | 19:44 |
| *** mylu has quit IRC | 19:44 | |
| *** mylu has joined #openstack-keystone | 19:44 | |
| *** mylu has quit IRC | 19:46 | |
| lbragstad | bknudson left a comment - https://review.openstack.org/#/c/281372/2 | 19:48 |
| patchbot | lbragstad: patch 281372 - keystone - Move admin_token_auth before build_auth_context in... | 19:48 |
| *** ninag has joined #openstack-keystone | 19:48 | |
| *** mylu has joined #openstack-keystone | 19:48 | |
| ayoung | morgan, dolphm, starting to look at Fernet-default again. test_revoke_by_audit_chain_id_chained_token fails, but it looks like it was never exposed to the outside world. Am I correct in understanding that there is not enough info in the signed body of the token to support revoke by chained audit ids? Is it ok to comment out that code for now? | 19:48 |
| dolphm | jorge_munoz: ^ | 19:49 |
| dolphm | jorge_munoz: oh nvm, i saw "chained" and thought trusts | 19:49 |
| dolphm | ayoung: both audit IDs should be included in Fernet | 19:50 |
| *** petertr7 is now known as petertr7_away | 19:50 | |
| *** henrynash has joined #openstack-keystone | 19:50 | |
| *** ChanServ sets mode: +v henrynash | 19:50 | |
| ayoung | dolphm, so we can fix that one? OK...I'll look in to it | 19:50 |
| *** ninag has quit IRC | 19:52 | |
| *** timcline_ has joined #openstack-keystone | 19:53 | |
| *** ninag has joined #openstack-keystone | 19:53 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Move admin_token_auth before build_auth_context in sample paste.ini https://review.openstack.org/281372 | 19:55 |
| bknudson | lbragstad: ^ how's that? | 19:55 |
| *** petertr7_away is now known as petertr7 | 19:55 | |
| lbragstad | bknudson works for me | 19:57 |
| lbragstad | bknudson thanks! | 19:57 |
| bknudson | no problem | 19:57 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 19:57 |
| *** timcline_ has quit IRC | 19:57 | |
| dolphm | rderose: did you look at that patch i said would conflict with shadow users earlier? | 19:58 |
| rderose | dolphm: I did and fixed the conflict | 19:58 |
| dolphm | rderose: i left a bunch of comments on the last patchset too | 19:58 |
| rderose | dolphm: didn't see those, looking now | 19:59 |
| rderose | dolphm: The current mapped auth plugin gets an "id" and "name" as input, which I am mapping to "unique_id" and "display_name" in the federated_user table. | 20:00 |
| stevemar | rderose: it's looking good | 20:01 |
| dolphm | morgan: weren't you working on keystone-manage bootstrap somewhere? | 20:01 |
| rderose | stevemar: thanks :) | 20:01 |
| stevemar | dolphm: whats the issue with it? | 20:01 |
| morgan | dolphm: uhm, define working on it? | 20:01 |
| morgan | Devstack uses it now ;) | 20:01 |
| rderose | dolphm: should we change the api to support unique_id and display_name? | 20:01 |
| morgan | It probably could use improvements but it def covers MVP atm | 20:02 |
| dolphm | morgan: don't recall; i thought i looked at a patch regarding it a couple days ago | 20:02 |
| dolphm | rderose: which API? | 20:02 |
| morgan | Not from me. | 20:02 |
| stevemar | dolphm: you dreaming | 20:03 |
| rderose | dolphm: good question, I assume there is a user api out there for federation that allows id and name as input | 20:03 |
| rderose | dolphm: and since unique_id and display_name are new, we would need to update the api some where :) | 20:04 |
| rderose | dolphm: to let the client know these are now required. Or, as I said, are we mapping id to unqiue_id and name to display_name? | 20:05 |
| dolphm | morgan: attach request local caching patch to https://bugs.launchpad.net/keystone/+bug/1259827 ? | 20:05 |
| openstack | Launchpad bug 1259827 in OpenStack Identity (keystone) "keystone execute SQL statements so many times?" [Medium,Triaged] - Assigned to David Stanek (dstanek) | 20:05 |
| dolphm | rderose: is that not the "setup_username()" method? | 20:06 |
| dolphm | rderose: the mapping is that "api" i suppose, we wouldn't / shouldn't be impacting how you write your mapping | 20:06 |
| rderose | setup_username just maps a username to id and/or name depending on what the client passed in | 20:07 |
| dolphm | the same output is required from mapping, we just do something new with the resulting data (lookup or create a shadow user) | 20:07 |
| dolphm | rderose: isn't that code called after the mapping engine is called? | 20:07 |
| *** petertr7 is now known as petertr7_away | 20:08 | |
| rderose | dolphm: sorry, by mapping I just mean that take an id or username passed in from the client and sets the user.id, user.name values | 20:09 |
| dolphm | rderose: how are they passed in? | 20:10 |
| *** jsavak has joined #openstack-keystone | 20:10 | |
| rderose | dolphm: through mapped authentication, from the context | 20:11 |
| dolphm | stevemar: any chance you have a link to that tempest + keystone bug about how repeated runtimes of tempest get slower and slower because the revocation table fills up? | 20:11 |
| *** zqfan has quit IRC | 20:12 | |
| dolphm | rderose: the client in that case is mod_shib / mod_mellon handling a SAML doc | 20:12 |
| openstackgerrit | Sam Leong proposed openstack/keystoneauth: Auth plugin for X.509 tokenless authz https://review.openstack.org/283905 | 20:12 |
| dolphm | rderose: the results are passed through CGI / WSGI environment variables | 20:12 |
| *** slberger has quit IRC | 20:13 | |
| rderose | dolphm: ahhh | 20:13 |
| rderose | dolphm: okay, so should I assume the id passed in from mod_shib... is the unqiue_id and name is the display_name? | 20:15 |
| dolphm | rderose: that is my thinking, yes | 20:15 |
| rderose | dolphm: cool | 20:15 |
| dolphm | rderose: but the setup_username() code has some wonky edge cases where ID might not be passed in (i swear it was the one thing we mandated), etc, so it tries to handle all those cases | 20:16 |
| * dolphm steps away for a bit | 20:16 | |
| samueldmq | henrynash: hi, still about ?cascade thing | 20:17 |
| samueldmq | henrynash: have you thought more about it? | 20:18 |
| *** gordc has quit IRC | 20:18 | |
| morgan | dolphm: sure on adding it to that bug | 20:19 |
| *** mylu has quit IRC | 20:20 | |
| *** henrynash has quit IRC | 20:20 | |
| *** mylu has joined #openstack-keystone | 20:22 | |
| *** fangxu has quit IRC | 20:24 | |
| *** fangxu has joined #openstack-keystone | 20:26 | |
| *** rk4n has quit IRC | 20:26 | |
| *** petertr7_away is now known as petertr7 | 20:31 | |
| *** jsavak has quit IRC | 20:32 | |
| *** timcline_ has joined #openstack-keystone | 20:33 | |
| *** JBenson has joined #openstack-keystone | 20:36 | |
| *** jsavak has joined #openstack-keystone | 20:36 | |
| *** spzala has quit IRC | 20:40 | |
| *** rderose has quit IRC | 20:46 | |
| *** gordc has joined #openstack-keystone | 20:47 | |
| *** slberger has joined #openstack-keystone | 20:51 | |
| *** boris-42 has joined #openstack-keystone | 20:53 | |
| *** belmoreira has quit IRC | 20:53 | |
| stevemar | dolphm: sorry, was otp, did you find the bug? | 20:59 |
| stevemar | dolphm: https://bugs.launchpad.net/keystone/+bug/1471665 ? | 21:04 |
| openstack | Launchpad bug 1471665 in OpenStack Identity (keystone) "Successive runs of identity tempest tests take more and more time to finish" [Low,Confirmed] | 21:04 |
| dolphm | morgan: does dogpile.cache work on generators? | 21:04 |
| morgan | dolphm: uhmm... | 21:04 |
| dolphm | stevemar: yes, that's it! thank you | 21:04 |
| morgan | dolphm: don't think you can memoize a generator | 21:04 |
| stevemar | dolphm: yw :] | 21:04 |
| morgan | dolphm: by definition a generator isn't memoizable - it results in a side-effect of running the funciton/method vs a static object | 21:05 |
| stevemar | dolphm: the amount of bugs related to performance and revocation is TOO DAMN HIGHT https://bugs.launchpad.net/keystone/+bugs?field.tag=performance | 21:05 |
| morgan | dolphm: if you can serialize a generator (don't think this is really possible), then you can memoize it. i mean, barring the in-memory dict cache [bad idea] | 21:06 |
| *** nllrte has quit IRC | 21:06 | |
| *** timcline_ has quit IRC | 21:06 | |
| morgan | dolphm: heck does copy.deepcopy really work well on generators? | 21:06 |
| stevemar | morgan dolphm https://bugs.launchpad.net/keystone/+bug/1259827 I think we can close this one now? cause caching? | 21:06 |
| openstack | Launchpad bug 1259827 in OpenStack Identity (keystone) "keystone execute SQL statements so many times?" [Medium,Triaged] - Assigned to David Stanek (dstanek) | 21:06 |
| openstackgerrit | Merged openstack/keystone: db_sync doesn't create default domain https://review.openstack.org/282042 | 21:06 |
| *** timcline_ has joined #openstack-keystone | 21:07 | |
| morgan | stevemar: nope, you can close that with the request local cache. | 21:07 |
| morgan | stevemar: and only partially close really, it doesn't "stop" the queries, it just limits them | 21:07 |
| stevemar | morgan: feel like rebasing that bad boy? | 21:07 |
| morgan | stevemar: if you want it to land i can. it's not a hard rebase. | 21:07 |
| dstanek | morgan: stevemar: with local cache we are just hacking around the problem, but i guess the bug would go away | 21:08 |
| morgan | basically it solves the bug but doesn't solve the root cause | 21:08 |
| morgan | long term we need a real fix. | 21:08 |
| *** annasort has quit IRC | 21:08 | |
| morgan | also the request local thing was blocking on the oslo_config change dhellmann pushed through for non-standard default opts | 21:09 |
| *** mylu has quit IRC | 21:09 | |
| *** mylu has joined #openstack-keystone | 21:09 | |
| *** jsavak has quit IRC | 21:10 | |
| *** pcaruana has quit IRC | 21:10 | |
| *** timcline_ has quit IRC | 21:11 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/277436 | 21:13 |
| ayoung | dolphm, stevemar did we drop 'expires_at' from the revocation events? | 21:19 |
| morgan | stevemar, dolphm: almost done rebasing the local cache | 21:21 |
| morgan | just running unit tests, will add in the default cache config stuff after | 21:22 |
| *** mylu has quit IRC | 21:24 | |
| *** pauloewerton has quit IRC | 21:27 | |
| *** ekarlso- has quit IRC | 21:34 | |
| *** ekarlso- has joined #openstack-keystone | 21:34 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Use requst local in-process cache per request https://review.openstack.org/272007 | 21:34 |
| morgan | stevemar, dstanek, dolphm: ^ rebased | 21:35 |
| *** jsavak has joined #openstack-keystone | 21:42 | |
| dolphm | ayoung: i don't know | 21:46 |
| ayoung | dolphm, the Fernet patch is failing because one of the explicit revokes is lookiomng at the events, and is trying to match on expires | 21:47 |
| ayoung | In the past, I thought all evetns held expires_at so we could purge them | 21:47 |
| ayoung | I am not certain if this check is still necsessary, but I am reluctant to just drop it | 21:48 |
| dolphm | ayoung: i thought so too | 21:48 |
| dolphm | ayoung: or maybe not expires at, but they have some date attached to them for sure | 21:49 |
| ayoung | issued_at? | 21:49 |
| dolphm | ayoung: or is it just event date + token lifespan == when revoke events are no longer useful | 21:49 |
| dolphm | issued_at + token lifespan | 21:50 |
| dolphm | that sounds right | 21:50 |
| ayoung | so not hacing expires_at in a revocation event should not be a deal breaker, so long as the rest works | 21:50 |
| ayoung | I think I'll just remove the check | 21:50 |
| *** sdake has quit IRC | 21:51 | |
| *** sdake has joined #openstack-keystone | 21:52 | |
| *** mylu has joined #openstack-keystone | 21:53 | |
| stevemar | ayoung: we did not | 21:54 |
| stevemar | ayoung: i had a patch but abandoned it | 21:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Default caching to on for request-local caching. https://review.openstack.org/277198 | 21:55 |
| ayoung | stevemar, I'm guessing the change happened in the token provider chain somewhere. I don't think it is an important check, but I am seeing a later failure that looks like our old race condition | 21:56 |
| ayoung | let me confirm... | 21:56 |
| stevemar | ayoung: here was my patch to remove it (abandoned) https://review.openstack.org/#/c/271135/ | 21:56 |
| patchbot | stevemar: patch 271135 - keystone - remove deprecated revoke_by_expiration function (ABANDONED) | 21:56 |
| ayoung | stevemar, bring it back to life | 21:57 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Trying latest oslo.* from master https://review.openstack.org/284155 | 21:57 |
| ayoung | It can hang out until Newton opens up | 21:58 |
| stevemar | ayoung: the tests were a pain in the you know where | 21:58 |
| ayoung | but it is the right idea | 21:58 |
| ayoung | stevemar, I'll get them. | 21:58 |
| stevemar | ayoung: IT'S ALIVE! | 21:58 |
| ayoung | cool | 21:58 |
| *** jsavak has quit IRC | 22:01 | |
| *** ninag has quit IRC | 22:02 | |
| *** jsavak has joined #openstack-keystone | 22:02 | |
| *** david-lyle has joined #openstack-keystone | 22:03 | |
| * stevemar should head out and go to the local openstack meetup | 22:05 | |
| *** knikolla has quit IRC | 22:05 | |
| stevemar | dolphm ayoung morgan dstanek i have to allocate the fishbowl / work rooms for austin soon, want to just go with what we did last year | 22:07 |
| *** timcline_ has joined #openstack-keystone | 22:07 | |
| stevemar | dolphm ayoung morgan dstanek for reference, last year we had 7 fishbowls, and 3 work rooms in tokyo | 22:07 |
| dolphm | stevemar: how about a session to workshop known security "weaknesses"? | 22:07 |
| ayoung | Tokyo was a good balance, I think | 22:07 |
| stevemar | dolphm: this is just allocating numbers for now | 22:08 |
| dolphm | oh | 22:08 |
| dolphm | stevemar: well then i want 1 fishbowl then | 22:08 |
| stevemar | should i request one more of each? feel like we didn't have enough time? | 22:08 |
| stevemar | lol | 22:08 |
| stevemar | just 1? why? | 22:08 |
| ayoung | one just for dolphm to yell at people | 22:09 |
| dolphm | stevemar: because i can only think of 1 topic off hand | 22:09 |
| dolphm | stevemar: make it two, i forgot about my yelling session | 22:09 |
| ayoung | what were the defs of fishbowls vs workrooms, and are they going to be the same here? | 22:09 |
| dolphm | thanks ayoung | 22:09 |
| dolphm | ayoung: the work rooms were the big conference table rooms on friday | 22:10 |
| stevemar | ayoung: more or less the same as tokyo... the fishbowls have a proejctor and usually one or two people in the front guiding the session | 22:10 |
| ayoung | So...cross project on roles should be Fishbowl? | 22:10 |
| morgan | fishbowls can hold a lot more people | 22:10 |
| stevemar | ayoung: the workroom is a big table and usually a flip chart | 22:10 |
| dolphm | ayoung: yes | 22:11 |
| stevemar | fishbowls are more for discussion | 22:11 |
| *** petertr7 is now known as petertr7_away | 22:11 | |
| *** daemontool has joined #openstack-keystone | 22:11 | |
| *** timcline_ has quit IRC | 22:11 | |
| dstanek | dolphm: https://gist.github.com/anonymous/ee333c34e5943fd1b47a | 22:11 |
| ayoung | seems like most of the big things are cross-project | 22:12 |
| morgan | dolphm: https://eero.com/ just ordered a set of these. yay real mesh networking @ home. | 22:12 |
| morgan | dolphm: figured i'd share, because ugh been battling wifi hell lately | 22:12 |
| *** sdake has quit IRC | 22:13 | |
| dolphm | morgan: ooh, let me know how it goes | 22:13 |
| ayoung | 20 tests failing on Fernet...how long do I have to fix this? | 22:13 |
| stevemar | heading out to meetup | 22:13 |
| dolphm | lbragstad: ^ | 22:13 |
| lbragstad | ayoung is that on your switch to fernet default patch? | 22:13 |
| morgan | will do, i know mordred also got some, so ask him too in a couple weeks. | 22:13 |
| morgan | dolphm: ^ | 22:13 |
| ayoung | lbragstad, yeah | 22:13 |
| ayoung | lbragstad, I've fixed 2 issues | 22:14 |
| lbragstad | ayoung I think most of those are going to be timing things | 22:14 |
| ayoung | lbragstad, that is what I am starting to see | 22:14 |
| morgan | mordred: telling people to ask you about eero btw, you didn't do anything :P | 22:14 |
| *** dims has quit IRC | 22:14 | |
| lbragstad | ayoung morgan had an elegant want to fix that | 22:14 |
| ayoung | lbragstad, what are we doing about thsoe? Introducing delays? | 22:14 |
| morgan | lbragstad: i did what? | 22:14 |
| ayoung | change the clock? | 22:14 |
| lbragstad | ayoung no - we talked about using freezegun at the midcycle | 22:14 |
| ayoung | morgan, timing bug in a test | 22:14 |
| morgan | ayoung: change the clock. | 22:14 |
| morgan | ayoung: don't add a delay unless its in tempest | 22:15 |
| ayoung | lbragstad, there examples of that in the review already? | 22:15 |
| lbragstad | ayoung no | 22:15 |
| lbragstad | not that I am aware of | 22:15 |
| ayoung | ok...how do I do that, then? | 22:15 |
| lbragstad | ayoung let me see if I can dig up a review | 22:15 |
| morgan | we have some examples of using mock, though i hear freezegun is way cooler | 22:15 |
| ayoung | morgan, if it is a new dependency, is it kosher to pull in? | 22:16 |
| morgan | ayoung: it's already in g-r and should be fine to add | 22:16 |
| morgan | as long as the patch lands pre m-3 | 22:16 |
| morgan | to add it that is | 22:17 |
| ayoung | bknudson, you know about Freezegun? I see you added it to reqs. | 22:17 |
| bknudson | ayoung: dolphm suggested it | 22:17 |
| lbragstad | ayoung https://review.openstack.org/#/c/228603/ | 22:17 |
| patchbot | lbragstad: patch 228603 - requirements - Add freezegun to global requirements (MERGED) | 22:17 |
| ayoung | yeah...now how do I use it... | 22:18 |
| lbragstad | dolphm do you still have that patch lingering around that uses freeze gun to mock the clock for ferent | 22:18 |
| bknudson | ayoung: it looks like a "cool" idea. I don't think it's used yet. | 22:18 |
| *** spzala has joined #openstack-keystone | 22:18 | |
| bknudson | ayoung: there's some code in oslo for clock handling, too. But I think freezegun covers more apis | 22:18 |
| bknudson | oslotest | 22:18 |
| *** raildo is now known as raildo-afk | 22:19 | |
| dolphm | ayoung: i have a patch for freezegun somewhere | 22:19 |
| ayoung | dolphm, is it the right tool for dealing with the tokne/.time issues? | 22:19 |
| dolphm | ayoung: yes | 22:19 |
| dolphm | ayoung: it lets you control the clock in any python library, basically | 22:19 |
| ayoung | dolphm, OK, i think I have a failure right here due to it... | 22:19 |
| dolphm | ayoung: https://review.openstack.org/#/c/227995/ | 22:20 |
| patchbot | dolphm: patch 227995 - keystone - Test revocation race conditions | 22:20 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/test_auth.py#n643 | 22:20 |
| *** spzala has quit IRC | 22:20 | |
| * dolphm is out for the day | 22:23 | |
| *** daemontool has quit IRC | 22:23 | |
| ayoung | dolphm, GAH | 22:23 |
| ayoung | only person that has used freezegun is you dolphm | 22:23 |
| ayoung | don't leave me now! | 22:24 |
| ayoung | I think I can do it without Freezegun, actually | 22:25 |
| ayoung | we advance the time elsewhere already... | 22:25 |
| lbragstad | ayoung it has to work across python libraries I think too | 22:26 |
| *** jorge_munoz has quit IRC | 22:26 | |
| lbragstad | since cryptography is the thing that creates the timestamp we go off of | 22:26 |
| *** csoukup has joined #openstack-keystone | 22:27 | |
| ayoung | lbragstad, you are still in family mode for a while, right? | 22:29 |
| lbragstad | ayoung just got back last night | 22:29 |
| ayoung | lbragstad, OK. Let me see if I can find why this last one is failing, and I'll post my changes | 22:30 |
| *** mylu has quit IRC | 22:36 | |
| *** ninag has joined #openstack-keystone | 22:37 | |
| *** mylu has joined #openstack-keystone | 22:38 | |
| *** gordc has quit IRC | 22:38 | |
| openstackgerrit | Merged openstack/keystone: Reference config values at runtime https://review.openstack.org/283842 | 22:44 |
| *** henrynash has joined #openstack-keystone | 22:45 | |
| *** ChanServ sets mode: +v henrynash | 22:45 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:54 | |
| *** fangxu has quit IRC | 22:55 | |
| *** fangxu has joined #openstack-keystone | 22:58 | |
| *** dims has joined #openstack-keystone | 23:08 | |
| *** timcline_ has joined #openstack-keystone | 23:08 | |
| *** timcline_ has quit IRC | 23:12 | |
| *** sdake has joined #openstack-keystone | 23:12 | |
| *** david-lyle has quit IRC | 23:13 | |
| *** csoukup has quit IRC | 23:15 | |
| *** diazjf has quit IRC | 23:16 | |
| *** jsavak has quit IRC | 23:17 | |
| *** dan_nguyen has left #openstack-keystone | 23:17 | |
| *** jsavak has joined #openstack-keystone | 23:17 | |
| *** pushkaru has quit IRC | 23:18 | |
| *** rk4n has joined #openstack-keystone | 23:18 | |
| *** jsavak has quit IRC | 23:22 | |
| *** sdake has quit IRC | 23:25 | |
| *** vilobhmm11 has quit IRC | 23:25 | |
| *** vilobhmm11 has joined #openstack-keystone | 23:25 | |
| *** timcline_ has joined #openstack-keystone | 23:33 | |
| *** dan_nguyen has joined #openstack-keystone | 23:36 | |
| *** timcline_ has quit IRC | 23:37 | |
| *** mylu has quit IRC | 23:44 | |
| *** pushkaru has joined #openstack-keystone | 23:45 | |
| *** mylu has joined #openstack-keystone | 23:48 | |
| *** mylu has quit IRC | 23:50 | |
| *** pushkaru has quit IRC | 23:52 | |
| ayoung | lbragstad, so the revoke tree looks like this {'trust_id=*': {'consumer_id=*': {'access_token_id=*': {'audit_id=*': {u'audit_chain_id=None': {'expires_at=*': {'domain_id=*': {'project_id=*': {'user_id=*': {'role_id=*': {'domain_scope_id=*': {'issued_before': datetime.datetime(2016, 2, 24, 23, 42, 57, 795165)}}}}}}}}}}}} | 23:54 |
| ayoung | {u'audit_chain_id=None' ? | 23:55 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!