| *** sdake has joined #openstack-keystone | 00:00 | |
| *** fpatwa_ has joined #openstack-keystone | 00:06 | |
| *** mylu has joined #openstack-keystone | 00:07 | |
| *** csoukup has quit IRC | 00:07 | |
| *** fpatwa_ has quit IRC | 00:10 | |
| *** wmolicki has joined #openstack-keystone | 00:17 | |
| *** roxanagh_ has quit IRC | 00:17 | |
| *** roxanaghe has joined #openstack-keystone | 00:18 | |
| *** jasonsb has joined #openstack-keystone | 00:20 | |
| *** jasonsb has quit IRC | 00:25 | |
| *** wmolicki has quit IRC | 00:28 | |
| *** wmolicki has joined #openstack-keystone | 00:28 | |
| *** roxanaghe has quit IRC | 00:32 | |
| *** roxanaghe has joined #openstack-keystone | 00:34 | |
| *** roxanaghe has quit IRC | 00:35 | |
| *** markvoelker has joined #openstack-keystone | 00:43 | |
| *** wmolicki has quit IRC | 00:44 | |
| *** sdake has quit IRC | 00:45 | |
| *** mylu has quit IRC | 00:46 | |
| *** markvoelker has quit IRC | 00:47 | |
| *** mylu has joined #openstack-keystone | 00:50 | |
| *** sdake has joined #openstack-keystone | 00:50 | |
| *** sdake has quit IRC | 01:06 | |
| *** EinstCrazy has joined #openstack-keystone | 01:06 | |
| *** mylu has quit IRC | 01:07 | |
| *** sdake has joined #openstack-keystone | 01:08 | |
| *** fpatwa_ has joined #openstack-keystone | 01:08 | |
| *** mylu has joined #openstack-keystone | 01:09 | |
| *** bjornar has quit IRC | 01:14 | |
| *** sdake has quit IRC | 01:43 | |
| *** vilobhmm11 has joined #openstack-keystone | 01:43 | |
| *** mylu has quit IRC | 01:44 | |
| *** markvoelker has joined #openstack-keystone | 01:44 | |
| *** mylu has joined #openstack-keystone | 01:46 | |
| *** markvoelker has quit IRC | 01:48 | |
| *** vilobhmm11 has quit IRC | 02:00 | |
| *** mylu has quit IRC | 02:18 | |
| *** mylu has joined #openstack-keystone | 02:20 | |
| *** mylu has quit IRC | 02:28 | |
| *** mylu has joined #openstack-keystone | 02:29 | |
| *** aginwala has joined #openstack-keystone | 02:29 | |
| *** sdake has joined #openstack-keystone | 02:31 | |
| *** mylu has quit IRC | 02:35 | |
| *** fpatwa_ has quit IRC | 02:36 | |
| *** mylu has joined #openstack-keystone | 02:37 | |
| *** spandhe has quit IRC | 02:37 | |
| *** mylu has quit IRC | 02:40 | |
| *** markvoelker has joined #openstack-keystone | 02:44 | |
| openstackgerrit | ayoung proposed openstack/keystone: Remove unneeded revocation events https://review.openstack.org/285134 | 02:45 |
|---|---|---|
| *** mdavidson has quit IRC | 02:46 | |
| *** mylu has joined #openstack-keystone | 02:46 | |
| *** lennyb__ has quit IRC | 02:46 | |
| *** richm has quit IRC | 02:47 | |
| *** lennyb__ has joined #openstack-keystone | 02:47 | |
| *** kfox1111 has quit IRC | 02:49 | |
| *** markvoelker has quit IRC | 02:49 | |
| *** richm has joined #openstack-keystone | 02:49 | |
| *** kfox1111 has joined #openstack-keystone | 02:49 | |
| *** mdavidson has joined #openstack-keystone | 02:50 | |
| *** boris-42 has joined #openstack-keystone | 02:50 | |
| *** roxanaghe has joined #openstack-keystone | 02:52 | |
| *** vilobhmm11 has joined #openstack-keystone | 02:58 | |
| *** spandhe has joined #openstack-keystone | 03:02 | |
| *** mylu has quit IRC | 03:07 | |
| *** mylu has joined #openstack-keystone | 03:07 | |
| *** roxanaghe has quit IRC | 03:14 | |
| *** sdake has quit IRC | 03:19 | |
| *** aginwala has quit IRC | 03:20 | |
| *** jasonsb has joined #openstack-keystone | 03:23 | |
| *** mylu has quit IRC | 03:23 | |
| *** aginwala has joined #openstack-keystone | 03:23 | |
| *** jasonsb has quit IRC | 03:28 | |
| *** roxanaghe has joined #openstack-keystone | 03:39 | |
| *** roxanaghe has quit IRC | 03:42 | |
| *** roxanaghe has joined #openstack-keystone | 03:42 | |
| *** dave-mccowan has quit IRC | 03:42 | |
| *** fangxu has joined #openstack-keystone | 03:43 | |
| *** Nirupama has joined #openstack-keystone | 03:43 | |
| *** links has joined #openstack-keystone | 03:44 | |
| *** sdake has joined #openstack-keystone | 03:47 | |
| *** aginwala has quit IRC | 03:51 | |
| *** topol_ has joined #openstack-keystone | 03:53 | |
| *** stevemar has joined #openstack-keystone | 03:53 | |
| *** Ephur has quit IRC | 03:59 | |
| *** links has quit IRC | 04:01 | |
| *** ChanServ sets mode: +o stevemar | 04:06 | |
| *** spandhe has quit IRC | 04:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/277436 | 04:11 |
| *** david-lyle has joined #openstack-keystone | 04:13 | |
| *** links has joined #openstack-keystone | 04:18 | |
| *** david-lyle has quit IRC | 04:36 | |
| openstackgerrit | guang-yee proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/277436 | 04:43 |
| *** markvoelker has joined #openstack-keystone | 04:45 | |
| *** markvoelker has quit IRC | 04:50 | |
| *** david-lyle has joined #openstack-keystone | 04:50 | |
| *** david-lyle has quit IRC | 04:56 | |
| *** spandhe has joined #openstack-keystone | 05:00 | |
| *** spandhe has quit IRC | 05:01 | |
| *** mylu has joined #openstack-keystone | 05:07 | |
| *** aginwala has joined #openstack-keystone | 05:38 | |
| *** fpatwa_ has joined #openstack-keystone | 05:44 | |
| *** roxanaghe has quit IRC | 05:44 | |
| *** roxanaghe has joined #openstack-keystone | 05:45 | |
| *** mylu has quit IRC | 05:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:54 | |
| *** fpatwa_ has quit IRC | 06:09 | |
| *** aginwala has quit IRC | 06:19 | |
| *** fangxu has quit IRC | 06:19 | |
| *** jasonsb has joined #openstack-keystone | 06:27 | |
| *** fangxu has joined #openstack-keystone | 06:27 | |
| *** jasonsb has quit IRC | 06:32 | |
| *** richm has quit IRC | 06:36 | |
| *** aginwala has joined #openstack-keystone | 06:39 | |
| *** sdake has quit IRC | 06:43 | |
| *** rcernin has joined #openstack-keystone | 06:45 | |
| *** ianw has quit IRC | 06:45 | |
| *** markvoelker has joined #openstack-keystone | 06:46 | |
| *** rcernin has quit IRC | 06:49 | |
| *** ianw has joined #openstack-keystone | 06:50 | |
| *** markvoelker has quit IRC | 06:50 | |
| *** sdake has joined #openstack-keystone | 06:59 | |
| *** jaosorior has joined #openstack-keystone | 07:01 | |
| *** henrynash has joined #openstack-keystone | 07:13 | |
| *** ChanServ sets mode: +v henrynash | 07:13 | |
| *** fawadk has joined #openstack-keystone | 07:15 | |
| *** fawadkhaliq has quit IRC | 07:15 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:15 | |
| *** roxanaghe has quit IRC | 07:17 | |
| *** sdake has quit IRC | 07:17 | |
| openstackgerrit | lei zhang proposed openstack/keystone: Make service type unique https://review.openstack.org/263197 | 07:19 |
| *** fawadk has quit IRC | 07:20 | |
| openstackgerrit | Pandiyan proposed openstack/keystone: Add driver details in architecture doc https://review.openstack.org/280802 | 07:21 |
| *** rcernin has joined #openstack-keystone | 07:24 | |
| *** belmoreira has joined #openstack-keystone | 07:25 | |
| *** spandhe has joined #openstack-keystone | 07:32 | |
| *** pcaruana has joined #openstack-keystone | 07:43 | |
| *** fawadkhaliq has quit IRC | 07:43 | |
| *** gus has quit IRC | 07:50 | |
| *** gus has joined #openstack-keystone | 07:52 | |
| *** rk4n has joined #openstack-keystone | 08:02 | |
| *** spandhe has quit IRC | 08:05 | |
| *** rk4n has quit IRC | 08:05 | |
| *** fpatwa_ has joined #openstack-keystone | 08:09 | |
| *** fpatwa_ has quit IRC | 08:14 | |
| *** jed56 has joined #openstack-keystone | 08:20 | |
| *** fawadkhaliq has joined #openstack-keystone | 08:27 | |
| *** jasonsb has joined #openstack-keystone | 08:29 | |
| *** rcernin has quit IRC | 08:29 | |
| *** fangxu has quit IRC | 08:32 | |
| *** jasonsb has quit IRC | 08:33 | |
| *** rcernin has joined #openstack-keystone | 08:37 | |
| *** fawadkhaliq has quit IRC | 08:38 | |
| *** pnavarro has joined #openstack-keystone | 08:39 | |
| *** d0ugal_ has quit IRC | 08:46 | |
| *** d0ugal has joined #openstack-keystone | 08:46 | |
| *** markvoelker has joined #openstack-keystone | 08:47 | |
| *** markvoelker has quit IRC | 08:51 | |
| openstackgerrit | Sergey Nikitin proposed openstack/keystone: Added .idea to the .gitignore https://review.openstack.org/281796 | 09:07 |
| *** jistr has joined #openstack-keystone | 09:20 | |
| *** rk4n has joined #openstack-keystone | 09:21 | |
| *** huats is now known as Guest33875 | 09:22 | |
| samueldmq | morning keystoners | 09:23 |
| breton | щ. | 09:24 |
| breton | :( | 09:24 |
| breton | o/ | 09:24 |
| samueldmq | breton: o/ | 09:25 |
| *** vilobhmm11 has quit IRC | 09:31 | |
| henrynash | samueldmq: hi | 09:31 |
| samueldmq | henrynash: hi | 09:33 |
| henrynash | samuedlmq: on the update cascade….is someone putting up another patch (with a more complete solution as described in the docstring), or are we going with this one? | 09:34 |
| samueldmq | henrynash: I'm working on another patch | 09:35 |
| henrynash | samueldmq: ok, will review as soon as it is up | 09:35 |
| samueldmq | henrynash: perfect | 09:35 |
| samueldmq | henrynash: after that, I will dive into reseller's one | 09:35 |
| henrynash | samuledmq: are you happy with teh projects acting as a domain patch? If so, could you at least +1 it to show you agree (or -1 if you don’t!!!) | 09:36 |
| henrynash | samuedlmq: ah, ok | 09:36 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: API support for project cascade update https://review.openstack.org/243585 | 09:38 |
| samueldmq | henrynash: just updated the docstring ... ^ will take a quick look in reseller before I leave for breakfast | 09:38 |
| henrynash | samueldmq: thx | 09:39 |
| *** e0ne has joined #openstack-keystone | 09:43 | |
| *** aginwala has quit IRC | 09:43 | |
| *** sdake has joined #openstack-keystone | 09:51 | |
| *** boris-42 has quit IRC | 09:54 | |
| *** e0ne has quit IRC | 09:55 | |
| *** henrynash has quit IRC | 10:03 | |
| wanghua | henrynash: | 10:06 |
| *** sdake has quit IRC | 10:06 | |
| *** pnavarro has quit IRC | 10:09 | |
| *** fpatwa_ has joined #openstack-keystone | 10:10 | |
| *** EinstCrazy has quit IRC | 10:14 | |
| *** fpatwa_ has quit IRC | 10:15 | |
| *** daemontool_ has quit IRC | 10:23 | |
| *** daemontool has joined #openstack-keystone | 10:29 | |
| *** jasonsb has joined #openstack-keystone | 10:30 | |
| *** jasonsb has quit IRC | 10:36 | |
| *** daemontool_ has joined #openstack-keystone | 10:39 | |
| *** daemontool has quit IRC | 10:41 | |
| *** daemontool_ is now known as daemontool | 10:42 | |
| *** sdake has joined #openstack-keystone | 10:43 | |
| *** markvoelker has joined #openstack-keystone | 10:47 | |
| *** markvoelker has quit IRC | 10:52 | |
| *** sdake has quit IRC | 10:53 | |
| *** daemontool__ has joined #openstack-keystone | 10:56 | |
| *** flaper87 has quit IRC | 10:56 | |
| *** flaper87 has joined #openstack-keystone | 10:56 | |
| *** daemontool has quit IRC | 10:57 | |
| *** rk4n_ has joined #openstack-keystone | 11:01 | |
| *** rk4n has quit IRC | 11:04 | |
| *** richm has joined #openstack-keystone | 11:04 | |
| *** sdake has joined #openstack-keystone | 11:06 | |
| *** xek has joined #openstack-keystone | 11:12 | |
| *** pnavarro has joined #openstack-keystone | 11:12 | |
| *** sdake has quit IRC | 11:16 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:19 | |
| *** daemontool_ has joined #openstack-keystone | 11:23 | |
| *** daemontool__ has quit IRC | 11:27 | |
| zigo | notmorgan: Hi, could you please remove intersphinx from the positional package? | 11:27 |
| zigo | notmorgan: Also, the image with references to external resources in the README.rst. | 11:28 |
| zigo | I had to patch all of these out in Debian... | 11:28 |
| *** rk4n_ has quit IRC | 11:28 | |
| *** dims has joined #openstack-keystone | 11:29 | |
| *** dims has quit IRC | 11:32 | |
| *** dims has joined #openstack-keystone | 11:32 | |
| *** rk4n has joined #openstack-keystone | 11:33 | |
| openstackgerrit | Sean Dague proposed openstack/keystone: Make keystone tests work on leap years https://review.openstack.org/285987 | 11:35 |
| *** tellesnobrega_af is now known as tellesnobrega | 11:41 | |
| *** henrynash has joined #openstack-keystone | 11:47 | |
| *** ChanServ sets mode: +v henrynash | 11:47 | |
| *** raildo-afk is now known as raildo | 11:49 | |
| samueldmq | henrynash: hi | 11:55 |
| *** dave-mccowan has joined #openstack-keystone | 11:55 | |
| henrynash | samueldmq: hi | 11:55 |
| samueldmq | henrynash: where does the project_id in the url goes inside context? | 11:55 |
| samueldmq | henrynash: the project passed as the body in an update goes into input_attr right? | 11:56 |
| henrynash | samueldmq: i’ll have to remind myself! | 11:56 |
| henrynash | hold on | 11:56 |
| samueldmq | henrynash: ok | 11:57 |
| henrynash | samueldmq: so if a project_id is passed as a param, the entity is read from teh driver and place in ‘target’ | 11:57 |
| samueldmq | henrynash: as a param == in the url? | 11:58 |
| *** htruta` is now known as htruta | 11:58 | |
| henrynash | samueldmq: oh, sorry….I thought you were talking abour aclling the policy engine | 11:58 |
| samueldmq | henrynash: yes I am :) | 11:58 |
| samueldmq | henrynash: let me submit another patchset, and we can discuss ther | 11:59 |
| henrynash | samuedlmq: ok! | 11:59 |
| *** ChanServ sets mode: +v topol_ | 11:59 | |
| *** topol_ is now known as topol | 11:59 | |
| henrynash | samueldmq: as an aside, I’m still struggling a little with what the right thing is to do with that patch | 11:59 |
| samueldmq | henrynash: I feel the same | 11:59 |
| samueldmq | henrynash: and this implementation (as proposed now) seems a bit risky to merge this late? | 12:00 |
| henrynash | samuedlmq: although at least won’t affect anything else (e.g. it’s localized) | 12:00 |
| samueldmq | henrynash: yes, but wewould need, for example, test all token workflows involved | 12:01 |
| samueldmq | henrynash: etc tec, it needs lots of testing | 12:01 |
| henrynash | samueldmq: agrred…and federation | 12:01 |
| samueldmq | henrynash: yes, let's rethink about it | 12:02 |
| samueldmq | henrynash: if we have a different entry in the policy ... | 12:02 |
| samueldmq | henrynash: and next cycle we decide to go with this check (as proposed now) | 12:02 |
| samueldmq | henrynash: what would be the impact ? | 12:02 |
| samueldmq | henrynash: need to deprecate things ? (since a policy entry would disappear?) | 12:02 |
| henrynash | samueldmq: yes, I think we would had a config switch to use it or not (once we had a correct solution), and teh depreacte | 12:03 |
| henrynash | ..and then deprecate | 12:03 |
| samueldmq | henrynash: either we do this, or wait for a rc (or probably N) to get it in | 12:04 |
| henrynash | samuedlmq: this feels like we need to do this in confunction with unified delgation….since it exposes the differences between regualr tokens, trusts and federation | 12:04 |
| samueldmq | henrynash: yes, the fact they're different right now makes it harder | 12:05 |
| henrynash | (and inherited assiggnmnets) | 12:05 |
| henrynash | exactly | 12:05 |
| samueldmq | henrynash: for now I was considering skip trusts, as they don't support inherited role assignments | 12:05 |
| samueldmq | henrynash: and the way it's proposed, it would be designed for working with inherited assignmetns | 12:05 |
| henrynash | samuedlmq: …although would you explicitely stop trusts working? I guess you’d have to | 12:06 |
| samueldmq | henrynash: as per my last version o the docstring | 12:06 |
| -openstackstatus- NOTICE: Infra currently has a long backlog. Please be patient and where possible avoid rechecks while it catches up. | 12:06 | |
| samueldmq | henrynash: well, trust scoped tokens would only work (in the current proposal) if the policy was like: | 12:06 |
| samueldmq | "update_project": "" | 12:06 |
| samueldmq | or didn't check on target: like "update_rpoject": "role:admin" | 12:07 |
| henrynash | samueldmq: is the user_id of a trust token the trustor or trustee (of neither)? | 12:08 |
| henrynash | (or neither) | 12:08 |
| samueldmq | henrynash: I don't know, would need to check | 12:08 |
| samueldmq | henrynash: also I am not 100% familiar with all tokens workflows | 12:08 |
| henrynash | samuedlmq: if it is trustor or trustee…would the current code just kick in and try and run the current algorithm... | 12:09 |
| samueldmq | henrynash: which increase prob of something going wrong | 12:09 |
| henrynash | samueldmq: yep | 12:09 |
| samueldmq | henrynash: yes, the current algorithm, in the worst case, tries to use the original token for all projects | 12:10 |
| samueldmq | henrynash: so I think we're agreeing to postpone this a little bit | 12:10 |
| samueldmq | henrynash: as it needs broader discussions | 12:10 |
| henrynash | samuedlmq: if we do anything now, the only (easily depreacted) solution would be a separate policy endpoint….otherwise it’s going to be too confusing to migrate | 12:11 |
| henrynash | samueldmq: what doees the current master code actually do? | 12:11 |
| henrynash | samueldmq: i.e. if what will Mitaka code do if we don’t change anything | 12:11 |
| samueldmq | henrynash: what do you mean by master? | 12:11 |
| samueldmq | henrynash: the proposed code ? | 12:12 |
| samueldmq | henrynash: so if we don't change anything, mitaka code doesnt expose the API for ?cascade | 12:12 |
| henrynash | samueldmq: ah, ok | 12:12 |
| henrynash | samueldmq: so it’s safe, at least | 12:12 |
| samueldmq | henrynash: and honestly, otherwise someone really *needs* this feature now | 12:13 |
| samueldmq | henrynash: I vote for postponing and having broader discussions at the summit | 12:13 |
| henrynash | samueldmq: I tend to agree, given our uncertainty over teh correct policy decision, I support postponement | 12:14 |
| samueldmq | henrynash: ++ | 12:14 |
| samueldmq | stevemar: cc ^ | 12:14 |
| samueldmq | stevemar: given that neither henrynash and myself are not 100% confident we are going towards the right direction in the current proposal for ?cascade operations | 12:15 |
| samueldmq | stevemar: we propose to postpone this feature; we believe this needs further discussion and may be influenced (positively) by unified delegation | 12:15 |
| samueldmq | henrynash: rodrigods also had an interesting comment on patchset 25 https://review.openstack.org/#/c/243585 | 12:16 |
| henrynash | samueldmq: agreed | 12:17 |
| *** EinstCrazy has joined #openstack-keystone | 12:17 | |
| samueldmq | henrynash: perfect, I am going to focus on reseller review now | 12:17 |
| samueldmq | henrynash: which is much more important to get now imo | 12:17 |
| henrynash | samuedlmq: ok, thanks | 12:18 |
| rodrigods | henrynash, samueldmq, ++ to postpone and... regarding hierarchical quotas, i think this is how they are doing right now | 12:18 |
| rodrigods | "branch rights" | 12:18 |
| *** daemontool_ has quit IRC | 12:18 | |
| samueldmq | rodrigods: nice | 12:19 |
| henrynash | samueldmq: one of the reasons I want to try and get it in is that we know many projects are designing their nested quota systems….and having projects as a domain as part of their models is important | 12:19 |
| samueldmq | henrynash: an immediate question that comes to my mind on that patch ( | 12:19 |
| samueldmq | Projects acting as domains) | 12:19 |
| *** clenimar has joined #openstack-keystone | 12:19 | |
| samueldmq | henrynash: do we have *all* domain calls at manager level equally tested with domain projects ? | 12:19 |
| henrynash | samuedlmq: it’s a good question….I think most, but I’ll review that. thx | 12:20 |
| *** daemontool has joined #openstack-keystone | 12:20 | |
| samueldmq | henrynash: nice, I will look as well | 12:22 |
| henrynash | smauedlmq: looks well tested - see test_v3_resource | 12:26 |
| samueldmq | henrynash: looking | 12:27 |
| henrynash | samueldmq: we mereged the tests in a previous patch | 12:27 |
| samueldmq | henrynash: also I have something to mention ... something related (functional tests) that you may support for keystone as well | 12:27 |
| samueldmq | henrynash: data driven functional tests (HTTP level) | 12:28 |
| samueldmq | henrynash: see http://gabbi.readthedocs.org/en/latest/ | 12:28 |
| henrynash | samueldmq: yes….had been thikning about that | 12:28 |
| *** gordc has joined #openstack-keystone | 12:32 | |
| *** jasonsb has joined #openstack-keystone | 12:32 | |
| *** daemontool has quit IRC | 12:32 | |
| *** jaosorior has quit IRC | 12:33 | |
| *** jaosorior has joined #openstack-keystone | 12:34 | |
| *** daemontool has joined #openstack-keystone | 12:34 | |
| *** jasonsb has quit IRC | 12:37 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the migration issue for the user doesn't have a password https://review.openstack.org/285152 | 12:38 |
| *** rk4n_ has joined #openstack-keystone | 12:39 | |
| *** rk4n has quit IRC | 12:42 | |
| *** Guest33875 has quit IRC | 12:45 | |
| *** nisha has joined #openstack-keystone | 12:45 | |
| *** huats_ has joined #openstack-keystone | 12:47 | |
| *** markvoelker has joined #openstack-keystone | 12:48 | |
| openstackgerrit | Jacek Tomasiak proposed openstack/keystoneauth: Fix typos and improve formatting in migrating.rst https://review.openstack.org/286018 | 12:50 |
| *** markvoelker has quit IRC | 12:53 | |
| *** pcaruana has quit IRC | 12:53 | |
| *** josecastroleon has joined #openstack-keystone | 12:54 | |
| *** daemontool has quit IRC | 12:55 | |
| *** daemontool has joined #openstack-keystone | 12:55 | |
| *** daemontool has quit IRC | 12:56 | |
| *** nisha_ has joined #openstack-keystone | 12:57 | |
| *** daemontool has joined #openstack-keystone | 12:59 | |
| *** nisha has quit IRC | 13:01 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Fix the migration issue for the user doesn't have a password https://review.openstack.org/285152 | 13:03 |
| *** nisha__ has joined #openstack-keystone | 13:03 | |
| *** Oku_OS has joined #openstack-keystone | 13:05 | |
| *** fpatwa_ has joined #openstack-keystone | 13:06 | |
| *** nisha_ has quit IRC | 13:06 | |
| *** pcaruana has joined #openstack-keystone | 13:08 | |
| raildo | ayoung: I loved the "ValueError: day is out of range for month" error :P | 13:09 |
| *** huats_ has quit IRC | 13:10 | |
| ayoung | raildo, nothing is going to pass today. I also wonder about all the systems out there running OpenStack. It could be really bad | 13:10 |
| *** fpatwa_ has quit IRC | 13:11 | |
| *** huats_ has joined #openstack-keystone | 13:11 | |
| *** huats_ has quit IRC | 13:11 | |
| *** huats_ has joined #openstack-keystone | 13:11 | |
| raildo | ayoung: yes, it's awkward, what if we send a patch changing the date for a valid year? | 13:12 |
| *** nisha_ has joined #openstack-keystone | 13:12 | |
| samueldmq | raildo: ayoung: sdague has a patch earlier today to fix our tests | 13:13 |
| samueldmq | see https://review.openstack.org/285987 | 13:13 |
| *** nisha__ has quit IRC | 13:16 | |
| *** links has quit IRC | 13:18 | |
| raildo | samueldmq: awesome, thanks! | 13:18 |
| samueldmq | raildo: np | 13:20 |
| *** nisha has joined #openstack-keystone | 13:20 | |
| samueldmq | henrynash: we have people using their own drivers in keystone right ? | 13:20 |
| samueldmq | henrynash: I mean, do we really want to support legacy drivers for everything ? that's a lot of effort | 13:20 |
| henrynash | samueldmq: well, that’s aways the theory! | 13:20 |
| henrynash | samueldmq: and racksapce certainly used to | 13:21 |
| samueldmq | henrynash: probably people have token drivers ? but I doubt for other backends like resource, etc | 13:21 |
| henrynash | samueldmq: we’ve made that commitment, and, at least for now, I guess we have to conitnue (and yes, is a PITA) | 13:21 |
| samueldmq | henrynash: we should probably consider asking people about that, and probably remove legacy support where we don't need to | 13:22 |
| samueldmq | (good for everyone at the end) | 13:22 |
| samueldmq | henrynash: but yes, for now it's the commitment, can't change without asking | 13:22 |
| *** nisha__ has joined #openstack-keystone | 13:22 | |
| henrynash | samueldmq: I guess one problem is that we might not know during cycle Y that someone had just built a driver based on cycle X…and then we break them | 13:23 |
| *** nisha_ has quit IRC | 13:23 | |
| samueldmq | henrynash: could we ask -operators ? and see who effectively uses this | 13:24 |
| samueldmq | henrynash: do other projects support htis too ? | 13:24 |
| henrynash | samueldmq: so cinder and neutron would be interesting to ask, since they must do a LOT of this | 13:25 |
| *** edmondsw has joined #openstack-keystone | 13:25 | |
| samueldmq | henrynash: ++ | 13:25 |
| samueldmq | henrynash: about reseller .. | 13:25 |
| samueldmq | henrynash: did we support is_domain projs in L ? | 13:25 |
| samueldmq | henrynash: nevermind, I am always confused with the purpose of our legacy driver | 13:26 |
| henrynash | samueldmq: it was a defined attribute, but reserved for future use | 13:26 |
| *** nisha has quit IRC | 13:26 | |
| samueldmq | I got it | 13:26 |
| samueldmq | henrynash: L1372 https://review.openstack.org/#/c/231289/61/keystone/resource/core.py | 13:28 |
| patchbot | samueldmq: patch 231289 - keystone - Projects acting as domains | 13:28 |
| samueldmq | henrynash: the old driver didn't expect any project to appear inthe domain table, why do we have to query on both tables (domain and projs) ? | 13:28 |
| *** nisha__ has quit IRC | 13:29 | |
| *** huats_ has quit IRC | 13:30 | |
| henrynash | samuedlmq: because we are responsind to a list_projects call from the manager…which DOES expect to (in the case of no filter) to see both, so we have to extract the match from both tables | 13:30 |
| henrynash | samueldmq: the manager list_domains, calls list_projects_acting_as_domains, so that one is fine | 13:31 |
| *** huats_ has joined #openstack-keystone | 13:31 | |
| samueldmq | henrynash: manager expects is_domain projects to be returned (and those are still in the domain table) | 13:34 |
| samueldmq | henrynash: right? | 13:34 |
| henrynash | samueldmq: so for list_projects, it expects both, no? | 13:34 |
| henrynash | samueldmq: (which we don’t allow via the API today, but at the manager level we do) | 13:35 |
| samueldmq | henrynash: okay, don't we need to do he same for list_projects_from_ids ? | 13:35 |
| samueldmq | henrynash: since manager may be querying an is_domain project that is still at the legacy domain table ? | 13:35 |
| henrynash | samuelmdq: we do…which is why we call get_project for each ID and it will get it from the right table | 13:36 |
| samueldmq | henrynash: agreed | 13:36 |
| samueldmq | henrynash: in the new manager, can I call list_projects_in_subtree(None) ? | 13:42 |
| samueldmq | henrynash: in the old I could too, I guess | 13:42 |
| *** Guest45139 is now known as amakarov | 13:43 | |
| *** fawadkhaliq has joined #openstack-keystone | 13:43 | |
| samueldmq | henrynash: left a couple of comments/questions | 13:46 |
| henrynash | samueldmq: project_id==None is caught by _assert_valid_project_id | 13:46 |
| henrynash | samueldmq: ok, will look , thx | 13:46 |
| *** markvoelker has joined #openstack-keystone | 13:47 | |
| *** ninag has joined #openstack-keystone | 13:47 | |
| *** daemontool has quit IRC | 13:48 | |
| *** henrynash has quit IRC | 13:51 | |
| *** daemontool has joined #openstack-keystone | 13:54 | |
| *** daemontool_ has joined #openstack-keystone | 13:55 | |
| *** links has joined #openstack-keystone | 13:58 | |
| *** daemontool has quit IRC | 13:59 | |
| *** mhickey has joined #openstack-keystone | 14:06 | |
| edmondsw | have y'all seen UTs failing today because of the leap year? | 14:09 |
| edmondsw | things like datetime.datetime.utcnow().replace(year=2030) fail with "ValueError: day is out of range for month" because there is no Feb 29 in 2030 | 14:11 |
| edmondsw | working on a patch if nobody else already is | 14:11 |
| samueldmq | edmondsw: https://review.openstack.org/#/c/285987/ | 14:11 |
| patchbot | samueldmq: patch 285987 - keystone - Make keystone tests work on leap years | 14:11 |
| edmondsw | tx samueldmq | 14:12 |
| *** Nirupama has quit IRC | 14:12 | |
| samueldmq | edmondsw: np | 14:13 |
| edmondsw | samueldmq hmm... looks like he only caught some of the places | 14:16 |
| edmondsw | 2030 isn't a leap year either | 14:16 |
| edmondsw | and that's used in at least 3 places I saw | 14:16 |
| *** links has quit IRC | 14:16 | |
| *** boris-42 has joined #openstack-keystone | 14:16 | |
| *** diazjf has joined #openstack-keystone | 14:17 | |
| *** bknudson has left #openstack-keystone | 14:19 | |
| *** bknudson has joined #openstack-keystone | 14:19 | |
| *** ChanServ sets mode: +v bknudson | 14:19 | |
| *** pauloewerton has joined #openstack-keystone | 14:20 | |
| *** andrewbogott has quit IRC | 14:21 | |
| *** andrewbogott has joined #openstack-keystone | 14:21 | |
| edmondsw | henrynash samueldmq that patch is already +workflow... but I don't think it can merge until the 2030 cases | 14:23 |
| edmondsw | should I throw up another patch there, or do we need to do something like remove the +workflow first? | 14:23 |
| bknudson | edmondsw: if you post a new revision it will remove it from the merge queue | 14:24 |
| bknudson | also, if the unit tests aren't going to pass it's not going to merge | 14:25 |
| lupine | seems like today is a very bad day for me to try to get the tests passing locally :D | 14:26 |
| marekd | dolphm: for the patch https://review.openstack.org/#/c/284943 it's not only the tests that miss | 14:28 |
| marekd | but some logic as well | 14:28 |
| marekd | dolphm: i am working on this | 14:28 |
| marekd | dolphm: we will need to actually fetch role assignments for user and mix them with roles for groups | 14:28 |
| marekd | otherwise we will not be backwards compatible. | 14:29 |
| dolphm | marekd: ++ that's exactly what i was hoping to get out of the test | 14:29 |
| *** jsavak has joined #openstack-keystone | 14:30 | |
| dolphm | marekd: thanks for your help! | 14:30 |
| bknudson | unit tests are still failing even with https://review.openstack.org/#/c/285987/ | 14:32 |
| patchbot | bknudson: patch 285987 - keystone - Make keystone tests work on leap years | 14:32 |
| *** mylu has joined #openstack-keystone | 14:34 | |
| *** sdake has joined #openstack-keystone | 14:35 | |
| bknudson | edmondsw: you working on a fix for the unit tests? | 14:35 |
| edmondsw | yeah, tox recreate is just taking a while | 14:35 |
| bknudson | failing tests are keystone.tests.unit.test_v3_auth.TestTrustRedelegation.test_redelegate_with_role_by_name keystone.tests.unit.test_v3_auth.TestTrustRedelegation.test_roles_subset keystone.tests.unit.test_v3_auth.TestTrustRedelegation.test_redelegation_terminator | 14:36 |
| edmondsw | yep | 14:36 |
| *** mylu has quit IRC | 14:38 | |
| *** pcaruana has quit IRC | 14:38 | |
| openstackgerrit | Matthew Edmonds proposed openstack/keystone: Make keystone tests work on leap years https://review.openstack.org/285987 | 14:39 |
| marekd | dolphm: no problem. | 14:40 |
| edmondsw | samueldmq henrynash bknudson ^ that should fix the tests | 14:41 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:42 | |
| *** mylu has joined #openstack-keystone | 14:42 | |
| *** knikolla has joined #openstack-keystone | 14:42 | |
| *** woodster_ has joined #openstack-keystone | 14:49 | |
| *** pcaruana has joined #openstack-keystone | 14:52 | |
| *** rk4n_ has quit IRC | 14:55 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Constraint to prevent duplicate endpoints https://review.openstack.org/134095 | 14:56 |
| *** rk4n has joined #openstack-keystone | 14:56 | |
| *** doug-fish has joined #openstack-keystone | 14:56 | |
| *** sdake has quit IRC | 14:58 | |
| *** EinstCra_ has joined #openstack-keystone | 15:01 | |
| *** EinstCra_ has quit IRC | 15:02 | |
| *** EinstCrazy has quit IRC | 15:02 | |
| *** lennyb__ is now known as lennyb | 15:03 | |
| *** EinstCrazy has joined #openstack-keystone | 15:03 | |
| *** nisha has joined #openstack-keystone | 15:03 | |
| *** henrynash has joined #openstack-keystone | 15:06 | |
| *** ChanServ sets mode: +v henrynash | 15:06 | |
| *** fpatwa_ has joined #openstack-keystone | 15:07 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:10 |
| *** fpatwa_ has quit IRC | 15:12 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Shadow users - Concrete role assignments for federated users https://review.openstack.org/284943 | 15:12 |
| *** permalac has joined #openstack-keystone | 15:19 | |
| *** permalac has quit IRC | 15:19 | |
| *** permalac has joined #openstack-keystone | 15:20 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 15:21 |
| *** phalmos has joined #openstack-keystone | 15:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Concrete role assignments for federated users https://review.openstack.org/284943 | 15:25 |
| ayoung | edmondsw, I Wonder why the tests with 2030 don;'t fail either. | 15:27 |
| ayoung | edmondsw, because I just saw them failing when I rebased my most recent patch on them | 15:28 |
| *** jorge_munoz has joined #openstack-keystone | 15:28 | |
| *** mylu has quit IRC | 15:28 | |
| edmondsw | ayoung they do fail... or rather, did until I fixed them | 15:28 |
| ayoung | edmondsw, ah, maybe I rebased on the earlier patch | 15:29 |
| henrynash | dstanek: ping | 15:29 |
| ayoung | edmondsw, cool I'll grab yours. THanks | 15:29 |
| edmondsw | 2031 references were earlier in each method, so those were hit first and it didn't get to 2030. But when you fix the 2031 references and rerun the UTs, the 2030 references fail | 15:29 |
| *** timcline has quit IRC | 15:29 | |
| edmondsw | ayoung ^ | 15:30 |
| ayoung | edmondsw, we should be using real Calendar tools. | 15:30 |
| edmondsw | ayoung, absolutely this isn't the best way to fix it... just the quickest | 15:31 |
| edmondsw | to get things unblocked | 15:31 |
| ayoung | edmondsw, well I wish I had known the sdagues patch was untested. Easy enough to test. I assume you ran the whole battery? | 15:32 |
| notmorgan | lol | 15:32 |
| notmorgan | really leap years fail? | 15:32 |
| notmorgan | *facepalm* | 15:32 |
| edmondsw | ayoung, I just reran the failing tests, but yeah, I ran each of those | 15:32 |
| notmorgan | is this a python screwup or a keystone screwup? | 15:32 |
| ayoung | notmorgan, a little of both | 15:32 |
| ayoung | notmorgan, we are using datetime, and changing the year | 15:33 |
| ayoung | this fix is still wonky, but if it gets through the tests, we'll do a better one | 15:33 |
| notmorgan | so strictly us | 15:33 |
| edmondsw | notmorgan yes | 15:33 |
| notmorgan | you coule we could also do datetime(day=20, year=2032) | 15:33 |
| notmorgan | i would recommend that rather than being "smart" | 15:34 |
| notmorgan | and trying to cover edge cases - use a known day | 15:34 |
| ayoung | notmorgan, year == utcnow.year + 20 | 15:34 |
| ayoung | keep rolling it forward | 15:34 |
| notmorgan | right until you overrun unixtime and hit another edge case. | 15:34 |
| stevemar | o/ | 15:35 |
| stevemar | keystone doesn't do leap days, that's just awesome | 15:35 |
| notmorgan | lets not be "clever" here. lets use a fixed date, if we have to fix the tests in 2030, we did something very right | 15:35 |
| *** mylu has joined #openstack-keystone | 15:36 | |
| bknudson | just try to be retired by 2030 | 15:36 |
| notmorgan | i -1 | 15:36 |
| notmorgan | 'd the review with the comment | 15:36 |
| notmorgan | feel free to still +A it | 15:36 |
| notmorgan | just a dissenting opinion | 15:36 |
| dstanek | henrynash: pong | 15:37 |
| samueldmq | stevemar: I had read something like: "make keystone works in leap years"; and thought wow hehe | 15:37 |
| *** jaosorior is now known as jaosorior_away | 15:37 | |
| henrynash | dstanek: hi - wanted to check in on the projects acting as a domain….are you in agreement that we are at least provding the right level of backward compatibility (albiet you might prefer that we push the logic into teh driver layer) | 15:38 |
| henrynash | https://review.openstack.org/#/c/231289 | 15:38 |
| samueldmq | notmorgan: you mean a completly fixed date vs current day/month in a different year? | 15:38 |
| notmorgan | samueldmq: yep | 15:38 |
| ayoung | notmorgan, let's force it past unixtime at a minimum.... | 15:39 |
| samueldmq | notmorgan: yeah, makes sense to me too | 15:39 |
| notmorgan | ayoung: works for me, just a dissenting opinion on the fix to not be "today in 2032" or whaever, it isn't a good test, if we want to check every date, we write a test to check every date :P | 15:40 |
| notmorgan | ayoung: like i said, feel free to +A the change to unblock things as well, I wouldn't hold it up. | 15:40 |
| ayoung | notmorgan, no, you are right on, but if we can't handle Unix time yet, we need to address that first, and then make expiry something unsurpring in our tests second | 15:40 |
| ayoung | notmorgan, I need your help on something | 15:40 |
| notmorgan | ayoung: i shall try | 15:40 |
| notmorgan | unrelated, i get my 802.11s network today! :) | 15:41 |
| ayoung | notmorgan, I was working on reducing the revocation events, and instead re-validating the auth data on token validation | 15:41 |
| ayoung | in doing so, I had to remove the MEMOIZE calls in the token provider | 15:41 |
| ayoung | is this a real problem, or will we be OK due to caching in the other drivers? | 15:41 |
| notmorgan | ayoung: in the token provider or in the token persistence? | 15:41 |
| ayoung | provider | 15:41 |
| ayoung | notmorgan, I'll link: | 15:42 |
| dstanek | henrynash: i think so, but i haven't had time to go in depth. if others think it's fine i wouldn't hold that up | 15:42 |
| notmorgan | it's going to hurt because that is a lot of offloaded logic to memoization (depending on what was removed) | 15:42 |
| henrynash | dstanek: ok, just wanted to check, thx | 15:42 |
| notmorgan | but it can probably be re-spun or shuffled around a little. | 15:42 |
| *** timcline has joined #openstack-keystone | 15:42 | |
| ayoung | https://review.openstack.org/#/c/285134/4/keystone/token/provider.py | 15:42 |
| patchbot | ayoung: patch 285134 - keystone - Remove unneeded revocation events | 15:43 |
| ayoung | look at line 304 in the new | 15:43 |
| notmorgan | ayoung: that is going to make repeate token validation way way way more expensive :( | 15:43 |
| notmorgan | what was the issue you ran into w/ removing the events? | 15:43 |
| notmorgan | also invalidate_individual_token_cache is only relevant in revoke_by_audit_id/ID | 15:44 |
| ayoung | notmorgan, basically that if you memoize, you don't see changes like project inactivation or role removal | 15:44 |
| ayoung | notmorgan, so, the checks really should be done against the independant backends, not against the snapshot of the token | 15:44 |
| *** henrynash has quit IRC | 15:45 | |
| ayoung | we could do it as a cache that gets invalidated when the changes come in. | 15:45 |
| *** pushkaru has joined #openstack-keystone | 15:45 | |
| notmorgan | nah. that wont be super useful. | 15:45 |
| ayoung | But I suspect that there will be so many changes the cache will just be always invalidating, and that might hurt more | 15:45 |
| notmorgan | yeah | 15:45 |
| notmorgan | exactly | 15:45 |
| notmorgan | as long as we have caching on the other subsystems it'll be not as bad as it could be | 15:46 |
| *** nisha_ has joined #openstack-keystone | 15:47 | |
| ayoung | notmorgan, right, and if there are multiple threads, is the MEMOIZE going to actually do anything? | 15:47 |
| ayoung | or was that done assuming a greenlet impl | 15:47 |
| notmorgan | yes, because @memoize must go to a shared backend | 15:47 |
| notmorgan | we do not support per-thread caching | 15:47 |
| *** nisha_ has quit IRC | 15:48 | |
| notmorgan | so you must have a shared memcache for all keystones if caching is enabled, otherwise invalidates of the cache aren't shared | 15:48 |
| *** nisha_ has joined #openstack-keystone | 15:48 | |
| *** nisha_ has quit IRC | 15:48 | |
| notmorgan | all keystones and all threads/processes. | 15:48 |
| *** nisha_ has joined #openstack-keystone | 15:48 | |
| *** nisha_ has quit IRC | 15:48 | |
| ayoung | notmorgan, so even with caching, a token validation is not going to hit memcache several times for each validation | 15:49 |
| notmorgan | ayoung: https://review.openstack.org/#/c/272007/ will offload some of the added pain here | 15:49 |
| patchbot | notmorgan: patch 272007 - keystone - Use requst local in-process cache per request | 15:49 |
| notmorgan | ayoung: correct. | 15:49 |
| notmorgan | ayoung: with your change that is. | 15:49 |
| notmorgan | ayoung: previously a single token could be cached therefore subsequent validates will be a single hit. the request local cache helps limit the number of trips in a single request to memcache/sql as well. | 15:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Concrete role assignments for federated users https://review.openstack.org/284943 | 15:50 |
| notmorgan | i'm ok with this, but you'll need to add a releasenote | 15:50 |
| *** nisha has quit IRC | 15:50 | |
| notmorgan | specifically about this | 15:50 |
| *** nisha has joined #openstack-keystone | 15:51 | |
| ayoung | So the revocation events approach optimizes based on the assumption that the token is likely to be valid. The validate-whole-token approach optimized based on the assumption that something is going to change, or that multiple validations of the token are rare | 15:53 |
| *** wolsen has joined #openstack-keystone | 15:53 | |
| *** rderose has joined #openstack-keystone | 15:53 | |
| ayoung | notmorgan, for my needs, I don't actually give Rodents Hindquarters about revocations | 15:54 |
| ayoung | it is actually to solve a different problem, which is to drop the validation based on the cached token data for UUID tokens | 15:54 |
| ayoung | but jorge was seeing the increase size and performance issues with revocation events checking. So maybe there is no good solution here. | 15:55 |
| *** EinstCrazy has quit IRC | 15:55 | |
| notmorgan | request local cache will help some, and clearly calling out that tokens validates themselves are not cached. | 15:55 |
| notmorgan | not that they were cached post rev event processing anyway | 15:56 |
| notmorgan | that caching is needed on the other subsystems to ensure smooth operation vs just token now (a fair recommendation) | 15:56 |
| *** slberger has joined #openstack-keystone | 15:58 | |
| *** roxanaghe has joined #openstack-keystone | 15:58 | |
| ayoung | tox -e py27 -- keystone.tests.unit.test_v2.V2TestCase.test_remove_role_revokes_token passes | 16:02 |
| ayoung | tox -e py27 -- keystone.tests.unit.test_v2.V2TestCase passes | 16:02 |
| ayoung | tox -e py27 -- keystone.tests.unit.test_v2 fails on the above test | 16:02 |
| ayoung | double you tee eff | 16:02 |
| *** jsavak has quit IRC | 16:03 | |
| *** jsavak has joined #openstack-keystone | 16:04 | |
| ayoung | GAH HEISENBUG | 16:05 |
| notmorgan | ayoung: hehe | 16:05 |
| ayoung | notmorgan, actually, might be the same test is run in multiple suites | 16:06 |
| notmorgan | ah | 16:06 |
| notmorgan | yeah that happens | 16:06 |
| notmorgan | less heisenbug more "different setup = different results" | 16:07 |
| ayoung | well, change it for one, it fails in the other. But I thought I saw a com,plete tox -epy27 run last night | 16:07 |
| ayoung | keystone.tests.unit.test_v2.RevokeApiTestCase.test_remove_role_revokes_token | 16:07 |
| ayoung | keystone.tests.unit.test_v2.V2TestCase.test_remove_role_revokes_token | 16:07 |
| ayoung | hmmm | 16:08 |
| *** henrynash has joined #openstack-keystone | 16:10 | |
| *** ChanServ sets mode: +v henrynash | 16:10 | |
| *** browne has joined #openstack-keystone | 16:11 | |
| ayoung | and this leads to even more code efficiency! ooh, I like this | 16:15 |
| *** rcernin has quit IRC | 16:16 | |
| *** fawadkhaliq has quit IRC | 16:17 | |
| *** pcaruana has quit IRC | 16:17 | |
| ayoung | notmorgan, what is the right way to do expires = datetime.something.('2032, 2, 29') | 16:23 |
| notmorgan | ayoung: explain? | 16:23 |
| notmorgan | not sure what you're asking | 16:23 |
| ayoung | notmorgan, addressing your comment | 16:23 |
| notmorgan | oh | 16:23 |
| notmorgan | uhm. | 16:23 |
| samueldmq | ayoung: notmorgan: I am doing it with just putting the string directly '2031-02-18T18:10:00Z' | 16:24 |
| ayoung | I'm going to make our test date be leap years day in 2032 | 16:24 |
| notmorgan | datetime.datetime(day=<day>, month=<month>, year=<year>) | 16:24 |
| openstackgerrit | Jacek Tomasiak proposed openstack/keystoneauth: Fix typos and improve formatting in migrating.rst https://review.openstack.org/286018 | 16:24 |
| samueldmq | taht can be passed to new_trust_ref | 16:24 |
| notmorgan | would be the best choice. | 16:24 |
| *** belmoreira has quit IRC | 16:24 | |
| notmorgan | but you can also strftime it or is it strptime | 16:24 |
| ayoung | samueldmq, that works. | 16:24 |
| notmorgan | whatever there is a way to STR->DATETIMe easier to use the string | 16:24 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 16:25 | |
| * samueldmq is running the tests | 16:25 | |
| ayoung | samueldmq, set it once in the core test file and use | 16:25 |
| ayoung | unit.FUTURE_EXPIRY | 16:25 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 16:25 | |
| notmorgan | ayoung: next monday I am swinging through Boston btw | 16:25 |
| ayoung | notmorgan, excellent! | 16:25 |
| *** mylu has quit IRC | 16:25 | |
| ayoung | notmorgan, breakfast, lunch, coffee, or dinner? | 16:26 |
| notmorgan | ayoung: dunno if i'm going to NH that day or just bumming around until i catch a flight home. | 16:26 |
| notmorgan | one of those for sure! | 16:26 |
| notmorgan | if i'm headed to NH, i'll also be back through on wed | 16:26 |
| ayoung | Where in NH? | 16:26 |
| notmorgan | unfortunately, my friends are in the bahamas atm, so hard to coordinate | 16:26 |
| notmorgan | portsmouth | 16:26 |
| notmorgan | might be going snowboarding for a day on tuesday | 16:27 |
| notmorgan | figured i was on the east coast anyway, so what's an extra day? ;) | 16:27 |
| ayoung | cool. Its been warm. Snowboarding might not be worth it. | 16:28 |
| *** mylu has joined #openstack-keystone | 16:28 | |
| notmorgan | right now it looks like i wont make it to NH, if i can't get ahold of my friends, just gonna book my flight home from BOS | 16:28 |
| ayoung | it was 50 degress when I last checked down here...same yesterday | 16:28 |
| notmorgan | on monday | 16:28 |
| *** rodrigods has quit IRC | 16:29 | |
| * notmorgan taps foot and waits for fedex >.< | 16:29 | |
| *** rodrigods has joined #openstack-keystone | 16:29 | |
| notmorgan | topol: you've been awfully quiet. | 16:29 |
| *** timcline has quit IRC | 16:30 | |
| ayoung | samueldmq, what call are you making to do the string parsing? | 16:31 |
| ayoung | Oh, we can just do | 16:31 |
| notmorgan | ayoung: internally it does strptime | 16:32 |
| ayoung | ref['expires_at'] = '2031-02-18T18:10:00Z' | 16:32 |
| notmorgan | if it's a known string, so yeah | 16:32 |
| samueldmq | ayoung: yes | 16:32 |
| ayoung | notmorgan, we have | 16:32 |
| ayoung | ref['expires_at'] = datetime.datetime.utcnow().replace( | 16:32 |
| ayoung | year=2032).strftime(unit.TIME_FORMAT) | 16:32 |
| samueldmq | ayoung: that's what I am doing | 16:32 |
| ayoung | so yeah, IO think that is s astring | 16:32 |
| ayoung | OK... | 16:32 |
| * samueldmq is running tests | 16:32 | |
| notmorgan | it can be a followup patch btw samueldmq | 16:32 |
| notmorgan | if you want to just +A the current fix. | 16:33 |
| notmorgan | so things can gate | 16:33 |
| ayoung | notmorgan, will do | 16:33 |
| ayoung | it is holding me up | 16:33 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add hints to list_services for templated backend https://review.openstack.org/286142 | 16:34 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: add hints to list_services for templated backend https://review.openstack.org/286142 | 16:34 |
| samueldmq | notmorgan: done | 16:34 |
| samueldmq | ayoung: oops | 16:34 |
| ayoung | heh... | 16:35 |
| openstackgerrit | ayoung proposed openstack/keystone: Remove unneeded revocation events https://review.openstack.org/285134 | 16:37 |
| *** nkinder has joined #openstack-keystone | 16:38 | |
| openstackgerrit | ayoung proposed openstack/keystone: Remove unneeded revocation events https://review.openstack.org/285134 | 16:38 |
| ayoung | ooh that is nice! | 16:39 |
| ayoung | rebase in the webui | 16:39 |
| stevemar | jeez, our tests for the templated backend are broken as hell | 16:39 |
| *** mylu has quit IRC | 16:42 | |
| stevemar | bknudson: thanks for releasing a new ksc | 16:42 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Use a fixed expiry date in keystone tests https://review.openstack.org/286148 | 16:42 |
| notmorgan | stevemar: the whole concept of the templated backend is broken | 16:43 |
| notmorgan | stevemar: maybe i'll write the yaml based one today and we can just deprecate the current one? | 16:43 |
| samueldmq | ayoung: notmorgan ^ still need an update; can't use something fixed as expires_at is part of the unique constraint | 16:43 |
| bknudson | stevemar: y, I don't know what we do to get meta info in the list results | 16:43 |
| samueldmq | so tests are giving duplicated erros hehe | 16:43 |
| bknudson | stevemar: since whatever we do seems to break the world | 16:43 |
| ayoung | hehehehehhe | 16:43 |
| ayoung | we don't make it easy | 16:43 |
| samueldmq | ayoung: :-) | 16:44 |
| *** mhickey has quit IRC | 16:45 | |
| stevemar | bknudson: don't rage quit on me now | 16:45 |
| *** amakarov has quit IRC | 16:46 | |
| *** pkarikh has quit IRC | 16:46 | |
| * notmorgan rage quits | 16:46 | |
| notmorgan | oh wait | 16:46 |
| ayoung | 2032 will get the tests to pass. But..are we dealing with unix time here? Will adding 3 decades break things | 16:47 |
| ayoung | ? | 16:47 |
| *** pkarikh has joined #openstack-keystone | 16:47 | |
| notmorgan | the datetime object wont | 16:48 |
| notmorgan | but... fernet might? | 16:48 |
| notmorgan | >>> datetime.datetime(month=2, day=20, year=3000) | 16:49 |
| notmorgan | datetime.datetime(3000, 2, 20, 0, 0) | 16:49 |
| notmorgan | samueldmq: ok, so use a fixed day/month/year and let the time be "flexible" | 16:51 |
| notmorgan | samueldmq: that is closer to a real production use-case anyway | 16:52 |
| *** amakarov has joined #openstack-keystone | 16:52 | |
| marekd | dolphm: erm.... | 16:53 |
| marekd | dolphm: i'd rather want you take a close look at some implementation details of def shadow users because i think this means touching lots of sensitive logic. | 16:54 |
| marekd | dolphm: we will need to relax some constraints when it comes to popularing roles assigned to users and their groups | 16:54 |
| samueldmq | notmorgan: ayoung: def get_future_expiry_str(hour, minute, second) in unit core ? | 16:54 |
| dolphm | marekd: rderose: how so? | 16:54 |
| samueldmq | with fixed day/month:year | 16:54 |
| notmorgan | samueldmq: *shrug* | 16:55 |
| marekd | dolphm: and since it means relaxing constraints it means throughtful thinking about potential breaking security stuff. | 16:55 |
| ayoung | samueldmq, nah...I'm giving up on this | 16:55 |
| dolphm | marekd: (what constraints?) | 16:55 |
| *** petertr7 is now known as petertr7_away | 16:55 | |
| *** daemontool_ has quit IRC | 16:55 | |
| marekd | dolphm: we need to support role assignments from a) role assignment between fed user and a project/domain but also role assignments between groups and project/domains | 16:55 |
| dolphm | marekd: gotcha, ++ | 16:56 |
| marekd | dolphm: and roles must be additive, otherwise we will badly break whole federation assumption we ve been talking about past 2+ years | 16:56 |
| dolphm | marekd: how would they be non-additive? | 16:56 |
| dolphm | would/might | 16:56 |
| marekd | dolphm: either 'classic role assignments' or 'groups only' | 16:57 |
| marekd | dolphm: look, what i need to do now is: populate roles for user_id where user is a shadow user and later populate roles for groups assigned as mapping effect | 16:57 |
| dolphm | marekd: i don't know if it's possible for mitaka, but i'd like federated group memberships to become 'classic group memberships' (so the output of mapping is "here's a user ID, it's already been added to 3 groups in SQL" | 16:58 |
| marekd | now, guess what happens if the user doesn't have role assignment for a project. it raises Unauthorized | 16:58 |
| marekd | because this is how we treat normal users | 16:58 |
| marekd | no role assignemnt -> 401 | 16:58 |
| marekd | hm i can catch exception | 16:58 |
| marekd | but it's smelly :( | 16:58 |
| rderose | dolphm: reading... | 16:59 |
| *** petertr7_away is now known as petertr7 | 17:01 | |
| marekd | dolphm: i doubt it is possible, because my understandind we still need to preserve old behaviour | 17:03 |
| notmorgan | stevemar: http://paste.openstack.org/show/488605/ something like that as the templated catalog input? | 17:06 |
| *** sdake has joined #openstack-keystone | 17:06 | |
| notmorgan | stevemar: rather than "source a blob of json and string replace and hope it works" | 17:06 |
| dolphm | marekd: the old behavior of ephemeral group memberships? | 17:06 |
| dolphm | marekd: or? | 17:06 |
| marekd | dolphm: old behavior | 17:06 |
| dolphm | marekd: old behavior of what? | 17:06 |
| notmorgan | stevemar: /me was going to try and be clever and do node references as well.. but ugh | 17:06 |
| marekd | dolphm: dynamic assignment of groups and resolving roles assignment based on group membership. | 17:07 |
| notmorgan | stevemar: or so we really jus tnot care about the templated catalog. | 17:08 |
| notmorgan | cause it was/is dropped from devstack | 17:08 |
| stevemar | notmorgan: i don't like user defined IDs :| | 17:08 |
| dolphm | marekd: we can now have concrete group memberships - we don't need to maintain the old ephemeral model | 17:08 |
| *** jaosorior_away is now known as jaosorior | 17:08 | |
| *** fpatwa_ has joined #openstack-keystone | 17:08 | |
| dolphm | marekd: have the opportunity* to use | 17:08 |
| *** sheel has joined #openstack-keystone | 17:08 | |
| stevemar | notmorgan: it was dropped from devstack cause it was broken | 17:08 |
| notmorgan | stevemar: and should never be re-added | 17:08 |
| stevemar | it was broken cause we don't care about it | 17:08 |
| notmorgan | stevemar: so, if we care about having a CMS managed catalog | 17:09 |
| notmorgan | it should be something like ^ | 17:09 |
| notmorgan | as waht the CMS manages | 17:09 |
| marekd | dolphm: so we can just remove mechanism without any notification? | 17:09 |
| notmorgan | if we don't we should just deprecate the catalog | 17:09 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 17:09 |
| marekd | dolphm: tomorrow dynamic assignments are not working any more, please update your shadow users accordingly? | 17:09 |
| notmorgan | "you're on your own using this, we wont remove it but..... good luck: | 17:09 |
| dolphm | marekd: ? i'm lost on what feature we're potentially losing | 17:09 |
| henrynash | samuedlmq: have updated: https://review.openstack.org/231289 | 17:10 |
| *** dan_nguyen has joined #openstack-keystone | 17:10 | |
| henrynash | ayoung: would be good to get a thumbs up (or not) from you on that too: https://review.openstack.org/231289 | 17:10 |
| dolphm | marekd: after a mapping is applied to a saml doc, you get a user identity and a list of groups, right? | 17:10 |
| marekd | dolphm: in the mapping you specify list of groups the autenticated member will become a member | 17:10 |
| dolphm | marekd: in liberty, for example | 17:10 |
| ayoung | henrynash, happy to look. | 17:10 |
| marekd | dolphm: yep | 17:10 |
| sheel | stevemar: hi there | 17:11 |
| marekd | and based on the group are fetching roles | 17:11 |
| marekd | and match with projects etc | 17:11 |
| stevemar | sheel: hey | 17:11 |
| dolphm | marekd: so, the next step is to actually call for group_id in mapped_group_memberships: assignments_api.add_user_to_group(shadowed_user_id, group_id) | 17:11 |
| dolphm | marekd: and actually assign that user ID into all those groups | 17:11 |
| sheel | stevemar: its regarding one approval required | 17:11 |
| *** henrynash has quit IRC | 17:11 | |
| dolphm | marekd: no more ephemeral group / role management | 17:11 |
| sheel | stevemar: i tries to find you on openstack client | 17:12 |
| marekd | dolphm: is that already implemented anywhere? | 17:12 |
| sheel | stevemar: so is it ok to raise request here for https://blueprints.launchpad.net/python-openstackclient/+spec/cinder-command-support | 17:12 |
| sheel | stevemar: could you please have a look and approve it? | 17:12 |
| stevemar | sheel: there is no openstackclient channel, dtroyer and others are in #openstack-sdks for all things openstackclient | 17:12 |
| dolphm | marekd: no, i'm saying that's the missing piece of that shadow user chain, and it would be required to pass the test that is outlined in https://review.openstack.org/#/c/284943/ | 17:12 |
| patchbot | dolphm: patch 284943 - keystone - Shadow users - Concrete role assignments for feder... | 17:12 |
| sheel | stevemar: ohk... i just searched on ops | 17:13 |
| dolphm | marekd: we have the infrastructure to support concrete role assignments at that point, but no concrete role assignments for shadow users | 17:13 |
| *** fpatwa_ has quit IRC | 17:13 | |
| stevemar | sheel: let's go to #openstack-sdks and talk there | 17:13 |
| marekd | dolphm: what if admin removes group from the mapping? today they would expect user user no longer to be assiged group | 17:13 |
| sheel | stevemar: yeah sure | 17:13 |
| *** boris-42 has quit IRC | 17:14 | |
| dolphm | marekd: good question ; did the SAML doc contain an expiration on the attribute that ultimately resulted in the group membership? | 17:14 |
| ayoung | dolphm, so, I think I want to back off pushing for Fernet to be the default in Mitaka. Target that at Newton, and instead file a slew of bugs for the things that keep Fernet from being the default, and try to knock out as many of those as possible before the M release. | 17:14 |
| dolphm | marekd: if so, the correct solution would be to result in a group membership that will expire at that point, but can be refreshed with future federated auth flows | 17:15 |
| ayoung | The effort to make it the default has been a stellar bug reveal. | 17:15 |
| lbragstad | ayoung FYI - https://review.openstack.org/#/c/278693/ | 17:15 |
| patchbot | lbragstad: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 17:15 |
| dolphm | ayoung: ++ | 17:15 |
| marekd | dolphm: you are asking for attributes expiration? | 17:15 |
| ayoung | lbragstad, Cool. I have been deep in the token/trust code this weekend. | 17:16 |
| lbragstad | ayoung - those failures give me the willies | 17:16 |
| dolphm | marekd: yes, saml has a validUntil property, if i remember correctly? | 17:16 |
| ayoung | lbragstad, see https://review.openstack.org/#/c/285134/ | 17:16 |
| patchbot | ayoung: patch 285134 - keystone - Remove unneeded revocation events | 17:16 |
| lbragstad | ayoung everything passes locally - but it's tempest stuff... so something tells me it's timing related :( | 17:16 |
| ayoung | lbragstad, it might be, but there are other things I have found....l;ets see | 17:16 |
| marekd | dolphm: something like that. | 17:17 |
| ayoung | ah, 34 vs 27... | 17:17 |
| marekd | but it looks like slightly less trivial than 3 lines of Python and I think we have deadline today? | 17:17 |
| *** openstackgerrit has quit IRC | 17:18 | |
| marekd | dolphm: i am not sure what's your personal goal for Mitaka? | 17:18 |
| *** openstackgerrit has joined #openstack-keystone | 17:18 | |
| marekd | have a working shadow users? | 17:18 |
| dolphm | marekd: yes | 17:18 |
| dolphm | marekd: local, unified authorization management for federated users | 17:18 |
| marekd | so we are missing only code manages group membership from mapping engine and ideally handles group membership expiration :-) | 17:19 |
| lbragstad | ayoung have we been tagging all the bugs we come up with as 'fernet'? | 17:19 |
| dolphm | "federated users should be able to consume local role assignments just like locally-managed users can " http://specs.openstack.org/openstack/keystone-specs/specs/mitaka/shadow-users.html | 17:19 |
| lbragstad | ayoung if we're not going to be able to land fernet as the default this release then I want to prep it so that we can land it as soon as Newton opens for dev | 17:20 |
| ayoung | lbragstad, ++ | 17:20 |
| *** jasonsb has joined #openstack-keystone | 17:20 | |
| dolphm | marekd: rderose: i wasn't sure how much code that last step was going to take; if it's a non-trivial effort from where the current patchset stands, we should make the call to punt the spec to newton now | 17:20 |
| dolphm | we're on step 3 from the original work items: http://specs.openstack.org/openstack/keystone-specs/specs/mitaka/shadow-users.html#work-items | 17:21 |
| dolphm | stevemar: ^ punt shadow users to newton? | 17:21 |
| marekd | dolphm: i will see if i can propose something, and it will be up to you to decide | 17:21 |
| *** sdake has quit IRC | 17:22 | |
| marekd | but dont expect fireworks | 17:22 |
| dolphm | work items 4 and 5 can likely wait (subsequent notifications impact is just an anticipated bug-fix, and item 5 is correcting tech debt created by the spec) | 17:22 |
| stevemar | dolphm: i was actually going to approve it today | 17:22 |
| dolphm | marekd: lol | 17:22 |
| dolphm | stevemar: approve what? | 17:23 |
| *** bjornar has joined #openstack-keystone | 17:23 | |
| *** sdake has joined #openstack-keystone | 17:23 | |
| ayoung | OK...singing out for a while...back later on tonight | 17:23 |
| *** ayoung has quit IRC | 17:23 | |
| stevemar | dolphm: the latest patch rderose had to store authed users to a backend | 17:23 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:26 | |
| *** jasonsb has quit IRC | 17:26 | |
| *** daemontool_ has joined #openstack-keystone | 17:26 | |
| *** jistr has quit IRC | 17:26 | |
| dolphm | stevemar: correct, but can those users consume local role assignments? do we still have a need for federated fernet tokens, ephemeral group memberships, etc? | 17:27 |
| * lbragstad hopes we can kill federated fernet tokens | 17:27 | |
| stevemar | lbragstad: you and me both! | 17:27 |
| openstackgerrit | Marek Denis proposed openstack/keystone: Role assignment resolution for shadow users. https://review.openstack.org/286169 | 17:27 |
| marekd | dolphm: https://review.openstack.org/286169 it passes test_v3_federation tests | 17:28 |
| dolphm | marekd: is this my fireworks? | 17:28 |
| stevemar | dolphm: so those are all fine to answer in newton, administratively i'd like to leave that spec in mitaka and propose follow up blueprints or bugs for newton | 17:28 |
| marekd | dolphm: no | 17:29 |
| marekd | this should make you pass tests from https://review.openstack.org/#/c/284943/ | 17:29 |
| patchbot | marekd: patch 284943 - keystone - Shadow users - Concrete role assignments for feder... | 17:29 |
| marekd | and old tests from test_v3_federation. | 17:29 |
| * dolphm is looking at the new test | 17:30 | |
| *** david-lyle has joined #openstack-keystone | 17:30 | |
| dolphm | marekd: cool! you could make more assertions about the token that's returned (like it specifically contains the role you just assigned) | 17:32 |
| dolphm | marekd: i'd also like to see a group membership added in the same test (one that is not provided via mapping) | 17:32 |
| *** jsavak has quit IRC | 17:33 | |
| marekd | have you seen https://review.openstack.org/#/c/286169/1/keystone/token/providers/common.py ? | 17:34 |
| patchbot | marekd: patch 286169 - keystone - Role assignment resolution for shadow users. | 17:34 |
| *** jsavak has joined #openstack-keystone | 17:34 | |
| marekd | i assume tests failing due to Feb 29 are okay | 17:35 |
| *** csoukup has joined #openstack-keystone | 17:35 | |
| marekd | dolphm: otherwise this should pass our auth tests. | 17:35 |
| dstanek | rderose: pep8 doesn't check the commit messages | 17:35 |
| marekd | dolphm: i need to leave for a while | 17:36 |
| dolphm | marekd: thank you sir! | 17:36 |
| dolphm | marekd: going to be back on "today"? | 17:36 |
| dolphm | marekd: i'm going to be AFK next two days | 17:36 |
| *** fawadkhaliq has joined #openstack-keystone | 17:36 | |
| marekd | yes, in a 2hrs | 17:36 |
| dolphm | marekd: cool, ping me | 17:36 |
| marekd | need to do sth before they close the office | 17:36 |
| dolphm | (or Ron) | 17:36 |
| dolphm | rderose: *( | 17:36 |
| dstanek | rderose: https://wiki.openstack.org/wiki/GitCommitMessages#Summary_of_Git_commit_message_structure | 17:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 17:37 |
| rderose | marekd Added your test case back: | 17:39 |
| rderose | https://review.openstack.org/#/c/279162/63/keystone/tests/unit/test_v3_federation.py | 17:39 |
| patchbot | rderose: patch 279162 - keystone - Shadow users - Shadow federated users | 17:39 |
| rderose | marekd Took it out because the new FederatedUserTests class was a work-in-progress and wasn't sure I wanted to keep it. But see your point and as I said, have added it back. Thanks for your help. | 17:39 |
| dolphm | rderose: what do you mean by "marekd's test case?" | 17:40 |
| rderose | "Shadow federated users" is ready for review. I believe I have addressed all feedback this can be release independent of "concrete role assignments" | 17:40 |
| rderose | marekd push a new patch with an additional unit test | 17:41 |
| *** pece has joined #openstack-keystone | 17:41 | |
| rderose | dolphm^ | 17:41 |
| *** nisha_ has joined #openstack-keystone | 17:41 | |
| * dolphm is stepping away for food real quick | 17:42 | |
| bjornar | Is any effort beeing done to make database calls more efficient in keystone? | 17:42 |
| notmorgan | bjornar: it's a very slow process because we have a lot of "can't break" previous behaviors | 17:43 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Use a fixed expiry date in keystone tests https://review.openstack.org/286148 | 17:43 |
| *** nisha has quit IRC | 17:43 | |
| notmorgan | bjornar: the shortest fix is to ensure a given entity is only queried from the backend once per request chain. I have a patch to handle that. the next is really about fixing how we query the backends, but remember each subsystem is independant, you can't join resource to identity for example, as the backend owning the data is potentially different | 17:44 |
| samueldmq | stevemar: replied your question in patch 286148 | 17:44 |
| patchbot | samueldmq: https://review.openstack.org/#/c/286148/ - keystone - Use a fixed expiry date in keystone tests | 17:44 |
| notmorgan | bjornar: so there will always be *some* extra chattyness because it's not all run by a single driver. | 17:45 |
| bjornar | notmorgan, looking at token issue now, a total of 86 queries (including rollback/commit/select 1) | 17:45 |
| bjornar | 23 "real" queries | 17:45 |
| notmorgan | ignore the rollback/select/1 ones | 17:45 |
| samueldmq | stevemar: but it is still giving an error (I copy-psted it there) which made me curious | 17:45 |
| bjornar | notmorgan, its still packets back and forth, but ok | 17:45 |
| notmorgan | right. and we might be able to eliminate ~10 of those? | 17:45 |
| notmorgan | here let me link you my patch and you can look at how it lightens the load | 17:46 |
| notmorgan | bjornar: https://review.openstack.org/#/c/272007/ and enable caching (you don't need a shared backend for this) | 17:46 |
| patchbot | notmorgan: patch 272007 - keystone - Use requst local in-process cache per request | 17:46 |
| notmorgan | bjornar: but that should ensure we query the backends exactly 1 time for a given entitiy. it is a dodge/not a final fix | 17:46 |
| bjornar | Because looking at the queries it looks like it could be more or less one query with proper joins :/ | 17:46 |
| bjornar | really ugly | 17:47 |
| notmorgan | bjornar: again, if you are crossing subsystem boundries you can't join | 17:47 |
| notmorgan | bjornar: if you see a call for user, then role, then project | 17:47 |
| notmorgan | those have to be assumed to not be in the same backend | 17:47 |
| notmorgan | by architecture | 17:47 |
| bjornar | notmorgan, but keystone should know | 17:47 |
| notmorgan | bjornar: we *do* know, but the issue is if it isn't in the same backend we have massively different logic | 17:48 |
| *** spandhe has joined #openstack-keystone | 17:48 | |
| notmorgan | or we're hooking in to deep-dark-voodoo of SQLA to make it talk to different backends in wierd ways | 17:48 |
| notmorgan | like ORM -> LDAP | 17:48 |
| notmorgan | that is scary stuff | 17:48 |
| bjornar | But I mean.. some >X % is using sql | 17:48 |
| notmorgan | we opted for "use the same code path when getting entities from different backends" | 17:48 |
| notmorgan | so we can support driver splits without needing an insane test matrix and a lot of edge cases | 17:49 |
| notmorgan | bjornar: it isn't really feasible to use joins if everything is SQL but not use joins if things are in LDAP | 17:50 |
| notmorgan | or in something else | 17:50 |
| notmorgan | we have to treat any system with it's own driver config as separate. | 17:50 |
| bjornar | notmorgan, But it is even repeating the same queries | 17:51 |
| notmorgan | bjornar: so first step there is look at the patch i linked you | 17:51 |
| notmorgan | bjornar: that one minimizes duplicate queries as long as caching is turned on. | 17:52 |
| bjornar | But dont you guys take this seriously, sorry, but this is crappy | 17:52 |
| *** jsavak has quit IRC | 17:53 | |
| notmorgan | bjornar: look, i'm trying. seriously. the fix i proposed works in any/all memoized values even if you don't configure memcache (make the dogpile backend null). it is specifically designed to avoid queryin the backend multiple times as the first step | 17:54 |
| *** sdake has quit IRC | 17:54 | |
| bjornar | notmorgan, I mean, its even reapeating the exact same query two times in a row! | 17:55 |
| notmorgan | bjornar: the hard part is, i am only one person. I can only do so much. so if you want to dump on us for "not taking it seriously", feel free to. but it isn't the case. We also have other architectural fixes that are aimed to move us in the right direction | 17:55 |
| *** david-lyle has quit IRC | 17:55 | |
| bjornar | SELECT role.id AS role_id, role.name AS role_name, role.domain_id AS role_domain_id, role.extra AS role_extra FROM role WHERE role.id = '629f506286cd4c3191c291f8ac2f9a25' | 17:55 |
| *** david-lyle_ has joined #openstack-keystone | 17:55 | |
| bjornar | notmorgan, Sorry, I dont mean to be rude. But someone should be blamed for writing this code in the first place | 17:56 |
| notmorgan | bjornar: it wasn't "just written" like that | 17:56 |
| bjornar | I mean.. this is not a "pet-project" anymore, and keystone is some huge percentage if the total "delay" | 17:56 |
| notmorgan | bjornar: it evolved | 17:56 |
| notmorgan | and WE have been working to clean this up | 17:56 |
| bjornar | notmorgan, but if devs dont log queries.. | 17:56 |
| *** sdake has joined #openstack-keystone | 17:57 | |
| bjornar | notmorgan, I remember I sent you a big query trace like 2 years ago... if anything, its worse now! | 17:57 |
| notmorgan | bjornar: what is the "huge" delay? | 17:57 |
| notmorgan | bjornar: define a "huge" delay for me | 17:57 |
| bjornar | huge is anything above 10ms | 17:57 |
| bjornar | ;) | 17:57 |
| *** jsavak has joined #openstack-keystone | 17:57 | |
| notmorgan | because 50ms is so bad when it takes 30seconds for something else to process | 17:58 |
| notmorgan | or even 100ms | 17:58 |
| notmorgan | anyway, seriously, i am trying to address this in the shortest way possible | 17:58 |
| notmorgan | hence my proposed patch | 17:58 |
| bjornar | I will look at it. | 17:59 |
| notmorgan | until we can unwind some other things like make it so token validation doesn't have 5 or 6 different paths it could go down | 17:59 |
| notmorgan | if we have 1 or 2 paths we can start ensuring that we're not making silly calls for no reason. | 17:59 |
| dstanek | rderose: did a first pass | 17:59 |
| bjornar | notmorgan, Where can I find the document that describes what queries are done for what api calls and statistics about what api calls take the most hits? | 17:59 |
| notmorgan | but if we have 5 or 6 and 3 or 4 of those are called sometimes but no others, it's problematic | 18:00 |
| notmorgan | bjornar: osprofiler is a WIP and likely will be able to be used to do that in Newton | 18:00 |
| rderose | dstanek: cool, thx | 18:00 |
| dstanek | did keystone really break the gate for a week? | 18:00 |
| notmorgan | bjornar: we have grown to a point where we need it, but its tooling that is being developed | 18:00 |
| notmorgan | dstanek: yes, for kolla, the admin_auth_token thing | 18:01 |
| notmorgan | dstanek: iirc | 18:01 |
| bjornar | notmorgan, because that is where to start I think. Document the performance impact | 18:01 |
| *** Guest67703 is now known as me_ | 18:01 | |
| *** agireud has quit IRC | 18:01 | |
| *** me_ is now known as med_ | 18:01 | |
| bjornar | notmorgan, I can perhaps do some initial work there | 18:01 |
| *** med_ has quit IRC | 18:01 | |
| *** med_ has joined #openstack-keystone | 18:01 | |
| notmorgan | bjornar: so there is osprofiler, and it will do exactly what you want - it isn't something we can "document" by hand, we need tooling. like i said, that is a WIP | 18:01 |
| notmorgan | bjornar: and please do help! :) | 18:01 |
| notmorgan | bjornar: i expect osprofiler to be landed in Newton fwiw. | 18:02 |
| notmorgan | bjornar: support for it that is. | 18:02 |
| lbragstad | bjornar what did you use to gather your metrics? | 18:02 |
| notmorgan | and it can outline all the queries and everything done, including time spend in the cache | 18:02 |
| bjornar | lbragstad, query logs | 18:02 |
| *** henrynash has joined #openstack-keystone | 18:02 | |
| *** ChanServ sets mode: +v henrynash | 18:02 | |
| *** agireud has joined #openstack-keystone | 18:03 | |
| bjornar | notmorgan, one good start would be to "tag" queries | 18:03 |
| notmorgan | bjornar: right now we also have trace level logging in keystone that will tell you how long a manager (identity_api, assigment_api, etc) will take if enabled | 18:03 |
| dstanek | notmorgan: bummer..i didn't know that | 18:03 |
| notmorgan | bjornar: which might also help. | 18:03 |
| notmorgan | dstanek: they fixed it on their end before we fixed it on ours | 18:03 |
| notmorgan | dstanek: and they also did approve of our choice, just hit in an unfortunate way | 18:04 |
| dstanek | notmorgan: what took so long? just nobody to work on it? | 18:04 |
| bjornar | notmorgan, so a: SELECT /* trace details */ foo... | 18:04 |
| *** aginwala has joined #openstack-keystone | 18:04 | |
| notmorgan | dstanek: it was more of a "hey if the gate is broke don't land things" message | 18:04 |
| notmorgan | dstanek: we (keystone) didn't know. and they went about fixing it. | 18:04 |
| notmorgan | bjornar: if you want to work on adding that into the queires with SQLAlchemy, please do, i am not sure how to do that off the top of my head | 18:05 |
| dstanek | notmorgan: ah, ok. the recent email made it seem like we knew and didn't do anything about it | 18:05 |
| notmorgan | bjornar: the ORM somewhat makes this a bit harder. | 18:05 |
| notmorgan | dstanek: nope, we didsomething about it. this was critizing "push code through w/o things working" | 18:05 |
| openstackgerrit | Tin Lam proposed openstack/keystoneauth: Properly set ClientException message https://review.openstack.org/285757 | 18:06 |
| notmorgan | dstanek: vs "fix gate then push things through". since they can't test always in the gerrit CI they have external/nonvote/etc things to deal with | 18:06 |
| notmorgan | dstanek: technically people can push through with a fail vote as i understand it | 18:06 |
| notmorgan | bjornar: also, just make sure if you're proposing adding the trace details to the queries, that is is only enabled in "debug" mode. | 18:06 |
| bjornar | notmorgan, sure! | 18:07 |
| notmorgan | bjornar: for obvious reasons (or with a flag), this may also be something that needs to go in oslo.db | 18:07 |
| notmorgan | bjornar: so it might be easier there. take a look in both places (our core sql code is in keystone.common.sql | 18:07 |
| bjornar | notmorgan, actually it depends how "small" one makes the trace | 18:07 |
| bjornar | because if its just a "few" bytes, it might make sense to leave it on unless some flag.. I dont know | 18:08 |
| notmorgan | bjornar: i'll tell you that as long as the trace is opt-in, i'm not opposed | 18:08 |
| notmorgan | but if it's always on, i'm going to need more justification / proof that is is low impact when passed through the ORM | 18:08 |
| notmorgan | and that it doesn't do wonky things. | 18:08 |
| dstanek | rderose: let me know if you have questions | 18:08 |
| *** aginwala has quit IRC | 18:09 | |
| notmorgan | bjornar: also here is os-profiler: https://review.openstack.org/#/c/103368/ which will summarize a lot of this stuff when it lands | 18:09 |
| patchbot | notmorgan: patch 103368 - keystone - Integrate OSprofiler in Keystone | 18:09 |
| bjornar | notmorgan, Thanks, I'll check it out. | 18:09 |
| notmorgan | we now have the tech to set options in the libraries from inside keystone, so that will be a newton thing i'm sure. | 18:10 |
| notmorgan | i should poke DinaBelova about that patch see if we can getthe bits done quickly | 18:10 |
| bjornar | about the templated "bug", 1550742 .. has it been this way since early 2015? | 18:10 |
| notmorgan | bug 1550742 | 18:10 |
| openstack | bug 1550742 in OpenStack Identity (keystone) "bug listing services when using templated backend (v3)" [Medium,In progress] https://launchpad.net/bugs/1550742 - Assigned to Steve Martinelli (stevemar) | 18:11 |
| notmorgan | bjornar: yeah the templated catalog is broken and has been for a long time | 18:11 |
| notmorgan | bjornar: we're probably better off just deprecating it tbh. | 18:11 |
| bjornar | notmorgan, so noone is using it? Why? | 18:11 |
| bjornar | Is peoples catalogs changing on a daily basis? | 18:11 |
| notmorgan | bjornar: people use it, but it is very badly designed. and should be redesigned if we want to keep it | 18:12 |
| notmorgan | bjornar: basically right now it's a json blob on disk with substitutions in code. | 18:12 |
| notmorgan | bjornar: which means typos/strings being slightly off, etc on the CMS side can break everything | 18:12 |
| bjornar | yeah.. but thats fine :) | 18:12 |
| notmorgan | because it becomes invalid/partially valid/a totally different in-memory structure due to json load | 18:12 |
| notmorgan | that is terribad | 18:13 |
| notmorgan | if we want to support that, we should have structured yaml or even json that is just the elements | 18:13 |
| notmorgan | let keystone format the catalog | 18:13 |
| notmorgan | sorry, wasn't clear | 18:13 |
| *** nisha_ has quit IRC | 18:13 | |
| notmorgan | it is the complete catalog as though it was rendered by the API | 18:13 |
| *** petertr7 is now known as petertr7_away | 18:13 | |
| notmorgan | and we just substitute some values in | 18:13 |
| *** nisha has joined #openstack-keystone | 18:13 | |
| notmorgan | so it's like saying get me the catalog, sorting that result to disk via your CMS | 18:13 |
| notmorgan | that is not correct :P | 18:14 |
| notmorgan | loading some values from json/yaml and formatting it sanely would be correct | 18:14 |
| bjornar | notmorgan, should not be too hard | 18:14 |
| notmorgan | but for the most part no one uses it, since updates to your catalog shouldn't require keystone restarts, and the DB is shared across servers | 18:14 |
| notmorgan | so you don't need to coordinate CMS runs/restarts in the hopes that you don't get inconsistent catalogs | 18:15 |
| notmorgan | bjornar: all solvable/workable things, but with limited use it has a low priority | 18:15 |
| *** bjornar has quit IRC | 18:15 | |
| stevemar | notmorgan: bjornar__ actually i think that just recently broke when dstanek removed the kvs backend | 18:17 |
| notmorgan | stevemar: likely | 18:17 |
| dstanek | stevemar: broke the templated catalog? | 18:17 |
| *** bjornar has joined #openstack-keystone | 18:18 | |
| dstanek | it should work fine with the exception that we not don't allow write perations | 18:18 |
| dstanek | errr....operations | 18:18 |
| *** lhcheng has joined #openstack-keystone | 18:24 | |
| *** ChanServ sets mode: +v lhcheng | 18:24 | |
| *** Guest63721 is now known as mfisch | 18:24 | |
| *** mfisch is now known as Guest2004 | 18:25 | |
| *** petertr7_away is now known as petertr7 | 18:26 | |
| *** raildo is now known as raildo-afk | 18:27 | |
| stevemar | dstanek: refer to bug 1550742 | 18:27 |
| openstack | bug 1550742 in OpenStack Identity (keystone) "bug listing services when using templated backend (v3)" [Medium,In progress] https://launchpad.net/bugs/1550742 - Assigned to Steve Martinelli (stevemar) | 18:27 |
| *** Guest2004 is now known as mfisch | 18:28 | |
| *** mfisch has quit IRC | 18:28 | |
| *** mfisch has joined #openstack-keystone | 18:28 | |
| *** raildo-afk is now known as raildo | 18:29 | |
| marekd | dolphm: thanks for the review. | 18:30 |
| *** boris-42 has joined #openstack-keystone | 18:30 | |
| marekd | I did swallow the exceptions because it was the quickies yet kind of robust thing to do but I don't actually think this should be merged in a way it's implemented. On the other hand I am not sure we can just remove raising Unauthorized from methods like populate_roles() | 18:31 |
| *** doug-fish has quit IRC | 18:32 | |
| *** huats_ has quit IRC | 18:33 | |
| *** huats_ has joined #openstack-keystone | 18:33 | |
| *** huats_ has quit IRC | 18:33 | |
| *** huats_ has joined #openstack-keystone | 18:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Change tests to pass session to Client https://review.openstack.org/285815 | 18:33 |
| openstackgerrit | Merged openstack/python-keystoneclient: Link to AccessInfoV3 returned from get_raw_token_from_identity_service https://review.openstack.org/285823 | 18:33 |
| *** browne has quit IRC | 18:33 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Tests stop using deprecated HTTPClient.get() https://review.openstack.org/285807 | 18:33 |
| *** pece has quit IRC | 18:34 | |
| sbezverk | Hello, any idea when https://review.openstack.org/#/c/285987/ gets merged?? | 18:37 |
| patchbot | sbezverk: patch 285987 - keystone - Make keystone tests work on leap years | 18:37 |
| stevemar | sbezverk: it's still going through the check queue: http://status.openstack.org/zuul/ | 18:38 |
| sbezverk | @stevemar thank you | 18:39 |
| dstanek | stevemar: wow, how it that not caught in the tests? | 18:41 |
| stevemar | dstanek: have you seen the tests?! | 18:41 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 18:41 |
| stevemar | https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_templated.py | 18:41 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Moved CORS middleware configuration into oslo-config-generator https://review.openstack.org/285308 | 18:42 |
| krotscheck | bknudson: Update for ya ^^. Most notable change is that the defaults are now also set during app initialization. | 18:43 |
| *** sdake has quit IRC | 18:43 | |
| dstanek | stevemar: yep, unfortunately :-P | 18:43 |
| krotscheck | Doh, forgot the subdomain | 18:44 |
| krotscheck | sec | 18:44 |
| dstanek | stevemar: actually it looks like i don't use the list_services or _list_services ever. i thought it would have been used to get the catalog | 18:44 |
| dstanek | stevemar: should be a super easy fix | 18:44 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Moved CORS middleware configuration into oslo-config-generator https://review.openstack.org/285308 | 18:44 |
| *** clenimar has quit IRC | 18:44 | |
| *** nisha has quit IRC | 18:45 | |
| dstanek | stevemar: use remove 'hints' from _list_services :-) | 18:45 |
| *** rk4n has quit IRC | 18:45 | |
| *** doug-fish has joined #openstack-keystone | 18:46 | |
| *** doug-fish has quit IRC | 18:46 | |
| *** doug-fish has joined #openstack-keystone | 18:47 | |
| stevemar | dstanek: true | 18:47 |
| stevemar | dstanek: did you want to re-propose? | 18:47 |
| dstanek | stevemar: it is likely only there because i copied 'list_services' and renamed it to '_list_services' so that i could use it twice. probably not, i think the get catalog may got more confusing, but feel free to try it out and see how it looks | 18:48 |
| *** vilobhmm11 has joined #openstack-keystone | 18:49 | |
| * dolphm is back | 18:49 | |
| *** pnavarro has quit IRC | 18:50 | |
| *** e0ne has joined #openstack-keystone | 18:51 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:53 | |
| *** spzala has joined #openstack-keystone | 18:53 | |
| stevemar | *welcomes dolphm back* | 18:54 |
| *** jaosorior has quit IRC | 18:54 | |
| openstackgerrit | Andreas Jaeger proposed openstack/pycadf: Remove unused pngmath Sphinx extension https://review.openstack.org/286215 | 18:57 |
| *** jaosorior has joined #openstack-keystone | 18:58 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 19:00 |
| dolphm | rderose: how goes it? | 19:03 |
| *** doug-fis_ has joined #openstack-keystone | 19:03 | |
| stevemar | rderose: did we ditch the 'update federated user' method? | 19:04 |
| henrynash | ayoung: (let me know if you have questions on https://review.openstack.org/#/c/231289/, trying to get a thumbs up from all the cores who are listed as authors!) | 19:04 |
| patchbot | henrynash: patch 231289 - keystone - Projects acting as domains | 19:04 |
| rderose | I hope not :) Did I overwrite it? Looking now... | 19:04 |
| rderose | *stevemar^ | 19:04 |
| *** doug-fi__ has joined #openstack-keystone | 19:06 | |
| *** doug-fi__ has quit IRC | 19:06 | |
| *** doug-fi__ has joined #openstack-keystone | 19:07 | |
| rderose | stevemar it's there | 19:07 |
| rderose | dolphm was just responding to dstanek's comments | 19:07 |
| *** jaosorior has quit IRC | 19:07 | |
| rderose | dolphm making little progress on "concrete role assignment" | 19:07 |
| *** doug-fish has quit IRC | 19:07 | |
| *** clenimar has joined #openstack-keystone | 19:08 | |
| rderose | dolphm I know you are hesitant about merging “shadow federated users” without having “concrete role assignments”, but I’m concerned that I won’t have time to get this in by the end of the week. Just have tons of meetings this week. | 19:08 |
| *** doug-fis_ has quit IRC | 19:08 | |
| rderose | dolphm I do feel strongly that “shadow federated users” can be merged without "concrete role assignment" | 19:08 |
| dolphm | rderose: i primarily wanted it to be proposed and to see what type of work it would take to make the tests pass there; i think it has achieved that | 19:09 |
| *** fpatwa_ has joined #openstack-keystone | 19:09 | |
| dolphm | rderose: yes, the patches can be merged independently, but a revised / smaller spec needs to be proposed to newton now is all | 19:09 |
| dolphm | to go along with the narrower scope of work | 19:09 |
| dolphm | (i'll work on that right now) | 19:09 |
| rderose | dolphm I see, cool | 19:10 |
| marekd | dolphm: so we are abandoning https://review.openstack.org/#/c/286169/1 ? | 19:10 |
| patchbot | marekd: patch 286169 - keystone - Role assignment resolution for shadow users. | 19:10 |
| dolphm | marekd: no! | 19:10 |
| stevemar | rderose: i was looking at the wrong # | 19:11 |
| stevemar | :( | 19:11 |
| *** dims_ has joined #openstack-keystone | 19:11 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Role assignment resolution for shadow users. https://review.openstack.org/286169 | 19:11 |
| *** dims has quit IRC | 19:11 | |
| henrynash | bknudson: I think I covered off all the points you had on https://review.openstack.org/#/c/231289/ (other than refactoring the migration select, which I may come back in and do)….are you Ok with this now? | 19:12 |
| patchbot | henrynash: patch 231289 - keystone - Projects acting as domains | 19:12 |
| bknudson | henrynash: I'll add it to my list of things to look at | 19:13 |
| henrynash | bknudson: thx | 19:13 |
| *** fpatwa_ has quit IRC | 19:13 | |
| *** henrynash has quit IRC | 19:14 | |
| stevemar | bknudson: it's on my list too :O | 19:16 |
| *** doug-fi__ is now known as doug-fish | 19:16 | |
| *** jsavak has quit IRC | 19:16 | |
| openstackgerrit | Jacek Tomasiak proposed openstack/python-keystoneclient: Fix invalidation of tokens stored by DefaultCLI plugin https://review.openstack.org/286236 | 19:17 |
| *** jsavak has joined #openstack-keystone | 19:17 | |
| rderose | marekd: appreciate the help, but I have a patched started for this already: | 19:17 |
| rderose | https://review.openstack.org/#/c/286169/ | 19:17 |
| patchbot | rderose: patch 286169 - keystone - Role assignment resolution for shadow users. | 19:17 |
| rderose | marekd: https://review.openstack.org/#/c/284943/ | 19:17 |
| patchbot | rderose: patch 284943 - keystone - Shadow users - Concrete role assignments for feder... | 19:17 |
| rderose | marekd what's up, are we duplicating work? | 19:18 |
| *** e0ne has quit IRC | 19:20 | |
| dstanek | rderose: i don't remember don't remember the postgres auto increment behavior, but i thought it was like oracle and used independent sequence objects | 19:21 |
| rderose | dstanek I see... Wouldn't tests fail if this were the case though? | 19:22 |
| dstanek | rderose: are you testing on postgres? | 19:22 |
| dstanek | rderose: i haven't used postgres for several years so i don't quite remember what the issue was and google isn't helping too much | 19:23 |
| rderose | dstanek just thought that the functional tests would run the test against all support databases | 19:24 |
| dstanek | rderose: not that i know of | 19:24 |
| rderose | dstanek I'll google this some more as well | 19:24 |
| rderose | dstanek okay | 19:24 |
| dstanek | i can fire up pg in a bit too for some manual testing | 19:24 |
| dstanek | stevemar: do you know the answer to that? | 19:24 |
| rderose | dstanek that would be great | 19:25 |
| stevemar | hmm? | 19:25 |
| stevemar | dstanek: whats the concern with pg? | 19:26 |
| stevemar | rderose: dstanek we do not test at all with postgres atm | 19:26 |
| dstanek | stevemar: does sqlalchemy do auto increments in pg the same as it does for mysql | 19:26 |
| marekd | rderose: dolph suggest could merge both patches into one, so unless you are going to do it now I will submit new patch. | 19:27 |
| stevemar | dstanek: excellent question! | 19:27 |
| stevemar | dstanek: i think zzzeek may know the answer to that question :) | 19:27 |
| rderose | marekd okay, go for it. in the future, it would be nice to get a heads up | 19:28 |
| marekd | rderose: what heads up? | 19:28 |
| dstanek | rderose: why are we splitting the shadow users driver from the users backends? | 19:28 |
| marekd | dolphm: you called "catch Exception, e" as old style exception catching, where the problem was ",e" part, right? | 19:30 |
| marekd | instead of "catch Exception as e" | 19:30 |
| rderose | dstanek because we would need to support the new methods in the ldap driver as well and that didn't make sense | 19:32 |
| rderose | dstanek for ldap driver, I'd have to create stub methods or something | 19:33 |
| rderose | dstanek so in the end it just seemed better to create a new, separate driver to support all of the shadow user functionality | 19:33 |
| *** knikolla has quit IRC | 19:34 | |
| dstanek | rderose: feels weird to me that we have two different sets of backends that access the same tables. now you can misconfigure it and break it on accident. | 19:34 |
| dstanek | marekd: can the mapped auth plugin be used with the ldap identity backend? | 19:36 |
| dstanek | stevemar: ^ | 19:36 |
| marekd | dstanek: today mapped plugin doesnt really need any info about users from any backend | 19:37 |
| rderose | dstanek 2 backends, but all of the ORM mapping is still being done in backends/sql.py | 19:37 |
| marekd | dstanek: well, it can be used as a mean of authentication and later data is read from whatever backend keystone has configured | 19:37 |
| rderose | dstanek we just have a separate driver for the shadow user functionality is all | 19:38 |
| dstanek | marekd: ok so can a keystone instance that is setup to do ldap identity be used in a federation? | 19:38 |
| dstanek | rderose: what if they are not using the sql identity backend? | 19:39 |
| dstanek | rderose: so i guess my concern is that if it is possible for keystone to have federated authentication using the ldap backend then what is the upgrade path for those deployments? if it's even possible | 19:41 |
| marekd | dstanek: | 19:41 |
| marekd | yes | 19:41 |
| marekd | dstanek: that's what we have at cern | 19:41 |
| marekd | our users are stored in ldap | 19:41 |
| marekd | and we also provide federated access | 19:42 |
| rderose | dstanek if they are not using sql identity backend, shadow users driver is, and will still shadow federated users | 19:42 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: WIP/DNM Closure table for HMT https://review.openstack.org/285521 | 19:42 |
| dstanek | rderose: so, will all of the tables be correctly created so that cern will still work after the upgrade? | 19:43 |
| marekd | dstanek: i'd assume they'd need to be in sql backend | 19:43 |
| marekd | as ldap is ro ? | 19:43 |
| marekd | what we have is: users/grops in ldap, rest in dedicated sql (projects, domains, roles, role assignments) | 19:44 |
| rderose | dstanek federated auth hasn't been changed, the only difference is were shadowing federated users | 19:44 |
| rderose | dstanek hmm... | 19:45 |
| *** fangxu has joined #openstack-keystone | 19:45 | |
| marekd | notmorgan: LDAP access is/will be RO ? | 19:45 |
| marekd | notmorgan: i think you were driving that change. | 19:46 |
| notmorgan | marekd: nope wasn't me driving it. Henry and a few others were. But that is the long term plan | 19:46 |
| rderose | dstanek what do you mean by all of the tables? | 19:47 |
| marekd | notmorgan: but it's safe to assume that no new features should rely on RW LDAP? | 19:47 |
| notmorgan | That would be a safe assumption | 19:47 |
| marekd | notmorgan: thanks. | 19:47 |
| rderose | dstanek there is only the federated_user table in this patch and it does get created with the migration | 19:47 |
| dstanek | rderose: does an ldap deployment have all of the tables and they just are not used? | 19:50 |
| rderose | dstanek yes, I believe so | 19:51 |
| *** knikolla has joined #openstack-keystone | 19:51 | |
| rderose | dstanek stevemar I missed the comment about versioning the driver: https://review.openstack.org/#/c/279162/62/keystone/identity/core.py | 19:51 |
| patchbot | rderose: patch 279162 - keystone - Shadow users - Shadow federated users | 19:51 |
| rderose | dstanek stevemar: how important is this? | 19:52 |
| dstanek | rderose: we need to version our drivers so that we can properly change interfaces in the future | 19:52 |
| *** pnavarro has joined #openstack-keystone | 19:54 | |
| rderose | dstanek so is it just a matter of adding V9 at the end of the class name? | 19:54 |
| dstanek | rderose: i don't know enough about the read-only ldap identity backend to say it there'd be any weird issues. | 19:54 |
| rderose | dstanek I don't think there would be. those tables should still exist in sql and will be populated for federated users. | 19:56 |
| rderose | dstanek and eventually we will shadow ldap users as well | 19:56 |
| dstanek | rderose: and it's OK if identity doesn't use those tables? | 19:56 |
| *** dims_ has quit IRC | 19:58 | |
| *** spzala has quit IRC | 19:59 | |
| rderose | dstanek for this patch, yes it wouldn't matter. because the only thing we are doing is creating a local identity for federated users | 19:59 |
| dstanek | rderose: i think dolphm would be much better at identifying corner cases in this particular area that me | 19:59 |
| rderose | dstanek you raise some interesting points that we will need to consider and test | 20:00 |
| *** Guest71383 is now known as redrobot | 20:01 | |
| dstanek | rderose: yes, to you question about just adding V9 | 20:01 |
| *** sdake has joined #openstack-keystone | 20:04 | |
| *** shaleh has joined #openstack-keystone | 20:04 | |
| *** dims has joined #openstack-keystone | 20:12 | |
| *** david-lyle_ is now known as david-lyle | 20:12 | |
| dolphm | marekd: yes, "catch" statements should use "as" instead of commas, because in py3 that's just interpreted as a tuple of exception types, where "e" is not an object that has been imported | 20:13 |
| *** hockeynut_afk is now known as hockeynut | 20:13 | |
| *** pushkaru has quit IRC | 20:13 | |
| *** pushkaru has joined #openstack-keystone | 20:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 20:16 |
| *** mhickey has joined #openstack-keystone | 20:16 | |
| rderose | stevemar dstanek added "V9" to the shadow users driver | 20:17 |
| *** nkinder has quit IRC | 20:19 | |
| *** sdake has quit IRC | 20:22 | |
| marekd | dolphm: yeah | 20:22 |
| *** fawadkhaliq has quit IRC | 20:22 | |
| marekd | that's what I've been asking about | 20:22 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: V2 operations create default domain on demand https://review.openstack.org/284778 | 20:22 |
| dolphm | stevemar: did we stop creating the default domain as part of db_sync ? | 20:23 |
| dolphm | there's no bug report or anything there | 20:23 |
| *** doug-fish has quit IRC | 20:24 | |
| dstanek | dolphm: i remember seeing somewhere that we did | 20:24 |
| dolphm | dstanek: new version https://review.openstack.org/#/c/279162/ | 20:27 |
| patchbot | dolphm: patch 279162 - keystone - Shadow users - Shadow federated users | 20:27 |
| notmorgan | dolphm: we just recently did | 20:28 |
| dolphm | notmorgan: why? | 20:28 |
| notmorgan | dolphm: bootstrap should be used instead (at least that was the reasoning) rather than baking it into a db_sync. but if we rely on it being there, it is actually better to create it on demand if it doesn't exist | 20:29 |
| notmorgan | if you get down to it | 20:29 |
| *** dims has quit IRC | 20:29 | |
| notmorgan | having custom/non-recreatable things baked into our migration scripts probably wasn't the best idea | 20:29 |
| notmorgan | then again, removing it from the scripts also may have been bad. *shrug* | 20:30 |
| *** doug-fish has joined #openstack-keystone | 20:30 | |
| * notmorgan is only recounting history here not advocating one way or another. | 20:30 | |
| *** doug-fis_ has joined #openstack-keystone | 20:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow users - Shadow federated users https://review.openstack.org/279162 | 20:33 |
| *** doug-fish has quit IRC | 20:34 | |
| *** yarkot_ has joined #openstack-keystone | 20:36 | |
| dolphm | notmorgan: ah, cool | 20:36 |
| *** mylu has joined #openstack-keystone | 20:37 | |
| *** doug-fis_ has quit IRC | 20:37 | |
| dolphm | notmorgan: existing liberty deployments shouldn't run bootstrap, right? | 20:37 |
| notmorgan | dolphm: correct | 20:37 |
| *** yarkot_ has quit IRC | 20:38 | |
| notmorgan | dolphm: and if existing de[ployments riun bootstrap the worst it can do is create data in the DB. | 20:44 |
| notmorgan | dolphm: if they specify already existing roles/users/etc it does nothing | 20:44 |
| notmorgan | except warn that it didn't need to create things | 20:44 |
| *** knikolla has quit IRC | 20:45 | |
| stevemar | dolphm: bknudson tossed up a patch to create one if one is not created (but the user does a user/project list operation) | 20:46 |
| bknudson | seems like we should be able to deprecate default_domain_id | 20:48 |
| stevemar | bknudson: true | 20:48 |
| bknudson | if v2 creation methods are deprecated | 20:48 |
| *** jsavak has quit IRC | 20:48 | |
| stevemar | bknudson: they already are | 20:51 |
| *** jsavak has joined #openstack-keystone | 20:54 | |
| openstackgerrit | Marek Denis proposed openstack/keystone: Shadow users - Concrete role assignments for federated users https://review.openstack.org/284943 | 20:55 |
| stevemar | marekd: rderose going to rebase ^ on the latest... come on rebase button! don't fail me now | 20:59 |
| stevemar | womp womp | 20:59 |
| marekd | stevemar: should be easy | 21:00 |
| *** chlong_ has joined #openstack-keystone | 21:01 | |
| stevemar | marekd: thank you | 21:01 |
| marekd | stevemar: no problemo. | 21:03 |
| *** rderose has quit IRC | 21:06 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Correct test running instructions https://review.openstack.org/285821 | 21:06 |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix reference to ClientException https://review.openstack.org/285819 | 21:06 |
| *** knikolla has joined #openstack-keystone | 21:07 | |
| *** pushkaru has quit IRC | 21:09 | |
| *** fpatwa_ has joined #openstack-keystone | 21:10 | |
| *** raildo is now known as raildo-afk | 21:12 | |
| *** fpatwa_ has quit IRC | 21:14 | |
| *** henrynash has joined #openstack-keystone | 21:16 | |
| *** ChanServ sets mode: +v henrynash | 21:16 | |
| *** ayoung has joined #openstack-keystone | 21:17 | |
| *** ChanServ sets mode: +v ayoung | 21:17 | |
| *** sheel has quit IRC | 21:17 | |
| ayoung | htruta, I'm looking at https://review.openstack.org/#/c/231289/ and am pertty close to approving. One question: how immutable it a domain? Why do we even support update Project and or Domain? It should be just the description field, right? | 21:18 |
| patchbot | ayoung: patch 231289 - keystone - Projects acting as domains | 21:18 |
| ayoung | patchbot ++ | 21:18 |
| *** jsavak has quit IRC | 21:19 | |
| *** jsavak has joined #openstack-keystone | 21:19 | |
| stevemar | ayoung: i believe name and description are mutable | 21:20 |
| stevemar | ayoung: id/domain_id should not be | 21:20 |
| stevemar | parent_id should be mutable.. | 21:20 |
| ayoung | serverascode, its the parent and domain stuff I want to be sure of | 21:20 |
| ayoung | why should parent be mutable? | 21:21 |
| ayoung | stevemar, that sounds wrong | 21:21 |
| *** dims has joined #openstack-keystone | 21:23 | |
| henrynash | ayoung: you can’t move a project within a hierarchy | 21:24 |
| ayoung | henrynash, so what is mutable? | 21:24 |
| ayoung | henrynash, I would be happier if we just made projects immutable and left it there | 21:24 |
| ayoung | what would that do, besides make it harder to add a description after the fact? | 21:25 |
| henrynash | ayoung: name, description…..and under very strict cirumstances you can change domain_id (for backward compatibiity reasons) | 21:25 |
| ayoung | ah, name we want to be abkle to change for the cleanup | 21:25 |
| ayoung | why domain_id? And where is the logic that protects that? | 21:25 |
| henrynash | ayoung: you used to be able to “move” a project betwen domains by changeing the domain_id….this functionality is deprecated, but not removed | 21:26 |
| ayoung | henrynash, hmmm. Don't recall that | 21:26 |
| krotscheck | Irony, thy name is bknudson ;) | 21:26 |
| krotscheck | bknudson: I'm guessing you script-patched everything in oslo because of feature freeze? | 21:26 |
| krotscheck | Sorry- script -2'd. | 21:26 |
| henrynash | ayoung: so (until we can formally remove that…in N I think), we let a project who’s immediate parent is a domain, but has not children have their domain_id changed | 21:27 |
| bknudson | krotscheck: yes, oslo will not have any new releases except bug fixes in M | 21:28 |
| ayoung | henrynash, now, there is no way a project can become a domain by accident, right? | 21:28 |
| krotscheck | bknudson: Serious question- I'd like to make sure set_defaults is called during api initialization, where's the right place to put that? | 21:28 |
| henrynash | ayoung: is_domain is definitely immutable | 21:30 |
| ayoung | cool | 21:30 |
| bknudson | krotscheck: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/common.py#n29 -- in keystone.server.common.configure() | 21:30 |
| krotscheck | bknudson: Thank you, much obliged. | 21:31 |
| bknudson | krotscheck: this change is llke config.set_default_for_default_log_levels() | 21:31 |
| ayoung | henrynash, not sure what it would break if a project accidentally became a domain anyway | 21:31 |
| bknudson | krotscheck: so maybe create a config.set_defaults() and change server.common.configure to call that | 21:31 |
| henrynash | ayoung: with only top level domains, probably nothing | 21:31 |
| ayoung | henrynash, I'm a +2A that one. | 21:31 |
| ayoung | its got enough +1s and it has been around 62 revisions. I really should take my name off as co-author | 21:32 |
| ayoung | my changes are gone | 21:32 |
| henrynash | ayoung: ok, I think many of the changes from the string of authors are gone! | 21:33 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Moved CORS middleware configuration into oslo-config-generator https://review.openstack.org/285308 | 21:33 |
| *** browne has joined #openstack-keystone | 21:33 | |
| samueldmq | henrynash: patch 231289 is on the gate | 21:37 |
| patchbot | samueldmq: https://review.openstack.org/#/c/231289/ - keystone - Projects acting as domains | 21:37 |
| samueldmq | henrynash: congrats, nicely done | 21:37 |
| henrynash | samueldmq: yep, cool :-) | 21:37 |
| henrynash | samueldmq: thx for all your help on it | 21:37 |
| openstackgerrit | Michael Krotscheck proposed openstack/keystone: Consolidate configuration default overrides https://review.openstack.org/286291 | 21:38 |
| krotscheck | bknudson: And there's the followup that collects all of the method invocations into one ^^ | 21:38 |
| bknudson | krotscheck: how do I test out the cors change? look for headers when I do a request? | 21:38 |
| krotscheck | bknudson: The tests should fail.... | 21:39 |
| krotscheck | bknudson: But yes- switch out allowed_origin with a uri (http://foo.example.com), then do a curl OPTIONS request with the Origin: http://foo.example.com header. | 21:39 |
| *** dims has quit IRC | 21:40 | |
| krotscheck | Waaait a sec. Where did my tests go. | 21:41 |
| krotscheck | Oh, discussion told me not to add tests for middleware. | 21:42 |
| *** dims has joined #openstack-keystone | 21:44 | |
| samueldmq | henrynash: np, my pleasure :) | 21:46 |
| samueldmq | henrynash: glad to see it moving | 21:46 |
| henrynash | samueldmq: been a long time coming.... | 21:46 |
| *** browne has quit IRC | 21:47 | |
| samueldmq | henrynash: yep :) | 21:49 |
| *** fawadkhaliq has joined #openstack-keystone | 21:50 | |
| *** hambuergaer has joined #openstack-keystone | 21:53 | |
| *** edmondsw has quit IRC | 21:53 | |
| stevemar | ayoung: ++ on approving that patch, i was just going to do the same | 21:53 |
| stevemar | ayoung: samueldmq henrynash depending on what gets merged first (reseller or shadow users) we will need to rename 093 to 094 | 21:53 |
| *** pnavarro has quit IRC | 21:54 | |
| henrynash | stevemar: understand | 21:54 |
| *** hambuergaer has quit IRC | 21:55 | |
| stevemar | samueldmq: henrynash last patch needed for mitaka-3, cascade, whats going on there? | 21:56 |
| samueldmq | stevemar: so, I and henrynash agree that it needs further discussion | 21:57 |
| samueldmq | stevemar: because we are not 100% sure it's the right way to do it, as proposed | 21:58 |
| stevemar | samueldmq: henrynash from an API perspective, i think it's fine and working... just the policy may need tweaking | 21:58 |
| samueldmq | stevemar: and it also may benefit from unified delegation | 21:58 |
| henrynash | stevemar: samueldmq and I are for postponing this one…there is still much uncertaintiy over exactly what policy rules we shoudl follow…especially when you try and think how it should work for normal tokens, trusts and federation | 21:58 |
| *** vilobhmm11 has quit IRC | 21:58 | |
| stevemar | henrynash: samueldmq anyway we can make it strict right now? and loosen the policy if we think it is necessary ? | 21:59 |
| *** vilobhmm11 has joined #openstack-keystone | 21:59 | |
| SamYaple | hello my keystone people! question about bootstrap. without admin_token i can create the user/role/project, basically enough to get me a token. I can then use that token to create service/endpoint and then auth like normal | 21:59 |
| samueldmq | stevemar: is it better to make strict and relax or the opposite ? | 21:59 |
| henrynash | stevemar: if we want something now, I’d suggest the separate polciy endpoint option, then in teh future we can deprecate that in place of an agreed hierarchical approach | 22:00 |
| *** vilobhmm11 has quit IRC | 22:00 | |
| SamYaple | my question is, is there a non-deprecated way to do that via python? http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html says non-session auth is deprecated | 22:00 |
| stevemar | samueldmq: one is easier to reverse than the other :) | 22:00 |
| samueldmq | stevemar: henrynash also the implementation would require a lot of tests for different types of tokens | 22:00 |
| *** vilobhmm11 has joined #openstack-keystone | 22:00 | |
| samueldmq | stevemar: yes, but in this case (a new policy entry) is a more relaxed approach; but if we need to change that in the future, we would need to deprecate the policy entry | 22:01 |
| samueldmq | as henrynash said | 22:01 |
| stevemar | henrynash: i like that suggestion, separate policy for that API call... but we've never deprecated a policy entry | 22:01 |
| rodrigods | ^ i like this one | 22:01 |
| samueldmq | stevemar: and based on the fact of thinking on a possible deprecation of something that is still being proposed ... it's not good | 22:01 |
| rodrigods | but not the idea of proposing to deprecate later | 22:02 |
| stevemar | henrynash: samueldmq if you guys are okay with bumping it to N, we can do that | 22:02 |
| rodrigods | i like it overall, because the concept of "branch" operation | 22:02 |
| henrynash | stevemar: true, I think once we had a hierarchial approach agreed, we would first create a config option that woudl determine which policy entry we use, then depracte the separate entry pint | 22:02 |
| henrynash | point | 22:02 |
| *** pauloewerton has quit IRC | 22:02 | |
| stevemar | henrynash: if we're creating all these plug points just to squeeze this in for M, then I'm OK with bumping to N | 22:03 |
| samueldmq | stevemar: henrynash: my heart says that, if we're going to do it, let's do it right from the start | 22:03 |
| stevemar | samueldmq: henrynash hehe, all that code for handling cascade and we fall just short of the finish line :) | 22:04 |
| samueldmq | stevemar: yes, imo this and all the hmt things need broader discussions | 22:05 |
| *** sdake has joined #openstack-keystone | 22:05 | |
| henrynash | stevemar: I think there is a lesson here….we often tend to consider policy enforcment of API changes as an implemenation detail, whereas we probably should have a section explicitely in the specs on it | 22:06 |
| *** doug-fish has joined #openstack-keystone | 22:06 | |
| stevemar | henrynash: definitely | 22:06 |
| samueldmq | stevemar: henrynash: it's basically what's happening now, like glance has support for hierarchical proejcts, and others don't, sometimes they don't even agree in the approach | 22:06 |
| stevemar | esepecially when it's non-obvious, like this one | 22:06 |
| samueldmq | henrynash: stevemar: ++ | 22:06 |
| samueldmq | and specifically on this one, we even asked the api-wg for advices :) | 22:07 |
| * samueldmq things every project should have a member in the api-wg | 22:07 | |
| samueldmq | thinks* | 22:08 |
| henrynash | stevemar: separate question….was does SKIPPED mean under tests for patch in teh gate? (which is what projects as a domain now says)… | 22:08 |
| *** knikolla has quit IRC | 22:09 | |
| SamYaple | ayoung: you around? | 22:09 |
| ayoung | SamYaple, I'm around | 22:09 |
| *** dims has quit IRC | 22:09 | |
| SamYaple | hey. posted a question above I cant find a good answer too. | 22:10 |
| SamYaple | any non-deprecated way to bootstrap endpoint and service without a cli tool? | 22:10 |
| ayoung | "hello my keystone people! question about bootstrap. without admin_token i can create the user/role/project, basically enough to get me a token. I can then use that token to create service/endpoint and then auth like normal" | 22:10 |
| ayoung | SamYaple, Um. Why | 22:10 |
| SamYaple | followed by "my question is, is there a non-deprecated way to do that via python? http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html says non-session auth is deprecated" | 22:10 |
| ayoung | why is CLI a problem? | 22:11 |
| SamYaple | for kolla with ansible I need to know if something has changed | 22:11 |
| SamYaple | also so i dont recreate teh same service and endpoints over and over | 22:11 |
| *** browne has joined #openstack-keystone | 22:11 | |
| SamYaple | openstack service create is not idempotent | 22:11 |
| *** browne has quit IRC | 22:12 | |
| samueldmq | henrynash: looking | 22:12 |
| samueldmq | henrynash: zuul? | 22:12 |
| henrynash | samueldmq: yes….in teh gate queue | 22:12 |
| *** browne has joined #openstack-keystone | 22:12 | |
| SamYaple | ayoung: basically im trying to avoid doing this non-sense https://review.openstack.org/#/c/285625/9/docker/keystone/keystone_bootstrap.sh | 22:13 |
| patchbot | SamYaple: patch 285625 - kolla - Remove keystone admin token | 22:13 |
| *** mylu_ has joined #openstack-keystone | 22:13 | |
| henrynash | samueldmq: seaerch for 231289 | 22:13 |
| *** vilobhmm11 has left #openstack-keystone | 22:13 | |
| *** mylu has quit IRC | 22:13 | |
| ayoung | SamYaple, bug notmorgan about that. Idempotentcy and not destroying a working install should be a baseline | 22:14 |
| *** sdake has quit IRC | 22:14 | |
| *** petertr7 is now known as petertr7_away | 22:15 | |
| *** jsavak has quit IRC | 22:15 | |
| SamYaple | notmorgan: bug | 22:15 |
| samueldmq | henrynash: I'm looking for answer on -infra | 22:15 |
| *** jsavak has joined #openstack-keystone | 22:15 | |
| henrynash | samueldmq: thx | 22:16 |
| *** browne has quit IRC | 22:17 | |
| *** sdake has joined #openstack-keystone | 22:18 | |
| samueldmq | henrynash: there is a black point on the side of the gate | 22:19 |
| samueldmq | henrynash: hover over it | 22:19 |
| samueldmq | henrynash: merge conflict! thanks to anteaya for clarifying | 22:19 |
| henrynash | samueldmq: ah! got it! | 22:19 |
| henrynash | samuedlmq: damn! | 22:20 |
| anteaya | hover over the black dot | 22:20 |
| anteaya | in status.openstack.org/zuul | 22:20 |
| openstackgerrit | Merged openstack/keystone: Make keystone tests work on leap years https://review.openstack.org/285987 | 22:20 |
| samueldmq | anteaya: thanks, appreciate your help | 22:21 |
| anteaya | pleasure | 22:21 |
| anteaya | :) | 22:21 |
| *** browne has joined #openstack-keystone | 22:27 | |
| stevemar | bknudson: poke about https://review.openstack.org/#/c/285152/ | 22:27 |
| patchbot | stevemar: patch 285152 - keystone - Fix the migration issue for the user doesn't have ... | 22:27 |
| bknudson | stevemar: what about it? | 22:27 |
| SamYaple | see if it were me i would have just said everyone gets a day off every 4 years... https://review.openstack.org/285987 | 22:28 |
| stevemar | bknudson: i think davechen is looking for a bit of guidance on that patch | 22:28 |
| bknudson | stevemar: I'll try it out and see if it works. | 22:30 |
| samueldmq | henrynash: it needs rebase | 22:32 |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Update developer docs for ubuntu 15.10 https://review.openstack.org/286307 | 22:33 |
| *** shaleh has quit IRC | 22:35 | |
| *** doug-fis_ has joined #openstack-keystone | 22:35 | |
| *** doug-fish has quit IRC | 22:37 | |
| henrynash | samueldmq: tried that, seems no chanegs required…puzzling | 22:38 |
| openstackgerrit | henry-nash proposed openstack/keystone: Projects acting as domains https://review.openstack.org/231289 | 22:39 |
| *** ChanServ sets mode: +v samueldmq | 22:42 | |
| htruta | henrynash, samueldmq: wow. Look who's merging | 22:44 |
| henrynash | stevemar, ayoung, samueldmq: just had to rebase https://review.openstack.org/231289, feel free to add in some +2s so it doesn’t look like I;m forcing this in on my own :-) | 22:45 |
| htruta | we should've put "Co-authored by: keystone team" | 22:45 |
| *** fpatwa_ has joined #openstack-keystone | 22:45 | |
| *** sdake has quit IRC | 22:46 | |
| *** ninag has quit IRC | 22:47 | |
| *** doug-fis_ has quit IRC | 22:48 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Document session as an argument to v3.Client https://review.openstack.org/285822 | 22:48 |
| *** doug-fish has joined #openstack-keystone | 22:48 | |
| *** fpatwa_ has quit IRC | 22:50 | |
| *** jsavak has quit IRC | 22:50 | |
| *** diazjf has quit IRC | 22:52 | |
| *** doug-fish has quit IRC | 22:53 | |
| *** doug-fish has joined #openstack-keystone | 22:53 | |
| stevemar | htruta: hehe | 22:53 |
| stevemar | henrynash: i'll rebase it on shadow users, since they are both using 093... and then punt it through | 22:55 |
| stevemar | then baby sit the gate :) | 22:55 |
| henrynash | stevmar: shadow users is failing in teh check queue…so it won’t make itthrough | 23:01 |
| henrynash | stevemar: without changes, not sure what the problem is | 23:02 |
| henrynash | stevemar: shadow users is failing p34 and legacy drivers | 23:03 |
| *** sdake has joined #openstack-keystone | 23:03 | |
| *** browne has quit IRC | 23:09 | |
| *** phalmos has quit IRC | 23:10 | |
| breton | mitaka-3 feature freeze on FEB 29 | 23:12 |
| breton | are we freezed? | 23:12 |
| samueldmq | breton: almost :) just waiting on last changes to merge | 23:12 |
| *** akscram has quit IRC | 23:12 | |
| samueldmq | breton: as far as I know, stevemar's right person to confirm :) | 23:13 |
| *** akscram has joined #openstack-keystone | 23:13 | |
| *** browne has joined #openstack-keystone | 23:14 | |
| *** browne has quit IRC | 23:14 | |
| *** dims has joined #openstack-keystone | 23:14 | |
| *** ninag has joined #openstack-keystone | 23:18 | |
| *** ninag has quit IRC | 23:22 | |
| stevemar | breton: just about frozen. i'll be pushing shadow users and projects-as-domains tonight | 23:25 |
| stevemar | and tagging the master branch | 23:25 |
| stevemar | henrynash: what the heckaroony, why is it failing py34 and legacy tests | 23:27 |
| *** spandhe has quit IRC | 23:28 | |
| *** mhickey has quit IRC | 23:29 | |
| bknudson | https://review.openstack.org/#/c/272007/ which is just about to merge conflicts with Projects acting as domains | 23:31 |
| patchbot | bknudson: patch 272007 - keystone - Use requst local in-process cache per request | 23:31 |
| henrynash | stevemar: py27 failed too…looks like coding error in https://review.openstack.org/#/c/279162/67/keystone/identity/shadow_backends/sql.py for from_dict() at line 30 | 23:34 |
| patchbot | henrynash: patch 279162 - keystone - Shadow users - Shadow federated users | 23:34 |
| *** EinstCrazy has joined #openstack-keystone | 23:34 | |
| *** EinstCrazy has quit IRC | 23:35 | |
| *** slberger has left #openstack-keystone | 23:37 | |
| *** spandhe has joined #openstack-keystone | 23:39 | |
| *** browne has joined #openstack-keystone | 23:43 | |
| henrynash | bknudson, stevemar: I’ll fix the merge issue with https://review.openstack.org/#/c/272007/ and projects as a domain….but looks like shadow users actually has a coding error | 23:43 |
| patchbot | henrynash: patch 272007 - keystone - Use requst local in-process cache per request | 23:43 |
| *** gordc has quit IRC | 23:50 | |
| *** mylu_ has quit IRC | 23:52 | |
| *** csoukup has quit IRC | 23:55 | |
| *** mylu has joined #openstack-keystone | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!