| *** ninag has joined #openstack-keystone | 00:02 | |
| *** maxabidi has quit IRC | 00:02 | |
| *** ninag has quit IRC | 00:07 | |
| mfisch | lbragstad: dolphm hey Fernetians, our talk was picked | 00:08 |
|---|---|---|
| mfisch | get your slide faces on | 00:08 |
| *** sdake has joined #openstack-keystone | 00:12 | |
| *** GB21 has quit IRC | 00:13 | |
| *** jasonsb has joined #openstack-keystone | 00:13 | |
| *** Ephur has quit IRC | 00:16 | |
| *** rk4n has quit IRC | 00:17 | |
| *** jrist has quit IRC | 00:17 | |
| *** dan_nguyen has left #openstack-keystone | 00:17 | |
| *** jrist has joined #openstack-keystone | 00:18 | |
| *** rk4n has joined #openstack-keystone | 00:18 | |
| *** dan_nguyen has joined #openstack-keystone | 00:20 | |
| *** sdake has quit IRC | 00:29 | |
| *** browne has quit IRC | 00:34 | |
| *** anush has quit IRC | 00:36 | |
| *** sheel has joined #openstack-keystone | 00:39 | |
| *** pushkaru has quit IRC | 00:41 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Fix warning when running tox https://review.openstack.org/289635 | 00:43 |
| *** spandhe has quit IRC | 00:45 | |
| *** fangxu has joined #openstack-keystone | 00:48 | |
| *** wanghua has joined #openstack-keystone | 00:50 | |
| *** fpatwa_ has joined #openstack-keystone | 00:52 | |
| *** trown|outtypewww has quit IRC | 00:55 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Un-wrap functions https://review.openstack.org/289642 | 01:00 |
| *** fpatwa_ has quit IRC | 01:04 | |
| *** rk4n has quit IRC | 01:05 | |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 01:06 |
| *** rk4n has joined #openstack-keystone | 01:07 | |
| *** gyee has quit IRC | 01:11 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Un-wrap function https://review.openstack.org/289642 | 01:13 |
| dolphm | mfisch: oh noes | 01:14 |
| dolphm | mfisch: i linked to your blog today | 01:15 |
| *** browne has joined #openstack-keystone | 01:17 | |
| *** ankita_wagh has quit IRC | 01:22 | |
| *** harlowja has quit IRC | 01:23 | |
| *** shaleh has quit IRC | 01:25 | |
| *** pushkaru has joined #openstack-keystone | 01:31 | |
| *** furface has quit IRC | 01:33 | |
| *** furface has joined #openstack-keystone | 01:36 | |
| openstackgerrit | Merged openstack/keystoneauth: Adding authentication compatibility for OpenStackClient https://review.openstack.org/289472 | 01:44 |
| *** spzala has quit IRC | 01:49 | |
| *** spzala has joined #openstack-keystone | 01:50 | |
| *** spzala has quit IRC | 01:54 | |
| *** spzala has joined #openstack-keystone | 01:54 | |
| *** rderose has quit IRC | 01:59 | |
| *** anush has joined #openstack-keystone | 02:02 | |
| *** ankita_wagh has joined #openstack-keystone | 02:12 | |
| *** rk4n has quit IRC | 02:13 | |
| *** dan_nguyen has quit IRC | 02:24 | |
| *** fangxu has quit IRC | 02:24 | |
| *** edmondsw has quit IRC | 02:25 | |
| *** sdake has joined #openstack-keystone | 02:27 | |
| *** fangxu has joined #openstack-keystone | 02:28 | |
| *** JBenson has quit IRC | 02:30 | |
| *** pushkaru has quit IRC | 02:36 | |
| *** richm has quit IRC | 02:50 | |
| *** jamielennox is now known as jamielennox|away | 02:56 | |
| *** woodster_ has quit IRC | 02:57 | |
| *** anush has quit IRC | 03:01 | |
| *** jamielennox|away is now known as jamielennox | 03:01 | |
| *** fpatwa_ has joined #openstack-keystone | 03:03 | |
| *** mtreinish has quit IRC | 03:04 | |
| *** mtreinish has joined #openstack-keystone | 03:04 | |
| *** jamielennox is now known as jamielennox|away | 03:05 | |
| *** sheel has quit IRC | 03:07 | |
| *** fangxu has quit IRC | 03:10 | |
| *** jamielennox|away is now known as jamielennox | 03:15 | |
| *** fpatwa_ has quit IRC | 03:16 | |
| *** browne1 has joined #openstack-keystone | 03:22 | |
| *** lhcheng_ has joined #openstack-keystone | 03:23 | |
| *** browne has quit IRC | 03:24 | |
| *** spandhe has joined #openstack-keystone | 03:26 | |
| *** lhcheng has quit IRC | 03:26 | |
| *** spandhe_ has joined #openstack-keystone | 03:29 | |
| *** fangxu has joined #openstack-keystone | 03:30 | |
| *** spandhe has quit IRC | 03:30 | |
| *** spandhe_ is now known as spandhe | 03:30 | |
| *** lhcheng_ has quit IRC | 03:32 | |
| *** fangxu has quit IRC | 03:34 | |
| *** ccard_ has quit IRC | 03:35 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 03:48 |
| *** ccard_ has joined #openstack-keystone | 03:50 | |
| *** wxy has joined #openstack-keystone | 03:52 | |
| *** JBenson has joined #openstack-keystone | 03:52 | |
| *** dan_nguyen has joined #openstack-keystone | 03:57 | |
| *** smcginnis has left #openstack-keystone | 03:58 | |
| *** spzala has quit IRC | 04:01 | |
| *** spzala has joined #openstack-keystone | 04:01 | |
| *** spzala has quit IRC | 04:06 | |
| *** ankita_wagh has quit IRC | 04:08 | |
| *** ankita_wagh has joined #openstack-keystone | 04:08 | |
| *** lhcheng has joined #openstack-keystone | 04:10 | |
| *** ChanServ sets mode: +v lhcheng | 04:10 | |
| *** ninag has joined #openstack-keystone | 04:12 | |
| *** bapalm has quit IRC | 04:13 | |
| *** ninag has quit IRC | 04:16 | |
| *** bapalm has joined #openstack-keystone | 04:30 | |
| *** dan_nguyen has quit IRC | 04:31 | |
| *** EinstCrazy has joined #openstack-keystone | 04:32 | |
| *** links has joined #openstack-keystone | 04:33 | |
| *** lhcheng_ has joined #openstack-keystone | 04:40 | |
| *** spzala has joined #openstack-keystone | 04:41 | |
| *** fangxu has joined #openstack-keystone | 04:41 | |
| *** lhcheng has quit IRC | 04:43 | |
| *** spzala has quit IRC | 04:44 | |
| *** nisha has joined #openstack-keystone | 04:45 | |
| *** jaosorior has joined #openstack-keystone | 04:46 | |
| nisha | Hello all :) | 04:50 |
| *** sdake_ has joined #openstack-keystone | 05:00 | |
| *** sdake has quit IRC | 05:01 | |
| *** nkinder has joined #openstack-keystone | 05:01 | |
| nisha | I am participating in Openstack BugSmash and I am trying to fix this documentation bug https://bugs.launchpad.net/openstack-manuals/+bug/1459402 | 05:05 |
| openstack | Launchpad bug 1459402 in openstack-manuals "Conceptual overview of the Keystone service catalog" [Wishlist,Confirmed] - Assigned to Nisha Yadav (ynisha11) | 05:05 |
| *** markvoelker_ has quit IRC | 05:06 | |
| *** fpatwa_ has joined #openstack-keystone | 05:07 | |
| *** phalmos has joined #openstack-keystone | 05:11 | |
| *** dave-mccowan has quit IRC | 05:21 | |
| *** fawadkhaliq has quit IRC | 05:22 | |
| *** phalmos has quit IRC | 05:25 | |
| *** EinstCrazy has quit IRC | 05:27 | |
| *** belmoreira has joined #openstack-keystone | 05:31 | |
| *** sdake_ has quit IRC | 05:40 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:42 | |
| *** fpatwa_ has quit IRC | 05:43 | |
| *** rha has quit IRC | 05:46 | |
| *** frickler has quit IRC | 05:46 | |
| *** Nirupama has joined #openstack-keystone | 05:47 | |
| *** boris-42 has quit IRC | 05:54 | |
| *** furface has quit IRC | 05:54 | |
| *** tomoiaga has joined #openstack-keystone | 05:56 | |
| *** fangxu has quit IRC | 05:56 | |
| *** rcernin has joined #openstack-keystone | 06:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/289722 | 06:03 |
| *** roxanagh_ has joined #openstack-keystone | 06:06 | |
| *** markvoelker has joined #openstack-keystone | 06:07 | |
| *** jamielennox is now known as jamielennox|away | 06:08 | |
| nisha | Has anyone come across a low-hanging fruit or an easy documentation bug related to keystone? | 06:23 |
| nisha | I am looking for one, any suggestions ? | 06:23 |
| *** belmoreira has quit IRC | 06:24 | |
| *** spandhe has quit IRC | 06:26 | |
| *** spandhe has joined #openstack-keystone | 06:28 | |
| *** roxanagh_ has quit IRC | 06:37 | |
| *** furface has joined #openstack-keystone | 06:37 | |
| *** ankita_w_ has joined #openstack-keystone | 06:39 | |
| *** zzzeek has quit IRC | 06:42 | |
| *** ankita_wagh has quit IRC | 06:43 | |
| *** david-lyle_ has joined #openstack-keystone | 06:44 | |
| *** david-lyle has quit IRC | 06:44 | |
| *** fawadkhaliq has quit IRC | 06:44 | |
| morgan | nisha: I can take a gander later tonight or tomorrow. It's late in the US/North America where most keystone devs are. | 06:56 |
| morgan | So might take a bit to get a response. | 06:57 |
| *** pcaruana has quit IRC | 06:57 | |
| nisha | ohh, i understand morgan | 06:57 |
| nisha | morgan: I was looking at this as of now https://bugs.launchpad.net/openstack-manuals/+bug/1516341 | 06:58 |
| openstack | Launchpad bug 1516341 in openstack-manuals "Identity services (keystone) in High Availability Guide" [Undecided,New] | 06:58 |
| *** spandhe has quit IRC | 07:16 | |
| *** nkinder has quit IRC | 07:22 | |
| *** lhcheng has joined #openstack-keystone | 07:23 | |
| *** ChanServ sets mode: +v lhcheng | 07:23 | |
| *** lhcheng_ has quit IRC | 07:27 | |
| *** belmoreira has joined #openstack-keystone | 07:31 | |
| stevemar | jamielennox|away: mordred :) you guys are fun! | 07:37 |
| stevemar | jamielennox|away: mordred great to hear that the bootstrap with endpoint works great :) | 07:38 |
| *** fpatwa_ has joined #openstack-keystone | 07:44 | |
| *** e0ne has joined #openstack-keystone | 07:48 | |
| *** fpatwa_ has quit IRC | 07:49 | |
| *** e0ne has quit IRC | 07:49 | |
| *** frickler has joined #openstack-keystone | 07:57 | |
| *** browne1 has quit IRC | 08:07 | |
| *** permalac has joined #openstack-keystone | 08:15 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add wrapper classes for return-request-id-to-caller https://review.openstack.org/261188 | 08:24 |
| *** ankita_w_ has quit IRC | 08:35 | |
| openstackgerrit | Merged openstack/keystone: Race condition in keystone domain config https://review.openstack.org/287020 | 08:40 |
| *** mvk has joined #openstack-keystone | 08:41 | |
| *** pece has joined #openstack-keystone | 08:46 | |
| *** markus_z has left #openstack-keystone | 09:00 | |
| *** jistr has joined #openstack-keystone | 09:11 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/289722 | 09:22 |
| nisha | any quick links on how to do code coverage in keystone, please | 09:30 |
| nisha | I tried this http://adam.younglogic.com/2013/06/keystone-test-coverage/, but it says no such file or directory when I used the command ./run_tests.sh -c | 09:31 |
| marekd | nisha: hi, try tox -ecover | 09:34 |
| marekd | generally speaking tox is now recommended way to run unit tests. | 09:35 |
| *** mhickey has joined #openstack-keystone | 09:35 | |
| nisha | marekd: thanks for help, it's running | 09:38 |
| marekd | nisha: cool! | 09:38 |
| stevemar | marekd: o/ | 09:38 |
| stevemar | marekd: i'm only one tz behind you! | 09:38 |
| marekd | stevemar: why one? | 09:38 |
| marekd | you are UTC+1 | 09:38 |
| stevemar | oh! | 09:38 |
| stevemar | same! | 09:38 |
| marekd | yeah | 09:38 |
| marekd | stevemar: you see how calm the channel is at this time?! | 09:39 |
| stevemar | UTC+1 is lonely on irc, but my goodness do changes get merged fast | 09:39 |
| marekd | :) | 09:39 |
| marekd | how is your time in France? | 09:39 |
| stevemar | good! great food so far | 09:39 |
| marekd | hehe | 09:39 |
| marekd | seafood you mean or wine and cheese? | 09:40 |
| stevemar | wine and bread :) | 09:40 |
| marekd | :) | 09:40 |
| *** fpatwa_ has joined #openstack-keystone | 09:45 | |
| *** fpatwa_ has quit IRC | 09:50 | |
| nisha | marekd: http://paste.openstack.org/show/489647/ | 09:51 |
| nisha | please have a look, the command is still running but the screen shows this | 09:52 |
| nisha | displays* | 09:52 |
| marekd | nisha: you have nevest keystone? | 09:52 |
| marekd | and up to date tox? | 09:52 |
| stevemar | marekd: there's a small fix to the warning here: https://review.openstack.org/#/c/289635/ | 09:53 |
| patchbot | stevemar: patch 289635 - keystone - Fix warning when running tox | 09:53 |
| * stevemar will try running cover | 09:53 | |
| marekd | stevemar: let's see how soon it will be in master branch :-) | 09:54 |
| marekd | nisha: let me run it locally | 09:55 |
| nisha | marekd: nevest ? do you mean to say newest? | 09:56 |
| nisha | I had done git pull and ran tox also before | 09:57 |
| marekd | yes, i meant newest, most up to date | 09:57 |
| stevemar | nisha: did a directory get created? cover? | 09:57 |
| nisha | stevemar: so, the command is still running, though nothing has popped up after the paste link | 09:58 |
| nisha | i had a directory .cover | 09:58 |
| stevemar | nisha: yeah, same here | 09:58 |
| marekd | nisha: it takes time usually | 09:59 |
| marekd | nisha: in the end you are supposed to examine html generated pages with coverage | 10:00 |
| nisha | stevemar: marekd : i am sorry spelling mistake, I have a directory hidden .coverage | 10:00 |
| nisha | I don't have any cover directory though | 10:01 |
| nisha | marekd: I am using a VM for running keystone | 10:03 |
| stevemar | nisha: did the command finish? | 10:03 |
| marekd | nisha: doesn't matter i think. | 10:03 |
| marekd | nisha: i am running tox-ecover and have 'cover' dir. | 10:04 |
| nisha | marekd: stevemar : alright, not yet still running | 10:04 |
| marekd | nisha: permission problems? | 10:04 |
| marekd | ls -al s okay in keystone dir? | 10:04 |
| marekd | is* | 10:04 |
| nisha | should i cancel the running command and then check? | 10:05 |
| marekd | nisha: maybe open another terminal | 10:05 |
| nisha | oki, sure | 10:05 |
| nisha | still the same thing, no directory named cover | 10:07 |
| nisha | http://paste.openstack.org/show/489650/ | 10:07 |
| stevemar | nisha: i think it takes a while | 10:07 |
| marekd | nisha: but what about permissions? | 10:07 |
| marekd | meybe you cloned repo as root or something and now tox cannot create dir | 10:07 |
| marekd | or something | 10:07 |
| nisha | i ran tox command before without sudo , that worked well | 10:08 |
| nisha | marekd: Is there any way I can cross check, to be sure about permissions? | 10:08 |
| marekd | ls | 10:08 |
| marekd | ls -al | 10:08 |
| marekd | will show you who owns the dir | 10:09 |
| marekd | and files | 10:09 |
| *** _pece has joined #openstack-keystone | 10:10 | |
| nisha | http://paste.openstack.org/show/489650/ this was the result of the query ls- -al | 10:10 |
| marekd | nisha: looks goo | 10:11 |
| marekd | ok, so one thing off the table. | 10:11 |
| marekd | nisha: i'd wait few more minutes | 10:11 |
| nisha | marekd: stevemar : the directory cover will be created once the command has finished right? at least is should | 10:11 |
| marekd | nisha: not sure when exactly | 10:11 |
| nisha | thanks, sure | 10:11 |
| *** pece has quit IRC | 10:11 | |
| stevemar | nisha: yes it should | 10:11 |
| marekd | nisha: but yes, it should be there at some point | 10:11 |
| marekd | nisha: as this is where coverage files are located. | 10:12 |
| marekd | so you can browse them. | 10:12 |
| *** mvk has quit IRC | 10:14 | |
| stevemar | nisha: http://ronaldbradford.com/blog/writing-and-testing-unit-tests-in-openstack-2015-06-05/ | 10:14 |
| stevemar | You can use the code coverage of unit tests to determine possible places to start adding to existing unit tests. The following command will produce a HTML report in the /cover directory of your project | 10:15 |
| stevemar | tox -e cover | 10:15 |
| *** mvk has joined #openstack-keystone | 10:15 | |
| stevemar | should be able to open keystone/cover/html/index.html in firefox ... if i remember it correctly | 10:16 |
| marekd | stevemar: ++ | 10:16 |
| stevemar | looks like it runs the entire py27 suite, then determines the coverage | 10:16 |
| stevemar | wow | 10:16 |
| marekd | nisha: maybe it just takes time as you VM is slow or low on memory? | 10:16 |
| nisha | umm, stevemar marekd i had typed $tox -ecover not $tox -e cover | 10:18 |
| marekd | nisha: it doesn't matter | 10:18 |
| stevemar | nisha: that's fine, | 10:18 |
| marekd | nisha: check if it's still running something | 10:19 |
| marekd | for instance if your CPU are loaded :-) | 10:19 |
| nisha | the screen just says the same , looks freezdd | 10:20 |
| nisha | and i had allocated 3.5 GB RAM and 100 GB hard disk size | 10:20 |
| nisha | for the VM | 10:21 |
| nisha | can't I cancel and try running it again | 10:21 |
| marekd | nisha: yes, you can - it's your VM :-) | 10:21 |
| stevemar | nisha: my run just finished | 10:21 |
| marekd | nisha: one thing you can do is to try updating all your packages | 10:22 |
| marekd | pip install --upgrade -r test-requirements.txt -r requirements.txt | 10:22 |
| stevemar | nisha: http://paste.openstack.org/show/489653/ | 10:22 |
| stevemar | nisha: i opened it with $ firefox cover/index.html and see the data | 10:23 |
| stevemar | nisha: report: http://paste.openstack.org/show/489655/ | 10:23 |
| nisha | yeah, sure will update packages marekd :) | 10:26 |
| nisha | http://paste.openstack.org/show/489658/ | 10:32 |
| *** openstackgerrit has quit IRC | 10:33 | |
| *** openstackgerrit has joined #openstack-keystone | 10:33 | |
| nisha | marekd: I am getting some errors while upgrading packages | 10:33 |
| nisha | Tried with sudo command as well, same error | 10:33 |
| stevemar | ohhh i like this change: https://review.openstack.org/#/c/289848/ | 10:35 |
| patchbot | stevemar: patch 289848 - openstack-infra/project-config - Convert tox jobs with DB to use ubuntu-trusty | 10:35 |
| marekd | stevemar: so, all jenkins jobs would be running on top Mysql and postgres?! | 10:36 |
| marekd | cool! | 10:36 |
| marekd | more realistic testing suite | 10:36 |
| stevemar | hmm, i guess it does some set up for that... | 10:37 |
| *** dims has joined #openstack-keystone | 10:44 | |
| nisha | stevemar: marekd : nice taking to you! Gotta catch a flight in few hours | 10:46 |
| nisha | thanks for all the help, will try to fix the errors later :) | 10:46 |
| marekd | nisha: good luck1 | 10:46 |
| *** lhcheng has quit IRC | 10:47 | |
| *** nisha has left #openstack-keystone | 10:48 | |
| openstackgerrit | Merged openstack/keystone: Fix warning when running tox https://review.openstack.org/289635 | 10:52 |
| marekd | stevemar: ^^ fast, he? | 10:52 |
| odyssey4me | stevemar rumour has it you're lonely at UTC+1? | 11:10 |
| stevemar | odyssey4me: so lonely :( | 11:10 |
| stevemar | odyssey4me: but lunch soon! | 11:10 |
| odyssey4me | haha, but the gate queues are nice and low in the morning :) | 11:10 |
| odyssey4me | try working on weekends when the gate queues are <10 long... it's amazing | 11:11 |
| *** ninag has joined #openstack-keystone | 11:12 | |
| *** trown has joined #openstack-keystone | 11:13 | |
| *** trown is now known as trown|outtypewww | 11:14 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 11:15 |
| *** ninag has quit IRC | 11:17 | |
| *** rk4n has joined #openstack-keystone | 11:19 | |
| *** rk4n has quit IRC | 11:23 | |
| *** wxy has quit IRC | 11:29 | |
| *** dave-mccowan has joined #openstack-keystone | 11:33 | |
| *** sheel has joined #openstack-keystone | 11:38 | |
| *** wxy has joined #openstack-keystone | 11:39 | |
| rcernin | ayoung, can you integrate keystone v2 with AD? | 11:40 |
| *** rk4n has joined #openstack-keystone | 11:43 | |
| *** fpatwa_ has joined #openstack-keystone | 11:46 | |
| *** fpatwa_ has quit IRC | 11:51 | |
| *** permalac has quit IRC | 11:55 | |
| *** EinstCrazy has joined #openstack-keystone | 11:56 | |
| *** jaosorior has quit IRC | 12:02 | |
| *** jaosorior has joined #openstack-keystone | 12:02 | |
| *** bjornar has joined #openstack-keystone | 12:05 | |
| stevemar | rcernin: you sure can! | 12:09 |
| stevemar | rcernin: it doesn't matter what version of keystone you use -- keystone supports AD | 12:09 |
| stevemar | you may not have group support, which is sad times | 12:09 |
| *** fpatwa_ has joined #openstack-keystone | 12:09 | |
| stevemar | odyssey4me: marekd, so apparently after lunch time everyone starts joining up! getting all sorts of pings from early risers | 12:10 |
| *** rodrigods has quit IRC | 12:11 | |
| *** rodrigods has joined #openstack-keystone | 12:11 | |
| *** andreykurilin__ has joined #openstack-keystone | 12:14 | |
| *** pece has joined #openstack-keystone | 12:15 | |
| *** _pece has quit IRC | 12:16 | |
| andreykurilin__ | hi all! Does it possible to setup devstack with keystone v3 as an identity api by default? | 12:17 |
| *** rk4n has quit IRC | 12:19 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:25 | |
| odyssey4me | stevemar yeah, we get a quiet morning to be all productive and stuff - then herd the cats all afternoon :p | 12:26 |
| stevemar | odyssey4me: damn those cats | 12:32 |
| *** gordc has joined #openstack-keystone | 12:35 | |
| marekd | ++ | 12:38 |
| *** fpatwa_ has quit IRC | 12:45 | |
| *** trown|outtypewww has quit IRC | 12:48 | |
| *** tomoiaga has quit IRC | 12:51 | |
| *** tomoiaga has joined #openstack-keystone | 12:52 | |
| *** Nirupama has quit IRC | 12:56 | |
| *** markvoelker has quit IRC | 12:57 | |
| *** markvoelker has joined #openstack-keystone | 12:57 | |
| *** edmondsw has joined #openstack-keystone | 12:57 | |
| *** markvoelker_ has joined #openstack-keystone | 12:59 | |
| *** markvoelker has quit IRC | 13:01 | |
| *** doug-fish has joined #openstack-keystone | 13:07 | |
| *** Soni has joined #openstack-keystone | 13:11 | |
| Soni | Hi | 13:11 |
| Soni | Need some help | 13:11 |
| Soni | regarding endpoint filter in keystone | 13:11 |
| Soni | Anyone? | 13:11 |
| stevemar | Soni: ask away and stay online :) | 13:12 |
| stevemar | Soni: eventually someone will answer you, we're just not always available every minute :) | 13:12 |
| *** SAshish has joined #openstack-keystone | 13:12 | |
| SAshish | Thanks :) I am asking on behalf of Soni | 13:13 |
| SAshish | I have a keystone v3 setup and using keystone API. Can someone please tell me how to know whether my keystone uses endpoint filter or not? | 13:14 |
| rodrigods | stevemar, any talk in Austin? | 13:15 |
| stevemar | SAshish: depends on the keystone version, i think as of liberty we deploy it by default | 13:16 |
| stevemar | rodrigods: i think i'm on a panel? what about you? | 13:16 |
| rodrigods | stevemar, didn't submit anything, will be just watching :) | 13:17 |
| SAshish | thanks Steve, Any way to get it confirmed? | 13:17 |
| rodrigods | stevemar, link for the panel? | 13:17 |
| stevemar | rodrigods: ah, that makes getting a talk accepted rather difficult | 13:17 |
| SAshish | I mean any API call ? | 13:18 |
| stevemar | SAshish: try GET /v3//OS-EP-FILTER/endpoint_groups and see if it 404's | 13:18 |
| stevemar | if it does, then it's not in the pipeline just yet! | 13:18 |
| stevemar | rodrigods: https://www.openstack.org/summit/austin-2016/summit-schedule/events/7795 | 13:19 |
| rodrigods | stevemar, awesome | 13:20 |
| *** tellesnobrega_af is now known as tellesnobrega | 13:24 | |
| *** palexster has quit IRC | 13:25 | |
| ayoung | rcernin, there is not Keystone V2. Only Zuul. | 13:44 |
| ayoung | stevemar, stop lying to rcernin | 13:45 |
| rcernin | ayoung, cheers, is there any guide on downgrading keystone V3 back to V2 with AD support? | 13:48 |
| *** zzzeek has joined #openstack-keystone | 13:48 | |
| *** dave-mccowan has quit IRC | 13:48 | |
| ayoung | rcernin, there is no V2. Anyone who says differently is selling something | 13:48 |
| *** dave-mccowan has joined #openstack-keystone | 13:48 | |
| ayoung | rcernin, OK...here is the real deal | 13:48 |
| *** lennyb__ is now known as lennyb | 13:49 | |
| ayoung | V2 does not support multiple domains | 13:49 |
| ayoung | rcernin, usually, when you do AD/LDAP you can't write users to the Directory Server STore | 13:49 |
| ayoung | so, the best option is to do this: http://adam.younglogic.com/2014/08/getting-service-users-out-of-ldap/ | 13:49 |
| ayoung | if you do that, then you can, possibly, make the LDAP backed domain the default domain, but you have to be careful not to break your other services: the service users need to use v3 to talk to the Keystone server | 13:50 |
| *** Ephur has joined #openstack-keystone | 13:53 | |
| dstanek | samueldmq: are you still working on https://review.openstack.org/#/c/127433 ? | 13:53 |
| *** jistr is now known as jistr|call | 13:59 | |
| *** markvoelker_ has quit IRC | 14:00 | |
| htruta | ayoung: does that mean that all services use v3 service token by default? | 14:01 |
| ayoung | htruta, well..there is no "default" as you need to explicitly add it to their config files to do so, but yes, they all use V3 | 14:02 |
| htruta | ayoung: but the 'default' config gen with oslo_config and the middleware set them to v3, right? | 14:02 |
| ayoung | htruta, no clue | 14:03 |
| *** rk4n has joined #openstack-keystone | 14:03 | |
| htruta | ayoung: ok | 14:03 |
| stevemar | i get so sad when people think keystone has a v2 or v3 version :( | 14:03 |
| ayoung | htruta, I always assume the worst. THat way, I am sometimes pleasantly surprised | 14:03 |
| *** LZ has quit IRC | 14:04 | |
| ayoung | stevemar, we should just deprecate the entire V2 API | 14:04 |
| ayoung | caput | 14:04 |
| htruta | stevemar: hehe | 14:04 |
| stevemar | rcernin: v2 and v3 are API versions, keystone's versions are released with openstack (havana, grizzly, icehouse, etc...) and since grizzly, keystone supports both API versions | 14:04 |
| stevemar | ayoung: we already did! | 14:05 |
| ayoung | stevemar, including auth | 14:05 |
| stevemar | ayoung: that's deprecated too | 14:05 |
| ayoung | stevemar, really? See. Assume the worst and you are never disappointed | 14:05 |
| *** ninag has joined #openstack-keystone | 14:05 | |
| htruta | ayoung: they're all deprecated, but some have no timeline for removal | 14:05 |
| *** ninag has quit IRC | 14:05 | |
| stevemar | https://github.com/openstack/keystone/commit/e63a8311fa2e5d7cccdb76b4cd3fc17719cc86c6 | 14:05 |
| *** ninag has joined #openstack-keystone | 14:05 | |
| stevemar | ayoung: the CRUD routes have a timeline for removal of Q, the auth routes have no timeline for removal | 14:06 |
| openstackgerrit | David Stanek proposed openstack/keystone: Fixes a few LDAP tests to actually run https://review.openstack.org/289933 | 14:06 |
| ayoung | stevemar, OK. Removing them now.... | 14:06 |
| stevemar | hehe | 14:06 |
| stevemar | i wish! | 14:06 |
| stevemar | ayoung: if you're in the mood for removing crud, hopefully these patches can satisfy your hunger when newton opens up: https://review.openstack.org/#/c/258181/ - https://review.openstack.org/#/c/249486/ and https://review.openstack.org/#/c/257127/ | 14:07 |
| patchbot | stevemar: patch 258181 - python-keystoneclient - remove CLI from keystoneclient | 14:07 |
| patchbot | stevemar: patch 249486 - keystone - Remove eventlet support | 14:07 |
| patchbot | stevemar: patch 257127 - python-keystoneclient - remove oslo-incubator apiclient | 14:07 |
| htruta | FYI, we had a keystone talk accepted: https://www.openstack.org/summit/austin-2016/summit-schedule/events/8458 | 14:08 |
| ayoung | stevemar, remove the -1 and I'll +2 A them now | 14:08 |
| ayoung | heh | 14:08 |
| *** petertr7_away is now known as petertr7 | 14:08 | |
| ayoung | anyway, progress.... | 14:08 |
| stevemar | ayoung: hehe, soon soon :) | 14:08 |
| stevemar | htruta: NICE | 14:08 |
| htruta | we've also submitted one "It's time to move to identity API v3", but it wasn't accepted | 14:08 |
| stevemar | htruta: aww man | 14:09 |
| stevemar | htruta: that would be a good topic | 14:09 |
| htruta | stevemar: :/ | 14:09 |
| stevemar | but i guess it's a known issue :P | 14:09 |
| htruta | stevemar: known issue for us... considering the amount of people that still have v2 doubts in here, I wouldn't say it's well spread | 14:10 |
| openstackgerrit | Merged openstack/keystone: Adding 'domain_id' filter to list_user_projects() https://review.openstack.org/182569 | 14:10 |
| *** pauloewerton has joined #openstack-keystone | 14:11 | |
| rodrigods | htruta, ppl like HMT more than v3 x v2, be proud | 14:12 |
| htruta | rodrigods: I am! hehe | 14:12 |
| stevemar | hmm, we have "fixtures" still in keystoneclient, but they are in keystoneauth now... | 14:14 |
| stevemar | but it looks like other projects still use it: http://codesearch.openstack.org/?q=from%20keystoneclient%20import%20fixture&i=nope&files=&repos= :( | 14:14 |
| stevemar | i wonder if we can do a simple s/keystoneclient/keystoneauth | 14:14 |
| htruta | stevemar: speaking of keystoneauth... I've been using it one of these days, and I created a token auth without passing the project_id and it gave no catalog | 14:15 |
| htruta | stevemar: is this a bug? | 14:15 |
| htruta | I wonder if it shouldn't take the project_id from the token | 14:15 |
| stevemar | htruta: doesn't sound like one, that's what i would expect | 14:16 |
| stevemar | was the token a project scoped token? | 14:16 |
| SAshish | can some one tell me what is client here. class keystoneclient.v3.contrib.endpoint_filter.EndpointFilterManager(client) | 14:16 |
| htruta | stevemar: almost sure it was | 14:16 |
| stevemar | htruta: then it probably should take the project id from the token, like you said | 14:17 |
| *** richm has joined #openstack-keystone | 14:18 | |
| stevemar | jamielennox|away: have we deprecated ksc-kerb yet? | 14:18 |
| stevemar | oh we did, yay! | 14:19 |
| htruta | stevemar: I'll double check and submit a bug | 14:19 |
| stevemar | coolio | 14:19 |
| dstanek | stevemar: wontfix? https://bugs.launchpad.net/keystone/+bug/1280084 | 14:21 |
| openstack | Launchpad bug 1280084 in OpenStack Identity (keystone) "get trust missing @controller.protected" [Medium,Confirmed] | 14:21 |
| stevemar | dstanek: yeah, i saw that recently and it raised an eyebrow | 14:21 |
| stevemar | dstanek: yeah, it's weird... i can't think of a way to undo the change without it being backwards incompatible | 14:22 |
| dstanek | stevemar: i agree. it may be a bug (or feature) that some of those URLs and cases are not controlled by policy | 14:23 |
| dstanek | stevemar: but that bug specifically isn't all that useful | 14:23 |
| stevemar | dstanek: yeah, you know what, let's mark it as won't fix. | 14:23 |
| *** jaugustine has joined #openstack-keystone | 14:23 | |
| stevemar | dstanek: please go ahead and mark it as such | 14:23 |
| dstanek | stevemar: done | 14:26 |
| *** links has quit IRC | 14:27 | |
| *** markvoelker has joined #openstack-keystone | 14:31 | |
| *** doug-fish has quit IRC | 14:32 | |
| *** doug-fish has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct create_project driver versioning https://review.openstack.org/289058 | 14:33 |
| *** EinstCrazy has quit IRC | 14:34 | |
| stevemar | tossed up https://review.openstack.org/#/c/289945/1 | 14:36 |
| patchbot | stevemar: patch 289945 - django-openstack-auth-kerberos - switch to ksa | 14:36 |
| *** doug-fish has quit IRC | 14:37 | |
| *** jistr|call is now known as jistr | 14:40 | |
| edmondsw | htruta stevemar, you can use a token to get another token in another project, so it can't assume which project you want if you don't tell it | 14:44 |
| edmondsw | it will assume you want unscoped, which is also allowed | 14:45 |
| *** doug-fish has joined #openstack-keystone | 14:46 | |
| *** spzala has joined #openstack-keystone | 14:46 | |
| *** markvoelker has quit IRC | 14:50 | |
| ayoung | OK, so I 'm trying my hack again to run Keystone on ports 80/443 in additions to running on ports 5000/35357. And, I am getting an error opening the log file on both admin and main | 14:55 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:55 | |
| ayoung | BTW, I wonder if we can drop admin/main split in V3 in the future. | 14:55 |
| ayoung | But, anyway | 14:55 |
| ayoung | the WSGI process is running as keystone user and group | 14:55 |
| ayoung | WSGIApplicationGroup %{GLOBAL} | 14:56 |
| ayoung | WSGIDaemonProcess keystone_main_11 display-name=keystone-main group=keystone processes=1 threads=1 user=keystone | 14:56 |
| ayoung | SE Linux is set to permissive | 14:56 |
| ayoung | I can su - keystone and echo a value into the log file. so the keystone user has permissions | 14:56 |
| ayoung | It must be something in the WSGI setup | 14:57 |
| *** knikolla has joined #openstack-keystone | 14:58 | |
| edmondsw | ayoung, I just run it on 5000/35357, and then have a reverse proxy setup to point to those from 80/443, rather than trying to run on both | 14:59 |
| ayoung | edmondsw, good, now come and rewrtie Tripleo for me and I'm done | 14:59 |
| edmondsw | ayoung... lol | 15:00 |
| ayoung | edmondsw, there are many ways to divest this particular Feline of its hide | 15:00 |
| *** sdake has joined #openstack-keystone | 15:00 | |
| * edmondsw crawls back under rock | 15:00 | |
| ayoung | edmondsw, nope | 15:00 |
| ayoung | edmondsw, now you need to help me brainstorm | 15:00 |
| lbragstad | dolphm fyi - https://ask.openstack.org/en/question/87887/keystone-notifications-on-addremove-user-to-group/ | 15:00 |
| ayoung | why am I getting a permissons error? | 15:00 |
| ayoung | [Tue Mar 08 14:58:58.519525 2016] [:error] [pid 31057] [remote 10.45.2.8:248] IOError: [Errno 13] Permission denied: '/var/log/keystone/keystone.log' | 15:00 |
| *** knikolla has quit IRC | 15:00 | |
| ayoung | 31057 ? 00:00:00 httpd | 15:01 |
| ayoung | apache 31057 31052 0 14:58 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND | 15:01 |
| edmondsw | ayoung did you set them up to use separate log files, so they're not trying to open the same file? | 15:01 |
| dolphm | lbragstad: we should totally do that | 15:01 |
| ayoung | it is not the Keystone user opening it | 15:01 |
| ayoung | it is the Httpd daemon prefork... | 15:01 |
| ayoung | edmondsw, see you 've been helpful already | 15:01 |
| stevemar | edmondsw: stop hiding under rocks! :) | 15:02 |
| ayoung | But it is a python exception, which means python should have forked already | 15:02 |
| ayoung | but it is called from File "/usr/lib/python2.7/site-packages/keystone/server/wsgi.py", line 38, in initialize_application | 15:03 |
| ayoung | Why does this not fail for 10-keystone that is in a virtual-host> | 15:03 |
| *** phalmos has joined #openstack-keystone | 15:04 | |
| ayoung | edmondsw, so, I thought about the multiple writers issue, but Keystone already logs both main and admin to the same file, so it can't be an exclusive lock | 15:05 |
| edmondsw | ayoung true | 15:06 |
| *** mhickey has quit IRC | 15:06 | |
| ayoung | and I was able to echo a value in there as the keystone user, too. No, it looks like the issue is that the HTTPD user is doing the writing, for some reason | 15:06 |
| *** woodster_ has joined #openstack-keystone | 15:06 | |
| ayoung | and that must have to do with how processes are forked in HTTPD, and it is different for virastul hosts? | 15:06 |
| samueldmq | dstanek: hi, looking | 15:06 |
| dstanek | samueldmq: o | 15:07 |
| dstanek | samueldmq: i'm actually rebasing it now. almost done. checkout my comments and see if you agree | 15:07 |
| samueldmq | dstanek: should we log a warn saying that method is being ignored ? | 15:07 |
| samueldmq | dstanek: yes I do | 15:07 |
| dstanek | samueldmq: maybe | 15:07 |
| samueldmq | dstanek: but I think we should log a warn in the wrapper saying it isn't doing anything | 15:08 |
| samueldmq | dstanek: cool | 15:08 |
| dstanek | i'm just rebasing now and not making any changes | 15:08 |
| ayoung | edmondsw, so my goal here is to eradicate the 5000 and 35357 port expectations. If we keep those around, people will keep using them, and they might end up, in your case, caloling direct as opposed to via the reverse Proxy | 15:08 |
| ayoung | Maybe if I drink more coffee... | 15:09 |
| edmondsw | ayoung what's your LogLevel? | 15:09 |
| edmondsw | maybe turn it down and see if the problem goes away? | 15:09 |
| edmondsw | (as a test) | 15:09 |
| *** knikolla has joined #openstack-keystone | 15:10 | |
| ayoung | edmondsw, IN the apache log? THe Keystone Log? I don't follow your reasoning | 15:11 |
| stevemar | dstanek: good luck with the keystone meeting, sucker! | 15:11 |
| edmondsw | apache | 15:11 |
| ayoung | it appears to be that the initial python application runs as HTTPD. The HTTPD user does not have the right to post to the log file | 15:11 |
| ayoung | I could probably change that | 15:11 |
| edmondsw | seems like httpd is logging something... maybe they only log something if you have the log level turned way up? | 15:12 |
| ayoung | ...let's see, got grins | 15:12 |
| ayoung | edmondsw, nah, it is in the initialization | 15:12 |
| ayoung | File "/usr/lib/python2.7/site-packages/oslo_log/log.py", line 319, in _setup_logging_from_conf | 15:12 |
| *** knikolla has quit IRC | 15:12 | |
| dstanek | stevemar: is that really all there is on the agenda? | 15:12 |
| dstanek | stevemar: when does m3 actually get cut? | 15:13 |
| ayoung | edmondsw, Ok, not a straight permissions error. I get it even with: -rw-rw-rw-. 1 keystone apache 1175807 Mar 8 15:08 /var/log/keystone/keystone.log | 15:16 |
| edmondsw | ugh | 15:16 |
| edmondsw | ayoung what does the error look like? | 15:17 |
| ayoung | edmondsw, its the directory | 15:17 |
| ayoung | making the dir world readable moved the problem down the line | 15:17 |
| ayoung | now it is is reading the config file? | 15:17 |
| ayoung | find_paste_config | 15:18 |
| ayoung | so the real question is why is it trying to do all this stuff as apache, and not as keystone? | 15:18 |
| ayoung | what did I fat finger here? | 15:18 |
| *** spzala has quit IRC | 15:20 | |
| *** mhickey has joined #openstack-keystone | 15:20 | |
| *** phalmos has quit IRC | 15:21 | |
| *** knikolla has joined #openstack-keystone | 15:23 | |
| *** jorge_munoz has joined #openstack-keystone | 15:25 | |
| *** pushkaru has joined #openstack-keystone | 15:26 | |
| ayoung | edmondsw, ok...so I think the answer is here http://paste.openstack.org/show/489694/ | 15:28 |
| ayoung | WSGIProcessGroup keystone_main_11 | 15:28 |
| ayoung | is not tied to the line above it | 15:28 |
| *** phalmos has joined #openstack-keystone | 15:28 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove foreign assignments when deleting a domain https://review.openstack.org/127433 | 15:32 |
| dstanek | samueldmq: ^ | 15:32 |
| dstanek | samueldmq: i fixed the issues i brought up too | 15:33 |
| edmondsw | ayount how would you tie them together? | 15:34 |
| edmondsw | ayoung even | 15:34 |
| ayoung | edmondsw, no idea. Maybe the problem is that the Application group is global? | 15:34 |
| edmondsw | ayoung oh, you mean in the Location block | 15:34 |
| *** EinstCrazy has joined #openstack-keystone | 15:34 | |
| ayoung | yeah, but I don;t think location works to scope it | 15:35 |
| edmondsw | yeah | 15:35 |
| ayoung | http://modwsgi.readthedocs.org/en/develop/configuration-directives/WSGIProcessGroup.html | 15:35 |
| ayoung | server config, virtual host, directory | 15:35 |
| samueldmq | dstanek: lgtm, thanks for updating it | 15:36 |
| dstanek | samueldmq: gotta be bug squashing! | 15:36 |
| *** bunting has left #openstack-keystone | 15:37 | |
| ayoung | edmondsw, directory | 15:38 |
| ayoung | A directive marked as being valid in this context may be used inside <Directory>, <Location>, <Files>, <If>, and <Proxy> containers in the server configuration files, subject to the restrictions outlined in Configuration Sections. | 15:38 |
| ayoung | https://httpd.apache.org/docs/2.4/mod/directive-dict.html#Context | 15:38 |
| ayoung | so Location should be OK... | 15:38 |
| *** ff has joined #openstack-keystone | 15:39 | |
| samueldmq | dstanek: ++ | 15:40 |
| samueldmq | O/ | 15:40 |
| *** EinstCrazy has quit IRC | 15:41 | |
| *** rha has joined #openstack-keystone | 15:42 | |
| *** ksavich has joined #openstack-keystone | 15:45 | |
| *** permalac has joined #openstack-keystone | 15:46 | |
| dstanek | do we care about this? https://bugs.launchpad.net/keystone/+bug/1279750 | 15:47 |
| openstack | Launchpad bug 1279750 in OpenStack Identity (keystone) "username validation 64 chars but can be 255 in database" [Low,In progress] - Assigned to Trevor McCasland (twm2016) | 15:47 |
| *** links has joined #openstack-keystone | 15:52 | |
| *** slberger has joined #openstack-keystone | 15:53 | |
| *** tomoiaga has quit IRC | 15:55 | |
| *** permalac_ has joined #openstack-keystone | 15:56 | |
| *** phalmos has quit IRC | 15:57 | |
| *** mhickey_ has joined #openstack-keystone | 15:57 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:57 | |
| *** tellesnobrega_af is now known as tellesnobrega | 15:59 | |
| *** mhickey has quit IRC | 15:59 | |
| *** daemontool_ has joined #openstack-keystone | 15:59 | |
| *** permalac has quit IRC | 16:00 | |
| *** daemontool has quit IRC | 16:01 | |
| *** sdake_ has joined #openstack-keystone | 16:05 | |
| *** sdake has quit IRC | 16:05 | |
| htruta | edmondsw: makes sense | 16:06 |
| dolphm | jorge_munoz: https://review.openstack.org/#/c/278693/ | 16:06 |
| patchbot | dolphm: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 16:06 |
| *** phalmos has joined #openstack-keystone | 16:09 | |
| *** bjornar has quit IRC | 16:10 | |
| *** browne has joined #openstack-keystone | 16:19 | |
| *** jaosorior has quit IRC | 16:21 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 16:21 |
| *** petertr7 is now known as petertr7_away | 16:24 | |
| *** david-lyle_ is now known as david-lyle | 16:28 | |
| openstackgerrit | Merged openstack/keystone: Un-wrap function https://review.openstack.org/289642 | 16:28 |
| *** henrynash has joined #openstack-keystone | 16:29 | |
| *** ChanServ sets mode: +v henrynash | 16:29 | |
| *** belmoreira has quit IRC | 16:29 | |
| *** gyee has joined #openstack-keystone | 16:34 | |
| *** ChanServ sets mode: +v gyee | 16:34 | |
| lbragstad | jorge_munoz it was between these two reviews - https://review.openstack.org/#/c/278802/ https://review.openstack.org/#/c/278693/ cc dolphm | 16:35 |
| patchbot | lbragstad: patch 278802 - keystone - Remove support for trust scoped tokens in v2.0 (ABANDONED) | 16:35 |
| patchbot | lbragstad: patch 278693 - keystone - Make fernet support trust auth against v2.0 | 16:35 |
| *** sdake_ is now known as sdake | 16:36 | |
| *** EinstCrazy has joined #openstack-keystone | 16:40 | |
| *** petertr7_away is now known as petertr7 | 16:41 | |
| *** pgbridge has joined #openstack-keystone | 16:43 | |
| *** phalmos has quit IRC | 16:44 | |
| *** EinstCrazy has quit IRC | 16:46 | |
| openstackgerrit | guang-yee proposed openstack/keystoneauth: Support TOTP auth plugin https://review.openstack.org/281086 | 16:46 |
| *** SAshish has quit IRC | 16:52 | |
| *** browne has quit IRC | 16:54 | |
| *** ff has quit IRC | 16:55 | |
| *** ff has joined #openstack-keystone | 16:56 | |
| *** ff has quit IRC | 16:58 | |
| lbragstad | morgan dstanek dolphm I'd be happy to get your opinion on my latest comments here https://review.openstack.org/#/c/288643/4 (in the bug report or the patch) | 16:59 |
| patchbot | lbragstad: patch 288643 - keystone - Send notifications with entity name in payload | 16:59 |
| *** rderose has joined #openstack-keystone | 17:01 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Changes the policy to allow non-admin users to List and Get service providers. https://review.openstack.org/290020 | 17:02 |
| *** lhcheng has joined #openstack-keystone | 17:05 | |
| *** ChanServ sets mode: +v lhcheng | 17:05 | |
| *** dan_nguyen has joined #openstack-keystone | 17:06 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Policy to allow non-admin users to List and Get service providers. https://review.openstack.org/290020 | 17:14 |
| *** daemontool_ has quit IRC | 17:16 | |
| ayoung | edmondsw, so...I am sure you want some closuer on our conversation this morning. I found out what was causing the mess up | 17:17 |
| ayoung | it was two things | 17:17 |
| ayoung | first, I had 2 threads, and oslo-conf does not like threads, | 17:17 |
| ayoung | but the real problem was that I was matching on | 17:18 |
| ayoung | <Location "/keystone/admin/"> instead of <Location "/keystone/admin"> | 17:18 |
| bknudson | ayoung: devstack has a sample apache config - http://git.openstack.org/cgit/openstack-dev/devstack/tree/files/apache-keystone.template | 17:20 |
| ayoung | bknudson, I know | 17:20 |
| ayoung | bknudson, and now that you've made the mistake of drawing my attention, can you tell me what I hate about those? | 17:21 |
| bknudson | I don't know what you think is wrong with it. | 17:21 |
| bknudson | since you haven't posted a review to fix it | 17:21 |
| *** daemontool has joined #openstack-keystone | 17:21 | |
| *** bjornar has joined #openstack-keystone | 17:22 | |
| openstackgerrit | Merged openstack/keystone: Fixes a few LDAP tests to actually run https://review.openstack.org/289933 | 17:22 |
| *** permalac_ has quit IRC | 17:22 | |
| bknudson | seems to work pretty well since the gate's passing | 17:22 |
| ayoung | bknudson, virtual host. port 5000 35357 | 17:22 |
| ayoung | bknudson, that is because the whole world is taking crazy pills | 17:23 |
| bknudson | those are pretty much required for tempest. | 17:23 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Clarify virtualenv setup in developer docs https://review.openstack.org/290029 | 17:23 |
| bknudson | unfortunately tempest doesn't support doing requests on /identity/ yet | 17:23 |
| ayoung | bknudson, hence: http://adam.younglogic.com/2016/02/keystone-on-port-80-for-tripleo/ | 17:23 |
| ayoung | bknudson, so I a trying to run them side by side. | 17:23 |
| *** browne has joined #openstack-keystone | 17:24 | |
| bknudson | do you run tempest on tr | 17:24 |
| ayoung | leave the 5000/35357 tehre, but add in another that is on the server default | 17:24 |
| ayoung | bknudson, I was just getting it set up for the first time | 17:24 |
| bknudson | devstack apache config listens on both :5000 and :80 | 17:24 |
| ayoung | bknudson, but in seaprate virtual hosts | 17:24 |
| *** pece has quit IRC | 17:25 | |
| bknudson | I think I need the virtualhost to get apache to accept on :5000? | 17:25 |
| ayoung | specifically, 80 and 443 are the server defaults. So I wanted to make sure what I did worked outside a virtual host. | 17:25 |
| ayoung | I have not yet tried to get 443 working, as that is usually a virtual host, too.... | 17:25 |
| *** d0ugal has quit IRC | 17:26 | |
| *** harlowja has joined #openstack-keystone | 17:29 | |
| ayoung | bknudson, is there any reason to do both /identity/admin and /identity/main now, or can I just put a single /identity in there? | 17:32 |
| ayoung | and have /identity/v3 etc | 17:32 |
| *** rcernin has quit IRC | 17:34 | |
| bknudson | ayoung: admin and main are different for v2 | 17:39 |
| *** wxy has quit IRC | 17:39 | |
| ayoung | bknudson, I keep forgetting we haven't killed v2 yet | 17:40 |
| *** spandhe has joined #openstack-keystone | 17:40 | |
| bknudson | another configuration that we could try is have keystone run as uwsgi and apache does reverse-proxy | 17:41 |
| bknudson | run keystone under uwsgi or gunicorn or something | 17:41 |
| bknudson | apache could be reverse-proxy http or whatever protocols uwsgi/gunicorn support | 17:42 |
| *** jistr has quit IRC | 17:43 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 17:44 |
| *** EinstCrazy has joined #openstack-keystone | 17:44 | |
| *** EinstCrazy has quit IRC | 17:49 | |
| *** knikolla has quit IRC | 17:53 | |
| *** rk4n has quit IRC | 17:58 | |
| *** tsymanczyk has joined #openstack-keystone | 17:58 | |
| *** mvk has quit IRC | 18:00 | |
| henrynash | stevemar: tried to modify meeting agenda…can’t seem to save anymore! | 18:00 |
| stevemar | henrynash: there's an anti-spam thing at the top of the wiki page now, with a lame question like "What's the first letter of this sentence" | 18:01 |
| *** agrebennikov has joined #openstack-keystone | 18:02 | |
| henrynash | stevemar: gahhh | 18:02 |
| *** e0ne has joined #openstack-keystone | 18:03 | |
| agrebennikov | stevemar, hi, I have a question/comment about https://review.openstack.org/#/c/289537/ | 18:03 |
| patchbot | agrebennikov: patch 289537 - keystone (stable/liberty) - Backported POSIX groups support for MOS 8 | 18:03 |
| stevemar | agrebennikov: i'm on mobile, but the rest of the keystone team should be able to help out, bknudson dstanek and others | 18:04 |
| agrebennikov | stevemar, ok, let me find out who was reviewing that one | 18:04 |
| agrebennikov | dstanek, let me know if you are able to discuss the original patch https://review.openstack.org/#/c/258528/ | 18:05 |
| patchbot | agrebennikov: patch 258528 - keystone - Enable support for posixGroups in LDAP (MERGED) | 18:05 |
| dstanek | agrebennikov: sure, after the meeting i'll get back to yo | 18:06 |
| dstanek | u | 18:06 |
| *** petertr7 is now known as petertr7_away | 18:06 | |
| agrebennikov | dstanek, ok, thanks! (the idea is that you guys allowed to merge non-working one ;) ) | 18:06 |
| dstanek | agrebennikov: you found a bug? | 18:07 |
| agrebennikov | yep | 18:07 |
| agrebennikov | dstanek, just ping me when you back please | 18:07 |
| dstanek | agrebennikov: ok, can you file a bug? | 18:09 |
| *** Guest40848 has quit IRC | 18:09 | |
| agrebennikov | dstanek, I can, but I'm just not sure if it makes sense to start over or we can work it out as commit change | 18:11 |
| agrebennikov | dstanek, (if it is possible in general) | 18:11 |
| agrebennikov | dstanek, I'll probably re-open initial one | 18:11 |
| *** ankita_wagh has joined #openstack-keystone | 18:11 | |
| *** shaleh has joined #openstack-keystone | 18:12 | |
| *** sdake_ has joined #openstack-keystone | 18:15 | |
| *** e0ne has quit IRC | 18:17 | |
| *** e0ne has joined #openstack-keystone | 18:17 | |
| *** e0ne has quit IRC | 18:17 | |
| dstanek | agrebennikov: sounds good. give as much details as you can | 18:18 |
| agrebennikov | dstanek, https://bugs.launchpad.net/keystone/+bug/1526462/comments/12 | 18:18 |
| openstack | Launchpad bug 1526462 in OpenStack Identity (keystone) "Need support for OpenDirectory in LDAP driver" [Medium,Fix released] - Assigned to Alexander Makarov (amakarov) | 18:18 |
| *** markvoelker has joined #openstack-keystone | 18:18 | |
| agrebennikov | dstanek, please take a look | 18:18 |
| morgan | dstanek, agrebennikov: usually config options are not back portable | 18:18 |
| morgan | fyi | 18:18 |
| *** sdake has quit IRC | 18:19 | |
| agrebennikov | morgan, do you mean we cannot take it back to liberty? | 18:19 |
| morgan | even if default behavior isn't changed, it is semi-icky to backport a change with a config option | 18:19 |
| morgan | agrebennikov: if the default behavior is changed at all, it isn't backportable. and even if default behavior is the same, new options would be an extreme case | 18:20 |
| lbragstad | jorge_munoz https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3.py#L309 | 18:20 |
| *** sdake_ is now known as sdake | 18:20 | |
| *** jasonsb has quit IRC | 18:20 | |
| agrebennikov | morgan, that's sad... seems it will be custom one for the current deployment... | 18:20 |
| morgan | agrebennikov: http://docs.openstack.org/project-team-guide/stable-branches.html#review-guidelines | 18:21 |
| morgan | agrebennikov: this is somewhere between a "new feature" and a "bug fix" | 18:22 |
| morgan | agrebennikov: i would want more stable-core folks to sign off on it [not just keystone stable core] | 18:23 |
| *** links has quit IRC | 18:23 | |
| *** mhickey_ has quit IRC | 18:25 | |
| *** jbell8 has joined #openstack-keystone | 18:25 | |
| agrebennikov | morgan, "There is no rule about how often or how many bugs found and fixed in master should be backported to stable branches" ;) | 18:25 |
| *** petertr7_away is now known as petertr7 | 18:26 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:28 | |
| morgan | agrebennikov: it is what is being added i am pointing out | 18:31 |
| morgan | this is somewhere between a bug and a feature | 18:31 |
| morgan | and it adds config options | 18:31 |
| agrebennikov | morgan, right | 18:31 |
| morgan | agrebennikov: so i'd like some of the stable-core to weigh in | 18:32 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 18:32 |
| morgan | before we accept it as a backport (not just keystone stable folks) | 18:32 |
| morgan | i'll support it if stable maintainers don't have an issue with it | 18:32 |
| * morgan isn't against it. | 18:32 | |
| morgan | :) | 18:32 |
| morgan | for the record | 18:32 |
| agrebennikov | morgan, the problem is as usually - you guys mostly are focused on just development in master and stables are only for actually Fixing bugs. What happens in the field is something different | 18:32 |
| morgan | agrebennikov: the nice thing is it is in master, right? for mitaka | 18:33 |
| agrebennikov | morgan, we are doing some large deployments with kilo and liberty for now | 18:33 |
| *** jbell8 has quit IRC | 18:33 | |
| agrebennikov | morgan, and we Just started with liberty | 18:33 |
| morgan | so, i am on the stable keystone team. i am just asking for you to get eyes from the main stable core folks | 18:33 |
| morgan | so that i feel good with the backport | 18:34 |
| morgan | mtreinish: ^ cc (re stavle backport) | 18:34 |
| dims | @morgan : over on #openstack-stable? | 18:34 |
| morgan | dims: yeah that would be good. | 18:34 |
| mtreinish | morgan: which patch? | 18:34 |
| morgan | dims: i can't keep track of all the things... | 18:34 |
| morgan | https://review.openstack.org/#/c/289537/3 | 18:34 |
| patchbot | morgan: patch 289537 - keystone (stable/liberty) - Backported POSIX groups support for MOS 8 | 18:34 |
| morgan | there is an original one with the changeid, but ignoring that - that is basically the code | 18:35 |
| *** markvoelker has quit IRC | 18:35 | |
| morgan | that would be backported [so if the changeid/other bits are fixed] | 18:35 |
| morgan | how does the stable team feel about it. i'll be ok with it if the -stable folks are | 18:35 |
| mtreinish | morgan: that looks like a feature backport | 18:36 |
| mtreinish | wrapped in a bug number | 18:36 |
| morgan | mtreinish: that was my gut response | 18:36 |
| morgan | mtreinish: i THINK it's somewhere between featuere and bug, but leaning towards feature | 18:37 |
| *** markvoelker has joined #openstack-keystone | 18:37 | |
| mtreinish | right, and I'd support your -2 on that backport on those grounds | 18:37 |
| mtreinish | (assuming you want to play the bad guy instead of me :) ) | 18:37 |
| morgan | eh, i can play bad guy but wanted agrebennikov to get the feedback on why more directly :) | 18:38 |
| mtreinish | well based on the lack of a commit msg, it's needed for the mirantis product :) | 18:38 |
| morgan | agrebennikov: ^ so this is too close to a feature add for a stable backport - sorry. =/ . You'll need to carry this code for your deplyments unless you can swing dims and mtreinish's views | 18:39 |
| morgan | agrebennikov: but upgrade to mitaka [when it happens] will mean you can drop your version of it. | 18:39 |
| morgan | mtreinish: i assumed the commit msg/change-id would be fixed before it landed - but i was basing my view and looking for confirmation based on content | 18:40 |
| agrebennikov | morgan, mtreinish well... this was actually my mistake originally - I didn't point an attention that I'm commiting to upstream. | 18:40 |
| morgan | agrebennikov: anyway. sorry for the bad news. | 18:40 |
| dims | agrebennikov : morgan : mtreinish : i agree with the call as that's the current policy | 18:41 |
| morgan | agrebennikov: if there is something non-behavior impacting (and no new options) that can solve the problem, we can revisit | 18:41 |
| morgan | mtreinish: can you -2 it? i can't get LP to log me in. =( | 18:42 |
| mtreinish | morgan: sure | 18:42 |
| morgan | mtreinish: my x1c broke this weekend...and the macbook is ... ugh | 18:42 |
| morgan | mtreinish: and by broke... i mean.. i have to replace it =/ | 18:43 |
| *** sdake_ has joined #openstack-keystone | 18:43 | |
| agrebennikov | all right, thanks anyway | 18:43 |
| mtreinish | morgan: ugh, that sucks | 18:44 |
| morgan | agrebennikov: np. like i said, if there is another way that isn't as feature-like we can definitely discuss it | 18:44 |
| *** sdake has quit IRC | 18:45 | |
| mtreinish | morgan: do you get to replace it under warranty? Or do you have to get a new one out of pocket? | 18:45 |
| *** phalmos has joined #openstack-keystone | 18:45 | |
| morgan | mtreinish: the screen was shattered because i knocked it off a desk | 18:46 |
| morgan | and the hinges broke | 18:46 |
| mtreinish | yikes | 18:46 |
| morgan | hit just right to break the screen off from the body of the laptop | 18:46 |
| morgan | had a horrible migrane and phone went off right when i fell asleep | 18:46 |
| dims | morgan : ouch | 18:46 |
| morgan | in an effort ot silence the phone knocked the laptop pretty hard and it went flying | 18:46 |
| morgan | and all the wifi antennae are in the screen, so even if i connect it to an external monitor... it's not super useful. | 18:47 |
| mtreinish | morgan: you still have the weird ethernet port pigtail thing | 18:49 |
| mtreinish | I've never used that before :) | 18:50 |
| *** sdake_ is now known as sdake | 18:50 | |
| *** trown has joined #openstack-keystone | 18:52 | |
| *** belmoreira has joined #openstack-keystone | 18:52 | |
| *** petertr7 is now known as petertr7_away | 18:53 | |
| morgan | mtreinish: i'd need to buy another one... and find an ethernet port | 18:53 |
| morgan | mtreinish: i don't... have one. | 18:53 |
| *** petertr7_away is now known as petertr7 | 18:54 | |
| *** knikolla has joined #openstack-keystone | 18:55 | |
| *** ankita_wagh has quit IRC | 18:55 | |
| *** anush has joined #openstack-keystone | 18:55 | |
| *** ankita_wagh has joined #openstack-keystone | 18:56 | |
| *** ninag has quit IRC | 18:57 | |
| *** rderose has quit IRC | 18:57 | |
| *** ninag has joined #openstack-keystone | 18:57 | |
| *** henrynash has quit IRC | 18:59 | |
| *** doug-fis_ has joined #openstack-keystone | 18:59 | |
| *** anush has quit IRC | 19:00 | |
| *** ninag_ has joined #openstack-keystone | 19:00 | |
| *** ninag_ has quit IRC | 19:00 | |
| gyee | dstanek, lbragstad, have you ever try to change username in a production system? | 19:01 |
| *** ninag_ has joined #openstack-keystone | 19:01 | |
| dstanek | gyee: openstack or other? | 19:01 |
| lbragstad | nope | 19:01 |
| gyee | dstanek, any | 19:01 |
| dstanek | gyee: yes, of course, but not in openstack | 19:01 |
| *** bapalm has quit IRC | 19:02 | |
| *** ninag has quit IRC | 19:02 | |
| shaleh | pretty easy on the old Unix systems. vipw, fix the name, wait for NIS to catch up | 19:02 |
| shaleh | the UID was the important bit. The text is for us people. | 19:02 |
| *** doug-fish has quit IRC | 19:02 | |
| *** doug-fish has joined #openstack-keystone | 19:03 | |
| *** doug-fish has quit IRC | 19:03 | |
| *** doug-fish has joined #openstack-keystone | 19:03 | |
| shaleh | gyee: is it particularly hard in OpenStack? The UUID is the bit passed around everywhere. | 19:03 |
| dstanek | be back in a few | 19:03 |
| *** doug-fis_ has quit IRC | 19:04 | |
| gyee | shaleh, it depends what the cloud providers allow you to do | 19:04 |
| shaleh | gyee: I never expect to be able to do it as myself. I always expect the need of admins. | 19:05 |
| shaleh | gyee: when it just works for me, that is great. | 19:05 |
| *** jbell8 has joined #openstack-keystone | 19:05 | |
| gyee | shaleh, try changing your username for corp AD and see if 1) they let you, and 2) how many apps break after that :-) | 19:06 |
| shaleh | gyee: like I said, I expect admin help. | 19:06 |
| shaleh | and yes, Windows is particularly stupid about this. I have worked with enough women over the years to see them struggle. | 19:06 |
| shaleh | lbragstad: the needs love list is looking a little more sane. More of them are under current activity now. | 19:07 |
| *** tellesnobrega is now known as tellesnobrega_af | 19:09 | |
| lbragstad | shaleh awesome - thanks! | 19:09 |
| shaleh | lbragstad: little steps to the goal right? | 19:10 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 19:10 |
| lbragstad | shaleh thats right | 19:10 |
| *** anush has joined #openstack-keystone | 19:10 | |
| *** ninag_ has quit IRC | 19:11 | |
| *** ninag has joined #openstack-keystone | 19:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Send notifications with entity name in payload https://review.openstack.org/288643 | 19:12 |
| *** ninag has quit IRC | 19:12 | |
| *** ninag has joined #openstack-keystone | 19:13 | |
| *** ninag has quit IRC | 19:14 | |
| *** ninag has joined #openstack-keystone | 19:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor TestFernetTokenProvider unscoped token tests https://review.openstack.org/286906 | 19:17 |
| *** markus_z has joined #openstack-keystone | 19:17 | |
| markus_z | bknudson: hi, do you have a minute? | 19:17 |
| bknudson | markus_z: sure | 19:17 |
| lbragstad | bknudson comments addressed - https://review.openstack.org/#/c/286906/3/keystone/tests/unit/test_v3_auth.py | 19:17 |
| patchbot | lbragstad: patch 286906 - keystone - Refactor TestFernetTokenProvider unscoped token tests | 19:17 |
| markus_z | bknudson: I'm going through old nova bugs and found this one: https://bugs.launchpad.net/nova/+bug/1464750 | 19:17 |
| openstack | Launchpad bug 1464750 in OpenStack Compute (nova) "Service accounts can be used to login horizon" [Undecided,Incomplete] - Assigned to Adam Young (ayoung) | 19:17 |
| markus_z | bknudson: I'm unsure what to do with this one | 19:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor TestFernetTokenProvider domain-scoped tests https://review.openstack.org/286907 | 19:18 |
| ayoung | markus_z, dynamic policy. | 19:18 |
| ayoung | markus_z, why should not a service account be able to log in to Horizon? | 19:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor TestFernetTokenProvider project-scoped tests https://review.openstack.org/286908 | 19:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor TestFernetTokenProvider trust-scoped tests https://review.openstack.org/286909 | 19:19 |
| *** bapalm has joined #openstack-keystone | 19:19 | |
| bknudson | markus_z: there should be some way to disallow a user logging in to horizon? That sounds like a horizon issue if they don't provide some way to do that | 19:19 |
| bknudson | I don't think keystone is ever going to have anything that says that a user can log into horizon or not | 19:19 |
| markus_z | IIUC it's that a service user has admin rights. I can use the same credentials with a CLI client, right? | 19:19 |
| bknudson | but they could implement it using roles | 19:19 |
| bknudson | not all service users have admin rights | 19:20 |
| shaleh | lbragstad: in your notifications patch, you have a few places with 'if foo.get('name')'. So 'name' is always set but it might be empty/None? | 19:20 |
| markus_z | That it can log in to horizon is a minor thing I guess? | 19:20 |
| markus_z | ayoung: I don't understand what you mean with "dynamic policy". Is this a keystone concept? | 19:20 |
| bknudson | whether it's minor or not depends on the deployer... some companies may just not user openstack because of this | 19:20 |
| david-lyle | why would I block a service user from logging in? | 19:20 |
| lbragstad | shaleh actually - we might not be doing that approach anymore... do you have thoughts on this: https://bugs.launchpad.net/keystone/+bug/1552795 | 19:21 |
| openstack | Launchpad bug 1552795 in OpenStack Identity (keystone) "enhance notification for user events with user name" [Wishlist,In progress] - Assigned to Lance Bragstad (lbragstad) | 19:21 |
| ayoung | markus_z, heh...too much context. Short answer is we don't have a general solution to that problem yet | 19:21 |
| shaleh | lbragstad: let me look | 19:21 |
| markus_z | ayoung: I wasn't fully sure that it is a real problem, to be honest. | 19:21 |
| ayoung | markus_z, so, Horizon has long wanted a way to be able to query a users capabilities from a token. And we don't really ahve that | 19:22 |
| bknudson | david-lyle: I think you would block service users from horizon because service users don't need to use horizon. | 19:22 |
| ayoung | markus_z, so, a service use is a case of a user with no-viable roles | 19:23 |
| markus_z | ok, I can follow | 19:23 |
| david-lyle | bknudson: but what's the downside? | 19:23 |
| ayoung | but, it could also be chaning the view so that users that have no network roles don't see the network tab | 19:23 |
| ayoung | etc etc | 19:23 |
| ayoung | david-lyle, you cornered me at the Summit how many years ago about this? | 19:23 |
| shaleh | lbragstad: yeah, while I am not a fan of the UX with UUID it is more flexible and probably the right thing to do. | 19:23 |
| david-lyle | ayoung: we honor that now, based on policy and service catalog contents | 19:24 |
| shaleh | lbragstad: could you maybe post this to -operators and get some feedback there? | 19:25 |
| ayoung | david-lyle, yeah, it is a lot bettter than it was | 19:25 |
| bknudson | david-lyle: the downside of allowing service users to login to horizon? The only thing I can think of is if there's a security flaw in horizon that a user could exploit that they couldn't exploit using the api directly. | 19:26 |
| shaleh | lbragstad: maybe we need to document why the log has what it has and point at snippets for how to improve their experience? | 19:26 |
| markus_z | ayoung: bknudson: I'm asking from a Nova point of view and I have no clue what we should do about that. | 19:26 |
| lbragstad | shaleh ++ that'd be a good idea - after thinking about it and discussing it i'm not sure keystone is the right place for the fix | 19:26 |
| david-lyle | bknudson: but horizon has to make the API calls ultimately anyway | 19:26 |
| david-lyle | we don't really do anything :D | 19:26 |
| *** fawadkhaliq has quit IRC | 19:26 | |
| lbragstad | shaleh dolphm had a really interesting solution that would maintain all the audit info without patching keystone at all | 19:26 |
| bknudson | david-lyle: this might be a security flaw in horizon where one logged-in user can access another user's tokens | 19:27 |
| ayoung | david-lyle, I really want to split Horizon. I would like it if the user facing piece could run alone in a vm owned by the user, not in a a global instance, and only talk to the one Project. | 19:27 |
| shaleh | lbragstad: some form of log/audit post processing? | 19:27 |
| lbragstad | shaleh well - if you have a consumer setup to consume events from keystone, you are always guaranteed a resource type and a resource ID in the payload of the notification | 19:28 |
| markus_z | Shouldn't that bug report point to keystone then? Without a change there we in Nova cannot do anything, can we? | 19:28 |
| lbragstad | but you don't always have to go to keystone to get more information about the resource that changed | 19:29 |
| david-lyle | bknudson: we have bigger problems that service accounts in that case | 19:29 |
| david-lyle | but sure | 19:29 |
| lbragstad | and example would be if a consumer received a delete user event from identity and they wanted to query keystone about that user - that's obviously not going to work | 19:29 |
| shaleh | lbragstad: agreed. Then one can make API calls to fill in the gaps when they are interested. | 19:29 |
| david-lyle | ayoung: we could do that, versioning might become interesting | 19:30 |
| bknudson | markus_z: I don't know what you could possibly do in nova to prevent users logging in to horizon | 19:30 |
| ayoung | david-lyle, I was thinking that we do RBAC on URLs | 19:30 |
| lbragstad | as a dba you could set up triggers to persist things from the keystone db to a shadow keystone database (that doesn't actually delete things) | 19:30 |
| markus_z | bknudson: can we do anything in how the nova account gets created? | 19:30 |
| bknudson | markus_z: one thing you could do in nova is not require admin for service users | 19:30 |
| gyee | lbragstad, fwiw, added my $0.02 to https://bugs.launchpad.net/keystone/+bug/1552795 | 19:31 |
| openstack | Launchpad bug 1552795 in OpenStack Identity (keystone) "enhance notification for user events with user name" [Wishlist,In progress] - Assigned to Lance Bragstad (lbragstad) | 19:31 |
| ayoung | david-lyle, https://review.openstack.org/#/c/279379/ is the current thinking | 19:31 |
| patchbot | ayoung: patch 279379 - keystone-specs - Dynamic RBAC Policy | 19:31 |
| lbragstad | shaleh so you could essentially have all that data still around for audit purposes and query-able for the consuming application | 19:31 |
| lbragstad | but you don't have to couple the consumer to the keystone API | 19:31 |
| bknudson | markus_z: not require admin for service users by default, I mean. | 19:31 |
| shaleh | lbragstad: but now the operators need to maintain two galera clusters. | 19:32 |
| bknudson | markus_z: for example, nova requires the neutron user to have admin to send notifications | 19:32 |
| bknudson | (again, by default) | 19:32 |
| bknudson | or, maybe it's hardcoded... I don't know how nova works | 19:32 |
| lbragstad | shaleh yeah - that would only be if they decided to not query keystone... but if you're concerned able keeping things around for audit purposes would that be a bad thing? | 19:33 |
| shaleh | lbragstad: part of my surprise is "Delete" actually deletes. I am used to it marking the entry as "deleted" which hides it from most queries. | 19:33 |
| lbragstad | shaleh right - keystone doesn't currently do that | 19:33 |
| markus_z | bknudson: me neither :) | 19:33 |
| shaleh | lbragstad: like I said, this is one of those moments where providing options to operators is a good way forward. | 19:34 |
| *** phalmos has quit IRC | 19:34 | |
| lbragstad | shaleh but do we only include usernames + domain ids? | 19:34 |
| shaleh | lbragstad: I think adding yet another DB layer to monitor, maintain, etc. is quite a bit for many | 19:34 |
| lbragstad | what about idenitty providers? | 19:34 |
| markus_z | bknudson: OK, what I take with me from the discussion is that this is a valid and known issue. It could be mitigated in nova when we don't rely per default on admin rights from service users. Is this correct? | 19:35 |
| bknudson | markus_z: that sounds right | 19:35 |
| markus_z | progress, yeah :) | 19:35 |
| markus_z | bknudson: ayoung: ok, cool, thanks for your time and the explanation | 19:36 |
| shaleh | lbragstad: agreed, there is the how much data to log question. | 19:36 |
| markus_z | ayoung: I would remove your name as assignee in Nova, is that an issue? Just to avoid confusion if any one is working on that. | 19:37 |
| shaleh | lbragstad: but really, 3 more machines. 3 more sets of disks. Yet anoter thing for the admins to get a call for at 2am. | 19:37 |
| *** phalmos has joined #openstack-keystone | 19:37 | |
| *** lhcheng_ has joined #openstack-keystone | 19:37 | |
| gyee | shaleh, you never gotten a call at 2am?! :-) | 19:37 |
| shaleh | gyee: damn right I have | 19:38 |
| * shaleh has wore the sys admin hat | 19:38 | |
| ayoung | markus_z, it was closed, I thought. I was working on it from the Keystone side. Please take or do with it as you will | 19:38 |
| gyee | hahahah, you can have my on-call phone | 19:38 |
| ayoung | markus_z, rule of thumb, I have too much to do. Always take work away from me. | 19:38 |
| markus_z | ayoung: "incomplete" is an open state and I'm working through the old open incomplete bugs. | 19:39 |
| markus_z | ayoung: That's how I came here | 19:39 |
| *** lhcheng has quit IRC | 19:41 | |
| lbragstad | shaleh i'm trying to understand the pov of the operator - if an operator cares about audit-type things won't they want to have control of where the data is anyway? | 19:41 |
| shaleh | lbragstad: my audit logging may go to another team's db or a db I have much less access to | 19:43 |
| *** richm has quit IRC | 19:43 | |
| shaleh | lbragstad: asking them to maintain a copy of my DB just to keep their audit logs in sync seems a bit of an ask | 19:44 |
| *** anush has quit IRC | 19:44 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 19:44 |
| *** unsprinkled has joined #openstack-keystone | 19:44 | |
| shaleh | lbragstad: I can totally see some people accepting that | 19:44 |
| *** tellesnobrega_af is now known as tellesnobrega | 19:44 | |
| lbragstad | shaleh keep it in sync with what? | 19:44 |
| shaleh | lbragstad: I am just not sure we should tell people that is the expected use scenario | 19:44 |
| *** doug-fish has quit IRC | 19:45 | |
| dolphm | http://arnab.org/blog/shadow-tables-using-mysql-triggers | 19:45 |
| *** doug-fish has joined #openstack-keystone | 19:45 | |
| shaleh | lbragstad: if I understand, all of this is because I cannot query Keystone for a user's name based on ID because that user may have been deleted. So the audit group needs to keep a shadow copy of the Keystone DB so they can connect the dots. | 19:45 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove TestFernetTokenProvider https://review.openstack.org/286910 | 19:46 |
| shaleh | dolphm: I get that it works. I am asking is that the mechanism we want to suggest to people as the standard approach. | 19:46 |
| *** richm has joined #openstack-keystone | 19:46 | |
| lbragstad | shaleh yes - i believe so | 19:46 |
| shaleh | lbragstad: personally, I would rather fix Keystone to not really delete users. | 19:46 |
| lbragstad | shaleh brb | 19:47 |
| shaleh | lbragstad: either move them to a graveyard table or mark them as "invalid" | 19:47 |
| dolphm | shaleh: in my experience, it's a good separation of concerns between the application & it's data, versus historical auditing, etc (that stuff is not business logic and doesn't belong in the app) | 19:48 |
| dolphm | shaleh: i.e. keystone should not have to know about the "graveyard" table, etc | 19:48 |
| dolphm | jorge_munoz: https://bugs.launchpad.net/keystone/+bug/1553224 | 19:49 |
| openstack | Launchpad bug 1553224 in OpenStack Identity (keystone) "keystone-manage bootstrap assumes user-project role assignment" [Wishlist,Triaged] | 19:49 |
| shaleh | dolphm: from a purely software perspective sure. From a holistic design perspective I disagree. | 19:49 |
| *** doug-fish has quit IRC | 19:50 | |
| *** daemontool has quit IRC | 19:51 | |
| bknudson | let's not take a holistic design perspective if that means keystone becomes a kitchen sink | 19:51 |
| *** agrebennikov has quit IRC | 19:52 | |
| dolphm | shaleh: it's also a really widespread common problem that is not application-specific, i wouldn't expect an application-specific solution. if your employer cares that much, you're probably already familiar with the tools to make the job easy. let's not re-invent the wheel. | 19:52 |
| *** unsprinkled has quit IRC | 19:52 | |
| shaleh | dolphm: I am not proposing a new wheel. Not deleting users is a very common design. | 19:53 |
| shaleh | or not deleting entities I should say | 19:54 |
| shaleh | explicitly because it makes auditing, rollback, etc. work | 19:54 |
| dolphm | jorge_munoz: https://bugs.launchpad.net/keystone/+bug/1553216 | 19:54 |
| openstack | Launchpad bug 1553216 in OpenStack Identity (keystone) "keystone-manage bootstrap does not work for non-SQL identity drivers" [Medium,Triaged] | 19:54 |
| *** sdake_ has joined #openstack-keystone | 19:55 | |
| knikolla | Does OpenStackClient support issuing commands to a federated service provider? | 19:55 |
| knikolla | something like: openstack image list --service-provider sp_id | 19:56 |
| shaleh | knikolla: not yet | 19:56 |
| *** sdake has quit IRC | 19:57 | |
| *** sheel has quit IRC | 19:57 | |
| knikolla | shaleh, I'd be interested in coding the functionality. Would I need to write a blueprint for that? | 19:57 |
| shaleh | knikolla: yeah, and it needs to blend down to each OpenStack python interface | 19:58 |
| shaleh | knikolla: one sec, let me get you a URL | 19:58 |
| shaleh | knikolla: https://github.com/CCI-MOC/python-novaclient this adds that kind of functionality specifically for nova to mount a cinder volume over federation. | 19:59 |
| shaleh | knikolla: look around their github for an idea of the work involved. | 19:59 |
| knikolla | shaleh, I'm actually on the team who coded that :) | 20:00 |
| shaleh | knikolla: nice :-) | 20:00 |
| *** ninag has quit IRC | 20:00 | |
| shaleh | knikolla: then why are you asking when your team had to add bits? :-) | 20:00 |
| *** ninag has joined #openstack-keystone | 20:01 | |
| knikolla | shaleh, but all it actually does is pass a 'serviceProvider' attribute to the Nova API | 20:01 |
| knikolla | and then Nova API does the federation and SAML exchange | 20:01 |
| shaleh | knikolla: right, that was my point. You need to add that ability to all of the CLI calls. | 20:01 |
| shaleh | knikolla: --service-provider needs to work and be understood. Even if the end goal is not MOC style cross federation work. | 20:02 |
| *** ninag_ has joined #openstack-keystone | 20:02 | |
| *** markus_z has left #openstack-keystone | 20:02 | |
| shaleh | knikolla: not impossible. not really a ton of work. but it needs to be written, tested, etc. | 20:03 |
| shaleh | knikolla: plenty of people will be happy when it exists too :-) | 20:03 |
| *** petertr7 is now known as petertr7_away | 20:03 | |
| *** Ephur has quit IRC | 20:03 | |
| shaleh | if I get time in my schedule to hack on k2k it is something I have been meaning to hack on. | 20:04 |
| knikolla | shaleh: I understand that. What I was asking is something different. | 20:04 |
| knikolla | shaleh: To add an argument to the openstack client so that the command itself is directed to the federated openstack. | 20:05 |
| *** ninag__ has joined #openstack-keystone | 20:05 | |
| *** tellesnobrega is now known as tellesnobrega_af | 20:05 | |
| knikolla | so: `nova list` and `nova --service-provider sp_id list` would be too different things | 20:05 |
| *** petertr7_away is now known as petertr7 | 20:05 | |
| shaleh | knikolla: right, you need to make it be a supported top level argument for OSC. Then you need to plumb the code so when it exists it talks to the right place. | 20:05 |
| *** ninag has quit IRC | 20:05 | |
| knikolla | shaleh, which i did for the novaclient only as a POC. Let me find a link. | 20:06 |
| knikolla | shaleh: https://github.com/knikolla/python-novaclient/commit/ee88ea73b6e0311939303c4ee008a0d5eac585a3 | 20:06 |
| shaleh | knikolla: if you have done this, what is the question? | 20:06 |
| *** ninag_ has quit IRC | 20:07 | |
| knikolla | shaleh: I saw a --os-service-provider-endpoint command in osc and felt cautious to ask first if it does the same thing. | 20:07 |
| *** gyee has quit IRC | 20:10 | |
| shaleh | knikolla: where did you see that? I do not see it on OSC master branch. | 20:10 |
| dims | shaleh : knikolla : i think it gets pulled in from here - http://codesearch.openstack.org/?q=service_provider_endpoint&i=nope&files=&repos= | 20:11 |
| *** sdake_ is now known as sdake | 20:11 | |
| shaleh | dims: right, that enables auth at the plugin level. | 20:12 |
| dims | knikolla : is your code change make the call like the one in adfs.py? | 20:14 |
| edmondsw | ayoung glad you figured it out | 20:14 |
| *** rbrady has joined #openstack-keystone | 20:15 | |
| knikolla | dims: I used the Keystone2Keystone class from keystoneauth, so I assumes that's what it does behind the scenes. | 20:16 |
| rbrady | I'm trying to do token auth. Does this look correct? http://paste.openstack.org/show/489731/ | 20:16 |
| shaleh | rbrady: what do you mean by "token auth" here? You mean you have already a valid, authenticated token via something like `openstack token issue`? | 20:18 |
| *** ksavich has quit IRC | 20:18 | |
| *** tellesnobrega_af is now known as tellesnobrega | 20:19 | |
| rbrady | shaleh: yes, the client app authenticates through the API and receives a token. That token is passed into the Mistral Workflow via a param | 20:20 |
| *** sdake has quit IRC | 20:25 | |
| *** jbell8 has quit IRC | 20:29 | |
| dstanek | htruta: raildo-afk: did either of you guys make changes to https://review.openstack.org/#/c/134095 that haven't been pushed? i just fixed the merge conflict, but i don't want to mess you up | 20:31 |
| htruta | dstanek: I haven't. the <<null>> region_id stuff is on my todo list | 20:32 |
| dstanek | htruta: ok, i'll push what i have and take a look at that | 20:32 |
| htruta | dstanek: don't count on raildo this week. He's on honeymoon | 20:32 |
| dstanek | htruta: unacceptable! | 20:32 |
| htruta | dstanek: lol | 20:33 |
| *** browne has quit IRC | 20:34 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Constraint to prevent duplicate endpoints https://review.openstack.org/134095 | 20:36 |
| dstanek | htruta: ^ | 20:37 |
| *** belmoreira has quit IRC | 20:37 | |
| dstanek | i'll look at the region_id now | 20:37 |
| *** rbrady is now known as rbrady-run | 20:37 | |
| *** mhickey_ has joined #openstack-keystone | 20:37 | |
| htruta | dstanek: awesome. If you want, submit a WIP patch that I can work on it too | 20:38 |
| *** phalmos has quit IRC | 20:41 | |
| *** shaleh has quit IRC | 20:41 | |
| *** sdake has joined #openstack-keystone | 20:52 | |
| *** tjcocozz_ has quit IRC | 20:58 | |
| *** bapalm has quit IRC | 20:58 | |
| *** sdake_ has joined #openstack-keystone | 21:05 | |
| *** browne has joined #openstack-keystone | 21:05 | |
| *** sdake has quit IRC | 21:07 | |
| *** tellesnobrega is now known as tellesnobrega_af | 21:11 | |
| *** bapalm has joined #openstack-keystone | 21:14 | |
| *** tjcocozz has joined #openstack-keystone | 21:15 | |
| *** boris-42 has joined #openstack-keystone | 21:18 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: v2 tokens validated on the v3 API are missing timezones https://review.openstack.org/290139 | 21:21 |
| *** mhickey_ has quit IRC | 21:24 | |
| *** ediardo has joined #openstack-keystone | 21:24 | |
| *** phalmos has joined #openstack-keystone | 21:29 | |
| *** browne has quit IRC | 21:37 | |
| *** ninag__ has quit IRC | 21:41 | |
| *** ninag has joined #openstack-keystone | 21:42 | |
| *** ediardo has quit IRC | 21:42 | |
| *** ankita_wagh has quit IRC | 21:42 | |
| *** ankita_wagh has joined #openstack-keystone | 21:42 | |
| *** tqtran has joined #openstack-keystone | 21:42 | |
| *** ankita_wagh has quit IRC | 21:43 | |
| *** ankita_wagh has joined #openstack-keystone | 21:43 | |
| *** ninag has quit IRC | 21:46 | |
| lbragstad | here's a bug that could use a review - https://review.openstack.org/#/c/287857/ | 21:49 |
| patchbot | lbragstad: patch 287857 - keystone - Add notifications to user/group membership | 21:49 |
| *** ediardo has joined #openstack-keystone | 21:53 | |
| *** henrynash has joined #openstack-keystone | 21:54 | |
| *** ChanServ sets mode: +v henrynash | 21:54 | |
| *** nkinder has joined #openstack-keystone | 21:58 | |
| *** browne has joined #openstack-keystone | 21:59 | |
| *** pauloewerton has quit IRC | 22:02 | |
| *** sdake_ is now known as sdake | 22:03 | |
| *** phalmos has quit IRC | 22:05 | |
| *** knikolla has quit IRC | 22:05 | |
| *** csoukup has joined #openstack-keystone | 22:06 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove foreign assignments when deleting a domain https://review.openstack.org/127433 | 22:07 |
| *** rbrady-run is now known as rbrady | 22:09 | |
| *** sdake_ has joined #openstack-keystone | 22:11 | |
| *** ediardo has quit IRC | 22:12 | |
| *** petertr7 is now known as petertr7_away | 22:12 | |
| *** sdake has quit IRC | 22:13 | |
| *** knikolla has joined #openstack-keystone | 22:20 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 22:21 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 22:23 |
| *** jaugustine has quit IRC | 22:23 | |
| *** trown is now known as trown|outtypewww | 22:24 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 22:28 |
| *** jamielennox|away is now known as jamielennox | 22:29 | |
| *** knikolla has quit IRC | 22:30 | |
| *** nkinder has quit IRC | 22:31 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move role backend tests https://review.openstack.org/290167 | 22:34 |
| *** tsymanczyk has quit IRC | 22:34 | |
| *** rbrady has quit IRC | 22:36 | |
| *** ediardo has joined #openstack-keystone | 22:37 | |
| *** tsymanczyk has joined #openstack-keystone | 22:40 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:40 | |
| *** tsymanczyk is now known as Guest39559 | 22:40 | |
| *** Guest39559 has quit IRC | 22:45 | |
| *** tellesnobrega_af is now known as tellesnobrega | 22:50 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 22:52 |
| *** tsymancz1k has joined #openstack-keystone | 22:54 | |
| *** jorge_munoz has quit IRC | 22:54 | |
| *** sdake_ has quit IRC | 22:56 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move role backend tests https://review.openstack.org/290167 | 22:58 |
| openstackgerrit | henry-nash proposed openstack/keystone: Move role backend tests https://review.openstack.org/290167 | 22:59 |
| *** slberger has left #openstack-keystone | 23:00 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 23:01 |
| *** ediardo has quit IRC | 23:05 | |
| mfisch | ayoung: thanks for being clear about what I was trying to say "You'd be insane to do this in production" | 23:05 |
| morgan | mfisch: hah, after i read "why" i was typing the same thing ayoung said | 23:09 |
| morgan | mfisch: but hey, i mean, i didn't know "why" thye wanted it... maybe they had a usecase and it was just something we needed to explain the best approach for | 23:09 |
| *** sdake has joined #openstack-keystone | 23:11 | |
| *** markvoelker has quit IRC | 23:14 | |
| *** tsymancz1k has quit IRC | 23:21 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: v2 tokens validated on the v3 API are missing timezones https://review.openstack.org/290139 | 23:29 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/290180 | 23:31 |
| *** andreykurilin__ has quit IRC | 23:33 | |
| *** gordc has quit IRC | 23:34 | |
| *** ninag has joined #openstack-keystone | 23:34 | |
| *** ankita_wagh has quit IRC | 23:34 | |
| *** ankita_wagh has joined #openstack-keystone | 23:35 | |
| *** ninag has quit IRC | 23:35 | |
| *** arunkant has quit IRC | 23:36 | |
| *** markvoelker_ has joined #openstack-keystone | 23:38 | |
| openstackgerrit | Merged openstack/keystone: Minor edits to the installation doc https://review.openstack.org/285123 | 23:39 |
| *** csoukup has quit IRC | 23:47 | |
| *** markvoelker_ has quit IRC | 23:48 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!