| *** sdake_ has joined #openstack-keystone | 00:02 | |
| *** sdake has quit IRC | 00:03 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split out domain config driver and manager tests https://review.openstack.org/290195 | 00:04 |
|---|---|---|
| *** alex_xu has quit IRC | 00:05 | |
| *** sdake has joined #openstack-keystone | 00:05 | |
| *** edmondsw has quit IRC | 00:06 | |
| *** alex_xu has joined #openstack-keystone | 00:07 | |
| *** sdake_ has quit IRC | 00:07 | |
| *** davechen_afk has quit IRC | 00:07 | |
| *** woodster_ has quit IRC | 00:09 | |
| *** woodster_ has joined #openstack-keystone | 00:10 | |
| *** gyee has joined #openstack-keystone | 00:10 | |
| *** ChanServ sets mode: +v gyee | 00:10 | |
| *** gyee has quit IRC | 00:11 | |
| *** doug-fish has joined #openstack-keystone | 00:11 | |
| *** gyee has joined #openstack-keystone | 00:15 | |
| *** ChanServ sets mode: +v gyee | 00:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Move role backend tests https://review.openstack.org/290167 | 00:21 |
| *** fawadkhaliq has joined #openstack-keystone | 00:23 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Explicitly exclude tests from bandit scan https://review.openstack.org/290201 | 00:29 |
| *** browne has quit IRC | 00:33 | |
| *** fawadkhaliq has quit IRC | 00:35 | |
| *** tjcocozz has quit IRC | 00:37 | |
| *** bapalm has quit IRC | 00:37 | |
| *** sheel has joined #openstack-keystone | 00:39 | |
| gyee | lbragstad, can you take another look whenever you have a chance? https://review.openstack.org/#/c/288816/ | 00:42 |
| patchbot | gyee: patch 288816 - keystone (stable/liberty) - Return 404 instead of 401 for tokens w/o roles | 00:42 |
| *** wxy has joined #openstack-keystone | 00:47 | |
| morgan | gyee: oh backport? | 00:52 |
| gyee | morgan, yeah, since its API impact | 00:52 |
| morgan | gyee: hmm... should be safe to 404 v 401 | 00:52 |
| morgan | it's not changing the error code classification | 00:53 |
| morgan | heck a 500 -> 400 is probably an "ok" backport | 00:53 |
| gyee | 500 to anything is better :-) | 00:53 |
| *** tjcocozz has joined #openstack-keystone | 00:53 | |
| morgan | gyee: well no | 00:53 |
| morgan | 500 -> 200 is probably wrong | 00:53 |
| morgan | :P | 00:54 |
| gyee | hah | 00:54 |
| *** bapalm has joined #openstack-keystone | 00:54 | |
| morgan | and 500 -> 418 is never right | 00:54 |
| morgan | unless you really are a teapot | 00:54 |
| gyee | oh I love that one | 00:54 |
| * morgan wants to use http 418 legitimately at some point | 00:54 | |
| morgan | and i want to use 402 in keystone: "Pay me to fix this bug" | 00:55 |
| morgan | :P | 00:55 |
| gyee | ransomware :-) | 00:55 |
| *** harlowja has quit IRC | 00:55 | |
| *** ankita_wagh has quit IRC | 00:56 | |
| morgan | gyee: >.> | 00:56 |
| morgan | gyee: http://www.google.com/teapot | 00:56 |
| gyee | lmao | 00:57 |
| gyee | hey its useful! | 00:57 |
| morgan | click the teapot! | 00:57 |
| gyee | wow | 00:57 |
| morgan | right! | 00:57 |
| morgan | :) | 00:57 |
| *** trown|outtypewww is now known as trown | 01:06 | |
| *** browne has joined #openstack-keystone | 01:08 | |
| *** sdake has quit IRC | 01:20 | |
| *** jasonsb has joined #openstack-keystone | 01:21 | |
| *** daemontool has joined #openstack-keystone | 01:37 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 01:38 |
| *** tellesnobrega is now known as tellesnobrega_af | 01:39 | |
| openstackgerrit | Merged openstack/keystone: Minor edits to the configuration doc https://review.openstack.org/285105 | 01:39 |
| *** fpatwa_ has joined #openstack-keystone | 01:40 | |
| openstackgerrit | fengzhr proposed openstack/keystone: The name can be just white character except project and user https://review.openstack.org/272358 | 01:42 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 01:44 |
| *** fpatwa_ has quit IRC | 01:52 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Add docs for additional bootstrap endpoint parameters https://review.openstack.org/290226 | 01:55 |
| lbragstad | bknudson thanks for all the reviews on the testing refactor - responded to your comment https://review.openstack.org/#/c/286909/3 | 01:56 |
| patchbot | lbragstad: patch 286909 - keystone - Refactor TestFernetTokenProvider trust-scoped tests | 01:56 |
| *** lhcheng_ has quit IRC | 01:58 | |
| *** spandhe has quit IRC | 02:03 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 02:12 |
| *** pushkaru has quit IRC | 02:14 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 02:16 |
| *** doug-fish has quit IRC | 02:19 | |
| *** doug-fish has joined #openstack-keystone | 02:19 | |
| *** doug-fis_ has joined #openstack-keystone | 02:23 | |
| *** doug-fish has quit IRC | 02:24 | |
| *** doug-fis_ has quit IRC | 02:27 | |
| *** lhcheng has joined #openstack-keystone | 02:28 | |
| *** ChanServ sets mode: +v lhcheng | 02:28 | |
| *** doug-fish has joined #openstack-keystone | 02:29 | |
| *** sdake has joined #openstack-keystone | 02:33 | |
| *** doug-fish has quit IRC | 02:35 | |
| *** woodster_ has quit IRC | 02:37 | |
| *** dan_nguyen has quit IRC | 02:39 | |
| *** doug-fish has joined #openstack-keystone | 02:40 | |
| *** csoukup has joined #openstack-keystone | 02:43 | |
| *** doug-fish has quit IRC | 02:45 | |
| *** csoukup has quit IRC | 02:47 | |
| *** doug-fish has joined #openstack-keystone | 02:50 | |
| *** richm has quit IRC | 02:54 | |
| *** doug-fish has quit IRC | 02:55 | |
| *** tqtran has quit IRC | 03:00 | |
| *** gyee has quit IRC | 03:02 | |
| *** lhcheng has quit IRC | 03:24 | |
| *** ankita_wagh has joined #openstack-keystone | 03:25 | |
| *** dims has quit IRC | 03:25 | |
| *** markvoelker has joined #openstack-keystone | 03:30 | |
| *** csoukup has joined #openstack-keystone | 03:33 | |
| *** sdake has quit IRC | 03:37 | |
| *** sdake has joined #openstack-keystone | 03:43 | |
| *** csoukup has quit IRC | 03:45 | |
| *** fpatwa_ has joined #openstack-keystone | 03:53 | |
| *** jamielennox is now known as jamielennox|away | 03:54 | |
| *** fpatwa_ has quit IRC | 03:58 | |
| *** links has joined #openstack-keystone | 04:03 | |
| *** Soni has quit IRC | 04:11 | |
| *** fifieldt has joined #openstack-keystone | 04:47 | |
| *** furface has quit IRC | 04:48 | |
| *** furface has joined #openstack-keystone | 04:49 | |
| *** EinstCrazy has joined #openstack-keystone | 04:57 | |
| *** GB21 has joined #openstack-keystone | 05:02 | |
| stevemar | anyone want to take a quick look at https://review.openstack.org/#/c/290029/1 ? | 05:09 |
| patchbot | stevemar: patch 290029 - keystone - Clarify virtualenv setup in developer docs | 05:09 |
| morgan | stevemar: uh | 05:10 |
| morgan | stevemar: what does that do? | 05:10 |
| morgan | or what is the intention for that? | 05:10 |
| stevemar | morgan: it doesn't run the tests, as the name suggests | 05:11 |
| morgan | right | 05:11 |
| morgan | why is that needed? | 05:11 |
| morgan | vs ... .tox/py27? or.? | 05:11 |
| morgan | or using virtualenv directly? | 05:11 |
| * morgan stops asking | 05:11 | |
| stevemar | morgan: we just want to create the virtualenv | 05:12 |
| morgan | i... i think it's wrong to wedge / document using tox created venvs for running keystone | 05:13 |
| morgan | vs document using virtualenv command and not having the venv in .tox/ | 05:13 |
| morgan | but... | 05:13 |
| morgan | eh w/e, +2/+A | 05:13 |
| morgan | it solves the problem. | 05:14 |
| openstackgerrit | Steve Martinelli proposed openstack/keystonemiddleware: Return default value for pkg_version if missing https://review.openstack.org/222042 | 05:14 |
| *** fpatwa_ has joined #openstack-keystone | 05:19 | |
| *** sdake_ has joined #openstack-keystone | 05:24 | |
| *** sdake has quit IRC | 05:27 | |
| *** EinstCrazy has quit IRC | 05:28 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 05:28 |
| *** henrynash has quit IRC | 05:29 | |
| stevemar | henrynash is being naughty, he's supposed to be on vacation | 05:29 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/290180 | 05:31 |
| *** lhcheng_ has joined #openstack-keystone | 05:34 | |
| *** fpatwa_ has quit IRC | 05:36 | |
| *** spandhe has joined #openstack-keystone | 05:41 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:47 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/290284 | 06:03 |
| *** Nirupama has joined #openstack-keystone | 06:03 | |
| *** rcernin has joined #openstack-keystone | 06:09 | |
| openstackgerrit | Merged openstack/keystone: Clarify virtualenv setup in developer docs https://review.openstack.org/290029 | 06:15 |
| *** lhcheng has joined #openstack-keystone | 06:23 | |
| *** ChanServ sets mode: +v lhcheng | 06:23 | |
| *** lhcheng_ has quit IRC | 06:26 | |
| *** tyagiprince has joined #openstack-keystone | 06:26 | |
| tyagiprince | Hey ayoung, @all, I have a question to which you are one of the person who can answer the best. I want multiple AD's to be integrated with keystone. what is the best tool around which can do so? Also let me know which one is the easiest to configure :) | 06:28 |
| *** furface has quit IRC | 06:43 | |
| *** furface has joined #openstack-keystone | 06:47 | |
| *** chlong has quit IRC | 06:54 | |
| *** dave-mccowan has quit IRC | 07:02 | |
| breton | multiple domains and domain-specific configs | 07:04 |
| breton | tyagiprince: ^ | 07:04 |
| *** chlong has joined #openstack-keystone | 07:07 | |
| *** bjornar has quit IRC | 07:09 | |
| *** spandhe has quit IRC | 07:10 | |
| *** tomoiaga has joined #openstack-keystone | 07:15 | |
| *** fawadkhaliq has quit IRC | 07:28 | |
| *** eglute has quit IRC | 07:35 | |
| *** d34dh0r53 has quit IRC | 07:36 | |
| *** sigmavirus24_awa has quit IRC | 07:36 | |
| *** odyssey4me has quit IRC | 07:36 | |
| *** cloudnull has quit IRC | 07:38 | |
| *** GB21 has quit IRC | 07:41 | |
| *** odyssey4me has joined #openstack-keystone | 07:41 | |
| *** belmoreira has joined #openstack-keystone | 07:56 | |
| *** sdake_ is now known as sdake | 08:01 | |
| *** tyagiprince has quit IRC | 08:08 | |
| *** d0ugal has joined #openstack-keystone | 08:09 | |
| *** e0ne has joined #openstack-keystone | 08:10 | |
| *** ankita_wagh has quit IRC | 08:11 | |
| *** browne has quit IRC | 08:11 | |
| *** ankita_wagh has joined #openstack-keystone | 08:12 | |
| *** lhcheng_ has joined #openstack-keystone | 08:14 | |
| *** ankita_wagh has quit IRC | 08:16 | |
| *** lhcheng has quit IRC | 08:17 | |
| *** e0ne has quit IRC | 08:19 | |
| *** rk4n has joined #openstack-keystone | 08:22 | |
| *** wanghua has quit IRC | 08:24 | |
| *** fhubik has joined #openstack-keystone | 08:26 | |
| *** pece has joined #openstack-keystone | 08:31 | |
| *** josecastroleon has quit IRC | 08:32 | |
| *** lhcheng_ has quit IRC | 08:32 | |
| *** josecastroleon has joined #openstack-keystone | 08:33 | |
| *** rk4n has quit IRC | 08:36 | |
| *** tyagiprince has joined #openstack-keystone | 08:46 | |
| *** daemontool_ has joined #openstack-keystone | 08:47 | |
| *** openstackgerrit has quit IRC | 08:47 | |
| *** openstackgerrit has joined #openstack-keystone | 08:47 | |
| *** daemontool has quit IRC | 08:49 | |
| *** GB21 has joined #openstack-keystone | 08:52 | |
| *** doug-fish has joined #openstack-keystone | 08:52 | |
| *** tyagiprince has quit IRC | 08:53 | |
| *** tyagiprince has joined #openstack-keystone | 08:54 | |
| *** links has quit IRC | 08:55 | |
| *** doug-fish has quit IRC | 08:57 | |
| *** jaosorior has joined #openstack-keystone | 09:06 | |
| *** andreykurilin__ has joined #openstack-keystone | 09:10 | |
| *** chaitu has joined #openstack-keystone | 09:11 | |
| *** bapalm has quit IRC | 09:14 | |
| *** tjcocozz has quit IRC | 09:15 | |
| chaitu | Hi all, Iam trying to create multiple domain in keystone, While running the following command "keystone-manage domain_config_upload --domain-name domain1".Following error occured http://paste.openstack.org/show/489787/ | 09:16 |
| *** jistr has joined #openstack-keystone | 09:19 | |
| stevemar | chaitu: you can file a bug if you'd like | 09:20 |
| *** d34dh0r53 has joined #openstack-keystone | 09:23 | |
| *** eglute has joined #openstack-keystone | 09:24 | |
| *** sigmavirus24_awa has joined #openstack-keystone | 09:24 | |
| *** cloudnull has joined #openstack-keystone | 09:26 | |
| *** mhickey_ has joined #openstack-keystone | 09:27 | |
| *** bapalm has joined #openstack-keystone | 09:27 | |
| chaitu | stevemar: how to make sure whether there is any errors in my side. How do i debug the issue. | 09:27 |
| *** tjcocozz has joined #openstack-keystone | 09:31 | |
| *** furface has quit IRC | 09:32 | |
| *** furface has joined #openstack-keystone | 09:35 | |
| *** e0ne has joined #openstack-keystone | 09:51 | |
| stevemar | dstanek: thoughts on https://bugs.launchpad.net/keystone/+bug/1546834 when you get a chance | 09:53 |
| openstack | Launchpad bug 1546834 in OpenStack Identity (keystone) " The deletion of an LDAP domain in keystone when write enabled should not clear the LDAP database" [Low,Triaged] - Assigned to Nisha Yadav (ynisha11) | 09:53 |
| *** GB21 has quit IRC | 09:54 | |
| *** e0ne has quit IRC | 10:01 | |
| *** e0ne has joined #openstack-keystone | 10:04 | |
| *** bjornar has joined #openstack-keystone | 10:09 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient-kerberos: use keystoneauth instead of keystoneclient https://review.openstack.org/290374 | 10:11 |
| *** rk4n has joined #openstack-keystone | 10:11 | |
| *** tyagiprince has quit IRC | 10:13 | |
| *** daemontool_ is now known as daemontool | 10:19 | |
| *** mvk has joined #openstack-keystone | 10:21 | |
| *** GB21 has joined #openstack-keystone | 10:24 | |
| *** rk4n has quit IRC | 10:34 | |
| Anticimex | hmm, on a kilo keystone with saml2 idps, what do i need to restart to make it re-read rules.json (i.e. mapping file)? | 10:35 |
| Anticimex | i've tried both httpd and openstack-keystone, but it keeps the old mapping file | 10:35 |
| Anticimex | ahh, i see, this file is input using openstackclient.. | 10:36 |
| *** rk4n has joined #openstack-keystone | 10:37 | |
| *** rk4n has quit IRC | 10:40 | |
| *** rk4n has joined #openstack-keystone | 10:40 | |
| marekd | Anticimex: no, you don't have to restat server | 10:55 |
| Anticimex | i didn't set it up so i thought a static file is read, but we use that file as input to "openstack mapping set --rules /etc/keystone/rules.json $mappingname" | 10:59 |
| Anticimex | now better :) | 10:59 |
| Anticimex | marekd: thanks for confirming that | 11:00 |
| marekd | Anticimex: sure! | 11:00 |
| *** GB21 has quit IRC | 11:03 | |
| *** dims has joined #openstack-keystone | 11:07 | |
| dstanek | stevemar: my initial reaction is lol | 11:14 |
| dstanek | stevemar: i agree with your assessment about writable ldap being removed | 11:15 |
| *** GB21 has joined #openstack-keystone | 11:17 | |
| *** doug-fish has joined #openstack-keystone | 11:17 | |
| *** doug-fish has quit IRC | 11:22 | |
| breton | chaitu: Group DEFAULT is not supported for domain specific configurations | 11:24 |
| breton | chaitu: you need to remove group [DEFAULT] from your configs and leave there only ldap and identity | 11:25 |
| *** pnavarro has joined #openstack-keystone | 11:25 | |
| breton | *[ldap] and [identity] | 11:25 |
| Anticimex | marekd: have you played with mapping federated users into hierachical projects? | 11:37 |
| Anticimex | marekd: i.e. with the project permissions as part of the SAML2 entitlements? | 11:37 |
| Anticimex | our goal is to let the idp owners manage their project/group memberships themselves, via some registered entitlements in some fashion | 11:38 |
| *** wxy has quit IRC | 11:39 | |
| *** chlong has quit IRC | 11:42 | |
| *** tyagiprince has joined #openstack-keystone | 11:44 | |
| Anticimex | it's of course start to do 1st level customer projects (i.e. a customer, domain, has many projects), and perhaps even two-level in some semi-static mapping fashion. | 11:44 |
| Anticimex | but ideally there would be a recursive:ish mapping thing, and some method of actually setting up these projects on the fly, as well | 11:45 |
| Anticimex | ie upon first seeing the user logging in and the accompanied entitlements. would that perhaps be a job for a keystone middleware for example? | 11:45 |
| *** links has joined #openstack-keystone | 11:48 | |
| *** GB21 has quit IRC | 11:50 | |
| *** fpatwa_ has joined #openstack-keystone | 11:59 | |
| *** jaosorior has quit IRC | 12:02 | |
| *** jaosorior has joined #openstack-keystone | 12:02 | |
| *** trown is now known as trown|commute | 12:03 | |
| *** GB21 has joined #openstack-keystone | 12:08 | |
| *** fpatwa_ has quit IRC | 12:09 | |
| *** chlong has joined #openstack-keystone | 12:14 | |
| *** EinstCrazy has joined #openstack-keystone | 12:15 | |
| *** mvk has quit IRC | 12:20 | |
| stevemar | dstanek: also, it was disabled already :) | 12:22 |
| *** daemontool_ has joined #openstack-keystone | 12:23 | |
| *** toddnni_ has joined #openstack-keystone | 12:24 | |
| *** jdennis has quit IRC | 12:27 | |
| *** toddnni has quit IRC | 12:27 | |
| *** ryanpetrello has quit IRC | 12:27 | |
| *** chlong has quit IRC | 12:27 | |
| *** tristanC has quit IRC | 12:27 | |
| *** toddnni_ is now known as toddnni | 12:27 | |
| *** jdennis1 has joined #openstack-keystone | 12:27 | |
| *** jaosorior has quit IRC | 12:27 | |
| *** bapalm has quit IRC | 12:27 | |
| *** daemontool has quit IRC | 12:27 | |
| *** zeus has quit IRC | 12:27 | |
| *** jaosorior has joined #openstack-keystone | 12:27 | |
| *** tristanC has joined #openstack-keystone | 12:27 | |
| *** bapalm has joined #openstack-keystone | 12:27 | |
| *** daemontool_ is now known as daemontool | 12:29 | |
| *** zeus has joined #openstack-keystone | 12:30 | |
| *** GB21 has quit IRC | 12:30 | |
| *** zeus is now known as Guest8646 | 12:30 | |
| *** doug-fish has joined #openstack-keystone | 12:31 | |
| *** ryanpetrello has joined #openstack-keystone | 12:36 | |
| *** rodrigods has quit IRC | 12:37 | |
| *** rodrigods has joined #openstack-keystone | 12:37 | |
| *** chlong has joined #openstack-keystone | 12:40 | |
| *** doug-fish has quit IRC | 12:48 | |
| marekd | Anticimex: no, i haven't yet | 12:51 |
| *** mvk has joined #openstack-keystone | 12:51 | |
| *** pauloewerton has joined #openstack-keystone | 13:02 | |
| *** dims has quit IRC | 13:05 | |
| *** dims_ has joined #openstack-keystone | 13:05 | |
| *** markvoelker_ has joined #openstack-keystone | 13:08 | |
| *** gchung has joined #openstack-keystone | 13:09 | |
| *** petertr7_away is now known as petertr7 | 13:10 | |
| *** edmondsw has joined #openstack-keystone | 13:10 | |
| *** dims_ has quit IRC | 13:10 | |
| *** markvoelker has quit IRC | 13:11 | |
| *** dims has joined #openstack-keystone | 13:14 | |
| *** rbrady has joined #openstack-keystone | 13:14 | |
| *** jaosorior has quit IRC | 13:15 | |
| *** jaosorior has joined #openstack-keystone | 13:15 | |
| rbrady | I'm trying to create Mistral actions that use their own keystone auth, using a token given as a param to get access to a keystone client. Does this look right? http://paste.openstack.org/show/489731/ | 13:16 |
| *** trown|commute is now known as trown | 13:18 | |
| *** markvoelker_ has quit IRC | 13:20 | |
| *** richm has joined #openstack-keystone | 13:22 | |
| *** dave-mccowan has joined #openstack-keystone | 13:22 | |
| *** fhubik has quit IRC | 13:25 | |
| *** doug-fish has joined #openstack-keystone | 13:29 | |
| *** doug-fish has quit IRC | 13:31 | |
| *** doug-fish has joined #openstack-keystone | 13:32 | |
| *** tyagiprince has quit IRC | 13:32 | |
| edmondsw | rbrady, is this with mitaka? | 13:32 |
| rbrady | edmondsw: yes | 13:33 |
| edmondsw | because keystoneclient is deprecated in mitaka... use keystoneauth1 | 13:33 |
| rbrady | edmondsw: I've been using http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html. Is there a better set of docs I should be reading? | 13:34 |
| edmondsw | and one sec, writing you a better example | 13:34 |
| *** links has quit IRC | 13:35 | |
| *** markvoelker has joined #openstack-keystone | 13:39 | |
| edmondsw | rbrady, try this: http://paste.openstack.org/show/489836/ | 13:40 |
| edmondsw | replace "rbrady_code" with whatever is appropriate there | 13:40 |
| edmondsw | and it would be odd for the project ID to be "admin"... wouldn't it be a UUID? | 13:41 |
| *** pkarikh has quit IRC | 13:41 | |
| *** amakarov has quit IRC | 13:41 | |
| *** tsufiev has quit IRC | 13:41 | |
| *** rk4n has quit IRC | 13:41 | |
| edmondsw | if you don't know the id, you may need to specify project_name and project_domain_name instead | 13:43 |
| edmondsw | stevemar, someone should update http://docs.openstack.org/developer/python-keystoneclient/using-api-v3.html per above conversation | 13:44 |
| *** fhubik has joined #openstack-keystone | 13:44 | |
| *** ninag has joined #openstack-keystone | 13:46 | |
| stevemar | edmondsw: sounds like you're agreeing to fix it :) | 13:46 |
| stevemar | edmondsw: https://bugs.launchpad.net/python-keystoneclient/+bug/1470520 | 13:46 |
| openstack | Launchpad bug 1470520 in python-keystoneclient "docs for sessions are out of date" [Low,Triaged] | 13:46 |
| edmondsw | stevemar I would love to.. but if you wait for that, it'll probably be a while :) | 13:47 |
| edmondsw | I'm under a huge pile right now | 13:47 |
| stevemar | edmondsw: i know that feel | 13:47 |
| *** trown is now known as trown|brb | 13:50 | |
| rbrady | edmondsw: success! Thanks | 13:52 |
| edmondsw | rbrady, awesome | 13:52 |
| *** trown|brb is now known as trown | 13:52 | |
| *** henrynash has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v henrynash | 13:57 | |
| *** markvoelker has quit IRC | 13:58 | |
| *** tyagiprince has joined #openstack-keystone | 14:01 | |
| *** Nirupama has quit IRC | 14:02 | |
| *** daemontool_ has joined #openstack-keystone | 14:03 | |
| *** daemontool has quit IRC | 14:07 | |
| *** jaugustine has joined #openstack-keystone | 14:09 | |
| *** tyagiprince has quit IRC | 14:10 | |
| *** rk4n has joined #openstack-keystone | 14:13 | |
| *** amakarov has joined #openstack-keystone | 14:13 | |
| *** nkinder has joined #openstack-keystone | 14:14 | |
| *** pkarikh has joined #openstack-keystone | 14:16 | |
| *** tyagiprince has joined #openstack-keystone | 14:16 | |
| *** fifieldt has quit IRC | 14:16 | |
| *** tyagiprince has quit IRC | 14:18 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 14:19 |
| *** tyagiprince has joined #openstack-keystone | 14:19 | |
| *** tsufiev has joined #openstack-keystone | 14:23 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct create_project driver versioning https://review.openstack.org/289058 | 14:24 |
| *** nkinder has quit IRC | 14:36 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split out domain config driver and manager tests https://review.openstack.org/290195 | 14:37 |
| *** ninag has quit IRC | 14:38 | |
| lbragstad | nonameentername one minor suggestion inline on https://review.openstack.org/#/c/290139/2 | 14:39 |
| patchbot | lbragstad: patch 290139 - keystone - v2 tokens validated on the v3 API are missing time... | 14:39 |
| lbragstad | nonameentername I pulled that down locally and it checks out | 14:40 |
| *** ninag_ has joined #openstack-keystone | 14:41 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 14:45 |
| *** knikolla has joined #openstack-keystone | 14:47 | |
| *** markvoelker has joined #openstack-keystone | 14:48 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 14:50 |
| *** sdake_ has joined #openstack-keystone | 14:50 | |
| *** sdake has quit IRC | 14:53 | |
| *** frontrunner has joined #openstack-keystone | 14:55 | |
| *** jdennis1 has quit IRC | 14:56 | |
| *** jdennis has joined #openstack-keystone | 14:56 | |
| frontrunner | keystone-manage bootstrap' is spitting out this... | 14:58 |
| frontrunner | 2016-03-09 09:48:18.001 15650 INFO keystone.cmd.cli [req-94c9c18e-f663-4783-8ef1-ddbf16d344c6 - - - - -] Domain default already exists, skipping creation. | 14:58 |
| frontrunner | 2016-03-09 09:48:18.005 15650 CRITICAL keystone [req-94c9c18e-f663-4783-8ef1-ddbf16d344c6 - - - - -] DomainNotFound: Could not find domain: default | 14:58 |
| *** sdake has joined #openstack-keystone | 14:58 | |
| frontrunner | one line tells me domain 'default | 14:58 |
| frontrunner | 'exists | 14:58 |
| frontrunner | the next line says it does not | 14:58 |
| frontrunner | any suggestions anyone? | 14:59 |
| *** sdake_ has quit IRC | 15:00 | |
| *** xek_ is now known as xek | 15:05 | |
| *** pushkaru has joined #openstack-keystone | 15:06 | |
| *** rk4n has quit IRC | 15:06 | |
| stevemar | frontrunner: what args did you pass in? | 15:07 |
| *** BigWillie has joined #openstack-keystone | 15:08 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:09 | |
| *** pushkaru has quit IRC | 15:14 | |
| *** rk4n has joined #openstack-keystone | 15:15 | |
| *** slberger has joined #openstack-keystone | 15:16 | |
| dstanek | htruta: i was doing other stuff and didn't get a chance to fix up that review any more | 15:18 |
| *** pushkaru has joined #openstack-keystone | 15:19 | |
| *** tyagiprince has quit IRC | 15:19 | |
| *** phalmos has joined #openstack-keystone | 15:26 | |
| *** tomoiaga has quit IRC | 15:26 | |
| mfisch | ayoung: have the LDAP terrorists already won? https://github.com/SUSE-Cloud/keystone-hybrid-backend/issues/42 | 15:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystoneauth: Examples for kerberos and saml2 plugins https://review.openstack.org/288669 | 15:28 |
| *** spzala has joined #openstack-keystone | 15:33 | |
| *** phalmos has quit IRC | 15:33 | |
| stevemar | mfisch: ayoung -2 | 15:36 |
| dstanek | stevemar: thoughts on https://bugs.launchpad.net/keystone/+bug/1552795 ? | 15:37 |
| openstack | Launchpad bug 1552795 in OpenStack Identity (keystone) "enhance notification for user events with user name" [Wishlist,In progress] - Assigned to Lance Bragstad (lbragstad) | 15:37 |
| stevemar | dstanek: bug description looks legit, whats the issue | 15:38 |
| dstanek | mfisch: they'll only win if they merge! i don't care if terrorists build pipe bombs as long as they are blowing off their own hands | 15:38 |
| lbragstad | dstanek stevemar speaking of notifications! https://review.openstack.org/#/q/topic:bug/1552639 closes a bug | 15:38 |
| stevemar | isn't this a dupe? | 15:38 |
| lbragstad | stevemar we had two notification bugs opened within a day | 15:39 |
| *** ninag_ has quit IRC | 15:39 | |
| lbragstad | stevemar one was for not sending notifications on user/group assignments | 15:39 |
| lbragstad | which is fixed above ^ | 15:39 |
| dstanek | stevemar: i don't think it's legit. there's comments in there from lbragstad, dolphm and i explaining why. | 15:39 |
| stevemar | dstanek: lbragstad blah, i need to read it | 15:39 |
| lbragstad | stevemar "top to bottom, left to right..." | 15:39 |
| *** ninag has joined #openstack-keystone | 15:40 | |
| *** ninag has quit IRC | 15:40 | |
| *** ninag has joined #openstack-keystone | 15:40 | |
| lbragstad | stevemar the other bug was because username wasn't in the notification payload | 15:40 |
| stevemar | lbragstad: never! | 15:40 |
| *** ninag has quit IRC | 15:40 | |
| *** sdake_ has joined #openstack-keystone | 15:41 | |
| *** sdake has quit IRC | 15:41 | |
| *** gchung is now known as gordc | 15:42 | |
| frontrunner | what is proper etiquette for replying to messages in this chat - do i reply via the general chat or do i reply via personal response? | 15:42 |
| stevemar | frontrunner: general chat! | 15:43 |
| stevemar | frontrunner: i just saw your PM :( | 15:43 |
| frontrunner | 'openstack domain list' gives me different results with domains i create myself... | 15:43 |
| frontrunner | +----------------------------------+----------+---------+--------------------+ | 15:43 |
| frontrunner | | ID | Name | Enabled | Description | | 15:43 |
| frontrunner | +----------------------------------+----------+---------+--------------------+ | 15:43 |
| frontrunner | | d4aa83d0fe3d43d99e660b06c98c7b15 | default2 | True | | | 15:43 |
| frontrunner | | default | Default | True | The default domain | | 15:43 |
| frontrunner | +----------------------------------+----------+---------+--------------------+ | 15:43 |
| frontrunner | the openstack created default domain has an ID='default' | 15:43 |
| frontrunner | while any domain i create has an ID of some hash | 15:43 |
| frontrunner | could that be the issue? | 15:43 |
| stevemar | frontrunner: logic is if the original person walks away (like i did), someone else can carry the conversation | 15:43 |
| frontrunner | ok, thanks | 15:44 |
| stevemar | frontrunner: i'd delete "d4aa83d0fe3d43d99e660b06c98c7b15" | 15:44 |
| frontrunner | that was just a test | 15:44 |
| stevemar | frontrunner: keystone-manage boostrap is atomic, so it shouldn't create duplicates | 15:44 |
| frontrunner | i am trying to create the 'default' domain and it does not seem to work | 15:45 |
| frontrunner | perhaps because the ID is a hash and not the text 'default' | 15:45 |
| *** browne has joined #openstack-keystone | 15:45 | |
| frontrunner | can i create a domain with an ID of some string value? | 15:46 |
| stevemar | frontrunner: you shouldn't need to create the default domain, the bootstrap should do that for you | 15:46 |
| *** ninag has joined #openstack-keystone | 15:46 | |
| stevemar | frontrunner: if you're running off of master branch, then here's an example of something you can do: https://review.openstack.org/#/c/289669/1/lib/keystone | 15:47 |
| patchbot | stevemar: patch 289669 - openstack-dev/devstack - Use extended keystone-manage bootstrap parameters | 15:47 |
| frontrunner | yes, the bootstrap does, but i am trying to recreate what it does in order to debug something else | 15:47 |
| stevemar | keystone-manage bootstrap --bootstrap-username admin --bootstrap-password secretadmin --bootstrap-project-name admin --bootstrap-role-name admin --bootstrap-service-name keystone --bootstrap-region-id RegionOne --bootstrap-admin-url http://127.0.0.1:35357/v3 --bootstrap-public-url http://127.0.0.1:5000/v3 --bootstrap-internal-url http://127.0.0.1:5000/v3 | 15:47 |
| stevemar | frontrunner: ahhh | 15:48 |
| stevemar | frontrunner: this is what it does: https://github.com/openstack/keystone/blob/2445d24efacd4c5f96174b3bf1028bf5770f7bab/keystone/cmd/cli.py#L162-L343 | 15:48 |
| lbragstad | dstanek do you have a link to the "current open keystone bugs"? | 15:49 |
| *** jorge_munoz has joined #openstack-keystone | 15:49 | |
| lbragstad | dstanek this is the one that you use - right? https://goo.gl/rYZADQ | 15:50 |
| dstanek | lbragstad: i have been using two... | 15:51 |
| frontrunner | ok, i derive from what you sent that i can not create a domain with an ID="my own name" | 15:51 |
| dstanek | lbragstad: the default search minus the fix-committed http://bit.ly/1nwwzVT | 15:51 |
| *** phalmos has joined #openstack-keystone | 15:52 | |
| *** jorge_munoz_ has joined #openstack-keystone | 15:52 | |
| dstanek | lbragstad: bugs that i almost definitely have patches http://bit.ly/1M6G30n | 15:52 |
| frontrunner | where is this derived: CONF.identity.default_domain_id | 15:52 |
| stevemar | frontrunner: correct! IDs are UUID | 15:52 |
| stevemar | frontrunner: only the default domain is handled in a special way | 15:53 |
| frontrunner | ok | 15:53 |
| *** jorge_munoz has quit IRC | 15:54 | |
| *** jorge_munoz_ is now known as jorge_munoz | 15:54 | |
| frontrunner | that renders that test unfeasible | 15:54 |
| *** EinstCrazy has quit IRC | 15:56 | |
| dstanek | frontrunner: what are you trying to test? | 15:56 |
| frontrunner | the true problem i am trying to get past is installing from git whereby part of my bash relies in fedora pack commands 'yum install...' and part from 'pip install' and part from 'git clone...' these all land me in package management hell with issues like: "cpio: rename" | 15:59 |
| htruta | dstanek: I saw that you put it as WIP. submit your progress if you want, and I guess I can finish it today | 15:59 |
| dstanek | htruta: i have nothing new for that review. if you want it go for it. i'll ask before i do any more work. the merge conflicts on that one were enough for the day :-) | 16:00 |
| htruta | dstanek: nice! thanks | 16:01 |
| dstanek | htruta: no, thank you! | 16:01 |
| frontrunner | is there an source install philosophy that I am missing such as: if i use git clone then i can't use "yum install..." for any other openstack installs? | 16:02 |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove foreign assignments when deleting a domain https://review.openstack.org/127433 | 16:02 |
| *** zzzeek has quit IRC | 16:03 | |
| *** nkinder has joined #openstack-keystone | 16:03 | |
| dstanek | super easy review ^ already have +2+A and just needed a tweak | 16:03 |
| *** zzzeek has joined #openstack-keystone | 16:04 | |
| lbragstad | dstanek does that need a release note? | 16:08 |
| lbragstad | saying that assignments are cleaned up? | 16:08 |
| stevemar | lbragstad: nah | 16:09 |
| lbragstad | ok | 16:09 |
| stevemar | lbragstad: we don't need to advertise EVERYTHING | 16:09 |
| stevemar | lbragstad: there's no new config option | 16:09 |
| *** nkinder has quit IRC | 16:10 | |
| dstanek | stevemar: lbragstad: ++ although it does change the driver signature | 16:10 |
| dstanek | lbragstad: just commented on https://review.openstack.org/#/c/287977/2 with a question | 16:11 |
| patchbot | dstanek: patch 287977 - keystone - Add ability to send notifications for actors | 16:11 |
| ayoung | mfisch, yes, the terrorists have won | 16:11 |
| morgan | stevemar: ADVERTISE IT ALL! | 16:12 |
| morgan | :P | 16:12 |
| stevemar | morgan: go back to bed! | 16:12 |
| morgan | stevemar: it's 8am here | 16:12 |
| ayoung | mfisch, we have enough people requesting it that we need to at least code review it and be able to speak honestly around it | 16:12 |
| dstanek | #action morgan to write release notes for all commits that don't already have them | 16:12 |
| morgan | #action flake on dstanek's action, leaving it to dstanek to complete | 16:12 |
| * dstanek is sad | 16:13 | |
| morgan | dstanek: :P | 16:13 |
| ayoung | mfisch, It also allows me to start working on an approach to wean people off the Hybrid driver and onto something supportable | 16:13 |
| morgan | ayoung: which hybrid driver? | 16:13 |
| ayoung | morgan, https://github.com/SUSE-Cloud/keystone-hybrid-backend/ | 16:14 |
| morgan | oh oh | 16:14 |
| morgan | that... ick | 16:14 |
| ayoung | morgan, its essentially a V2 crutch at this point | 16:14 |
| morgan | yeah | 16:14 |
| *** sdake has joined #openstack-keystone | 16:14 | |
| morgan | it's the same thing i wrote back in essex for metacloud | 16:14 |
| morgan | basically | 16:14 |
| ayoung | morgan, maybe if I had been less hard headed a few years ago it would have been the norm in Keystone | 16:14 |
| morgan | eh. | 16:15 |
| morgan | maybe not. | 16:15 |
| *** sdake_ has quit IRC | 16:15 | |
| ayoung | morgan, the issue is that people in the LDAP domain have all these scripts that are V2 specific. I need a way to transition them cleanly to V3 | 16:15 |
| ayoung | and having the code that they are working with be outside the tree means that, well, it can do anything. | 16:16 |
| lbragstad | dstanek ah - that comment makes sense, i can either incorporate it into that patch or do it in a follow on. | 16:16 |
| lbragstad | dstanek preference? | 16:16 |
| morgan | shrug. | 16:16 |
| *** sdake_ has joined #openstack-keystone | 16:17 | |
| mfisch | ayoung: also I have to rehack this driver each time we release, and I'd love a transition plan | 16:18 |
| mfisch | ayoung: I'd love to get rid of this and switch to domains but I think it might be painful | 16:18 |
| ayoung | mfisch, can you own this effort? I am happy to guide? | 16:18 |
| mfisch | I wonder if the SuSe guy would, they havent taken many of my patches | 16:18 |
| mfisch | Im glad to help but probably not until after the summit | 16:18 |
| *** sdake has quit IRC | 16:19 | |
| *** BigWillie has quit IRC | 16:20 | |
| *** sdake_ is now known as sdake | 16:21 | |
| *** roxanagh_ has joined #openstack-keystone | 16:21 | |
| ayoung | mfisch, that is fine. And, screw SuSE. If they don't play, we can deal with it ourselves. | 16:21 |
| mfisch | ayoung: isnt there a path to just dump this completely and use domains? | 16:22 |
| ayoung | mfisch, how? | 16:22 |
| mfisch | service domain for mysql and ldap domain for users | 16:22 |
| ayoung | mfisch, its the V2 scripts that are the problem, though | 16:23 |
| ayoung | so...yes, but | 16:23 |
| ayoung | we need to make sure all of the services use V3 first, I guess | 16:23 |
| mfisch | =1 | 16:24 |
| mfisch | +1! | 16:24 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: WIP: Add users functional tests https://review.openstack.org/289306 | 16:24 |
| samueldmq | I'd like to discuss something on how we do functional tests in ksclient | 16:24 |
| samueldmq | dstanek: stevemar: bknudson: hi ^ | 16:25 |
| samueldmq | (anyone else willing to discuss it is welcome too) | 16:25 |
| bknudson | samueldmq: what's up? I'm around | 16:26 |
| samueldmq | bknudson: if you look at my patch above, I have written a test (test_create_user) | 16:26 |
| samueldmq | bknudson: I am already using the resources provided by devstack: 'default' domain and 'demo' project | 16:26 |
| samueldmq | bknudson: but I am not sure this is the right way to go, because those tests should be able to run against any installation | 16:27 |
| ayoung | mfisch, how do you configure your Nova servers? What do you use? Puppet? | 16:27 |
| bknudson | samueldmq: not every deployment that we want to run these tests on is going to support creating users | 16:27 |
| mfisch | ayoung: yessir | 16:27 |
| samueldmq | bknudson: my idea was that we created our own test scenario to run tests on | 16:27 |
| *** bjornar has quit IRC | 16:27 | |
| bknudson | you should read a config file to figure out the domain and projects to use | 16:27 |
| ayoung | mfisch, OK, so we need a way to use that to migrate from V2 to V3 for the configuration to talk to Keystone | 16:27 |
| mfisch | change params, restart service? | 16:28 |
| mfisch | is there more? | 16:28 |
| samueldmq | bknudson: yes, so there should be a config file telling how to run the tests ... | 16:28 |
| samueldmq | bknudson: like create_users=False would skip that test, for example | 16:28 |
| bknudson | samueldmq: right, like devstack creates for tempest. Maybe our tests should read the tempest config? | 16:28 |
| morgan | mfisch: thats mostly it. | 16:29 |
| bknudson | or, just put these tests in tempest | 16:29 |
| morgan | mfisch: or it should be it. | 16:29 |
| bknudson | why duplicate the effort? | 16:29 |
| mfisch | thats pretty much puppet's #1 function | 16:29 |
| ayoung | mfisch, set the domain...and figuring out what domain to use. Splitting it off of the default. I think that is the hard part. | 16:29 |
| mfisch | ayoung: yes, I was just thinking only of the v3 switch | 16:30 |
| mfisch | the domains is more work | 16:30 |
| samueldmq | bknudson: afaik tempest uses its own client to make requests | 16:30 |
| samueldmq | bknudson: we need to have tests for individual clients too, tempest only tests the HTTP APIs | 16:30 |
| ayoung | mfisch, then, there is the fact that the LDAP users might have scripted v3 to explicirtly say OS_DOMAIN_ID=default | 16:30 |
| ayoung | so...need to think through it, soup to nuts | 16:30 |
| bknudson | samueldmq: tempest is testing keystone, not keystoneclient, so they use their own client. They can't have tests for keystoneclient? | 16:30 |
| mfisch | yep | 16:31 |
| mfisch | I've had not much luck selling my boss on ditching this driver unfortunately | 16:31 |
| mfisch | need to get cycles from the scheduler | 16:31 |
| bknudson | samueldmq: I guess it makes sense they don't want to test keystoneclient. At least try to share the config somehow. | 16:31 |
| samueldmq | bknudson: I don't thnk they want to test clients | 16:32 |
| samueldmq | bknudson: yes, but the config has much more than we need | 16:32 |
| samueldmq | bknudson: but I will take a deeper look | 16:32 |
| *** shaleh has joined #openstack-keystone | 16:33 | |
| *** dims has quit IRC | 16:33 | |
| bknudson | samueldmq: well, either way the tests need to be customizable to the deployment | 16:33 |
| samueldmq | bknudson: completely agreed | 16:34 |
| ayoung | mfisch, If we can make the change at the Service configuration level, it should be easier. It might require some magic to duplicate role assignments between two domains for a while. | 16:35 |
| mfisch | we may have some changes in our theory about how we deal with non-openstack service accounts, so not like nova | 16:35 |
| mfisch | but like the account for "Adam's Team CI account" | 16:35 |
| mfisch | right now those are in mysql | 16:35 |
| mfisch | but we may push those to LDAP so we can tie to an employee | 16:36 |
| *** nkinder has joined #openstack-keystone | 16:36 | |
| *** arunkant has joined #openstack-keystone | 16:36 | |
| ayoung | mfisch, I think that there is a risk there. Those should be service accounts, not real users | 16:36 |
| mfisch | ayoung: is this something we can cover in autsin too? | 16:36 |
| mfisch | preferably with alcohol and bbq | 16:37 |
| ayoung | unified delegation probably should address exactly that use case | 16:37 |
| ayoung | mfisch, and music. Don't forget the music | 16:37 |
| mfisch | yes | 16:38 |
| mfisch | you play sax, I'll take notes | 16:38 |
| *** gyee has joined #openstack-keystone | 16:39 | |
| *** ChanServ sets mode: +v gyee | 16:39 | |
| ayoung | mfisch, that too. | 16:39 |
| ayoung | mfisch, lets try to have a plan going in to Austin, though. Treat the Summit as a time to polish and refine, as well as get consensus | 16:40 |
| *** trown has quit IRC | 16:41 | |
| *** dims has joined #openstack-keystone | 16:44 | |
| henrynash | bknudson: ping | 16:45 |
| *** fhubik has quit IRC | 16:45 | |
| bknudson | henrynash: what's up? | 16:45 |
| henrynash | bknudson: just wanted to chat about our respective commenst on the resource driver... | 16:46 |
| *** rderose has joined #openstack-keystone | 16:46 | |
| henrynash | bknudson: so “resource” has two, independant, drivers - resource and domain_config | 16:46 |
| bknudson | henrynash: I'm checking to see if there's a foreign key in the domain config | 16:46 |
| henrynash | bknudson: (whcih would indeed scupper my argument!) | 16:47 |
| bknudson | henrynash: there isn't one in http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/config_backends/sql.py#n19 | 16:48 |
| henrynash | bknudson: I didn’t think so…. | 16:48 |
| bknudson | so there shouldn't be any need to have the domain_id exist in the resource backend in order to have it in the domain_config backend | 16:49 |
| henrynash | bknudson: ahhh, right - I’m with you | 16:49 |
| *** e0ne has quit IRC | 16:50 | |
| bknudson | you do for the manager tests because the manager checks | 16:50 |
| bknudson | I assume the manager checks... that's what we usually do | 16:50 |
| henrynash | bknudson: right, so for the driver tests we can just use a uuid for domain_id | 16:50 |
| bknudson | henrynash: yes, just use any old id | 16:51 |
| henrynash | bknudson: ok…will fix up, thx | 16:51 |
| bknudson | the value has to be valid for the drivers | 16:51 |
| *** belmoreira has quit IRC | 16:52 | |
| *** wolsen has quit IRC | 16:52 | |
| *** wolsen has joined #openstack-keystone | 16:52 | |
| *** browne has quit IRC | 16:53 | |
| *** trown has joined #openstack-keystone | 16:53 | |
| lbragstad | dstanek responded https://review.openstack.org/#/c/287977/2 | 16:55 |
| patchbot | lbragstad: patch 287977 - keystone - Add ability to send notifications for actors | 16:55 |
| *** jaosorior has quit IRC | 16:55 | |
| lbragstad | and added - https://review.openstack.org/#/c/290666/1 | 16:55 |
| patchbot | lbragstad: patch 290666 - keystone - Clarify actor operation for notifications | 16:55 |
| *** EinstCrazy has joined #openstack-keystone | 16:56 | |
| *** tellesnobrega_af is now known as tellesnobrega | 17:00 | |
| *** tyagiprince has joined #openstack-keystone | 17:01 | |
| *** rk4n has quit IRC | 17:02 | |
| dstanek | lbragstad: is there any chance that this will be backported and the followup patch lost? | 17:02 |
| *** fawadkhaliq has joined #openstack-keystone | 17:03 | |
| *** EinstCrazy has quit IRC | 17:03 | |
| *** fawadkhaliq has quit IRC | 17:03 | |
| lbragstad | dstanek I don't think we will be backporting https://review.openstack.org/#/c/287857/4 but that's up to stevemar - the bug isn't tagged with backport potential | 17:04 |
| patchbot | lbragstad: patch 287857 - keystone - Add notifications to user/group membership | 17:04 |
| bknudson | lbragstad: you can backport whatever you want to | 17:04 |
| bknudson | doesn't need to be tagged as backport potential | 17:05 |
| lbragstad | bknudson dstanek I can backport it - up to your guys | 17:05 |
| lbragstad | you* | 17:05 |
| *** daemontool has joined #openstack-keystone | 17:05 | |
| *** dan_nguyen has joined #openstack-keystone | 17:06 | |
| dstanek | lbragstad: no i just mean that if they are separate and someone wants that backported their notification format would be incorrect without the follow up | 17:06 |
| *** BigWillie has joined #openstack-keystone | 17:06 | |
| *** jistr has quit IRC | 17:06 | |
| *** daemontool_ has quit IRC | 17:07 | |
| openstackgerrit | Merged openstack/keystone: Correct create_project driver versioning https://review.openstack.org/289058 | 17:08 |
| *** rk4n has joined #openstack-keystone | 17:08 | |
| *** rcernin has quit IRC | 17:09 | |
| lbragstad | dstanek I don't think it would be incorrect - is just a better name for the key | 17:09 |
| *** fawadkhaliq has joined #openstack-keystone | 17:10 | |
| dstanek | lbragstad: but any consumers would later have to be rewritten to use the new key | 17:10 |
| lbragstad | dstanek ah - yes | 17:10 |
| openstackgerrit | Merged openstack/keystone: Validate v2 fernet token returns extra attributes https://review.openstack.org/289618 | 17:11 |
| *** rk4n has quit IRC | 17:11 | |
| *** rk4n has joined #openstack-keystone | 17:12 | |
| *** browne has joined #openstack-keystone | 17:18 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add ability to send notifications for actors https://review.openstack.org/287977 | 17:19 |
| lbragstad | dstanek fixed | 17:20 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add notifications to user/group membership https://review.openstack.org/287857 | 17:20 |
| dstanek | lbragstad: wasn't it discussed somewhere that we'd attach the full entity for things like deletions? | 17:20 |
| *** bjornar has joined #openstack-keystone | 17:20 | |
| lbragstad | dstanek i'm not sure if it was discussed - we still only provide the ID of the resource that was deleted and the resource type | 17:21 |
| dstanek | lbragstad: hmm, ok. maybe i can find that somewhere... | 17:21 |
| lbragstad | dstanek why? | 17:21 |
| openstackgerrit | Merged openstack/keystone: v2 tokens validated on the v3 API are missing timezones https://review.openstack.org/290139 | 17:21 |
| lbragstad | maybe dolphm knows ^? | 17:21 |
| dstanek | lbragstad: gyee commented on that bug from earlier | 17:22 |
| dolphm | the answer is B | 17:22 |
| lbragstad | 42 | 17:22 |
| dstanek | $1000 on B please | 17:22 |
| stevemar | lbragstad: it's always 42 | 17:22 |
| *** daemontool_ has joined #openstack-keystone | 17:22 | |
| dolphm | dstanek: we have definitely discussed that in the past - but what's the point if you can mutate the object to something unrecognizable and then delete it? | 17:23 |
| dolphm | if you care, you need real data auditing | 17:23 |
| *** daemontool has quit IRC | 17:23 | |
| browne | Hi bknudson, where are you at with the bandit changes for keystonemiddleware? I see a bunch of patches in WIP. | 17:23 |
| stevemar | lbragstad: wasn't intending to backport https://review.openstack.org/#/c/287857/4 - seems kinda featurey and not buggy | 17:23 |
| patchbot | stevemar: patch 287857 - keystone - Add notifications to user/group membership | 17:23 |
| lbragstad | stevemar yeah - that's kinda what I was thinking | 17:23 |
| dstanek | dolphm: that's true. in the old ticketing system i worked on we stored new=entity and old=entity for updates. | 17:24 |
| bknudson | browne: I was working on them for a while and then I stopped working on them since I figured we'd switch to configless. Reviewers kept commenting on issues with the sample config. | 17:24 |
| lbragstad | dstanek dolphm explained the shadow thing to me yesterday and it made sense | 17:24 |
| bknudson | browne: if you've got time to work on it go ahead | 17:24 |
| stevemar | browne: sounds like you're volunteering :) | 17:24 |
| lbragstad | browne you've just been volun-told | 17:25 |
| browne | bknudson: yeah, want to switch it to configless. | 17:25 |
| openstackgerrit | henry-nash proposed openstack/keystone: Split out domain config driver and manager tests https://review.openstack.org/290195 | 17:25 |
| browne | lbragstad: haha, like that | 17:25 |
| openstackgerrit | Merged openstack/keystone: Explicitly exclude tests from bandit scan https://review.openstack.org/290201 | 17:26 |
| dolphm | any thoughts on my last comment here? apparently e.message is deprecated in py26, but i struggled to find any mention of it after that https://bugs.launchpad.net/keystoneauth/+bug/1534363 | 17:27 |
| openstack | Launchpad bug 1534363 in keystoneauth "message doesn't set properly on ClientException" [Medium,In progress] - Assigned to Tin Lam (tl3438) | 17:27 |
| dolphm | py27 seems to support e.args instead of .message -- which is printed by __str__() | 17:28 |
| *** tyagiprince1 has joined #openstack-keystone | 17:29 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Split out domain config driver and manager tests https://review.openstack.org/290195 | 17:32 |
| *** tyagiprince has quit IRC | 17:33 | |
| *** tyagiprince1 is now known as tyagiprince | 17:33 | |
| openstackgerrit | Merged openstack/keystone: Move domain config backend tests https://review.openstack.org/290038 | 17:35 |
| dstanek | dolphm: yeah, e.message is gone in Python3 | 17:36 |
| openstackgerrit | David Stanek proposed openstack/keystoneauth: WIP: interesting idea https://review.openstack.org/290719 | 17:40 |
| dstanek | dolphm: ^ | 17:40 |
| dstanek | that's what i think it should be | 17:40 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Remove bandit.yaml in favor of defaults https://review.openstack.org/267116 | 17:44 |
| *** tyagiprince has quit IRC | 17:44 | |
| *** spandhe has joined #openstack-keystone | 17:45 | |
| *** mhickey_ has quit IRC | 17:46 | |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Remove bandit.yaml in favor of defaults https://review.openstack.org/267116 | 17:46 |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 17:47 |
| *** slberger has quit IRC | 17:49 | |
| *** nkinder has quit IRC | 17:51 | |
| *** rk4n has quit IRC | 17:53 | |
| zigo | dolphm: Hi there. I've had a discussion in this channel about the admin_token_auth being removed from the default Keystone pipeline, but having a look, it doesn't seem to be the case. Do you know if that was reverted, somehow? | 17:55 |
| *** petertr7 is now known as petertr7_away | 18:00 | |
| dstanek | zigo: i thought it wasn't going to be removed from the paste pipeline until it's removed in O, but morgan would know the deets | 18:03 |
| morgan | it was put back in | 18:04 |
| zigo | morgan: Ah, thanks! :) | 18:04 |
| morgan | and not removed. | 18:04 |
| morgan | until O ot whatever | 18:04 |
| zigo | morgan: When trying to bootstrap my first admin user, I get: | 18:04 |
| zigo | Creating tenants... No domain with a name or ID of 'default' exists. | 18:04 |
| zigo | morgan: The "default" domain isn't there by default? :) | 18:05 |
| zigo | morgan: How do I even list the domains when I don't have a working admin user? | 18:05 |
| zigo | (yes, I know, I *will* use the keystone bootstrap stuff, I just want to unstuck everything before I write things correctly...) | 18:06 |
| *** ankita_wagh has joined #openstack-keystone | 18:09 | |
| zigo | The domain table has some kind of weird content... | 18:09 |
| zigo | In Mitaka b2, I had: | 18:09 |
| zigo | mysql> SELECT * FROM domain; | 18:10 |
| zigo | +---------+---------+---------+-----------------------------------------------------------------------------------------+ | 18:10 |
| zigo | | id | name | enabled | extra | | 18:10 |
| zigo | +---------+---------+---------+-----------------------------------------------------------------------------------------+ | 18:10 |
| zigo | | default | Default | 1 | {"description": "Owns users and tenants (i.e. projects) available on Identity API v2."} | | 18:10 |
| *** daemontool__ has joined #openstack-keystone | 18:10 | |
| zigo | Now, instead, I get: | 18:10 |
| zigo | mysql> SELECT * FROM domain; | 18:10 |
| zigo | +--------------------------+--------------------------+---------+-------+ | 18:10 |
| zigo | | id | name | enabled | extra | | 18:10 |
| zigo | +--------------------------+--------------------------+---------+-------+ | 18:10 |
| zigo | | <<keystone.domain.root>> | <<keystone.domain.root>> | 0 | {} | | 18:10 |
| zigo | Is this normal? | 18:10 |
| zigo | morgan: ^ | 18:10 |
| *** spzala has quit IRC | 18:11 | |
| *** sdake has quit IRC | 18:11 | |
| *** spzala has joined #openstack-keystone | 18:11 | |
| stevemar | bknudson: you should be able to ditch the bandit patches in keystonemiddleware now | 18:13 |
| *** daemontool_ has quit IRC | 18:13 | |
| zigo | Oh, I see... Looks like I can't do without "keystone-manage bootstrap" these days, right? | 18:14 |
| stevemar | zigo: keystone-manage bootstrap is the prefered way | 18:15 |
| stevemar | zigo: but1 | 18:15 |
| stevemar | zigo: BUT! | 18:15 |
| stevemar | zigo: you can go ahead and use the admin_token like you used to | 18:15 |
| stevemar | create the endpoint, user, etc.. | 18:16 |
| *** ankita_wagh has quit IRC | 18:16 | |
| zigo | stevemar: Well, it doesn't work, because the "default" domain isn't there then. | 18:16 |
| *** daemontool__ has quit IRC | 18:16 | |
| stevemar | keystone will create a default domain if it doesn't detect one | 18:16 |
| zigo | stevemar: It just failed on me because of that. | 18:16 |
| *** spzala has quit IRC | 18:16 | |
| stevemar | zigo: what did you try to do? | 18:17 |
| zigo | stevemar: Let me show you... | 18:17 |
| zigo | stevemar: http://anonscm.debian.org/cgit/openstack/keystone.git/tree/debian/keystone.postinst.in <--- This is what the Debian package does automatically *IF* you ask it to do so (by default it does nothing). | 18:18 |
| zigo | This way, "apt-get install keystone" is enough to have a working Keystone install. | 18:18 |
| zigo | stevemar: It failed in the keystone_create_admin_tenant if I didn't run keystone-manage bootstrap. | 18:19 |
| morgan | zigo: you know i disagree with apt-get install setting up anything in the db, | 18:19 |
| zigo | morgan: It's off by default... | 18:19 |
| morgan | zigo: a package trying to be that smart is doing it wrong imo. | 18:19 |
| stevemar | morgan: he did say IF :) | 18:19 |
| zigo | morgan: Do you think I | 18:19 |
| zigo | morgan: Do you think I'm dumb ? :) | 18:20 |
| morgan | anyway | 18:20 |
| morgan | use of bootstrap would be ideal | 18:20 |
| morgan | fwiw | 18:20 |
| zigo | There's dbconfig-common to setup dbs, and it's supposed to "do the right thing" (tm). That's the standard interface in Debian for it, so I don't see why not, especially if it's off by default. Plus I use all of that with preseed so that everything gets installed automatically in my CI, without the need to interact with anything puppet, so it's *very* useful. | 18:21 |
| *** jaosorior has joined #openstack-keystone | 18:21 | |
| zigo | morgan: Will do. | 18:21 |
| zigo | Thanks guys. | 18:21 |
| morgan | zigo: it might be an edge case | 18:21 |
| *** jasonsb has quit IRC | 18:22 | |
| morgan | zigo: as well. where the default domain doesn't get created in some cases. should be confirmed | 18:22 |
| zigo | morgan: I just thought I'd delay fixing the postinst to do the correct thing after everything else was working in Mitaka, but it looks like I'm going to work on this first ! :) | 18:22 |
| morgan | zigo: but def. move to use bootstrap if you can in general, it's what devstack does and ideally this is the general way going forward. | 18:22 |
| zigo | Doing so right now. | 18:23 |
| *** slberger has joined #openstack-keystone | 18:23 | |
| zigo | (as I just tried manually, and it worked...) | 18:23 |
| morgan | zigo: if you can isolate a case where default domain isn't created automatically - it's worth filing a bug on it. | 18:23 |
| morgan | zigo: and worth us fixing - before mitaka ships - we claim to support automatic creation of the default domain | 18:24 |
| *** nkinder has joined #openstack-keystone | 18:24 | |
| zigo | Well, install Keystone, run db_sync, then attempt to do: | 18:25 |
| zigo | openstack --os-token ${AUTH_TOKEN} --os-url=http://127.0.0.1:35357/v3/ --os-domain-name default --os-identity-api-version=3 project create --or-show $ADMIN_TENANT_NAME --domain default --description "Default Debian admin project" | 18:25 |
| morgan | stevemar, bknudson: ^ | 18:25 |
| *** spzala has joined #openstack-keystone | 18:25 | |
| zigo | It may have failed a bit later, let me make sure... | 18:25 |
| bknudson | only if v2 is used does it create a default domain | 18:26 |
| bknudson | because that's what the default domain is for - v2 users | 18:26 |
| morgan | bknudson: so in this case zigo needs to create the default domain if not using bootstrap | 18:26 |
| morgan | bknudson: if he's using it. | 18:26 |
| morgan | ok | 18:26 |
| morgan | that is fine | 18:26 |
| bknudson | create a domain. Call it default if you want | 18:26 |
| morgan | bknudson: ++ | 18:26 |
| morgan | zigo: so instead of converting to bootstrap, just add the domain create call, but i still recommend bootstrap if possible | 18:27 |
| * zigo moves to use keystone-manage bootstrap anyway | 18:27 | |
| openstackgerrit | Doug Hellmann proposed openstack/python-keystoneclient: Update reno for stable/mitaka https://review.openstack.org/290759 | 18:27 |
| *** mvk has quit IRC | 18:27 | |
| morgan | zigo: ok cool. just figured we'd offer the small amount of work. | 18:27 |
| morgan | zigo: anyway. | 18:27 |
| morgan | zigo: cheers | 18:28 |
| zigo | I very much prefer the bootstrap way, because I don't have to pass a password in the command line, which would be a security issue (it is right now...). | 18:28 |
| zigo | Thanks a lot guys, you're really super helpful. | 18:28 |
| *** e0ne has joined #openstack-keystone | 18:29 | |
| *** tyagiprince has joined #openstack-keystone | 18:38 | |
| ayoung | It is 80 degress here in Massachusetts. | 18:40 |
| bknudson | Centigrade? | 18:41 |
| stevemar | bknudson: thatd be interesting | 18:42 |
| *** pece has quit IRC | 18:42 | |
| ayoung | It is warmer outside my house than inside | 18:43 |
| bknudson | straight to the ac | 18:43 |
| ayoung | bknudson, I guess that is about 25 degrees Centigrade | 18:43 |
| ayoung | Just opened the majority of the windows in my house | 18:43 |
| bknudson | it was warm here yesterday and then today it cools off | 18:44 |
| *** dims has quit IRC | 18:44 | |
| *** dims has joined #openstack-keystone | 18:46 | |
| sigmavirus24 | For interested parties, I'm going to be speaking about keystoneauth's betamax feature and betamax for the OpenStack NYC Bugsmash event: https://twitter.com/sigmavirus24/status/707629010323308544 The talk will be live-streamed over Hangouts on Air | 18:46 |
| sigmavirus24 | psst morgan what made you add the BetamaxFixture btw? | 18:47 |
| morgan | sigmavirus24: because we wanted to record public cloud/clouds that are in OCC | 18:47 |
| morgan | and be able to replay the responses for unit tests | 18:47 |
| sigmavirus24 | :) | 18:47 |
| morgan | making sure we don't regress/break real installs | 18:47 |
| morgan | it hasn't gotten there yet, but that was the reasoning for adding it to ksa | 18:48 |
| sigmavirus24 | morgan: I know why I'd use the fixture, just wasn't sure what made you choose betamax really :) | 18:48 |
| morgan | the fixture was a good way to handle that recording also so we can do recording elegantly - the option was betamax or crazy requests-mock stuff | 18:48 |
| sigmavirus24 | Cool | 18:48 |
| morgan | figured betamax did most of what we wanted already, so yay | 18:48 |
| morgan | why reinvent the wheel | 18:49 |
| sigmavirus24 | Thanks :) | 18:49 |
| morgan | sigmavirus24: sure thing | 18:49 |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Rename v2 token schema used for validation https://review.openstack.org/290768 | 18:52 |
| *** sdake has joined #openstack-keystone | 18:57 | |
| *** petertr7_away is now known as petertr7 | 18:57 | |
| *** ninag has quit IRC | 18:58 | |
| *** ninag has joined #openstack-keystone | 18:59 | |
| *** markvoelker has quit IRC | 19:01 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Rename v2 token schema used for validation https://review.openstack.org/290768 | 19:02 |
| *** markvoelker has joined #openstack-keystone | 19:03 | |
| *** ninag has quit IRC | 19:03 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/290645 | 19:03 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 19:05 |
| *** trown is now known as trown|lunch | 19:05 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation driver interface https://review.openstack.org/209600 | 19:06 |
| *** petertr7 is now known as petertr7_away | 19:07 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Rename v2 token schema used for validation https://review.openstack.org/290768 | 19:08 |
| lbragstad | jorge_munoz https://review.openstack.org/#/q/status:open+project:openstack/keystone+branch:master+topic:refactor-tests | 19:09 |
| shaleh | stevemar, lbragstad you all around to talk about the migrate_repo review? | 19:12 |
| *** andreykurilin__ has quit IRC | 19:13 | |
| *** boris-42 has quit IRC | 19:14 | |
| *** tqtran has joined #openstack-keystone | 19:15 | |
| openstackgerrit | Jorge Munoz proposed openstack/keystone: Consolidate TestTrustRedelegation and TestTrustAuth tests https://review.openstack.org/280447 | 19:15 |
| *** markvoelker has quit IRC | 19:17 | |
| *** markvoelker has joined #openstack-keystone | 19:18 | |
| *** doug-fis_ has joined #openstack-keystone | 19:19 | |
| *** doug-fis_ is now known as doug-fish_ | 19:20 | |
| krotscheck | morgan: Hey, is there a spec somewhere that describes how keystone is deprecating the v2 api (headers, etc)? Trove is in a similar situation. | 19:21 |
| *** doug-fish has quit IRC | 19:21 | |
| *** gordc has quit IRC | 19:22 | |
| *** tyagiprince has quit IRC | 19:26 | |
| *** sdake_ has joined #openstack-keystone | 19:30 | |
| *** sdake has quit IRC | 19:32 | |
| *** jed56 has quit IRC | 19:33 | |
| *** mvk has joined #openstack-keystone | 19:39 | |
| *** petertr7_away is now known as petertr7 | 19:40 | |
| *** ninag has joined #openstack-keystone | 19:40 | |
| *** lhcheng has joined #openstack-keystone | 19:40 | |
| *** ChanServ sets mode: +v lhcheng | 19:40 | |
| *** ninag_ has joined #openstack-keystone | 19:42 | |
| *** ninag has quit IRC | 19:44 | |
| *** tyagiprince has joined #openstack-keystone | 19:45 | |
| tjcocozz | bknudson, it looks like the warnerrors functionality is going to come back https://review.openstack.org/#/c/229951/ | 19:46 |
| patchbot | tjcocozz: patch 229951 - openstack-dev/pbr - Restore warnerrors behavior | 19:46 |
| *** woodster_ has joined #openstack-keystone | 19:47 | |
| bknudson | tjcocozz: that's going to cause everything to break again! he he | 19:47 |
| *** pushkaru has quit IRC | 19:48 | |
| *** pushkaru has joined #openstack-keystone | 19:48 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:48 | |
| tjcocozz | bknudson, yeah, just checked and it hasn't been running since Apr 7 | 19:49 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Add PKIZ coverage to trust tests https://review.openstack.org/290813 | 19:52 |
| *** BigWillie has quit IRC | 19:54 | |
| *** doug-fish has joined #openstack-keystone | 19:55 | |
| *** doug-fish_ has quit IRC | 19:55 | |
| *** tyagiprince has quit IRC | 19:59 | |
| *** pauloewerton has quit IRC | 20:02 | |
| *** jaosorior has quit IRC | 20:02 | |
| *** gordc has joined #openstack-keystone | 20:02 | |
| *** jaosorior has joined #openstack-keystone | 20:03 | |
| *** tyagiprince has joined #openstack-keystone | 20:04 | |
| morgan | krotscheck: uhmmmmmmmmm | 20:06 |
| morgan | krotscheck: ask stevemar, dolphm, bknudson, and dstanek | 20:07 |
| bknudson | krotscheck: we're just having use of the v2 apis log a deprecation warning | 20:08 |
| *** gyee has quit IRC | 20:08 | |
| *** pushkaru has quit IRC | 20:09 | |
| *** pumarani__ has joined #openstack-keystone | 20:09 | |
| *** nkinder has quit IRC | 20:11 | |
| *** daemontool has joined #openstack-keystone | 20:14 | |
| dolphm | stevemar: WTF does NOT_REGISTERED mean in the jenkins job? https://review.openstack.org/#/c/290768/ | 20:17 |
| patchbot | dolphm: patch 290768 - keystone - Rename v2 token schema used for validation | 20:17 |
| dolphm | jorge_munoz: ^ | 20:20 |
| *** sdake has joined #openstack-keystone | 20:21 | |
| dolphm | krotscheck: the clients log warnings client-side, the API should be advertised as deprecated on the root endpoint at some point (i think the status is still "stable" for us), and the servers log usage as deprecation warnings | 20:21 |
| krotscheck | dolphm: Thanks :) | 20:22 |
| *** mewald has joined #openstack-keystone | 20:22 | |
| morgan | dolphm: "not registered" is a jenkins issue i think, the job is in zuul but not registered with jenkins to run | 20:23 |
| morgan | dolphm: i think | 20:23 |
| dolphm | morgan: weird, so just recheck? | 20:23 |
| *** sdake_ has quit IRC | 20:23 | |
| morgan | dolphm: well, if it passed previously, yes, if no, then look at the infra config to make sure it's properly setup | 20:23 |
| *** pumarani__ has quit IRC | 20:25 | |
| *** pumarani__ has joined #openstack-keystone | 20:25 | |
| mewald | I am using Keystone V3 with multiple domains which works fine with the "openstack" client (for example, openstack user list etc) But the "keystone" client fails to run like this https://gist.github.com/mewald1/b897b1adb26fbf499b78 This is what the environment looks like: https://gist.github.com/mewald1/88c52a8431cf22a5d769 | 20:26 |
| *** trown|lunch is now known as trown | 20:27 | |
| *** tellesnobrega is now known as tellesnobrega_af | 20:30 | |
| *** tyagiprince has quit IRC | 20:33 | |
| openstackgerrit | Sean Perry proposed openstack/keystone: Migrate_repo init version helper https://review.openstack.org/137640 | 20:33 |
| lbragstad | dolphm https://review.openstack.org/#/c/244871/6/doc/admin-guide-cloud/source/keystone_tokens.rst | 20:36 |
| patchbot | lbragstad: patch 244871 - openstack-manuals - Add documentation for keystone tokens (MERGED) | 20:36 |
| lbragstad | dolphm https://review.openstack.org/#/q/status:merged+project:openstack/openstack-manuals+branch:master+topic:add-tokens-doc | 20:36 |
| *** tellesnobrega_af is now known as tellesnobrega | 20:39 | |
| lbragstad | dolphm http://docs.openstack.org/admin-guide-cloud/keystone_tokens.html | 20:40 |
| morgan | mewald: the keystoneclient cli does not work with v3 | 20:41 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add auto-increment int primary key to revoke.backends.sql https://review.openstack.org/290841 | 20:45 |
| *** doug-fish has quit IRC | 20:49 | |
| *** Ephur has joined #openstack-keystone | 20:49 | |
| *** tsufiev has left #openstack-keystone | 20:50 | |
| *** e0ne has quit IRC | 20:53 | |
| *** tqtran has quit IRC | 20:54 | |
| *** tqtran has joined #openstack-keystone | 20:55 | |
| openstackgerrit | Merged openstack/keystoneauth: Swap the order of username deprecation https://review.openstack.org/287754 | 20:55 |
| *** pumarani__ has quit IRC | 20:57 | |
| *** pushkaru has joined #openstack-keystone | 20:57 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:58 | |
| *** petertr7 is now known as petertr7_away | 21:00 | |
| *** rderose has quit IRC | 21:02 | |
| *** pushkaru has quit IRC | 21:02 | |
| *** pushkaru has joined #openstack-keystone | 21:02 | |
| lbragstad | dolphm I got the same thing here - https://review.openstack.org/#/q/topic:bug/1552639 | 21:03 |
| lbragstad | gate-keystone-tox-db-legacy_driversNOT_REGISTERED | 21:04 |
| * lbragstad has absolutely no idea what that is | 21:04 | |
| *** dims has quit IRC | 21:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Make modifications to domain config atomic https://review.openstack.org/290223 | 21:14 |
| *** mewald has quit IRC | 21:18 | |
| *** markvoelker has quit IRC | 21:20 | |
| *** doug-fish has joined #openstack-keystone | 21:25 | |
| *** trown is now known as trown|outtypewww | 21:25 | |
| *** sheel has quit IRC | 21:27 | |
| *** dims has joined #openstack-keystone | 21:37 | |
| *** pnavarro has quit IRC | 21:38 | |
| *** sdake has quit IRC | 21:44 | |
| *** SDub has joined #openstack-keystone | 21:45 | |
| *** gyee has joined #openstack-keystone | 21:51 | |
| *** ChanServ sets mode: +v gyee | 21:51 | |
| *** rk4n has joined #openstack-keystone | 21:52 | |
| SDub | Anyone know how to configure keystone to use TLS for public and admin endpoints? | 21:53 |
| *** dims has quit IRC | 21:56 | |
| *** dims has joined #openstack-keystone | 21:58 | |
| *** slberger has quit IRC | 22:01 | |
| *** ninag_ has quit IRC | 22:05 | |
| zigo | morgan: stevemar: When I do "openstack token issue", I get as a reply: | 22:09 |
| zigo | __init__() got an unexpected keyword argument 'token' | 22:09 |
| zigo | What's going on? :( | 22:09 |
| zigo | "openstack help" does show token as a possible command ... | 22:10 |
| morgan | thats... weird | 22:10 |
| morgan | like... that shouldn't happen | 22:10 |
| *** knikolla has quit IRC | 22:10 | |
| zigo | Right... | 22:11 |
| zigo | morgan: http://paste.openstack.org/show/489913/ | 22:13 |
| morgan | stevemar: ^ | 22:14 |
| *** gordc has quit IRC | 22:16 | |
| *** phalmos has quit IRC | 22:19 | |
| *** jaugustine has quit IRC | 22:19 | |
| zigo | I'm trying to upgrade OSC and KSC to latest version released a few days ago, see what happens. | 22:19 |
| zigo | (I was fairly up-to-date already...) | 22:19 |
| *** david-lyle has quit IRC | 22:19 | |
| *** dave-mccowan has quit IRC | 22:20 | |
| *** david-lyle has joined #openstack-keystone | 22:20 | |
| shaleh | odd. Why is a token being passed to the Password plugin? | 22:21 |
| *** mewald has joined #openstack-keystone | 22:21 | |
| morgan | shaleh: yeah it seems... wrong | 22:22 |
| shaleh | also, notice it is doing IDENTITTY_API_VERSION=3 but calling a /v2.0 api | 22:23 |
| shaleh | might be part of the issue | 22:23 |
| *** jorge_munoz has left #openstack-keystone | 22:24 | |
| morgan | oh huh | 22:25 |
| morgan | that is likely an issue | 22:25 |
| zigo | Ah... | 22:25 |
| *** mewald has quit IRC | 22:26 | |
| zigo | It used to work very well for Liberty to do that. | 22:26 |
| shaleh | zigo: why is 'token' defined here when calling 'token issue'? | 22:26 |
| shaleh | left over variable? | 22:27 |
| zigo | shaleh: I'm not sure what you mean. | 22:27 |
| morgan | shaleh: maybe | 22:27 |
| shaleh | zigo: can you paste the output of 'env' from the same shell. If that is called by a script, add it as a line just above the call to OSC. | 22:28 |
| shaleh | zigo: obviously mask out anything we should not see | 22:28 |
| *** dims has quit IRC | 22:29 | |
| zigo | shaleh: Oh, I see what was wrong ! :) | 22:30 |
| zigo | morgan: shaleh: My bad, I was playing with export OS_TOKEN to avoid passing it on the command line, and an old one was there when trying to do "openstack token issue" again. | 22:31 |
| zigo | So, it's my fault, though a nicer error message would have been nice ! :P | 22:31 |
| shaleh | zigo: agreed. Check if there is an open bug and if not please open one. | 22:31 |
| * zigo does that | 22:32 | |
| zigo | shaleh: Against KSC, right? | 22:32 |
| shaleh | zigo: OSC I think. It should have sanitized the inputs. | 22:32 |
| zigo | Ok. | 22:32 |
| shaleh | KSC was totally correct to complain about a token being passed into the Password plugin. | 22:33 |
| *** roxanagh_ has quit IRC | 22:33 | |
| shaleh | zigo: thank you for the bug report. Now someone else won't have the same experience. | 22:34 |
| *** pushkaru has quit IRC | 22:34 | |
| zigo | :) | 22:34 |
| *** dave-mccowan has joined #openstack-keystone | 22:34 | |
| shaleh | zigo: do mind the setting of IDENTITY_API_VERSION=3 but calling a /v2.0 api. This might bite you at some point. | 22:34 |
| zigo | shaleh: Shout this to the documentation people, that's what they advise to do. And by the way, for Liberty, this is what worked best, for some reason ... | 22:35 |
| zigo | shaleh: Hopefully, with everyone migrating to v3, we wont need it anymore. | 22:36 |
| shaleh | zigo: link please. | 22:36 |
| zigo | shaleh: somewhere in docs.openstack.org -> install guide | 22:36 |
| zigo | (for Liberty) | 22:36 |
| zigo | That's what I reproduced for my own Debian packaging CI, and it worked very well. | 22:36 |
| shaleh | zigo: luck and the hard work of the Open Stack team | 22:37 |
| zigo | :) | 22:38 |
| zigo | https://bugs.launchpad.net/python-openstackclient/+bug/1555366 | 22:42 |
| openstack | Launchpad bug 1555366 in python-openstackclient "OSC should check if OS_TOKEN is set when performing a "token issue" command" [Undecided,New] | 22:42 |
| shaleh | zigo: excellent | 22:42 |
| *** henrynash has quit IRC | 22:43 | |
| zigo | Ah no... | 22:44 |
| zigo | It looks like OS_TOKEN doesn't even work :( | 22:44 |
| zigo | I mean export OS_TOKEN. | 22:44 |
| zigo | Or does it? | 22:44 |
| *** dims has joined #openstack-keystone | 22:44 | |
| shaleh | zigo: try --os-token | 22:44 |
| zigo | shaleh: The point is, I don't want to push it to the command line. | 22:45 |
| shaleh | zigo: I know. Prove it works with --os-token. Then try it as a variable. Makes debugging easier :-) | 22:45 |
| zigo | (ie: that'd be leaking a token in /proc, visible to any user doing "ps auxf") | 22:45 |
| zigo | Ok. | 22:45 |
| shaleh | zigo: in theory the code treats --os-foo and OS_FOO the same | 22:46 |
| stevemar | zigo: dupe of https://bugs.launchpad.net/devstack/+bug/1549095 ? | 22:51 |
| openstack | Launchpad bug 1549095 in Ironic "devstack fails while running Ironic grenade job: init__() got an unexpected keyword argument 'token'" [High,In progress] - Assigned to John L. Villalovos (happycamp) | 22:51 |
| *** browne has quit IRC | 22:55 | |
| ctracey | for those federation folks...any thought given to supporting OR logic in remote mappings? | 22:57 |
| ctracey | right now all the remote mappings need to be true for the mapping to occur | 22:58 |
| *** bjornar has quit IRC | 23:01 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Update developer docs for bootstrap command https://review.openstack.org/290897 | 23:01 |
| *** lunarlamp is now known as mariusv | 23:01 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!