| *** timcline has joined #openstack-keystone | 00:13 | |
| *** timcline has quit IRC | 00:17 | |
| *** darrenc is now known as darrenc_afk | 00:26 | |
| *** sdake has joined #openstack-keystone | 00:31 | |
| *** sdake_ has quit IRC | 00:34 | |
| *** markvoelker has joined #openstack-keystone | 00:47 | |
| *** rk4n has joined #openstack-keystone | 00:50 | |
| *** darrenc_afk is now known as darrenc | 00:53 | |
| *** rk4n has quit IRC | 00:55 | |
| *** timcline has joined #openstack-keystone | 01:14 | |
| *** sdake_ has joined #openstack-keystone | 01:17 | |
| *** sdake has quit IRC | 01:18 | |
| *** timcline has quit IRC | 01:18 | |
| *** mylu has quit IRC | 01:21 | |
| *** naresht has quit IRC | 01:22 | |
| *** mylu has joined #openstack-keystone | 01:29 | |
| *** mylu has quit IRC | 01:30 | |
| *** mylu has joined #openstack-keystone | 01:32 | |
| *** zqfan has joined #openstack-keystone | 01:44 | |
| *** furface has quit IRC | 01:44 | |
| *** furface has joined #openstack-keystone | 01:45 | |
| *** bapalm has joined #openstack-keystone | 01:51 | |
| *** dan_nguyen has joined #openstack-keystone | 01:51 | |
| *** rk4n has joined #openstack-keystone | 01:52 | |
| *** sdake has joined #openstack-keystone | 01:53 | |
| *** sdake_ has quit IRC | 01:54 | |
| *** rk4n has quit IRC | 01:57 | |
| *** mylu has quit IRC | 02:02 | |
| *** mylu has joined #openstack-keystone | 02:03 | |
| *** sdake has quit IRC | 02:03 | |
| *** mylu has quit IRC | 02:05 | |
| *** sdake has joined #openstack-keystone | 02:06 | |
| *** mylu has joined #openstack-keystone | 02:06 | |
| *** timcline has joined #openstack-keystone | 02:15 | |
| *** timcline has quit IRC | 02:19 | |
| *** roxanaghe has joined #openstack-keystone | 02:27 | |
| *** roxanaghe has quit IRC | 02:31 | |
| *** links has joined #openstack-keystone | 02:46 | |
| *** dan_nguyen has quit IRC | 02:54 | |
| *** markvoelker has quit IRC | 03:14 | |
| *** timcline has joined #openstack-keystone | 03:15 | |
| *** timcline has quit IRC | 03:20 | |
| *** jamielennox is now known as jamielennox|away | 03:27 | |
| *** sdake_ has joined #openstack-keystone | 03:29 | |
| *** sdake has quit IRC | 03:32 | |
| *** jamielennox|away is now known as jamielennox | 03:37 | |
| *** dan_nguyen has joined #openstack-keystone | 03:37 | |
| *** dave-mcc_ has quit IRC | 03:49 | |
| *** furface has quit IRC | 03:52 | |
| *** rk4n has joined #openstack-keystone | 03:54 | |
| *** mylu has quit IRC | 03:56 | |
| jamielennox | ayoung, dolphm, stevemar, bknudson: Updated the cross-project policy spec: https://review.openstack.org/#/c/245629/ | 03:57 |
|---|---|---|
| patchbot | jamielennox: patch 245629 - openstack-specs - A common policy scenario across all projects | 03:57 |
| *** rk4n has quit IRC | 03:59 | |
| *** mylu has joined #openstack-keystone | 04:05 | |
| *** roxanaghe has joined #openstack-keystone | 04:08 | |
| *** sdake_ is now known as sdake | 04:12 | |
| *** roxanaghe has quit IRC | 04:12 | |
| *** markvoelker has joined #openstack-keystone | 04:15 | |
| *** timcline has joined #openstack-keystone | 04:16 | |
| stevemar | jamielennox: nice | 04:17 |
| jamielennox | stevemar: it's a reasonably big change from the last revision - i mostly want to know they still make sense | 04:18 |
| *** timcline has quit IRC | 04:21 | |
| *** markvoelker has quit IRC | 04:21 | |
| *** Nirupama has joined #openstack-keystone | 04:23 | |
| *** mylu_ has joined #openstack-keystone | 04:25 | |
| *** mylu has quit IRC | 04:27 | |
| *** jasonsb has joined #openstack-keystone | 04:36 | |
| *** dan_nguyen has quit IRC | 04:39 | |
| morgan | jamielennox: woot | 04:47 |
| *** furface has joined #openstack-keystone | 04:52 | |
| *** rk4n has joined #openstack-keystone | 04:57 | |
| *** xek has quit IRC | 04:59 | |
| *** xek has joined #openstack-keystone | 05:01 | |
| *** GB21 has joined #openstack-keystone | 05:01 | |
| *** rk4n has quit IRC | 05:01 | |
| *** jasonsb has quit IRC | 05:09 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v2_0) https://review.openstack.org/267449 | 05:10 |
| *** jasonsb has joined #openstack-keystone | 05:13 | |
| *** timcline has joined #openstack-keystone | 05:17 | |
| *** mylu_ has quit IRC | 05:19 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Handle cache invalidate outside cache object https://review.openstack.org/268662 | 05:21 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Use oslo_config in auth_token middleware https://review.openstack.org/268664 | 05:21 |
| *** timcline has quit IRC | 05:22 | |
| *** jasonsb has quit IRC | 05:24 | |
| *** jasonsb has joined #openstack-keystone | 05:27 | |
| *** furface has quit IRC | 05:34 | |
| *** furface has joined #openstack-keystone | 05:38 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3) https://review.openstack.org/267456 | 05:40 |
| jamielennox | morgan: i know it must be late, but do you know anything about the memcachepool implementation in oslo.cache? | 05:45 |
| morgan | uhmm... | 05:45 |
| morgan | its' the same as we had in our code i think | 05:45 |
| morgan | and just as bad | 05:46 |
| jamielennox | morgan: so long as it just as bad | 05:46 |
| jamielennox | your name is co-author on the review | 05:46 |
| morgan | yeah | 05:46 |
| morgan | it was ok when we started | 05:46 |
| morgan | it got worse as we went on | 05:46 |
| jamielennox | does dogpile not have something of it's own it could use | 05:46 |
| morgan | somewhat | 05:47 |
| morgan | dogpile is meant to be a lib that provides a framework | 05:47 |
| morgan | so pool is something that most likely would be implemented in oslo.cache | 05:48 |
| morgan | and never in dogpile | 05:48 |
| jamielennox | ok | 05:49 |
| jamielennox | i'm just looking to see if i can remove the implementation from keystonemiddleware | 05:49 |
| morgan | yes | 05:49 |
| morgan | if we use oslo.cache | 05:50 |
| jamielennox | morgan: https://review.openstack.org/268664 | 05:50 |
| * morgan nods | 05:51 | |
| jamielennox | it's not going to pass jenkins | 05:51 |
| jamielennox | but still, at the moment i've got a check if you've configured oslo.cache then use that, otherwise use the existing code | 05:51 |
| stevemar | gerrit is super slow right now | 05:51 |
| morgan | stevemar: yeah it is | 05:51 |
| morgan | backup time i think? | 05:51 |
| jamielennox | but if the oslo.cache stuff is ok then i can figure out something better and like translate the options or something | 05:51 |
| stevemar | jamielennox: you've written oslo.config everywhere instead of oslo.cache (in the commit msg) | 05:52 |
| morgan | jamielennox: yeah | 05:52 |
| jamielennox | bah - muscle memory | 05:52 |
| stevemar | :) | 05:52 |
| jamielennox | oslo.cache doesn't do the security_strategy stuff, so we might be stuck doing our own anyway | 05:56 |
| *** roxanaghe has joined #openstack-keystone | 05:56 | |
| morgan | jamielennox: we will need to do that ourselves | 05:56 |
| morgan | we'll do that as a dogpile proxy | 05:56 |
| morgan | rather than in the driver itself | 05:56 |
| jamielennox | ok | 05:57 |
| jamielennox | that makes sense | 05:57 |
| morgan | commented | 05:57 |
| *** roxanaghe has quit IRC | 06:01 | |
| jamielennox | morgan: replied, but not major - is there a way i can configure oslo_cache without using the CONF | 06:03 |
| morgan | don't think so really atm | 06:03 |
| morgan | well.. maybe? | 06:03 |
| morgan | the security strategy is the important bits to cover | 06:03 |
| morgan | before we convert to using oslo.cache | 06:03 |
| morgan | my other comments were either "is this needed?" or "future looking" | 06:04 |
| jamielennox | so i don't know how the proxy works exactly but the concept there is easy and i've seen some stuff in testing that would apply | 06:05 |
| morgan | it should be easy to add | 06:05 |
| morgan | look at the local cache stuff in keystone | 06:05 |
| morgan | that makes use of it | 06:05 |
| jamielennox | the bit i'm looking at now is if the old memcache_servers options are set how do i pass the old option names to dogpile | 06:05 |
| morgan | you can construct a dict of config values | 06:06 |
| morgan | and then pass that to .configure i think | 06:06 |
| morgan | *thinkg* | 06:06 |
| morgan | i'll need to look at it again | 06:06 |
| morgan | when it's not almost midnight | 06:06 |
| morgan | and i have a flight in like 7 hrs :P | 06:06 |
| morgan | i need to pack for | 06:06 |
| jamielennox | morgan: yea, i wasn't meaning to grab you about it right now | 06:06 |
| jamielennox | morgan: just looking through it and you answered the ping | 06:06 |
| * morgan nods. | 06:06 | |
| jamielennox | but no, from reading it's expecting a oslo_config object | 06:07 |
| stevemar | morgan: where you off to? :O | 06:12 |
| morgan | stevemar: SF | 06:12 |
| *** timcline has joined #openstack-keystone | 06:18 | |
| *** timcline has quit IRC | 06:23 | |
| *** daemontool has joined #openstack-keystone | 06:24 | |
| *** GB21 has quit IRC | 06:30 | |
| *** ankur has joined #openstack-keystone | 06:30 | |
| *** shoutm has joined #openstack-keystone | 06:37 | |
| *** shoutm_ has joined #openstack-keystone | 06:46 | |
| *** shoutm has quit IRC | 06:47 | |
| *** shoutm__ has joined #openstack-keystone | 06:47 | |
| *** sdake has quit IRC | 06:48 | |
| *** sdake has joined #openstack-keystone | 06:50 | |
| *** shoutm_ has quit IRC | 06:51 | |
| *** sdake_ has joined #openstack-keystone | 06:54 | |
| *** sdake has quit IRC | 06:56 | |
| jamielennox | is there any reason someone woulud not want the use_advanced_pool set in auth_token middleware? | 06:58 |
| *** rk4n has joined #openstack-keystone | 06:59 | |
| *** sdake has joined #openstack-keystone | 06:59 | |
| *** sdake_ has quit IRC | 07:00 | |
| *** shoutm__ has quit IRC | 07:04 | |
| *** rk4n has quit IRC | 07:04 | |
| *** shoutm has joined #openstack-keystone | 07:06 | |
| *** shoutm has quit IRC | 07:11 | |
| *** prometheanfire has left #openstack-keystone | 07:13 | |
| -openstackstatus- NOTICE: Gerrit is going to be restarted due to bad performance | 07:14 | |
| *** browne has quit IRC | 07:17 | |
| *** timcline has joined #openstack-keystone | 07:18 | |
| *** timcline has quit IRC | 07:23 | |
| *** GB21 has joined #openstack-keystone | 07:32 | |
| *** samueldmq has quit IRC | 07:37 | |
| *** samueldmq has joined #openstack-keystone | 07:37 | |
| *** charz has quit IRC | 07:37 | |
| *** agireud has quit IRC | 07:40 | |
| *** bigjools has quit IRC | 07:43 | |
| *** rcernin has joined #openstack-keystone | 07:43 | |
| *** agireud has joined #openstack-keystone | 07:43 | |
| *** charz has joined #openstack-keystone | 07:43 | |
| *** bigjools has joined #openstack-keystone | 07:43 | |
| *** bigjools has quit IRC | 07:43 | |
| *** bigjools has joined #openstack-keystone | 07:43 | |
| *** sdake has quit IRC | 07:53 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:54 | |
| *** rk4n has joined #openstack-keystone | 07:56 | |
| *** jamielennox is now known as jamielennox|away | 08:01 | |
| *** rk4n has quit IRC | 08:01 | |
| *** e0ne has joined #openstack-keystone | 08:02 | |
| *** jed56 has joined #openstack-keystone | 08:06 | |
| breton | jamielennox|away: does it work? | 08:07 |
| *** fawadkhaliq has quit IRC | 08:10 | |
| *** zqfan has quit IRC | 08:12 | |
| *** daemontool_ has joined #openstack-keystone | 08:13 | |
| *** jaosorior has joined #openstack-keystone | 08:14 | |
| *** daemontool has quit IRC | 08:17 | |
| *** jistr has joined #openstack-keystone | 08:19 | |
| *** rdo has joined #openstack-keystone | 08:19 | |
| *** timcline has joined #openstack-keystone | 08:19 | |
| *** timcline has quit IRC | 08:24 | |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add return-request-id-to-caller function(v3/contrib) https://review.openstack.org/268003 | 08:24 |
| openstackgerrit | Maho Koshiya proposed openstack/python-keystoneclient: Add release notes for return-request-id-to-caller https://review.openstack.org/276644 | 08:32 |
| *** mdavidson has quit IRC | 08:39 | |
| *** rk4n has joined #openstack-keystone | 08:57 | |
| *** jaosorior has quit IRC | 08:57 | |
| *** GB21 has quit IRC | 09:01 | |
| *** EinstCrazy has joined #openstack-keystone | 09:01 | |
| *** jaosorior has joined #openstack-keystone | 09:05 | |
| *** timcline has joined #openstack-keystone | 09:20 | |
| *** GB21 has joined #openstack-keystone | 09:20 | |
| *** timcline has quit IRC | 09:24 | |
| *** roxanaghe has joined #openstack-keystone | 09:32 | |
| *** henrynash has quit IRC | 09:35 | |
| *** mdavidson has joined #openstack-keystone | 09:35 | |
| *** roxanaghe has quit IRC | 09:36 | |
| *** links has quit IRC | 09:53 | |
| *** links has joined #openstack-keystone | 09:54 | |
| *** nisha has joined #openstack-keystone | 09:59 | |
| *** nisha_ has joined #openstack-keystone | 10:08 | |
| *** nisha has quit IRC | 10:12 | |
| *** jdennis has joined #openstack-keystone | 10:13 | |
| *** jdennis1 has quit IRC | 10:15 | |
| *** timcline has joined #openstack-keystone | 10:21 | |
| *** timcline has quit IRC | 10:26 | |
| *** sheel has joined #openstack-keystone | 10:27 | |
| *** openstackgerrit has quit IRC | 10:48 | |
| *** openstackgerrit has joined #openstack-keystone | 10:48 | |
| *** rodrigods has quit IRC | 10:50 | |
| *** rodrigods has joined #openstack-keystone | 10:50 | |
| *** tellesnobrega is now known as tellesnobrega_af | 10:56 | |
| *** nisha_ has quit IRC | 11:00 | |
| openstackgerrit | Thomas Goirand proposed openstack/keystoneauth: fix OrderedDict mutated during iteration https://review.openstack.org/301049 | 11:10 |
| *** krotscheck_vaca is now known as krotscheck | 11:13 | |
| *** roxanaghe has joined #openstack-keystone | 11:20 | |
| *** timcline has joined #openstack-keystone | 11:22 | |
| *** roxanaghe has quit IRC | 11:25 | |
| *** timcline has quit IRC | 11:26 | |
| *** sdake has joined #openstack-keystone | 11:34 | |
| *** sdake_ has joined #openstack-keystone | 11:36 | |
| *** gordc has joined #openstack-keystone | 11:36 | |
| *** sdake has quit IRC | 11:38 | |
| *** GB21 has quit IRC | 11:46 | |
| *** henrynash has joined #openstack-keystone | 11:49 | |
| *** ChanServ sets mode: +v henrynash | 11:49 | |
| *** EinstCrazy has quit IRC | 11:50 | |
| *** henrynash has quit IRC | 11:52 | |
| *** tellesnobrega_af is now known as tellesnobrega | 11:54 | |
| *** mvk_ has joined #openstack-keystone | 11:57 | |
| *** raildo-afk is now known as raildo | 11:58 | |
| *** mvk has quit IRC | 12:00 | |
| *** mvk_ has quit IRC | 12:03 | |
| *** zqfan has joined #openstack-keystone | 12:13 | |
| *** ChanServ sets mode: +v samueldmq | 12:14 | |
| *** markvoelker has joined #openstack-keystone | 12:15 | |
| *** GB21 has joined #openstack-keystone | 12:15 | |
| *** tellesnobrega is now known as tellesnobrega_af | 12:17 | |
| *** timcline has joined #openstack-keystone | 12:22 | |
| *** edmondsw has joined #openstack-keystone | 12:24 | |
| *** timcline has quit IRC | 12:27 | |
| *** GB21 has quit IRC | 12:28 | |
| *** sdake_ has quit IRC | 12:30 | |
| *** josecastroleon has joined #openstack-keystone | 12:32 | |
| *** sdake has joined #openstack-keystone | 12:34 | |
| *** Kalaswan has joined #openstack-keystone | 12:38 | |
| *** mvk_ has joined #openstack-keystone | 12:39 | |
| dstanek | good morning keystone | 12:45 |
| *** sheel has quit IRC | 12:47 | |
| breton | o/ | 12:47 |
| rodrigods | dstanek, o/ | 12:48 |
| *** tellesnobrega_af is now known as tellesnobrega | 12:48 | |
| rodrigods | did you see https://github.com/openstack/keystone/tree/master/keystone_tempest_plugin ? | 12:49 |
| samueldmq | dstanek: howdy | 12:49 |
| dstanek | rodrigods: i didn't, but i'll take a look today | 12:50 |
| rodrigods | dstanek, it is just the base, no tests yet... here is the change to add the tests job: https://review.openstack.org/#/c/298696/ | 12:51 |
| patchbot | rodrigods: patch 298696 - openstack-infra/project-config - Enable non-voting keystone tempest plugin tests | 12:51 |
| *** lamt has joined #openstack-keystone | 12:52 | |
| dstanek | rodrigods: nice, looking forward to catching up | 12:54 |
| *** tjcocozz has joined #openstack-keystone | 13:01 | |
| *** diazjf has joined #openstack-keystone | 13:02 | |
| *** diazjf has quit IRC | 13:02 | |
| *** dgonzalez has joined #openstack-keystone | 13:05 | |
| *** roxanaghe has joined #openstack-keystone | 13:08 | |
| *** jdennis1 has joined #openstack-keystone | 13:13 | |
| *** roxanaghe has quit IRC | 13:13 | |
| lbragstad | dstanek o/ | 13:14 |
| *** jaosorior has quit IRC | 13:14 | |
| *** jaosorior has joined #openstack-keystone | 13:14 | |
| *** jdennis has quit IRC | 13:16 | |
| *** jaosorior has quit IRC | 13:17 | |
| *** jaosorior has joined #openstack-keystone | 13:18 | |
| *** ankur has quit IRC | 13:21 | |
| *** links has quit IRC | 13:21 | |
| *** timcline has joined #openstack-keystone | 13:23 | |
| *** jsavak has joined #openstack-keystone | 13:28 | |
| *** timcline has quit IRC | 13:28 | |
| morgan | dstanek: it is in fact morning! | 13:28 |
| *** bizarrodan is now known as dansmith | 13:35 | |
| *** woodster_ has joined #openstack-keystone | 13:36 | |
| dstanek | morgan: i hope a good one | 13:36 |
| amakarov | morgan, hi! Is the idea to introduce driver connectors still alive? | 13:42 |
| *** josecastroleon has quit IRC | 13:59 | |
| *** rk4n_ has joined #openstack-keystone | 14:03 | |
| *** Kalaswan has quit IRC | 14:04 | |
| *** woodburn has joined #openstack-keystone | 14:05 | |
| raildo | stevemar: ping, we created the topic (number 26) about v3 on devstack: https://etherpad.openstack.org/p/newton-cross-project-sessions | 14:05 |
| *** rk4n__ has joined #openstack-keystone | 14:05 | |
| *** rk4n has quit IRC | 14:05 | |
| *** rk4n_ has quit IRC | 14:08 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:09 | |
| *** knikolla has joined #openstack-keystone | 14:09 | |
| *** pushkaru has joined #openstack-keystone | 14:13 | |
| *** doug-fish has joined #openstack-keystone | 14:15 | |
| *** Nirupama has quit IRC | 14:15 | |
| *** pauloewerton has joined #openstack-keystone | 14:21 | |
| *** timcline has joined #openstack-keystone | 14:24 | |
| *** jasonsb has quit IRC | 14:25 | |
| *** jasonsb has joined #openstack-keystone | 14:26 | |
| *** edmondsw has quit IRC | 14:27 | |
| *** spzala has joined #openstack-keystone | 14:28 | |
| *** EinstCrazy has joined #openstack-keystone | 14:28 | |
| *** timcline has quit IRC | 14:29 | |
| *** slberger has joined #openstack-keystone | 14:29 | |
| *** phalmos has joined #openstack-keystone | 14:32 | |
| *** browne has joined #openstack-keystone | 14:48 | |
| *** rderose has joined #openstack-keystone | 14:48 | |
| *** timcline has joined #openstack-keystone | 14:49 | |
| *** timcline has quit IRC | 14:49 | |
| *** david_cu has joined #openstack-keystone | 14:50 | |
| *** timcline has joined #openstack-keystone | 14:50 | |
| *** edmondsw has joined #openstack-keystone | 15:02 | |
| *** diazjf has joined #openstack-keystone | 15:04 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 15:04 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:04 | |
| *** jsavak has quit IRC | 15:04 | |
| *** mhickey has joined #openstack-keystone | 15:05 | |
| *** jsavak has joined #openstack-keystone | 15:08 | |
| *** EinstCrazy has quit IRC | 15:10 | |
| *** pushkaru has quit IRC | 15:16 | |
| stevemar | raildo: ++ | 15:16 |
| stevemar | howdy mister dstanek | 15:16 |
| *** pushkaru has joined #openstack-keystone | 15:16 | |
| rderose | bknudson: just saw your comment re: abstract base class. If you are creating a custom driver, how is this line being used then: | 15:22 |
| rderose | Driver = manager.create_legacy_driver(identity_interface.IdentityDriverV8) | 15:22 |
| bknudson | rderose: that line isn't being used | 15:22 |
| rderose | bknudson: not by us, but isn't there for custom drivers? | 15:23 |
| morgan | amakarov: hmm? | 15:23 |
| morgan | dstanek: it was OK. Was on an airplane and back in California for the day. | 15:23 |
| bknudson | rderose: oops, I was wrong, a custom driver might be using Driver. | 15:23 |
| morgan | stevemar: pushed the py3.5 change for ksa zigo proposed. | 15:24 |
| rderose | bknudson: shouldn't they be using the Driver and not the abstract base class | 15:24 |
| morgan | Prob should be backported | 15:24 |
| bknudson | rderose: Driver is deprecated. They shouldn't be using it | 15:24 |
| bknudson | but they still can | 15:24 |
| bknudson | we can remove it next release. | 15:24 |
| rderose | bknudson: when I discussed with morgan, I thought he mentioned that client would not be using the abstract base class, only the Drivers | 15:25 |
| bknudson | rderose: that's odd. We need to support developers implementing their own drivers using the abstract base class. | 15:26 |
| *** mylu has joined #openstack-keystone | 15:26 | |
| bknudson | they should be able to develop a driver without using the abstract base class (duck typing) | 15:26 |
| morgan | bknudson: I think what you requested on that review was my initial recommendation | 15:27 |
| stevemar | morgan: we can wait til someone hits it, possibly... it is only a fixture | 15:27 |
| *** nkinder has joined #openstack-keystone | 15:27 | |
| rderose | bknudson morgan: okay, so if not moving the Driver line, do we have any issues? | 15:28 |
| morgan | stevemar: well it is relevant for tests passing for Debian etc. Since its 3.5 specific | 15:28 |
| morgan | stevemar: and a minor change. Backport for mitaka. Nothing else. | 15:28 |
| morgan | And just in the next maintenance/release of.mitaka ksa whenever it happens | 15:28 |
| morgan | No release specifically for it. Def not back further. | 15:29 |
| openstackgerrit | Merged openstack/keystoneauth: fix OrderedDict mutated during iteration https://review.openstack.org/301049 | 15:29 |
| morgan | Trying to make zigo's life here easier ;) | 15:29 |
| bknudson | rderose: yes, there needs to be IdentityDriverV8 in identity/core.py | 15:29 |
| *** tellesnobrega is now known as tellesnobrega_af | 15:29 | |
| stevemar | morgan: nod | 15:29 |
| bknudson | for the same reason that there's a Driver in identity/core.py | 15:30 |
| morgan | bknudson: +( | 15:30 |
| morgan | ++ even. | 15:30 |
| rderose | bknudson morgan: to move them out of the core, I'll keep them in both places for now and add a deprecation warning | 15:31 |
| stevemar | morgan: https://review.openstack.org/#/c/301186/ (backport) | 15:31 |
| patchbot | stevemar: patch 301186 - keystoneauth (stable/mitaka) - fix OrderedDict mutated during iteration | 15:31 |
| stevemar | morgan: you should be able to approve now, we won't cut anything from there | 15:31 |
| bknudson | rderose: ok | 15:32 |
| rderose | bknudson morgan: remove in O? | 15:32 |
| morgan | stevemar: will do in a sec. | 15:32 |
| bknudson | rderose: I'm ok with saying it can be removed in O, although I think we usually go with +2 | 15:32 |
| rderose | bknudson: okay, cool | 15:33 |
| rderose | bknudson: thx | 15:33 |
| morgan | rderose bknudson for internal interfaces 1 cycle should be OK. But 2 is safer | 15:33 |
| rderose | cool | 15:33 |
| *** jaugustine has joined #openstack-keystone | 15:34 | |
| *** jsavak has quit IRC | 15:35 | |
| *** jsavak has joined #openstack-keystone | 15:35 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/keystone: Use messaging notifications transport instead of default https://review.openstack.org/301193 | 15:36 |
| *** roxanaghe has joined #openstack-keystone | 15:37 | |
| amakarov | morgan, the idea to make driver interface a special class, that can be used as a proxy transforming python function calls to http requests on the client side, and as a router+controller+whatever on the server side | 15:41 |
| *** jistr has quit IRC | 15:41 | |
| morgan | amakarov: hmm. I don't remember this convo. | 15:41 |
| morgan | That sounds interesting. | 15:41 |
| amakarov | morgan, this way we can allow anybody implement any backend without the need to merge it into the keystone codebase | 15:42 |
| bknudson | drivers don't need to be in the keystone codebase already | 15:43 |
| morgan | bknudson: ++ | 15:43 |
| morgan | amakarov: not sure of the win there. But open to the convo. In Austin? | 15:43 |
| *** nisha has joined #openstack-keystone | 15:43 | |
| amakarov | bknudson, yes, though we still need to restart the keystone to change the driver | 15:43 |
| bknudson | for some reason it seems like anytime someone implements a driver or external auth they always stick it in keystone. I don't get it. | 15:43 |
| dstanek | bknudson: ++ | 15:44 |
| dstanek | bknudson: we didn't when we made capstone | 15:44 |
| bknudson | probably so we get blamed if there's a bug in it | 15:44 |
| morgan | bknudson: probably | 15:44 |
| morgan | dstanek: clearly you're slacking :P | 15:44 |
| bknudson | amakarov: you are correct about having to restart keystone... not sure why restarting a keystone is that big of a deal. | 15:45 |
| dstanek | morgan: :-) | 15:45 |
| bknudson | capstone? | 15:45 |
| dstanek | bknudson: yessir | 15:45 |
| morgan | bknudson: I don't either. But people seem to care a lot about restarts. | 15:45 |
| *** gagehugo has joined #openstack-keystone | 15:46 | |
| amakarov | bknudson, that very argument people tell me why do we need to store policies in keystone rather than in files :) | 15:46 |
| *** jaosorior has quit IRC | 15:46 | |
| morgan | amakarov: I also generally disagree with keystone being authoritative for policy files. | 15:46 |
| dstanek | amakarov: i'm intested to see your proposal. not sure i understand the benefits | 15:46 |
| amakarov | morgan, yes, HA is an issue | 15:46 |
| bknudson | amakarov: keystone reloads policy files on every request so you don't need to restart for that. | 15:46 |
| morgan | amakarov: in db that is. | 15:47 |
| *** jaosorior has joined #openstack-keystone | 15:47 | |
| *** harlowja_at_home has joined #openstack-keystone | 15:47 | |
| morgan | Shoving everything in the db is not nessicarily good design | 15:47 |
| morgan | Using db as IPC leads to bad patterns. | 15:47 |
| *** jaosorior has quit IRC | 15:48 | |
| *** lhcheng has joined #openstack-keystone | 15:48 | |
| *** ChanServ sets mode: +v lhcheng | 15:48 | |
| *** david-lyle_ has quit IRC | 15:48 | |
| *** jaosorior has joined #openstack-keystone | 15:48 | |
| morgan | Unrelated: the Bart going to Oakland airport is nice. No bus needed. | 15:48 |
| *** david-lyle has joined #openstack-keystone | 15:48 | |
| amakarov | morgan, ++ I don't like extreme measures too, but horizon folks seem keen to have it as is simplifies policy management. | 15:49 |
| amakarov | And there is yet another thing in my idea: we don't bother about client-server API match | 15:49 |
| bknudson | horizon needs something better than policy files | 15:49 |
| amakarov | as it's serverd automatically | 15:49 |
| bknudson | policy files are one way to accomplish what they want but I doubt it's the best way | 15:50 |
| amakarov | bknudson, right now they are ok if we let them store json | 15:50 |
| bknudson | wouldn't they rather have an api that returns what the user can do? | 15:50 |
| bknudson | amakarov: what about yaml? | 15:51 |
| * amakarov asks horizon guys | 15:51 | |
| *** josecastroleon has joined #openstack-keystone | 15:51 | |
| amakarov | looks like not only horizon people want that but it will be like moving entire openstack to v3 now :) | 15:53 |
| amakarov | bknudson, I think they'll be ok with yaml too | 15:54 |
| david-lyle | bknudson: a list of what a user can do can be large, and we would have to store/cache it per user | 15:55 |
| david-lyle | service catalog issue x N services | 15:55 |
| amakarov | david-lyle, I think that's tbd | 15:56 |
| david-lyle | that would be my primary concern | 15:56 |
| *** browne has quit IRC | 15:56 | |
| david-lyle | amakarov: what is? | 15:56 |
| david-lyle | I just referring to the option to provide a list of all actions a user is authorized to do | 15:57 |
| amakarov | david-lyle, the concept: either to get all the user rights or just ask for particular ones | 15:57 |
| david-lyle | additionally, target information can effect the result | 15:57 |
| amakarov | or limit them somehow | 15:57 |
| amakarov | or filter :) | 15:57 |
| bknudson | I don't want us to get tied into a specific implementation... we've already got proposals for changing to a different way to do policy | 15:57 |
| *** tellesnobrega_af is now known as tellesnobrega | 16:03 | |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 16:05 |
| *** e0ne has quit IRC | 16:07 | |
| *** mhickey has quit IRC | 16:10 | |
| *** dan_nguyen has joined #openstack-keystone | 16:14 | |
| *** dflorea has joined #openstack-keystone | 16:17 | |
| *** josecastroleon has quit IRC | 16:23 | |
| *** mylu has quit IRC | 16:25 | |
| stevemar | knikolla: navidp -- next keystoneauth release is in 1 week: next keystoneauth release should be in 1 week: https://review.openstack.org/#/c/300965/ | 16:25 |
| patchbot | stevemar: patch 300965 - releases - release keystoneauth 2.5.0 | 16:25 |
| stevemar | maybe earlier if mitaka is finalized ... | 16:25 |
| stevemar | but for now the release time is concentrating on actually releasing mitaka and not libraries for newton :) | 16:26 |
| *** rk4n__ has quit IRC | 16:26 | |
| *** mylu has joined #openstack-keystone | 16:27 | |
| *** josecastroleon has joined #openstack-keystone | 16:29 | |
| knikolla | stevemar, i see. thanks! | 16:31 |
| *** dflorea has quit IRC | 16:38 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone-specs: Assignments in Apache Fortress https://review.openstack.org/254782 | 16:39 |
| *** harlowja_at_home has quit IRC | 16:39 | |
| *** jsavak has quit IRC | 16:40 | |
| *** jsavak has joined #openstack-keystone | 16:41 | |
| nisha | hey all :) | 16:43 |
| *** rcernin has quit IRC | 16:48 | |
| *** dflorea has joined #openstack-keystone | 16:49 | |
| *** dflorea has quit IRC | 16:55 | |
| *** tellesnobrega is now known as tellesnobrega_af | 16:56 | |
| *** mylu has quit IRC | 16:57 | |
| *** josecastroleon has quit IRC | 16:59 | |
| *** mylu has joined #openstack-keystone | 17:01 | |
| *** dflorea has joined #openstack-keystone | 17:02 | |
| *** jasonsb has quit IRC | 17:04 | |
| *** tqtran has joined #openstack-keystone | 17:06 | |
| *** mylu has quit IRC | 17:07 | |
| *** mylu has joined #openstack-keystone | 17:08 | |
| *** mylu has quit IRC | 17:10 | |
| *** josecastroleon has joined #openstack-keystone | 17:15 | |
| *** nisha has quit IRC | 17:18 | |
| *** nisha has joined #openstack-keystone | 17:18 | |
| *** trown is now known as trown|lunch | 17:20 | |
| *** zqfan has quit IRC | 17:22 | |
| *** jdennis1 has quit IRC | 17:23 | |
| ayoung | Its still snowing. I am going out Cross Country Skiing. | 17:24 |
| rderose | nice :) | 17:24 |
| *** sheel has joined #openstack-keystone | 17:25 | |
| ayoung | Hello New England. It is Spring....APRIL FOOLS! | 17:25 |
| roxanaghe | knikolla, any other setup that I need for using the ldap3 driver with your patch https://review.openstack.org/#/c/296090/13? | 17:29 |
| patchbot | roxanaghe: patch 296090 - keystone - WIP - ldap3 Identity Driver | 17:29 |
| roxanaghe | knikolla, I did choose ldap_identity driver in keystone.conf | 17:29 |
| roxanaghe | knikolla, but I'm getting No driver found, so I'm windering if I'm missing anything | 17:30 |
| roxanaghe | *wondering | 17:30 |
| stevemar | ayoung: we got rocked too | 17:32 |
| *** dflorea has quit IRC | 17:34 | |
| *** dflorea has joined #openstack-keystone | 17:39 | |
| *** mylu has joined #openstack-keystone | 17:40 | |
| *** mvk_ has quit IRC | 17:42 | |
| *** josecastroleon has quit IRC | 17:45 | |
| *** rderose has quit IRC | 17:47 | |
| *** rderose has joined #openstack-keystone | 17:49 | |
| *** dave-mccowan has joined #openstack-keystone | 17:50 | |
| ayoung | roxanaghe, No driver found might be due to a v couple things | 18:00 |
| ayoung | roxanaghe, it might be that the entry point is not registered | 18:00 |
| ayoung | roxanaghe, or it might be due to the driver not being able to pull in a dependency | 18:00 |
| roxanaghe | ayoung, so I did register it in setup.cfg | 18:01 |
| ayoung | roxanaghe, try running python from the command line and importing the driver | 18:01 |
| ayoung | if it is a dependency issue, you will get a complaint there | 18:01 |
| *** doug-fish has quit IRC | 18:03 | |
| *** doug-fish has joined #openstack-keystone | 18:03 | |
| *** doug-fish has quit IRC | 18:03 | |
| *** jsavak has quit IRC | 18:04 | |
| *** diazjf has quit IRC | 18:05 | |
| *** jsavak has joined #openstack-keystone | 18:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface and common code out of identity.core https://review.openstack.org/296140 | 18:06 |
| *** e0ne has joined #openstack-keystone | 18:06 | |
| harlowja | ayoung morgan u guys got a sec, a question around project_metadata for some godaddy folks (we/godaddy carry a local patch to retain a project_metadata table) and it appears that said table used to be in keystone, but got removed and godaddy still uses it, and ..., <therefore local patch> | 18:07 |
| harlowja | was wondering if u guys had any recommendations for where to store this kind of data | 18:07 |
| harlowja | example of data stored: | 18:07 |
| harlowja | metadata: { | 18:08 |
| harlowja | owning_group: (i.e. cloud, for on_call) | 18:08 |
| harlowja | envionment_type: (prod, dev) | 18:08 |
| harlowja | budget_code: ?? (for chargebacks) | 18:08 |
| harlowja | } | 18:08 |
| ayoung | harlowja, metadata? | 18:08 |
| harlowja | ya, like things about a project | 18:08 |
| ayoung | you mean the stuff that Nova reads when booting an instance, or the stuff that used to be in the v2 tokens? | 18:08 |
| ayoung | harlowja, that's nova, not Keystone | 18:09 |
| ayoung | budget_code? | 18:09 |
| ayoung | I've never seen that | 18:09 |
| harlowja | this was an example of some metadata :-P | 18:09 |
| harlowja | *from what godaddy is say using it for | 18:10 |
| harlowja | basically data stored on a project | 18:10 |
| *** jsavak has quit IRC | 18:10 | |
| harlowja | is there a recommended place to store such tenant specific info in keystone? | 18:11 |
| *** jsavak has joined #openstack-keystone | 18:11 | |
| harlowja | nova doesn't seem like the right place | 18:11 |
| harlowja | basically at godaddy, that information is stored in a keystone table that is associated to the tenant/project (that information would be different depending on company...) | 18:12 |
| harlowja | does that make sense so far ;) | 18:14 |
| bknudson | why call it metadata and not just data? | 18:14 |
| harlowja | sure, the table in the patch here is called project_metadata | 18:15 |
| harlowja | but ya, just data | 18:15 |
| harlowja | either/or | 18:15 |
| harlowja | lol | 18:15 |
| bknudson | the sql driver allows you to set whatever extra properties you want to on a project. | 18:16 |
| harlowja | nice | 18:16 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/V8_backends/sql.py#n254 | 18:17 |
| harlowja | extra = sql.Column(sql.JsonBlob()) | 18:17 |
| harlowja | nice | 18:17 |
| harlowja | that might just do it | 18:17 |
| bknudson | it's not nice, but deployers want it. | 18:17 |
| harlowja | ya, not nice for some aspects/defintion of nice | 18:17 |
| harlowja | lol | 18:17 |
| *** mdorman has joined #openstack-keystone | 18:17 | |
| harlowja | that is staying (for now?) | 18:18 |
| *** spzala has quit IRC | 18:18 | |
| harlowja | forever... | 18:19 |
| harlowja | lol | 18:19 |
| bknudson | it's not even deprecated | 18:19 |
| *** spzala has joined #openstack-keystone | 18:19 | |
| harlowja | cool, (for some version of cool) | 18:19 |
| harlowja | lol | 18:19 |
| *** daemontool_ has quit IRC | 18:20 | |
| *** wwriverrat has joined #openstack-keystone | 18:21 | |
| *** e0ne has quit IRC | 18:22 | |
| *** trown|lunch is now known as trown | 18:23 | |
| *** spzala has quit IRC | 18:24 | |
| *** klindgren has joined #openstack-keystone | 18:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface out of assignment.core https://review.openstack.org/299635 | 18:25 |
| knikolla | roxanaghe, for now I've always imported it from command line, that's why there's a lot of stuff in __init__ | 18:27 |
| *** timcline has quit IRC | 18:27 | |
| *** timcline has joined #openstack-keystone | 18:28 | |
| knikolla | stuff which will eventually be coming from CONF instead of being hardcoded | 18:28 |
| *** timcline has quit IRC | 18:33 | |
| *** Ephur has joined #openstack-keystone | 18:34 | |
| *** mylu has quit IRC | 18:40 | |
| roxanaghe | ayoung, knikolla it worked after I added the new driver entrypoint in my keystone's egg-info entry_points.txt | 18:42 |
| roxanaghe | I was using an already setup devstack.. | 18:43 |
| *** mylu has joined #openstack-keystone | 18:43 | |
| *** e0ne has joined #openstack-keystone | 18:43 | |
| *** henrynash has joined #openstack-keystone | 18:45 | |
| *** ChanServ sets mode: +v henrynash | 18:45 | |
| ayoung | roxanaghe, cool, glad it was a simple solution. How are things looking? | 18:45 |
| *** henrynash has quit IRC | 18:45 | |
| *** mylu has quit IRC | 18:46 | |
| *** spzala has joined #openstack-keystone | 18:50 | |
| *** timcline has joined #openstack-keystone | 18:51 | |
| roxanaghe | ayoung, I'm still having doubts which level of mocking do we want, something that just mocks very specific ldap responses, or something more generic that can be used in the already existing tests. | 18:52 |
| *** dflorea has quit IRC | 18:52 | |
| roxanaghe | ayoung, so I'm just gonna start with something and see where it goes | 18:52 |
| *** mylu has joined #openstack-keystone | 18:52 | |
| *** timcline_ has joined #openstack-keystone | 18:52 | |
| ayoung | roxanaghe, yes, better to try *something* than suffer analysis paralysis | 18:52 |
| *** timcline_ has quit IRC | 18:52 | |
| *** henrynash has joined #openstack-keystone | 18:53 | |
| *** ChanServ sets mode: +v henrynash | 18:53 | |
| *** timcline has quit IRC | 18:53 | |
| *** mylu has quit IRC | 18:53 | |
| *** timcline has joined #openstack-keystone | 18:53 | |
| *** mylu has joined #openstack-keystone | 18:53 | |
| *** henrynash has quit IRC | 18:54 | |
| *** mylu has quit IRC | 18:55 | |
| bknudson | roxanaghe: I think you should test the new driver with https://review.openstack.org/#/c/291950/ . expand on those where needed. | 18:55 |
| patchbot | bknudson: patch 291950 - keystone - Define identity interface - easy cases | 18:55 |
| roxanaghe | ayoung, I'm learning that rapidly :) | 18:55 |
| *** dflorea has joined #openstack-keystone | 18:55 | |
| roxanaghe | bknudson, yeah, that's what I was thinking | 18:55 |
| roxanaghe | bknudson, but do we want to have these tests: https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_backend_ldap.py running for the new driver as well? | 18:56 |
| bknudson | roxanaghe: yes, that was the intention | 18:56 |
| bknudson | roxanaghe: oh, you were asking about different tests | 18:56 |
| bknudson | my opinion is no | 18:56 |
| bknudson | but others might have their own opinions. | 18:57 |
| bknudson | I'm against these level-crossing tests | 18:57 |
| bknudson | the tests take way too long to run because we run a bunch of tests 6 times. | 18:57 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 18:58 | |
| *** pushkaru has quit IRC | 18:58 | |
| bknudson | so if we're going to multiply that by another driver now they'll be running 8 times, I guess. | 18:58 |
| bknudson | oops, 9 times. | 18:58 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:58 | |
| bknudson | you'll have to put a skip on probably 75% of them like they are already anyways | 18:59 |
| roxanaghe | bknudson, level-crossing means tests that involve other drivers as well, right? | 18:59 |
| *** diazjf has joined #openstack-keystone | 19:00 | |
| bknudson | roxanaghe: well, they do involve multiple drivers in our tests, but level-crossing means that they test multiple components in the stack (in this case manager and driver) | 19:00 |
| *** pushkaru has joined #openstack-keystone | 19:00 | |
| roxanaghe | bknudson, I see | 19:00 |
| bknudson | we wind up having a bunch of tests that verify manager behavior, and tests that test verify driver behavior, and we don't know which is which. | 19:01 |
| *** rderose has quit IRC | 19:03 | |
| roxanaghe | bknudson, I agree - it's very hard to follow those tests in test_backend_ldap, so I agree with the approach you started by testing each driver independently | 19:03 |
| *** mylu has joined #openstack-keystone | 19:03 | |
| roxanaghe | bknudson, so I'm gonna start use your patch and be able to run your tests for the new ldap driver and go from there | 19:06 |
| roxanaghe | bknudson, thanks for the clarifications | 19:06 |
| *** agrebennikov has joined #openstack-keystone | 19:06 | |
| bknudson | roxanaghe: great, thanks. There will be changes required to the tests, you'll probably have to override create_user to do ldap ops to create the user in the live case... | 19:06 |
| bknudson | for the fake case will probably set up a mock or something? | 19:07 |
| bknudson | roxanaghe: live tests are in a follow-on https://review.openstack.org/#/c/300237/ | 19:07 |
| patchbot | bknudson: patch 300237 - keystone - Opportunistic LDAP testing | 19:07 |
| nisha | hey, I need to upgrade my tox version from 2.1.1 to atleast 2.3.1 | 19:08 |
| nisha | I tried doing sudo apt-get update and upgrade | 19:09 |
| nisha | and ran tox command too | 19:09 |
| *** gagehugo has quit IRC | 19:10 | |
| nisha | But I am unable to upgrade the tox version. I need it for running ./stack.sh as I am installing devstack | 19:10 |
| nisha | Can anyone please help me ? | 19:10 |
| roxanaghe | bknudson, right, we'll use mocking for the fake case | 19:11 |
| *** dflorea has quit IRC | 19:11 | |
| roxanaghe | bknudson, when are the live tests running, and against which ldap server? | 19:11 |
| *** jaugustine has quit IRC | 19:11 | |
| bknudson | roxanaghe: they're not running in the gate. Someone needs to work on that (probably me) | 19:11 |
| *** sdake_ has joined #openstack-keystone | 19:12 | |
| bknudson | to make it easier I made it run on my devstack install locally | 19:12 |
| roxanaghe | bknudson, ok - so it's for when we'll have a gate using an ldap server installed | 19:12 |
| bknudson | y, in the py27 and py34 job | 19:13 |
| bknudson | we could have a ldap tempest gate any time. | 19:13 |
| bknudson | not sure why we don't have one already | 19:14 |
| *** sdake has quit IRC | 19:15 | |
| roxanaghe | bknudson, agreed - I'd like to help fix that at one point | 19:15 |
| ayoung | roxanaghe, ++++ | 19:16 |
| *** dflorea has joined #openstack-keystone | 19:16 | |
| bknudson | roxanaghe: that would be great. | 19:16 |
| bknudson | for the new ldap driver we'll have to figure out how to change devstack to go directly to ldap to create users | 19:17 |
| roxanaghe | bknudson, ahh yeah good point, since it's read-only now | 19:19 |
| bknudson | shouldn't be hard if creating users is in a function, but you never know | 19:19 |
| *** mdorman has left #openstack-keystone | 19:19 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:21 | |
| *** dflorea has quit IRC | 19:22 | |
| *** rk4n has joined #openstack-keystone | 19:22 | |
| *** dflorea has joined #openstack-keystone | 19:25 | |
| *** sheel has quit IRC | 19:27 | |
| *** arunkant has quit IRC | 19:28 | |
| *** mylu has quit IRC | 19:28 | |
| *** jdennis has joined #openstack-keystone | 19:29 | |
| *** rk4n has quit IRC | 19:29 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface and common code out of identity.core https://review.openstack.org/296140 | 19:30 |
| *** mylu has joined #openstack-keystone | 19:34 | |
| *** dflorea has quit IRC | 19:37 | |
| *** dflorea has joined #openstack-keystone | 19:39 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend interface out of assignment.core https://review.openstack.org/299635 | 19:42 |
| *** dflorea has quit IRC | 19:44 | |
| *** mylu has quit IRC | 19:44 | |
| *** rderose has joined #openstack-keystone | 19:46 | |
| *** mylu has joined #openstack-keystone | 19:48 | |
| *** arunkant has joined #openstack-keystone | 19:49 | |
| *** mylu has quit IRC | 19:49 | |
| *** tellesnobrega_af is now known as tellesnobrega | 19:54 | |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: WIP Allow Python 3 testing for `test_fernet_provider` https://review.openstack.org/297768 | 19:55 |
| *** jaosorior has quit IRC | 19:57 | |
| *** jsavak has quit IRC | 19:57 | |
| *** mylu has joined #openstack-keystone | 19:59 | |
| *** tqtran is now known as tqtran-afk | 20:00 | |
| *** nisha_ has joined #openstack-keystone | 20:00 | |
| *** rk4n has joined #openstack-keystone | 20:03 | |
| *** nisha has quit IRC | 20:04 | |
| *** nisha__ has joined #openstack-keystone | 20:05 | |
| *** nisha_ has quit IRC | 20:07 | |
| *** jsavak has joined #openstack-keystone | 20:10 | |
| *** e0ne has quit IRC | 20:11 | |
| *** nisha__ is now known as nisha | 20:13 | |
| *** sdake_ is now known as sdake | 20:14 | |
| *** nisha has quit IRC | 20:16 | |
| zigo | morgan: Thanks! :) | 20:16 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 20:17 | |
| *** maxabidi has joined #openstack-keystone | 20:17 | |
| zigo | morgan: FYI, the fix idea was lamely copied from Corey Bryant from one of his patch in keystoneclient ... ;P | 20:18 |
| samueldmq | ayoung: hi, re: patch 279263 | 20:18 |
| patchbot | samueldmq: https://review.openstack.org/#/c/279263/ - keystone - Extract enforcement logic to its own method | 20:18 |
| samueldmq | ayoung: do you still think it's worth it to extract that from common/controller? | 20:18 |
| zigo | I hope we soon have a Py35 gate. | 20:18 |
| *** rk4n has quit IRC | 20:19 | |
| *** rderose has quit IRC | 20:20 | |
| *** rk4n has joined #openstack-keystone | 20:23 | |
| ayoung | samueldmq, always have | 20:25 |
| samueldmq | ayoung: tricky part is that it needs self (controller) | 20:26 |
| *** edmondsw has quit IRC | 20:26 | |
| samueldmq | ayoung: so a bit hard to decloupe (maybe it needs a bigger refactorin) | 20:26 |
| ayoung | samueldmq, what does it need out of self... | 20:27 |
| *** maxabidi has quit IRC | 20:28 | |
| samueldmq | ayoung: callback, for exampel | 20:28 |
| ayoung | samueldmq, so there is token_data=self.token_provider_api.validate_token( | 20:28 |
| ayoung | context['token_id'])) | 20:28 |
| ayoung | yeah, callback needs to be there, but that is the odd one | 20:29 |
| ayoung | samueldmq, ok the tricky one is if (hasattr(self, 'get_member_from_driver') and | 20:30 |
| ayoung | self.get_member_from_driver is not None): | 20:30 |
| ayoung | that is where it needs to fetch something from the database first | 20:30 |
| samueldmq | ayoung: yeah, very hard .. maybe it should be extracted somewhere else | 20:30 |
| samueldmq | ayoung: like when you call enforce, you pass everything needed in | 20:31 |
| samueldmq | ayoung: and enforce only des the enforcement logic itself | 20:31 |
| ayoung | samueldmq, want me to give it another hack, or are you on it? | 20:32 |
| samueldmq | ayoung: go for it | 20:32 |
| *** notmyname has joined #openstack-keystone | 20:32 | |
| ayoung | OK.... | 20:33 |
| notmyname | the admin pipeline is supposed to not be on a public interface, right? what happens if it is? | 20:33 |
| breton | notmyname: for v2 or v3? | 20:34 |
| notmyname | either, really | 20:34 |
| breton | notmyname: for v3 there is no difference at all | 20:34 |
| *** sdake_ has joined #openstack-keystone | 20:34 | |
| *** sdake has quit IRC | 20:34 | |
| notmyname | ok | 20:34 |
| breton | notmyname: for v2... the result of some list operations might be different as far as i remember | 20:35 |
| breton | list of tenants iirc | 20:35 |
| notmyname | I mean, is it a bad idea as a general practice to have the admin pipeline listening on a publicly routable IP? | 20:36 |
| *** tqtran-afk is now known as tqtran | 20:36 | |
| ayoung | samueldmq, off the top of your head, you know which unit tests I can run to test that? | 20:37 |
| samueldmq | ayoung: test_v3_protection I think | 20:37 |
| ayoung | samueldmq, looks like test_V3_auth is enough to show my typos | 20:38 |
| agrebennikov | hi folks, is there anybody who successfully implemented CLI clients working with federated keystone? | 20:40 |
| notmyname | another question... | 20:41 |
| notmyname | is the s3 endpoint and the s3_token middleware still maintained going forward? | 20:42 |
| *** mylu has quit IRC | 20:43 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:44 |
| *** mylu has joined #openstack-keystone | 20:44 | |
| *** dflorea has joined #openstack-keystone | 20:45 | |
| ayoung | agrebennikov, yep | 20:48 |
| ayoung | notmyname, you want it to be? I can assigne the bugs to you. :) | 20:48 |
| agrebennikov | ayoung, is there any publicly available guide for it? I mean the part of obtaining the saml token from the external idp, if it is actually possible | 20:49 |
| ayoung | agrebennikov, ECP support is tricky but people got it to work. | 20:49 |
| *** dflorea has quit IRC | 20:49 | |
| ayoung | I think you need a special auth plugin. | 20:50 |
| ayoung | agrebennikov, you asked me about 24 hours too early | 20:50 |
| ayoung | I have to look in to that tonight anyway | 20:50 |
| rodrigods | ayoung, we have all kinds of plugins alreayd | 20:50 |
| rodrigods | not sure if we have support in openstackclient | 20:50 |
| ayoung | rodrigods, yeah, and ECP doesn't need anything too wacky...I just forget. jamielennox|away knows that stuff off the top of his head. Let me see if I documented in rippowam when we tried it | 20:51 |
| rodrigods | i *think* we have ECP support there | 20:51 |
| rodrigods | in OSC, i mean | 20:51 |
| rodrigods | not K2K, though (because it is a plugin inside another plugin) | 20:52 |
| ayoung | agrebennikov, try an rc file like this | 20:52 |
| ayoung | http://paste.openstack.org/show/492928/ | 20:52 |
| ayoung | rodrigods, yeah, post deploy it ends up in ~/.ossipee/deployments/ayoung.oslab/fed-accrc for example | 20:52 |
| rodrigods | nic | 20:52 |
| rodrigods | nice | 20:52 |
| ayoung | rodrigods, I was supposed to try and get Keycloak working that way, but have not started on it yet....task for tonight | 20:53 |
| notmyname | ayoung: since I hear lots of requests for "s3 support", and since ostensibly there's some openstack deployments that use keystone (;-)), then yeah. I was wondering if it was an out-of-site/mind thing in keystone, or if it was goingt o be actively deprecated, or actively improved | 20:53 |
| *** dflorea has joined #openstack-keystone | 20:53 | |
| rodrigods | ayoung, ++ | 20:54 |
| ayoung | notmyname, its still supported and required. I had some question about whether we ever made ec2 work with V3 Keystone API | 20:54 |
| ayoung | and it does not look like it | 20:54 |
| agrebennikov | ayoung, who in this case plays the role of idp? | 20:54 |
| agrebennikov | I mean is it another keystoner? | 20:54 |
| ayoung | s3 I have not looked at yesterday | 20:54 |
| stevemar | knikolla: poke | 20:54 |
| ayoung | agrebennikov, so our Proof of concept was using FreeIPA and Ipsilon | 20:54 |
| timburke | ayoung: i'll go with "no" for s3: https://github.com/openstack/keystonemiddleware/blob/4.4.0/keystonemiddleware/s3_token.py#L152 | 20:54 |
| agrebennikov | ayoung, kind of an external software, right? | 20:55 |
| *** slberger has quit IRC | 20:55 | |
| stevemar | knikolla: you going to the summit? | 20:55 |
| notmyname | ayoung: yeah, it seems to be hard-coded to v2 endpoints | 20:55 |
| ayoung | timburke, there you go jumping to conclusions again.... | 20:55 |
| ayoung | stevemar, bknudson is there any reason why s3 and ec2 does not need to work with V3 in middleware? | 20:56 |
| ayoung | agrebennikov, yeah, a non-shibboleth SAML implementation | 20:56 |
| stevemar | ayoung: probably cause no one has done it yet, no real reason i assume? | 20:56 |
| stevemar | ayoung: the ec2 and s3 middleware is not exactly well maintained :( | 20:57 |
| ayoung | stevemar, so these guys shoud open bugs on that if they care? | 20:57 |
| ayoung | stevemar, yep | 20:57 |
| agrebennikov | ayoung, what does it mean "non shibboleth"? from what I understand shibboleth is sitting on the side of SP | 20:57 |
| ayoung | agrebennikov, shib is 2 things | 20:57 |
| knikolla | stevemar, yeah | 20:57 |
| agrebennikov | together with keystone | 20:57 |
| ayoung | 1 it is a remote server kicking out SAML | 20:57 |
| ayoung | 2 it is module that runs in apache that understands saml | 20:57 |
| knikolla | let me catch up on the convo | 20:57 |
| *** mvk_ has joined #openstack-keystone | 20:57 | |
| ayoung | at Red Hat we don't like SHib | 20:58 |
| ayoung | We like pizza | 20:58 |
| ayoung | and we like mod_mellon | 20:58 |
| agrebennikov | ayoung, ah, yeah, I see | 20:58 |
| ayoung | and we like welll | 20:58 |
| *** dflorea has quit IRC | 20:58 | |
| ayoung | we were liking Ipsilon, which was a nice, lite, python base SAML provider | 20:58 |
| ayoung | but...well, it looks like we are being told that we need to like Keycloak these days. | 20:58 |
| ayoung | And, to be fair, Keycloak is a much more full featured APp | 20:59 |
| ayoung | but it means that my Proof of concept from last summer on Ipsilon is not going to be what we use | 20:59 |
| ayoung | which does not make me that happy | 20:59 |
| agrebennikov | ayoung, but still, those additional parameters like OS_AUTH_TYPE=v3unscopedsaml and OS_IDENTITY_PRO* | 20:59 |
| ayoung | aH | 20:59 |
| agrebennikov | ayoung, are they all who do the magic? | 20:59 |
| ayoung | ok so the OS_AUTH_TYPE=v3unscopedsaml is the auth plugin | 21:00 |
| ayoung | that tells the client to use the saml plugin for initial authentication | 21:00 |
| ayoung | and the other one tells the client to use V3 version of the Keystone APIK | 21:00 |
| ayoung | API | 21:00 |
| ayoung | so you want both of those values for SAML Federation anyway | 21:00 |
| agrebennikov | ayoung, and what it is supposed to be with shib? | 21:00 |
| ayoung | same things | 21:01 |
| agrebennikov | is it what I create in keystone catalog? | 21:01 |
| *** jsavak has quit IRC | 21:01 | |
| stevemar | knikolla: no other questions from me, just wanted to make sure you were at the summit - wanted to show folks your OSC work (with sp-url) | 21:01 |
| *** jsavak has joined #openstack-keystone | 21:01 | |
| *** dflorea has joined #openstack-keystone | 21:02 | |
| knikolla | stevemar, yeah i'll be there. sp-id* | 21:02 |
| agrebennikov | ayoung, and then, in case I specify all those spells as well as os_username and os_password your idp just gives you the token? | 21:02 |
| ayoung | agrebennikov, yep. Assuming your IDP is set up for ECP. | 21:03 |
| *** vgridnev has joined #openstack-keystone | 21:03 | |
| ayoung | agrebennikov, I was not involved in any of the Shibboleth work, so I can't speak to those docs | 21:03 |
| *** slberger has joined #openstack-keystone | 21:03 | |
| *** raildo is now known as raildo-afk | 21:03 | |
| knikolla | agrebennikov, i have an ansible playbook for setting up k2k, if interested. | 21:03 |
| *** rk4n has quit IRC | 21:04 | |
| agrebennikov | knikolla, ah, thanks a lot, but on the one hand I'm not familiar with ansible at all, as well as my goal at this point is okta acting as idp | 21:04 |
| agrebennikov | so I'm mostly interested in SP side part | 21:05 |
| agrebennikov | as well as the clients | 21:05 |
| agrebennikov | but in addition, how you guys deal with groups mapping? | 21:05 |
| knikolla | agrebennikov, i see. well in that case it won't help, as it just sets up apache/mod_shib on the sp side. | 21:05 |
| knikolla | and normal keystone as idp | 21:05 |
| agrebennikov | do I really need to always create local groups on the SP keystone side? | 21:05 |
| agrebennikov | since otherwise no way to create proper assignments | 21:06 |
| knikolla | hmm... now that we have shadow users, what has changed? | 21:06 |
| *** rk4n has joined #openstack-keystone | 21:06 | |
| *** daemontool has joined #openstack-keystone | 21:13 | |
| *** sdake_ has quit IRC | 21:14 | |
| *** dflorea has quit IRC | 21:16 | |
| *** trown is now known as trown|outtypewww | 21:16 | |
| *** dflorea has joined #openstack-keystone | 21:19 | |
| *** pauloewerton has quit IRC | 21:20 | |
| *** jdennis has quit IRC | 21:21 | |
| *** dflorea has quit IRC | 21:23 | |
| *** pushkaru has quit IRC | 21:24 | |
| agrebennikov | knikolla, I don't think this is ideal way to go | 21:24 |
| agrebennikov | I just wanted to hear from you guys knikolla and ayoung how you deal with it | 21:24 |
| *** jdennis has joined #openstack-keystone | 21:25 | |
| *** rderose has joined #openstack-keystone | 21:29 | |
| ayoung | agrebennikov, I agree it is a PITA. I lost that battle. | 21:30 |
| agrebennikov | ayoung, PITA?)) | 21:31 |
| agrebennikov | what is that | 21:31 |
| ayoung | Pain in the Gluteaus Maximus | 21:31 |
| rodrigods | lol | 21:32 |
| stevemar | bknudson: around still? | 21:32 |
| agrebennikov | ayoung, lol)) gotcha..... | 21:32 |
| bknudson | stevemar: I'm around. setting up a new pc | 21:32 |
| bknudson | ubuntu | 21:32 |
| stevemar | bknudson: get another tp? | 21:33 |
| agrebennikov | ayoung, but still, if you guys has the semi-prod deployment | 21:33 |
| bknudson | stevemar: yes | 21:33 |
| stevemar | had questions about https://review.openstack.org/#/c/291817/11 | 21:33 |
| patchbot | stevemar: patch 291817 - openstack-dev/devstack - Deploy keystone running in uwsgi proxy by apache | 21:33 |
| bknudson | stevemar: what's the q? | 21:33 |
| agrebennikov | it should work somehow, not just "I make it working im my VM as a PoC" | 21:33 |
| stevemar | bknudson: y remove the 'setup_colorized_logging' bits? | 21:33 |
| bknudson | stevemar: I haven't figured out how to do colorized logging with uwsgi + apache | 21:34 |
| bknudson | we never had colorized logging with mod_wsgi | 21:34 |
| bknudson | only eventlet did it | 21:34 |
| bknudson | and the uwsgi process had it | 21:34 |
| stevemar | okay, so leftover from the eventlet patch | 21:34 |
| bknudson | but now we've got logging config for both apache and uwsgi... | 21:34 |
| bknudson | there'll still be some work to figure out what we want from logging in this brave new world | 21:35 |
| bknudson | apache is good at access logging, so we do that | 21:36 |
| bknudson | then we've got logging for the uwsgi processes | 21:36 |
| bknudson | which is the keystone debug log | 21:36 |
| stevemar | bknudson: so now the only 2 options for keystone_deploy are mod_wsgi and uwsgi? | 21:36 |
| bknudson | then there's other logging for apache, like whether it started or not | 21:36 |
| *** vgridnev has quit IRC | 21:36 | |
| bknudson | stevemar: right, there's only 2 deploys, mod_wsgi and uwsgi (proxy) | 21:36 |
| bknudson | At first I was going to have a new deploy option for wsgi proxy but this is taking long enough as it is. | 21:37 |
| stevemar | bknudson: right, that is what i was confused about | 21:37 |
| *** jsavak has quit IRC | 21:37 | |
| stevemar | bknudson: we are going to hijack the straight uwsgi deploy with uwsgi proxy? | 21:37 |
| bknudson | y, I don't think there's any advantage to the wsgi deploy | 21:38 |
| stevemar | agreed | 21:38 |
| *** richm has joined #openstack-keystone | 21:38 | |
| stevemar | okay cool | 21:38 |
| bknudson | I was just going to get rid of it if the proxy deploy worked | 21:38 |
| stevemar | yeah, uwsgi itself is pointless | 21:38 |
| *** jsavak has joined #openstack-keystone | 21:38 | |
| stevemar | so now we have apache or apache with mod_proxy and uwsgi | 21:39 |
| *** alex_xu has quit IRC | 21:39 | |
| stevemar | we should make the latter the default | 21:39 |
| bknudson | I agree the default gate should be uwsgi_proxy and our non-voting job should be mod_proxy | 21:39 |
| bknudson | oops, the non-voting job should be mod_wsgi | 21:40 |
| bknudson | not sure how to get there... | 21:40 |
| *** dflorea has joined #openstack-keystone | 21:41 | |
| stevemar | we can figure out the details later i guess | 21:41 |
| stevemar | may have to make our jobs non-voting or something for a hot minute | 21:42 |
| bknudson | probably add the non-voting job to keystone and then make the default switch in devstack | 21:42 |
| bknudson | then we can remove our uwsgi non-voting job | 21:42 |
| stevemar | aye | 21:44 |
| *** Raildo has joined #openstack-keystone | 21:44 | |
| *** daemontool has quit IRC | 21:45 | |
| bknudson | rain delay :( | 21:46 |
| *** alex_xu has joined #openstack-keystone | 21:47 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Introduce an identity_admin role to policy.json https://review.openstack.org/274143 | 21:48 |
| stevemar | bknudson: womp womp :( | 21:48 |
| stevemar | bknudson: play in a dome! | 21:49 |
| stevemar | no home opener until 11th | 21:49 |
| bknudson | maybe the weather will be better by then | 21:49 |
| bknudson | twins are in baltimore you'd think they'd be safe | 21:50 |
| stevemar | The Twins have lost seven straight season openers dating back to 2009 — the only MLB team to lose all seven openers during that stretch. | 21:50 |
| bknudson | you are like an encyclopedia | 21:50 |
| stevemar | or an espn artile | 21:51 |
| stevemar | article* | 21:52 |
| *** Raildo_ has joined #openstack-keystone | 21:53 | |
| *** sdake has joined #openstack-keystone | 21:54 | |
| *** Raildo has quit IRC | 21:57 | |
| *** Raildo_ is now known as raildo | 21:58 | |
| *** david_cu has quit IRC | 21:59 | |
| *** pushkaru has joined #openstack-keystone | 21:59 | |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: [do not merge] Testing Rally & Keysotne https://review.openstack.org/301367 | 21:59 |
| *** lamt has quit IRC | 22:00 | |
| *** david-lyle_ has joined #openstack-keystone | 22:02 | |
| *** david-lyle has quit IRC | 22:03 | |
| *** david-lyle_ is now known as david-lyle | 22:03 | |
| *** pumarani__ has joined #openstack-keystone | 22:04 | |
| *** jsavak has quit IRC | 22:04 | |
| *** pushkaru has quit IRC | 22:07 | |
| *** rderose has quit IRC | 22:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Remove comment from D202 rule https://review.openstack.org/301370 | 22:08 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:20 | |
| kfox1111 | know why neutron might be updating /var/lib/neutron/keystone-signing/revoked.pem multiple times a second? | 22:20 |
| *** diazjf has quit IRC | 22:22 | |
| *** gordc has quit IRC | 22:29 | |
| *** knikolla has quit IRC | 22:30 | |
| *** timcline has quit IRC | 22:30 | |
| agrebennikov | ayoung, let me try to bug you once again - so I assume you guys should have federated keystone working in production, and you probably already resolved the groups. Could you help me to understand it? | 22:33 |
| agrebennikov | ayoung, I don't believe you are creating local groups every single time when you are creating new tenant | 22:33 |
| *** sdake has quit IRC | 22:36 | |
| *** markvoelker has quit IRC | 22:37 | |
| *** rk4n has quit IRC | 22:37 | |
| *** zqfan has joined #openstack-keystone | 22:38 | |
| *** spandhe has joined #openstack-keystone | 22:39 | |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: [do not merge] Testing Rally & Keysotne https://review.openstack.org/301367 | 22:39 |
| *** pumarani__ has quit IRC | 22:40 | |
| *** david-lyle has quit IRC | 22:44 | |
| *** david-lyle has joined #openstack-keystone | 22:47 | |
| *** henrynash has joined #openstack-keystone | 22:50 | |
| *** ChanServ sets mode: +v henrynash | 22:50 | |
| *** dflorea has quit IRC | 22:51 | |
| *** slberger has left #openstack-keystone | 22:51 | |
| *** mylu has quit IRC | 22:58 | |
| *** alex_xu has quit IRC | 23:09 | |
| *** alex_xu has joined #openstack-keystone | 23:11 | |
| *** pushkaru has joined #openstack-keystone | 23:14 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/300626 | 23:17 |
| *** chlong has joined #openstack-keystone | 23:18 | |
| openstackgerrit | Boris Pavlovic proposed openstack/keystone: [do not merge] Testing Rally & Keysotne https://review.openstack.org/301367 | 23:19 |
| *** mylu has joined #openstack-keystone | 23:19 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Migrate tempest tests into keystone tree https://review.openstack.org/301398 | 23:27 |
| *** mylu has quit IRC | 23:31 | |
| *** mylu has joined #openstack-keystone | 23:31 | |
| *** markvoelker has joined #openstack-keystone | 23:37 | |
| ayoung | agrebennikov, sorry, was in family mode. | 23:43 |
| agrebennikov | ayoung, that's no problem)) | 23:44 |
| ayoung | I can't say that I am running Federation in production | 23:44 |
| ayoung | I'm in an engineering shop | 23:44 |
| agrebennikov | ayoung, selling something? ;) | 23:44 |
| ayoung | we've had limited call for Federation. I'm doing some work with it now | 23:44 |
| ayoung | agrebennikov, I work For Red Hat, so, yeah, we sell a distribution, but most of our customers are using LDAP | 23:45 |
| *** mylu has quit IRC | 23:45 | |
| agrebennikov | ayoung, are you aware about Any production deployment of federated keystone (except cern)? | 23:45 |
| agrebennikov | *of | 23:45 |
| morgan | stevemar: back port for py3.5 pushed | 23:45 |
| ayoung | agrebennikov, I'm sure that it is in production. | 23:45 |
| *** mylu has joined #openstack-keystone | 23:45 | |
| * morgan is now on bart to the south bay... | 23:45 | |
| agrebennikov | ayoung, even in CERN?? seriously? | 23:46 |
| ayoung | morgan, um, BART goes to the southbay now? | 23:46 |
| agrebennikov | and unfortunately marek doesn't want to tell me more about it ;( | 23:46 |
| ayoung | agrebennikov, I am sure that it is in production, yes, even at CERN | 23:46 |
| ayoung | heh | 23:47 |
| ayoung | agrebennikov, so the create a group thing is annoying | 23:47 |
| ayoung | I wanted it that it was passed through from the front end only | 23:47 |
| *** mylu has quit IRC | 23:47 | |
| ayoung | I'm not certain what other people are doing to make it scale. | 23:47 |
| agrebennikov | ayoung, I was thinking about the entire assignment story in case of federation | 23:47 |
| ayoung | I think CERN does some part of auto-provisioning. But that would require some other listener | 23:48 |
| agrebennikov | and seems all stuff works only "per-user" | 23:48 |
| morgan | OK no it doesn't. But with traffic this to Fremont then uber is faster than Oakland to SFO to caltrain | 23:48 |
| ayoung | agrebennikov, even there it is some short comings | 23:48 |
| agrebennikov | ayoung, since usually all manuals are saying "go create one local group and assign it to 1 tenant. voilla" | 23:48 |
| ayoung | as you don;t actually have a user ID in the system before the federated user visits | 23:48 |
| ayoung | agrebennikov, so, how would you like it to work? | 23:49 |
| *** mylu has joined #openstack-keystone | 23:49 | |
| agrebennikov | ayoung, I'd like to somehow be able to utilize remote groups (of course) | 23:49 |
| agrebennikov | like I'm doing it with straight ldap | 23:49 |
| agrebennikov | I don't need to assign each user, when I can assign remote group to the tenant | 23:50 |
| agrebennikov | wanted to have something similar here | 23:50 |
| agrebennikov | ayoung, but since they don't exist..... don't know | 23:50 |
| ayoung | agrebennikov, could you do a one time sync, or do you really need groups created on the fly? | 23:50 |
| agrebennikov | ayoung, I have at least 3 customers at this moment who really want all federation to be implemented | 23:51 |
| agrebennikov | ayoung, well | 23:51 |
| agrebennikov | how I see it - every time you create a tenant you will need a new group | 23:51 |
| *** pushkaru has quit IRC | 23:51 | |
| agrebennikov | since how otherwise you'll restrict anybody? | 23:51 |
| ayoung | agrebennikov, do you want the groups from Federation, or new groups managed by Keystone? | 23:52 |
| morgan | ayoung: the groups are managed by keystone anyway. Iirc. | 23:52 |
| ayoung | morgan, "new" groups managed by Keystone | 23:52 |
| morgan | Since you need to assign roles to the groups pre shadow users. | 23:53 |
| morgan | Or map to an existing user. | 23:53 |
| agrebennikov | ayoung, ideally, if I made cli working, I could do auto-sync of the remote groups (just get the list), and then create same ones locally | 23:53 |
| morgan | agrebennikov I think is right, we need a group per permission set for the tenant/project. | 23:53 |
| agrebennikov | ayoung, struggling with cli right now)) | 23:54 |
| agrebennikov | morgan, this reminds me the paradox of the egg and hen a little bit)) | 23:54 |
| agrebennikov | I mean - the groups are remote.... I want to get them somehow, but for doing that I have to first create them locally | 23:55 |
| *** mylu has quit IRC | 23:55 | |
| agrebennikov | ayoung, so per cli problem: export OS_IDENTITY_PROVIDER_URL=https://ipa.ayoung.oslab.test/idp/saml2/SSO/SOAP | 23:56 |
| agrebennikov | this is the pure link to the remote idp, right | 23:56 |
| agrebennikov | ? | 23:56 |
| ayoung | That? No | 23:56 |
| agrebennikov | em | 23:56 |
| ayoung | ah | 23:56 |
| ayoung | sorry, misread it | 23:56 |
| agrebennikov | export OS_AUTH_URL=https://openstack.ayoung.oslab.test:5000/v3 | 23:57 |
| agrebennikov | this is your keystone | 23:57 |
| ayoung | agrebennikov, so yea, that is for ECP | 23:57 |
| ayoung | and the link is the remote URL. I think that with ECP you need to pre-auth somehow | 23:57 |
| agrebennikov | but why do you need to specify that ^^ if ideally it should be worked out by keystone's apache | 23:57 |
| ayoung | agrebennikov, what is the Federated provider you need to talk to? It might not support ECP | 23:57 |
| *** mylu has joined #openstack-keystone | 23:58 | |
| agrebennikov | ayoung, they are - pingfederate and okta | 23:58 |
| agrebennikov | just checked ping | 23:58 |
| ayoung | agrebennikov, damned if I know. I keep talking hoping that someone that actually knows this jumps in an rescues me | 23:58 |
| ayoung | hint stevemar hint | 23:58 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!