| stevemar | morgan: keystonemiddleware stable is broken | 00:01 |
|---|---|---|
| stevemar | morgan: this fixes it: https://review.openstack.org/#/c/305527/ | 00:01 |
| patchbot | stevemar: patch 305527 - keystonemiddleware (stable/mitaka) - do not review - test commit | 00:01 |
| stevemar | rather... https://review.openstack.org/#/c/305526/ | 00:01 |
| patchbot | stevemar: patch 305526 - keystonemiddleware (stable/mitaka) - Remove bandit.yaml in favor of defaults | 00:01 |
| *** fawadkhaliq has joined #openstack-keystone | 00:13 | |
| *** stingaci has joined #openstack-keystone | 00:18 | |
| morgan | stevemar: wait which is it? | 00:20 |
| *** fhubik has joined #openstack-keystone | 00:27 | |
| *** roxanaghe has quit IRC | 00:31 | |
| *** mylu has quit IRC | 00:32 | |
| *** stingaci has quit IRC | 00:33 | |
| *** mylu has joined #openstack-keystone | 00:33 | |
| *** fhubik has quit IRC | 00:34 | |
| stevemar | morgan: the latter | 00:47 |
| *** diazjf has joined #openstack-keystone | 00:48 | |
| morgan | stevemar: so... i'm going to be a bad person | 00:49 |
| morgan | stevemar: i was a bad person. but there you go | 00:50 |
| *** dan_nguyen has quit IRC | 00:50 | |
| *** spandhe has quit IRC | 00:53 | |
| *** brad[]` is now known as brad[] | 00:57 | |
| *** gyee has quit IRC | 00:59 | |
| *** stingaci has joined #openstack-keystone | 01:01 | |
| *** stewie925 has quit IRC | 01:02 | |
| *** csoukup_ has joined #openstack-keystone | 01:02 | |
| *** pumarani__ has quit IRC | 01:06 | |
| *** csoukup_ has quit IRC | 01:06 | |
| *** spzala has quit IRC | 01:09 | |
| *** browne has quit IRC | 01:09 | |
| *** spzala has joined #openstack-keystone | 01:10 | |
| *** josecastroleon has joined #openstack-keystone | 01:16 | |
| *** mylu has quit IRC | 01:22 | |
| *** mylu has joined #openstack-keystone | 01:24 | |
| *** stingaci has quit IRC | 01:27 | |
| *** EinstCrazy has joined #openstack-keystone | 01:28 | |
| *** rderose has quit IRC | 01:29 | |
| *** stingaci has joined #openstack-keystone | 01:31 | |
| *** EinstCrazy has quit IRC | 01:32 | |
| *** EinstCrazy has joined #openstack-keystone | 01:32 | |
| *** josecastroleon has quit IRC | 01:38 | |
| *** jasonsb has joined #openstack-keystone | 01:45 | |
| stevemar | morgan: bad person?! | 01:48 |
| morgan | stevemar: go look at your patch | 01:48 |
| stevemar | morgan: you pushed it through | 01:48 |
| morgan | yep | 01:48 |
| morgan | bad person | 01:48 |
| morgan | ;) | 01:48 |
| morgan | was a clean cherry-pick and unbreaking a stable gate = important | 01:49 |
| stevemar | :) | 01:49 |
| stevemar | yolanda: morgan ksa 2.6.0 is out :) | 01:49 |
| morgan | stevemar: woo | 01:50 |
| stevemar | morgan: https://review.openstack.org/#/c/304924/1 should pass now... | 01:50 |
| patchbot | stevemar: patch 304924 - keystonemiddleware (stable/mitaka) - Create signing_dir upon first usage | 01:50 |
| morgan | ++ | 01:50 |
| morgan | important backport | 01:50 |
| morgan | stevemar: +2 on that backport, +A whenever it passes | 01:51 |
| morgan | stevemar: ... this one https://review.openstack.org/#/c/208488/ makes my head hurt a little :( | 01:52 |
| patchbot | morgan: patch 208488 - keystone - Unified delegation model | 01:52 |
| morgan | wel the whole chain | 01:53 |
| *** tqtran has quit IRC | 01:53 | |
| *** sdake has quit IRC | 01:55 | |
| *** sdake has joined #openstack-keystone | 01:56 | |
| *** browne has joined #openstack-keystone | 01:58 | |
| *** EinstCrazy has quit IRC | 01:59 | |
| *** EinstCrazy has joined #openstack-keystone | 02:01 | |
| *** dan_nguyen has joined #openstack-keystone | 02:05 | |
| *** fawadkhaliq has quit IRC | 02:08 | |
| morgan | stevemar: http://lists.openstack.org/pipermail/openstack-dev/2016-April/092298.html | 02:08 |
| *** dan_nguyen has quit IRC | 02:10 | |
| *** zqfan has joined #openstack-keystone | 02:10 | |
| *** sdake has quit IRC | 02:12 | |
| mfisch | anyone seen this error before with memcache reaping? | 02:12 |
| mfisch | https://bugs.launchpad.net/keystone/+bug/1570158 | 02:12 |
| openstack | Launchpad bug 1570158 in OpenStack Identity (keystone) "memcache pool reap issue (stable/liberty)" [Undecided,New] | 02:12 |
| morgan | mfisch: i have not | 02:14 |
| morgan | mfisch: also https://review.openstack.org/#/c/304487/ | 02:15 |
| patchbot | morgan: patch 304487 - keystone (stable/mitaka) - Set the values for the request_local_cache | 02:15 |
| mfisch | I saw that | 02:15 |
| mfisch | I dont quite understand what that solves | 02:15 |
| morgan | mfisch: limites the queries to the backend and to memcache | 02:15 |
| morgan | so if you ask .get_domain(<id>) for that http request, it will never ask outside of keystone | 02:16 |
| mfisch | oh | 02:16 |
| mfisch | thats good | 02:16 |
| morgan | stores the data in the request object | 02:16 |
| morgan | it relies on caching, but it does it for all cached values | 02:16 |
| morgan | you can use it as well without memcache by setting caching backend to dogpile.null | 02:17 |
| morgan | and then enable caching | 02:17 |
| *** browne has quit IRC | 02:17 | |
| mfisch | can we backport it? | 02:18 |
| morgan | mfisch: that review is for mitaka | 02:18 |
| morgan | backporting to liberty is backporting the whole request local cache | 02:18 |
| morgan | doable, (it's encapsulated) but needs buyin from stevemar and other stable reviewers | 02:19 |
| mfisch | I mean M | 02:19 |
| morgan | yep | 02:19 |
| mfisch | we have to BP to M now right? | 02:19 |
| morgan | yes | 02:19 |
| morgan | ^ that review is the backport to mitaka | 02:19 |
| morgan | it's a bug fix to solve a missing if check/set in the original code | 02:20 |
| mfisch | morgan: ok cool | 02:20 |
| mfisch | we're going to go to M after the summit | 02:20 |
| morgan | nice | 02:21 |
| morgan | mfisch: also - http://lists.openstack.org/pipermail/openstack-dev/2016-April/092298.html come midcycle with us :) | 02:22 |
| *** morgan changes topic to "Newton Summit Soon! | Midcycle Planning Thread: http://lists.openstack.org/pipermail/openstack-dev/2016-April/092298.html" | 02:23 | |
| mfisch | I'd like to | 02:23 |
| stevemar | mfisch: morgan backporting to liberty would be a no-go, it's more feature-y than buggy | 02:23 |
| *** diazjf1 has joined #openstack-keystone | 02:25 | |
| mfisch | yeah I just meant M | 02:26 |
| *** lhcheng has quit IRC | 02:26 | |
| *** diazjf has quit IRC | 02:27 | |
| mfisch | ok i'm out | 02:27 |
| stevemar | morgan: i don't think mfisch can attend, he's having a summer of george | 02:31 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/305187 | 02:33 |
| morgan | stevemar: ooh the proposal bot is back with another ready-to-fail update ;) | 02:33 |
| morgan | i love that the only change is removing the extras | 02:34 |
| morgan | :P | 02:34 |
| *** spzala has quit IRC | 02:38 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:38 | |
| *** spzala has joined #openstack-keystone | 02:38 | |
| *** edmondsw has quit IRC | 02:40 | |
| *** stingaci has quit IRC | 02:42 | |
| stevemar | morgan: :) | 02:42 |
| stevemar | morgan: that bot doesn't learn very well does it? | 02:42 |
| *** spzala has quit IRC | 02:43 | |
| *** fawadkhaliq has quit IRC | 02:45 | |
| *** stingaci has joined #openstack-keystone | 02:46 | |
| *** fawadkhaliq has joined #openstack-keystone | 02:46 | |
| *** fawadkhaliq has quit IRC | 02:47 | |
| *** lhcheng_ has joined #openstack-keystone | 03:04 | |
| *** stingaci has quit IRC | 03:14 | |
| *** diazjf1 has quit IRC | 03:18 | |
| *** diazjf has joined #openstack-keystone | 03:22 | |
| *** real56 has joined #openstack-keystone | 03:26 | |
| *** real56 has quit IRC | 03:33 | |
| *** diazjf has left #openstack-keystone | 03:33 | |
| *** real56 has joined #openstack-keystone | 03:33 | |
| *** ankur has joined #openstack-keystone | 03:37 | |
| *** stingaci has joined #openstack-keystone | 03:37 | |
| *** mylu has quit IRC | 03:39 | |
| *** stingaci has quit IRC | 03:41 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 03:44 |
| *** jasonsb has quit IRC | 03:47 | |
| *** stingaci has joined #openstack-keystone | 03:55 | |
| *** richm has quit IRC | 03:56 | |
| *** spzala has joined #openstack-keystone | 04:02 | |
| *** mylu has joined #openstack-keystone | 04:07 | |
| *** spzala has quit IRC | 04:08 | |
| *** ksavich has joined #openstack-keystone | 04:17 | |
| *** timburke has quit IRC | 04:30 | |
| *** hugokuo has quit IRC | 04:30 | |
| *** rvba has quit IRC | 04:31 | |
| *** rdo has quit IRC | 04:31 | |
| *** mc_nair has quit IRC | 04:31 | |
| *** SamYaple has quit IRC | 04:31 | |
| *** SamYaple has joined #openstack-keystone | 04:31 | |
| *** rvba has joined #openstack-keystone | 04:31 | |
| *** rvba has quit IRC | 04:31 | |
| *** rvba has joined #openstack-keystone | 04:31 | |
| *** mc_nair has joined #openstack-keystone | 04:31 | |
| *** jlvillal has quit IRC | 04:32 | |
| *** jlvillal has joined #openstack-keystone | 04:32 | |
| *** timburke has joined #openstack-keystone | 04:34 | |
| *** hugokuo has joined #openstack-keystone | 04:34 | |
| *** lamt has quit IRC | 04:36 | |
| *** rdo has joined #openstack-keystone | 04:37 | |
| *** fawadkhaliq has joined #openstack-keystone | 04:42 | |
| *** rcernin has joined #openstack-keystone | 04:50 | |
| *** mylu has quit IRC | 04:56 | |
| *** spzala has joined #openstack-keystone | 05:02 | |
| *** markvoelker has quit IRC | 05:06 | |
| *** spzala has quit IRC | 05:07 | |
| *** roxanaghe has joined #openstack-keystone | 05:12 | |
| *** roxanaghe has quit IRC | 05:12 | |
| *** roxanaghe has joined #openstack-keystone | 05:13 | |
| *** jaosorior has joined #openstack-keystone | 05:20 | |
| *** lhcheng_ has quit IRC | 05:21 | |
| *** lhcheng has joined #openstack-keystone | 05:21 | |
| *** ChanServ sets mode: +v lhcheng | 05:21 | |
| *** ksavich has quit IRC | 05:22 | |
| *** roxanagh_ has joined #openstack-keystone | 05:22 | |
| *** real56 has quit IRC | 05:22 | |
| *** real56 has joined #openstack-keystone | 05:23 | |
| *** jidar has quit IRC | 05:24 | |
| *** roxanaghe has quit IRC | 05:24 | |
| *** roxanagh_ has quit IRC | 05:26 | |
| *** jidar has joined #openstack-keystone | 05:28 | |
| *** real56 has quit IRC | 05:49 | |
| *** real56 has joined #openstack-keystone | 05:50 | |
| *** spandhe has joined #openstack-keystone | 05:54 | |
| *** markvoelker has joined #openstack-keystone | 06:00 | |
| *** dims_ has joined #openstack-keystone | 06:00 | |
| *** vnogin1 has joined #openstack-keystone | 06:02 | |
| *** darrenc_ has joined #openstack-keystone | 06:02 | |
| *** spzala has joined #openstack-keystone | 06:03 | |
| *** tristanC_ has joined #openstack-keystone | 06:04 | |
| *** sigmavirus24b has joined #openstack-keystone | 06:05 | |
| *** alex_xu_ has joined #openstack-keystone | 06:05 | |
| *** pumarani- has joined #openstack-keystone | 06:06 | |
| *** markvoelker has quit IRC | 06:06 | |
| *** charz_ has joined #openstack-keystone | 06:07 | |
| *** huats__ has joined #openstack-keystone | 06:07 | |
| *** sileht_ has joined #openstack-keystone | 06:07 | |
| *** zeus- has joined #openstack-keystone | 06:07 | |
| *** Nirupama has joined #openstack-keystone | 06:07 | |
| *** spzala has quit IRC | 06:07 | |
| yolanda | stevemar, thanks | 06:08 |
| *** Nakato_ has joined #openstack-keystone | 06:08 | |
| *** woodster_ has quit IRC | 06:08 | |
| *** rvba` has joined #openstack-keystone | 06:08 | |
| *** jlvillal_ has joined #openstack-keystone | 06:08 | |
| *** gsilvis_ has joined #openstack-keystone | 06:08 | |
| *** fawadkhaliq has quit IRC | 06:08 | |
| *** jlvillal has quit IRC | 06:08 | |
| *** rvba has quit IRC | 06:08 | |
| *** stingaci has quit IRC | 06:08 | |
| *** ankur has quit IRC | 06:08 | |
| *** huats_ has quit IRC | 06:08 | |
| *** sileht has quit IRC | 06:08 | |
| *** vnogin has quit IRC | 06:08 | |
| *** charz has quit IRC | 06:08 | |
| *** afazekas has quit IRC | 06:08 | |
| *** dtroyer has quit IRC | 06:08 | |
| *** alex_xu has quit IRC | 06:08 | |
| *** dims has quit IRC | 06:08 | |
| *** gsilvis has quit IRC | 06:08 | |
| *** SpamapS has quit IRC | 06:08 | |
| *** tristanC has quit IRC | 06:08 | |
| *** med_ has quit IRC | 06:08 | |
| *** mdavidson has quit IRC | 06:08 | |
| *** zeus has quit IRC | 06:08 | |
| *** cloudnull has quit IRC | 06:08 | |
| *** darrenc has quit IRC | 06:08 | |
| *** krotscheck_dcm has quit IRC | 06:08 | |
| *** adam_g has quit IRC | 06:08 | |
| *** ryanpetrello has quit IRC | 06:08 | |
| *** sigmavirus24_awa has quit IRC | 06:08 | |
| *** Nakato has quit IRC | 06:08 | |
| *** pumaranikar has quit IRC | 06:08 | |
| *** ctracey has quit IRC | 06:08 | |
| *** dobson has quit IRC | 06:08 | |
| *** spandhe has quit IRC | 06:08 | |
| *** zeus- is now known as zeus | 06:09 | |
| *** krotscheck has joined #openstack-keystone | 06:09 | |
| *** zeus is now known as Guest36812 | 06:09 | |
| *** ryanpetrello has joined #openstack-keystone | 06:09 | |
| *** darrenc_ is now known as darrenc | 06:10 | |
| *** jlvillal_ is now known as jlvillal | 06:10 | |
| *** tqtran has joined #openstack-keystone | 06:10 | |
| *** real56 has quit IRC | 06:10 | |
| *** jlvillal is now known as Guest83485 | 06:10 | |
| *** real56 has joined #openstack-keystone | 06:11 | |
| *** dobson has joined #openstack-keystone | 06:11 | |
| *** med_ has joined #openstack-keystone | 06:12 | |
| *** real56 has quit IRC | 06:12 | |
| *** med_ is now known as Guest46337 | 06:12 | |
| *** ryanpetrello has quit IRC | 06:14 | |
| *** sileht_ is now known as sileht | 06:15 | |
| *** real56 has joined #openstack-keystone | 06:15 | |
| *** SpamapS has joined #openstack-keystone | 06:15 | |
| *** mdavidson has joined #openstack-keystone | 06:15 | |
| *** ctracey has joined #openstack-keystone | 06:16 | |
| *** ryanpetrello has joined #openstack-keystone | 06:16 | |
| *** lhcheng has quit IRC | 06:17 | |
| *** cloudnull has joined #openstack-keystone | 06:24 | |
| *** darrenc has quit IRC | 06:25 | |
| *** roxanaghe has joined #openstack-keystone | 06:27 | |
| *** roxanaghe has quit IRC | 06:32 | |
| *** rk4n has joined #openstack-keystone | 06:33 | |
| *** dikonoor has joined #openstack-keystone | 06:35 | |
| *** dikonoo has joined #openstack-keystone | 06:35 | |
| stevemar | yolanda: yw :) | 06:37 |
| stevemar | yolanda: thank you for the betamax work | 06:37 |
| *** real56 has quit IRC | 06:43 | |
| *** real56 has joined #openstack-keystone | 06:44 | |
| *** ryanpetrello has quit IRC | 06:45 | |
| *** tesseract- has joined #openstack-keystone | 06:45 | |
| *** josecastroleon has joined #openstack-keystone | 06:46 | |
| *** e0ne has joined #openstack-keystone | 06:46 | |
| *** tqtran has quit IRC | 06:47 | |
| *** fawadkhaliq has joined #openstack-keystone | 06:49 | |
| *** dhellmann has quit IRC | 06:49 | |
| *** jaosorior has quit IRC | 06:50 | |
| *** jaosorior has joined #openstack-keystone | 06:50 | |
| *** rk4n has quit IRC | 06:52 | |
| *** ryanpetrello has joined #openstack-keystone | 06:52 | |
| *** dhellmann has joined #openstack-keystone | 06:56 | |
| *** adam_g has joined #openstack-keystone | 06:58 | |
| *** adam_g has quit IRC | 06:58 | |
| *** adam_g has joined #openstack-keystone | 06:58 | |
| *** rk4n has joined #openstack-keystone | 06:59 | |
| *** afazekas has joined #openstack-keystone | 07:00 | |
| *** real56 has quit IRC | 07:02 | |
| *** spzala has joined #openstack-keystone | 07:03 | |
| *** real56 has joined #openstack-keystone | 07:05 | |
| *** spzala has quit IRC | 07:08 | |
| *** darrenc has joined #openstack-keystone | 07:09 | |
| *** sdake has joined #openstack-keystone | 07:12 | |
| *** stingaci has joined #openstack-keystone | 07:12 | |
| *** jaosorior has quit IRC | 07:13 | |
| *** e0ne has quit IRC | 07:15 | |
| *** daemontool has joined #openstack-keystone | 07:15 | |
| *** daemontool_ has quit IRC | 07:17 | |
| *** stingaci has quit IRC | 07:17 | |
| *** e0ne has joined #openstack-keystone | 07:18 | |
| *** e0ne has quit IRC | 07:21 | |
| *** ryanpetrello has quit IRC | 07:21 | |
| *** real56 has quit IRC | 07:21 | |
| *** real56 has joined #openstack-keystone | 07:21 | |
| *** ryanpetrello has joined #openstack-keystone | 07:23 | |
| *** real56 has quit IRC | 07:23 | |
| *** rk4n has quit IRC | 07:23 | |
| *** real56 has joined #openstack-keystone | 07:24 | |
| *** real56 has quit IRC | 07:29 | |
| *** real56 has joined #openstack-keystone | 07:30 | |
| *** sdake has quit IRC | 07:31 | |
| *** fawadkhaliq has quit IRC | 07:34 | |
| *** jaosorior has joined #openstack-keystone | 07:35 | |
| *** pnavarro has joined #openstack-keystone | 07:36 | |
| *** mhickey has joined #openstack-keystone | 07:43 | |
| stevemar | morgan: if you get a chance, look at the session schedule: https://www.openstack.org/summit/austin-2016/summit-schedule/global-search?t=Keystone%3A | 07:43 |
| *** fhubik has joined #openstack-keystone | 07:47 | |
| *** jaosorior has quit IRC | 07:48 | |
| *** jaosorior has joined #openstack-keystone | 07:48 | |
| *** daemontool has quit IRC | 07:49 | |
| *** jaosorior has quit IRC | 07:49 | |
| *** jaosorior has joined #openstack-keystone | 07:49 | |
| *** dtroyer has joined #openstack-keystone | 07:49 | |
| *** daemontool has joined #openstack-keystone | 07:51 | |
| *** markvoelker has joined #openstack-keystone | 08:02 | |
| *** spzala has joined #openstack-keystone | 08:05 | |
| *** markvoelker has quit IRC | 08:08 | |
| *** spzala has quit IRC | 08:10 | |
| *** roxanaghe has joined #openstack-keystone | 08:12 | |
| *** Tridde has quit IRC | 08:14 | |
| *** roxanaghe has quit IRC | 08:16 | |
| *** henrynash has joined #openstack-keystone | 08:17 | |
| *** ChanServ sets mode: +v henrynash | 08:17 | |
| *** jistr has joined #openstack-keystone | 08:18 | |
| *** real56 has quit IRC | 08:21 | |
| *** real56 has joined #openstack-keystone | 08:24 | |
| *** openstackstatus has joined #openstack-keystone | 08:25 | |
| *** ChanServ sets mode: +v openstackstatus | 08:25 | |
| *** adam_g has quit IRC | 08:30 | |
| *** e0ne has joined #openstack-keystone | 08:34 | |
| *** adam_g has joined #openstack-keystone | 08:36 | |
| *** adam_g has quit IRC | 08:36 | |
| *** adam_g has joined #openstack-keystone | 08:36 | |
| *** e0ne has quit IRC | 08:44 | |
| *** permalac has joined #openstack-keystone | 08:53 | |
| *** e0ne has joined #openstack-keystone | 08:53 | |
| *** daemontool_ has joined #openstack-keystone | 08:57 | |
| permalac | Hello guys. | 08:57 |
| permalac | I have an openstack installation and I have to federate it with another one. | 08:57 |
| permalac | they just gave me a bunch of users and passwords, users like admin-<region> nova-<region> and so on. | 08:58 |
| permalac | I'm trying to understand what to do, but I'm failing on it on a very Hollywood style. | 08:59 |
| *** ankur has joined #openstack-keystone | 08:59 | |
| permalac | can someone give me a link to a place where to learn the required knowledge to understand how to test the keystone functionalities? | 08:59 |
| permalac | I really think that I'm not understanding something basic or so. | 09:00 |
| *** roxanaghe has joined #openstack-keystone | 09:00 | |
| *** daemontool has quit IRC | 09:01 | |
| *** roxanaghe has quit IRC | 09:05 | |
| *** odyssey4me_ is now known as odyssey4me | 09:05 | |
| *** real56 has quit IRC | 09:07 | |
| *** real56 has joined #openstack-keystone | 09:08 | |
| *** GB21 has joined #openstack-keystone | 09:10 | |
| *** chlong has quit IRC | 09:11 | |
| *** Trident has joined #openstack-keystone | 09:27 | |
| *** akscram has quit IRC | 09:30 | |
| *** david-lyle_ has joined #openstack-keystone | 09:30 | |
| *** david-lyle has quit IRC | 09:33 | |
| *** dhellmann has quit IRC | 09:33 | |
| *** mc_nair has quit IRC | 09:33 | |
| *** trey has quit IRC | 09:33 | |
| *** bradjones has quit IRC | 09:33 | |
| *** mdavidson has quit IRC | 09:34 | |
| *** dancn` has quit IRC | 09:34 | |
| *** akscram has joined #openstack-keystone | 09:35 | |
| *** real56 has quit IRC | 09:38 | |
| *** jistr has quit IRC | 09:38 | |
| *** tesseract- has quit IRC | 09:38 | |
| *** dancn has joined #openstack-keystone | 09:39 | |
| *** GB21 has quit IRC | 09:40 | |
| *** trey has joined #openstack-keystone | 09:41 | |
| *** dhellmann has joined #openstack-keystone | 09:41 | |
| *** bradjones has joined #openstack-keystone | 09:43 | |
| *** bradjones has quit IRC | 09:43 | |
| *** bradjones has joined #openstack-keystone | 09:43 | |
| *** mc_nair has joined #openstack-keystone | 09:45 | |
| *** GB21 has joined #openstack-keystone | 09:47 | |
| *** mvk has joined #openstack-keystone | 09:50 | |
| *** tesseract- has joined #openstack-keystone | 09:50 | |
| *** mdavidson has joined #openstack-keystone | 09:51 | |
| *** GB21 has quit IRC | 09:57 | |
| *** e0ne has quit IRC | 10:01 | |
| *** e0ne has joined #openstack-keystone | 10:01 | |
| *** markvoelker has joined #openstack-keystone | 10:04 | |
| *** alex_xu_ has quit IRC | 10:04 | |
| *** spzala has joined #openstack-keystone | 10:07 | |
| *** alex_xu has joined #openstack-keystone | 10:08 | |
| *** markvoelker has quit IRC | 10:09 | |
| *** daemontool__ has joined #openstack-keystone | 10:10 | |
| *** spzala has quit IRC | 10:12 | |
| *** daemontool_ has quit IRC | 10:14 | |
| *** fhubik has quit IRC | 10:16 | |
| *** jistr has joined #openstack-keystone | 10:22 | |
| *** sheel has joined #openstack-keystone | 10:24 | |
| *** GB21 has joined #openstack-keystone | 10:28 | |
| *** daemontool__ has quit IRC | 10:57 | |
| *** mvk has quit IRC | 10:59 | |
| *** EinstCrazy has quit IRC | 11:02 | |
| *** edmondsw has joined #openstack-keystone | 11:03 | |
| *** GB21 has quit IRC | 11:06 | |
| *** ankur has quit IRC | 11:07 | |
| *** spzala has joined #openstack-keystone | 11:08 | |
| *** GB21 has joined #openstack-keystone | 11:08 | |
| *** alex_xu has quit IRC | 11:08 | |
| *** henrynash has quit IRC | 11:09 | |
| *** alex_xu has joined #openstack-keystone | 11:10 | |
| *** spzala has quit IRC | 11:13 | |
| *** doug-fish has joined #openstack-keystone | 11:13 | |
| *** stingaci has joined #openstack-keystone | 11:14 | |
| *** mnaser has quit IRC | 11:16 | |
| *** stingaci has quit IRC | 11:19 | |
| *** GB21 has quit IRC | 11:20 | |
| *** GB21 has joined #openstack-keystone | 11:22 | |
| *** aimeeU has joined #openstack-keystone | 11:24 | |
| *** mnaser has joined #openstack-keystone | 11:31 | |
| *** flaper87 has quit IRC | 11:33 | |
| *** flaper87 has joined #openstack-keystone | 11:33 | |
| *** GB21 has quit IRC | 11:39 | |
| *** GB21 has joined #openstack-keystone | 11:39 | |
| *** gordc has joined #openstack-keystone | 11:40 | |
| *** dancn has quit IRC | 11:42 | |
| *** wanghua has quit IRC | 11:44 | |
| *** dancn has joined #openstack-keystone | 11:50 | |
| *** woodburn has quit IRC | 11:50 | |
| *** Guest46337 is now known as med_ | 11:55 | |
| *** med_ has quit IRC | 11:55 | |
| *** med_ has joined #openstack-keystone | 11:55 | |
| *** dancn has quit IRC | 12:00 | |
| *** doug-fish has quit IRC | 12:01 | |
| *** doug-fish has joined #openstack-keystone | 12:02 | |
| *** bradjones has quit IRC | 12:02 | |
| *** mdavidson has quit IRC | 12:04 | |
| *** flaper87 has quit IRC | 12:04 | |
| *** markvoelker has joined #openstack-keystone | 12:05 | |
| *** Guest83485 has quit IRC | 12:05 | |
| *** doug-fish has quit IRC | 12:06 | |
| *** dancn has joined #openstack-keystone | 12:07 | |
| *** spzala has joined #openstack-keystone | 12:09 | |
| *** bradjones has joined #openstack-keystone | 12:09 | |
| *** bradjones has quit IRC | 12:09 | |
| *** bradjones has joined #openstack-keystone | 12:09 | |
| *** markvoelker has quit IRC | 12:09 | |
| *** trown|outtypewww is now known as trown | 12:10 | |
| *** flaper87 has joined #openstack-keystone | 12:11 | |
| *** flaper87 has quit IRC | 12:11 | |
| *** flaper87 has joined #openstack-keystone | 12:11 | |
| *** jlvillal has joined #openstack-keystone | 12:13 | |
| *** tristanC_ is now known as tristanC | 12:13 | |
| *** mdavidson has joined #openstack-keystone | 12:13 | |
| *** spzala has quit IRC | 12:13 | |
| *** markvoelker has joined #openstack-keystone | 12:14 | |
| *** markvoelker has quit IRC | 12:14 | |
| *** tesseract- has quit IRC | 12:15 | |
| *** tesseract- has joined #openstack-keystone | 12:16 | |
| *** raildo-afk is now known as raildo | 12:17 | |
| *** GB21 has quit IRC | 12:18 | |
| *** GB21 has joined #openstack-keystone | 12:23 | |
| *** furface has quit IRC | 12:25 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Improve docs for v3 users https://review.openstack.org/305796 | 12:26 |
| *** dancn has quit IRC | 12:26 | |
| samueldmq | bknudson: ^ as requested for user functional tests | 12:26 |
| *** markvoelker has joined #openstack-keystone | 12:27 | |
| *** furface has joined #openstack-keystone | 12:28 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Add users functional tests https://review.openstack.org/289306 | 12:28 |
| *** GB21 has quit IRC | 12:28 | |
| *** richm has joined #openstack-keystone | 12:31 | |
| *** dancn has joined #openstack-keystone | 12:33 | |
| *** ninag has joined #openstack-keystone | 12:38 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Create V9 driver for identity backend https://review.openstack.org/305315 | 12:42 |
| *** dancn has quit IRC | 12:42 | |
| *** rvba` has quit IRC | 12:45 | |
| *** rvba has joined #openstack-keystone | 12:45 | |
| *** rvba has quit IRC | 12:45 | |
| *** rvba has joined #openstack-keystone | 12:45 | |
| *** Guest36812 is now known as zeus | 12:45 | |
| *** zeus has quit IRC | 12:46 | |
| *** zeus has joined #openstack-keystone | 12:46 | |
| *** jaosorior has quit IRC | 12:46 | |
| *** dancn has joined #openstack-keystone | 12:49 | |
| *** doug-fish has joined #openstack-keystone | 12:52 | |
| *** spzala has joined #openstack-keystone | 12:53 | |
| *** doug-fish has quit IRC | 12:53 | |
| *** doug-fish has joined #openstack-keystone | 12:54 | |
| *** lamt has joined #openstack-keystone | 13:01 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Create V9 driver for identity backend https://review.openstack.org/305315 | 13:07 |
| *** henrynash has joined #openstack-keystone | 13:09 | |
| *** ChanServ sets mode: +v henrynash | 13:09 | |
| *** jsavak has joined #openstack-keystone | 13:12 | |
| *** Nakato_ is now known as Nakato | 13:14 | |
| *** permalac_ has joined #openstack-keystone | 13:14 | |
| *** david-lyle has joined #openstack-keystone | 13:15 | |
| *** markvoelker_ has joined #openstack-keystone | 13:15 | |
| *** roxanaghe has joined #openstack-keystone | 13:16 | |
| *** cburgess has quit IRC | 13:17 | |
| *** richm has quit IRC | 13:17 | |
| *** richm1 has joined #openstack-keystone | 13:17 | |
| *** rvba has quit IRC | 13:17 | |
| *** jaimguer has quit IRC | 13:17 | |
| *** pleia2 has quit IRC | 13:17 | |
| *** lmiccini has quit IRC | 13:17 | |
| *** markvoelker has quit IRC | 13:17 | |
| *** jlvillal has quit IRC | 13:17 | |
| *** david-lyle_ has quit IRC | 13:17 | |
| *** permalac has quit IRC | 13:17 | |
| *** rvba has joined #openstack-keystone | 13:17 | |
| *** rvba has quit IRC | 13:18 | |
| *** rvba has joined #openstack-keystone | 13:18 | |
| *** pleia2 has joined #openstack-keystone | 13:18 | |
| *** jlvillal has joined #openstack-keystone | 13:18 | |
| *** jaimguer has joined #openstack-keystone | 13:19 | |
| *** lmiccini has joined #openstack-keystone | 13:20 | |
| *** roxanaghe has quit IRC | 13:21 | |
| *** cburgess has joined #openstack-keystone | 13:22 | |
| *** pauloewerton has joined #openstack-keystone | 13:23 | |
| *** tlbr has quit IRC | 13:26 | |
| *** tlbr has joined #openstack-keystone | 13:26 | |
| *** daemontool has joined #openstack-keystone | 13:36 | |
| *** Nirupama has quit IRC | 13:39 | |
| *** mylu has joined #openstack-keystone | 13:39 | |
| *** richm1 is now known as richm | 13:39 | |
| *** darosale has joined #openstack-keystone | 13:46 | |
| *** ninag_ has joined #openstack-keystone | 13:46 | |
| *** pumarani- has quit IRC | 13:47 | |
| *** med_ has quit IRC | 13:47 | |
| *** aimeeU has quit IRC | 13:48 | |
| *** dhellmann has quit IRC | 13:48 | |
| *** vnogin1 has quit IRC | 13:48 | |
| *** SamYaple has quit IRC | 13:48 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone-specs: Include blacklist and whitelist to mappings docs https://review.openstack.org/305866 | 13:49 |
| *** daemontool has quit IRC | 13:49 | |
| *** ninag has quit IRC | 13:49 | |
| *** mdavidson has quit IRC | 13:49 | |
| *** edmondsw has quit IRC | 13:49 | |
| *** daemontool has joined #openstack-keystone | 13:49 | |
| *** med_ has joined #openstack-keystone | 13:52 | |
| *** med_ is now known as Guest90748 | 13:53 | |
| *** sigmavirus24b is now known as sigmavirus24 | 13:53 | |
| *** sigmavirus24 has quit IRC | 13:53 | |
| *** sigmavirus24 has joined #openstack-keystone | 13:53 | |
| *** pumaranikar has joined #openstack-keystone | 13:54 | |
| *** woodburn has joined #openstack-keystone | 13:55 | |
| *** ametts has joined #openstack-keystone | 13:57 | |
| *** ayoung has quit IRC | 13:57 | |
| *** dhellmann has joined #openstack-keystone | 13:58 | |
| *** dhellmann has quit IRC | 14:01 | |
| *** aimeeU has joined #openstack-keystone | 14:01 | |
| *** vnogin has joined #openstack-keystone | 14:02 | |
| *** edmondsw has joined #openstack-keystone | 14:02 | |
| *** mdavidson has joined #openstack-keystone | 14:03 | |
| *** dhellmann has joined #openstack-keystone | 14:03 | |
| *** dmellado_ is now known as dmellado | 14:04 | |
| *** gagehugo has joined #openstack-keystone | 14:06 | |
| *** Guest90748 is now known as medberry | 14:10 | |
| *** medberry has quit IRC | 14:10 | |
| *** medberry has joined #openstack-keystone | 14:10 | |
| *** SamYaple has joined #openstack-keystone | 14:11 | |
| *** pushkaru has joined #openstack-keystone | 14:14 | |
| *** ksavich has joined #openstack-keystone | 14:15 | |
| *** woodster_ has joined #openstack-keystone | 14:15 | |
| rodrigods | knikolla, ping... did my email help? | 14:17 |
| *** mylu has quit IRC | 14:17 | |
| *** rderose has joined #openstack-keystone | 14:22 | |
| knikolla | rodrigods: yeah, but we’re facing other issues after the redirect. | 14:22 |
| *** mylu has joined #openstack-keystone | 14:22 | |
| *** jaugustine has joined #openstack-keystone | 14:22 | |
| mylu | rodrigods: lol I need help | 14:22 |
| rodrigods | mylu, knikolla, sure | 14:23 |
| rodrigods | what is the current issue? | 14:23 |
| knikolla | rodrigods: i’ll let mylu explain | 14:23 |
| *** dan_nguyen has joined #openstack-keystone | 14:24 | |
| mylu | rodrigods: so when I request http://keystone.sp/v3/OS-FEDERATION/identity_providers/kestone-idp/protocols/saml2/auth after 302, I get WARN Shibboleth.SessionInitiator.SAML2 [8]: unable to locate compatible SSO service for provider and INFO Shibboleth.SessionInitiator.Shib1 [8]: unable to locate Shibboleth-aware identity provider role for provider | 14:24 |
| mylu | But I did see INFO Shibboleth.SessionCache [8]: new session created for my idp | 14:25 |
| rodrigods | mylu, ok... we need to check shibboleth's config, check your IdP setup and your SP setup (the entities created in both of them) | 14:26 |
| mylu | and in keystone.log I see None of the configured SessionInitiators handled the request. | 14:26 |
| mylu | rodrigods: we're testing in a devstack pair that has k2k set up correctly, meaning that it works when we use keystoneauth1 | 14:27 |
| rodrigods | mylu, hmm ok, so you may be calling the wrong URL | 14:28 |
| *** gagehugo has quit IRC | 14:28 | |
| rodrigods | mylu, can you paste the list of service providers (and its attributes) of your IdP keystone? | 14:28 |
| *** gagehugo has joined #openstack-keystone | 14:28 | |
| rodrigods | mylu, https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#listing-service-providers | 14:29 |
| *** slberger has joined #openstack-keystone | 14:30 | |
| mylu | I believe I'm using the right url I just got this http://sp-ip:35357/v3/OS-FEDERATION/identity_providers/keystone-idp/protocols/saml2/auth | 14:30 |
| mylu | and when I look in keystone_access log I found this: | 14:31 |
| mylu | When I use keystoneauth: "POST /Shibboleth.sso/SAML2/ECP HTTP/1.1" 302 292 "-" "Python-httplib2/0.9.2 (gzip)" 13234(us) | 14:31 |
| mylu | "GET /v3/OS-FEDERATION/identity_providers/keystone-idp/protocols/saml2/auth HTTP/1.1" 500 988 "-" "Python-httplib2/0.9.2 (gzip)" 2466(us) | 14:31 |
| mylu | wait sorry the above is when I use my test code in tempest | 14:32 |
| henrynash | quick, easy (hopefully) +2/A (famous last words): https://review.openstack.org/#/c/288403/4 | 14:32 |
| patchbot | henrynash: patch 288403 - keystone - Expose not clearing of user default project on pro... | 14:32 |
| *** phalmos has joined #openstack-keystone | 14:32 | |
| mylu | this is when I use keystoneauth: "POST /Shibboleth.sso/SAML2/ECP HTTP/1.1" 302 292 "-" "keystoneauth1/2.3.0 python-requests/2.9.1 CPython/2.7.6" 15955(us) | 14:32 |
| mylu | "GET /v3/OS-FEDERATION/identity_providers/keystone-idp/protocols/saml2/auth HTTP/1.1" 201 438 "-" "keystoneauth1/2.3.0 python-requests/2.9.1 CPython/2.7.6" 11802960(us) | 14:32 |
| rodrigods | mylu, could you paste in paste.openstack.org? it is easier to read there | 14:33 |
| mylu | rodrigods: http://paste.openstack.org/show/494084/ | 14:34 |
| *** permalac_ has quit IRC | 14:36 | |
| *** ksavich has quit IRC | 14:40 | |
| *** mvk has joined #openstack-keystone | 14:40 | |
| *** csoukup_ has joined #openstack-keystone | 14:42 | |
| rodrigods | mylu, strange... can i take a look in the code? | 14:44 |
| *** gagehugo has quit IRC | 14:44 | |
| mylu | rodrigods: yes sure | 14:44 |
| rodrigods | mylu, you can paste here... i'll be leaving for lunch but as soon as i'm back i'll take a look | 14:44 |
| mylu | rodrigods: let me commit it to my own github...its messy bare with me lol | 14:44 |
| rodrigods | sure | 14:44 |
| *** timcline has joined #openstack-keystone | 14:50 | |
| *** henrynash has quit IRC | 14:52 | |
| *** ayoung has joined #openstack-keystone | 14:53 | |
| *** ChanServ sets mode: +v ayoung | 14:53 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP users https://review.openstack.org/305487 | 14:55 |
| mylu | rodrigods: https://github.com/minggLu/tempest/commit/f02eee8598d51fb431a9c3d81f6ed6ec49007fbe ... sorry in advance cuz it too messy... | 14:55 |
| *** gagehugo has joined #openstack-keystone | 14:55 | |
| *** henrynash has joined #openstack-keystone | 14:56 | |
| *** ChanServ sets mode: +v henrynash | 14:56 | |
| *** mylu has quit IRC | 14:57 | |
| *** zzxwill has joined #openstack-keystone | 14:57 | |
| *** tesseract- has quit IRC | 14:58 | |
| *** mylu has joined #openstack-keystone | 14:58 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 14:58 |
| breton | have we discussed roles-scoped tokens before? | 15:02 |
| *** henrynash has quit IRC | 15:06 | |
| *** EinstCrazy has joined #openstack-keystone | 15:07 | |
| morgan | breton: role scoped? what would a role scope be? | 15:10 |
| morgan | breton: keystone made a choice in ... grizzly? to not have a role (global) assigned to a user without an associated project | 15:11 |
| morgan | stevemar: schdule looks good to me | 15:12 |
| *** zzxwill has quit IRC | 15:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 15:14 |
| *** stingaci has joined #openstack-keystone | 15:15 | |
| breton | morgan: role+project scoped | 15:15 |
| morgan | breton: isn't... that what we have now? | 15:16 |
| rodrigods | mylu, think i found the issue | 15:16 |
| rodrigods | mylu, https://github.com/minggLu/tempest/commit/f02eee8598d51fb431a9c3d81f6ed6ec49007fbe#diff-ee738dc5e5d9db383e0c17fa92770f52R103 is missing the port | 15:16 |
| mylu | rodrigods: sorry I forgot to change it back, that was when I changed it this morning because I was not a believer | 15:17 |
| gsilvis_ | breton: do you mean a token that only grants some of the roles that a user would have? | 15:17 |
| breton | morgan: if a user has 3 assignments to 1 project, all these roles will be activated. I'm thinking about activating a single role. | 15:17 |
| mylu | rodrigods: I did it before with port 5000 and 35357 and it wasn't working either | 15:18 |
| breton | morgan: (or a subset of roles) | 15:18 |
| breton | gsilvis_: yep | 15:18 |
| morgan | breton: token with limited roles/subset. that is something ayoung was working on | 15:18 |
| gsilvis_ | breton: because I believe it's possible to get such a token right now, using trusts, though I don't know if there's a more straightforward way | 15:18 |
| *** gsilvis_ is now known as gsilvis | 15:18 | |
| ayoung | morgan, gsilvis is right | 15:18 |
| morgan | you can do that with trusts as gsilvis said, but it's clunky | 15:18 |
| ayoung | token is the only way today | 15:18 |
| breton | gsilvis: afaik we cannot create trust on ourselves. | 15:18 |
| ayoung | breton, why not? | 15:18 |
| breton | ayoung: i dunno, i've just tried in tests and it have 403. Maybe i tried bad though. | 15:19 |
| ayoung | breton, I mean, I don't trust *myself* but you should trust you | 15:19 |
| breton | *it gave | 15:19 |
| ayoung | nah, self trusts work | 15:19 |
| breton | do we have a test for it? | 15:19 |
| ayoung | breton, just do it | 15:19 |
| ayoung | it works | 15:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 15:20 |
| ayoung | or write a test if you don't believe me....I forget if we tested it, but there is not explicit check that trustee can nnot = user | 15:20 |
| *** stingaci has quit IRC | 15:20 | |
| *** slberger1 has joined #openstack-keystone | 15:21 | |
| * breton checks | 15:21 | |
| *** slberger has quit IRC | 15:22 | |
| breton | right. It works, i tried not enough before. | 15:22 |
| breton | ok then | 15:22 |
| *** henrynash has joined #openstack-keystone | 15:22 | |
| *** ChanServ sets mode: +v henrynash | 15:22 | |
| rodrigods | mylu, can you avoid the final step of doing the GET after the redirect? | 15:23 |
| rodrigods | and do that manually, with cURL | 15:23 |
| *** jsavak has quit IRC | 15:23 | |
| mylu | rodrigods: sure | 15:23 |
| rodrigods | to check what happens? i'm suspecting the "self.get()" is including unnecessary stuff in the request | 15:23 |
| rderose | any idea when oslo_log package will get updated? | 15:26 |
| rderose | So that we can refer to the Newton release in our deprecated decorator, e.g. versionutils.deprecated.NEWTON | 15:26 |
| *** jsavak has joined #openstack-keystone | 15:26 | |
| *** josecastroleon has quit IRC | 15:30 | |
| *** Bjoern has joined #openstack-keystone | 15:30 | |
| *** josecastroleon has joined #openstack-keystone | 15:33 | |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: WIP: Create custom serializer for keystoneauth and betamax https://review.openstack.org/305937 | 15:34 |
| stevemar | morgan: i will leave the work rooms as-is | 15:34 |
| stevemar | morgan: i won't fill in the details, we can work on stuff from the fishbowls | 15:35 |
| morgan | yeah | 15:35 |
| morgan | wfm | 15:35 |
| mylu | rodrigods: http://paste.openstack.org/show/494094/ | 15:36 |
| *** pnavarro has quit IRC | 15:38 | |
| *** skape has joined #openstack-keystone | 15:39 | |
| *** stingaci has joined #openstack-keystone | 15:40 | |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Fix D401 PEP8 violation. https://review.openstack.org/305944 | 15:41 |
| mylu | rodrigods: I feel like the problem is when I do get request to /v3/OS-FEDERATION/identity_providers/keystone-idp/protocols/saml2/auth, shibboleth tries to initiate a new session instead of using the cached one | 15:43 |
| mylu | rodrigods: maybe I need to pass extra parameter with my GET request.. like the 'set-cookie' I got from the 302 response? | 15:44 |
| rodrigods | mylu, hmm... maybe? | 15:44 |
| mylu | rodrigods: but I have no idea how to do it lol I'm gonna try to look at how keystoneauth session does it... | 15:45 |
| skape | Hi! guys !!! | 15:45 |
| skape | i'm installing mitaka following the install guide for rdo on centos, all went well until the verification of cinder with the command "cinder service-list" when I receive an 503 error. in the cinder-api.log lists an authentication error. while trying to resolv this issue I found out the keystone command is also not working for exemple keystone catalog, and here is where i'm lost "openstack token issue" works fine what am I | 15:45 |
| *** chianingwang has quit IRC | 15:46 | |
| rodrigods | mylu, a easy way is to check the request being made by keystoneauth to see what is missing | 15:47 |
| mylu | rodrigods: I've been looking at keystoneauth.identity.v3.k2k for references, I'm doing exactly the same thing https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/k2k.py#L155 | 15:49 |
| mylu | rodrigods: it could be session is doing something that I'm not doing and that caused the problem...but that doesn't make sense either because | 15:50 |
| rodrigods | mylu, exactly, i mean you check the request headers, url, everything | 15:50 |
| mylu | rodrigods: http://paste.openstack.org/show/494096/ this is what I got from the debug message when I run it with keystoneauth | 15:51 |
| mylu | rodrigods: and it's the same curl command except not including User-Agent... | 15:52 |
| *** henrynash has quit IRC | 15:52 | |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: DO NOT REVIEW (testing experimental) https://review.openstack.org/305954 | 15:52 |
| rodrigods | mylu, bizarre... need to leave for a hour or so | 15:52 |
| mylu | rodrigods: same here hahaha | 15:52 |
| rodrigods | will ping you when i'm back | 15:53 |
| mylu | rodrigods: but I'll still look into the session code and see if I can find anything helpful | 15:53 |
| mylu | rodrigods: sounds good Thanks for helping! | 15:53 |
| skape | what is the diference between "openstack token issue" and "keystone catalog" what can be wrong when the first works but the second dont ? | 15:54 |
| *** henrynash has joined #openstack-keystone | 15:55 | |
| *** ChanServ sets mode: +v henrynash | 15:55 | |
| skape | join #openstack-cinder | 15:55 |
| skape | ops | 15:56 |
| EmilienM | so last night with ayoung we played with fernet keys deployments with puppet-keystone and we were wondering where is the right place for keys. Should it be in /etc/keystone/fernet-keys? or /var/lib/keystone/fernet-keys? somewhere else? current situation is /etc/keystone/fernet-keys by default | 15:56 |
| morgan | EmilienM: i would say /etc/keystone/fernet-keys | 15:56 |
| lbragstad | EmilienM that's totally up to your - the keys just have to be readable by the process running keystone | 15:57 |
| ayoung | EmilienM, I think you could make an argument for either, so lets go least resisitenace | 15:57 |
| lbragstad | you* | 15:57 |
| ayoung | lbragstad, its a permissions thing | 15:57 |
| *** roxanaghe has joined #openstack-keystone | 15:57 | |
| EmilienM | I like /etc/keystone/fernet-keys | 15:57 |
| EmilienM | it's where we have ssl certifs, and all config | 15:57 |
| morgan | it is keystone config-like data, i worry /var/lib/* will be less consistent | 15:57 |
| ayoung | in general, you want /etc to be owned by root and only readable by the process, where as /var is for data written by the process. You don't typically want a process able to change its own config | 15:57 |
| morgan | and certs etc... yes what EmilienM said | 15:57 |
| bknudson | maybe we can use this for keystone tests to get rid of eventlet -- https://github.com/jd/pifpaf | 15:57 |
| *** henrynash has quit IRC | 15:58 | |
| EmilienM | ayoung: so using /etc/keystone/fernet-keys works find on ubuntu with UCA packaging. It does not work on RDO because of permissions. Maybe can we discuss about it on #rdo, to make it work? | 15:58 |
| morgan | i don't expect keystone to write keys from the keystoneprocess | 15:58 |
| morgan | in fact... i'd say that is a security concern | 15:58 |
| ayoung | however, a Key like this is fine in /etc. I would sy, then, that it should be written by root, but readable byt the Keystone user | 15:58 |
| ayoung | morgan, he was runnning keystone-manage as non-root | 15:58 |
| lbragstad | ayoung I'd agree with that | 15:58 |
| ayoung | EmilienM is the puppetmaster | 15:58 |
| openstackgerrit | Merged openstack/keystoneauth: Removing tox ignore D401 and make keystoneauth compliant https://review.openstack.org/304843 | 15:58 |
| EmilienM | ok, let me summarize the problem : | 15:59 |
| morgan | ayoung: regardless of root or non-root, i see a security gap if the running keystone can write keys | 15:59 |
| ayoung | EmilienM, so, maybe run as root, but chgrp keystone perms 640 | 15:59 |
| ayoung | morgan, ++ | 15:59 |
| morgan | ayoung: def. keystone group read :) | 15:59 |
| EmilienM | 1/ if I ru keystone-manage fernet as root, it works fine, except /var/log/keystone/keystone/log is written as root user, so later db_sync fails since it's written with keystone user (same for httpd process btw) | 15:59 |
| morgan | 640 is good. | 15:59 |
| morgan | EmilienM: lets work on making keystone-manage better then. | 16:00 |
| EmilienM | 2/ if I run keystone-manage fernet as keystone user, I got permissions issues on centos7 (using RDO), impossible to create /etC/keystone/fernet-keys | 16:00 |
| ayoung | EmilienM, hack/workoaround: touch /var/log/keystone/keystone/log; chown keystone:keystone /var/log/keystone/keystone/log | 16:00 |
| morgan | maybe keystone-manage deserves it's own log? not keystone/log | 16:00 |
| ayoung | morgan, ++ | 16:00 |
| EmilienM | morgan: ++ bis | 16:00 |
| morgan | :) | 16:01 |
| EmilienM | but we still have the problem with db_sync | 16:01 |
| ayoung | /var/log/keystone/keystone_manage.log? | 16:01 |
| EmilienM | we run db_sync as keystone user | 16:01 |
| ayoung | mange | 16:01 |
| ayoung | Magia | 16:01 |
| ayoung | Mangia | 16:01 |
| EmilienM | https://github.com/openstack/puppet-keystone/blob/master/manifests/db/sync.pp | 16:01 |
| EmilienM | why should we use root at all? | 16:02 |
| ayoung | Hmmmm....So that is going to connect to the database as the Keystone user anyway. | 16:02 |
| ayoung | It probably does not matter there | 16:02 |
| morgan | ayoung: that'll connect with whatever the config says. | 16:02 |
| EmilienM | to me, the simpliest thing is to allow keystone user to create /etc/keystone/fernet-keys in RDO package | 16:02 |
| *** mylu has quit IRC | 16:02 | |
| ayoung | Bad practice to run with root by default, though. | 16:02 |
| EmilienM | yes | 16:03 |
| EmilienM | imho, we should run everything as keystone | 16:03 |
| morgan | EmilienM: that is your call, but i would be inclined to say the order of operations could solve this. | 16:03 |
| morgan | i also very strongly disagree with fernet keys being rotated by the same user running keystone | 16:03 |
| ayoung | EmilienM, nah...keystone-manage in general is doing config type stuff...the database one is even OK to do as Root | 16:03 |
| EmilienM | today, all works fine on ubuntu packaging | 16:03 |
| ayoung | EmilienM, "damned by faint praise" | 16:03 |
| morgan | but i stay out of packaging conversations usually | 16:03 |
| ayoung | No errors != It works right | 16:04 |
| dstanek | morgan: ++ if you do that there may be room for an attacker to mess with it | 16:04 |
| EmilienM | morgan: right, that's why I propose to continue on #rdo if needed | 16:04 |
| ayoung | Keys should be owned by root | 16:04 |
| * morgan moves to #rdo, dstanek join us!:) | 16:04 | |
| *** sdake has joined #openstack-keystone | 16:05 | |
| *** mylu has joined #openstack-keystone | 16:06 | |
| *** mhickey has quit IRC | 16:06 | |
| *** josecastroleon has quit IRC | 16:06 | |
| *** mylu has quit IRC | 16:08 | |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: DO NOT REVIEW (testing experimental) https://review.openstack.org/305954 | 16:09 |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: DO NOT REVIEW (testing experimental) https://review.openstack.org/305963 | 16:09 |
| *** mylu has joined #openstack-keystone | 16:11 | |
| *** aimeeU has quit IRC | 16:11 | |
| *** sheel has quit IRC | 16:15 | |
| *** sheel has joined #openstack-keystone | 16:15 | |
| *** mylu has quit IRC | 16:18 | |
| *** timcline has quit IRC | 16:21 | |
| samueldmq | DO NOT REVIEW -> okay, let's take a quick look at it | 16:22 |
| samueldmq | tjcocozz: ^ | 16:22 |
| tjcocozz | samueldmq, lol I always do the same thing :-) | 16:22 |
| samueldmq | tjcocozz: actually this has the opposite effect | 16:23 |
| samueldmq | tjcocozz: I will add this when I need something merging quickly | 16:23 |
| samueldmq | lol | 16:23 |
| samueldmq | at least getting quick feedback hehe | 16:23 |
| EmilienM | morgan: how did you triage it for " Status tracked in Newton " in Launchpad? | 16:24 |
| EmilienM | is it automagic? | 16:24 |
| tjcocozz | samueldmq, You should add "REVIEW" at the beginnning so I know to review it :p | 16:24 |
| morgan | EmilienM: "target series" and select newton | 16:24 |
| morgan | EmilienM: :) | 16:24 |
| morgan | EmilienM: and the project is set to have newton as the primary target | 16:25 |
| morgan | of dev. | 16:25 |
| EmilienM | oh ok | 16:25 |
| morgan | :) | 16:25 |
| *** jistr has quit IRC | 16:28 | |
| *** trown is now known as trown|lunch | 16:30 | |
| *** EinstCrazy has quit IRC | 16:32 | |
| *** josecastroleon has joined #openstack-keystone | 16:35 | |
| *** rcernin has quit IRC | 16:36 | |
| *** skape has left #openstack-keystone | 16:37 | |
| *** ninag_ has quit IRC | 16:39 | |
| *** stingaci has quit IRC | 16:40 | |
| mfisch | dolphm: one of my devs asked me why fernet tokens vacillate in size, 184 bytes to 205 bytes, wondering why they're not always the same | 16:41 |
| openstackgerrit | Tom Cocozzello (tjcocozz) proposed openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 16:42 |
| *** rbak has joined #openstack-keystone | 16:42 | |
| dolphm | mfisch: different payloads | 16:47 |
| *** browne has joined #openstack-keystone | 16:48 | |
| mfisch | not sure why I thought they were always fixed | 16:48 |
| dolphm | mfisch: unscoped tokens are different in size from project-scoped, are different in size than federated tokens, are different in size from trust tokens | 16:48 |
| dolphm | mfisch: you tend to see one of two sizes most frequently, i think | 16:48 |
| mfisch | seems obvious once you tell me | 16:48 |
| dolphm | mfisch: rderose's "shadow user" work has the potential to eliminate federated tokens this release, which are potentially unbounded in size right now (they carry an enumeration of groups) | 16:49 |
| rbak | I knew there was a difference between scoped and unscopped tokens, but assuming I'm always authenticating with the same set of credentials, what would change in the payload? | 16:50 |
| *** harlowja has quit IRC | 16:51 | |
| mfisch | datestamp but thats the same length | 16:51 |
| *** fawadkhaliq has joined #openstack-keystone | 16:53 | |
| *** aimeeU has joined #openstack-keystone | 16:56 | |
| *** fawadkhaliq has quit IRC | 16:56 | |
| *** josecastroleon has quit IRC | 16:57 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:58 | |
| *** fawadkhaliq has quit IRC | 16:59 | |
| *** e0ne has quit IRC | 16:59 | |
| dolphm | Bjoern: o/ did you get your v3cloudsample policy issue worked out? | 17:00 |
| Bjoern | no | 17:00 |
| dolphm | Bjoern: you replaced "admin_domain_id" in the sample file with a real domain ID, correct? | 17:01 |
| *** fawadkhaliq has joined #openstack-keystone | 17:01 | |
| Bjoern | yeah also tried "role:admin and (token.is_admin_project:True or domain_id:%(domain_id)s)" | 17:02 |
| Bjoern | but still 401 | 17:02 |
| dolphm | Bjoern: but you tried something like "role:admin and (token.is_admin_project:True or domain_id:5ZCjEqDd3rXGFhUzLOvIie)" ? | 17:03 |
| Bjoern | yes | 17:03 |
| Bjoern | I used the id returned from domain list | 17:03 |
| *** trown|lunch is now known as trown | 17:03 | |
| dolphm | Bjoern: cool - then you authenticated with keystone with a domain-scope on the same domain? | 17:03 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the assignment abstract base class out of core https://review.openstack.org/299635 | 17:03 |
| dolphm | Bjoern: username + password + user_domain_id + domain_id, for example? | 17:04 |
| Bjoern | if you send me your public SSH key I can show you the env | 17:04 |
| Bjoern | I use OS_PROJECT_DOMAN, OS_USER_DOMAIN and username/password | 17:05 |
| dolphm | Bjoern: OS_PROJECT* will authenticate you for a project-scoped token instead of a domain-scoped token | 17:05 |
| dolphm | Bjoern: in which case, you won't have domain-level authorization and won't be able to match a domain-based policy check | 17:05 |
| dolphm | Bjoern: you need to use the OS_DOMAIN* variables instead | 17:05 |
| dolphm | OS_DOMAIN_ID should suffice, since you already have the ID | 17:06 |
| Bjoern | ok let me test | 17:06 |
| Bjoern | that was one of my questions back in March | 17:06 |
| Bjoern | because we set both domain settings | 17:06 |
| dolphm | Bjoern: there are 3 | 17:06 |
| Bjoern | and I didn't know which one is for what | 17:06 |
| Bjoern | yeah I know | 17:06 |
| dolphm | Bjoern: well, 6 | 17:06 |
| Bjoern | so the token can only scoped to one domain at a time ? | 17:06 |
| dolphm | Bjoern: Bjoern: USER_DOMAIN_ID/NAME, PROJECT_DOMAIN_ID/NAME, DOMAIN_ID/NAME | 17:07 |
| dolphm | Bjoern: correct | 17:07 |
| dolphm | Bjoern: the USER_DOMAIN contextualizes the user you're authenticating as, because usernames are not unique across domains | 17:07 |
| Bjoern | why did we set OS_USER_DOMAIN_NAME and OS_PROJECT_DOMAIN_NAME inside the our standard openrc ? | 17:07 |
| dolphm | Bjoern: the PROJECT_DOMAIN* contextualizes the project scope you're requesting for the same reason (names are not unique across domains) | 17:07 |
| Bjoern | I mean both settings at the same time | 17:07 |
| dolphm | Bjoern: and DOMAIN* requests a domain-scope instead of a project-scope | 17:08 |
| dolphm | Bjoern: OS_USER_DOMAIN_NAME is set because it probably authenticates with a username | 17:08 |
| dolphm | Bjoern: OS_PROJECT_DOMAIN_NAME is set because it probably authenticates for a project-scoped token normally | 17:08 |
| Bjoern | whey I set OS_DOMAIN_NAME I get ERROR: openstack Authentication cannot be scoped to multiple targets. Pick one of: project, domain or trust | 17:09 |
| dolphm | Bjoern: you'll have to unset OS_PROJECT* to get a domain scope instead | 17:09 |
| Bjoern | I had also OS_PROJECT_NAME set | 17:09 |
| dolphm | Bjoern: unset! | 17:09 |
| *** darosale has quit IRC | 17:09 | |
| Bjoern | yeah still got the same error | 17:10 |
| *** stingaci has joined #openstack-keystone | 17:10 | |
| Bjoern | so the domain level scoping is the reason why I do see now assignments attached to the domain I guess ? | 17:10 |
| Bjoern | what is that token.is_admin_project for ? | 17:11 |
| *** lhcheng has joined #openstack-keystone | 17:11 | |
| *** ChanServ sets mode: +v lhcheng | 17:11 | |
| dolphm | Bjoern: that's a new feature in mitaka - let me find you a link | 17:12 |
| *** lhcheng has quit IRC | 17:12 | |
| *** lhcheng has joined #openstack-keystone | 17:12 | |
| *** ChanServ sets mode: +v lhcheng | 17:12 | |
| dolphm | Bjoern: and 'yes' to your previous question | 17:12 |
| dolphm | Bjoern: what's your output of: env | grep OS_* | awk -F "=" '{print $1}' | tr '\n' ' ' ; echo | 17:12 |
| Bjoern | OS_AUTH_VERSION OS_IDENTITY_API_VERSION OS_PASSWORD OS_DOMAIN_NAME OS_AUTH_URL OS_USERNAME OS_TENANT_NAME OS_ENDPOINT_TYPE OS_NO_CACHE LESSCLOSE | 17:12 |
| dolphm | Bjoern: are you setting OS_DOMAIN_NAME to the name or ID? | 17:13 |
| *** jsavak has quit IRC | 17:13 | |
| dolphm | Bjoern: also, unset OS_TENANT_NAME -- that *should* be equivalent to OS_PROJECT*, but i think neutronclient or something still uses the old name | 17:13 |
| *** jsavak has joined #openstack-keystone | 17:14 | |
| Bjoern | yeah it was the OS_TENANT_NAME. Still get 401, let me check if the user has the correct role assigned for the UserDomain trtget | 17:15 |
| *** fawadk has joined #openstack-keystone | 17:17 | |
| *** rbak_ has joined #openstack-keystone | 17:18 | |
| *** markvoelker has joined #openstack-keystone | 17:18 | |
| *** woodburn has quit IRC | 17:18 | |
| openstackgerrit | Merged openstack/keystonemiddleware: PEP257: add flake8-docstring testing https://review.openstack.org/304925 | 17:19 |
| *** cburgess has quit IRC | 17:19 | |
| *** woodburn has joined #openstack-keystone | 17:19 | |
| *** fawadkhaliq has quit IRC | 17:19 | |
| *** dancn has quit IRC | 17:19 | |
| Bjoern | yeah still 401 | 17:20 |
| *** slberger1 has quit IRC | 17:20 | |
| *** rbak has quit IRC | 17:20 | |
| *** gordc has quit IRC | 17:20 | |
| *** ayoung has quit IRC | 17:21 | |
| *** markvoelker_ has quit IRC | 17:21 | |
| *** mnaser has quit IRC | 17:21 | |
| dolphm | Bjoern: is keystone in debug mode? | 17:21 |
| *** timcline has joined #openstack-keystone | 17:22 | |
| *** iurygregory has quit IRC | 17:23 | |
| *** sdake has quit IRC | 17:23 | |
| *** gordc has joined #openstack-keystone | 17:24 | |
| *** fawadk has quit IRC | 17:25 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:25 | |
| *** cburgess has joined #openstack-keystone | 17:26 | |
| *** sdake has joined #openstack-keystone | 17:26 | |
| *** ericksonsantos has quit IRC | 17:26 | |
| *** mnaser has joined #openstack-keystone | 17:26 | |
| *** timcline has quit IRC | 17:27 | |
| *** pauloewerton has quit IRC | 17:28 | |
| *** dancn has joined #openstack-keystone | 17:28 | |
| *** rbak__ has joined #openstack-keystone | 17:31 | |
| *** slberger has joined #openstack-keystone | 17:33 | |
| *** jaosorior has joined #openstack-keystone | 17:33 | |
| *** jsavak has quit IRC | 17:34 | |
| *** rbak_ has quit IRC | 17:34 | |
| *** jsavak has joined #openstack-keystone | 17:35 | |
| *** ayoung has joined #openstack-keystone | 17:35 | |
| *** ChanServ sets mode: +v ayoung | 17:35 | |
| *** dikonoo has quit IRC | 17:36 | |
| *** dikonoor has quit IRC | 17:36 | |
| *** yolanda has quit IRC | 17:36 | |
| *** tqtran has joined #openstack-keystone | 17:44 | |
| *** darosale has joined #openstack-keystone | 17:44 | |
| *** dan_nguyen_ has joined #openstack-keystone | 17:48 | |
| *** sdake_ has joined #openstack-keystone | 17:48 | |
| *** rderose_ has joined #openstack-keystone | 17:49 | |
| *** timcline has joined #openstack-keystone | 17:50 | |
| *** roxanaghe_ has joined #openstack-keystone | 17:50 | |
| *** mkoderer__ has joined #openstack-keystone | 17:50 | |
| *** mkoderer___ has quit IRC | 17:50 | |
| *** dan_nguyen has quit IRC | 17:50 | |
| *** dan_nguyen_ is now known as dan_nguyen | 17:50 | |
| *** jsavak has quit IRC | 17:50 | |
| *** yolanda has joined #openstack-keystone | 17:51 | |
| *** fawadkhaliq has quit IRC | 17:51 | |
| *** sdake has quit IRC | 17:51 | |
| *** roxanaghe has quit IRC | 17:51 | |
| *** rderose has quit IRC | 17:51 | |
| *** vnogin has quit IRC | 17:51 | |
| *** fawadkhaliq has joined #openstack-keystone | 17:51 | |
| *** jsavak has joined #openstack-keystone | 17:52 | |
| *** vnogin has joined #openstack-keystone | 17:52 | |
| *** josecastroleon has joined #openstack-keystone | 17:54 | |
| *** timcline has quit IRC | 17:54 | |
| *** gyee has joined #openstack-keystone | 17:55 | |
| *** ChanServ sets mode: +v gyee | 17:55 | |
| *** rbak_ has joined #openstack-keystone | 17:56 | |
| *** ametts has quit IRC | 17:59 | |
| *** rbak__ has quit IRC | 17:59 | |
| *** ametts has joined #openstack-keystone | 18:01 | |
| *** fawadkhaliq has quit IRC | 18:02 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:02 | |
| *** sdake_ is now known as sdake | 18:04 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 18:04 |
| *** rbak__ has joined #openstack-keystone | 18:06 | |
| *** fawadkhaliq has quit IRC | 18:09 | |
| *** harlowja has joined #openstack-keystone | 18:09 | |
| *** rbak_ has quit IRC | 18:09 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:09 | |
| *** ericksonsantos has joined #openstack-keystone | 18:12 | |
| openstackgerrit | Merged openstack/keystone: OSprofiler release notes https://review.openstack.org/305344 | 18:12 |
| Bjoern | dplphm: I run keystone now on debug will send you some output later, anything in particular ? | 18:13 |
| Bjoern | dolphm: ^ | 18:13 |
| dolphm | Bjoern: i'm wondering what the details of your 401 are | 18:15 |
| dolphm | Bjoern: the error message should be a bit more verbose with keystone in debug mode | 18:15 |
| Bjoern | RBAC ? | 18:15 |
| Bjoern | oh yes I recall | 18:15 |
| dolphm | Bjoern: there should be a "message" in the response, with hopefully something more than a "you're not authorized" | 18:15 |
| *** sdake_ has joined #openstack-keystone | 18:17 | |
| Bjoern | lol 2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core UserNotFound: Could not find user: | 18:18 |
| Bjoern | q2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core return fn(*arg, **kw) | 18:18 |
| Bjoern | 2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core File "/usr/local/lib/python2.7/dist-packages/keystone/identity/core.py", line 773, in get_user_by_name | 18:18 |
| Bjoern | 2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core ref = driver.get_user_by_name(user_name, domain_id) | 18:18 |
| Bjoern | 2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core File "/usr/local/lib/python2.7/dist-packages/keystone/identity/backends/sql.py", line 145, in get_user_by_name | 18:18 |
| Bjoern | 2016-04-14 18:18:15.306 593 TRACE keystone.auth.plugins.core raise exception.UserNotFound(user_id=user_name) | 18:19 |
| *** sdake has quit IRC | 18:19 | |
| Bjoern | so the scoping did not work | 18:19 |
| Bjoern | the openstack client does scoping EBUG: openstackclient.identity.v3.user.ListUser take_action(Namespace(columns=[], domain='domain1', formatter='table', group=None, long=False, max_width=0, project=None, quote_mode='nonnumeric')) | 18:19 |
| Bjoern | I will try the ID | 18:19 |
| *** jsavak has quit IRC | 18:20 | |
| *** fawadkhaliq has quit IRC | 18:20 | |
| *** jsavak has joined #openstack-keystone | 18:20 | |
| *** timcline has joined #openstack-keystone | 18:21 | |
| *** fawadkhaliq has joined #openstack-keystone | 18:22 | |
| *** timcline has quit IRC | 18:22 | |
| *** timcline has joined #openstack-keystone | 18:23 | |
| *** josecastroleon has quit IRC | 18:23 | |
| *** fawadkhaliq has quit IRC | 18:24 | |
| *** tqtran has quit IRC | 18:25 | |
| *** pauloewerton has joined #openstack-keystone | 18:26 | |
| dstanek | Bjoern: try to use paste as it make reading easier | 18:27 |
| Bjoern | yes | 18:28 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 18:30 |
| dolphm | Bjoern: that's not a scoping issue - it failed before it got that far | 18:30 |
| dolphm | Bjoern: that's an issue with your OS_USER* variables alone | 18:30 |
| *** daemontool has quit IRC | 18:31 | |
| *** sdake_ is now known as sdake | 18:32 | |
| *** fhubik has joined #openstack-keystone | 18:32 | |
| dolphm | Bjoern: also, do mention me in your replies :) | 18:32 |
| *** zqfan has quit IRC | 18:32 | |
| dolphm | Bjoern: are you sure your OS_USER_DOMAIN_NAME is correct? the user is *in* that domain? | 18:33 |
| rodrigods | breton, can you revisit https://review.openstack.org/#/c/303502/5/keystone_tempest_plugin/tests/api/identity/v3/test_service_providers.py | 18:35 |
| patchbot | rodrigods: patch 303502 - keystone - Add service providers integration tests | 18:35 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 18:36 |
| *** jsavak has quit IRC | 18:39 | |
| openstackgerrit | Marcellin Fom Tchassem proposed openstack/keystone: Deprecation reason for domain_id_immutable https://review.openstack.org/306021 | 18:41 |
| *** fhubik has quit IRC | 18:42 | |
| openstackgerrit | Merged openstack/keystoneauth: Documentation example fix https://review.openstack.org/304233 | 18:47 |
| *** jsavak has joined #openstack-keystone | 18:49 | |
| openstackgerrit | Marcellin Fom Tchassem proposed openstack/keystone: Deprecation reason for domain_id_immutable https://review.openstack.org/306021 | 18:51 |
| breton | rodrigods: i've removed -1, but can't +1 yet. | 18:51 |
| *** tqtran has joined #openstack-keystone | 18:59 | |
| *** spandhe has joined #openstack-keystone | 18:59 | |
| ayoung | dolphm, you ever figure out running unit tests on an old code base? I'm working through that now | 19:01 |
| *** e0ne has joined #openstack-keystone | 19:01 | |
| *** jaosorior has quit IRC | 19:01 | |
| dolphm | ayoung: every time i worked out one dependency issue, i'd run into another, so i gave up :-/ | 19:02 |
| ayoung | dolphm, so I cna help | 19:02 |
| *** sdake has quit IRC | 19:02 | |
| ayoung | there is an internal set of RPMS I found on our CI server | 19:02 |
| ayoung | and then I am still installing pysaml from PIP | 19:02 |
| *** lhcheng has quit IRC | 19:05 | |
| *** sdake has joined #openstack-keystone | 19:05 | |
| *** lhcheng has joined #openstack-keystone | 19:07 | |
| *** ChanServ sets mode: +v lhcheng | 19:07 | |
| *** lhcheng has quit IRC | 19:07 | |
| *** trown is now known as trown|afk | 19:08 | |
| *** lhcheng has joined #openstack-keystone | 19:08 | |
| *** ChanServ sets mode: +v lhcheng | 19:08 | |
| *** mylu has joined #openstack-keystone | 19:10 | |
| *** e0ne has quit IRC | 19:13 | |
| *** iurygregory has joined #openstack-keystone | 19:16 | |
| *** iurygregory has quit IRC | 19:18 | |
| *** iurygregory has joined #openstack-keystone | 19:18 | |
| *** e0ne has joined #openstack-keystone | 19:22 | |
| *** timcline has quit IRC | 19:27 | |
| dolphm | ayoung: thanks for your help, btw! | 19:28 |
| *** mrhillsman has joined #openstack-keystone | 19:29 | |
| mrhillsman | hey folks, anyone aware of how to have a "projectadmin", user with projectadmin role that can only create/delete/update users within the project they belong | 19:30 |
| mrhillsman | i can get the role to allow visibility of users tab in horizon, but when you click on it, says unauthorized | 19:31 |
| *** harlowja has quit IRC | 19:31 | |
| mrhillsman | even when said role can run openstack user list | 19:31 |
| ayoung | mrhillsman, you willing to write custom policy? | 19:32 |
| mrhillsman | yep | 19:33 |
| ayoung | so look at the cloudsample policy file. It has a special check to prevent a global admin: | 19:33 |
| ayoung | is_admin_proejct | 19:33 |
| ayoung | mrhillsman, http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json#n3 | 19:34 |
| mrhillsman | yep, looking | 19:34 |
| ayoung | so the default is http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n45 admin required | 19:35 |
| mrhillsman | yep, i follow | 19:35 |
| dolphm | ayoung: that's new for mitaka, right? | 19:35 |
| ayoung | we cn't put the "is_admin_project" rule into the default policy file, as it will break a lot of people | 19:35 |
| ayoung | dolphm, yep | 19:35 |
| *** e0ne has quit IRC | 19:35 | |
| dolphm | mrhillsman: i assume you're on stable/mitaka or master? | 19:35 |
| mrhillsman | unfortunately trying to implement in kilo | 19:35 |
| *** harlowja has joined #openstack-keystone | 19:36 | |
| ayoung | dolphm, one of things to nail down this summit is the migration plan for this | 19:36 |
| ayoung | mrhillsman, ooh. So, yeah | 19:36 |
| dolphm | mrhillsman: ooh, this is definitely not supported at all in kilo | 19:36 |
| dolphm | mrhillsman: (why kilo?!) | 19:36 |
| ayoung | the issue is https://bugs.launchpad.net/keystone/+bug/968696 | 19:36 |
| openstack | Launchpad bug 968696 in Glance ""admin"-ness not properly scoped" [High,Triaged] | 19:36 |
| mrhillsman | yeah, read that bug | 19:36 |
| dolphm | mrhillsman: would you like a bug 968696 tshirt? | 19:36 |
| mrhillsman | lol | 19:36 |
| dolphm | mrhillsman: bug 968696 is not a joke :( | 19:37 |
| ayoung | mrhillsman, dolphm I only had 2 made up, and gave on away. Pretty sure he doesn't want the one I wore. Should I have more made up? | 19:37 |
| *** jsavak has quit IRC | 19:37 | |
| dolphm | ayoung: it was an awesome shirt :P | 19:37 |
| mrhillsman | i got all the way to pretty much looking the code before i said let me ask the folks who would know better than me | 19:37 |
| dolphm | mrhillsman: that'd be a lot of code to backport to kilo :P | 19:37 |
| mrhillsman | ok cool | 19:38 |
| mrhillsman | i did not know it was that involved | 19:38 |
| dolphm | mrhillsman: can you wait for / upgrade to kilo? | 19:38 |
| ayoung | mrhillsman, ok, so unless you are willing to backport the fix for _is_admin_project I don't relly have a good answer for you | 19:38 |
| dolphm | err, mitaka? | 19:38 |
| ayoung | hmmm | 19:38 |
| ayoung | mrhillsman, actually, yes I do | 19:38 |
| ayoung | you can hardcode the project_id | 19:38 |
| ayoung | in the policy files if you are willing to write custom | 19:38 |
| mrhillsman | yes | 19:39 |
| mrhillsman | i tried to do a custom rule | 19:39 |
| ayoung | so a project admin would be just role:admin, but for any more important API call add in project_id: <uuidofadminproject> | 19:39 |
| mrhillsman | and use project_id:%(user.project_id)s i believe | 19:39 |
| ayoung | Nope | 19:39 |
| mrhillsman | ah, so you would have to hardcode it | 19:39 |
| ayoung | mrhillsman, yeah, for the APIs that you *don't* want just anyole admin executing | 19:40 |
| navidp | hi this patch fixes some pep8 D400 and removes the ignore D400 from tox, if youhave time to review it https://review.openstack.org/#/c/305944/ | 19:40 |
| patchbot | navidp: patch 305944 - keystone - Fix D401 PEP8 violation. | 19:40 |
| ayoung | navidp, whatis pep8 D400? | 19:40 |
| navidp | D401 not D400 | 19:40 |
| mrhillsman | thank you ayoung | 19:40 |
| ayoung | What is D401? | 19:40 |
| mrhillsman | i appreciate the info | 19:40 |
| ayoung | mrhillsman, good luck. If you get it to work, write it up and send me the soltion | 19:41 |
| navidp | ayoung, 401: First line should be in imperative mood | 19:41 |
| mrhillsman | sure thing | 19:41 |
| openstackgerrit | Brian Curtin proposed openstack/keystoneauth: Include query string in request logging https://review.openstack.org/306051 | 19:41 |
| *** real56 has joined #openstack-keystone | 19:41 | |
| ayoung | GAH | 19:42 |
| navidp | ayoung, https://github.com/openstack/keystone/blob/master/tox.ini#L124-L128 | 19:42 |
| ayoung | navidp, I'm stunned | 19:42 |
| ayoung | One the one hand, wow, that was a lot of work | 19:42 |
| dolphm | ayoung: navidp: all the pep257 error codes http://pydocstyle.readthedocs.org/en/latest/error_codes.html | 19:42 |
| ayoung | on the other hand, I don't think I want churn for that in our codebase | 19:42 |
| ayoung | I mean, I'm pretty pedantic, and that is a bit much for me | 19:43 |
| navidp | ayoung, ok | 19:45 |
| ayoung | navidp, but...thanks. | 19:45 |
| dolphm | navidp: that is a LOT of files - but if we get the change reviewed quickly you won't have to rebase it endlessly | 19:45 |
| *** e0ne has joined #openstack-keystone | 19:45 | |
| *** e0ne has quit IRC | 19:45 | |
| dolphm | navidp: i bet that was the pep257 rule with the most violations too lol | 19:45 |
| ayoung | THat is not a bad way to learn the code base. And it is early in the cycle. | 19:45 |
| ayoung | dolphm, can they actually automate that check? | 19:45 |
| dolphm | ayoung: yes, pypi/pep257 | 19:45 |
| ayoung | Wow | 19:46 |
| navidp | dolphm, that would be great | 19:46 |
| dolphm | ayoung: or rather, we're using pypi/flake8-pep257, which uses pypi/pep257 | 19:46 |
| dolphm | ayoung: so we run it as part of the pep8 / hacking job | 19:46 |
| ayoung | navidp, going through it now. If there is nothing glaring, tmepted to just +2 and bedone iwth it | 19:47 |
| *** sdake_ has joined #openstack-keystone | 19:47 | |
| navidp | ayoung, good deed thanks | 19:47 |
| dolphm | i am too - first few files look great | 19:48 |
| *** sdake has quit IRC | 19:49 | |
| ayoung | navidp, its actually a pretty easy code review. | 19:50 |
| ayoung | And things should still backport OK, which is what I was really worried about | 19:51 |
| ayoung | works for me | 19:52 |
| navidp | ayoung, yap, it is, thanks | 19:52 |
| ayoung | its a one time hit, and it might actually hepl write better docs | 19:52 |
| *** real56 has quit IRC | 19:53 | |
| *** mylu has quit IRC | 19:54 | |
| *** mminesh has joined #openstack-keystone | 19:55 | |
| *** akscram has quit IRC | 19:58 | |
| *** akscram has joined #openstack-keystone | 19:59 | |
| *** mylu has joined #openstack-keystone | 19:59 | |
| dolphm | go team go | 20:04 |
| dolphm | navidp: you also don't need to open bugs for all these - there is no end user impact to these changes beyond docs, and the required changes are already tracked in tox.ini per project | 20:05 |
| dolphm | navidp: (bugs should track things that end users care directly about) | 20:05 |
| navidp | ok dolphm | 20:06 |
| *** mminesh has quit IRC | 20:06 | |
| *** ayoung has quit IRC | 20:08 | |
| openstackgerrit | Marcellin Fom Tchassem proposed openstack/keystone: Deprecation reason for domain_id_immutable https://review.openstack.org/306021 | 20:08 |
| openstackgerrit | Navid Pustchi proposed openstack/keystone: Fix D401 PEP8 violation. https://review.openstack.org/305944 | 20:09 |
| *** rcarrillocruz has joined #openstack-keystone | 20:13 | |
| rcarrillocruz | hi folks | 20:14 |
| rcarrillocruz | question | 20:14 |
| rcarrillocruz | i'm checking http://developer.openstack.org/api-ref-identity-v3.html#projects-v3 docs | 20:14 |
| rcarrillocruz | and noticed the delete operation of projects does not allow domain_id as param | 20:14 |
| rcarrillocruz | whereas create/update does | 20:14 |
| rcarrillocruz | is there a reason for this? | 20:14 |
| *** timcline has joined #openstack-keystone | 20:14 | |
| *** gagehugo_ has joined #openstack-keystone | 20:16 | |
| *** gagehugo has quit IRC | 20:18 | |
| *** mylu_ has joined #openstack-keystone | 20:19 | |
| *** sileht has quit IRC | 20:19 | |
| *** sileht has joined #openstack-keystone | 20:19 | |
| *** mylu has quit IRC | 20:22 | |
| *** mylu_ has quit IRC | 20:24 | |
| *** sheel has quit IRC | 20:25 | |
| *** mylu has joined #openstack-keystone | 20:25 | |
| morgan | rcarrillocruz: because create you need to specify the domain owner | 20:25 |
| morgan | rcarrillocruz: on delete, the id is known - and the domain can be discovered by the project ref | 20:25 |
| morgan | rcarrillocruz: basically, because domain_id isn't needed on delete :) | 20:25 |
| *** mylu has quit IRC | 20:26 | |
| *** mylu has joined #openstack-keystone | 20:27 | |
| *** fhubik has joined #openstack-keystone | 20:27 | |
| rcarrillocruz | so, what you are saying is that when you do a delete it has to be with a domain scoped token, thus it's infered ? | 20:27 |
| rcarrillocruz | what i'm getting at, is that a cloud admin, that has access to all domains and all projects contained in them (projects/users/etc) cannot do a delete specifying the domain id, it has to get a token scoped to the domain and then do the delete? | 20:30 |
| rcarrillocruz | morgan: ^ | 20:30 |
| morgan | rcarrillocruz: no delete on any resource you are allowed (policy dictates) knows what domain the project is in | 20:31 |
| morgan | rcarrillocruz: because you're using project_id | 20:31 |
| morgan | ids are unique | 20:31 |
| morgan | you technically can delete the project you are scoped to *if* policy allows you to | 20:31 |
| morgan | when using id (user_id, group_id, project_id, etc) you don't need to guess what domain, but on creation it just is a case of "who owns this resource i am creating" | 20:32 |
| morgan | it could be inferred by scope, but that gets wonky with cloud-admin like roles | 20:32 |
| rcarrillocruz | oh wait | 20:33 |
| rcarrillocruz | so | 20:33 |
| rcarrillocruz | a project id | 20:33 |
| rcarrillocruz | is unique | 20:33 |
| rcarrillocruz | even amongst domains | 20:33 |
| rcarrillocruz | ? | 20:33 |
| rcarrillocruz | i.e. i can't have project_id=1 on domain foo and domain bar | 20:34 |
| rcarrillocruz | project_id will be unique inter-domain? | 20:34 |
| *** hongbin has joined #openstack-keystone | 20:40 | |
| morgan | yes | 20:40 |
| morgan | project_name is only unique within it's owning domain | 20:40 |
| morgan | project_id is a uuid.uuid4() - if it collides in your install (legitimately), I'll buy the round of drinks ;) | 20:41 |
| morgan | we use the id as a unique index to look up things - so it has to be unique in a given deployment | 20:42 |
| *** aimeeU has quit IRC | 20:43 | |
| rcarrillocruz | that makes sense now | 20:43 |
| rcarrillocruz | thanks for clarifying | 20:43 |
| morgan | and with 32bytes hex, it likely is unique in the entire world. if my math isn't awful, there are 3.4028237e+38 possible uuid4s | 20:44 |
| rcarrillocruz | :-) | 20:44 |
| morgan | rcarrillocruz: glad to help | 20:53 |
| *** stevelle has joined #openstack-keystone | 20:55 | |
| *** harlowja has quit IRC | 20:55 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Test list project hierarchy is correct for a large tree https://review.openstack.org/277512 | 21:00 |
| *** gagehugo_ has quit IRC | 21:00 | |
| *** jaugustine has quit IRC | 21:02 | |
| *** ninag has joined #openstack-keystone | 21:04 | |
| *** navidp has quit IRC | 21:07 | |
| *** hongbin has left #openstack-keystone | 21:15 | |
| morgan | stevemar, dude i found a way to make our tokens smaller we do something like this https://twitter.com/internetofshit/status/720714402949963778 | 21:18 |
| morgan | lbragstad, dstanek, dolphm, ^ cc | 21:18 |
| bknudson | we could strip of the gAAAAA from the front of the tokens | 21:19 |
| rodrigods | morgan, makes sense! | 21:20 |
| morgan | bknudson: hehe | 21:20 |
| morgan | i hate to admit how hard i laughed at that tweet | 21:20 |
| EmilienM | morgan: I tried to do that in the meantime https://review.openstack.org/#/c/306044/ | 21:22 |
| patchbot | EmilienM: patch 306044 - puppet-keystone - pki/fernet: write keystone-manage logs in new files | 21:22 |
| morgan | EmilienM: nice! | 21:22 |
| EmilienM | morgan: but it does not work yet, I don't know why but logs still go in http://logs.openstack.org/51/305451/8/check/gate-puppet-openstack-integration-3-scenario003-tempest-centos-7/8ebc2a8/logs/keystone/keystone.txt.gz (on centos only, on ubuntu it goes in the right file) | 21:22 |
| morgan | ah. | 21:22 |
| morgan | weird | 21:22 |
| morgan | very weird | 21:22 |
| morgan | maybe logging.conf is clobbering something? | 21:23 |
| openstackgerrit | Merged openstack/keystone: Dev doc update for moving abstract base classes out of core https://review.openstack.org/302317 | 21:23 |
| EmilienM | yeah, I'm investigating | 21:23 |
| *** csoukup_ has quit IRC | 21:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 21:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move the resource abstract base class out of core https://review.openstack.org/302826 | 21:32 |
| *** pauloewerton has quit IRC | 21:35 | |
| *** baffle_ is now known as baffle | 21:35 | |
| *** fhubik has quit IRC | 21:39 | |
| *** fhubik has joined #openstack-keystone | 21:39 | |
| *** doug-fis_ has joined #openstack-keystone | 21:47 | |
| *** doug-fis_ has quit IRC | 21:47 | |
| *** doug-fis_ has joined #openstack-keystone | 21:48 | |
| *** trown|afk is now known as trown|outtypewww | 21:48 | |
| *** slberger has left #openstack-keystone | 21:49 | |
| *** doug-fish has quit IRC | 21:50 | |
| *** timcline has quit IRC | 21:50 | |
| *** timcline has joined #openstack-keystone | 21:51 | |
| *** doug-fis_ has quit IRC | 21:52 | |
| *** gyee has quit IRC | 21:52 | |
| *** gyee has joined #openstack-keystone | 21:53 | |
| *** ChanServ sets mode: +v gyee | 21:53 | |
| *** edmondsw has quit IRC | 21:53 | |
| *** jlvillal has quit IRC | 21:53 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 21:54 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Shadow LDAP and non-local users https://review.openstack.org/305487 | 21:54 |
| *** tqtran has quit IRC | 21:56 | |
| *** rderose_ has quit IRC | 21:57 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:57 | |
| *** jlvillal has joined #openstack-keystone | 21:58 | |
| *** rderose_ has joined #openstack-keystone | 21:58 | |
| *** pushkaru has quit IRC | 22:00 | |
| *** roxanaghe_ has quit IRC | 22:01 | |
| *** richm has quit IRC | 22:01 | |
| *** doug-fish has joined #openstack-keystone | 22:01 | |
| *** pushkaru has joined #openstack-keystone | 22:02 | |
| *** roxanaghe_ has joined #openstack-keystone | 22:03 | |
| *** edmondsw has joined #openstack-keystone | 22:04 | |
| *** csoukup_ has joined #openstack-keystone | 22:04 | |
| *** dan_nguyen has quit IRC | 22:05 | |
| *** darosale has quit IRC | 22:07 | |
| *** harlowja has joined #openstack-keystone | 22:09 | |
| *** ametts has quit IRC | 22:10 | |
| *** tqtran has joined #openstack-keystone | 22:10 | |
| *** csoukup_ has quit IRC | 22:11 | |
| *** spandhe has quit IRC | 22:14 | |
| *** richm has joined #openstack-keystone | 22:15 | |
| *** pushkaru has quit IRC | 22:18 | |
| *** gordc has quit IRC | 22:21 | |
| *** Bjoern has quit IRC | 22:23 | |
| *** ninag has quit IRC | 22:25 | |
| *** ayoung has joined #openstack-keystone | 22:39 | |
| *** ChanServ sets mode: +v ayoung | 22:39 | |
| *** tqtran has quit IRC | 22:44 | |
| *** tqtran has joined #openstack-keystone | 22:44 | |
| *** phalmos has quit IRC | 22:44 | |
| *** sheel has joined #openstack-keystone | 22:47 | |
| *** mylu has quit IRC | 22:51 | |
| *** mylu has joined #openstack-keystone | 22:54 | |
| *** rbak__ has quit IRC | 22:55 | |
| *** jamielennox is now known as jamielennox|away | 22:58 | |
| *** spzala has quit IRC | 23:03 | |
| *** spzala has joined #openstack-keystone | 23:03 | |
| *** spzala has quit IRC | 23:08 | |
| *** mylu has quit IRC | 23:11 | |
| *** mylu has joined #openstack-keystone | 23:11 | |
| *** mylu has quit IRC | 23:18 | |
| *** mylu has joined #openstack-keystone | 23:21 | |
| *** ayoung has quit IRC | 23:23 | |
| *** mylu has quit IRC | 23:24 | |
| *** mylu has joined #openstack-keystone | 23:25 | |
| *** mylu has quit IRC | 23:30 | |
| *** alex_xu has quit IRC | 23:40 | |
| *** alex_xu has joined #openstack-keystone | 23:42 | |
| *** timcline has quit IRC | 23:44 | |
| *** shoutm has joined #openstack-keystone | 23:45 | |
| *** spzala has joined #openstack-keystone | 23:46 | |
| *** jamielennox|away is now known as jamielennox | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!