| *** pgbridge has quit IRC | 00:02 | |
| *** rbridgeman_ has joined #openstack-keystone | 00:07 | |
| *** rbridgeman__ has joined #openstack-keystone | 00:10 | |
| *** rbridgeman_ has quit IRC | 00:13 | |
| *** roxanagh_ has quit IRC | 00:31 | |
| *** browne has joined #openstack-keystone | 00:36 | |
| openstackgerrit | Merged openstack/keystone: replace logging with oslo.log https://review.openstack.org/309869 | 00:40 |
|---|---|---|
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/314356 | 00:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/314357 | 00:44 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/314358 | 00:44 |
| *** edtubill has joined #openstack-keystone | 00:45 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/314372 | 00:49 |
| *** dmellado has joined #openstack-keystone | 00:49 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updating sample configuration file https://review.openstack.org/314333 | 00:54 |
| *** tqtran has quit IRC | 00:54 | |
| *** dan_nguyen has joined #openstack-keystone | 00:57 | |
| *** sdake has joined #openstack-keystone | 01:02 | |
| *** browne has quit IRC | 01:16 | |
| *** shalpin has joined #openstack-keystone | 01:25 | |
| *** EinstCrazy has joined #openstack-keystone | 01:31 | |
| shalpin | Hi! I'm trying to use the v3 Client, but it doesn't check the ca cert store. In V2.0 there was a cacert parameter, but not in v3. Is there some way to specify a cacert store to v3? | 01:31 |
| *** dan_nguyen has quit IRC | 01:38 | |
| *** edtubill has quit IRC | 01:41 | |
| *** edtubill has joined #openstack-keystone | 01:42 | |
| *** roxanagh_ has joined #openstack-keystone | 01:48 | |
| *** BjoernT has joined #openstack-keystone | 01:49 | |
| *** tqtran has joined #openstack-keystone | 01:51 | |
| *** spzala has joined #openstack-keystone | 01:56 | |
| *** tqtran has quit IRC | 01:57 | |
| ayoung | shalpin, um...is this CLI or python? | 01:57 |
| ayoung | jamielennox, its probably an error. Safe to ignore, but more correct to warn. Suspect that erroring so will break people since it is new behavior | 01:58 |
| *** stingaci has quit IRC | 02:00 | |
| *** spzala has quit IRC | 02:02 | |
| *** EinstCrazy has quit IRC | 02:05 | |
| shalpin | ayoung this is via python | 02:05 |
| ayoung | shalpin, so there is still the ability to pass in that param. I think it goes to the session object, though | 02:06 |
| shalpin | BTW I'm not very familiar with IRC, so please let me know of any ettiquette mistakes I make | 02:06 |
| ayoung | shalpin, NP. | 02:06 |
| *** spandhe has joined #openstack-keystone | 02:06 | |
| ayoung | No problem | 02:06 |
| *** EinstCrazy has joined #openstack-keystone | 02:08 | |
| ayoung | shalpin, http://docs.openstack.org/developer/keystoneauth/using-sessions.html | 02:09 |
| ayoung | verify='/path/to/ca.cert' | 02:09 |
| *** spandhe_ has joined #openstack-keystone | 02:16 | |
| shalpin | +ayoung ah ... I see. I had overlooked that, looking for ca-cert | 02:16 |
| shalpin | +ayoung thank you | 02:16 |
| *** jorge_munoz has quit IRC | 02:16 | |
| ayoung | shalpin, you are welcome. Spread the word to others | 02:16 |
| *** ayoung has quit IRC | 02:17 | |
| shalpin | +ayoung What that .... ayoung will solve all your problems? :) I just confirmed and it is working fine for me now | 02:17 |
| *** spzala has joined #openstack-keystone | 02:17 | |
| *** spandhe has quit IRC | 02:18 | |
| *** spandhe_ is now known as spandhe | 02:18 | |
| *** woodster_ has quit IRC | 02:18 | |
| *** jorge_munoz has joined #openstack-keystone | 02:19 | |
| *** edtubill has quit IRC | 02:20 | |
| *** TxGVNN has joined #openstack-keystone | 02:20 | |
| *** spzala has quit IRC | 02:21 | |
| *** spzala has joined #openstack-keystone | 02:21 | |
| *** roxanagh_ has quit IRC | 02:21 | |
| *** spandhe_ has joined #openstack-keystone | 02:35 | |
| *** spandhe has quit IRC | 02:35 | |
| *** spandhe_ is now known as spandhe | 02:35 | |
| *** fangxu has quit IRC | 02:38 | |
| jamielennox | damn missed ayoung - the problem is it's a user warning, there's not really anything useful about throwing up an error on the keystone side | 02:42 |
| jamielennox | also i'd be interested to see who's using it cause it's not easy | 02:42 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add oauth plugin to keystoneauth https://review.openstack.org/314401 | 02:50 |
| jamielennox | amakarov: ^ | 02:50 |
| *** BjoernT has quit IRC | 02:53 | |
| *** sdake has quit IRC | 03:07 | |
| *** agrebennikov has quit IRC | 03:22 | |
| *** rbridgeman__ has quit IRC | 03:25 | |
| *** EinstCrazy has quit IRC | 03:28 | |
| *** EinstCrazy has joined #openstack-keystone | 03:28 | |
| *** links has joined #openstack-keystone | 03:29 | |
| *** dan_nguyen has joined #openstack-keystone | 03:34 | |
| *** shalpin has quit IRC | 03:38 | |
| *** roxanagh_ has joined #openstack-keystone | 03:39 | |
| openstackgerrit | ayoung proposed openstack/keystone: WIP Remove unneeded revocation events https://review.openstack.org/285134 | 03:41 |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 03:41 |
| *** ayoung has joined #openstack-keystone | 03:42 | |
| *** ChanServ sets mode: +v ayoung | 03:42 | |
| *** EinstCra_ has joined #openstack-keystone | 03:46 | |
| *** EinstCrazy has quit IRC | 03:48 | |
| *** tqtran has joined #openstack-keystone | 03:53 | |
| *** tqtran has quit IRC | 03:57 | |
| *** edtubill has joined #openstack-keystone | 04:08 | |
| *** roxanagh_ has quit IRC | 04:12 | |
| *** sdake has joined #openstack-keystone | 04:13 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Expose is_admin_project in AccessInfo https://review.openstack.org/314409 | 04:13 |
| jamielennox | ayoung: can you have a look at this one for me: https://review.openstack.org/#/c/312323/ ? | 04:14 |
| patchbot | jamielennox: patch 312323 - keystone - Always add is_admin_project if admin project defined | 04:14 |
| *** stingaci has joined #openstack-keystone | 04:20 | |
| *** stingaci has quit IRC | 04:20 | |
| stevemar | jamielennox: nice patches for oauth and ksa | 04:21 |
| *** stingaci has joined #openstack-keystone | 04:21 | |
| jamielennox | stevemar: thanks, took me longer than i expected, oauth is a bit of a PITA | 04:21 |
| jamielennox | well, the way we do it | 04:21 |
| crinkle | stevemar: i started poking at 311827 and i think i worked out all the py3 issues, do you mind if i push up a patchset for it? | 04:31 |
| stevemar | crinkle: by all means | 04:32 |
| stevemar | crinkle: what was the kicker? | 04:32 |
| crinkle | cool | 04:32 |
| crinkle | stevemar: all utf8/str stuff | 04:32 |
| stevemar | i imagine something in the way the connection manager? | 04:32 |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: WIP: review at own risk: switch to pyldap https://review.openstack.org/311827 | 04:32 |
| stevemar | hmmm, i was using oslo.encodeutils in my dev env, in the same spots you highlighted :O | 04:33 |
| stevemar | i never got around to updating fakeldap :) | 04:34 |
| *** stingaci has quit IRC | 04:34 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add oauth plugin to keystoneauth https://review.openstack.org/314401 | 04:34 |
| stevemar | i was using https://github.com/openstack/oslo.utils/blob/master/oslo_utils/encodeutils.py#L107-L121 | 04:35 |
| crinkle | aha | 04:36 |
| stevemar | crinkle: i'll pull it down and use it against our internal ldap and see what blows up :) | 04:38 |
| crinkle | stevemar: awesome | 04:38 |
| *** sheel has joined #openstack-keystone | 04:44 | |
| stevemar | crinkle: py34 passes :) i may tinker with it a bit more to see if the osloutils stuff works, and to clean up the pep8 fail | 04:45 |
| crinkle | stevemar: coolbeans | 04:47 |
| *** sdake has quit IRC | 05:06 | |
| *** dan_nguyen has quit IRC | 05:07 | |
| *** roxanagh_ has joined #openstack-keystone | 05:08 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/314358 | 05:09 |
| *** spzala has quit IRC | 05:12 | |
| *** spzala has joined #openstack-keystone | 05:14 | |
| *** spzala has quit IRC | 05:19 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/314357 | 05:20 |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/314333 | 05:27 |
| *** roxanagh_ has quit IRC | 05:42 | |
| *** d0ugal has joined #openstack-keystone | 05:52 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/314356 | 06:01 |
| *** spandhe has quit IRC | 06:04 | |
| *** spzala has joined #openstack-keystone | 06:15 | |
| *** spzala has quit IRC | 06:21 | |
| *** rcernin has joined #openstack-keystone | 06:26 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/314372 | 06:28 |
| *** yolanda has joined #openstack-keystone | 06:35 | |
| *** edtubill has quit IRC | 06:48 | |
| *** roxanagh_ has joined #openstack-keystone | 07:00 | |
| *** jed56 has joined #openstack-keystone | 07:00 | |
| *** tesseract has joined #openstack-keystone | 07:03 | |
| *** jamielennox is now known as jamielennox|away | 07:08 | |
| *** yolanda has quit IRC | 07:22 | |
| *** d0ugal has quit IRC | 07:23 | |
| *** d0ugal has joined #openstack-keystone | 07:26 | |
| *** d0ugal has quit IRC | 07:26 | |
| *** d0ugal has joined #openstack-keystone | 07:26 | |
| *** yolanda has joined #openstack-keystone | 07:27 | |
| *** roxanagh_ has quit IRC | 07:33 | |
| *** josecastroleon has joined #openstack-keystone | 07:34 | |
| *** jamielennox|away is now known as jamielennox | 07:49 | |
| *** yolanda has quit IRC | 07:50 | |
| *** belmoreira has joined #openstack-keystone | 07:51 | |
| *** yolanda has joined #openstack-keystone | 07:58 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** jaosorior has joined #openstack-keystone | 08:01 | |
| *** woodburn has quit IRC | 08:09 | |
| *** woodburn has joined #openstack-keystone | 08:13 | |
| *** mvk has quit IRC | 08:16 | |
| *** spzala has joined #openstack-keystone | 08:18 | |
| *** spzala has quit IRC | 08:22 | |
| *** daemontool__ is now known as daemontool | 08:30 | |
| *** jistr has joined #openstack-keystone | 08:37 | |
| *** mvk has joined #openstack-keystone | 08:45 | |
| *** roxanagh_ has joined #openstack-keystone | 08:51 | |
| *** vnogin has joined #openstack-keystone | 08:55 | |
| *** danielh has joined #openstack-keystone | 08:58 | |
| *** TxGVNN has quit IRC | 08:59 | |
| *** TxGVNN has joined #openstack-keystone | 08:59 | |
| *** sdake has joined #openstack-keystone | 09:01 | |
| *** woodburn has quit IRC | 09:13 | |
| *** woodburn has joined #openstack-keystone | 09:14 | |
| *** spzala has joined #openstack-keystone | 09:19 | |
| *** spzala has quit IRC | 09:24 | |
| *** roxanagh_ has quit IRC | 09:25 | |
| *** daemontool has quit IRC | 09:28 | |
| *** chlong has quit IRC | 09:30 | |
| *** zqfan has quit IRC | 09:33 | |
| *** mvk has quit IRC | 10:03 | |
| *** mvk has joined #openstack-keystone | 10:04 | |
| *** daemontool has joined #openstack-keystone | 10:08 | |
| *** jaosorior has quit IRC | 10:09 | |
| *** jaosorior has joined #openstack-keystone | 10:09 | |
| *** spzala has joined #openstack-keystone | 10:20 | |
| *** spzala has quit IRC | 10:24 | |
| *** EinstCra_ has quit IRC | 10:30 | |
| *** EinstCrazy has joined #openstack-keystone | 10:31 | |
| *** EinstCrazy has quit IRC | 10:35 | |
| *** sdake has quit IRC | 10:42 | |
| *** roxanagh_ has joined #openstack-keystone | 10:42 | |
| openstackgerrit | Pallavi proposed openstack/keystone-specs: Added missed double quote https://review.openstack.org/314498 | 10:44 |
| jamielennox | stevemar: nothing on the meeting agenda for tomorrow so i'm sleeping in | 10:48 |
| *** rodrigods has quit IRC | 10:49 | |
| *** rodrigods has joined #openstack-keystone | 10:49 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Honor ldap_filter on filtered user list https://review.openstack.org/312126 | 10:50 |
| *** sdake has joined #openstack-keystone | 11:07 | |
| openstackgerrit | Merged openstack/keystone-specs: Added missed double quote https://review.openstack.org/314498 | 11:10 |
| *** roxanagh_ has quit IRC | 11:15 | |
| *** dims has quit IRC | 11:20 | |
| *** jaosorior has quit IRC | 11:20 | |
| *** jaosorior has joined #openstack-keystone | 11:20 | |
| *** spzala has joined #openstack-keystone | 11:20 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:24 | |
| *** dims has joined #openstack-keystone | 11:25 | |
| *** spzala has quit IRC | 11:25 | |
| *** gordc has joined #openstack-keystone | 11:26 | |
| *** TxGVNN has quit IRC | 11:36 | |
| *** jaosorior has quit IRC | 11:42 | |
| *** jaosorior has joined #openstack-keystone | 11:43 | |
| *** sdake has quit IRC | 11:56 | |
| *** sdake has joined #openstack-keystone | 12:02 | |
| *** ozialien10 has quit IRC | 12:08 | |
| *** sdake_ has joined #openstack-keystone | 12:08 | |
| *** ozialien10 has joined #openstack-keystone | 12:09 | |
| *** sdake has quit IRC | 12:11 | |
| *** yolanda has quit IRC | 12:18 | |
| *** spzala has joined #openstack-keystone | 12:21 | |
| *** yolanda has joined #openstack-keystone | 12:22 | |
| *** spzala has quit IRC | 12:26 | |
| *** roxanagh_ has joined #openstack-keystone | 12:33 | |
| *** pauloewerton has joined #openstack-keystone | 12:50 | |
| *** edmondsw has joined #openstack-keystone | 12:55 | |
| *** EinstCrazy has joined #openstack-keystone | 12:57 | |
| *** julim has joined #openstack-keystone | 12:58 | |
| *** richm has joined #openstack-keystone | 13:00 | |
| *** dave-mccowan has joined #openstack-keystone | 13:03 | |
| *** roxanagh_ has quit IRC | 13:06 | |
| *** spzala has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: WIP/DNM Unified delegation assignment driver https://review.openstack.org/291318 | 13:11 |
| *** edmondsw has quit IRC | 13:11 | |
| dstanek | bknudson: i just responded to your concern about the shadow users changes | 13:19 |
| *** daemontool_ has joined #openstack-keystone | 13:21 | |
| *** spzala has quit IRC | 13:23 | |
| *** links has quit IRC | 13:23 | |
| bknudson | dstanek: see the comment in patch set 12: we will use it to shadow all backend identities | 13:24 |
| *** daemontool has quit IRC | 13:24 | |
| bknudson | It also breaks the keystone architecture to hav ethe shadow users SQL backend reuse the identity SQL models. | 13:25 |
| bknudson | I guess I don't see the point of having the shadow users SQL driver use the identity SQL driver models. Somebody might use a their own driver for either identity backend or shadow users backend. | 13:26 |
| dstanek | bknudson: i think that's because shadow users is a superset of the identity user backend | 13:29 |
| bknudson | to me this looks like it's just broken. | 13:30 |
| dstanek | i don't know what, if any, future plans exist to make the drivers more consistent | 13:30 |
| bknudson | why is the shadow user table in identity and not in shadow_backends ?? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n113 | 13:31 |
| dstanek | i don't think anything is broken, but it streteched the architecture a bit | 13:31 |
| dstanek | i guess it could be there but that would mean that the dependency goes both ways | 13:32 |
| bknudson | there can't be dependencies between drivers. that's the architecture. | 13:32 |
| bknudson | because you can replace the driver with a different implementation | 13:32 |
| bknudson | it would make more sense to have shadow users not even have a driver and always be sql. | 13:33 |
| dstanek | you could replace either the identity backend or the shadow users backend as it exists today | 13:33 |
| bknudson | and maybe it's ok to still do that since there's no way it would work otherwise | 13:33 |
| dstanek | if you don't use the identity sql driver the User tables are still used if you use the shadow users SQL driver | 13:34 |
| bknudson | how? | 13:38 |
| *** jsavak has joined #openstack-keystone | 13:40 | |
| *** edmondsw has joined #openstack-keystone | 13:41 | |
| *** mhickey has joined #openstack-keystone | 13:41 | |
| *** edtubill has joined #openstack-keystone | 13:42 | |
| bknudson | I don't see how the identity sql model code can work if I change out the shadow_backends sql driver for a different one. It's referring to tables that aren't getting set up: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n35 | 13:43 |
| bknudson | FederatedUser is only used by shadow_backends/sql.py, so not sure why it was ever in identity/backends/sql.py | 13:44 |
| *** rderose has joined #openstack-keystone | 13:45 | |
| bknudson | oh, there's a foreign key on it http://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/backends/sql.py#n38 | 13:45 |
| dstanek | it's a little funky | 13:51 |
| *** yolanda has quit IRC | 13:56 | |
| *** TxGVNN has joined #openstack-keystone | 13:56 | |
| *** ametts has joined #openstack-keystone | 13:58 | |
| *** tonytan4ever has joined #openstack-keystone | 13:59 | |
| *** afazekas has quit IRC | 14:01 | |
| *** afazekas has joined #openstack-keystone | 14:01 | |
| *** yolanda has joined #openstack-keystone | 14:01 | |
| *** jsavak has quit IRC | 14:02 | |
| *** jsavak has joined #openstack-keystone | 14:02 | |
| *** woodburn has quit IRC | 14:03 | |
| *** tonytan4ever has quit IRC | 14:03 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:04 | |
| *** TxGVNN has quit IRC | 14:09 | |
| *** woodburn has joined #openstack-keystone | 14:11 | |
| *** julim has quit IRC | 14:11 | |
| *** julim has joined #openstack-keystone | 14:12 | |
| *** jsavak has quit IRC | 14:16 | |
| *** dan_nguyen has joined #openstack-keystone | 14:16 | |
| *** jsavak has joined #openstack-keystone | 14:17 | |
| andreaf | hi - I'm looking for help on a trusts test failure I hit - anyone around who can help me? | 14:17 |
| *** dan_nguyen has quit IRC | 14:19 | |
| lbragstad | it doesn't look like our documenting in keystone-wsgi-admin and keystone-wgsi-public is correct http://cdn.pasteraw.com/bi4iygib70jv3p2dqonrarpvjbdy1ic | 14:21 |
| lbragstad | documentation* | 14:21 |
| *** phalmos has joined #openstack-keystone | 14:22 | |
| lbragstad | does anyone else get that issue? ^ | 14:23 |
| *** jaosorior has quit IRC | 14:24 | |
| *** dan_nguyen has joined #openstack-keystone | 14:26 | |
| *** jsavak has quit IRC | 14:30 | |
| *** jsavak has joined #openstack-keystone | 14:30 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:32 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:33 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 14:35 | |
| *** navid__ has joined #openstack-keystone | 14:35 | |
| *** pushkaru has joined #openstack-keystone | 14:37 | |
| *** navid_ has joined #openstack-keystone | 14:37 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:37 | |
| *** tellesnobrega_af is now known as tellesnobrega | 14:38 | |
| stevemar | lbragstad: what are you pointing out? | 14:39 |
| lbragstad | stevemar I can't specify a port to run on list the help says | 14:40 |
| lbragstad | --port 35357 doesn't work | 14:40 |
| lbragstad | even though the help says it's possible | 14:40 |
| *** belmoreira has quit IRC | 14:40 | |
| lbragstad | (unless i'm computering wrong) | 14:40 |
| stevemar | ohhh interesting | 14:40 |
| *** navid__ has quit IRC | 14:41 | |
| lbragstad | the same story for keystone-wsgi-public (because it's the same script) | 14:41 |
| *** spandhe has joined #openstack-keystone | 14:41 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 14:42 |
| *** jamie_h has joined #openstack-keystone | 14:42 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 14:45 |
| bknudson | lbragstad: you need https://review.openstack.org/#/c/296061/ | 14:46 |
| patchbot | bknudson: patch 296061 - openstack-dev/pbr - Fix wsgiref script use with oslo.config (MERGED) | 14:46 |
| bknudson | looks like it's not in a release yet -- http://git.openstack.org/cgit/openstack-dev/pbr/log/ | 14:47 |
| lbragstad | bknudson ah - i just rebuilt keystone on master so we must have to bump our version once it's released | 14:47 |
| rodrigods | for a federated user authenticate, we still need the role assignment entry in the keystone side, right? | 14:48 |
| *** ramishra_ has quit IRC | 14:49 | |
| rodrigods | dstanek, regarding https://review.openstack.org/#/c/311652/ | 14:51 |
| patchbot | rodrigods: patch 311652 - keystone - Replace revoke tree with linear search | 14:51 |
| rodrigods | see lbragstad previous comments | 14:51 |
| *** pcaruana has joined #openstack-keystone | 14:53 | |
| *** slberger has joined #openstack-keystone | 14:53 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:53 | |
| *** jorge_munoz has quit IRC | 14:54 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:54 | |
| *** rderose has quit IRC | 14:58 | |
| *** jsavak has quit IRC | 14:58 | |
| *** jsavak has joined #openstack-keystone | 14:59 | |
| *** navid__ has joined #openstack-keystone | 15:01 | |
| *** navid_ has quit IRC | 15:05 | |
| *** navid_ has joined #openstack-keystone | 15:05 | |
| *** rderose has joined #openstack-keystone | 15:06 | |
| *** navid_ has quit IRC | 15:07 | |
| *** gagehugo has joined #openstack-keystone | 15:07 | |
| *** navid__ has quit IRC | 15:08 | |
| *** navidp has joined #openstack-keystone | 15:09 | |
| *** mou1 has joined #openstack-keystone | 15:11 | |
| *** mou has quit IRC | 15:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 15:15 |
| *** mhickey has quit IRC | 15:15 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 15:17 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Update documentation to remove keystone-all https://review.openstack.org/314628 | 15:17 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Update documentation to remove keystone-all https://review.openstack.org/314628 | 15:20 |
| *** timcline has joined #openstack-keystone | 15:22 | |
| edtubill | rderose, stevemar: Hi, I haven't really worked on keystone too much and haven't really worked with multiple people on the same bp. Is there sometime of workflow you guys use? I'm not sure how co-authoring works. | 15:23 |
| stevemar | edtubill: review the code as if it were you own, and i can walk you through adding a follow on patch | 15:24 |
| stevemar | edtubill: try and stay in contact with rderose, see if you two can logically split the work, i can help you out with any git rebasing madness | 15:25 |
| edtubill | stevemar: ok thx | 15:25 |
| rderose | edtubill: feel free to create new patch re: db design | 15:26 |
| *** tellesnobrega is now known as tellesnobrega_af | 15:26 | |
| rderose | edtubill: but yeah, lets talk as well | 15:26 |
| stevemar | rderose: db design meaning the models and backend? | 15:26 |
| rderose | stevemar, edtubill: sorry, regarding db design for the PCI stuff | 15:27 |
| edtubill | rderose: yeah. I saw you already started on the migration scripts... I tested it on my local system. | 15:27 |
| stevemar | rderose: edtubill just make sure the two of you are on the same page about how the solution should look like... | 15:27 |
| stevemar | rderose: myself and edtubill had written out a straw man here: https://etherpad.openstack.org/p/keystone-newton-pci-dss | 15:27 |
| rderose | stevemar, edtubill: sounds good | 15:27 |
| rderose | stevemar: saw that; added a comment | 15:28 |
| stevemar | we can have a hangout to talk about splitting the work :) | 15:28 |
| stevemar | if rderose isn't having connectivity issues this time around :) | 15:28 |
| rderose | stevemar: yep, I figured once we agree on the db changes, we could start splitting the work | 15:28 |
| rderose | stevemar: :) | 15:29 |
| edtubill | stevemar, rderose: hangout sounds like a good idea. | 15:29 |
| rderose | stevemar: have you seen this patch: https://review.openstack.org/#/c/314284/? | 15:29 |
| patchbot | rderose: patch 314284 - keystone - WIP - Database changes to support PCI-DSS | 15:29 |
| stevemar | edtubill: point is, this shouldn't impact or slow you down... toss up whatever code you got when it's ready. and *review review review review review* | 15:29 |
| edtubill | rderose: I just put comments/questions on the patch. | 15:30 |
| rderose | edtubill: cool, I'll take a look | 15:30 |
| edtubill | stevemar, rderose: so I guess we should agree on the database and then split the work? I was going to look into where to put the config options. | 15:31 |
| rderose | edtubill: agree | 15:32 |
| *** navid_ has joined #openstack-keystone | 15:32 | |
| *** navidp has quit IRC | 15:35 | |
| *** pgbridge has joined #openstack-keystone | 15:35 | |
| stevemar | edtubill: working on the config options sounds like a good start | 15:36 |
| edtubill | stevemar: okay. | 15:37 |
| *** rderose has quit IRC | 15:38 | |
| arunkant | stevemar: Can you look into this review. https://review.openstack.org/#/c/279828/ . Trying to get attention on this for a while. | 15:40 |
| patchbot | arunkant: patch 279828 - keystonemiddleware - Adding audit middleware specific notification driv... | 15:40 |
| stevemar | arunkant: will do | 15:40 |
| *** woodster_ has joined #openstack-keystone | 15:46 | |
| *** tellesnobrega_af is now known as tellesnobrega | 15:47 | |
| *** sdake_ has quit IRC | 15:47 | |
| *** yolanda has quit IRC | 15:48 | |
| *** ktychkova_ has joined #openstack-keystone | 15:48 | |
| *** agrebennikov has joined #openstack-keystone | 15:49 | |
| *** sdake has joined #openstack-keystone | 15:50 | |
| *** ktychkova has quit IRC | 15:51 | |
| *** tesseract has quit IRC | 15:52 | |
| *** sdake_ has joined #openstack-keystone | 15:54 | |
| *** sdake has quit IRC | 15:57 | |
| *** erhudy has joined #openstack-keystone | 15:58 | |
| *** jsavak has quit IRC | 16:04 | |
| *** jsavak has joined #openstack-keystone | 16:05 | |
| *** ericksonsantos has joined #openstack-keystone | 16:06 | |
| *** rderose has joined #openstack-keystone | 16:08 | |
| *** zqfan has joined #openstack-keystone | 16:09 | |
| *** ramishra has joined #openstack-keystone | 16:11 | |
| *** daemontool_ has quit IRC | 16:13 | |
| *** spzala has joined #openstack-keystone | 16:14 | |
| *** TxGVNN has joined #openstack-keystone | 16:16 | |
| *** Raildo_ has joined #openstack-keystone | 16:24 | |
| *** fangxu has joined #openstack-keystone | 16:26 | |
| *** tqtran has joined #openstack-keystone | 16:26 | |
| *** stingaci has joined #openstack-keystone | 16:31 | |
| *** ksavich has joined #openstack-keystone | 16:34 | |
| *** sdake_ is now known as sdake | 16:38 | |
| lbragstad | stevemar looks like https://bugs.launchpad.net/keystone/+bug/1523664 affects stable/liberty, do we want to backport the fix? | 16:39 |
| openstack | Launchpad bug 1523664 in OpenStack Identity (keystone) "Token operations fail when fernet key repository isn't writeable" [Undecided,Fix released] - Assigned to Ron De Rose (ronald-de-rose) | 16:39 |
| stevemar | lbragstad: sure, makes sense to do so | 16:40 |
| lbragstad | cc ksavich ^ | 16:40 |
| ksavich | awesome | 16:41 |
| lbragstad | stevemar updated https://bugs.launchpad.net/keystone/+bug/1523664 | 16:42 |
| openstack | Launchpad bug 1523664 in OpenStack Identity (keystone) "Token operations fail when fernet key repository isn't writeable" [Undecided,Fix released] - Assigned to Ron De Rose (ronald-de-rose) | 16:42 |
| *** mou1 has quit IRC | 16:42 | |
| lbragstad | stevemar ksavich posted https://review.openstack.org/#/c/314672/ | 16:42 |
| patchbot | lbragstad: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 16:42 |
| *** EinstCrazy has quit IRC | 16:42 | |
| lbragstad | ksavich good find | 16:42 |
| ksavich | was ayoung and nkinder really | 16:43 |
| edtubill | stevemar: I made some config changes to keystone for compliance and I want to push it up. I tried setting the branch to /bp/pci-dss (same as rderose's) but I'm getting: "failed to push some refs" because it's missing the change-id. Am I missing something? Am I supposed to pull down the previous code and put a commit on top of that? | 16:43 |
| ayoung | fernet repo should not be writable | 16:43 |
| *** rbridgeman has joined #openstack-keystone | 16:43 | |
| lbragstad | ayoung yeah - looks like we fixed that in mitaka but never backported the fix | 16:43 |
| ayoung | Ah | 16:44 |
| dstanek | edtubill: a missing change id sounds like git-review isn't setup | 16:44 |
| lbragstad | ayoung backport here https://review.openstack.org/#/c/314672/ | 16:44 |
| patchbot | lbragstad: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 16:44 |
| rderose | edtubill: were you trying to put a patch on top of my patch or a new patch? | 16:44 |
| edtubill | dstanek: I've been able to to do it before, maybe I'll check the settings again. | 16:44 |
| edtubill | rderose: I was trying to push up a new patch. | 16:45 |
| ayoung | ksavich, nice work. | 16:45 |
| ksavich | ayoung - np, thanks for your help | 16:45 |
| *** flaper87 has quit IRC | 16:46 | |
| *** flaper87 has joined #openstack-keystone | 16:46 | |
| morgan | stevemar: going through and doing lots of keystone reviews today FYI, expect to see a bunch of things hit (i'm hoping to review every open patch for our projects today) | 16:46 |
| edtubill | dstanek: it seems `git review -s` doesn't throw an error | 16:46 |
| dstanek | edtubill: it's very odd that it didn't add the change id for you | 16:47 |
| *** navidp has joined #openstack-keystone | 16:49 | |
| edtubill | dstanek: I'm thinking that I need to cherry pick my commit on top of rderose's branch. not sure what the workflow is. | 16:49 |
| dstanek | edtubill: i don't think that error means that | 16:50 |
| dstanek | edtubill: there may be a fancy way to do this, but you can just 'git review -d ####' and then chrrry-pick your commit | 16:51 |
| dstanek | edtubill: try making a simple change to master and see if you get the change id | 16:51 |
| *** navid_ has quit IRC | 16:52 | |
| edtubill | dstanek: It's a new patch on a new branch. | 16:52 |
| dstanek | also your .git/hooks/commit-msg should have code to add the change id | 16:52 |
| dstanek | edtubill: if you made the commit msg before you setup git-review then you can just edit the commit message to force it to add a chnage id | 16:53 |
| *** navid_ has joined #openstack-keystone | 16:53 | |
| *** rbridgeman has quit IRC | 16:54 | |
| *** navidp has quit IRC | 16:56 | |
| *** mvk has quit IRC | 16:57 | |
| openstackgerrit | Elvin Tubillara proposed openstack/keystone: WIP - Config changes to support PCI-DSS https://review.openstack.org/314679 | 16:58 |
| edtubill | dstanek: thanks! I guess I forgot to do git review -s for keystone :p | 16:58 |
| dstanek | edtubill: ah. :-) | 16:59 |
| *** jaugustine has joined #openstack-keystone | 17:00 | |
| *** daemontool_ has joined #openstack-keystone | 17:00 | |
| samueldmq | lbragstad: howdy, you available ? | 17:05 |
| samueldmq | lbragstad: quick question on patch 308088 | 17:05 |
| patchbot | samueldmq: https://review.openstack.org/#/c/308088/ - keystone - Separate protocol schema | 17:05 |
| samueldmq | lbragstad: other than that, it looks good to go :) | 17:05 |
| *** jsavak has quit IRC | 17:08 | |
| *** gagehugo has quit IRC | 17:18 | |
| *** gagehugo has joined #openstack-keystone | 17:19 | |
| *** BAKfr has quit IRC | 17:20 | |
| *** BAKfr has joined #openstack-keystone | 17:20 | |
| *** jistr has quit IRC | 17:21 | |
| *** stingaci has quit IRC | 17:23 | |
| *** daemontool_ has quit IRC | 17:25 | |
| *** navid_ has quit IRC | 17:26 | |
| stevemar | morgan: more power to you | 17:27 |
| morgan | stevemar: hehe. | 17:28 |
| stevemar | seems like no one wants to have meetings anymore!!? | 17:28 |
| morgan | nothing on the agenda again? | 17:28 |
| samueldmq | :( | 17:29 |
| samueldmq | does tha mean keystone is done? | 17:29 |
| samueldmq | that* :B | 17:30 |
| dstanek | stick a fork in it | 17:31 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Relax the project name uniqueness constraints https://review.openstack.org/310048 | 17:32 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script https://review.openstack.org/314244 | 17:32 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Relax the project name uniqueness constraints https://review.openstack.org/310048 | 17:34 |
| stevemar | morgan: samueldmq dstanek i added a few topics :) | 17:34 |
| samueldmq | stevemar: phew! thanks :) | 17:35 |
| *** eandersson has joined #openstack-keystone | 17:35 | |
| stevemar | morgan: if you're going through: https://review.openstack.org/#/c/314672/ | 17:36 |
| patchbot | stevemar: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 17:36 |
| morgan | stevemar: sure | 17:36 |
| morgan | i'm actually hitting every backlogged patchset as well | 17:37 |
| morgan | even if it is just a comment of "do we still need this?" | 17:37 |
| morgan | because the next round if no one answers some of those is abandon. | 17:37 |
| morgan | 155 open reviews and no movement on a number of them is too much | 17:37 |
| morgan | (keystone server) | 17:37 |
| stevemar | morgan: i appreciate you doing that | 17:37 |
| *** spandhe has quit IRC | 17:38 | |
| morgan | stevemar: gotta keep up holding a high review spot in keystone ;) | 17:38 |
| stevemar | morgan: i wouldn't know what that's like | 17:38 |
| morgan | stevemar: nope... | 17:39 |
| morgan | stevemar: never you... ever... EVAR | 17:39 |
| *** rderose has quit IRC | 17:40 | |
| *** rderose_ has joined #openstack-keystone | 17:40 | |
| stevemar | morgan: bknudson has the most keystone reviews of all time | 17:40 |
| stevemar | 4159 | 17:40 |
| stevemar | with dolphm not far behind | 17:40 |
| eandersson | Sorry back with question on upgrading from Kilo to Liberty again! | 17:41 |
| eandersson | The fernet token changes that happened, are those only related to the cached one (e.g. in memcached), or do they also affect the ones stored on disk? | 17:41 |
| eandersson | The padding changes in Liberty I believe. | 17:42 |
| dstanek | morgan: i have a bunch that i need to revisit | 17:42 |
| morgan | eandersson: fernet tokens are not stored to disk. | 17:43 |
| eandersson | sorry, the fernet keys | 17:43 |
| morgan | eandersson: the fernet keys themselves did not change | 17:43 |
| eandersson | perfect | 17:43 |
| morgan | just the tokens have no padding | 17:43 |
| eandersson | and the fernet tokens are stored in memcached right? | 17:43 |
| eandersson | or are they stored in mysql as well? | 17:43 |
| lbragstad | eandersson nope | 17:44 |
| lbragstad | they are not persisted in sql | 17:44 |
| stevemar | how can i tell if i'm running devstack under py3? i added "USE_PYTHON3=true" to my local.conf | 17:44 |
| *** neophy has joined #openstack-keystone | 17:46 | |
| dolphm | eandersson: fernet tokens are not stored at all. fernet keys, used to create and validate fernet tokens, are stored on disk. | 17:46 |
| *** shaleh has joined #openstack-keystone | 17:49 | |
| shaleh | dstanek: have you experiment with mypy any? | 17:50 |
| dstanek | shaleh: just a tiny bit before i started typist | 17:51 |
| shaleh | dstanek: I had not realized that python3 accepted type annotations but ignores them. | 17:52 |
| shaleh | def foo(a: int) -> int: return a + 1 | 17:52 |
| shaleh | that is totally valid Python3 today | 17:52 |
| dstanek | shaleh: they are not specifically for types - you can do other things too | 17:53 |
| dstanek | i wrote a blog post back in the day with a decorator that did the same thing for py2x | 17:53 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Relax the project name uniqueness constraints https://review.openstack.org/310048 | 17:53 |
| morgan | stevemar: punted the liberty fix through | 17:57 |
| *** rderose_ has quit IRC | 17:57 | |
| eandersson | dolphm: What I am trying to figure out is the least disruptive fix for the following error after a liberty upgrade http://paste.openstack.org/show/EjCP7wwSdDO6MzFWYvBx/ | 17:57 |
| eandersson | which sounds like simply restarting memcached? | 17:58 |
| *** henrynash has joined #openstack-keystone | 18:00 | |
| *** ChanServ sets mode: +v henrynash | 18:00 | |
| dolphm | eandersson: i don't think restarting memcached will help you there. that looks like a bug we solved back in stable/kilo? are you using the version of keystone in whatever stable/* branch you're on? | 18:00 |
| eandersson | That is after upgrading to liberty | 18:00 |
| *** jaugustine_ has joined #openstack-keystone | 18:01 | |
| dolphm | eandersson: but where are you starting from - an old version of kilo? | 18:01 |
| eandersson | 2015.1.0 | 18:01 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: review at own risk: switch to pyldap https://review.openstack.org/311827 | 18:01 |
| stevemar | oh noes! | 18:01 |
| dolphm | eandersson: you're missing lots of fernet bug fixes in 2015.1.1 and up. i imagine you wouldn't be seeing that at all if you had started from updated code :( | 18:02 |
| eandersson | Yea, so the plan is to go from 2015.1.0 to 2015.1.4 and then finally to Liberty | 18:02 |
| *** rderose has joined #openstack-keystone | 18:04 | |
| *** jaugustine has quit IRC | 18:04 | |
| *** stingaci has joined #openstack-keystone | 18:06 | |
| *** lhcheng has joined #openstack-keystone | 18:06 | |
| *** ChanServ sets mode: +v lhcheng | 18:06 | |
| *** tonytan4ever has joined #openstack-keystone | 18:07 | |
| *** jorge_munoz has quit IRC | 18:13 | |
| *** rcernin has quit IRC | 18:13 | |
| *** jorge_munoz has joined #openstack-keystone | 18:16 | |
| *** mvk has joined #openstack-keystone | 18:17 | |
| *** pushkaru has quit IRC | 18:18 | |
| *** navid_ has joined #openstack-keystone | 18:21 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Update documentation to remove keystone-all https://review.openstack.org/314628 | 18:22 |
| *** spzala has quit IRC | 18:23 | |
| *** spzala has joined #openstack-keystone | 18:23 | |
| *** spzala has quit IRC | 18:25 | |
| *** spzala has joined #openstack-keystone | 18:25 | |
| *** haplo37 has joined #openstack-keystone | 18:26 | |
| *** navid__ has joined #openstack-keystone | 18:31 | |
| *** gyee has joined #openstack-keystone | 18:34 | |
| *** ChanServ sets mode: +v gyee | 18:34 | |
| *** navid_ has quit IRC | 18:34 | |
| *** navid__ has quit IRC | 18:37 | |
| *** arunkant has quit IRC | 18:39 | |
| *** haplo37 has quit IRC | 18:40 | |
| *** gagehugo has quit IRC | 18:41 | |
| *** gagehugo has joined #openstack-keystone | 18:41 | |
| *** lhcheng has quit IRC | 18:42 | |
| *** lhcheng has joined #openstack-keystone | 18:42 | |
| *** verne.freenode.net sets mode: +v lhcheng | 18:42 | |
| *** rcernin has joined #openstack-keystone | 18:43 | |
| *** TxGVNN has quit IRC | 18:51 | |
| *** sdake has quit IRC | 18:52 | |
| *** pushkaru has joined #openstack-keystone | 18:53 | |
| stevemar | lbragstad: liberty gate is busted i think? | 18:53 |
| *** jaugustine_ has quit IRC | 18:56 | |
| morgan | stevemar: oh noes! | 18:59 |
| *** navidp has joined #openstack-keystone | 19:00 | |
| lbragstad | stevemar possibly? I didn't really investigate it | 19:00 |
| *** jaugustine has joined #openstack-keystone | 19:00 | |
| stevemar | lbragstad: the failure was with oslo policy raising an exception instead of true/false | 19:00 |
| stevemar | so think so | 19:00 |
| ayoung | dtroyer, why is the API version number returned not sufficient? | 19:01 |
| stevemar | bknudson: lbragstad: morgan i think we need to backport https://review.openstack.org/#/c/311804/ to mitaka and liberty | 19:01 |
| patchbot | stevemar: patch 311804 - keystone - Remove test_invalid_policy_raises_error (MERGED) | 19:01 |
| lbragstad | stevemar ah - does that mean stable/liberty is missing a dependency version or something? | 19:01 |
| morgan | stevemar: oh possibly | 19:01 |
| dtroyer | ayoung: it is… I thought I saw something about adding something without changing the version | 19:01 |
| stevemar | i proposed them, we'll see how it goes | 19:02 |
| bknudson | stevemar: are there failures? I didn't see anything posted to the stable status list? | 19:02 |
| bknudson | (probably because we're using upper-constraints?) | 19:02 |
| lbragstad | bknudson just this https://review.openstack.org/#/c/314672/ | 19:02 |
| patchbot | lbragstad: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 19:02 |
| stevemar | bknudson: https://review.openstack.org/#/c/314672/ | 19:02 |
| patchbot | stevemar: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 19:02 |
| bknudson | the damn coverage job! | 19:02 |
| bknudson | do we need that job on stable? seems like a waste. | 19:02 |
| ayoung | morgan, so, to be clear, lets say that henrynash 's change goes into 3.8. Is saying we hold the API version to 3.7 until it merges sufficient? | 19:03 |
| *** spandhe has joined #openstack-keystone | 19:03 | |
| rcernin | TakzeHm | 19:05 |
| morgan | ayoung: uhm.. each change i think is monotonic increase of api version | 19:06 |
| morgan | ayoung: we should conferr with dtroyer and sdague to be sure on the right way (consistent) of doing this in openstack | 19:07 |
| bknudson | I haven't looked at nova -- do they use flask or something better than the mess that we have in keystone? | 19:08 |
| ayoung | morgan, so, I guess I don't see why this is really any more of a change than adding a new API. We probably need to have ameans to approve a change to the API without giving it an explicit version until it is implemented, then bump the version assigned to the feature | 19:08 |
| bknudson | keystone doesn't currently support a way for the client to say "give me the 3.5 version of the API" | 19:08 |
| *** navidp has quit IRC | 19:09 | |
| dtroyer | the biggest change with microversions is mental. No more semver, and bumps happen more frequently for smaller reasons rather than batching them up | 19:09 |
| bknudson | we've hardly been able to handle supporting v2 and v3 together. | 19:10 |
| dtroyer | but you've handled 3.1, 3.2, 3.3, etc… | 19:11 |
| *** pcaruana has quit IRC | 19:12 | |
| bknudson | dtroyer: we don't handle them together. Once we go to 3.3 that's what the server supports for v3 | 19:12 |
| bknudson | See http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n312 | 19:12 |
| bknudson | we've got validate_v2_token and validate_v3_token | 19:13 |
| bknudson | now we'll have validate_v3_1_token , validate_v3_2_token | 19:13 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py#n358 | 19:13 |
| bknudson | issue_v3_1_token, issue_v3_2_token | 19:13 |
| *** jorge_munoz has quit IRC | 19:13 | |
| morgan | bknudson: i think we need to make "auth" paths special. | 19:14 |
| dtroyer | why? does that change every microversion? there is a difference between v2 and v3 almost _everywhere_. | 19:14 |
| morgan | even with microversions... as in explicitly excluded | 19:14 |
| bknudson | I'd be happy to see the auth paths versioned separately | 19:14 |
| bknudson | rather than have validate_v*_token there should be a single validate_token and the translation happens in the controller | 19:15 |
| dtroyer | morgan: I think you need to keep everything under the endpoint versioned, maybe this is what the 5000/35357 split _should_ have been? | 19:15 |
| *** jorge_munoz has joined #openstack-keystone | 19:16 | |
| ayoung | dtroyer, sortofbutnah? | 19:16 |
| ayoung | 5000/35357 was just immature | 19:16 |
| morgan | dtroyer: eh, maybe? | 19:16 |
| ayoung | it really needed to be two different interfaces: one internal one external. At least that was the intention way back when | 19:16 |
| morgan | dtroyer: well i mean, we *neveR* change the auth path | 19:16 |
| morgan | regardless of the microversion | 19:16 |
| morgan | an accepted convention because... *auth* | 19:16 |
| dtroyer | ayoung: from a versioning standpoint… if you want /tokens versioned separately, it should be a separate endpoint | 19:17 |
| morgan | dtroyer: i have a spec to move auth to /auth/ | 19:17 |
| morgan | dtroyer: instead of /v3/auth | 19:17 |
| morgan | dtroyer: and this is one of the many reasons for that | 19:17 |
| ayoung | dtroyer, auth versus managment of the identity Service? Yep | 19:17 |
| dtroyer | morgan: +++++ | 19:17 |
| morgan | dtroyer: and i was just going to wire /v3/auth up to the /auth routes internally. but it's a lot of code shuffle. | 19:18 |
| ayoung | morgan, yes! | 19:18 |
| ayoung | and since it is not under /v3, that, too will be an API break. | 19:18 |
| ayoung | Ugh. | 19:18 |
| morgan | dtroyer: it's on my "in my spare time" initiatives (might hack it out one monday night or something) | 19:18 |
| morgan | ayoung: we would keep the old routes | 19:18 |
| ayoung | Too late for coffee, to early for Beer | 19:18 |
| morgan | ayoung: just wire them up to the new code path(s) in a compat way | 19:19 |
| ayoung | "Just" is my trigger word | 19:19 |
| dtroyer | like 'smop' | 19:19 |
| bknudson | microaggression! | 19:19 |
| dtroyer | 'small matter of programming' | 19:19 |
| morgan | ayoung: if you look at the spec, it really already lined that up | 19:20 |
| *** jsavak has joined #openstack-keystone | 19:20 | |
| *** fangxu has quit IRC | 19:20 | |
| morgan | ayoung, dtroyer: http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/decouple-auth-from-api-version.html | 19:21 |
| dtroyer | morgan: that hit the things I would worry about (so far), looks good! | 19:23 |
| morgan | dtroyer: i spent a lot of tim thinking about that. | 19:24 |
| *** neophy has quit IRC | 19:24 | |
| dtroyer | mordred: so would you expect $AUTH_URL to include '/auth' at the end? | 19:25 |
| *** julim has quit IRC | 19:26 | |
| mordred | dtroyer: never | 19:26 |
| mordred | or, rather | 19:26 |
| mordred | I have never seen it include that | 19:26 |
| *** jaugustine_ has joined #openstack-keystone | 19:26 | |
| mordred | the BEST clouds give me auth_urls that don't have versions either | 19:26 |
| dtroyer | and duh, I meant morgan… but yeah, you'll have an opinion here too mordred ;) | 19:26 |
| mordred | :) | 19:26 |
| bknudson | would it be on /identity/auth or on /auth? | 19:26 |
| morgan | bknudson: it would be <prefix>/auth | 19:27 |
| dtroyer | I would want to use $AUTH_URL/auth to get the auth versions supported | 19:27 |
| dtroyer | and go from there | 19:27 |
| morgan | instead of /v3/auth | 19:27 |
| morgan | and i would make it support (if we do versioned auth) /auth/version/ | 19:28 |
| dtroyer | and it sounds like $AUTH_URL == $KEYSTONE_ENDPOINT still? | 19:28 |
| rodrigods | https://review.openstack.org/#/c/303471/ anyone willing to +A it? | 19:28 |
| patchbot | rodrigods: patch 303471 - keystone-specs - Add note about service provider fields | 19:28 |
| dtroyer | ie, '/' to the keystone server | 19:28 |
| *** jaugustine has quit IRC | 19:28 | |
| morgan | dtroyer: i also would make it discoverable on the JSON_home or / or whatever | 19:29 |
| bknudson | it would be easy enough to create another entrypoint for pbr for it and then make that available as /auth on apache | 19:29 |
| *** neophy has joined #openstack-keystone | 19:30 | |
| *** slberger1 has joined #openstack-keystone | 19:36 | |
| *** slberger has quit IRC | 19:36 | |
| morgan | bknudson: yeah that is one thought | 19:36 |
| morgan | bknudson: i'll propose moving that spec over to active by next week. | 19:36 |
| *** rcernin has quit IRC | 19:51 | |
| *** daemontool_ has joined #openstack-keystone | 19:51 | |
| stevemar | ayoung: did you just fork ldappool? https://github.com/admiyo/ldappool | 19:52 |
| ayoung | stevemar, I sure did! | 19:52 |
| stevemar | ayoung: i've been tweaking a fork in my github :) | 19:52 |
| ayoung | stevemar, setting up a venv to try and run the existing tests | 19:52 |
| stevemar | https://github.com/stevemart/ldappool | 19:52 |
| ayoung | stevemar, looking | 19:52 |
| stevemar | mine should be py3 friendly in about 2 seconds | 19:53 |
| stevemar | ayoung: and now master has py3 support (in my fork) | 19:53 |
| ayoung | how'd you test it? | 19:54 |
| *** rcernin has joined #openstack-keystone | 19:59 | |
| stevemar | ayoung: just ran nosetests so far | 20:00 |
| ayoung | stevemar, venv? | 20:00 |
| ayoung | OK...got it | 20:01 |
| stevemar | ayoung: haven't updated the ldappool unit tests, that's next on the list | 20:01 |
| ayoung | stevemar, so runmning tests against master using python 3.4 worked. I'm guessing the tests are useless? | 20:03 |
| ayoung | not against your master, the fork from the original | 20:03 |
| stevemar | ayoung: maybe not useless... but there certainly are not a lot of tests, | 20:04 |
| stevemar | whats that weird requirements syntax for using a repo instead of the latest version of something? | 20:05 |
| stevemar | maybe lbragstad knows, he did it for fernet tokens? | 20:06 |
| *** daemontool_ has quit IRC | 20:06 | |
| lbragstad | ? | 20:06 |
| stevemar | git+git://git.myproject.org/SomeProject#egg=SomeProject | 20:06 |
| bknudson | stevemar: you can just pip install -U to your venv | 20:06 |
| *** haplo37 has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: use forked ldappool + pyldap for ldap https://review.openstack.org/314755 | 20:24 |
| *** rderose has quit IRC | 20:25 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 20:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 20:31 |
| *** slberger has joined #openstack-keystone | 20:33 | |
| *** slberger1 has quit IRC | 20:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Database changes to support PCI-DSS https://review.openstack.org/314284 | 20:35 |
| stevemar | bknudson: looks like it's not allowed in setup.cfg: https://review.openstack.org/#/c/314755/1/setup.cfg :\ | 20:35 |
| patchbot | stevemar: patch 314755 - keystone - WIP: use forked ldappool + pyldap for ldap | 20:35 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration https://review.openstack.org/313141 | 20:35 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add authorize method to Enforcer https://review.openstack.org/313142 | 20:35 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script https://review.openstack.org/314244 | 20:36 |
| bknudson | stevemar: you are a nut! | 20:36 |
| stevemar | bknudson: never! | 20:37 |
| bknudson | what's it say? | 20:37 |
| bknudson | what's the error? | 20:37 |
| rcernin | while checking catalog list in Mitaka/Liberty, was there a change in openstack cli that handles --os-token << http://paste.openstack.org/show/496623/ >> unexpected keyword argument 'token' | 20:37 |
| stevemar | bknudson: "Invalid marker: '(//github.com/stevemart/ldappool.git)', parse error at '//github'" | 20:37 |
| stevemar | bknudson: and if i move it to test-reqs: "Could not satisfy constraints for 'ldappool': installation from path or url cannot be constrained to a version" | 20:38 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script https://review.openstack.org/314244 | 20:38 |
| bknudson | probably because it uses : for splitting out the version stuff: ldappool>=1.0:python_version=='2.7' | 20:39 |
| bknudson | so can't have a url with : in it. | 20:39 |
| bknudson | maybe there's a workaround | 20:39 |
| bknudson | quotes or something | 20:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: use forked ldappool + pyldap for ldap https://review.openstack.org/314755 | 20:41 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Database changes to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 20:42 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: New password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 20:43 |
| stevemar | bknudson: still failed with quotes | 20:44 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 20:44 |
| stevemar | morgan: looks like we got a reply :) | 20:45 |
| morgan | stevemar: cool | 20:45 |
| morgan | stevemar: just replied again | 20:49 |
| *** spzala has quit IRC | 20:50 | |
| stevemar | morgan: good news all around | 20:51 |
| stevemar | no need to fork or bring in tree :O | 20:51 |
| morgan | exactly | 20:51 |
| morgan | and we'll just import it into gerrit | 20:52 |
| morgan | i'll handle that as soon as he replies again. woot. | 20:52 |
| morgan | stevemar: this is all around great news for ldapool and us.. meakes it way easier. | 20:54 |
| *** spzala has joined #openstack-keystone | 20:54 | |
| morgan | cool. we should have that all up and in place maybe tomorrow | 20:54 |
| morgan | or at least proposed so infra can let it all in/happen :) | 20:55 |
| morgan | stevemar: do you want keystone-core to own it or a separate group? | 20:55 |
| * tellesnobrega is away: I'm busy | 20:55 | |
| stevemar | morgan: keystone-core sounds fair to me | 20:57 |
| morgan | stevemar: wfm | 20:57 |
| stevemar | we just gotta remember to not pull in oslo stuff | 20:58 |
| morgan | oh that's easy... | 20:58 |
| morgan | we'll make an in-tree hacking hceck to prevent that | 20:58 |
| stevemar | yep | 20:58 |
| stevemar | we can start looking at the old PRs that are open against it too | 20:58 |
| morgan | yar | 20:59 |
| morgan | like i said, i'll handle all of that as soon as we get the pypi bits transferred over | 20:59 |
| morgan | :) | 20:59 |
| morgan | hopefully tomorrow | 20:59 |
| * morgan likes when people ar ehappy to see their projects live on | 20:59 | |
| *** arunkant has joined #openstack-keystone | 20:59 | |
| *** vgridnev has joined #openstack-keystone | 20:59 | |
| *** spzala has quit IRC | 21:00 | |
| dstanek | stevemar: morgan: that's really good news | 21:02 |
| dstanek | is the license staying as-is then? | 21:02 |
| morgan | he offered to re-release as ASLv2 | 21:03 |
| morgan | i said that would be ideal, but happy to take it as is | 21:03 |
| ayoung | gyee, https://adam.younglogic.com/2016/05/logging-certmonger/ | 21:03 |
| bknudson | just saw this in a book I'm reading -- "A skipped test that remains skipped for too long is a bad smell." | 21:03 |
| stevemar | bknudson: probably smells like fish | 21:04 |
| stevemar | morgan: dstanek ASL would be aweomeo | 21:04 |
| *** rderose has joined #openstack-keystone | 21:06 | |
| *** jsavak has quit IRC | 21:08 | |
| *** spzala has joined #openstack-keystone | 21:09 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add helper methods for generating policy info https://review.openstack.org/314774 | 21:09 |
| dstanek | bknudson: which book is that? | 21:11 |
| stevemar | lbragstad: i rebased https://review.openstack.org/#/c/314672/2 on the oslo.policy fix for the gate | 21:11 |
| patchbot | stevemar: patch 314672 - keystone (stable/liberty) - Changed the key repo validation to allow read only | 21:11 |
| lbragstad | stevemar danke | 21:11 |
| bknudson | dstanek: Jenkins: The Definitive Guide | 21:12 |
| bknudson | last week it was learning ansible and vagrant, this week it's jenkins | 21:12 |
| bknudson | I couldn't figure out how to get vagrant to use libvirt... I guess there's a plugin but it didn't install easy on 14.04 | 21:13 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 21:13 |
| *** pauloewerton has quit IRC | 21:15 | |
| *** jaugustine_ has quit IRC | 21:15 | |
| dstanek | bknudson: cool, nice to stay edu-macated | 21:16 |
| bknudson | it's all stuff I should know | 21:16 |
| *** ametts has quit IRC | 21:17 | |
| *** phalmos has quit IRC | 21:21 | |
| *** jsavak has joined #openstack-keystone | 21:24 | |
| *** rderose has quit IRC | 21:29 | |
| *** rderose has joined #openstack-keystone | 21:30 | |
| stevemar | bknudson: i already assume you know everything | 21:32 |
| bknudson | not even close | 21:33 |
| stevemar | bknudson: i kinda thought you were a really advanced version of watson | 21:34 |
| *** daemontool_ has joined #openstack-keystone | 21:35 | |
| bknudson | http://techland.time.com/2011/02/16/why-did-watson-think-toronto-is-a-u-s-city-on-jeopardy/ | 21:35 |
| bknudson | I know some things watson doesn't | 21:35 |
| stevemar | hehe | 21:36 |
| andreaf | hi - sorry if I jump in the middle of a conversation, I'm looking for some help on trusts and token scope for this tempest patch - https://review.openstack.org/#/c/221020/32 - is anyone around who can help me? | 21:37 |
| patchbot | andreaf: patch 221020 - tempest - Use scope in v3 identity client | 21:37 |
| * stevemar tags in ayoung ^ | 21:38 | |
| ayoung | andreaf, I'll take a look | 21:38 |
| ayoung | oooh. um | 21:39 |
| stevemar | bknudson: so the answer to that jeaopardy question is chicago right | 21:39 |
| ayoung | andreaf, hold on a bit, though, I am helping someone else at the moment | 21:39 |
| ayoung | ping me in about 20 minutes if I don't context switch andreaf | 21:39 |
| stevemar | "Its largest airport is named for a World War II hero; its second largest, for a World War II battle" | 21:39 |
| andreaf | ayoung: ok, thanks | 21:39 |
| stevemar | toronto's 2 airports are named after ww2 folks | 21:40 |
| stevemar | easy to see why it was confused :P | 21:40 |
| bknudson | stevemar: midway is a battle. | 21:40 |
| bknudson | not sure who a'hare is | 21:40 |
| bknudson | o'hare is | 21:40 |
| bknudson | ayoung would know | 21:41 |
| *** rderose has quit IRC | 21:41 | |
| stevemar | bknudson: wiki says a ww2 ace! | 21:41 |
| *** henrynash has quit IRC | 21:42 | |
| stevemar | they dont go giving away "ace" designations to anyone | 21:42 |
| stevemar | probably comes with a cool jacket | 21:42 |
| lbragstad | kinda like that funny green jacket they hand out when people play golf | 21:42 |
| bknudson | I think it only takes 5 kills to be an ace | 21:43 |
| ayoung | only | 21:43 |
| lbragstad | i'd be lucky if i could figure out how to get in a fighter jet | 21:44 |
| ayoung | https://en.wikipedia.org/wiki/Edward_O'Hare | 21:44 |
| ayoung | the first naval recipient of the Medal of Honor in World War II. | 21:44 |
| *** gagehugo has quit IRC | 21:45 | |
| *** neophy has quit IRC | 21:45 | |
| bknudson | stevemar: wikipedia says pearson was a ww1 | 21:46 |
| *** edmondsw has quit IRC | 21:49 | |
| *** Ephur has quit IRC | 21:52 | |
| *** daemontool_ has quit IRC | 21:55 | |
| *** edtubill has quit IRC | 21:58 | |
| *** slberger has left #openstack-keystone | 22:01 | |
| andreaf | ayoung: is it now a better time? | 22:05 |
| ayoung | andreaf, sure. My coworker just gave up in disgust. | 22:05 |
| andreaf | upz | 22:05 |
| andreaf | I'm trying to teach Tempest how to use domain scoped tokens (or unscoped ones) | 22:06 |
| andreaf | as of now it only deals with project scoped ones, which is a limitation I'd like to remove | 22:06 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Update documentation to remove keystone-all https://review.openstack.org/314628 | 22:06 |
| andreaf | in doing that I came across two issues here https://review.openstack.org/#/c/221020/32 | 22:07 |
| patchbot | andreaf: patch 221020 - tempest - Use scope in v3 identity client | 22:07 |
| ayoung | andreaf, ok so | 22:07 |
| ayoung | andreaf, yeah...I wish domain scoped tokens would die in a fire | 22:08 |
| andreaf | ok, good to know - I guess that's because of domain now being a special type of project? | 22:08 |
| ayoung | This is a scary statement "Modify the v3 client managers used to obtain v3 admin idenity clients to always request the domain scope." | 22:08 |
| ayoung | andreaf, yes | 22:08 |
| *** shaleh has quit IRC | 22:08 | |
| ayoung | andreaf, but...lets assume they are here to stay. | 22:09 |
| andreaf | ayoung: well the way I'm implementing it is to have a default behaviour and then tests can always override the token scope | 22:09 |
| ayoung | so, you are saying that all of the APIs you are aclling require domains scoped tokens... | 22:10 |
| *** markvoelker_ has joined #openstack-keystone | 22:10 | |
| andreaf | like in https://review.openstack.org/#/c/221020/32/tempest/api/identity/admin/v3/test_trusts.py L271 | 22:10 |
| patchbot | andreaf: patch 221020 - tempest - Use scope in v3 identity client | 22:10 |
| ayoung | that might be true... | 22:10 |
| andreaf | ayoung: well it depends on the keystone policy really | 22:10 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:10 | |
| ayoung | But I don't think so | 22:10 |
| ayoung | right | 22:10 |
| andreaf | ayoung: in devstack it works fine with project scope | 22:10 |
| ayoung | so...users, and groups sure | 22:10 |
| ayoung | yeah but devstack uses base policy | 22:10 |
| andreaf | right | 22:12 |
| andreaf | still even with the default policy domain scoped tokens seems to work fine | 22:12 |
| andreaf | so it seems to me that using them would broaden the number of clouds that can be tested with tempest | 22:12 |
| ayoung | andreaf, it really depends on the policy file. If domain scoped work, it might be by accident | 22:13 |
| morgan | stevemar: i'm going to start punting a few things through the gate | 22:14 |
| morgan | stevemar: FYI | 22:14 |
| *** sheel has quit IRC | 22:15 | |
| andreaf | ayoung: well for instance listing trusts seems not to be working unless I set a project scope, but I get back 401, if it's a policy issue I would expect 403 | 22:15 |
| andreaf | which is why I need https://review.openstack.org/#/c/221020/32/tempest/api/identity/admin/v3/test_trusts.py L271, and I wanted to check with you if this makes sense | 22:16 |
| patchbot | andreaf: patch 221020 - tempest - Use scope in v3 identity client | 22:16 |
| andreaf | and the other issue I get is that on liberty all v3 admin tests fail when using domain scoped tokens, telling me that the user has no access to domain 'default' which is strange because I give them an admin role on the domain (which works in mitaka and newton) http://logs.openstack.org/20/221020/32/check/gate-tempest-dsvm-full-liberty/3ba83e2/logs/testr_results.html.gz | 22:18 |
| andreaf | ayoung: ^^^ | 22:20 |
| *** sdake has joined #openstack-keystone | 22:22 | |
| morgan | zzzeek: ping - re dogpile things | 22:23 |
| morgan | zzzeek: would like to get your read on the kwargs keygen and the merge dogpile.core in PRs | 22:23 |
| *** haplo37 has quit IRC | 22:24 | |
| *** pgbridge has quit IRC | 22:25 | |
| zzzeek | morgan: it's a little late for me here and i have to run some errands....but also i havent gotten the openstack CI going due to taht keystone error | 22:30 |
| zzzeek | bbl.. | 22:30 |
| morgan | zzzeek: ah nod. i promised i'd look at that too | 22:30 |
| *** markvoelker_ has quit IRC | 22:32 | |
| gyee | ayoung, so on my ubuntu trusty boyx, 'getcert add-ca' says not supported | 22:33 |
| gyee | doesn't appear 'add-ca' is a supported option for getcert | 22:33 |
| gyee | I am testing out my helper script, its much easier than I thought | 22:34 |
| *** gordc has quit IRC | 22:34 | |
| ayoung | gyee, getcert-add-ca | 22:37 |
| ayoung | all one command | 22:37 |
| ayoung | er for the man page | 22:37 |
| ayoung | and maybe that is not installed on your box? | 22:38 |
| *** raildo is now known as raildo-afk | 22:38 | |
| *** pgbridge has joined #openstack-keystone | 22:38 | |
| ayoung | hmmm | 22:39 |
| gyee | ok, the doc is outdated then | 22:39 |
| ayoung | gyee, maybe getcert -s add-ca for doing it as session | 22:39 |
| ayoung | it has to be there...its old code | 22:39 |
| gyee | getcert add-ca -c CAName /path/to/helper/script | 22:40 |
| gyee | that's according to the doc | 22:40 |
| ayoung | getcert add-ca -c remoter -e /home/ayoung/bin/remote_certmonger.sh | 22:40 |
| ayoung | Insufficient access. Please retry operation as root. | 22:40 |
| ayoung | -e | 22:40 |
| gyee | right | 22:40 |
| gyee | which version of certmonger are you using? | 22:41 |
| ayoung | certmonger-0.78.4-1.fc23.x86_64 | 22:41 |
| gyee | sudo getcert add-ca -c Test -p /home/gyee/anchor.py | 22:42 |
| gyee | add-ca: unrecognized command | 22:42 |
| ayoung | gyee, what version are you running? | 22:42 |
| gyee | 0.74 | 22:42 |
| ayoung | gyee, it might be that in older versions you were expected to edit the files by hand | 22:43 |
| gyee | I got certmonger from apt-get | 22:43 |
| *** edtubill has joined #openstack-keystone | 22:44 | |
| ayoung | gyee, git blame shows that went in | 22:44 |
| ayoung | 75153e03 (Nalin Dahyabhai 2015-04-23 17:18:18 -0400 4336) help(argv0, "add-ca"); | 22:44 |
| ayoung | so it is possible .74 predates it | 22:45 |
| gyee | maybe apt-get repo is way out of date? | 22:45 |
| ayoung | but it looks like that was popt | 22:45 |
| ayoung | possible | 22:45 |
| ayoung | gyee, you can probably edit the files by hand, and then restart certmonger and see the changes | 22:46 |
| ayoung | just clone one of the other ones | 22:46 |
| gyee | yeah, I can try that next | 22:46 |
| gyee | just need to go through it once, then automate the steps in devstack | 22:46 |
| ayoung | for session they are in ~/.config/certmonger/cas/ | 22:46 |
| ayoung | gyee, maybe there is another .deb you need. check in apt-cache | 22:46 |
| ayoung | although...that seems strnage.. | 22:47 |
| ayoung | gyee, ok yeah, 74 is kindof old | 22:47 |
| ayoung | 2014-6-6 | 22:48 |
| ayoung | last commit in 0.74.94 | 22:48 |
| gyee | do I need to point to a different repo? | 22:48 |
| ayoung | gyee, is there an update for ubuntu? Maybe. But lets work with what we get out of the box, and worry about upgrade later | 22:49 |
| gyee | k | 22:49 |
| ayoung | gyee, commit 280f97ac70d769ff68b919e4ebd513af01df3179 | 22:50 |
| ayoung | Author: Nalin Dahyabhai <nalin@redhat.com> | 22:50 |
| ayoung | Date: Tue Feb 24 16:41:06 2015 -0500 | 22:50 |
| ayoung | Add getcert add-ca/add-scep-ca/modify-ca/remove-ca | 22:50 |
| ayoung | so, yeah, that stuff was added afterwards. Its nice housecleaning stuff, but not essential | 22:50 |
| gyee | does getcert has to be executed with sudo? for devstack, it should be local user right? | 22:51 |
| ayoung | gyee, I think is should be as a local user, which means session, but lets make sure that Ubuntu supports that | 22:55 |
| ayoung | it uses dbus...let me see... | 22:55 |
| ayoung | gyee, http://adam.younglogic.com/2014/03/certmonger-session/ | 22:55 |
| ayoung | export DBUS_SESSION_BUS_ADDRESS=`dbus-daemon --session --fork --print-address` | 22:56 |
| morgan | stevemar: did we kill the materialized path thing? | 22:56 |
| ayoung | then getcert list-cas -s | 22:56 |
| ayoung | morgan, yes | 22:56 |
| ayoung | morgan, its not dead dead, just mostly dead | 22:56 |
| *** edtubill has quit IRC | 22:56 | |
| ayoung | so, not yet time to go through its pockets looking for spare change | 22:56 |
| morgan | so 251455 is dead? | 22:57 |
| morgan | erm patch 251455 | 22:57 |
| patchbot | morgan: https://review.openstack.org/#/c/251455/ - keystone - Materialized path convenience wrapper | 22:57 |
| ayoung | morgan, yeah | 22:57 |
| morgan | ok | 22:57 |
| ayoung | morgan, we see it as a performance tune we can go to if desperately needed, but do not expect it to be so | 22:57 |
| ayoung | morgan, I suspect it is something we could do better in the caching layer | 22:58 |
| morgan | ayoung: i am just administratively abandoning it for now. | 22:59 |
| *** edtubill has joined #openstack-keystone | 22:59 | |
| gyee | "administratively abandoning" sounds like good band name :-) | 23:00 |
| ayoung | gyee, so you are working on a certmonger helper app for Anchor? | 23:02 |
| gyee | ayoung, yet, code is pretty trivial | 23:03 |
| gyee | just a single http request, no polling | 23:03 |
| ayoung | gyee, cool. | 23:03 |
| ayoung | gyee, it automatically creates the cert, and does not store it localling in the anchor server, right? | 23:03 |
| *** tonytan4ever has quit IRC | 23:03 | |
| gyee | my plan is to get it working locally, then figure out how to do it in devstack | 23:03 |
| gyee | http request return the cert in the payload | 23:04 |
| gyee | certmonger generates the CSR | 23:04 |
| gyee | all I have to do is POST the CSR to Anchor | 23:04 |
| *** edtubill has quit IRC | 23:05 | |
| gyee | we also need to figure out bootstrapping as Anchor can authenticate using a local username/password, LDAP, or Keystone | 23:05 |
| gyee | anyway, baby steps :-) | 23:05 |
| *** edtubill has joined #openstack-keystone | 23:07 | |
| *** jamielennox is now known as jamielennox|away | 23:13 | |
| *** edtubill has quit IRC | 23:14 | |
| *** d0ugal has quit IRC | 23:21 | |
| *** jamielennox|away is now known as jamielennox | 23:21 | |
| jamielennox | ayoung: left a response on https://review.openstack.org/#/c/312323/ | 23:23 |
| patchbot | jamielennox: patch 312323 - keystone - Always add is_admin_project if admin project defined | 23:23 |
| jamielennox | ayoung: because we default to True if nothing is set then always setting True in the token doesn't actually buy us anything new | 23:23 |
| jamielennox | (and if they came across twice it's cause i got disconnected and weren't sure they got sent) | 23:23 |
| stevemar | bknudson: yep, my mistake, pearson and billy bishop were both ww1 | 23:23 |
| *** timcline has quit IRC | 23:24 | |
| *** ChanServ sets mode: +o morgan | 23:26 | |
| *** jsavak has quit IRC | 23:28 | |
| *** morgan changes topic to "Keystone Midcycle Update: http://lists.openstack.org/pipermail/openstack-dev/2016-May/094574.html | Hosted By Cicso, July 20-22, 170 W Tasman Dr, San Jose, CA 95134" | 23:28 | |
| *** furface has joined #openstack-keystone | 23:28 | |
| *** rcernin has quit IRC | 23:28 | |
| *** morgan sets mode: -o morgan | 23:28 | |
| morgan | stevemar: ^ | 23:29 |
| *** sdake has quit IRC | 23:30 | |
| *** spandhe has quit IRC | 23:36 | |
| *** d0ugal has joined #openstack-keystone | 23:36 | |
| *** spandhe has joined #openstack-keystone | 23:38 | |
| *** sdake has joined #openstack-keystone | 23:38 | |
| *** dan_nguyen has quit IRC | 23:40 | |
| *** roxanaghe has quit IRC | 23:46 | |
| ayoung | jamielennox, it does. It buys us the ability to turn off "is_admin_project" once the policy files are rewritten | 23:49 |
| morgan | stevemar: omg. 158 open reviews in openstack-keystone (reviewed down to 80ish) | 23:49 |
| morgan | stevemar: ^_^ | 23:49 |
| jamielennox | ayoung: i don't follow, when do we expect to turn that off? | 23:50 |
| ayoung | jamielennox, during an actual live deployment | 23:50 |
| ayoung | jamielennox, we can drop "always add" in about 2 cycles | 23:50 |
| ayoung | jamielennox, look at why this review failed | 23:51 |
| ayoung | https://review.openstack.org/#/c/257636/ | 23:51 |
| patchbot | ayoung: patch 257636 - keystone - Add is_admin_project check to policy.json | 23:51 |
| jamielennox | ayoung: gah, that's because you are going direct to the token | 23:51 |
| ayoung | jamielennox, nope | 23:51 |
| jamielennox | ayoung: keystone is the only service that does that and it shouldn't | 23:52 |
| ayoung | jamielennox, its because everything expects that policy file to continue working | 23:52 |
| ayoung | jamielennox, right..and we can deal with that, too | 23:52 |
| ayoung | but that is not the issue | 23:52 |
| jamielennox | ayoung: so the way services should deal with this is auth_token middleware sets an X_IS_ADMIN_PROJECT flag in headers | 23:52 |
| *** edtubill has joined #openstack-keystone | 23:52 | |
| jamielennox | because we tell the services not to inspect the token directly | 23:52 |
| ayoung | jamielennox, sure, that is fine, and we can get that to work | 23:52 |
| ayoung | so we do that | 23:53 |
| jamielennox | auth_token middleware relies on keystoneauth | 23:53 |
| *** edtubill has quit IRC | 23:53 | |
| ayoung | jamielennox, I'm with you 100% on the context stuff | 23:53 |
| jamielennox | this https://review.openstack.org/#/c/314409/1/keystoneauth1/access/access.py | 23:53 |
| patchbot | jamielennox: patch 314409 - keystoneauth - Expose is_admin_project in AccessInfo | 23:53 |
| ayoung | none of that is the issue yet | 23:53 |
| jamielennox | defaults to True if not set | 23:53 |
| jamielennox | so the problem is the way you're trying to implement it in policy, not that it's unset | 23:53 |
| ayoung | ah...ok, so you were doing the same thing, just in a different layer | 23:54 |
| ayoung | the next effect would have been the same | 23:54 |
| jamielennox | ayoung: there is a sequence to this stuff :) | 23:54 |
| jamielennox | for non-keystone projects anyway | 23:54 |
| jamielennox | though my use auth_token in keystone patch got +Aed so maybe we can make keystone behave nicely soon as well | 23:54 |
| ayoung | jamielennox, ok, we have the same target, just coming from different directions | 23:55 |
| *** fangxu has joined #openstack-keystone | 23:55 | |
| jamielennox | ayoung: yep, just that oslo.policy assumes a missing value to be False where you need it to be true | 23:55 |
| *** crinkle has quit IRC | 23:55 | |
| ayoung | jamielennox, I see where you are going. I'll let you drive, but we need to fix cloudsample, too then | 23:55 |
| ayoung | OK...that will work | 23:55 |
| jamielennox | ayoung: well we need to pass is_admin_project as a specific value, rather than using oslo.policy to pull random fields out of a token | 23:56 |
| *** chlong has joined #openstack-keystone | 23:56 | |
| ayoung | jamielennox, I just +2Aed your patch | 23:57 |
| jamielennox | ayoung: thank you sir | 23:57 |
| ayoung | https://review.openstack.org/#/c/312323/2 | 23:57 |
| patchbot | ayoung: patch 312323 - keystone - Always add is_admin_project if admin project defined | 23:57 |
| *** pumarani__ has joined #openstack-keystone | 23:57 | |
| ayoung | jamielennox, I might need to make a T-Shirt for you. | 23:58 |
| jamielennox | ayoung: heh, it's proving difficult and we haven't got to the point of figuring out where horizon or anything breaks yet :) | 23:58 |
| *** pushkaru has quit IRC | 23:59 | |
| ayoung | Let's get a full solution implemented in Keystone. | 23:59 |
| jamielennox | ayoung: also i looked at rippowam again because i want to figure out what is happening with the saml and kerberos plugins and i'm not sure if i can still use it, there's a few overcloud/undercloud references that seem specific to new stuff | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!