| gyee | no need | 00:00 |
|---|---|---|
| notmorgan | ope | 00:01 |
| *** pushkaru has quit IRC | 00:01 | |
| notmorgan | nope | 00:01 |
| notmorgan | still fails in the same way | 00:01 |
| notmorgan | the test is *really* opaque | 00:01 |
| gyee | wth? it works on python-openstackclient | 00:01 |
| notmorgan | this is failing with a 401 in our unit test | 00:01 |
| notmorgan | passes py27 just fine.. something is wonky | 00:02 |
| *** lhcheng_ has quit IRC | 00:02 | |
| notmorgan | our unit test is bad. | 00:02 |
| notmorgan | is what it looks like | 00:02 |
| notmorgan | but i don't know how it is bad... or if something in keysotne server is erroring silently | 00:02 |
| notmorgan | because i love our opaque restfultestcase | 00:02 |
| notmorgan | gyee: this is the failure: http://paste.openstack.org/show/497630/ | 00:03 |
| notmorgan | and all 4 fail in the same way | 00:03 |
| notmorgan | each time | 00:03 |
| *** jamielennox is now known as jamielennox|away | 00:04 | |
| *** jamielennox|away is now known as jamielennox | 00:04 | |
| notmorgan | i'm guessing it's an issue in _generate_totp_passcode | 00:05 |
| notmorgan | not working right | 00:05 |
| * notmorgan sighs. | 00:05 | |
| *** diazjf has quit IRC | 00:05 | |
| *** ddieterly has joined #openstack-keystone | 00:06 | |
| gyee | let me try it locally | 00:06 |
| notmorgan | i am guessing in py3 totp.py is doing something different | 00:07 |
| *** gyee has quit IRC | 00:08 | |
| *** gyee has joined #openstack-keystone | 00:08 | |
| *** ChanServ sets mode: +v gyee | 00:08 | |
| *** harlowja_ has joined #openstack-keystone | 00:11 | |
| *** furface has joined #openstack-keystone | 00:13 | |
| *** sdake has quit IRC | 00:13 | |
| *** markvoelker has quit IRC | 00:13 | |
| *** harlowja has quit IRC | 00:15 | |
| dstanek | gyee: notmorgan: what are you guys trying to do with that craziness? | 00:16 |
| notmorgan | dstanek: trying to fix the last 4 tests so test_v3_auth is py3-able | 00:17 |
| *** iurygregory_ has joined #openstack-keystone | 00:17 | |
| notmorgan | dstanek: http://paste.openstack.org/show/497630/ is the failure | 00:17 |
| notmorgan | dstanek: https://review.openstack.org/#/c/318381/1 is the current state, 4 failures in | 00:17 |
| patchbot | notmorgan: patch 318381 - keystone - Enable py3 tests for test_v3_auth | 00:17 |
| notmorgan | keystone.tests.unit.test_v3_auth.TestAuthTOTP | 00:17 |
| *** iurygregory has quit IRC | 00:18 | |
| notmorgan | dstanek: also tried with blob = base64.b32encode(os.urandom(20)).decode('utf-8') | 00:20 |
| notmorgan | instead of the wacky encode/decode thing | 00:20 |
| notmorgan | and it fails in the same way | 00:20 |
| dstanek | notmorgan: do you have a traceback of what's happening in the service? | 00:20 |
| notmorgan | nope | 00:21 |
| notmorgan | no traceback as far as i know | 00:21 |
| notmorgan | 553452 | 00:21 |
| dstanek | notmorgan: running the tests now | 00:26 |
| *** raddaoui has quit IRC | 00:27 | |
| *** rderose has joined #openstack-keystone | 00:30 | |
| notmorgan | dstanek: ++ | 00:32 |
| gyee | dstanek, I am also running the tests | 00:33 |
| gyee | taking a long time | 00:33 |
| *** gyee has quit IRC | 00:34 | |
| notmorgan | dstanek: oh i ... uh think this might be an issue in the detection of the success case | 00:34 |
| notmorgan | because i see a token being issued | 00:34 |
| notmorgan | but still getting a 401 response | 00:34 |
| *** gyee has joined #openstack-keystone | 00:34 | |
| *** ChanServ sets mode: +v gyee | 00:34 | |
| *** stingaci has joined #openstack-keystone | 00:35 | |
| *** julim has joined #openstack-keystone | 00:35 | |
| dstanek | gyee: notmorgan: you guys probably already figured this out but, python setup.py testr --testr-args="--subunit keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_username_and_domain_id" | subunit-trace -f will run just a single test | 00:40 |
| notmorgan | dstanek: i'm just been using source .tox/.... and python -m testtools.run <test> | 00:42 |
| notmorgan | dstanek: since its the same env as tox runs that way | 00:42 |
| gyee | dstanek, nice! did tox used to be able to run a single test? | 00:43 |
| dstanek | gyee: yes, but i hacked it for the py34 tests. once we get them all working we can put it back the way it was | 00:44 |
| gyee | like tox -e py34 keystone.tests.unit.test_v3_auth.TestAuthTOTP.test_with_username_and_domain_id | 00:44 |
| dstanek | you can still run single tests on py27 though | 00:44 |
| gyee | I see | 00:44 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 00:45 | |
| *** stingaci has quit IRC | 00:45 | |
| *** julim has quit IRC | 00:49 | |
| gyee | dstanek, I got import error with the above command | 00:51 |
| *** ninag has joined #openstack-keystone | 00:57 | |
| openstackgerrit | Clenimar Filemon proposed openstack/keystoneauth: Add is_domain to keystoneauth token https://review.openstack.org/282377 | 00:59 |
| *** ninag has quit IRC | 01:02 | |
| *** rderose has quit IRC | 01:07 | |
| *** spzala has joined #openstack-keystone | 01:08 | |
| *** spzala has quit IRC | 01:08 | |
| *** spzala has joined #openstack-keystone | 01:08 | |
| *** lhcheng has joined #openstack-keystone | 01:12 | |
| *** ChanServ sets mode: +v lhcheng | 01:12 | |
| ayoung | samueldmq, notmorgan https://review.openstack.org/#/c/311652/ passes when I strip out the caching. | 01:13 |
| patchbot | ayoung: patch 311652 - keystone - Replace revoke tree with linear search | 01:13 |
| ayoung | notmorgan, how can we make progress here? | 01:13 |
| *** roxanaghe has joined #openstack-keystone | 01:24 | |
| *** doug-fish has joined #openstack-keystone | 01:24 | |
| notmorgan | ayoung: i'll poke at the caching stuff | 01:24 |
| notmorgan | ayoung: and see what we can do about it/ | 01:24 |
| notmorgan | ayoung: but if we don't pass with caching, it tells me we're making some really bad assumptions because the invalidates are as expected. | 01:25 |
| notmorgan | ayoung: my guess is we're asusming you can lookup the event list multiple times in a given request. | 01:25 |
| ayoung | notmorgan, that is probably the case in a validate | 01:25 |
| ayoung | service token gets one lookup | 01:25 |
| *** EinstCrazy has joined #openstack-keystone | 01:26 | |
| ayoung | then the token it is validating gets the second | 01:26 |
| ayoung | notmorgan, should we drive on to the database solution? | 01:26 |
| *** roxanaghe has quit IRC | 01:29 | |
| *** doug-fish has quit IRC | 01:29 | |
| notmorgan | ayoung: probably | 01:31 |
| notmorgan | ayoung: we can do it incrementally. | 01:31 |
| notmorgan | we probably still want caching | 01:31 |
| notmorgan | dstanek: any joy on those tests? | 01:31 |
| dstanek | notmorgan: certainly, but no fix just yet | 01:31 |
| ayoung | notmorgan, caching makes sense. if it is on a per token basis, then asking for data for the same token a second time goes to cache | 01:32 |
| *** ddieterly is now known as ddieterly[away] | 01:32 | |
| dstanek | so _to_content_type in keystone/tests/unit/rest.py takes the passcode from b'338484' to [34, 45, 56, ..] | 01:32 |
| ayoung | never need to worry about invalidating | 01:32 |
| *** ddieterly[away] has quit IRC | 01:32 | |
| dstanek | notmorgan: i think maybe our generate totp should just not return bytes, but i don't have the time to check yet | 01:33 |
| notmorgan | dstanek: yeah its... ugh | 01:33 |
| notmorgan | dstanek: i'll poke at that next | 01:34 |
| notmorgan | thanks | 01:34 |
| notmorgan | ayoung: uhm............. sure? | 01:34 |
| ayoung | notmorgan, can we merge the cacheless version, to get things working, and then drive on with optimizations? | 01:34 |
| ayoung | it gives a better baseline | 01:34 |
| *** skoude has quit IRC | 01:36 | |
| *** skoude has joined #openstack-keystone | 01:37 | |
| notmorgan | ayoung: if you prove it fixes the race | 01:44 |
| notmorgan | ayoung: otherwise i'd like to figure out where the race is first | 01:47 |
| notmorgan | dstanek: sigh | 01:59 |
| notmorgan | dstanek: yep... we can't return bytes from totp generate | 01:59 |
| notmorgan | FFFFFFfffffffff | 01:59 |
| notmorgan | fixes the bug | 01:59 |
| *** EinstCra_ has joined #openstack-keystone | 02:00 | |
| *** ngupta has joined #openstack-keystone | 02:00 | |
| *** EinstCrazy has quit IRC | 02:03 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 tests for test_v3_auth https://review.openstack.org/318381 | 02:03 |
| notmorgan | ^ dstanek 3/4 | 02:03 |
| *** tqtran has quit IRC | 02:09 | |
| *** tqtran has joined #openstack-keystone | 02:18 | |
| jamielennox | notmorgan: so how do i write a tc letter? | 02:19 |
| notmorgan | jamielennox: a tc what? | 02:20 |
| jamielennox | notmorgan: "it's no longer the gates problem if you don't default to keystone v3 in otaca" | 02:20 |
| notmorgan | oh.. uhm | 02:20 |
| notmorgan | ..... there is a way to do this | 02:21 |
| *** lhcheng has quit IRC | 02:22 | |
| notmorgan | jamielennox: sorry brain is ... braining | 02:23 |
| jamielennox | notmorgan: i'm not in a rush to write it :p | 02:23 |
| notmorgan | jamielennox: but in short send a message to the dev mailing list, tagged with [tc], explaining the stuff | 02:23 |
| notmorgan | jamielennox: and then propose a resolution to the governance directory (prob reference the resoltion review in the email) | 02:23 |
| jamielennox | oh - that all, i figured thered at least be a template | 02:23 |
| notmorgan | and be ready to show up at a TC meeting to discuss | 02:23 |
| notmorgan | look at other resolutions | 02:24 |
| notmorgan | would be what i'd do | 02:24 |
| stevemar | notmorgan: i think bknudson wanted to swap the uwsgi job for a proper apache+mod_proxy_uswgi job | 02:26 |
| notmorgan | stevemar: fair enough | 02:26 |
| stevemar | notmorgan: cause the uwsgi job just runs uwsgi instead of apache, and it's a poor excuse for a web server | 02:26 |
| *** tqtran has quit IRC | 02:26 | |
| notmorgan | yah | 02:27 |
| notmorgan | ok | 02:27 |
| *** ngupta has quit IRC | 02:29 | |
| jamielennox | looking at past resolutions v3 default doesn't really seem to be at the same point | 02:30 |
| *** BjoernT has joined #openstack-keystone | 02:32 | |
| notmorgan | jamielennox: write something up! | 02:32 |
| jamielennox | notmorgan: i'm trying my best to avoid it | 02:32 |
| *** links has joined #openstack-keystone | 02:35 | |
| jamielennox | going for lunch instead | 02:37 |
| openstackgerrit | Merged openstack/keystone: Make AuthContext depend on auth_token middleware https://review.openstack.org/255686 | 02:38 |
| notmorgan | lol | 02:39 |
| *** BjoernT has quit IRC | 02:39 | |
| *** otaciliofl has joined #openstack-keystone | 02:42 | |
| *** spzala has quit IRC | 02:43 | |
| *** spzala has joined #openstack-keystone | 02:43 | |
| *** spzala has quit IRC | 02:44 | |
| *** spzala has joined #openstack-keystone | 02:44 | |
| *** woodster_ has quit IRC | 02:48 | |
| *** EinstCra_ has quit IRC | 02:58 | |
| *** EinstCrazy has joined #openstack-keystone | 02:59 | |
| *** spzala has quit IRC | 03:03 | |
| *** adu has joined #openstack-keystone | 03:04 | |
| *** TxGVNN has joined #openstack-keystone | 03:06 | |
| *** ozialien10 has quit IRC | 03:18 | |
| *** ozialien10 has joined #openstack-keystone | 03:19 | |
| *** tqtran has joined #openstack-keystone | 03:23 | |
| *** lhcheng has joined #openstack-keystone | 03:25 | |
| *** ChanServ sets mode: +v lhcheng | 03:25 | |
| *** tqtran has quit IRC | 03:27 | |
| *** edtubill has joined #openstack-keystone | 03:29 | |
| jamielennox | holy crap that merged | 03:32 |
| jamielennox | i wonder if it broke anything | 03:32 |
| *** lhcheng_ has joined #openstack-keystone | 03:33 | |
| *** lhcheng has quit IRC | 03:36 | |
| *** richm has quit IRC | 03:43 | |
| stevemar | notmorgan: ah https://review.openstack.org/#/c/312061/ and https://review.openstack.org/#/c/318381/ are the same thing | 03:48 |
| patchbot | stevemar: patch 312061 - keystone - Port test_v3_auth unit test to Python 3 | 03:48 |
| patchbot | stevemar: patch 318381 - keystone - Enable py3 tests for test_v3_auth | 03:48 |
| notmorgan | stevemar: feel free to kilkl either one | 03:49 |
| notmorgan | stevemar: but i was just stacking up all the changes to get there | 03:49 |
| stevemar | yeah, looking at both | 03:49 |
| notmorgan | stevemar: btw... oauth1... :( | 03:49 |
| stevemar | notmorgan: ruh roh | 03:49 |
| stevemar | oh no, is the damn lib not py3?! | 03:49 |
| notmorgan | it's an uuuuuugly p3 port | 03:49 |
| notmorgan | no not the lib | 03:50 |
| stevemar | phew | 03:50 |
| notmorgan | our code is icky | 03:50 |
| stevemar | ugly i can deal with | 03:50 |
| notmorgan | lots of icky | 03:50 |
| stevemar | you mean *my* code | 03:50 |
| notmorgan | fixing py3 issues nets a tonne of notification bugs | 03:50 |
| stevemar | it's only community code when it's pretty | 03:50 |
| notmorgan | nope. not even your code | 03:50 |
| notmorgan | things built on your code post facto | 03:50 |
| stevemar | if it's ugly, "who wrote this?!' | 03:50 |
| notmorgan | so fwiw, my patch is a bit more surgical now than the previous on | 03:51 |
| notmorgan | one* | 03:52 |
| notmorgan | and i'm really hoping to solve the oauth1 tests soon | 03:52 |
| notmorgan | cause then we can update our classifiers to be py34 | 03:52 |
| notmorgan | :) | 03:52 |
| notmorgan | we're so very close | 03:52 |
| adu | py3 is great it's py2 that's ugly | 03:55 |
| adu | I use py2 at work, so I would know | 03:56 |
| *** edtubill has quit IRC | 04:00 | |
| *** links has quit IRC | 04:00 | |
| *** chlong has joined #openstack-keystone | 04:04 | |
| *** ninag has joined #openstack-keystone | 04:06 | |
| openstackgerrit | Tony Breeds proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 04:06 |
| jamielennox | tonyb: did something go wrong? ^ | 04:08 |
| *** edtubill has joined #openstack-keystone | 04:08 | |
| tonyb | jamielennox: No | 04:08 |
| tonyb | jamielennox: dims runs a bunch of test jobs out of cron the sniff test that u-c updates "work" | 04:09 |
| tonyb | jamielennox: keystone wasn't in that list so ... now it is :) | 04:09 |
| tonyb | jamielennox: basically ignore that thing | 04:09 |
| jamielennox | ah, ok - i was just a bit concerned about the last merge, thought it might have broken something | 04:09 |
| *** ninag has quit IRC | 04:10 | |
| tonyb | jamielennox: it could take a while to see if it breaks. | 04:10 |
| tonyb | jamielennox: good to be worried :) | 04:10 |
| *** links has joined #openstack-keystone | 04:16 | |
| *** can8dnSix has joined #openstack-keystone | 04:21 | |
| *** iurygregory_ has quit IRC | 04:24 | |
| *** adu has quit IRC | 04:29 | |
| *** adu has joined #openstack-keystone | 04:29 | |
| *** darosale has joined #openstack-keystone | 04:35 | |
| *** adu has quit IRC | 04:43 | |
| notmorgan | stevemar: *sigh* '2016-05-19T03:19:02.901847Z' != '2016-05-19T03:19:02.901846Z' | 04:45 |
| notmorgan | stevemar: REALLY!?! | 04:45 |
| notmorgan | stevemar: :( | 04:45 |
| stevemar | notmorgan: that's what https://review.openstack.org/#/c/312061/ was addressing | 04:45 |
| patchbot | stevemar: patch 312061 - keystone - Port test_v3_auth unit test to Python 3 | 04:45 |
| notmorgan | 1 microsecond off. | 04:45 |
| notmorgan | 1 effing microsecond. | 04:45 |
| stevemar | notmorgan: there is aslso, as lbragstad said, a function called "closeEnoughForGovernmentWork" :) | 04:45 |
| notmorgan | yeah we should use that | 04:46 |
| notmorgan | cause... seriously | 04:46 |
| *** GB21 has joined #openstack-keystone | 04:46 | |
| notmorgan | i don't even know how we managed to 1 microsecond drift there | 04:47 |
| stevemar | "assertCloseEnoughForGovernmentWork" | 04:47 |
| stevemar | we use it in a few spots already | 04:47 |
| stevemar | notmorgan: oh also, troveclient, designateclient and heatclient are now using ksa \o/ | 04:47 |
| notmorgan | that is below the level of cpu slices | 04:48 |
| *** GB21 has quit IRC | 04:51 | |
| notmorgan | stevemar: i am going to simply recheck that failure | 05:04 |
| notmorgan | that is a cosmic ray level event | 05:04 |
| notmorgan | it is the first time i legitmately feel that way | 05:04 |
| notmorgan | '2016-05-19T03:19:02.901847Z' != '2016-05-19T03:19:02.901846Z' 1 microsecond?! really | 05:04 |
| notmorgan | maybe with terahertz cpu... or electron migration | 05:05 |
| *** bkero has joined #openstack-keystone | 05:05 | |
| notmorgan | bkero: can totally appreciate it | 05:06 |
| *** GB21 has joined #openstack-keystone | 05:06 | |
| stevemar | notmorgan: it's your doom :) | 05:07 |
| *** doug-fish has joined #openstack-keystone | 05:11 | |
| *** can8dnSix has quit IRC | 05:12 | |
| *** doug-fish has quit IRC | 05:15 | |
| *** chlong has quit IRC | 05:17 | |
| notmorgan | stevemar: impossible | 05:18 |
| *** roxanaghe has joined #openstack-keystone | 05:18 | |
| bkero | inconceivable<Vizzini> | 05:20 |
| bkero | </Vizzini> | 05:20 |
| *** roxanaghe has quit IRC | 05:20 | |
| *** tqtran has joined #openstack-keystone | 05:24 | |
| stevemar | bkero: ++ | 05:25 |
| jamielennox | stevemar: what's the likelyhood people are subclassing our controllers outside of keysotne? | 05:26 |
| jamielennox | do we consider those apis public | 05:26 |
| stevemar | jamielennox: probably low | 05:27 |
| jamielennox | so if i replace context with a request object so long as it works in keystone i'm good ? | 05:27 |
| stevemar | jamielennox: yeah, technically it's all public, but i would assume it's unlikely | 05:27 |
| *** markvoelker has joined #openstack-keystone | 05:27 | |
| stevemar | jamielennox: you had to pick something that affects *all* controllers | 05:28 |
| *** tqtran has quit IRC | 05:28 | |
| stevemar | jamielennox: whats the gain we get from switching? | 05:28 |
| jamielennox | it's bugged me since the beginning, and it's somewhat relaxing | 05:28 |
| jamielennox | i want to start using real oslo.context and stuff throughout keystone | 05:29 |
| jamielennox | rather than our botched together dictionary | 05:29 |
| jamielennox | s/relaxing/cathartic | 05:30 |
| stevemar | jamielennox: safest best would be to toss up a patch and send a note to ops | 05:30 |
| stevemar | try and pitch it a bit better, other than `cathartic` | 05:31 |
| stevemar | :) | 05:31 |
| *** chlong has joined #openstack-keystone | 05:31 | |
| *** rderose has joined #openstack-keystone | 05:31 | |
| stevemar | go for `consistency between projects`, that always wins people over! | 05:31 |
| *** rderose has quit IRC | 05:31 | |
| stevemar | otherwise, folks will just roll their eyes "devs gonna dev" | 05:31 |
| notmorgan | so stevemar, the issue with oauth1 tests is... pretty deep :( | 05:32 |
| stevemar | when they just want stability | 05:32 |
| stevemar | gdi | 05:32 |
| *** naresht has quit IRC | 05:32 | |
| *** markvoelker has quit IRC | 05:34 | |
| stevemar | notmorgan: what are you seeing? | 05:36 |
| *** GB21 has quit IRC | 05:37 | |
| *** stingaci has joined #openstack-keystone | 05:37 | |
| notmorgan | stevemar: just a mess | 05:37 |
| notmorgan | stevemar: i fix one thing and it spawns notification errors | 05:38 |
| notmorgan | stevemar: it's ... blah | 05:38 |
| notmorgan | so close :( | 05:38 |
| notmorgan | most recent: AssertionError: Notification not sent. | 05:38 |
| notmorgan | 33 of them | 05:39 |
| notmorgan | i am wondering if the library is an issue :( | 05:39 |
| notmorgan | stevemar: oauthlib claims 3.4 compat | 05:40 |
| notmorgan | so.. prob. not a lib error | 05:40 |
| stevemar | notmorgan: post the patch as WIP? | 05:41 |
| notmorgan | mebee | 05:41 |
| notmorgan | bleh | 05:41 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: WIP - Py3 oauth tests https://review.openstack.org/318451 | 05:42 |
| notmorgan | stevemar: ^ | 05:44 |
| notmorgan | ls | 05:44 |
| *** lhcheng has joined #openstack-keystone | 05:44 | |
| *** ChanServ sets mode: +v lhcheng | 05:44 | |
| notmorgan | stevemar: i figure whoever finishes the py3 changes gets to propose the classifier change | 05:45 |
| stevemar | notmorgan: haha | 05:45 |
| *** lhcheng_ has quit IRC | 05:45 | |
| stevemar | that's why you are gunning for it! | 05:45 |
| notmorgan | stevemar: nah, i want to make it easy for someone else to. | 05:45 |
| notmorgan | stevemar: anyone else. it's a big change :) | 05:45 |
| stevemar | notmorgan: i dunno, dstanek does have a claim to the py3 throne too | 05:45 |
| notmorgan | i actually hope someone picks up the oauth patchset | 05:45 |
| stevemar | notmorgan: maybe we can bribe haypo | 05:46 |
| notmorgan | stevemar: ooh | 05:46 |
| notmorgan | good idea | 05:46 |
| stevemar | i mean beg, or bribe, whatever he wants | 05:46 |
| stevemar | comes with the territory or the rebase shield | 05:46 |
| stevemar | of* | 05:47 |
| *** edtubill has quit IRC | 05:54 | |
| *** gyee has quit IRC | 05:56 | |
| *** fawadkhaliq has joined #openstack-keystone | 05:57 | |
| *** doug-fish has joined #openstack-keystone | 05:57 | |
| *** furface has quit IRC | 06:00 | |
| *** doug-fish has quit IRC | 06:01 | |
| *** chlong has quit IRC | 06:05 | |
| *** rcernin has joined #openstack-keystone | 06:13 | |
| *** GB21 has joined #openstack-keystone | 06:14 | |
| *** chlong has joined #openstack-keystone | 06:22 | |
| *** cloudpuppy has quit IRC | 06:29 | |
| *** TxGVNN has quit IRC | 06:32 | |
| *** lhcheng has quit IRC | 06:39 | |
| *** darosale has quit IRC | 06:44 | |
| *** belmoreira has joined #openstack-keystone | 06:45 | |
| *** EinstCrazy has quit IRC | 06:51 | |
| *** EinstCrazy has joined #openstack-keystone | 06:52 | |
| *** chlong has quit IRC | 06:54 | |
| *** EinstCrazy has quit IRC | 06:54 | |
| *** EinstCrazy has joined #openstack-keystone | 06:56 | |
| *** EinstCrazy has quit IRC | 06:57 | |
| *** TxGVNN has joined #openstack-keystone | 06:58 | |
| *** pnavarro has joined #openstack-keystone | 06:58 | |
| *** EinstCrazy has joined #openstack-keystone | 06:58 | |
| *** jaosorior has quit IRC | 06:59 | |
| *** jaosorior has joined #openstack-keystone | 07:00 | |
| *** EinstCrazy has quit IRC | 07:00 | |
| *** TxGVNN has quit IRC | 07:00 | |
| *** EinstCrazy has joined #openstack-keystone | 07:01 | |
| *** furface has joined #openstack-keystone | 07:04 | |
| jamielennox | gah, that ones a bit ugly https://review.openstack.org/#/c/318349/2/keystone/token/providers/fernet/token_formatters.py | 07:07 |
| patchbot | jamielennox: patch 318349 - keystone - Enable py3 testing for Fernet token provider | 07:07 |
| jamielennox | stevemar: it's no longer cathartic - our tests suck so bad | 07:10 |
| *** pnavarro has quit IRC | 07:15 | |
| stevemar | jamielennox: good, i've successfully convinced you to not do it | 07:23 |
| jamielennox | not sure about that | 07:23 |
| stevemar | dammit | 07:28 |
| *** ninag has joined #openstack-keystone | 07:32 | |
| zigo | Is it correct to say that users should be using "keystone-manage token_flush" only if [token]/provider is set to uuid? | 07:36 |
| zigo | Or is it useful in other cases? | 07:36 |
| *** ninag has quit IRC | 07:37 | |
| zigo | I've got some report of unhappy users of fernet tokens that want me to remove the cron job of the Debian package, which is why I'm asking. | 07:37 |
| stevemar | zigo: only useful for uuid really | 07:37 |
| zigo | Ok. | 07:37 |
| zigo | stevemar: Is it deprecated? | 07:37 |
| zigo | (I've been told that...) | 07:37 |
| zigo | stevemar: Or still useful? | 07:37 |
| stevemar | zigo: nope | 07:37 |
| zigo | Ok, thanks a lot. | 07:37 |
| stevemar | zigo: definitely not deprecated | 07:37 |
| zigo | FYI, I'm about to do: | 07:37 |
| zigo | PROVIDER=$(grep -E '^[ \t]*provider[ \t]*=' /etc/keystone/keystone.conf) | 07:37 |
| zigo | if [ -n "${PROVIDER}" ] ; then | 07:37 |
| zigo | PROVIDER=$(grep -E '^[ \t]*provider[ \t]*=' /etc/keystone/keystone.conf | sed -e 's/[ \t]*provider[ \t]*=//' | awk '{print $1}') | 07:37 |
| zigo | if [ "${PROVIDER}" = "uuid" ] ; then | 07:37 |
| zigo | su -c '/usr/bin/keystone-manage token_flush >/var/log/keystone/keystone-tokenflush.log 2>&1' keystone | 07:37 |
| zigo | fi | 07:38 |
| zigo | fi | 07:38 |
| zigo | Oh, I'm forgetting the default value ... :P | 07:38 |
| zigo | But you got the idea, I believe. | 07:38 |
| *** fawadkhaliq has quit IRC | 07:39 | |
| *** fawadkhaliq has joined #openstack-keystone | 07:39 | |
| stevemar | notmorgan: do we still persist/store tokens for fernet (if and only if they are v2 tokens)? | 07:39 |
| stevemar | zigo: let me double check we i am giving you all the right info! | 07:40 |
| stevemar | i seem to remember now a case where we still persist tokens even if fernet is selected | 07:41 |
| zigo | stevemar: At least, for fernet tokens, the script fails and trace dumps, which is problematic in production (ie: our monitoring tool is reporting it...). | 07:41 |
| stevemar | ouch | 07:41 |
| zigo | stevemar: https://bugs.launchpad.net/fuel/+bug/1520321 | 07:42 |
| openstack | Launchpad bug 1520321 in Fuel for OpenStack "keystone-manage token_flush command fails" [Low,Fix released] - Assigned to Max Yatsenko (myatsenko) | 07:42 |
| stevemar | i wonder why it would fail | 07:42 |
| zigo | Well, it should gracefully fail, instead of just raising a Python error. | 07:43 |
| stevemar | interesting | 07:44 |
| zigo | IMO, best would be to just output a nice warning in a single line, and exit. | 07:45 |
| stevemar | so when packaging, you used to always set up the hourly job regardless of the token provider | 07:45 |
| stevemar | but now (as you pasted) it'll depend if uuid | 07:45 |
| zigo | Right, because I didn't know. | 07:45 |
| zigo | Well, now, the cron job stays, but it will check for the config, yes. | 07:45 |
| stevemar | cool cool | 07:45 |
| zigo | http://paste.openstack.org/show/497648/ <--- My current version. | 07:46 |
| zigo | I'd prefer to always call keystone-manage, and have *it* to know better than me. | 07:46 |
| zigo | Though, as it just crashes and fills-up the log, I can't anymore. | 07:46 |
| stevemar | zigo: it may just be that we didn't anticipate this command running with fernet and it went untested. mind if i open that bug against keystone | 07:47 |
| stevemar | we could fail silently or return nothing | 07:47 |
| zigo | Thanks ! :) | 07:47 |
| stevemar | sounds easy enough to implement, unless some of the fernet guys (lbragstad and dolphm) are against it for some reason | 07:48 |
| zigo | In any case, for this kind of issues, we have 4 groups of people interacting (ie: upstream, package maintainers, puppet team, monitoring guys and ops), so communication on what we shall do is important! :) | 07:48 |
| *** dmk0202 has joined #openstack-keystone | 07:50 | |
| stevemar | zigo: yep! | 07:51 |
| stevemar | zigo: question for you, somewhat related | 07:51 |
| stevemar | zigo: fernet as the default token provider, yes or no? | 07:52 |
| stevemar | as a packager, your thoughts... | 07:52 |
| zigo | Well, do we have to, at some point, generate keys and such, to make it work? | 07:53 |
| stevemar | i know you it when a user is able to just install the package and get going | 07:53 |
| zigo | I don't mind having it the default, but then if I need to generate keys in the postinst, I need to get the doc on how to do it. | 07:53 |
| zigo | How does that work? | 07:54 |
| stevemar | zigo: fine with me. i can get you the docs. | 07:54 |
| stevemar | zigo: for an all-in-one deployment it should just be 2 additional keystone-manage commands | 07:54 |
| zigo | Cool ! :) | 07:55 |
| *** GB21 has quit IRC | 07:55 | |
| zigo | Then I'm ok with it as default. | 07:55 |
| stevemar | zigo: i'll add it to the list! | 07:55 |
| zigo | Just the latest CVE scares me a bit. | 07:55 |
| stevemar | the audit id one? | 07:55 |
| zigo | Yes. | 07:55 |
| zigo | Are Fernet tokens mature enough? | 07:55 |
| stevemar | yeah, that one is unfortunate. | 07:56 |
| stevemar | we only discovered it after we made it the default | 07:56 |
| stevemar | i think so. we kicked the tires for a few releases now, and we wouldn't have found it without making it the default in devstack | 07:56 |
| *** EinstCra_ has joined #openstack-keystone | 07:57 | |
| zigo | Fair enough. | 07:57 |
| stevemar | zigo: not sure if you have access to the bug, but someone confirmed it is not an issue in liberty | 07:58 |
| stevemar | we will backport the fix to mitaka | 07:59 |
| zigo | I have access to the bug (it's disclosed, and anyway, I am in the embargoe list), and there's already a backport to Mitaka. | 07:59 |
| zigo | I'm currently building the package and will upload after it passes all unit tests. | 07:59 |
| stevemar | yay, i just saw that it was merged | 07:59 |
| *** zzzeek has quit IRC | 08:00 | |
| *** EinstCrazy has quit IRC | 08:00 | |
| stevemar | now if someone can approve my mitaka releases, i would be happy: https://review.openstack.org/#/c/317839/ :) | 08:00 |
| patchbot | stevemar: patch 317839 - releases - release keystone server and libraries for mitaka | 08:00 |
| stevemar | holy heck it's 4am, i need to sleep | 08:01 |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** jamielennox is now known as jamielennox|away | 08:05 | |
| *** cheran has quit IRC | 08:09 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** vnogin has joined #openstack-keystone | 08:10 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Let OidcPassword accept scope parameters as kwargs https://review.openstack.org/317895 | 08:14 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Let OidcPassword accept scope parameters as kwargs https://review.openstack.org/317895 | 08:17 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: create an OidcBase class with common methods https://review.openstack.org/317967 | 08:18 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: Remove unused parameters in OidcPassword methods https://review.openstack.org/317966 | 08:18 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: add OidcToken class to authenticate reusing an access token https://review.openstack.org/317968 | 08:18 |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** daemontool has joined #openstack-keystone | 08:21 | |
| *** GB21 has joined #openstack-keystone | 08:21 | |
| *** ozialien10 has quit IRC | 08:27 | |
| *** ozialien10 has joined #openstack-keystone | 08:27 | |
| *** jistr has joined #openstack-keystone | 08:30 | |
| *** EinstCrazy has joined #openstack-keystone | 08:38 | |
| *** EinstCra_ has quit IRC | 08:40 | |
| openstackgerrit | Merged openstack/keystone: Enable py3 for credential tests https://review.openstack.org/318341 | 08:42 |
| openstackgerrit | Alfredo Moralejo proposed openstack/keystone: Add .mo files to MANIFEST.in https://review.openstack.org/318527 | 09:18 |
| *** fawadkhaliq has quit IRC | 09:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 09:24 | |
| *** GB21 has quit IRC | 09:30 | |
| *** zqfan has joined #openstack-keystone | 09:30 | |
| *** EinstCrazy has quit IRC | 09:36 | |
| *** EinstCrazy has joined #openstack-keystone | 09:36 | |
| *** ericksonsantos has quit IRC | 09:46 | |
| *** clenimar has quit IRC | 09:47 | |
| *** clenimar has joined #openstack-keystone | 09:49 | |
| *** ericksonsantos has joined #openstack-keystone | 09:49 | |
| *** EinstCrazy has quit IRC | 09:51 | |
| *** rk4n has joined #openstack-keystone | 09:55 | |
| *** GB21 has joined #openstack-keystone | 09:59 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 10:00 |
| *** porunov has joined #openstack-keystone | 10:01 | |
| *** mvk_ has quit IRC | 10:15 | |
| *** d0ugal has quit IRC | 10:24 | |
| *** d0ugal has joined #openstack-keystone | 10:28 | |
| *** d0ugal has quit IRC | 10:31 | |
| *** d0ugal has joined #openstack-keystone | 10:31 | |
| *** danielh has quit IRC | 10:35 | |
| *** mou has joined #openstack-keystone | 10:36 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: create an OidcBase class with common methods https://review.openstack.org/317967 | 10:37 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/python-keystoneclient: oidc: add OidcToken class to authenticate reusing an access token https://review.openstack.org/317968 | 10:37 |
| *** mvk_ has joined #openstack-keystone | 10:50 | |
| *** jamielennox|away is now known as jamielennox | 11:03 | |
| *** tellesnobrega is now known as tellesnobrega_af | 11:10 | |
| *** rk4n has quit IRC | 11:18 | |
| *** rodrigods has quit IRC | 11:20 | |
| *** rodrigods has joined #openstack-keystone | 11:20 | |
| *** iurygregory has joined #openstack-keystone | 11:26 | |
| *** porunov has quit IRC | 11:27 | |
| *** doug-fish has joined #openstack-keystone | 11:28 | |
| *** doug-fish has quit IRC | 11:29 | |
| *** fawadkhaliq has quit IRC | 11:30 | |
| *** ninag has joined #openstack-keystone | 11:34 | |
| *** ninag has quit IRC | 11:38 | |
| *** gordc has joined #openstack-keystone | 11:41 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Added app for policy enforcement https://review.openstack.org/317529 | 11:46 |
| *** ddieterly has joined #openstack-keystone | 12:03 | |
| *** rk4n has joined #openstack-keystone | 12:05 | |
| *** jistr has quit IRC | 12:08 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support hierarchical project naming https://review.openstack.org/318605 | 12:12 |
| *** TxGVNN has joined #openstack-keystone | 12:13 | |
| *** amrith is now known as _amrith_ | 12:14 | |
| *** raildo-afk is now known as raildo | 12:15 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support hierarchical project naming https://review.openstack.org/318605 | 12:16 |
| *** raildo has left #openstack-keystone | 12:16 | |
| *** markvoelker has joined #openstack-keystone | 12:16 | |
| *** raildo has joined #openstack-keystone | 12:17 | |
| *** rk4n has quit IRC | 12:17 | |
| *** rk4n has joined #openstack-keystone | 12:18 | |
| *** markvoelker has quit IRC | 12:21 | |
| *** markvoelker has joined #openstack-keystone | 12:24 | |
| *** GB21 has quit IRC | 12:24 | |
| *** ddieterly is now known as ddieterly[away] | 12:25 | |
| *** jistr has joined #openstack-keystone | 12:28 | |
| *** edmondsw has joined #openstack-keystone | 12:28 | |
| *** jistr is now known as jistr|bbl | 12:28 | |
| *** stingaci has quit IRC | 12:31 | |
| *** julim has joined #openstack-keystone | 12:34 | |
| *** links has quit IRC | 12:36 | |
| *** tellesnobrega_af is now known as tellesnobrega | 12:37 | |
| *** ninag has joined #openstack-keystone | 12:38 | |
| *** markvoelker has quit IRC | 12:41 | |
| *** markvoelker has joined #openstack-keystone | 12:42 | |
| *** ninag has quit IRC | 12:43 | |
| *** markvoelker_ has joined #openstack-keystone | 12:46 | |
| *** ninag_ has joined #openstack-keystone | 12:47 | |
| *** ddieterly[away] is now known as ddieterly | 12:48 | |
| *** markvoelker_ has quit IRC | 12:48 | |
| *** markvoelker_ has joined #openstack-keystone | 12:49 | |
| *** markvoelker has quit IRC | 12:50 | |
| *** markvoelker_ has quit IRC | 12:55 | |
| *** markvoelker has joined #openstack-keystone | 12:55 | |
| *** ddieterly has quit IRC | 12:57 | |
| *** richm has joined #openstack-keystone | 13:01 | |
| lbragstad | samueldmq ping | 13:06 |
| openstackgerrit | Alfredo Moralejo proposed openstack/keystone: Add .mo files to MANIFEST.in https://review.openstack.org/318527 | 13:09 |
| *** markvoelker_ has joined #openstack-keystone | 13:12 | |
| *** markvoelker_ has quit IRC | 13:12 | |
| *** dave-mccowan has joined #openstack-keystone | 13:12 | |
| *** markvoelker_ has joined #openstack-keystone | 13:12 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Replace context building with a request object https://review.openstack.org/318657 | 13:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 13:15 |
| jamielennox | stevemar: present for you ^ | 13:15 |
| *** markvoelker has quit IRC | 13:15 | |
| *** pauloewerton has joined #openstack-keystone | 13:16 | |
| *** rk4n_ has joined #openstack-keystone | 13:25 | |
| *** rk4n has quit IRC | 13:26 | |
| *** ngupta has joined #openstack-keystone | 13:31 | |
| *** mou has quit IRC | 13:31 | |
| *** mou has joined #openstack-keystone | 13:32 | |
| *** ddieterly has joined #openstack-keystone | 13:32 | |
| *** BigWillie has joined #openstack-keystone | 13:37 | |
| knikolla | o/ morning keystone! | 13:40 |
| openstackgerrit | Alfredo Moralejo proposed openstack/keystone: Add .mo files to MANIFEST.in https://review.openstack.org/318527 | 13:41 |
| *** markvoelker_ has quit IRC | 13:44 | |
| *** ddieterly is now known as ddieterly[away] | 13:45 | |
| *** tellesnobrega is now known as tellesnobrega_af | 13:46 | |
| *** ddieterly[away] is now known as ddieterly | 13:52 | |
| *** ametts has joined #openstack-keystone | 13:52 | |
| *** gagehugo has joined #openstack-keystone | 13:53 | |
| *** belmoreira has quit IRC | 13:55 | |
| *** belmoreira has joined #openstack-keystone | 13:55 | |
| dstanek | good morning knikolla | 13:57 |
| *** mou has quit IRC | 13:57 | |
| *** mou has joined #openstack-keystone | 13:57 | |
| *** ngupta has quit IRC | 14:00 | |
| *** jistr|bbl is now known as jistr | 14:00 | |
| *** ngupta has joined #openstack-keystone | 14:01 | |
| knikolla | morning dstanek. since you’re here i have a few questions about devstack plugins for k2k, if you don’t mind. | 14:01 |
| *** ninag_ has quit IRC | 14:02 | |
| *** woodster_ has joined #openstack-keystone | 14:02 | |
| *** ngupta_ has joined #openstack-keystone | 14:03 | |
| *** darosale has joined #openstack-keystone | 14:03 | |
| *** ninag has joined #openstack-keystone | 14:03 | |
| dstanek | knikolla: i don't think i'd be helpful for that, but you should ask away for when someone that is familiar with it is in here | 14:04 |
| *** ninag_ has joined #openstack-keystone | 14:05 | |
| *** ngupta has quit IRC | 14:05 | |
| knikolla | dstanek: sure, so i made https://github.com/knikolla/devstack-plugin-k2k-idp and https://github.com/knikolla/devstack-plugin-k2k-sp and just wanted to know if 2 separate plugins is the way to do it, or not. | 14:06 |
| *** ninag has quit IRC | 14:07 | |
| *** rderose has joined #openstack-keystone | 14:08 | |
| rodrigods | knikolla, hmm we are going to put everything under keystone/devstack, right? | 14:08 |
| rodrigods | can we execute two plugins? i think we can? | 14:09 |
| knikolla | rodrigods: yes, you can execute as many as you want. but not from the same repo. | 14:10 |
| knikolla | rodrigods: so if we want it in keystone/devstack, there can only be one plugin there. | 14:11 |
| rodrigods | knikolla, really? why is that? | 14:11 |
| knikolla | rodrigods: that’s my understanding of the devstack plugin architecture. you point it to a repo and it searches for devstack/plugin.sh and runs it. | 14:12 |
| dstanek | knikolla: this seems like something to bring up at the QA meeting today :-) | 14:12 |
| dstanek | what is the case for making it multiple plugins? | 14:12 |
| *** edtubill has joined #openstack-keystone | 14:13 | |
| *** pauloewerton has quit IRC | 14:13 | |
| rodrigods | knikolla, hmm got it | 14:13 |
| *** pauloewerton has joined #openstack-keystone | 14:13 | |
| knikolla | dstanek: based on the etherpad from the design summit, we’re gonna have all kinds of plugins, ad/ldap, federation, k2k. so making them work nicely with a single plugin, i’m not sure about that. | 14:14 |
| knikolla | https://etherpad.openstack.org/p/newton-keystone-testing | 14:14 |
| knikolla | dstanek: actually nevermind about ad/ldap as it’s already built in devstack. | 14:15 |
| dstanek | knikolla: we could do a single plugin and control what components are setup using env vars | 14:15 |
| rodrigods | dstanek, ++ | 14:15 |
| knikolla | dstanek: sure, i planned on giving it a try. i split them into two since it was easier to debug. | 14:16 |
| rodrigods | knikolla, besides that, i'm really glad to see stuff evolving on this side | 14:16 |
| dstanek | just like how you setup services in devstack we could have KEY_PLUGIN_COMPONENTS="sp,idp,awesome" | 14:16 |
| *** edtubill has quit IRC | 14:17 | |
| rodrigods | we could even have flavors for each component | 14:17 |
| rodrigods | sp_mod_mellon, sp_mod_shib | 14:17 |
| knikolla | rodrigods: dstanek: that sounds good to me. | 14:18 |
| knikolla | also i’m not sure why there is a bullet point in the etherpad for federation, and a separate one for k2k. isn’t the sp the same in both cases. | 14:19 |
| rodrigods | knikolla, i think it is | 14:19 |
| knikolla | or is this a scenarion with some other idp instead of keystone | 14:19 |
| rodrigods | we have the "regular" federation scenario too | 14:19 |
| *** _amrith_ is now known as amrith | 14:20 | |
| dstanek | right, it's about scenarios and not necessarily plugins | 14:20 |
| knikolla | rodrigods: dstanek: right, also k2k uses saml/ecp whereas some other idp might use something else. got it. | 14:21 |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Use betamax hooks to mask fixture results https://review.openstack.org/311133 | 14:21 |
| knikolla | i’ll need to sync up with breton_ if we’re going to go the single plugin route. | 14:21 |
| *** belmoreira has quit IRC | 14:27 | |
| *** fawadkhaliq has joined #openstack-keystone | 14:29 | |
| *** ninag_ has quit IRC | 14:32 | |
| *** fawadkhaliq has quit IRC | 14:33 | |
| *** pushkaru has joined #openstack-keystone | 14:34 | |
| stevemar | morning knikolla! | 14:34 |
| knikolla | morning stevemar! :) | 14:35 |
| *** belmoreira has joined #openstack-keystone | 14:38 | |
| stevemar | knikolla: feeling ambitious? https://review.openstack.org/#/c/318451/ :) | 14:38 |
| patchbot | stevemar: patch 318451 - keystone - WIP - Py3 oauth tests | 14:38 |
| lbragstad | only two modules left! | 14:38 |
| knikolla | stevemar: sure! i’ll give it a go! | 14:40 |
| knikolla | stevemar: is that the last thing blacklisted? | 14:40 |
| stevemar | knikolla: hmm? blacklisted? | 14:41 |
| knikolla | stevemar: as in tests-py3-blacklist.txt | 14:41 |
| stevemar | knikolla: the blacklist are tests that don't run in py3 gate job | 14:41 |
| stevemar | knikolla: the oauth tests are on the blacklist, this patch is trying to remove them | 14:42 |
| stevemar | knikolla: but notmorgan can't seem to crack it, and is looking for help :P | 14:42 |
| knikolla | stevemar: i know, i understand what the patch is trying to do. i was just curious if after the pyldap thing his was the only thing left to remove from the py3 blacklist. | 14:43 |
| knikolla | this* | 14:43 |
| knikolla | but i see there are a few others :P | 14:43 |
| *** sdake_ has joined #openstack-keystone | 14:44 | |
| stevemar | knikolla: yep! 2 last changes :) | 14:45 |
| *** raddaoui has joined #openstack-keystone | 14:47 | |
| *** tellesnobrega_af is now known as tellesnobrega | 14:47 | |
| *** TxGVNN has quit IRC | 14:47 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:48 | |
| *** tellesnobrega is now known as tellesnobrega_af | 14:49 | |
| *** tellesnobrega_af is now known as tellesnobrega | 14:49 | |
| *** tonytan4ever has joined #openstack-keystone | 14:49 | |
| *** timcline has joined #openstack-keystone | 14:49 | |
| *** otaciliofl has quit IRC | 14:52 | |
| *** rk4n_ has quit IRC | 14:52 | |
| raildo | stevemar: look how beautiful this is: https://github.com/openstack/glance/blob/master/glance/common/auth.py#L121-L125 :P | 14:52 |
| stevemar | raildo: :( | 14:52 |
| *** edtubill has joined #openstack-keystone | 14:53 | |
| openstackgerrit | Merged openstack/keystone: Enable py3 testing for Fernet token provider https://review.openstack.org/318349 | 14:53 |
| *** fesp has joined #openstack-keystone | 14:53 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 14:55 |
| *** julim has quit IRC | 14:56 | |
| *** julim has joined #openstack-keystone | 14:56 | |
| *** ninag_ has joined #openstack-keystone | 14:56 | |
| *** jaosorior has quit IRC | 14:59 | |
| *** jaosorior has joined #openstack-keystone | 15:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 15:01 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 15:01 |
| *** ddieterly is now known as ddieterly[away] | 15:01 | |
| *** ddieterly[away] is now known as ddieterly | 15:01 | |
| *** alaski has joined #openstack-keystone | 15:02 | |
| *** jaosorior has quit IRC | 15:03 | |
| *** diazjf has joined #openstack-keystone | 15:03 | |
| *** jaosorior has joined #openstack-keystone | 15:03 | |
| *** diazjf1 has joined #openstack-keystone | 15:07 | |
| *** spzala has joined #openstack-keystone | 15:08 | |
| *** jaosorior has quit IRC | 15:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 15:10 |
| *** doug-fish has joined #openstack-keystone | 15:10 | |
| *** diazjf has quit IRC | 15:10 | |
| *** links has joined #openstack-keystone | 15:11 | |
| *** tellesnobrega is now known as tellesnobrega_af | 15:11 | |
| *** doug-fish has quit IRC | 15:12 | |
| *** alex_xu has quit IRC | 15:13 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Remove unused parameters in _OidcBase https://review.openstack.org/318732 | 15:14 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: DRY when obtaining a keystone token https://review.openstack.org/318733 | 15:14 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: DRY when obtaining an access token https://review.openstack.org/318734 | 15:14 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix typo in docstring https://review.openstack.org/318735 | 15:14 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix typo in docstring https://review.openstack.org/318735 | 15:16 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: DRY when obtaining an access token https://review.openstack.org/318734 | 15:16 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: DRY when obtaining a keystone token https://review.openstack.org/318733 | 15:16 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: Remove unused parameters in _OidcBase https://review.openstack.org/318732 | 15:16 |
| *** doug-fish has joined #openstack-keystone | 15:20 | |
| knikolla | i’m starting to regret moving back to os x for development. damn tox and python dependencies! | 15:20 |
| *** ninag_ has quit IRC | 15:21 | |
| *** TxGVNN has joined #openstack-keystone | 15:24 | |
| *** fawadkhaliq has joined #openstack-keystone | 15:24 | |
| stevemar | knikolla: hehe | 15:25 |
| *** links has quit IRC | 15:26 | |
| knikolla | stevemar: vagrant with synced folders to the rescue! | 15:28 |
| *** belmoreira has quit IRC | 15:28 | |
| *** dmk0202 has quit IRC | 15:33 | |
| stevemar | \o/ | 15:36 |
| *** ninag has joined #openstack-keystone | 15:37 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 15:40 |
| *** darosale has quit IRC | 15:41 | |
| henrynash | raildo, samueldmq: ping | 15:48 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add OidcAccessToken class to authenticate reusing an access token https://review.openstack.org/318750 | 15:49 |
| samueldmq | henrynash: pong | 15:49 |
| henrynash | samuedlmq: not sure if you have seen https://review.openstack.org/#/c/318605/ yet….the next iteration in the attempt to allow duplicate project names... | 15:50 |
| patchbot | henrynash: patch 318605 - keystone-specs - Support hierarchical project naming | 15:50 |
| henrynash | samueldmq: my real qeustion is whether (once we have microversioning), this should be controlled by a config switch…or just on all the time? | 15:51 |
| henrynash | samueldmq: if it’s controlled by a config switch, then you need a way of interogatig wethee full names are in use of not, even after you are taking the microversion….which seems silly | 15:52 |
| samueldmq | henrynash: ok so the idea is to make a non-backward compatible cahnge | 15:52 |
| samueldmq | henrynash: and be allowed to do that by using microversions | 15:52 |
| henrynash | samuedlmq: well, I think there is no way of making this change and it be backward compatible.... | 15:52 |
| samueldmq | henrynash: agreed | 15:52 |
| samueldmq | henrynash: for microversions I believe you will need to specify the version when calling the ndpoinet | 15:53 |
| samueldmq | endpoint* | 15:53 |
| henrynash | samueldmq: so yes, you ONLY get any of this if you have requested (at least) vesion 3.7 (or whatevr the next one is) | 15:53 |
| samueldmq | henrynash: it's gonna be 4.0, can't be 3.x if it's backward incompatible | 15:53 |
| henrynash | samueldmq: why can’t we have a 3.X microversion? | 15:54 |
| notmorgan | stevemar: i don't know how we're getting microsecond differences... | 15:54 |
| samueldmq | henrynash: you can, but afaik if you create a backward incompatible change, you need to turn the big number | 15:54 |
| henrynash | samueldmq: but isn’t that teh point of a microversion? | 15:55 |
| henrynash | samueldmq: you only get the new changce if you ask for iyt | 15:55 |
| samueldmq | henrynash: I think you're correct https://specs.openstack.org/openstack/nova-specs/specs/kilo/implemented/api-microversions.html#versioning | 15:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 15:56 |
| samueldmq | henrynash: but it says "X will only be changed if a significant backwards incompatible API change is made which affects the API as whole. That is, something that is only very very rarely incremented." | 15:57 |
| samueldmq | henrynash: anyways, that can be figured out later :) | 15:57 |
| samueldmq | henrynash: is there an effort to support microversions this cycle ? | 15:58 |
| henrynash | samuedlmq: yes | 15:58 |
| henrynash | samuedlmq: ayoung has a spec for it (although not very complete yet) | 15:58 |
| ayoung | henrynash, microversion spec? Feel free to take it/modify | 16:00 |
| henrynash | samueldmq: I *think*, to avoid confusing, if we implement the hierarchical naming, then it wold just be on all the time (from that microversion on) | 16:00 |
| henrynash | ayoung: will do….reading up a bit about it | 16:00 |
| samueldmq | henrynash: ok, I had discussed about this with jamielennox at the summit and we came to a conclusion that it looks like it's still maturing and we could wait a bit more until adopt it | 16:00 |
| samueldmq | henrynash: however if we have a need for it, why not | 16:00 |
| *** sdake_ is now known as sdake | 16:01 | |
| samueldmq | henrynash: exactly, no config option | 16:01 |
| henrynash | samueldmq: ++ | 16:01 |
| samueldmq | henrynash: from version x.y on, that's the way a name is represented | 16:01 |
| henrynash | samuedlmq: I might introduce a new attribute (leafname ?) so that a client could do operations like create project without having to construct a full name from the tree | 16:02 |
| henrynash | samuedlmq: again, only available in that version of teh api onwards | 16:02 |
| *** julim has quit IRC | 16:02 | |
| samueldmq | henrynash: so you want a new attribute to be added to projects so that it represents its hierarchy? | 16:03 |
| samueldmq | henrynash: vs modifying the project 'name' attribute ? | 16:04 |
| *** rcernin has quit IRC | 16:04 | |
| henrynash | samueldmq: well we could do it that way, but I’m suggetsing the opposite - name is the full path, but so taht you can create project without having to constructs the path (since you already can give a parent ID)…maybe it would be nice to have a leaf name? | 16:05 |
| henrynash | samueldmq: it seems odd to specify parent_id and full name? If you provide name (which is a full path now) you won’t need to specifiy parentID…..but that means you always have to construct the full path to create a prject | 16:07 |
| *** darosale has joined #openstack-keystone | 16:07 | |
| henrynash | samuedlmq: I’ll propose it in the API spec, then we can argue over it! | 16:07 |
| samueldmq | henrynash: maybe if you specify parent_id then project 'name' can be either way? | 16:07 |
| raildo | henrynash: hey | 16:08 |
| henrynash | sameldmq: ah, nice…if parent_id then teh name is relative to that…….. | 16:08 |
| samueldmq | henrynash: yes | 16:08 |
| samueldmq | henrynash: can be, if you specify full name it may also work | 16:09 |
| henrynash | samueldmq: ah, but then when you read the proejct back name is not what you specified in teh create….(it’s a full path now)…which maybe is a bit confusing? | 16:09 |
| samueldmq | henrynash: since it's easy to get the leaf name from that | 16:09 |
| samueldmq | henrynash: maybe | 16:10 |
| samueldmq | henrynash: let's put all that in the spec and see what others think about it too | 16:11 |
| *** fawadkhaliq has quit IRC | 16:11 | |
| *** ninag has quit IRC | 16:11 | |
| henrynash | samueldmq: yep | 16:11 |
| *** ninag has joined #openstack-keystone | 16:12 | |
| raildo | -- for config option ++ for create project with full path and no parent_id | 16:16 |
| *** ninag has quit IRC | 16:16 | |
| raildo | it's something similar with we made for domain_id | 16:16 |
| raildo | when you can infer the domain_id from parent_id | 16:17 |
| *** agrebennikov has joined #openstack-keystone | 16:25 | |
| *** ninag has joined #openstack-keystone | 16:26 | |
| *** tonytan4ever has quit IRC | 16:28 | |
| *** fesp has quit IRC | 16:29 | |
| *** tonytan4ever has joined #openstack-keystone | 16:33 | |
| stevemar | does anyone know this alvaro lopez dude? https://review.openstack.org/#/c/318750/ ? | 16:33 |
| patchbot | stevemar: patch 318750 - keystoneauth - oidc: add OidcAccessToken class to authenticate re... | 16:33 |
| stevemar | he is crushing it for all the openid connect patches | 16:33 |
| samueldmq | stevemar: ++ | 16:34 |
| *** lhcheng has joined #openstack-keystone | 16:35 | |
| *** ChanServ sets mode: +v lhcheng | 16:35 | |
| stevemar | samueldmq: ah, his nick is aloga | 16:35 |
| *** tellesnobrega_af is now known as tellesnobrega | 16:35 | |
| *** ninag has quit IRC | 16:35 | |
| *** ninag has joined #openstack-keystone | 16:36 | |
| *** ninag has quit IRC | 16:36 | |
| *** gagehugo has left #openstack-keystone | 16:36 | |
| *** ninag has joined #openstack-keystone | 16:36 | |
| *** roxanaghe has joined #openstack-keystone | 16:37 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add policy registration and authorize method https://review.openstack.org/313141 | 16:40 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add sample file generation script and helper methods https://review.openstack.org/314244 | 16:40 |
| *** ninag has quit IRC | 16:41 | |
| henrynash | raildo: ++ | 16:42 |
| *** jbell8 has joined #openstack-keystone | 16:44 | |
| *** fawadkhaliq has joined #openstack-keystone | 16:46 | |
| *** edtubill has quit IRC | 16:48 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support hierarchical project naming https://review.openstack.org/318605 | 16:48 |
| stevemar | anyone want to review this patch chain for openid connect slight refactoring? i've already given it a +2: https://review.openstack.org/#/c/318732/2 | 16:49 |
| patchbot | stevemar: patch 318732 - keystoneauth - oidc: Remove unused parameters in _OidcBase | 16:49 |
| stevemar | it's just straight refactoring, no special openid connect knowledge needed! | 16:49 |
| stevemar | (there are 4 patches in the chain) | 16:49 |
| samueldmq | stevemar: will look now | 16:49 |
| *** tqtran has joined #openstack-keystone | 16:50 | |
| *** doug-fish has quit IRC | 16:50 | |
| *** doug-fish has joined #openstack-keystone | 16:51 | |
| *** mvk_ has quit IRC | 16:51 | |
| *** pnavarro has quit IRC | 16:54 | |
| *** ninag has joined #openstack-keystone | 16:54 | |
| *** doug-fis_ has joined #openstack-keystone | 16:54 | |
| *** doug-fish has quit IRC | 16:55 | |
| stevemar | samueldmq: danke! | 16:56 |
| *** r-daneel has joined #openstack-keystone | 16:58 | |
| samueldmq | stevemar: in the case of change 318750, you suggested to open a bug.. | 16:58 |
| samueldmq | stevemar: should be a wishlist thing, right? | 16:58 |
| *** ninag has quit IRC | 16:59 | |
| *** doug-fis_ has quit IRC | 16:59 | |
| *** doug-fish has joined #openstack-keystone | 16:59 | |
| stevemar | samueldmq: yeah, its a request for enhancement | 17:00 |
| *** edtubill has joined #openstack-keystone | 17:00 | |
| stevemar | doesn't need a spec or blueprint, just a bug so we have a record of it | 17:01 |
| samueldmq | stevemar: nice; do we also use release notes in ksa? | 17:01 |
| samueldmq | stevemar: agreed | 17:01 |
| *** ninag_ has joined #openstack-keystone | 17:02 | |
| stevemar | samueldmq: o yeh! ++ | 17:03 |
| stevemar | samueldmq: that is definitely release note worthy | 17:03 |
| *** doug-fish has quit IRC | 17:04 | |
| stevemar | samueldmq: if you are +2 otherwise, want me to add in the release note and bug, and we can merge it? | 17:04 |
| *** ninag_ has quit IRC | 17:05 | |
| samueldmq | stevemar: wfm | 17:05 |
| *** ninag has joined #openstack-keystone | 17:05 | |
| *** julim has joined #openstack-keystone | 17:10 | |
| samueldmq | stevemar: see latest comment there too | 17:11 |
| *** doug-fish has joined #openstack-keystone | 17:11 | |
| *** doug-fish has quit IRC | 17:11 | |
| *** doug-fish has joined #openstack-keystone | 17:12 | |
| *** ddieterly is now known as ddieterly[away] | 17:12 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 17:14 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 17:17 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 17:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 17:19 |
| *** mou has quit IRC | 17:20 | |
| *** mou has joined #openstack-keystone | 17:20 | |
| *** mou has quit IRC | 17:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 17:24 |
| *** ksatrimed has joined #openstack-keystone | 17:27 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 17:27 |
| *** stingaci has joined #openstack-keystone | 17:29 | |
| *** stingaci has quit IRC | 17:29 | |
| *** fawadkhaliq has quit IRC | 17:33 | |
| *** pnavarro has joined #openstack-keystone | 17:34 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 17:37 |
| *** ddieterly[away] is now known as ddieterly | 17:39 | |
| *** pnavarro has quit IRC | 17:39 | |
| *** jbell8 has quit IRC | 17:39 | |
| *** r-daneel has quit IRC | 17:44 | |
| *** tonytan4ever has quit IRC | 17:45 | |
| *** pushkaru has quit IRC | 17:47 | |
| *** daemontool has quit IRC | 17:47 | |
| *** pnavarro has joined #openstack-keystone | 17:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Move identity.backends.sql model code to sql_model.py https://review.openstack.org/292611 | 17:54 |
| *** ksatrimed has quit IRC | 17:56 | |
| *** jbell8 has joined #openstack-keystone | 17:56 | |
| *** tonytan4ever has joined #openstack-keystone | 17:57 | |
| *** ddieterly is now known as ddieterly[away] | 18:02 | |
| *** darosale has quit IRC | 18:03 | |
| *** darosale has joined #openstack-keystone | 18:04 | |
| *** cheran has joined #openstack-keystone | 18:04 | |
| openstackgerrit | Merged openstack/keystoneauth: oidc: Remove unused parameters in _OidcBase https://review.openstack.org/318732 | 18:04 |
| ayoung | samueldmq, can you confirm that https://review.openstack.org/#/c/311652/ does/does not fix the test race conditions? It has no caching | 18:07 |
| patchbot | ayoung: patch 311652 - keystone - Replace revoke tree with linear search | 18:07 |
| *** notmorgan has quit IRC | 18:11 | |
| *** ninag has quit IRC | 18:15 | |
| *** doug-fis_ has joined #openstack-keystone | 18:16 | |
| *** ninag has joined #openstack-keystone | 18:16 | |
| *** TxGVNN has quit IRC | 18:16 | |
| *** ninag has quit IRC | 18:17 | |
| *** ninag has joined #openstack-keystone | 18:18 | |
| *** doug-fish has quit IRC | 18:19 | |
| openstackgerrit | Merged openstack/keystoneauth: oidc: DRY when obtaining a keystone token https://review.openstack.org/318733 | 18:21 |
| *** jbell8 has quit IRC | 18:22 | |
| *** ninag has quit IRC | 18:24 | |
| *** ninag has joined #openstack-keystone | 18:25 | |
| openstackgerrit | Merged openstack/keystoneauth: oidc: DRY when obtaining an access token https://review.openstack.org/318734 | 18:25 |
| *** notmorgan has joined #openstack-keystone | 18:26 | |
| *** dmellado has quit IRC | 18:26 | |
| *** nonameentername has quit IRC | 18:26 | |
| *** kfox1111 has quit IRC | 18:26 | |
| *** crinkle has quit IRC | 18:26 | |
| *** lifeless has quit IRC | 18:26 | |
| *** Daviey has quit IRC | 18:26 | |
| *** mfisch has quit IRC | 18:26 | |
| *** kfox1111 has joined #openstack-keystone | 18:26 | |
| *** nonameentername has joined #openstack-keystone | 18:26 | |
| *** Daviey has joined #openstack-keystone | 18:26 | |
| *** lifeless has joined #openstack-keystone | 18:26 | |
| *** crinkle has joined #openstack-keystone | 18:26 | |
| *** mfisch has joined #openstack-keystone | 18:27 | |
| *** mfisch is now known as Guest76268 | 18:27 | |
| *** dmellado has joined #openstack-keystone | 18:27 | |
| *** ninag has quit IRC | 18:27 | |
| *** ninag has joined #openstack-keystone | 18:28 | |
| openstackgerrit | Merged openstack/keystoneauth: oidc: fix typo in docstring https://review.openstack.org/318735 | 18:28 |
| *** jbell8 has joined #openstack-keystone | 18:30 | |
| *** andrewbogott has quit IRC | 18:31 | |
| *** zhiyan has quit IRC | 18:31 | |
| *** andrewbogott has joined #openstack-keystone | 18:34 | |
| *** zhiyan has joined #openstack-keystone | 18:34 | |
| *** ninag has quit IRC | 18:42 | |
| *** jistr has quit IRC | 18:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/318320 | 18:43 |
| *** rcernin has joined #openstack-keystone | 18:47 | |
| *** andrewbogott has quit IRC | 18:51 | |
| *** andrewbogott has joined #openstack-keystone | 18:51 | |
| *** pnavarro has quit IRC | 18:55 | |
| *** alaski has left #openstack-keystone | 18:56 | |
| *** doug-fis_ has quit IRC | 18:58 | |
| *** ninag has joined #openstack-keystone | 19:01 | |
| *** ddieterly[away] has quit IRC | 19:02 | |
| *** pushkaru has joined #openstack-keystone | 19:04 | |
| *** doug-fish has joined #openstack-keystone | 19:09 | |
| *** henrynash has quit IRC | 19:11 | |
| *** rderose has quit IRC | 19:11 | |
| *** ddieterly has joined #openstack-keystone | 19:26 | |
| *** jbell8 has quit IRC | 19:27 | |
| *** Guest76268 is now known as mfisch | 19:30 | |
| *** jbell8 has joined #openstack-keystone | 19:30 | |
| *** mfisch has quit IRC | 19:30 | |
| *** mfisch has joined #openstack-keystone | 19:30 | |
| *** stingaci has joined #openstack-keystone | 19:34 | |
| *** ninag has quit IRC | 19:37 | |
| *** ninag has joined #openstack-keystone | 19:38 | |
| *** BjoernT has joined #openstack-keystone | 19:40 | |
| *** ninag has quit IRC | 19:42 | |
| *** harbor2 has joined #openstack-keystone | 19:43 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 19:45 |
| *** ngupta_ has quit IRC | 19:48 | |
| *** ddieterly is now known as ddieterly[away] | 19:51 | |
| *** pushkaru has quit IRC | 19:53 | |
| *** ngupta_ has joined #openstack-keystone | 19:53 | |
| *** rderose has joined #openstack-keystone | 20:01 | |
| *** gyee has joined #openstack-keystone | 20:02 | |
| *** ChanServ sets mode: +v gyee | 20:02 | |
| rderose | dstanek: regarding the PCI config settings, do we want to be PCI compliant by default? I'm just concerned about existing deployments having to go change a bunch settings. | 20:02 |
| rderose | dstanek: and the other issue would be that, that every time PCI change their standards, we'll have to go change our defaults to match | 20:03 |
| dstanek | rderose: yeah, we probably can't for backward compatibility, but i wish we could | 20:03 |
| stevemar | dstanek: definitely can't be by default | 20:03 |
| dstanek | we should provide some documented guidance for how to be compliant | 20:04 |
| rderose | dstanek, stevemar: we could, but I think most settings should be relaxed by default | 20:04 |
| rderose | dstanek stevemar: for example, passwords shouldn't expire by default. agree? | 20:06 |
| *** ddieterly[away] is now known as ddieterly | 20:06 | |
| rderose | dstanek stevemar: but for folks that want to be PCI compliant (which can vary between operators), they'll have some options | 20:08 |
| *** amrith is now known as _amrith_ | 20:09 | |
| *** pushkaru has joined #openstack-keystone | 20:11 | |
| dstanek | rderose: yeah, i agree that most should be relaxed by default. but we should definitely create a new doc with configuration information | 20:13 |
| stevemar | dstanek: rderose we can definitely give a blurb in the docs at recommended settings/values | 20:13 |
| stevemar | but yeah, they unfortunately all have to be off or 0 by default | 20:14 |
| rderose | dstanek stevemar: sounds good | 20:14 |
| stevemar | in the help we could write something like "It is recommended to set this to X. The default value of 0 indicates this compliance check is not enabled" | 20:14 |
| stevemar | rderose: ^ in the help of the config option | 20:15 |
| *** doug-fish has quit IRC | 20:15 | |
| dstanek | i think we need a separate doc defining how we see PCI in addition to configuration | 20:15 |
| *** markvoelker has joined #openstack-keystone | 20:15 | |
| dstanek | like locked vs. disabled, etc. | 20:15 |
| stevemar | dstanek: fo sho | 20:15 |
| rderose | stevemar dstanek: I think we should shy away from telling folks how to be PCI compliant, only because this is going to change over time. Instead, we should just provide the functionality and then they can set the configuration to be PCI compliant | 20:17 |
| rderose | stevemar dstanek: some PCI compliant things are subjective and how operators implement PCI could vary between organizations | 20:18 |
| *** markvoelker has quit IRC | 20:20 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add OidcAccessToken class to authenticate reusing an access token https://review.openstack.org/318750 | 20:20 |
| *** ayoung has quit IRC | 20:24 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: oidc: add OidcAccessToken class to authenticate reusing an access token https://review.openstack.org/318750 | 20:24 |
| stevemar | any takers on https://review.openstack.org/#/c/318750/3 ^ it's pretty slick | 20:25 |
| patchbot | stevemar: patch 318750 - keystoneauth - oidc: add OidcAccessToken class to authenticate re... | 20:25 |
| *** xenthree3 has joined #openstack-keystone | 20:29 | |
| *** xenthree3 has left #openstack-keystone | 20:29 | |
| *** ddieterly is now known as ddieterly[away] | 20:30 | |
| *** daemontool has joined #openstack-keystone | 20:32 | |
| dstanek | rderose: i agree about specific values, but there is a lot more to the docs than that | 20:34 |
| *** doug-fish has joined #openstack-keystone | 20:38 | |
| *** ninag has joined #openstack-keystone | 20:39 | |
| *** dmk0202 has joined #openstack-keystone | 20:39 | |
| *** tqtran has quit IRC | 20:40 | |
| *** julim has quit IRC | 20:42 | |
| *** julim has joined #openstack-keystone | 20:42 | |
| *** doug-fish has quit IRC | 20:43 | |
| rderose | dstanek: yeah, this is just a small subset | 20:43 |
| *** doug-fish has joined #openstack-keystone | 20:43 | |
| rderose | dstanek: eventually PCI out-of-the-box though :) | 20:44 |
| dstanek | rderose: subset? | 20:44 |
| rderose | dstanek: we'll keep adding to it | 20:44 |
| rderose | dstanek: this is only a handful of standards for PCI | 20:44 |
| rderose | dstanek: as you said, a lot more to the docs | 20:44 |
| openstackgerrit | Merged openstack/oslo.policy: Add policy registration and authorize method https://review.openstack.org/313141 | 20:47 |
| dstanek | rderose: for the docs we need to define anything specific to Keystone for PCI - so what is a disabled user and how do they get re-enabled (and things like that) | 20:47 |
| dstanek | stevemar: osc code seems weird | 20:47 |
| *** tonytan4ever has quit IRC | 20:51 | |
| *** zqfan has quit IRC | 20:53 | |
| *** BigWillie has quit IRC | 20:58 | |
| *** tqtran has joined #openstack-keystone | 21:00 | |
| *** ddieterly[away] is now known as ddieterly | 21:00 | |
| *** raildo is now known as raildo-afk | 21:10 | |
| notmorgan | stevemar: ok so i think i'll pull in victor's assertTimeStampEquals | 21:11 |
| notmorgan | and co-author him on the patch | 21:11 |
| notmorgan | that sound good? | 21:11 |
| *** ninag has quit IRC | 21:14 | |
| *** ngupta_ has quit IRC | 21:15 | |
| *** rderose has quit IRC | 21:19 | |
| *** julim has quit IRC | 21:20 | |
| *** dmk0202 has quit IRC | 21:22 | |
| *** pauloewerton has quit IRC | 21:26 | |
| *** pushkaru has quit IRC | 21:27 | |
| *** jbell8 has quit IRC | 21:29 | |
| *** edtubill has quit IRC | 21:33 | |
| *** chrisshattuck has joined #openstack-keystone | 21:35 | |
| *** rderose has joined #openstack-keystone | 21:37 | |
| *** doug-fish has quit IRC | 21:38 | |
| *** sdake has quit IRC | 21:39 | |
| *** jbell8 has joined #openstack-keystone | 21:42 | |
| *** jbell8 has quit IRC | 21:44 | |
| *** doug-fish has joined #openstack-keystone | 21:44 | |
| *** jbell8 has joined #openstack-keystone | 21:47 | |
| *** doug-fish has quit IRC | 21:49 | |
| dstanek | notmorgan: sounds greeeaaat. | 21:49 |
| *** doug-fish has joined #openstack-keystone | 21:50 | |
| *** doug-fish has quit IRC | 21:54 | |
| openstackgerrit | guang-yee proposed openstack/keystone: make sure default_project_id is not domain on user creation and update https://review.openstack.org/317792 | 21:56 |
| *** daemontool has quit IRC | 21:57 | |
| *** darosale has quit IRC | 22:04 | |
| *** edmondsw has quit IRC | 22:06 | |
| *** ddieterly is now known as ddieterly[away] | 22:07 | |
| *** ayoung has joined #openstack-keystone | 22:08 | |
| *** ChanServ sets mode: +v ayoung | 22:08 | |
| *** jbell8 has quit IRC | 22:09 | |
| *** rderose has quit IRC | 22:13 | |
| *** shaleh has joined #openstack-keystone | 22:13 | |
| notmorgan | dstanek: lol | 22:15 |
| *** rderose has joined #openstack-keystone | 22:18 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:20 | |
| *** rcernin has quit IRC | 22:23 | |
| *** markvoelker has joined #openstack-keystone | 22:27 | |
| *** markvoelker has quit IRC | 22:29 | |
| *** ddieterly[away] is now known as ddieterly | 22:29 | |
| *** markvoelker has joined #openstack-keystone | 22:29 | |
| *** sdake has joined #openstack-keystone | 22:30 | |
| *** ngupta has joined #openstack-keystone | 22:32 | |
| *** ninag has joined #openstack-keystone | 22:38 | |
| *** ninag has quit IRC | 22:41 | |
| *** doug-fish has joined #openstack-keystone | 22:44 | |
| *** doug-fish has quit IRC | 22:44 | |
| *** sdake has quit IRC | 22:45 | |
| *** ddieterly has quit IRC | 22:51 | |
| *** diazjf1 has quit IRC | 22:54 | |
| *** josecastroleon has quit IRC | 22:54 | |
| *** chrisshattuck has quit IRC | 22:55 | |
| *** markvoelker has quit IRC | 22:58 | |
| *** timcline has quit IRC | 22:59 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Config changes to support PCI-DSS https://review.openstack.org/314679 | 23:01 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Config settings to support PCI-DSS https://review.openstack.org/314679 | 23:02 |
| *** yolanda has quit IRC | 23:03 | |
| *** ametts has quit IRC | 23:04 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:04 |
| *** sdake has joined #openstack-keystone | 23:04 | |
| *** ngupta has quit IRC | 23:05 | |
| *** yolanda has joined #openstack-keystone | 23:05 | |
| *** dan_nguyen has joined #openstack-keystone | 23:06 | |
| *** ngupta has joined #openstack-keystone | 23:08 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 tests for test_v3_auth https://review.openstack.org/318381 | 23:11 |
| notmorgan | stevemar: ^ | 23:11 |
| notmorgan | dstanek: ^ | 23:11 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:14 |
| *** sdake has quit IRC | 23:14 | |
| *** sdake has joined #openstack-keystone | 23:15 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 23:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Config settings to support PCI-DSS https://review.openstack.org/314679 | 23:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 23:20 |
| *** sdake has quit IRC | 23:21 | |
| *** ayoung has quit IRC | 23:22 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:25 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 23:26 |
| *** gordc has quit IRC | 23:26 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/317007 | 23:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:29 |
| notmorgan | dstanek, gyee, stevemar: https://review.openstack.org/#/c/318381/3 this just passed the py27/34 tests and the previous version passed everything else. should be good to land today | 23:31 |
| patchbot | notmorgan: patch 318381 - keystone - Enable py3 tests for test_v3_auth | 23:31 |
| notmorgan | (or looks like it's passing 34) | 23:31 |
| gyee | notmorgan, nice! I was looking at the timestamp failure | 23:32 |
| gyee | there was a second difference, not subsecond | 23:32 |
| *** jbell8 has joined #openstack-keystone | 23:32 | |
| notmorgan | gyee: every test i saw was subsecond difference | 23:32 |
| *** jbell8 has quit IRC | 23:33 | |
| notmorgan | gyee: ran it a few hundred times here. | 23:33 |
| gyee | that's good | 23:33 |
| notmorgan | gyee: sigh and it failed again | 23:33 |
| notmorgan | our tests suck | 23:33 |
| gyee | btw, is python-openstackclient master broken? | 23:34 |
| notmorgan | gyee: another '2016-05-20T00:28:48.523130Z' != '2016-05-20T00:28:48.523129Z'" subsecond failure | 23:34 |
| gyee | I keep getting "TypeError: Message objects do not support addition." | 23:34 |
| notmorgan | sigh.. missed one | 23:34 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Enable py3 tests for test_v3_auth https://review.openstack.org/318381 | 23:36 |
| notmorgan | gyee: dunno | 23:36 |
| bkero | notmorgan: \o/ | 23:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:36 |
| *** BjoernT has quit IRC | 23:37 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Pass a request to controllers instead of a context https://review.openstack.org/318658 | 23:37 |
| gyee | stevemar, dtroyer, https://bugs.launchpad.net/python-openstackclient/+bug/1575787 | 23:40 |
| openstack | Launchpad bug 1575787 in python-openstackclient "i18n Error for message objects concatenation" [Undecided,In progress] - Assigned to Madhu Mohan Nelemane (mmohan-9) | 23:40 |
| gyee | I also got the same problem | 23:40 |
| *** zqfan has joined #openstack-keystone | 23:41 | |
| *** chrisshattuck has joined #openstack-keystone | 23:49 | |
| *** ayoung has joined #openstack-keystone | 23:49 | |
| *** ChanServ sets mode: +v ayoung | 23:49 | |
| *** jamielennox is now known as jamielennox|away | 23:49 | |
| *** sdake has joined #openstack-keystone | 23:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 23:54 |
| *** iurygregory_ has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!