| *** iurygregory has joined #openstack-keystone | 00:00 | |
| *** jhesketh_ is now known as jhesketh | 00:02 | |
| *** spzala has joined #openstack-keystone | 00:07 | |
| *** timcline has joined #openstack-keystone | 00:09 | |
| *** gyee has quit IRC | 00:10 | |
| *** roxanagh_ has joined #openstack-keystone | 00:11 | |
| *** ddieterly has joined #openstack-keystone | 00:13 | |
| *** timcline has quit IRC | 00:14 | |
| *** spzala has quit IRC | 00:14 | |
| *** roxanagh_ has quit IRC | 00:16 | |
| *** neophy has joined #openstack-keystone | 00:16 | |
| *** rderose has joined #openstack-keystone | 00:17 | |
| *** samueldmq has joined #openstack-keystone | 00:19 | |
| *** d0ugal has joined #openstack-keystone | 00:19 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 00:20 |
|---|---|---|
| *** josecastroleon has joined #openstack-keystone | 00:20 | |
| *** andrewbogott has joined #openstack-keystone | 00:21 | |
| *** ngupta has quit IRC | 00:24 | |
| *** shaleh has quit IRC | 00:36 | |
| *** browne has quit IRC | 00:37 | |
| *** lhcheng has quit IRC | 00:41 | |
| *** sheel has joined #openstack-keystone | 00:43 | |
| *** stingaci has quit IRC | 00:45 | |
| *** ngupta has joined #openstack-keystone | 00:57 | |
| *** brad[] has quit IRC | 01:03 | |
| *** brad[] has joined #openstack-keystone | 01:03 | |
| *** rderose has quit IRC | 01:10 | |
| *** timcline has joined #openstack-keystone | 01:10 | |
| *** furface has joined #openstack-keystone | 01:13 | |
| *** timcline has quit IRC | 01:15 | |
| *** spzala has joined #openstack-keystone | 01:19 | |
| *** EinstCrazy has joined #openstack-keystone | 01:24 | |
| *** rderose has joined #openstack-keystone | 01:36 | |
| *** browne has joined #openstack-keystone | 01:49 | |
| *** spzala has quit IRC | 01:52 | |
| *** ngupta has quit IRC | 01:55 | |
| *** tqtran has quit IRC | 01:59 | |
| *** EinstCrazy has quit IRC | 02:00 | |
| *** EinstCrazy has joined #openstack-keystone | 02:00 | |
| *** adu has joined #openstack-keystone | 02:01 | |
| openstackgerrit | Merged openstack/keystoneauth: Use betamax hooks to mask fixture results https://review.openstack.org/311133 | 02:04 |
| *** ngupta has joined #openstack-keystone | 02:05 | |
| *** neophy has quit IRC | 02:07 | |
| *** timcline has joined #openstack-keystone | 02:11 | |
| *** ngupta has quit IRC | 02:11 | |
| *** neophy has joined #openstack-keystone | 02:13 | |
| *** ddieterly is now known as ddieterly[away] | 02:15 | |
| *** timcline has quit IRC | 02:16 | |
| *** hoonetorg has quit IRC | 02:20 | |
| *** ddieterly[away] is now known as ddieterly | 02:20 | |
| *** hoonetorg has joined #openstack-keystone | 02:20 | |
| *** markvoelker has quit IRC | 02:21 | |
| *** ddieterly is now known as ddieterly[away] | 02:24 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 02:24 |
| *** spzala has joined #openstack-keystone | 02:26 | |
| *** spzala has quit IRC | 02:26 | |
| *** spzala has joined #openstack-keystone | 02:27 | |
| *** ngupta has joined #openstack-keystone | 02:28 | |
| *** browne has quit IRC | 02:30 | |
| *** spzala has quit IRC | 02:31 | |
| *** pgreg has joined #openstack-keystone | 02:35 | |
| *** pgreg has quit IRC | 02:36 | |
| *** pgreg has joined #openstack-keystone | 02:37 | |
| *** adu has quit IRC | 02:44 | |
| *** TxGVNN has joined #openstack-keystone | 02:47 | |
| *** richm has quit IRC | 02:51 | |
| *** adu has joined #openstack-keystone | 02:54 | |
| *** tqtran has joined #openstack-keystone | 02:56 | |
| *** tqtran has quit IRC | 03:00 | |
| *** chenzeng has joined #openstack-keystone | 03:02 | |
| *** spzala has joined #openstack-keystone | 03:02 | |
| *** timcline has joined #openstack-keystone | 03:04 | |
| *** spzala has quit IRC | 03:08 | |
| *** timcline has quit IRC | 03:09 | |
| *** iurygregory_ has joined #openstack-keystone | 03:12 | |
| *** roxanagh_ has joined #openstack-keystone | 03:15 | |
| *** iurygregory has quit IRC | 03:18 | |
| *** roxanagh_ has quit IRC | 03:20 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Config settings to support PCI-DSS https://review.openstack.org/314679 | 03:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 03:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/320156 | 03:20 |
| *** markvoelker has joined #openstack-keystone | 03:22 | |
| *** ddieterly[away] has quit IRC | 03:24 | |
| *** markvoelker has quit IRC | 03:27 | |
| *** roxanagh_ has joined #openstack-keystone | 03:27 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.4: User must change their password requirements https://review.openstack.org/320156 | 03:27 |
| *** adu has quit IRC | 03:29 | |
| *** sdake_ has quit IRC | 03:29 | |
| *** tqtran has joined #openstack-keystone | 03:32 | |
| notmorgan | ayoung: what time is rodrigods usually online? | 03:32 |
| notmorgan | ayoung: need to chat with him tomorrow. | 03:32 |
| *** tqtran has quit IRC | 03:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength and change password requirements https://review.openstack.org/320156 | 03:34 |
| *** dave-mcc_ has quit IRC | 03:38 | |
| *** lhcheng has joined #openstack-keystone | 03:39 | |
| *** ChanServ sets mode: +v lhcheng | 03:39 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength and change password requirements https://review.openstack.org/320156 | 03:40 |
| *** roxanagh_ has quit IRC | 03:46 | |
| *** roxanagh_ has joined #openstack-keystone | 03:55 | |
| *** david-lyle_ has joined #openstack-keystone | 03:55 | |
| *** david-lyle has quit IRC | 03:57 | |
| notmorgan | rderose: you just going to stack up all the changes and then un wip them? | 03:58 |
| rderose | notmorgan: yeah, the latest I think will really be about change password requirements | 03:59 |
| rderose | notmorgan: I'm going to try to break it up into chunks; not do everything at once | 04:00 |
| notmorgan | rderose: wfm. | 04:00 |
| rderose | notmorgan: wfm?? | 04:00 |
| rderose | notmorgan: but yeah, each patch will be dependent on the next | 04:01 |
| *** spzala has joined #openstack-keystone | 04:04 | |
| *** timcline has joined #openstack-keystone | 04:05 | |
| *** links has joined #openstack-keystone | 04:07 | |
| *** lhcheng has quit IRC | 04:08 | |
| *** timcline has quit IRC | 04:09 | |
| *** spzala has quit IRC | 04:10 | |
| *** rderose has quit IRC | 04:13 | |
| *** rderose has joined #openstack-keystone | 04:13 | |
| *** rderose has quit IRC | 04:17 | |
| *** sdake has joined #openstack-keystone | 04:17 | |
| *** sdake has quit IRC | 04:18 | |
| *** TxGVNN has quit IRC | 04:20 | |
| *** markvoelker has joined #openstack-keystone | 04:23 | |
| jamielennox | works for me | 04:26 |
| *** markvoelker has quit IRC | 04:28 | |
| *** diazjf has joined #openstack-keystone | 04:40 | |
| *** diazjf has quit IRC | 04:40 | |
| *** roxanagh_ has quit IRC | 04:43 | |
| *** jaosorior has joined #openstack-keystone | 04:56 | |
| *** GB21 has joined #openstack-keystone | 04:58 | |
| *** spzala has joined #openstack-keystone | 05:02 | |
| *** timcline has joined #openstack-keystone | 05:06 | |
| *** spzala has quit IRC | 05:06 | |
| *** timcline has quit IRC | 05:10 | |
| *** dmellado has quit IRC | 05:13 | |
| *** links has quit IRC | 05:14 | |
| *** dmellado has joined #openstack-keystone | 05:17 | |
| *** links has joined #openstack-keystone | 05:18 | |
| *** links has quit IRC | 05:24 | |
| *** markvoelker has joined #openstack-keystone | 05:24 | |
| *** roxanagh_ has joined #openstack-keystone | 05:25 | |
| *** ngupta has quit IRC | 05:25 | |
| *** markvoelker has quit IRC | 05:29 | |
| *** roxanagh_ has quit IRC | 05:29 | |
| *** jaosorior has quit IRC | 05:38 | |
| *** jaosorior has joined #openstack-keystone | 05:41 | |
| *** GB21 has quit IRC | 05:44 | |
| *** ngupta has joined #openstack-keystone | 05:44 | |
| *** TxGVNN has joined #openstack-keystone | 05:50 | |
| *** GB21 has joined #openstack-keystone | 05:56 | |
| *** rk4n has joined #openstack-keystone | 06:00 | |
| *** links has joined #openstack-keystone | 06:03 | |
| *** timcline has joined #openstack-keystone | 06:07 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Added X-Forwarding-For support. https://review.openstack.org/309038 | 06:07 |
| *** rcernin has joined #openstack-keystone | 06:08 | |
| openstackgerrit | Merged openstack/keystone-specs: Cleanup 'implied roles' section of Identity API V3 spec https://review.openstack.org/298925 | 06:08 |
| *** sdake has joined #openstack-keystone | 06:11 | |
| *** timcline has quit IRC | 06:11 | |
| *** nikhil has quit IRC | 06:14 | |
| *** serverascode has quit IRC | 06:15 | |
| *** ctracey has quit IRC | 06:15 | |
| *** DuncanT has quit IRC | 06:15 | |
| *** nikhil has joined #openstack-keystone | 06:16 | |
| *** ctracey has joined #openstack-keystone | 06:16 | |
| *** DuncanT has joined #openstack-keystone | 06:18 | |
| *** dolphm has quit IRC | 06:21 | |
| *** med_ has quit IRC | 06:21 | |
| *** woodster_ has quit IRC | 06:22 | |
| *** dolphm has joined #openstack-keystone | 06:23 | |
| *** ChanServ sets mode: +o dolphm | 06:23 | |
| *** markvoelker has joined #openstack-keystone | 06:25 | |
| *** med_ has joined #openstack-keystone | 06:25 | |
| *** med_ has quit IRC | 06:25 | |
| *** med_ has joined #openstack-keystone | 06:25 | |
| *** sdake has quit IRC | 06:25 | |
| *** woodster_ has joined #openstack-keystone | 06:26 | |
| *** hughsaunders has quit IRC | 06:26 | |
| *** samueldmq has quit IRC | 06:27 | |
| *** samueldmq has joined #openstack-keystone | 06:27 | |
| *** harlowja has quit IRC | 06:28 | |
| *** markvoelker has quit IRC | 06:29 | |
| *** aloga has quit IRC | 06:31 | |
| *** hughsaunders has joined #openstack-keystone | 06:32 | |
| *** ngupta has quit IRC | 06:33 | |
| *** serverascode has joined #openstack-keystone | 06:35 | |
| *** sdake has joined #openstack-keystone | 06:37 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 06:37 |
| *** rk4n has joined #openstack-keystone | 06:39 | |
| *** neophy has quit IRC | 06:40 | |
| *** sdake has quit IRC | 06:53 | |
| *** spzala has joined #openstack-keystone | 07:02 | |
| *** tesseract has joined #openstack-keystone | 07:04 | |
| *** spzala has quit IRC | 07:07 | |
| *** timcline has joined #openstack-keystone | 07:07 | |
| *** tesseract has quit IRC | 07:08 | |
| *** rk4n has quit IRC | 07:11 | |
| *** aloga has joined #openstack-keystone | 07:11 | |
| *** timcline has quit IRC | 07:12 | |
| openstackgerrit | Merged openstack/keystoneauth: Add is_domain to keystoneauth token https://review.openstack.org/282377 | 07:16 |
| *** rwsu has joined #openstack-keystone | 07:19 | |
| *** rwsu has quit IRC | 07:22 | |
| *** markvoelker has joined #openstack-keystone | 07:26 | |
| *** jaosorior is now known as jaosorior_brb | 07:28 | |
| *** markvoelker has quit IRC | 07:32 | |
| *** henrynash has joined #openstack-keystone | 07:32 | |
| *** ChanServ sets mode: +v henrynash | 07:32 | |
| *** woodster_ has quit IRC | 07:48 | |
| *** GB21 has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** spzala has joined #openstack-keystone | 08:04 | |
| *** spzala has quit IRC | 08:08 | |
| *** timcline has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** timcline has quit IRC | 08:12 | |
| *** belmoreira has joined #openstack-keystone | 08:15 | |
| *** dmk0202 has joined #openstack-keystone | 08:16 | |
| *** GB21 has joined #openstack-keystone | 08:17 | |
| *** odyssey4me_ is now known as odyssey4me | 08:26 | |
| *** afazekas_ is now known as afazekas | 08:27 | |
| *** markvoelker has joined #openstack-keystone | 08:28 | |
| *** markvoelker has quit IRC | 08:32 | |
| *** pnavarro has joined #openstack-keystone | 08:34 | |
| *** EinstCrazy has quit IRC | 08:37 | |
| *** EinstCrazy has joined #openstack-keystone | 08:40 | |
| *** ig0r_ has joined #openstack-keystone | 08:40 | |
| *** fmarco76 has joined #openstack-keystone | 08:50 | |
| *** jaosorior_brb is now known as jaosorior | 08:50 | |
| *** fmarco76 has quit IRC | 08:50 | |
| *** EinstCrazy has quit IRC | 08:51 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add name to the project deleted notification event https://review.openstack.org/320299 | 08:52 |
| *** EinstCrazy has joined #openstack-keystone | 08:57 | |
| *** daemontool_ has joined #openstack-keystone | 09:00 | |
| *** timcline has joined #openstack-keystone | 09:09 | |
| *** timcline has quit IRC | 09:13 | |
| *** sdake has joined #openstack-keystone | 09:20 | |
| *** GB21 has quit IRC | 09:21 | |
| *** Dave____ is now known as Dave | 09:21 | |
| *** zigo_ is now known as zigo | 09:28 | |
| openstackgerrit | Ryosuke Mizuno proposed openstack/keystone: Add name to the project deleted notification event https://review.openstack.org/320299 | 09:30 |
| *** GB21 has joined #openstack-keystone | 09:37 | |
| *** iurygregory_ is now known as iurygregory | 09:45 | |
| *** mvk has quit IRC | 09:53 | |
| *** sdake has quit IRC | 10:01 | |
| *** spzala has joined #openstack-keystone | 10:05 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 10:05 |
| *** rk4n has joined #openstack-keystone | 10:05 | |
| *** spzala has quit IRC | 10:10 | |
| *** timcline has joined #openstack-keystone | 10:10 | |
| *** timcline has quit IRC | 10:14 | |
| openstackgerrit | yolanda.robla proposed openstack/keystoneauth: Update keystoneauth fixture to support v3 https://review.openstack.org/320340 | 10:19 |
| *** mvk has joined #openstack-keystone | 10:22 | |
| *** markvoelker has joined #openstack-keystone | 10:29 | |
| *** EinstCrazy has quit IRC | 10:32 | |
| *** EinstCrazy has joined #openstack-keystone | 10:32 | |
| *** markvoelker has quit IRC | 10:34 | |
| *** EinstCrazy has quit IRC | 10:37 | |
| openstackgerrit | Dina Belova proposed openstack/keystone: Add DB operations tracing https://review.openstack.org/294535 | 10:45 |
| openstackgerrit | Dina Belova proposed openstack/keystone: == DO NOT MERGE == Add cache profiling https://review.openstack.org/302799 | 10:45 |
| *** pgreg_ has joined #openstack-keystone | 10:48 | |
| *** pgreg has quit IRC | 10:51 | |
| *** spzala has joined #openstack-keystone | 11:06 | |
| *** spzala has quit IRC | 11:10 | |
| *** timcline has joined #openstack-keystone | 11:10 | |
| *** timcline has quit IRC | 11:15 | |
| *** brad[] has quit IRC | 11:16 | |
| *** tellesnobrega has quit IRC | 11:17 | |
| *** sdake has joined #openstack-keystone | 11:17 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 11:19 |
| *** brad[] has joined #openstack-keystone | 11:24 | |
| *** markvoelker has joined #openstack-keystone | 11:30 | |
| *** rodrigods has quit IRC | 11:31 | |
| *** rodrigods has joined #openstack-keystone | 11:31 | |
| *** tlbr_ has quit IRC | 11:31 | |
| *** ig0r_ has quit IRC | 11:34 | |
| *** markvoelker has quit IRC | 11:35 | |
| *** jaosorior has quit IRC | 11:39 | |
| *** jaosorior has joined #openstack-keystone | 11:40 | |
| *** jaosorior has quit IRC | 11:40 | |
| *** jaosorior has joined #openstack-keystone | 11:41 | |
| *** ddieterly has joined #openstack-keystone | 11:41 | |
| *** julim has joined #openstack-keystone | 11:45 | |
| *** sdake has quit IRC | 11:49 | |
| *** pgreg_ has quit IRC | 11:51 | |
| *** ddieterly is now known as ddieterly[away] | 11:55 | |
| *** brad[] has quit IRC | 11:56 | |
| *** ig0r_ has joined #openstack-keystone | 11:57 | |
| *** brad[] has joined #openstack-keystone | 11:57 | |
| *** tlbr has joined #openstack-keystone | 12:00 | |
| *** markvoelker has joined #openstack-keystone | 12:02 | |
| *** spzala has joined #openstack-keystone | 12:07 | |
| *** spzala has quit IRC | 12:11 | |
| *** timcline has joined #openstack-keystone | 12:11 | |
| *** afred312 has quit IRC | 12:15 | |
| *** timcline has quit IRC | 12:15 | |
| *** afred312 has joined #openstack-keystone | 12:16 | |
| *** ddieterly[away] is now known as ddieterly | 12:18 | |
| *** ayoung has quit IRC | 12:19 | |
| *** GB21 has quit IRC | 12:20 | |
| *** afred312 has quit IRC | 12:20 | |
| *** gordc has joined #openstack-keystone | 12:20 | |
| openstackgerrit | wangxiyuan proposed openstack/python-keystoneclient: Allow send null value in extra properties https://review.openstack.org/296246 | 12:38 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3 docs from api-ref repo https://review.openstack.org/320145 | 12:40 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Microversions https://review.openstack.org/315180 | 12:41 |
| dstanek | i'm going to start a mini series 'fun with shib' | 12:44 |
| samueldmq | dstanek: howdy, blog posts? | 12:44 |
| *** ChanServ sets mode: +v samueldmq | 12:45 | |
| dstanek | videos! | 12:45 |
| *** afred312 has joined #openstack-keystone | 12:45 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Microversions https://review.openstack.org/315180 | 12:45 |
| samueldmq | dstanek: ++ | 12:45 |
| *** afred312 has quit IRC | 12:46 | |
| dstanek | i finally took the time to make a screencast yesterday using software that i bought years ago | 12:46 |
| *** afred312 has joined #openstack-keystone | 12:46 | |
| samueldmq | dstanek: going to upload it ? :) | 12:46 |
| dstanek | samueldmq: it's on youtube already....getting the link | 12:47 |
| dstanek | https://www.youtube.com/watch?v=BbDlUMaA-Zk | 12:47 |
| samueldmq | dstanek: cool! looking, thanks | 12:47 |
| dstanek | next step is to figure out what i was seeing in that video | 12:47 |
| samueldmq | dstanek: segfault ? lol | 12:48 |
| rodrigods | dstanek, lol | 12:48 |
| dstanek | yeppers | 12:48 |
| *** catintheroof has joined #openstack-keystone | 12:49 | |
| samueldmq | dstanek: that's scary | 12:50 |
| samueldmq | dstanek: and nice thing too, that's a very cool resource | 12:51 |
| samueldmq | because you explain the federation workflow, etc :) | 12:52 |
| *** rk4n has quit IRC | 12:52 | |
| rodrigods | dstanek, that's why we need to use mod_auth_mellon | 12:52 |
| rodrigods | samueldmq, ++ | 12:52 |
| *** rk4n has joined #openstack-keystone | 12:52 | |
| lbragstad | dstanek do you have patches up for ^ | 12:53 |
| lbragstad | dstanek also - given the email about python 3 yesterday https://review.openstack.org/#/c/207526/1 | 12:53 |
| patchbot | lbragstad: patch 207526 - keystone - WIP Fernet on Python 3 | 12:53 |
| dstanek | rodrigods: i can give that a try and see what happens - i wasn't able to get it to reload idps without restarting apache | 12:53 |
| dstanek | lbragstad: reviews for what? | 12:53 |
| lbragstad | dstanek the shib stuff? | 12:54 |
| *** andrewbogott has quit IRC | 12:54 | |
| *** andrewbogott has joined #openstack-keystone | 12:54 | |
| dstanek | lbragstad: no that was just testing k2k | 12:54 |
| rodrigods | dstanek, btw... do you have your ansbile stuff in github? | 12:54 |
| lbragstad | ah gotcha | 12:54 |
| dstanek | lbragstad: i don't think that is needed anymore, but i can check | 12:54 |
| dstanek | lbragstad: not yet....i really want to publish some roles on galaxy...but time :-( | 12:55 |
| *** sheel has quit IRC | 12:55 | |
| rodrigods | dstanek, damm... was about to ask you to review something for me :) | 12:56 |
| *** pauloewerton has joined #openstack-keystone | 12:56 | |
| *** david-lyle has joined #openstack-keystone | 12:57 | |
| catintheroof | guys, i need to know some conceptual thing, supposing that i have only identity with LDAP and assignment with sql, the idea behind using mysql to tell which user is on what project and LDAP for auth, is that keystone just finds the user on ldap and nothing related to projects & roles & etc ? | 12:57 |
| bknudson | how do you represent in LDAP that a user has a role on a project? | 12:59 |
| catintheroof | bknudson, i suppose that using LDAP with assignment, but will not be my case | 12:59 |
| catintheroof | bknudson, so ... what im assuming is right ? | 13:00 |
| *** jistr is now known as jistr|mtg | 13:01 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Migrate identity /v3 docs from api-ref repo https://review.openstack.org/320145 | 13:01 |
| bknudson | catintheroof: I don't understand what you're assuming. If you think that only users and groups are in ldap, and roles, projects, and role-assignments are in sql then that's correct. | 13:01 |
| *** david-lyle_ has quit IRC | 13:01 | |
| dstanek | rodrigods: i am setting aside a few hours for reviews today. which one were you going to ask about? | 13:01 |
| rodrigods | dstanek, the old tempest plugin one https://review.openstack.org/#/c/302299/ :) | 13:02 |
| patchbot | rodrigods: patch 302299 - keystone - Add identity providers integration tests | 13:02 |
| *** ddieterly has quit IRC | 13:02 | |
| rodrigods | dstanek, the patch is chain is just doing basic testing in the tempest clients -> so we can write scenarios using them! | 13:02 |
| catintheroof | bknudson, nice, that's what im assuming, thanks for confirming. and the last one would be, in that case, when you assign a user to a project, does keystone validates that the user exists on LDAP ? | 13:02 |
| dstanek | rodrigods: cool...added to the list :-) | 13:03 |
| rodrigods | thanks dstanek | 13:03 |
| bknudson | catintheroof: this seems like something that would be very easy for you to try out. | 13:03 |
| *** edmondsw has joined #openstack-keystone | 13:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Correct Identity spec for versions response https://review.openstack.org/320437 | 13:07 |
| *** spzala has joined #openstack-keystone | 13:07 | |
| *** sdake has joined #openstack-keystone | 13:09 | |
| *** jaosorior has quit IRC | 13:10 | |
| dstanek | rodrigods: yw....going heads-down on capstone for a little while | 13:12 |
| *** timcline has joined #openstack-keystone | 13:12 | |
| *** spzala has quit IRC | 13:12 | |
| *** BjoernT has joined #openstack-keystone | 13:12 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:12 | |
| *** sdake has quit IRC | 13:13 | |
| *** timcline has quit IRC | 13:16 | |
| *** richm has joined #openstack-keystone | 13:17 | |
| *** afred312 has quit IRC | 13:22 | |
| *** _amrith_ is now known as amrith | 13:23 | |
| *** afred312 has joined #openstack-keystone | 13:23 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Correct Identity spec for versions response https://review.openstack.org/320437 | 13:23 |
| *** dave-mccowan has joined #openstack-keystone | 13:24 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:24 | |
| *** ayoung has joined #openstack-keystone | 13:27 | |
| *** ChanServ sets mode: +v ayoung | 13:27 | |
| *** afred312 has quit IRC | 13:27 | |
| *** jsavak has joined #openstack-keystone | 13:27 | |
| *** ddieterly has joined #openstack-keystone | 13:29 | |
| *** ngupta has joined #openstack-keystone | 13:29 | |
| henrynash | rodigods: tahnks for the review on the microversions spec….your comment on the /v3 API call…not quite sure I understand what you are getting at there? | 13:36 |
| *** fesp has joined #openstack-keystone | 13:36 | |
| rodrigods | henrynash, the versions call is not only to /v3, but also to / | 13:37 |
| henrynash | rodigods: ah, right - yep | 13:37 |
| henrynash | rodigods: (which doesn’t seem to be documented anywhere :-) ) | 13:37 |
| rodrigods | henrynash, heh so we found a doc bug! | 13:37 |
| *** BigWillie has joined #openstack-keystone | 13:38 | |
| henrynash | :-) | 13:38 |
| *** fesp has quit IRC | 13:40 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Microversions https://review.openstack.org/315180 | 13:41 |
| *** ddieterly is now known as ddieterly[away] | 13:41 | |
| *** afred312 has joined #openstack-keystone | 13:42 | |
| *** ametts has joined #openstack-keystone | 13:46 | |
| *** ddieterly[away] is now known as ddieterly | 13:48 | |
| *** phalmos has joined #openstack-keystone | 13:59 | |
| *** jaugustine has joined #openstack-keystone | 13:59 | |
| *** phalmos_ has joined #openstack-keystone | 14:00 | |
| *** darosale has joined #openstack-keystone | 14:03 | |
| *** phalmos has quit IRC | 14:04 | |
| *** jistr|mtg is now known as jistr | 14:04 | |
| *** gagehugo has joined #openstack-keystone | 14:05 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Microversions https://review.openstack.org/315180 | 14:06 |
| henrynash | notmorgan, ayoung: ping | 14:08 |
| ayoung | henrynash, da comrade! | 14:09 |
| *** afred312 has quit IRC | 14:09 | |
| *** ngupta has quit IRC | 14:09 | |
| *** woodster_ has joined #openstack-keystone | 14:09 | |
| henrynash | ayoung: :-) so as you have seen I;ve been bashing on the microversions spec…I noticed you put morgan as primary assignee….is taht because he wanted it..or just that you didn’t !?!?! | 14:10 |
| ayoung | henrynash, yes, he wanted it, and I wanted to make sure it was recorded | 14:10 |
| ayoung | you are welcome to take it | 14:10 |
| ayoung | I think it is more process for process sake myself | 14:11 |
| henrynash | ayoung: Ok, I’ll check with hime to see how we divi this out…. | 14:11 |
| henrynash | ayoung: thx | 14:12 |
| *** henrynash has quit IRC | 14:12 | |
| *** timcline has joined #openstack-keystone | 14:13 | |
| *** spzala has joined #openstack-keystone | 14:14 | |
| *** spzala has quit IRC | 14:14 | |
| *** julim has quit IRC | 14:15 | |
| *** timcline has quit IRC | 14:17 | |
| *** sheel has joined #openstack-keystone | 14:18 | |
| *** spzala has joined #openstack-keystone | 14:18 | |
| *** afred312_ has joined #openstack-keystone | 14:24 | |
| notmorgan | I want to point out Henry needs an IRC bouncer. | 14:29 |
| notmorgan | He is almost never online with overlap with me so when he asks these questions it is by proxy. | 14:30 |
| rodrigods | ++ | 14:31 |
| *** ddieterly is now known as ddieterly[away] | 14:33 | |
| *** rk4n_ has joined #openstack-keystone | 14:35 | |
| *** rk4n has quit IRC | 14:36 | |
| *** zzzeek has quit IRC | 14:40 | |
| *** afred312_ has quit IRC | 14:42 | |
| *** BjoernT has quit IRC | 14:42 | |
| *** david-lyle has quit IRC | 14:42 | |
| *** mvk has quit IRC | 14:42 | |
| *** josecastroleon has quit IRC | 14:42 | |
| *** hugokuo has quit IRC | 14:42 | |
| *** dolphm has quit IRC | 14:42 | |
| *** pushkaru has joined #openstack-keystone | 14:43 | |
| *** phalmos_ has quit IRC | 14:44 | |
| *** _d34dh0r53_ is now known as d34dh0r53 | 14:45 | |
| *** rcernin has quit IRC | 14:47 | |
| SamYaple | did the reseller domains-are-projects stuff get implemented in time for mitaka? | 14:48 |
| rodrigods | SamYaple, yes sir | 14:49 |
| *** sdake has joined #openstack-keystone | 14:49 | |
| *** edtubill has joined #openstack-keystone | 14:49 | |
| SamYaple | rodrigods: ok sweet. i have some experimenting to do then. thanks | 14:50 |
| rodrigods | SamYaple, it might help you: https://review.openstack.org/#/c/285541/ | 14:50 |
| patchbot | rodrigods: patch 285541 - tempest - Add parent_id to create_project | 14:50 |
| SamYaple | thanks rodrigods looking. might pop back with a question or two | 14:52 |
| rodrigods | SamYaple, yw :) | 14:53 |
| *** ngupta has joined #openstack-keystone | 14:54 | |
| *** ddieterly[away] is now known as ddieterly | 14:55 | |
| SamYaple | rodrigods: do you know how well this plays with ldap and multi-domains? | 14:55 |
| rodrigods | SamYaple, ldap for identity? | 14:55 |
| SamYaple | yea | 14:55 |
| rodrigods | should have no difference at all | 14:56 |
| SamYaple | cool | 14:56 |
| *** links has quit IRC | 14:57 | |
| *** GB21 has joined #openstack-keystone | 14:57 | |
| *** ddieterly is now known as ddieterly[away] | 14:57 | |
| *** rcernin has joined #openstack-keystone | 14:59 | |
| *** julim has joined #openstack-keystone | 15:00 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: Added app for policy enforcement https://review.openstack.org/317529 | 15:01 |
| *** mou has joined #openstack-keystone | 15:02 | |
| *** zzzeek has joined #openstack-keystone | 15:03 | |
| *** jistr is now known as jistr|mtg | 15:04 | |
| *** phalmos_ has joined #openstack-keystone | 15:04 | |
| *** timcline has joined #openstack-keystone | 15:13 | |
| *** Junhongl_ has joined #openstack-keystone | 15:14 | |
| *** diazjf has joined #openstack-keystone | 15:14 | |
| *** jrist has quit IRC | 15:15 | |
| *** diazjf has quit IRC | 15:15 | |
| yolanda | notmorgan, i prepared a new patch for keystoneauth: https://review.openstack.org/320340 | 15:17 |
| *** amrith is now known as _amrith_ | 15:17 | |
| notmorgan | yolanda: cool. | 15:18 |
| *** timcline has quit IRC | 15:18 | |
| *** rderose has joined #openstack-keystone | 15:18 | |
| notmorgan | yolanda: oh much better not using re.sub | 15:19 |
| *** Junhongl_ has left #openstack-keystone | 15:20 | |
| *** henrynash has joined #openstack-keystone | 15:22 | |
| *** ChanServ sets mode: +v henrynash | 15:22 | |
| yolanda | notmorgan, i prefer that way also | 15:23 |
| henrynash | notmorgan: I know I need an irc bouncer….just never manage to make it work | 15:24 |
| notmorgan | henrynash: ask stevemar, he helped topol set one up | 15:25 |
| bknudson | henrynash: I've got an irc bouncer on a softlayer. I tried to set one up on BlueMix but I always get errors. | 15:25 |
| topol | henrynash, stevemar I think wrote an opentech article on how to do this | 15:26 |
| henrynash | topol: nice! | 15:26 |
| samueldmq | I just have tmux + weechat on a server | 15:26 |
| topol | henrynash https://developer.ibm.com/opentech/2016/02/16/creating-a-new-virtual-machine-on-bluemix/ | 15:26 |
| lbragstad | henrynash https://github.com/dhellmann/ansible-znc-on-znc | 15:27 |
| topol | henrynash whoops! This one: https://developer.ibm.com/opentech/2016/01/21/openstack-development-tips-setting-up-a-znc-bouncer/ | 15:27 |
| *** jaosorior has joined #openstack-keystone | 15:27 | |
| henrynash | notmorgan: so (in non irc bouncer mode….aka…RT)….wanted to check in with you to see if you are looking to drive the microversions…or if you wanted someone else to…I’ve basically re-written the spec (i.e. translated the niva approach into a keystone one) | 15:28 |
| * topol I'm a littletoo fast on the trigger today | 15:28 | |
| henrynash | topol, lbragstad: thx | 15:28 |
| notmorgan | henrynash: unfortunately i wont have time to write it | 15:28 |
| notmorgan | henrynash: i am working to ramp up on zuul and nodepool. | 15:28 |
| notmorgan | henrynash: as that is my "what i am being paid for" job | 15:29 |
| henrynash | notmorgan: Ok, I’m up for it (since I need the functionality for the changes I want)….so OK if I take it? | 15:29 |
| notmorgan | henrynash: please do | 15:29 |
| henrynash | notmorgan: Ok, will do | 15:29 |
| *** tonytan4ever has joined #openstack-keystone | 15:31 | |
| *** ngupta has quit IRC | 15:33 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Microversions https://review.openstack.org/315180 | 15:33 |
| *** links has joined #openstack-keystone | 15:36 | |
| *** julim has quit IRC | 15:37 | |
| *** dmk0202 has quit IRC | 15:38 | |
| *** dmk0202 has joined #openstack-keystone | 15:38 | |
| *** rk4n_ has quit IRC | 15:39 | |
| *** julim has joined #openstack-keystone | 15:40 | |
| *** jistr|mtg is now known as jistr | 15:40 | |
| *** dolphm has joined #openstack-keystone | 15:40 | |
| *** wilhelm.freenode.net sets mode: +o dolphm | 15:40 | |
| *** Junhongl_ has joined #openstack-keystone | 15:40 | |
| *** Junhongl_ has quit IRC | 15:44 | |
| *** Junhongl_ has joined #openstack-keystone | 15:44 | |
| *** diazjf has joined #openstack-keystone | 15:45 | |
| *** afred312_ has joined #openstack-keystone | 15:45 | |
| *** BjoernT has joined #openstack-keystone | 15:45 | |
| *** david-lyle has joined #openstack-keystone | 15:45 | |
| *** mvk has joined #openstack-keystone | 15:45 | |
| *** josecastroleon has joined #openstack-keystone | 15:45 | |
| *** hugokuo has joined #openstack-keystone | 15:45 | |
| *** jrist has joined #openstack-keystone | 15:46 | |
| *** Junhongl_ has quit IRC | 15:47 | |
| *** jrist has quit IRC | 15:47 | |
| *** jrist has joined #openstack-keystone | 15:48 | |
| *** Junhongl has joined #openstack-keystone | 15:48 | |
| *** belmoreira has quit IRC | 15:51 | |
| *** Junhongl has quit IRC | 15:51 | |
| *** gyee has joined #openstack-keystone | 15:53 | |
| *** ChanServ sets mode: +v gyee | 15:53 | |
| *** jsavak has quit IRC | 15:54 | |
| *** phalmos has joined #openstack-keystone | 15:55 | |
| *** timcline has joined #openstack-keystone | 15:56 | |
| *** timcline has quit IRC | 15:56 | |
| *** ngupta has joined #openstack-keystone | 15:56 | |
| *** timcline has joined #openstack-keystone | 15:57 | |
| *** phalmos has quit IRC | 15:57 | |
| *** jrist has quit IRC | 15:57 | |
| *** afred312_ has quit IRC | 15:57 | |
| *** BjoernT has quit IRC | 15:57 | |
| *** david-lyle has quit IRC | 15:57 | |
| *** mvk has quit IRC | 15:57 | |
| *** josecastroleon has quit IRC | 15:57 | |
| *** hugokuo has quit IRC | 15:57 | |
| *** ddieterly[away] has quit IRC | 15:57 | |
| *** phalmos_ has quit IRC | 15:59 | |
| *** jaosorior has quit IRC | 16:01 | |
| *** ddieterly has joined #openstack-keystone | 16:02 | |
| *** ngupta has quit IRC | 16:03 | |
| *** phalmos has joined #openstack-keystone | 16:06 | |
| *** jrist has joined #openstack-keystone | 16:06 | |
| *** david-lyle has joined #openstack-keystone | 16:06 | |
| *** mvk has joined #openstack-keystone | 16:06 | |
| *** josecastroleon has joined #openstack-keystone | 16:06 | |
| *** hugokuo has joined #openstack-keystone | 16:06 | |
| *** ngupta has joined #openstack-keystone | 16:06 | |
| ayoung | notmorgan, are you following up on the tempest failures on the Tree Killer patch?> | 16:12 |
| notmorgan | ayoung: been looking at it. something weird. i think tempest is doing something fundamentally wrong | 16:13 |
| ayoung | notmorgan, but it passed without caching, right? | 16:13 |
| notmorgan | ayoung: since its not consistent, it's ~4-5 failures. | 16:13 |
| notmorgan | ayoung: not sure actually. | 16:13 |
| ayoung | notmorgan, patch set 9 had no cache, and it passed | 16:13 |
| ayoung | I think it is us | 16:13 |
| ayoung | what would cause the token to be improperly marked as revoked, but only if it is cached? | 16:14 |
| notmorgan | ayoung: only if the events are cached. | 16:14 |
| ayoung | so lets look at the types of revocations in the failing tests... | 16:14 |
| ayoung | are they all in teardown? It means the token for the admin user running the test is invalid at the end | 16:15 |
| notmorgan | nope. | 16:15 |
| notmorgan | mostly in setup | 16:15 |
| notmorgan | afaict | 16:15 |
| ayoung | http://logs.openstack.org/52/311652/16/check/gate-tempest-dsvm-full/861709f/console.html | 16:16 |
| ayoung | its in tear down, one failure | 16:16 |
| *** GB21 has quit IRC | 16:16 | |
| notmorgan | looking at the others it was mostly setup | 16:16 |
| notmorgan | meh screw it | 16:16 |
| notmorgan | just kill the caching | 16:16 |
| * notmorgan is done battling this. | 16:16 | |
| ayoung | http://logs.openstack.org/52/311652/16/check/gate-tempest-dsvm-postgres-full/df5e8a1/console.html was a mix | 16:17 |
| ayoung | caching should be viable here. | 16:18 |
| notmorgan | snd drive towards direct SQL queries. | 16:18 |
| *** GB21 has joined #openstack-keystone | 16:18 | |
| *** rk4n has joined #openstack-keystone | 16:18 | |
| notmorgan | we can deal with adding caching back in at that point | 16:18 |
| ayoung | notmorgan, OK, I'll take this one back over | 16:19 |
| notmorgan | just reset to pre-caching fix | 16:19 |
| notmorgan | and get it to pass. | 16:19 |
| ayoung | I think I can fixthe caching. Give me a few minutes | 16:19 |
| notmorgan | not worth it really if we're moving towards direct sql | 16:20 |
| ayoung | I think it is bleed over between tests. But how does caching do that | 16:20 |
| ayoung | notmorgan, we are not 100% in agreement there yet | 16:20 |
| notmorgan | in tempest state is preserved | 16:20 |
| ayoung | I have my doubts still | 16:20 |
| notmorgan | not between tests but in the services | 16:20 |
| ayoung | right, and that should be acceptable. Caching should not break things | 16:20 |
| notmorgan | and a DB query is low cost if you are matching indexes. | 16:21 |
| notmorgan | loading the events into ram and making python string match isn't going to be that effective. | 16:21 |
| notmorgan | its simpler to just lean on sql. | 16:22 |
| notmorgan | or well the driver | 16:22 |
| notmorgan | the logic sholdn't be in the manager | 16:22 |
| notmorgan | let the driver implement the matching, either in python *or* in sql query | 16:22 |
| notmorgan | just push that logic out of the manager: .is_revoked(token_data) | 16:23 |
| ayoung | notmorgan, that's the Problem! The query flushes expired events. Caching holds on to them | 16:23 |
| ayoung | we are matching events that should be expired....let me look at the logic | 16:24 |
| notmorgan | which means... we aren't properly matching events | 16:24 |
| *** dmk0202 has quit IRC | 16:24 | |
| *** ig0r_ has quit IRC | 16:24 | |
| ayoung | notmorgan, right | 16:25 |
| *** knikolla has left #openstack-keystone | 16:25 | |
| *** knikolla has joined #openstack-keystone | 16:26 | |
| lbragstad | so making the is_revoked() method a driver call | 16:27 |
| notmorgan | ayoung: i think you need to check the issued_before earlier | 16:27 |
| lbragstad | and smarteer | 16:27 |
| notmorgan | ayoung: and this might be back to subsecond issues | 16:28 |
| *** catintheroof has quit IRC | 16:28 | |
| notmorgan | ayoung: or just do a if now > event.expires_at return false? | 16:29 |
| notmorgan | lbragstad: that is my view. | 16:29 |
| rodrigods | notmorgan, ayoung, log the reason why the event is being revoked? | 16:29 |
| rodrigods | along the values | 16:29 |
| notmorgan | lbragstad: so the driver can do something like .query() | 16:30 |
| notmorgan | ayoung: ... waht is this line: event.role_id != role for role in roles | 16:31 |
| notmorgan | is that just an optimisation to avoid another nested for? | 16:31 |
| notmorgan | oh its in all() | 16:31 |
| notmorgan | nvm | 16:31 |
| notmorgan | ayoung: are you sue all() is correct not any() in a bunch of these cases? | 16:32 |
| notmorgan | ayoung: e.g. | 16:33 |
| notmorgan | f all(event.user_id != token_values[attribute_name] | 16:33 |
| notmorgan | for attribute_name in ['user_id', 'trustor_id', 'trustee_id']): | 16:33 |
| notmorgan | return False | 16:33 |
| notmorgan | or is it because you;'re doing a !=? | 16:33 |
| *** phalmos has quit IRC | 16:33 | |
| *** phalmos has joined #openstack-keystone | 16:34 | |
| *** TxGVNN has quit IRC | 16:35 | |
| *** alex_xu has quit IRC | 16:35 | |
| *** sdake_ has joined #openstack-keystone | 16:35 | |
| *** GB21 has quit IRC | 16:36 | |
| *** GB21 has joined #openstack-keystone | 16:37 | |
| *** cheran has joined #openstack-keystone | 16:38 | |
| *** sdake has quit IRC | 16:38 | |
| ayoung | notmorgan, dmanit now you have me thinking in circles | 16:38 |
| notmorgan | ayoung: sorry, just kill the cache to start. | 16:38 |
| notmorgan | ayoung: lets just readd it later. | 16:38 |
| ayoung | notmorgan, nah, its the list going in. I can fix this. | 16:38 |
| *** alex_xu has joined #openstack-keystone | 16:38 | |
| rodrigods | ayoung, all attributes are set in toke_values[]? | 16:40 |
| rodrigods | it may result in a key error | 16:40 |
| ayoung | rodrigods, maybe, but I bet this is it | 16:41 |
| ayoung | hmmmm | 16:41 |
| ayoung | notmorgan, does tempest do any flushing of the database tables, like revoke events, or anything like that? It doesn't, right? | 16:44 |
| notmorgan | no | 16:44 |
| notmorgan | it does not | 16:44 |
| ayoung | token expire is not going to be an issue. | 16:44 |
| *** mvk has quit IRC | 16:45 | |
| ayoung | what is the query we do to refetch...http://git.openstack.org/cgit/openstack/keystone/tree/keystone/revoke/backends/sql.py#n66 | 16:46 |
| ayoung | so we might have deleted an old event | 16:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Config settings to support PCI-DSS https://review.openstack.org/314679 | 16:47 |
| notmorgan | ayoung: but that shouldn't matter. when we issue a new event we invalidate the cache | 16:47 |
| notmorgan | (after new event, and after _prune) | 16:47 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 16:48 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength and change password requirements https://review.openstack.org/320156 | 16:48 |
| notmorgan | ayoung: def revoke(self, event): | 16:48 |
| notmorgan | self.driver.revoke(event) | 16:48 |
| notmorgan | REVOKE_REGION.invalidate() | 16:48 |
| *** daemontool_ has quit IRC | 16:49 | |
| notmorgan | ayoung: so we revoke, which prunes, then invalidates | 16:49 |
| notmorgan | unless you must rely on event_list being pre-filtered ? but that seems... incorrect? | 16:49 |
| *** daemontool_ has joined #openstack-keystone | 16:49 | |
| ayoung | notmorgan, we still prune on fetch | 16:49 |
| notmorgan | no. we don't | 16:49 |
| notmorgan | if we do, then we have a regression | 16:49 |
| ayoung | Ok | 16:49 |
| ayoung | um | 16:50 |
| ayoung | hmmm | 16:50 |
| notmorgan | unless we use last_fetch | 16:50 |
| notmorgan | and afict we dont | 16:50 |
| ayoung | the cache might be right, and the cacheless might be in error | 16:50 |
| ayoung | last_fetch... | 16:51 |
| notmorgan | that was the api thing | 16:51 |
| ayoung | that was assuming there was a built list | 16:51 |
| ayoung | right | 16:51 |
| notmorgan | like i said, don't think we use it | 16:51 |
| ayoung | need to ignore that | 16:51 |
| *** harlowja has joined #openstack-keystone | 16:51 | |
| notmorgan | so, i don't know how the cache is wrong and the .... wait. | 16:51 |
| ayoung | we might have been dropping events | 16:51 |
| notmorgan | let me try something. | 16:52 |
| *** daemontool_ has quit IRC | 16:53 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 16:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: WIP TESTING https://review.openstack.org/320573 | 16:54 |
| notmorgan | ayoung: ^ i'm disabling the context cache there | 16:54 |
| notmorgan | if that passes the issue is in serialize/deserialize of the event. | 16:54 |
| notmorgan | ayoung: also... free rebase. | 16:54 |
| notmorgan | on your patch | 16:54 |
| notmorgan | we need to wait for zuul now. | 16:55 |
| *** tonytan4ever has quit IRC | 16:55 | |
| ayoung | notmorgan, yep, I would believe it was serialize/deserialize | 16:55 |
| notmorgan | ayoung: which means if we don't use the .to_dict() bit instead properly serialize the datetime object it should be fine | 16:56 |
| ayoung | if that is the case, I should be able to write serialization tests that show it | 16:56 |
| notmorgan | since msgpack can properly handle a datetime object | 16:56 |
| *** diazjf has quit IRC | 16:57 | |
| *** ddieterly is now known as ddieterly[away] | 16:58 | |
| *** roxanaghe_ has joined #openstack-keystone | 16:58 | |
| *** roxanaghe has quit IRC | 17:01 | |
| *** ddieterly[away] is now known as ddieterly | 17:02 | |
| ayoung | notmorgan, ok, I see how to_dict is to blam | 17:04 |
| ayoung | e | 17:04 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 17:04 |
| *** darosale has quit IRC | 17:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/305487 | 17:05 |
| ayoung | notmorgan, and the solution hase fewer line of code | 17:06 |
| notmorgan | ayoung: anyway. | 17:07 |
| ayoung | notmorgan, I need to get used to running tox -epy34 ... | 17:08 |
| notmorgan | ayoung: i had to compile py34 :( | 17:08 |
| notmorgan | ayoung: my laptop has 35 only, though afaik py34 -> 35 is compat | 17:08 |
| notmorgan | but 35 -> 34 isn't | 17:08 |
| notmorgan | (always) | 17:09 |
| ayoung | ImportError: No module named 'ldap' | 17:09 |
| ayoung | so I need pyldap in my venv | 17:09 |
| *** afred312 has joined #openstack-keystone | 17:09 | |
| notmorgan | possibly | 17:09 |
| openstackgerrit | ayoung proposed openstack/keystone: Replace revoke tree with linear search https://review.openstack.org/311652 | 17:11 |
| *** roxanaghe__ has joined #openstack-keystone | 17:11 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 17:12 |
| notmorgan | ayoung: we'll see | 17:12 |
| *** pnavarro has quit IRC | 17:12 | |
| *** roxanaghe_ has quit IRC | 17:15 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 17:19 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS 8.2.3: Password strength requirements https://review.openstack.org/320586 | 17:21 |
| *** ayoung has quit IRC | 17:22 | |
| *** ayoung has joined #openstack-keystone | 17:23 | |
| *** ChanServ sets mode: +v ayoung | 17:23 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS 8.2.3: Password strength requirements https://review.openstack.org/320586 | 17:24 |
| *** GB21 has quit IRC | 17:25 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 17:28 |
| *** darosale has joined #openstack-keystone | 17:28 | |
| openstackgerrit | Merged openstack/keystone-specs: Correct Identity spec for versions response https://review.openstack.org/320437 | 17:29 |
| *** lhcheng has joined #openstack-keystone | 17:30 | |
| *** ChanServ sets mode: +v lhcheng | 17:30 | |
| *** ayoung has quit IRC | 17:35 | |
| *** ayoung has joined #openstack-keystone | 17:36 | |
| *** ChanServ sets mode: +v ayoung | 17:36 | |
| *** ddieterly is now known as ddieterly[away] | 17:39 | |
| *** lamt has joined #openstack-keystone | 17:57 | |
| notmorgan | it's that time ... | 17:58 |
| notmorgan | ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, jorge_munoz, knikolla, lbragstad, lhcheng, marekd, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tjcocozz, tsymanczyk, topol, vivekd, wanghong, xek | 17:58 |
| notmorgan | meeting! | 17:58 |
| *** diazjf has joined #openstack-keystone | 18:01 | |
| *** ngupta has quit IRC | 18:03 | |
| *** sdake_ is now known as sdake | 18:11 | |
| *** david-lyle_ has joined #openstack-keystone | 18:12 | |
| *** josecastroleon1 has joined #openstack-keystone | 18:14 | |
| *** jrist has quit IRC | 18:15 | |
| *** jrist has joined #openstack-keystone | 18:16 | |
| *** david-lyle has quit IRC | 18:16 | |
| *** josecastroleon has quit IRC | 18:16 | |
| *** ig0r_ has joined #openstack-keystone | 18:23 | |
| *** shaleh has joined #openstack-keystone | 18:24 | |
| *** ddieterly[away] is now known as ddieterly | 18:26 | |
| *** rcernin has quit IRC | 18:29 | |
| breton_ | knikolla: sorry, lets talk after the meeting. I need to run away for 30 minutes now. | 18:30 |
| knikolla | breton_: sure, i’ll be here. | 18:30 |
| breton_ | knikolla: (we shall probably not have time at the meeting anyway, because i forgot to add it to agenda) | 18:30 |
| knikolla | breton_: no worries, too many topics already. | 18:31 |
| *** clenimar has joined #openstack-keystone | 18:39 | |
| samueldmq | rodrigods: congrats, well deserved | 18:40 |
| rodrigods | thanks samueldmq :) | 18:43 |
| *** pushkaru has quit IRC | 18:45 | |
| *** pushkaru has joined #openstack-keystone | 18:46 | |
| *** links has quit IRC | 18:48 | |
| *** ddieterly is now known as ddieterly[away] | 18:51 | |
| *** markvoelker_ has joined #openstack-keystone | 18:57 | |
| *** markvoelker has quit IRC | 18:59 | |
| *** markvoelker has joined #openstack-keystone | 19:00 | |
| ayoung | lbragstad, OK, so the FAQ misses the critical question: how do you transport keys | 19:01 |
| jamielennox | ayoung: you think it's a reasonable request to have user's specify ids? | 19:01 |
| lbragstad | ayoung we can certainly add it | 19:01 |
| shaleh | dstanek: I could see a workflow driven by Puppet / Ansible that adds a new project / role / whatever and triggers a DB push to remote regions | 19:01 |
| ayoung | jamielennox, and admin user? yes | 19:01 |
| gyee | ++ | 19:01 |
| jamielennox | shaleh: that's way too much like doing our own replication hadnling | 19:01 |
| ayoung | jamielennox, its an administrative workflow, and I could see making a separate microservice to do it | 19:01 |
| agrebennikov | ayoung, jamielennox it worked in v2 | 19:01 |
| *** tonytan4ever has joined #openstack-keystone | 19:01 | |
| jamielennox | agrebennikov: it did? | 19:01 |
| agrebennikov | yea | 19:02 |
| ayoung | jamielennox, yep | 19:02 |
| shaleh | jamielennox: but Keystone would not be part of it | 19:02 |
| shaleh | 100% external to it | 19:02 |
| agrebennikov | so one of our largest customes uses exactly this workflow | 19:02 |
| ayoung | jamielennox, tenantId was an optional param | 19:02 |
| *** markvoelker_ has quit IRC | 19:02 | |
| agrebennikov | right | 19:02 |
| bknudson | Did you consider K2K federation for multi datacenter? | 19:02 |
| bknudson | or even regular federation | 19:03 |
| ayoung | so, lets say we do it as a seprate service. Would anything call it besides keystone/CMS? | 19:03 |
| agrebennikov | bknudson, I don't need it in this particular case since I'm usually allowed to directly call to ldap | 19:03 |
| ayoung | bknudson, K2K needs this. Otherwise, you end up with users but no projects in the remote keystone | 19:03 |
| agrebennikov | ayoung, federation brings much more mess | 19:04 |
| gyee | what's stopping you from mapping projects? | 19:04 |
| ayoung | gyee, to what? There are none there until you create them | 19:04 |
| ayoung | and we have no autoprovisioning workflow | 19:04 |
| gyee | ayoung, you saying shadowing projects? | 19:04 |
| agrebennikov | federation unfortunately is only about auth | 19:04 |
| jamielennox | agrebennikov: so what's the harm with replicating databases to the datacenter? | 19:04 |
| bknudson | I'm thinking essentially what gyee is. The projects don't have to have the same ID. | 19:05 |
| *** ddieterly[away] is now known as ddieterly | 19:05 | |
| *** diazjf has quit IRC | 19:05 | |
| agrebennikov | jamielennox, again as I said - we want to keep dbs as separate as possible. You may break one peer and it will replicate error to anothers | 19:06 |
| shaleh | but how often are you adding / removing projects? Once a day? an hour? | 19:06 |
| agrebennikov | depends | 19:06 |
| agrebennikov | if there is a CI set up - quite often | 19:06 |
| shaleh | agrebennikov: ok, so DB is separate but somehow in sync? | 19:06 |
| bknudson | use K2K then you can keep your dbs totally separate | 19:06 |
| *** diazjf has joined #openstack-keystone | 19:06 | |
| gyee | exactly | 19:06 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP - Devstack plugin for Federation https://review.openstack.org/320623 | 19:06 |
| gyee | k2k gives you the flexibility in upgrade as well, upgrade each datacenter *separately* | 19:07 |
| agrebennikov | afaik they just create projects from some central point | 19:07 |
| agrebennikov | k2k what? | 19:07 |
| amakarov | agrebennikov, keystone to keystone federation | 19:08 |
| shaleh | agrebennikov: right. Call that "home". Once home is tested you initiate a push to remote regions. Where is the issue? | 19:08 |
| dstanek | agrebennikov: how do you prevent propagating bad data even if you use a manual sync process? | 19:08 |
| breton_ | knikolla: nice stuff ^ | 19:08 |
| agrebennikov | dstanek, because I do not deal with the DB directly - I just make api calls | 19:08 |
| knikolla | breton_ thanks! | 19:09 |
| agrebennikov | and I cannot bring the entire thing down | 19:09 |
| dstanek | agrebennikov: what do you mean y 'bring it down'? | 19:09 |
| knikolla | breton_: i’ve been working from my local git repo till now. | 19:09 |
| breton_ | knikolla: have you seen my stuff? https://github.com/bretonium/devstack-plugin-federation-test | 19:10 |
| *** BigWillie has quit IRC | 19:10 | |
| breton_ | knikolla: i will join you starting monday | 19:11 |
| agrebennikov | break keystone db across all regions because something happened in one | 19:12 |
| knikolla | breton_: i’m checking it now. | 19:12 |
| dstanek | agrebennikov: 'break' meaning bad data? | 19:12 |
| shaleh | agrebennikov: right. The process would be: add project to Keystone. Test it exists. Initiate DB sync using external process. | 19:12 |
| shaleh | agrebennikov: this is wrapped in Puppet / Ansible / whatever to provide sanity and automation | 19:13 |
| breton_ | knikolla: the config files there are bad and really just placeholders | 19:13 |
| knikolla | breton_: i see that that is quite a bit of overlap. | 19:14 |
| agrebennikov | dstanek, yeah. Our folks had a downtime across 80 regions because something went wrong in one of them and all global keystone db got broken | 19:14 |
| knikolla | breton_: there* | 19:14 |
| knikolla | breton_: i started from existing automation in ansible/python, so it wasn’t too hard. | 19:14 |
| shaleh | agrebennikov: failure in testing | 19:14 |
| *** tqtran has joined #openstack-keystone | 19:14 | |
| agrebennikov | dstanek, this is why they decided to Not replicate keystone db ever anymore | 19:14 |
| knikolla | breton_: and devstack had some pretty amazing functions. | 19:14 |
| dstanek | agrebennikov: so if you insert bad data and then replication bad data over *APIs* how are you safe? | 19:15 |
| *** sheel has quit IRC | 19:15 | |
| breton_ | knikolla: we have existing automation in ansible in the gates? | 19:15 |
| *** shaleh is now known as shaleh|away | 19:15 | |
| agrebennikov | dstanek, no, if you have the db issue in one place it doesn't affect others - we only use api calls to keystone since that time | 19:16 |
| *** mfisch has joined #openstack-keystone | 19:16 | |
| *** mfisch is now known as Guest92937 | 19:16 | |
| knikolla | breton_: https://github.com/knikolla/ansible-k2k nope, my scripts | 19:16 |
| dstanek | agrebennikov: what kind of DB issue did you have? | 19:16 |
| dstanek | knikolla: oh, interesting. i have something similar | 19:16 |
| *** rderose_ has joined #openstack-keystone | 19:16 | |
| bknudson | https://review.openstack.org/#/c/193894/24/lib/keystone is gating on devstack, so the catalog will have keystone on /identity rather than :5000 | 19:16 |
| patchbot | bknudson: patch 193894 - openstack-dev/devstack - Use path-mounted keystone when running in httpd | 19:16 |
| agrebennikov | dstanek, you need technical details? :) | 19:16 |
| dstanek | agrebennikov: yes, otherwise i can't help | 19:17 |
| bknudson | agrebennikov: are you talking about a distributed galera? | 19:17 |
| *** rk4n has quit IRC | 19:17 | |
| agrebennikov | dstanek, that is not my personal area of responsibility.... bknudson yeah | 19:17 |
| breton_ | knikolla: have you been at the summit? | 19:17 |
| knikolla | breton_: yes | 19:18 |
| bknudson | we have had issues here with distributed galera too. | 19:18 |
| *** rk4n has joined #openstack-keystone | 19:18 | |
| *** Guest92937 is now known as mfisch | 19:18 | |
| agrebennikov | dstanek, but it ended up with keystone to stop responding across all sites | 19:18 |
| *** mfisch has quit IRC | 19:18 | |
| *** mfisch has joined #openstack-keystone | 19:18 | |
| agrebennikov | dstanek, this is not the current point though | 19:18 |
| amakarov | bknudson, galera was made for zero lag envs | 19:18 |
| dstanek | bknudson: what is IBM doing now in their public cloud? | 19:19 |
| breton_ | knikolla: i wasn't :) so i was wondering what you decided there | 19:19 |
| *** rderose has quit IRC | 19:19 | |
| bknudson | dstanek: my understanding is we still have distributed galera but there's a master datacenter and the rest are read-only. I haven't totally figured out the architecture yet. | 19:19 |
| bknudson | in the previous incarnation we tried to have multiple masters and wound up split-brain when australia links went away | 19:20 |
| *** sdake has quit IRC | 19:21 | |
| agrebennikov | bknudson, in general case everybody is allowed to write and the write will be replicated to all members. bknudson this is a second challenge^^ | 19:21 |
| agrebennikov | usually in one dc you have 3 members of galera | 19:21 |
| knikolla | breton_: https://etherpad.openstack.org/p/newton-keystone-testing the notes are here. it wasn’t entirely clear, as is usual with design sessions. but basically we decided to build the plugins for devstack. and for some reason k2k and federation were treated as separate things regarding the plugins. | 19:21 |
| agrebennikov | now if you have 2 dcs you have 6 members | 19:21 |
| *** sdake has joined #openstack-keystone | 19:21 | |
| agrebennikov | bknudson, if you lose connectivity betveen the dcs for some reason - boom | 19:22 |
| bknudson | agrebennikov: right, this is exactly what the charts showed for us... maybe it was a reference architecture. | 19:22 |
| agrebennikov | bknudson, this is why you have to introduce arbitrators etc | 19:22 |
| knikolla | breton_: then, there would be a single gate which tested everything. (i’m not entirely convinced by this) | 19:23 |
| agrebennikov | and then you have only one main dc when all others get frozen if they are disconnected | 19:23 |
| bknudson | so if there's a break in the 2 dcs you have 2 groups of 3 and no quorum | 19:23 |
| agrebennikov | bknudson, exactly | 19:23 |
| bknudson | I believe we've chosen the one main dc architecture since split-brain was too painful | 19:23 |
| gyee | we had to use arbitrators for mongo as well | 19:24 |
| agrebennikov | bknudson, this is why it was decided to demolish global galera and replicate stuff through api (create and delete) | 19:24 |
| *** rk4n has quit IRC | 19:24 | |
| bknudson | ansible should make it pretty easy to replicate across dcs | 19:24 |
| agrebennikov | this is how you can guarantee that dcs are independent | 19:25 |
| bknudson | if you use k2k then ansible can set up the mapping, etc. | 19:25 |
| knikolla | long live ansible! | 19:25 |
| bknudson | I haven't tried any of this so am speculating. | 19:25 |
| breton_ | knikolla: that's what we decided at the previous meeting | 19:26 |
| agrebennikov | bknudson, we don't want to introduce federation at this point. It is very unclear for the customer, while direct connection to ldap is much more straightforward | 19:26 |
| breton_ | knikolla: before the summit | 19:26 |
| bknudson | it's not federation of IDs it's federation of keystone tokens | 19:26 |
| breton_ | knikolla: ok then! i'll be back in a week and will review/code some things regarding it | 19:26 |
| bknudson | you take a token in DC1 and translate it into a token in DC2 | 19:27 |
| *** mvk has joined #openstack-keystone | 19:27 | |
| breton_ | knikolla: nice to see that i am not the only one working on it! | 19:27 |
| agrebennikov | bknudson, so this is trusts then | 19:27 |
| agrebennikov | no? | 19:27 |
| knikolla | breton_: thanks! that would be really helpful! | 19:27 |
| knikolla | breton_: enjoy your time ff | 19:27 |
| bknudson | agrebennikov: you have to set up a trust relationship between the two DCs. | 19:27 |
| knikolla | off* | 19:27 |
| bknudson | and a mapping between stuff in DC1 to stuff in DC2. | 19:28 |
| gyee | bknudson, we need to make one more enhancement to federation, right now you cannot directly get a project-scoped token | 19:28 |
| gyee | it has to start with an unscoped token first | 19:28 |
| agrebennikov | bknudson, don't you think keeping same project ids across dcs in much easier? ;) | 19:28 |
| knikolla | gyee: true, but keystoneauth abstracts that. | 19:29 |
| gyee | knikolla, not really, user cannot directly specify a project-scoped in one shot | 19:29 |
| bknudson | agrebennikov: Having the same project IDs would make things easier... | 19:29 |
| bknudson | you can always make that happen by sneaking into the db. | 19:30 |
| agrebennikov | bknudson, oh, please! | 19:30 |
| gyee | hahahah, sneaking into the db?!! | 19:30 |
| agrebennikov | I have a couple of thousands projects and CI systems on the top | 19:30 |
| *** sdake has quit IRC | 19:30 | |
| bknudson | if you've got CI then you're in good shape. | 19:31 |
| *** sdake has joined #openstack-keystone | 19:31 | |
| agrebennikov | bknudson, I can agree when you do a PoC env (like I did to make sure same project IDs allow you to bring tokens to other DC) | 19:31 |
| knikolla | gyee: through the api that is correct. i was talking about the keystoneauth python library. It makes multiple calls and gets the scoped token after getting the unscoped one. http://paste.openstack.org/show/486755/ | 19:31 |
| agrebennikov | bknudson, but I would never allow you to touch the DB in prod | 19:31 |
| agrebennikov | so ayoung, would you like to revisit your review and make custom project IDs working please? | 19:32 |
| bknudson | would you call a function in keystone that adds projects? | 19:34 |
| agrebennikov | yes sir | 19:35 |
| rderose_ | jamielennox: got a minute? | 19:36 |
| bknudson | Here's the function: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/core.py#n189 | 19:36 |
| dstanek | bknudson: so we're done? | 19:36 |
| jamielennox | rderose_: yea | 19:36 |
| rderose_ | jamielennox: I'm working on a PCI patch that would require a user to change their password if it was expired. So authentication would fail, Unauthorized("Change password required..."). Something like that. | 19:36 |
| rderose_ | jamielennox: But then the client would need to be able to change their password without a token (because authentication fails > expired password). | 19:36 |
| ayoung | agrebennikov, I'm not the one you need to convince. | 19:36 |
| rderose_ | jamielennox: I can change the policy.json for the change_password api, but I think the client would still need a token, correct? | 19:37 |
| ayoung | agrebennikov, it was -2ed due to needing a spec etc | 19:37 |
| jamielennox | rderose_: so the client would default to trying to get a token | 19:37 |
| jamielennox | rderose_: just because that's what it expects to do | 19:37 |
| agrebennikov | ayoung, spec for api feature you mean? | 19:38 |
| ayoung | agrebennikov, yep | 19:38 |
| rderose_ | jamielennox: but of course, getting a token would fail because auth failed due to expired password | 19:38 |
| amakarov | rderose_, do you have a patch disabling users after 6 unsuccessfull attempts? | 19:38 |
| jamielennox | rderose_: you can pass, authenticated=False and interface=AUTH_INTERFACE to get around that | 19:38 |
| ayoung | agrebennikov, pull up my review and look at dolphm 's comment. | 19:38 |
| jamielennox | so authenticated=False is don't pass a token to the request | 19:38 |
| agrebennikov | ayoung, I saw that | 19:38 |
| rderose_ | amakarov: not yet | 19:39 |
| gyee | knikolla, that's good, if we can reduce it to a single roundtrip that would be better | 19:39 |
| jamielennox | and interface=AUTH_INTERFACE means use the auth_url for the plugin instead of the url from the service catalog | 19:39 |
| agrebennikov | ayoung, and this is weird since it was always there until v3 | 19:39 |
| rderose_ | jamielennox: ah, okay | 19:39 |
| agrebennikov | ayoung, and now for some reason the wheel has to be reinvented | 19:39 |
| *** diazjf has quit IRC | 19:39 | |
| *** ig0r_ has quit IRC | 19:39 | |
| ayoung | agrebennikov, round and round | 19:39 |
| amakarov | rderose_, I have an urgent customer request for this function, so would you mind if I come up with a CR or some concept? | 19:40 |
| jamielennox | rderose_: i don't think we've ever had anything in keystoneclient want to use authenticated=False so you might need to plumb that through the manager layer | 19:40 |
| agrebennikov | ayoung, sometimes it seems to me you guys are slowing down yourselves just because "bureaucracy should already exist" | 19:41 |
| rderose_ | jamielennox: okay | 19:41 |
| rderose_ | jamielennox: let me dig into this approach then | 19:41 |
| knikolla | gyee: does that need a spec? | 19:41 |
| jamielennox | sounds good, i'm going to go back to bed for a bit, bug ping me with a review if you get there | 19:42 |
| rderose_ | jamielennox: cool, thx | 19:42 |
| gyee | knikolla, yeah, I was going to write one, but time disagrees with me the last few weeks | 19:43 |
| rderose_ | amakarov: I'm okay with you working on this, but I'd like you to say with in my design | 19:43 |
| *** zqfan has quit IRC | 19:43 | |
| amakarov | rderose_, ack. which spec should I follow? | 19:43 |
| rderose_ | amakarov: #link https://review.openstack.org/#/c/320586/ | 19:44 |
| patchbot | rderose_: patch 320586 - keystone - WIP - PCI-DSS Password strength requirements | 19:44 |
| amakarov | rderose_, thanks | 19:44 |
| rderose_ | amakarov: so I imagine it should be part of the PasswordValidator class | 19:44 |
| rderose_ | amakarov: but let me know if you have other ideas | 19:44 |
| amakarov | rderose_, the problem is that auth is not stateless anymore | 19:45 |
| amakarov | so we have to have a place to store auth states per user | 19:46 |
| *** diazjf has joined #openstack-keystone | 19:46 | |
| amakarov | and we can't extend user model as it's not necessare sql | 19:46 |
| *** tonytan4ever has quit IRC | 19:46 | |
| amakarov | s/necessare/necessary/ | 19:46 |
| *** prometheanfire has joined #openstack-keystone | 19:47 | |
| rderose_ | amakarov: hmm... I thought this would be very sql specific | 19:47 |
| prometheanfire | 9.0.1 should be on tarballs.openstack.org right? | 19:47 |
| rderose_ | amakarov: especially since we won't be writing to ldap | 19:47 |
| *** gyee has quit IRC | 19:47 | |
| amakarov | rderose_, so there are no plans for LDAP? | 19:48 |
| rderose_ | amakarov: no, not that I am aware of | 19:48 |
| bknudson | prometheanfire: 9.0.1 is the latest release according to http://git.openstack.org/cgit/openstack/keystone/?h=stable%2Fmitaka | 19:48 |
| bknudson | prometheanfire: I think this is a question for #openstack-release | 19:49 |
| prometheanfire | bknudson: the tarball is missing from tarballs.openstack.org | 19:49 |
| amakarov | rderose_, LDAP is widely used, so we can't declare PCI without it | 19:49 |
| prometheanfire | bknudson: ok, I did bring it up in -infra as well | 19:49 |
| *** timcline has quit IRC | 19:49 | |
| rderose_ | amakarov: yeah, but again, we're stopping writing to ldap | 19:49 |
| rderose_ | amakarov: ldap will be read-only | 19:49 |
| rderose_ | so you can be PCI compliant via Federation or sql | 19:49 |
| rderose_ | amakarov: it's likely that folks that have LDAP will use federation | 19:50 |
| rderose_ | amakarov: once we make federation more powerful that is | 19:50 |
| amakarov | rderose_, let's hope, but right now nobody uses federation in production besides CERN | 19:50 |
| rderose_ | amakarov: understand | 19:51 |
| rderose_ | amakarov: there will be some PCI options for ldap, auto disable inactive users for example | 19:52 |
| rderose_ | amakarov: but not password history rules or change expired passwords because ldap is read-only | 19:52 |
| amakarov | rderose_, yeah, I'll look for a non-keystone solution too | 19:52 |
| rderose_ | amakarov: hopefully, we solve much of our federation issues in Newton, so not too far off | 19:53 |
| *** dmk0202 has joined #openstack-keystone | 19:54 | |
| knikolla | gyee: i could work on that | 19:54 |
| amakarov | rderose_, the big issue of federation is "overcomplicated" and it's not going to be solved in Newton :) | 19:55 |
| rderose_ | amakarov: not totally, but we're hoping to make some big changes. dstanek is working on this as well | 19:56 |
| rderose_ | :) | 19:56 |
| amakarov | rderose_, that's good :) | 19:57 |
| *** amakarov is now known as amakarov_away | 19:57 | |
| *** prometheanfire has left #openstack-keystone | 19:58 | |
| *** diazjf has quit IRC | 20:00 | |
| *** sdake_ has joined #openstack-keystone | 20:02 | |
| *** sdake has quit IRC | 20:05 | |
| *** jaugustine has quit IRC | 20:05 | |
| *** ddieterly is now known as ddieterly[away] | 20:06 | |
| *** rk4n has joined #openstack-keystone | 20:07 | |
| *** tonytan4ever has joined #openstack-keystone | 20:10 | |
| *** ayoung has quit IRC | 20:21 | |
| *** timcline has joined #openstack-keystone | 20:23 | |
| *** diazjf has joined #openstack-keystone | 20:25 | |
| *** ddieterly[away] is now known as ddieterly | 20:29 | |
| *** rderose_ has quit IRC | 20:31 | |
| *** julim has quit IRC | 20:35 | |
| *** rderose_ has joined #openstack-keystone | 20:38 | |
| *** pushkaru has quit IRC | 20:40 | |
| *** pushkaru has joined #openstack-keystone | 20:40 | |
| *** shaleh|away has quit IRC | 20:41 | |
| rderose_ | amakarov: I totally misread your message in IRC, I thought you were talking about password history rules, but you were referring to the locking the user after x amount failed attempts | 20:45 |
| *** gyee has joined #openstack-keystone | 20:45 | |
| *** ChanServ sets mode: +v gyee | 20:45 | |
| rderose_ | amakarov: sorry, doing too many things at once | 20:45 |
| rderose_ | amakarov: this would be included for LDAP and I haven't started it | 20:46 |
| rderose_ | amakarov: so feel free to propose something | 20:46 |
| rderose_ | amakarov: the only thing we've done for this is set the configuration: | 20:47 |
| rderose_ | #link https://review.openstack.org/#/c/314679/ | 20:47 |
| patchbot | rderose_: patch 314679 - keystone - Config settings to support PCI-DSS | 20:47 |
| *** phalmos_ has joined #openstack-keystone | 20:49 | |
| *** diazjf has quit IRC | 20:50 | |
| *** phalmos has quit IRC | 20:53 | |
| *** mou has quit IRC | 20:55 | |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Apply a heuristic for product name if a user_agent is not provided https://review.openstack.org/288175 | 20:56 |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Determine project name from oslo_config or local config https://review.openstack.org/320123 | 20:59 |
| *** rcernin has joined #openstack-keystone | 21:03 | |
| *** _amrith_ is now known as amrith | 21:03 | |
| *** ayoung has joined #openstack-keystone | 21:05 | |
| *** ChanServ sets mode: +v ayoung | 21:05 | |
| *** phalmos_ has quit IRC | 21:06 | |
| *** pauloewerton has quit IRC | 21:06 | |
| *** phalmos has joined #openstack-keystone | 21:07 | |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 21:08 |
| *** ddieterly is now known as ddieterly[away] | 21:09 | |
| *** gordc has quit IRC | 21:13 | |
| *** haplo37_ has joined #openstack-keystone | 21:19 | |
| *** pushkaru has quit IRC | 21:19 | |
| *** pushkaru has joined #openstack-keystone | 21:20 | |
| *** ddieterly[away] is now known as ddieterly | 21:20 | |
| *** amrith is now known as _amrith_ | 21:20 | |
| *** ddieterly has quit IRC | 21:21 | |
| bknudson | https://review.openstack.org/#/c/320670/ in stable/mitaka fixes a problem where the tarballs aren't getting uploaded. | 21:21 |
| patchbot | bknudson: patch 320670 - keystone (stable/mitaka) - Fix post jobs | 21:21 |
| *** haplo37_ has quit IRC | 21:24 | |
| *** gagehugo has quit IRC | 21:25 | |
| *** dmk0202 has quit IRC | 21:32 | |
| *** sdake has joined #openstack-keystone | 21:34 | |
| *** edtubill has quit IRC | 21:34 | |
| *** ametts has quit IRC | 21:35 | |
| *** dmk0202 has joined #openstack-keystone | 21:37 | |
| *** sdake_ has quit IRC | 21:38 | |
| *** henrynash has quit IRC | 21:43 | |
| *** rcernin has quit IRC | 21:43 | |
| bknudson | https://review.openstack.org/#/c/320670/ is +A already so don't bother. | 21:55 |
| patchbot | bknudson: patch 320670 - keystone (stable/mitaka) - Fix post jobs | 21:55 |
| *** flwang has joined #openstack-keystone | 21:58 | |
| *** timcline has quit IRC | 22:06 | |
| *** dmk0202 has quit IRC | 22:09 | |
| *** darrenc is now known as darrenc_afk | 22:09 | |
| *** sdake has quit IRC | 22:09 | |
| *** pushkaru has quit IRC | 22:09 | |
| *** pushkaru has joined #openstack-keystone | 22:13 | |
| *** darrenc_afk is now known as darrenc | 22:16 | |
| *** sdake has joined #openstack-keystone | 22:19 | |
| *** spzala has quit IRC | 22:22 | |
| *** spzala has joined #openstack-keystone | 22:22 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 22:24 |
| *** darosale has quit IRC | 22:26 | |
| *** spzala has quit IRC | 22:27 | |
| stevemar | ayoung: poke: https://review.openstack.org/#/c/271135/ needs one last check | 22:34 |
| patchbot | stevemar: patch 271135 - keystone - remove deprecated revoke_by_expiration function | 22:34 |
| *** rk4n has quit IRC | 22:42 | |
| *** spzala has joined #openstack-keystone | 22:43 | |
| *** edmondsw has quit IRC | 22:50 | |
| *** pushkaru has quit IRC | 22:53 | |
| *** openstackgerrit has quit IRC | 23:03 | |
| *** openstackgerrit has joined #openstack-keystone | 23:03 | |
| *** amakarov_away has quit IRC | 23:07 | |
| *** amakarov_away has joined #openstack-keystone | 23:07 | |
| *** markvoelker has quit IRC | 23:11 | |
| *** david-lyle_ is now known as david-lyle | 23:12 | |
| *** rbridgeman has joined #openstack-keystone | 23:19 | |
| *** roxanaghe__ has quit IRC | 23:25 | |
| *** rderose_ has quit IRC | 23:32 | |
| *** zqfan has joined #openstack-keystone | 23:38 | |
| *** rbridgeman has quit IRC | 23:48 | |
| *** sdake has quit IRC | 23:55 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!