| stevemar | i figure i'll let you do this one, just copy the previous release yaml, slap on 10.0.0.0b1 and pick the latest sha | 00:00 |
|---|---|---|
| jamielennox | current master is 38d3c73888d46a330d8043e230e5bd4cc6f7b6b4 - i don't assume there's any point waiting for whatever to merge for b1 | 00:01 |
| *** lhcheng has quit IRC | 00:01 | |
| stevemar | jamielennox: correct, and you can remove the release notes url, since it doesn't exist yet | 00:02 |
| jamielennox | stevemar: we don't tag middleware, client and auth as part of this release? | 00:03 |
| stevemar | jamielennox: nah, and i just did those before i left | 00:03 |
| jamielennox | theoretically they're release independant but this might be different | 00:04 |
| jamielennox | stevemar: we were going to do another ksa this week | 00:04 |
| jamielennox | should check to see if that merged.. | 00:04 |
| stevemar | jamielennox: i did all the libs 2 weeks ago: https://review.openstack.org/#/c/317837/ | 00:04 |
| patchbot | stevemar: patch 317837 - releases - release keystone libraries (MERGED) | 00:04 |
| stevemar | jamielennox: oh sure, if someone wants a new ksa, that is usually not an issue | 00:04 |
| *** amrith is now known as _amrith_ | 00:05 | |
| jamielennox | stevemar: yea, yolanda has been trying to get an up to date one with the betamax stuff in it for infra | 00:05 |
| stevemar | jamielennox: no one has requested a new ksa release | 00:05 |
| stevemar | looking at https://review.openstack.org/#/q/project:openstack/releases anyway | 00:05 |
| jamielennox | we were waiting for https://review.openstack.org/#/c/321814/ to merge | 00:05 |
| patchbot | jamielennox: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 00:05 |
| stevemar | ah | 00:06 |
| stevemar | fi-lgtm ? | 00:06 |
| jamielennox | stevemar: probably - if it's broken it's no more broken than not existing at all | 00:06 |
| stevemar | yep | 00:06 |
| stevemar | i'll +A | 00:06 |
| jamielennox | ayoung had said he would test | 00:06 |
| notmorgan | stevemar: https://pbs.twimg.com/media/CjxOMODUoAE5Mvl.jpg:large | 00:07 |
| stevemar | jamielennox: people can blame me if something goes wrong | 00:07 |
| notmorgan | stevemar: too late i already blame you | 00:08 |
| stevemar | notmorgan: bring it on! | 00:08 |
| notmorgan | stevemar: even if it doesn't go wrong | 00:08 |
| notmorgan | stevemar: /me is formatting OSSA email. | 00:08 |
| jamielennox | done: https://review.openstack.org/#/c/324143/ | 00:09 |
| patchbot | jamielennox: patch 324143 - releases - Release keystone 10.0.0.0b1 | 00:09 |
| *** sdake_ is now known as sdake | 00:19 | |
| *** ayoung has joined #openstack-keystone | 00:22 | |
| *** ChanServ sets mode: +v ayoung | 00:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 00:23 |
| stevemar | jamielennox: you can make a ksa release with SHA f7766ebb37d34d0a4185fa8405e4799d5cb91bcd | 00:23 |
| jamielennox | stevemar: was going to wait for the merge - why'd you re-propose? | 00:24 |
| stevemar | jamielennox: it wasn't gating/queued according to zuul | 00:24 |
| stevemar | and jenkins didn't trigger anything | 00:24 |
| stevemar | re-basing / re-proposing just kinda kicked it in the pants | 00:24 |
| *** dan_nguyen has quit IRC | 00:25 | |
| stevemar | jamielennox: anyway, the SHA shouldn't change, you can create a new patch with that one safely | 00:27 |
| *** diazjf has joined #openstack-keystone | 00:29 | |
| stevemar | jamielennox: nooo it failed tests now | 00:29 |
| *** BjoernT has quit IRC | 00:30 | |
| *** diazjf has quit IRC | 00:34 | |
| *** dan_nguyen has joined #openstack-keystone | 00:46 | |
| ayoung | rodrigods, you figure out what "Only single element list is acceptable" means? | 00:51 |
| *** KarthikB has joined #openstack-keystone | 00:55 | |
| ayoung | self._first(idp_response_consumer_url) | 00:56 |
| ayoung | returns [] | 00:56 |
| ayoung | jdennis, ^^ | 00:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 01:06 |
| *** woodster_ has quit IRC | 01:08 | |
| *** BjoernT has joined #openstack-keystone | 01:09 | |
| *** BjoernT has quit IRC | 01:14 | |
| *** raddaoui has quit IRC | 01:17 | |
| *** KarthikB has quit IRC | 01:17 | |
| *** EinstCrazy has joined #openstack-keystone | 01:25 | |
| *** sheel has joined #openstack-keystone | 01:28 | |
| *** amit213 has joined #openstack-keystone | 01:39 | |
| *** amit213 has quit IRC | 01:41 | |
| *** amit213 has joined #openstack-keystone | 01:44 | |
| *** dan_nguyen has quit IRC | 01:45 | |
| *** KarthikB has joined #openstack-keystone | 01:46 | |
| *** sdake has quit IRC | 01:49 | |
| *** KarthikB has quit IRC | 01:50 | |
| *** tlbr has quit IRC | 01:50 | |
| *** tlbr has joined #openstack-keystone | 01:51 | |
| *** rmizuno_ has quit IRC | 01:58 | |
| *** roxanaghe has joined #openstack-keystone | 02:04 | |
| *** spandhe has quit IRC | 02:08 | |
| *** roxanaghe has quit IRC | 02:09 | |
| *** eszxy has joined #openstack-keystone | 02:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 02:15 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add password table columns to meet PCI-DSS change password requirements https://review.openstack.org/314284 | 02:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 02:16 |
| *** sdake has joined #openstack-keystone | 02:16 | |
| *** sdake has quit IRC | 02:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 02:26 |
| *** itisha has quit IRC | 02:30 | |
| *** richm has quit IRC | 02:31 | |
| *** KarthikB has joined #openstack-keystone | 02:36 | |
| ayoung | jamielennox, ECP Federation Auth plugin...works getting an unscoped token, but does not seem to beaware that it needs to request a scoped token. THis is OSP7, so....Liberty. Sound like a known issue? | 02:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 02:42 |
| ayoung | notmorgan, http://git.openstack.org/cgit/openstack/keystoneauth/tree/setup.cfg where is the SAML plugin? | 02:42 |
| *** KarthikB_ has joined #openstack-keystone | 02:52 | |
| *** KarthikB has quit IRC | 02:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 02:59 |
| *** roxanaghe has joined #openstack-keystone | 03:04 | |
| *** julim has joined #openstack-keystone | 03:05 | |
| *** diazjf has joined #openstack-keystone | 03:06 | |
| *** diazjf has quit IRC | 03:06 | |
| *** spandhe has joined #openstack-keystone | 03:07 | |
| *** roxanaghe has quit IRC | 03:09 | |
| *** KarthikB_ has quit IRC | 03:12 | |
| *** KarthikB has joined #openstack-keystone | 03:12 | |
| *** KarthikB has quit IRC | 03:17 | |
| *** spandhe_ has joined #openstack-keystone | 03:21 | |
| *** dan_nguyen has joined #openstack-keystone | 03:22 | |
| *** spandhe has quit IRC | 03:23 | |
| *** spandhe_ is now known as spandhe | 03:23 | |
| *** dan_nguyen has quit IRC | 03:29 | |
| *** neophy has joined #openstack-keystone | 03:29 | |
| *** dan_nguyen has joined #openstack-keystone | 03:30 | |
| *** rderose has quit IRC | 03:34 | |
| *** links has joined #openstack-keystone | 03:35 | |
| *** julim has quit IRC | 03:36 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Drop Support for Driver Versioning https://review.openstack.org/324081 | 03:36 |
| *** clenimar has quit IRC | 03:41 | |
| *** gerhardqux has quit IRC | 03:43 | |
| stevemar | henrynash_: did you finally setup a bouncer? | 04:00 |
| openstackgerrit | Merged openstack/keystone: Fix credentials_factory method call https://review.openstack.org/323360 | 04:01 |
| *** TxGVNN has joined #openstack-keystone | 04:01 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/322539 | 04:04 |
| *** roxanaghe has joined #openstack-keystone | 04:05 | |
| stevemar | jamielennox: can you verify i didn't do something crazy between ps6 and ps7? https://review.openstack.org/#/c/321814/ | 04:07 |
| patchbot | stevemar: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 04:07 |
| *** roxanaghe has quit IRC | 04:09 | |
| jamielennox | stevemar: so there's a real concern of that patch that when you iterate through all the plugins it loads all the modules and requests_kerberos isn't available | 04:10 |
| jamielennox | i thought i checked it once before but it may be an actual problem | 04:10 |
| jamielennox | i don't think crinkle is waiting on it? | 04:11 |
| stevemar | jamielennox: i don't think she is | 04:11 |
| stevemar | jamielennox: we can release without it | 04:11 |
| stevemar | jamielennox: i'm not sure i understand your previous statements... ? | 04:12 |
| jamielennox | stevemar: right, then figure out if it's a real problem | 04:12 |
| *** TxGVNN has quit IRC | 04:12 | |
| stevemar | jamielennox: the patch that introduced the entry point check is here; https://review.openstack.org/#/c/319980/ | 04:12 |
| patchbot | stevemar: patch 319980 - keystoneauth - Check that all defined entry points can be loaded (MERGED) | 04:12 |
| crinkle | o/ | 04:13 |
| jamielennox | stevemar: so there is a function that loops through all plugins in the system via entrypoint | 04:13 |
| stevemar | yep.. | 04:13 |
| stevemar | crinkle: o/ | 04:13 |
| stevemar | crinkle: taking a break from pycon? :) | 04:13 |
| crinkle | stevemar: yeah just for a bit :) | 04:13 |
| jamielennox | stevemar: if you import say requests_kerberos that requires an extras install then the import might get triggered without the package being installed | 04:13 |
| stevemar | everyone is at pycon or mesoscon and i'm am home changing diapers >.< | 04:13 |
| stevemar | jamielennox: i think i get what you're saying | 04:14 |
| stevemar | jamielennox: do you have a suggestion / alternative to what i proposed? | 04:15 |
| jamielennox | crinkle: are you waiting for that kerberos plugin for something or just fixing the bug? | 04:15 |
| jamielennox | stevemar: i hven't seen you change anything | 04:15 |
| crinkle | jamielennox: i was just bug stomping | 04:15 |
| stevemar | jamielennox: i did this: https://review.openstack.org/#/c/321814/6..7/keystoneauth1/tests/unit/loading/test_entry_points.py | 04:16 |
| patchbot | stevemar: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 04:16 |
| jamielennox | crinkle: cool, we were holding a KSA release because it was close but if you're not needing it we can release without it and wait till next one | 04:16 |
| stevemar | jamielennox: in order to resolve this: http://logs.openstack.org/14/321814/6/check/gate-keystoneauth-python34/3f02584/testr_results.html.gz | 04:16 |
| *** dan_nguyen has quit IRC | 04:16 | |
| crinkle | jamielennox: fine with me | 04:17 |
| *** roxanaghe has joined #openstack-keystone | 04:17 | |
| jamielennox | stevemar: yep, but the bug fail is an actual problem | 04:19 |
| jamielennox | because the kerberos plugin will now show up when you find all available plugins | 04:19 |
| jamielennox | and if you don't have requests_kerberos installed you will get an error | 04:19 |
| jamielennox | i think we might need to do some importerror checking | 04:20 |
| stevemar | jamielennox: ahhhh i get what you mean | 04:20 |
| jamielennox | like in the kerberos plugin on importerror set a flag | 04:20 |
| stevemar | you don't want that EP showing up at all if they just did pip install keystoneauth (no kerb) | 04:20 |
| jamielennox | and then in the loadable we do if not imported then don't let people instantiate the plugin | 04:20 |
| jamielennox | stevemar: not sure if we have that choice | 04:21 |
| jamielennox | stevemar: everything in the setup.cfg is going to show up anyway | 04:21 |
| jamielennox | but we need to throw an error in --os-auth-type kerberos before seeing the importerror | 04:22 |
| *** ayoung has quit IRC | 04:22 | |
| *** patchbot has quit IRC | 04:22 | |
| *** patchbot has joined #openstack-keystone | 04:22 | |
| *** nonameentername has quit IRC | 04:23 | |
| *** dmellado has quit IRC | 04:24 | |
| *** brad_behle has quit IRC | 04:25 | |
| *** nonameentername has joined #openstack-keystone | 04:25 | |
| stevemar | jamielennox: btw https://review.openstack.org/324202 | 04:25 |
| jamielennox | stevemar: cool, i was about to do that | 04:25 |
| stevemar | jamielennox: i have a few spare cycles now :P | 04:26 |
| stevemar | i see lbragstad went on a review spree | 04:27 |
| *** dmellado has joined #openstack-keystone | 04:27 | |
| lbragstad | stevemar yes sir - dev on capstone is slowing down so i'm hoping to transition back to keystone | 04:27 |
| lbragstad | all keystone, all the time | 04:27 |
| *** lipt has joined #openstack-keystone | 04:31 | |
| stevemar | lbragstad: i like the sound of that! | 04:31 |
| *** edtubill has joined #openstack-keystone | 04:33 | |
| *** edtubill_ has joined #openstack-keystone | 04:35 | |
| *** dave-mccowan has quit IRC | 04:36 | |
| lbragstad | stevemar me too! | 04:37 |
| *** edtubill has quit IRC | 04:38 | |
| lbragstad | stevemar aren't you suppose to be away from you computer? | 04:41 |
| stevemar | lbragstad: both people i'm taking care of are asleep | 04:44 |
| lbragstad | stevemar shouldn't you be?! | 04:44 |
| stevemar | lbragstad: so... many... diapers | 04:44 |
| lbragstad | stevemar how have night been - is he up a lot? | 04:44 |
| lbragstad | er nights* | 04:45 |
| stevemar | lbragstad: he's actually pretty good. wakes up about 3 times, soon (1am), then 4-5am, then 8-9am (when we get up for the day) | 04:45 |
| stevemar | luckily, he goes back to sleep fairly easily | 04:46 |
| lbragstad | wow - that doesn't seem too bad (i've heard of worse) | 04:46 |
| stevemar | oh yeah | 04:46 |
| stevemar | we lucked out | 04:46 |
| lbragstad | stevemar that's awesome | 04:46 |
| *** iurygregory has quit IRC | 04:47 | |
| *** jamielennox is now known as jamielennox|away | 04:48 | |
| *** eszxy has quit IRC | 04:52 | |
| *** eszxy has joined #openstack-keystone | 04:53 | |
| *** spandhe has quit IRC | 04:58 | |
| *** jamielennox|away is now known as jamielennox | 05:04 | |
| *** spandhe has joined #openstack-keystone | 05:12 | |
| openstackgerrit | edan david proposed openstack/oslo.policy: Fix typo: 'olso' to 'oslo' https://review.openstack.org/324216 | 05:35 |
| *** roxanaghe has quit IRC | 05:38 | |
| *** roxanaghe has joined #openstack-keystone | 05:38 | |
| *** GB21 has joined #openstack-keystone | 05:42 | |
| *** jbell8 has quit IRC | 05:43 | |
| *** roxanaghe has quit IRC | 05:43 | |
| *** rcernin has joined #openstack-keystone | 05:48 | |
| *** jamielennox is now known as jamielennox|away | 06:01 | |
| *** GB21 has quit IRC | 06:02 | |
| *** GB21 has joined #openstack-keystone | 06:15 | |
| *** jamielennox|away is now known as jamielennox | 06:16 | |
| *** mou has joined #openstack-keystone | 06:27 | |
| *** spandhe has quit IRC | 06:35 | |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/322539 | 06:36 |
| *** edtubill_ has quit IRC | 06:39 | |
| *** roxanaghe has joined #openstack-keystone | 06:39 | |
| notmorgan | stevemar: fwiw, re+2 on the ksa thing. | 06:43 |
| notmorgan | stevemar: but i am still inclined to hold for direct confirmation of a fix. | 06:43 |
| *** roxanaghe has quit IRC | 06:43 | |
| *** zyxes has joined #openstack-keystone | 06:52 | |
| *** mvk_ has quit IRC | 06:52 | |
| *** tesseract- has joined #openstack-keystone | 06:53 | |
| *** eszxy has quit IRC | 06:56 | |
| *** sdake has joined #openstack-keystone | 06:57 | |
| *** jaosorior has joined #openstack-keystone | 07:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Imported Translations from Zanata https://review.openstack.org/324258 | 07:16 |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Provide user friendly messages for db_sync https://review.openstack.org/289316 | 07:18 |
| *** henrynash has joined #openstack-keystone | 07:22 | |
| *** ChanServ sets mode: +v henrynash | 07:22 | |
| *** neophy has quit IRC | 07:29 | |
| *** GB21 has quit IRC | 07:36 | |
| *** henrynash has quit IRC | 07:36 | |
| *** hoonetorg has quit IRC | 07:38 | |
| *** sdake has quit IRC | 07:39 | |
| *** roxanaghe has joined #openstack-keystone | 07:40 | |
| *** lipt has quit IRC | 07:41 | |
| *** jaosorior has quit IRC | 07:42 | |
| *** roxanaghe has quit IRC | 07:44 | |
| *** lipt has joined #openstack-keystone | 07:46 | |
| *** lipt has quit IRC | 07:46 | |
| *** hoonetorg has joined #openstack-keystone | 07:50 | |
| *** lipt has joined #openstack-keystone | 07:51 | |
| *** lipt has quit IRC | 07:51 | |
| *** lipt has joined #openstack-keystone | 07:51 | |
| *** lipt has quit IRC | 07:51 | |
| *** lipt has joined #openstack-keystone | 07:56 | |
| *** lipt has quit IRC | 07:56 | |
| *** jaosorior has joined #openstack-keystone | 07:56 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** GB21 has joined #openstack-keystone | 08:03 | |
| *** henrynash has joined #openstack-keystone | 08:07 | |
| *** ChanServ sets mode: +v henrynash | 08:07 | |
| *** jbell8 has joined #openstack-keystone | 08:08 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** jaosorior has quit IRC | 08:14 | |
| *** jaosorior has joined #openstack-keystone | 08:15 | |
| *** lipt has joined #openstack-keystone | 08:15 | |
| *** lipt has quit IRC | 08:15 | |
| *** lipt has joined #openstack-keystone | 08:19 | |
| *** lipt has quit IRC | 08:19 | |
| *** lipt has joined #openstack-keystone | 08:20 | |
| *** lipt has quit IRC | 08:20 | |
| *** lipt has joined #openstack-keystone | 08:21 | |
| *** lipt has quit IRC | 08:21 | |
| *** lipt has joined #openstack-keystone | 08:22 | |
| *** lipt has quit IRC | 08:22 | |
| *** markvoelker has quit IRC | 08:29 | |
| *** markvoelker has joined #openstack-keystone | 08:30 | |
| *** lipt has joined #openstack-keystone | 08:34 | |
| *** lipt has quit IRC | 08:34 | |
| *** lipt has joined #openstack-keystone | 08:34 | |
| *** lipt has quit IRC | 08:34 | |
| *** lipt has joined #openstack-keystone | 08:43 | |
| *** lipt has quit IRC | 08:43 | |
| *** lipt has joined #openstack-keystone | 08:44 | |
| *** lipt has quit IRC | 08:44 | |
| *** lipt has joined #openstack-keystone | 08:45 | |
| *** lipt has quit IRC | 08:45 | |
| *** lipt has joined #openstack-keystone | 08:50 | |
| *** lipt has quit IRC | 08:50 | |
| *** lipt has joined #openstack-keystone | 08:52 | |
| *** lipt has quit IRC | 08:52 | |
| *** lipt has joined #openstack-keystone | 08:59 | |
| *** lipt has quit IRC | 08:59 | |
| *** lipt has joined #openstack-keystone | 09:02 | |
| *** lipt has quit IRC | 09:02 | |
| *** lipt has joined #openstack-keystone | 09:04 | |
| *** lipt has quit IRC | 09:04 | |
| *** lipt has joined #openstack-keystone | 09:09 | |
| *** lipt has quit IRC | 09:09 | |
| *** sdake has joined #openstack-keystone | 09:13 | |
| *** TxGVNN has joined #openstack-keystone | 09:17 | |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Return BadRequest for 4 byte unicode characters https://review.openstack.org/324320 | 09:19 |
| *** pnavarro has joined #openstack-keystone | 09:36 | |
| *** TxGVNN has quit IRC | 09:36 | |
| *** _amrith_ is now known as amrith | 09:37 | |
| *** sdake has quit IRC | 09:40 | |
| *** roxanaghe has joined #openstack-keystone | 09:42 | |
| *** henrynash has quit IRC | 09:43 | |
| *** roxanaghe has quit IRC | 09:46 | |
| *** neophy has joined #openstack-keystone | 10:03 | |
| *** mou has quit IRC | 10:07 | |
| *** henrynash has joined #openstack-keystone | 10:10 | |
| *** ChanServ sets mode: +v henrynash | 10:10 | |
| *** GB21 has quit IRC | 10:14 | |
| *** GB21 has joined #openstack-keystone | 10:16 | |
| *** neophy has quit IRC | 10:22 | |
| *** spandhe has joined #openstack-keystone | 10:25 | |
| *** EinstCrazy has quit IRC | 10:26 | |
| *** henrynash has quit IRC | 10:36 | |
| *** rodrigods has quit IRC | 10:39 | |
| *** rodrigods has joined #openstack-keystone | 10:40 | |
| *** amrith is now known as _amrith_ | 10:40 | |
| *** mvk_ has joined #openstack-keystone | 10:41 | |
| *** roxanaghe has joined #openstack-keystone | 10:42 | |
| *** roxanaghe has quit IRC | 10:47 | |
| *** GB21 has quit IRC | 10:53 | |
| breton_ | ² | 10:58 |
| *** GB21 has joined #openstack-keystone | 11:22 | |
| *** julim has joined #openstack-keystone | 11:31 | |
| breton_ | so | 11:38 |
| breton_ | since keystone is on suburl now by default in devstack | 11:39 |
| breton_ | how should federation-related things be configured? | 11:39 |
| breton_ | for example, should shibboleth live on /identity/Shibboleth.sso or on /Shibboleth.sso? | 11:39 |
| *** nisha has joined #openstack-keystone | 11:40 | |
| breton_ | should /v3/auth/OS-FEDERATION/websso/saml2 be prefixed with /identity/ everywhere or there should be a cleaner way? | 11:40 |
| breton_ | like moving it inside the <Location /identity/>? | 11:40 |
| *** roxanaghe has joined #openstack-keystone | 11:43 | |
| *** roxanaghe has quit IRC | 11:48 | |
| *** nisha has quit IRC | 11:48 | |
| *** rk4n has joined #openstack-keystone | 11:48 | |
| *** _amrith_ is now known as amrith | 11:52 | |
| *** raildo-afk is now known as raildo | 11:53 | |
| *** jbell8 has quit IRC | 11:54 | |
| *** clenimar has joined #openstack-keystone | 12:01 | |
| openstackgerrit | Merged openstack/keystone: Simplify & fix configuration file copy in setup.cfg https://review.openstack.org/322086 | 12:02 |
| *** nisha has joined #openstack-keystone | 12:07 | |
| *** hoonetorg has quit IRC | 12:12 | |
| *** GB21 has quit IRC | 12:18 | |
| *** hoonetorg has joined #openstack-keystone | 12:27 | |
| *** dave-mccowan has joined #openstack-keystone | 12:28 | |
| *** clenimar has quit IRC | 12:31 | |
| *** mou has joined #openstack-keystone | 12:33 | |
| *** clenimar has joined #openstack-keystone | 12:38 | |
| *** julim has quit IRC | 12:41 | |
| *** clenimar has quit IRC | 12:44 | |
| *** roxanaghe has joined #openstack-keystone | 12:44 | |
| *** zyxes has quit IRC | 12:46 | |
| *** gordc has joined #openstack-keystone | 12:46 | |
| *** roxanaghe has quit IRC | 12:48 | |
| *** zyxes has joined #openstack-keystone | 12:50 | |
| *** iurygregory has joined #openstack-keystone | 12:51 | |
| *** zyxes has quit IRC | 12:56 | |
| *** neophy has joined #openstack-keystone | 12:56 | |
| rodrigods | knikolla, ping.. there? | 12:57 |
| *** amrith is now known as _amrith_ | 13:00 | |
| *** _amrith_ is now known as amrith | 13:09 | |
| *** julim has joined #openstack-keystone | 13:14 | |
| *** rderose has joined #openstack-keystone | 13:17 | |
| *** neophy has quit IRC | 13:18 | |
| shewless | Hi there. Is anyone available to help walk me through federation using keystone as the service provider and adfs as the identity provider? I've followed the steps here: http://docs.openstack.org/developer/keystone/federation/federated_identity.html but I'm having trouble generating the "right" metadata for adfs | 13:19 |
| *** pauloewerton has joined #openstack-keystone | 13:22 | |
| *** edmondsw has joined #openstack-keystone | 13:29 | |
| rodrigods | rderose, ping... re: role assignments with shadow users | 13:30 |
| rderose | rodrigods: just checking your comments | 13:31 |
| rderose | rodrigods: thanks btw | 13:31 |
| rderose | rodigods: what's up | 13:32 |
| rderose | *rodrigods | 13:33 |
| *** nisha has quit IRC | 13:33 | |
| rodrigods | rderose, did you consider changing the role_assignments to use FKs? | 13:33 |
| rodrigods | the table, i mean | 13:33 |
| rodrigods | (just brainstorming) | 13:33 |
| *** crinkle has quit IRC | 13:35 | |
| rderose | rodrigods: hmm... no, my goal has been to treat federated users like any other users, so using the existing implementation | 13:35 |
| rodrigods | rderose, yeah... i remember that one of the reasons we don't have FKs there were federated users | 13:35 |
| *** henrynash has joined #openstack-keystone | 13:36 | |
| *** ChanServ sets mode: +v henrynash | 13:36 | |
| rderose | rodrigods: oh really... yeah, then there may be an opportunity now to add them (FKs) | 13:36 |
| *** crinkle has joined #openstack-keystone | 13:36 | |
| rderose | rodrigods: I'll look into it | 13:36 |
| rodrigods | rderose, yeah, just don't remember all the use cases, but would avoid to manually delete everything in the manager/driver layer | 13:37 |
| rderose | rodrigods: ah, I see. | 13:37 |
| rodrigods | rderose, for example: https://github.com/openstack/keystone/blob/master/keystone/resource/core.py#L465 | 13:38 |
| henrynash | dolphm: ping | 13:40 |
| rderose | rodrigods: hmm... this method is cleaning up assignments after a project has been deleted, so if having FK, you would have to delete assignments first... | 13:41 |
| *** tonytan4ever has joined #openstack-keystone | 13:41 | |
| *** aurelien__ has joined #openstack-keystone | 13:41 | |
| rodrigods | rderose, thinking about using cascade | 13:41 |
| rderose | rodrigods: right | 13:42 |
| *** richm has joined #openstack-keystone | 13:42 | |
| rderose | rodrigods: yeah, seems like a good opportunity to do some performance improvements and refactoring | 13:42 |
| rderose | rodrigods: adding it to my list :) thx | 13:43 |
| rodrigods | rderose, awesome :) | 13:43 |
| rodrigods | thanks | 13:43 |
| *** roxanaghe has joined #openstack-keystone | 13:45 | |
| *** roxanaghe has quit IRC | 13:49 | |
| *** jaugustine has joined #openstack-keystone | 13:51 | |
| *** lucas__ has joined #openstack-keystone | 13:51 | |
| *** ametts has joined #openstack-keystone | 13:53 | |
| *** rk4n has quit IRC | 13:55 | |
| knikolla | rodrigods: hey, just saw your ping | 13:56 |
| rodrigods | knikolla, hey | 13:56 |
| rodrigods | to let you know that i have a saml2/ecp tempest test working | 13:56 |
| * rodrigods is doing a refactoring right now | 13:56 | |
| breton_ | rderose: | 13:58 |
| breton_ | rderose: i've investigated the issue with concrete role assignments | 13:58 |
| rderose | breton_: yeah, just reading your comments | 13:59 |
| rderose | breton_: and thanks for looking into this btw | 13:59 |
| *** aurelien__ has quit IRC | 13:59 | |
| breton_ | rderose: it happens because of that api call | 13:59 |
| rderose | breton_: I see | 13:59 |
| breton_ | rderose: and the call happens because of code in keystoneclient's ./v3/contrib/federation/base.py | 13:59 |
| *** gagehugo has joined #openstack-keystone | 14:00 | |
| breton_ | rderose: so we have 2 options | 14:00 |
| breton_ | rderose: 1. fix concrete role assignments | 14:00 |
| breton_ | rderose: 2. fix the client | 14:00 |
| *** ddieterly has joined #openstack-keystone | 14:00 | |
| *** KarthikB has joined #openstack-keystone | 14:00 | |
| breton_ | although OS-FEDERATION/projects is deprecated, i don't know when | 14:00 |
| *** KarthikB has quit IRC | 14:00 | |
| breton_ | "since 1.1" it says | 14:01 |
| rderose | breton_: on the surface, I think fixing the client makes more sense. what do you think? | 14:01 |
| *** KarthikB has joined #openstack-keystone | 14:01 | |
| breton_ | rderose: it depends on how far we are from removing OS-FEDERATION/projects | 14:01 |
| breton_ | if we are going to remove it this cycle, i am all for fixing the client | 14:01 |
| breton_ | if we are not going to remove it this cycle, i am for fixing the server | 14:02 |
| rderose | breton_: good point | 14:03 |
| breton_ | i will post all this to the review now | 14:03 |
| rderose | breton_: appreciate that and thanks again | 14:03 |
| knikolla | rodrigods: we were already working on that with mylu and now another intern. should probably compare and see if we are duplicating effort. | 14:04 |
| *** EinstCrazy has joined #openstack-keystone | 14:04 | |
| knikolla | rodrigods: do you have the code available somewhere? | 14:04 |
| *** rk4n_ has joined #openstack-keystone | 14:05 | |
| *** ayoung has joined #openstack-keystone | 14:05 | |
| *** ChanServ sets mode: +v ayoung | 14:05 | |
| *** lucas__ has quit IRC | 14:05 | |
| *** jaosorior has quit IRC | 14:06 | |
| *** lucas__ has joined #openstack-keystone | 14:09 | |
| *** edtubill has joined #openstack-keystone | 14:09 | |
| *** shoutm has joined #openstack-keystone | 14:09 | |
| *** lucas__ has quit IRC | 14:10 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Mapping Rules https://review.openstack.org/324552 | 14:10 |
| *** lucas__ has joined #openstack-keystone | 14:12 | |
| *** links has quit IRC | 14:12 | |
| *** jbell8 has joined #openstack-keystone | 14:15 | |
| *** lucas__ has quit IRC | 14:16 | |
| rodrigods | knikolla, yep, let me finish it here and send it to you | 14:16 |
| rodrigods | knikolla, mine is for "regular" federation, not k2k | 14:17 |
| *** woodster_ has joined #openstack-keystone | 14:17 | |
| *** aurelien__ has joined #openstack-keystone | 14:18 | |
| *** lucas__ has joined #openstack-keystone | 14:19 | |
| knikolla | rodrigods: ours does k2k, gets a token, gets a saml from keystone, exchanges, gets an unscoped token, scopes it. | 14:19 |
| *** ayoung has quit IRC | 14:19 | |
| *** lucas__ has quit IRC | 14:20 | |
| *** lucas__ has joined #openstack-keystone | 14:20 | |
| *** edtubill has quit IRC | 14:21 | |
| *** lucas__ has quit IRC | 14:21 | |
| *** lucas___ has joined #openstack-keystone | 14:21 | |
| *** edtubill has joined #openstack-keystone | 14:21 | |
| knikolla | rodrigods: we're working on refactoring it https://github.com/wjdan94/tempest/compare/master...wjdan94:k2k | 14:22 |
| *** lucas___ has quit IRC | 14:22 | |
| *** lucas__ has joined #openstack-keystone | 14:22 | |
| *** nisha_ has joined #openstack-keystone | 14:24 | |
| *** vint_bra has joined #openstack-keystone | 14:28 | |
| *** spandhe_ has joined #openstack-keystone | 14:29 | |
| *** nisha_ has quit IRC | 14:29 | |
| *** spandhe has quit IRC | 14:30 | |
| *** spandhe_ is now known as spandhe | 14:30 | |
| *** BjoernT has joined #openstack-keystone | 14:32 | |
| *** ayoung has joined #openstack-keystone | 14:35 | |
| *** ChanServ sets mode: +v ayoung | 14:35 | |
| henrynash | anyone been doing performance checkigng token validation with fernet tokens? (and trying to explain why they seem slower than UUID validation)? | 14:37 |
| *** pushkaru has joined #openstack-keystone | 14:37 | |
| henrynash | dolphm did a while back, and we’ve done cache improvements in Mitaka…and tryingt o see how good we got | 14:37 |
| lbragstad | henrynash one of the current major hangups is the revocation path | 14:40 |
| lbragstad | ayoung and jorge_munoz had a bunch of patches up to prune the unnecessary revocation events and remove the tree structure | 14:41 |
| henrynash | lbragstad: does that only cause issues when you ahve to revoke, or slow down all fernet access? | 14:42 |
| ayoung | lbragstad, starting to wonder if that is a good idea, or if leaving it in the revocation events will actually be the faster track | 14:42 |
| ayoung | there is going to be a DB hit on either | 14:42 |
| lbragstad | henrynash when we validate a fernet token, we have to check *all* the revocation events | 14:42 |
| henrynash | lbragstad: ouch | 14:42 |
| lbragstad | henrynash yup | 14:42 |
| ayoung | with the "remove spurious" approach, the validation has to then hit the identity, assignment, and resource back ends | 14:42 |
| ayoung | "all the revocation events" might actually be faster than querying all these backends on each token | 14:43 |
| * notmorgan still believes we should oush this down to the db as a test | 14:43 | |
| lbragstad | notmorgan ++ | 14:43 |
| ayoung | notmorgan, so, kindof orthoganal | 14:43 |
| *** mou has quit IRC | 14:43 | |
| notmorgan | ask sql to dk the work instead of python. indexed lookups are cheap | 14:43 |
| notmorgan | ayoung: i think regardless of pruned events or not | 14:44 |
| notmorgan | so ++ | 14:44 |
| *** david-lyle has joined #openstack-keystone | 14:44 | |
| henrynash | as an aside, do we know who creates all teh tests for: http://performance-docs.readthedocs.io/en/latest/test_results/keystone/all-in-one/index.html since we haev token issue in there, but not token vlaidation (which would be good to add) | 14:44 |
| ayoung | notmorgan, events held in memory and checked via iterating through a list is probably going to be the fastest. SQL will be slower, as it is an out-of-process call, regardless of how optimized. | 14:45 |
| *** timcline has joined #openstack-keystone | 14:45 | |
| notmorgan | ayoung: like i said we should poc it | 14:45 |
| ayoung | but...either way will probably be faster than checking identity, assignment, and resource for each validation | 14:45 |
| *** roxanaghe has joined #openstack-keystone | 14:45 | |
| ayoung | notmorgan, On the other hand, checking the backends is the simpler approach | 14:46 |
| notmorgan | ayoung: to be fair... we already hit all those backends in a validate call before revoke check | 14:46 |
| notmorgan | we could invert that once we wxplode the fernet payload | 14:46 |
| ayoung | notmorgan, right | 14:47 |
| breton_ | henrynash: DinaBelova had something to do with it afaik | 14:47 |
| notmorgan | and the local cache means we hit those backebds 1 time regardless | 14:47 |
| henrynash | lbragstad: (and sorr for bing dumb but)…when you say we need to check revocations, you mean the middleware lib has to do this so it knows whether its cache is out of date? | 14:47 |
| ayoung | notmorgan, we should populate and validate each piece step by step | 14:47 |
| henrynash | breton_: thx | 14:47 |
| ayoung | remember my pipeline design from oh 18 years ago or so? | 14:47 |
| notmorgan | ayoung: eh. id say check revoke tjen pass to validate | 14:47 |
| notmorgan | ayoung: we dont need to hit the backebds at all to check revoke in most cases | 14:48 |
| notmorgan | (or at all?) | 14:48 |
| ayoung | notmorgan, agreed, if we reduce the number of spurious revocation events, that is probably the right sequence | 14:49 |
| openstackgerrit | Merged openstack/oslo.policy: Fix typo: 'olso' to 'oslo' https://review.openstack.org/324216 | 14:49 |
| notmorgan | eve without reducing events | 14:49 |
| ayoung | a good data point would be "how many token validations are done with cached data" | 14:49 |
| lbragstad | rderose https://github.com/openstack/keystone-specs/blob/master/specs/keystone/liberty/keystone-tokenless-authz-with-x509-ssl-client-cert.rst | 14:50 |
| *** adu has joined #openstack-keystone | 14:50 | |
| ayoung | notmorgan, regardless, if I don't get ECP working with Keycloak I won't have time for any of this | 14:50 |
| breton_ | DinaBelova: ayoung: osprofiler could do something like that | 14:50 |
| *** roxanaghe has quit IRC | 14:50 | |
| * DinaBelova reading | 14:51 | |
| ayoung | breton_, more idle curoisity than anything else...would have to be run on a large size deployment. ProbAbly depends on what client is used....lots of variables | 14:51 |
| rderose | lbragstad: so this is the spec, but it was implemented, right? | 14:52 |
| DinaBelova | henrynash - perofrmance-docs is the result of performance WG activities. We're proposing test plans, etc. on review, work on them, and then land the results and plans to the docs | 14:52 |
| *** vgridnev_ has joined #openstack-keystone | 14:53 | |
| *** vgridnev_ has quit IRC | 14:53 | |
| henrynash | DinaBelova: great! If i wanted to prose an addition to the keystone tests, how would I go abour doing that | 14:53 |
| DinaBelova | ayoung - as for the number of the revocation calls - it looks like this can be checked via adding just one profiling decorator on the interested function call to the debugged keystone and run several profiling requests to see full tree of the calls | 14:54 |
| lbragstad | rderose yes - i believe that was gyee's doing | 14:54 |
| rderose | lbragstad: cool, thx | 14:55 |
| lbragstad | rderose yep | 14:55 |
| lbragstad | henrynash sorry - was in a meeting | 14:55 |
| henrynash | lbragstad: no worried! | 14:55 |
| lbragstad | henrynash the token_provider_api has to perform checks against the revocation api to see if a given token is invalidated | 14:55 |
| DinaBelova | henrynash - very simple workflow :) you may join #openstack-performance channel, we're mostly working right now on two repos - https://github.com/openstack/performance-docs and https://github.com/openstack/osprofiler | 14:55 |
| DinaBelova | the test plan proposal is the same as any commit in the OpenStack | 14:56 |
| DinaBelova | the same gerrit workflow | 14:56 |
| lbragstad | henrynash https://github.com/openstack/keystone/blob/0068096e132d05aa799a8d7b58f9646b4d96ac34/keystone/token/provider.py#L260 | 14:56 |
| henrynash | DinaBelova: great, thx | 14:57 |
| DinaBelova | henrynash - so yeah, you can wrap this line with @profiler.trace(<needed info>) and see the result in the result profiling report | 14:57 |
| henrynash | lbragstad: yep, that’s smack there | 14:57 |
| *** andreykurilin__ has joined #openstack-keystone | 14:57 | |
| *** raddaoui has joined #openstack-keystone | 14:57 | |
| *** clenimar has joined #openstack-keystone | 14:57 | |
| *** spandhe has quit IRC | 15:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 15:00 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Domain Specific Mapping Rules https://review.openstack.org/324552 | 15:00 |
| *** pnavarro has quit IRC | 15:01 | |
| *** amrith is now known as _amrith_ | 15:02 | |
| *** spandhe has joined #openstack-keystone | 15:03 | |
| lbragstad | henrynash what do you think about lines 166 - 169 here https://review.openstack.org/#/c/324055/2/specs/keystone/newton/shadow-mapping.rst | 15:03 |
| patchbot | lbragstad: patch 324055 - keystone-specs - Mapping shadow users into projects and roles | 15:03 |
| henrynash | lbragstad: looking | 15:03 |
| *** basilAB has quit IRC | 15:06 | |
| *** _amrith_ is now known as amrith | 15:08 | |
| *** basilAB has joined #openstack-keystone | 15:08 | |
| *** KevinE has joined #openstack-keystone | 15:09 | |
| *** KevinE has quit IRC | 15:09 | |
| *** amrith is now known as _amrith_ | 15:09 | |
| *** KevinE has joined #openstack-keystone | 15:09 | |
| *** KevinE has quit IRC | 15:10 | |
| henrynash | lbragstad: so I’ve added a question…it would be great it we could do it all within the scoped of more flexible mapping…. | 15:11 |
| *** KevinE has joined #openstack-keystone | 15:11 | |
| *** _amrith_ is now known as amrith | 15:14 | |
| *** pumarani__ has joined #openstack-keystone | 15:17 | |
| lbragstad | henrynash ++ | 15:18 |
| *** pushkaru has quit IRC | 15:20 | |
| ayoung | rodrigods, so did you test SAML Federated plugin using Mitaka (OSP8) and the corresponding keystoneauth? | 15:20 |
| ayoung | DinaBelova, that would be cool to do long term, but really, I think the focus for now needs to be on correctness. I'm a litle leery of putting too much effort in to performance tuning Keystone token validations under artificial loads. We can lock ourselves into more bad decisions that way | 15:22 |
| *** ksavich has joined #openstack-keystone | 15:22 | |
| ayoung | “We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil.” | 15:22 |
| *** shoutm has quit IRC | 15:23 | |
| DinaBelova | ayoung understood :) | 15:23 |
| henrynash | ayoung: are you saying you don’t think we should at least get the number of token validation? (one of the most common keystone calls of all time) | 15:29 |
| *** jbell8 has quit IRC | 15:29 | |
| ayoung | henrynash, sort of. | 15:30 |
| *** clenimar has quit IRC | 15:30 | |
| henrynash | ayoung: :-) | 15:30 |
| ayoung | henrynash, I was actually suggesting that there is a difference in cost for 2 token validations if | 15:30 |
| ayoung | they are for the same token versus two different tokens | 15:30 |
| henrynash | ayoung: ah, sure | 15:30 |
| ayoung | and for the same user, role, project versus different | 15:30 |
| ayoung | caching etc | 15:30 |
| *** pumarani__ has quit IRC | 15:33 | |
| *** ksavich has quit IRC | 15:35 | |
| *** EinstCrazy has quit IRC | 15:35 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 15:40 |
| *** rk4n_ has quit IRC | 15:42 | |
| *** GB21 has joined #openstack-keystone | 15:42 | |
| *** agrebennikov has joined #openstack-keystone | 15:47 | |
| *** spzala has joined #openstack-keystone | 15:48 | |
| *** pushkaru has joined #openstack-keystone | 15:48 | |
| *** lucas__ has quit IRC | 15:49 | |
| *** lucas__ has joined #openstack-keystone | 15:54 | |
| *** ddieterly is now known as ddieterly[away] | 15:57 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add failed auth attempts logic to meet PCI-DSS https://review.openstack.org/324029 | 15:58 |
| *** tesseract- has quit IRC | 15:59 | |
| *** lucas__ has quit IRC | 15:59 | |
| *** rcernin has quit IRC | 16:01 | |
| *** diazjf has joined #openstack-keystone | 16:02 | |
| *** diazjf has quit IRC | 16:02 | |
| *** ddieterly[away] is now known as ddieterly | 16:02 | |
| *** mvk_ has quit IRC | 16:03 | |
| *** diazjf has joined #openstack-keystone | 16:07 | |
| *** gyee has joined #openstack-keystone | 16:08 | |
| *** ChanServ sets mode: +v gyee | 16:08 | |
| *** ayoung has quit IRC | 16:09 | |
| lbragstad | rderose i have another dumb shadow users question | 16:09 |
| *** ayoung has joined #openstack-keystone | 16:09 | |
| *** ChanServ sets mode: +v ayoung | 16:09 | |
| rderose | lbragstad: sure | 16:09 |
| lbragstad | when a user comes in from ldap or some custom driver - i thought keystone would be creating them a user id | 16:10 |
| lbragstad | for example - even though my username in ldap is lance and my user_id is lbragstad - my user id in keystone would be some uuid.uuid4().hex value | 16:11 |
| lbragstad | which would be the id used when assigning roles to my shadow user, right? | 16:11 |
| breton_ | are shadow users for ldap implemented? | 16:13 |
| *** breton_ is now known as breton | 16:13 | |
| rderose | that's not a dumb question :) when a person comes in from LDAP or custom driver, we'll create a (user -> nonlocal_user) object. | 16:13 |
| rderose | lbragstad: ^ | 16:13 |
| *** lhcheng has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v lhcheng | 16:13 | |
| lbragstad | breton it's up for review | 16:13 |
| rderose | lbragstad: If your using an LDAP driver the user.user_id would be lbragstad and the domain_id and username would be mapped in the nonlocal_user table | 16:14 |
| lbragstad | rderose i see the NonLocalUser model has three attributes, domain_id, name, and user_id | 16:15 |
| rderose | lbragstad: the user_id in that table is an FK to the user table | 16:15 |
| lbragstad | ok so the user.id and the nonlocal_user.id would be the same | 16:15 |
| rderose | lbragstad: correct | 16:16 |
| lbragstad | so the user table could have a bunch of different format IDs in it | 16:16 |
| KevinE | I have a folder of scenarios I'd like to merge up. Is it possible to build unit tests in a secondary merge for cleanliness, or would my initial one just get shot down for not having them in the first place? | 16:16 |
| lbragstad | some being rderose or lbragstad and some being deeab2451cd04839aa705712bf539c60 | 16:16 |
| lbragstad | depending on where the user was actually created | 16:16 |
| rderose | lbragstad, not really. if your backend identity is ldap, it will have what's in ldap. but if ldap has a bunch of different formats, then yes. | 16:18 |
| *** nisha_ has joined #openstack-keystone | 16:18 | |
| rderose | lbragstad: so this model allows us to do account linking where you could have a nonlocal identity and a federated identity, all tied to the same user | 16:18 |
| rderose | lbragstad: actually, if your are using LDAP and federation, your federated users created would have a uuid | 16:20 |
| lbragstad | rderose and that is because the federated user is persisted as a shadow user and the user id for the shadow user is generated by keystone (some arbitrary uuid) | 16:21 |
| rderose | lbragstad: correct | 16:21 |
| lbragstad | so if i authenticate via federation there is going to be a user entry persisted in keystone with deeab2451cd04839aa705712bf539c60 as the id (for example) | 16:22 |
| rderose | lbragstad: yes | 16:22 |
| lbragstad | if I authenticate with LDAP there is going to be another user entry persisted in keystone with lbragstad as the id | 16:22 |
| *** jbell8 has joined #openstack-keystone | 16:22 | |
| rderose | lbragstad: correct | 16:22 |
| lbragstad | two totally separate user references - and they can be linked in either direction i assume? | 16:23 |
| rderose | lbragstad: and that's one thing we'll need to solve with account linking. when we link your ldap account with your federated account, which id will you get | 16:23 |
| lbragstad | right | 16:23 |
| lbragstad | for some reason i'm getting mixed up on that part | 16:24 |
| *** david-lyle has quit IRC | 16:24 | |
| rderose | lbragstad: two totally different users before the accounts are linked | 16:24 |
| lbragstad | but i don't think that has much to do with what's currently proposed | 16:24 |
| rderose | lbragstad: it can be confusing, but essentially shadow users creates a data model that supports all of these identities under a master identity (user table) | 16:24 |
| rderose | lbragstad: so all users (ldap, federated, sql...) will have a record in the user table | 16:26 |
| rderose | lbragstad: and IDs may not be standard, but it works as long as they are unique | 16:26 |
| lbragstad | rderose do you think unique-ness with IDs will be an issue? | 16:27 |
| lbragstad | say there is an lbragstad in another ldap somewhere | 16:28 |
| rderose | lbragstad: no, because it's not currently with LDAP and everything else would be uuid | 16:28 |
| rderose | lbragstad and multiple ldaps, we have already solved this with id_mapping | 16:28 |
| lbragstad | ok - that makes sense | 16:29 |
| lbragstad | rderose what about this case | 16:29 |
| breton | knikolla: https://review.openstack.org/#/c/320623/ looks good. Do you mind if i fix some things if i find them there during live testing? | 16:29 |
| patchbot | breton: patch 320623 - keystone - Devstack plugin for Federation | 16:29 |
| lbragstad | say we have an LDAP setup and I have a user persisted in it with the id lbragstad | 16:30 |
| lbragstad | i authenticate against keystone with that ldap and my user id in keystone is also lbragstad | 16:30 |
| *** rk4n has joined #openstack-keystone | 16:31 | |
| lbragstad | let's say that I use that same LDAP as an identity provider and get a SAML assertion proving my identity | 16:31 |
| lbragstad | and i pass that to keystone | 16:31 |
| knikolla | breton: sure, please do! | 16:31 |
| lbragstad | I'll get a shadow user with an arbitrary uuid for the user id | 16:31 |
| rderose | the current implementation would create a new user record for the federated user with a uuid as the id | 16:31 |
| *** clenimar has joined #openstack-keystone | 16:31 | |
| rderose | lbragstad: yes | 16:32 |
| *** lucas__ has joined #openstack-keystone | 16:32 | |
| *** lucas__ has quit IRC | 16:32 | |
| *** lucas__ has joined #openstack-keystone | 16:32 | |
| lbragstad | so shadowing users will behave differently with id depending on where the authentication is coming from | 16:32 |
| rderose | lbragstad: and in that case, maybe we should automatically link them, however... | 16:32 |
| rderose | lbragstad: I don't think that use case would be practical, I mean why would you do that? maybe migrating to federation perhaps... | 16:33 |
| lbragstad | rderose right - it's probably not practical at all | 16:34 |
| rderose | lbragstad: actually... | 16:34 |
| lbragstad | just using it as a way to showcase the fact shadow users behaves differently (possibly with the same ldap) depending on where authentication (assertions?) come from. | 16:34 |
| lbragstad | i guess the question i'm trying to answer is - why wouldn't we just do for LDAP and custom like we do for federated users? | 16:35 |
| lbragstad | in terms of the ID generation | 16:35 |
| rderose | lbragstad: yeah, we would still create 2 separate users | 16:35 |
| breton | are there plans to have a function to unify 2 shadow users into 1? | 16:38 |
| rderose | lbragstad: shadow users happens at authentication, but you may want to get user and assign them a role before they every auth | 16:38 |
| knikolla | breton: like linked accounts? | 16:38 |
| lbragstad | rderose wouldn't that case be solved by dolphm's new spec? | 16:38 |
| lbragstad | breton yep - down the road | 16:39 |
| breton | knikolla: probably | 16:39 |
| breton | lbragstad: cool | 16:39 |
| breton | i am also a little concerned about how shadow ldap users will work with id_mapping_api | 16:39 |
| rderose | lbragstad: dolphm's spec is specific to federation | 16:39 |
| breton | in terms of performance | 16:39 |
| breton | because there are performance issues even now for id_mapping_api (which i wanted to tackle but didn't have time) | 16:40 |
| lbragstad | rderose true - the mapping engine would have to be available for ldap cases too | 16:40 |
| breton | and i wonder if it gets worse with an additional layer | 16:40 |
| rderose | lbragstad: to standardize the ids for LDAP (and custom), we would need to inject the id for all API calls; not only authentication | 16:41 |
| *** aurelien__ has quit IRC | 16:41 | |
| rderose | lbragstad: and it would require a substantial data migration | 16:41 |
| rderose | lbragstad: I think ultimately, we want to solve this with federation and make federation a first class citizen | 16:42 |
| rderose | lbragstad: so that deployers are using LDAP through federation | 16:42 |
| lbragstad | right - agree | 16:42 |
| rderose | lbragstad: but does that answer your question "...why wouldn't we just do for LDAP and custom like we do for federated users?" | 16:43 |
| rderose | lbragstad: does that make sense? | 16:43 |
| *** sdake has joined #openstack-keystone | 16:44 | |
| lbragstad | rderose and the answer is because it would be a significant data migration, right? | 16:44 |
| lbragstad | also - what did you mean by inject the id for all API calls? | 16:44 |
| *** tesseract has joined #openstack-keystone | 16:44 | |
| lbragstad | sorry, i didn't catch that part | 16:44 |
| rderose | lbragstad: I mean, what if an admin calls get users (LDAP) before users authenticate? which user id is returned? | 16:45 |
| lbragstad | rderose oh - meaning the id from LDAP (identity/backends/ldap.py) or the shadow id | 16:47 |
| *** roxanaghe has joined #openstack-keystone | 16:47 | |
| rderose | lbragstad: shadow users creates the user id for federation at authentication. we couldn't do that for ldap unless we injected the user id for all api calls (get user, get user list...) | 16:47 |
| rderose | yes, id from backends/ldap | 16:48 |
| lbragstad | got it | 16:48 |
| lbragstad | yeah - that makes sense | 16:48 |
| lbragstad | so which one gets priority | 16:48 |
| rderose | lbragstad: cool | 16:48 |
| rderose | lbragstad: priority? | 16:49 |
| rderose | lbragstad: what do you mean? | 16:50 |
| lbragstad | rderose the user in ldap would have an id and if we ignored that id when creating the shadow user and created it with some arbitrary uuid then which id is technically considered correct when you do a list_users() | 16:50 |
| *** roxanaghe has quit IRC | 16:51 | |
| *** julim has quit IRC | 16:51 | |
| rderose | lbragstad: so if we did ignore it, then the uuid would be the user's user_id. however, we don't, so for LDAP identities, lbragstad would be the user_id | 16:51 |
| *** tesseract has quit IRC | 16:51 | |
| rderose | lbragstad: I'm getting the feeling that I'm confusing you :) | 16:52 |
| lbragstad | so listing users from LDAP would return lbragstad as the id - but my "real" user id that is used to create role assignments is something different | 16:52 |
| lbragstad | ^ that would be the case if we decided to generate user id for LDAP (and custom) users like we do for federated users | 16:54 |
| rderose | lbragstad: in that case, the real user id would be the uuid | 16:54 |
| rderose | lbragstad: in that case, admin calls list users, we would map lbragstad to a uuid in the user table (if it didn't already exist) | 16:56 |
| rderose | so like shadow users, we would create the user_id, but it would have to happen at other API calls like get user | 16:57 |
| rderose | not only authentication | 16:57 |
| *** dan_nguyen has joined #openstack-keystone | 16:58 | |
| lbragstad | rderose ok - right... so we kind of get around the problem by using the id from ldap | 16:59 |
| rderose | lbragstad: exactly | 16:59 |
| * lbragstad hears church bells | 16:59 | |
| lbragstad | sweet - makes sense | 16:59 |
| rderose | :) | 16:59 |
| lbragstad | i had to whiteboard it | 16:59 |
| lbragstad | like four times | 16:59 |
| rderose | lbragstad: lol, yeah I've had to as well | 17:00 |
| lbragstad | rderose thanks for the explanation | 17:00 |
| rderose | lbragstad: no problem, let me know if more questions come up. or, if you think over this again and doesn't make sense :) | 17:01 |
| lbragstad | rderose will do - i think the only thing that i was hung up on was why ldap users weren't treated like federated users | 17:01 |
| rderose | lbragstad: yeah, I see | 17:02 |
| lbragstad | but i'll review your change now that I have a clearer picture | 17:02 |
| rderose | lbragstad: cool | 17:02 |
| *** nisha_ has quit IRC | 17:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Change password requirements https://review.openstack.org/320156 | 17:06 |
| *** timcline has quit IRC | 17:08 | |
| *** timcline has joined #openstack-keystone | 17:09 | |
| *** ayoung has quit IRC | 17:09 | |
| *** timcline has quit IRC | 17:09 | |
| *** timcline has joined #openstack-keystone | 17:10 | |
| *** timcline_ has joined #openstack-keystone | 17:11 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone-specs: Credential Encryption https://review.openstack.org/324714 | 17:11 |
| *** spandhe_ has joined #openstack-keystone | 17:11 | |
| *** spandhe has quit IRC | 17:13 | |
| *** spandhe_ is now known as spandhe | 17:13 | |
| *** spzala has quit IRC | 17:13 | |
| *** timcline has quit IRC | 17:14 | |
| *** mvk_ has joined #openstack-keystone | 17:14 | |
| *** pushkaru has quit IRC | 17:14 | |
| *** tonytan4ever has quit IRC | 17:17 | |
| *** nisha_ has joined #openstack-keystone | 17:20 | |
| *** ddieterly is now known as ddieterly[away] | 17:32 | |
| *** pushkaru has joined #openstack-keystone | 17:36 | |
| andreykurilin__ | Is there someone how can review patch about novaclient integration with keystone session? | 17:39 |
| *** gyee has quit IRC | 17:40 | |
| *** timcline_ has quit IRC | 17:40 | |
| *** timcline has joined #openstack-keystone | 17:41 | |
| *** tonytan4ever has joined #openstack-keystone | 17:42 | |
| *** timcline has quit IRC | 17:45 | |
| *** lucas__ has quit IRC | 17:47 | |
| raildo | andreykurilin__: can you provide a link for it? | 17:47 |
| andreykurilin__ | raildo: sure. https://review.openstack.org/#/c/304035 | 17:48 |
| *** lucas__ has joined #openstack-keystone | 17:49 | |
| *** lucas__ has quit IRC | 17:54 | |
| *** jbell8 has quit IRC | 17:54 | |
| *** diazjf has quit IRC | 17:56 | |
| *** lucas__ has joined #openstack-keystone | 17:56 | |
| *** links has joined #openstack-keystone | 17:56 | |
| *** lucas___ has joined #openstack-keystone | 17:58 | |
| *** lucas___ has quit IRC | 17:59 | |
| *** rdo has quit IRC | 17:59 | |
| *** lucas____ has joined #openstack-keystone | 17:59 | |
| *** lucas__ has quit IRC | 17:59 | |
| *** jbell8 has joined #openstack-keystone | 17:59 | |
| *** browne has joined #openstack-keystone | 18:01 | |
| *** spzala has joined #openstack-keystone | 18:01 | |
| *** spzala has quit IRC | 18:06 | |
| *** timcline has joined #openstack-keystone | 18:06 | |
| dolphm | notmorgan: https://review.openstack.org/#/c/324714/ should resolve your issue on https://review.openstack.org/#/c/284950/8/specs/keystone/newton/credential-encryption.rst@89 | 18:07 |
| patchbot | dolphm: patch 324714 - keystone-specs - Credential Encryption | 18:07 |
| patchbot | dolphm: patch 284950 - keystone-specs - Credential Encryption | 18:07 |
| *** iurygregory_ has joined #openstack-keystone | 18:07 | |
| notmorgan | dolphm: cool. | 18:09 |
| *** david-lyle has joined #openstack-keystone | 18:09 | |
| SamYaple | can domains currently have sub-domains (projects with is_domain=True)? | 18:09 |
| *** nisha_ has quit IRC | 18:09 | |
| notmorgan | SamYaple: no | 18:09 |
| notmorgan | SamYaple: and it is not planned. | 18:09 |
| dolphm | anyone use gertty regularly? i've been meaning to try it again, and just started it up for the first time. it appears stuck on the project list screen (L), and isn't responding to input (or i have no idea how to use it) | 18:09 |
| notmorgan | dolphm: yes. | 18:10 |
| notmorgan | dolphm: it has some bugs. but i haven't run into that | 18:10 |
| SamYaple | notmorgan: i thought that was part of the reseller stuff | 18:10 |
| dolphm | i chose to sync 2 projects, the Sync count went up to 329 and now it's "frozen" | 18:10 |
| notmorgan | SamYaple: it was a long while ago, but I am very skeptical of that value | 18:10 |
| notmorgan | dolphm: it gets very slow sometimes when syncing | 18:10 |
| *** mvk has joined #openstack-keystone | 18:10 | |
| SamYaple | im unsure how useful resellers are if projects can't have non-uniuque users | 18:11 |
| SamYaple | users are still unique to domains, right? | 18:11 |
| notmorgan | SamYaple: more domains. | 18:11 |
| notmorgan | SamYaple: plain and simple, create more domains to isolate | 18:11 |
| SamYaple | right but inherited permissions don't work in that case, or have i missed something | 18:11 |
| notmorgan | SamYaple: it's the same thing just not under a root -- it is much much much more complex. | 18:11 |
| dolphm | notmorgan: hmm, i guess you're right. it is spinning up lots of git processes | 18:11 |
| dolphm | the count isn't going down though | 18:12 |
| notmorgan | dolphm: yeah it blocks on the sqlite backend. | 18:12 |
| dolphm | or up | 18:12 |
| notmorgan | dolphm: and http+git | 18:12 |
| notmorgan | dolphm: the ui gets hung up if there is a lock on the sqlite things | 18:12 |
| notmorgan | dolphm: since it can't query/etc via the blocking lock | 18:13 |
| *** mvk_ has quit IRC | 18:13 | |
| notmorgan | SamYaple: we can work on inherited permissions across domains for that case. but it feels like trees of domains is going to be highly complex and problematic in general. and the current model helps limit the extra complexity without forcing API breaking changes/auth-insanity | 18:14 |
| amakarov | notmorgan, good day! Can you please give me an example how @MEMOIZE things are being tested? | 18:14 |
| notmorgan | dolphm: +2/+A btw | 18:14 |
| notmorgan | dolphm: on the spec | 18:14 |
| notmorgan | amakarov: sure sec. | 18:14 |
| SamYaple | i understand your worries, and do share them to a degree. but i question how useful any "reseller" type thing is without inherited permissions and the ability to list only subdomains (not list _ALL_ domains) | 18:15 |
| dolphm | notmorgan: sweet | 18:15 |
| notmorgan | SamYaple: asking for "domains I can see" is a fine acl change | 18:17 |
| SamYaple | notmorgan: sure, but for inherited permissions or that to work you would have to have some way to track a domains parent domain I would think | 18:17 |
| notmorgan | SamYaple: no not really, domains are easy to tell "does user have grant X on domain[list]" | 18:18 |
| notmorgan | SamYaple: inherited permissions *can* be assigned onto the domain [any domain] for [user]. | 18:18 |
| SamYaple | i suppose what im missing is the linkage that says this domain is related in any way to this other domain | 18:18 |
| SamYaple | inherited implies some hierarcy | 18:19 |
| notmorgan | it isn't. and it shouldn't be in keystone | 18:19 |
| notmorgan | SamYaple: that is a billing thing. not a keystone thing | 18:19 |
| *** pushkaru has quit IRC | 18:19 | |
| notmorgan | SamYaple: you're asking for business logic in keystone, and i disagree with that. | 18:19 |
| notmorgan | amakarov: https://github.com/openstack/keystone/blob/f7b33213f1cb8313d2cb81225e8530ebbc37ce18/keystone/tests/unit/resource/test_backends.py#L1497-L1554 | 18:19 |
| *** pushkaru has joined #openstack-keystone | 18:19 | |
| notmorgan | amakarov: that is a test of the caching + crud. | 18:19 |
| amakarov | notmorgan, thank you | 18:19 |
| notmorgan | amakarov: it basically does crud and reaches behind the manager to ask the driver directly | 18:20 |
| notmorgan | amakarov: also look for the _invalidate tests | 18:20 |
| SamYaple | notmorgan: im not sure i am. but its completely possible im missing something. how can *inherited* permissions work without the concept of a hierarchy? unless you are suggesting manually assigning userX with roleX in domainX | 18:20 |
| notmorgan | SamYaple: when you create the new domain - assign to the account the RoleX in domainX | 18:21 |
| notmorgan | SamYaple: it's a billing thing. | 18:21 |
| notmorgan | SamYaple: and business logic thing. | 18:21 |
| *** roxanaghe has joined #openstack-keystone | 18:22 | |
| SamYaple | when you refer to "account" are you refering to a user? | 18:23 |
| notmorgan | SamYaple: account is a billing construct | 18:23 |
| notmorgan | SamYaple: sorry assign user <reseller> to newdomainx | 18:23 |
| *** julim has joined #openstack-keystone | 18:23 | |
| dolphm | notmorgan: *poke* since you +2/+A'd the follow up https://review.openstack.org/#/c/284950/ | 18:24 |
| patchbot | dolphm: patch 284950 - keystone-specs - Credential Encryption | 18:24 |
| SamYaple | notmorgan: i mean thats not inherited permissions at that point. so i suppose thats where my confustion comes from here | 18:24 |
| notmorgan | SamYaple: i'm arguing billing != keystone constructs. | 18:25 |
| notmorgan | dolphm: done | 18:26 |
| SamYaple | im not familiar with buisness or billing logic to be honest. but if I am manually (automated) assigning permissions to new domains then its not inheritied | 18:26 |
| notmorgan | SamYaple: it shouldn't be magically inherited. | 18:26 |
| dolphm | notmorgan: ++ | 18:26 |
| SamYaple | notmorgan: i mean, its not magic. its inheritance | 18:27 |
| notmorgan | SamYaple: create the domains directly. | 18:27 |
| notmorgan | SamYaple: inheritence if permission sin keystone are really magical | 18:27 |
| notmorgan | SamYaple: it should be less so. | 18:27 |
| notmorgan | SamYaple: when you are going to sell another thing, get a domain for your new user (ask ythe provider's portal for the domain) which assigns the permissions for your (owner) account | 18:28 |
| SamYaple | fair enough. but just to be clear that is just permissions at that point, nothing is inherited | 18:29 |
| notmorgan | SamYaple: then you sell that. it also means you explicitly get automatic breakdown of utilizations. isolation of quotas etc. | 18:29 |
| notmorgan | SamYaple: it is inherited into the stuff under the new domain | 18:29 |
| notmorgan | it is not *automatically magically* inherited. | 18:29 |
| *** spzala has joined #openstack-keystone | 18:29 | |
| notmorgan | SamYaple: as long as the nerw domain role has inherit=true which i assume in my argument | 18:29 |
| notmorgan | SamYaple: it's a difference between encoding business logic into keystone for some limited (very limited) models of deployment or providing tools for those deployments to succeed | 18:30 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 18:30 |
| notmorgan | and i'm very much worried of the complexity for the narrow use cases (and it is narrow) for that type of reseller build that isn't met 90% of the way already with the current model. | 18:31 |
| SamYaple | notmorgan: inherit=true is where? is this the new theortical feature that could be implemented? | 18:31 |
| SamYaple | or something im not aware of | 18:31 |
| notmorgan | SamYaple: it is when you assign a role | 18:32 |
| notmorgan | SamYaple: you can assign a role to userX that is inherited to everything under that domain/project resource | 18:33 |
| notmorgan | SamYaple: so, when you create the domain(s) you assign an inherited role. | 18:33 |
| notmorgan | SamYaple: anyway. so. the volume of complexity and massive security considerations worryme with stacking domains in domains in domains in domains. | 18:34 |
| SamYaple | i am familiar with inherited roles, but ive been looking at this a different. let me try to wrap my brain around what youre saying | 18:34 |
| notmorgan | SamYaple: sounds good :) | 18:34 |
| SamYaple | and for the record i am not advocating domains of domains, just trying to understand | 18:34 |
| SamYaple | i get the potential issues there | 18:34 |
| notmorgan | SamYaple: i am also saying "resellers selling to resellers selling to resellers" is not common | 18:34 |
| notmorgan | and if it is, i have heard of very limited interest at best. | 18:35 |
| *** david-lyle has quit IRC | 18:35 | |
| SamYaple | i only started the conversation with resellers since that was the name of the blueprint | 18:35 |
| notmorgan | SamYaple: /me nods. | 18:36 |
| openstackgerrit | Merged openstack/keystone: Allow domain admins to list users in groups with v3 policy https://review.openstack.org/321128 | 18:36 |
| notmorgan | SamYaple: :) | 18:36 |
| notmorgan | SamYaple: lets continue this when you've had a chance to think it over :) | 18:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 18:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 18:36 |
| SamYaple | notmorgan: thanks for the talk! | 18:37 |
| notmorgan | SamYaple: of course! | 18:37 |
| *** ddieterly[away] is now known as ddieterly | 18:37 | |
| *** diazjf has joined #openstack-keystone | 18:38 | |
| *** links has quit IRC | 18:39 | |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Show deprecation when a user_agent is not set https://review.openstack.org/289645 | 18:41 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 18:42 |
| *** shaleh has joined #openstack-keystone | 18:43 | |
| shaleh | lbragstad: you around? | 18:43 |
| *** ddieterly has quit IRC | 18:43 | |
| lbragstad | shaleh yessir | 18:44 |
| *** harlowja has quit IRC | 18:44 | |
| shaleh | lbragstad: re: your review of my keystone auth change. What would you like to see me change? I was worried I would be too verbose and apparently i erred on the too quiet side. | 18:44 |
| lbragstad | shaleh do you have the link handy? | 18:45 |
| shaleh | lbragstad: one sec | 18:45 |
| *** dan_nguyen has quit IRC | 18:45 | |
| shaleh | lbragstad: https://review.openstack.org/#/c/288175/ | 18:45 |
| patchbot | shaleh: patch 288175 - keystoneauth - Apply a heuristic for product name if a user_agent... | 18:45 |
| shaleh | It is my plan to remove this code once the deprecate cycle completes and user_agent is a required parameter. | 18:46 |
| lbragstad | shaleh ah gotcha | 18:49 |
| shaleh | lbragstad: until then it makes keystone's access file actually usable. | 18:49 |
| shaleh | We were trying to figure out what was spamming keystone. It turned out to be monasca and neutron. | 18:49 |
| lbragstad | shaleh hah nice | 18:50 |
| shaleh | I will add more detail and update the review. Thanks for the guidance. | 18:50 |
| *** jbell8 has quit IRC | 18:50 | |
| lbragstad | shaleh thanks for the patch :) | 18:52 |
| *** jbell8 has joined #openstack-keystone | 18:52 | |
| lbragstad | shaleh and putting up with my questions! | 18:52 |
| shaleh | lbragstad: you always ask good questions. | 18:53 |
| dolphm | dstanek: when will soon be now? https://github.com/dstanek/vim-gertty | 18:53 |
| *** diazjf has quit IRC | 18:53 | |
| SamYaple | notmorgan: if i have this correct, user "reseller" has "domainadmin" role in "domain1". "domain2" and "domain3" three are compaines (business/billing logic) under "domain1". assign user "reseller" "domainadmin" role in "domain2" and "domain3" at time of domain creations is your suggested solution here? | 18:56 |
| *** amakarov is now known as amakarov_away | 19:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 19:02 |
| *** clenimar has quit IRC | 19:02 | |
| notmorgan | SamYaple: yes | 19:03 |
| notmorgan | SamYaple: that sounds correct | 19:03 |
| *** nisha_ has joined #openstack-keystone | 19:05 | |
| *** clenimar has joined #openstack-keystone | 19:06 | |
| openstackgerrit | Merged openstack/keystone-specs: Credential Encryption https://review.openstack.org/284950 | 19:07 |
| *** nisha_ has quit IRC | 19:10 | |
| *** GB21 has quit IRC | 19:10 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 19:11 |
| SamYaple | notmorgan: ok. that works for permissions. i personally wouldn't call that "inherited". | 19:11 |
| notmorgan | SamYaple: sure | 19:11 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 19:12 |
| SamYaple | regarding the "domains I can see" acl, would that be "domains I have roles assigned in"? | 19:12 |
| notmorgan | SamYaple: i'd say "domains I have X role in" | 19:12 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 19:12 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add protocols integration tests https://review.openstack.org/307508 | 19:12 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add mapping rules integration tests https://review.openstack.org/305444 | 19:12 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add service providers integration tests https://review.openstack.org/303502 | 19:12 |
| notmorgan | SamYaple: but same idea :) | 19:13 |
| openstackgerrit | Sean Perry proposed openstack/keystoneauth: Apply a heuristic for product name if a user_agent is not provided https://review.openstack.org/288175 | 19:13 |
| shaleh | lbragstad: ^^ | 19:13 |
| *** clenimar has quit IRC | 19:14 | |
| SamYaple | notmorgan: are we talking new api call for this? I don't see an existing one that maps well for what we are talking about | 19:15 |
| notmorgan | SamYaple: i would say new API here | 19:15 |
| notmorgan | tbh | 19:15 |
| *** clenimar has joined #openstack-keystone | 19:17 | |
| SamYaple | /v3/users/{user_id}/domains/{role_id} maybe? | 19:17 |
| SamYaple | it doesnt really map well with the other ones does it | 19:17 |
| openstackgerrit | Merged openstack/keystone-specs: Credential Encryption https://review.openstack.org/324714 | 19:18 |
| notmorgan | SamYaple: i'd be open to something under /v3/domains | 19:18 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 19:19 |
| notmorgan | SamYaple: or something new under /../users | 19:19 |
| *** timcline has quit IRC | 19:19 | |
| SamYaple | i think users might make the most sense. but that should be easily switchable. let me get a WIP up. endpoint can always change before merge | 19:21 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 19:21 |
| *** david-lyle has joined #openstack-keystone | 19:24 | |
| *** clenimar has quit IRC | 19:32 | |
| notmorgan | SamYaple: this is goin to need a spec because it's changing the API too. | 19:33 |
| notmorgan | SamYaple: but WIP code to start is cool too. | 19:33 |
| notmorgan | SamYaple: just a heads up (we'll want the spec to be proposed tomorrow if we want to land it this cycle) | 19:33 |
| *** sdake has quit IRC | 19:35 | |
| SamYaple | esh im not a spec guy notmorgan. not sure i could write it by tomorrow | 19:36 |
| notmorgan | SamYaple: it should be an easy spec :) | 19:36 |
| notmorgan | SamYaple: but at least get the WIP code up | 19:36 |
| notmorgan | we can talk spec-freeze exception on tuesday if needed. | 19:37 |
| SamYaple | yea im going to see if i can copy a spec real quick | 19:37 |
| *** sdake has joined #openstack-keystone | 19:38 | |
| *** openstackstatus has quit IRC | 19:39 | |
| *** openstack has joined #openstack-keystone | 19:39 | |
| *** openstackstatus has joined #openstack-keystone | 19:40 | |
| *** ChanServ sets mode: +v openstackstatus | 19:40 | |
| *** sdake_ has joined #openstack-keystone | 19:40 | |
| *** frontrunner has joined #openstack-keystone | 19:41 | |
| *** sdake has quit IRC | 19:43 | |
| *** jbell8_ has joined #openstack-keystone | 19:45 | |
| *** jbell8 has quit IRC | 19:45 | |
| *** timcline has joined #openstack-keystone | 19:49 | |
| *** timcline_ has joined #openstack-keystone | 19:51 | |
| *** timcline has quit IRC | 19:51 | |
| *** clenimar has joined #openstack-keystone | 19:51 | |
| *** neophy has joined #openstack-keystone | 19:54 | |
| *** clenimar has quit IRC | 19:56 | |
| *** david-lyle has quit IRC | 19:57 | |
| openstackgerrit | Merged openstack/keystone: Imported Translations from Zanata https://review.openstack.org/324258 | 19:59 |
| *** clenimar has joined #openstack-keystone | 19:59 | |
| bknudson | I've been trying some performance tests with devstack -- uuid tokens takes 12 seconds validate a token 1000 times, fernet takes 56 seconds. | 20:02 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users and deprecate driver backend https://review.openstack.org/323596 | 20:03 |
| stevemar | bknudson: that doesn't sound good | 20:05 |
| bknudson | I'm going to mess with caching | 20:05 |
| stevemar | bknudson: mess it all up | 20:05 |
| stevemar | bknudson: oh, i wanted to ask you to review this: https://review.openstack.org/#/c/274400/ before someone punts it through | 20:06 |
| patchbot | stevemar: patch 274400 - keystonemiddleware - Use extras for oslo.messaging dependency | 20:06 |
| stevemar | and possibly it's follow on patch... it may have an impact on devstack | 20:06 |
| *** amrith is now known as _amrith_ | 20:07 | |
| *** clenimar has quit IRC | 20:07 | |
| *** spzala has quit IRC | 20:08 | |
| *** clenimar has joined #openstack-keystone | 20:11 | |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Adding role assignment lists unit tests https://review.openstack.org/254436 | 20:12 |
| *** neophy has quit IRC | 20:12 | |
| raildo | samueldmq: ^ | 20:12 |
| openstackgerrit | Raildo Mascena proposed openstack/keystone: Adding role assignment lists unit tests https://review.openstack.org/254436 | 20:13 |
| *** tqtran has joined #openstack-keystone | 20:14 | |
| *** spzala has joined #openstack-keystone | 20:14 | |
| *** clenimar has quit IRC | 20:17 | |
| *** roxanaghe has joined #openstack-keystone | 20:18 | |
| openstackgerrit | Sam Yaple proposed openstack/keystone-specs: Add spec for domains user has role assignments in https://review.openstack.org/324797 | 20:19 |
| *** spzala has quit IRC | 20:19 | |
| SamYaple | notmorgan: ^ not a spec guy though... not sure i even described the situation adequetly | 20:19 |
| lbragstad | bknudson ayoung had a patch up for revocation stuff | 20:19 |
| lbragstad | bknudson not sure what the status of that is | 20:20 |
| *** rcernin has joined #openstack-keystone | 20:20 | |
| *** clenimar has joined #openstack-keystone | 20:21 | |
| *** harlowja has joined #openstack-keystone | 20:24 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 20:28 |
| *** lucas____ has quit IRC | 20:29 | |
| *** gyee has joined #openstack-keystone | 20:31 | |
| *** ChanServ sets mode: +v gyee | 20:31 | |
| *** clenimar has quit IRC | 20:31 | |
| *** lucas___ has joined #openstack-keystone | 20:31 | |
| bknudson | lbragstad: since this is a clean install there shouldn't be a lot of revocations unless devstack is doing a bunch. (not a very realistic test) | 20:32 |
| lbragstad | bknudson what devstack tests are you running? | 20:32 |
| bknudson | also I probably need to set up memcache for this to be realistic | 20:32 |
| bknudson | lbragstad: I wrote my own script that just creates a token and calls validate using it | 20:32 |
| bknudson | python script | 20:33 |
| *** lucas____ has joined #openstack-keystone | 20:33 | |
| *** spzala has joined #openstack-keystone | 20:33 | |
| bknudson | I can post it to my github | 20:33 |
| lbragstad | bknudson oh - so does your test do anything that would create a revocation event? | 20:33 |
| *** dan_nguyen has joined #openstack-keystone | 20:33 | |
| *** lucas____ has quit IRC | 20:33 | |
| *** lucas____ has joined #openstack-keystone | 20:33 | |
| *** lucas___ has quit IRC | 20:34 | |
| bknudson | lbragstad: https://github.com/brantlk/keystone_performance | 20:34 |
| *** clenimar has joined #openstack-keystone | 20:34 | |
| bknudson | lbragstad: the token is not revoked | 20:34 |
| lbragstad | bknudson gotcha | 20:35 |
| bknudson | lbragstad: I would be interested to know what kind of numbers you get on your own systems | 20:35 |
| *** sheel has quit IRC | 20:35 | |
| bknudson | then I could compare it to what we get | 20:35 |
| lbragstad | bknudson when I was performance testing, i was doing it with devstack | 20:35 |
| lbragstad | and just hammering it with tempest tests | 20:36 |
| bknudson | lbragstad: did you compare fernet and uuid? | 20:36 |
| lbragstad | ./run_tempest tempest.api.identity.v3 (for example) | 20:36 |
| lbragstad | bknudson https://gist.github.com/lbragstad/7b60de511cfcd71b8bb5 | 20:37 |
| bknudson | so my next things to try are to set up memcache and also to run in parallel since we want to see if there's contention | 20:37 |
| lbragstad | but that was a different test - i was using dolphm's benchmark scripts | 20:37 |
| bknudson | lbragstad: let me take a look at these | 20:38 |
| *** lucas____ has quit IRC | 20:38 | |
| bknudson | response time - 1665.453 (ms) | 20:39 |
| bknudson | that's 1.6 seconds :( | 20:39 |
| dolphm | lbragstad: are you actually using caching? you have to point keystone to memcache | 20:40 |
| dolphm | lbragstad: or whatever your cache backend is - you can't just hit enable = true | 20:40 |
| lbragstad | dolphm i could have been doing that wrong - i also don't have the environment up anymore | 20:40 |
| bknudson | concurrent token validate: 4047.776 (ms) -- 4 seconds :(((( | 20:41 |
| *** tonytan4ever has quit IRC | 20:41 | |
| *** jbell8_ has quit IRC | 20:42 | |
| bknudson | https://gist.github.com/lbragstad/7b60de511cfcd71b8bb5 shows that uuid is faster, too: concurrent token validate: 348.120 for uuid vs 1414.370 for fernet | 20:43 |
| *** lucas___ has joined #openstack-keystone | 20:44 | |
| lbragstad | yeah - that was my general findings | 20:44 |
| *** lucas___ has quit IRC | 20:44 | |
| *** lucas___ has joined #openstack-keystone | 20:45 | |
| bknudson | we need to speed that up! | 20:45 |
| lbragstad | bknudson the call the check service providers in the validation path is also something that took forever | 20:46 |
| bknudson | lbragstad: do you have an idea where the extra time is spent? decryption or database? | 20:46 |
| lbragstad | at least the last time dstanek dolphm and i ran profiling on keystone | 20:46 |
| bknudson | service catalog? | 20:46 |
| dolphm | bknudson: federated service providers | 20:46 |
| lbragstad | yep | 20:47 |
| dolphm | bknudson: it gets called several times to generate one token | 20:47 |
| dolphm | list_service_providers(), i believe | 20:47 |
| lbragstad | dolphm generate or validate? | 20:47 |
| bknudson | that's included in these devstack tests? | 20:47 |
| dolphm | lbragstad: both? | 20:47 |
| lbragstad | dolphm that's what I thought | 20:47 |
| dolphm | bknudson: yes, even if the list is empty, it takes forever | 20:47 |
| lbragstad | dolphm bknudson marekd had a patch somewhere to add caching to it | 20:48 |
| bknudson | was it not cached or not cachable or something? | 20:48 |
| dolphm | bknudson: it's very cacheable and not cached today | 20:48 |
| dolphm | afaik | 20:48 |
| lbragstad | bknudson not sure what the status of it is | 20:48 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 20:48 |
| lbragstad | s/it/that patch/ | 20:48 |
| *** lucas___ has quit IRC | 20:49 | |
| dolphm | actually, the hangup might have been that we don't do caching on lists, generally speaking... but this one should be trivial | 20:49 |
| *** roxanagh_ has joined #openstack-keystone | 20:50 | |
| *** diazjf has joined #openstack-keystone | 20:51 | |
| *** joaotargino has quit IRC | 20:51 | |
| bknudson | maybe you're talking about https://github.com/openstack/keystone/blame/master/keystone/federation/core.py#L66 ? | 20:52 |
| bknudson | https://review.openstack.org/#/c/298748/ -- looks like lbragstad owns that one | 20:52 |
| patchbot | bknudson: patch 298748 - keystone - Refactor to allow for service provider caching | 20:52 |
| *** julim has quit IRC | 20:53 | |
| lbragstad | bknudson ah - you're right | 20:53 |
| lbragstad | that looks like it's it | 20:53 |
| *** roxanagh_ has quit IRC | 20:55 | |
| bknudson | one thing I realized is that we do validation twice whenever we validate a token -- once for x-auth-token and again for x-subject-token | 20:55 |
| dolphm | dstanek: ping | 20:55 |
| bknudson | the validation of x-auth-token should be much faster since it's not going to care about service catalogs or service providers | 20:55 |
| dolphm | dstanek: if you answered yesterday, i never saw the response :( but i'm still keeping an eye out for the pysaml service provider PoC | 20:55 |
| lbragstad | dolphm isn't dstanek on vacation this week? | 20:56 |
| *** raildo is now known as raildo-afk | 20:56 | |
| dolphm | lbragstad: oh, boo. | 20:56 |
| lbragstad | bknudson maybe we can add a patch to always do something like ?nocatalog for the x-auth-token | 20:56 |
| dolphm | lbragstad: i swear i talked to him a day or two ago lol | 20:56 |
| bknudson | lbragstad: that should be easy to do. | 20:56 |
| lbragstad | dolphm yeah - he was in for a bit on monday and he said he might be on for a bit tomorrow | 20:57 |
| bknudson | dstanek needs to learn how to take a vacation | 20:57 |
| dolphm | lbragstad: ack | 20:57 |
| *** ayoung has joined #openstack-keystone | 20:59 | |
| *** ChanServ sets mode: +v ayoung | 20:59 | |
| bknudson | lbragstad: I'm going to keep trying stuff (setting up memcache) and see if I can get better numbers. I'll have to check out the service providers caching issue, too. | 20:59 |
| lbragstad | bknudson i'll see if i can get the patch cleaned up and rebased | 21:00 |
| bknudson | that would be great | 21:00 |
| *** iurygregory_ has quit IRC | 21:03 | |
| *** gagehugo has quit IRC | 21:04 | |
| *** diazjf1 has joined #openstack-keystone | 21:07 | |
| *** diazjf has quit IRC | 21:09 | |
| *** diazjf1 has quit IRC | 21:12 | |
| *** adu has quit IRC | 21:16 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Shadow LDAP and custom driver users https://review.openstack.org/323602 | 21:16 |
| *** diazjf has joined #openstack-keystone | 21:18 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Move stray notification options into config module https://review.openstack.org/324880 | 21:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor to allow for service provider caching https://review.openstack.org/298748 | 21:18 |
| lbragstad | notmorgan i rebased ^ but i think it still needs some work | 21:19 |
| notmorgan | lbragstad: okie | 21:19 |
| notmorgan | lbragstad: i'll take a look soon | 21:19 |
| lbragstad | notmorgan i'm running tests locally but the caching stuff still don't quite make sense to me | 21:19 |
| lbragstad | notmorgan thanks | 21:19 |
| notmorgan | lbragstad: oh working to elminate circular importing huh? | 21:22 |
| notmorgan | lbragstad: i think i see what you;re doing there | 21:22 |
| *** pauloewerton has quit IRC | 21:22 | |
| *** jaugustine has quit IRC | 21:23 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor to allow for service provider caching https://review.openstack.org/298748 | 21:23 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Move stray notification options into config module https://review.openstack.org/324880 | 21:24 |
| *** ayoung has quit IRC | 21:25 | |
| lbragstad | notmorgan yes - so revoke_model.py has a dependency on keystone.common.cache._context_cache has a dependency on revoke_model | 21:25 |
| lbragstad | er... revoke_model has a dependency on cache and _context_cache has a dependency on revoke_model | 21:27 |
| notmorgan | lbragstad: right. you're just restructuring that it looks like. | 21:28 |
| *** _amrith_ is now known as amrith | 21:30 | |
| lbragstad | notmorgan why is/was _RevokeModelHandler here https://review.openstack.org/#/c/298748/3/keystone/models/revoke_model.py,unified/ | 21:30 |
| patchbot | lbragstad: patch 298748 - keystone - Refactor to allow for service provider caching | 21:30 |
| lbragstad | https://review.openstack.org/#/c/298748/3/keystone/models/revoke_model.py,unified * | 21:31 |
| patchbot | lbragstad: patch 298748 - keystone - Refactor to allow for service provider caching | 21:31 |
| lbragstad | notmorgan isn't that handled by keystone/common/cache/_context_cache.py _RevokeEventHandler()? | 21:31 |
| notmorgan | lbragstad: uhm... it is. | 21:32 |
| notmorgan | lbragstad: or should be. | 21:32 |
| lbragstad | notmorgan hmm | 21:32 |
| notmorgan | lbragstad: i would love to fix it so we can use json instead of msgpack | 21:32 |
| notmorgan | but there are some things... datetime objects etc that... wlel | 21:33 |
| notmorgan | :( | 21:33 |
| notmorgan | we could use cpickle >.> | 21:33 |
| lbragstad | so the changes to https://review.openstack.org/#/c/298748/3/keystone/models/revoke_model.py,unified should *not* include the _RevokeModelHandler | 21:33 |
| patchbot | lbragstad: patch 298748 - keystone - Refactor to allow for service provider caching | 21:33 |
| notmorgan | <.< | 21:33 |
| * notmorgan waits for bknudson to throw things. | 21:33 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Change password requirements https://review.openstack.org/320156 | 21:33 |
| notmorgan | lbragstad: it's fine to move it, but long term it should just go away | 21:33 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Password strength requirements https://review.openstack.org/320586 | 21:33 |
| notmorgan | it needs to be able to import revoke_model | 21:34 |
| notmorgan | because it *needs* to say what objects it specifically serializes | 21:34 |
| notmorgan | also wait why is it still doing RevokeTree? | 21:34 |
| lbragstad | because that was proposed quite a white ago | 21:34 |
| notmorgan | didn't revoketree go away? | 21:35 |
| lbragstad | notmorgan yep https://github.com/openstack/keystone/commit/75abc21ecfc2a37c10be61289204b5056403dd5c | 21:35 |
| notmorgan | yeah that should just go away | 21:35 |
| notmorgan | or if anything is moved the RevokeEventHandler moves. | 21:36 |
| notmorgan | but RevokeTree handler is superfluous now | 21:36 |
| notmorgan | (in fact that probably will fail jenkins because RevokeTree isn't a thing | 21:36 |
| lbragstad | notmorgan right | 21:37 |
| notmorgan | yeah this is an unfun rebase it looks like | 21:37 |
| *** rcernin_ has joined #openstack-keystone | 21:38 | |
| lbragstad | notmorgan hmm why does the handler registration have to the line in the revoke_model? | 21:38 |
| lbragstad | notmorgan cache.register_model_handler(_RevokeModelHandler) was in /keystone/models/revoke_model.pu | 21:39 |
| lbragstad | .py* | 21:39 |
| notmorgan | lbragstad: not sure what you're asking | 21:40 |
| lbragstad | notmorgan but that handler registration should already be taken care of here - https://github.com/openstack/keystone/blob/c1e712e18743fd683c9e6ee8886032a6e468188e/keystone/common/cache/_context_cache.py#L45 | 21:40 |
| *** adu has joined #openstack-keystone | 21:41 | |
| notmorgan | lbragstad: right. it should unless you can't have context cache import revoke_model | 21:41 |
| notmorgan | which case, you may need to move it and have revoke_model import context_cache and register | 21:41 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Update man page for Newton release https://review.openstack.org/324891 | 21:43 |
| *** edtubill has quit IRC | 21:43 | |
| lbragstad | notmorgan hmm how did this come up when trying to cache service providers? | 21:43 |
| *** diazjf has quit IRC | 21:43 | |
| notmorgan | lbragstad: no idea | 21:43 |
| lbragstad | this circular dependency seems unrelated to caching service providers | 21:43 |
| notmorgan | i'm very confused by this patch fwiw | 21:43 |
| lbragstad | me too | 21:43 |
| bknudson | I just noticed that mitaka devstack has memcache enabled already, so that might explain the improvements I saw on devstack mitaka | 21:46 |
| notmorgan | bknudson: yes | 21:46 |
| notmorgan | bknudson: it was something i was working on to help with when we did the "disable in-memory cache" in keystonemiddleware | 21:46 |
| notmorgan | bknudson: it was the other fix that was landed ... an hour after the "OMG REVERT" fix | 21:47 |
| bknudson | notmorgan: ok. I thought it was because fernet is too slow without it. | 21:47 |
| bknudson | now I'm trying to figure out how to enable caching on liberty ... Can't load plugin dogpile.cache oslo_cache.memcache_pool | 21:48 |
| notmorgan | bknudson: nope. fernet being slow is also fixed by cache, but the reason devstack runs cache (and shared cache for service's validating user tokens, like it should be), is because of the ksm change | 21:48 |
| notmorgan | "fixed" | 21:48 |
| *** henrynash has quit IRC | 21:48 | |
| *** ThomasHsiao has joined #openstack-keystone | 21:48 | |
| bknudson | we probably weren't using oslo_cache in liberty | 21:50 |
| *** spzala has quit IRC | 21:51 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Refactor to allow for service provider caching https://review.openstack.org/298748 | 21:52 |
| lbragstad | notmorgan starting over from square one | 21:52 |
| notmorgan | bknudson: not in ksm. | 21:53 |
| notmorgan | bknudson: i *think* oslo_cache landed in keystone in mitaka, and ksm in ... newton? | 21:54 |
| bknudson | notmorgan: we were still using keystone.cache.memcache_pool in liberty | 21:57 |
| stevemar | bknudson: fun times with performance eh | 21:58 |
| *** markvoelker has quit IRC | 21:58 | |
| bknudson | stevemar: yes, people aren't happy with the performance. | 21:59 |
| notmorgan | bknudson: yes :( | 22:01 |
| notmorgan | bknudson: memcache_pool is uses (oslo_cache version) in mitaka | 22:02 |
| notmorgan | bknudson: that will hopefully start going away once we fixup python-memcached (i'll be taking ownership of it next week) | 22:02 |
| bknudson | we're old-school | 22:02 |
| *** gordc has quit IRC | 22:02 | |
| notmorgan | bknudson: aslo i want to pointout... that i love that we are the "clear" performance issue (we scale horizontally fairly well) compared to the seconds+ it takes nova and other projects to perform actions | 22:03 |
| *** ametts has quit IRC | 22:03 | |
| notmorgan | bknudson: also the lack of most people willing to look at keystone until welllllll after we ship things because we're "not the problem" then "OMG YOURE SLOW" | 22:04 |
| notmorgan | bknudson: (common thread I keep hearing, if you can't tell) | 22:04 |
| stevemar | notmorgan: you sound totally happy about it | 22:05 |
| notmorgan | bknudson: operationally easier to manage keystone > pure performance imnsho. | 22:05 |
| notmorgan | but with that said...w eshould not suck at performance | 22:05 |
| *** rcernin_ has quit IRC | 22:06 | |
| lbragstad | notmorgan gah! | 22:06 |
| lbragstad | notmorgan so when we strip it down to the base basics - https://review.openstack.org/#/c/298748/4 | 22:06 |
| patchbot | lbragstad: patch 298748 - keystone - Refactor to allow for service provider caching | 22:06 |
| lbragstad | we will fail on another *different* circular dependency | 22:06 |
| lbragstad | http://cdn.pasteraw.com/jybhso7rfr2yqhc0xjsyjrjh403hu0l | 22:07 |
| notmorgan | lbragstad: so we need to fix some import orders/where things live | 22:09 |
| *** ayoung has joined #openstack-keystone | 22:11 | |
| *** ChanServ sets mode: +v ayoung | 22:11 | |
| *** KarthikB has quit IRC | 22:13 | |
| openstackgerrit | Merged openstack/keystoneauth: Apply a heuristic for product name if a user_agent is not provided https://review.openstack.org/288175 | 22:13 |
| *** KarthikB has joined #openstack-keystone | 22:14 | |
| notmorgan | stevemar: what makes you think i'm happy :P | 22:14 |
| *** KarthikB has quit IRC | 22:15 | |
| *** KarthikB has joined #openstack-keystone | 22:15 | |
| *** KarthikB has quit IRC | 22:17 | |
| *** KarthikB has joined #openstack-keystone | 22:17 | |
| *** KarthikB_ has joined #openstack-keystone | 22:19 | |
| *** openstackgerrit has quit IRC | 22:19 | |
| *** openstackgerrit has joined #openstack-keystone | 22:20 | |
| *** KarthikB has quit IRC | 22:22 | |
| *** KevinE has quit IRC | 22:23 | |
| *** KarthikB_ has quit IRC | 22:24 | |
| notmorgan | FYI we're getting a policy file validation error bug being opened | 22:27 |
| notmorgan | we should really make it better ( devananda will hand us the bugid soonish) | 22:27 |
| *** edmondsw has quit IRC | 22:28 | |
| *** rk4n has quit IRC | 22:28 | |
| *** henrynash has joined #openstack-keystone | 22:29 | |
| *** ChanServ sets mode: +v henrynash | 22:29 | |
| *** dave-mccowan has quit IRC | 22:30 | |
| *** devananda has joined #openstack-keystone | 22:31 | |
| devananda | notmorgan: https://bugs.launchpad.net/oslo.policy/+bug/1588552 | 22:31 |
| openstack | Launchpad bug 1588552 in oslo.policy "policy file validation errors are hard to debug" [Undecided,New] | 22:31 |
| notmorgan | devananda: thanks! | 22:32 |
| *** frontrunner has quit IRC | 22:38 | |
| *** edtubill has joined #openstack-keystone | 22:41 | |
| *** agrebennikov has quit IRC | 22:42 | |
| *** samueldmq has quit IRC | 22:48 | |
| *** pushkaru has quit IRC | 22:48 | |
| *** dave-mccowan has joined #openstack-keystone | 22:48 | |
| *** roxanagh_ has joined #openstack-keystone | 22:52 | |
| *** adu has quit IRC | 22:52 | |
| *** frontrunner has joined #openstack-keystone | 22:56 | |
| *** roxanagh_ has quit IRC | 22:56 | |
| *** lucas__ has joined #openstack-keystone | 22:58 | |
| *** markvoelker has joined #openstack-keystone | 22:58 | |
| *** lucas___ has joined #openstack-keystone | 23:00 | |
| *** lucas____ has joined #openstack-keystone | 23:02 | |
| *** lucas__ has quit IRC | 23:02 | |
| *** markvoelker has quit IRC | 23:03 | |
| *** ThomasHsiao has quit IRC | 23:04 | |
| *** ayoung has quit IRC | 23:04 | |
| *** lucas___ has quit IRC | 23:05 | |
| *** tonytan4ever has joined #openstack-keystone | 23:06 | |
| *** lucas____ has quit IRC | 23:06 | |
| *** r-daneel has joined #openstack-keystone | 23:07 | |
| *** lucas__ has joined #openstack-keystone | 23:09 | |
| *** rcernin has quit IRC | 23:10 | |
| *** lucas__ has quit IRC | 23:12 | |
| *** lucas___ has joined #openstack-keystone | 23:12 | |
| *** edtubill has quit IRC | 23:12 | |
| *** lucas__ has joined #openstack-keystone | 23:13 | |
| *** lucas___ has quit IRC | 23:17 | |
| *** pushkaru has joined #openstack-keystone | 23:17 | |
| *** lucas__ has quit IRC | 23:18 | |
| *** agireud has quit IRC | 23:19 | |
| *** BjoernT has quit IRC | 23:20 | |
| *** david-lyle has joined #openstack-keystone | 23:20 | |
| *** agireud has joined #openstack-keystone | 23:21 | |
| *** pushkaru has quit IRC | 23:22 | |
| *** lhcheng has quit IRC | 23:22 | |
| *** adu has joined #openstack-keystone | 23:23 | |
| *** roxanaghe has quit IRC | 23:29 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/324830 | 23:30 |
| *** shaleh has quit IRC | 23:39 | |
| *** henrynash has quit IRC | 23:43 | |
| *** timcline_ has quit IRC | 23:49 | |
| *** roxanaghe has joined #openstack-keystone | 23:52 | |
| *** iurygregory_ has joined #openstack-keystone | 23:53 | |
| *** sdake has joined #openstack-keystone | 23:54 | |
| *** sdake_ has quit IRC | 23:56 | |
| *** roxanaghe has quit IRC | 23:57 | |
| *** sdake has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
