| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/identity/v3/federated.py#n54 | 00:00 |
|---|---|---|
| ayoung | wait not that | 00:00 |
| jamielennox | yea, that's what i meant though - they should be provided you shouldn't need them in your own get_options | 00:01 |
| ayoung | keystoneclient/contrib/auth/v3/saml2.py | 00:01 |
| ayoung | http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/contrib/auth/v3/saml2.py#n68 | 00:02 |
| ayoung | I could have hardcoded protocol to saml2.... | 00:03 |
| jamielennox | it'd be nice if the plugin could in some way default that | 00:03 |
| jamielennox | anyway, the federated base will give you everything but idp-url, username and password | 00:04 |
| *** ddieterly has joined #openstack-keystone | 00:04 | |
| ayoung | jamielennox, yeah. It seems strange to be building the URL out of components | 00:04 |
| jamielennox | ayoung: well that bit i don't have much choice over | 00:05 |
| *** sdake_ has quit IRC | 00:05 | |
| ayoung | jamielennox, right. This was just out of trial and error. Was happy it was so easy | 00:05 |
| ayoung | Let me see what we have in auth right now... | 00:05 |
| jamielennox | ayoung: so don't pop protocol | 00:06 |
| ayoung | jamielennox, where are the entry points for KSA extras? | 00:06 |
| ayoung | yeah...vestige | 00:06 |
| jamielennox | same place in setup.cfg | 00:06 |
| ayoung | not quite...something is strange | 00:06 |
| jamielennox | oh, so most of them aren't there atm | 00:06 |
| jamielennox | we have a problem with listing all plugins where not all the dependencies are available which we still need to sort out | 00:07 |
| ayoung | http://git.openstack.org/cgit/openstack/keystoneauth/tree/setup.cfg#n25 has something that almost looks like them | 00:07 |
| ayoung | can we defer the imports until we create the objects? | 00:08 |
| jamielennox | i thought the seperation between loading and object would fix it - it will help | 00:08 |
| ayoung | so just enumerating them will not pull in the dependencies | 00:08 |
| ayoung | when you list the objects, you pull in the dependencies. I was doing this: | 00:09 |
| jamielennox | we can either only load the module when the plugin is invoked | 00:09 |
| jamielennox | so defer the import to the plugin creation point | 00:09 |
| ayoung | import pkg_resources | 00:09 |
| ayoung | <ayoung> >>> named_objects = {} | 00:09 |
| ayoung | <ayoung> >>> for ep in pkg_resources.iter_entry_points(group='keystoneclient.auth.plugin'): | 00:09 |
| ayoung | <ayoung> ... named_objects.update({ep.name: ep.load()}) | 00:09 |
| ayoung | <ayoung> >>> print named_objects['v3unscopedsaml'] | 00:09 |
| jamielennox | but that means if you list everything you still see plugins you can't use | 00:09 |
| ayoung | I think I'm OK with that | 00:09 |
| jamielennox | or we can put like an @property available on the plugins | 00:09 |
| jamielennox | default it to true | 00:09 |
| jamielennox | kerberos would set available = False whenever it can't load the deps | 00:10 |
| *** dan_nguyen has left #openstack-keystone | 00:10 | |
| jamielennox | and the iterator would only return plugins that have available=True | 00:10 |
| ayoung | can you register an entrypoint after the fact? | 00:10 |
| jamielennox | and anyone doing pkg_resources looping is on their own :) | 00:10 |
| ayoung | jamielennox, if we don't have entrypoints for samls and Kerberos, does that mean we broke federation in Mitaka? | 00:10 |
| jamielennox | ayoung: i don't think so - and it wouldn't work because you could only register it then when the module was loaded | 00:11 |
| jamielennox | ayoung: it means we don't have an upgrade path for them to keystoneauth | 00:11 |
| ayoung | https://pythonhosted.org/setuptools/pkg_resources.html Ironic | 00:11 |
| jamielennox | however OSC still hasn't moved | 00:11 |
| jamielennox | nor has horizon | 00:11 |
| jamielennox | 404? | 00:12 |
| jamielennox | https://setuptools.readthedocs.io/en/latest/pkg_resources.html | 00:12 |
| ayoung | was looking at this section https://setuptools.readthedocs.io/en/latest/pkg_resources.html#id9 | 00:13 |
| ayoung | https://setuptools.readthedocs.io/en/latest/pkg_resources.html#locating-plugins | 00:13 |
| jamielennox | but to do that you would have to import the module to register the entrypoint and the whole idea is to not have to do that | 00:13 |
| jamielennox | oh, find_plugins is new i think | 00:13 |
| jamielennox | but either way we are wrapping it with stevedore | 00:14 |
| ayoung | add_entry(entry) | 00:15 |
| jamielennox | ayoung: but where would i call that from? | 00:16 |
| ayoung | jamielennox, no idea..this is all new to me. It might not be what it looks like | 00:16 |
| jamielennox | ayoung: it would have to be called from somewhere frequently imported like base __init__.py or even loading, but that would mean trying to import all these dependencies even if they're not used | 00:17 |
| jamielennox | it wouldn't fail, but it would be slow and cause problems for anyone trying to host plugins out of tree | 00:17 |
| ayoung | jamielennox, if we are going to put the plugin into KSA, lets enumerate all of the plugins (even extras) and then fail on loading them if the deps don't match | 00:17 |
| ayoung | If people yell and scream about that, we'll split them out into their own dependency specific packages | 00:18 |
| *** markvoelker has joined #openstack-keystone | 00:20 | |
| jamielennox | ayoung: that was the KSC approach, the intent with ksa was to bring them into tree and use the extras functionality | 00:20 |
| jamielennox | like pip install keystoneauth['kerberos,saml2'] | 00:20 |
| ayoung | is extras a thing? | 00:23 |
| jamielennox | yep | 00:23 |
| ayoung | http://pythonhosted.org//setuptools/setuptools.html#declaring-extras-optional-features-with-their-own-dependencies 404 Jopy | 00:23 |
| jamielennox | ayoung: it's moved to the readthedocs | 00:24 |
| ayoung | yeah, but the links are different | 00:24 |
| ayoung | so, that doc did not move...its not anywhere now, is it? | 00:24 |
| *** markvoelker has quit IRC | 00:25 | |
| jamielennox | https://setuptools.readthedocs.io/en/latest/setuptools.html#declaring-extras-optional-features-with-their-own-dependencies | 00:27 |
| ayoung | jamielennox, so the entrypoints go in a text file...I don;'t see how that can be optional | 00:28 |
| ayoung | /usr/lib/python2.7/site-packages/python_keystoneclient_kerberos-0.2.1-py2.7.egg-info/entry_points.txt has | 00:28 |
| ayoung | [keystoneclient.auth.plugin] | 00:29 |
| ayoung | v3kerberos = keystoneclient_kerberos.v3:Kerberos | 00:29 |
| ayoung | v3fedkerb = keystoneclient_kerberos.v3:FederatedKerberos | 00:29 |
| ayoung | either they are there or they are not. | 00:29 |
| jamielennox | different concepts | 00:29 |
| jamielennox | https://github.com/openstack/keystoneauth/blob/master/setup.cfg#L25-L35 | 00:29 |
| jamielennox | we are then relying on the fact the user installed the correct extras to display the correct plugins | 00:30 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add available flag to plugin loaders https://review.openstack.org/326189 | 00:36 |
| jamielennox | ayoung, stevemar, crinkle: that ^ would let a plugin opt out of being available if it's dependencies were not met | 00:36 |
| jamielennox | (needs tests and a bug) | 00:37 |
| ayoung | jamielennox, so then do we put the entrypoints in setup.cfg, just like the others? | 00:37 |
| jamielennox | ayoung: yes, we have to | 00:38 |
| ayoung | OK | 00:38 |
| jamielennox | ayoung: we still need a list somewhere of the plugins we can iterate over | 00:38 |
| ayoung | OK..I 'm with you on this | 00:38 |
| *** sdake has joined #openstack-keystone | 00:38 | |
| *** r-daneel has quit IRC | 00:39 | |
| jamielennox | i'm not sure if it should be a class property, or just a regular attribute - it probably doesn't matter | 00:42 |
| ayoung | jamielennox, say I wanted to use that...how would I do so? | 00:42 |
| jamielennox | so taking the kerberos plugin as an examle | 00:42 |
| jamielennox | try: | 00:42 |
| jamielennox | import requests_kerberos | 00:42 |
| jamielennox | except ImportError: | 00:43 |
| jamielennox | HAS_KERBEROS = False | 00:43 |
| jamielennox | else: | 00:43 |
| jamielennox | HAS_KERBEROS = True | 00:43 |
| jamielennox | then from the loader | 00:43 |
| jamielennox | @property | 00:43 |
| jamielennox | def available(self): | 00:43 |
| jamielennox | return kerberos.HAS_KERBEROS | 00:43 |
| ayoung | where is the loader? | 00:44 |
| jamielennox | so this is ksa | 00:44 |
| ayoung | yep | 00:44 |
| jamielennox | atm its https://review.openstack.org/#/c/321814/ | 00:44 |
| patchbot | jamielennox: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 00:44 |
| jamielennox | it was supposed to land in the last release but we found this problem | 00:44 |
| ayoung | ah...the one I am supposed to be revieweing instead of jabbering on... | 00:45 |
| ayoung | OK...let me do that | 00:45 |
| jamielennox | i'm not sure why that's passing tests now | 00:45 |
| ayoung | rippowam puts the federation config in a wierd place | 00:46 |
| jamielennox | oh, they hacked around it https://review.openstack.org/#/c/321814/7/keystoneauth1/tests/unit/loading/test_entry_points.py | 00:46 |
| patchbot | jamielennox: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 00:46 |
| ayoung | /etc/httpd/conf instead of conf.d | 00:46 |
| jamielennox | so in this case available might be six.PY2 and kerberos.HAS_KERBEROS | 00:47 |
| jamielennox | i chased this a while ago, i though requests_kerberos was py3 now | 00:48 |
| jamielennox | i had a bug for replacing pykerberos with the gssapi one | 00:48 |
| jamielennox | and pykerberos fixed itself | 00:48 |
| ayoung | joy | 00:51 |
| *** iurygregory_ has joined #openstack-keystone | 00:58 | |
| *** lhcheng has quit IRC | 01:07 | |
| openstackgerrit | Tin Lam proposed openstack/keystoneauth: Fix ClientException message property not set properly https://review.openstack.org/285757 | 01:07 |
| *** lhcheng has joined #openstack-keystone | 01:08 | |
| *** ChanServ sets mode: +v lhcheng | 01:08 | |
| *** harlowja has joined #openstack-keystone | 01:08 | |
| *** lhcheng has quit IRC | 01:08 | |
| *** lhcheng has joined #openstack-keystone | 01:09 | |
| *** ChanServ sets mode: +v lhcheng | 01:09 | |
| *** anteaya has quit IRC | 01:10 | |
| *** browne1 has quit IRC | 01:17 | |
| *** vint_bra has joined #openstack-keystone | 01:17 | |
| *** jasondotstar has quit IRC | 01:18 | |
| *** tqtran has quit IRC | 01:19 | |
| *** lhcheng has quit IRC | 01:24 | |
| *** ddieterly has quit IRC | 01:34 | |
| *** EinstCrazy has joined #openstack-keystone | 01:35 | |
| *** rmizuno has joined #openstack-keystone | 01:37 | |
| *** sdake has quit IRC | 01:50 | |
| jamielennox | i have no idea how to write a test for this | 01:54 |
| jamielennox | i think you'd have to patch pkg_resources, but even stevedore tests don't attempt that | 01:55 |
| *** sdake has joined #openstack-keystone | 02:11 | |
| *** rm_work has quit IRC | 02:16 | |
| *** browne has joined #openstack-keystone | 02:18 | |
| *** sdake_ has joined #openstack-keystone | 02:18 | |
| *** sdake has quit IRC | 02:20 | |
| *** markvoelker has joined #openstack-keystone | 02:21 | |
| *** markvoelker has quit IRC | 02:26 | |
| *** jamielennox is now known as jamielennox|away | 02:27 | |
| *** jamielennox|away is now known as jamielennox | 02:35 | |
| *** TxGVNN has joined #openstack-keystone | 02:40 | |
| ayoung | jamielennox, can we just throw it over the wall? | 02:44 |
| ayoung | I mean....its packaging. it should be a functional test, not unti | 02:44 |
| ayoung | unti | 02:44 |
| ayoung | unit | 02:44 |
| jamielennox | ayoung: i'm thinking maybe ,i've got multiple levels of mocks going on and if stevedore changes they'll all break | 02:44 |
| ayoung | unionoinoioinoinoint | 02:44 |
| ayoung | not worth it | 02:44 |
| ayoung | if this passess the tests, ship it | 02:45 |
| ayoung | meaning integration tests | 02:45 |
| ayoung | we have to accept that some aspect of this is going to be tested just by being deployed. | 02:45 |
| jamielennox | ayoung: yea, it's so close... but i don't think it's worth it | 02:48 |
| *** rm_work has joined #openstack-keystone | 02:56 | |
| stevemar | jamielennox: i probably missed some of the conversation here, but for https://review.openstack.org/#/c/326189/ -- its expected that the kerberos and saml plugins override the "available" function by checking if the import was successful? | 03:00 |
| patchbot | stevemar: patch 326189 - keystoneauth - Add available flag to plugin loaders | 03:00 |
| jamielennox | stevemar: yes | 03:00 |
| ayoung | jamielennox, ok, how do I test that patch? | 03:00 |
| ayoung | https://review.openstack.org/#/c/321814/ | 03:01 |
| patchbot | ayoung: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 03:01 |
| *** sheel has joined #openstack-keystone | 03:01 | |
| ayoung | OK I think I need a domain specific backend for keystone and back it to IPA? | 03:03 |
| *** richm has quit IRC | 03:04 | |
| *** amrith is now known as _amrith_ | 03:06 | |
| *** rm_work has quit IRC | 03:07 | |
| jamielennox | ayoung: so for this one i think you need to add the auth_method kerberos to keystone | 03:07 |
| jamielennox | umm, and then... | 03:07 |
| jamielennox | i think that gets mapped to external | 03:07 |
| jamielennox | this is so long ago | 03:07 |
| ayoung | jamielennox, its ok...I remember this, and I have it in a blog post. So we need a successful unscoped token request | 03:09 |
| jamielennox | i'd never recommend anyone set this up this way | 03:09 |
| jamielennox | i was kind of hoping this plugin could just die with the transition to ksa and we only provide the federated one | 03:10 |
| jamielennox | but whatver | 03:10 |
| *** rm_work has joined #openstack-keystone | 03:11 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add available flag to plugin loaders https://review.openstack.org/326189 | 03:14 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 03:14 |
| jamielennox | ayoung: try that one | 03:14 |
| openstackgerrit | Merged openstack/keystone: Keystone uwsgi performance tuning https://review.openstack.org/325677 | 03:15 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add available flag to plugin loaders https://review.openstack.org/326189 | 03:22 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 03:22 |
| *** rmizuno has quit IRC | 03:23 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 03:29 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Add available flag to plugin loaders https://review.openstack.org/326189 | 03:32 |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Make the kerberos plugin loadable https://review.openstack.org/321814 | 03:32 |
| jamielennox | gah, ok that should be good now | 03:32 |
| *** sdake_ has quit IRC | 03:38 | |
| *** jamielennox is now known as jamielennox|away | 03:44 | |
| *** links has joined #openstack-keystone | 03:56 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Midcycle wiki https://wiki.openstack.org/wiki/Sprints/KeystoneNewtonSprint | Meeting Etherpad https://etherpad.openstack.org/p/keystone-weekly-meeting" | 03:59 | |
| *** jamielennox|away is now known as jamielennox | 03:59 | |
| *** stevemar changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Midcycle (July 20-22, San Jose, CA) wiki https://wiki.openstack.org/wiki/Sprints/KeystoneNewtonSprint | Meeting Etherpad https://etherpad.openstack.org/p/keystone-weekly-meeting" | 03:59 | |
| *** rmizuno has joined #openstack-keystone | 04:06 | |
| *** lhcheng has joined #openstack-keystone | 04:07 | |
| *** ChanServ sets mode: +v lhcheng | 04:07 | |
| *** TxGVNN has quit IRC | 04:07 | |
| *** TxGVNN has joined #openstack-keystone | 04:08 | |
| *** woodster_ has quit IRC | 04:08 | |
| *** pcaruana has joined #openstack-keystone | 04:11 | |
| *** markvoelker has joined #openstack-keystone | 04:22 | |
| *** iurygregory_ has quit IRC | 04:22 | |
| *** pcaruana has quit IRC | 04:24 | |
| *** markvoelker has quit IRC | 04:26 | |
| *** pcaruana has joined #openstack-keystone | 04:34 | |
| *** dave-mccowan has quit IRC | 04:35 | |
| *** pcaruana has quit IRC | 04:40 | |
| *** diazjf has joined #openstack-keystone | 04:42 | |
| *** diazjf has quit IRC | 04:46 | |
| *** GB21 has joined #openstack-keystone | 04:53 | |
| *** edtubill has joined #openstack-keystone | 04:58 | |
| *** TxGVNN has quit IRC | 04:59 | |
| *** jaosorior has joined #openstack-keystone | 05:05 | |
| *** GB21 has quit IRC | 05:12 | |
| *** henrynash_ has joined #openstack-keystone | 05:16 | |
| *** ChanServ sets mode: +v henrynash_ | 05:16 | |
| ayoung | jamielennox, so the kerberos plugin looks useless | 05:19 |
| ayoung | we need FedKerb like we have in KC-Kerberos, | 05:19 |
| *** markvoelker has joined #openstack-keystone | 05:23 | |
| *** vint_bra has quit IRC | 05:27 | |
| *** markvoelker has quit IRC | 05:27 | |
| *** itisha has quit IRC | 05:30 | |
| *** GB21 has joined #openstack-keystone | 05:31 | |
| *** edtubill has quit IRC | 05:36 | |
| *** rcernin has joined #openstack-keystone | 05:36 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Cache fernet tokens the same way we do UUID https://review.openstack.org/326234 | 05:37 |
| jamielennox | ayoung: i would agree | 05:39 |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Cache fernet tokens the same way we do UUID https://review.openstack.org/326234 | 05:39 |
| jamielennox | ayoung: i think the straight kerberos plugin like this was an experiment prior to federation working properly | 05:39 |
| ayoung | jamielennox, well, we also broke the ability to use Kerberos with an LDAP backend at some point | 05:40 |
| ayoung | I think it is ID mapping that did it, but I can't get the log file to show it yet | 05:40 |
| jamielennox | ayoung: sigh - how? | 05:41 |
| ayoung | jamielennox, not sure...I am close | 05:41 |
| jamielennox | the kerberos plugin is just the external plugin - so that means all external is broken | 05:41 |
| *** edtubill has joined #openstack-keystone | 05:48 | |
| *** josecastroleon has joined #openstack-keystone | 05:49 | |
| ayoung | jamielennox, not quite...I can get curl to work like this | 05:52 |
| ayoung | curl -H "Content-Type:application/json" --negotiate -u : -d '{ "auth": { "identity": { "methods": ["kerberos"], "kerberos":{} } }}' -X POST https://openstack.ayoungosp8.oslab.test/keystone/krb/v3/auth/tokens | 05:52 |
| *** jaosorior has quit IRC | 05:52 | |
| ayoung | and the same thing will work if I change the 'kerberos' method to 'external' | 05:52 |
| ayoung | IO just can't get it to work if I call it useing | 05:53 |
| *** jaosorior has joined #openstack-keystone | 05:53 | |
| ayoung | export OS_AUTH_TYPE=v3kerberos | 05:53 |
| ayoung | export OS_AUTH_URL=https://openstack.ayoungosp8.oslab.test/keystone/krb | 05:53 |
| ayoung | jamielennox, and it no longer dumps out the token request if I pass in --debug, which is really painful | 05:54 |
| ayoung | but I do know it is not triggering my logging,. so no 'kerberos' in the methods, I think | 05:55 |
| *** roxanaghe has joined #openstack-keystone | 05:57 | |
| jamielennox | what are you loading that with? | 05:57 |
| *** roxanaghe has quit IRC | 05:58 | |
| jamielennox | OSC won't load it, because it's still ksc | 05:58 |
| ayoung | this is OSP8 | 06:00 |
| ayoung | so Liberty | 06:00 |
| ayoung | It works for FedKerb (or it did before I broke the server) | 06:00 |
| ayoung | OK, I need to crash | 06:01 |
| openstackgerrit | Merged openstack/oslo.policy: Add equality operator to policy.RuleDefault https://review.openstack.org/321242 | 06:01 |
| *** lhcheng has quit IRC | 06:03 | |
| *** lhcheng has joined #openstack-keystone | 06:04 | |
| *** ChanServ sets mode: +v lhcheng | 06:04 | |
| *** lhcheng has quit IRC | 06:04 | |
| *** gyee has quit IRC | 06:05 | |
| *** jaosorior has quit IRC | 06:06 | |
| *** jaosorior has joined #openstack-keystone | 06:07 | |
| *** jaosorior has quit IRC | 06:11 | |
| *** jaosorior has joined #openstack-keystone | 06:12 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Consolidate user agent calculation https://review.openstack.org/319717 | 06:12 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Simply local_oslo_config handling https://review.openstack.org/319716 | 06:12 |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Create a Config object https://review.openstack.org/319715 | 06:12 |
| *** lhcheng has joined #openstack-keystone | 06:17 | |
| *** ChanServ sets mode: +v lhcheng | 06:17 | |
| *** edtubill has quit IRC | 06:20 | |
| *** jaosorior has quit IRC | 06:21 | |
| *** lhcheng has quit IRC | 06:22 | |
| *** jaosorior has joined #openstack-keystone | 06:24 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Add caching for get roles on groups https://review.openstack.org/326246 | 06:29 |
| *** lhcheng has joined #openstack-keystone | 06:42 | |
| *** ChanServ sets mode: +v lhcheng | 06:42 | |
| *** roxanaghe has joined #openstack-keystone | 06:58 | |
| *** jaosorior has quit IRC | 07:00 | |
| *** jaosorior has joined #openstack-keystone | 07:00 | |
| *** jaosorior has quit IRC | 07:01 | |
| *** roxanaghe has quit IRC | 07:03 | |
| *** markvoelker has joined #openstack-keystone | 07:23 | |
| *** jaosorior has joined #openstack-keystone | 07:24 | |
| *** markvoelker has quit IRC | 07:28 | |
| *** zqfan has joined #openstack-keystone | 07:28 | |
| *** jed56 has joined #openstack-keystone | 07:34 | |
| *** yolanda has joined #openstack-keystone | 07:52 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** roxanaghe has joined #openstack-keystone | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** roxanaghe has quit IRC | 08:04 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Add caching for get roles on groups https://review.openstack.org/326246 | 08:12 |
| *** lhcheng has quit IRC | 08:18 | |
| *** mvk has quit IRC | 08:22 | |
| *** jaosorior has quit IRC | 08:23 | |
| *** jaosorior has joined #openstack-keystone | 08:24 | |
| *** aurelien__ has joined #openstack-keystone | 08:28 | |
| *** nisha has joined #openstack-keystone | 08:30 | |
| nisha | hey all! | 08:31 |
| *** achatterjee has left #openstack-keystone | 08:34 | |
| *** nisha has quit IRC | 08:42 | |
| *** nisha has joined #openstack-keystone | 08:43 | |
| *** wanghua has quit IRC | 08:45 | |
| nisha | I am an intern and I am stil learning. I would like to know more about - How keystone server provides its services (HTTP APis) and how keystoneclient queries those APIs (by creating the URLs and doing requsets to keystone server) . | 08:46 |
| nisha | Can someone please suggest a direction for a newcomer to get more familiar with the keystoneclient and above? | 08:47 |
| *** mvk has joined #openstack-keystone | 08:50 | |
| *** tesseract has joined #openstack-keystone | 08:50 | |
| *** nisha_ has joined #openstack-keystone | 08:56 | |
| *** nisha has quit IRC | 08:59 | |
| *** nisha_ is now known as nisha | 09:02 | |
| amakarov | nisha, welcome, newcomer :) You can review this patch: https://review.openstack.org/#/c/317529/ - despite it's not perfect, it'll give you the understanding of the architecture: how API request is handled | 09:04 |
| patchbot | amakarov: patch 317529 - keystone - Added app for policy enforcement | 09:04 |
| *** dmk0202 has joined #openstack-keystone | 09:05 | |
| *** TxGVNN has joined #openstack-keystone | 09:09 | |
| odyssey4me | lbragstad bknudson henrynash_ with regards to https://github.com/openstack/openstack-ansible-os_keystone/blob/master/templates/keystone.conf.j2#L101-L107 the issue we saw, resulting in that being patched in, was only seen on a multi-node keystone build... effectively the catalog cache wasn't flushed/expired from memcache on both nodes when a new catalog entry was written... it was only flushed on the same node | 09:13 |
| odyssey4me | that wrote the new catalog entry | 09:13 |
| *** aurelien__ has quit IRC | 09:17 | |
| nisha | amakarov, thank you, going through it :) | 09:19 |
| *** markvoelker has joined #openstack-keystone | 09:24 | |
| *** markvoelker has quit IRC | 09:29 | |
| samueldmq | morning keystone | 09:44 |
| *** mvk has quit IRC | 09:46 | |
| *** mvk has joined #openstack-keystone | 09:47 | |
| *** permalac has joined #openstack-keystone | 09:57 | |
| *** TxGVNN has quit IRC | 10:02 | |
| *** nisha_ has joined #openstack-keystone | 10:19 | |
| *** nisha has quit IRC | 10:20 | |
| *** TxGVNN has joined #openstack-keystone | 10:20 | |
| *** _amrith_ is now known as amrith | 10:24 | |
| *** jed56 has quit IRC | 10:25 | |
| openstackgerrit | Merged openstack/keystone: Let setup.py compile_catalog process all language files https://review.openstack.org/319260 | 10:35 |
| *** dave-mccowan has joined #openstack-keystone | 10:35 | |
| *** julim has joined #openstack-keystone | 10:40 | |
| *** GB21 has quit IRC | 10:45 | |
| *** rk4n has joined #openstack-keystone | 10:46 | |
| *** rk4n_ has joined #openstack-keystone | 10:49 | |
| *** GB21 has joined #openstack-keystone | 10:52 | |
| *** rk4n has quit IRC | 10:53 | |
| *** nisha_ is now known as nisha | 11:12 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP - Add caching for get roles on groups https://review.openstack.org/326246 | 11:18 |
| *** henrynash_ has quit IRC | 11:19 | |
| *** markvoelker has joined #openstack-keystone | 11:25 | |
| *** yolanda has quit IRC | 11:28 | |
| *** markvoelker has quit IRC | 11:29 | |
| *** nisha_ has joined #openstack-keystone | 11:30 | |
| *** nisha has quit IRC | 11:31 | |
| *** yolanda has joined #openstack-keystone | 11:31 | |
| crinkle | jamielennox: 321814 is still trying to do kerberos things on py3 :( | 11:34 |
| crinkle | ayoung: jamielennox I was using https://review.openstack.org/#/c/276350/ to test the plugin loading | 11:34 |
| patchbot | crinkle: patch 276350 - python-openstackclient - Moving authentication from keystoneclient to keyst... | 11:34 |
| *** TxGVNN has quit IRC | 11:43 | |
| *** TxGVNN has joined #openstack-keystone | 11:44 | |
| *** markvoelker has joined #openstack-keystone | 12:06 | |
| *** rodrigods has quit IRC | 12:09 | |
| *** rodrigods has joined #openstack-keystone | 12:09 | |
| *** rk4n_ has quit IRC | 12:10 | |
| *** zqfan has quit IRC | 12:13 | |
| *** nisha_ has quit IRC | 12:19 | |
| *** nisha_ has joined #openstack-keystone | 12:19 | |
| *** rk4n has joined #openstack-keystone | 12:23 | |
| *** GB21 has quit IRC | 12:23 | |
| *** amrith is now known as _amrith_ | 12:35 | |
| samueldmq | crinkle: hi | 12:36 |
| *** gordc has joined #openstack-keystone | 12:36 | |
| samueldmq | crinkle: that's odd, you evaluate six.PY2 to define the value of 'available' property for the plugin | 12:37 |
| samueldmq | crinkle: so it shouldn't be running on py3 | 12:37 |
| *** EinstCrazy has quit IRC | 12:41 | |
| *** EinstCrazy has joined #openstack-keystone | 12:41 | |
| *** EinstCrazy has quit IRC | 12:46 | |
| *** links has quit IRC | 12:51 | |
| *** links has joined #openstack-keystone | 12:52 | |
| *** pauloewerton has joined #openstack-keystone | 12:55 | |
| *** edmondsw has joined #openstack-keystone | 13:01 | |
| samueldmq | crinkle: https://review.openstack.org/#/c/321814/11/keystoneauth1/extras/kerberos/__init__.py was raising ImportError at import time before | 13:04 |
| patchbot | samueldmq: patch 321814 - keystoneauth - Make the kerberos plugin loadable | 13:04 |
| samueldmq | crinkle: and isn't anymore | 13:04 |
| samueldmq | crinkle: ImportError was caught here https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/tests/unit/extras/kerberos/test_v3.py | 13:04 |
| samueldmq | which was skipping the tests for py3 | 13:04 |
| *** richm has joined #openstack-keystone | 13:07 | |
| *** edtubill has joined #openstack-keystone | 13:09 | |
| *** r-daneel has joined #openstack-keystone | 13:11 | |
| bknudson | odyssey4me: the cache is never flushed on multi-nodes. This is just how caching works. | 13:12 |
| bknudson | only the node where the change happened sees the change until the cache timeout | 13:12 |
| *** jaosorior has quit IRC | 13:15 | |
| *** jaosorior has joined #openstack-keystone | 13:16 | |
| *** r-daneel has quit IRC | 13:24 | |
| *** doug-fish has joined #openstack-keystone | 13:25 | |
| *** sdake has joined #openstack-keystone | 13:27 | |
| *** nisha has joined #openstack-keystone | 13:28 | |
| *** frontrunner has joined #openstack-keystone | 13:29 | |
| *** nisha_ has quit IRC | 13:30 | |
| *** richm has quit IRC | 13:30 | |
| *** henrynash_ has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v henrynash_ | 13:32 | |
| henrynash_ | lbragstad: hi | 13:33 |
| *** sdake_ has joined #openstack-keystone | 13:34 | |
| *** sdake has quit IRC | 13:36 | |
| *** r-daneel has joined #openstack-keystone | 13:36 | |
| *** edtubill has quit IRC | 13:39 | |
| *** nisha has quit IRC | 13:43 | |
| *** vint_bra has joined #openstack-keystone | 13:52 | |
| *** vint_bra has quit IRC | 13:53 | |
| *** ametts has joined #openstack-keystone | 13:53 | |
| odyssey4me | bknudson yeah, so the trouble is that when you add a new catalog entry, no other nodes can see the new entry until the cache timeout | 13:53 |
| *** rderose has joined #openstack-keystone | 13:59 | |
| *** _amrith_ is now known as amrith | 14:02 | |
| *** richm has joined #openstack-keystone | 14:02 | |
| shewless | hello. I'm trying to create an identity provider in keystone. I'm getting this error.. I'm using shibboleth as my sp to my enterprise ip. Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL. Internal Server Error (HTTP 500) | 14:05 |
| shewless | would someone be able to help? | 14:06 |
| *** edtubill has joined #openstack-keystone | 14:09 | |
| dstanek | shewless: you'll have to look in the keystone log to find the error | 14:09 |
| *** jed56 has joined #openstack-keystone | 14:11 | |
| shewless | +dstanek: I'm looking at /var/log/*.log and I don't see anything logged when I get this error. | 14:12 |
| shewless | sorry.. /var/log/keystone/keystone*.log | 14:13 |
| *** edtubill has quit IRC | 14:13 | |
| shewless | +dstanek ..maybe it's in the apache logs? Since I'm using mitaka and wsgi? | 14:14 |
| dstanek | shewless: yes, if you are using apache you likely have /var/log/apache/keystone.log | 14:15 |
| dstanek | errr...apache2 that is | 14:16 |
| henrynash | samueldmq: hi | 14:16 |
| *** chlong has quit IRC | 14:16 | |
| shewless | +dstanek: problem loading keystone-wsgi-admin... not sure what this means: http://paste.ubuntu.com/17089268 | 14:17 |
| *** tonytan4ever has joined #openstack-keystone | 14:17 | |
| dstanek | shewless: what is /usr/bin/keystone-wsgi-admin on your system? | 14:18 |
| dstanek | oh, and the args already parsed thing. i don't remember what that was | 14:19 |
| samueldmq | henrynash: hi | 14:20 |
| shewless | +dstanek: not sure what you mean.. the file exists and 'file' says: /usr/bin/keystone-wsgi-admin: Python script, ASCII text executable | 14:23 |
| henrynash_ | samueldmq: your comment on https://review.openstack.org/#/c/326246/ - just checking what you were meaning regarding hierarchy changes? | 14:23 |
| patchbot | henrynash_: patch 326246 - keystone - WIP - Add caching for get roles on groups | 14:23 |
| lbragstad | henrynash_ o/ | 14:24 |
| henrynash_ | lbragstad: hi | 14:24 |
| samueldmq | henrynash_: if there is an inherited assignment for a group on a parent project | 14:25 |
| samueldmq | henrynash_: it will be expanded to its children | 14:25 |
| henrynash_ | samueldmq: ah, right, sure….I thought you meant tree structureal chanegs (which I don’t think we support yet?) | 14:25 |
| samueldmq | henrynash_: if another project is added to its children, the response will change, and by consequence the cache needs to be invalidated | 14:25 |
| samueldmq | henrynash_: like moving parts of the tree? | 14:25 |
| samueldmq | henrynash_: no I didn't mean that :) | 14:26 |
| henrynash_ | samueldmq: ok, fine…I’m with you then | 14:26 |
| *** nisha_ has joined #openstack-keystone | 14:26 | |
| samueldmq | henrynash_: ++ thanks for asking | 14:27 |
| henrynash_ | lbragstad: any chance you could try out those WIP patches I put up on fernet caching on your performance set up? | 14:27 |
| lbragstad | henrynash_ yep - I could do that | 14:27 |
| henrynash_ | lbragstad: https://review.openstack.org/#/c/326234/ and https://review.openstack.org/#/c/326246/ (which are alternative attempts to fix the same problem) | 14:28 |
| patchbot | henrynash_: patch 326234 - keystone - WIP - Cache fernet tokens the same way we do UUID | 14:28 |
| patchbot | henrynash_: patch 326246 - keystone - WIP - Add caching for get roles on groups | 14:28 |
| lbragstad | henrynash_ sweet | 14:29 |
| lbragstad | henrynash i'll give them a shot | 14:29 |
| *** woodster_ has joined #openstack-keystone | 14:30 | |
| henrynash_ | lbragstad: great! They’d both need some more work in order to merge, but as they are should show us whether they are curing the issue | 14:30 |
| lbragstad | that works | 14:30 |
| dstanek | shewless: someone else in here may remember what the args already processed error means and if not i can take a look after my meeting | 14:30 |
| *** chlong has joined #openstack-keystone | 14:32 | |
| *** frontrunner has quit IRC | 14:33 | |
| *** tonytan4ever has quit IRC | 14:33 | |
| *** KevinE has joined #openstack-keystone | 14:34 | |
| *** sheel has quit IRC | 14:35 | |
| *** sdake_ has quit IRC | 14:36 | |
| *** raddaoui has joined #openstack-keystone | 14:39 | |
| *** mfisch has joined #openstack-keystone | 14:40 | |
| *** mfisch has quit IRC | 14:40 | |
| *** mfisch has joined #openstack-keystone | 14:40 | |
| shewless | anyone remember what this error means: ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option? | 14:49 |
| *** timcline has joined #openstack-keystone | 14:50 | |
| *** frontrunner has joined #openstack-keystone | 14:53 | |
| zigo | When trying to do: | 14:55 |
| zigo | $ OS_TOKEN=$(openstack token issue -c id -f value) openstack endpoint create --region regionOne keystone public http://117.121.243.212:5000/v2.0 --os-url http://localhost:5000/v3 | 14:55 |
| zigo | I get: "Unable to establish connection to http://localhost:5000/v3/endpoints" | 14:55 |
| zigo | Has the way to bootstrap keystone changed in Newton b1? | 14:55 |
| EmilienM | nothing changed on this side afik, we didn't change anything in puppet module at least | 14:59 |
| openstackgerrit | Merged openstack/keystone: Add caching config for federation https://review.openstack.org/325514 | 15:01 |
| shewless | +dstanek: looks like I might have to wait for you.. | 15:03 |
| *** vint_bra has joined #openstack-keystone | 15:06 | |
| shewless | it's quite possible I'm leaving out some information when attempting to create a provider.. this is what I'm doing: openstack identity provider create testshib --enable | 15:07 |
| shewless | did I miss anything? | 15:07 |
| dhellmann | jamielennox, ayoung : I noticed mention of testing plugins in the scrollback. stevedore includes a class to be used to replace managers in tests, so you can inject the plugins you want. You shouldn't mock pkg_resources, that's too low level. Drop by #openstack-oslo if you have questions. | 15:08 |
| *** rk4n_ has joined #openstack-keystone | 15:09 | |
| *** vnogin has joined #openstack-keystone | 15:10 | |
| *** rk4n has quit IRC | 15:12 | |
| rodrigods | rderose, are you ok with marking "concrete role assignments" patch as WIP while the fixes aren't ready? | 15:12 |
| *** vnogin1 has quit IRC | 15:12 | |
| *** tonytan4ever has joined #openstack-keystone | 15:14 | |
| *** rcernin has quit IRC | 15:17 | |
| rderose | rodrigods: still thinking about next steps | 15:17 |
| *** sheel has joined #openstack-keystone | 15:17 | |
| rodrigods | rderose, seems it depends on some fixes? | 15:17 |
| rderose | rodrigods: may decide to move forward with this patch and address boris's issue in a subsequent patch | 15:18 |
| rderose | rodrigods: but will look at it today and decide | 15:18 |
| rderose | rodrigods: what are your thoughts on this? | 15:18 |
| rderose | rodrigods: OS-FEDERATION/projects should be deprecated soon I would think | 15:19 |
| rodrigods | rderose, we can't merge something that will leave keystone breaking, even if it has a subsequente patch to fix it | 15:19 |
| *** edtubill has joined #openstack-keystone | 15:19 | |
| rodrigods | rderose, need to check when it has been marked as deprecated | 15:20 |
| rderose | rodrigods: hmm... it wouldn't break keystone | 15:20 |
| *** itisha has joined #openstack-keystone | 15:20 | |
| rodrigods | rderose, won't it? looks like it breaks websso | 15:20 |
| rderose | rodrigods: yeah, I don't know about Horizon. But if you assign a federated users a role, the issue is, is that its not reflected in OS-FEDERATION/projects | 15:21 |
| rderose | rodrigods: but it would be in auth/projects | 15:22 |
| rodrigods | rderose, right, the problem is that it breaks the response of that API | 15:22 |
| rodrigods | even if it is deprecated, we can't break it | 15:22 |
| rodrigods | the fix can be fix OS-FEDERATION/projects or remove it, but needs to land before your patch | 15:23 |
| rderose | rodrigods: does it break, or does it simply returns a valid response saying the user doesn't have any projects? | 15:23 |
| rodrigods | rderose, OS-FEDERATION/project should mirror auth/projects | 15:24 |
| rodrigods | for this use case, i mean | 15:24 |
| rderose | rodrigods: true. and keep in mind that shadowing federated users has already been merged and technically, you could still assign a federated user a role. it just won't work. | 15:24 |
| rodrigods | rderose, it doesn't work already? | 15:25 |
| rodrigods | ugh | 15:25 |
| rodrigods | ah, ok | 15:25 |
| rodrigods | got it | 15:25 |
| rodrigods | let's check if it can be removed | 15:25 |
| rodrigods | rderose, yes, it can be removed | 15:26 |
| rderose | rodrigods: removed? | 15:26 |
| rodrigods | rderose, https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3-os-federation-ext.rst#whats-new-in-version-11 | 15:26 |
| *** links has quit IRC | 15:26 | |
| rderose | rodrigods: OS-FEDERATION/projects can be removed? | 15:27 |
| rodrigods | rderose, yes | 15:27 |
| rderose | rodrigods: SWEET!!! | 15:27 |
| rodrigods | rderose, let's just confirm in today's meeting and fix python-keystoneclient (and others) that are currently using it | 15:27 |
| rodrigods | and then remove it | 15:27 |
| rderose | rodrigods: sounds good | 15:28 |
| *** sdake has joined #openstack-keystone | 15:28 | |
| henrynash_ | redrose, rodigods: so I do have a bit of worry about all this….I had imagined that shadow users would be optional….i.e. would only have to use them if I wanted direect user assignment bia the keystone API. if we do enahnce the mapper to created projects/roles….I wonder if we could do all this with the unique user_id assiged by the mapper, without needing shadow users… | 15:31 |
| henrynash_ | redrose, rodigods: my concern is that today we can use federation tokens and NOT have to have a big user table that would require replication in a multi-datacentre configruation…but now we are forcing people to do this | 15:32 |
| *** jbell8 has joined #openstack-keystone | 15:36 | |
| *** lifeless has quit IRC | 15:37 | |
| *** GB21 has joined #openstack-keystone | 15:45 | |
| *** lifeless has joined #openstack-keystone | 15:49 | |
| *** BjoernT has joined #openstack-keystone | 15:51 | |
| samueldmq | henrynash: that's also a topic in the meeting today right ? | 15:52 |
| henrynash_ | samuedlmq: yep | 15:53 |
| samueldmq | henrynash_: nice | 15:53 |
| notmorgan | henrynash_: FYI even though i am opposed to the bandaid cache fix because it doesn't go far enough, I'd like to just see us commit to a wider fix. | 15:56 |
| notmorgan | henrynash_: and would support the fix as is if we do. | 15:56 |
| notmorgan | (with invalidation code/test added) | 15:56 |
| henrynash_ | notmorgan: yep, totally undestand | 15:57 |
| bknudson | notmorgan: btw, this change made a huge difference in performance - https://review.openstack.org/#/c/272007/ | 15:57 |
| patchbot | bknudson: patch 272007 - keystone - Use requst local in-process cache per request (MERGED) | 15:57 |
| bknudson | it's like 3x better after that one. | 15:58 |
| notmorgan | bknudson: not surprised at all | 15:58 |
| notmorgan | bknudson: it's just insane we have ot battle performance bugs in two code paths. | 15:58 |
| notmorgan | bknudson: so we should cache, we should also fix it so we don't have to battle bugs across multiple paths. | 15:59 |
| bknudson | it's insane to have 2 code paths to begin with | 15:59 |
| notmorgan | bknudson: exactly. | 15:59 |
| bknudson | not sure if there's a better way to do development. seems like we just take whatever garbage is posted and then hope to fix it up later. | 16:00 |
| notmorgan | bknudson: well part of the acceptance of fernet was that we align code for token issuance/validation | 16:00 |
| bknudson | maybe we need to take better code to begin with | 16:00 |
| notmorgan | bknudson: and that hasn't happened. | 16:00 |
| rderose | rodrigods: you still there? | 16:01 |
| bknudson | y, requiring something to happen in future hasn't been working | 16:01 |
| *** GB21 has quit IRC | 16:01 | |
| *** gokrokve has joined #openstack-keystone | 16:02 | |
| *** frontrunner has quit IRC | 16:09 | |
| *** frontrunner has joined #openstack-keystone | 16:12 | |
| *** tesseract has quit IRC | 16:13 | |
| *** nisha_ has quit IRC | 16:17 | |
| *** r-daneel has quit IRC | 16:17 | |
| *** nisha_ has joined #openstack-keystone | 16:18 | |
| *** jaosorior has quit IRC | 16:24 | |
| *** jaosorior has joined #openstack-keystone | 16:24 | |
| *** jaosorior has quit IRC | 16:26 | |
| *** r-daneel has joined #openstack-keystone | 16:26 | |
| *** dmk0202 has quit IRC | 16:30 | |
| breton | rderose: rodrigods: wow, lets at least add support to keystoneclient. And then remove in the next cycle. No one has been using /v3/auth/projects for federated tokens since the deprecation, because everybody uses keystoneclient and keystoneclient calls to OS-FEDERATION/projects | 16:37 |
| zigo | With apache2, I can make keystone to work, but with uwsgi, it doesn't (ie: openstack endpoint list fails to connect, for a reason) | 16:38 |
| zigo | Could anyone give me a keystone's uwsgi .ini content to look at? | 16:38 |
| rderose | breton: yeah, actually I don't think we'll be able to remove OS-FEDERATION/projects API | 16:39 |
| zigo | Also, this doc: http://docs.openstack.org/developer/keystone/configuringservices.html doesn't provide any path after the hostname. Should we ommit the /v3 at the end of URLs from now on? | 16:39 |
| rderose | breton: however, I think we can simply fix this by including not only the group projects, but the assigned projects as well | 16:39 |
| rderose | rderose: and fixing it in keystone should automatically fix it in keystoneclient, don't you think? | 16:40 |
| rderose | *breton | 16:40 |
| rderose | :) | 16:40 |
| *** _cjones_ has joined #openstack-keystone | 16:41 | |
| *** tonytan4ever has quit IRC | 16:41 | |
| *** _cjones_ has quit IRC | 16:41 | |
| zigo | notmorgan: ^ | 16:42 |
| notmorgan | zigo: uhm. what error are you seeing, also might recommend doing mod_proxy in front of uwsgi. | 16:44 |
| *** vint_bra1 has joined #openstack-keystone | 16:44 | |
| zigo | notmorgan: The client complains that it cannot connect to /v3/endpoints | 16:44 |
| notmorgan | zigo: but i did do a simple uwsgi without the need of a specific ini | 16:44 |
| notmorgan | zigo: and it worked. | 16:44 |
| *** vint_bra2 has joined #openstack-keystone | 16:44 | |
| zigo | Though "openstack token issue" works. | 16:44 |
| rodrigods | breton, rderose i'm back | 16:45 |
| zigo | notmorgan: What was the command line that you used? | 16:45 |
| rodrigods | what's up | 16:45 |
| notmorgan | zigo: do you have a keystone entry point in the catalog? | 16:45 |
| notmorgan | zigo: s/entry/endpoint | 16:45 |
| zigo | notmorgan: Yup. | 16:45 |
| notmorgan | token issue works... but the rest doesnt... | 16:45 |
| notmorgan | ODD. | 16:45 |
| zigo | $ openstack endpoint list | 16:46 |
| zigo | Unable to establish connection to http://127.0.0.1:5000/v3/auth/tokens | 16:46 |
| zigo | That's what I'm getting, even though the endpoints are on the public IP. | 16:46 |
| notmorgan | do you have a uwsgi running on port 5000? | 16:46 |
| zigo | Yup. | 16:46 |
| notmorgan | and on 35357? | 16:46 |
| zigo | I got 2 instances of UWSGI. | 16:46 |
| notmorgan | ah | 16:46 |
| zigo | One for admin, one for public. | 16:46 |
| notmorgan | ugh. | 16:46 |
| rderose | rodrigods: I sent you a message | 16:47 |
| * notmorgan wants that to die so hard | 16:47 | |
| notmorgan | :P | 16:47 |
| zigo | :) | 16:47 |
| notmorgan | but that aside | 16:47 |
| notmorgan | let me find my uwsgi line | 16:47 |
| rderose | rodrigods: I think I have a fix for concrete role assignments, just need to create a new test case for OS-FEDERATION/projects API | 16:47 |
| zigo | http://paste.openstack.org/show/508721/ <--- That's what I'm getting. | 16:47 |
| rodrigods | rderose, great | 16:48 |
| *** vint_bra has quit IRC | 16:48 | |
| notmorgan | zigo: netstat -plant | grep 35357 (as root)? | 16:48 |
| zigo | uwsgi has 767 options !!! :) | 16:48 |
| *** vint_bra1 has quit IRC | 16:48 | |
| zigo | notmorgan: It's there, and port 5000 too. | 16:48 |
| notmorgan | zigo: yes, uwsgi has a bazillion options. | 16:48 |
| zigo | Of course, I checked for that ... | 16:48 |
| notmorgan | zigo: on that ip? or internal? | 16:48 |
| notmorgan | and 2x check iptalbes? | 16:49 |
| zigo | On 0.0.0.0 | 16:49 |
| notmorgan | ok | 16:49 |
| zigo | Which is exactly what I wish to do. | 16:49 |
| notmorgan | cool | 16:49 |
| *** rk4n_ has quit IRC | 16:49 | |
| notmorgan | right, i figure you have it right, but doesn't hurt to 2x check :) | 16:49 |
| zigo | Sure! :) | 16:49 |
| zigo | Thanks for helping. | 16:49 |
| notmorgan | and stupid question, no typos in the IP address in the endpoints in the db? | 16:49 |
| zigo | Nop, as it works with apache. | 16:50 |
| zigo | So, really, the issue should be my uwsgi params. | 16:50 |
| notmorgan | ok hm. | 16:50 |
| *** rk4n has joined #openstack-keystone | 16:50 | |
| notmorgan | yeah sec. then | 16:50 |
| notmorgan | and not using mod_proxy in front of uwsgi? | 16:50 |
| notmorgan | just plain uwsgi? | 16:50 |
| zigo | The point here, is that I'm using plain uwsgi, so that the daemon starts and I can do stuff in the .postinst to setup endpoints and such. | 16:50 |
| zigo | But later on, users can modify the .ini to do what they want, and push apache in front. | 16:51 |
| notmorgan | so it sounds like the 35357 one is having an issue | 16:51 |
| notmorgan | because 5000 is where you're getting the token from | 16:51 |
| zigo | I'm using a .ini as it's a CONFFILE, and its config will stay over upgrades, while params in the config file would have been stored in a script, which is less convenient. | 16:51 |
| notmorgan | right | 16:51 |
| notmorgan | thats fine. | 16:51 |
| notmorgan | it shouldn't matter if you're using .ini or cli | 16:52 |
| notmorgan | tbh | 16:52 |
| zigo | Looks like uwsgi supports both the same way, indeed. | 16:52 |
| notmorgan | my command line is: uwsgi --wsgi-file <keystone-wsgi-file> --http-socket <correct args for binding> -p <processes> | 16:53 |
| notmorgan | it was very very simple | 16:53 |
| zigo | Whats -p for? | 16:53 |
| notmorgan | number of processes/workers | 16:53 |
| notmorgan | e.g. 2 or 4 or whatever | 16:53 |
| zigo | This looks like a uwsgi 1.x command line, as you don't need a --plugin python option. | 16:53 |
| zigo | Ah, right. | 16:53 |
| zigo | I got that too... | 16:53 |
| notmorgan | 2.0.13.1 | 16:53 |
| zigo | notmorgan: Was this on top of Trusty? | 16:53 |
| zigo | Ah... :/ | 16:54 |
| zigo | That's Xenial. | 16:54 |
| notmorgan | no opensuse, tumbleweed | 16:54 |
| zigo | Oh ok. | 16:54 |
| zigo | Anyway, that's 2.x like me. | 16:54 |
| notmorgan | als pip installed | 16:54 |
| notmorgan | vs packaged. | 16:54 |
| notmorgan | which i kindof like that uwsgi can just be pip installed :) | 16:54 |
| zigo | I got 2.0.12 | 16:54 |
| zigo | So, close enough. | 16:54 |
| notmorgan | cool. close enough | 16:54 |
| notmorgan | yeah | 16:54 |
| zigo | :/ | 16:54 |
| notmorgan | if you give me a few minutes i can setup a venv for this | 16:54 |
| notmorgan | and actually try it. | 16:54 |
| zigo | That's not helping ... | 16:55 |
| zigo | :( | 16:55 |
| notmorgan | i've been working on zuul/nodepool. | 16:55 |
| zigo | Well, thanks, but I don't think that will help. | 16:55 |
| zigo | I'll investigate further alone, IMO. | 16:55 |
| notmorgan | ok. lmk if i can can help, maybe replicate your ini/env? | 16:55 |
| openstackgerrit | Merged openstack/oslo.policy: Add sample file generation script and helper methods https://review.openstack.org/314244 | 16:56 |
| zigo | notmorgan: That's what I have: http://paste.openstack.org/show/508723/ | 16:59 |
| *** r-daneel has quit IRC | 17:02 | |
| stevemar | zigo: while you're around... mind commenting on https://review.openstack.org/#/c/326152/ | 17:06 |
| patchbot | stevemar: patch 326152 - keystone - Revert "Install necessary files in etc/" | 17:06 |
| zigo | stevemar: Would you think that's normal to package config files in /usr/etc ? | 17:06 |
| zigo | stevemar: Monty wrote that adding stuff in /etc using PBR is a *bug*, we shouldn't do that. | 17:07 |
| stevemar | zigo: /usr/etc is clearly not right, but i don't disagree with jd about installing keystone in a virtualenv | 17:10 |
| zigo | stevemar: Then fight for JD's https://review.openstack.org/#/c/274077/ to be approved first. | 17:10 |
| patchbot | zigo: patch 274077 - openstack-dev/pbr - Add --sysconfdir option to install command (ABANDONED) | 17:10 |
| *** mvk has quit IRC | 17:11 | |
| zigo | stevemar: Until it's done, then https://review.openstack.org/#/c/320880/ broke absolutely all downstream distributions: RDO, SuSE, Ubuntu, Debian, Gentoo ... | 17:11 |
| patchbot | zigo: patch 320880 - keystone - Install necessary files in etc/ (MERGED) | 17:11 |
| zigo | stevemar: IMO, the solution is to get 274077 merged, as it looks like it takes too long to get it done "upper in the stack" | 17:13 |
| *** tonytan4ever has joined #openstack-keystone | 17:13 | |
| zigo | stevemar: Also, it's likely that Robert Collins wont -2 a patch anywhere again (or did he find another employer after HP?). | 17:14 |
| *** r-daneel has joined #openstack-keystone | 17:15 | |
| *** jbell8 has quit IRC | 17:16 | |
| *** roxanaghe has joined #openstack-keystone | 17:18 | |
| stevemar | zigo: not sure what lifeless' situation is; what do other projects do with these files and virtualenvs? | 17:24 |
| *** jbell8 has joined #openstack-keystone | 17:37 | |
| *** tonytan4ever has quit IRC | 17:44 | |
| *** lhcheng has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v lhcheng | 17:47 | |
| *** lhcheng has quit IRC | 17:52 | |
| *** mvk has joined #openstack-keystone | 17:53 | |
| *** shaleh has joined #openstack-keystone | 17:56 | |
| *** lhcheng has joined #openstack-keystone | 17:56 | |
| *** ChanServ sets mode: +v lhcheng | 17:56 | |
| *** jbell8 has quit IRC | 17:58 | |
| samueldmq | courtesy ping to ajayaa, amakarov, ayoung, breton, browne, crinkle, claudiub, davechen, david8hu, dolphm, dstanek, edmondsw, gyee, henrynash, hogepodge, htruta, jamielennox, joesavak, jorge_munoz, knikolla, lbragstad, lhcheng, marekd, MaxPC, morgan, nkinder, notmorgan, raildo, rodrigods, rderose, roxanaghe, samleon, samueldmq, shaleh, stevemar, tjcocozz, tsymanczyk, topol, vivekd, wanghong, xek | 18:00 |
| *** TxGVNN has quit IRC | 18:00 | |
| *** ebalduf_ has joined #openstack-keystone | 18:06 | |
| *** nisha_ has quit IRC | 18:06 | |
| *** jorge_munoz has joined #openstack-keystone | 18:09 | |
| *** gyee has joined #openstack-keystone | 18:11 | |
| *** ChanServ sets mode: +v gyee | 18:11 | |
| *** mvk_ has joined #openstack-keystone | 18:14 | |
| shewless | +dstanek: there? | 18:15 |
| *** doug-fis_ has joined #openstack-keystone | 18:15 | |
| *** mvk has quit IRC | 18:17 | |
| shewless | I still get this error in keystone.log: http://paste.ubuntu.com/17089268/ after running this command: openstack identity provider create testshib --enable. I'm not sure if this is a bug or if I'm doing something wrong. It's been mentioned that there is some bug or known issue with the error. | 18:18 |
| shewless | The error seems to be related to "ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option\" | 18:18 |
| *** doug-fish has quit IRC | 18:18 | |
| *** lucas___ has joined #openstack-keystone | 18:20 | |
| *** lhcheng has quit IRC | 18:23 | |
| *** jbell8 has joined #openstack-keystone | 18:24 | |
| *** rk4n has quit IRC | 18:25 | |
| *** ametts has quit IRC | 18:27 | |
| *** lhcheng has joined #openstack-keystone | 18:27 | |
| *** ChanServ sets mode: +v lhcheng | 18:27 | |
| KevinE | how annoying is it to merge something just to see how jenkins/mirantis fails it and logs it? Is that a pretty standard thing? | 18:32 |
| shewless | my "wsgi-keystone-public" configuration says: WSGIProcessGroup keystone-admin | 18:32 |
| shewless | Is that the right group? | 18:32 |
| *** gokrokve has quit IRC | 18:32 | |
| KevinE | oops wrong channel but I guess someone'll still know | 18:32 |
| edtubill | stevemar: So for django_openstack_auth k2k I added tests for the patch https://review.openstack.org/#/c/159910/. Also, I thought of a different way of approaching k2k authentication in horizon: https://review.openstack.org/#/c/325901. I was wondering if I could get your thoughts on it. | 18:34 |
| patchbot | edtubill: patch 159910 - django_openstack_auth - K2K federation | 18:34 |
| stevemar | edtubill: it's on my list of things to look at | 18:35 |
| edtubill | stevemar: cool. | 18:36 |
| *** rk4n has joined #openstack-keystone | 18:37 | |
| *** lucas___ has quit IRC | 18:38 | |
| *** lucas___ has joined #openstack-keystone | 18:39 | |
| *** ametts has joined #openstack-keystone | 18:40 | |
| *** lucas___ has quit IRC | 18:44 | |
| *** vint_bra2 has quit IRC | 18:44 | |
| jamielennox | ayoung: i haven't got a full list of things but mellon is lacking a lot of functionality from shib | 18:45 |
| jamielennox | ayoung: to the point where i consider them for different use cases | 18:45 |
| rodrigods | jamielennox, is shib still active? | 18:47 |
| rodrigods | its development, i mean | 18:47 |
| shewless | okay guys. If I change /etc/keystone.conf and comment out [auth] methods = external,password,token,oauth1,mapped,openid then I can create domains, and run openstack commands | 18:47 |
| jamielennox | rodrigods: afaik yes | 18:48 |
| shewless | If I add that "[auth] methods= external,password,token,oauth1,mapped,openid" then I can no longer create domains or really do much.. I keep getting the error "Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL. Internal Server Error (HTTP 500)" | 18:48 |
| shewless | any ideas why that would be? I am attempting to "federate" and I'm following the instructions here: http://docs.openstack.org/developer/keystone/federation/federated_identity.html | 18:48 |
| dstanek | shaleh: i'm planning on trying to push as much as i can upstream to pysaml - so we'll see what happens there | 18:49 |
| shaleh | dstanek: yeah, upstreaming can be hard | 18:49 |
| dstanek | shewless: our keystone meeting is almost over - have you been able to get past you args issue? | 18:49 |
| stevemar | shaleh: the pysaml author is pretty good about accepting PRs | 18:50 |
| ayoung | jamielennox, you got a general summary of the differences? | 18:51 |
| shaleh | stevemar: good to hear. Some upstreams are no fun to interact with | 18:51 |
| shewless | +dstanek: thanks for asking. the args issue is directly related to what I posted above. that "[auth] methods = " line in keystone.conf appears to be indirectly cuasing the args issue | 18:51 |
| *** shaleh has quit IRC | 18:51 | |
| ayoung | by commenting out "[auth] methods" ye get the defaults | 18:52 |
| shewless | +ayoung: yup | 18:52 |
| ayoung | dstanek, apparently mod_auth_mellon can talk to Shib. What if we had a better configuration tool to make that happen? | 18:52 |
| shewless | +dstantek and +ayoung: so doing this seems to have worked: methods = external,password,token,oauth1,saml2 saml2 = keystone.auth.plugins.mapped.Mapped | 18:52 |
| ayoung | shewless, that looks like a sane config to me | 18:53 |
| *** shaleh has joined #openstack-keystone | 18:53 | |
| shewless | +ayoung it's right from the docs.. | 18:53 |
| dstanek | shewless: odd that having openid in there would cause an issue | 18:53 |
| shewless | +dstanek: it's not the openid (I tried with and without) | 18:53 |
| shewless | +dstanek: it's the fact that I tried to put "mapped" on the methods line instead of "saml2" and then call out that "saml2" uses the Mapped plugin | 18:54 |
| jamielennox | ayoung: mostly it's how dynamic they are, so shib will do things like call out to the IDP and fetch all the data you need and refresh all that | 18:54 |
| jamielennox | ayoung: mellon's data is all configured in apache config | 18:54 |
| *** lucas___ has joined #openstack-keystone | 18:54 | |
| jamielennox | ayoung: also shib spawns of a daemon to do all it's actual work and there is a small amount of things you can do without restarting apache | 18:55 |
| shewless | Did I find a bug? Or maybe it's just a "not yet supported feature"? this documenation is just wrong: http://docs.openstack.org/developer/keystone/federation/federated_identity.html | 18:55 |
| shewless | you cannot set methods = "mapped" without bad stuff happening | 18:55 |
| jamielennox | ayoung: so if you're running like 1 IDP that really doesn't change much for your org then mellon is great, if you're integrating with a number shib seems to be better | 18:55 |
| ayoung | jamielennox, right, but I think that you can tell apache to reread config for new connections without actually restartying it | 18:55 |
| *** frontrunner has quit IRC | 18:58 | |
| knikolla | ayoung: quick question. when a user is removed from a project/role is the token revoked? | 18:59 |
| dstanek | shewless: no idea. i'll have to experiment with it a little | 18:59 |
| dstanek | shewless: but at least you can proceed now | 19:00 |
| gyee | notmorgan, come to think of it, actually not a bad idea, get the foundation to do a drawing at the end of the cycle for a free trip | 19:00 |
| gyee | the number of entries is based on the number of code reviews | 19:00 |
| dstanek | shewless: if it's a bug i'll create a bug on launchpad and fix it | 19:00 |
| notmorgan | gyee: eh. | 19:00 |
| notmorgan | gyee: nope i'm mostly against that. | 19:00 |
| *** doug-fis_ has quit IRC | 19:00 | |
| dstanek | shewless: or you can fix it if you are up for it :-) | 19:00 |
| notmorgan | gyee: but you can ask tom fefeild (sp?) | 19:00 |
| notmorgan | gyee: he could talk more about that. | 19:00 |
| gyee | heck we get to draw starbuck gift card for filling out surveys :-) | 19:00 |
| *** doug-fish has joined #openstack-keystone | 19:01 | |
| *** doug-fish has quit IRC | 19:01 | |
| gyee | little carrots here and there | 19:01 |
| *** henrynash_ has quit IRC | 19:01 | |
| *** shaleh has quit IRC | 19:01 | |
| *** doug-fish has joined #openstack-keystone | 19:01 | |
| rodrigods | knikolla, yes ^ | 19:05 |
| *** sheel has quit IRC | 19:05 | |
| *** amrith is now known as _amrith_ | 19:06 | |
| knikolla | rodrigods: cool. thanks, some folks here are doing some security research on keystone and that's what i assumed happens, but wasn't entirely sure. | 19:06 |
| rodrigods | knikolla, cool, let us know of the results :) | 19:07 |
| knikolla | rodrigods: sure :) | 19:08 |
| *** frontrunner has joined #openstack-keystone | 19:15 | |
| *** lucas___ has quit IRC | 19:16 | |
| *** raddaoui has quit IRC | 19:17 | |
| dstanek | shewless: are you able to post your keystone.log file somewhere? or at least the portions with any tracebacks | 19:18 |
| *** lucas___ has joined #openstack-keystone | 19:19 | |
| *** jayh has joined #openstack-keystone | 19:20 | |
| *** lucas____ has joined #openstack-keystone | 19:21 | |
| *** timcline has quit IRC | 19:22 | |
| *** timcline has joined #openstack-keystone | 19:23 | |
| *** lucas___ has quit IRC | 19:24 | |
| *** lucas____ has quit IRC | 19:25 | |
| *** timcline has quit IRC | 19:27 | |
| *** raddaoui has joined #openstack-keystone | 19:28 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Return 404 instead of 401 for tokens w/o roles https://review.openstack.org/322280 | 19:28 |
| *** diazjf has joined #openstack-keystone | 19:29 | |
| jayh | rodrigods,ayoung: do you know which function to look at to see when the revocation happens after removing a role? | 19:31 |
| ayoung | jayh, you can always look in the database | 19:31 |
| ayoung | there is no exrternal exposed API | 19:31 |
| ayoung | well...depnds on what version you mean | 19:32 |
| ayoung | actually do we still have the list revocation evetns api? don't recall | 19:32 |
| *** lucas___ has joined #openstack-keystone | 19:34 | |
| *** permalac has quit IRC | 19:36 | |
| *** diazjf has quit IRC | 19:39 | |
| *** diazjf has joined #openstack-keystone | 19:41 | |
| *** timcline has joined #openstack-keystone | 19:43 | |
| *** mkrcmari__ has joined #openstack-keystone | 19:44 | |
| *** rk4n has quit IRC | 19:44 | |
| *** timcline has quit IRC | 19:45 | |
| *** timcline has joined #openstack-keystone | 19:45 | |
| *** mvk_ has quit IRC | 19:47 | |
| *** dan_nguyen has joined #openstack-keystone | 19:51 | |
| *** tqtran has joined #openstack-keystone | 19:51 | |
| *** lucas___ has quit IRC | 19:52 | |
| *** lucas___ has joined #openstack-keystone | 19:55 | |
| *** lucas___ has quit IRC | 19:57 | |
| *** lucas___ has joined #openstack-keystone | 19:59 | |
| ayoung | dstanek, your middleware approach is based on the pain you've had dealing with adding an additioanl IdP to a keystone deployment, right? | 20:01 |
| *** mvk_ has joined #openstack-keystone | 20:01 | |
| dstanek | ayoung: basically yes | 20:02 |
| *** clenimar has joined #openstack-keystone | 20:04 | |
| jayh | ayoung: I'm not sure I follow re: your DB comment. There is an exlpicit revocation API (http://developer.openstack.org/api-ref-identity-v3.html#revokeTokens), but I am trying to find where things like "DELETE /v3/projects/{project_id}/groups/{group_id}/roles/{role_id}" call it. Any suggestions? | 20:04 |
| *** mkrcmari__ has quit IRC | 20:05 | |
| *** edtubill has quit IRC | 20:06 | |
| *** lucas___ has quit IRC | 20:06 | |
| ayoung | jayh, I'd have to look at the code to rembmer | 20:07 |
| ayoung | dstanek, so, lets split apart the issues | 20:07 |
| ayoung | You want to be able to dynamically add a new Idp/protocol (not just saml remember) when it becomes available | 20:08 |
| ayoung | this means setting up all the metadata, registering the sp with the Idp before you ever tell the webserver anything | 20:08 |
| ayoung | step to is telling the webserver about the new Idp, which for apache means "copy files and restart" | 20:09 |
| dstanek | ayoung: i'm not looking to tell the webserver anything | 20:09 |
| ayoung | if we can drop the "restart" step and instead do a "reread config" it would be better | 20:09 |
| ayoung | dstanek, yes you are | 20:09 |
| ayoung | the Webserver or whatever processes saml needs config info | 20:09 |
| ayoung | middleware is still webserver | 20:10 |
| dstanek | ayoung: i'm not sure i like the idea of having our APIs rewrite configs and then restart the service | 20:10 |
| *** lucas___ has joined #openstack-keystone | 20:10 | |
| ayoung | dstanek, are you sure this should be an API call? | 20:12 |
| *** _amrith_ is now known as amrith | 20:12 | |
| dstanek | ayoung: i want to have APIs to add the IdP for real (metadata, etc) that way a domain admin can add an IdP and not have to be a cloud admin | 20:13 |
| *** diazjf has quit IRC | 20:13 | |
| ayoung | dstanek, so there is a whole set of applications that are doing just this. ADFS for example | 20:14 |
| ayoung | I'd rather just remove Keystone all together if we do that, and let a dedicated app talk direct to nova | 20:15 |
| ayoung | dstanek, that is what Keycloak and Ipsilon were both doing, too. THis idea of protocol translation. | 20:17 |
| *** diazjf has joined #openstack-keystone | 20:18 | |
| dstanek | ayoung: in that world what gets a token? | 20:20 |
| *** lucas___ has quit IRC | 20:21 | |
| *** lucas___ has joined #openstack-keystone | 20:22 | |
| ayoung | dstanek, tokens are really just another protocol, a crappy one at that. I would drop them, and have a user go SAML direct to Nova,. then mnova just list mapping and roles for the Idp that came in in process. Remove Keystone from the users view | 20:23 |
| ayoung | dstanek, the question here is how can we do less inside Keystone itself, and make more general purpose solutions | 20:23 |
| bknudson | it would be interesting if someone else could recreate what I'm seeing -- when I turn on token caching it looks like the token is never found in the cache for the call to _validate_v3_token, but it is for _validate_token. | 20:23 |
| ayoung | Keystone is way to hard coded into the way people use Openstack, but that also prevents people from using the Keystone DATA in other applications | 20:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:24 |
| shewless | +dstanek: do you need more then this: http://paste.ubuntu.com/17089268/ | 20:26 |
| *** roxanaghe has quit IRC | 20:27 | |
| shewless | +dstanek: once I've got my openstack a bit further on I plan on contributing where I can. For now there is a lot to learn! | 20:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:28 |
| *** diazjf has quit IRC | 20:28 | |
| shewless | on that note is there any "more complete" documentation on federation then this: http://docs.openstack.org/developer/keystone/federation/federated_identity.html | 20:30 |
| shewless | I'm finding this documentation better in a lot of ways.. but it's still lacking: https://www.ibm.com/support/knowledgecenter/SST55W_4.3.0/liaca/liaca_creating_mappings_for_keystone_service_provider.html | 20:30 |
| ayoung | dstanek, I don;t want to stop you hard here, but I think what you are shooting for is outside of what we should do in Keystone proper. I feel pretty strongly about this, but want to solve the same problem that you do. Just in a more general pattern. I know you area python guy, and thus are pursuing a Python based solution. mod_mellon is C and Apache specific code. And Mellon does not have aDB backend, which makes it | 20:31 |
| ayoung | tricker as well, and there would be no API...but this should not be an API problem, everywhere...but IO agree it should be an API in Keystone. | 20:31 |
| ayoung | What we have does not scale. | 20:32 |
| *** dan_nguyen has quit IRC | 20:32 | |
| ayoung | dstanek, we also have to remember that we have this issue with openidc. It would scope creep on us. | 20:33 |
| ayoung | with any other protocols | 20:33 |
| *** BjoernT has quit IRC | 20:33 | |
| dstanek | ayoung: it's possible that this could/should grow up to be a standalone replacement for shib/mellon, but first things first. we need something to talk about | 20:36 |
| dstanek | ayoung: do you know if you need to use sticky sessions for shib/mellon? | 20:36 |
| knikolla | dstanek: whatever direction this goes, i'd love to help. | 20:36 |
| ayoung | dstanek, I do not know. jdennis ? | 20:37 |
| dstanek | ayoung: my goal right now is to get this to work and then get as much out of keystone as possible. then we go from there | 20:37 |
| ayoung | dstanek, my goal it to get everything protocol specifc out of Keystone | 20:38 |
| ayoung | well, one of my goals | 20:38 |
| dstanek | ayoung: i also want to solve world hunger and become a minecraft expert | 20:39 |
| ayoung | I can help you on the latter | 20:39 |
| ayoung | http://shop.oreilly.com/product/0636920036562.do is awesome | 20:39 |
| jdennis | dstanek: can you define what you mean by sticky session? | 20:39 |
| *** lucas___ has quit IRC | 20:40 | |
| ayoung | dstanek, I just got the call that I am on Kid duty...I will promise to think deeply about this and come up with a way to not roadblock you. | 20:40 |
| *** lucas___ has joined #openstack-keystone | 20:40 | |
| *** lucas___ has quit IRC | 20:40 | |
| dstanek | jdennis: where a load balancer always sends you to the same node | 20:41 |
| *** rk4n has joined #openstack-keystone | 20:42 | |
| dstanek | jdennis: i was wondering how shib prevents replay attacks without the service providers having to share any state | 20:44 |
| bknudson | devstack configured keystone to connect to memcache on the IP address of the machine, but memcache was only listening on loopback... and there's nothing that tells you that memcache wasn't working at all. | 20:44 |
| *** ayoung has quit IRC | 20:44 | |
| bknudson | so the performance testing I've been doing for the past few days has been useless. | 20:45 |
| jdennis | dstanek: at the moment mellon only supports sessions in one process, so yes it would have to go back to the same apache instance, but we've talked about adding interprocess session support via something like memcache | 20:45 |
| dstanek | bknudson: memcached is designed to work and not work at the same time. lots o'fail there | 20:45 |
| bknudson | yes, makes sense but also hard to debug. | 20:46 |
| dstanek | jdennis: i wouldn't use memcache unless it's ok for sessions to be dropped | 20:46 |
| dstanek | bknudson: this is why you get paid the big bucks | 20:46 |
| dstanek | jdennis: ok, that's what i figured | 20:47 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:47 |
| dstanek | jdennis: what do you like about mellon over shib? | 20:48 |
| jdennis | dstanek: yeah, memcache has it's problems but there are other solutions | 20:48 |
| *** frontrunner has quit IRC | 20:49 | |
| *** pauloewerton has quit IRC | 20:50 | |
| jdennis | dstanek: the decision to use mellon was made prior to my involvement | 20:53 |
| shewless | hmm. I'm trying to get an unscoped token now and I'm seeing this error. Any ideas? {"error": {"message": "Attempted to authenticate with an unsupported method.", "code": 401, "identity": {"methods": ["external", "password", "token", "oauth1", "saml2"]}, "title": "Unauthorized"}} | 20:53 |
| *** lucas___ has joined #openstack-keystone | 20:53 | |
| *** lucas____ has joined #openstack-keystone | 20:54 | |
| *** lucas____ has quit IRC | 20:55 | |
| jdennis | dstanek: if I recall correctly (always a liability) the primary reason is we wanted to use the same code base for both SP and IdP | 20:55 |
| *** lucas has joined #openstack-keystone | 20:56 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 20:56 |
| jdennis | dstanek: mellon is based on the Lasso library, so is Ipsilon (an IdP we developed) | 20:56 |
| jdennis | dstanek: there were concerns on the IdP side about supporting a massive Java deployment | 20:57 |
| *** roxanaghe has joined #openstack-keystone | 20:58 | |
| *** lucas___ has quit IRC | 20:58 | |
| openstackgerrit | Merged openstack/keystone: Updating sample configuration file https://review.openstack.org/326594 | 20:59 |
| *** lhcheng has quit IRC | 21:00 | |
| *** lucas has quit IRC | 21:00 | |
| *** lucas has joined #openstack-keystone | 21:02 | |
| *** clenimar has quit IRC | 21:02 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password history requirements https://review.openstack.org/325589 | 21:03 |
| *** doug-fish has quit IRC | 21:03 | |
| *** lhcheng has joined #openstack-keystone | 21:03 | |
| *** ChanServ sets mode: +v lhcheng | 21:03 | |
| *** doug-fish has joined #openstack-keystone | 21:04 | |
| *** ayoung has joined #openstack-keystone | 21:04 | |
| *** ChanServ sets mode: +v ayoung | 21:04 | |
| *** doug-fish has quit IRC | 21:05 | |
| *** doug-fish has joined #openstack-keystone | 21:05 | |
| *** lucas has quit IRC | 21:06 | |
| *** diazjf has joined #openstack-keystone | 21:06 | |
| *** edtubill has joined #openstack-keystone | 21:09 | |
| KevinE | How do you get a commit to link a blueprint correctly? Do you just put the link in and have gerrit fix formatting? | 21:09 |
| *** r-daneel has quit IRC | 21:09 | |
| *** ebalduf_ has quit IRC | 21:10 | |
| *** spandhe has joined #openstack-keystone | 21:12 | |
| *** edtubill has quit IRC | 21:12 | |
| *** edtubill has joined #openstack-keystone | 21:13 | |
| notmorgan | KevinE: "bp: <bp-name>" | 21:15 |
| notmorgan | KevinE: gerrit has magic formatters for that | 21:15 |
| KevinE | notmorgan: awesome, and what's the format for multiple blueprints on one commit? | 21:15 |
| notmorgan | KevinE: one per line | 21:16 |
| notmorgan | bp: <bp1> | 21:16 |
| notmorgan | bp: <bp2> | 21:16 |
| KevinE | Oh I don't do implements: ? | 21:16 |
| rderose | breton: check out the new patch, it should that issue with OS-FEDERATION/projects: https://review.openstack.org/#/c/284943/ | 21:16 |
| patchbot | rderose: patch 284943 - keystone - Concrete role assignments for federated users | 21:16 |
| *** rderose has quit IRC | 21:17 | |
| *** frontrunner has joined #openstack-keystone | 21:19 | |
| bknudson | lbragstad: I just tried comparing uuid with fernet with memcache configured correctly and now the perf is the same. | 21:19 |
| bknudson | so I take back everything I said | 21:20 |
| lbragstad | bknudson hah! | 21:20 |
| lbragstad | bknudson just against master? | 21:20 |
| lbragstad | or did you test a patch | 21:20 |
| bknudson | lbragstad: haven't tried master yet. I've got liberty with some extra patches backported. | 21:20 |
| lbragstad | ok | 21:21 |
| lbragstad | bknudson so validation is the same? | 21:21 |
| bknudson | I'll get around to master but would be interesting to see if someone can get the same #s. | 21:21 |
| bknudson | this is with fernet (1000 validations * 4 threads): P50/P90: 0.0102944374084/0.0142611265182 min/max: 0.00701904296875/0.503746986389 total: 45.90666008 wall: 11.5824248791 | 21:21 |
| bknudson | this is with uuid: P50/P90: 0.0117950439453/0.0166970491409 min/max: 0.00753307342529/0.0266060829163 total: 49.5508112907 wall: 12.4753248692 | 21:21 |
| bknudson | so fernet is a little faster | 21:21 |
| lbragstad | sweet | 21:22 |
| lbragstad | bknudson how were we not getting that before? | 21:22 |
| notmorgan | KevinE: meh you can do implements, "bp" is the nbeeded part | 21:22 |
| lbragstad | bknudson what were we doing wrong with caching? | 21:22 |
| bknudson | lbragstad: memcache was not working at all. | 21:22 |
| lbragstad | bknudson in keystone or configuring it? | 21:22 |
| bknudson | lbragstad: the system had keystone configured to use hostname:11211 but memcached was only listening on localhost | 21:22 |
| bknudson | and there's nothing in the logs. | 21:23 |
| lbragstad | hmm - and that is something we do by default? | 21:23 |
| openstackgerrit | guang-yee proposed openstack/keystonemiddleware: Support local config options https://review.openstack.org/321882 | 21:23 |
| bknudson | lbragstad: since this is liberty I had to muck with devstack. Haven't had a chance to see what master does. | 21:23 |
| bknudson | if master devstack has this same issue | 21:24 |
| lbragstad | bknudson actually - i think dolphm has a bug opened against devstack for that? | 21:25 |
| bknudson | lbragstad: I don't see any reviews posted in devstack... should be a 1 line change. | 21:26 |
| *** dan_nguyen has joined #openstack-keystone | 21:27 | |
| *** r-daneel has joined #openstack-keystone | 21:30 | |
| *** dan_nguyen has quit IRC | 21:31 | |
| bknudson | lbragstad: Not sure if this is mentioned already, but I think henrynash change in https://review.openstack.org/#/c/326234/ actually fixes a regression | 21:31 |
| patchbot | bknudson: patch 326234 - keystone - WIP - Cache fernet tokens the same way we do UUID | 21:31 |
| bknudson | because in stable/liberty fernet tokens would be cached just like uuid tokens | 21:31 |
| *** mvk has joined #openstack-keystone | 21:33 | |
| *** diazjf has quit IRC | 21:33 | |
| *** jbell8 has quit IRC | 21:34 | |
| *** mkrcmari__ has joined #openstack-keystone | 21:34 | |
| *** doug-fish has quit IRC | 21:34 | |
| zigo | stevemar: It happens in other projects, and then it got reverted. | 21:34 |
| zigo | Just like I'm proposing. | 21:34 |
| *** mkrcmari__ has quit IRC | 21:35 | |
| *** r-daneel has quit IRC | 21:35 | |
| *** mvk_ has quit IRC | 21:35 | |
| lbragstad | bknudson why would that be a regression again? | 21:36 |
| bknudson | lbragstad: because we used to cache fernet tokens just like uuid tokens; and then something changed to not do that. | 21:36 |
| *** diazjf has joined #openstack-keystone | 21:36 | |
| lbragstad | bknudson hmmm | 21:36 |
| *** mvk has quit IRC | 21:37 | |
| lbragstad | dolphm https://github.com/lbragstad/keystone-performance/issues/1 | 21:38 |
| bknudson | lbragstad: in liberty, validate_v3_token just called self._validate_v3_token which has @MEMOIZE | 21:38 |
| bknudson | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/provider.py?h=stable/liberty#n232 | 21:38 |
| lbragstad | oh... | 21:39 |
| bknudson | at some point it changed to call self.validate_non_persistent_token which is not MEMOIZEd | 21:39 |
| bknudson | so henrynash is adding that back https://review.openstack.org/#/c/326234/2/keystone/token/provider.py | 21:39 |
| patchbot | bknudson: patch 326234 - keystone - WIP - Cache fernet tokens the same way we do UUID | 21:39 |
| *** doug-fish has joined #openstack-keystone | 21:40 | |
| lbragstad | ls | 21:40 |
| bknudson | . .. | 21:41 |
| *** rk4n has quit IRC | 21:41 | |
| bknudson | lbragstad: this is why we need the performance tests so we can catch regressions like this | 21:43 |
| lbragstad | bknudson ++ | 21:43 |
| lbragstad | bknudson dolphm and I just made some good progress on the bare metal nodes | 21:43 |
| bknudson | they're even more metal | 21:43 |
| lbragstad | exactly | 21:43 |
| lbragstad | moar metal plz | 21:44 |
| bknudson | turn it up to 11! | 21:44 |
| *** doug-fis_ has joined #openstack-keystone | 21:46 | |
| *** jbell8 has joined #openstack-keystone | 21:48 | |
| *** r-daneel has joined #openstack-keystone | 21:48 | |
| *** rk4n has joined #openstack-keystone | 21:49 | |
| *** doug-fish has quit IRC | 21:50 | |
| *** doug-fis_ has quit IRC | 21:51 | |
| *** roxanaghe has quit IRC | 21:52 | |
| *** rk4n has quit IRC | 21:52 | |
| *** ayoung has quit IRC | 21:54 | |
| *** frontrunner has quit IRC | 21:54 | |
| *** edtubill has quit IRC | 21:55 | |
| *** gordc has quit IRC | 21:57 | |
| *** edtubill has joined #openstack-keystone | 21:57 | |
| *** jbell8 has quit IRC | 21:58 | |
| *** jbell8 has joined #openstack-keystone | 22:00 | |
| *** rderose has joined #openstack-keystone | 22:01 | |
| lbragstad | dolphm https://github.com/openstack/openstack-ansible-os_keystone/blob/master/meta/main.yml#L41-L44 | 22:01 |
| bknudson | lbragstad: mitaka has the regression. just tried it and fernet performance is worse | 22:02 |
| bknudson | 24.6582419872 vs 16.8900539875 | 22:02 |
| *** edtubill has quit IRC | 22:03 | |
| *** sdake_ has joined #openstack-keystone | 22:03 | |
| *** doug-fish has joined #openstack-keystone | 22:04 | |
| lbragstad | bknudson ok - that's consistent with what mfisch said too | 22:05 |
| lbragstad | dolphm http://docs.ansible.com/ansible/playbooks_conditionals.html#applying-when-to-roles-and-includes | 22:05 |
| *** sdake has quit IRC | 22:06 | |
| *** diazjf has quit IRC | 22:06 | |
| *** henrynash_ has joined #openstack-keystone | 22:06 | |
| *** ChanServ sets mode: +v henrynash_ | 22:06 | |
| *** sdake has joined #openstack-keystone | 22:06 | |
| *** rderose has quit IRC | 22:08 | |
| *** ayoung has joined #openstack-keystone | 22:08 | |
| *** ChanServ sets mode: +v ayoung | 22:08 | |
| dolphm | lbragstad: https://review.openstack.org/#/c/326748/ ? | 22:09 |
| patchbot | dolphm: patch 326748 - openstack-ansible-os_keystone - Always use memcached | 22:09 |
| *** doug-fish has quit IRC | 22:09 | |
| bknudson | 127.0.0.1 ... smart | 22:09 |
| *** sdake_ has quit IRC | 22:10 | |
| *** rderose has joined #openstack-keystone | 22:10 | |
| *** edtubill has joined #openstack-keystone | 22:11 | |
| bknudson | lbragstad henrynash: backported https://review.openstack.org/#/c/326234/2/keystone/token/provider.py to mitaka and it fixes performance regression | 22:14 |
| patchbot | bknudson: patch 326234 - keystone - WIP - Cache fernet tokens the same way we do UUID | 22:14 |
| mfisch | is that going to land? | 22:17 |
| mfisch | security team want me to fix that token revoke issue but Im still on L | 22:17 |
| *** r-daneel has quit IRC | 22:17 | |
| bknudson | mfisch: I'll work on it if henrynash isn't. | 22:17 |
| mfisch | k | 22:17 |
| *** KevinE has quit IRC | 22:18 | |
| bknudson | we'll need it to (also still on L) | 22:18 |
| bknudson | too | 22:18 |
| mfisch | i could test that in M maybe tomorrow or later this week | 22:22 |
| *** rderose has quit IRC | 22:24 | |
| *** lhcheng has quit IRC | 22:25 | |
| *** BjoernT has joined #openstack-keystone | 22:26 | |
| *** timcline has quit IRC | 22:27 | |
| *** timcline has joined #openstack-keystone | 22:28 | |
| *** fawadkhaliq has joined #openstack-keystone | 22:28 | |
| *** itisha has quit IRC | 22:30 | |
| *** ametts has quit IRC | 22:30 | |
| *** lhcheng has joined #openstack-keystone | 22:31 | |
| *** ChanServ sets mode: +v lhcheng | 22:31 | |
| *** timcline has quit IRC | 22:32 | |
| henrynash_ | bknudson, mfisch: great that it fixed the regression…..I’ll work on it for invalidations, asap | 22:39 |
| bknudson | henrynash_: thanks. I was just working on the devstack change. | 22:39 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 22:40 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: clean up test_resource_uuid https://review.openstack.org/281546 | 22:40 |
| *** sdake has quit IRC | 22:43 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 22:43 |
| bknudson | devstack change to enable keystone to use memcached: | 22:44 |
| bknudson | https://review.openstack.org/#/c/326756/ | 22:44 |
| patchbot | bknudson: patch 326756 - openstack-dev/devstack - Correct keystone memcached host setting | 22:44 |
| *** henrynash_ has quit IRC | 22:45 | |
| *** edmondsw has quit IRC | 22:47 | |
| *** dan_nguyen has joined #openstack-keystone | 22:49 | |
| bknudson | henrynash: I opened a bug: https://bugs.launchpad.net/keystone/+bug/1590179 | 22:49 |
| openstack | Launchpad bug 1590179 in OpenStack Identity (keystone) "fernet memcache performance regression" [Undecided,New] | 22:49 |
| *** frontrunner has joined #openstack-keystone | 22:55 | |
| *** iurygregory_ has joined #openstack-keystone | 22:59 | |
| bknudson | ran my validation test using henrynash's patch and it improves the fernet validation perf. | 23:01 |
| lbragstad | bknudson sweet! | 23:01 |
| lbragstad | bknudson I would like to use henrynash 's patch to test the perf CI | 23:02 |
| *** edtubill has quit IRC | 23:08 | |
| *** sdake has joined #openstack-keystone | 23:12 | |
| *** roxanaghe has joined #openstack-keystone | 23:13 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** lhcheng has quit IRC | 23:16 | |
| *** BjoernT has quit IRC | 23:16 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 23:16 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Password strength requirements https://review.openstack.org/320586 | 23:19 |
| *** henrynash_ has joined #openstack-keystone | 23:21 | |
| *** ChanServ sets mode: +v henrynash_ | 23:21 | |
| *** lucas has joined #openstack-keystone | 23:23 | |
| *** lucas has quit IRC | 23:23 | |
| *** lucas has joined #openstack-keystone | 23:24 | |
| *** lucas has quit IRC | 23:28 | |
| *** lucas has joined #openstack-keystone | 23:30 | |
| openstackgerrit | guang-yee proposed openstack/keystoneauth: Support TOTP auth plugin https://review.openstack.org/281086 | 23:32 |
| *** lucas___ has joined #openstack-keystone | 23:32 | |
| *** furface has joined #openstack-keystone | 23:33 | |
| *** lucas has quit IRC | 23:35 | |
| *** mvk has joined #openstack-keystone | 23:36 | |
| *** lucas___ has quit IRC | 23:37 | |
| *** fawadkhaliq has quit IRC | 23:37 | |
| *** furface has quit IRC | 23:43 | |
| *** henrynash_ has quit IRC | 23:45 | |
| *** sdake has quit IRC | 23:46 | |
| *** clenimar has joined #openstack-keystone | 23:49 | |
| *** fawadkhaliq has joined #openstack-keystone | 23:52 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Update the keystone-manage man page options https://review.openstack.org/326764 | 23:52 |
| *** fawadkhaliq has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!