| jamielennox | ayoung: ok, but i don't want to do multi hour operations with it | 00:00 |
|---|---|---|
| ayoung | I suspect 2 hours will be what we end up needing | 00:00 |
| jamielennox | trusts were abused for the timeout issue, hopefully we can improve that later | 00:00 |
| ayoung | that is the problem that we are facing. | 00:00 |
| jamielennox | but something like a trust is still the right thing for really long lived operations | 00:01 |
| jamielennox | but we'll see | 00:01 |
| ayoung | yeah, but there are things like snapshot that are like 1hour + a few minutes | 00:01 |
| *** ddieterly has joined #openstack-keystone | 00:01 | |
| ayoung | andything that is routine should not need a database record to authorize it | 00:01 |
| jamielennox | yea, so that i feel should be ok for a reservation | 00:01 |
| jamielennox | because it's still the user's request | 00:02 |
| ayoung | I think we agree on everything but the name | 00:02 |
| ayoung | to me reservations mean "specific to a resource" | 00:02 |
| ayoung | and these are not | 00:02 |
| jamielennox | ayoung: define resource | 00:02 |
| jamielennox | words i see: | 00:06 |
| jamielennox | authority | 00:06 |
| jamielennox | heh, blessing | 00:07 |
| jamielennox | license | 00:07 |
| jamielennox | mandate | 00:07 |
| jamielennox | decree | 00:08 |
| jamielennox | instruction | 00:08 |
| jamielennox | directive | 00:09 |
| jamielennox | charge | 00:09 |
| jamielennox | commission | 00:09 |
| notmorgan | i... wow | 00:09 |
| notmorgan | theasaurus much? | 00:09 |
| jamielennox | i have no other ideas | 00:10 |
| jamielennox | an authorization is the right word, but it's overused | 00:10 |
| *** lucas____ has joined #openstack-keystone | 00:11 | |
| jamielennox | anyway - if someone has a better term i'm all ears | 00:12 |
| *** markvoelker has joined #openstack-keystone | 00:12 | |
| jamielennox | ayoung: also i'm back to being annoyed that you can't easily install ipa and ipsilon side by side | 00:13 |
| *** markvoelker_ has joined #openstack-keystone | 00:13 | |
| *** rderose_ has joined #openstack-keystone | 00:14 | |
| *** markvoel_ has joined #openstack-keystone | 00:15 | |
| *** markvoelker has quit IRC | 00:15 | |
| *** lucas____ has quit IRC | 00:15 | |
| *** julim has joined #openstack-keystone | 00:17 | |
| *** rderose has quit IRC | 00:18 | |
| *** markvoelker_ has quit IRC | 00:19 | |
| *** roxanaghe has quit IRC | 00:22 | |
| amrith | bknudson_, I'm throwing in the towel. making timeutils.isoformat() produce .000000 effectively defeats the claim that it is a wrapper on isoformat() with just one little tweak. The 'tweak' to make it do the .000000 is pretty much throwing in the towel and reinventing isotime(). I propose to abandon my patch ... | 00:25 |
| *** rderose_ has quit IRC | 00:26 | |
| openstackgerrit | Sam Leong proposed openstack/keystoneauth: Auth plugin for X.509 tokenless authz https://review.openstack.org/283905 | 00:36 |
| openstackgerrit | Sam Leong proposed openstack/keystoneauth: Auth plugin for X.509 tokenless authz https://review.openstack.org/283905 | 00:39 |
| *** catintheroof has joined #openstack-keystone | 00:47 | |
| *** edtubill has quit IRC | 00:57 | |
| *** davechen has joined #openstack-keystone | 00:59 | |
| *** gordc has quit IRC | 01:03 | |
| *** lucas____ has joined #openstack-keystone | 01:06 | |
| *** catintheroof has quit IRC | 01:07 | |
| *** lucas____ has quit IRC | 01:10 | |
| *** KevinE has quit IRC | 01:10 | |
| *** mserngawy_ has quit IRC | 01:10 | |
| *** raddaoui has quit IRC | 01:17 | |
| *** BjoernT has joined #openstack-keystone | 01:18 | |
| *** BjoernT has quit IRC | 01:28 | |
| *** ktychkova has quit IRC | 01:34 | |
| *** dan_nguyen has joined #openstack-keystone | 01:39 | |
| jamielennox | gyee, this x509 tokenless auth plugin, how will that work against a service other than identity? | 01:41 |
| ayoung | jamielennox, it won't | 01:50 |
| *** toddnni_ has joined #openstack-keystone | 01:50 | |
| ayoung | we need all the other plumbing I've talked about to do that | 01:50 |
| *** EinstCrazy has joined #openstack-keystone | 01:50 | |
| ayoung | basically, the remote service needs the ability to concoct an AuthCOntext from the X509: | 01:50 |
| *** ddieterly has quit IRC | 01:51 | |
| *** toddnni has quit IRC | 01:51 | |
| *** toddnni_ is now known as toddnni | 01:51 | |
| ayoung | it needs to look up the mapping, use that and something the user provides to get the set of roles that the user has on the project scoped to the resource. | 01:51 |
| ayoung | jamielennox, BTW...are you punting on the 968696 work? | 01:51 |
| jamielennox | ayoung: i don't know how x509 service to service would work - where is the service catalog coming from? | 01:52 |
| ayoung | jamielennox, like anything else, it would have to be queried from Keystone | 01:52 |
| jamielennox | ayoung: no, https://review.openstack.org/331374 merged yesterday | 01:52 |
| jamielennox | ayoung: and the next one would be https://review.openstack.org/331916 | 01:52 |
| ayoung | jamielennox thanks. that came up earlier this week | 01:53 |
| ayoung | wasn;'t sure if it was still making progress. | 01:53 |
| jamielennox | ayoung: yea, we've had a few where you have to wait for a release then fix in another library then wait | 01:53 |
| stevemar | ayoung: slowly, lots of pieces to update | 01:53 |
| jamielennox | but with the context patch we need to figure out what the rule should look like in oslo_policy | 01:53 |
| ayoung | right | 01:54 |
| jamielennox | i admit to have wriitten the context patch without any idea how to do that | 01:54 |
| ayoung | heh | 01:54 |
| jamielennox | but i'm passing a boolean 'is_admin_policy' through to policy so we should be able to work with that | 01:54 |
| jamielennox | 'is_admin_project' | 01:54 |
| ayoung | so policy would be is_admin_project=True? | 01:55 |
| jamielennox | i actually wasn't sure if a string would be better there for policy, but it should work with a bool | 01:55 |
| *** stevemar has quit IRC | 01:56 | |
| jamielennox | ayoung: so line 109 of https://review.openstack.org/#/c/331916/2/oslo_context/context.py | 01:56 |
| patchbot | jamielennox: patch 331916 - oslo.context - Add is_admin_project to context | 01:56 |
| jamielennox | that's the standard policy dict | 01:56 |
| jamielennox | all services will (eventually) pass at least those values through to policy enforce() | 01:57 |
| jamielennox | 'is_admin_project' is a bool | 01:57 |
| jamielennox | now maybe we want a custom rule in oslo.policy? | 01:57 |
| jamielennox | i can't do policy language off the top of my head to know how to match 'is_admin_project' missing or True | 01:58 |
| jamielennox | if it appears like i've just completely missed something that was said please repeat it as i'm in a coffee shop and the connection is not exactly stable | 02:00 |
| jamielennox | ayoung: also refering to earlier, if you are using tokenless auth and you have to fetch a service catalog and such from keystone you are much better off using a federated IDP with an x509 credential | 02:01 |
| *** iurygregory_ has quit IRC | 02:03 | |
| *** spandhe has quit IRC | 02:03 | |
| *** ddieterly has joined #openstack-keystone | 02:03 | |
| notmorgan | jamielennox: i think we've avoided using "a user authorization" as an article fairly well | 02:09 |
| notmorgan | jamielennox: not sure if that matters, but we could probably use it in this context | 02:09 |
| notmorgan | jamielennox: might be worth doing so. | 02:10 |
| notmorgan | jamielennox: OR we name it something totally new / made up. | 02:11 |
| notmorgan | jamielennox: that has no real bearing word-wise to authz things [ick] | 02:11 |
| *** ddieterly has quit IRC | 02:14 | |
| *** jamielennox is now known as jamielennox|away | 02:16 | |
| *** jamielennox|away is now known as jamielennox | 02:17 | |
| *** jorge_munoz has quit IRC | 02:17 | |
| jamielennox | notmorgan: like ticket? | 02:19 |
| jamielennox | show your id, give your money, get a ticket for one ride? | 02:19 |
| *** browne has quit IRC | 02:21 | |
| openstackgerrit | Merged openstack/keystone: /services?name=<name> API fails when using list_limit https://review.openstack.org/331790 | 02:26 |
| openstackgerrit | David Stanek proposed openstack/keystone: Use the ldap fixture to simplify tests https://review.openstack.org/332603 | 02:30 |
| *** tonytan4ever has joined #openstack-keystone | 02:30 | |
| notmorgan | jamielennox: ticket would work too | 02:36 |
| notmorgan | and fwiw, we're close enough to krb that it makes sense. | 02:36 |
| *** stevemar has joined #openstack-keystone | 02:56 | |
| *** ChanServ sets mode: +o stevemar | 02:56 | |
| gyee | jamielennox, x.509 can be used for server to service authentication, you don't even need mapping if you don't want to :-) | 03:02 |
| jamielennox | gyee: how does a service with x509 know where the other services are? | 03:04 |
| gyee | you can either configure it, or lookup catalog from keystone | 03:05 |
| gyee | we already have tokenless token validation, not too difficult to extend it to other operations | 03:06 |
| gyee | like catalog lookup | 03:06 |
| gyee | remember, mapping can take ALL environment variables into consideration, include METHOD and PATH | 03:07 |
| gyee | and API is essentially identified by METHOD and PATH | 03:08 |
| gyee | so you can controller which API to grant access by matching METHOD and PATH | 03:08 |
| jamielennox | gyee: it's not going via mapping though because you don't get a token | 03:11 |
| gyee | jamielennox, I am drafting an abstract for Barcelona on all the wonderful things you can do we certificates, hopefully it will get selected | 03:11 |
| gyee | so come to my session if it happens, I'll spill the beans :-) | 03:11 |
| gyee | jamielennox, take a look at the tokenless auth code | 03:12 |
| jamielennox | gyee: i'm mostly not wanting to steer sam's tokenless auth patch wrong | 03:12 |
| gyee | there's a mapping involved on the server side | 03:13 |
| jamielennox | to me the only get_endpoint it would ever be asked for is the identity endpoint because that's what auth_token uses for user validation | 03:13 |
| gyee | we can easily extend it to make it generic | 03:13 |
| jamielennox | and i'm stuck on how and why you would change that for more services | 03:13 |
| gyee | you can use it for service to service | 03:13 |
| gyee | auth context is constructed from identity headers, no? | 03:13 |
| jamielennox | does it correctly set up X_SERVICE_BLAH headers? i'm pretty sure no | 03:14 |
| gyee | we can easily translate certificate attributes into identity headers | 03:14 |
| gyee | yes it can | 03:14 |
| jamielennox | can=-=does? | 03:14 |
| gyee | you can do the trick at Apache or HAProxy | 03:14 |
| jamielennox | can==does? | 03:14 |
| gyee | mod_rewrite? | 03:14 |
| jamielennox | so auth_token middleware scraps all incoming headers that might try and emulate what we pass down to services | 03:15 |
| jamielennox | so you can't fake it at the apache level | 03:15 |
| jamielennox | but forgetting that i'm not worried about keystone | 03:15 |
| jamielennox | it's every other service i'm not sure about | 03:15 |
| jamielennox | on keystone side this is all easy | 03:15 |
| jamielennox | but how would a tokenless auth be used to talk to something not keystone? | 03:16 |
| *** topol has joined #openstack-keystone | 03:16 | |
| *** ChanServ sets mode: +v topol | 03:16 | |
| gyee | I think we can find a way to tell auth_token to by pass scrapping headers | 03:16 |
| gyee | jamelennox, certificate contains a set of attributes, not different than SAML2 attributes | 03:17 |
| jamielennox | gyee: that would involve auth_token/something on the (eg) nova service knowing how to do client cert validation? | 03:17 |
| gyee | we just need a way to map those attributes into something meaningful to the service itself | 03:17 |
| gyee | cert validation is done by the front-end, where SSL terminates | 03:18 |
| gyee | it is up to the application to decide what to do with it | 03:19 |
| gyee | if cert is not trust, connection will not even go through | 03:19 |
| gyee | s/trust/trusted/ | 03:19 |
| jamielennox | ok, i don't know how to deal with that from an auth_token sense | 03:19 |
| jamielennox | or what's producing the catalog etc | 03:20 |
| jamielennox | but i think if for now we just fail to do anything but auth that's ok | 03:20 |
| jamielennox | sorry fail to call anything but identity | 03:20 |
| gyee | that's fine, we have something to start with | 03:21 |
| gyee | but my point is we can easily extend it to other areas | 03:21 |
| gyee | when it comes to security, we have to consider the totality of the system, not just part of it | 03:21 |
| gyee | jamielennox, I have to bail, dinner time, ttyl, thanks for the code review | 03:23 |
| jamielennox | gyee: cya | 03:23 |
| gyee | I'll do more code reviews after a full belly | 03:23 |
| *** gyee has quit IRC | 03:24 | |
| *** davechen has quit IRC | 03:24 | |
| *** EinstCrazy has quit IRC | 03:25 | |
| *** EinstCrazy has joined #openstack-keystone | 03:25 | |
| *** links has joined #openstack-keystone | 03:29 | |
| *** spandhe has joined #openstack-keystone | 03:41 | |
| *** spandhe_ has joined #openstack-keystone | 03:44 | |
| *** catintheroof has joined #openstack-keystone | 03:44 | |
| *** spandhe has quit IRC | 03:45 | |
| *** spandhe_ is now known as spandhe | 03:45 | |
| *** roxanaghe has joined #openstack-keystone | 03:46 | |
| *** dave-mcc_ has quit IRC | 03:48 | |
| *** tonytan4ever has quit IRC | 03:53 | |
| *** anush__ has joined #openstack-keystone | 03:58 | |
| *** anush__ has quit IRC | 04:00 | |
| *** richm has quit IRC | 04:00 | |
| *** anush__ has joined #openstack-keystone | 04:00 | |
| *** stevemar has quit IRC | 04:02 | |
| *** catintheroof has quit IRC | 04:02 | |
| *** EinstCrazy has quit IRC | 04:09 | |
| *** jaosorior has joined #openstack-keystone | 04:23 | |
| *** dan_nguyen has quit IRC | 04:25 | |
| *** sheel has joined #openstack-keystone | 04:30 | |
| *** rcernin has joined #openstack-keystone | 04:56 | |
| *** stevemar has joined #openstack-keystone | 05:02 | |
| *** ChanServ sets mode: +o stevemar | 05:02 | |
| *** stevemar has quit IRC | 05:07 | |
| *** KevinE has joined #openstack-keystone | 05:10 | |
| *** roxanaghe has quit IRC | 05:11 | |
| *** roxanaghe has joined #openstack-keystone | 05:12 | |
| *** KevinE has quit IRC | 05:15 | |
| *** rcernin has quit IRC | 05:16 | |
| *** roxanaghe has quit IRC | 05:17 | |
| *** lucas____ has joined #openstack-keystone | 05:30 | |
| *** chlong has quit IRC | 05:34 | |
| *** lucas____ has quit IRC | 05:35 | |
| openstackgerrit | Alex Xu proposed openstack/oslo.policy: Add note about not all APIs support policy enforcement by user_id https://review.openstack.org/325645 | 05:40 |
| *** chlong has joined #openstack-keystone | 05:47 | |
| *** rcernin has joined #openstack-keystone | 05:55 | |
| *** TxGVNN has joined #openstack-keystone | 06:07 | |
| *** EinstCrazy has joined #openstack-keystone | 06:10 | |
| *** roxanaghe has joined #openstack-keystone | 06:18 | |
| *** roxanaghe has quit IRC | 06:22 | |
| *** yolanda has quit IRC | 06:29 | |
| openstackgerrit | Srushti Gadadare proposed openstack/keystone: Return BadRequest for 4 byte unicode characters https://review.openstack.org/324320 | 06:42 |
| *** david-lyle_ has joined #openstack-keystone | 06:46 | |
| *** tesseract- has joined #openstack-keystone | 06:47 | |
| *** hugokuo_ has joined #openstack-keystone | 06:48 | |
| *** dmellado_ has joined #openstack-keystone | 06:52 | |
| *** jaosorior is now known as jaosorior_brb | 06:54 | |
| *** charz has joined #openstack-keystone | 06:54 | |
| *** dgonzalez_ has joined #openstack-keystone | 06:55 | |
| openstackgerrit | Swapnil Kulkarni (coolsvap) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 06:59 |
| openstackgerrit | Swapnil Kulkarni (coolsvap) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 06:59 |
| *** EinstCrazy has quit IRC | 07:01 | |
| *** EinstCrazy has joined #openstack-keystone | 07:02 | |
| *** yolanda has joined #openstack-keystone | 07:04 | |
| *** anush__ has quit IRC | 07:04 | |
| *** david-lyle has quit IRC | 07:04 | |
| *** dgonzalez has quit IRC | 07:04 | |
| *** rm_work has quit IRC | 07:04 | |
| *** dmellado has quit IRC | 07:04 | |
| *** charz_ has quit IRC | 07:04 | |
| *** david_cu has quit IRC | 07:04 | |
| *** hugokuo has quit IRC | 07:04 | |
| *** dgonzalez_ is now known as dgonzalez | 07:04 | |
| *** hugokuo_ is now known as hugokuo | 07:04 | |
| *** permalac_ has quit IRC | 07:06 | |
| *** EinstCrazy has quit IRC | 07:07 | |
| *** yolanda has quit IRC | 07:10 | |
| *** EinstCrazy has joined #openstack-keystone | 07:11 | |
| *** spandhe has quit IRC | 07:13 | |
| *** rm_work has joined #openstack-keystone | 07:14 | |
| *** spandhe has joined #openstack-keystone | 07:16 | |
| *** Dave has quit IRC | 07:18 | |
| henrynash_ | jamielennox: hi | 07:20 |
| *** pcaruana has joined #openstack-keystone | 07:22 | |
| jamielennox | henrynash_: hey | 07:23 |
| henrynash | hi….do you have a moment to talk about test_middleware and _middleware_failure class? | 07:24 |
| jamielennox | henrynash: sure, can do | 07:25 |
| henrynash | this is tests/unit/test_middleware…. | 07:25 |
| *** chlong has quit IRC | 07:25 | |
| *** stevemar has joined #openstack-keystone | 07:26 | |
| *** ChanServ sets mode: +o stevemar | 07:26 | |
| jamielennox | oh, yep, i see it - i remember this one | 07:26 |
| henrynash | …and I note a comment of yous in the _middleware_failuer class on the fact that its a bit ugly! | 07:26 |
| *** stevemar_ has joined #openstack-keystone | 07:27 | |
| *** ChanServ sets mode: +o stevemar_ | 07:27 | |
| henrynash | for preparation for passing around versions in the request for microversioning, I have proposed that we pass teh request (that you added to teh controllers) back into render_response | 07:28 |
| jamielennox | are you looking for whyh? | 07:28 |
| *** amoralej|off is now known as amoralej | 07:28 | |
| henrynash | see: | 07:28 |
| *** davechen has joined #openstack-keystone | 07:28 | |
| *** davechen has left #openstack-keystone | 07:28 | |
| henrynash | https://review.openstack.org/#/c/330720/ | 07:28 |
| patchbot | henrynash: patch 330720 - keystone - Pass request back into wsgi render_reponse | 07:28 |
| henrynash | all fine | 07:28 |
| henrynash | but when I come to use this request in the wsgi response, the AuthContextMiddle tests blow up…. | 07:29 |
| jamielennox | yep, i had a brief look through that patch the other day, but i was waiting for some more info re whether we are still doing microversions first | 07:29 |
| jamielennox | oooh | 07:30 |
| jamielennox | hmm, | 07:30 |
| *** stevemar has quit IRC | 07:30 | |
| henrynash | basically any of the AuthContextMiddeleware tests un test_midleware end up calling wsgi.render_response….but I don’t knwo how they get to do that | 07:30 |
| jamielennox | i think because the authcontext subclasses auth_token middleware | 07:31 |
| jamielennox | and auth_token middleware doesn't expect a response to be passed | 07:31 |
| jamielennox | https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L334 | 07:31 |
| *** ebarrera has joined #openstack-keystone | 07:32 | |
| *** stevemar_ has quit IRC | 07:32 | |
| henrynash | (aorry, I meat the ended up calling wsgi.render_exception) | 07:32 |
| henrynash | I’m obviously missing something obvious, but can’t see the path to how they get tp using our wsgi methods in these tests | 07:33 |
| henrynash | all the other middle classes are derived rom wsgi.Application or something - so that makes sense…but not AuthContext | 07:34 |
| jamielennox | henrynash: via this decorator: https://github.com/openstack/keystone/blob/master/keystone/middleware/auth.py#L139 | 07:35 |
| henrynash | ahh, damn, right | 07:36 |
| jamielennox | it's annoying really, the proper thing to do is for middleware to render its own exceptions but that logic was already in place because it used to depend on wsgi.Middleware | 07:37 |
| henrynash | would you rather have it refactored…I’d be Ok doing that if you want | 07:38 |
| rakhmerov | hi, is there anybody who can answer a couple questions about auth plugins? | 07:41 |
| jamielennox | henrynash: whatever works for you, i'm just saying don't worry too much about some current grand design | 07:42 |
| jamielennox | henrynash: i got caught because the request object is different at the middleware level to the core level | 07:42 |
| henrynash | ok, thanks…you’ve solved my main headache…understanding how the error was getting there in the first place! | 07:42 |
| jamielennox | henrynash: when exectued as middleware its a auth_token.Request and when in core its a keystone.Request | 07:42 |
| jamielennox | because i moved some of the logic onto the request object and it didn't work in all case | 07:43 |
| jamielennox | s | 07:43 |
| henrynash | yep, slowly worked my brain round all that as i debugged this! | 07:43 |
| henrynash | ok, thanks…I’ll go mull on this... | 07:44 |
| jamielennox | no worries | 07:44 |
| *** wangqun has joined #openstack-keystone | 07:49 | |
| *** wangqun has quit IRC | 07:49 | |
| *** wangqun has joined #openstack-keystone | 07:49 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| *** EinstCrazy has quit IRC | 08:03 | |
| *** jaosorior_brb is now known as jaosorior | 08:05 | |
| *** EinstCrazy has joined #openstack-keystone | 08:05 | |
| *** M00nr41n has joined #openstack-keystone | 08:17 | |
| *** yolanda has joined #openstack-keystone | 08:18 | |
| *** henrynash has quit IRC | 08:18 | |
| *** spandhe has quit IRC | 08:19 | |
| *** dmk0202 has joined #openstack-keystone | 08:23 | |
| *** stevemar has joined #openstack-keystone | 08:27 | |
| *** ChanServ sets mode: +o stevemar | 08:27 | |
| *** pnavarro has joined #openstack-keystone | 08:28 | |
| *** stevemar_ has joined #openstack-keystone | 08:29 | |
| *** ChanServ sets mode: +o stevemar_ | 08:29 | |
| *** stevemar has quit IRC | 08:32 | |
| *** stevemar_ has quit IRC | 08:34 | |
| *** Dave has joined #openstack-keystone | 08:36 | |
| *** rmizuno has joined #openstack-keystone | 08:37 | |
| *** bapalm has quit IRC | 08:37 | |
| *** bapalm has joined #openstack-keystone | 08:42 | |
| *** EinstCrazy has quit IRC | 08:44 | |
| *** vnogin has quit IRC | 08:45 | |
| *** ktychkova has joined #openstack-keystone | 08:51 | |
| *** mvk has joined #openstack-keystone | 08:52 | |
| *** jaosorior has quit IRC | 09:09 | |
| *** jaosorior has joined #openstack-keystone | 09:10 | |
| *** nisha has joined #openstack-keystone | 09:17 | |
| *** mvk has quit IRC | 09:35 | |
| *** nisha_ has joined #openstack-keystone | 09:37 | |
| *** BlackDex_ is now known as BlackDex | 09:40 | |
| *** nisha has quit IRC | 09:41 | |
| *** nisha_ is now known as nisha | 09:42 | |
| *** ryom has joined #openstack-keystone | 09:46 | |
| ryom | The reason why I am writing this email to you is I'd like to ask some questions about reseller 2nd phase in Newton. I wished that is possible to ask at the IRC. But use e-mail by the time difference. Previously, I asked you about the implementation in Newton cycle of the hierarchy of the project acting as domain at the IRC (6/1). At that time, I received an answer "doubt it" from you. I want to know more detail information | 09:47 |
| *** ryom has quit IRC | 09:48 | |
| *** bapalm has quit IRC | 09:48 | |
| *** samueldmq has joined #openstack-keystone | 09:53 | |
| samueldmq | morning keystone | 09:53 |
| *** ChanServ sets mode: +v samueldmq | 09:54 | |
| *** bapalm has joined #openstack-keystone | 09:54 | |
| *** mvk has joined #openstack-keystone | 09:56 | |
| *** daemontool has joined #openstack-keystone | 10:07 | |
| *** yolanda has quit IRC | 10:10 | |
| *** daemontool has quit IRC | 10:19 | |
| openstackgerrit | jingtao liang proposed openstack/keystone: Fix argument order for assertEqual to (expected, observed) https://review.openstack.org/332729 | 10:23 |
| *** wangqun has quit IRC | 10:26 | |
| *** stevemar has joined #openstack-keystone | 10:31 | |
| *** ChanServ sets mode: +o stevemar | 10:31 | |
| *** stevemar has quit IRC | 10:36 | |
| samueldmq | jamielennox: hi, you still around ? | 10:47 |
| *** henrynash has joined #openstack-keystone | 10:48 | |
| *** ChanServ sets mode: +v henrynash | 10:48 | |
| samueldmq | jamielennox: left a couple of comments/suggestions on the reservation spec | 10:53 |
| * samueldmq is almost out of specs to review | 10:54 | |
| samueldmq | and now it's time to look at https://review.openstack.org/#/c/318605 | 10:57 |
| samueldmq | henrynash: hi, it seems to me there is no consensus on that yet | 10:57 |
| samueldmq | henrynash: am I right ? | 10:57 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 10:58 |
| henrynash | samueldmq: no, there is no consensus yet….I’m going to write up the domain-centric alternative for comparison | 10:58 |
| samueldmq | henrynash: which means ? | 10:59 |
| samueldmq | henrynash: projects still unique within the domain ? | 11:00 |
| henrynash | samuedlmq: I’m trying to think it through…..but the only way to make the domain-led version work is that we allow nested domains, and domain names ALWAYS are their full path to the root….otherwise a domain in one customer would prevent one of a similar name in anyother customer | 11:01 |
| *** nisha_ has joined #openstack-keystone | 11:01 | |
| henrynash | samueldmq: …which wouldn’t break any compatibility, since domain names today are all top level domains | 11:02 |
| *** nisha has quit IRC | 11:02 | |
| samueldmq | henrynash: great | 11:02 |
| samueldmq | henrynash: we can't fix hierarchical projects because it's been there for a while | 11:02 |
| henrynash | but would allow a customer (within their own domain), to create domains like prodcution, test, staging | 11:02 |
| samueldmq | henrynash: but we can make it right (as we want) for hierarchical domains | 11:03 |
| henrynash | yes | 11:03 |
| nisha_ | samueldmq, good morning | 11:03 |
| samueldmq | nisha_: good morning | 11:03 |
| henrynash | and by including the path, the name of a given domain is always (still) unique | 11:03 |
| samueldmq | nisha_: just saw your patch, there we go | 11:03 |
| nisha_ | samueldmq, :) | 11:03 |
| samueldmq | henrynash: right | 11:03 |
| samueldmq | henrynash: I think we should be good on that, and everyone would agree | 11:04 |
| samueldmq | henrynash: we document that, if you want to create siblings with the same name, that must be in different domains | 11:05 |
| samueldmq | henrynash: because project names are still unique | 11:05 |
| henrynash | samuedlmq: yes | 11:05 |
| samueldmq | henrynash: I like this, looking forward to seeing the spec | 11:05 |
| henrynash | samueldmq: I’m thinking that we need to add a flag to a domain (only useful for non root domains), that says whether it inherits users and groups from its parent (which will always be a domain), otherwise you’d have to replicate thing slike LDAP configs across the domains | 11:06 |
| samueldmq | henrynash: it must be the parent setting the flag it wants to share its users | 11:06 |
| henrynash | samuedlmq: good point | 11:07 |
| samueldmq | henrynash: but I think that's a separate thing than the organisation -> token issuance we're talking about so far | 11:07 |
| henrynash | samuedlmq: yep | 11:07 |
| samueldmq | henrynash: maybe that even deserve its own spec | 11:07 |
| samueldmq | ++ | 11:07 |
| *** henrynash has quit IRC | 11:09 | |
| *** chlong has joined #openstack-keystone | 11:21 | |
| *** ddieterly has joined #openstack-keystone | 11:23 | |
| samueldmq | nisha_: reviewed | 11:32 |
| nisha_ | samueldmq, looking thanks | 11:33 |
| *** ddieterly has quit IRC | 11:33 | |
| *** rodrigods has quit IRC | 11:39 | |
| *** rodrigods has joined #openstack-keystone | 11:39 | |
| *** ddieterly has joined #openstack-keystone | 11:41 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 11:43 | |
| *** amoralej is now known as amoralej|lunch | 11:44 | |
| *** sdake has quit IRC | 11:48 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 11:48 |
| samueldmq | (status:open project:openstack/keystone-specs label:Code-Review-0,self NOT label:Workflow-1) is now empty | 11:50 |
| * samueldmq dances | 11:50 | |
| *** chlong has quit IRC | 11:51 | |
| samueldmq | nisha_: see a couple of comments again :) | 11:54 |
| nisha_ | samueldmq, sure | 11:56 |
| samueldmq | nisha_: let me know if you agree/disagree | 11:56 |
| *** ddieterly has quit IRC | 11:59 | |
| *** sdake has joined #openstack-keystone | 12:03 | |
| *** raildo-afk is now known as raildo | 12:09 | |
| *** ramishra has joined #openstack-keystone | 12:09 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 12:10 |
| ramishra | ayoung: hi around? | 12:11 |
| nisha_ | samueldmq, why is it showing conflicts with alongside the patch | 12:12 |
| *** dave-mccowan has joined #openstack-keystone | 12:19 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 12:21 |
| *** d0ugal has quit IRC | 12:25 | |
| *** d0ugal has joined #openstack-keystone | 12:25 | |
| *** ddieterly has joined #openstack-keystone | 12:27 | |
| dstanek | rodrigods: i just moved that comment with the code, but now that i read it i think it may be safe to just delete | 12:27 |
| *** aurelien has joined #openstack-keystone | 12:27 | |
| rodrigods | dstanek, yeah, saw that | 12:27 |
| rodrigods | maybe in another patchset | 12:27 |
| dstanek | yeah, i have several more to push already. i've been cleaning out one of my old dev nodes | 12:29 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 12:33 |
| *** pauloewerton has joined #openstack-keystone | 12:34 | |
| *** nisha_ has quit IRC | 12:38 | |
| *** julim has quit IRC | 12:39 | |
| *** ddieterly has quit IRC | 12:42 | |
| *** sdake has quit IRC | 12:43 | |
| *** edmondsw has joined #openstack-keystone | 12:43 | |
| *** ramishra has quit IRC | 12:53 | |
| *** henrynash has joined #openstack-keystone | 12:55 | |
| *** ChanServ sets mode: +v henrynash | 12:55 | |
| *** lamt has joined #openstack-keystone | 13:01 | |
| *** julim has joined #openstack-keystone | 13:06 | |
| *** chlong has joined #openstack-keystone | 13:06 | |
| *** richm has joined #openstack-keystone | 13:06 | |
| *** permalac has joined #openstack-keystone | 13:07 | |
| *** links has quit IRC | 13:09 | |
| *** woodster_ has joined #openstack-keystone | 13:11 | |
| dstanek | henrynash: what if you also mark existng project (at the time of the upgrade/migration) somehow and allow them to be accessed both ways? | 13:12 |
| dstanek | that is the equivalent of giving each exising heirarchical name a root level alias | 13:13 |
| openstackgerrit | Merged openstack/keystone: Use the ldap fixture to simplify tests https://review.openstack.org/332603 | 13:13 |
| henrynash_ | dstanek: yes, you could do that…(and I hiint at that in the summary), it’s just that then you have to remember which projects where created befpre and after the upgrade | 13:13 |
| henrynash_ | i mean the user has to remember | 13:13 |
| dstanek | henrynash_: i think the user should just always use fully path names after the upgrade. the hacks are just to allow old clients to work | 13:14 |
| henrynash_ | dstanek: that’s exacty the proposal as it is currently! | 13:14 |
| dstanek | henrynash_: i dont' read it like that. specifically where it talks about 3.6 clients | 13:15 |
| *** aurelien has quit IRC | 13:16 | |
| dstanek | for example, creating new projects that are not hierarchical | 13:16 |
| henrynash_ | dtsanek: creating a new project before or after the server is upgrdaed to Newton? | 13:18 |
| dstanek | after | 13:19 |
| henrynash_ | dstanek: ah, so you as suggesting that projects created after the upgrade are somehow returned to a 3.6 client without a path? | 13:19 |
| henrynash_ | dstanek: this would work OK for projects created as top level ones, but how to distiquish between two projects of teh same name, one as a root project, one somewhere in the hierarchy…when talking to a 3.6 client? | 13:21 |
| openstackgerrit | Merged openstack/keystone: Reduce setup overhead in auth_plugin tests https://review.openstack.org/266397 | 13:21 |
| dstanek | henrynash_: hierarchical projects created before the upgrade are effectively root projects to old clients. ones created after would have their path returned to the client | 13:22 |
| *** real56 has joined #openstack-keystone | 13:23 | |
| henrynash_ | dstanek: even though a new cleint might create another root project of the same name as the old one that is down the hierarchy somewhere…. | 13:23 |
| *** BigWillie has joined #openstack-keystone | 13:24 | |
| henrynash_ | dstanek: I did try these kind of approaches, but worrised about the confusion over which project was really being accessed….and would that mean that if I did a list projects I would see the old project as a root projects….or is this just an auth scoping mechanism | 13:24 |
| dstanek | you'd have to enforce uniqueness there since there can be only one /test project (it's just that /blah/test has a /test "alias") | 13:25 |
| *** topol has quit IRC | 13:26 | |
| dstanek | i think it would be fine to show the path, even to old clients, it's just that the old client needs the ability to access it the old way | 13:26 |
| henrynash_ | dstanek: ok, so effectively the top level poject space ould be special, since it could contain these “aliases” | 13:26 |
| dstanek | the problem is that the current "hierarchical" projects have effectively 2 names. so that would be confusing | 13:26 |
| henrynash_ | dstanek: interesting idea…….yes, I agree confuson certainly possible1 | 13:27 |
| dstanek | yes, special is a nice way to put it :-) | 13:27 |
| *** tonytan4ever has joined #openstack-keystone | 13:27 | |
| kfox1111 | trying to do a juno -> mitaka upgrade. db_sync does nothing as far as I can tell. | 13:28 |
| kfox1111 | version still 55. | 13:28 |
| kfox1111 | oh... | 13:31 |
| kfox1111 | cause this machine's keystone is older then juno. | 13:31 |
| dstanek | kfox1111: that predates my openstack involvement :-) | 13:32 |
| dstanek | henrynash_: anyway, it was just a thought i had when walking through the review again before the meeting yesterday | 13:33 |
| kfox1111 | hehe. | 13:34 |
| henrynash_ | dstaneK much apreciated….I’ll mull on it…and am writing up the “use domains for this” approach advocated by dolhm & notmorgan | 13:34 |
| henrynash_ | dstanek: to see how that would work | 13:34 |
| kfox1111 | yeah. the 55 to 66 or something migrations were removed. | 13:34 |
| *** ddieterly has joined #openstack-keystone | 13:34 | |
| *** rderose has joined #openstack-keystone | 13:37 | |
| *** sdake has joined #openstack-keystone | 13:37 | |
| *** amoralej|lunch is now known as amoralej | 13:38 | |
| kfox1111 | ok. went to kilo first, then mitaka. | 13:38 |
| kfox1111 | db sync's finished without error. | 13:38 |
| *** jefrite has joined #openstack-keystone | 13:39 | |
| kfox1111 | db version is now 90 | 13:40 |
| kfox1111 | ok. but something failed. | 13:41 |
| kfox1111 | ProgrammingError: (_mysql_exceptions.ProgrammingError) (1146, "Table 'keystone.federated_user' doesn't exist") [SQL: u'SELECT federated_user.id AS federated_user_id, federated_user.user_id AS federated_user_user_id, federated_user.idp_id AS federated_user_idp_id, federated_user.protocol_id AS federated_user_protocol_id, federated_user.unique_id AS federated_user_unique_id, federated_user.display_name AS federated_user_display_name, anon_1.user_id | 13:41 |
| kfox1111 | ah. there are migrations beyond 90. | 13:43 |
| kfox1111 | db_sync is exiting without printing anything. :/ | 13:43 |
| *** mwheckmann has joined #openstack-keystone | 13:43 | |
| *** lucas____ has joined #openstack-keystone | 13:45 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 13:45 |
| *** ddieterly is now known as ddieterly[away] | 13:45 | |
| *** chlong has quit IRC | 13:49 | |
| *** walharthi has joined #openstack-keystone | 13:50 | |
| *** woodburn has joined #openstack-keystone | 13:50 | |
| *** BjoernT has joined #openstack-keystone | 13:52 | |
| *** phalmos has joined #openstack-keystone | 13:55 | |
| *** ddieterly[away] is now known as ddieterly | 13:55 | |
| *** phalmos_ has joined #openstack-keystone | 13:56 | |
| *** phalmos has quit IRC | 13:59 | |
| *** ametts has joined #openstack-keystone | 14:01 | |
| *** darosale has joined #openstack-keystone | 14:02 | |
| *** chlong has joined #openstack-keystone | 14:05 | |
| *** gordc has joined #openstack-keystone | 14:06 | |
| kfox1111 | ok. I think I got it fixed. it somehow deleted the constraint and couldn't then rerun. commented it out and things finished, and seems to be ok. | 14:06 |
| *** timcline has joined #openstack-keystone | 14:07 | |
| *** timcline has quit IRC | 14:07 | |
| *** timcline has joined #openstack-keystone | 14:07 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 14:13 |
| *** anush__ has joined #openstack-keystone | 14:15 | |
| *** henrynash has quit IRC | 14:16 | |
| dstanek | kfox1111: how where you able to figure that out? it's troubling that you didn't get any indication of why/what error | 14:17 |
| *** edtubill has joined #openstack-keystone | 14:17 | |
| ayoung | notmorgan, do we have caching for LDAP enabled? | 14:17 |
| bknudson_ | caching happens in the manager not the driver | 14:18 |
| walharthi | Hello! I am having some problems when trying to use keystone-to-keystone authentication | 14:18 |
| walharthi | I am using a scoped token to authenticate my request to the service provider but I am getting a 401 and keystone log in the service provider says “could not find token”. The token hasn’t expired nor was it revoked, and I my request contains the project id I used to scoped the token earlier. Any idea about what else could cause this? | 14:19 |
| *** topol has joined #openstack-keystone | 14:22 | |
| *** ChanServ sets mode: +v topol | 14:22 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:22 | |
| *** GB21 has joined #openstack-keystone | 14:24 | |
| *** nisha_ has joined #openstack-keystone | 14:24 | |
| *** phalmos_ has quit IRC | 14:24 | |
| *** phalmos has joined #openstack-keystone | 14:26 | |
| *** ddieterly is now known as ddieterly[away] | 14:30 | |
| *** ddieterly[away] is now known as ddieterly | 14:30 | |
| *** ddieterly is now known as ddieterly[away] | 14:31 | |
| *** ddieterly[away] is now known as ddieterly | 14:31 | |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| *** yolanda has joined #openstack-keystone | 14:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 14:34 |
| *** KevinE has joined #openstack-keystone | 14:35 | |
| *** nisha__ has joined #openstack-keystone | 14:37 | |
| samueldmq | dstanek: hi | 14:37 |
| dstanek | samueldmq: hey | 14:38 |
| samueldmq | dstanek: just left a comment in 332729, perhaps the bug is invalid then | 14:38 |
| dstanek | samueldmq: is that the assertEqual one? | 14:38 |
| samueldmq | dstanek: yes | 14:38 |
| samueldmq | dstanek: the bug says: "The test cases will produce a confusing error message if the tests ever fail, so this is worth fixing." | 14:38 |
| samueldmq | dstanek: and per your comment, the message isn't confusing | 14:39 |
| dstanek | i don't feel strongly about it either way. i don't see much utility, but on the other hand i submitted patches because it was an accepted bug | 14:39 |
| *** nisha_ has quit IRC | 14:40 | |
| samueldmq | dstanek: you submitted patches for it as well ? | 14:40 |
| samueldmq | dstanek: anyways, I think it doesn't hurt to have it | 14:41 |
| samueldmq | dstanek: I will mark the bug as wishlist | 14:41 |
| dstanek | samueldmq: jas | 14:41 |
| dstanek | samueldmq: loking up the source now | 14:41 |
| *** ma91 has joined #openstack-keystone | 14:43 | |
| *** nisha__ is now known as nisha_ | 14:44 | |
| *** ramishra has joined #openstack-keystone | 14:44 | |
| *** jaosorior has quit IRC | 14:47 | |
| *** david-lyle_ has quit IRC | 14:47 | |
| *** jaosorior has joined #openstack-keystone | 14:47 | |
| dstanek | yeah, i don't think anything has changed. so see much value in that bug. | 14:48 |
| *** tonytan4ever has quit IRC | 14:50 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:50 | |
| * samueldmq nods | 14:51 | |
| *** jorge_munoz has quit IRC | 14:51 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:51 | |
| *** timcline has quit IRC | 14:51 | |
| *** timcline has joined #openstack-keystone | 14:52 | |
| dstanek | i can't believe the amount of people that are in downtown Cleveland right now | 14:52 |
| *** tonytan4ever has joined #openstack-keystone | 14:53 | |
| *** timcline has quit IRC | 14:54 | |
| *** timcline has joined #openstack-keystone | 14:54 | |
| *** anush__ has quit IRC | 14:54 | |
| *** jistr is now known as jistr|mtg | 14:58 | |
| *** tonytan4ever has quit IRC | 14:58 | |
| KevinE | dstanek: I heard them talking about it on the radio, sounds pretty crazy | 14:58 |
| *** lucas____ has quit IRC | 14:59 | |
| dstanek | KevinE: yesterday i was thinking i should go. i'm super glad that i didn't make that mistake | 14:59 |
| *** ramishra has quit IRC | 14:59 | |
| *** lucas____ has joined #openstack-keystone | 14:59 | |
| *** jaugustine has joined #openstack-keystone | 15:01 | |
| *** jaosorior has quit IRC | 15:02 | |
| *** luca_____ has joined #openstack-keystone | 15:02 | |
| *** lucas____ has quit IRC | 15:02 | |
| *** lucas____ has joined #openstack-keystone | 15:04 | |
| *** lucas____ has quit IRC | 15:05 | |
| *** lucas____ has joined #openstack-keystone | 15:05 | |
| *** luca_____ has quit IRC | 15:07 | |
| *** permalac has quit IRC | 15:08 | |
| *** rcernin has quit IRC | 15:09 | |
| *** lucas____ has quit IRC | 15:10 | |
| *** timcline has quit IRC | 15:10 | |
| *** yolanda has quit IRC | 15:10 | |
| *** sdake has quit IRC | 15:10 | |
| *** bapalm has quit IRC | 15:10 | |
| *** robcresswell_ has joined #openstack-keystone | 15:10 | |
| *** bapalm has joined #openstack-keystone | 15:10 | |
| *** agireud has quit IRC | 15:10 | |
| *** yarkot1 has quit IRC | 15:10 | |
| *** hogepodge has quit IRC | 15:10 | |
| *** robcresswell has quit IRC | 15:10 | |
| *** yolanda has joined #openstack-keystone | 15:10 | |
| *** robcresswell_ is now known as robcresswell | 15:10 | |
| *** tesseract- has quit IRC | 15:10 | |
| *** timcline has joined #openstack-keystone | 15:10 | |
| *** yarkot1 has joined #openstack-keystone | 15:11 | |
| *** hogepodge has joined #openstack-keystone | 15:11 | |
| *** sdake_ has joined #openstack-keystone | 15:11 | |
| *** agireud has joined #openstack-keystone | 15:11 | |
| *** itisha has joined #openstack-keystone | 15:17 | |
| *** sdake has joined #openstack-keystone | 15:18 | |
| *** sdake_ has quit IRC | 15:19 | |
| *** lucas____ has joined #openstack-keystone | 15:19 | |
| *** luca_____ has joined #openstack-keystone | 15:20 | |
| *** pcaruana has quit IRC | 15:22 | |
| *** GB21 has quit IRC | 15:22 | |
| *** anush__ has joined #openstack-keystone | 15:23 | |
| shewless | ayoung: do you remember that bug we were talking about regarding federated login showing the user "id" instead of the user "name" in some cases? | 15:23 |
| *** anush__ has quit IRC | 15:23 | |
| *** GB21 has joined #openstack-keystone | 15:23 | |
| *** lucas____ has quit IRC | 15:24 | |
| *** rcernin has joined #openstack-keystone | 15:24 | |
| mwheckmann | shewless: I thought I saw a commit fixing that. I'll double check later on to see if I'm still affected by it | 15:25 |
| *** luca_____ has quit IRC | 15:25 | |
| *** ebarrera has quit IRC | 15:25 | |
| ayoung | shewless, yep | 15:25 |
| dstanek | walharthi: what kind of tokens are you using? | 15:27 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add project functional tests https://review.openstack.org/332871 | 15:27 |
| walharthi | @dstanek fernet tokens | 15:28 |
| nisha_ | samueldmq, please have a look ^ | 15:28 |
| *** mwheckmann has quit IRC | 15:29 | |
| *** jistr|mtg is now known as jistr | 15:32 | |
| dstanek | walharthi: so you auth to one keystone and try to use the token on the other and get a "could not find token" error message? | 15:32 |
| *** roxanaghe has joined #openstack-keystone | 15:32 | |
| shewless | ayoung, mwheckmann, I'd love to get my hands on that fix if it's been delivered. Is there a ticket number I can use for reference? | 15:33 |
| samueldmq | nisha_: sure, looking | 15:33 |
| walharthi | dstanek Yes. I used k2k to obtain a token from my sp but when I try to use the token, I get the error msg. | 15:34 |
| dstanek | walharthi: do you have sample code to show what you are doing on the client side? | 15:35 |
| *** dan_nguyen has joined #openstack-keystone | 15:35 | |
| *** roxanaghe has quit IRC | 15:36 | |
| *** pcaruana has joined #openstack-keystone | 15:36 | |
| *** timcline has quit IRC | 15:37 | |
| *** timcline has joined #openstack-keystone | 15:37 | |
| *** anush__ has joined #openstack-keystone | 15:41 | |
| *** tonytan4ever has joined #openstack-keystone | 15:41 | |
| *** spandhe has joined #openstack-keystone | 15:42 | |
| *** spandhe_ has joined #openstack-keystone | 15:43 | |
| *** pnavarro has quit IRC | 15:44 | |
| *** stevemar has joined #openstack-keystone | 15:44 | |
| *** ChanServ sets mode: +o stevemar | 15:44 | |
| *** spandhe has quit IRC | 15:47 | |
| *** spandhe_ is now known as spandhe | 15:47 | |
| *** catintheroof has joined #openstack-keystone | 15:49 | |
| *** chlong has quit IRC | 15:50 | |
| *** lucas____ has joined #openstack-keystone | 15:50 | |
| bknudson_ | dstanek: I wrote a sample program that shows logging the request ID using a hook -- https://github.com/brantlk/keystone_samples/blob/master/request_id_hook.py | 15:51 |
| dstanek | bknudson_: nice. | 15:51 |
| *** adu has joined #openstack-keystone | 15:51 | |
| *** lucas____ has quit IRC | 15:52 | |
| bknudson_ | sample output: http://paste.openstack.org/ | 15:52 |
| *** lucas____ has joined #openstack-keystone | 15:52 | |
| stevemar | bknudson_: your link is missing an ID :) | 15:53 |
| walharthi | dstanek http://paste.openstack.org/show/521200/ that's the k2k token client | 15:54 |
| *** lucas____ has quit IRC | 15:54 | |
| *** lucas____ has joined #openstack-keystone | 15:54 | |
| bknudson_ | stevemar: "Could not submit your paste because your paste contains spam." | 15:54 |
| *** roxanaghe has joined #openstack-keystone | 15:54 | |
| bknudson_ | stevemar: dstanek: http://paste.openstack.org/show/521203/ | 15:54 |
| stevemar | bknudson_: you are always spamming things | 15:55 |
| bknudson_ | it's so tasy | 15:55 |
| bknudson_ | tasty | 15:55 |
| shewless | ayoung: do you recall the bug ID? | 15:56 |
| ayoung | https://bugs.launchpad.net/keystone/+bugs?search=Search&field.assignee=ayoung | 15:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 15:58 |
| bknudson_ | dstanek: you can also get the request time: https://github.com/brantlk/keystone_samples/blob/master/request_id_hook.py#L15 | 15:58 |
| bknudson_ | http://paste.openstack.org/show/521204/ | 15:59 |
| *** daemontool has joined #openstack-keystone | 16:00 | |
| *** slberger has joined #openstack-keystone | 16:01 | |
| *** lamt has quit IRC | 16:01 | |
| bknudson_ | I wonder what I'd get from https://review.openstack.org/#/c/261188/ ? I assume it wouldn't give the request IDs for fetching the token that occurs during the user list. | 16:02 |
| patchbot | bknudson_: patch 261188 - python-keystoneclient - Add wrapper classes for return-request-id-to-caller | 16:02 |
| *** dmk0202 has quit IRC | 16:02 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 16:03 |
| bknudson_ | jamielennox: it would be nice if I could pass hooks into ksa Session. | 16:05 |
| walharthi | dstanek that's how the token is obtained using the k2k token client http://paste.openstack.org/show/521205/ . get_scoped_token() actually returns the token body not the id in the newer version | 16:05 |
| bknudson_ | although, I guess I can't pass hooks into requests Session either. | 16:06 |
| bknudson_ | maybe we could have a custom Response object that also has request ID | 16:06 |
| dstanek | walharthi: have you tried my code at all against your setup? i'm curious to know if it works | 16:07 |
| dstanek | bknudson_: what would you do with the response object? | 16:08 |
| *** roxanaghe has quit IRC | 16:08 | |
| bknudson_ | dstanek: would be nice to not require the user to know that the header is 'x-openstack-request-id' ... so hide that by automatically putting it into a .openstack_request_id property | 16:09 |
| bknudson_ | or maybe it could be a kwarg on the callback or something | 16:10 |
| *** roxanaghe has joined #openstack-keystone | 16:11 | |
| *** mwheckmann has joined #openstack-keystone | 16:12 | |
| *** dan_nguyen has quit IRC | 16:12 | |
| dstanek | bknudson_: would it make sense to update my patch do add a ksc hook that returns a response object more like that? basically removing the return values | 16:12 |
| *** gyee has joined #openstack-keystone | 16:13 | |
| *** ChanServ sets mode: +v gyee | 16:13 | |
| walharthi | dstanek yes, I got a 403 (You are not authorized to perform the requested action) | 16:13 |
| bknudson_ | dstanek: if you can make it happen. I thought it would have to happen in keystoneauth and not keystoneclient. | 16:14 |
| *** ddieterly is now known as ddieterly[away] | 16:14 | |
| *** phalmos has quit IRC | 16:14 | |
| *** tonytan4ever has quit IRC | 16:15 | |
| *** links has joined #openstack-keystone | 16:16 | |
| dstanek | bknudson_: you don't want the honors? | 16:19 |
| bknudson_ | dstanek: no, I need to work on other stuff today | 16:19 |
| dstanek | bknudson_: :-) | 16:19 |
| *** ma91 has left #openstack-keystone | 16:19 | |
| dstanek | bknudson_: i'm in the same boat, but i'll see what i can do | 16:20 |
| bknudson_ | don't tell my boss I was messing around with this. | 16:20 |
| *** jaugustine has quit IRC | 16:20 | |
| *** nisha__ has joined #openstack-keystone | 16:21 | |
| *** ddieterly[away] is now known as ddieterly | 16:22 | |
| *** nisha_ has quit IRC | 16:24 | |
| *** nisha__ is now known as nisha_ | 16:25 | |
| * dstanek forgets that this conversation ever happened | 16:25 | |
| nisha_ | samueldmq, you wrote this in comment - Assert project parent is not None, it's always present in v3 | 16:25 |
| nisha_ | can you please explain it a bit | 16:26 |
| *** spandhe has quit IRC | 16:26 | |
| nisha_ | samueldmq, in create project, the attribute parent is optional, and by default gets None value | 16:26 |
| shewless | ayoung: I guess that means you haven't started on https://bugs.launchpad.net/keystone/+bug/1590426. Dumb question: where can I find the code on my openstack install? | 16:28 |
| openstack | Launchpad bug 1590426 in OpenStack Identity (keystone) "Keystone Federated Identity assertion name not included in token" [Undecided,New] - Assigned to Adam Young (ayoung) | 16:28 |
| *** jaugustine has joined #openstack-keystone | 16:32 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:34 |
| *** TxGVNN has quit IRC | 16:37 | |
| *** daemontool has quit IRC | 16:37 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:38 |
| *** links has quit IRC | 16:40 | |
| *** rcernin has quit IRC | 16:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:42 |
| *** pcaruana has quit IRC | 16:43 | |
| *** raddaoui has joined #openstack-keystone | 16:44 | |
| dstanek | shewless: how did you install it? | 16:44 |
| *** mfisch has joined #openstack-keystone | 16:45 | |
| *** mfisch has quit IRC | 16:45 | |
| *** mfisch has joined #openstack-keystone | 16:45 | |
| mfisch | stevemar: dolphm: can we get this backported to Mitaka? | 16:45 |
| mfisch | https://review.openstack.org/#/c/329855/ | 16:45 |
| patchbot | mfisch: patch 329855 - keystone - Correct domain_id and name constraint dropping (MERGED) | 16:45 |
| mfisch | my L->M upgrade breaks because of it | 16:46 |
| mfisch | 2016-06-22 16:41:58.129 1 ERROR keystone OperationalError: (_mysql_exceptions.OperationalError) (1091, "Can't DROP 'ixu_user_name_domain_id'; check that column/key exists") [SQL: u'ALTER TABLE user DROP INDEX ixu_user_name_domain_id'] | 16:46 |
| *** jbell8 has joined #openstack-keystone | 16:46 | |
| *** jaugustine has quit IRC | 16:46 | |
| stevemar | mfisch: i think i asked someone to backport it? | 16:49 |
| stevemar | mfisch: but yeah, do-able | 16:49 |
| mfisch | thats what I was wondering | 16:49 |
| mfisch | its not a 1click BP but if nobody is working on it I can | 16:49 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 16:49 |
| mfisch | i'm about to jump on a plane, so steve I'll let you crack the whip! | 16:49 |
| stevemar | mfisch: oh fun, i'm about to eat lunch, i can look at it after | 16:50 |
| mfisch | ok | 16:50 |
| shewless | dstanek: following the install guide more or less (have some custom ansible playbooks that replicate the install guide). Seeing the code in /usr/lib/pythong2.7/dist-packages/ there is a bunch of keystone stuff. currently looking at the middleware | 16:50 |
| mfisch | flying back to the miserable heat :( | 16:50 |
| stevemar | anyone else want to backport stuff? (so i can still +2 it :) ) | 16:50 |
| stevemar | mfisch: hope dockercon was fun | 16:50 |
| mfisch | yeah it was cool, I have a bunch of new things to play with now. foundation folks were here too | 16:51 |
| mfisch | ok ttyl thanks for the bp help | 16:52 |
| stevemar | mfisch: safe flight | 16:53 |
| *** darosale_ has joined #openstack-keystone | 16:55 | |
| *** spandhe has joined #openstack-keystone | 16:56 | |
| *** darosale has quit IRC | 16:57 | |
| *** darosale_ is now known as darosale | 16:57 | |
| *** josecastroleon has quit IRC | 16:58 | |
| *** isd has joined #openstack-keystone | 17:08 | |
| samueldmq | nisha_: hmm, you're correct | 17:09 |
| *** sdake_ has joined #openstack-keystone | 17:09 | |
| samueldmq | nisha_: in the case it's none, it's still present in the returned entity, isn't it ? | 17:09 |
| nisha_ | samueldmq, yeah | 17:09 |
| *** sdake has quit IRC | 17:10 | |
| *** mvk has quit IRC | 17:11 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 17:11 |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add project functional tests https://review.openstack.org/332871 | 17:12 |
| samueldmq | nisha_: I think it's still set to the domain ID | 17:13 |
| samueldmq | nisha_: try self.assertNotNone(project.parent) and see if it works | 17:13 |
| nisha_ | samueldmq, assertIsNotNone above right | 17:14 |
| nisha_ | samueldmq, I tried it gives error | 17:14 |
| nisha_ | samueldmq, I did the rest of the changes you mentioned in comments | 17:16 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 17:16 |
| samueldmq | nisha_: cool | 17:17 |
| nisha_ | samueldmq, thanks, pushing the changes | 17:17 |
| samueldmq | nisha_: ++ | 17:17 |
| *** rcernin has joined #openstack-keystone | 17:20 | |
| *** phalmos has joined #openstack-keystone | 17:27 | |
| openstackgerrit | Nisha Yadav proposed openstack/python-keystoneclient: Add project functional tests https://review.openstack.org/332871 | 17:28 |
| *** pauloewerton has quit IRC | 17:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 17:29 |
| openstackgerrit | Merged openstack/python-keystoneclient: Improve docs for v3 projects https://review.openstack.org/332747 | 17:29 |
| *** sdake_ has quit IRC | 17:29 | |
| *** henrynash has joined #openstack-keystone | 17:29 | |
| *** ChanServ sets mode: +v henrynash | 17:29 | |
| *** ddieterly is now known as ddieterly[away] | 17:36 | |
| *** pauloewerton has joined #openstack-keystone | 17:38 | |
| samueldmq | dstanek: hi | 17:40 |
| samueldmq | dstanek: what is https://review.openstack.org/#/c/274129? I don't see how cache invalidation is safer with that | 17:40 |
| *** mvk has joined #openstack-keystone | 17:41 | |
| *** daemontool has joined #openstack-keystone | 17:41 | |
| *** daemontool has quit IRC | 17:44 | |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support nested domains to provide addional project namespaces https://review.openstack.org/332940 | 17:44 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support nested domains to provide addional project namespaces https://review.openstack.org/332940 | 17:45 |
| openstackgerrit | henry-nash proposed openstack/keystone-specs: Support nested domains to provide addional project namespaces https://review.openstack.org/332940 | 17:47 |
| *** henrynash has quit IRC | 17:48 | |
| *** henrynash has joined #openstack-keystone | 17:49 | |
| *** ChanServ sets mode: +v henrynash | 17:49 | |
| *** henrynash has quit IRC | 17:50 | |
| *** nisha_ has quit IRC | 17:58 | |
| *** slberger1 has joined #openstack-keystone | 17:59 | |
| *** phalmos has quit IRC | 18:00 | |
| *** slberger has quit IRC | 18:01 | |
| openstackgerrit | Merged openstack/keystone: Fix argument order for assertEqual to (expected, observed) https://review.openstack.org/332729 | 18:02 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 18:03 |
| *** arunkant has quit IRC | 18:03 | |
| *** arunkant has joined #openstack-keystone | 18:06 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 18:09 |
| *** josecastroleon has joined #openstack-keystone | 18:14 | |
| *** browne has joined #openstack-keystone | 18:17 | |
| *** david-lyle has joined #openstack-keystone | 18:19 | |
| *** amoralej is now known as amoralej|off | 18:21 | |
| *** anush__ has quit IRC | 18:22 | |
| *** anush__ has joined #openstack-keystone | 18:23 | |
| *** jbell8 has quit IRC | 18:25 | |
| *** samueldmq has quit IRC | 18:25 | |
| *** anush__ has quit IRC | 18:25 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 18:27 |
| *** phalmos has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Merged openstack/keystone: Change the remaining conf setup to use the fixture https://review.openstack.org/266398 | 18:33 |
| *** ddieterly[away] has quit IRC | 18:36 | |
| *** GB21 has quit IRC | 18:37 | |
| *** slberger1 has quit IRC | 18:37 | |
| shewless | Hello. I'm wondering how to use the openstack client (cli) as a federated user. I think I need a token for that? Can anyone confirm? I tried using the "user-rc.sh" file (I guess password based) from horizon but that doesn't work | 18:42 |
| stevemar | shewless: that's currently a bit "underconstruction" | 18:43 |
| *** josecastroleon has quit IRC | 18:43 | |
| stevemar | shewless: the auth plugins for federation were all tossed into keystoneauth (from keystoneclient) | 18:43 |
| stevemar | shewless: but openstackclient (osc) was still using keystoneclient for all it's auth logic | 18:44 |
| shewless | stevemar: hmm.. what does that mean for Mitaka? | 18:44 |
| stevemar | shewless: if you are willing to try the master branch of osc, we recently (just this week) merged a change to get OSC to use keystoneauth for it's auth logic | 18:44 |
| *** ddieterly has joined #openstack-keystone | 18:45 | |
| *** tonytan4ever has joined #openstack-keystone | 18:45 | |
| dtroyer | I'd be careful here, I'm still in the middle of sorting out all of the crap between ksc/ksa/occ and osc | 18:45 |
| dtroyer | ksc/ksa shold be done | 18:45 |
| stevemar | shewless: for mitaka, your mileage may vary, authenticating as a federated user may work, depends on the plugin | 18:45 |
| stevemar | shewless: i think ECP (from what i read you are using shib right?) should work | 18:46 |
| dtroyer | I'm getting the fallout from that pushed back into osc-lib as we speak, then I have to reconcile all of the things o-c-c has grown in the last month | 18:46 |
| stevemar | just gotta specify the right args | 18:46 |
| shewless | stevemar: I am using shib | 18:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 18:47 |
| *** sdake has joined #openstack-keystone | 18:47 | |
| *** jbell8 has joined #openstack-keystone | 18:47 | |
| stevemar | shewless: you'll have to specify the idp and protocol and possibly more | 18:47 |
| shewless | stevemar: what args do a specify? :) Also I could use the master branch of osc if needed.. that can be installed seperate from openstack anyways right? | 18:47 |
| shewless | stevemar: like say I want to use openstack user list | 18:47 |
| stevemar | shewless: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L106-L123 | 18:48 |
| shewless | stevemar: so I do have to get an unscoped token somehow? | 18:49 |
| stevemar | shewless: i believe so, and then use the token to get a project listing | 18:51 |
| *** slberger has joined #openstack-keystone | 18:51 | |
| shewless | stevemar: do you know where I can do some reading on this? How can I leverage the token in the osc? or can i? | 18:52 |
| *** mvk_ has joined #openstack-keystone | 18:53 | |
| shewless | stevemar: I guess I export OS_TOKEN or something | 18:54 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 18:54 |
| *** sdake_ has joined #openstack-keystone | 18:55 | |
| *** phalmos has quit IRC | 18:55 | |
| *** mvk has quit IRC | 18:55 | |
| *** sdake has quit IRC | 18:58 | |
| *** roxanaghe has quit IRC | 19:00 | |
| *** roxanaghe has joined #openstack-keystone | 19:02 | |
| *** mkrcmari__ has joined #openstack-keystone | 19:02 | |
| *** mvk_ has quit IRC | 19:02 | |
| isd | Hey all. I'm working on integrating keystone's auth middleware into a service, and am trying to debug a script that sets up keystone with some initial data for CI purposes. The script is here: https://github.com/zenhack/haas/blob/keystone-auth/ci/keystone/keystone.sh | 19:03 |
| dstanek | isd: what's the issue? | 19:04 |
| isd | Once I've used that script to set things up, doing an `openstack user list` will intermittently actually list users as expected, or give me an error "Unable to establish connection to http://localhost:5000/v3/auth/tokens", or a similar error for /v3/users | 19:04 |
| isd | I'm at a bit of a loss as to what's going on | 19:05 |
| *** adu has quit IRC | 19:05 | |
| isd | The server's logs report only 200/201 responses. I looked at the traffic with wireshark, and wasn't able to descern any obvious problems, though I have only a very loose familiarity with the HTTP api. | 19:07 |
| stevemar | isd: i think running keystone under uwsgi proper can be flakey if not tuned properly | 19:08 |
| *** samueldmq has joined #openstack-keystone | 19:09 | |
| *** ChanServ sets mode: +v samueldmq | 19:09 | |
| dstanek | isd: sounds like you can't connect to the server. does apache show your connection when you get that error? | 19:09 |
| stevemar | isd: this is the tuning we had to do to make it run in our CI https://github.com/openstack-dev/devstack/blob/e88c51cc1b0aa59abbae353f3fd3c2ef58e1602a/lib/keystone#L304-L342 | 19:09 |
| isd | stevemar: thanks for the reference. I'll stare at that for a bit | 19:11 |
| dstanek | stevemar: aren't those keystone settings? | 19:11 |
| isd | dstanek: It *is* connecting; the server is reporting responses, and wireshark agrees. Whatever it's on about it isn't talking about TCP. | 19:12 |
| stevemar | dstanek: they don't look keystone-y to me | 19:12 |
| isd | It does look like it's mucking with keystone.conf | 19:13 |
| stevemar | it should be mucking around with: KEYSTONE_PUBLIC_UWSGI_FILE | 19:13 |
| stevemar | and KEYSTONE_ADMIN_UWSGI_FILE | 19:13 |
| isd | Err, yeah, you're right, nevermind | 19:13 |
| *** ddieterly is now known as ddieterly[away] | 19:13 | |
| stevemar | isd: anywho, all of that is for the case where you are running *just* uwsgi (which I think you're doing) and not uwsgi+apache | 19:14 |
| *** mkrcmari__ has quit IRC | 19:15 | |
| isd | stevemar: correct | 19:15 |
| isd | which, honestly, I'm only doing because that's what the page I reference at the top of the script was doing. I have no attachment to uwsgi | 19:16 |
| dstanek | isd: oh, you're not running apache at all? | 19:16 |
| stevemar | isd: try looking at those settings, IIRC we were getting weird 401s when we had our CI running without them | 19:16 |
| *** mvk has joined #openstack-keystone | 19:16 | |
| *** real56 has quit IRC | 19:16 | |
| stevemar | isd: running under apache has given the best results | 19:16 |
| *** timcline has quit IRC | 19:16 | |
| dstanek | stevemar: isd's issue seems to be that the server just isn't responding on the port. | 19:17 |
| isd | dstanek: no, that's not the case | 19:17 |
| stevemar | dstanek: "doing an `openstack user list` will intermittently actually list users as expected, or give me an error" | 19:17 |
| dstanek | isd: i thought you said you were getting an "unable to establish connection" | 19:17 |
| isd | the above is the message the cli is printing, but it *is* making a tcp connection, and an http request, and getting a (200 or 201) response | 19:18 |
| dstanek | that's a "server not there" error | 19:18 |
| *** josecastroleon has joined #openstack-keystone | 19:18 | |
| isd | So, crappy error message maybe, but wireshark makes it pretty clear it's not a simple connection issue. | 19:18 |
| dstanek | isd: so the server is returning 2xx responses and keystoneclient is choking on them? | 19:19 |
| *** tqtran has joined #openstack-keystone | 19:19 | |
| isd | dstanek: as far as I can tell | 19:19 |
| dstanek | isd: just make sure you see a server log entry for each response. just because you only see 2xx doesn't mean your calls are successful | 19:19 |
| tqtran | gm everyone, when one of you have time, could you briefly take a look at https://review.openstack.org/#/c/331788/2 ? we updating the rc download file and would love to have some keystone input. | 19:20 |
| patchbot | tqtran: patch 331788 - horizon - Add valuable exports to openstack RC file download | 19:20 |
| tqtran | whoa.... awesome | 19:20 |
| *** jamielennox is now known as jamielennox|away | 19:21 | |
| isd | hmm, I'm looking actually, and the one that gives an error about /v3/users never actually grabs that, page, just /v3/ and /v3/auth/tokens. it probably is some kind of connection issue, which points to uwsgi as the problem. I will stare at that config a bit. | 19:21 |
| isd | I know we're also already talking about sticking apache into the ci for other reasons, I'll talk with the folks working on that to see if we can't de-dup some effort. | 19:21 |
| isd | Thanks for your help. I'll speak up if I have further questions. | 19:22 |
| stevemar | tqtran: aren't interface and auth_type similar o_O | 19:22 |
| stevemar | i thought we deprecated one | 19:22 |
| *** tonytan4ever has quit IRC | 19:22 | |
| stevemar | oh wait, auth_type is password or token or etc... | 19:24 |
| stevemar | interface and endpoint_type** | 19:24 |
| shewless | Hey guys, I'm trying this to get an unscoped token.. but I'm getting a 302 error.. I think it's because my IDP is redirecting me to a webpage to enter the username and password... Is there anyway for me to pass that info along in curl. I'm using this now: curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth | 19:24 |
| stevemar | tqtran: "To get url using service catalog endpoint_type parameter was changed to interface:" | 19:25 |
| *** sheel has quit IRC | 19:25 | |
| *** spzala has joined #openstack-keystone | 19:26 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 19:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Delegation parent discovery function https://review.openstack.org/330573 | 19:28 |
| tqtran | stevemar: thanks steve! | 19:29 |
| stevemar | tqtran: np | 19:29 |
| *** sdake has joined #openstack-keystone | 19:31 | |
| *** sdake_ has quit IRC | 19:33 | |
| *** ddieterly[away] is now known as ddieterly | 19:37 | |
| *** ddieterly is now known as ddieterly[away] | 19:38 | |
| *** josecastroleon has quit IRC | 19:47 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Pre-cache new tokens https://review.openstack.org/309146 | 19:48 |
| *** lucas____ has quit IRC | 19:48 | |
| *** timcline has joined #openstack-keystone | 19:50 | |
| *** mwheckmann has quit IRC | 19:50 | |
| *** mwheckmann has joined #openstack-keystone | 19:51 | |
| *** lucas____ has joined #openstack-keystone | 19:51 | |
| *** lucas____ has quit IRC | 19:52 | |
| *** rderose has quit IRC | 19:58 | |
| *** sdake_ has joined #openstack-keystone | 20:01 | |
| *** mvk_ has joined #openstack-keystone | 20:01 | |
| *** samueldmq has quit IRC | 20:04 | |
| isd | stevemar: I copied some of those settings, and it seems to be working now. thank you very much. | 20:04 |
| *** sdake has quit IRC | 20:04 | |
| *** mvk has quit IRC | 20:05 | |
| *** browne has quit IRC | 20:05 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone-specs: Complete RBAC in keystone https://review.openstack.org/325326 | 20:08 |
| stevemar | isd: de nada | 20:09 |
| stevemar | mfisch: i backported that change for you | 20:09 |
| stevemar | mfisch: https://review.openstack.org/#/c/332994/ | 20:10 |
| patchbot | stevemar: patch 332994 - keystone (stable/mitaka) - Correct domain_id and name constraint dropping | 20:10 |
| *** lucas____ has joined #openstack-keystone | 20:10 | |
| stevemar | helping people ate up my day, i will review patches tomorrow o_O | 20:10 |
| *** ddieterly[away] is now known as ddieterly | 20:10 | |
| *** stevemar has quit IRC | 20:14 | |
| *** lucas____ has quit IRC | 20:14 | |
| *** stevemar has joined #openstack-keystone | 20:14 | |
| *** ChanServ sets mode: +o stevemar | 20:14 | |
| *** henrynash has joined #openstack-keystone | 20:16 | |
| *** ChanServ sets mode: +v henrynash | 20:16 | |
| *** rderose has joined #openstack-keystone | 20:17 | |
| *** stevemar has quit IRC | 20:19 | |
| *** mwheckmann has quit IRC | 20:19 | |
| *** adu has joined #openstack-keystone | 20:22 | |
| *** rderose has quit IRC | 20:24 | |
| *** amakarov is now known as amakarov_away | 20:26 | |
| *** browne has joined #openstack-keystone | 20:29 | |
| *** sdake_ has quit IRC | 20:34 | |
| *** rderose has joined #openstack-keystone | 20:34 | |
| *** jbell8 has quit IRC | 20:39 | |
| *** josecastroleon has joined #openstack-keystone | 20:45 | |
| *** spandhe has quit IRC | 20:48 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Disable inactive users requirements https://review.openstack.org/328447 | 20:50 |
| *** spandhe has joined #openstack-keystone | 20:50 | |
| *** jbell8 has joined #openstack-keystone | 20:54 | |
| *** stevemar has joined #openstack-keystone | 20:54 | |
| *** ChanServ sets mode: +o stevemar | 20:54 | |
| *** BigWillie has quit IRC | 20:54 | |
| *** spandhe has quit IRC | 20:55 | |
| *** rderose has quit IRC | 20:59 | |
| *** ddieterly is now known as ddieterly[away] | 21:01 | |
| *** spandhe has joined #openstack-keystone | 21:01 | |
| *** pauloewerton has quit IRC | 21:05 | |
| *** isd has left #openstack-keystone | 21:05 | |
| *** ddieterly[away] is now known as ddieterly | 21:05 | |
| *** julim has quit IRC | 21:05 | |
| *** yolanda has quit IRC | 21:06 | |
| *** pushkaru has joined #openstack-keystone | 21:11 | |
| *** josecastroleon has quit IRC | 21:15 | |
| *** edtubill has quit IRC | 21:19 | |
| *** timcline_ has joined #openstack-keystone | 21:26 | |
| *** sdake has joined #openstack-keystone | 21:28 | |
| *** yolanda has joined #openstack-keystone | 21:29 | |
| *** timcline has quit IRC | 21:29 | |
| *** roxanaghe has quit IRC | 21:34 | |
| *** roxanaghe has joined #openstack-keystone | 21:35 | |
| *** yolanda has quit IRC | 21:36 | |
| *** sdake_ has joined #openstack-keystone | 21:38 | |
| *** sdake has quit IRC | 21:39 | |
| *** henrynash has quit IRC | 21:39 | |
| *** rderose has joined #openstack-keystone | 21:39 | |
| *** walharthi has quit IRC | 21:40 | |
| *** itisha has quit IRC | 21:40 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 21:40 | |
| *** pushkaru has quit IRC | 21:44 | |
| *** anush__ has joined #openstack-keystone | 21:45 | |
| *** spzala has quit IRC | 21:48 | |
| *** jamielennox|away is now known as jamielennox | 21:48 | |
| *** spzala has joined #openstack-keystone | 21:48 | |
| *** ametts has quit IRC | 21:50 | |
| *** anush__ has quit IRC | 21:52 | |
| *** spzala has quit IRC | 21:53 | |
| *** anush__ has joined #openstack-keystone | 21:53 | |
| jamielennox | bknudson_: what would you want to do with hooks in ksa? | 21:55 |
| bknudson_ | jamielennox: make the request ID available. | 21:55 |
| jamielennox | bknudson_: why would you need to hook session for that? | 21:56 |
| bknudson_ | jamielennox: what's the alternative? | 21:56 |
| bknudson_ | to hooking session | 21:56 |
| *** tqtran has quit IRC | 21:56 | |
| *** spzala has joined #openstack-keystone | 21:57 | |
| jamielennox | bknudson_: session returns a requests.Response object, so request-id is found by resp.headers['X-OpenStack-Request-id'] | 21:57 |
| jamielennox | (i think that's the header name) | 21:58 |
| bknudson_ | what if there were multiple responses for a call? (for example, if re-auth has to happen) | 21:58 |
| jamielennox | so you won't get the auth resquest info - but are you interested in that? after the reauth the same request should be resubmitted with the same info | 22:01 |
| bknudson_ | if there's a failure I want to be able to match the ID from the request with the ID in the logs | 22:01 |
| *** adu has quit IRC | 22:02 | |
| bknudson_ | I also don't want to have to change every return in the keystoneclient | 22:02 |
| bknudson_ | and every other client | 22:03 |
| *** samueldmq has joined #openstack-keystone | 22:03 | |
| *** ChanServ sets mode: +v samueldmq | 22:03 | |
| *** anush__ has quit IRC | 22:05 | |
| jamielennox | i'm not sure you can get around changing the clients -they're stupidly broken | 22:06 |
| *** lucas____ has joined #openstack-keystone | 22:06 | |
| jamielennox | umm, i guess we could add a hook to request() | 22:06 |
| bknudson_ | that's what this does: https://github.com/brantlk/keystone_samples/blob/master/request_id_hook.py | 22:06 |
| bknudson_ | we should be able to have a library that hides the detail of the "x-openstack-request-id" header. | 22:07 |
| jamielennox | bknudson_: so if you add it to the session like that you would get it for every client that reused that session | 22:07 |
| jamielennox | is that the plan? | 22:07 |
| bknudson_ | yes! | 22:07 |
| jamielennox | like that would let you as a user track it, but isn't a good idea for doing on a per-client basis | 22:08 |
| *** slberger has quit IRC | 22:08 | |
| bknudson_ | I think I'd just have separate sessions if I wanted different session config. | 22:08 |
| jamielennox | as a user maybe, but it doesn't give you a solution for keystoneclient | 22:09 |
| jamielennox | or other clients | 22:09 |
| jamielennox | you can't have keystoneclient adding hooks to a global session object because it will pick up more things than just that client's requests | 22:09 |
| bknudson_ | why not? I can see all the requests that are made including the request IDs. | 22:09 |
| bknudson_ | oh, I don't want keystoneclient to add hooks. | 22:09 |
| jamielennox | but we've done this for other things in like a cascading fashion, have session global hooks, have adapter hooks for clients and per request hooks and just join them together | 22:10 |
| bknudson_ | I'm wondering if ksa can modify the hook | 22:10 |
| bknudson_ | right. | 22:10 |
| jamielennox | bknudson_: modify? | 22:10 |
| *** lucas____ has quit IRC | 22:11 | |
| *** ddieterly is now known as ddieterly[away] | 22:11 | |
| bknudson_ | I think what I'd like is, I should be able to add a response hook to the ksa Session, and when the callback is called, the request also has an openstack_request_id field. | 22:11 |
| bknudson_ | so in my example program: https://github.com/brantlk/keystone_samples/blob/master/request_id_hook.py | 22:12 |
| bknudson_ | in log_request, I can do r.openstack_request_id | 22:12 |
| bknudson_ | instead of r.headers.get('x-openstack-request-id') | 22:12 |
| bknudson_ | Not that big of an improvement, I guess. | 22:13 |
| bknudson_ | but the point of libraries is to make it so I don't have to remember things like x-auth-token and x-openstack-request-id. | 22:13 |
| jamielennox | bknudson_: so i don't think requests (unlike webob) lets you override the responseclass | 22:13 |
| jamielennox | would need to check | 22:13 |
| bknudson_ | it could also be a kwarg? | 22:13 |
| *** lucas____ has joined #openstack-keystone | 22:13 | |
| jamielennox | bknudson_: i don't want to open it as a user provided thing, but i'd be happy to subclass requests.Response with a ksa.Response | 22:14 |
| bknudson_ | that would be cool | 22:14 |
| *** browne1 has joined #openstack-keystone | 22:14 | |
| *** browne has quit IRC | 22:15 | |
| *** lucas____ has quit IRC | 22:18 | |
| jamielennox | bknudson_: so there's no current way to specify the class, and the response object is built from the adapter level which will make it hard to change | 22:19 |
| jamielennox | bknudson_: so i don't think we can do a subclass | 22:19 |
| bknudson_ | :( | 22:20 |
| jamielennox | however, the hook part i'd be ok with | 22:20 |
| jamielennox | hook_cb(request, response) ? | 22:20 |
| bknudson_ | it could be like ksa_session.session.hooks = {'openstack_response': log_request} ? | 22:21 |
| *** sdake has joined #openstack-keystone | 22:21 | |
| *** roxanaghe has quit IRC | 22:21 | |
| bknudson_ | requests only defines the one hook as far as I can tell | 22:21 |
| bknudson_ | the response already includes the request | 22:22 |
| *** jorge_munoz has quit IRC | 22:22 | |
| *** roxanaghe has joined #openstack-keystone | 22:22 | |
| dstanek | samueldmq: howdy | 22:22 |
| *** topol has quit IRC | 22:22 | |
| samueldmq | dstanek: hi | 22:22 |
| jamielennox | bknudson_: i don't think we would piggyback on the requests session | 22:22 |
| dstanek | samueldmq: you bailed earlier before i got to answer you | 22:22 |
| jamielennox | btw you can provide a requests.session to a ksa.session | 22:23 |
| jamielennox | r = requests.Session() | 22:23 |
| jamielennox | k = keystoneauth1.Session(session=r) | 22:23 |
| samueldmq | dstanek: ah, my IRC bouncer is down, sorry | 22:23 |
| bknudson_ | jamielennox: I did that https://github.com/brantlk/keystone_samples/commit/79e6df68585826340179c977904c0cc5358b3c04 | 22:23 |
| samueldmq | dstanek: it was about the cache invalidation thing iirc | 22:23 |
| jamielennox | so if the requests hooks are sufficient you can use them | 22:23 |
| bknudson_ | I thought this was better | 22:23 |
| dstanek | samueldmq: the goal of that cache invalidation patch was to shield us from any exceptions that happen when calling invalidate | 22:23 |
| *** slberger has joined #openstack-keystone | 22:24 | |
| bknudson_ | jamielennox: I was worried I'd miss any requests that happen on ksa.Session creation but there weren't any. | 22:24 |
| jamielennox | bknudson_: ok, i just mean that we would do our own hooking mechanism above requests | 22:24 |
| dstanek | samueldmq: i notice you've been looking at some of my older patches. not sure if you noticed, but i've been slowly getting them updated | 22:24 |
| bknudson_ | jamielennox: our own hooking mechanism works. | 22:24 |
| *** sdake_ has quit IRC | 22:24 | |
| jamielennox | bknudson_: no session is only triggered on request | 22:24 |
| samueldmq | dstanek: hmm, so we wouldn't need to try/expect for cache invalidate/notifications ( we had a patch for that ) | 22:25 |
| jamielennox | ok, so the only thing i would want to fix there is to do our own requests.Request.prepare_request() stuff in ksa | 22:25 |
| samueldmq | dstanek: yes, I am seeing you're updating them; I am just sticking -1's with minor comments/suggestions | 22:25 |
| jamielennox | so that the hook interface had a request object instead of all the parameters it works with currently | 22:25 |
| samueldmq | dstanek: so I clean them up from my review list; you have a great amount of great things needing an update :) | 22:26 |
| jamielennox | bknudson_: i tried that once before and there was an issue i got fixed upstream, so that should be ok now | 22:26 |
| dstanek | samueldmq: don't i know it :-( | 22:26 |
| samueldmq | dstanek: it's great you're updating them, they're all great stuff, you will get that list empty soon :) | 22:29 |
| *** BjoernT has quit IRC | 22:30 | |
| *** sdake_ has joined #openstack-keystone | 22:31 | |
| *** sdake has quit IRC | 22:34 | |
| *** ddieterly[away] is now known as ddieterly | 22:34 | |
| *** darosale has quit IRC | 22:37 | |
| *** slberger has left #openstack-keystone | 22:37 | |
| *** samueldmq has quit IRC | 22:38 | |
| *** jamielennox is now known as jamielennox|away | 22:44 | |
| *** sdake_ has quit IRC | 22:49 | |
| *** timcline_ has quit IRC | 22:51 | |
| *** timcline has joined #openstack-keystone | 22:52 | |
| *** dan_nguyen has joined #openstack-keystone | 22:53 | |
| *** jamielennox|away is now known as jamielennox | 22:53 | |
| *** tqtran has joined #openstack-keystone | 22:54 | |
| *** timcline has quit IRC | 22:56 | |
| *** ddieterly is now known as ddieterly[away] | 22:57 | |
| *** tqtran has quit IRC | 22:58 | |
| *** rcernin has quit IRC | 23:00 | |
| *** jamielennox is now known as jamielennox|away | 23:05 | |
| *** stevemar has quit IRC | 23:06 | |
| *** stevemar has joined #openstack-keystone | 23:06 | |
| *** ChanServ sets mode: +o stevemar | 23:06 | |
| *** stevemar has quit IRC | 23:11 | |
| *** gyee has quit IRC | 23:11 | |
| *** edmondsw has quit IRC | 23:15 | |
| *** lucas____ has joined #openstack-keystone | 23:15 | |
| *** KevinE_ has joined #openstack-keystone | 23:16 | |
| *** KevinE_ has quit IRC | 23:18 | |
| *** lucas____ has quit IRC | 23:19 | |
| *** KevinE has quit IRC | 23:19 | |
| *** lucas____ has joined #openstack-keystone | 23:22 | |
| *** luca_____ has joined #openstack-keystone | 23:23 | |
| *** lucas____ has quit IRC | 23:24 | |
| *** sdake has joined #openstack-keystone | 23:24 | |
| *** samueldmq has joined #openstack-keystone | 23:26 | |
| *** ChanServ sets mode: +v samueldmq | 23:26 | |
| *** luca_____ has quit IRC | 23:28 | |
| *** iurygregory_ has joined #openstack-keystone | 23:29 | |
| *** lucas____ has joined #openstack-keystone | 23:30 | |
| *** lucas____ has quit IRC | 23:35 | |
| *** catintheroof has quit IRC | 23:35 | |
| *** lucas____ has joined #openstack-keystone | 23:35 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystonemiddleware: Config: no need to set default=None By default https://review.openstack.org/333068 | 23:41 |
| *** sdake has quit IRC | 23:42 | |
| *** lucas____ has quit IRC | 23:43 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/keystonemiddleware: Config: no need to set default=None https://review.openstack.org/333068 | 23:44 |
| *** dan_nguyen has quit IRC | 23:47 | |
| *** ddieterly has joined #openstack-keystone | 23:48 | |
| *** sheel has joined #openstack-keystone | 23:55 | |
| *** jamielennox|away is now known as jamielennox | 23:57 | |
| *** stevemar has joined #openstack-keystone | 23:59 | |
| *** ChanServ sets mode: +o stevemar | 23:59 | |
| *** tqtran has joined #openstack-keystone | 23:59 | |
| *** lmiccini has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!