| *** markvoelker has quit IRC | 00:01 | |
| *** markvoelker has joined #openstack-keystone | 00:02 | |
| *** markvoelker has quit IRC | 00:02 | |
| *** markvoelker has joined #openstack-keystone | 00:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Remove the sample config from the git tree https://review.openstack.org/335236 | 00:04 |
|---|---|---|
| *** fangxu has quit IRC | 00:13 | |
| *** edmondsw has quit IRC | 00:19 | |
| *** jefrite has joined #openstack-keystone | 00:27 | |
| *** julim has quit IRC | 00:27 | |
| *** tqtran has quit IRC | 00:34 | |
| *** fangxu has joined #openstack-keystone | 00:43 | |
| *** spzala has joined #openstack-keystone | 01:01 | |
| *** spzala has quit IRC | 01:06 | |
| stevemar | anyone want to punt https://review.openstack.org/#/c/330822/2 through? | 01:10 |
| patchbot | stevemar: patch 330822 - keystone - Use request.params instead of context['query_string'] | 01:10 |
| *** mwheckmann has joined #openstack-keystone | 01:17 | |
| *** gabriel-bezerra has quit IRC | 01:18 | |
| *** ericksonsantos has quit IRC | 01:18 | |
| *** clenimar has quit IRC | 01:18 | |
| *** iurygregory has quit IRC | 01:18 | |
| *** openstack has joined #openstack-keystone | 01:22 | |
| *** raildo is now known as raildo-afk | 01:27 | |
| *** raildo-afk is now known as raildo | 01:27 | |
| *** ddieterly has quit IRC | 01:28 | |
| *** EinstCrazy has joined #openstack-keystone | 01:30 | |
| *** ericksonsantos has joined #openstack-keystone | 01:30 | |
| *** clenimar has joined #openstack-keystone | 01:30 | |
| *** tqtran has joined #openstack-keystone | 01:31 | |
| *** iurygregory has joined #openstack-keystone | 01:31 | |
| jamielennox | i probably shouldn't | 01:31 |
| *** gabriel-bezerra has joined #openstack-keystone | 01:33 | |
| *** wangqun has joined #openstack-keystone | 01:34 | |
| ayoung | stevemar, jamielennox I'll look | 01:35 |
| *** tqtran has quit IRC | 01:36 | |
| ayoung | I like +2ing things | 01:36 |
| ayoung | jamielennox, what is host = urllib.parse.unquote_plus(origin) | 01:37 |
| jamielennox | ayoung: unquote_plus? | 01:38 |
| ayoung | jamielennox, yeah, was buried in that review | 01:39 |
| *** woodster_ has quit IRC | 01:39 | |
| notmorgan | jamielennox: some in-line comments +3 though | 01:39 |
| ayoung | I it just looks weird. It was in the origian | 01:39 |
| notmorgan | cc stevemar ^ | 01:39 |
| jamielennox | ayoung: Like unquote(), but also replace plus signs by spaces, as required for unquoting HTML form values. | 01:39 |
| ayoung | ah | 01:39 |
| jamielennox | makes sense | 01:39 |
| jamielennox | if that was in the review though it just got moved around | 01:40 |
| jamielennox | notmorgan: thanks | 01:40 |
| notmorgan | jamielennox: but the in-line comments should be looked at and addressed in a followup | 01:40 |
| ayoung | jamielennox, have all the changes gone through for is_admin_project getting exposed to the services? | 01:40 |
| notmorgan | mostly comments and fix your OMG WHY ARE WR WRITING TO THE DICT note | 01:40 |
| jamielennox | ayoung: no, i still need someone core on oslo.context to approve the patch there | 01:41 |
| ayoung | gah | 01:41 |
| jamielennox | notmorgan: i replied to the comments from stevemar which overlap yours | 01:41 |
| ayoung | OK...I'll beat people up on that | 01:41 |
| notmorgan | hehe | 01:41 |
| jamielennox | but i can do the fixups in code | 01:41 |
| notmorgan | yeah. the pop one - just a cleanup/less code ifyou use pop(key, default) | 01:42 |
| jamielennox | oh, the dict one - i've got no idea on that | 01:42 |
| notmorgan | jamielennox: yeah we should work on fixing that | 01:42 |
| jamielennox | it's either to prevent some subtle bug, or just a really dumb way to do things | 01:42 |
| notmorgan | we should never write to the QS. | 01:42 |
| notmorgan | in fact, we should make params a frozen object | 01:43 |
| jamielennox | and those two things are hard to distinguish | 01:43 |
| notmorgan | if we need domain_id passed through, pass it through directly, don't rely on QS state that was munged with after the request was parsed. | 01:43 |
| jamielennox | ayoung: have you had a chance to look at the olso.policy side of that and figure out what you want the rule to look like? | 01:45 |
| ayoung | jamielennox, I figured just is_admin_project=True | 01:45 |
| jamielennox | it'll work like that? | 01:46 |
| ayoung | have not tested it, but there is not a way to specify namespace for context, I think it works by default | 01:46 |
| ayoung | jamielennox, to be honest, I'll run it in the debugger once it merges and look | 01:46 |
| ayoung | jamielennox, lets look at another rule for comparison | 01:47 |
| jamielennox | ayoung: that's been my thing as well | 01:47 |
| *** ddieterly has joined #openstack-keystone | 01:47 | |
| jamielennox | passing a bool should be really simple to use, but i'm not really up to date on my policy language | 01:47 |
| jamielennox | and i don't konw who to bug from oslo | 01:48 |
| *** dan_nguyen has joined #openstack-keystone | 01:48 | |
| jamielennox | ayoung: did you get a saml env up? | 01:48 |
| ayoung | jamielennox, I'm in TripHellO land with that | 01:49 |
| jamielennox | ayoung: i spent like a full day on messing with ansible and cannot figure out how to install ipsilon, ipa, and keystone in apache on the same box | 01:49 |
| ayoung | really? | 01:49 |
| ayoung | that does not seem like it would be too bad | 01:49 |
| ayoung | do Keystone last | 01:49 |
| *** TxGVNN has joined #openstack-keystone | 01:49 | |
| jamielennox | i know how to do it, but using the ipa-server-install and ipsilon-install just polute the crap out of apache configs | 01:49 |
| ayoung | Nah | 01:50 |
| jamielennox | like those things should know how to co-exist | 01:50 |
| ayoung | all Keystone needs beyond that is 2 files for virtual envs | 01:50 |
| ayoung | they are on separate ports, should not touch any other config | 01:50 |
| jamielennox | ipa and ipsilon don't do vhosts | 01:50 |
| ayoung | Does not matter | 01:50 |
| ayoung | let them do what they want | 01:50 |
| ayoung | then run Keystone on 5000 and 35357 | 01:51 |
| *** dan_nguyen has quit IRC | 01:51 | |
| ayoung | you only need a vhost for them, leave IPA and Ipsilon as-is | 01:51 |
| notmorgan | jamielennox: docker! | 01:53 |
| jamielennox | won't that end up with everything exposed on all ports? | 01:53 |
| jamielennox | notmorgan: yea, if i worked for redhat having a dockerized ipa and ipsilon would be on my priorities i think... | 01:53 |
| ayoung | jamielennox, nope...I can past the ones from the tripleo install one sec | 01:53 |
| ayoung | jamielennox, http://paste.openstack.org/show/523872/ | 01:54 |
| notmorgan | jamielennox: if ipa/ipsilon only occupy port 80/443 in the vhost, then no. | 01:54 |
| ayoung | jamielennox, try that | 01:54 |
| *** mwheckmann has quit IRC | 01:54 | |
| notmorgan | ayoung: don't you need a listen directive too somewhere? | 01:55 |
| ayoung | notmorgan, yep. We put it in | 01:55 |
| notmorgan | or is vhost with a port implicit listen? | 01:55 |
| ayoung | /etc/httpd/conf/ports.conf | 01:55 |
| ayoung | Listen 192.0.2.1:35357 | 01:55 |
| ayoung | Listen 192.0.2.1:5000 | 01:55 |
| ayoung | Listen 80 | 01:55 |
| ayoung | Listen 8042 | 01:55 |
| ayoung | Let me see what the IPA server has | 01:55 |
| ayoung | nss.conf has Listen 443 | 01:57 |
| ayoung | so I think it can go anywhere. Put it at the top of | 01:57 |
| ayoung | /etc/httpd/conf.d/10-keystone_wsgi_admin.conf | 01:57 |
| *** mwheckmann has joined #openstack-keystone | 01:59 | |
| jamielennox | ok, i'll have another look at that | 02:01 |
| jamielennox | this is where i started talking you about official ansible stuff for deploying IPA | 02:02 |
| *** EinstCra_ has joined #openstack-keystone | 02:02 | |
| *** spzala has joined #openstack-keystone | 02:03 | |
| *** ddieterly has quit IRC | 02:04 | |
| *** davechen has joined #openstack-keystone | 02:05 | |
| *** EinstCrazy has quit IRC | 02:05 | |
| *** shewless has quit IRC | 02:06 | |
| *** spzala has quit IRC | 02:08 | |
| ayoung | jamielennox, is there such a beast? | 02:13 |
| *** fangxu has quit IRC | 02:13 | |
| ayoung | I know the RH CI team is starting o check roles into individual repos, complete with setuptool support | 02:14 |
| ayoung | https://github.com/redhat-openstack/ansible-role-tripleo-inventory for example is the inventory | 02:14 |
| openstackgerrit | Merged openstack/keystone: Revert "Install necessary files in etc/" https://review.openstack.org/326152 | 02:19 |
| ayoung | jamielennox, wrote this a long time ago...not sure if you would find it helpful http://adam.younglogic.com/2014/04/nss-horizon/ | 02:20 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 02:20 |
| jamielennox | ayoung: sorry, was elsewhere | 02:20 |
| jamielennox | ayoung: no there is no such beast - i would like there to be though | 02:20 |
| ayoung | jamielennox, NP...I'm kindof in and out | 02:21 |
| ayoung | jamielennox, that is what I am saying...write it as a stand alone role | 02:21 |
| ayoung | they end up putting the roles under /usr/local/share/ansible/roles and there is a config option that you set that tells ansible to look for roles there | 02:22 |
| jamielennox | ayoung: so ipsilon would probably be not that hard because ipsilon-install is not that complicated | 02:23 |
| jamielennox | ayoung: ipa install would be difficult and it would really need to be maintained by someone close to it | 02:23 |
| ayoung | yeah | 02:23 |
| ayoung | the thing about IPA is the need for a FQDN that resolves | 02:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 02:24 |
| ayoung | undercloud.ayoung-dell-t1700.test | 02:24 |
| jamielennox | ayoung: you can always just make that required to the role | 02:24 |
| jamielennox | or default to ansible_fqdn | 02:24 |
| ayoung | yeah...and script the conversion form FQDN to REALM for IPA | 02:25 |
| ayoung | beyond that, IPA install is pretty easy | 02:25 |
| jamielennox | yea, that's not hard to do | 02:25 |
| ayoung | http://adam.younglogic.com/2015/06/install-freeipa-ansible/ | 02:25 |
| jamielennox | ayoung: there is a lot of apache config and stuff that gets dropped | 02:26 |
| jamielennox | ayoung: then theres dogtag conf which means java, and other stuff | 02:26 |
| jamielennox | and figuring out how to scale it, like LDAP on a different box | 02:26 |
| ayoung | yeah, but ipa-server-install covers all that | 02:26 |
| ayoung | the Java stuff comes in via packagin | 02:26 |
| ayoung | replication is part of IPA | 02:26 |
| jamielennox | in my mind this is a replacement for ipa-server-install | 02:27 |
| ayoung | Heh | 02:27 |
| jamielennox | hence, difficult | 02:27 |
| ayoung | You don't have enough time to redo that | 02:27 |
| jamielennox | ayoung: right, and it's pointless unless someone from the IPA team is maintaining it | 02:27 |
| ayoung | Just earlier today I said "I wonder what IPA server install would look like if we started it today. Probably be in ansible": | 02:27 |
| ayoung | jamielennox, look in email at the thread titled Re: [openstack-dev] [cinder] [keystone] cinder quota behavior differences after Keystone mitaka upgrade | 02:29 |
| ayoung | I think it might be a context issue? | 02:29 |
| ayoung | nah, forget it | 02:29 |
| ayoung | not in the token not oslo-context | 02:29 |
| jamielennox | looking at -dev is on my immediate todo :) | 02:30 |
| jamielennox | there's a message there about the cross project policy that i haven't seen to and procrastinating on | 02:30 |
| jamielennox | ayoung: sigh, yea, that seems like we broke an API | 02:31 |
| *** raddaoui has joined #openstack-keystone | 02:32 | |
| jamielennox | but i think it might be something cinder has to figure out | 02:34 |
| *** spzala has joined #openstack-keystone | 02:34 | |
| *** code-R has joined #openstack-keystone | 02:37 | |
| *** sheel has joined #openstack-keystone | 02:48 | |
| *** bj0rnar has quit IRC | 02:48 | |
| openstackgerrit | Merged openstack/keystone: Use request.params instead of context['query_string'] https://review.openstack.org/330822 | 02:48 |
| *** bj0rnar has joined #openstack-keystone | 02:50 | |
| *** gyee has quit IRC | 03:02 | |
| *** jamielennox is now known as jamielennox|away | 03:07 | |
| *** jamielennox|away is now known as jamielennox | 03:07 | |
| *** rderose has quit IRC | 03:09 | |
| *** richm has quit IRC | 03:15 | |
| *** rderose has joined #openstack-keystone | 03:15 | |
| *** diazjf has joined #openstack-keystone | 03:22 | |
| *** diazjf has quit IRC | 03:24 | |
| *** imcsk8 has quit IRC | 03:26 | |
| *** imcsk8 has joined #openstack-keystone | 03:26 | |
| *** diazjf has joined #openstack-keystone | 03:26 | |
| *** tqtran has joined #openstack-keystone | 03:32 | |
| *** mwheckmann has quit IRC | 03:33 | |
| *** TxGVNN has quit IRC | 03:35 | |
| *** tqtran has quit IRC | 03:36 | |
| *** spzala has quit IRC | 03:42 | |
| *** spzala has joined #openstack-keystone | 03:43 | |
| *** rderose has quit IRC | 03:43 | |
| *** spzala has quit IRC | 03:47 | |
| *** diazjf has quit IRC | 03:49 | |
| *** TxGVNN has joined #openstack-keystone | 03:58 | |
| *** roxanaghe has joined #openstack-keystone | 04:00 | |
| *** gnuoy has quit IRC | 04:01 | |
| *** links has joined #openstack-keystone | 04:22 | |
| *** roxanaghe has quit IRC | 04:26 | |
| *** dan_nguyen has joined #openstack-keystone | 04:28 | |
| *** markvoelker has quit IRC | 04:31 | |
| *** code-R has quit IRC | 04:34 | |
| *** dan_nguyen has quit IRC | 04:35 | |
| *** spzala has joined #openstack-keystone | 04:43 | |
| *** spzala has quit IRC | 04:48 | |
| *** browne has quit IRC | 04:50 | |
| *** rcernin has joined #openstack-keystone | 04:53 | |
| *** pcaruana has quit IRC | 04:58 | |
| *** roxanaghe has joined #openstack-keystone | 04:59 | |
| *** dan_nguyen has joined #openstack-keystone | 05:01 | |
| *** spzala has joined #openstack-keystone | 05:01 | |
| *** spzala has quit IRC | 05:06 | |
| *** dan_nguyen has quit IRC | 05:06 | |
| *** M00nr41n has quit IRC | 05:06 | |
| *** code-R has joined #openstack-keystone | 05:09 | |
| *** dan_nguyen has joined #openstack-keystone | 05:10 | |
| *** code-R_ has joined #openstack-keystone | 05:12 | |
| *** code-R has quit IRC | 05:15 | |
| *** darosale has joined #openstack-keystone | 05:15 | |
| *** code-R has joined #openstack-keystone | 05:17 | |
| *** code-R_ has quit IRC | 05:17 | |
| *** code-R has quit IRC | 05:17 | |
| *** dan_nguyen has quit IRC | 05:28 | |
| *** markvoelker has joined #openstack-keystone | 05:32 | |
| *** vgridnev_ has joined #openstack-keystone | 05:32 | |
| *** rcernin has quit IRC | 05:33 | |
| *** GB21 has joined #openstack-keystone | 05:35 | |
| *** markvoelker has quit IRC | 05:37 | |
| *** roxanaghe has quit IRC | 05:43 | |
| *** GB21 has quit IRC | 05:44 | |
| *** EinstCra_ has quit IRC | 05:55 | |
| *** EinstCrazy has joined #openstack-keystone | 05:57 | |
| *** spzala has joined #openstack-keystone | 06:02 | |
| *** davechen has quit IRC | 06:04 | |
| *** davechen has joined #openstack-keystone | 06:05 | |
| *** rcernin has joined #openstack-keystone | 06:06 | |
| *** spzala has quit IRC | 06:07 | |
| *** chrisshattuck has quit IRC | 06:08 | |
| *** M00nr41n has joined #openstack-keystone | 06:08 | |
| *** henrynash has joined #openstack-keystone | 06:09 | |
| *** ChanServ sets mode: +v henrynash | 06:09 | |
| *** ygl has joined #openstack-keystone | 06:10 | |
| ygl | Hi All | 06:10 |
| ygl | is there anyone here ? | 06:11 |
| *** GB21 has joined #openstack-keystone | 06:13 | |
| ygl | i need some hep with keystone | 06:13 |
| ygl | *help | 06:13 |
| ygl | can anyone help me please ? | 06:13 |
| *** pcaruana has joined #openstack-keystone | 06:16 | |
| *** pcaruana is now known as pcaruana|afk| | 06:19 | |
| *** M00nr41n has quit IRC | 06:22 | |
| *** M00nr41n has joined #openstack-keystone | 06:23 | |
| *** markvoelker has joined #openstack-keystone | 06:33 | |
| *** M00nr41n has quit IRC | 06:33 | |
| *** aloga_ has joined #openstack-keystone | 06:34 | |
| *** M00nr41n has joined #openstack-keystone | 06:34 | |
| *** pnavarro has joined #openstack-keystone | 06:35 | |
| *** markvoelker has quit IRC | 06:37 | |
| *** pnavarro has quit IRC | 06:41 | |
| *** pcaruana|afk| is now known as pcaruana | 06:49 | |
| *** aloga_ has quit IRC | 06:53 | |
| *** jed56 has joined #openstack-keystone | 06:53 | |
| *** TxGVNN has quit IRC | 06:54 | |
| *** belmoreira has joined #openstack-keystone | 06:56 | |
| *** raddaoui has quit IRC | 06:57 | |
| pcaruana | ygl, exactly what kind of deployment you have? broker? load balancers are the commands timing out always againt the same controller node? | 07:03 |
| *** spzala has joined #openstack-keystone | 07:03 | |
| ygl | pcaruana: its a ha proxy | 07:03 |
| ygl | pcaruana: DEBUG:keystoneclient.session:Request returned failure status: 500 | 07:04 |
| ygl | pcaruana: but it is working sometimes | 07:04 |
| *** jpena|off is now known as jpena | 07:04 | |
| pcaruana | ygl. if you simplify the test against one particular node.. including just curling the request, do you observe the same issue? what broker you are using? to be use the messages are being consumed. | 07:05 |
| ygl | pcaruana: how to check the broker | 07:05 |
| ygl | pcaruana: the curl is giving empty results | 07:06 |
| pcaruana | broker i what is using for the amqp.. rabbitmq or similars | 07:07 |
| ygl | pcaruana: it is rabbitmq | 07:07 |
| *** spzala has quit IRC | 07:08 | |
| *** tesseract- has joined #openstack-keystone | 07:09 | |
| pcaruana | ygl if you can use a pastebin kind.. are you geting the 500 exeptions using OS_TOKEN variables? having a pastebin for the basic configuratio and the rabbitmqctl report can give an idea.. also confirming this was working before for you or it's just new deployment that never worked? | 07:09 |
| *** amoralej|off is now known as amoralej | 07:10 | |
| ygl | pcaruana: its a new deployment | 07:13 |
| openstackgerrit | Shan Guo proposed openstack/keystone: API Change Tutorial doc code modify https://review.openstack.org/335341 | 07:14 |
| *** danpawlik has joined #openstack-keystone | 07:14 | |
| *** imcsk8 has quit IRC | 07:16 | |
| *** imcsk8 has joined #openstack-keystone | 07:16 | |
| *** tlbr has quit IRC | 07:17 | |
| *** tlbr has joined #openstack-keystone | 07:19 | |
| *** darosale has quit IRC | 07:22 | |
| pcaruana | ygl http://pastebin.com/rYHidmDj | 07:24 |
| ygl | pcaruana: the curl is not giving any output | 07:25 |
| openstackgerrit | Andreas Jaeger proposed openstack/python-keystoneclient: Update other-requirements.txt for Xenial https://review.openstack.org/335345 | 07:27 |
| openstackgerrit | Andreas Jaeger proposed openstack/keystone: Update other-requirements for Xenial https://review.openstack.org/335346 | 07:29 |
| *** GB21 has quit IRC | 07:30 | |
| *** henrynash has quit IRC | 07:33 | |
| *** markvoelker has joined #openstack-keystone | 07:34 | |
| pcaruana | ygl is really the admin token working for you? if you are not able to do a simple keystone --debug token-get. chekc both env| grep -i os for confirming your variables .. when failing the most simple things are.. user not exist, password is wrong, detaul tenant is not valid one.. the admin token is a better way openstack --os-token ADMIN --os-url.. still asumming your configuration is ok (bakends, passwords, etc), and the db | 07:34 |
| pcaruana | was created and synced correctly.. wihtout having ouputs we are just guessing about it | 07:34 |
| ygl | pcaruana: but it is working once in 6 times. i am getting the output | 07:35 |
| pcaruana | ygl, well bypassing the haproxy is a good test to isolate the cause, like having one particular node slower than others | 07:37 |
| ygl | pcaruana: ok | 07:38 |
| *** markvoelker has quit IRC | 07:38 | |
| *** EinstCrazy has quit IRC | 07:39 | |
| *** EinstCrazy has joined #openstack-keystone | 07:40 | |
| pcaruana | ygl, unfortunally there is not shortcut as being the difference game. you need to track all the keystone nodes, who is processing correctly the request and comparing againt the other ones.. | 07:49 |
| pcaruana | something has to be different between the good request and the others. | 07:50 |
| ygl | pcaruana: ok | 07:50 |
| ygl | pcaruana: thanks for ur help | 07:51 |
| *** ygl has quit IRC | 07:51 | |
| *** EinstCrazy has quit IRC | 07:52 | |
| *** pnavarro has joined #openstack-keystone | 07:53 | |
| *** EinstCrazy has joined #openstack-keystone | 07:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Imported Translations from Zanata https://review.openstack.org/335350 | 07:56 |
| openstackgerrit | Dave Chen proposed openstack/keystone: API Change Tutorial doc code modify https://review.openstack.org/335341 | 07:57 |
| *** zzzeek has quit IRC | 08:00 | |
| *** tlbr has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** tqtran has joined #openstack-keystone | 08:00 | |
| *** mvk has joined #openstack-keystone | 08:02 | |
| *** tlbr has joined #openstack-keystone | 08:03 | |
| *** tlbr has quit IRC | 08:04 | |
| *** spzala has joined #openstack-keystone | 08:04 | |
| *** tqtran has quit IRC | 08:05 | |
| *** tlbr has joined #openstack-keystone | 08:07 | |
| *** vgridnev_ has quit IRC | 08:08 | |
| *** spzala has quit IRC | 08:10 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** davechen has left #openstack-keystone | 08:15 | |
| *** wanghua has joined #openstack-keystone | 08:29 | |
| *** GB21 has joined #openstack-keystone | 08:31 | |
| *** markvoelker has joined #openstack-keystone | 08:34 | |
| *** real56 has joined #openstack-keystone | 08:38 | |
| *** markvoelker has quit IRC | 08:38 | |
| *** dmk0202 has joined #openstack-keystone | 08:39 | |
| *** maestropandy has joined #openstack-keystone | 08:46 | |
| *** chlong has quit IRC | 09:04 | |
| *** spzala has joined #openstack-keystone | 09:06 | |
| *** pece has joined #openstack-keystone | 09:08 | |
| *** EinstCrazy has quit IRC | 09:10 | |
| *** spzala has quit IRC | 09:11 | |
| *** EinstCrazy has joined #openstack-keystone | 09:11 | |
| *** imcsk8 has quit IRC | 09:12 | |
| *** imcsk8 has joined #openstack-keystone | 09:12 | |
| *** EinstCra_ has joined #openstack-keystone | 09:14 | |
| *** spzala has joined #openstack-keystone | 09:16 | |
| *** real56 has quit IRC | 09:17 | |
| *** chlong has joined #openstack-keystone | 09:17 | |
| *** EinstCrazy has quit IRC | 09:17 | |
| *** spzala has quit IRC | 09:20 | |
| *** EinstCra_ has quit IRC | 09:31 | |
| *** EinstCrazy has joined #openstack-keystone | 09:31 | |
| *** GB21 has quit IRC | 09:35 | |
| *** mvk has quit IRC | 09:35 | |
| *** mvk has joined #openstack-keystone | 09:36 | |
| *** GB21 has joined #openstack-keystone | 09:53 | |
| *** nisha_ has joined #openstack-keystone | 10:11 | |
| *** spzala has joined #openstack-keystone | 10:16 | |
| *** janonymous has joined #openstack-keystone | 10:17 | |
| janonymous | hello | 10:17 |
| janonymous | when i deleted my trust entry from keystone database and ran `db sync` tables were not recreated again.. how can i create them | 10:18 |
| janonymous | ? | 10:18 |
| janonymous | @dstanek: ping | 10:21 |
| *** nisha__ has joined #openstack-keystone | 10:21 | |
| *** spzala has quit IRC | 10:22 | |
| *** TxGVNN has joined #openstack-keystone | 10:22 | |
| *** nisha_ has quit IRC | 10:25 | |
| *** wangqun has quit IRC | 10:34 | |
| *** markvoelker has joined #openstack-keystone | 10:36 | |
| *** LarsErikP has joined #openstack-keystone | 10:37 | |
| *** GB21 has quit IRC | 10:38 | |
| LarsErikP | hi! Does anyone have experience with using a large AD as LDAP backend i keystone? I've created at keystone domain with Active Directory as backend, and I've synced in over 100.000 users. I'm having issues with user listing... | 10:39 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Implement Views and convert credentials https://review.openstack.org/335423 | 10:39 |
| LarsErikP | i.e "openstack user list --domain MY-AD" takes forever, and will eventually timeout and/or pretty much eat all the RAM in my server :-/ | 10:40 |
| LarsErikP | same goes for user listing in horizon | 10:40 |
| *** markvoelker has quit IRC | 10:40 | |
| dstanek | janonymous: pong | 10:40 |
| dstanek | LarsErikP: IIRC using listing with LDAP isn't a good thing; i don't use LDAP all that much though | 10:41 |
| LarsErikP | dstanek: it's not that i really need to list users that often, but i.e project creation in horizon is impossible, because it tries to list all users in the the LDAP-catalog.. | 10:44 |
| *** bjornar_ has joined #openstack-keystone | 10:44 | |
| *** jefrite has quit IRC | 10:46 | |
| *** GB21 has joined #openstack-keystone | 10:48 | |
| *** EinstCrazy has quit IRC | 10:55 | |
| *** spzala has joined #openstack-keystone | 11:18 | |
| *** spzala has quit IRC | 11:23 | |
| janonymous | dstanek: I deleted trust with curl but the entry was still not deleted from database, so i manually dropped the trust table but after running db_sync tables were not recreated | 11:25 |
| dstanek | janonymous: you dropped the while table instead of deleting the record? | 11:25 |
| dstanek | janonymous: tables won't be recreated by the sync. it remember the revision of the schema that you are currently on and runs migrations to bring it up to date. | 11:26 |
| janonymous | dstanek: Ohkay i understand my mistake, i created the schema manually for now, but can you tell me a proper way to do it .. | 11:28 |
| *** rodrigods has quit IRC | 11:28 | |
| *** rodrigods has joined #openstack-keystone | 11:28 | |
| janonymous | i mean recreate table now.. | 11:29 |
| *** ddieterly has joined #openstack-keystone | 11:34 | |
| *** markvoelker has joined #openstack-keystone | 11:37 | |
| janonymous | dstanek: Thanks! , hv to leave now... | 11:38 |
| *** markvoelker has quit IRC | 11:41 | |
| *** ddieterly has quit IRC | 11:41 | |
| *** ayoung has quit IRC | 11:43 | |
| *** fifieldt has quit IRC | 11:47 | |
| jamielennox | henrynash_: what do you think about doing your pass request to response builder like: https://review.openstack.org/335423 | 11:48 |
| *** ddieterly has joined #openstack-keystone | 11:50 | |
| * jamielennox disappears | 11:50 | |
| dstanek | janonymous: maybe restore from backup? | 11:51 |
| dstanek | janonymous: keystone doesn't provide disaster recovery tools | 11:51 |
| *** nisha_ has joined #openstack-keystone | 11:52 | |
| *** nisha__ has quit IRC | 11:56 | |
| *** fifieldt has joined #openstack-keystone | 12:02 | |
| *** tqtran has joined #openstack-keystone | 12:02 | |
| EmilienM | stevemar: https://bugs.launchpad.net/python-openstackclient/+bug/1597246 | 12:03 |
| openstack | Launchpad bug 1597246 in python-openstackclient "User show fails with "--domain default" after https://review.openstack.org/#/c/311206/" [Undecided,New] | 12:03 |
| *** nisha__ has joined #openstack-keystone | 12:05 | |
| *** pece has quit IRC | 12:05 | |
| stevemar | EmilienM: thank you for the bug, i'll start peeking into it today | 12:05 |
| *** tqtran has quit IRC | 12:06 | |
| *** nisha_ has quit IRC | 12:06 | |
| *** ddieterly has quit IRC | 12:07 | |
| *** markvoelker has joined #openstack-keystone | 12:08 | |
| *** GB21 has quit IRC | 12:08 | |
| *** wangqun has joined #openstack-keystone | 12:11 | |
| *** GB21 has joined #openstack-keystone | 12:11 | |
| *** pnavarro has quit IRC | 12:17 | |
| *** samueldmq has joined #openstack-keystone | 12:19 | |
| *** ChanServ sets mode: +v samueldmq | 12:19 | |
| *** spzala has joined #openstack-keystone | 12:19 | |
| samueldmq | good morning keystone | 12:19 |
| stevemar | o/ | 12:19 |
| samueldmq | stevemar: o/ | 12:20 |
| *** nisha__ has quit IRC | 12:20 | |
| *** nisha__ has joined #openstack-keystone | 12:22 | |
| *** spzala has quit IRC | 12:24 | |
| *** nisha__ is now known as nisha_ | 12:24 | |
| nisha_ | samueldmq, morning | 12:24 |
| samueldmq | nisha_: morning, how are you ? | 12:24 |
| samueldmq | nisha_: I am looking at your patches now :-) | 12:25 |
| *** ddieterly has joined #openstack-keystone | 12:30 | |
| *** pnavarro has joined #openstack-keystone | 12:31 | |
| *** gordc has joined #openstack-keystone | 12:37 | |
| *** ddieterly is now known as ddieterly[away] | 12:41 | |
| *** amoralej is now known as amoralej|lunch | 12:41 | |
| aloga | samueldmq: hi there | 12:44 |
| aloga | samueldmq: yesterday I was off the office when you replied me :( | 12:44 |
| samueldmq | aloga: hi | 12:45 |
| aloga | samueldmq: "samueldmq | aloga: so is it wrong setting scope=profile as the default for all those 3 classe s? " | 12:45 |
| aloga | samueldmq: yes | 12:45 |
| aloga | the correct should be, at least, "openid" | 12:45 |
| samueldmq | aloga: so there is a bug ? | 12:46 |
| aloga | samueldmq: no | 12:47 |
| aloga | samueldmq: at least, all the providers I have tested give a valid response to a "scope='profile'" | 12:47 |
| *** jsavak has joined #openstack-keystone | 12:47 | |
| aloga | even if the standard says that the "openid" scope is mandatory | 12:47 |
| samueldmq | aloga: what if we change the default to openid ? | 12:48 |
| samueldmq | aloga: what would that change to others ? would that break anything ? | 12:48 |
| *** edmondsw has joined #openstack-keystone | 12:48 | |
| aloga | samueldmq: I would say "openid profile" | 12:49 |
| samueldmq | aloga: sure | 12:49 |
| samueldmq | aloga: do we expect that to break something ? | 12:49 |
| aloga | samueldmq: I don't think so | 12:50 |
| aloga | samueldmq: AFAIK, the "openid" scope only means that the request is going to be an "openid" request | 12:50 |
| samueldmq | aloga: what if we: i) open a bug saying even though the behavior is correct, we're not followig the specs | 12:51 |
| samueldmq | ii) change the default scope to 'openid scope' in that patch (so all 3 classes get that ) ? | 12:51 |
| aloga | samueldmq: yes, that's perfect | 12:51 |
| *** wangqun has quit IRC | 12:52 | |
| samueldmq | aloga: nice, thanks! | 12:52 |
| *** EinstCrazy has joined #openstack-keystone | 12:53 | |
| aloga | samueldmq: however, I do not know what to do with users not providing "openid" on their scope | 12:53 |
| aloga | samueldmq: i.e. a user doing scope='email' instead of scope='openid email' | 12:53 |
| aloga | samueldmq: should we allow the former, or raise an error? | 12:53 |
| aloga | samueldmq: adhering to the OpenID specification, "openid" MUST be present, otherwise the behaviour of the server is unspecified: it may work but it may fail as well | 12:54 |
| samueldmq | aloga: unfortunately I don't have a lot of knowledge on openid :( | 12:54 |
| samueldmq | aloga: I think we could get a good feedback from stevemar and jamielennox | 12:55 |
| aloga | samueldmq: IMO we should allow the user to pass whatever scope they want, if the server copes with it, that's fine, if the server returns an error, we return it to the user | 12:55 |
| samueldmq | aloga: looks good, we should keep supporting what we have today | 12:56 |
| aloga | samueldmq: great | 12:56 |
| samueldmq | aloga: if one specifies scope='profile' it's okay, as it is today | 12:56 |
| samueldmq | aloga: scope='email', the same | 12:56 |
| aloga | samueldmq: yes, great | 12:56 |
| samueldmq | aloga: if they specify scope='openid profile' or scope='openid email', that should be work too | 12:56 |
| aloga | we're on the same track then | 12:56 |
| samueldmq | cool | 12:57 |
| samueldmq | brb | 12:57 |
| *** rderose has joined #openstack-keystone | 12:58 | |
| *** samueldmq has quit IRC | 12:58 | |
| *** richm has joined #openstack-keystone | 13:01 | |
| *** GB21 has quit IRC | 13:02 | |
| *** woodster_ has joined #openstack-keystone | 13:05 | |
| *** real56 has joined #openstack-keystone | 13:06 | |
| *** real56 has left #openstack-keystone | 13:07 | |
| openstackgerrit | Merged openstack/keystone: API Change Tutorial doc code modify https://review.openstack.org/335341 | 13:07 |
| stevemar | i'm thinking about just pushing in the API ref changes | 13:08 |
| *** pauloewerton has joined #openstack-keystone | 13:08 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Update other-requirements.txt for Xenial https://review.openstack.org/335345 | 13:09 |
| *** samueldmq has joined #openstack-keystone | 13:10 | |
| *** ChanServ sets mode: +v samueldmq | 13:10 | |
| *** spzala has joined #openstack-keystone | 13:11 | |
| *** M00nr41n has quit IRC | 13:11 | |
| *** code-R has joined #openstack-keystone | 13:17 | |
| *** nisha__ has joined #openstack-keystone | 13:17 | |
| *** lamt has joined #openstack-keystone | 13:17 | |
| *** sdake has joined #openstack-keystone | 13:17 | |
| openstackgerrit | Merged openstack/oslo.policy: Imported Translations from Zanata https://review.openstack.org/335350 | 13:20 |
| *** nisha_ has quit IRC | 13:21 | |
| *** code-R_ has joined #openstack-keystone | 13:21 | |
| *** sdake_ has joined #openstack-keystone | 13:22 | |
| *** sdake has quit IRC | 13:22 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: WIP - oidc: fix OpenID Connect authorization code grant_type https://review.openstack.org/330006 | 13:22 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: fix OpenID scope management https://review.openstack.org/330463 | 13:22 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: add discovery document support https://review.openstack.org/330464 | 13:22 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: oidc: remove grant_type argument https://review.openstack.org/330465 | 13:22 |
| *** code-R has quit IRC | 13:24 | |
| *** ddieterly has joined #openstack-keystone | 13:24 | |
| openstackgerrit | Merged openstack/keystone: Update other-requirements for Xenial https://review.openstack.org/335346 | 13:26 |
| *** sdake has joined #openstack-keystone | 13:26 | |
| *** sdake_ has quit IRC | 13:27 | |
| *** henrynash has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +v henrynash | 13:32 | |
| *** samueldmq has quit IRC | 13:34 | |
| *** links has quit IRC | 13:36 | |
| *** haneef has joined #openstack-keystone | 13:36 | |
| *** amoralej|lunch is now known as amoralej | 13:37 | |
| *** gordc has quit IRC | 13:38 | |
| *** ddieterly is now known as ddieterly[away] | 13:40 | |
| *** code-R_ has quit IRC | 13:41 | |
| *** code-R has joined #openstack-keystone | 13:41 | |
| *** ayoung has joined #openstack-keystone | 13:42 | |
| *** ChanServ sets mode: +v ayoung | 13:42 | |
| *** ayoung has quit IRC | 13:42 | |
| *** ayoung has joined #openstack-keystone | 13:42 | |
| *** ChanServ sets mode: +v ayoung | 13:42 | |
| *** jaugustine has joined #openstack-keystone | 13:44 | |
| *** raddaoui has joined #openstack-keystone | 13:54 | |
| *** ddieterly[away] is now known as ddieterly | 13:55 | |
| *** ametts has joined #openstack-keystone | 13:56 | |
| *** samueldmq has joined #openstack-keystone | 13:57 | |
| *** ChanServ sets mode: +v samueldmq | 13:57 | |
| *** pece has joined #openstack-keystone | 14:01 | |
| *** ravelar159 has joined #openstack-keystone | 14:03 | |
| *** jaugustine has quit IRC | 14:03 | |
| *** henrynash has quit IRC | 14:05 | |
| *** nisha__ is now known as nisha_ | 14:06 | |
| *** ravelar159 has quit IRC | 14:07 | |
| *** ravelar159 has joined #openstack-keystone | 14:07 | |
| *** chrisshattuck has joined #openstack-keystone | 14:07 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove test_backend_ldap skips for missing tests https://review.openstack.org/335514 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a skip method to identify useless skips https://review.openstack.org/335515 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Use skip_test_overrides in test_backend_ldap https://review.openstack.org/335516 | 14:10 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updated tests that claimed to be blocked by bugs https://review.openstack.org/335517 | 14:10 |
| *** nkinder has joined #openstack-keystone | 14:11 | |
| *** henrynash has joined #openstack-keystone | 14:11 | |
| *** ChanServ sets mode: +v henrynash | 14:11 | |
| *** ddieterly is now known as ddieterly[away] | 14:12 | |
| *** tonytan4ever has joined #openstack-keystone | 14:12 | |
| breton_ | rderose: i am afraid that https://review.openstack.org/#/c/284943/ is again -1 | 14:13 |
| patchbot | breton_: patch 284943 - keystone - Concrete role assignments for federated users | 14:13 |
| breton_ | (who uses my nick? let me kick him...) | 14:14 |
| rderose | breton_: of course :) | 14:15 |
| rderose | breton_: what's the problem? | 14:15 |
| *** ravelar_159 has joined #openstack-keystone | 14:15 | |
| *** breton_ is now known as breton | 14:15 | |
| *** woodburn has quit IRC | 14:15 | |
| breton | that's better | 14:15 |
| breton | rderose: group role assignment are broken | 14:16 |
| *** sdake has quit IRC | 14:16 | |
| rderose | breton: hmm... can you describe the test case? | 14:17 |
| *** sdake has joined #openstack-keystone | 14:17 | |
| *** sdake has quit IRC | 14:17 | |
| *** ravelar159 has quit IRC | 14:18 | |
| breton | rderose: http://paste.openstack.org/show/524058/ mapping | 14:18 |
| breton | rderose: openstack role add --group remote_people --group-domain Default --domain Default admin | 14:19 |
| breton | rderose: openstack role add --group remote_people --group-domain Default --project admin admin | 14:19 |
| breton | (i've issues role add for both domain and project to be sure, this is not test case specific) | 14:19 |
| *** sdake has joined #openstack-keystone | 14:19 | |
| breton | rderose: and horizon gives me "" | 14:20 |
| breton | Login failed: Unable to retrieve authorized projects. | 14:20 |
| *** ddieterly[away] is now known as ddieterly | 14:20 | |
| *** nisha_ has quit IRC | 14:21 | |
| rderose | breton: but no issues via the cli? | 14:21 |
| *** mwheckmann has joined #openstack-keystone | 14:21 | |
| breton | rderose: in keystone log there is http://paste.openstack.org/show/524059/ | 14:21 |
| *** nisha_ has joined #openstack-keystone | 14:22 | |
| breton | rderose: i have not tested via cli and probably will not -- i don't have a ECP-enabled idp configured. | 14:22 |
| breton | now let me check if concrete role assignment works | 14:23 |
| rderose | breton: okay, thanks | 14:23 |
| breton | rderose: http://paste.openstack.org/show/524062/ is this expected? | 14:25 |
| *** henrynash has quit IRC | 14:27 | |
| rderose | breton: are you talking about this message > 'No user with a name or ID of 'bbobrov@mirantis.com' exists.' | 14:27 |
| openstackgerrit | Martin Schuppert proposed openstack/keystone: Verify domain_id when get_domain is being called https://review.openstack.org/331567 | 14:27 |
| breton | rderose: yes | 14:28 |
| breton | rderose: i see this message even though the name is in the list | 14:28 |
| *** shauavik has joined #openstack-keystone | 14:29 | |
| shauavik | Hi I am looking for some help with setting up keystone using https (ssl) | 14:29 |
| shauavik | I really cannot find any document that lays out how to do it | 14:30 |
| rderose | breton: and 'bbobrov@mirantis.com' is a federated user? | 14:30 |
| *** dan_nguyen has joined #openstack-keystone | 14:30 | |
| breton | rderose: yes. | 14:30 |
| breton | rderose: i was able to create the assignment by specifying id, but it doesn't work by name. | 14:31 |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| dstanek | shauavik: have you setup apache to use SSL? | 14:32 |
| rderose | breton: hmm... it should work by using the display name, which is your email address, right? | 14:32 |
| breton | rderose: yep | 14:32 |
| rderose | breton: okay, I'll dig into that as well | 14:33 |
| shauavik | No I have not | 14:34 |
| *** jsavak has quit IRC | 14:34 | |
| shauavik | I am looking for steps to set it up | 14:34 |
| dstanek | shauavik: apache ssl? | 14:35 |
| shauavik | no | 14:35 |
| dstanek | shauavik: how are you running keystone? | 14:35 |
| shauavik | the complete thing like all services and apache on ssll is required that too | 14:35 |
| shauavik | I have test setup on a single node | 14:36 |
| *** maestropandy has quit IRC | 14:36 | |
| shauavik | RDO setup | 14:36 |
| dstanek | shauavik: the first step is to get things running behind apache using SSL | 14:36 |
| shauavik | ok | 14:36 |
| shauavik | so before even adding a keystone endpoint, I will have to setup apache to use ssl | 14:37 |
| dstanek | then you have to make sure your catalog is updated if you change services from http to https | 14:37 |
| *** jsavak has joined #openstack-keystone | 14:37 | |
| shauavik | ok | 14:37 |
| breton | rderose: here is the full trace if you want: http://paste.openstack.org/show/524068/ | 14:37 |
| dstanek | shauavik: doesn't matter all that much. just get it running behind apache | 14:38 |
| breton | rderose: osc trace i mean | 14:38 |
| shauavik | ok | 14:39 |
| shauavik | thanks +dstanek | 14:40 |
| shauavik | I will first try setting apache with ssl and then move ahead | 14:41 |
| dstanek | shauavik: you're welcome | 14:41 |
| breton | rderose: i tried removing group role assignment and left only the concrete one. Still getting "" | 14:41 |
| breton | Login failed: Unable to retrieve authorized projects. | 14:41 |
| breton | dammit, when will i learn that pasting doesn't work. | 14:42 |
| rderose | breton: hmm... and policy.json should have changed from 'identity:list_projects_for_groups' to 'identity:list_projects_for_user' | 14:43 |
| rderose | breton: so that is probably not it | 14:44 |
| *** aloga_ has joined #openstack-keystone | 14:45 | |
| breton | rderose: maybe that's the reason. I have not updated /etc/keystone/policy.json. | 14:45 |
| breton | rderose: let me check | 14:45 |
| rderose | breton: yeah, try that | 14:45 |
| *** henrynash has joined #openstack-keystone | 14:46 | |
| *** ChanServ sets mode: +v henrynash | 14:46 | |
| rderose | breton: for both projects and domains 'identity:list_domains_for_groups' to 'identity:list_domains_for_user' | 14:46 |
| * breton remembers recent rant by notmorgan about code-as-config | 14:48 | |
| *** jorge_munoz_ has joined #openstack-keystone | 14:48 | |
| *** jorge_munoz has quit IRC | 14:48 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:48 | |
| *** ravelar_159 has quit IRC | 14:48 | |
| breton | rderose: it worked! | 14:51 |
| rderose | breton: awesome!!! | 14:51 |
| breton | rderose: both concrete and group assignments | 14:51 |
| breton | so the only issue is inability to create an assignment by name | 14:51 |
| rderose | breton: sweet!!! | 14:51 |
| *** bjornar_ has quit IRC | 14:52 | |
| rderose | breton: okay, will dig into that | 14:52 |
| *** nkinder has quit IRC | 14:52 | |
| rderose | breton: thanks for all your help on testing this btw (and patience) :) | 14:52 |
| *** KevinE has joined #openstack-keystone | 14:55 | |
| breton | rodrigods: stevemar: what's your opinion on the fact that merging concrete role assignments will require editing policy.json file on existing installation? | 14:57 |
| rodrigods | breton, that's tricky | 14:58 |
| rodrigods | i have the same concern | 14:58 |
| rodrigods | but not sure if it is ok since it has a release note | 14:58 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [credential] documentation https://review.openstack.org/334702 | 14:59 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [domain_config] documentation https://review.openstack.org/335545 | 14:59 |
| *** ravelar159 has joined #openstack-keystone | 15:00 | |
| *** timcline has joined #openstack-keystone | 15:01 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Performance oriented functional test for HMT https://review.openstack.org/335144 | 15:05 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 15:06 |
| stevemar | breton: i think that is OK, usually ops go through that on upgrade | 15:07 |
| stevemar | breton: whats the result of `openstack role assignment list --names` for http://paste.openstack.org/show/524079/ | 15:08 |
| *** danpawlik has quit IRC | 15:08 | |
| stevemar | breton: it may be that we need to enhance the lookup code to work for federated user name | 15:10 |
| stevemar | breton: rderose if we really want to be careful with the policy file thing... we could always add 2 new lines and keep the old ones | 15:10 |
| stevemar | and have list_projects_for_group point to list_projects_for_user | 15:11 |
| rderose | breton rodrigods stevemar: the error 'No user with a name or ID of 'bbobrov@mirantis.com' exists.', I believe is because get_user_by_name method is not pulling the federated displayname | 15:11 |
| *** chrisshattuck has quit IRC | 15:11 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Performance oriented functional test for HMT https://review.openstack.org/335144 | 15:11 |
| rderose | breton rodrigods stevemar: but as breton points out, it does work successfully with ID | 15:11 |
| *** tesseract- has quit IRC | 15:12 | |
| rderose | breton rodrigods stevemar: I'm okay with the policy.json change because those methods are really pointing to deprecated API methods. And if an operator is not using those API methods, that wouldn't be impacted by the change. | 15:12 |
| *** chrisshattuck has joined #openstack-keystone | 15:13 | |
| rderose | breton rodrigods stevemar: I talked to dolphm regarding this and he was in favor of making the name changes | 15:13 |
| *** rcernin has quit IRC | 15:14 | |
| rderose | stevemar: add 2 lines and keep the old methods? | 15:14 |
| *** sheel has quit IRC | 15:15 | |
| rderose | stevemar: I think we should just change it. It could be confusing later on if we keep it (maybe) | 15:16 |
| *** catintheroof has joined #openstack-keystone | 15:16 | |
| *** pcaruana has quit IRC | 15:17 | |
| rodrigods | rderose, hmm interesting bug on get project by name | 15:17 |
| rodrigods | user* | 15:17 |
| rodrigods | signal we need another test :) | 15:17 |
| catintheroof | guys, quick question, in keystone, does anyone knows (i didnt look the code) if the userid hash when using LDAP driver for identity uses the domainid that the user belongs to to build it ? | 15:18 |
| rderose | rodrigods: yep | 15:19 |
| rderose | rodrigods: it never ends :) | 15:19 |
| rderose | rodrigods: but we are getting close :) | 15:19 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 15:21 |
| *** marekd has joined #openstack-keystone | 15:24 | |
| *** gordc has joined #openstack-keystone | 15:25 | |
| *** ChanServ sets mode: +v marekd | 15:25 | |
| rderose | rodrigods: yeah, this is going to be tough | 15:25 |
| rderose | rodrigods: domain and displayname are unique within the federated_user table, but searching for the displayname in the local_user table is problematic | 15:27 |
| rderose | rodrigods: this probably something we can solve when we implement account linking | 15:28 |
| bknudson_ | I wrote a load tester using the twisted library -- https://github.com/brantlk/keystone_performance/blob/master/keystone_performance/load_test_twisted.py | 15:28 |
| bknudson_ | seems to work pretty well. | 15:28 |
| rderose | rodrigods: you should not be inputting the displayname here: openstack role add --user '<displayname>' --project admin admin | 15:30 |
| *** code-R has quit IRC | 15:30 | |
| rderose | rodrigods: as this is intended to be the local username; not the federated displayname | 15:30 |
| rderose | rodrigods: what do you think? | 15:30 |
| *** rcernin has joined #openstack-keystone | 15:31 | |
| *** code-R has joined #openstack-keystone | 15:31 | |
| *** pcaruana has joined #openstack-keystone | 15:32 | |
| *** darosale has joined #openstack-keystone | 15:34 | |
| *** code-R has quit IRC | 15:35 | |
| *** bjornar_ has joined #openstack-keystone | 15:42 | |
| *** belmoreira has quit IRC | 15:43 | |
| *** Nakato has quit IRC | 15:43 | |
| rderose | stevemar rodrigods breton: left a comment here: https://review.openstack.org/#/c/284943/ | 15:44 |
| patchbot | rderose: patch 284943 - keystone - Concrete role assignments for federated users | 15:44 |
| rderose | stevemar rodrigods breton: let me know what you think | 15:44 |
| *** Nakato has joined #openstack-keystone | 15:45 | |
| *** david-lyle has quit IRC | 15:46 | |
| *** phalmos has joined #openstack-keystone | 15:46 | |
| *** sheel has joined #openstack-keystone | 15:49 | |
| *** bjornar_ has quit IRC | 15:52 | |
| rodrigods | rderose, looking | 15:53 |
| catintheroof | hi! does anyone knows how keystone builds the user id if the identity backend is ldap ? | 15:54 |
| rodrigods | rderose, can you point me to the federated user model? so i can understand what is "displayname" | 15:55 |
| rderose | rodrigods: sure, just a sec | 15:55 |
| *** ravelar159 is now known as hi | 15:56 | |
| *** hi is now known as Guest29153 | 15:56 | |
| *** Guest29153 is now known as jaceitr | 15:56 | |
| rodrigods | catintheroof, uuid.uuid4().hex | 15:56 |
| rodrigods | it is the same way for SQL | 15:56 |
| *** jaceitr is now known as ravelar159 | 15:57 | |
| rodrigods | actually, this is done in the layer above | 15:57 |
| rderose | rodrigods: https://review.openstack.org/#/c/279162/ | 15:57 |
| patchbot | rderose: patch 279162 - keystone - Shadow users - Shadow federated users (MERGED) | 15:57 |
| *** ddieterly is now known as ddieterly[away] | 15:57 | |
| *** ravelar159 has quit IRC | 15:57 | |
| rderose | rodrigods: displayname added as part of adding the federated_user table: https://review.openstack.org/#/c/279162/68/keystone/common/sql/migrate_repo/versions/094_add_federated_user_table.py | 15:58 |
| patchbot | rderose: patch 279162 - keystone - Shadow users - Shadow federated users (MERGED) | 15:58 |
| catintheroof | rodrigods, so ... if i use the same replicated LDAP all over the world with different keystone installations, but the assignment backend is local to that keystone, despite the identity backend, the user id will be different right ? | 15:58 |
| *** ravelar159 has joined #openstack-keystone | 15:58 | |
| *** jacelc has joined #openstack-keystone | 15:58 | |
| *** ravelar159 has quit IRC | 15:58 | |
| *** jacelc has quit IRC | 15:58 | |
| *** phalmos has quit IRC | 15:59 | |
| rodrigods | catintheroof, if you use the same LDAP backend for identity, and local backends for assignment? | 15:59 |
| catintheroof | rodrigods, yeahp | 15:59 |
| rodrigods | rderose, where ¨shadow_federated_user" is called? | 15:59 |
| rodrigods | catintheroof, the user_id will be the same | 16:00 |
| *** jaugustine has joined #openstack-keystone | 16:00 | |
| *** ddieterly[away] is now known as ddieterly | 16:01 | |
| rodrigods | rderose, found it | 16:01 |
| catintheroof | rodrigods, hmmm that doesnt happen in a lab with 3 keystones with local SQL assignment but pointing to the same openldap, the users are regognized to be part of the same domain (using domain specific drivers) but the user ID are all different on 3 keystones | 16:01 |
| catintheroof | rodrigods, what could be the reason ? the domain names are the same on 3 keystones, but of course the domain ids are differnet because assignment are local to that keystone | 16:02 |
| rderose | rodrigods: cool, let me know if you have any questions | 16:03 |
| *** tqtran has joined #openstack-keystone | 16:03 | |
| *** jsavak has quit IRC | 16:04 | |
| *** GB21 has joined #openstack-keystone | 16:04 | |
| catintheroof | rodrigods, would help me a lot if you help me understand if the different user ID are right or should be the same | 16:05 |
| *** jsavak has joined #openstack-keystone | 16:05 | |
| *** nisha_ has quit IRC | 16:06 | |
| rodrigods | catintheroof, the user id should be the same, maybe there is something wonky in your config... can't think of reason why they would be different | 16:06 |
| *** haplo37_ has joined #openstack-keystone | 16:07 | |
| *** diazjf has joined #openstack-keystone | 16:07 | |
| rodrigods | catintheroof: maybe bknudson_, ayoung or henrynash can help you, since they have more knowledge of LDAP and domain specific backends | 16:07 |
| *** pnavarro has quit IRC | 16:07 | |
| *** fangxu has joined #openstack-keystone | 16:08 | |
| catintheroof | rodrigods, what i dont understand is ... if it gets calculated by keystone by the time it gets read on the LDAP, why is wrong that every keystone is generating a different ID ? | 16:08 |
| *** tqtran has quit IRC | 16:08 | |
| henrynash | catintheroof: hi... | 16:08 |
| catintheroof | henrynash, hi ! | 16:08 |
| *** GB21 has quit IRC | 16:08 | |
| rodrigods | rderose, so display name is mapped to name when querying a user? | 16:08 |
| henrynash | catintheroof: so this is a question about the userID generated by keystone for a user in LDAP? | 16:09 |
| rodrigods | henrynash, yes! | 16:09 |
| catintheroof | henrynash, exactly, and not only that, using the SAME LDAP backend on 3 different keystone that have the identity backend local and not replicated, te user ids are all different | 16:10 |
| *** roxanaghe has joined #openstack-keystone | 16:10 | |
| henrynash | catintheroof: is the domain_id the same in each case? | 16:10 |
| rderose | rodrigods: it's mapped to the user, in the sense that it's part of the user model | 16:10 |
| catintheroof | henrynash, rodrigods one thing to notice is that the user already exists on ldap, is not created by kesytone | 16:10 |
| rderose | user -> federated_user (1:many) | 16:11 |
| rodrigods | rderose, right... so if I do a GET v3/users, how the federated users are displayed? | 16:11 |
| henrynash | catintheroof: the algorithim is that the domain_id and local_id in the LDAP record are hashed together to create the userID keystone exports | 16:12 |
| rderose | rodrigods: yes, because of this: https://github.com/openstack/keystone/blob/master/keystone/identity/backends/sql_model.py#L54 | 16:12 |
| *** fangxu has quit IRC | 16:12 | |
| catintheroof | henrynash, what i thought .. .so if the domain name are the same across keystones, but ids are different i will never get the same user id | 16:12 |
| catintheroof | henrynash, that's why i should replicate identity backend also, right ç? | 16:13 |
| henrynash | catintheroof: it’s teh domain_id not the domain name... | 16:13 |
| catintheroof | henrynash, yeah, the domain id are all different across all three keystones | 16:13 |
| rderose | rodrigods: if username is null, show the federated displayname | 16:13 |
| *** fangxu has joined #openstack-keystone | 16:13 | |
| rodrigods | rderose, right... so the for someone querying keystone's API, doesn't matter if it is a federated_user displayname or a user name, correct? | 16:14 |
| henrynash | catintheroof: and bu design we did NOT want you to end up with teh same user_id….since in the non-fedrated case, we do not support this | 16:14 |
| *** phalmos has joined #openstack-keystone | 16:14 | |
| *** shewless has joined #openstack-keystone | 16:14 | |
| *** EinstCrazy has quit IRC | 16:15 | |
| *** roxanaghe has quit IRC | 16:15 | |
| catintheroof | henrynash, but if i replicate not only the ldap backend but also the identity (sql) backend across 3 keystones, that would work right, regarding having the same ids all across ? | 16:15 |
| rderose | rodrigods: true, but that wasn't the original intent for the displayname | 16:15 |
| stevemar | EmilienM: amoralej fyi: https://review.openstack.org/#/c/335577/ | 16:15 |
| patchbot | stevemar: patch 335577 - osc-lib - Attempt to find resource by ID, without kwargs | 16:15 |
| rderose | rodrigods: displayname: Ron De Rose, username: rderose | 16:15 |
| EmilienM | stevemar: man you're too fast | 16:16 |
| *** phalmos has quit IRC | 16:16 | |
| rderose | rodrigods: I think this was something we were going to fix with account linking | 16:16 |
| stevemar | EmilienM: i should have had it done yesterday! | 16:16 |
| henrynash | catintheroof: do you replicats the resource (sql) backend as well? | 16:16 |
| amoralej | great stevemar | 16:16 |
| henrynash | catintheroof: if you did that, I think it would work | 16:16 |
| *** code-R has joined #openstack-keystone | 16:16 | |
| henrynash | catintheroof: if that’s really what you want to do | 16:16 |
| rodrigods | rderose, do you see the issue? because for someone who is consuming keystone's API, i don't care how it is stored internally | 16:17 |
| EmilienM | stevemar: it's already tomorrow in some timezones, so you're good | 16:17 |
| rodrigods | i want to use the field "name" to query the user | 16:17 |
| rodrigods | so if you show to me, name = "foo" and i query using it and nothing returns, it is an API inconsistency | 16:17 |
| *** fangxu has quit IRC | 16:18 | |
| rodrigods | rderose, guess it is a bug not related to concrete role asssignments | 16:18 |
| rderose | rodrigods: I do see the issue, but I think it's small | 16:18 |
| rodrigods | rderose, i prefer to see as a bad issue, but not related to concrente role assignments | 16:19 |
| rderose | rodrigods: And I'm concerned about treating the displayname as the username. Just think we should think this through some more. | 16:19 |
| *** code-R_ has joined #openstack-keystone | 16:20 | |
| *** david-lyle has joined #openstack-keystone | 16:20 | |
| *** andreykurilin has quit IRC | 16:20 | |
| rderose | rodrigods: agree. | 16:20 |
| rodrigods | rderose, stevemar, breton ^ think the displayname <-> name is a bug not related to concrete role assignments | 16:20 |
| *** roxanaghe has joined #openstack-keystone | 16:21 | |
| *** david-lyle has quit IRC | 16:21 | |
| *** phalmos has joined #openstack-keystone | 16:21 | |
| *** david-lyle has joined #openstack-keystone | 16:21 | |
| *** jaugustine has quit IRC | 16:21 | |
| *** ddieterly is now known as ddieterly[away] | 16:22 | |
| *** david-lyle has quit IRC | 16:22 | |
| *** browne has joined #openstack-keystone | 16:22 | |
| *** code-R has quit IRC | 16:23 | |
| shewless | dstanek or anyone else: I have SSO working but at some point down the road I lost my project mapping somehow. In my keystone logs I see "[wsgi:error] [pid 8596:tid 140538404390656] Unable to retrieve project list" | 16:23 |
| *** david-lyle has joined #openstack-keystone | 16:23 | |
| *** raildo is now known as raildo-afk | 16:23 | |
| shewless | The log has a stacktrace which I will pastebin.. | 16:23 |
| *** dan_nguyen has quit IRC | 16:24 | |
| shewless | any help would be appreciated. I have a group created and a project created and my user has a role that is mapped to both | 16:24 |
| *** gagehugo has joined #openstack-keystone | 16:25 | |
| shewless | Here is the error stacktrace: http://paste.ubuntu.com/18107929/ | 16:25 |
| *** david-lyle has quit IRC | 16:25 | |
| *** david-lyle has joined #openstack-keystone | 16:25 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Performance oriented unit test for HMT https://review.openstack.org/335144 | 16:25 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Closure table for HMT https://review.openstack.org/285521 | 16:25 |
| stevemar | rderose: breton i posed the question about renaming policy.json targets to some ops in #openstack-ops | 16:26 |
| stevemar | waiting for a reply, i think it's OK | 16:26 |
| stevemar | dolphm: notmorgan ^ | 16:26 |
| *** raildo-afk is now known as raildo | 16:26 | |
| *** pushkaru has joined #openstack-keystone | 16:27 | |
| *** vgridnev_ has joined #openstack-keystone | 16:28 | |
| *** phalmos has quit IRC | 16:28 | |
| rodrigods | rderose, left a comment there | 16:29 |
| rderose | rodrigods: cool and thanks for your help on reviewing this patch | 16:30 |
| rodrigods | np :) | 16:31 |
| catintheroof | henrynash, yeahp ! everything but the identity ! | 16:31 |
| *** dmk0202 has quit IRC | 16:31 | |
| *** itisha has joined #openstack-keystone | 16:31 | |
| *** browne has quit IRC | 16:33 | |
| *** jorge_munoz has quit IRC | 16:33 | |
| henrynash | catintheroof: so you are saying that the domain entities are being replcated…and yet the user_ids are still different? | 16:34 |
| henrynash | secret2me | 16:34 |
| henrynash | oops | 16:34 |
| raildo | henrynash: not a secret anymore | 16:34 |
| henrynash | (ignore that) | 16:34 |
| catintheroof | henrynash, no no ! im saying that IF i replicate everything (which i just tested) that user id are the same (and also projects !) | 16:35 |
| henrynash | catintheroof: ok, right, that’s what I would expect | 16:35 |
| *** pcaruana has quit IRC | 16:36 | |
| catintheroof | henrynash, thank you so much for the support ! | 16:37 |
| *** jaugustine has joined #openstack-keystone | 16:37 | |
| henrynash | catintheroof: np, you’re welcome | 16:38 |
| *** rcernin has quit IRC | 16:45 | |
| shewless | henrynash: if you have a minute have you ever seen this stack trace before: http://paste.ubuntu.com/18107929/ | 16:45 |
| henrynash | shewless: looking | 16:45 |
| *** ddieterly[away] is now known as ddieterly | 16:48 | |
| henrynash | shewless: not exactly, this is from what …a request issued by an authenticated federated user, or form an attempt of a federated use to autehtniacte | 16:49 |
| henrynash | ? | 16:49 |
| *** jpena is now known as jpena|off | 16:50 | |
| shewless | henrynash: so this is from my "connecting/logging" from horizon. So I login as a federated user.. it allows me to login just fine but I'm not associated with any projects from what I can tell | 16:51 |
| *** jaugustine has quit IRC | 16:51 | |
| henrynash | shewless: federated user or “stored in keystone” suer? | 16:51 |
| shewless | henrynash: federated user | 16:52 |
| henrynash | shewless: I’d check the mapping to ensure the project/groups or whatever exist | 16:53 |
| shewless | henrynash: yes I have the mapping hard coded to a local group. http://paste.ubuntu.com/18109826/. I verified that group is associated with teh project I care about. | 16:55 |
| *** fifieldt has quit IRC | 16:55 | |
| *** jacelc has joined #openstack-keystone | 16:55 | |
| *** jacelc is now known as ravelar159 | 16:55 | |
| shewless | henrynash: IE "openstack role assignment list --role user --group default_group" shows me that the group in the mapping is mapped to a project. and that project exists and is enabled | 16:56 |
| henrynash | shewless: hmm, curious | 16:57 |
| *** timcline has quit IRC | 16:58 | |
| *** timcline has joined #openstack-keystone | 16:59 | |
| henrynash | shewless: I’m not sure of the issue without further debug….I need to drop off, but wil lbe back on later…maybe someone more experienced with federation and keystoneauth might be abe to help while I am away? | 17:01 |
| *** vgridnev_ has quit IRC | 17:01 | |
| shewless | henrynash: don't know if it's related but I had to enable SSL on port 5000.. but I didn't do it on the keystone admin side | 17:01 |
| *** krotscheck is now known as krotscheck_vaca | 17:01 | |
| *** krotscheck_vaca is now known as krot_vaca_jul19 | 17:01 | |
| shewless | henrynash: okay thanks anyways | 17:01 |
| *** timcline has quit IRC | 17:03 | |
| *** pushkaru has quit IRC | 17:07 | |
| *** sdake_ has joined #openstack-keystone | 17:08 | |
| *** spandhe has joined #openstack-keystone | 17:08 | |
| *** mvk has quit IRC | 17:08 | |
| *** sdake has quit IRC | 17:10 | |
| *** ravelar159 has quit IRC | 17:11 | |
| *** diazjf has quit IRC | 17:11 | |
| *** rderose has quit IRC | 17:14 | |
| *** jsavak has quit IRC | 17:15 | |
| *** jsavak has joined #openstack-keystone | 17:15 | |
| *** dmk0202 has joined #openstack-keystone | 17:16 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Add failed auth attempts logic to meet PCI-DSS https://review.openstack.org/324029 | 17:18 |
| dstanek | shewless: still no luck, huh... | 17:21 |
| *** fangxu has joined #openstack-keystone | 17:22 | |
| *** ddieterly is now known as ddieterly[away] | 17:25 | |
| *** timcline has joined #openstack-keystone | 17:28 | |
| shewless | dstanek: no.. I thought I was out of the woods. I'm sure this worked in the past.. | 17:28 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 17:29 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 17:29 |
| *** timcline_ has joined #openstack-keystone | 17:30 | |
| *** pushkaru has joined #openstack-keystone | 17:31 | |
| *** timcline has quit IRC | 17:32 | |
| *** timcline_ has quit IRC | 17:34 | |
| *** tqtran has joined #openstack-keystone | 17:36 | |
| *** gyee has joined #openstack-keystone | 17:37 | |
| *** ChanServ sets mode: +v gyee | 17:37 | |
| *** gyee has quit IRC | 17:37 | |
| *** julim has joined #openstack-keystone | 17:38 | |
| shewless | dstanek: I think it's because I had to add SSL to port 5000. I think there are some things (like in nova.conf) that have "http://" urls to keystone.. they likely need to be updated to https | 17:39 |
| shewless | dstanek: though I'm not sure why I'm able to login but the projects don't load | 17:39 |
| *** amoralej is now known as amoralej|off | 17:42 | |
| *** spzala has quit IRC | 17:43 | |
| *** spzala has joined #openstack-keystone | 17:43 | |
| *** tqtran has quit IRC | 17:43 | |
| *** rcernin has joined #openstack-keystone | 17:44 | |
| *** timcline has joined #openstack-keystone | 17:45 | |
| *** ayoung has quit IRC | 17:47 | |
| shewless | dstanek: I'm at a loss | 17:47 |
| *** ayoung has joined #openstack-keystone | 17:47 | |
| *** ChanServ sets mode: +v ayoung | 17:47 | |
| *** spzala has quit IRC | 17:48 | |
| shewless | dstanek: I updated nova/neutron/heat/glance to use https for port 5000 (auth_uri) but that didn't change a thing | 17:48 |
| shewless | dstanek: for whatever reason I get this wsgi:error Unable to retrieve project list | 17:48 |
| dstanek | shewless: you're able to get a token? | 17:48 |
| shewless | dstanek: let me try that | 17:49 |
| *** diazjf has joined #openstack-keystone | 17:49 | |
| *** spzala has joined #openstack-keystone | 17:50 | |
| *** chlong has quit IRC | 17:52 | |
| shewless | dstanek: How would I get a token? I can certainly login using horizon.. | 17:52 |
| shewless | dstanek: tried this and got a 401 error.. "curl -u my_user -X GET -L https://mycloud.foo.com:5000/v3/OS-FEDERATION/identity_providers/my_provider/protocols/saml2/auth" | 17:52 |
| dstanek | shewless: if you logged in then you should get a token. what action is causeing the error? | 17:53 |
| dstanek | shewless: federation is not as easy at that :-( | 17:53 |
| *** gyee has joined #openstack-keystone | 17:53 | |
| *** ChanServ sets mode: +v gyee | 17:53 | |
| *** browne has joined #openstack-keystone | 17:54 | |
| *** pece has quit IRC | 17:54 | |
| shewless | dstanek: I'm logged in. But as I log in I can see that error logged to apache/keystone. | 17:55 |
| *** sdake_ has quit IRC | 17:55 | |
| shewless | dstanek: once I login if I click the projects tab on the left I don't see any projects associated with my user name | 17:56 |
| *** darosale has quit IRC | 17:56 | |
| dstanek | shewless: and the group you are mapping to has roles on the projects? | 17:56 |
| *** permalac has quit IRC | 17:57 | |
| shewless | dstanek: yes I believe so. if I check with "openstack role assignment list --role user --group default_group" right? | 17:58 |
| ayoung | who is working on Rolling upgrades? bknudson_ ? | 18:00 |
| *** mvk has joined #openstack-keystone | 18:00 | |
| bknudson_ | I haven't been working on it. | 18:00 |
| dstanek | xek: mostly | 18:00 |
| bknudson_ | yes, xek | 18:01 |
| dstanek | ayoung: xek mostly | 18:01 |
| ayoung | xek, let me know when you want to talk rolling upgrades. Just had fascinating discussion about it IRL | 18:01 |
| ayoung | dstanek, bknudson_ what do you think of the idea that we group our migrations into two types: pre and post | 18:02 |
| *** jaugustine has joined #openstack-keystone | 18:02 | |
| ayoung | pre are "OK to run with Mitaka Code" and post are "require Newton code to run" | 18:02 |
| bknudson_ | makes sense, in a way. | 18:02 |
| bknudson_ | oh... not sure how that would work? | 18:02 |
| ayoung | its a little strange for people that want to follow master, but that should still be OK | 18:02 |
| ayoung | it just means that the DB migrations might come in out of order | 18:03 |
| bknudson_ | we're going to follow master | 18:03 |
| ayoung | so we need to think about that too, | 18:03 |
| ayoung | if we make each migration idempotent, like Ansible tasks, we can rerun them multiple times | 18:03 |
| ayoung | with no serious impact other than cycles | 18:03 |
| ayoung | maybe Alembic is the way to go here | 18:04 |
| dstanek | why would you rerun them? | 18:04 |
| ayoung | dstanek, say we use Alchemey and have 2 groups, pre and post | 18:04 |
| *** jsavak has quit IRC | 18:04 | |
| ayoung | now we come up with a new one that should go in pre | 18:04 |
| ayoung | but someone following master has already run some of the "post" ones | 18:04 |
| *** jsavak has joined #openstack-keystone | 18:05 | |
| ayoung | we want them to run it, too, to get the new behavior | 18:05 |
| ayoung | say we have 2 sets of unrealated changes. One is for revocations, one is for domains | 18:05 |
| bknudson_ | so what's been suggested in the past is having only additive changes in one group, and then have "cleanup" changes in another group. | 18:05 |
| bknudson_ | maybe this is the idea of pre / post? | 18:05 |
| ayoung | domains has Migrations D1 and D2 with D1 in pre, and D2 in post. Revoke has R1 and R2 | 18:05 |
| ayoung | Feature for domains goes in first, so D1 goes into Pre, D2 goes into post | 18:06 |
| dstanek | ayoung: i'd have to think about that. my short, short verision is: pull an instance out and update the code, use that instance to run additive schema changes (will work with old and new code), update all the code everywhere run migrations to add RI, not nulls, FKs, etc | 18:06 |
| ayoung | now bknudson_ you want the Revoke feature, So you need to run R1. We can't strictly order that with D2 | 18:06 |
| henrynash | ayoung: I am working on them | 18:07 |
| ayoung | dstanek, yeah..exactly that model | 18:07 |
| ayoung | henrynash, cool | 18:07 |
| dstanek | ayoung: that's the model i'd like to discuss at mid-cycle | 18:07 |
| ayoung | dstanek, ++ | 18:07 |
| ayoung | dstanek, so we need an intermediate state where it is safe to run M and N servers at the same time | 18:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/333445 | 18:08 |
| henrynash | ayoung: ++ | 18:08 |
| ayoung | dstanek, I was thinking a process like: Migrate to Pre. Start brining up N servers. Bring down M servers. Migrate to Post | 18:08 |
| henrynash | ayoung: I don’t know if we need the migrate to pre necessaryily (upgrading the first server could do that), but conceptaully I agree | 18:09 |
| henrynash | ayoung: I am building the migrate to post as a WIP right now | 18:09 |
| ayoung | henrynash, right, it is not "necsarry" right now, as we don | 18:09 |
| ayoung | 't know what the migrations are going to be | 18:09 |
| ayoung | it might, and probably will be necessary | 18:09 |
| henrynash | ayoung: agreed | 18:09 |
| ayoung | an example is "a new column with a reasonable default value" | 18:09 |
| ayoung | we need that in place before running the N code | 18:10 |
| ayoung | but the M code will quite happily run with the new, default column | 18:10 |
| henrynash | ayoung: yes | 18:10 |
| bknudson_ | ayoung: can you give an example of something that would happen in "migrate to post"? | 18:10 |
| henrynash | ayoung: should have a WIP post phase in a few days or so | 18:10 |
| ayoung | the post migration is "update the column to match the domain-specific-data-for-that -resource" | 18:10 |
| ayoung | bknudson_, only from expireinec,e not current work | 18:11 |
| dstanek | ayoung: i don't think you can bring up N servers until the first set of migrations runs | 18:11 |
| ayoung | we had data migrations when going from v2 to v3 catalogs | 18:11 |
| ayoung | dstanek, correct | 18:11 |
| ayoung | dstanek, that is the "pre" migrations | 18:11 |
| ayoung | pre happesn with M based servers only | 18:11 |
| dstanek | bknudson_: see my definition above | 18:11 |
| henrynash | bknudson_, ayoung: https://bugs.launchpad.net/keystone/+bug/1596500 | 18:11 |
| openstack | Launchpad bug 1596500 in OpenStack Identity (keystone) "Passwords created_at attribute could remain unset during rolling upgrade" [Undecided,New] - Assigned to Henry Nash (henry-nash) | 18:11 |
| dstanek | bknudson_: FKs, not nulls, etc | 18:11 |
| dstanek | henrynash: ++ exactly that | 18:12 |
| bknudson_ | dstanek: so we'd run for a while without FKs, not NULLs, etc? The post migration might fail. | 18:12 |
| ayoung | we need to account for failure recover | 18:13 |
| ayoung | y | 18:13 |
| ayoung | I think we also need to be able to have the new code in "compat mode" | 18:13 |
| henrynash | bknudson_: the post phase would have to set the values required (i.e. in the case I mention setting it to now() ) is fine | 18:13 |
| ayoung | that means it knows it is running along side M servers | 18:13 |
| *** fangxu has quit IRC | 18:13 | |
| henrynash | ..set any roes added during the rolling migrate phase that got written via non-upgrade dsevres | 18:13 |
| dstanek | bknudson_: we would have to set proper defaults | 18:14 |
| bknudson_ | I'm more worried about the FKs, since without the FK the referenced row might be removed. | 18:15 |
| dstanek | ayoung: i think compat mode just adds complexity. they can run side by side for most changes | 18:15 |
| dstanek | bknudson_: yep, depending on what we are doing there would be a small about of time where things could get out of sync | 18:16 |
| *** julim has quit IRC | 18:16 | |
| henrynash | bknudson_: agreed, it can’t (at least not easily) cope with all cases…without tempotatu scaffolding created by interi code….. | 18:16 |
| ayoung | dstanek, we define the superset of mechanisms, and only use them if required | 18:17 |
| shewless | dstanek: maybe this is a bit of a red herring | 18:17 |
| ayoung | Roe...Herring... http://www.shakespeare-navigators.com/romeo/T24.html | 18:17 |
| shewless | dstanek: I can actually login and create instances.. and my neighbour can too... I certainly get that error in the logs but maybe I don't care? | 18:17 |
| bknudson_ | would it be OK for operations against the old servers to fail for a while? | 18:18 |
| bknudson_ | or to disable updates to the old servers? | 18:18 |
| shewless | dstanek: do you know if it is possible to get a token from the command line? I haven't been able to figure that out.. then I could list projects | 18:18 |
| dstanek | shewless: if you don't care then i don't care :-) you should probably find out why you can't get a projects list though | 18:18 |
| bknudson_ | I assume we'd be fine as long as we could issue / validate tokens. | 18:18 |
| dstanek | shewless: i think only from a python script. | 18:19 |
| *** ddieterly[away] is now known as ddieterly | 18:19 | |
| dstanek | bknudson_: i don't mind a read-only mode | 18:20 |
| shewless | dstanek: well I do care because I assume it'll bite me in the ass later.. :P | 18:20 |
| dstanek | we would still have to be careful about moving/renaming things that are necessary for tokens | 18:20 |
| *** jorge_munoz has joined #openstack-keystone | 18:20 | |
| shewless | dstanek: is there a precanned python script I can use? | 18:20 |
| dstanek | shewless: does the group you are mapping to have roles on any projects? | 18:20 |
| dstanek | shewless: i gave you an example a week or two ago :-P. I'll have to look for it in a bit | 18:21 |
| shewless | dstanek: oh? hmm. maybe at the time I wasn't ready for it. I wish I could "grep" that eavesdrop log. | 18:21 |
| shewless | dstanek: regarding roles: I think so but to be honest I don't know how to check | 18:21 |
| bknudson_ | If it would make things a lot easier I think we should consider a no-updates mode. | 18:22 |
| shewless | I was doing these 3 commands for every user: 1: "openstack group create Ego --domain my_domain" 2:"openstack project create Ego --domain my_domain" 3:"openstack role add user --group Ego --project Ego" | 18:22 |
| *** tqtran has joined #openstack-keystone | 18:23 | |
| shewless | dstanek: is " openstack role add user " wrong? | 18:23 |
| *** timcline has quit IRC | 18:26 | |
| *** timcline has joined #openstack-keystone | 18:27 | |
| shewless | dstanek: I think I have it right. For role "user" I have several "group and project" mappings | 18:27 |
| shewless | dstanek: since I want each user in the end to come in on their own group and get their own project. This seems to be functioning.. it's just that blasted error | 18:27 |
| dstanek | shewless: are you getting that error in the keystone or horizon log? | 18:31 |
| *** timcline has quit IRC | 18:31 | |
| *** jaugustine has quit IRC | 18:31 | |
| *** dmk0202 has quit IRC | 18:32 | |
| shewless | dstanek: it's in apache2 - I think it's keystone.. | 18:34 |
| shewless | dstanek: but not sure how to check | 18:34 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 18:34 |
| *** dmk0202 has joined #openstack-keystone | 18:34 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 18:34 |
| *** dmk0202 has quit IRC | 18:37 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fix the username value in federated tokens https://review.openstack.org/335617 | 18:37 |
| *** henrynash has quit IRC | 18:38 | |
| shewless | dstanek: maybe it's horizon | 18:40 |
| dstanek | which log is it in? | 18:40 |
| shewless | dstanek: I checked the pid logged by the wsgi:error and the pid belongs to apache2 (user horizon) | 18:40 |
| *** jsavak has quit IRC | 18:40 | |
| shewless | dstanek: /var/log/apache2/error.log | 18:40 |
| *** dan_nguyen has joined #openstack-keystone | 18:41 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Extracted common ldap setup and use in the filter tests https://review.openstack.org/334063 | 18:42 |
| openstackgerrit | David Stanek proposed openstack/keystone: Reduce domain specific config setup duplication https://review.openstack.org/334062 | 18:42 |
| *** ayoung has quit IRC | 18:44 | |
| *** ayoung has joined #openstack-keystone | 18:44 | |
| *** ChanServ sets mode: +v ayoung | 18:44 | |
| *** diazjf has quit IRC | 18:46 | |
| *** diazjf has joined #openstack-keystone | 18:46 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Removes duplicate ldap test setup https://review.openstack.org/334064 | 18:47 |
| *** julim has joined #openstack-keystone | 18:47 | |
| *** jacelc has joined #openstack-keystone | 18:47 | |
| *** jacelc is now known as ravelar159 | 18:47 | |
| *** jaugustine has joined #openstack-keystone | 18:50 | |
| *** henrynash has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v henrynash | 18:54 | |
| *** sheel has quit IRC | 18:55 | |
| *** jaugustine has quit IRC | 18:56 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [DEFAULT] documentation https://review.openstack.org/334669 | 18:56 |
| *** jaugustine has joined #openstack-keystone | 18:56 | |
| *** darosale has joined #openstack-keystone | 18:57 | |
| *** julim has quit IRC | 18:58 | |
| shewless | dstanek: FYI every time I click on pretty much anything in the horizon gui it logs the "Unable to retrieve project list" | 19:00 |
| *** notmyname has quit IRC | 19:01 | |
| shewless | dstanek: weird? | 19:01 |
| *** stevemar has quit IRC | 19:02 | |
| *** slberger has joined #openstack-keystone | 19:03 | |
| *** stevemar has joined #openstack-keystone | 19:03 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Rename [DEFAULT] keystone.conf module to keystone.conf.default https://review.openstack.org/335628 | 19:03 |
| *** notmyname has joined #openstack-keystone | 19:04 | |
| *** fangxu has joined #openstack-keystone | 19:09 | |
| *** timcline has joined #openstack-keystone | 19:10 | |
| dstanek | shewless: what is happening in the keystone log when you see that? | 19:10 |
| *** fangxu has quit IRC | 19:11 | |
| *** sdake has joined #openstack-keystone | 19:14 | |
| *** timcline has quit IRC | 19:14 | |
| *** spandhe has quit IRC | 19:15 | |
| *** aloga_ has quit IRC | 19:15 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [domain_config] documentation https://review.openstack.org/335545 | 19:16 |
| shewless | dstanek: on login I see a warning: Could not find domain: Federated | 19:16 |
| *** mwheckmann has quit IRC | 19:16 | |
| shewless | dstanek but otherwise nothing (like when I click on stuff) | 19:16 |
| shewless | dstanek: that could not find domain might be a problem? | 19:17 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [credential] documentation https://review.openstack.org/334702 | 19:18 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [endpoint_filter] documentation https://review.openstack.org/335636 | 19:20 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [endpoint_policy] documentation https://review.openstack.org/335638 | 19:20 |
| *** roxanaghe has quit IRC | 19:23 | |
| dstanek | shewless: possibly. what is you keystone log level set to? | 19:24 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [eventlet_server] documentation https://review.openstack.org/335642 | 19:25 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: update a config option deprecation message https://review.openstack.org/335643 | 19:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: update a config option deprecation message https://review.openstack.org/335643 | 19:27 |
| stevemar | dolphm: https://review.openstack.org/#/c/335643/ | 19:28 |
| patchbot | stevemar: patch 335643 - keystone - update a config option deprecation message | 19:28 |
| dolphm | stevemar: awesome | 19:28 |
| *** mwheckmann has joined #openstack-keystone | 19:30 | |
| stevemar | lbragstad: can you review https://review.openstack.org/#/c/332493/ | 19:32 |
| patchbot | stevemar: patch 332493 - keystone - Correct use of isotime | 19:32 |
| *** jsavak has joined #openstack-keystone | 19:34 | |
| *** pushkaru has quit IRC | 19:35 | |
| *** henrynash has quit IRC | 19:35 | |
| *** catintheroof has quit IRC | 19:43 | |
| *** henrynash has joined #openstack-keystone | 19:47 | |
| *** ChanServ sets mode: +v henrynash | 19:47 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Remove test_backend_ldap skips for missing tests https://review.openstack.org/335514 | 19:48 |
| openstackgerrit | David Stanek proposed openstack/keystone: Adds a skip method to identify useless skips https://review.openstack.org/335515 | 19:48 |
| openstackgerrit | David Stanek proposed openstack/keystone: Use skip_test_overrides in test_backend_ldap https://review.openstack.org/335516 | 19:48 |
| openstackgerrit | David Stanek proposed openstack/keystone: Updated tests that claimed to be blocked by bugs https://review.openstack.org/335517 | 19:48 |
| openstackgerrit | David Stanek proposed openstack/keystone: Update the nosetests test regex for legacy tests https://review.openstack.org/335649 | 19:48 |
| notmorgan | dstanek: woo. | 19:50 |
| *** ddieterly is now known as ddieterly[away] | 19:56 | |
| *** henrynash has quit IRC | 19:56 | |
| *** Guest20454 is now known as mgagne | 19:58 | |
| *** mgagne has joined #openstack-keystone | 19:58 | |
| dstanek | notmorgan: ? | 19:58 |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 19:59 |
| *** ChanServ sets mode: +o stevemar | 20:04 | |
| *** timcline has joined #openstack-keystone | 20:04 | |
| *** diazjf has quit IRC | 20:05 | |
| *** timcline has quit IRC | 20:09 | |
| *** aloga_ has joined #openstack-keystone | 20:09 | |
| *** pnavarro has joined #openstack-keystone | 20:12 | |
| *** aloga_ has quit IRC | 20:13 | |
| dstanek | nonameentername: you around? | 20:16 |
| dstanek | dolphm: i find the encrypted credentials implementation a little strange and wanted to get your take on it | 20:17 |
| dolphm | dstanek: how so? | 20:18 |
| dolphm | (it's been a several weeks since i've reviewed it, but i believe i +2'd it at some point) | 20:19 |
| *** julim has joined #openstack-keystone | 20:19 | |
| *** ddieterly[away] is now known as ddieterly | 20:19 | |
| dstanek | dolphm: the keys in config file seems strange | 20:20 |
| dstanek | dolphm: to rotate keys you have to orchestrate two different config file changes plus a migration | 20:21 |
| dolphm | dstanek: that's correct - but i don't expect the rotation strategy to look anything like what we'd recommend for fernet tokens either | 20:23 |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/333445 | 20:23 |
| dolphm | dstanek: IF you ever need to rotate tokens, yeah, it's not a super graceful process | 20:23 |
| dolphm | dstanek: but the major difference is that ciphertext is NEVER exposed directly to clients | 20:23 |
| dolphm | dstanek: they're just used to encrypt things at rest in the backend | 20:23 |
| dolphm | #iamnotacryptoexpert | 20:24 |
| *** stevemar_ has joined #openstack-keystone | 20:24 | |
| *** ChanServ sets mode: +o stevemar_ | 20:24 | |
| dolphm | rotate *keys*, sorry | 20:24 |
| dstanek | it seems like one of those things that will bite operators because of the fact that you do it infrequently. when you need to it's likely a compromise situation and you have to figure out how the while thing works again | 20:26 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [federation] documentation https://review.openstack.org/335661 | 20:26 |
| dstanek | dolphm: also doesn't PCI dictate having to change these types of secrets too? | 20:26 |
| dolphm | dstanek: agree, and good question | 20:26 |
| dolphm | dstanek: i'm not sure, but i'd have to imagine yes :-/ | 20:27 |
| dolphm | dstanek: maybe pick this up in our code review time tomorrow? | 20:28 |
| dstanek | dolphm: sounds good to me | 20:28 |
| *** roxanaghe has joined #openstack-keystone | 20:28 | |
| dolphm | dstanek: i'm not sure werner has attended one | 20:28 |
| notmorgan | dstanek: seeing the proposed patches | 20:29 |
| dstanek | notmorgan: ah, i unwound what used to be test_backend_ldap...you're welcome | 20:30 |
| *** aloga_ has joined #openstack-keystone | 20:31 | |
| notmorgan | :) | 20:34 |
| *** timcline has joined #openstack-keystone | 20:35 | |
| *** timcline has quit IRC | 20:35 | |
| openstackgerrit | werner mendizabal proposed openstack/keystone: Support encryption of credentials in Keystone https://review.openstack.org/317169 | 20:35 |
| *** timcline has joined #openstack-keystone | 20:36 | |
| *** tonytan4ever has quit IRC | 20:40 | |
| notmorgan | dolphm: so.. yes PCI requires those secrets to be changed/rotated in some ways | 20:42 |
| notmorgan | but it's not as common | 20:42 |
| notmorgan | the "at rest" part is tricky because the keys themselves need to be securely stored... | 20:42 |
| notmorgan | as well -- ugh, yay NSS! | 20:43 |
| notmorgan | ayoung: ^ ;) | 20:43 |
| notmorgan | when you're retrofitting crypto into a current system you end up with weird compromises. :( | 20:43 |
| dstanek | notmorgan: yeah, we used to have a thing called the 'keymaster' and instances would negotiate for keys and only store them in RAM disk | 20:44 |
| notmorgan | dstanek: right. ideally you need to isolate the keys from the main keystone config. thnkfully we can load multiple config files. | 20:44 |
| notmorgan | dstanek: also, what happens when you encrypt the data and the keys fail to load? keystone needs to validate the key is "good" somehow? or potentially it is writing bad/corrupted data/unreadable data | 20:45 |
| notmorgan | dstanek: so do we need a canary entry? | 20:45 |
| dstanek | notmorgan: i'm hoping the fernet library craps itself if you try to encrypt with a bad key | 20:45 |
| notmorgan | also, concerns about what crypto we support out of the box, since bad crypto is easy to do. | 20:45 |
| notmorgan | dstanek: i mean the credentials backend | 20:46 |
| notmorgan | not fernet - fernet is fine imho | 20:46 |
| dstanek | notmorgan: the patch uses fernet as the default provider for the credentials backend | 20:46 |
| nonameentername | dstanek: did you have a question? | 20:46 |
| notmorgan | nonameentername: ^ just some thoughts | 20:46 |
| notmorgan | nonameentername: not that the credential crypto spec is bad, just things to consider when working on it :) | 20:47 |
| dstanek | nonameentername: yeah ^. dolphm and i were talking about discussing it more tomorrow | 20:47 |
| dstanek | notmorgan: this goes back the the whole 'let barbican do it' argument | 20:48 |
| notmorgan | i wish PKI was faster/less painful. | 20:48 |
| notmorgan | dstanek: our crendential backend has been historically terrible | 20:48 |
| notmorgan | dstanek: however, barbican has weird issues/limits that make it hard to fit into the model we have built | 20:48 |
| nonameentername | yeah, I think moving forward credentials should not be stored in keystone | 20:49 |
| nonameentername | but meanwhile they are we should not store them in plain text | 20:49 |
| dstanek | notmorgan: agreed, but something we may need to figure out | 20:49 |
| notmorgan | basically they need to support a "service" owner vs a "tenant" owner like they do now, unless we just 100% bail on keystone acting as a proxy here [100% fine with that, but we have some things that need to know how to get the things from barbican] | 20:49 |
| nonameentername | I think keystone should not have them at all since that's what Barbican is designed to do | 20:50 |
| notmorgan | nonameentername: right - now we just need to deal with "how does one lookup the relevant secret from barbican in keystone's context" | 20:51 |
| notmorgan | since keystone doesn't have the authz from the user yet | 20:51 |
| nonameentername | yeah, keystone would have to get credentials from Barbican somehow | 20:52 |
| notmorgan | and barbican stores things by tenant iirc | 20:52 |
| notmorgan | which gives us some weird things to work out. | 20:52 |
| dstanek | could you have a keystone_service tenant that owns all the secrets (i have no idea what barbican's data model looks like) | 20:53 |
| nonameentername | I don't know, I would have to look at Barbican to understand how it works | 20:54 |
| *** dmk0202 has joined #openstack-keystone | 20:54 | |
| woodster_ | dstanek: nonameentername redrobot Barbican does store secrets via tenant/project ID | 20:55 |
| *** aloga_ has quit IRC | 20:56 | |
| * woodster_ so you could have a service tenant if you wanted | 20:56 | |
| * woodster_ apologizes for missing context potentially | 20:56 | |
| *** haplo37_ has quit IRC | 20:59 | |
| *** raildo is now known as raildo-afk | 21:03 | |
| dstanek | woodster_: nope, that's what i was asking :-) | 21:08 |
| dstanek | woodster_: we have credentials stored in keystone on behalf of the user and keystone must access them without the user authenticating | 21:08 |
| woodster_ | dstanek: did the user put the keys there, or did keystone? | 21:10 |
| *** jsavak has quit IRC | 21:11 | |
| stevemar_ | bknudson_: so it seems like patch 332493 is good? | 21:12 |
| patchbot | stevemar_: https://review.openstack.org/#/c/332493/ - keystone - Correct use of isotime | 21:12 |
| stevemar_ | bknudson_: based on your results | 21:12 |
| dstanek | woodster_: in the case of TOTP the user will. they tell keystone a secret for the TOTP auth so they must be authenticated and the secret must be associated with them somehow. when the user auths with TOTP then won't be authed yet and keystone will need to pull that secret as part of the algorithm for validating the one time codes | 21:12 |
| *** jaugustine has quit IRC | 21:12 | |
| bknudson_ | stevemar_: maybe? I don't know if fernet wants to have .000000Z rather than 703495Z ? | 21:13 |
| stevemar_ | dolphm: lbragstad ^ | 21:14 |
| bknudson_ | but it should work the way it is. | 21:14 |
| stevemar_ | bknudson_: you're supposed to know everything | 21:14 |
| bknudson_ | not sure if we want to actually change the v2 behavior. | 21:14 |
| bknudson_ | I think it's more correct with the change since it matches the spec | 21:15 |
| bknudson_ | but there's also the argument that it's been working the old way for a long time so better not to change it. | 21:16 |
| *** dan_nguyen has quit IRC | 21:16 | |
| woodster_ | dstanek: oh I see. Yeah it seems Keystone would need to store their secret under keystone's service tenant. Keystone could add the user's ID to the secret if the user needs to be able to access that secret later. | 21:17 |
| *** fangxu has joined #openstack-keystone | 21:17 | |
| bknudson_ | I'm leaning towards don't change it. | 21:18 |
| * woodster_ reminds me of impersonation/trusts discussions of long ago | 21:19 | |
| *** ayoung has quit IRC | 21:20 | |
| openstackgerrit | Merged openstack/keystone: Improve keystone.conf [DEFAULT] documentation https://review.openstack.org/334669 | 21:21 |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [identity] documentation https://review.openstack.org/335673 | 21:25 |
| *** dan_nguyen has joined #openstack-keystone | 21:26 | |
| *** gagehugo has quit IRC | 21:26 | |
| *** dan_nguyen has quit IRC | 21:32 | |
| *** ravelar159 has quit IRC | 21:33 | |
| *** pauloewerton has quit IRC | 21:36 | |
| *** spandhe has joined #openstack-keystone | 21:43 | |
| *** tqtran has quit IRC | 21:45 | |
| *** tqtran has joined #openstack-keystone | 21:46 | |
| *** ddieterly is now known as ddieterly[away] | 21:47 | |
| openstackgerrit | Merged openstack/keystone: Rename [DEFAULT] keystone.conf module to keystone.conf.default https://review.openstack.org/335628 | 21:48 |
| openstackgerrit | Merged openstack/keystone: update a config option deprecation message https://review.openstack.org/335643 | 21:48 |
| *** gordc has quit IRC | 21:49 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Improve keystone.conf [identity_mapping] documentation https://review.openstack.org/335681 | 21:52 |
| *** rcernin has quit IRC | 21:54 | |
| *** spzala has quit IRC | 21:55 | |
| *** spzala has joined #openstack-keystone | 21:55 | |
| *** spzala has quit IRC | 22:00 | |
| *** pnavarro has quit IRC | 22:02 | |
| *** dmk0202 has quit IRC | 22:08 | |
| *** itisha has quit IRC | 22:10 | |
| *** rderose has joined #openstack-keystone | 22:10 | |
| notmorgan | bknudson_: shouldn't want .000000z | 22:13 |
| notmorgan | ideally we should drop microseconds across the board not just floor them | 22:13 |
| notmorgan | bknudson_: aiui the format fernet uses is sans decimal. | 22:14 |
| *** spzala has joined #openstack-keystone | 22:14 | |
| notmorgan | bknudson_: i would *like* to see us drop subseconds everywhere, period. | 22:15 |
| bknudson_ | notmorgan: the identity API spec specifies the format has microseconds. | 22:15 |
| *** ddieterly[away] is now known as ddieterly | 22:15 | |
| notmorgan | bknudson_: then we need to fix that. | 22:15 |
| bknudson_ | v4 here we come. | 22:15 |
| notmorgan | bknudson_: legitimately, we should NEVEr have included microseconds, it was a bad choice to get "unique" data in the tokens | 22:16 |
| notmorgan | and a poor one | 22:16 |
| notmorgan | we need to unwind that so everything works like it should. | 22:16 |
| *** ametts has quit IRC | 22:16 | |
| notmorgan | and no, not V4, SPLIT AUTH OFF CRUD | 22:16 |
| notmorgan | and then work on auth as it's own thing | 22:17 |
| notmorgan | because this whole AUTH must be the same version as the CRUD interface is absurd | 22:17 |
| bknudson_ | ok. somebody needs to work on the code | 22:17 |
| *** chlong has joined #openstack-keystone | 22:17 | |
| notmorgan | it's on my long long list, but i am limited by keystone not being my job. | 22:17 |
| notmorgan | actually it is towards the top of my list for keystone things. | 22:18 |
| notmorgan | i just need to sit down one afternoon and do it. | 22:19 |
| notmorgan | it's not crazy difficult code. | 22:19 |
| bknudson_ | first you'll need to refactor the auth provider interface. | 22:19 |
| notmorgan | not a lot. | 22:19 |
| bknudson_ | figure out how to handle the service catalog | 22:19 |
| notmorgan | basically my thoughts are /auth and ... /catalog? | 22:20 |
| notmorgan | and then wire everything up to be hooked into the new code location -- the new code location will allow specification of an auth-version | 22:21 |
| bknudson_ | microversioning? | 22:21 |
| notmorgan | which if not supplied is <base whateveR> -- just like microversions but separate | 22:21 |
| notmorgan | yeah | 22:21 |
| notmorgan | basically auth itself is not a Openstack-Verson XXX thing | 22:21 |
| notmorgan | but i would add version into the auth-request body | 22:21 |
| bknudson_ | what about validation? | 22:22 |
| notmorgan | same thing. specify the version you want when validating. | 22:22 |
| notmorgan | we will format it for you | 22:22 |
| bknudson_ | right, but not in the body | 22:22 |
| notmorgan | but i don't want it to be tied to the explicit API microversion supported | 22:22 |
| notmorgan | since you may want CRUD interface 23, but auth-format v3 | 22:23 |
| notmorgan | since api-microversions are the entire API surface | 22:23 |
| bknudson_ | so we'd have microversion on the v2.0 api ? | 22:23 |
| notmorgan | V2.0 would remain as it is and be unsupported in new auth formating | 22:23 |
| bknudson_ | the first microversion should be remove v2 API | 22:24 |
| notmorgan | V3 and formats extending beyond V3 will be supported under /auth | 22:24 |
| bknudson_ | it would just be nice if everybody didn't use v2 all the time. | 22:25 |
| notmorgan | so maybe we make it OpenStack-Auth-Format? or OpenStack-Auth-Version | 22:25 |
| notmorgan | the idea is that auth should work with any form of the CRUD api. | 22:25 |
| notmorgan | so make the formats we return better. | 22:25 |
| notmorgan | and allow iterating on it without needing to version the entire API | 22:26 |
| notmorgan | and KSM can learn the new formats since it's opaque to the underlying services. | 22:26 |
| notmorgan | [it also lets us explore things like OAuth2 if we really wanted to as a "format"] | 22:27 |
| bknudson_ | auth-token middleware? It just uses the auth plugins | 22:27 |
| notmorgan | right, but it "knows" the format of the response | 22:27 |
| notmorgan | if we fix/optimize/solve issues with the format | 22:27 |
| notmorgan | we can make KSM learn it. | 22:27 |
| notmorgan | older KSMs will just consume what they do today | 22:27 |
| notmorgan | newer will be smarter. | 22:27 |
| bknudson_ | would be nice to drop support for v2 in auth-token middleware | 22:27 |
| *** ayoung has joined #openstack-keystone | 22:27 | |
| *** ChanServ sets mode: +v ayoung | 22:27 | |
| notmorgan | yes. | 22:27 |
| notmorgan | i agree | 22:28 |
| *** chrisshattuck has quit IRC | 22:28 | |
| notmorgan | i think we legitimately are close to being able to do so | 22:28 |
| notmorgan | fwiw | 22:28 |
| bknudson_ | why couldn't we? | 22:28 |
| *** chrisshattuck has joined #openstack-keystone | 22:28 | |
| notmorgan | i think we need to just ensure it works in a gate job as expected. | 22:28 |
| notmorgan | i think the blocker is nova->neutron fwiw. | 22:28 |
| *** mwheckmann has quit IRC | 22:29 | |
| *** darosale has quit IRC | 22:29 | |
| bknudson_ | I meant auth-token middleware talking to keystone v2 | 22:29 |
| notmorgan | but a gate job would solve it. [also 100% of the v3 conversion headache has been the tight coupling of auth to crud versions] | 22:29 |
| notmorgan | bknudson_: so like i said, a gate job, make sure we don't have someone still leaning on the bad config options in ksm outside of the ksm block | 22:30 |
| bknudson_ | there probably is something out there setting the auth_token version to v2.0 | 22:30 |
| notmorgan | yeah. | 22:30 |
| notmorgan | i think the v3-only gate thing really is going to be when we can do that | 22:31 |
| notmorgan | unfortunately | 22:31 |
| openstackgerrit | Merged openstack/keystonemiddleware: Refactor API tests to not run middleware https://review.openstack.org/334294 | 22:35 |
| *** stevemar_ has quit IRC | 22:38 | |
| *** sdake_ has joined #openstack-keystone | 22:42 | |
| stevemar | bknudson_: did you book a hotel for barcelona yet? | 22:44 |
| *** sdake has quit IRC | 22:45 | |
| *** edmondsw has quit IRC | 22:46 | |
| *** ddieterly is now known as ddieterly[away] | 22:47 | |
| *** ddieterly[away] has quit IRC | 22:47 | |
| *** sdake_ has quit IRC | 22:49 | |
| *** KevinE has quit IRC | 22:51 | |
| *** code-R_ has quit IRC | 22:52 | |
| bknudson_ | stevemar: I don't think so. | 22:56 |
| bknudson_ | stevemar: oh, actually, I did | 22:57 |
| bknudson_ | Holiday Inn Express BARCELONA - CITY 22@ | 22:57 |
| *** setuid has quit IRC | 22:58 | |
| *** dan_nguyen has joined #openstack-keystone | 22:58 | |
| *** setuid has joined #openstack-keystone | 23:01 | |
| *** setuid has joined #openstack-keystone | 23:01 | |
| *** sdake has joined #openstack-keystone | 23:01 | |
| *** sdake has quit IRC | 23:04 | |
| *** chrisshattuck has quit IRC | 23:06 | |
| *** jamielennox is now known as jamielennox|away | 23:13 | |
| openstackgerrit | Roxana Gherle proposed openstack/keystone: Fix the username value in federated tokens https://review.openstack.org/335617 | 23:17 |
| *** slberger has left #openstack-keystone | 23:19 | |
| *** roxanaghe has quit IRC | 23:22 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Exclude releasenotes from pep8 https://review.openstack.org/335710 | 23:22 |
| openstackgerrit | Merged openstack/keystone: Concrete role assignments for federated users https://review.openstack.org/284943 | 23:24 |
| stevemar | bknudson_: 2km away | 23:24 |
| stevemar | oof | 23:24 |
| *** dan_nguyen has quit IRC | 23:25 | |
| *** code-R has joined #openstack-keystone | 23:28 | |
| *** iurygregory_ has joined #openstack-keystone | 23:35 | |
| *** jamielennox|away is now known as jamielennox | 23:51 | |
| jamielennox | bknudson_: you have oslo.context core! | 23:53 |
| jamielennox | excellent, now i know who to come to | 23:53 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!