| *** markvoelker has joined #openstack-keystone | 00:12 | |
| *** sdake has joined #openstack-keystone | 00:13 | |
| *** tonytan4ever has joined #openstack-keystone | 00:16 | |
| *** markvoelker has quit IRC | 00:17 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs: Optional MFA via password + TOTP auth plugin https://review.openstack.org/345113 | 00:17 |
|---|---|---|
| *** sdake has quit IRC | 00:17 | |
| *** tonytan4ever has quit IRC | 00:21 | |
| *** chlong has joined #openstack-keystone | 00:26 | |
| *** chlong has quit IRC | 00:30 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone: adding combined password and totp auth plugin https://review.openstack.org/343422 | 00:37 |
| *** chlong has joined #openstack-keystone | 00:41 | |
| adriant | steavemar: do you want me to add an item about MFA to the meeting agenda? | 00:45 |
| adriant | stevemar^ | 00:45 |
| *** tqtran has joined #openstack-keystone | 00:46 | |
| *** tqtran has quit IRC | 00:51 | |
| stevemar | adriant: sure | 00:53 |
| stevemar | adriant: over here: https://etherpad.openstack.org/p/keystone-weekly-meeting | 00:53 |
| stevemar | adriant: i was just gonna add something else there... | 00:54 |
| *** julim has joined #openstack-keystone | 01:05 | |
| *** chlong has quit IRC | 01:10 | |
| *** markvoelker has joined #openstack-keystone | 01:13 | |
| *** spzala has quit IRC | 01:13 | |
| *** spzala has joined #openstack-keystone | 01:13 | |
| adriant | stevemar: oh awesome, you've added it already. Thanks. :) | 01:13 |
| stevemar | adriant: ;) | 01:13 |
| *** davechen has joined #openstack-keystone | 01:14 | |
| stevemar | adriant: will you be able to attend and any questions? | 01:17 |
| *** markvoelker has quit IRC | 01:17 | |
| adriant | Yep, the meeting is a convenient 6pm my time. :) | 01:17 |
| *** tonytan4ever has joined #openstack-keystone | 01:18 | |
| *** spzala has quit IRC | 01:18 | |
| adriant | stevemar: correction, not 6pm my time, but yes will attent. :) | 01:22 |
| *** tonytan4ever has quit IRC | 01:22 | |
| *** chlong has joined #openstack-keystone | 01:23 | |
| *** chlong has quit IRC | 01:28 | |
| *** chlong has joined #openstack-keystone | 01:30 | |
| *** EinstCrazy has joined #openstack-keystone | 01:35 | |
| *** EinstCrazy has quit IRC | 01:38 | |
| *** EinstCrazy has joined #openstack-keystone | 01:38 | |
| *** spzala has joined #openstack-keystone | 01:50 | |
| *** spzala has quit IRC | 01:50 | |
| *** spzala has joined #openstack-keystone | 01:50 | |
| *** tangchen has joined #openstack-keystone | 01:58 | |
| stevemar | lbragstad: can you confirm if https://bugs.launchpad.net/keystone/+bug/1433331 is resolved? | 02:41 |
| openstack | Launchpad bug 1433331 in OpenStack Identity (keystone) "Collapse Fernet specific tests into test_v3_auth.py TestAuth" [Low,Triaged] | 02:41 |
| *** tonytan4ever has joined #openstack-keystone | 02:52 | |
| *** NanKe has joined #openstack-keystone | 03:00 | |
| *** TxGVNN has joined #openstack-keystone | 03:03 | |
| *** roxanaghe has joined #openstack-keystone | 03:10 | |
| *** jamiec has quit IRC | 03:20 | |
| *** jamiec has joined #openstack-keystone | 03:21 | |
| *** spzala has quit IRC | 03:26 | |
| *** amitkqed has quit IRC | 03:38 | |
| openstackgerrit | Merged openstack/keystone: Add schema validation to v2 update tenant https://review.openstack.org/348738 | 03:38 |
| *** amitkqed has joined #openstack-keystone | 03:38 | |
| *** tqtran has joined #openstack-keystone | 03:47 | |
| *** code-R_ has joined #openstack-keystone | 03:50 | |
| *** code-R has quit IRC | 03:50 | |
| *** tqtran has quit IRC | 03:52 | |
| *** roxanaghe has quit IRC | 03:54 | |
| *** chlong has quit IRC | 04:15 | |
| *** roxanaghe has joined #openstack-keystone | 04:19 | |
| *** jidar has quit IRC | 04:20 | |
| *** jidar has joined #openstack-keystone | 04:24 | |
| *** code-R has joined #openstack-keystone | 04:26 | |
| *** code-R_ has quit IRC | 04:28 | |
| *** davechen has quit IRC | 04:29 | |
| *** chlong has joined #openstack-keystone | 04:31 | |
| *** code-R has quit IRC | 05:01 | |
| *** code-R has joined #openstack-keystone | 05:01 | |
| *** code-R_ has joined #openstack-keystone | 05:09 | |
| *** code-R has quit IRC | 05:12 | |
| *** roxanaghe has quit IRC | 05:20 | |
| *** tonytan4ever has quit IRC | 05:25 | |
| *** spzala has joined #openstack-keystone | 05:26 | |
| *** spzala has quit IRC | 05:31 | |
| *** tqtran has joined #openstack-keystone | 05:49 | |
| *** tqtran has quit IRC | 05:53 | |
| *** brancal has joined #openstack-keystone | 06:02 | |
| *** code-R has joined #openstack-keystone | 06:12 | |
| *** code-R_ has quit IRC | 06:13 | |
| *** tqtran has joined #openstack-keystone | 06:20 | |
| *** roxanaghe has joined #openstack-keystone | 06:21 | |
| *** davechen has joined #openstack-keystone | 06:24 | |
| *** tqtran has quit IRC | 06:24 | |
| *** roxanaghe has quit IRC | 06:25 | |
| *** adriant has quit IRC | 06:26 | |
| *** tonytan4ever has joined #openstack-keystone | 06:26 | |
| *** zouyapeng has joined #openstack-keystone | 06:30 | |
| *** tonytan4ever has quit IRC | 06:31 | |
| *** zouyapeng has quit IRC | 06:33 | |
| *** zouyapeng has joined #openstack-keystone | 06:33 | |
| *** belmoreira has joined #openstack-keystone | 06:33 | |
| *** tesseract- has joined #openstack-keystone | 06:44 | |
| *** daemontool_ has joined #openstack-keystone | 06:53 | |
| *** gb21 has joined #openstack-keystone | 06:55 | |
| *** chlong has quit IRC | 06:59 | |
| *** gb21 is now known as GB21 | 06:59 | |
| *** jpena|off has joined #openstack-keystone | 07:00 | |
| *** jpena|off is now known as jpena | 07:00 | |
| *** jed56 has joined #openstack-keystone | 07:04 | |
| *** chlong has joined #openstack-keystone | 07:11 | |
| *** tonytan4ever has joined #openstack-keystone | 07:27 | |
| *** code-R has quit IRC | 07:30 | |
| *** tonytan4ever has quit IRC | 07:32 | |
| *** chlong has quit IRC | 07:34 | |
| *** rha has joined #openstack-keystone | 07:42 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** jaosorior has joined #openstack-keystone | 08:03 | |
| *** roxanaghe has joined #openstack-keystone | 08:09 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: [WIP] Testing latest u-c https://review.openstack.org/318435 | 08:10 |
| *** roxanaghe has quit IRC | 08:14 | |
| *** roxanaghe has joined #openstack-keystone | 09:00 | |
| *** brancal has quit IRC | 09:01 | |
| *** brancal has joined #openstack-keystone | 09:02 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Improve authentication plugins documentation https://review.openstack.org/349423 | 09:03 |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Add missing class name to tuple of public objects https://review.openstack.org/349424 | 09:03 |
| *** roxanaghe has quit IRC | 09:06 | |
| *** tangchen has quit IRC | 09:27 | |
| *** tonytan4ever has joined #openstack-keystone | 09:28 | |
| *** tonytan4ever has quit IRC | 09:33 | |
| *** spzala has joined #openstack-keystone | 09:45 | |
| *** tangchen has joined #openstack-keystone | 09:46 | |
| *** spzala has quit IRC | 09:49 | |
| *** rodrigods has quit IRC | 09:55 | |
| *** rodrigods has joined #openstack-keystone | 09:55 | |
| *** EinstCrazy has quit IRC | 10:23 | |
| *** tangchen has quit IRC | 10:25 | |
| *** NanKe has quit IRC | 10:35 | |
| *** TxGVNN has quit IRC | 10:36 | |
| *** NanKe has joined #openstack-keystone | 10:36 | |
| *** NanKe has quit IRC | 10:36 | |
| *** NanKe has joined #openstack-keystone | 10:39 | |
| *** NanKe has quit IRC | 10:40 | |
| *** NanKe has joined #openstack-keystone | 10:45 | |
| *** NanKe has quit IRC | 10:46 | |
| *** davechen has quit IRC | 10:47 | |
| *** NanKe has joined #openstack-keystone | 10:56 | |
| *** tangchen has joined #openstack-keystone | 11:14 | |
| *** edmondsw has joined #openstack-keystone | 11:40 | |
| *** pauloewerton has joined #openstack-keystone | 11:49 | |
| *** jpena is now known as jpena|lunch | 11:50 | |
| *** itisha has joined #openstack-keystone | 12:00 | |
| *** sdake_ has joined #openstack-keystone | 12:02 | |
| *** raildo has joined #openstack-keystone | 12:05 | |
| *** pnavarro has joined #openstack-keystone | 12:05 | |
| *** davechen has joined #openstack-keystone | 12:22 | |
| *** tangchen has quit IRC | 12:23 | |
| *** markvoelker has joined #openstack-keystone | 12:27 | |
| *** samueldmq has joined #openstack-keystone | 12:35 | |
| *** ChanServ sets mode: +v samueldmq | 12:35 | |
| samueldmq | morning keystone | 12:35 |
| *** davechen has quit IRC | 12:40 | |
| *** julim has quit IRC | 12:40 | |
| *** NanKe has quit IRC | 12:42 | |
| *** sileht has quit IRC | 12:44 | |
| *** sileht has joined #openstack-keystone | 12:46 | |
| *** sdake_ is now known as sdake | 12:48 | |
| *** nishaYadav has joined #openstack-keystone | 12:49 | |
| *** jsavak has joined #openstack-keystone | 12:57 | |
| *** nisha_ has joined #openstack-keystone | 13:00 | |
| *** nisha__ has joined #openstack-keystone | 13:02 | |
| *** jpena|lunch is now known as jpena | 13:03 | |
| *** nishaYadav has quit IRC | 13:04 | |
| *** dikonoor has joined #openstack-keystone | 13:04 | |
| *** nisha_ has quit IRC | 13:05 | |
| *** dikonoor has quit IRC | 13:05 | |
| *** dikonoor has joined #openstack-keystone | 13:06 | |
| *** bill_az has joined #openstack-keystone | 13:06 | |
| *** nisha_ has joined #openstack-keystone | 13:08 | |
| *** TxGVNN has joined #openstack-keystone | 13:11 | |
| *** nisha__ has quit IRC | 13:12 | |
| *** spzala has joined #openstack-keystone | 13:14 | |
| *** tonytan4ever has joined #openstack-keystone | 13:15 | |
| *** nisha_ is now known as nishaYadav | 13:16 | |
| *** dave-mcc_ has quit IRC | 13:19 | |
| *** tonytan4ever has quit IRC | 13:19 | |
| *** dave-mccowan has joined #openstack-keystone | 13:19 | |
| *** dave-mccowan has quit IRC | 13:19 | |
| *** nishaYadav has quit IRC | 13:23 | |
| *** julim has joined #openstack-keystone | 13:24 | |
| *** nisha_ has joined #openstack-keystone | 13:25 | |
| *** nisha_ is now known as nishaYadav | 13:25 | |
| *** julim has quit IRC | 13:26 | |
| *** julim has joined #openstack-keystone | 13:28 | |
| *** tonytan4ever has joined #openstack-keystone | 13:34 | |
| *** ayoung has joined #openstack-keystone | 13:36 | |
| *** ChanServ sets mode: +v ayoung | 13:36 | |
| *** tonytan_brb has joined #openstack-keystone | 13:39 | |
| *** tonytan4ever has quit IRC | 13:41 | |
| dstanek | samueldmq: good morning | 13:41 |
| *** ametts has joined #openstack-keystone | 13:41 | |
| *** nisha_ has joined #openstack-keystone | 13:44 | |
| *** richm has joined #openstack-keystone | 13:45 | |
| *** nisha__ has joined #openstack-keystone | 13:45 | |
| *** dave-mccowan has joined #openstack-keystone | 13:46 | |
| *** nishaYadav has quit IRC | 13:47 | |
| *** nishaYadav has joined #openstack-keystone | 13:48 | |
| *** nishaYadav is now known as Guest99769 | 13:48 | |
| *** nisha_ has quit IRC | 13:49 | |
| lbragstad | stevemar that should be closed - or fix committed. https://bugs.launchpad.net/keystone/+bug/1433331 | 13:49 |
| openstack | Launchpad bug 1433331 in OpenStack Identity (keystone) "Collapse Fernet specific tests into test_v3_auth.py TestAuth" [Low,Fix committed] | 13:49 |
| lbragstad | stevemar I've updated it with a comment | 13:49 |
| *** Guest99769 is now known as nisha_ | 13:49 | |
| *** nisha__ has quit IRC | 13:49 | |
| *** thumpba has joined #openstack-keystone | 13:50 | |
| *** ametts has quit IRC | 13:51 | |
| *** samueldmq has quit IRC | 13:53 | |
| *** ametts has joined #openstack-keystone | 14:00 | |
| *** lamt_ has quit IRC | 14:03 | |
| *** raddaoui has quit IRC | 14:04 | |
| *** tpeoples has quit IRC | 14:04 | |
| *** thiagolib has quit IRC | 14:04 | |
| *** DuncanT has quit IRC | 14:04 | |
| *** jraim has quit IRC | 14:04 | |
| *** jed56 has quit IRC | 14:04 | |
| *** zhiyan has quit IRC | 14:04 | |
| *** auggy has quit IRC | 14:04 | |
| *** briancurtin has quit IRC | 14:04 | |
| *** boris-42 has quit IRC | 14:04 | |
| *** itisha has quit IRC | 14:04 | |
| *** serverascode has quit IRC | 14:04 | |
| *** code-R has joined #openstack-keystone | 14:05 | |
| *** code-R_ has joined #openstack-keystone | 14:06 | |
| *** slberger has joined #openstack-keystone | 14:08 | |
| lbragstad | breton it looks like you have a patch up to fix the caching problems I was seeing on Friday - https://review.openstack.org/#/c/327885/13 | 14:09 |
| patchbot | lbragstad: patch 327885 - keystone - Fix cache invalidation | 14:09 |
| *** code-R has quit IRC | 14:10 | |
| *** tangchen_ has joined #openstack-keystone | 14:10 | |
| *** ravelar159 has joined #openstack-keystone | 14:11 | |
| *** tonytan4ever has joined #openstack-keystone | 14:14 | |
| *** raddaoui has joined #openstack-keystone | 14:16 | |
| *** dave-mccowan has quit IRC | 14:16 | |
| *** roxanaghe has joined #openstack-keystone | 14:17 | |
| *** dave-mccowan has joined #openstack-keystone | 14:17 | |
| *** tonytan_brb has quit IRC | 14:17 | |
| *** itisha has joined #openstack-keystone | 14:18 | |
| *** boris-42 has joined #openstack-keystone | 14:18 | |
| *** DuncanT has joined #openstack-keystone | 14:18 | |
| *** briancurtin has joined #openstack-keystone | 14:18 | |
| *** jed56 has joined #openstack-keystone | 14:18 | |
| *** auggy has joined #openstack-keystone | 14:18 | |
| *** tpeoples has joined #openstack-keystone | 14:18 | |
| *** thiagolib has joined #openstack-keystone | 14:19 | |
| *** jraim has joined #openstack-keystone | 14:19 | |
| *** zhiyan has joined #openstack-keystone | 14:19 | |
| *** serverascode has joined #openstack-keystone | 14:19 | |
| *** lamt_ has joined #openstack-keystone | 14:20 | |
| *** roxanaghe has quit IRC | 14:21 | |
| breton | lbragstad: have you tried it? | 14:21 |
| breton | lbragstad: we tried it with Samuel and afaik it didn't fix your issues | 14:22 |
| breton | lbragstad: but i've updated it since then | 14:22 |
| *** ravelar_159 has joined #openstack-keystone | 14:22 | |
| lbragstad | breton I'm testing it locally now | 14:22 |
| *** ravelar159 has quit IRC | 14:22 | |
| lbragstad | breton it seems to have fixed the issue I was seeing on Friday | 14:22 |
| lbragstad | breton https://bugs.launchpad.net/keystone/+bug/1607553 | 14:23 |
| openstack | Launchpad bug 1607553 in OpenStack Identity (keystone) "Revocation event caching is broken across processes" [High,New] | 14:23 |
| breton | lbragstad: review the patch then please | 14:24 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Lockout requirements https://review.openstack.org/340074 | 14:24 |
| lbragstad | breton yep - working on it | 14:24 |
| lbragstad | breton locally - the tempest.api.identity tests pass for me except for one (tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_update_user_password) | 14:25 |
| *** aastha has joined #openstack-keystone | 14:25 | |
| lbragstad | that one fails occasionally | 14:25 |
| dstanek | breton: i'm a little worried that it is hooking into dogpile's internals that way. seems like a new concept that dogpile needs to grow | 14:26 |
| *** chlong has joined #openstack-keystone | 14:26 | |
| breton | dstanek: they already have it | 14:27 |
| *** chlong is now known as chlong|gone | 14:27 | |
| dstanek | breton: have what? | 14:27 |
| breton | dstanek: custom region invalidation | 14:28 |
| dstanek | breton: can't we use that then? | 14:29 |
| dstanek | i was thinking it needed a namespace concept which is what most people seem to think regions are | 14:29 |
| *** jaosorior has quit IRC | 14:30 | |
| *** spedione|AWAY is now known as spedione | 14:30 | |
| *** slberger1 has joined #openstack-keystone | 14:30 | |
| *** slberger has quit IRC | 14:30 | |
| *** chlong|gone has quit IRC | 14:32 | |
| *** jaosorior has joined #openstack-keystone | 14:32 | |
| *** jorge_munoz has joined #openstack-keystone | 14:32 | |
| *** chlong|gone has joined #openstack-keystone | 14:33 | |
| *** chlong|gone is now known as chlong | 14:34 | |
| breton | dstanek: 1. we need to backport it to mitaka 2. wait for new dogpile release 3. make oslo_cache support it | 14:35 |
| lbragstad | breton with your patch I seem to get one or two tempest failures when running the entire tempest.api.identity suite | 14:35 |
| *** michauds has joined #openstack-keystone | 14:35 | |
| breton | lbragstad: and without? | 14:35 |
| dstanek | breton: exactly | 14:35 |
| *** jorge_munoz_ has joined #openstack-keystone | 14:35 | |
| lbragstad | breton double checking | 14:35 |
| breton | dstanek: that's why we can't use it yet | 14:36 |
| breton | dstanek: https://gerrit.sqlalchemy.org/#/c/108/ | 14:36 |
| dstanek | breton: when could we..just need a new release? | 14:37 |
| *** jorge_munoz has quit IRC | 14:37 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:37 | |
| *** tonytan4ever has quit IRC | 14:38 | |
| breton | dstanek: we also need to backport it to mitaka. There won't be new release of dogpile. | 14:38 |
| lbragstad | breton that would require bumping the version of dogpile in mitaka - right? | 14:38 |
| *** hwcomcn has joined #openstack-keystone | 14:38 | |
| dstanek | breton: why not? | 14:38 |
| *** hwcomcn has quit IRC | 14:39 | |
| breton | dstanek: or we could bump the version of dogpile in mitaka, right. I am just not sure that we can do it for a bugfix. | 14:39 |
| *** thumpba has quit IRC | 14:39 | |
| *** hwcomcn has joined #openstack-keystone | 14:39 | |
| lbragstad | breton that's exactly what I was wondering | 14:40 |
| *** hwcomcn has quit IRC | 14:41 | |
| breton | but using that new feature in dogpile cache sounds like a new feature for keystone | 14:41 |
| breton | while there i propose a fix for what was there | 14:41 |
| lbragstad | breton http://docs.openstack.org/project-team-guide/stable-branches.html#active-maintenance | 14:42 |
| *** jdennis has joined #openstack-keystone | 14:42 | |
| lbragstad | looks like version bumping is a no-go in stable branches | 14:42 |
| *** hwcomcn has joined #openstack-keystone | 14:42 | |
| dstanek | breton: can we do the hack only for a backport and do the right thing in master then? | 14:43 |
| lbragstad | backports have to be merged into master prior to landing in a stable branch i though.. | 14:43 |
| lbragstad | thought* | 14:43 |
| breton | dstanek: technically yes. Not sure about the policies though. | 14:44 |
| *** tonytan4ever has joined #openstack-keystone | 14:44 | |
| dstanek | lbragstad: they do, *i think*, but i don't feel comfortable with a hack like this unless there is a clear path to remove it | 14:44 |
| breton | dstanek: hack like this was there long before my patch | 14:44 |
| breton | dstanek: it just didn't work :) | 14:45 |
| dstanek | it's very possible that a dogpile release will completely break this and thus break some people using older releases | 14:45 |
| *** thumpba has joined #openstack-keystone | 14:45 | |
| dstanek | breton: yes, i know. it was a mistake then too | 14:45 |
| breton | yep | 14:45 |
| lbragstad | i believe we talked about this at the austin mid-cycle | 14:45 |
| *** gagehugo has joined #openstack-keystone | 14:46 | |
| dstanek | i really wish we could say we only use memcache for caching and just use that directly | 14:46 |
| lbragstad | yeah - that would be nice in this case | 14:47 |
| dstanek | i actually started down that path a little to make some of our things easier to cache | 14:47 |
| dstanek | maybe i'll throw up a review and see what people thing | 14:47 |
| dstanek | think* | 14:47 |
| breton | wow | 14:47 |
| breton | in fact, the new dogpile release *will* break https://review.openstack.org/#/c/327885/ | 14:48 |
| patchbot | breton: patch 327885 - keystone - Fix cache invalidation | 14:48 |
| *** thiagolib has quit IRC | 14:48 | |
| dstanek | breton: fantastic :-) | 14:48 |
| *** sto has joined #openstack-keystone | 14:49 | |
| *** clenimar has quit IRC | 14:49 | |
| breton | sounds like a good thing to discuss tomorrow | 14:50 |
| lbragstad | breton ++ | 14:50 |
| *** clenimar has joined #openstack-keystone | 14:51 | |
| *** tonytan_brb has joined #openstack-keystone | 14:51 | |
| *** thiagolib has joined #openstack-keystone | 14:52 | |
| *** hwcomcn_ has joined #openstack-keystone | 14:52 | |
| *** dikonoor has quit IRC | 14:52 | |
| *** diazjf has joined #openstack-keystone | 14:53 | |
| *** tonytan4ever has quit IRC | 14:54 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create service in v2 https://review.openstack.org/346962 | 14:55 |
| *** hwcomcn has quit IRC | 14:55 | |
| *** nk2527 has quit IRC | 14:58 | |
| *** code-R_ has quit IRC | 14:59 | |
| *** gagehugo has quit IRC | 14:59 | |
| *** jistr is now known as jistr|call | 15:00 | |
| *** jaugustine has quit IRC | 15:00 | |
| *** mvk has quit IRC | 15:04 | |
| *** slberger1 has quit IRC | 15:07 | |
| lbragstad | breton I'm running the tempest tests repeatedly to get an average number of failures against master and with your patch (i'll update the bug when I have those averages) | 15:08 |
| *** gagehugo has joined #openstack-keystone | 15:08 | |
| *** dave-mccowan has quit IRC | 15:09 | |
| *** jaosorior is now known as jaosorior_lunch | 15:09 | |
| *** slberger has joined #openstack-keystone | 15:09 | |
| breton | lbragstad: thank you | 15:09 |
| *** jistr|call is now known as jistr | 15:12 | |
| *** clenimar has quit IRC | 15:13 | |
| *** pgbridge has joined #openstack-keystone | 15:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Lockout requirements https://review.openstack.org/340074 | 15:13 |
| *** samueldmq has joined #openstack-keystone | 15:13 | |
| *** ChanServ sets mode: +v samueldmq | 15:13 | |
| samueldmq | dstanek: o/ | 15:13 |
| *** pauloewerton has quit IRC | 15:13 | |
| *** dave-mccowan has joined #openstack-keystone | 15:13 | |
| *** jaugustine has joined #openstack-keystone | 15:15 | |
| *** ericksonsantos has quit IRC | 15:15 | |
| dstanek | hey samueldmq | 15:15 |
| *** dave-mccowan has quit IRC | 15:16 | |
| *** mrhillsman has joined #openstack-keystone | 15:19 | |
| *** raildo has quit IRC | 15:23 | |
| *** diazjf has quit IRC | 15:23 | |
| *** gagehugo_ has joined #openstack-keystone | 15:24 | |
| *** iurygregory has quit IRC | 15:24 | |
| samueldmq | dstanek: so this week I am 100% back.. fully recovered and have finished a couple of things I had to do :) | 15:28 |
| samueldmq | trying to get my virtualbox working with 64-bit vms | 15:30 |
| *** ericksonsantos has joined #openstack-keystone | 15:30 | |
| *** clenimar has joined #openstack-keystone | 15:31 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create service in v2 https://review.openstack.org/346962 | 15:31 |
| *** pauloewerton has joined #openstack-keystone | 15:31 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Lockout requirements https://review.openstack.org/340074 | 15:31 |
| *** iurygregory has joined #openstack-keystone | 15:32 | |
| *** code-R has joined #openstack-keystone | 15:32 | |
| *** raildo has joined #openstack-keystone | 15:32 | |
| *** nk2527 has joined #openstack-keystone | 15:33 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: [api] add blurb about experimental status https://review.openstack.org/347947 | 15:34 |
| *** code-R_ has joined #openstack-keystone | 15:34 | |
| *** sdake has quit IRC | 15:34 | |
| *** belmoreira has quit IRC | 15:36 | |
| *** nisha_ is now known as nishaYadav | 15:36 | |
| *** code-R has quit IRC | 15:38 | |
| samueldmq | stevemar: you around ? | 15:38 |
| stevemar | samueldmq: technically no, but whats up? | 15:38 |
| samueldmq | stevemar: about the federation docs on their own files ... | 15:39 |
| samueldmq | stevemar: will just leave a comment in the review, anyways I am fine with your proposal | 15:39 |
| *** diazjf has joined #openstack-keystone | 15:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: PCI-DSS Lockout requirements https://review.openstack.org/340074 | 15:40 |
| *** danpawlik has quit IRC | 15:42 | |
| *** dave-mccowan has joined #openstack-keystone | 15:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Improve authentication plugins documentation https://review.openstack.org/349423 | 15:52 |
| *** narengan has joined #openstack-keystone | 15:52 | |
| *** nithya has joined #openstack-keystone | 15:54 | |
| *** nithya has quit IRC | 15:54 | |
| lbragstad | breton dstanek https://bugs.launchpad.net/keystone/+bug/1607553/comments/5 | 15:55 |
| openstack | Launchpad bug 1607553 in OpenStack Identity (keystone) "Revocation event caching is broken across processes" [High,New] | 15:56 |
| breton | lbragstad: what tests fail in both cases? Are they the same from one run to another? | 15:58 |
| lbragstad | breton no - they are random | 15:58 |
| *** jistr is now known as jistr|biab | 16:01 | |
| breton | lbragstad: could you please post a list of tests that failed with my patch? I'll try to reproduce it manually | 16:01 |
| dstanek | lbragstad: that's really odd that it lowers the average like that | 16:01 |
| lbragstad | breton sure - doing another run now | 16:01 |
| lbragstad | dstanek very | 16:01 |
| * lbragstad breton these are the two the failed on my last run with your patch - http://cdn.pasteraw.com/5f44o8epievtqtfw3jy733f6qt5iyrc | 16:03 | |
| *** Guest15832 is now known as redrobot | 16:04 | |
| breton | test_list_user_roles_request_without_token | 16:04 |
| breton | huh | 16:04 |
| *** ayoung has quit IRC | 16:06 | |
| lbragstad | tempest.api.identity.admin.v2.test_roles_negative.RolesNegativeTestJSON.test_list_user_roles_request_without_token and tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_update_user_password failed | 16:06 |
| lbragstad | looks like test_list_user_roles_request_without_token failed because the token was validated successfully instead of raising a 401 | 16:07 |
| *** markvoelker has quit IRC | 16:09 | |
| lbragstad | but it looks like the failure in test_users.UsersV3TestJSON.test_update_user_password was because the token was considered invalid by keystone.. even though it should have been considered valid | 16:10 |
| *** jaosorior_lunch has quit IRC | 16:11 | |
| *** jaosorior has joined #openstack-keystone | 16:12 | |
| *** tesseract- has quit IRC | 16:14 | |
| *** ravelar_159 is now known as ravelar | 16:17 | |
| *** hwcomcn_ has quit IRC | 16:21 | |
| *** ayoung has joined #openstack-keystone | 16:21 | |
| *** ChanServ sets mode: +v ayoung | 16:21 | |
| *** diazjf has quit IRC | 16:24 | |
| *** TxGVNN has quit IRC | 16:25 | |
| *** diazjf has joined #openstack-keystone | 16:25 | |
| *** arunkant has quit IRC | 16:26 | |
| *** ntpttr has quit IRC | 16:28 | |
| *** arunkant has joined #openstack-keystone | 16:31 | |
| *** julim has quit IRC | 16:34 | |
| *** julim has joined #openstack-keystone | 16:36 | |
| breton | 2016-08-01 19:30:28.635230 2016-08-01 19:30:28.635 13651 DEBUG oslo.cache.core [req-46f294c8-0e8f-40c0-b40f-d1328e33b80d - - - - -] CACHE_SET: Key: "'1921523d6734d44e88ed58dfc76ef681a36b8e9b'" Value: "([<keystone.models.revoke_model.RevokeEvent object at 0x7f3fc8418910>, <keystone.models.revoke_model.RevokeEvent object at 0x7f3fc8418950>], {'v': 1, 'ct': 1470069028.634853})" set /home/breton/.vi | 16:40 |
| breton | rtualenvs/keystone/local/lib/python2.7/site-packages/oslo_cache/core.py:87 | 16:41 |
| breton | ugh | 16:41 |
| breton | CACHE_SET: Key: "'1921523d6734d44e88ed58dfc76ef681a36b8e9b'" Value: "([<keystone.models.revoke_model.RevokeEvent object at 0x7f3fc8418910>, <keystone.models.revoke_model.RevokeEvent object at 0x7f3fc8418950>], {'v': 1, 'ct': 1470069028.634853})" | 16:41 |
| breton | what are these reprs in value? | 16:42 |
| breton | how do we cache objects? | 16:44 |
| breton | something seems wrong here | 16:45 |
| *** Gorian_ has joined #openstack-keystone | 16:45 | |
| breton | lbragstad: | 16:46 |
| *** tesseract- has joined #openstack-keystone | 16:46 | |
| breton | how are non-serializable objects cached? | 16:46 |
| * breton will get back to tackling it in 3h | 16:47 | |
| samueldmq | breton: you suspect the revoke cache issues are related to how they're being cached internally in dogpile ? | 16:47 |
| *** pnavarro has quit IRC | 16:47 | |
| samueldmq | breton: ah you went afk, ttyl | 16:47 |
| *** daemontool__ has joined #openstack-keystone | 16:48 | |
| *** jistr|biab is now known as jistr | 16:49 | |
| *** narengan has quit IRC | 16:52 | |
| *** daemontool_ has quit IRC | 16:52 | |
| openstackgerrit | Merged openstack/keystoneauth: Add missing class name to tuple of public objects https://review.openstack.org/349424 | 16:53 |
| *** narengan has joined #openstack-keystone | 16:53 | |
| *** tesseract- has quit IRC | 16:54 | |
| *** Gorian_ has quit IRC | 16:54 | |
| *** Gorian_ has joined #openstack-keystone | 16:54 | |
| *** gyee has joined #openstack-keystone | 16:55 | |
| *** ChanServ sets mode: +v gyee | 16:55 | |
| *** iurygregory has quit IRC | 16:58 | |
| *** tesseract- has joined #openstack-keystone | 16:58 | |
| *** tesseract- has quit IRC | 16:58 | |
| *** gyee_ has joined #openstack-keystone | 16:59 | |
| *** ChanServ sets mode: +v gyee_ | 16:59 | |
| *** gyee has quit IRC | 16:59 | |
| *** gyee_ has quit IRC | 16:59 | |
| *** gyee has joined #openstack-keystone | 17:00 | |
| *** ChanServ sets mode: +v gyee | 17:00 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create user v2 https://review.openstack.org/348531 | 17:01 |
| *** jpena is now known as jpena|off | 17:02 | |
| *** TxGVNN has joined #openstack-keystone | 17:02 | |
| *** sdake has joined #openstack-keystone | 17:02 | |
| *** clenimar has quit IRC | 17:03 | |
| *** markvoelker has joined #openstack-keystone | 17:05 | |
| *** gagehugo has quit IRC | 17:06 | |
| *** slberger has quit IRC | 17:09 | |
| *** pauloewerton has quit IRC | 17:10 | |
| *** pauloewerton has joined #openstack-keystone | 17:11 | |
| *** ayoung has quit IRC | 17:11 | |
| *** slberger has joined #openstack-keystone | 17:12 | |
| *** roxanaghe has joined #openstack-keystone | 17:14 | |
| *** ericksonsantos has quit IRC | 17:14 | |
| stevemar | lbragstad: you opened a bug about revocation being broken everywhere | 17:17 |
| *** sdake has quit IRC | 17:17 | |
| dstanek | breton: objects are pickled before they are put in cache | 17:18 |
| *** pauloewerton has quit IRC | 17:18 | |
| *** TxGVNN has quit IRC | 17:20 | |
| lbragstad | stevemar only in multi-process setups | 17:20 |
| *** raildo has quit IRC | 17:20 | |
| lbragstad | stevemar https://bugs.launchpad.net/keystone/+bug/1607553 | 17:20 |
| openstack | Launchpad bug 1607553 in OpenStack Identity (keystone) "Revocation event caching is broken across processes" [High,New] | 17:20 |
| stevemar | lbragstad: which is every setup :) | 17:20 |
| lbragstad | stevemar one would think so | 17:21 |
| *** clenimar has joined #openstack-keystone | 17:21 | |
| *** iurygregory has joined #openstack-keystone | 17:21 | |
| samueldmq | lbragstad: even for other token formats ? | 17:21 |
| lbragstad | stevemar we seem to be narrowing it down to not having the ability to invalidate regions across multiple processes | 17:21 |
| lbragstad | samueldmq the uuid token provider doesn't rely on revocation events - so it might be short-circuiting that check | 17:22 |
| *** raildo has joined #openstack-keystone | 17:22 | |
| *** ericksonsantos has joined #openstack-keystone | 17:22 | |
| samueldmq | lbragstad: makes sense, that's what I thought > it's been broken for a while, but somehow it may be short-circuiting | 17:23 |
| samueldmq | so ppl didn4t make a harm yet | 17:23 |
| *** ayoung has joined #openstack-keystone | 17:23 | |
| *** ChanServ sets mode: +v ayoung | 17:23 | |
| *** pauloewerton has joined #openstack-keystone | 17:24 | |
| *** spzala has quit IRC | 17:24 | |
| *** julim has quit IRC | 17:24 | |
| samueldmq | lbragstad: so the plan now is to discover what's going on in the cache internals? | 17:26 |
| harlowja | stevemar sort of found answer, having some internal discussion around identity, and ..., will drag the folks internally in here for more questions (if any) | 17:26 |
| lbragstad | samueldmq well - I ended up finding that it was most likely an issue with not being able to invalidate cache regions across processes | 17:27 |
| lbragstad | samueldmq and dstanek pointed me to a patch that breton had up that is suppose to fix it | 17:27 |
| samueldmq | lbragstad: hmm, the dvsm install is multiprocess? | 17:27 |
| lbragstad | samueldmq devstack deploys keystone with 5 processes with 1 thread each | 17:27 |
| samueldmq | lbragstad: what patch? let's test it in the gate | 17:27 |
| samueldmq | adding that depends-on thing | 17:27 |
| lbragstad | samueldmq I tested it locally | 17:28 |
| samueldmq | lbragstad: and ... | 17:28 |
| lbragstad | samueldmq I posted my findings here - https://bugs.launchpad.net/keystone/+bug/1607553 | 17:28 |
| openstack | Launchpad bug 1607553 in OpenStack Identity (keystone) "Revocation event caching is broken across processes" [High,New] | 17:28 |
| samueldmq | lbragstad: did it work? | 17:28 |
| lbragstad | samueldmq not completely | 17:28 |
| lbragstad | but it seemed to be better | 17:28 |
| lbragstad | (not sure how that works) | 17:28 |
| lbragstad | if we're invalidating the cache region for revocation events every time we add a new revocation event, that should take care of the problem | 17:29 |
| *** brancal has quit IRC | 17:31 | |
| dstanek | that patch won't fix races...just the fact that our caching is broken | 17:31 |
| lbragstad | dstanek with that patch - i'm not sure how a race condition is still possible | 17:32 |
| lbragstad | in tempest | 17:32 |
| dstanek | why not? what do you theorize is happening | 17:33 |
| dstanek | cache races frequently happen with multiple processes | 17:33 |
| lbragstad | dstanek i'm not sure | 17:34 |
| lbragstad | dstanek but if we walk through https://github.com/openstack/tempest/blob/5ba5d648f613822f5fe39bccece72f5f74103113/tempest/api/identity/admin/v3/test_tokens.py#L49 | 17:34 |
| lbragstad | that test fails without breton's (and sometimes without it) | 17:34 |
| lbragstad | line 48 issues a client request to delete subject_token | 17:35 |
| lbragstad | which will be handled by a process in keystone, and tempest won't execute the next command until a 204 return code has been returned from keystone | 17:35 |
| lbragstad | so at that point we can assume that keystone has persisted a revocation event | 17:35 |
| dstanek | lbragstad: do you have a tempest config i could scam so i can try to reproduce? | 17:36 |
| lbragstad | and as a result - it should have invalidated the revocation cache | 17:36 |
| lbragstad | dstanek sure - my config is just devstack master | 17:36 |
| lbragstad | then I switched keystone token.provider = fernet | 17:36 |
| lbragstad | and I was able to recreate the issue on keystone master | 17:37 |
| dstanek | lbragstad: i have a clean devstack...let me see... | 17:37 |
| *** diazjf has quit IRC | 17:40 | |
| lbragstad | dstanek i built keystone locally on commit - 8a669fabad6591175db72de314af9931a8f26bb4 | 17:42 |
| lbragstad | dstanek and ran ./run_tempest.sh tempest.api.identity.admin.v3.test_tokens | 17:42 |
| dstanek | lbragstad: how often does it fail? | 17:47 |
| *** thumpba has quit IRC | 17:48 | |
| *** jaosorior has quit IRC | 17:49 | |
| *** thumpba has joined #openstack-keystone | 17:49 | |
| lbragstad | dstanek with fernet enabled and without breton's patch it fails about 70% of the time form e | 17:49 |
| lbragstad | for me* | 17:49 |
| dstanek | lbragstad: i wasn't patient enough i guess | 17:50 |
| lbragstad | dstanek do you have caching enabled for revocation events? | 17:50 |
| *** yeeg has joined #openstack-keystone | 17:50 | |
| *** gyee has quit IRC | 17:50 | |
| *** yeeg has quit IRC | 17:50 | |
| *** yeeg has joined #openstack-keystone | 17:51 | |
| *** yeeg has quit IRC | 17:51 | |
| *** gyee has joined #openstack-keystone | 17:52 | |
| *** spzala has joined #openstack-keystone | 17:52 | |
| dstanek | lbragstad: yeah, i can get it to fail now | 17:53 |
| *** markvoelker_ has joined #openstack-keystone | 17:53 | |
| *** markvoelker has quit IRC | 17:53 | |
| stevemar | harlowja: okay, keep us posted if you can | 17:54 |
| lbragstad | dstanek the error should look something like this - http://cdn.pasteraw.com/psy3io1qmf4jrt0x06i8n5baizuotq9 | 17:56 |
| *** narengan has quit IRC | 17:58 | |
| harlowja | stevemar sure | 17:59 |
| dstanek | lbragstad: it's impossible to look at the keystone log and see what's happening....tons of other stuff in there, i'm assuming from setup/teardown | 18:01 |
| lbragstad | dstanek i recreated the issue and documented the logs http://cdn.pasteraw.com/ms750ntgl1nv00z6a16jfew5jft23ml | 18:02 |
| lbragstad | dstanek this is the testing output http://cdn.pasteraw.com/67vnkdoo4n07f2xsqyruv6qlj9fi0xc | 18:02 |
| lbragstad | dstanek from there I mapped the token ID that was revoke through the logs to the cache id | 18:02 |
| *** narengan1 has joined #openstack-keystone | 18:04 | |
| *** julim has joined #openstack-keystone | 18:10 | |
| stevemar | breton: what's up with "Validating trust-scoped tokens with v2.0 API" | 18:10 |
| stevemar | anyone have an opinion on https://review.openstack.org/#/c/347543/4 ? seems kinda hacky? | 18:11 |
| patchbot | stevemar: patch 347543 - keystone - Add dummy domain_id column to cached role | 18:11 |
| stevemar | dstanek: lbragstad dolphm samueldmq anyone want to take a look at: https://review.openstack.org/#/c/344924/ ? | 18:16 |
| patchbot | stevemar: patch 344924 - keystone - Retry revocation on MySQL deadlock | 18:16 |
| stevemar | i'm trying to triage a few of the bugs we have | 18:16 |
| *** slberger has quit IRC | 18:18 | |
| stevemar | crinkle: did you -1 W this patch because of the test comment? https://review.openstack.org/#/c/344496/2 | 18:19 |
| patchbot | stevemar: patch 344496 - keystone - Skip middleware request processing for admin token | 18:19 |
| dstanek | stevemar: probably in a few....looking at the cache issue now | 18:20 |
| crinkle | stevemar: yes | 18:21 |
| stevemar | crinkle: not sure what to do about a test there... | 18:21 |
| *** brancal has joined #openstack-keystone | 18:23 | |
| *** permalac has joined #openstack-keystone | 18:23 | |
| crinkle | stevemar: yeah me either | 18:23 |
| stevemar | crinkle: I tried it out and it stopped blowing up for me, i'm happy with it | 18:24 |
| lbragstad | dstanek i'm finishing up a call quick and then i should be able to walk through it with you if you want to debug it on Google or something like that? | 18:25 |
| *** spzala_ has joined #openstack-keystone | 18:27 | |
| *** ayoung has quit IRC | 18:30 | |
| *** nishaYadav has quit IRC | 18:31 | |
| *** spzala has quit IRC | 18:31 | |
| stevemar | crinkle: you can set it to 0 workflow, i dont know how to create a test for this easily | 18:32 |
| stevemar | maybe jamielennox|away has an idea | 18:32 |
| crinkle | stevemar: i think maybe if i can capture logging in keystone/tests/unit/test_middleware.py i can use that | 18:34 |
| crinkle | but it's not working so far | 18:34 |
| *** brancal has quit IRC | 18:35 | |
| openstackgerrit | Merged openstack/keystone: Move Identity Provider API to its own file https://review.openstack.org/349009 | 18:36 |
| openstackgerrit | Merged openstack/keystone: refactor idp to its own file https://review.openstack.org/349218 | 18:37 |
| *** brancal has joined #openstack-keystone | 18:37 | |
| *** markvoelker_ has quit IRC | 18:38 | |
| *** markvoelker has joined #openstack-keystone | 18:39 | |
| *** markvoelker has quit IRC | 18:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/349638 | 18:41 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/349648 | 18:47 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/333449 | 18:47 |
| *** samueldmq has quit IRC | 18:47 | |
| *** GB21 has quit IRC | 18:54 | |
| *** doug-fish has joined #openstack-keystone | 18:55 | |
| *** jmlowe has joined #openstack-keystone | 19:00 | |
| *** jsavak has quit IRC | 19:02 | |
| *** jsavak has joined #openstack-keystone | 19:03 | |
| *** cheran has joined #openstack-keystone | 19:04 | |
| *** spzala_ has quit IRC | 19:05 | |
| *** cheran has quit IRC | 19:05 | |
| lbragstad | dstanek want to sync on the caching thing? | 19:06 |
| *** fifieldt has quit IRC | 19:07 | |
| jmlowe | Quick question about federation and mapping, is that really true about only doing group based role assignments? | 19:07 |
| *** spzala has joined #openstack-keystone | 19:09 | |
| stevemar | jmlowe: sorta? the mapping must result in a group (for now, see https://bugs.launchpad.net/keystone/+bug/1601929 ) | 19:09 |
| openstack | Launchpad bug 1601929 in OpenStack Identity (keystone) "Relax the requirement for mappings to result in group memberships" [Medium,Triaged] - Assigned to Ron De Rose (ronald-de-rose) | 19:09 |
| jmlowe | If I'm mapping all the federated users to local users wouldn't that be how they get their roles? | 19:09 |
| jmlowe | stevemar: ah, ok, seemed a bit odd since you could be mapped to a local user | 19:10 |
| jmlowe | stevemar: do you think that will hit in Newton? | 19:10 |
| stevemar | jmlowe: hopeful! | 19:11 |
| stevemar | jmlowe: do you use the mapping to map to local users? | 19:11 |
| jmlowe | stevemar: just in the planning stages | 19:11 |
| stevemar | jmlowe: not sure if you're aware, but there was work to shadow all federated users to the user table | 19:11 |
| stevemar | so they'll have IDs and such, you should be able to assign them roles | 19:12 |
| stevemar | this work landed in mitaka i think | 19:12 |
| *** spzala has quit IRC | 19:13 | |
| stevemar | rodrigods: are we ever going to expose these APIs: https://blueprints.launchpad.net/keystone/+spec/project-tree-deletion :) | 19:13 |
| jmlowe | stevemar: One more question, can I do a per user mapping? ie remote_user_a -> local_user_a, remote_user_c -> local_user_b | 19:13 |
| stevemar | jmlowe: yeah, it's pretty flexible, you should be able to do that | 19:14 |
| *** harlowja has quit IRC | 19:14 | |
| breton | stevemar: we can issue a trust-scoped token but cannot validate it in v2.0 | 19:14 |
| breton | stevemar: why? | 19:14 |
| dstanek | lbragstad: i think breton's patch fixes the caching issue, but i doubt it solves all of your troubles. | 19:15 |
| breton | lbragstad: what about uuid? Do they have failures with my patch? | 19:15 |
| dstanek | lbragstad: that test almost always fails without the patch and it hasn't failed with the patch yet | 19:15 |
| *** diazjf has joined #openstack-keystone | 19:15 | |
| lbragstad | dstanek what if you run the whole test suite? | 19:15 |
| *** harlowja has joined #openstack-keystone | 19:15 | |
| lbragstad | tempest.api.identity ? | 19:16 |
| dstanek | lbragstad: i'll try that in a sec...running against my patch now | 19:16 |
| lbragstad | breton let me check quick - I wouldn't think UUID would have issues with that patch | 19:16 |
| stevemar | breton: if you obtained a trust then you can use v3, why go around using v2? | 19:16 |
| *** sdake has joined #openstack-keystone | 19:18 | |
| breton | stevemar: because i obtained it using v2 | 19:18 |
| *** fifieldt has joined #openstack-keystone | 19:18 | |
| breton | dstanek: > objects are pickled before they are put in cache | 19:18 |
| breton | dstanek: i've grepped through dogpile cache and it seems that objects are pickled only for backends "file" and "memory" | 19:19 |
| stevemar | breton: trusts are v3 only, how did you get one using v2? | 19:19 |
| breton | dstanek: also redis | 19:19 |
| dstanek | breton: the memcache library does the pickling | 19:20 |
| *** slberger has joined #openstack-keystone | 19:21 | |
| breton | stevemar: keystone/tests/unit/test_auth.py, test_create_trust_impersonation for example | 19:22 |
| jmlowe | so big fat list with every remote user mapped to their corresponding local user is ok | 19:23 |
| lbragstad | breton I ran the tempest identity suite against your patch and uuid without any failures. | 19:23 |
| lbragstad | stevemar i think breton means that he can get a trust scoped token using v2.0 | 19:23 |
| lbragstad | not that he can create a trust on v2.0 | 19:23 |
| stevemar | jmlowe: you'll have a hell of a time maintaining that, but it should be OK | 19:23 |
| breton | lbragstad: ++ | 19:24 |
| stevemar | lbragstad: ah i follow.... | 19:24 |
| stevemar | lbragstad: just the HEAD request to validate? | 19:24 |
| *** KevinE has joined #openstack-keystone | 19:24 | |
| jmlowe | I have a whole bunch of users from xsede.org, I'm using auth.globus.org with openid connect, and I'll need to map them all to possibly different usernames at tacc.utexas.edu | 19:25 |
| jmlowe | only a tiny fraction know their credentials at tacc.utexas.edu but everybody knows their xsede.org credentials and everything should be setup for openid connect via globus auth | 19:26 |
| jmlowe | I can programmatically get all of the mappings | 19:26 |
| stevemar | jmlowe: sounds like it should be fun times | 19:27 |
| stevemar | jmlowe: we're very interested in hearing feedback from folks using federation | 19:27 |
| lbragstad | dstanek is your patch up for review? | 19:27 |
| stevemar | jmlowe: so please keep us looped in, even if your experience is shitty, we can improve that | 19:28 |
| stevemar | amakarov: dolphm: i don't remember this being approved https://blueprints.launchpad.net/keystone/+spec/pre-cache-tokens does it have a spec? | 19:28 |
| jmlowe | stevemar: another project I have is to create a central xsede.org keystone then federate with other project members running openstack, Bridges https://www.psc.edu/index.php/bridges-approach and Jetstream-cloud.org being the first two | 19:29 |
| *** ametts has quit IRC | 19:30 | |
| jmlowe | Where can I read up on the shadowing of federated users? | 19:31 |
| lbragstad | dstanek I notice that breton's patch fixes tempest.api.identity.admin.v3.test_tokens but I seems to get race conditions running the entire suite | 19:32 |
| lbragstad | dstanek i'll see if I can recreate another example | 19:33 |
| *** KevinE has quit IRC | 19:35 | |
| *** ametts has joined #openstack-keystone | 19:36 | |
| *** diazjf has quit IRC | 19:36 | |
| dstanek | lbragstad: not up yet, still getting it to work | 19:37 |
| lbragstad | dstanek cool | 19:37 |
| *** KevinE has joined #openstack-keystone | 19:37 | |
| *** diazjf has joined #openstack-keystone | 19:37 | |
| stevemar | jmlowe: heres what we did in mitaka: http://specs.openstack.org/openstack/keystone-specs/specs/keystone/mitaka/shadow-users.html and what we are doing for newton: http://specs.openstack.org/openstack/keystone-specs/specs/keystone/newton/shadow-users-newton.html | 19:41 |
| *** KevinE has quit IRC | 19:41 | |
| *** KevinE has joined #openstack-keystone | 19:42 | |
| *** jsavak has quit IRC | 19:43 | |
| *** spzala has joined #openstack-keystone | 19:43 | |
| *** jsavak has joined #openstack-keystone | 19:44 | |
| *** spzala has quit IRC | 19:44 | |
| *** spzala has joined #openstack-keystone | 19:44 | |
| lbragstad | dstanek breton here is another example of a test that fails with breton's patch - looks like a race condition | 19:45 |
| lbragstad | http://cdn.pasteraw.com/q11n0xcvg9z7ot55so31yqwqrr4d9n4 | 19:45 |
| *** spzala has quit IRC | 19:45 | |
| lbragstad | I think the race it between when the revocation event cache region is invalidated and when the next call hits keystone | 19:46 |
| jmlowe | stevemar: ok one more question, the mapping as it stands today in Mitaka could be remote_user — (keystone mapping) — > local_group -> role ? | 19:48 |
| lbragstad | well - more specifically, a race between when the revocation event cache region is invalidated across processes and when the next call hits keystone | 19:48 |
| stevemar | jmlowe: right, the remote_user will get a role via the local group (you can assign groups many roles), or you can assign the user an individual role (this may be in newton only...) | 19:49 |
| breton | lbragstad: why does it happen only on fernet? | 19:49 |
| lbragstad | breton I would think that it only happens with fernet because uuid and the other tokens formats don't rely on the revocation api | 19:50 |
| lbragstad | s/don't rely/don't rely heavily/ | 19:50 |
| jmlowe | you can map remote_user to local_user but the roles won't be applied until Newton? just want to make sure I'm really clear on this so I can present capabilities on a timeline to decision makers | 19:51 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to update user v2 https://review.openstack.org/345022 | 19:52 |
| *** ametts has quit IRC | 19:55 | |
| lbragstad | breton for example; when you have uuid enabled and a user changes their password, the user's tokens are actually pruned from the database https://github.com/openstack/keystone/blob/8a8f070bc0714d5bd2c3594dcd8b458ac688be61/keystone/identity/core.py#L979 | 19:56 |
| *** spzala has joined #openstack-keystone | 19:56 | |
| *** ametts has joined #openstack-keystone | 20:00 | |
| stevemar | dstanek: take a look at this one and re-assess please: https://bugs.launchpad.net/keystone/+bug/1376937 | 20:01 |
| openstack | Launchpad bug 1376937 in OpenStack Identity (keystone) "No way to prevent duplicates in endpoints" [Medium,In progress] - Assigned to David Stanek (dstanek) | 20:01 |
| *** jsavak has quit IRC | 20:01 | |
| *** narengan1 has quit IRC | 20:02 | |
| *** jsavak has joined #openstack-keystone | 20:02 | |
| *** KevinE has quit IRC | 20:08 | |
| dstanek | stevemar: sure | 20:09 |
| *** spzala has quit IRC | 20:12 | |
| *** spzala has joined #openstack-keystone | 20:13 | |
| breton | stevemar: i am actually keeping an eye on https://bugs.launchpad.net/bugs/1520244 | 20:17 |
| openstack | Launchpad bug 1520244 in python-keystoneclient "flag "truncated" in responses to list operations is not supported" [Medium,Triaged] | 20:17 |
| *** spzala has quit IRC | 20:17 | |
| breton | stevemar: we decided that i wait for other patch, adding request-id to ksc | 20:18 |
| stevemar | breton: ah, there was bound to be some false comments, it's a script i run | 20:19 |
| breton | ok | 20:21 |
| *** jorge_munoz has quit IRC | 20:22 | |
| *** narengan has joined #openstack-keystone | 20:22 | |
| stevemar | breton: hadn't run it in a while, ended up unassigning all of these: http://paste.openstack.org/show/545197/ :| | 20:23 |
| breton | a lot :( | 20:24 |
| *** ayoung has joined #openstack-keystone | 20:26 | |
| *** ChanServ sets mode: +v ayoung | 20:26 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Added postgresql libs to developer docs https://review.openstack.org/349688 | 20:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 20:33 |
| *** spzala has joined #openstack-keystone | 20:36 | |
| *** ametts has quit IRC | 20:36 | |
| *** slberger has quit IRC | 20:37 | |
| *** ametts has joined #openstack-keystone | 20:38 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 20:38 |
| *** slberger has joined #openstack-keystone | 20:39 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Reduce revoke events for disabled domains and projects. https://review.openstack.org/253273 | 20:39 |
| *** spzala has quit IRC | 20:41 | |
| dstanek | lbragstad: one of the fernet tests keep tripping me up | 20:43 |
| lbragstad | dstanek which one? | 20:43 |
| dstanek | keystone.tests.unit.test_auth.FernetAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled | 20:44 |
| dstanek | running the full test suite again to see if that's the only one | 20:44 |
| lbragstad | dstanek this one? https://github.com/openstack/keystone/blob/be88c0b7be4e891e7846ded85a3a289c72c5443c/keystone/tests/unit/test_auth.py#L1344 | 20:46 |
| dstanek | lbragstad: yes | 20:46 |
| lbragstad | dstanek how is it failing? | 20:46 |
| lbragstad | what do you have enabled? | 20:47 |
| lbragstad | dstanek or are you just running the unit tests? | 20:47 |
| dstanek | lbragstad: i've made some changes to how the cache key is generated and it doesn't seem to like it | 20:47 |
| dstanek | lbragstad: it's just the unit tests right now | 20:47 |
| lbragstad | dstanek paste | 20:47 |
| lbragstad | ? | 20:47 |
| stevemar | ayoung: please revisit https://bugs.launchpad.net/keystone/+bug/1268751 and mark as invalid if you think so | 20:48 |
| openstack | Launchpad bug 1268751 in OpenStack Identity (keystone) "Potential token revocation abuse via group membership" [Low,Triaged] | 20:48 |
| *** thiagolib has quit IRC | 20:48 | |
| ayoung | stevemar, my comment from 2016-03-02: stands | 20:49 |
| stevemar | ayoung: if we're not going to fix it when we should say so rather than letting it stand as open for 1000 days | 20:49 |
| lbragstad | dstanek is it failing intermittently or every time? | 20:51 |
| dstanek | lbragstad: everytime...need to figure out if it's all auth | 20:52 |
| dstanek | not helpful but http://paste.openstack.org/show/545201/ | 20:52 |
| lbragstad | hmm - so that should be a 403 | 20:53 |
| lbragstad | according to the test | 20:53 |
| lbragstad | dstanek do you have a diff of your patch? | 20:54 |
| *** diazjf has quit IRC | 20:57 | |
| openstackgerrit | Dolph Mathews proposed openstack/keystone: Introduce read-only mode for the database https://review.openstack.org/349700 | 20:59 |
| stevemar | dolphm: around a sec? | 20:59 |
| dolphm | rderose: henrynash: ^ | 21:00 |
| dolphm | stevemar: o/ | 21:00 |
| *** jsavak has quit IRC | 21:00 | |
| stevemar | dolphm: regarding https://bugs.launchpad.net/keystone/+bug/1077282 ... what was the reasoning behind removing all the kvs stuff ? | 21:00 |
| openstack | Launchpad bug 1077282 in OpenStack Identity (keystone) "Remove KVS Backend" [Wishlist,Triaged] | 21:00 |
| stevemar | just to get rid of it in favor of sql? | 21:00 |
| dstanek | lbragstad: yeah, jas | 21:00 |
| dstanek | stevemar: it's not good for read environments | 21:01 |
| breton | dstanek: actually i ran into that test too | 21:01 |
| breton | dstanek: keystone.tests.unit.test_auth.FernetAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled failed with my patch too, but then stopped | 21:01 |
| stevemar | dstanek: OK, i get that it's a sub optimal data store | 21:01 |
| dstanek | breton: at the midcycle i created a region subclass that does magic key generation to solve the invalidation problem | 21:02 |
| stevemar | i'm just wondering how to untangle the last of it from the token stuff: https://github.com/openstack/keystone/search?l=python&q=kvs&utf8=%E2%9C%93 | 21:02 |
| dstanek | stevemar: it's actually completely broken now that we use apache. each process would get a separate kvs data store | 21:02 |
| stevemar | as until we remove keystone/token/persistence/backends/memcache.py we can't accomplish that bug | 21:02 |
| dolphm | dstanek: the 'kvs' drivers are really entry points for dogpile now though, right? so you can point keystone at mongo | 21:03 |
| dolphm | which is what HP did | 21:03 |
| dolphm | but they don't do that anymore, so as gyee suggested at the midcycle, no one seems to need that support anymore | 21:03 |
| dstanek | i don't think we actually have kvs drivers for anything | 21:04 |
| dstanek | i think the base class is just subclassed for some reason, but it's been too long | 21:04 |
| *** mvk has joined #openstack-keystone | 21:04 | |
| dstanek | breton: i'm going to steal your REGION.name idea :-) locally i've fixed oslo.cache | 21:05 |
| *** raildo has quit IRC | 21:06 | |
| openstackgerrit | henry-nash proposed openstack/keystone: Add the migration phase status table https://review.openstack.org/349703 | 21:06 |
| openstackgerrit | David Stanek proposed openstack/keystone: WIP: region namespace POC for cache invalidation https://review.openstack.org/349704 | 21:07 |
| dstanek | lbragstad: breton: ^ midcycle hack | 21:07 |
| lbragstad | dstanek sweet - checking it out | 21:07 |
| lbragstad | dstanek is that what is failing the Fernet test? | 21:07 |
| lbragstad | for you locally? | 21:07 |
| *** diazjf has joined #openstack-keystone | 21:08 | |
| dstanek | lbragstad: yeah, but i'm not convinced it's that test.... feels like out auth is broken in some way | 21:08 |
| stevemar | i feel like marking https://bugs.launchpad.net/keystone/+bug/1180136 as "Opinion" at this point / cc dstanek | 21:09 |
| openstack | Launchpad bug 1180136 in OpenStack Identity (keystone) "Dependency injection framework is constructing the object first and then injecting the dependency which is incorrect" [Wishlist,Triaged] | 21:09 |
| *** brancal has quit IRC | 21:09 | |
| lbragstad | dstanek dogpile.cache.CacheRegion and dogpile.cache.region.CacheRegion are the same class, right? | 21:10 |
| lbragstad | dstanek just digging through the dogpile code and that's what I'm seeing | 21:10 |
| dstanek | stevemar: yeah, i mostly fixed that already. just a few things that still need to be cleaned up | 21:10 |
| stevemar | dstanek: mark it as fix released and cite what needs to be fixed. | 21:10 |
| dstanek | stevemar: i'll take a look at it | 21:10 |
| ayoung | stevemar, we are waiting for Fernet and revocation events to remove the form of revocation that would cause it. THe bug stands, but I am not going to fix it. Feel free to close Won't Fix if it bothers you that much, but otherwise, close it when the actual change is committed. Its ok for the bug to stay there until then, as documentation should anyone come across this | 21:11 |
| dstanek | stevemar: i think the issue with the dup endpoints is that we don't really know what to create a unique key on and as notmorgan noted, this would technically break backward compatibility | 21:13 |
| stevemar | dstanek: it totally would | 21:13 |
| stevemar | i will mark it as such | 21:13 |
| rderose | dolphm: looking... | 21:13 |
| dstanek | stevemar: doing to mark is a wontfix? | 21:14 |
| stevemar | dstanek: already did | 21:15 |
| stevemar | sorry about all the bug requests -- i'm ramping up for newton-3 and trying to take a look at all the keystone bugs that need some love | 21:15 |
| dstanek | stevemar: abandoned that patch | 21:15 |
| dstanek | more bug loving the better | 21:15 |
| notmorgan | dstanek: hmm? i saw my name | 21:17 |
| notmorgan | oh backwards compat things | 21:17 |
| *** GB21 has joined #openstack-keystone | 21:17 | |
| notmorgan | hehe yeah don't break backwards compat plz | 21:17 |
| *** pauloewerton has quit IRC | 21:17 | |
| dstanek | notmorgan: we were talking about the bug where someone wanted to add a constraint to endpoints | 21:17 |
| notmorgan | yah | 21:17 |
| notmorgan | i mean, it would be GREAT if we found a way to do it | 21:18 |
| notmorgan | but... backwards compat (eeeuuuwww) makes it hard | 21:18 |
| *** diazjf1 has joined #openstack-keystone | 21:19 | |
| *** sdake has quit IRC | 21:20 | |
| *** nk2527 has quit IRC | 21:22 | |
| *** jaugustine has quit IRC | 21:23 | |
| *** gagehugo_ has quit IRC | 21:23 | |
| *** diazjf has quit IRC | 21:23 | |
| *** nk2527 has joined #openstack-keystone | 21:24 | |
| *** gagehugo has joined #openstack-keystone | 21:28 | |
| lbragstad | dstanek I seem to get two different test failures with https://review.openstack.org/#/c/349704/1 | 21:30 |
| patchbot | lbragstad: patch 349704 - keystone - WIP: region namespace POC for cache invalidation | 21:30 |
| lbragstad | one that fails consistently is keystone.tests.unit.test_v3_assignment.AssignmentTestCase.test_get_head_role_assignments | 21:31 |
| lbragstad | the other that fails sometimes is keystone.tests.unit.test_auth.FernetAuthWithTrust.test_trust_get_token_fails_if_trustee_disabled | 21:31 |
| dstanek | lbragstad: that is also failing for me....a little scarry | 21:31 |
| lbragstad | dstanek so you're seeing both of those fail too | 21:31 |
| *** gagehugo_ has joined #openstack-keystone | 21:33 | |
| *** barclaac has quit IRC | 21:35 | |
| *** barclaac has joined #openstack-keystone | 21:35 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystoneauth: Improve authentication plugins documentation https://review.openstack.org/349423 | 21:39 |
| *** jaugustine has joined #openstack-keystone | 21:41 | |
| *** narengan has quit IRC | 21:43 | |
| lbragstad | dstanek for some reason http://cdn.pasteraw.com/1xlbs7c4d1radscl4gc6kpzyftbfqu2 fixes keystone.tests.unit.test_v3_assignment.AssignmentTestCase.test_get_head_role_assignments for me locally | 21:44 |
| *** jamielennox|away is now known as jamielennox | 21:48 | |
| openstackgerrit | Merged openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/333449 | 21:52 |
| *** tonytan4ever has joined #openstack-keystone | 21:54 | |
| *** ametts has quit IRC | 21:56 | |
| *** tonytan_brb has quit IRC | 21:57 | |
| openstackgerrit | henry-nash proposed openstack/keystone: WIP Add support for rolling upgrades to keystone-manage https://review.openstack.org/349716 | 21:57 |
| *** KevinE has joined #openstack-keystone | 21:58 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Skip middleware request processing for admin token https://review.openstack.org/344496 | 21:58 |
| *** KevinE has quit IRC | 21:59 | |
| *** jcalcote has joined #openstack-keystone | 21:59 | |
| jcalcote | I just installed newton keystone from canonical's cloud archive project on Ubuntu 16.04. It installs fine, but whenever I send it a curl command (e.g., curl http://localhost:5000/v2) I get back a 500 internal server error and the keystone log in /etc/apache2 shows a python stack trace - ImportError: no module named access | 22:01 |
| dstanek | jcalcote: can you paste the traceback into paste.openstack.org? | 22:02 |
| jcalcote | Sure - http://paste.openstack.org/show/545212/ | 22:03 |
| jcalcote | Google indicates a couple of other folks have seen this in the past with basically no resolution. | 22:04 |
| dstanek | jcalcote: can you also paste you keystone-paste.ini? it looks like an issue with dynamically loading something | 22:05 |
| *** KevinE has joined #openstack-keystone | 22:05 | |
| *** KevinE has quit IRC | 22:05 | |
| jcalcote | http://paste.openstack.org/show/545213/ | 22:06 |
| *** KevinE has joined #openstack-keystone | 22:06 | |
| *** GB21 has quit IRC | 22:07 | |
| *** diazjf1 has quit IRC | 22:07 | |
| lbragstad | jcalcote it looks like your paste.ini file is looking for keystone.contrib.access | 22:07 |
| jcalcote | oh yes - this makes sense - one of the few hits on google indicated a problem with contrib stuff - I just didn't follow what he was trying to say | 22:08 |
| jcalcote | ... and it turns out keystone.contrib.access is not installed. Wonder where to get that? | 22:12 |
| *** ravelar has quit IRC | 22:12 | |
| *** sdake has joined #openstack-keystone | 22:13 | |
| dstanek | jcalcote: i think what was actually removed | 22:13 |
| lbragstad | dstanek jcalcote yeah - that's what I'm thinking | 22:14 |
| dstanek | jcalcote: https://review.openstack.org/#/c/125703/ removed a long, long time ago | 22:14 |
| lbragstad | I am looking for the commit | 22:14 |
| lbragstad | and.... dstanek beat me to it | 22:14 |
| patchbot | dstanek: patch 125703 - keystone - remove deprecated access log middleware (MERGED) | 22:14 |
| jcalcote | dstanek - thanks - looks like a cloud archive bug then - they need to update their paste-ini file for their package. In the mean time, I don't know paste very well - can someone tell me how to clean up my paste ini file properly? | 22:14 |
| lbragstad | hah - we must have just removed the entry point | 22:15 |
| dstanek | jcalcote: remove access_log from your pipelines | 22:15 |
| jcalcote | k - thanks a log guys | 22:15 |
| dstanek | and probably the [filter:access_log] section just to be complete | 22:15 |
| *** slberger has left #openstack-keystone | 22:21 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add schema validation to create user v2 https://review.openstack.org/348531 | 22:27 |
| jcalcote | dstanik, lbragstad: thanks for the help - I had to remove the paste filters named: access, xml_body, sizelimiter before I could finally get rid of the 500 errors and get back something reasonable from the base keystone endpoint in curl. | 22:31 |
| jcalcote | kinda weird no one else is noticing this... | 22:31 |
| *** spedione is now known as spedione|AWAY | 22:32 | |
| *** ravelar has joined #openstack-keystone | 22:33 | |
| jamielennox | stevemar: so roxanaghe was going to have a look at the ADFS plugin - last i heard it didn't work | 22:34 |
| jamielennox | stevemar: so i'm not sure there's any point to giving it an entrypoint until then | 22:34 |
| roxanaghe | jamielennox, stevemar right, right now I'm testing the saml2 plugin and that doesn't work for me yet. for the adfs plugin I didn't try it recently but at least I found out why we need a separate one for ADFS: that's because ADFS doesn't support ECP, which is used in the saml2 plugin | 22:37 |
| *** spzala has joined #openstack-keystone | 22:41 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/349638 | 22:42 |
| *** spzala has quit IRC | 22:47 | |
| *** r-daneel has joined #openstack-keystone | 22:47 | |
| *** thumpba has quit IRC | 22:51 | |
| *** thumpba has joined #openstack-keystone | 22:51 | |
| jamielennox | roxanaghe: yea, i think that's the conclusion we came to at the midcycle, adfs had to do some form submission work and we're not sure how standard that form it | 22:53 |
| jamielennox | is | 22:53 |
| *** thumpba has quit IRC | 22:55 | |
| jamielennox | roxanaghe: if you need a hand with setting up the env let me know, it's been a little while but i remember most of it | 22:56 |
| roxanaghe | jamielennox, for saml2 or adfs? | 22:56 |
| jamielennox | saml2 mainly, i haven't done adfs | 22:57 |
| roxanaghe | jamielennox, I was able to setup a so-called testshib IDP - it's a test IDP provided by Shibboleth, I can use it via Horizon WebSSo but not via CLI | 22:59 |
| roxanaghe | jamielennox, I get this type of error: https://github.com/kennethreitz/requests/issues/2364 I'm trying to see why, since it works well using a Web REST client | 23:01 |
| *** sdake has quit IRC | 23:01 | |
| jamielennox | roxanaghe: mostly i've seen that when you make a mistake with SSL | 23:02 |
| jamielennox | either you have a https:// url without SSL configured or vice versa | 23:02 |
| *** sdake has joined #openstack-keystone | 23:03 | |
| roxanaghe | hm, let me verify that, thanks! | 23:04 |
| jamielennox | crinkle: i don't understand your comment on https://review.openstack.org/#/c/344496/3/keystone/tests/unit/test_middleware.py | 23:06 |
| patchbot | jamielennox: patch 344496 - keystone - Skip middleware request processing for admin token | 23:06 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/349648 | 23:06 |
| *** tonytan4ever has quit IRC | 23:07 | |
| crinkle | jamielennox: the request environment variable is getting transformed from 'openstack.context' to 'HTTP_OPENSTACK.CONTEXT' so the test I wrote fails, still trying to figure it out | 23:09 |
| jamielennox | crinkle: ah, ok - so that'll be because of the difference between environment and headers in wsgi | 23:10 |
| jamielennox | wsgi protocol passes everything around as an environment dict which contains a lot more than headers | 23:11 |
| jamielennox | things that are actually headers are prefixed with HTTP_ and uppercased | 23:11 |
| jamielennox | so when you do request.headers['name'] it actually does request.environ['HTTP_NAME'] | 23:11 |
| jamielennox | crinkle: i think you need to pass those as extra_environ= to make that work | 23:12 |
| crinkle | jamielennox: aha let me try that | 23:12 |
| *** Gorian_ has quit IRC | 23:15 | |
| *** thumpba has joined #openstack-keystone | 23:25 | |
| *** ravelar has quit IRC | 23:29 | |
| *** sdake has quit IRC | 23:31 | |
| *** edmondsw has quit IRC | 23:40 | |
| *** sdake has joined #openstack-keystone | 23:40 | |
| *** code-R_ has quit IRC | 23:45 | |
| *** ravelar159 has joined #openstack-keystone | 23:45 | |
| *** spzala has joined #openstack-keystone | 23:47 | |
| stevemar | ahh extra_environ | 23:47 |
| jamielennox | stevemar: is that ahh in realization or satisfaction? | 23:49 |
| stevemar | jamielennox: more of a: "ohhh right, that's what was needed" | 23:50 |
| jamielennox | realization | 23:51 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Move audit initiator creation to request https://review.openstack.org/342658 | 23:55 |
| * notmorgan sighs. | 23:56 | |
| notmorgan | i really need people to stop asking me keystone questions in private | 23:56 |
| stevemar | notmorgan: haha | 23:56 |
| notmorgan | this is causing me a lot of headaches trying to not swap contexts | 23:56 |
| stevemar | just ignore them | 23:57 |
| notmorgan | i just lost 4hrs of digging through code because of the context switch | 23:57 |
| stevemar | give us names! | 23:57 |
| stevemar | publicly shame! | 23:57 |
| notmorgan | no, i told them to stop asking me these things in private | 23:57 |
| stevemar | thats usually the best option | 23:57 |
| notmorgan | but it doesn't take a lot to swap the context | 23:57 |
| notmorgan | because this code is not straight forward | 23:57 |
| notmorgan | whereas keystone is. | 23:57 |
| notmorgan | so, you know how frustrating code can be where it's easy to just lose your spot =/ | 23:58 |
| *** spzala has quit IRC | 23:58 | |
| *** spzala has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!