| *** arunkant__ has quit IRC | 00:00 | |
| *** javis has quit IRC | 00:01 | |
| *** markvoelker has joined #openstack-keystone | 00:13 | |
| *** gagehugo has joined #openstack-keystone | 00:14 | |
| *** gagehugo has quit IRC | 00:15 | |
| *** BjoernT has quit IRC | 00:16 | |
| *** tqtran has quit IRC | 00:16 | |
| *** adrian_otto has quit IRC | 00:17 | |
| *** scarlisle has quit IRC | 00:32 | |
| *** gyee has quit IRC | 00:37 | |
| *** wasmum has joined #openstack-keystone | 00:37 | |
| *** browne has quit IRC | 00:56 | |
| *** mtreinish has quit IRC | 01:01 | |
| *** mtreinish has joined #openstack-keystone | 01:05 | |
| *** tonytan4ever has joined #openstack-keystone | 01:05 | |
| ayoung | dagnabit, kerberos plugin has bit rotted | 01:16 |
|---|---|---|
| *** davechen has joined #openstack-keystone | 01:20 | |
| *** spzala has joined #openstack-keystone | 01:21 | |
| *** wangqun has joined #openstack-keystone | 01:22 | |
| *** spzala has quit IRC | 01:26 | |
| stevemar | ayoung: no functional tests :( | 01:41 |
| ayoung | stevemar, hard to set them up. | 01:41 |
| ayoung | stevemar, but I think I was using the wrong "name" anyway | 01:42 |
| ayoung | nah, wait, | 01:42 |
| ayoung | it is v3fedkerb | 01:42 |
| ayoung | crubbles | 01:42 |
| ayoung | stevemar, OSC should not be tripping over any keystoneclient auth plugin stuff anymore should it? | 01:43 |
| stevemar | ayoung: definitely not, it should use all the ksa plugins as of 3.x.y | 01:44 |
| ayoung | stevemar, I was seeing a deprecation warking, but buried in the debugger. I wonder if our packaging is somehow getting the wrong version | 01:44 |
| ayoung | let me see what we have | 01:44 |
| ayoung | python-openstackclient-2.6.0-0.20160802193135.7dc2e1d.el7.centos.noarch | 01:45 |
| ayoung | 2.6.0 is that right? lets check pip | 01:45 |
| ayoung | python-openstackclient 3.2.0 | 01:47 |
| ayoung | stevemar, I is confooosed | 01:48 |
| ayoung | why does Pypi have such a high number? | 01:48 |
| ayoung | git tag shows 2.6, which is what the RPM is built from | 01:48 |
| stevemar | ayoung: we released 3.0.0, 3.0.1, 3.1.0 and 3.2.0 since 2.6.0 :) | 01:53 |
| stevemar | ayoung: yell at whoever packages osc! | 01:53 |
| stevemar | ayoung: to be fair, we released all those 3.x.x releases in the last 2-3 weeks | 01:53 |
| stevemar | could just be some lag in packaging the new one | 01:54 |
| stevemar | ayoung: maybe install 3.2.0 in a fresh virtualenv so it doesn't conflict with what you have installed from package | 01:54 |
| ayoung | stevemar, we are not tagging them in git? | 01:54 |
| stevemar | they should be... | 01:55 |
| ayoung | ah...was stale | 01:55 |
| ayoung | ok yep, that is way out of date | 01:55 |
| stevemar | ayoung: i'm seeing the tags here https://github.com/openstack/python-openstackclient | 01:55 |
| ayoung | stevemar, nah, my repor was stale. | 01:55 |
| stevemar | ah | 01:55 |
| ayoung | thought I had synced more recently than that | 01:55 |
| ayoung | so 2.6.0 was June | 01:56 |
| ayoung | tag 3.0.0 | 01:57 |
| ayoung | Tagger: Doug Hellmann <doug@doughellmann.com> | 01:57 |
| ayoung | Date: Mon Aug 22 08:21:22 2016 -0400 | 01:57 |
| ayoung | ah, so recent. 2.6 should be doing KSA too, then | 01:57 |
| stevemar | ayoung: nope, 2.6.0 was released, but we hadn't integrated with KSA yet | 01:58 |
| stevemar | ayoung: integrating with KSA was a huge PITA | 01:58 |
| ayoung | ah...let me see if we even have KSA in our repo | 01:58 |
| stevemar | thats why we actually did a 3.0.0, we know we would screw up somewhere, and we did have some minor regressions... | 01:58 |
| ayoung | python2-keystoneauth1-2.11.0-0.20160812120830.80ad3bc.el7.centos.noarch | 01:59 |
| ayoung | let me try and trigger a 3 series build | 01:59 |
| openstackgerrit | Merged openstack/python-keystoneclient: standardize release note page ordering https://review.openstack.org/366982 | 01:59 |
| *** esp has quit IRC | 01:59 | |
| *** adrian_otto has joined #openstack-keystone | 02:05 | |
| *** EinstCrazy has joined #openstack-keystone | 02:08 | |
| *** adrian_otto has quit IRC | 02:11 | |
| *** spedione|AWAY is now known as spedione | 02:13 | |
| *** adrian_otto has joined #openstack-keystone | 02:13 | |
| *** fangxu has quit IRC | 02:15 | |
| *** roxanagh_ has joined #openstack-keystone | 02:15 | |
| *** spzala has joined #openstack-keystone | 02:21 | |
| *** adrian_otto has quit IRC | 02:24 | |
| *** chlong has joined #openstack-keystone | 02:26 | |
| *** browne has joined #openstack-keystone | 02:28 | |
| *** topol has quit IRC | 02:29 | |
| *** topol has joined #openstack-keystone | 02:31 | |
| *** clayton has quit IRC | 02:32 | |
| *** clayton has joined #openstack-keystone | 02:33 | |
| *** chrisshattuck has joined #openstack-keystone | 02:38 | |
| *** namnh has joined #openstack-keystone | 02:40 | |
| *** browne has quit IRC | 02:43 | |
| *** ChanServ sets mode: +v topol | 02:44 | |
| *** tonytan4ever has quit IRC | 02:46 | |
| *** spzala has quit IRC | 02:48 | |
| openstackgerrit | JiWei proposed openstack/keystoneauth: Raise NotImplementedError instead of NotImplemented https://review.openstack.org/365194 | 02:56 |
| *** spedione is now known as spedione|AWAY | 02:57 | |
| *** code-R has joined #openstack-keystone | 02:59 | |
| *** code-R_ has joined #openstack-keystone | 03:01 | |
| *** code-R has quit IRC | 03:04 | |
| *** roxanagh_ has quit IRC | 03:07 | |
| *** chrisshattuck has quit IRC | 03:09 | |
| *** tqtran has joined #openstack-keystone | 03:15 | |
| *** chrisshattuck has joined #openstack-keystone | 03:17 | |
| *** tqtran has quit IRC | 03:19 | |
| *** david-lyle_ has joined #openstack-keystone | 03:22 | |
| *** david-lyle_ has quit IRC | 03:22 | |
| *** roxanagh_ has joined #openstack-keystone | 03:23 | |
| *** chrisshattuck has quit IRC | 03:25 | |
| *** chrisshattuck has joined #openstack-keystone | 03:26 | |
| *** esp has joined #openstack-keystone | 03:33 | |
| *** roxanagh_ has quit IRC | 03:33 | |
| *** wangqun has quit IRC | 03:35 | |
| *** wangqun has joined #openstack-keystone | 03:35 | |
| *** dikonoor has joined #openstack-keystone | 03:41 | |
| *** tonytan4ever has joined #openstack-keystone | 03:44 | |
| *** roxanagh_ has joined #openstack-keystone | 03:57 | |
| *** annp has joined #openstack-keystone | 04:04 | |
| *** esp has quit IRC | 04:15 | |
| *** tqtran has joined #openstack-keystone | 04:16 | |
| *** spzala has joined #openstack-keystone | 04:17 | |
| *** su_zhang has joined #openstack-keystone | 04:17 | |
| *** spzala has quit IRC | 04:17 | |
| *** woodster_ has quit IRC | 04:19 | |
| *** tqtran has quit IRC | 04:21 | |
| *** rm_work has quit IRC | 04:31 | |
| *** rm_work has joined #openstack-keystone | 04:34 | |
| *** rm_work has quit IRC | 04:36 | |
| *** rm_work has joined #openstack-keystone | 04:38 | |
| *** chrisshattuck has quit IRC | 04:42 | |
| *** rkrum has joined #openstack-keystone | 04:47 | |
| *** roxanagh_ has quit IRC | 04:50 | |
| *** su_zhang has quit IRC | 04:55 | |
| *** su_zhang has joined #openstack-keystone | 04:56 | |
| *** roxanagh_ has joined #openstack-keystone | 05:00 | |
| *** roxanagh_ has quit IRC | 05:00 | |
| *** su_zhang has quit IRC | 05:00 | |
| *** roxanagh_ has joined #openstack-keystone | 05:02 | |
| *** roxanagh_ has quit IRC | 05:07 | |
| *** roxanagh_ has joined #openstack-keystone | 05:10 | |
| *** su_zhang has joined #openstack-keystone | 05:12 | |
| *** jaosorior has joined #openstack-keystone | 05:21 | |
| *** roxanagh_ has quit IRC | 05:28 | |
| *** chlong_ has joined #openstack-keystone | 05:31 | |
| *** roxanagh_ has joined #openstack-keystone | 05:33 | |
| *** ukesh has joined #openstack-keystone | 05:36 | |
| ukesh | join | 05:38 |
| *** richm has quit IRC | 05:40 | |
| *** su_zhang has quit IRC | 05:40 | |
| *** su_zhang has joined #openstack-keystone | 05:41 | |
| *** su_zhang_ has joined #openstack-keystone | 05:42 | |
| *** su_zhang has quit IRC | 05:45 | |
| *** roxanagh_ has quit IRC | 05:49 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for projects https://review.openstack.org/367757 | 05:54 |
| *** adriant has quit IRC | 05:55 | |
| ukesh | I am having query on, https://bugs.launchpad.net/keystone/+bug/1614069 | 05:57 |
| openstack | Launchpad bug 1614069 in OpenStack Identity (keystone) "API v2.0 responds with HTTP 200 when trying to add a non-existent user to a project" [Medium,In progress] - Assigned to Ukesh (ukeshkumar) | 05:57 |
| *** tonytan4ever has quit IRC | 06:00 | |
| *** tqtran has joined #openstack-keystone | 06:18 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for services/endpoints https://review.openstack.org/367760 | 06:23 |
| *** tqtran has quit IRC | 06:23 | |
| *** pcaruana has joined #openstack-keystone | 06:23 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for v3 users https://review.openstack.org/367767 | 06:42 |
| *** su_zhang_ has quit IRC | 06:45 | |
| *** su_zhang has joined #openstack-keystone | 06:46 | |
| *** ukesh has quit IRC | 06:48 | |
| *** Ukesh has joined #openstack-keystone | 06:48 | |
| *** su_zhang has quit IRC | 06:50 | |
| openstackgerrit | Merged openstack/keystone-specs: clean up the spec repo for newton https://review.openstack.org/366268 | 06:50 |
| *** jamielennox|away is now known as jamielennox | 07:03 | |
| *** tesseract- has joined #openstack-keystone | 07:07 | |
| *** rkrum has quit IRC | 07:11 | |
| *** EinstCrazy has quit IRC | 07:14 | |
| *** jpena|off is now known as jpena | 07:18 | |
| *** chlong has quit IRC | 07:19 | |
| *** chlong_ has quit IRC | 07:19 | |
| *** EinstCrazy has joined #openstack-keystone | 07:24 | |
| *** annp has quit IRC | 07:27 | |
| *** annp has joined #openstack-keystone | 07:27 | |
| *** pnavarro has joined #openstack-keystone | 07:33 | |
| *** code-R_ has quit IRC | 07:34 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref for v3 groups https://review.openstack.org/367793 | 07:43 |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak api-ref doc for v3 roles https://review.openstack.org/367794 | 07:43 |
| *** tonytan4ever has joined #openstack-keystone | 07:46 | |
| *** tonytan4ever has quit IRC | 07:52 | |
| *** EinstCrazy has quit IRC | 07:55 | |
| *** EinstCrazy has joined #openstack-keystone | 07:55 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** EinstCrazy has quit IRC | 08:01 | |
| *** EinstCrazy has joined #openstack-keystone | 08:02 | |
| *** zzzeek has joined #openstack-keystone | 08:02 | |
| openstackgerrit | JiWei proposed openstack/keystone: Fix order of arguments in assertIs https://review.openstack.org/367804 | 08:03 |
| *** lmiccini_ has joined #openstack-keystone | 08:09 | |
| *** lmiccini has quit IRC | 08:10 | |
| *** arunkant has quit IRC | 08:22 | |
| *** lmiccini_ is now known as lmiccini | 08:23 | |
| *** arunkant has joined #openstack-keystone | 08:23 | |
| *** EinstCrazy has quit IRC | 08:26 | |
| *** EinstCra_ has joined #openstack-keystone | 08:29 | |
| *** EinstCra_ has quit IRC | 08:30 | |
| *** EinstCrazy has joined #openstack-keystone | 08:33 | |
| *** EinstCrazy has quit IRC | 08:35 | |
| *** EinstCrazy has joined #openstack-keystone | 08:35 | |
| *** jaosorior is now known as jaosorior_lunch | 08:40 | |
| *** asettle has joined #openstack-keystone | 08:42 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: [api-ref] Refactor code for Keystone v2 - part 1 https://review.openstack.org/367833 | 08:56 |
| *** sdake has joined #openstack-keystone | 09:02 | |
| *** EinstCrazy has quit IRC | 09:06 | |
| *** EinstCrazy has joined #openstack-keystone | 09:08 | |
| *** code-R has joined #openstack-keystone | 09:12 | |
| *** code-R_ has joined #openstack-keystone | 09:13 | |
| *** amakarov_away is now known as amakarov | 09:15 | |
| *** sdake_ has joined #openstack-keystone | 09:16 | |
| *** code-R has quit IRC | 09:17 | |
| *** sdake has quit IRC | 09:18 | |
| *** aloga has quit IRC | 09:23 | |
| *** aloga has joined #openstack-keystone | 09:24 | |
| *** asettle has quit IRC | 09:41 | |
| *** asettle has joined #openstack-keystone | 09:41 | |
| openstackgerrit | Ha Van Tu proposed openstack/keystone: [api-ref] Refactor Keystone API reference v2 - part 1 https://review.openstack.org/365947 | 09:41 |
| *** sdake has joined #openstack-keystone | 09:57 | |
| *** sdake_ has quit IRC | 10:00 | |
| *** annp has quit IRC | 10:05 | |
| *** richm has joined #openstack-keystone | 10:08 | |
| *** namnh has quit IRC | 10:09 | |
| *** EinstCrazy has quit IRC | 10:10 | |
| *** davechen has left #openstack-keystone | 10:11 | |
| openstackgerrit | Antoni Segura Puimedon proposed openstack/keystoneauth: doc: remove unused import https://review.openstack.org/367926 | 10:27 |
| *** apuimedo has joined #openstack-keystone | 10:28 | |
| *** sdake_ has joined #openstack-keystone | 10:31 | |
| *** sdake has quit IRC | 10:33 | |
| *** jaosorior_lunch is now known as jaosorior | 10:41 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 10:44 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 10:46 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 10:47 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation trust driver https://review.openstack.org/291871 | 10:47 |
| *** jaugustine has quit IRC | 11:16 | |
| *** jaugustine has joined #openstack-keystone | 11:22 | |
| *** tqtran has joined #openstack-keystone | 11:23 | |
| *** tqtran has quit IRC | 11:28 | |
| *** dikonoor has quit IRC | 11:30 | |
| *** GB21 has joined #openstack-keystone | 11:31 | |
| *** dikonoor has joined #openstack-keystone | 11:34 | |
| *** tonytan4ever has joined #openstack-keystone | 11:48 | |
| *** wangqun has quit IRC | 11:52 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 11:52 |
| *** tonytan4ever has quit IRC | 11:53 | |
| *** GB21 has quit IRC | 11:53 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Add sql backend for fernet keys https://review.openstack.org/367405 | 11:54 |
| *** jed56 has quit IRC | 11:55 | |
| *** pauloewerton has joined #openstack-keystone | 11:59 | |
| *** code-R_ has quit IRC | 12:00 | |
| *** code-R has joined #openstack-keystone | 12:00 | |
| *** apuimedo has left #openstack-keystone | 12:03 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 12:03 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 12:05 |
| *** code-R has quit IRC | 12:06 | |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Add sql backend for fernet keys https://review.openstack.org/367405 | 12:10 |
| *** jpena is now known as jpena|lunch | 12:12 | |
| *** asettle has quit IRC | 12:14 | |
| *** nicolasbock has joined #openstack-keystone | 12:15 | |
| *** asettle has joined #openstack-keystone | 12:23 | |
| *** sdake_ is now known as sdake | 12:47 | |
| *** tonytan4ever has joined #openstack-keystone | 12:49 | |
| *** jaosorior has quit IRC | 12:52 | |
| *** jaosorior has joined #openstack-keystone | 12:52 | |
| *** tonytan4ever has quit IRC | 12:54 | |
| *** Ukesh has quit IRC | 12:55 | |
| stevemar | dstanek: i'll update the commit message in the assertIs patch | 12:57 |
| dstanek | stevemar: ok | 12:58 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix order of arguments in assertIs https://review.openstack.org/367804 | 12:58 |
| stevemar | dstanek: ^ | 12:58 |
| stevemar | dstanek: yeah, i doubt it adds much value, but i'd rather have it not in our queue | 12:59 |
| dstanek | stevemar: i was thinking of taking that api-doc one breaking it up and listing the original author as a co-author, but want to give a little more time | 13:00 |
| *** joerch has quit IRC | 13:00 | |
| *** joerch has joined #openstack-keystone | 13:00 | |
| stevemar | dstanek: these ones: https://review.openstack.org/#/c/367757/ ? | 13:00 |
| stevemar | ugh, doubt we need that much detail for response codes | 13:01 |
| stevemar | i'd rather see the parameters in a table with nice definitions | 13:01 |
| stevemar | i also doubt many of the error codes have been verified in a long ass time | 13:01 |
| dstanek | stevemar: ++ i doubt it's correct. | 13:02 |
| dstanek | stevemar: i'd like to see a whitespace patch and a patch for each subsystem of things "fix tenant parameters in v2 api-doc" and stuff like that | 13:03 |
| dstanek | this stuff isn't fun to look though because of all of the time it takes to cross reference things | 13:03 |
| *** woodster_ has joined #openstack-keystone | 13:05 | |
| *** sdake has quit IRC | 13:05 | |
| stevemar | yeah, not the easiest to compare | 13:07 |
| *** admin0 has joined #openstack-keystone | 13:07 | |
| admin0 | hi all .. how do I upgrade keystone few versions up ? | 13:07 |
| admin0 | i have a keystone db on icehouse .. i want to upgrade ( only keystone ) to mitaka | 13:08 |
| admin0 | what is the best approach to do it ? | 13:08 |
| stevemar | admin0: that's a rather loaded question :) | 13:08 |
| stevemar | admin0: you still have to upgrade one version at a time | 13:08 |
| admin0 | my thought was .. setup a venv , git clone and then checkout each tag and run the db_migrate | 13:08 |
| stevemar | at least, you have to upgrade your databases one version at a time | 13:08 |
| admin0 | my db shows version as 55 | 13:09 |
| admin0 | select * from migrate_version; | 13:09 |
| admin0 | keystone 55, revoke 2 | 13:09 |
| stevemar | yeah, so you can't checkout the mitaka version, you'll get toasted | 13:09 |
| admin0 | here is the case .. old openstack in icehouse, new openstack = mitaka .. want to share the auth details, so wondering if an upgraded keystone is still backward compatible with icehouse .. siuch that old is region1, new is region2 | 13:10 |
| admin0 | if the upgrade works, i can then re-use this same keystone | 13:10 |
| stevemar | admin0: there are some notes here: http://docs.openstack.org/developer/keystone/upgrading.html | 13:11 |
| admin0 | how to find out what verion my kesytone is ? | 13:14 |
| admin0 | like number 55 = icehouse type | 13:14 |
| *** su_zhang has joined #openstack-keystone | 13:16 | |
| admin0 | for example, apt-get install keystone python-keystoneclient — if i do this now, this gets me from mitaka right .. how to get this from juno | 13:18 |
| admin0 | i downloaded git of openstack-keysotne and then did a checkout of juno-eol | 13:18 |
| admin0 | and strugglign there :) | 13:19 |
| *** jpena|lunch is now known as jpena | 13:24 | |
| ayoung | dstanek, stevemar, lbragstad what do we need to do with 'extras' in keystone auth to get them to load when they are auth plugins? | 13:25 |
| openstackgerrit | Mikhail Nikolaenko proposed openstack/keystone: [WIP] Move fernet utils to backend https://review.openstack.org/356499 | 13:26 |
| ayoung | I'm getting a "not found" error due to them being in a different namespace | 13:26 |
| dstanek | ayoung: you mean to install the packages? | 13:26 |
| ayoung | dstanek, no, to load the entrypoints when running OSC | 13:27 |
| ayoung | doing | 13:27 |
| ayoung | export OS_AUTH_TYPE=v3fedkerb | 13:27 |
| ayoung | leads to | 13:27 |
| ayoung | NoMatchingPlugin: The plugin v3fedkerb could not be found | 13:27 |
| dstanek | if the code is installed and on the python path it should be loaded | 13:27 |
| dstanek | unless you are creating your own entry points | 13:27 |
| dstanek | is that one of ours? | 13:27 |
| *** BjoernT has joined #openstack-keystone | 13:28 | |
| *** BjoernT is now known as Bjoern_zZzZzZzZ | 13:28 | |
| dstanek | admin0: do you need the older keystoneclient? | 13:29 |
| *** sdake has joined #openstack-keystone | 13:30 | |
| ayoung | dstanek, it is a standard entrypoint, but tracing through the debugger it does not get found in the stevedore code | 13:33 |
| ayoung | epi group show keystoneauth1.plugin shows it | 13:34 |
| ayoung | v3fedkerb | keystoneauth1.extras.kerberos._loading | MappedKerberos | keystoneauth1 2.12.1 | 13:34 |
| *** tonytan4ever has joined #openstack-keystone | 13:35 | |
| ayoung | dstanek, I can load it as a python class http://paste.openstack.org/show/570198/ | 13:35 |
| *** javis has joined #openstack-keystone | 13:35 | |
| *** Bjoern_zZzZzZzZ is now known as BjoernT | 13:41 | |
| *** ddieterly has joined #openstack-keystone | 13:42 | |
| ayoung | is Colleen Murphy on here? | 13:43 |
| ayoung | she did a bunch of auth work... | 13:43 |
| *** ddieterly has quit IRC | 13:44 | |
| *** ddieterly has joined #openstack-keystone | 13:45 | |
| *** jed56 has joined #openstack-keystone | 13:45 | |
| admin0 | dstanek: older keystonecleint = for old region/existing openstack | 13:49 |
| openstackgerrit | ayoung proposed openstack/keystoneauth: Test that fedkerb plugin loads https://review.openstack.org/368017 | 13:51 |
| *** joerch has quit IRC | 13:51 | |
| stevemar | ayoung: she'll be on later | 13:54 |
| stevemar | ayoung: how did you install keystoneauth? | 13:54 |
| stevemar | with the repo? | 13:54 |
| ayoung | stevemar, rpm | 13:54 |
| lbragstad | samueldmq well - it looks like it passed my rechecks - https://review.openstack.org/#/c/345688/ | 13:54 |
| stevemar | ayoung: http://www.gazlene.net/kerberos-devstack.html | 13:54 |
| *** ddieterly is now known as ddieterly[away] | 13:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:55 | |
| ayoung | export OS_AUTH_TYPE=v3kerberos | 13:56 |
| ayoung | it is similar | 13:56 |
| ayoung | not uite the same plugin | 13:56 |
| ayoung | I have requests-kerberos | 13:57 |
| admin0 | how do I translate ‘apt-get install keystone python-keystoneclient” to installation of keystone from git checkout keystone | 13:57 |
| admin0 | pip install . (setup requirents ) are done | 13:57 |
| stevemar | ayoung: cause keystoneauth will only make plugins discoverable if you have the necessary libraries, so for saml2 auth to be discovered, you need to have lxml installed, same with v3fedkerb and requests-kerberos, and v3oauth1 and oauthlib | 13:58 |
| dstanek | ayoung: do you know if the python libs that are required for the auth type are insalled? | 13:58 |
| stevemar | ayoung: that is as designed by jamielennox | 13:58 |
| ayoung | stevemar, I was able to load the entrypoint from the python interpreter | 13:58 |
| dstanek | admin0: admin0 so you want to install from source? | 13:59 |
| ayoung | >>> for ep in pkg_resources.iter_entry_points(group='keystoneauth1.plugin'): | 13:59 |
| ayoung | ... named_objects.update({ep.name: ep.load()}) | 13:59 |
| admin0 | yes | 13:59 |
| ayoung | print (named_objects) shows 'v3fedkerb': <class 'keystoneauth1.extras.kerberos._loading.MappedKerberos' | 13:59 |
| admin0 | becacuse db is in icehouse, i want to db-migrate to mitaka | 13:59 |
| admin0 | and then install mitaka and connect to this db and see if i can get the tokens and perform auth | 13:59 |
| dstanek | admin0: from icehouse directly to mitaka? | 13:59 |
| ayoung | admin0, python setup.py .... | 14:00 |
| stevemar | ayoung: you can verify you are passing in --v3fedkerb into OSC using --debug, again double check that you're using osc 3.x | 14:00 |
| stevemar | pre 3.x it's flakey and depends on keystoneclient-kerberos or something silly | 14:00 |
| ayoung | openstack --version | 14:00 |
| ayoung | WARNING: openstackclient.common.utils is deprecated and will be removed after Jun 2017. Please use osc_lib.utils | 14:00 |
| ayoung | openstack 3.2.0 | 14:00 |
| dstanek | admin0: i think you'll have to install each version after icehouse and apply their migrations in sequence. i don't think you can jump ahead like that | 14:01 |
| admin0 | dstanek: context .. i have one openstack region on icehouse, new one will be in mitaka .. so checking if i can re-use the same keystone db by upgrading the db to mitaka .. and see if it still works for the icehouse as region1 and also for mitaka as region2 | 14:01 |
| ayoung | stevemar, I'm running pdb. I see | 14:01 |
| admin0 | dstanek: exactly which i was sking .. how to do step wise version migrations to save time as well | 14:01 |
| dstanek | admin0: no, sharing a DB won't work | 14:01 |
| ayoung | print PLUGIN_NAMESPACE | 14:02 |
| ayoung | keystoneclient.auth.plugin | 14:02 |
| ayoung | print name | 14:02 |
| ayoung | v3fedkerb | 14:02 |
| ayoung | mgr = stevedore.DriverManager(namespace=PLUGIN_NAMESPACE, | 14:02 |
| ayoung | 90 name=name, | 14:02 |
| ayoung | 91 invoke_on_load=False) | 14:02 |
| stevemar | that's weird | 14:02 |
| ayoung | and when I call that I get | 14:02 |
| admin0 | dstanek: so an upgraded kesytone cannot serve older client ? | 14:02 |
| ayoung | No 'keystoneclient.auth.plugin' driver found, looking for 'v3fedkerb' | 14:02 |
| ayoung | yeah, it is a bazaar | 14:03 |
| dstanek | admin0: what do you mean by client? if you have once icehouse server and one mitaka server they cannot share a database | 14:03 |
| ayoung | brazier | 14:03 |
| ayoung | nrassiere | 14:03 |
| ayoung | feh | 14:04 |
| *** pnavarro has quit IRC | 14:04 | |
| ayoung | brasserie | 14:04 |
| admin0 | dstanek: then let me rephrase .. if there are 2 openstack clusters, one in icehouse and one in mitaka, can a single keystone be used for both of them, icehouse as region1 and mitaka as region2 ? | 14:04 |
| *** ddieterly[away] is now known as ddieterly | 14:04 | |
| ayoung | wwierd | 14:04 |
| dstanek | admin0: by keystone you mean client there? | 14:04 |
| admin0 | yes | 14:04 |
| ayoung | admin0, only if you use keystone mitake for both | 14:05 |
| dstanek | admin0: i doubt it. your versions are too far apart | 14:05 |
| dstanek | admin0: i would expect that you'll need an older version of keystoneclient to talk to icehouse (unless you are doing just auth and then maybe?) | 14:06 |
| admin0 | just to understand .. keystone needs to provide the api and validate tokens .. i thought those basic functions are the same .. what might have changed is the v2 and v3 .. so new ones can point to v3 and older one still to v2 | 14:06 |
| admin0 | problem is thati cannot upgrade the current environment | 14:06 |
| dstanek | admin0: your use of the word keystone keeps throwing me off | 14:07 |
| dstanek | admin0: so you have a icehouse cluster and a mitaka cluster. you also have some application that uses keystoneclient to talk to them. you want to know if the same instance of the application can talk to both right? | 14:08 |
| *** ravelar has joined #openstack-keystone | 14:08 | |
| ayoung | admin0, why can't you upgrade? Need 0 downtime? | 14:09 |
| ayoung | can't afford to reboot the apps? | 14:10 |
| admin0 | i have one existing icehouse cluster — complete set .. Now we want to build a new openstack platfrom .. however the backend.billing.invoice are all tied to existing uuid and stuff .. and we cannot upgrade the current openstack platfrom, because the old team hacked it to death for all customizations | 14:13 |
| admin0 | so i am trying to check if i can upgrade just keystone to mitaka in a new copy of database and server, so that for the new cluster,i will use this as the keystone database ( as region2 — so that all apis are different) and also hope that it works from the existing cluster — given there are no db/field changes | 14:14 |
| *** edmondsw has joined #openstack-keystone | 14:15 | |
| *** spzala has joined #openstack-keystone | 14:15 | |
| dstanek | admin0: no db/field changes between icehouse and mitaka? | 14:15 |
| admin0 | no clue .. that is what i am trying to find out | 14:16 |
| admin0 | and here, because you guys know this best | 14:16 |
| dstanek | admin0: there are tons | 14:16 |
| dstanek | in the last cycle alone the way the user records are handled were split from 1 table into (i think) 4 | 14:17 |
| admin0 | then in another question, can neutron, nova etc (on icehouse release ) point to and still work wtih a single keystone that is on mitaka ? | 14:17 |
| dstanek | admin0: i suspect yes, but i don't know. if they are just doing auth/token validation i think it would be OK as long as you are not using new token formats | 14:18 |
| dstanek | admin0: someone else here may know a more detailed answer | 14:19 |
| admin0 | the current is on icehouse with 4 patches from juno — token_reuse, tenant_name_to_id and otp | 14:19 |
| samueldmq | lbragstad: that'd odd | 14:20 |
| admin0 | apart from user/pass i do not think we are using it for anything fancy | 14:20 |
| lbragstad | samueldmq ++ | 14:20 |
| dstanek | admin0: also i don't think you can upgrade directly from icehouse to mitaka. | 14:20 |
| lbragstad | samueldmq so we definitely have a race condition | 14:20 |
| samueldmq | lbragstad: I just left another recheck | 14:20 |
| samueldmq | lbragstad: let's retest a few times | 14:20 |
| lbragstad | samueldmq i'm standing up a devstack | 14:20 |
| admin0 | dstanek: i am not trying ot upgrade directly | 14:20 |
| dstanek | i've heard of people having issues why they skipped releases | 14:20 |
| admin0 | i am trying to upgrade step by step | 14:20 |
| dstanek | admin0: k | 14:20 |
| admin0 | and asking for the best /quick way to do that | 14:20 |
| lbragstad | samueldmq i hope i can recreate it locally | 14:20 |
| nicolasbock | I am running mitaka, keystone identity with domain_specific_drivers enabled. | 14:20 |
| nicolasbock | I created a new domain called 'ldap' | 14:20 |
| samueldmq | lbragstad: cool, hopefully | 14:21 |
| nicolasbock | copied all LDAP relevant settings into keystone.ldap.conf | 14:21 |
| nicolasbock | what I can't figure out is how to do anything with the ldap domain | 14:21 |
| admin0 | from setup, i did python setup.py install and it installed inside the virtualenv | 14:21 |
| admin0 | now need to run db_migrate i guess | 14:21 |
| nicolasbock | how do I run 'openstack user list' on that domain? | 14:21 |
| admin0 | and then do the same for each version | 14:21 |
| nicolasbock | If I run 'openstack --os-user-domain-name ldap --os-username $USER --os-password $PASS user list' I get 'The request you have made requires authentication.' | 14:23 |
| *** ezpz has joined #openstack-keystone | 14:23 | |
| nicolasbock | I am sure though that the username/password combo is correct | 14:23 |
| nicolasbock | what am I missing? | 14:24 |
| *** tqtran has joined #openstack-keystone | 14:25 | |
| *** ezpz has quit IRC | 14:26 | |
| admin0 | from inside the virtualenv, i did python setup.py install .. created the kesytone.conf and logigng.conf ..when i run the db_sync says ImportError: No module named openstack | 14:27 |
| *** dikonoor has quit IRC | 14:29 | |
| *** tqtran has quit IRC | 14:29 | |
| stevemar | nicolasbock: you're not providing a project to authenticate with | 14:30 |
| nicolasbock | stevemar, you mean I need a user that lives in LDAP and is associated to a project? | 14:30 |
| stevemar | nicolasbock: i've blogged about domain specific drivers, others have found it useful, want to take a look? https://developer.ibm.com/opentech/2015/08/14/configuring-keystone-with-ibms-bluepages-ldap/ | 14:30 |
| nicolasbock | stevemar, thanks for the link! | 14:31 |
| stevemar | nicolasbock: the os-* variables are for authentication | 14:31 |
| stevemar | nicolasbock: take a look and read, i'll be here to answer questions for a few hours ;) | 14:31 |
| nicolasbock | stevemar, thanks, I will! | 14:32 |
| * nicolasbock goes reading... | 14:32 | |
| stevemar | dstanek: if you're around; https://review.openstack.org/#/c/366270/ | 14:33 |
| admin0 | ImportError: No module named openstack -guys , know what i need to install that is beyond pip ? | 14:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Fixes password created_at errors due to the server_default https://review.openstack.org/367025 | 14:35 |
| stevemar | admin0: i think that comes from the sdk, what did you do in order to invoke that? :) | 14:35 |
| *** michauds has joined #openstack-keystone | 14:37 | |
| *** su_zhang has quit IRC | 14:38 | |
| dstanek | stevemar: yep, i'm around. just tracing through upgrade code | 14:38 |
| *** su_zhang has joined #openstack-keystone | 14:38 | |
| dstanek | stevemar: tsk, tsk. an extra newline :-P | 14:39 |
| *** slberger has joined #openstack-keystone | 14:39 | |
| *** su_zhang_ has joined #openstack-keystone | 14:40 | |
| stevemar | dstanek: :) | 14:41 |
| stevemar | rderose: one day you'll have to teach me the secret to creating as many patch sets as you do | 14:41 |
| stevemar | rderose: you must like typing --amend a lot | 14:41 |
| dstanek | rderose: one amend per character changed? | 14:42 |
| *** su_zhang has quit IRC | 14:42 | |
| openstackgerrit | Merged openstack/keystone-specs: prime the ocata release https://review.openstack.org/366270 | 14:46 |
| *** asettle has quit IRC | 14:47 | |
| nicolasbock | stevemar, that's an awesome post! | 14:47 |
| nicolasbock | stevemar, ok, so I got things almost working | 14:47 |
| ayoung | stevemar, it gets more fun. I get different values from pkg_resources.iter_entry_points(group=PLUGIN_NAMESPACE) in the debuggger then when I run it in the python command line | 14:48 |
| nicolasbock | stevemar, what's not working right now is doing anything as an LDAP user | 14:48 |
| stevemar | nicolasbock: ah | 14:48 |
| stevemar | nicolasbock: does an ldap user (via a group or individual assignment) have a role on a project? | 14:48 |
| stevemar | and is using that project to auth? | 14:49 |
| nicolasbock | stevemar, well, now that's a good question | 14:49 |
| nicolasbock | stevemar, I created a project as you advised in your post | 14:49 |
| nicolasbock | stevemar, and exported the OS_PROJECT_DOMAIN_NAME appropriately | 14:50 |
| nicolasbock | stevemar, is it important that LDAP provides group information on a user? | 14:51 |
| nicolasbock | stevemar, we don't have that in our LDAP | 14:51 |
| *** roxanagh_ has joined #openstack-keystone | 14:59 | |
| *** ddieterly is now known as ddieterly[away] | 15:02 | |
| *** asettle has joined #openstack-keystone | 15:02 | |
| *** su_zhang_ has quit IRC | 15:04 | |
| *** su_zhang has joined #openstack-keystone | 15:04 | |
| *** jaosorior has quit IRC | 15:07 | |
| *** ddieterly[away] is now known as ddieterly | 15:07 | |
| *** pcaruana has quit IRC | 15:08 | |
| *** su_zhang has quit IRC | 15:09 | |
| *** wasmum has quit IRC | 15:10 | |
| nicolasbock | stevemar, I got it to work~ | 15:11 |
| nicolasbock | stevemar, the missing piece was the role assignment | 15:12 |
| nicolasbock | stevemar, I had to do that manually. Presumably, groups in LDAP would make that step unnecessary, right? | 15:12 |
| *** asettle has quit IRC | 15:13 | |
| mfisch | does Keystone itself use authtoken middleware? | 15:13 |
| ayoung | mfisch, maybe now it does? | 15:20 |
| ayoung | mfisch, we were headed that way, but not sure the state | 15:20 |
| stevemar | mfisch: it does now, yes | 15:21 |
| stevemar | nicolasbock: not entirely, keystone knows about the ldap groups, but the role you can assign to the group (and on what project) could vary greatly, so it's not something we can assume | 15:21 |
| nicolasbock | stevemar, is there a way then to default assign an LDAP user to a project? | 15:22 |
| nicolasbock | stevemar, or do I have to add each individual one by hand? | 15:22 |
| stevemar | nicolasbock: you can give a group a role assignment and all the users in that group will get that relationship automagically | 15:23 |
| *** javis has quit IRC | 15:23 | |
| nicolasbock | stevemar, but in my situation this would only work if LDAP new about groups, right? | 15:24 |
| stevemar | nicolasbock: righto | 15:24 |
| stevemar | nicolasbock: i assumed you had a setup where all users were part of a group "employees" or something | 15:24 |
| nicolasbock | stevemar, oh, wait, maybe you are right | 15:24 |
| stevemar | i think typically there exists such a group in most ldaps | 15:24 |
| nicolasbock | stevemar, let me check that | 15:24 |
| * nicolasbock wrestles with LDAP... | 15:25 | |
| *** joerch has joined #openstack-keystone | 15:26 | |
| stevemar | nicolasbock: give that ldap a full nelson | 15:26 |
| nicolasbock | nicolasbock, :) at least! | 15:26 |
| breton | mfisch: it partially does | 15:27 |
| *** browne has joined #openstack-keystone | 15:27 | |
| *** admin0 has quit IRC | 15:27 | |
| *** su_zhang has joined #openstack-keystone | 15:29 | |
| samueldmq | lbragstad: jenkins keep passing | 15:32 |
| samueldmq | lbragstad: just left another recheck | 15:32 |
| lbragstad | hmmm | 15:33 |
| lbragstad | i'm still fighting with devstack | 15:33 |
| *** jistr is now known as jistr|biab | 15:35 | |
| rderose | stevemar: haha I know | 15:37 |
| *** javis has joined #openstack-keystone | 15:41 | |
| * lbragstad gives up and drop kicks his current devstack box | 15:48 | |
| *** openstackgerrit has quit IRC | 15:49 | |
| *** openstackgerrit has joined #openstack-keystone | 15:49 | |
| *** tesseract- has quit IRC | 15:49 | |
| -openstackstatus- NOTICE: New setuptools release appears to have a circular import which is breaking many jobs - check for ImportError: cannot import name monkey. | 15:53 | |
| *** ChanServ changes topic to "New setuptools release appears to have a circular import which is breaking many jobs - check for ImportError: cannot import name monkey." | 15:53 | |
| *** esp has joined #openstack-keystone | 15:56 | |
| ayoung | print self.namespace | LOG.debug('found extension %r', ep) | 15:57 |
| ayoung | keystoneclient.auth.plugin | 15:57 |
| lbragstad | huh - yep... i *just* hit that ^ | 16:01 |
| ayoung | stevemar, lookie here http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/auth/base.py#n28 | 16:01 |
| lbragstad | samueldmq i can reproduce locally | 16:01 |
| ayoung | keystoneclient.auth.plugin not | 16:01 |
| stevemar | lbragstad: why u do dis | 16:01 |
| ayoung | keystoneauth1.plugin | 16:01 |
| lbragstad | stevemar do what? | 16:01 |
| stevemar | lbragstad: dropkick stuff | 16:02 |
| lbragstad | stevemar because it fixed the problem :) | 16:02 |
| stevemar | ayoung: for some reason you are loading the keystoneclient plguins :P | 16:02 |
| ayoung | stevemar, that reason is that is waht we still tell keystoneclient to search for | 16:02 |
| ayoung | see my link? | 16:02 |
| *** ddieterly is now known as ddieterly[away] | 16:04 | |
| *** esp has quit IRC | 16:06 | |
| lbragstad | samueldmq ugh... | 16:07 |
| lbragstad | samueldmq so i can recreate, but only when there aren't many revocation events in the revocation table | 16:07 |
| lbragstad | samueldmq if the revocation event table has more than like 500 rows in it, the test will pass.... | 16:08 |
| *** ddieterly[away] is now known as ddieterly | 16:08 | |
| lbragstad | samueldmq so something about how long it takes to get the list of revocation events is playing into this somehow | 16:09 |
| *** chrisshattuck has joined #openstack-keystone | 16:11 | |
| samueldmq | lbragstad: lol | 16:15 |
| samueldmq | lbragstad: what is that then? | 16:15 |
| samueldmq | lbragstad: hmm, yes | 16:15 |
| samueldmq | lbragstad: but the test sleeps for 1 second | 16:15 |
| lbragstad | samueldmq yep | 16:15 |
| samueldmq | lbragstad: and I don't assume it's taking more than a few ms to get the table | 16:15 |
| lbragstad | samueldmq this is blowing my mind... | 16:15 |
| samueldmq | lbragstad: even if it's more than 500 items | 16:15 |
| lbragstad | i don't really understand how this is possible | 16:16 |
| samueldmq | lbragstad: yeah, can you try to reproduce it again? and see if the same pattern applies (500+ items in the revoke table) | 16:18 |
| samueldmq | lbragstad: that doesn't really make sense | 16:18 |
| samueldmq | lbragstad: shoudl be worth it to try to reproduce with other token format too | 16:19 |
| samueldmq | because it doesn't make sense to be a fernet only thing | 16:19 |
| lbragstad | samueldmq the only thing that should be different between the two formats is the subsecond thing | 16:20 |
| samueldmq | lbragstad: yeah but doesn't make sense to me as the test has a sleep in it | 16:20 |
| *** lmiccini has quit IRC | 16:21 | |
| lbragstad | samueldmq right | 16:21 |
| *** spzala has quit IRC | 16:21 | |
| lbragstad | i don't get that either | 16:21 |
| ayoung | stevemar, I think we have been running KSC with the keystoneclient auth plugs, not the keystoneauth plugins | 16:21 |
| *** spzala has joined #openstack-keystone | 16:22 | |
| stevemar | ayoung: ohhh | 16:22 |
| stevemar | you've been using ksc for all this | 16:22 |
| stevemar | yeah | 16:22 |
| *** jistr|biab is now known as jistr | 16:25 | |
| *** sdake has quit IRC | 16:28 | |
| *** su_zhang has quit IRC | 16:29 | |
| *** su_zhang has joined #openstack-keystone | 16:30 | |
| *** su_zhang_ has joined #openstack-keystone | 16:32 | |
| *** chrisshattuck has quit IRC | 16:32 | |
| *** su_zhang has quit IRC | 16:32 | |
| *** raildo has joined #openstack-keystone | 16:35 | |
| *** su_zhang_ has quit IRC | 16:37 | |
| *** su_zhang has joined #openstack-keystone | 16:38 | |
| *** su_zhang has quit IRC | 16:42 | |
| ayoung | stevemar, what is our plan for the plugins inside of keystoneclient? Right now there is a slew of tests that assume they load via entrypoints etc | 16:43 |
| ayoung | if we yank them, we are going to break some people | 16:44 |
| ayoung | and we need to change this, or KSC will not be using KSA plugins | 16:44 |
| *** chrisshattuck has joined #openstack-keystone | 16:44 | |
| *** lmiccini has joined #openstack-keystone | 16:47 | |
| stevemar | ayoung: make them call the ksa ones | 16:48 |
| ayoung | stevemar, so we have at least one missing | 16:48 |
| stevemar | whats that? | 16:48 |
| *** Michaellaneous has joined #openstack-keystone | 16:49 | |
| ayoung | v3unscopedsaml = keystoneclient.contrib.auth.v3.saml2:Saml2UnscopedToken | 16:49 |
| ayoung | no entrypoint for that | 16:49 |
| Michaellaneous | Got an LDAP question. When I used groupOfUniqueNames Openstack could list my groups | 16:49 |
| Michaellaneous | But I swtitched to groupOfNames | 16:49 |
| Michaellaneous | And suddenly none are displayed. | 16:49 |
| Michaellaneous | Any idea why? | 16:49 |
| ayoung | Michaellaneous, try using ldapsearch | 16:50 |
| browne | Michaellaneous: depends on the schema of your ldap server | 16:50 |
| ayoung | when you turn on ldap debugging in the keystone server ,it spits out the ldap filters it uses. Try those ,see what your server give you | 16:50 |
| stevemar | ayoung: yeah, hmm, in keystoneauth jamie set it up to automatically get scope | 16:50 |
| browne | i also use Apache Directory Studio as a nice ldap browser | 16:50 |
| Michaellaneous | how can I turn ldap debugging on? | 16:51 |
| Michaellaneous | Oh debug_level | 16:52 |
| ayoung | stevemar, so if someone is using the old entrypoint, it will get an error if we change it. We could set that entrypoint in KSA to be an existing plugin | 16:53 |
| *** markd_ has quit IRC | 16:53 | |
| *** ChanServ changes topic to "Newton Deadlines: http://releases.openstack.org/newton/schedule.html | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting" | 16:56 | |
| -openstackstatus- NOTICE: setuptools 27.1.2 addresses the circular import | 16:56 | |
| Michaellaneous | doesn't matter, it works | 16:57 |
| Michaellaneous | Had to restart apache2 | 16:57 |
| Michaellaneous | I forgot keystone is not the right server to restart | 16:57 |
| Michaellaneous | Quick question, how can I list members of a group? | 16:57 |
| raildo | Michaellaneous, openstack user list --group <group_id> | 16:59 |
| Michaellaneous | Hm | 16:59 |
| Michaellaneous | I dont get it | 16:59 |
| ayoung | Michaellaneous, v3 api only | 17:00 |
| Michaellaneous | nah | 17:00 |
| Michaellaneous | i mean i cant list users of a group | 17:00 |
| Michaellaneous | but the other way it works | 17:00 |
| ayoung | Michaellaneous, v3 Keystone API for all group options | 17:00 |
| ayoung | otherwise, maybe old KSC? | 17:00 |
| Michaellaneous | nah I think it's an LDAP problem | 17:01 |
| *** rodrigods has quit IRC | 17:03 | |
| *** rodrigods has joined #openstack-keystone | 17:03 | |
| *** tqtran has joined #openstack-keystone | 17:05 | |
| *** markd_ has joined #openstack-keystone | 17:05 | |
| mfisch | I think there's a bug or bad assumption in puppet-keystone | 17:08 |
| mfisch | the bootstrap command is resetting the admin password | 17:09 |
| mfisch | when admin_password != admin_token | 17:09 |
| stevemar | browne: did you end up backporting that memcache fix? | 17:09 |
| mfisch | dang it sorry guys | 17:09 |
| mfisch | wrong room | 17:09 |
| stevemar | mfisch: :] | 17:09 |
| stevemar | mfisch: it's all good, you reminded me about the cache backport | 17:09 |
| browne | stevemar: i started a cherry-pick, https://review.openstack.org/#/c/364593/, but there are issues since it requires dogpile.cache 0.6.2 | 17:10 |
| browne | mitaka upper-contraints is currently at 0.5.8 | 17:10 |
| stevemar | browne: hmm, i thought breton had an idea on how to get around that | 17:11 |
| *** jpena is now known as jpena|off | 17:11 | |
| stevemar | monkeypatching something | 17:11 |
| *** ddieterly is now known as ddieterly[away] | 17:11 | |
| *** Michaellaneous has quit IRC | 17:12 | |
| mfisch | stevemar: can you join #puppet-openstack and weigh in on somethnig | 17:12 |
| stevemar | mfisch: sure | 17:13 |
| *** tonytan4ever has quit IRC | 17:16 | |
| lbragstad | samueldmq so - this is weird | 17:18 |
| lbragstad | here is what i've done to keystone | 17:18 |
| lbragstad | http://cdn.pasteraw.com/dbi002tf7u7qh98u7sqlw5534l7mtpp | 17:18 |
| lbragstad | which is just adding some logging | 17:18 |
| lbragstad | samueldmq make sense? | 17:18 |
| lbragstad | samueldmq here is what i've done to tempest - http://cdn.pasteraw.com/n1dhi34yntpp9ijx5qhymt6bp484ba4 | 17:20 |
| lbragstad | samueldmq here is the tempest failure - which makes sense - http://cdn.pasteraw.com/7pbso5g69l3190sl2jundms8bowvgoj | 17:22 |
| lbragstad | samueldmq but the token isn't even seen by keystone?! http://cdn.pasteraw.com/88daevajb3x6sycudfh1d0qldcn9izx | 17:22 |
| *** su_zhang has joined #openstack-keystone | 17:24 | |
| *** Michaellaneous has joined #openstack-keystone | 17:25 | |
| *** fangxu has joined #openstack-keystone | 17:29 | |
| *** amakarov is now known as amakarov_away | 17:30 | |
| samueldmq | lbragstad: that'd odd | 17:32 |
| samueldmq | lbragstad: where is the keystone log ? should be in /var/log/apache2/ right? | 17:32 |
| dstanek | samueldmq: yep | 17:32 |
| samueldmq | that should at least be logged, we're missing something in there | 17:32 |
| lbragstad | samueldmq yep - /var/log/apache2/keystone.log | 17:32 |
| lbragstad | when the test is successful the token is actually logged by my print statements | 17:33 |
| dstanek | browne: stevemar: yes, if nobody else been able to do it i can work on it this weekend | 17:33 |
| stevemar | dstanek: ha, i was actually just gonna ask you to take a look at https://review.openstack.org/#/c/350815/ the auth plugin loader has you written all over it ;) | 17:34 |
| dstanek | stevemar: sure | 17:34 |
| browne | dstanek: thanks, that would help. you can take over my cherry-pick if you like | 17:34 |
| stevemar | this one should be quicker than the cache beast | 17:34 |
| lbragstad | samueldmq added some more stuff to tempest - http://cdn.pasteraw.com/56iyirdh2hlx2qr0gvwzmd4xh5wsicj | 17:35 |
| samueldmq | lbragstad: in that case there is somethign else wrong | 17:35 |
| samueldmq | lbragstad: as we're not seeing the keystone logs at all | 17:35 |
| lbragstad | samueldmq tempest doesn't look like its sending a request to keystone | 17:35 |
| lbragstad | samueldmq http://cdn.pasteraw.com/a9m6oggyd4g9bb7og31nena4njbuv89 | 17:36 |
| samueldmq | lbragstad: and the test fails after that ^ | 17:36 |
| samueldmq | ? | 17:36 |
| *** tonytan4ever has joined #openstack-keystone | 17:37 | |
| lbragstad | samueldmq thats what tempest is logging when the test fails | 17:37 |
| lbragstad | samueldmq there is no request to /auth/tokens | 17:37 |
| samueldmq | lbragstad: so it either is not logging that call, or isn't calling at all | 17:37 |
| samueldmq | lbragstad: can you try the whole module : ./run_tempest.sh tempest.api.identity.admin.v3.test_users.UsersV3TestJSON | 17:38 |
| *** tonytan_brb has joined #openstack-keystone | 17:38 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 17:39 |
| lbragstad | samueldmq successful run - http://cdn.pasteraw.com/rygxgs90jn5tocbmxp4adb0em9jm9as | 17:40 |
| lbragstad | with logs | 17:40 |
| *** admin0 has joined #openstack-keystone | 17:40 | |
| samueldmq | lbragstad: and this time it called /users/<id>/password | 17:41 |
| lbragstad | logging of a failed run - http://cdn.pasteraw.com/itllpjjfmt1zf3j41gyzz961duiqroc | 17:41 |
| samueldmq | lbragstad: and it called v3/users/ac48b78cda32450ba143011b718dddf6/password | 17:42 |
| *** tonytan4ever has quit IRC | 17:42 | |
| *** pnavarro has joined #openstack-keystone | 17:42 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: POC sql query revoked tokens https://review.openstack.org/359371 | 17:42 |
| *** gyee has joined #openstack-keystone | 17:43 | |
| lbragstad | samueldmq weird... i think it's failing to validate the admin token | 17:44 |
| lbragstad | checkout the captured standard output of http://cdn.pasteraw.com/itllpjjfmt1zf3j41gyzz961duiqroc | 17:44 |
| lbragstad | x auth token = gAAAAABX0vNu6_AXGaXY-FZIGCDd_5o3vEh4xb5HG07HRdjPeSf069HSGrC7DJ_zqdMUxGh_y1yO7waauGxsHQ3cnePvwoPmduKLfnhdw95GjAIo5qYQU3evOznwuIWjPKZmxfdlfpbWUWAwvmVBbcsJGfABKSzIxA | 17:44 |
| lbragstad | the new subject token is = gAAAAABX0vNv1lHx2Y0yLl7SXXHjmar61Gf3pgZiKRmCiQzwwM0smwtE89Rf5D2Mo3xrng2cyVdt96Rfg4SiZOPq8XTo4Z_fHjbN92dNW997MOCXPkpod9Q5j-jYmq1gZVPv2SJf6WhV3msVleEBdPWWnvYCQs8vNw | 17:44 |
| samueldmq | lbragstad: yeah the token looks to be correct | 17:56 |
| samueldmq | lbragstad: the same x-auth is used all the tiem | 17:56 |
| lbragstad | samueldmq yeah | 17:56 |
| lbragstad | new ones with the request times logged | 17:56 |
| samueldmq | lbragstad: even after to delete the test user | 17:56 |
| lbragstad | success - http://cdn.pasteraw.com/tw95q28q009jkd6q3sppd02smkjjkrt | 17:57 |
| * lbragstad failure - http://cdn.pasteraw.com/zivm1vce5h9ce8wdedah35m8uz8mwo | 17:57 | |
| *** pnavarro has quit IRC | 18:00 | |
| *** chrisshattuck has quit IRC | 18:05 | |
| samueldmq | lbragstad: keystone doesn't stdout anything when it fails | 18:05 |
| lbragstad | samueldmq right - it's like it doesn't even see token | 18:06 |
| samueldmq | lbragstad: or does it ? | 18:06 |
| lbragstad | samueldmq this is what i've added to keystone | 18:06 |
| lbragstad | http://cdn.pasteraw.com/dbi002tf7u7qh98u7sqlw5534l7mtpp | 18:06 |
| lbragstad | samueldmq when the test is successful - I can see the token in keystone's logs | 18:06 |
| lbragstad | which means keystone is getting it and actually validating it properly - meaning it compares it and it is revoked | 18:07 |
| samueldmq | lbragstad: but when it fails you can't even see the "checking ,, at " | 18:07 |
| lbragstad | right | 18:07 |
| lbragstad | for example | 18:07 |
| lbragstad | in this failure | 18:07 |
| lbragstad | http://cdn.pasteraw.com/zivm1vce5h9ce8wdedah35m8uz8mwo | 18:07 |
| lbragstad | gAAAAABX0vdIJ4ND-r2WDnQtHc9EZodeYn12B6ecABg-EPQKvfUd82vFEPPIJzZdkpGu41lYAZrmKbPm9X7qyZbhyx3qvAa2P5YgKnb4R7wTNjD-DKLMt0ZT3wALZRtDJ_KVHxDuAogPg_4Oyg3DpymF5GS5XQ5J9w should be revoked | 18:07 |
| lbragstad | samueldmq agree? | 18:07 |
| samueldmq | lbragstad: why? | 18:08 |
| lbragstad | samueldmq oh wait - it should be valid | 18:08 |
| lbragstad | since it was obtained after the password was changed | 18:08 |
| lbragstad | right? | 18:08 |
| samueldmq | yes | 18:09 |
| samueldmq | the issue is that it's getting 404 when it shouldn't | 18:09 |
| lbragstad | ++ | 18:09 |
| lbragstad | yep | 18:09 |
| lbragstad | but - if i check keystone for that token | 18:09 |
| lbragstad | or the logs - it doesn't even see if | 18:10 |
| lbragstad | grep -R "4Oyg3DpymF5GS5XQ5J9w" /var/log/apache2/keystone.log | 18:10 |
| lbragstad | doesn't return anything | 18:10 |
| lbragstad | but - let's look at a successful run | 18:10 |
| lbragstad | samueldmq for example - http://cdn.pasteraw.com/tw95q28q009jkd6q3sppd02smkjjkrt | 18:11 |
| lbragstad | samueldmq gAAAAABX0vc6WLGDxQ0uNL2DvnGKHWgCuJU10wlMNtwgwbHcyjCc7HJ9MxF2Hemmpz_PVQZnrTibyBdzfB9uX4ZB2lMCNGdQ-D0qnqGYAmc12FXn3brhoLjj-1iWfaVbXgRQGHpQcpZe1gq1vLGbPg018gGt8K8_1w is the token to be validated after the password change | 18:11 |
| lbragstad | samueldmq and this is what keystone sees - http://cdn.pasteraw.com/1b8e08oiabbejrw7cwdyo8dt604ut2y | 18:12 |
| lbragstad | samueldmq strange - right? | 18:15 |
| lbragstad | samueldmq it's like the failure cases the token isn't even reaching the token_provider api | 18:16 |
| samueldmq | but it's reaching keystone | 18:16 |
| samueldmq | right ? | 18:16 |
| lbragstad | samueldmq in the failure cases? | 18:16 |
| lbragstad | where we get a 404? | 18:16 |
| samueldmq | lbragstad: the token is considered invalid | 18:18 |
| samueldmq | lbragstad: so keystone returns 404 | 18:18 |
| lbragstad | samueldmq i'd believe that if it was actually being validated | 18:18 |
| samueldmq | lbragstad: that what the test sees, I am tring to see if keystone receives the request in the case of a failure | 18:18 |
| lbragstad | samueldmq it's not even entering the validation methods | 18:18 |
| samueldmq | lbragstad: entering validate_v3_token | 18:19 |
| samueldmq | lbragstad: leaving validate_v3_token | 18:19 |
| lbragstad | samueldmq yes - but that's when the test passes | 18:19 |
| *** admin0 has quit IRC | 18:19 | |
| lbragstad | samueldmq when the test fails with a 404 (expecting a 200) those statements don't even exist in the logs | 18:20 |
| samueldmq | lbragstad: and the token in the subject-token | 18:20 |
| samueldmq | lbragstad: doesn't show up in the logs | 18:21 |
| samueldmq | ? | 18:21 |
| lbragstad | samueldmq right | 18:21 |
| lbragstad | samueldmq in here http://cdn.pasteraw.com/zivm1vce5h9ce8wdedah35m8uz8mwo we should be validating gAAAAABX0vdIJ4ND-r2WDnQtHc9EZodeYn12B6ecABg-EPQKvfUd82vFEPPIJzZdkpGu41lYAZrmKbPm9X7qyZbhyx3qvAa2P5YgKnb4R7wTNjD-DKLMt0ZT3wALZRtDJ_KVHxDuAogPg_4Oyg3DpymF5GS5XQ5J9w | 18:22 |
| lbragstad | but we don't | 18:22 |
| lbragstad | that token *never* enters validate_v3_token() | 18:22 |
| samueldmq | lbragstad: can you put a print in the router entry ? and controller? | 18:22 |
| samueldmq | lbragstad: just to make sure the request never hits keysotne | 18:23 |
| lbragstad | samueldmq where is the first entry point in keystone? | 18:23 |
| samueldmq | lbragstad: perhaps https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L132 | 18:24 |
| samueldmq | lbragstad: https://github.com/openstack/keystone/blob/master/keystone/common/wsgi.py#L203 | 18:26 |
| samueldmq | lbragstad: I think that __call__ is also called | 18:27 |
| samueldmq | for any request | 18:27 |
| lbragstad | samueldmq ah - yeah | 18:27 |
| *** su_zhang has quit IRC | 18:28 | |
| samueldmq | lbragstad: if that never hits keystone, it will be an error with the test | 18:28 |
| lbragstad | samueldmq success - http://cdn.pasteraw.com/ee7uu16gyrl3cnugs2aavxoag85mbm9 | 18:29 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/368107 | 18:29 |
| lbragstad | samueldmq failure - http://cdn.pasteraw.com/7iiz1xrf5xaykulfmrr0xhe7vzsd8ce | 18:29 |
| *** slberger has quit IRC | 18:30 | |
| *** slberger1 has joined #openstack-keystone | 18:30 | |
| samueldmq | lbragstad: and what keystone logs say | 18:30 |
| samueldmq | ? | 18:30 |
| lbragstad | samueldmq http://cdn.pasteraw.com/d2q3t3yvwyds8yht0rx7ss9hgdcw7g0 | 18:31 |
| *** su_zhang has joined #openstack-keystone | 18:31 | |
| lbragstad | samueldmq ah - rerunning | 18:31 |
| *** chrisshattuck has joined #openstack-keystone | 18:35 | |
| *** jed56 has quit IRC | 18:35 | |
| breton | stevemar: browne: i will heavily work on that next week. Sorry, this week i had to work on other things. | 18:35 |
| *** BjoernT has quit IRC | 18:36 | |
| browne | breton: np thanks! | 18:36 |
| lbragstad | samueldmq weird | 18:37 |
| lbragstad | samueldmq here another one - http://cdn.pasteraw.com/av5nm5wa9jn2evtmfmzlg7c6votrktc | 18:37 |
| lbragstad | ^ that's a failure | 18:37 |
| lbragstad | and it is logged in keystone.log http://cdn.pasteraw.com/px4jrfjxdxrheo8z8zlvwjzbozj4tqx | 18:38 |
| lbragstad | but it never makes it to the validate methods... | 18:38 |
| samueldmq | oh wow | 18:38 |
| samueldmq | that's odd! | 18:38 |
| lbragstad | so - i guess it's time to trace what happens between keystone.common.wsgi and keystone.auth.controller | 18:39 |
| samueldmq | lbragstad: ++ | 18:39 |
| samueldmq | lbragstad: narrow it down | 18:39 |
| samueldmq | lbragstad: and see where it disappears | 18:39 |
| samueldmq | lbragstad: and we will be able to find out what's going on | 18:39 |
| *** Guest_95843 has joined #openstack-keystone | 18:40 | |
| lbragstad | samueldmq fyi - method: <bound method Auth.validate_token of <keystone.auth.controllers.Auth object at 0x7fde8bc47990>> | 18:42 |
| lbragstad | so it is getting routed properly - but it never makes it there | 18:42 |
| *** Guest_95843 has left #openstack-keystone | 18:43 | |
| samueldmq | lbragstad: odd and why hapens only for passwd reset? | 18:43 |
| lbragstad | samueldmq apparently | 18:45 |
| lbragstad | samueldmq that i know of so far | 18:45 |
| samueldmq | what does it say before and after callind method(kwargs...) there in the app code | 18:47 |
| samueldmq | ? | 18:47 |
| lbragstad | I bet it's in the controller.protected() code | 18:48 |
| samueldmq | lbragstad: hmm so you might be right | 18:49 |
| samueldmq | lbragstad: the x-auth-token is the one invalid | 18:49 |
| lbragstad | right | 18:49 |
| samueldmq | lbragstad: ++ | 18:49 |
| lbragstad | that's the only thing in between keystone.common.wsgi and keystone.auth.controller | 18:50 |
| *** Michaellaneous has quit IRC | 18:50 | |
| *** chrisshattuck has quit IRC | 18:51 | |
| samueldmq | lbragstad: ++ | 18:52 |
| samueldmq | it's pertty likely to be that | 18:52 |
| lbragstad | samueldmq fresh failure with more logging - test output http://cdn.pasteraw.com/hu9w43qb639x54fjh6zlew95f50j1wu and lgos http://cdn.pasteraw.com/dys687r4ymvnhv774j9ik481w25a2ht | 18:52 |
| openstackgerrit | Merged openstack/keystone: Use freezegun for change password tests https://review.openstack.org/367017 | 18:54 |
| *** su_zhang has quit IRC | 18:56 | |
| *** ddieterly[away] is now known as ddieterly | 18:57 | |
| *** gagehugo has joined #openstack-keystone | 18:58 | |
| *** chrisshattuck has joined #openstack-keystone | 18:58 | |
| *** admin0 has joined #openstack-keystone | 18:59 | |
| ayoung | stevemar, bknudson this is probably a jamielennox question, but, why does the KSC Password plugin have a class level get_options but the KSA one des not? DIe we change a pattern? THis is one thing breaking the tests moving KSC to use the KSA plugins | 19:00 |
| *** chrissha_ has joined #openstack-keystone | 19:02 | |
| samueldmq | lbragstad: if the x-auth-token is invalid, it should return 401 I think, not 404 | 19:02 |
| samueldmq | lbragstad: can you dig in the protected wrapper? | 19:02 |
| *** chrisshattuck has quit IRC | 19:03 | |
| *** chrisshattuck has joined #openstack-keystone | 19:04 | |
| *** chrissha_ has quit IRC | 19:04 | |
| stevemar | breton: it's all good :] | 19:07 |
| lbragstad | samueldmq for some reason the admin user that changes the password has a revocation event | 19:10 |
| lbragstad | that matches when it goes to validate the user's new token | 19:10 |
| nicolasbock | OMG, LDAP is a tough one... | 19:14 |
| nicolasbock | I can't get groups to map to LDAP | 19:14 |
| samueldmq | lbragstad: kk, gotta figure out why | 19:14 |
| nicolasbock | 'openstack group list --domain ldap' is not returning anything | 19:14 |
| nicolasbock | and I can't see anything obviously wrong in the logs | 19:15 |
| lbragstad | samueldmq adding more debugging | 19:15 |
| nicolasbock | the base DN and the filter string look good (as far as I can tell) | 19:15 |
| nicolasbock | and when I run 'ldapsearch' manually I get a whole list of records | 19:15 |
| nicolasbock | Anyone any suggestions how I could debug this? | 19:16 |
| samueldmq | lbragstad: nice | 19:16 |
| *** spzala has quit IRC | 19:17 | |
| *** lmiccini has quit IRC | 19:22 | |
| samueldmq | lbragstad: it'd be nice if stored the origin of a revocation | 19:22 |
| lbragstad | yeah | 19:23 |
| *** ddieterly is now known as ddieterly[away] | 19:24 | |
| *** lamt has joined #openstack-keystone | 19:26 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Use KeystoneAuth1 Plugins https://review.openstack.org/368190 | 19:27 |
| *** chrissha_ has joined #openstack-keystone | 19:27 | |
| *** chrisshattuck has quit IRC | 19:29 | |
| *** ddieterly[away] is now known as ddieterly | 19:29 | |
| *** roxanagh_ has quit IRC | 19:31 | |
| *** sdake has joined #openstack-keystone | 19:38 | |
| stevemar | nicolasbock: you can enable debug logging in keystone and see what keystone is actually running when you do the command | 19:41 |
| nicolasbock | I did | 19:41 |
| stevemar | it'll spit out some ldapsearch | 19:41 |
| nicolasbock | stevemar, and using that ldapsearch I get lots of items from ldap | 19:42 |
| nicolasbock | I tried to trace back where things go wrong | 19:42 |
| *** sdake has quit IRC | 19:42 | |
| nicolasbock | but at some point I can't find where a `search_s` call goes | 19:42 |
| *** BjoernT has joined #openstack-keystone | 19:43 | |
| *** admin0 has quit IRC | 19:43 | |
| stevemar | =\ | 19:43 |
| nicolasbock | stevemar, looking at the code, I don't understand why the call is not returning. | 19:44 |
| *** sdake has joined #openstack-keystone | 19:44 | |
| nicolasbock | stevemar, I am using my old school debugging tricks and peppered the code with LOG.debug() calls :) | 19:44 |
| nicolasbock | stevemar, but for some reason I can't trace where the call is going. | 19:45 |
| nicolasbock | stevemar, last known position: /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:774 | 19:45 |
| nicolasbock | stevemar, then, next line: LDAP unbind unbind_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:913 | 19:45 |
| nicolasbock | Very odd | 19:45 |
| nicolasbock | LDAP search: base=ou=accounts,cn=suse,cn=de scope=2 filterstr=(&(objectClass=account)(gidNumber=*)) attrs=['', 'gidNumber', 'ou'] attrsonly=0 search_s /usr/lib/python2.7/site-packages/keystone/common/ldap/core.py:940 | 19:46 |
| nicolasbock | is the search it's performing | 19:46 |
| nicolasbock | ldapsearch -x -b ou=accounts,dc=suse,dc=de -h ldap.suse.de "(objectClass=account)" | 19:47 |
| nicolasbock | returns a ton of stuff | 19:47 |
| nicolasbock | :( | 19:48 |
| *** admin0 has joined #openstack-keystone | 19:48 | |
| *** jaugustine_ has joined #openstack-keystone | 19:50 | |
| *** chrissha_ has quit IRC | 19:50 | |
| *** jaugustine has quit IRC | 19:50 | |
| *** jaugustine_ is now known as jaugustine | 19:50 | |
| *** jaugustine_ has joined #openstack-keystone | 19:52 | |
| *** chrisshattuck has joined #openstack-keystone | 19:54 | |
| *** fangxu has quit IRC | 19:54 | |
| *** ddieterly is now known as ddieterly[away] | 19:54 | |
| *** chrisshattuck has quit IRC | 19:57 | |
| *** chrisshattuck has joined #openstack-keystone | 19:58 | |
| *** slberger1 has quit IRC | 20:00 | |
| *** chrisshattuck has quit IRC | 20:00 | |
| *** chrisshattuck has joined #openstack-keystone | 20:01 | |
| *** gyee has quit IRC | 20:02 | |
| lbragstad | samueldmq i think i figured it out... | 20:03 |
| *** slberger has joined #openstack-keystone | 20:06 | |
| *** michauds has quit IRC | 20:08 | |
| *** chrisshattuck has quit IRC | 20:08 | |
| lbragstad | samueldmq for some reason mysql is rounding up when storing the revocation event here - http://cdn.pasteraw.com/k75ivklu77ffz8eh2yqjpkb8a4b51iq | 20:10 |
| *** chrisshattuck has joined #openstack-keystone | 20:12 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: doctor check for domain specific configs https://review.openstack.org/361435 | 20:12 |
| *** jlopezgu has joined #openstack-keystone | 20:16 | |
| jlopezgu | hi o/ | 20:16 |
| jlopezgu | excuse me one question, when is the keystone.conf file created? | 20:17 |
| jlopezgu | that is created by the security_compliance.py, right? | 20:17 |
| stevemar | jlopezgu: nope | 20:17 |
| dstanek | jlopezgu: most likely at installation by whatever you use to install | 20:17 |
| dstanek | jlopezgu: i don't even know what that is :-) | 20:17 |
| samueldmq | lbragstad: looking | 20:17 |
| stevemar | jlopezgu: you can auto create the .conf file yourself using $ tox -e genconfig (you have to pull down the source) | 20:18 |
| *** tonytan_brb has quit IRC | 20:18 | |
| *** ddieterly[away] is now known as ddieterly | 20:18 | |
| stevemar | jlopezgu: orrrr more likely, whatever package you installed, created it for you | 20:18 |
| dstanek | stevemar: ++ | 20:18 |
| dstanek | jlopezgu: how did you install keystone? | 20:18 |
| stevemar | nicolasbock: i'm actually wrapping up for the week, i can help you out on monday again with ldap | 20:19 |
| jlopezgu | dstanek: in devstack and ./stack.sh | 20:19 |
| stevemar | theres been a bunch of ldap quetions these days | 20:19 |
| nicolasbock | stevemar, no problem, you already helped me out a lot today! | 20:19 |
| nicolasbock | stevemar, have a nice weekend! | 20:19 |
| stevemar | nicolasbock: you too! | 20:19 |
| samueldmq | lbragstad: what's going on there? | 20:19 |
| lbragstad | samueldmq i'm pretty sure it's a rounding issue | 20:20 |
| jlopezgu | dstanek: I'm working in an horizon's feature. I updated my code and I got updated a feature that I need for the feature but the keystone.conf was not updated | 20:20 |
| lbragstad | samueldmq when the password is changed we store this | 20:21 |
| lbragstad | persisting revocation event: {'revoked_at': '2016-09-09T19:54:49.664802Z', 'user_id': u'6878562382b6411baafd9c67c5879da6', 'issued_before': '2016-09-09T19:54:49.664802Z'} | 20:21 |
| samueldmq | Yes | 20:21 |
| dstanek | jlopezgu: i believe this is where the magic happens in devstack http://git.openstack.org/cgit/openstack-dev/devstack/tree/lib/keystone#n199 | 20:21 |
| lbragstad | samueldmq this is the event when we go to pull it out event: {'revoked_at': '2016-09-09T19:54:50.000000Z', 'user_id': u'6878562382b6411baafd9c67c5879da6', 'issued_before': '2016-09-09T19:54:50.000000Z'} | 20:21 |
| lbragstad | s/out/out:/ | 20:22 |
| samueldmq | lbragstad: aah it's rounding rather than truncating | 20:22 |
| lbragstad | samueldmq yep | 20:22 |
| stevemar | jlopezgu: we just pushed a patch to update keystone.conf | 20:22 |
| samueldmq | lbragstad: só even the sleep isnt enough | 20:22 |
| samueldmq | Needed 2 seconds | 20:22 |
| lbragstad | samueldmq right | 20:22 |
| stevemar | jlopezgu: https://github.com/openstack/keystone/commit/dd6f187e7f3fb9281ba9bf13e88335001286b393 | 20:23 |
| lbragstad | samueldmq or - we get rid of datetime completely | 20:23 |
| lbragstad | and give sql a float to store | 20:23 |
| stevemar | jlopezgu: it merged 21 hours ago | 20:23 |
| lbragstad | that is exactly precise to what we need | 20:23 |
| samueldmq | lbragstad: agreed | 20:23 |
| lbragstad | samueldmq this is the comparison | 20:23 |
| lbragstad | 93828 event: {'revoked_at': '2016-09-09T19:54:50.000000Z', 'user_id': u'6878562382b6411baafd9c67c5879da6', 'issued_before': '2016-09-09T19:54:50.000000Z'} | 20:23 |
| lbragstad | 93829 token_values: {'access_token_id': None, 'project_id': None, 'user_id': u'f0e706e9d8c74974bfdc802fc9edf0b0', 'roles': [u'd7ee7e440f7d4761b487940642b2391b'], 'audit_id': u'DUR8QCTRRqiiw0JWr1_FxA', 'trustee_id': None, 'trustor_id': None, 'expires_at': datetime.dateti me(2016, 9, 9, 20, 54, 49), 'consumer_id': None, 'assignment_domain_id': u'default', 'issued_at': datetime.datetime(2016, 9, 9, 19, 54, 49), 'identity_domain_id': | 20:23 |
| lbragstad | u'default', 'audit_chain_id': u'DUR8QCTRRqiiw0JWr1_FxA', 'trust_id': None} | 20:23 |
| lbragstad | sorry for the spam | 20:23 |
| lbragstad | so the revocation logic is doing exactly what it should be doing | 20:24 |
| samueldmq | lbragstad: well debugged sir | 20:24 |
| lbragstad | samueldmq completely frustrating... ;) | 20:24 |
| *** fangxu has joined #openstack-keystone | 20:24 | |
| samueldmq | lbragstad: so at the end the token validation was calling everything properly | 20:25 |
| jlopezgu | dstanek, stevemar: Thank you very much! :) | 20:25 |
| lbragstad | samueldmq yeah - not sure how i missed that before | 20:25 |
| samueldmq | It was just the Event's timestamp | 20:25 |
| lbragstad | samueldmq i believe so | 20:25 |
| samueldmq | Anyways you figured it out | 20:25 |
| lbragstad | at least according to the last few rounds of recreating it | 20:25 |
| dstanek | jlopezgu: yw | 20:26 |
| *** ddieterly is now known as ddieterly[away] | 20:29 | |
| *** ddieterly[away] is now known as ddieterly | 20:31 | |
| *** javis has quit IRC | 20:31 | |
| *** ddieterly has quit IRC | 20:31 | |
| *** roxanagh_ has joined #openstack-keystone | 20:35 | |
| samueldmq | lbragstad: add a 2 second sleep to tempest | 20:38 |
| samueldmq | lbragstad: and you will see you won't be able to reproduce it anymore | 20:39 |
| lbragstad | samueldmq stevemar dolphm dstanek https://bugs.launchpad.net/keystone/+bug/1622010 | 20:39 |
| openstack | Launchpad bug 1622010 in OpenStack Identity (keystone) "MySQL rounds timestamps" [Undecided,New] | 20:39 |
| *** lmiccini has joined #openstack-keystone | 20:39 | |
| bknudson | lbragstad: did you see this? https://julien.danjou.info/blog/2016/python-sqlalchemy-from-decimal-to-timestamp | 20:39 |
| dolphm | lbragstad: what version of mysql? | 20:41 |
| *** gyee has joined #openstack-keystone | 20:41 | |
| *** su_zhang has joined #openstack-keystone | 20:41 | |
| lbragstad | dolphm Server version: 5.7.13-0ubuntu0.16.04.2 (Ubuntu) | 20:41 |
| lbragstad | bknudson that looks familiar | 20:42 |
| lbragstad | updated the bug report | 20:42 |
| samueldmq | lbragstad: "This naturally works against the Fernet implementation because the Fernet implementation will *always* truncate it's issued_at time." | 20:42 |
| samueldmq | lbragstad: not sure I got that right | 20:42 |
| *** javis has joined #openstack-keystone | 20:43 | |
| lbragstad | samueldmq | 20:43 |
| lbragstad | samueldmq https://github.com/pyca/cryptography/blob/master/src/cryptography/fernet.py#L49 | 20:43 |
| samueldmq | lbragstad: you're testing against fernet | 20:43 |
| samueldmq | lbragstad: and it's failing | 20:43 |
| samueldmq | ? | 20:43 |
| lbragstad | samueldmq yep | 20:43 |
| samueldmq | lbragstad: so why "This naturally works against the Fernet implementation " | 20:43 |
| samueldmq | shouldn't be the opposite | 20:43 |
| stevemar | bknudson: increasing your twitter game | 20:44 |
| bknudson | stevemar: it's a useful source of openstack info | 20:44 |
| stevemar | bknudson: it sure is | 20:44 |
| stevemar | bknudson: did you read that py3.6 has dicts ordered by default | 20:44 |
| bknudson | I should "re-tweet" that one because it's useful | 20:45 |
| lbragstad | samueldmq because if we generate a token at 2016-09-09T19:54:49.664802Z it's issued at time will always be 2016-09-09T19:54:49.000000Z | 20:45 |
| bknudson | stevemar: ordered by what? | 20:45 |
| lbragstad | samueldmq if we store a revocation event at 2016-09-09T19:54:49.664802Z it will be rounded to 2016-09-09T19:54:50.000000Z in some versions of sql | 20:46 |
| lbragstad | samueldmq so for example | 20:46 |
| lbragstad | if we change our password at 2016-09-09T19:54:49.664802Z and get a token at 2016-09-09T19:54:49.674802Z it will fail | 20:46 |
| stevemar | bknudson: sorted* | 20:46 |
| stevemar | i assume alphabetically | 20:46 |
| lbragstad | even though it considered a valid situation | 20:46 |
| lbragstad | samueldmq does that make sense? | 20:47 |
| *** javis has quit IRC | 20:49 | |
| stevemar | bknudson: https://twitter.com/VictorStinner/status/774023234874281984 | 20:50 |
| *** tonytan4ever has joined #openstack-keystone | 20:50 | |
| bknudson | insertion order. weird. | 20:50 |
| *** raildo has quit IRC | 20:53 | |
| mtreinish | stevemar: ooh, now I don't have to use OrderedDict. Well if I ever write any py3.6 only code | 20:53 |
| *** openstackstatus has quit IRC | 20:57 | |
| stevemar | mtreinish: we'll eventually drop py2.x in a decade or so | 20:58 |
| bknudson | aren't we (keystone) waiting on memcache? | 20:59 |
| *** openstackstatus has joined #openstack-keystone | 20:59 | |
| *** ChanServ sets mode: +v openstackstatus | 20:59 | |
| *** jaugustine has quit IRC | 20:59 | |
| *** pauloewerton has quit IRC | 20:59 | |
| stevemar | bknudson: don't draw back the curtain! | 20:59 |
| *** gagehugo has quit IRC | 21:00 | |
| *** javis has joined #openstack-keystone | 21:00 | |
| lbragstad | samueldmq actually - you know how it happens? | 21:00 |
| lbragstad | samueldmq let's say we change the password at 2016-09-09T19:54:49.500001Z and it gets rounded to 2016-09-09T19:54:50.000000Z | 21:01 |
| lbragstad | we wait one second in tempest | 21:01 |
| mtreinish | stevemar: heh, sure. But how long until we won't have to support running on 3.5 anymore | 21:01 |
| lbragstad | so at 2016-09-09T19:54:50.500001Z we go to get a new token | 21:01 |
| lbragstad | and it's issued at time is 2016-09-09T19:54:50.000000Z (because it's truncated)... so it's a weird problem comprised of truncation and rounding issues | 21:02 |
| *** slberger has quit IRC | 21:08 | |
| *** gyee has quit IRC | 21:12 | |
| *** haplo37__ has joined #openstack-keystone | 21:12 | |
| *** su_zhang has quit IRC | 21:13 | |
| *** slberger has joined #openstack-keystone | 21:13 | |
| ayoung | stevemar, pretty sure that the OSC/KSA contract is not being met yet | 21:13 |
| *** gyee has joined #openstack-keystone | 21:15 | |
| lbragstad | samueldmq dolphm one way i think we can fix https://bugs.launchpad.net/keystone/+bug/1622010 is by rounding down the datetime before we store it in mysql | 21:16 |
| openstack | Launchpad bug 1622010 in OpenStack Identity (keystone) "MySQL rounds timestamps" [Undecided,New] | 21:16 |
| lbragstad | but what would also require us to round down the issued_at times of uuid tokens | 21:16 |
| lbragstad | thoughts? | 21:16 |
| lbragstad | or other alternatives? | 21:16 |
| samueldmq | lbragstad: ++ | 21:18 |
| samueldmq | lbragstad: I think taht works well | 21:18 |
| samueldmq | lbragstad: hmm.. the complete solution would be to store precision in a separate field | 21:18 |
| samueldmq | while we implement that | 21:18 |
| samueldmq | I think w ecould increase the sleep by 1 second | 21:18 |
| *** ddieterly has joined #openstack-keystone | 21:21 | |
| *** fangxu has quit IRC | 21:21 | |
| *** fangxu has joined #openstack-keystone | 21:22 | |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: use KSA plugins to fulfill entrypoints https://review.openstack.org/368234 | 21:23 |
| stevemar | ayoung: gorram reavers | 21:24 |
| stevemar | ayoung: i'm hoping you are wrong | 21:24 |
| ayoung | stevemar, TA MA DA! | 21:25 |
| stevemar | lbragstad: can you determine if that bug is rc potential ? | 21:25 |
| *** lamt has quit IRC | 21:25 | |
| *** admin0 has quit IRC | 21:28 | |
| lbragstad | stevemar well - it only happens with fernet | 21:28 |
| lbragstad | i think... | 21:29 |
| *** ddieterly has quit IRC | 21:29 | |
| samueldmq | lbragstad: why wouldn't it happen with other formats ? | 21:29 |
| lbragstad | testing it now | 21:30 |
| samueldmq | lbragstad: ah because the others have subsecond precision ? | 21:30 |
| lbragstad | right | 21:30 |
| samueldmq | lbragstad: += | 21:30 |
| samueldmq | ++ | 21:30 |
| lbragstad | yeah - it wouldn't happen with uuid | 21:30 |
| samueldmq | stevemar: I classified as high priority | 21:30 |
| samueldmq | lbragstad: so for fernet drop the subsecond precision too | 21:32 |
| openstackgerrit | ayoung proposed openstack/python-keystoneclient: Update to working python version https://review.openstack.org/368236 | 21:32 |
| *** haplo37__ has quit IRC | 21:32 | |
| samueldmq | lbragstad: when storing revocation events | 21:32 |
| samueldmq | lbragstad: when storing a revocaiton event and the token format is fernet, take the floor of the timestamp (rounding down) ? | 21:32 |
| samueldmq | lbragstad: should be a quick fix | 21:33 |
| lbragstad | well - we have to round down the revocation events issued_before and revoked_at | 21:33 |
| lbragstad | and we have to do the same with uuid's issued_at | 21:33 |
| lbragstad | then we have to make sure we patch tempest with time.sleep(1) like we had to with fernet | 21:34 |
| lbragstad | :/ | 21:34 |
| samueldmq | lbragstad: why ? if we make the revoke timestamp to be rounded down, I think that's all? | 21:34 |
| lbragstad | nope | 21:34 |
| samueldmq | 2016-09-09T19:54:49.500001Z gets rounded to 2016-09-09T19:54:50.000000Z | 21:35 |
| lbragstad | because if we get a uuid token at 2016-09-09T19:54:49.500001Z then change passwords at 2016-09-09T19:54:49.550001Z | 21:35 |
| samueldmq | 2016-09-09T19:54:49.500001Z would get rounded to 2016-09-09T19:54:49.000000Z | 21:35 |
| lbragstad | then that tokne is now valid again | 21:35 |
| lbragstad | when it shouldn't me | 21:36 |
| lbragstad | be* | 21:36 |
| samueldmq | lbragstad: we would only round down the revoke timestamp *if* the token format is fernet | 21:36 |
| samueldmq | lbragstad: for others we just leave as it is, because there is no bug for them | 21:36 |
| lbragstad | hmm | 21:36 |
| lbragstad | i feel like we should make it consistent regardless of the configuration | 21:37 |
| samueldmq | lbragstad: but different configurations offer a different level of precision already | 21:38 |
| samueldmq | so it's not consistent from there | 21:38 |
| lbragstad | samueldmq i'm wonder if we should fix that entire problem | 21:38 |
| *** wasmum has joined #openstack-keystone | 21:39 | |
| lbragstad | wondering* | 21:39 |
| stevemar | ayoung: opening all the bugs! | 21:39 |
| samueldmq | lbragstad: the ideal solution is to store in a separate field | 21:39 |
| samueldmq | lbragstad: because for uuid, if the revoke event gets rounded up | 21:39 |
| samueldmq | lbragstad: a token issued right after (some ms) will be invalid | 21:39 |
| samueldmq | lbragstad: agree? | 21:39 |
| lbragstad | samueldmq true - but i think we get around that with the waits in tempest now/ | 21:40 |
| samueldmq | lbragstad: yeah, but it's still wrong, even if tempest passes | 21:40 |
| samueldmq | lbragstad: imo the best solution woud be to store precision in a separate field | 21:40 |
| lbragstad | yeah - or a migration and a patch to keystone that would always handle precision outside for the data later | 21:41 |
| lbragstad | layer* | 21:41 |
| lbragstad | like storing everything as a long int 1473457302.083927 | 21:41 |
| samueldmq | lbragstad: how ? if teh timestamps are retrieved rounded already | 21:42 |
| samueldmq | from the backend | 21:42 |
| lbragstad | samueldmq we can override our slqalchemy type to handle that for use | 21:42 |
| lbragstad | us* | 21:42 |
| lbragstad | and make a SafeDateTime object | 21:42 |
| samueldmq | lbragstad: can we tell it to just NOT round anything ? | 21:43 |
| lbragstad | samueldmq i don't think we can do that if we use datetime in sql | 21:43 |
| lbragstad | because we've seen it operate differently across different versions | 21:43 |
| samueldmq | lbragstad: ok so you wanted to have a plain long int | 21:43 |
| samueldmq | lbragstad: and restore that as a datetime in python | 21:43 |
| lbragstad | yep | 21:43 |
| lbragstad | we would have complete control | 21:44 |
| samueldmq | after retrieving the number from backend | 21:44 |
| lbragstad | muahahaha | 21:44 |
| samueldmq | lbragstad: that works too | 21:44 |
| samueldmq | lbragstad: hehe | 21:44 |
| lbragstad | yes - that would be one solution | 21:44 |
| samueldmq | lbragstad: so we have 2 | 21:44 |
| lbragstad | then we wouldn't have to care what the backend does, so long as it supports a long int | 21:44 |
| *** rakhmerov has quit IRC | 21:44 | |
| samueldmq | if it doesn't support | 21:45 |
| samueldmq | please drop that backend and write to a file | 21:45 |
| samueldmq | :-) | 21:45 |
| lbragstad | samueldmq i contemplated doing this awhile ago - https://review.openstack.org/#/c/315735/ | 21:45 |
| samueldmq | lbragstad: hmm might want to restore that and update | 21:45 |
| samueldmq | :) | 21:46 |
| *** rakhmerov has joined #openstack-keystone | 21:47 | |
| *** spedione|AWAY is now known as spedione | 21:47 | |
| *** spedione is now known as spedione|AWAY | 21:48 | |
| lbragstad | samueldmq yep | 21:48 |
| *** fangxu has quit IRC | 22:00 | |
| *** chrisshattuck has quit IRC | 22:05 | |
| *** tonytan_brb has joined #openstack-keystone | 22:06 | |
| *** tonytan4ever has quit IRC | 22:07 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Consistently round down timestamps https://review.openstack.org/368244 | 22:13 |
| lbragstad | samueldmq ^ | 22:13 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: WIP: Switch fernet to be the default token provider. https://review.openstack.org/345688 | 22:13 |
| lbragstad | samueldmq running everything locally and all tempest.api.identity tests seem to pass | 22:16 |
| samueldmq | lbragstad: hmmm all that quick? | 22:17 |
| samueldmq | lbragstad: I will review it now then | 22:17 |
| lbragstad | we'll see | 22:17 |
| samueldmq | lbragstad: with https://review.openstack.org/#/c/315735/ ? | 22:17 |
| lbragstad | samueldmq nope | 22:17 |
| lbragstad | samueldmq this one https://review.openstack.org/#/c/368244/ | 22:17 |
| *** slberger has left #openstack-keystone | 22:18 | |
| samueldmq | lbragstad: yeah but that removes subsecond precision for every token format | 22:18 |
| lbragstad | all that does it round everything down before passing it to which ever backend is being used | 22:18 |
| lbragstad | samueldmq it does | 22:19 |
| samueldmq | lbragstad: remove the expiry_at change | 22:19 |
| samueldmq | lbragstad: and that will still pass | 22:19 |
| samueldmq | only thing is that token revocations will take efect in the next second | 22:19 |
| samueldmq | and it currently does, but with a shorter windows (ms) | 22:20 |
| lbragstad | yeah - but they will be truncated before writing to sql | 22:20 |
| *** ddieterly has joined #openstack-keystone | 22:25 | |
| *** ddieterly has quit IRC | 22:27 | |
| *** javis has quit IRC | 22:31 | |
| *** ddieterly has joined #openstack-keystone | 22:31 | |
| *** ravelar has quit IRC | 22:37 | |
| *** sdake has quit IRC | 22:40 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Remove the dead link in schema migration doc https://review.openstack.org/368249 | 22:50 |
| *** ddieterly has quit IRC | 22:57 | |
| *** ddieterly has joined #openstack-keystone | 22:59 | |
| *** ddieterly has quit IRC | 23:06 | |
| *** ddieterly has joined #openstack-keystone | 23:13 | |
| *** sdake has joined #openstack-keystone | 23:22 | |
| *** BjoernT has quit IRC | 23:30 | |
| *** ravelar has joined #openstack-keystone | 23:32 | |
| *** roxanagh_ has quit IRC | 23:35 | |
| *** nicolasbock has quit IRC | 23:37 | |
| *** ravelar has quit IRC | 23:37 | |
| *** fangxu has joined #openstack-keystone | 23:37 | |
| *** ddieterly has quit IRC | 23:54 | |
| *** gyee_ has joined #openstack-keystone | 23:58 | |
| *** ddieterly has joined #openstack-keystone | 23:59 | |
| *** ddieterly has quit IRC | 23:59 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!