| *** itsuugo has joined #openstack-keystone | 00:00 | |
| *** jamielennox is now known as jamielennox|away | 00:00 | |
| *** itsuugo has quit IRC | 00:05 | |
| *** itsuugo has joined #openstack-keystone | 00:06 | |
| *** itsuugo has quit IRC | 00:11 | |
| *** itsuugo has joined #openstack-keystone | 00:11 | |
| *** Alexey_Abashkin_ has quit IRC | 00:13 | |
| *** jamielennox|away is now known as jamielennox | 00:14 | |
| *** Alexey_Abashkin_ has joined #openstack-keystone | 00:14 | |
| *** Marcellin__ has quit IRC | 00:17 | |
| *** Alexey_Abashkin_ has quit IRC | 00:18 | |
| *** BjoernT has quit IRC | 00:20 | |
| *** adrian_otto has quit IRC | 00:21 | |
| *** tqtran has quit IRC | 00:25 | |
| stevemar | breton: rgr | 00:25 |
|---|---|---|
| *** itsuugo has quit IRC | 00:27 | |
| *** itsuugo has joined #openstack-keystone | 00:27 | |
| lbragstad | rodrigods did we revert the round down issue? | 00:28 |
| lbragstad | or patch? | 00:28 |
| rodrigods | lbragstad, not yet | 00:28 |
| rodrigods | fixed locally for me but not upstream | 00:28 |
| lbragstad | what tests is it impacting? | 00:29 |
| rodrigods | ksc functional ones | 00:29 |
| lbragstad | what if we take the same approach to the tempest tests and add waits? | 00:29 |
| rodrigods | lbragstad, maybe? not sure | 00:30 |
| rodrigods | i'm not convinced that it is the real issue since the tests didn't pass with the revert commit | 00:31 |
| rodrigods | they only pass locally for me | 00:31 |
| lbragstad | if we revert the microsecond rounding patch we're going to see race conditions with tempest again | 00:31 |
| *** Alexey_Abashkin_ has joined #openstack-keystone | 00:32 | |
| rodrigods | lbragstad, see https://review.openstack.org/#/c/373555/1 | 00:32 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 00:34 |
| *** itsuugo has quit IRC | 00:39 | |
| lbragstad | rodrigods interesting... did it fail the recheck | 00:39 |
| rodrigods | lbragstad, the recheck is still running | 00:40 |
| *** itsuugo has joined #openstack-keystone | 00:40 | |
| stevemar | so the reality of this is that rounding of microseconds shouldn't cause an issue in real deployments | 00:41 |
| stevemar | i'd be okay with using wait() here | 00:41 |
| rodrigods | lbragstad, stevemar locally https://paste.fedoraproject.org/431719/14744185/raw/ | 00:43 |
| stevemar | rodrigods: i wonder if the issue is that because the token timestamp is rounded down, the token isn't even valid yet? not that it's expired | 00:44 |
| rodrigods | stevemar, good point | 00:44 |
| *** roxanaghe has quit IRC | 00:45 | |
| stevemar | lbragstad: did that rounding change impact the issued_at field too? | 00:45 |
| lbragstad | the revocation event is still not catching it | 00:45 |
| lbragstad | yeah - i believe so | 00:45 |
| lbragstad | sorry - i'm multi-task | 00:45 |
| lbragstad | tasking* | 00:45 |
| lbragstad | trying to figure out if there is a doc meeting | 00:46 |
| stevemar | lbragstad: there isn't one today | 00:46 |
| stevemar | it was on the ML | 00:46 |
| stevemar | (the cancelation) | 00:46 |
| lbragstad | oh - my google calendar is out of date then | 00:47 |
| rodrigods | stevemar, failed again http://logs.openstack.org/55/373555/1/check/gate-keystoneclient-dsvm-functional-ubuntu-xenial/93f57ab/testr_results.html.gz | 00:48 |
| *** tonytan4ever has joined #openstack-keystone | 00:48 | |
| rodrigods | locally, 100% success | 00:48 |
| lbragstad | so - it must be in addition to something else? | 00:50 |
| stevemar | rodrigods: i think we need to drop in some wait()s | 00:50 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystonemiddleware: DO NOT MERGE: test commit https://review.openstack.org/373570 | 00:51 |
| rodrigods | since i can't reproduce locally ^ | 00:51 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 00:51 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: DO NOT MERGE: Check functional tests https://review.openstack.org/373555 | 00:52 |
| *** tonytan4ever has quit IRC | 00:52 | |
| *** itsuugo has quit IRC | 00:54 | |
| *** itsuugo has joined #openstack-keystone | 00:55 | |
| *** itsuugo has quit IRC | 01:03 | |
| *** itsuugo has joined #openstack-keystone | 01:05 | |
| *** zhangjl has joined #openstack-keystone | 01:11 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: test https://review.openstack.org/373578 | 01:12 |
| *** roxanaghe has joined #openstack-keystone | 01:13 | |
| *** itsuugo has quit IRC | 01:14 | |
| stevemar | crinkle: o/ | 01:14 |
| *** itsuugo has joined #openstack-keystone | 01:15 | |
| *** sdake_ has joined #openstack-keystone | 01:19 | |
| *** sdake has quit IRC | 01:21 | |
| *** davechen has joined #openstack-keystone | 01:22 | |
| *** zouyapeng has quit IRC | 01:25 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: test https://review.openstack.org/373578 | 01:30 |
| stevemar | rodrigods: you got lucky and the functional tests passed | 01:31 |
| *** roxanaghe has quit IRC | 01:33 | |
| *** roxanaghe has joined #openstack-keystone | 01:34 | |
| *** guoshan has joined #openstack-keystone | 01:34 | |
| *** itsuugo has quit IRC | 01:36 | |
| *** itsuugo has joined #openstack-keystone | 01:37 | |
| *** roxanaghe has quit IRC | 01:39 | |
| rodrigods | stevemar, just because the log | 01:40 |
| rodrigods | i bet | 01:41 |
| *** itsuugo has quit IRC | 01:46 | |
| *** itsuugo has joined #openstack-keystone | 01:47 | |
| *** tonytan4ever has joined #openstack-keystone | 01:49 | |
| *** roxanaghe has joined #openstack-keystone | 01:52 | |
| ayoung | jamielennox, got some data for you as far as how much work we need to do for reworking policy | 01:53 |
| ayoung | http://adam.younglogic.com/2016/09/distinct-rbac-policy-rules/ | 01:53 |
| *** tonytan4ever has quit IRC | 01:54 | |
| *** itsuugo has quit IRC | 01:55 | |
| *** itsuugo has joined #openstack-keystone | 01:56 | |
| *** itsuugo has quit IRC | 02:06 | |
| *** itsuugo has joined #openstack-keystone | 02:07 | |
| jamielennox | ayoung: that's pretty cool | 02:10 |
| jamielennox | ayoung: not sure if we can use that to determine which need to be is_admin_project | 02:10 |
| jamielennox | ayoung: but it's a good indication that we should have some global things defined across all projects, though i don't know how to do that | 02:10 |
| *** itsuugo has quit IRC | 02:12 | |
| *** itsuugo has joined #openstack-keystone | 02:12 | |
| ayoung | jamielennox, so long as we don't touch default, I think we can make it work | 02:13 |
| ayoung | what I should do is generate the complete set of rules from that, with something like identity:default for each of the individual files, then find a way to make that stick | 02:14 |
| ayoung | I'm not really looking for a unified polic file, either. I just need to be able to customize roles used upon deployment. That seems to require system wide scanning of policy | 02:15 |
| *** roxanaghe has quit IRC | 02:18 | |
| *** roxanaghe has joined #openstack-keystone | 02:18 | |
| *** itsuugo has quit IRC | 02:19 | |
| *** itsuugo has joined #openstack-keystone | 02:21 | |
| *** roxanaghe has quit IRC | 02:23 | |
| *** tonytan4ever has joined #openstack-keystone | 02:23 | |
| *** gagehugo has quit IRC | 02:24 | |
| rodrigods | stevemar, passed again | 02:24 |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: DO NOT MERGE: Check functional tests https://review.openstack.org/373555 | 02:25 |
| *** itsuugo has quit IRC | 02:36 | |
| *** itsuugo has joined #openstack-keystone | 02:37 | |
| *** nicolasbock has quit IRC | 02:41 | |
| *** itsuugo has quit IRC | 02:45 | |
| *** itsuugo has joined #openstack-keystone | 02:47 | |
| *** roxanaghe has joined #openstack-keystone | 02:50 | |
| *** itsuugo has quit IRC | 02:58 | |
| *** roxanaghe has quit IRC | 02:59 | |
| *** roxanaghe has joined #openstack-keystone | 03:00 | |
| *** itsuugo has joined #openstack-keystone | 03:00 | |
| *** xiaoyang has quit IRC | 03:02 | |
| *** david-lyle has quit IRC | 03:04 | |
| *** roxanaghe has quit IRC | 03:04 | |
| *** itsuugo has quit IRC | 03:05 | |
| stevemar | rodrigods: bah | 03:06 |
| jamielennox | stevemar, rodrigods: so it is something happening on the keystone side? | 03:06 |
| *** itsuugo has joined #openstack-keystone | 03:06 | |
| stevemar | jamielennox: sorta, is there a way to make the request sleep before issuing it or something | 03:07 |
| stevemar | jamielennox: i think the rounding definitely affected it | 03:07 |
| jamielennox | define easy | 03:08 |
| stevemar | but i'm not sure why | 03:08 |
| jamielennox | you can put a time.sleep in the request() function | 03:08 |
| jamielennox | but there's no like hook or existing param that would do it for you | 03:08 |
| stevemar | jamielennox: anyway to add it to ehre? https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/v3/client_fixtures.py | 03:08 |
| stevemar | on the flip side, if someone has a script like this, they'll be hitting timeouts all over the place too | 03:09 |
| jamielennox | you think it's because the auth and the op are happening in the same second? | 03:10 |
| stevemar | jamielennox: thats my hypothesis | 03:10 |
| jamielennox | didn't we fix that with a >= to > change or something | 03:10 |
| jamielennox | so if things are rounded to the same second then that's still ok | 03:10 |
| stevemar | jamielennox: https://github.com/openstack/keystone/commit/301b6a7bc770830485937f0b9927a26e2e5ec8c8 | 03:10 |
| stevemar | or even the same millisecond? | 03:11 |
| jamielennox | stevemar: if this is true you should be able to replicate locally | 03:11 |
| jamielennox | start your own keystone, run func tests or just something that does a fast auth then op and put prints everywhere | 03:12 |
| jamielennox | oh, so i think it's going to be using keystoneauth for the comm as well | 03:13 |
| jamielennox | because it's doing os_client_config | 03:13 |
| stevemar | its using os-client-config? | 03:13 |
| stevemar | eh, the easy solution for me is to revert the rounding work | 03:14 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 03:15 |
| *** itsuugo has quit IRC | 03:23 | |
| *** itsuugo has joined #openstack-keystone | 03:25 | |
| *** itsuugo has quit IRC | 03:29 | |
| *** itsuugo has joined #openstack-keystone | 03:31 | |
| *** dikonoor has joined #openstack-keystone | 03:33 | |
| *** itsuugo has quit IRC | 03:36 | |
| *** itsuugo has joined #openstack-keystone | 03:36 | |
| *** iurygregory_ has quit IRC | 03:37 | |
| *** itsuugo has quit IRC | 03:41 | |
| *** guoshan_ has joined #openstack-keystone | 03:41 | |
| *** guoshan has quit IRC | 03:41 | |
| *** itsuugo has joined #openstack-keystone | 03:42 | |
| *** sdake_ has quit IRC | 03:42 | |
| *** itsuugo has quit IRC | 03:51 | |
| *** itsuugo has joined #openstack-keystone | 03:52 | |
| *** guoshan_ has quit IRC | 03:52 | |
| *** itsuugo has quit IRC | 03:59 | |
| *** davechen has quit IRC | 03:59 | |
| *** davechen has joined #openstack-keystone | 03:59 | |
| *** itsuugo has joined #openstack-keystone | 04:01 | |
| *** lamt has quit IRC | 04:01 | |
| *** markvoelker has quit IRC | 04:03 | |
| *** itsuugo has quit IRC | 04:05 | |
| *** itsuugo has joined #openstack-keystone | 04:06 | |
| *** markvoelker has joined #openstack-keystone | 04:10 | |
| *** itsuugo has quit IRC | 04:11 | |
| *** itsuugo has joined #openstack-keystone | 04:12 | |
| *** itsuugo has quit IRC | 04:17 | |
| *** itsuugo has joined #openstack-keystone | 04:18 | |
| *** itsuugo has quit IRC | 04:23 | |
| *** itsuugo has joined #openstack-keystone | 04:24 | |
| *** fangxu has joined #openstack-keystone | 04:26 | |
| *** fangxu has quit IRC | 04:27 | |
| *** itsuugo has quit IRC | 04:29 | |
| *** itsuugo has joined #openstack-keystone | 04:30 | |
| *** vaishali_ has joined #openstack-keystone | 04:34 | |
| stevemar | jamielennox: poke | 04:35 |
| jamielennox | umph | 04:35 |
| stevemar | jamielennox: whats with the syntax in https://review.openstack.org/#/c/336971/4/keystonemiddleware/tests/unit/audit/test_audit_middleware.py | 04:35 |
| stevemar | self.create_simple_middleware()(req) | 04:35 |
| stevemar | is that some secret python i don't know? | 04:35 |
| jamielennox | stevemar: definitely | 04:35 |
| jamielennox | stevemar: it's just a wrapper that is returning a middleware object, then calling that object with a request | 04:36 |
| jamielennox | same as | 04:36 |
| jamielennox | middleware = self.create_simple_middleware() | 04:36 |
| jamielennox | middleware(req) | 04:36 |
| stevemar | oooohhh i see it | 04:36 |
| jamielennox | middleware.__call__(req) | 04:36 |
| stevemar | yeah, thats | 04:36 |
| stevemar | not pretty | 04:36 |
| stevemar | i guess you don't want to do: | 04:37 |
| stevemar | middleware = self.create_simple_middleware() | 04:37 |
| stevemar | middleware(req) | 04:37 |
| stevemar | save that 1 line ;) | 04:37 |
| jamielennox | i could, depends if you think it makes a difference | 04:37 |
| jamielennox | i think i fix it in a later review | 04:37 |
| jamielennox | i wrap it in an app thing | 04:38 |
| jamielennox | so you call middleware.get(...) instead of creating a request | 04:38 |
| jamielennox | https://review.openstack.org/#/c/336972/4 | 04:38 |
| jamielennox | but those audit tests are a bit of a shambles so i wanted to be really careful working through them | 04:39 |
| stevemar | gotcha | 04:39 |
| stevemar | i do find it a bit confusing | 04:39 |
| *** itsuugo has quit IRC | 04:45 | |
| *** itsuugo has joined #openstack-keystone | 04:46 | |
| *** jaosorior has joined #openstack-keystone | 04:50 | |
| *** itsuugo has quit IRC | 04:51 | |
| *** itsuugo has joined #openstack-keystone | 04:53 | |
| *** guoshan has joined #openstack-keystone | 04:53 | |
| *** code-R has joined #openstack-keystone | 04:56 | |
| *** sc68cal_ has joined #openstack-keystone | 05:09 | |
| *** woodster_ has quit IRC | 05:10 | |
| *** jaosorior has quit IRC | 05:10 | |
| *** jaosorior has joined #openstack-keystone | 05:11 | |
| *** sc68cal has quit IRC | 05:11 | |
| *** itsuugo has quit IRC | 05:12 | |
| *** itsuugo has joined #openstack-keystone | 05:12 | |
| *** asettle has joined #openstack-keystone | 05:20 | |
| *** tqtran has joined #openstack-keystone | 05:25 | |
| *** itsuugo has quit IRC | 05:26 | |
| *** itsuugo has joined #openstack-keystone | 05:27 | |
| *** asettle has quit IRC | 05:28 | |
| *** tqtran has quit IRC | 05:30 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Tweak status code in api-ref doc for v3 users https://review.openstack.org/367767 | 05:32 |
| *** itsuugo has quit IRC | 05:32 | |
| *** itsuugo has joined #openstack-keystone | 05:33 | |
| *** adriant has quit IRC | 05:35 | |
| openstackgerrit | Qiming Teng proposed openstack/keystone: Reorder APIs in api-ref doc for v3 users https://review.openstack.org/373660 | 05:36 |
| *** lamt has joined #openstack-keystone | 05:39 | |
| *** richm1 has quit IRC | 05:40 | |
| *** code-R has quit IRC | 05:51 | |
| *** tqtran has joined #openstack-keystone | 05:53 | |
| *** itsuugo has quit IRC | 05:53 | |
| *** itsuugo has joined #openstack-keystone | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/373678 | 05:58 |
| *** code-R has joined #openstack-keystone | 05:58 | |
| *** itsuugo has quit IRC | 05:59 | |
| *** itsuugo has joined #openstack-keystone | 06:01 | |
| *** markvoelker has quit IRC | 06:01 | |
| *** markvoelker has joined #openstack-keystone | 06:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/373686 | 06:03 |
| *** itsuugo has quit IRC | 06:05 | |
| *** itsuugo has joined #openstack-keystone | 06:07 | |
| *** rcernin has joined #openstack-keystone | 06:07 | |
| *** code-R_ has joined #openstack-keystone | 06:09 | |
| *** markvoelker has quit IRC | 06:11 | |
| *** code-R has quit IRC | 06:12 | |
| *** tonytan4ever has quit IRC | 06:14 | |
| *** itsuugo has quit IRC | 06:17 | |
| *** itsuugo has joined #openstack-keystone | 06:18 | |
| *** namnh has joined #openstack-keystone | 06:25 | |
| *** itsuugo has quit IRC | 06:25 | |
| *** itsuugo has joined #openstack-keystone | 06:27 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Handle the exception from creating access token properly https://review.openstack.org/359795 | 06:30 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Handle the exception from creating access token properly https://review.openstack.org/359795 | 06:35 |
| *** itsuugo has quit IRC | 06:37 | |
| *** itsuugo has joined #openstack-keystone | 06:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/373750 | 06:42 |
| *** itsuugo has quit IRC | 06:43 | |
| *** code-R_ has quit IRC | 06:45 | |
| *** itsuugo has joined #openstack-keystone | 06:45 | |
| *** itsuugo has quit IRC | 07:02 | |
| *** namnh has quit IRC | 07:02 | |
| *** itsuugo has joined #openstack-keystone | 07:03 | |
| *** namnh has joined #openstack-keystone | 07:03 | |
| *** itsuugo has quit IRC | 07:10 | |
| *** markvoelker has joined #openstack-keystone | 07:11 | |
| *** itsuugo has joined #openstack-keystone | 07:12 | |
| *** pcaruana has joined #openstack-keystone | 07:13 | |
| *** markvoelker has quit IRC | 07:16 | |
| *** vaishali_ has quit IRC | 07:18 | |
| *** tqtran has quit IRC | 07:19 | |
| *** jpena|off is now known as jpena | 07:19 | |
| *** Alexey_Abashkin_ has quit IRC | 07:20 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:23 | |
| *** itsuugo has quit IRC | 07:25 | |
| *** itsuugo has joined #openstack-keystone | 07:27 | |
| *** itsuugo has quit IRC | 07:33 | |
| *** itsuugo has joined #openstack-keystone | 07:35 | |
| *** pnavarro has joined #openstack-keystone | 07:35 | |
| *** code-R has joined #openstack-keystone | 07:37 | |
| openstackgerrit | Nanke_Liu (lnk) proposed openstack/keystonemiddleware: Replace 'MagicMock' with 'Mock' https://review.openstack.org/373826 | 07:41 |
| *** amoralej|off is now known as amoralej | 07:43 | |
| *** tonytan4ever has joined #openstack-keystone | 07:44 | |
| *** code-R has quit IRC | 07:46 | |
| *** vaishali has joined #openstack-keystone | 07:47 | |
| *** tonytan4ever has quit IRC | 07:50 | |
| *** vaishali has quit IRC | 07:51 | |
| *** pnavarro has quit IRC | 07:53 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** code-R has joined #openstack-keystone | 08:02 | |
| *** vaishali has joined #openstack-keystone | 08:04 | |
| *** pnavarro has joined #openstack-keystone | 08:04 | |
| *** itsuugo has quit IRC | 08:04 | |
| *** itsuugo has joined #openstack-keystone | 08:05 | |
| *** vaishali has quit IRC | 08:08 | |
| *** code-R has quit IRC | 08:11 | |
| *** marekd2 has joined #openstack-keystone | 08:15 | |
| *** pnavarro has quit IRC | 08:27 | |
| *** jaosorior is now known as jaosorior_brb | 08:28 | |
| *** vaishali has joined #openstack-keystone | 08:28 | |
| *** vaishali has quit IRC | 08:33 | |
| breton | dammit | 08:33 |
| breton | 20 mails about that stupid "Never use MagicMock" | 08:34 |
| *** pnavarro has joined #openstack-keystone | 08:38 | |
| jamielennox | yea, i hate those big launchpad bugs that then tell you everytime a new project is subscribed/unscubscribed/fixed and not interesting | 08:39 |
| *** asettle has joined #openstack-keystone | 08:45 | |
| *** vaishali_ has joined #openstack-keystone | 08:46 | |
| *** pnavarro has quit IRC | 08:57 | |
| *** mvk has quit IRC | 09:00 | |
| *** pnavarro has joined #openstack-keystone | 09:02 | |
| *** acoles_ is now known as acoles | 09:02 | |
| *** pnavarro has quit IRC | 09:13 | |
| *** itsuugo has quit IRC | 09:16 | |
| *** itsuugo has joined #openstack-keystone | 09:17 | |
| *** pnavarro has joined #openstack-keystone | 09:22 | |
| *** itsuugo has quit IRC | 09:22 | |
| *** itsuugo has joined #openstack-keystone | 09:23 | |
| *** code-R has joined #openstack-keystone | 09:30 | |
| *** mvk has joined #openstack-keystone | 09:31 | |
| *** code-R_ has joined #openstack-keystone | 09:31 | |
| *** pnavarro has quit IRC | 09:34 | |
| *** itsuugo has quit IRC | 09:34 | |
| *** code-R has quit IRC | 09:34 | |
| *** itsuugo has joined #openstack-keystone | 09:35 | |
| openstackgerrit | Dave Chen proposed openstack/keystone: Handle the exception from creating request token properly https://review.openstack.org/361087 | 09:38 |
| *** pnavarro has joined #openstack-keystone | 09:48 | |
| *** pnavarro has quit IRC | 09:53 | |
| aloga | stevemar: as promised https://review.openstack.org/#/c/373983/ | 10:00 |
| *** rdo_ has quit IRC | 10:02 | |
| *** rdo_ has joined #openstack-keystone | 10:04 | |
| *** richm has joined #openstack-keystone | 10:10 | |
| openstackgerrit | Alvaro Lopez Garcia proposed openstack/keystone-specs: OpenID Connect improved support https://review.openstack.org/373983 | 10:17 |
| *** tqtran has joined #openstack-keystone | 10:17 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: DO NOT MERGE: Check functional tests https://review.openstack.org/374003 | 10:18 |
| *** tqtran has quit IRC | 10:21 | |
| *** itsuugo has quit IRC | 10:21 | |
| *** itsuugo has joined #openstack-keystone | 10:23 | |
| *** vaishali_ has quit IRC | 10:25 | |
| *** itsuugo has quit IRC | 10:33 | |
| *** itsuugo has joined #openstack-keystone | 10:34 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Verbose 401/403 debug responses https://review.openstack.org/372433 | 10:40 |
| *** nicolasbock has joined #openstack-keystone | 10:41 | |
| *** pnavarro has joined #openstack-keystone | 10:41 | |
| *** vaishali_ has joined #openstack-keystone | 10:41 | |
| *** itsuugo has quit IRC | 10:41 | |
| *** itsuugo has joined #openstack-keystone | 10:43 | |
| *** tonytan4ever has joined #openstack-keystone | 10:46 | |
| *** tonytan4ever has quit IRC | 10:52 | |
| *** code-R_ has quit IRC | 10:56 | |
| *** code-R has joined #openstack-keystone | 10:56 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystonemiddleware: DO NOT MERGE: test commit https://review.openstack.org/373570 | 10:58 |
| *** itsuugo has quit IRC | 10:58 | |
| *** itsuugo has joined #openstack-keystone | 11:00 | |
| *** pnavarro has quit IRC | 11:00 | |
| *** zhangjl has quit IRC | 11:05 | |
| *** namnh has quit IRC | 11:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystonemiddleware: DO NOT MERGE: test commit https://review.openstack.org/373570 | 11:07 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Consolidate the common code into one method https://review.openstack.org/374043 | 11:16 |
| openstackgerrit | Dave Chen proposed openstack/keystone: Handle the exception from creating access token properly https://review.openstack.org/359795 | 11:18 |
| *** pnavarro has joined #openstack-keystone | 11:18 | |
| davechen | rodrigods: ^^ | 11:19 |
| davechen | rodrigods: btw, thanks for the review and comments! | 11:19 |
| rodrigods | davechen, np! :) | 11:23 |
| *** jed56 has quit IRC | 11:25 | |
| *** davechen has left #openstack-keystone | 11:26 | |
| *** jaosorior_brb is now known as jaosorior | 11:28 | |
| *** itsuugo has quit IRC | 11:28 | |
| *** itsuugo has joined #openstack-keystone | 11:29 | |
| *** daemontool has joined #openstack-keystone | 11:39 | |
| *** itsuugo has quit IRC | 11:39 | |
| *** itsuugo has joined #openstack-keystone | 11:40 | |
| *** woodster_ has joined #openstack-keystone | 11:40 | |
| *** code-R_ has joined #openstack-keystone | 11:42 | |
| *** code-R has quit IRC | 11:45 | |
| *** edmondsw has joined #openstack-keystone | 11:49 | |
| *** itsuugo has quit IRC | 11:52 | |
| *** itsuugo has joined #openstack-keystone | 11:53 | |
| *** jpena is now known as jpena|lunch | 11:57 | |
| *** lamt has quit IRC | 11:58 | |
| *** rodrigods has quit IRC | 11:59 | |
| *** rodrigods has joined #openstack-keystone | 11:59 | |
| *** pnavarro has quit IRC | 12:04 | |
| *** nk2527 has joined #openstack-keystone | 12:09 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy: Trivial: Don't need restrict export of class https://review.openstack.org/374102 | 12:21 |
| *** pauloewerton has joined #openstack-keystone | 12:26 | |
| *** lamt has joined #openstack-keystone | 12:29 | |
| *** itsuugo has quit IRC | 12:30 | |
| *** lamt has quit IRC | 12:31 | |
| *** lamt has joined #openstack-keystone | 12:32 | |
| *** itsuugo has joined #openstack-keystone | 12:32 | |
| *** markvoelker has joined #openstack-keystone | 12:33 | |
| *** guoshan has quit IRC | 12:33 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation model https://review.openstack.org/208488 | 12:44 |
| *** amoralej is now known as amoralej|lunch | 12:44 | |
| *** itsuugo has quit IRC | 12:55 | |
| *** david-lyle has joined #openstack-keystone | 12:56 | |
| *** itsuugo has joined #openstack-keystone | 12:57 | |
| *** vaishali_ has quit IRC | 12:58 | |
| *** acoles is now known as acoles_ | 12:58 | |
| *** jpena|lunch is now known as jpena | 13:00 | |
| *** jaosorior has quit IRC | 13:10 | |
| *** jaosorior has joined #openstack-keystone | 13:11 | |
| *** pnavarro has joined #openstack-keystone | 13:21 | |
| stevemar | jamielennox: breton you can mute the bug mail | 13:22 |
| *** stevemar changes topic to "Summit Brainstorm: https://etherpad.openstack.org/p/keystone-ocata-summit-brainstorm | Meeting Agenda https://etherpad.openstack.org/p/keystone-weekly-meeting | Newton retrospective: https://etherpad.openstack.org/p/keystone-newton-retrospective" | 13:30 | |
| stevemar | PSA for keystone devs: add content to the summit etherpad: https://etherpad.openstack.org/p/keystone-ocata-summit-brainstorm -- dolphm ayoung bknudson jamielennox dstanek marekd samueldmq rodrigods | 13:31 |
| rodrigods | thanks stevemar | 13:32 |
| *** code-R_ has quit IRC | 13:34 | |
| *** code-R has joined #openstack-keystone | 13:36 | |
| *** amoralej|lunch is now known as amoralej | 13:36 | |
| rodrigods | stevemar, think i know the issue in ksc tests, just don't know yet how it is related to rounding down | 13:46 |
| *** lamt has quit IRC | 13:47 | |
| *** spzala has joined #openstack-keystone | 13:47 | |
| ayoung | stevemar, will do | 13:50 |
| *** jrist has quit IRC | 13:52 | |
| dstanek | stevemar: do you really like the idea of having invalid settings by default? | 13:52 |
| dstanek | re:idp sso stuff | 13:52 |
| breton | what is psa? | 13:52 |
| *** tonytan4ever has joined #openstack-keystone | 13:52 | |
| dstanek | breton: public service announcement | 13:52 |
| *** asettle has quit IRC | 13:54 | |
| *** pnavarro has quit IRC | 13:54 | |
| *** asettle has joined #openstack-keystone | 13:55 | |
| rodrigods | dstanek, stevemar, lbragstad, so... think our ksc functional tests relied on a bug to work most of the times | 13:56 |
| rodrigods | and... the rounding down patch fixes that bug | 13:56 |
| lbragstad | rodrigods lol | 13:57 |
| rodrigods | breaking our ksc functional tests :) | 13:57 |
| dstanek | rodrigods: nice | 13:57 |
| *** lifeless has quit IRC | 13:57 | |
| lbragstad | rodrigods is this suppose to be good news? | 13:57 |
| dstanek | rodrigods: can we fix it so it doesn't rely on the bug? | 13:57 |
| rodrigods | lbragstad, i guess? | 13:57 |
| rodrigods | dstanek, i think so, replying to stevemar's ML list email | 13:57 |
| rodrigods | with more details | 13:57 |
| *** r-daneel has joined #openstack-keystone | 13:58 | |
| *** sdake has joined #openstack-keystone | 13:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation assignment driver https://review.openstack.org/291318 | 13:59 |
| *** lifeless has joined #openstack-keystone | 13:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Move dependency-related trust logic to manager https://review.openstack.org/360735 | 13:59 |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: Unified delegation trust driver https://review.openstack.org/291871 | 13:59 |
| rodrigods | lbragstad, dstanek, stevemar replied (ML thread is "gate-keystoneclient-dsvm-functional-ubuntu-xenial is broken") | 13:59 |
| *** sdake has quit IRC | 13:59 | |
| openstackgerrit | Alexander Makarov proposed openstack/keystone: OAuth1 driver for unified delegation https://review.openstack.org/370965 | 14:00 |
| *** sdake has joined #openstack-keystone | 14:00 | |
| *** acoles_ is now known as acoles | 14:03 | |
| rodrigods | lbragstad, dstanek, the ksc functional are pretty good tests because they create lots of race condition scenarios | 14:05 |
| rodrigods | it is a feature bug :) | 14:05 |
| *** jrist has joined #openstack-keystone | 14:07 | |
| *** spedione|AWAY is now known as spedione | 14:10 | |
| *** dikonoor has quit IRC | 14:18 | |
| *** tqtran has joined #openstack-keystone | 14:19 | |
| *** tqtran has quit IRC | 14:23 | |
| *** slberger has joined #openstack-keystone | 14:23 | |
| *** gagehugo has joined #openstack-keystone | 14:25 | |
| *** mfisch has quit IRC | 14:28 | |
| stevemar | rodrigods: hehe | 14:29 |
| *** edtubill has joined #openstack-keystone | 14:30 | |
| *** edtubill has quit IRC | 14:30 | |
| *** edtubill has joined #openstack-keystone | 14:31 | |
| rodrigods | stevemar, https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/tests/functional/v3/test_auth.py | 14:32 |
| *** jed56 has joined #openstack-keystone | 14:32 | |
| *** mfisch has joined #openstack-keystone | 14:32 | |
| rodrigods | these test | 14:32 |
| *** mfisch has quit IRC | 14:32 | |
| *** mfisch has joined #openstack-keystone | 14:32 | |
| rodrigods | tests*, that create the race condition | 14:32 |
| *** acoles is now known as acoles_ | 14:40 | |
| *** ravelar has joined #openstack-keystone | 14:41 | |
| *** LamT_ has quit IRC | 14:41 | |
| *** daemontool_ has joined #openstack-keystone | 14:41 | |
| rodrigods | stevemar, dstanek, lbragstad: https://review.openstack.org/#/c/374211/ | 14:42 |
| *** daemontool has quit IRC | 14:44 | |
| dstanek | rodrigods: so this has been a problem for 5 weeks? | 14:47 |
| dstanek | i thought it was only the last few days | 14:47 |
| rodrigods | dstanek, was uncovered by lbragstad commit | 14:47 |
| dstanek | rodrigods: ah | 14:47 |
| *** ddieterly has joined #openstack-keystone | 14:48 | |
| dstanek | rodrigods: +2 from me | 14:48 |
| breton | rodrigods: nice | 14:49 |
| *** acoles_ is now known as acoles | 14:49 | |
| rodrigods | thanks dstanek | 14:49 |
| rodrigods | breton, ++ was a nice one to debug :) | 14:50 |
| *** EinstCrazy has joined #openstack-keystone | 14:52 | |
| *** slberger1 has joined #openstack-keystone | 14:56 | |
| *** EinstCrazy has quit IRC | 14:56 | |
| dstanek | rodrigods: do we still need your other revert? | 14:57 |
| rodrigods | dstanek, no | 14:57 |
| *** slberger has quit IRC | 14:58 | |
| bknudson | I tried running with https://review.openstack.org/#/c/359371/15 and token validation is a lot faster. | 14:58 |
| *** daemontool_ has quit IRC | 14:58 | |
| dstanek | rodrigods: actually it looks like you have a few reverts | 14:58 |
| rodrigods | dstanek, only the ksc is required as per the last discoveries | 14:59 |
| *** openstack has joined #openstack-keystone | 14:59 | |
| stevemar | rodrigods: that's good news :) | 14:59 |
| rodrigods | dstanek, will abandon the other ones when the ksc revert proves that works | 14:59 |
| stevemar | rodrigods: no need to revert keystone patches ! | 15:00 |
| rodrigods | stevemar, ++ | 15:00 |
| stevemar | rodrigods: sure, abandon the others | 15:00 |
| *** slberger1 has quit IRC | 15:02 | |
| *** slberger has joined #openstack-keystone | 15:04 | |
| breton | http://bikeshed.com/ (hit reload a couple of times if you dislike background color) | 15:07 |
| breton | (or https://shed.bike/ for almost-plain-text) | 15:08 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Update docs on policy sample generator https://review.openstack.org/374232 | 15:10 |
| *** ddieterly is now known as ddieterly[away] | 15:12 | |
| *** ddieterly[away] is now known as ddieterly | 15:12 | |
| *** lamt has joined #openstack-keystone | 15:15 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fix formatting strings in LOG.warning https://review.openstack.org/361882 | 15:17 |
| *** gagehugo has quit IRC | 15:19 | |
| openstackgerrit | David Stanek proposed openstack/keystone: Fix formatting strings in LOG.debug https://review.openstack.org/361895 | 15:23 |
| lbragstad | bknudson nice! | 15:23 |
| dstanek | ^ i wanted to get those out of my queue forever | 15:24 |
| *** EinstCrazy has joined #openstack-keystone | 15:24 | |
| *** EinstCrazy has quit IRC | 15:26 | |
| *** EinstCrazy has joined #openstack-keystone | 15:27 | |
| ravelar | bknudson thanks for the feedback! :) been trying to get some views on this | 15:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: One validate method to rule them all... https://review.openstack.org/374243 | 15:28 |
| bknudson | ravelar: the commit message says it's a work in progress | 15:28 |
| ravelar | bknudson I updated it one more time since then, the commit message should be changed since 15? | 15:29 |
| *** ddieterly is now known as ddieterly[away] | 15:30 | |
| *** mvk has quit IRC | 15:31 | |
| *** gagehugo has joined #openstack-keystone | 15:32 | |
| stevemar | dolphm: https://review.openstack.org/#/c/374245/1 for mitaka | 15:33 |
| stevemar | thanks breton for backporting | 15:33 |
| *** slberger has quit IRC | 15:34 | |
| *** ddieterly[away] is now known as ddieterly | 15:34 | |
| *** slberger has joined #openstack-keystone | 15:35 | |
| breton | stevemar: wait, that's still probably wip, to early to +2. The tests will fail, and if they won't then it's pure luck and they will on recheck. | 15:36 |
| stevemar | breton: sad | 15:36 |
| stevemar | breton: do you have any other patches you want to backport? | 15:36 |
| stevemar | breton: otherwise i will ask to release the new mitaka today | 15:36 |
| *** edtubill has quit IRC | 15:37 | |
| dolphm | lbragstad: ^ | 15:37 |
| *** edtubill has joined #openstack-keystone | 15:37 | |
| lbragstad | dolphm ? | 15:38 |
| *** jaosorior has quit IRC | 15:39 | |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Perform basic checks on policy definitions https://review.openstack.org/373491 | 15:39 |
| openstackgerrit | Andrew Laski proposed openstack/oslo.policy: Add optional exception for check_rules https://review.openstack.org/374251 | 15:39 |
| dolphm | lbragstad: your patch is being backported | 15:39 |
| breton | stevemar: no, can't think of any. I need to leave for 3-4 hours, but after that i will finish 374245 and i think we're good. | 15:42 |
| bknudson | ravelar: I think the slow part of revocation event handling is reading and deserializing the data. | 15:42 |
| breton | but if anyone wants to get https://review.openstack.org/#/c/374245/ in earlier, feel free to poke it | 15:46 |
| *** d0ugal has quit IRC | 15:48 | |
| *** d0ugal has joined #openstack-keystone | 15:49 | |
| *** gagehugo has quit IRC | 15:51 | |
| *** itsuugo has quit IRC | 15:53 | |
| *** gagehugo has joined #openstack-keystone | 15:54 | |
| *** itsuugo has joined #openstack-keystone | 15:55 | |
| *** EinstCrazy has quit IRC | 15:59 | |
| *** roxanaghe has joined #openstack-keystone | 16:00 | |
| ravelar | bknudson you're probably right, another assignment I am currently looking into is dropping some of the unnecessary columns from the rev event list to clean this up a bit. Right now there are a number of possibilities for an entry in revocation table | 16:02 |
| bknudson | ravelar: we have talked about removing project_id and domain_id and check the state of the object instead. | 16:03 |
| *** rcernin has quit IRC | 16:03 | |
| bknudson | can also drop role_id, trust_id, consumer_id, access_token_id. | 16:04 |
| ravelar | yes, lbragstad brought me up to speed with his patches which may be able to do that. That would make a big difference since domain_id is one of the things that have multiple token_data fields matched to one revocation column | 16:04 |
| *** chianingwang has quit IRC | 16:04 | |
| *** chianingwang has joined #openstack-keystone | 16:04 | |
| bknudson | well, it all depends on how they're using the cloud. Not sure how many domain revocations are happening anyways. | 16:05 |
| ravelar | bknudson, just saw your other comments on the patch, will do them right away :) | 16:05 |
| bknudson | what does the typical query look like? | 16:05 |
| bknudson | Let me take a look. | 16:05 |
| *** gyee has joined #openstack-keystone | 16:07 | |
| *** vkmc is now known as vkmc|afk | 16:14 | |
| bknudson | Here's what my token_data looks like: http://paste.openstack.org/show/582424/ | 16:14 |
| bknudson | so the query is always going to have all the filters set. | 16:15 |
| bknudson | even when they don't matter (like access_token_id is null) | 16:15 |
| *** pcaruana has quit IRC | 16:15 | |
| *** pcaruana has joined #openstack-keystone | 16:17 | |
| ravelar | bknudson are you saying that token_data should remove None values and the query should only check the revocation event table for what isn't None in token_data? | 16:18 |
| bknudson | ravelar: seems like it. | 16:19 |
| bknudson | at least, don't need to do both is_(None) and == value when value is None | 16:19 |
| ravelar | bknudson, in one of my previous patches I implemented this but the problem was multiple tox tests failed because the current method is doing that. I just wasn't sure if that was the implementation we didn't want to get rid of | 16:20 |
| bknudson | ravelar: I was planning to look at the current method... | 16:21 |
| bknudson | for some reason the commit message didn't say that it was re-implementing something. | 16:21 |
| ravelar | the current method keeps none values of token_data so that if a revocation column has a column set and the token_data has it None then it fails | 16:21 |
| ravelar | bknudson ah, sorry | 16:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Test that v3fedkerb plugin loads https://review.openstack.org/368017 | 16:21 |
| *** ddieterly is now known as ddieterly[away] | 16:22 | |
| *** edtubill has quit IRC | 16:22 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Fix parameters for Kerberos Auth Plugin https://review.openstack.org/368288 | 16:23 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Test that v3fedkerb plugin loads https://review.openstack.org/368017 | 16:23 |
| *** edtubill has joined #openstack-keystone | 16:23 | |
| ravelar | bknudson but basically if you look at matches inside the revoke/backend/sql.py file it shows how it is still comparing all of revocation columns to all of token_data and so if something is in revocation column that isn't there in the corresponding token_data field then it short circuits as false. So it really only makes sure that a revocation event field that is None is not looked into, not the other way around. I am unsure how important | 16:24 |
| ravelar | this is and if we could change this to only match what the token gives us instead of the other way around. | 16:24 |
| ravelar | bknudson ooops I meant matches inside models/revoke_model.py | 16:25 |
| *** ddieterly[away] is now known as ddieterly | 16:25 | |
| bknudson | ravelar: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/models/revoke_model.py#n151 ? | 16:26 |
| ravelar | bknudson yes that's the one :) | 16:26 |
| bknudson | since there are 2 parts of code that do the same thing and need to be kept in sync there should be cross-referencing between them. | 16:27 |
| bknudson | or, maybe revoke_model.matches isn't used anymore so should be removed. | 16:27 |
| openstackgerrit | Merged openstack/keystone: Give domain admin rights to domain specific implied roles https://review.openstack.org/339558 | 16:29 |
| ravelar | bknudson yeah, I was thinking of just removing them since the first part of the POC was to see if it did improve performance and now that it does, the next step is having it replace the old method | 16:29 |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: delete python bytecode including pyo before every test run https://review.openstack.org/371324 | 16:29 |
| *** spzala has quit IRC | 16:30 | |
| *** spzala has joined #openstack-keystone | 16:31 | |
| bknudson | ravelar: it makes sense that performance is improved since from what I saw there was so much time spent deserializing the events... maybe there's a more efficient way to deserialize that would be a better solution | 16:31 |
| bknudson | for example if it was a list of dicts rather than a list of objects. | 16:31 |
| bknudson | and then if we cached the events. | 16:32 |
| bknudson | also, would be interesting if we could avoid a tablescan but I don't think that's going to be possible... need to check for the token audit_id and that's random. | 16:33 |
| ravelar | bknudson I was looking into indexing and caching, you definitely have a good point there | 16:34 |
| bknudson | if there's a lot of events it's going to wind up putting load on the server since has to read this table all the time.. | 16:34 |
| *** adrian_otto1 has joined #openstack-keystone | 16:34 | |
| ravelar | bknudson on a handful of columns? | 16:35 |
| bknudson | ravelar: y, at least the rows don't have a lot of bytes in them, so lots of rows in a page. | 16:35 |
| ravelar | bknudson how many events would actually put a noticeable load? Since revocation list is constantly cleaned up as well | 16:36 |
| bknudson | consider what happens if you've got a million rows | 16:36 |
| *** jplopezgu_ is now known as jlopezgu | 16:36 | |
| *** spzala has quit IRC | 16:37 | |
| bknudson | then every time a token is validated it does this query twice (once for the auth token and once for the subject token) | 16:37 |
| ravelar | bknudson a database normally deals with millions of rows? | 16:37 |
| bknudson | ravelar: I've worked with databases that contained millions of rows. | 16:37 |
| ravelar | bknudson I mean, I definitely see where you are going with this. Wouldn't adding indexes to issued_before or something along those lines help? | 16:38 |
| *** gagehugo has quit IRC | 16:38 | |
| bknudson | we already have an index on revoked_at http://git.openstack.org/cgit/openstack/keystone/tree/keystone/revoke/backends/sql.py#n36 | 16:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "Allow compatibility with keystonemiddleware 4.0.0" https://review.openstack.org/374284 | 16:39 |
| bknudson | probably because of the last_fetch filter in list_events. | 16:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "Allow compatibility with keystonemiddleware 4.0.0" https://review.openstack.org/374284 | 16:40 |
| ravelar | bknudson ahh, but list_events is no longer used with this new method since it doesnt need to convert db entries to dicts for matches anymore | 16:40 |
| ravelar | bknudson also I am interested in what you mentioned earlier about dicts rather than object. Could you explain? I didn't fully understand | 16:40 |
| bknudson | ravelar: first, when list_events is done all the rows are converted to RevocationEvent objects... | 16:41 |
| bknudson | also, when you do list_events it checks memcache to get the events, too. | 16:41 |
| bknudson | so then it has to get the binary data from memcache and rebuild a list of RevocationEvent objects | 16:42 |
| stevemar | ravelar: btw, can you check the bugs with the tag "revoke" and see if your patch will close any? https://bugs.launchpad.net/keystone/+bugs?field.tag=revoke -- if it does, then add Closes-Bug: 123456 to the commit message | 16:42 |
| openstack | bug 123456 in xine-lib (Ubuntu) "podcast crashes amarok" [Undecided,Fix released] https://launchpad.net/bugs/123456 | 16:42 |
| ravelar | bknudson but list_events only got called with the old implementation in check_token? | 16:42 |
| ravelar | stevemar sure, will look into that :) | 16:43 |
| bknudson | ravelar: yes, that's the problem with the current implementation. | 16:43 |
| *** lamt has quit IRC | 16:43 | |
| ravelar | bknudson ahh, okay ha. I misunderstood. I thought you were referring to mine | 16:43 |
| bknudson | ravelar: the potential problem with the new implementation is that the database server has more work to do. | 16:43 |
| ravelar | bknudson gotcha | 16:44 |
| bknudson | this is what SpamapS brought up in patch set 3. | 16:44 |
| stevemar | ravelar: i think it could close bug 1511775, bug 1524030, bug 1609566 and bug 1590805 | 16:44 |
| openstack | bug 1511775 in OpenStack Identity (keystone) "Revoking a role revokes the unscoped token for a user" [Medium,Triaged] https://launchpad.net/bugs/1511775 | 16:44 |
| openstack | bug 1524030 in OpenStack Identity (keystone) "Reduce revocation events for performance improvement" [Medium,In progress] https://launchpad.net/bugs/1524030 - Assigned to Richard (csravelar) | 16:44 |
| openstack | bug 1609566 in OpenStack Identity (keystone) "500 error from revocation event deserialize" [Medium,In progress] https://launchpad.net/bugs/1609566 - Assigned to Morgan Fainberg (mdrnstm) | 16:44 |
| openstack | bug 1590805 in OpenStack Identity (keystone) "Revoking "admin" role from a group invalidates domain admin's token" [Low,New] https://launchpad.net/bugs/1590805 | 16:44 |
| bknudson | I don't see any way that indexes would improve much... other than I'd expect issued_before to help. | 16:44 |
| stevemar | maybe not the last one... | 16:45 |
| ravelar | bknudson yeah, the other columns wouldn't make much use of indexes other than the one mentioned | 16:45 |
| bknudson | ravelar: I'm surprised that revoked_at isn't used in the new is_revoked. | 16:46 |
| bknudson | maybe because those rows should have been pruned out anyways? | 16:46 |
| *** spzala has joined #openstack-keystone | 16:46 | |
| *** adrian_otto1 has quit IRC | 16:49 | |
| *** edtubill has quit IRC | 16:51 | |
| ravelar | bknudson, hmm I believed I missed it before as it being indexed already. But having the query do something like query = session.query(RevocationEvent).order_by(RevocationEvent.revoked_at) | 16:52 |
| ravelar | bknudson prior would make it more likely that it finds a match earlier if at all, correct? | 16:53 |
| * SpamapS stirs | 16:53 | |
| *** lamt has joined #openstack-keystone | 16:57 | |
| *** ngupta has joined #openstack-keystone | 16:59 | |
| dstanek | /b 28 | 17:03 |
| *** marekd2 has quit IRC | 17:05 | |
| *** marekd2 has joined #openstack-keystone | 17:06 | |
| *** code-R has quit IRC | 17:09 | |
| *** marekd2 has quit IRC | 17:10 | |
| *** jpena is now known as jpena|off | 17:14 | |
| *** marekd2 has joined #openstack-keystone | 17:17 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/373678 | 17:20 |
| openstackgerrit | Merged openstack/python-keystoneclient: Revert "Add auth functional tests" https://review.openstack.org/374211 | 17:20 |
| *** marekd2 has quit IRC | 17:21 | |
| *** thebloggu has joined #openstack-keystone | 17:22 | |
| *** itsuugo has quit IRC | 17:22 | |
| *** itsuugo has joined #openstack-keystone | 17:23 | |
| *** rob_d has quit IRC | 17:24 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 17:29 |
| *** ddieterly is now known as ddieterly[away] | 17:32 | |
| *** jed56 has quit IRC | 17:35 | |
| *** ravelar has quit IRC | 17:37 | |
| bknudson | ravelar: I forgot about the order by revoked_at... I think the point of that is that it the events are supposed to be used in that order so that a tree could be made. | 17:40 |
| *** ravelar has joined #openstack-keystone | 17:44 | |
| *** haplo37__ has joined #openstack-keystone | 17:45 | |
| *** Dave has quit IRC | 17:45 | |
| bknudson | SpamapS: I've been looking into the performance problem with revocation events this week. | 17:46 |
| bknudson | and was able to actually test out https://review.openstack.org/#/c/359371/ -- results were excellent in vagrant. | 17:47 |
| SpamapS | bknudson: how's the database query thing looking? | 17:47 |
| *** amoralej is now known as amoralej|off | 17:47 | |
| bknudson | SpamapS: I think the actual problem that we see with the code as it is is that keystone needs to spend so much time deserializing values (from either the DB or from memcache) | 17:47 |
| bknudson | reading the binary "list of RevocationEvent" as binary from memcache and converting it into python objects | 17:48 |
| *** amoralej|off is now known as amoralej | 17:49 | |
| bknudson | but this is something I can look into more. | 17:49 |
| bknudson | I wanted to try out the sql query to see if that improved things since that was easier to do, and it is a lot faster. | 17:49 |
| bknudson | the sql query itself is not pretty, and I doubt that an index would help, other than an index on issued_before since that's in the query: and1.append(RevocationEvent.issued_before >= value) | 17:50 |
| *** Dave____ has joined #openstack-keystone | 17:51 | |
| bknudson | SpamapS: the code in https://review.openstack.org/#/c/359371/16/keystone/revoke/backends/sql.py makes it look like the query would typically not contain a lot, but as it turns out token_data always has all the fields. | 17:51 |
| bknudson | so for example, or1 will always have 3 or_s appended. | 17:52 |
| *** acoles is now known as acoles_ | 17:57 | |
| *** wajdi has joined #openstack-keystone | 17:57 | |
| *** amoralej is now known as amoralej|off | 18:02 | |
| *** itsuugo has quit IRC | 18:11 | |
| *** vkmc|afk is now known as vkmc | 18:12 | |
| *** itsuugo has joined #openstack-keystone | 18:13 | |
| *** ngupta has quit IRC | 18:13 | |
| wajdi | Hi folks! | 18:13 |
| *** ngupta has joined #openstack-keystone | 18:14 | |
| *** tonytan4ever has quit IRC | 18:14 | |
| *** tonytan4ever has joined #openstack-keystone | 18:15 | |
| SpamapS | bknudson: I wonder if msgpack serialization would help much. | 18:15 |
| wajdi | If I am logged in as an admin, and I want to provide a user temporary access to a tenant. What would be the best/acceptable approach to tackle this? | 18:16 |
| bknudson | SpamapS: That's a good idea. I'd have to do measurements to know. It's pickled now. | 18:18 |
| bknudson | is it easy to switch to msgpack? | 18:18 |
| SpamapS | bknudson: anyway, with all those OR's... one thing to look at it possibly using UNION | 18:18 |
| *** edtubill has joined #openstack-keystone | 18:18 | |
| SpamapS | because that way you can use multiple indexes | 18:18 |
| SpamapS | Another possibility is to maintain materialized views. | 18:19 |
| SpamapS | Most fun is if you expect mostly empty results, you can do a query in parallel per OR clause | 18:20 |
| *** gyee has quit IRC | 18:20 | |
| bknudson | the rows are actually pretty short, and we could make them shorter by dropping a bunch of cols from the table. (we could check the status of the project directly rather than have an event for it (same for other object types)) | 18:20 |
| *** Marcellin__ has joined #openstack-keystone | 18:20 | |
| *** gyee has joined #openstack-keystone | 18:20 | |
| SpamapS | bknudson: it's easy to switch to msgpack yes, you'd need to inject something in the keys so you don't confuse the json deserializers, but it's the same basic mode of operation. | 18:21 |
| bknudson | do you know if other openstack projects use msgpack for caching (or msgpack in general) | 18:22 |
| SpamapS | privsep I think | 18:22 |
| SpamapS | for talking over a local socket, not caching | 18:22 |
| SpamapS | It also saves quite a bit of cache space, which can be important sometimes. | 18:23 |
| openstackgerrit | Merged openstack/keystone: Handle the exception from creating access token properly https://review.openstack.org/359795 | 18:24 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/373750 | 18:24 |
| *** ngupta has quit IRC | 18:29 | |
| *** ngupta has joined #openstack-keystone | 18:29 | |
| *** rcernin has joined #openstack-keystone | 18:30 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Handle the exception from creating request token properly https://review.openstack.org/361087 | 18:35 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Consolidate the common code into one method https://review.openstack.org/374043 | 18:35 |
| *** sdake has quit IRC | 18:39 | |
| stevemar | anyone available to remove the bandaid we had in the newton release for keystonemiddlware <4.2.0 -- https://review.openstack.org/#/c/374284/2 | 18:40 |
| *** itsuugo has quit IRC | 18:42 | |
| *** esp has joined #openstack-keystone | 18:43 | |
| *** itsuugo has joined #openstack-keystone | 18:44 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Revert "Allow compatibility with keystonemiddleware 4.0.0" https://review.openstack.org/374284 | 18:44 |
| stevemar | bknudson: done | 18:44 |
| *** tqtran has joined #openstack-keystone | 18:47 | |
| *** Dave____ has quit IRC | 18:48 | |
| *** ig0r_ has joined #openstack-keystone | 18:50 | |
| *** ddieterly[away] is now known as ddieterly | 18:50 | |
| *** Dave has joined #openstack-keystone | 18:50 | |
| *** ngupta_ has joined #openstack-keystone | 18:56 | |
| *** sdake has joined #openstack-keystone | 18:56 | |
| *** asettle has quit IRC | 18:58 | |
| *** ngupta has quit IRC | 18:59 | |
| *** srobert has joined #openstack-keystone | 18:59 | |
| *** ngupta_ has quit IRC | 19:00 | |
| *** thebloggu has quit IRC | 19:04 | |
| *** ddieterly is now known as ddieterly[away] | 19:06 | |
| *** itsuugo has quit IRC | 19:06 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/374334 | 19:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/374335 | 19:07 |
| *** gagehugo has joined #openstack-keystone | 19:07 | |
| *** itsuugo has joined #openstack-keystone | 19:08 | |
| openstackgerrit | Merged openstack/keystone: Fix formatting strings in LOG.debug https://review.openstack.org/361895 | 19:12 |
| *** catintheroof has joined #openstack-keystone | 19:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/374338 | 19:12 |
| bknudson | lbragstad: do we still need this code? http://git.openstack.org/cgit/openstack/keystone/tree/keystone/models/revoke_model.py#n281 | 19:14 |
| bknudson | given https://review.openstack.org/#/c/368244/ | 19:15 |
| lbragstad | bknudson i'm not sure - i just know we make sure it doesn't have microsecond precision outside of 000000 | 19:15 |
| bknudson | lbragstad: the code in the revocation events is taking the token timestamp and setting microsec to 0... but all tokens should already be 0? | 19:16 |
| lbragstad | bknudson I believe so | 19:17 |
| *** ddieterly[away] is now known as ddieterly | 19:19 | |
| *** roxanaghe has quit IRC | 19:21 | |
| *** ngupta has joined #openstack-keystone | 19:25 | |
| *** ddieterly is now known as ddieterly[away] | 19:30 | |
| *** roxanaghe has joined #openstack-keystone | 19:33 | |
| *** roxanaghe has quit IRC | 19:34 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Minor docstring fix in mappings.py https://review.openstack.org/358698 | 19:34 |
| *** ddieterly[away] is now known as ddieterly | 19:37 | |
| stevemar | rderose: you can +2 and +W a patch at the same time :P | 19:37 |
| stevemar | rderose: doesn't have to be 2 actions :) | 19:37 |
| *** mfisch has quit IRC | 19:37 | |
| rderose | stevemar: got it ;) | 19:37 |
| breton | stevemar: the big problem with backporting round down patch is that a lot of tests don't expect it. We use freezegun for it in N, but can't do it for Mitaka. | 19:38 |
| rderose | stevemar: is it too late to add PCI release notes? | 19:38 |
| stevemar | rderose: nope, do it up | 19:39 |
| stevemar | rderose: actually... | 19:39 |
| stevemar | rderose: i think that ship has sailed :( | 19:39 |
| rderose | :) | 19:39 |
| breton | stevemar: the workaroind for tests would be to sleep(), but it doesn't sound good. | 19:39 |
| stevemar | rderose: docs would help though! | 19:40 |
| rderose | stevemar: on it! | 19:40 |
| stevemar | breton: why does sleep not sound good? | 19:40 |
| openstackgerrit | Merged openstack/python-keystoneclient: Import module instead of object https://review.openstack.org/369469 | 19:40 |
| *** tonytan_brb has joined #openstack-keystone | 19:41 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 19:41 |
| breton | stevemar: ~10 tests need it. Is adding 10 seconds to unit tests ok? | 19:41 |
| stevemar | breton: should be fine, the unit tests are pretty speedy | 19:43 |
| breton | stevemar: ok then, will push a new patch soon | 19:43 |
| bknudson | please don't add sleeps to unit tests. | 19:43 |
| breton | :) | 19:44 |
| bknudson | this is why we have freezegun and mocking | 19:44 |
| *** tonytan4ever has quit IRC | 19:44 | |
| breton | bknudson: what do you suggest to do in Mitaka? Mock? | 19:44 |
| bknudson | breton: yes. Let's not do something stupid in master because of a problem in mitaka. | 19:45 |
| breton | bknudson: the stupid will be done in Mitaka only | 19:45 |
| bknudson | that's fine. | 19:45 |
| breton | bknudson: master already does the smart way | 19:45 |
| breton | and mitaka cannot into smart way | 19:45 |
| bknudson | were you going to put sleep in mitaka only? I'm fine with that. | 19:46 |
| breton | bknudson: yes. Good. | 19:46 |
| *** artmr has joined #openstack-keystone | 19:52 | |
| *** gyee_ has joined #openstack-keystone | 19:55 | |
| *** gyee has quit IRC | 19:55 | |
| stevemar | bknudson: yes, i wasn't suggesting to put stupid into master. just mitaka since freezegun doesn't exist there yet | 19:56 |
| bknudson | some master tests are strangely slow already... wonder if there isn't a sleep in there somewhere. | 19:56 |
| stevemar | lbragstad rderose dolphm breton: i did an analysis on what is left to complete based on the blueprints that landed in newton, they are at the end of the etherpad here: https://etherpad.openstack.org/p/keystone-newton-retrospective | 20:00 |
| breton | while the tests are running... | 20:00 |
| stevemar | lbragstad rderose dolphm breton would love to get your opinion on these things | 20:00 |
| breton | how does rounding down affect tempest? | 20:01 |
| stevemar | breton: it didn't ? | 20:02 |
| breton | stevemar: i don't know, i am just asking | 20:03 |
| stevemar | breton: ah yeah, it didn't :) | 20:03 |
| breton | i mean, we have to use freezegun in unittests | 20:03 |
| breton | why we don't need to use sleeps in tempest? | 20:03 |
| stevemar | breton: it affected the keystoneclient functional tests, but that was cause the functional tests weren't quite correct | 20:03 |
| lbragstad | breton in the process of making fernet the default we were hitting an issue where tokens would/or wouldn't be invalidated because the revocation event had microsecond precision and the tokens didn't | 20:04 |
| lbragstad | breton and apparently on ubuntu 16.04 mysql will round up instead of truncating | 20:05 |
| lbragstad | s/mysql/mysql or sqlalchemy/ | 20:05 |
| lbragstad | breton which is different behavior than what we've seen in the past with mysql | 20:06 |
| lbragstad | (where extra datetime precision will be truncated before being shoved into mysql) | 20:06 |
| *** artmr has quit IRC | 20:07 | |
| *** catintheroof has quit IRC | 20:08 | |
| breton | lbragstad: stevemar: for example, in https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_assignment.py#L331 we tick to 1 second 2 times. Is skipping a second required in tempest? | 20:09 |
| lbragstad | breton i think in the tempest scenario we don't have complete system control of the clock across all processes(?) | 20:09 |
| lbragstad | someone would have to fact check me on that | 20:10 |
| *** _cjones_ has joined #openstack-keystone | 20:10 | |
| breton | lbragstad: i understand that, but do we need to add sleep(1s) to the scenarios? | 20:10 |
| lbragstad | breton the whole reason for the sleeps is because the underlying implementation of fernet (in the cryptography library) doesn't support microsecond precison | 20:11 |
| lbragstad | for fernet, the token issued at time is generated by the fernet library | 20:11 |
| lbragstad | which uses time.time() but converts it to an int() | 20:12 |
| lbragstad | removing all subsecond precison | 20:12 |
| breton | ok, i'll try to explain another way | 20:12 |
| breton | suppose i am a test writer | 20:13 |
| breton | and i want to implement test_token_revoked_once_group_role_grant_revoked in tempest | 20:13 |
| breton | i create a grant using curl, add user to group, get a token, validate it, delete grant, try to validate again | 20:14 |
| lbragstad | that token will be considered revoked | 20:14 |
| breton | everything happens in less than a second | 20:15 |
| lbragstad | yep | 20:15 |
| breton | will the test work correctly within this second? | 20:15 |
| lbragstad | well - you would want to make sure the token you got in step 3 is revoked | 20:16 |
| lbragstad | but you'll also want to make sure you wait to get into the threshold of a new second | 20:16 |
| lbragstad | to test authentication again | 20:16 |
| lbragstad | if you test authentication within the second the revocation event was stored you'll always get a 401 | 20:16 |
| *** ravelar has quit IRC | 20:16 | |
| lbragstad | (which should be the same behavior as attempted to authenticate with a group you're not it) | 20:17 |
| *** ezpz has joined #openstack-keystone | 20:17 | |
| breton | so if i don't make sure to wait to get into the new second, the test will fail | 20:18 |
| breton | because i think in mirantis we are now hitting this with tempest :( | 20:19 |
| lbragstad | possibly - another part of that is that tempest will attempt to get a new token when auth is cleared or reset | 20:19 |
| lbragstad | so if that is done within the same second as a revocation event - the new token will fail | 20:19 |
| bknudson | keystone doesn't make any assurance that a token that you just got will be valid | 20:20 |
| bknudson | so a test that relies on that will be incorrect | 20:20 |
| breton | bknudson: which token is valid then? | 20:20 |
| bknudson | the only way to tell if a token is valid is to use it. | 20:21 |
| bknudson | and it either works or it doesn't. | 20:21 |
| bknudson | if the token is invalid then get a new one and try again. | 20:21 |
| bknudson | It is strange that keystone would return a token that it should know is invalid. | 20:22 |
| *** ravelar has joined #openstack-keystone | 20:24 | |
| *** wajdi has quit IRC | 20:25 | |
| breton | ok, i think i got it. Thank you! | 20:26 |
| breton | so if stored revocation time == stored token created time, than this token passes, right? And with rounded down datetimes it happens with mysql too? | 20:29 |
| breton | *then | 20:30 |
| lbragstad | breton if the revocation event's issued_before time is the same as the token's issued_at time, keystone will err on the side of security and revoke the token | 20:34 |
| lbragstad | so if you get a token at 10:43.234562 and change your password at 10:43.240000, keystone will consider that token revoked | 20:35 |
| lbragstad | if you attempt to get another token at 10:43.500000 keystone will still consider that token revoked because it was issued within the same second as the revocation event | 20:35 |
| lbragstad | even though it was issued just *slightly* afterwords | 20:35 |
| lbragstad | this is where having to roll into the threshold of a new second matters | 20:36 |
| breton | do we run tempest on fernet? | 20:38 |
| lbragstad | breton devstack has support for fernet but we haven't made the switch ye | 20:38 |
| lbragstad | yet* | 20:38 |
| stevemar | breton: theres a devstack patch to switch to fernet, not merged yet, it has run tempest tests | 20:38 |
| lbragstad | and it all passes | 20:39 |
| breton | we run tempest on fernet and some things dont pass, each time different. Maybe for $mitaka reasons. | 20:41 |
| *** ddieterly is now known as ddieterly[away] | 20:41 | |
| *** gyee_ has quit IRC | 20:44 | |
| edtubill | Hi, I'm trying to get a federated user to do admin things like list projects -can someone help me? I can only get this to work if I set federated_domain_name=Default in keystone.conf. But if that is set during `keystone-manage bootstrap` I get an error during the creation of the Default domain. | 20:45 |
| edtubill | By "list projects" I mean listing them in horizon | 20:45 |
| breton | edtubill: what release is it? | 20:45 |
| edtubill | breton: mitaka | 20:46 |
| breton | edtubill: have you tried putting your user into a group that has admin role on Default domain? | 20:48 |
| breton | actually i don't know how Horizon does this... | 20:48 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Doctor check for LDAP domain specific configs https://review.openstack.org/361435 | 20:50 |
| edtubill | breton: I have an admin role on a project for the group, let me try the domain. | 20:50 |
| edtubill | breton: I tried adding the admin role for the default domain on a group and still no luck :/ | 20:54 |
| *** roxanaghe has joined #openstack-keystone | 20:54 | |
| stevemar | anyone want to take on removing PKI and write support for LDAP :) | 20:59 |
| stevemar | and/or | 20:59 |
| stevemar | hehe | 20:59 |
| stevemar | unwinding that mess is going to take a loooong time | 20:59 |
| breton | edtubill: you should figure out how Horizon tries to fetch list of projects. In Mitaka, projects are stored in domains and in your case they probably are in Default domain. I don't know how Horizon does things when you are in domain A and you want to list things in domain B. Maybe #openstack-horizon know this :) | 21:00 |
| breton | stevemar: i'd like to do the pki stuff | 21:00 |
| stevemar | breton: sure, good choice ;) | 21:01 |
| david-lyle | https://github.com/openstack/django_openstack_auth/blob/master/openstack_auth/plugin/base.py#L86 | 21:01 |
| knikolla | define: write support for LDAP | 21:01 |
| stevemar | breton: i think it's the more manageable one | 21:01 |
| stevemar | knikolla: delete/create/update for user/group | 21:01 |
| stevemar | they are both slated to be removed in O | 21:01 |
| knikolla | oh remove those, right | 21:01 |
| edtubill | @breton: thx for the help, I'm gonna to also check if a federated Admin user has the same issues on the CLI. | 21:06 |
| *** ddieterly[away] is now known as ddieterly | 21:07 | |
| stevemar | knikolla: regarding https://review.openstack.org/#/c/320623/ -- whats holding that one up from becoming non-WIP | 21:07 |
| stevemar | knikolla: anything I can help with? do you need a new infra job? | 21:08 |
| knikolla | stevemar: tere is a todo in the commit message saying it needs more testing. | 21:08 |
| knikolla | stevemar: running stack.sh with many possible values takes a long time and it's a boring job | 21:09 |
| stevemar | :) | 21:09 |
| *** pauloewerton has quit IRC | 21:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/374338 | 21:10 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/374335 | 21:12 |
| * stevemar pokes dolphm to look at https://review.openstack.org/#/c/374245/ for stable | 21:12 | |
| breton | how can test_list_users_filtered_by_funny_name fail in https://review.openstack.org/#/c/374245/ | 21:13 |
| stevemar | breton: thats funny | 21:14 |
| stevemar | breton: at least test_revoked_token_in_list is a real failure | 21:14 |
| stevemar | not sure why you are getting 401s for other tests | 21:15 |
| breton | stevemar: already fixed that one. But how could test_list_users_filtered_by_funny_name fail? | 21:15 |
| stevemar | breton: no idea | 21:15 |
| knikolla | stevemar: for the devstack plugin, i'll give it a few more spins this week, remove the WIP, and add it to next weeks agenda. sounds good? | 21:15 |
| stevemar | knikolla: sounds fantastic | 21:16 |
| breton | pdb it is then! | 21:16 |
| stevemar | breton: feeling better today? | 21:16 |
| *** itsuugo has quit IRC | 21:16 | |
| * stevemar forgot he had a tea and now it's called | 21:17 | |
| stevemar | cold* | 21:17 |
| breton | stevemar: yep! | 21:17 |
| stevemar | breton: great 2 hear | 21:17 |
| *** itsuugo has joined #openstack-keystone | 21:17 | |
| breton | aaaand it passes with pdb. | 21:18 |
| knikolla | stevemar: btw, i'll take the remove ldap write support. i should be able to devote more time to keystone in this ocata cycle. | 21:20 |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/374334 | 21:20 |
| *** rcernin has quit IRC | 21:24 | |
| *** wasmum has joined #openstack-keystone | 21:24 | |
| stevemar | breton: recheck :) | 21:25 |
| stevemar | knikolla: sounds good, i took a hack at it on a flight... if i find that change, want me to post it? | 21:25 |
| stevemar | knikolla: it probably needs work to make the tests pass | 21:25 |
| stevemar | i dont remember if i stashed the change or not | 21:26 |
| *** ngupta has quit IRC | 21:29 | |
| *** ngupta has joined #openstack-keystone | 21:30 | |
| *** itsuugo has quit IRC | 21:31 | |
| bknudson | I added timing of the memcache call when doing validate_token: http://paste.openstack.org/show/582470/ | 21:31 |
| bknudson | funny thing is, here the memcache calls takes longer than the sql call. | 21:31 |
| *** itsuugo has joined #openstack-keystone | 21:32 | |
| bknudson | still hard to tell if the memcache call takes a long time because of reading data or parsing it... | 21:32 |
| *** ngupta has quit IRC | 21:35 | |
| *** ngupta has joined #openstack-keystone | 21:36 | |
| *** edmondsw has quit IRC | 21:40 | |
| *** itsuugo has quit IRC | 21:42 | |
| *** itsuugo has joined #openstack-keystone | 21:42 | |
| *** esp has quit IRC | 21:43 | |
| *** esp has joined #openstack-keystone | 21:43 | |
| *** ig0r_ has quit IRC | 21:45 | |
| bknudson | I'm not seeing an obvious way to get the time to deserialize... putting a timer in msgpackutils.py.loads() winds up logging so much... I think it's recursive. | 21:50 |
| *** itsuugo has quit IRC | 21:55 | |
| *** haplo37__ has quit IRC | 21:55 | |
| *** itsuugo has joined #openstack-keystone | 21:56 | |
| *** roxanaghe has quit IRC | 21:56 | |
| *** roxanaghe has joined #openstack-keystone | 21:56 | |
| *** edtubill has quit IRC | 21:59 | |
| *** ezpz has quit IRC | 22:00 | |
| *** itsuugo has quit IRC | 22:01 | |
| *** srobert has quit IRC | 22:01 | |
| *** itsuugo has joined #openstack-keystone | 22:02 | |
| *** ddieterly is now known as ddieterly[away] | 22:03 | |
| knikolla | stevemar: sounds great. ping me if you find it. | 22:05 |
| *** spedione is now known as spedione|AWAY | 22:08 | |
| stevemar | dolphm: sorry about the false alarm | 22:09 |
| *** ravelar has quit IRC | 22:09 | |
| dolphm | stevemar: p.s. i'll be out tomorrow afternoon through next tuesday | 22:10 |
| *** itsuugo has quit IRC | 22:10 | |
| *** itsuugo has joined #openstack-keystone | 22:10 | |
| bknudson | we're going to have to dock your pay | 22:11 |
| *** adriant has joined #openstack-keystone | 22:12 | |
| *** timburke has quit IRC | 22:16 | |
| *** ravelar has joined #openstack-keystone | 22:16 | |
| *** timburke has joined #openstack-keystone | 22:16 | |
| *** spzala has quit IRC | 22:20 | |
| *** lamt has quit IRC | 22:20 | |
| *** adrian_otto has joined #openstack-keystone | 22:20 | |
| *** spzala has joined #openstack-keystone | 22:20 | |
| *** ddieterly[away] is now known as ddieterly | 22:21 | |
| *** itsuugo has quit IRC | 22:21 | |
| *** ngupta has quit IRC | 22:23 | |
| *** ngupta has joined #openstack-keystone | 22:23 | |
| *** itsuugo has joined #openstack-keystone | 22:23 | |
| *** spzala has quit IRC | 22:25 | |
| *** adrian_otto has quit IRC | 22:25 | |
| *** ngupta has quit IRC | 22:28 | |
| *** slberger has left #openstack-keystone | 22:28 | |
| *** adrian_otto has joined #openstack-keystone | 22:28 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add docs for PCI-DSS https://review.openstack.org/374422 | 22:31 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add docs for PCI-DSS https://review.openstack.org/374422 | 22:32 |
| stevemar | bknudson: do you mind looking at the backport then? https://review.openstack.org/#/c/374245/ | 22:32 |
| stevemar | bknudson: hopefully you don't find an issue with the original :( | 22:32 |
| bknudson | stevemar: I'll add it to my list | 22:33 |
| stevemar | bknudson: how long is the list now? | 22:33 |
| bknudson | I don't have much reason to care about stable anymore since we run off master. | 22:33 |
| stevemar | bknudson: i can remove you as a stable reviewer if you'd like? :P | 22:34 |
| bknudson | maybe I can get back to more upstream work in the near future. | 22:34 |
| breton | stevemar: still to early to review. Tests fail on second-third run, so i fix them when they do, and use gates to catch them faster | 22:38 |
| *** ddieterly has quit IRC | 22:40 | |
| *** markvoelker has quit IRC | 22:43 | |
| openstackgerrit | Merged openstack/keystone: Handle the exception from creating request token properly https://review.openstack.org/361087 | 22:45 |
| openstackgerrit | Merged openstack/keystone: Consolidate the common code into one method https://review.openstack.org/374043 | 22:45 |
| stevemar | breton: dang, tough one to backport | 22:46 |
| breton | stevemar: actually i figured it out | 22:46 |
| breton | stevemar: i just need to put sleep() everywhere where it's tick() in master | 22:47 |
| stevemar | breton: that makes sense | 22:47 |
| *** adrian_otto has quit IRC | 22:47 | |
| *** ngupta has joined #openstack-keystone | 22:50 | |
| *** itsuugo has quit IRC | 22:51 | |
| *** itsuugo has joined #openstack-keystone | 22:52 | |
| *** roxanaghe has quit IRC | 22:54 | |
| *** itsuugo has quit IRC | 22:57 | |
| *** _cjones_ has quit IRC | 22:57 | |
| *** itsuugo has joined #openstack-keystone | 22:58 | |
| breton | stevemar: ok, now it's good to review. All unit tests passed, functional are in progress. | 22:58 |
| stevemar | yeehaw | 22:59 |
| stevemar | bknudson: you too, if possible, otherwise i can ask notmorgan :) | 23:00 |
| stevemar | thanks for the hard work breton | 23:00 |
| *** itsuugo has quit IRC | 23:02 | |
| *** mvk has joined #openstack-keystone | 23:04 | |
| *** jamielennox is now known as jamielennox|away | 23:04 | |
| *** itsuugo has joined #openstack-keystone | 23:04 | |
| *** asettle has joined #openstack-keystone | 23:04 | |
| stevemar | breton: i'm going to mark this as invalid: https://bugs.launchpad.net/keystone/+bug/1624109 do you agree? | 23:05 |
| openstack | Launchpad bug 1624109 in OpenStack Identity (keystone) "keystone-manage fernet_setup fails silently" [Undecided,New] | 23:05 |
| *** roxanaghe has joined #openstack-keystone | 23:07 | |
| stevemar | breton: hehe, if we backport the rounding fix, we'll have to backport the functional test fix too (remove auth tests) | 23:07 |
| *** asettle has quit IRC | 23:09 | |
| breton | stevemar: yes, please mark as invalid | 23:09 |
| *** itsuugo has quit IRC | 23:10 | |
| breton | stevemar: right. Will do now. | 23:10 |
| *** hoonetorg has quit IRC | 23:10 | |
| stevemar | breton: no worries, i can do that, i left comments on your patch | 23:10 |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/374338 | 23:11 |
| *** itsuugo has joined #openstack-keystone | 23:11 | |
| *** ngupta has quit IRC | 23:13 | |
| stevemar | breton: ah, actually we won't need to backport the ksc functional test fix -- the failing tests aren't there ;) | 23:13 |
| *** roxanaghe has quit IRC | 23:13 | |
| *** ngupta has joined #openstack-keystone | 23:13 | |
| breton | stevemar: do we need to backport them to stable/newton? | 23:15 |
| *** itsuugo has quit IRC | 23:16 | |
| *** itsuugo has joined #openstack-keystone | 23:17 | |
| *** Marcellin__ has quit IRC | 23:17 | |
| *** ngupta has quit IRC | 23:18 | |
| *** roxanaghe has joined #openstack-keystone | 23:19 | |
| *** itsuugo has quit IRC | 23:22 | |
| *** itsuugo has joined #openstack-keystone | 23:22 | |
| stevemar | breton: probably... | 23:25 |
| bknudson | this is somewhat interesting: http://paste.openstack.org/show/582483/ | 23:26 |
| bknudson | 1st call for list_events goes to the db | 23:26 |
| bknudson | 2nd goes to memcache | 23:26 |
| bknudson | 3rd uses context cache | 23:26 |
| bknudson | why didn't the 2nd one use the context cache? | 23:27 |
| breton | is this from some patch? where do you see this? | 23:27 |
| bknudson | breton: this is using master keystone. I added timing statements | 23:27 |
| stevemar | breton: lets see if https://review.openstack.org/#/c/374445/ fails | 23:29 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change python code revocation search to sql https://review.openstack.org/359371 | 23:29 |
| bknudson | maybe the request context gets reset. | 23:31 |
| *** itsuugo has quit IRC | 23:32 | |
| *** itsuugo has joined #openstack-keystone | 23:34 | |
| * stevemar needs food | 23:36 | |
| *** jamielennox|away is now known as jamielennox | 23:43 | |
| *** lamt has joined #openstack-keystone | 23:43 | |
| *** markvoelker has joined #openstack-keystone | 23:44 | |
| jamielennox | howdy keystone, is everything broken today? | 23:44 |
| jamielennox | rodrigods: great job on the ksc functional tests | 23:44 |
| *** itsuugo has quit IRC | 23:46 | |
| stevemar | jamielennox: things are less broken today | 23:47 |
| stevemar | jamielennox: can you punt https://review.openstack.org/#/c/374284/ through? | 23:47 |
| *** itsuugo has joined #openstack-keystone | 23:47 | |
| *** lamt has quit IRC | 23:47 | |
| stevemar | jamielennox: also, etherpads to fill in: https://etherpad.openstack.org/p/keystone-ocata-summit-brainstorm and https://etherpad.openstack.org/p/keystone-newton-retrospective | 23:48 |
| jamielennox | stevemar: that got merged? | 23:48 |
| jamielennox | stevemar: oh, no this is for the ocata release right? | 23:48 |
| stevemar | right | 23:48 |
| stevemar | the bandaid went into newton | 23:48 |
| *** markvoelker has quit IRC | 23:49 | |
| jamielennox | ok so master is open again? | 23:49 |
| stevemar | jamielennox: wide open | 23:49 |
| jamielennox | woohoo | 23:49 |
| stevemar | jamielennox: please don't blow things up | 23:49 |
| jamielennox | whaaa, i wouldn't... well.. i have... but | 23:49 |
| jamielennox | but it means i can start looking at the context changes again | 23:50 |
| bknudson | the RequestContext doesn't actually last the whole request | 23:52 |
| bknudson | one gets created when the token is validated and some stuff is read from cache | 23:52 |
| bknudson | then another one gets created by keystone/middleware/auth.py(166)fill_context() which replaces the first one | 23:53 |
| jamielennox | bknudson: what is the first one created before middleware/auth? | 23:53 |
| jamielennox | the only time i can think that might happen twice is the jsonhome stuff which loops you through the wsgi stack again | 23:53 |
| jamielennox | (which we should either fix or remove) | 23:53 |
| bknudson | jamielennox: it's created here: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/cache/_context_cache.py#n37 | 23:54 |
| jamielennox | also i _hate_ that oslo.context as a library decided that it was ok to save itself to thread local on __init__ and don't trust it at all | 23:54 |
| bknudson | keystone is getting stuff from the cache... probably to validate the token | 23:54 |
| jamielennox | gah, ok, why is it doing that? | 23:55 |
| *** itsuugo has quit IRC | 23:55 | |
| bknudson | the first context is created by a call to /home/vagrant/keystone/keystone/middleware/auth.py(58)fetch_token() | 23:55 |
| jamielennox | so get_current() should/might work | 23:56 |
| *** itsuugo has joined #openstack-keystone | 23:56 | |
| bknudson | fill_context creates a new RequestContext() so it's going to replace the one that was created earlier | 23:56 |
| jamielennox | it's very unlikely that get_current returns None - however it may return the context from the last request if you call it incorrectly | 23:57 |
| bknudson | it'll be None the first time in the thread. | 23:57 |
| bknudson | I hope | 23:57 |
| jamielennox | yep | 23:57 |
| jamielennox | but middleware/auth should be resetting RequestContext because that is basically the entrypoint for alll requests into keysotne | 23:58 |
| bknudson | it's doing "return oslo_context.get_current() or oslo_context.RequestContext()" and "oslo_context/context.py(114)__init__()" | 23:58 |
| bknudson | so I assume get_current() there returned None | 23:58 |
| jamielennox | right, but as much as i hate get_current this must be called after middleware/auth and so the context it fetches should be correct right? | 23:59 |
| bknudson | y, but it's throwing away the little bit of work that happened | 23:59 |
| bknudson | and it's not a little bit of work either... getting the list of revocation events takes most of the time of validation | 23:59 |
| bknudson | for some reason there are 3 calls to list_events on token validate | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!