| *** guoshan has joined #openstack-keystone | 00:01 | |
| *** guoshan has quit IRC | 00:06 | |
| *** harlowja has joined #openstack-keystone | 00:06 | |
| *** haplo37_ has quit IRC | 00:25 | |
| *** haplo37_ has joined #openstack-keystone | 00:27 | |
| ayoung | stevemar, morgan kindof embarrasing when Keystone can't do Policy correctly. CAn we bump this one on https://review.openstack.org/#/c/371856/ | 00:29 |
|---|---|---|
| *** browne has quit IRC | 00:30 | |
| ayoung | rderose, you can do that too. i'm here to answer questions, but jamielennox has made Sisyphus look like a shirker here. | 00:30 |
| jamielennox | :) | 00:31 |
| jamielennox | did the nova policy patch merge? | 00:31 |
| ayoung | jamielennox, no, still arguing that one | 00:32 |
| ayoung | but it will | 00:32 |
| ayoung | functional tests are also fussy there | 00:33 |
| r1chardj0n3s | huh, I've been banging my head on keystone's v3 sample policy file, trying to figure out where some of the values come from, and then I see that patch "Fixing keystone's policy dict is going to be a big effort" :-D | 00:34 |
| jamielennox | https://review.openstack.org/#/c/295371/ and https://review.openstack.org/#/c/370499/ are the next ones to look at | 00:34 |
| david-lyle | r1chardj0n3s: what values? | 00:34 |
| david-lyle | one you have to set | 00:35 |
| *** xek_ has quit IRC | 00:35 | |
| *** robcresswell has quit IRC | 00:35 | |
| jamielennox | keystone flattens the entire user token data and drops it into policy | 00:35 |
| r1chardj0n3s | there's these two lines, for example: | 00:35 |
| r1chardj0n3s | "admin_and_matching_target_project_domain_id": "rule:admin_required and domain_id:%(target.project.domain_id)s", | 00:35 |
| r1chardj0n3s | "admin_and_matching_project_domain_id": "rule:admin_required and domain_id:%(project.domain_id)s", | 00:35 |
| *** xek_ has joined #openstack-keystone | 00:35 | |
| jamielennox | this is a PITA for a number of reasons like the data format is very different between v2 and v3 tokens | 00:35 |
| r1chardj0n3s | I understand that the first one comes from target, that's easy, it's the flattened dict, but I don't know what the second "project.domain_id" is | 00:36 |
| r1chardj0n3s | I've been working thru the keystone source, but can't see how that makes it into the policy dict | 00:36 |
| *** robcresswell has joined #openstack-keystone | 00:37 | |
| *** jlk has quit IRC | 00:37 | |
| ayoung | r1chardj0n3s, i kinda want to kill that sample policy file | 00:38 |
| *** jlk has joined #openstack-keystone | 00:38 | |
| *** jlk has quit IRC | 00:38 | |
| *** jlk has joined #openstack-keystone | 00:38 | |
| r1chardj0n3s | ayoung: lol, but it's all we've got! :-) | 00:38 |
| ayoung | r1chardj0n3s, let me fix the standard policy first.... | 00:39 |
| r1chardj0n3s | for some background, I'm coming from the perspective of a Horizon dev who's been told "Horizon is buggy because SSO federated domain admins can't admin projects in their domain..". and I'm having to learn what pretty much every word in that problem statement means (well, except the "Horizon is buggy" bit ;-) | 00:40 |
| r1chardj0n3s | so far I think I've determined that I'm pretty sure SSO federated logins *can't* have additional domains associated with their login... | 00:41 |
| r1chardj0n3s | but I was also looking into whether Horizon was mis-applying policies, but I couldn't figure out what the policy was actually saying ;-) | 00:42 |
| *** david-lyle_ has joined #openstack-keystone | 00:42 | |
| *** gagehugo has quit IRC | 00:42 | |
| r1chardj0n3s | (that's federated logins can't have domains other than the ephemeral "Federated" domain associated with them) | 00:42 |
| ayoung | r1chardj0n3s, I'll help you on that | 00:42 |
| r1chardj0n3s | \o/ | 00:42 |
| *** david-lyle has quit IRC | 00:45 | |
| *** gyee has quit IRC | 00:46 | |
| ayoung | r1chardj0n3s, let me get policy straight for the default cases first. We're close... | 00:47 |
| r1chardj0n3s | ayoung: yup | 00:47 |
| r1chardj0n3s | ayoung: if there's anything I can do in the interim, pls lemme know | 00:49 |
| *** spzala has quit IRC | 00:50 | |
| *** tqtran has quit IRC | 00:51 | |
| *** mnaser has quit IRC | 00:51 | |
| *** afazekas_ has quit IRC | 00:51 | |
| *** hoangcx has joined #openstack-keystone | 00:53 | |
| *** browne has joined #openstack-keystone | 00:59 | |
| jamielennox | ksa release? | 01:07 |
| jamielennox | excellent, solves those patches we missed last time | 01:08 |
| *** dflorea has quit IRC | 01:11 | |
| *** guoshan has joined #openstack-keystone | 01:14 | |
| *** zhugaoxiao has joined #openstack-keystone | 01:16 | |
| stevemar | dolphm or morgan: can you look https://review.openstack.org/#/c/386236/ its for stable/mitaka | 01:24 |
| *** davechen has joined #openstack-keystone | 01:28 | |
| *** browne has quit IRC | 01:29 | |
| *** spzala has joined #openstack-keystone | 01:30 | |
| *** jamielennox is now known as jamielennox|away | 01:30 | |
| rderose | ayoung: around? | 01:30 |
| *** afazekas has joined #openstack-keystone | 01:31 | |
| openstackgerrit | George Tian proposed openstack/keystone: Code cleanup https://review.openstack.org/384798 | 01:33 |
| ayoung | rderose, siepmre | 01:33 |
| *** mnaser has joined #openstack-keystone | 01:33 | |
| *** mnaser has quit IRC | 01:35 | |
| *** mnaser has joined #openstack-keystone | 01:35 | |
| rderose | ayoung: were you referring to https://review.openstack.org/#/c/371856/? | 01:35 |
| ayoung | rderose, yep | 01:36 |
| ayoung | rderose, here's the summary | 01:36 |
| ayoung | everything is broken now | 01:36 |
| rderose | ayoung: okay, looking at it now | 01:36 |
| rderose | everything? | 01:36 |
| rderose | :) | 01:36 |
| ayoung | we honor that brokeness, but provide a way to fix it | 01:36 |
| ayoung | rderose, adminess is broken | 01:36 |
| ayoung | but we can't break everyone's tests to fix it | 01:36 |
| ayoung | so we fix by inches | 01:37 |
| ayoung | in this case, we provide a truely 'orrible 'ack | 01:37 |
| *** spzala has quit IRC | 01:37 | |
| *** jamielennox|away is now known as jamielennox | 01:37 | |
| *** spzala has joined #openstack-keystone | 01:37 | |
| ayoung | namely, if the keystone server does not provide a field is_admin_project, the context defaults it to true | 01:37 |
| ayoung | so everything that was checking for admin in the past is still admin | 01:38 |
| ayoung | this workas everywhere but keystione, becuase keystone never actually passes the value from context to the policy engine during the check | 01:38 |
| *** wangqun has joined #openstack-keystone | 01:38 | |
| ayoung | this change only passes the value in...its a short term fix but essential | 01:38 |
| *** jaosorior has quit IRC | 01:40 | |
| *** jaosorior has joined #openstack-keystone | 01:40 | |
| rderose | ayoung: I see | 01:40 |
| *** spzala has quit IRC | 01:42 | |
| rderose | ayoung: needs a rebase | 01:42 |
| rderose | token model no longer checks for v3: if self.version is V3: | 01:42 |
| rderose | https://review.openstack.org/#/c/371856/3/keystone/models/token_model.py | 01:42 |
| rderose | https://github.com/openstack/keystone/blob/master/keystone/models/token_model.py | 01:43 |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project to policy dict https://review.openstack.org/371856 | 01:53 |
| ayoung | jamielennox, can you cover those changes, so I can still approve? | 01:55 |
| ayoung | I did the auto rebase, but not the code | 01:55 |
| *** sdake_ is now known as sdake | 02:01 | |
| r1chardj0n3s | omg ayoung that patch points to the bit I was missing re policy vars, nice timing :-) | 02:01 |
| *** adrian_otto has joined #openstack-keystone | 02:16 | |
| openstackgerrit | melissaml proposed openstack/oslo.policy: Change assertTrue(isinstance()) by optimal assert https://review.openstack.org/386309 | 02:18 |
| *** ayoung_ has joined #openstack-keystone | 02:21 | |
| *** ayoung has quit IRC | 02:21 | |
| jamielennox | ayoung_: sorry what? | 02:23 |
| ayoung_ | jamielennox, I think rderose had legit comments on https://review.openstack.org/#/c/371856/ | 02:24 |
| openstackgerrit | melissaml proposed openstack/keystone: Fix a typo in token_formatters.py https://review.openstack.org/386310 | 02:24 |
| jamielennox | oh o, what have you done! | 02:24 |
| jamielennox | :) | 02:24 |
| ayoung_ | namely, we changed TOkenModel out from underneath your | 02:24 |
| *** ayoung_ is now known as ayoung | 02:25 | |
| *** iurygregory_ has quit IRC | 02:26 | |
| *** maticue has quit IRC | 02:26 | |
| jamielennox | no worries, i can fix that up quick | 02:27 |
| ayoung | jamielennox, I was wondering why I had 900+ unit tests failing when I started testing is_admin_project=True. | 02:27 |
| ayoung | I need to rebase on this patch... | 02:27 |
| ayoung | But nova first | 02:27 |
| openstackgerrit | Jamie Lennox proposed openstack/keystone: Add is_admin_project to policy dict https://review.openstack.org/371856 | 02:32 |
| jamielennox | ayoung: ^ | 02:33 |
| ayoung | TYVM | 02:33 |
| *** adrian_otto has quit IRC | 02:40 | |
| ayoung | jamielennox, brings it down to 103 Failuers :/ | 02:44 |
| jamielennox | keystone unit tests? | 02:44 |
| jamielennox | ayoung: i'll admit i didn't run the whole thing, but it passed a bunch and it passed the new ones i added so i let the gate do the rest | 02:45 |
| ayoung | jamielennox, I'll dig. Your patch or mine, it needs to be fixed, but I doubt yours broke the trusts policy check... | 02:45 |
| jamielennox | i wouldnt think so, no | 02:46 |
| *** adrian_otto has joined #openstack-keystone | 02:47 | |
| openstackgerrit | George Tian proposed openstack/keystone: Code cleanup https://review.openstack.org/384798 | 02:57 |
| *** adrian_otto has quit IRC | 02:57 | |
| *** guoshan has quit IRC | 02:57 | |
| *** guoshan has joined #openstack-keystone | 03:03 | |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 03:04 |
| ayoung | jamielennox, I figured that service role policies should also be in the admin project | 03:05 |
| ayoung | jamielennox, before I go crazy working out the tests, take a look and see if the policies I am setting there are sane, please. | 03:06 |
| jamielennox | ayoung: i'm not sure what you mean | 03:06 |
| ayoung | jamielennox, in that review I just posted on top of yours | 03:07 |
| ayoung | https://review.openstack.org/#/c/257636/4/etc/policy.json | 03:07 |
| jamielennox | ayoung: i don't think you need the services in the admin project | 03:08 |
| ayoung | jamielennox, yes you do. Otherwise, we can't let projects assign their own roles | 03:09 |
| jamielennox | i'm not sure where else you put them, but because most read ops only need any role in a project giving service in the admin project is a fair bit of power | 03:09 |
| jamielennox | projects assign their own roles? | 03:09 |
| ayoung | anyone anywhere could assign a user the service role. That is supposed to be reserved for Nova, Glance, etc | 03:09 |
| ayoung | jamielennox, that is the goal here | 03:09 |
| ayoung | to let a project admin be able to assign any roles to their users | 03:10 |
| ayoung | otherwise, role assignment becomes something only the cloud_admin can do, and that does not scale | 03:10 |
| jamielennox | yea, we don't have the rbac thing of who can assign what | 03:13 |
| jamielennox | or even you can only delegate what you ahve | 03:13 |
| jamielennox | ayoung: so i'm still not sure you should make that change in the default policy file | 03:13 |
| ayoung | yeah, I know. But still Service role is supposed to be a lower level administrative priv, so it should be on an admin project. | 03:13 |
| jamielennox | most people assign a service project somewhere with nothing in it | 03:14 |
| ayoung | could make it a separate commit and we can fight over it there if you want | 03:14 |
| jamielennox | well so the issue will be things like devstack, when we turn on the admin project check ( i think we have already) you'll break everyone | 03:15 |
| jamielennox | cause the services aren't typically given roles on the admin project | 03:15 |
| ayoung | K | 03:15 |
| ayoung | we can punt on it for now | 03:15 |
| jamielennox | yea, we can discuss, but for getting this patch through i'd leave it out | 03:15 |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 03:15 |
| ayoung | I think we can make multiple projects into admin projects. That was one thing morgan had requested when we did this | 03:16 |
| jamielennox | ayoung: ha, i think i said that as well but was told we only need 1 | 03:16 |
| jamielennox | and i think i'm ok with only one | 03:17 |
| jamielennox | but there's no reason you couldn't force a similar thing | 03:17 |
| *** nicolasbock has quit IRC | 03:17 | |
| jamielennox | role:service project_id:XXX | 03:17 |
| ayoung | jamielennox, yep, it is a stropt | 03:19 |
| jamielennox | what's the advantage of multiple? | 03:21 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone-specs: Add reason to notifications for PCI-DSS events https://review.openstack.org/381302 | 03:35 |
| *** spzala has joined #openstack-keystone | 03:38 | |
| *** spzala has quit IRC | 03:43 | |
| *** tqtran has joined #openstack-keystone | 03:46 | |
| *** links has joined #openstack-keystone | 03:59 | |
| *** guoshan has quit IRC | 04:05 | |
| *** guoshan has joined #openstack-keystone | 04:05 | |
| *** dikonoo has joined #openstack-keystone | 04:08 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Move the token abstract base class out of core https://review.openstack.org/386102 | 04:09 |
| *** guoshan has quit IRC | 04:10 | |
| *** tqtran has quit IRC | 04:14 | |
| *** tqtran has joined #openstack-keystone | 04:17 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 04:26 |
| *** GB21 has joined #openstack-keystone | 04:28 | |
| *** GB21 has quit IRC | 04:32 | |
| stevemar | jamielennox: any additional changes to KSM for allow-expired? | 04:35 |
| stevemar | jamielennox: or you want me to release a new version of that now and we can get testing? | 04:35 |
| jamielennox | stevemar: ksm has a couple and will probably be last | 04:36 |
| jamielennox | ksm needs ksc needs k | 04:36 |
| jamielennox | s | 04:36 |
| jamielennox | what's happening with https://review.openstack.org/#/c/379035/ - the change it depends-on is merged and it has +A | 04:38 |
| *** david-lyle_ has quit IRC | 04:39 | |
| stevemar | jamielennox: it needs a kick in the pants? | 04:39 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Ignore unknown arguments to fetch_token https://review.openstack.org/379035 | 04:39 |
| jamielennox | oh, it's merged? | 04:39 |
| stevemar | nope | 04:39 |
| jamielennox | it says it's merged but it's still sitting in my queue | 04:39 |
| *** david-lyle has joined #openstack-keystone | 04:39 | |
| jamielennox | oh, o - Change has been successfully merged into the git repository by Jenkins | 04:39 |
| jamielennox | probably should report that to infra | 04:40 |
| stevemar | jamielennox: so... you want me to release ksm or not? | 04:40 |
| stevemar | that was weird | 04:40 |
| openstackgerrit | jian.song proposed openstack/keystone: Remove max-length in saml.py https://review.openstack.org/386329 | 04:41 |
| jamielennox | stevemar: nope -it's in the tree, it's just still hanging out as open in gerrit | 04:42 |
| jamielennox | stevemar: so i don't see anything in there that is worth releasing for | 04:43 |
| jamielennox | stevemar: but if you want it i don't mind | 04:44 |
| stevemar | jamielennox: i figure you needed a new ksm for the allow-expiry work? | 04:44 |
| *** GB21 has joined #openstack-keystone | 04:44 | |
| jamielennox | stevemar: nah, the keystone stuff can happen before that | 04:45 |
| stevemar | jamielennox: weird, i'll push for one anyway, it'll be good to get one before the summit | 04:46 |
| stevemar | otherwise we're likely to go a few weeks without a release | 04:46 |
| jamielennox | stevemar: oh, i put a depends-on from the keystone patch to the keystonemiddleware one | 04:46 |
| jamielennox | stevemar: that was safe, but we don't really need it because the whole point is it has to be compatible with old and new versions | 04:47 |
| jamielennox | so the keystone patches can go in without waiting for auth_token middleare | 04:47 |
| jamielennox | it's just if someone wanted to rename the variable or something we didn't want to merge the keystone one first | 04:47 |
| stevemar | jamielennox: right, i'm just trying to bump the minimum version of ksm needed for ocata -- just trying to be aggresive about it | 04:48 |
| *** jaosorior has quit IRC | 04:49 | |
| jamielennox | stevemar: i wouldn't worry about it, there's nothing in master we need and there will be stuff we want when all this allow_expired stuff actually lands | 04:49 |
| stevemar | jamielennox: alrighty | 04:50 |
| jamielennox | years of openstack later i still have nfi what to do when i get "No valid host was found." | 04:52 |
| jamielennox | how is there still no debug info for that | 04:52 |
| stevemar | haha | 04:52 |
| *** guoshan has joined #openstack-keystone | 05:20 | |
| *** sdake has quit IRC | 05:23 | |
| *** guoshan has quit IRC | 05:25 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Update code to use Newton as the code name https://review.openstack.org/368707 | 05:25 |
| *** davechen1 has joined #openstack-keystone | 05:30 | |
| *** davechen has quit IRC | 05:33 | |
| *** richm has quit IRC | 05:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/386377 | 05:43 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient-kerberos: Updated from global requirements https://review.openstack.org/373686 | 05:43 |
| *** sheel has joined #openstack-keystone | 05:45 | |
| openstackgerrit | Merged openstack/keystone: Move the token abstract base class out of core https://review.openstack.org/386102 | 05:48 |
| openstackgerrit | iswarya vakati proposed openstack/keystone: Drop MANIFEST.in - it's not needed by pbr https://review.openstack.org/386384 | 05:50 |
| *** tqtran has quit IRC | 05:52 | |
| *** woodster_ has quit IRC | 05:55 | |
| jamielennox | stevemar: lol, i don't mean to laugh but you got the wrong keystoneauth version: https://review.openstack.org/#/c/386135/ | 05:59 |
| jamielennox | stevemar: your message says 2.14, your code says 2.13 | 06:00 |
| *** tqtran has joined #openstack-keystone | 06:11 | |
| *** guoshan has joined #openstack-keystone | 06:11 | |
| *** adriant has quit IRC | 06:13 | |
| stevemar | jamielennox: lol | 06:13 |
| stevemar | jamielennox: that is laugh worthy | 06:13 |
| stevemar | jamielennox: resurrect https://review.openstack.org/#/c/386295/ ? | 06:14 |
| jamielennox | meh - i don't care who does it | 06:14 |
| jamielennox | but yea, i can | 06:15 |
| *** nkinder has quit IRC | 06:18 | |
| jamielennox | stevemar: restored and rebased | 06:18 |
| stevemar | jamielennox: thanks! can't believe i made that mistake :) | 06:18 |
| *** Zer0Byte__ has quit IRC | 06:19 | |
| *** Zer0Byte__ has joined #openstack-keystone | 06:21 | |
| *** guoshan_ has joined #openstack-keystone | 06:22 | |
| *** pcaruana has joined #openstack-keystone | 06:23 | |
| *** guoshan has quit IRC | 06:25 | |
| *** guoshan has joined #openstack-keystone | 06:26 | |
| *** guoshan_ has quit IRC | 06:26 | |
| *** Zer0Byte__ has quit IRC | 06:30 | |
| openstackgerrit | Merged openstack/keystone: Ignore unknown arguments to fetch_token https://review.openstack.org/379035 | 06:30 |
| *** spzala has joined #openstack-keystone | 06:38 | |
| openstackgerrit | Merged openstack/keystone: Return password_expires_at during auth https://review.openstack.org/367008 | 06:42 |
| *** spzala has quit IRC | 06:42 | |
| *** asettle has joined #openstack-keystone | 07:01 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/386363 | 07:01 |
| *** asettle has quit IRC | 07:02 | |
| openstackgerrit | George Tian proposed openstack/keystone: Remove unused arg(project and initiator) https://review.openstack.org/386413 | 07:03 |
| *** tesseract- has joined #openstack-keystone | 07:05 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/386377 | 07:12 |
| *** srihitha_ has quit IRC | 07:13 | |
| *** bjolo has quit IRC | 07:17 | |
| *** bjolo has joined #openstack-keystone | 07:18 | |
| *** rcernin has joined #openstack-keystone | 07:20 | |
| *** amoralej|off is now known as amoralej | 07:27 | |
| *** tqtran has quit IRC | 07:35 | |
| *** namnh has joined #openstack-keystone | 07:55 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:03 | |
| *** zhugaoxiao has quit IRC | 08:16 | |
| *** zhugaoxiao has joined #openstack-keystone | 08:16 | |
| *** jaosorior has joined #openstack-keystone | 08:19 | |
| *** asettle has joined #openstack-keystone | 08:23 | |
| *** tqtran has joined #openstack-keystone | 08:32 | |
| *** davechen1 has left #openstack-keystone | 08:35 | |
| *** timss has quit IRC | 08:36 | |
| *** timss has joined #openstack-keystone | 08:36 | |
| *** tqtran has quit IRC | 08:37 | |
| *** guoshan has quit IRC | 09:00 | |
| *** guoshan has joined #openstack-keystone | 09:01 | |
| breton | o/ | 09:31 |
| *** wangqun has quit IRC | 09:35 | |
| *** jaosorior has quit IRC | 09:40 | |
| *** jaosorior has joined #openstack-keystone | 09:40 | |
| *** openstackstatus has quit IRC | 09:44 | |
| *** openstack has joined #openstack-keystone | 09:45 | |
| *** openstackstatus has joined #openstack-keystone | 09:46 | |
| *** ChanServ sets mode: +v openstackstatus | 09:46 | |
| *** tqtran has joined #openstack-keystone | 10:04 | |
| *** tqtran has quit IRC | 10:08 | |
| *** richm has joined #openstack-keystone | 10:08 | |
| *** code-R has joined #openstack-keystone | 10:11 | |
| *** openstackstatus has quit IRC | 10:13 | |
| *** openstack has joined #openstack-keystone | 10:13 | |
| *** code-R_ has joined #openstack-keystone | 10:14 | |
| *** openstackstatus has joined #openstack-keystone | 10:14 | |
| *** ChanServ sets mode: +v openstackstatus | 10:14 | |
| *** hoangcx has quit IRC | 10:15 | |
| *** namnh has quit IRC | 10:17 | |
| *** code-R has quit IRC | 10:17 | |
| *** guoshan_ has joined #openstack-keystone | 10:19 | |
| *** guoshan has quit IRC | 10:22 | |
| *** guoshan_ has quit IRC | 10:24 | |
| openstackgerrit | Merged openstack/keystone: Fix a typo in token_formatters.py https://review.openstack.org/386310 | 10:25 |
| *** bjolo has quit IRC | 10:28 | |
| *** bjolo has joined #openstack-keystone | 10:28 | |
| breton | that feel when i open a patch for review, leave it in a tab and when get back to it, it is already merged. | 10:33 |
| *** nicolasbock has joined #openstack-keystone | 10:33 | |
| *** TonyXu has quit IRC | 10:33 | |
| *** spzala has joined #openstack-keystone | 10:38 | |
| *** spzala has quit IRC | 10:43 | |
| *** richm has quit IRC | 10:46 | |
| *** christop1ler has joined #openstack-keystone | 10:55 | |
| christop1ler | Hi. Ive got a keystone instance behind an nginx upstream, and Im getting 403 forbidden. The site serves directly over the ip/port. Im using nginx to upstream to some pyramid instances, and I cant see any difference in the implementation. Anyone got any experience / ideas? | 10:57 |
| *** dave-mccowan has joined #openstack-keystone | 10:58 | |
| christop1ler | http://paste.ofcode.org/DgD3MQpHKGe3rjAtazYvR8 | 10:58 |
| *** richm has joined #openstack-keystone | 11:01 | |
| *** code-R_ has quit IRC | 11:03 | |
| breton | are you getting 403 from nginx or from keystone? | 11:09 |
| *** jgrassler has joined #openstack-keystone | 11:15 | |
| *** code-R has joined #openstack-keystone | 11:26 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Update, correct, and enhance federation docs https://review.openstack.org/371210 | 11:26 |
| *** dgonzalez has quit IRC | 11:26 | |
| *** amoralej is now known as amoralej|lunch | 11:28 | |
| *** dgonzalez has joined #openstack-keystone | 11:43 | |
| *** GB21 has quit IRC | 11:43 | |
| *** akscram1 is now known as akscram | 11:58 | |
| *** ayoung has quit IRC | 12:00 | |
| *** links has quit IRC | 12:02 | |
| *** voelzmo has joined #openstack-keystone | 12:07 | |
| *** edmondsw has joined #openstack-keystone | 12:09 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| dolphm | doesn't auth_token have an option to require that the protected endpoint appears in the service catalog? | 12:10 |
| dolphm | if so, i don't see the option on https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py | 12:10 |
| *** maticue has joined #openstack-keystone | 12:10 | |
| dolphm | otherwise, endpoint filtering is nothing but obfuscation | 12:10 |
| *** links has joined #openstack-keystone | 12:14 | |
| *** lamt has quit IRC | 12:29 | |
| *** openstackstatus has quit IRC | 12:43 | |
| *** openstack has joined #openstack-keystone | 12:43 | |
| *** openstackstatus has joined #openstack-keystone | 12:44 | |
| *** ChanServ sets mode: +v openstackstatus | 12:44 | |
| *** Guest76323 is now known as tlbr | 12:46 | |
| *** ddieterly has joined #openstack-keystone | 12:53 | |
| openstackgerrit | Merged openstack/oslo.policy: Change assertTrue(isinstance()) by optimal assert https://review.openstack.org/386309 | 12:53 |
| *** ayoung has joined #openstack-keystone | 12:53 | |
| *** ChanServ sets mode: +v ayoung | 12:53 | |
| *** spzala has joined #openstack-keystone | 12:54 | |
| *** dikonoo has quit IRC | 12:58 | |
| dstanek | dolphm: i always thought that's all it was | 12:59 |
| *** code-R has quit IRC | 12:59 | |
| *** ddieterly has quit IRC | 13:00 | |
| dolphm | dstanek: i swear there was something based on endpoint ID in auth_token to actually make it useful | 13:00 |
| *** sdake_ has joined #openstack-keystone | 13:03 | |
| *** pnavarro has joined #openstack-keystone | 13:12 | |
| *** code-R has joined #openstack-keystone | 13:13 | |
| *** jperry has joined #openstack-keystone | 13:15 | |
| bknudson | dolphm: nobody ever wrote that. | 13:15 |
| dolphm | fun | 13:15 |
| dolphm | dstanek: bknudson: thanks for the sanity check | 13:16 |
| *** links has quit IRC | 13:16 | |
| *** ayoung has quit IRC | 13:17 | |
| *** TonyXu has joined #openstack-keystone | 13:19 | |
| *** Guest10825 is now known as zeus` | 13:19 | |
| *** zeus` is now known as zeus | 13:19 | |
| *** zeus has quit IRC | 13:20 | |
| *** zeus has joined #openstack-keystone | 13:20 | |
| *** daemontool has joined #openstack-keystone | 13:22 | |
| raildo | dolphm, when you are looking for the difference between --debug and --verbose and the first link that you find is: http://dolphm.com/debug-vs-verbose/ | 13:22 |
| raildo | dolphm, thanks sir :) | 13:22 |
| dolphm | raildo: ha | 13:22 |
| *** ddieterly has joined #openstack-keystone | 13:28 | |
| *** Zer0Byte__ has joined #openstack-keystone | 13:31 | |
| *** Zer0Byte__ has quit IRC | 13:32 | |
| *** ddieterly has quit IRC | 13:34 | |
| *** Marcellin__ has joined #openstack-keystone | 13:39 | |
| *** amoralej|lunch is now known as amoralej | 13:50 | |
| *** pnavarro has quit IRC | 13:50 | |
| *** sdake has joined #openstack-keystone | 14:00 | |
| *** gagehugo has joined #openstack-keystone | 14:04 | |
| *** sdake_ has quit IRC | 14:04 | |
| *** tqtran has joined #openstack-keystone | 14:06 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Use exceptions from Keystoneauth https://review.openstack.org/359705 | 14:10 |
| *** tqtran has quit IRC | 14:11 | |
| voelzmo | Hey, is there some equivalent to AWS IAM instance profiles in OpenStack? http://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html | 14:11 |
| *** voelzmo has quit IRC | 14:14 | |
| *** ddieterly has joined #openstack-keystone | 14:16 | |
| *** voelzmo has joined #openstack-keystone | 14:18 | |
| dstanek | voelzmo: i'm not sure what an instance profile is | 14:20 |
| *** chris_hultin|AWA is now known as chris_hultin | 14:23 | |
| voelzmo | @dstanek you can inject short-lived credentials with a well-defined scope into a VM using the metadata service | 14:27 |
| voelzmo | e.g. give a VM credentials that allow to upload an image, but not start a VM | 14:28 |
| voelzmo | So I guess the question consists of different things: | 14:29 |
| voelzmo | 1. can I create credentials for fine-grained access on the fly? | 14:30 |
| voelzmo | 2. can I provide credentials to VMs using something like the metadata service | 14:30 |
| dstanek | voelzmo: no i don't not believe there is a way to limit credentials to an operation | 14:31 |
| dstanek | that's what i've wanted for a while, but i don't think it exists | 14:31 |
| voelzmo | So you're either an admin in a Domain or you are a member | 14:32 |
| *** haplo37_ has quit IRC | 14:34 | |
| *** TonyXu has quit IRC | 14:34 | |
| *** TonyXu has joined #openstack-keystone | 14:34 | |
| *** lamt has joined #openstack-keystone | 14:35 | |
| edmondsw | voelzmo, you can customize policy to create additional roles besides admin, to get fine-grained access... what you can't do is the "on the fly" bit, or #2 | 14:35 |
| voelzmo | so all of this is configuration during install-time? | 14:36 |
| *** haplo37_ has joined #openstack-keystone | 14:36 | |
| edmondsw | customizing policy would be an install-time, thing, yes | 14:36 |
| edmondsw | creating credentials could be whenever | 14:37 |
| *** Zer0Byte__ has joined #openstack-keystone | 14:38 | |
| *** sdake_ has joined #openstack-keystone | 14:38 | |
| voelzmo | mh, so none of this is possible :( | 14:39 |
| voelzmo | I wonder how people use the OpenStack API from VMs created in OpenStack | 14:39 |
| dstanek | edmondsw: can we scope to a role? | 14:39 |
| voelzmo | or how they give other people scoped credentials for their specific use | 14:40 |
| *** ayoung has joined #openstack-keystone | 14:40 | |
| *** ChanServ sets mode: +v ayoung | 14:40 | |
| *** ddieterly is now known as ddieterly[away] | 14:40 | |
| edmondsw | dstanek what do you mean? | 14:40 |
| voelzmo | like only allowing to upload stuff to a swift bucket or so | 14:40 |
| *** sdake_ has quit IRC | 14:40 | |
| edmondsw | ayoung ^ | 14:40 |
| dstanek | you can't recreate a only-create-vms role and have a token only apply that role can you? | 14:40 |
| *** sdake has quit IRC | 14:41 | |
| edmondsw | s/recreate/create/ ? | 14:41 |
| ayoung | edmondsw, I might not have the context in this window | 14:41 |
| edmondsw | sure, you can create a role that only lets you create VMs | 14:41 |
| ayoung | edmondsw, I was moving locations, and got disconnected...what are we discusssing? | 14:42 |
| dstanek | edmondsw: can you limit the list of roles for a user dynamically? | 14:42 |
| voelzmo | ayoung: essentially if there is an equivalent to AWS's IAM instance profiles, and which parts would be missing in OpenStack to get somethiing like that | 14:42 |
| ayoung | dstanek, you mean, request a token with a subset of a users roles? | 14:43 |
| edmondsw | ayoung started here: http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-10-14.log.html#t2016-10-14T14:11:46 | 14:43 |
| dstanek | ayoung: yesah | 14:43 |
| ayoung | dstanek, I proposed a long time ago | 14:43 |
| ayoung | has not merged | 14:43 |
| dstanek | i remember us talking about it, but i don't think it was done | 14:43 |
| ayoung | only trusts today can do that | 14:43 |
| dstanek | ok, right | 14:43 |
| ayoung | dstanek, I do have this: | 14:43 |
| edmondsw | right | 14:43 |
| ayoung | https://review.openstack.org/#/c/186979/ | 14:43 |
| *** rvba` has quit IRC | 14:43 | |
| *** rvba has joined #openstack-keystone | 14:43 | |
| dstanek | i wonder if trusts can be used for this then, but certainly not specific instances of resources | 14:44 |
| *** rvba has quit IRC | 14:44 | |
| *** rvba has joined #openstack-keystone | 14:44 | |
| ayoung | and, in support of that... | 14:44 |
| *** michauds has joined #openstack-keystone | 14:44 | |
| edmondsw | voelzmo is asking " I wonder how people use the OpenStack API from VMs created in OpenStack or how they give other people scoped credentials for their specific use like only allowing to upload stuff to a swift bucket or so" | 14:44 |
| ayoung | https://review.openstack.org/#/c/310074/ | 14:44 |
| ayoung | edmondsw, it is frightening | 14:44 |
| ayoung | don't think about it if you want to sleep at night | 14:44 |
| edmondsw | yeah... which is why I thought you'd better explain it rather than me ;) | 14:44 |
| ayoung | edmondsw, can you file it as a CVE? Then maybe my chain-of-command will prioritize me working on it? | 14:45 |
| edmondsw | I think you meant to direct that to voelzmo | 14:45 |
| edmondsw | he was the one asking | 14:45 |
| ayoung | edmondsw, I don't care who files it | 14:45 |
| ayoung | I just want the damn thing fixed | 14:46 |
| edmondsw | yeah, but I'm not the one who cares about it... yet... | 14:46 |
| edmondsw | ;) | 14:46 |
| ayoung | edmondsw, so that is why "implied roles" | 14:46 |
| ayoung | get a token with a single role assigned to it, but use assigned roles to expand out the roles implied by that | 14:46 |
| *** ddieterly[away] is now known as ddieterly | 14:46 | |
| voelzmo | sorry, I'm not familiar with the usual processes, where should I file that? Don't care if you label it a CVE, bug, or feature :P | 14:46 |
| ayoung | voelzmo, I was being flippant | 14:47 |
| ayoung | it is a security related issue, but a well known one | 14:47 |
| ayoung | and thus not a CVE | 14:47 |
| ayoung | there is this bug which is the first step | 14:47 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/968696 | 14:47 |
| openstack | Launchpad bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] - Assigned to Adam Young (ayoung) | 14:47 |
| ayoung | beyond that, there are specs and design discussions | 14:48 |
| ayoung | if you can file a bug for your use case, please do, and let me know | 14:48 |
| ayoung | edmondsw, stop stealing my bug assignments! | 14:48 |
| ayoung | I am actually actively working on the Policy changes for Nova | 14:48 |
| ayoung | I appreciate your input, but would rather have you as a reviewer, so the fixes actually merge | 14:48 |
| ayoung | :) | 14:49 |
| edmondsw | dstanek, back to your question... what I was suggesting was that you could create a role with very specific permissions and then a user with only that role and give the VM that user's credentials... NOT that you would do any of this on the fly, or that the token would show less roles than the full set of that user... just that the user really only has this role | 14:49 |
| ayoung | I figured out why the is_admin check was needed, and have a fix for it for most tests | 14:49 |
| edmondsw | not what we really want, but might work for some applications | 14:49 |
| edmondsw | ayoung, it should merge now that I've fixed it... it wouldn't have before ;) | 14:49 |
| ayoung | edmondsw, a user can create a trust with themselves as the trustor and trustee, and use that trust to get a token, then pass that token to an application | 14:50 |
| ayoung | and that trust would only have the subordinate role in it | 14:50 |
| dstanek | edmondsw: but they you'd have a bunch of ghost users right? | 14:50 |
| ayoung | edmondsw, for a VM, I would do roughly the same thing | 14:50 |
| ayoung | dstanek, yes, but those ghost users go in their own domain | 14:51 |
| edmondsw | dstanek depends on whether you want to use a different user for each VM or just reuse the same one | 14:51 |
| ayoung | so they are cheap...one per VM | 14:51 |
| edmondsw | cool | 14:51 |
| ayoung | Heat does this already | 14:51 |
| ayoung | cool heat! | 14:51 |
| dstanek | for example, on this project i was to give fred the ability to write to a swift domain and on thie other project he should be able to recreate vms. so fred has two users in openstack? | 14:51 |
| edmondsw | ayoung, are you going to elaborate on your is_admin check comment or go review the changes I made and see how nice they are? ;) | 14:51 |
| voelzmo | ayoung: so from the bug I'm entirely unsure what the state of your bug is. Is this something that will actually we fixed sometime soon(ish)? | 14:52 |
| ayoung | edmondsw, I am still working on it. I'll pull in your suggestions, but I have not looked since the one you submitted last afternoon | 14:52 |
| ayoung | voelzmo, working on it now | 14:52 |
| edmondsw | I fixed the UTs this morning... didn't change anything else | 14:52 |
| *** sdake has joined #openstack-keystone | 14:53 | |
| dstanek | voelzmo: what version of keystone are you running? you'd likely have to go to master or the upcoming release to get the fixes | 14:53 |
| voelzmo | dstanek: We're running Mitaka | 14:53 |
| voelzmo | Once Newton is available I guess we're switching to it. Unfortunately it will take another 3 months until distributors have created a new release from that... | 14:54 |
| *** thiagolib has joined #openstack-keystone | 14:56 | |
| *** rcernin has quit IRC | 15:02 | |
| *** agrebennikov has joined #openstack-keystone | 15:02 | |
| *** sdake_ has joined #openstack-keystone | 15:03 | |
| *** ddieterly is now known as ddieterly[away] | 15:04 | |
| *** daemontool_ has joined #openstack-keystone | 15:05 | |
| *** sdake has quit IRC | 15:05 | |
| *** voelzmo has quit IRC | 15:06 | |
| *** daemontool_ has quit IRC | 15:08 | |
| *** daemontool has quit IRC | 15:08 | |
| *** dave-mccowan has quit IRC | 15:09 | |
| christop1ler | Hey, Keystone, Whats the prevailing wisdom on client vs server side facebook authentication? | 15:15 |
| *** pcaruana has quit IRC | 15:15 | |
| stevemar | easy review: https://mail.google.com/mail/u/0/#all/157c1be360c3939d | 15:17 |
| *** cargonza has quit IRC | 15:22 | |
| *** BlackDex has quit IRC | 15:22 | |
| *** cargonza has joined #openstack-keystone | 15:23 | |
| *** dave-mccowan has joined #openstack-keystone | 15:24 | |
| *** ddieterly[away] is now known as ddieterly | 15:26 | |
| *** dflorea has joined #openstack-keystone | 15:28 | |
| breton | stevemar: +1 | 15:29 |
| *** brofessor is now known as akrzos | 15:31 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use issue_v3_token instead of issue_v2_token https://review.openstack.org/386665 | 15:31 |
| *** GB21 has joined #openstack-keystone | 15:32 | |
| *** lamt has quit IRC | 15:37 | |
| *** adrian_otto has joined #openstack-keystone | 15:40 | |
| *** GB21 has quit IRC | 15:47 | |
| *** dave-mccowan has quit IRC | 15:51 | |
| *** ddieterly is now known as ddieterly[away] | 15:52 | |
| *** sdake has joined #openstack-keystone | 15:54 | |
| *** tesseract- has quit IRC | 15:54 | |
| *** ddieterly[away] is now known as ddieterly | 15:55 | |
| *** sdake_ has quit IRC | 15:56 | |
| openstackgerrit | ayoung proposed openstack/keystone: Fernet token formatter with explicit role https://review.openstack.org/310074 | 15:58 |
| openstackgerrit | Merged openstack/keystone: Add is_admin_project to policy dict https://review.openstack.org/371856 | 15:59 |
| *** Zer0Byte__ has quit IRC | 16:01 | |
| *** dave-mccowan has joined #openstack-keystone | 16:01 | |
| *** code-R has quit IRC | 16:01 | |
| *** Zer0Byte__ has joined #openstack-keystone | 16:04 | |
| *** asettle__ has joined #openstack-keystone | 16:17 | |
| *** asettle has quit IRC | 16:21 | |
| *** asettle__ has quit IRC | 16:21 | |
| *** xek_ has quit IRC | 16:25 | |
| *** xek_ has joined #openstack-keystone | 16:26 | |
| *** sdake_ has joined #openstack-keystone | 16:38 | |
| *** adrian_otto has quit IRC | 16:39 | |
| *** dflorea has quit IRC | 16:39 | |
| *** adrian_otto has joined #openstack-keystone | 16:39 | |
| *** sdake has quit IRC | 16:40 | |
| *** adrian_otto has quit IRC | 16:43 | |
| *** nkinder has joined #openstack-keystone | 16:54 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Invalidate trust when the related project is deleted https://review.openstack.org/384444 | 16:55 |
| *** xek_ has quit IRC | 16:55 | |
| *** xek_ has joined #openstack-keystone | 16:56 | |
| stevemar | henrynash: ^ | 16:56 |
| *** browne has joined #openstack-keystone | 16:58 | |
| *** ddieterly is now known as ddieterly[away] | 17:00 | |
| *** amoralej is now known as amoralej|off | 17:00 | |
| *** chris_hultin is now known as chris_hultin|AWA | 17:01 | |
| *** gyee has joined #openstack-keystone | 17:06 | |
| *** jlk is now known as omgwtfjlk | 17:06 | |
| *** adrian_otto has joined #openstack-keystone | 17:08 | |
| *** michauds has quit IRC | 17:12 | |
| *** code-R has joined #openstack-keystone | 17:17 | |
| *** dikonoo has joined #openstack-keystone | 17:17 | |
| *** links has joined #openstack-keystone | 17:18 | |
| *** code-R_ has joined #openstack-keystone | 17:18 | |
| *** dflorea has joined #openstack-keystone | 17:19 | |
| morgan | stevemar: +2. lgtm | 17:20 |
| morgan | stevemar: didn't +A since no jenkins response yet | 17:20 |
| stevemar | morgan: oh jenkins will be fine, PS4 had a +1 from jenkins and PS5 is just a releasenote change | 17:21 |
| *** code-R has quit IRC | 17:21 | |
| morgan | stevemar: feel free to +A | 17:21 |
| stevemar | morgan: want to review the patch it depends on? :) | 17:21 |
| morgan | uh... maybe | 17:22 |
| morgan | :P | 17:22 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend dependencies from token provider https://review.openstack.org/386136 | 17:22 |
| stevemar | morgan: ty! :) | 17:28 |
| *** tqtran has joined #openstack-keystone | 17:30 | |
| *** Zer0Byte__ has quit IRC | 17:32 | |
| *** scarlisle has joined #openstack-keystone | 17:35 | |
| *** artmr has joined #openstack-keystone | 17:38 | |
| *** alex_xu_ has quit IRC | 17:39 | |
| *** jaosorior has quit IRC | 17:40 | |
| *** jaosorior has joined #openstack-keystone | 17:40 | |
| artmr | Hello all, whom interested make review | 17:42 |
| *** alex_xu has joined #openstack-keystone | 17:42 | |
| artmr | https://review.openstack.org/#/c/375730/ https://review.openstack.org/#/c/378001/ | 17:43 |
| openstackgerrit | Arthur Miranda proposed openstack/python-keystoneclient: Prevent attempts to "filter" list() calls by globally unique IDs https://review.openstack.org/378001 | 17:47 |
| *** pcaruana has joined #openstack-keystone | 17:48 | |
| *** lamt has joined #openstack-keystone | 17:56 | |
| *** dflorea has quit IRC | 17:58 | |
| *** dflorea has joined #openstack-keystone | 18:00 | |
| *** chris_hultin|AWA is now known as chris_hultin | 18:06 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 18:06 |
| *** AndyWojo is now known as suburban_killade | 18:15 | |
| *** Zer0Byte__ has joined #openstack-keystone | 18:20 | |
| *** chris_hultin is now known as chris_hultin|AWA | 18:24 | |
| *** michauds has joined #openstack-keystone | 18:25 | |
| *** dikonoo has quit IRC | 18:26 | |
| *** hoonetorg has quit IRC | 18:30 | |
| *** dflorea has quit IRC | 18:33 | |
| *** nkinder has quit IRC | 18:40 | |
| *** links has quit IRC | 18:41 | |
| *** hoonetorg has joined #openstack-keystone | 18:41 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone: Update, correct, and enhance federation docs https://review.openstack.org/371210 | 18:42 |
| *** afred312_ has joined #openstack-keystone | 18:42 | |
| *** code-R has joined #openstack-keystone | 18:43 | |
| *** wolsen_ has joined #openstack-keystone | 18:44 | |
| *** auggy_ has joined #openstack-keystone | 18:44 | |
| *** raddaoui_ has joined #openstack-keystone | 18:45 | |
| *** dflorea has joined #openstack-keystone | 18:45 | |
| *** christophler has joined #openstack-keystone | 18:46 | |
| *** nikhil_ has joined #openstack-keystone | 18:47 | |
| *** nikhil_ is now known as Guest30998 | 18:47 | |
| *** jlk has joined #openstack-keystone | 18:48 | |
| *** jlk has quit IRC | 18:48 | |
| *** jlk has joined #openstack-keystone | 18:48 | |
| *** dolphm_ has joined #openstack-keystone | 18:49 | |
| *** ChanServ sets mode: +o dolphm_ | 18:49 | |
| *** odyssey4me_ has joined #openstack-keystone | 18:49 | |
| *** krotscheck_ has joined #openstack-keystone | 18:49 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 18:49 | |
| *** oomichi_ has joined #openstack-keystone | 18:49 | |
| *** med_` has joined #openstack-keystone | 18:49 | |
| *** knikolla_ has joined #openstack-keystone | 18:50 | |
| *** dflorea has quit IRC | 18:50 | |
| *** topol_ has joined #openstack-keystone | 18:50 | |
| *** _d34dh0r53_ has joined #openstack-keystone | 18:51 | |
| *** beddari1 has joined #openstack-keystone | 18:51 | |
| *** lamt has quit IRC | 18:51 | |
| *** code-R_ has quit IRC | 18:51 | |
| *** TonyXu has quit IRC | 18:51 | |
| *** timss has quit IRC | 18:51 | |
| *** omgwtfjlk has quit IRC | 18:51 | |
| *** samueldmq has quit IRC | 18:51 | |
| *** xenogear has quit IRC | 18:51 | |
| *** afred312 has quit IRC | 18:51 | |
| *** nikhil has quit IRC | 18:51 | |
| *** d34dh0r53 has quit IRC | 18:51 | |
| *** med_ has quit IRC | 18:51 | |
| *** raddaoui has quit IRC | 18:51 | |
| *** vkramskikh has quit IRC | 18:51 | |
| *** knikolla has quit IRC | 18:51 | |
| *** odyssey4me has quit IRC | 18:51 | |
| *** BrAsS_mO- has quit IRC | 18:51 | |
| *** topol has quit IRC | 18:51 | |
| *** jistr has quit IRC | 18:51 | |
| *** fungi has quit IRC | 18:51 | |
| *** andrewbogott has quit IRC | 18:51 | |
| *** oomichi has quit IRC | 18:51 | |
| *** d0ugal has quit IRC | 18:51 | |
| *** krotscheck has quit IRC | 18:51 | |
| *** christop1ler has quit IRC | 18:51 | |
| *** twouters has quit IRC | 18:51 | |
| *** beddari has quit IRC | 18:51 | |
| *** wolsen has quit IRC | 18:51 | |
| *** auggy has quit IRC | 18:51 | |
| *** suburban_killade has quit IRC | 18:51 | |
| *** _fortis has quit IRC | 18:51 | |
| *** lbragstad has quit IRC | 18:51 | |
| *** dolphm has quit IRC | 18:51 | |
| *** oomichi_ is now known as oomichi | 18:51 | |
| *** dolphm_ is now known as dolphm | 18:51 | |
| *** krotscheck_ is now known as krotscheck | 18:51 | |
| openstackgerrit | Merged openstack/keystone: Invalidate trust when the trustor or trustee is deleted https://review.openstack.org/369354 | 18:51 |
| *** suburban_killade has joined #openstack-keystone | 18:51 | |
| *** odyssey4me_ is now known as odyssey4me | 18:51 | |
| *** suburban_killade has quit IRC | 18:52 | |
| *** suburban_killade has joined #openstack-keystone | 18:52 | |
| *** ddieterly[away] is now known as ddieterly | 18:52 | |
| *** vkramskikh has joined #openstack-keystone | 18:52 | |
| *** Guest30998 is now known as nikhil | 18:52 | |
| *** auggy_ is now known as auggy | 18:53 | |
| *** raddaoui_ is now known as raddaoui | 18:53 | |
| *** lbragstad has joined #openstack-keystone | 18:53 | |
| *** edmondsw has quit IRC | 18:54 | |
| *** jistr has joined #openstack-keystone | 18:54 | |
| *** wolsen_ is now known as wolsen | 18:54 | |
| *** xenogear has joined #openstack-keystone | 18:55 | |
| *** adrian_otto has quit IRC | 18:56 | |
| *** timss has joined #openstack-keystone | 18:56 | |
| *** voelzmo has joined #openstack-keystone | 18:56 | |
| voelzmo | sorry, had to leave ;( Just wanted to say thanks, ayoung and dstanek. | 18:57 |
| ayoung | voelzmo, your are very welcome | 18:58 |
| voelzmo | Are you in Barcelona at the summit in two weeks? Still looking for a way to discuss the IAM instance profile stuff in person with someone. | 18:59 |
| *** _fortis_ has joined #openstack-keystone | 19:00 | |
| *** TonyXu has joined #openstack-keystone | 19:00 | |
| *** d0ugal has joined #openstack-keystone | 19:01 | |
| *** fungi has joined #openstack-keystone | 19:01 | |
| lbragstad | stevemar does anything use the Ec2Controller anymore? | 19:01 |
| *** twouters has joined #openstack-keystone | 19:02 | |
| *** twouters has joined #openstack-keystone | 19:02 | |
| *** andrewbogott has joined #openstack-keystone | 19:02 | |
| *** samueldmq has joined #openstack-keystone | 19:03 | |
| *** ChanServ sets mode: +v samueldmq | 19:03 | |
| *** andrewbogott has quit IRC | 19:05 | |
| *** andrewbogott has joined #openstack-keystone | 19:05 | |
| *** jdennis has quit IRC | 19:05 | |
| *** jdennis has joined #openstack-keystone | 19:08 | |
| *** _fortis_ is now known as _fortis | 19:09 | |
| *** voelzmo has quit IRC | 19:09 | |
| *** browne has quit IRC | 19:11 | |
| *** voelzmo has joined #openstack-keystone | 19:13 | |
| stevemar | lbragstad: pfft, maybe? | 19:14 |
| lbragstad | stevemar I ask because I can guarantee that I broke https://github.com/openstack/keystone/blob/f98e8fd0db45936e95aab6b44a6a9c7d2cbb6a95/keystone/contrib/ec2/controllers.py#L283 | 19:15 |
| lbragstad | i ran all the tests and nothing failed | 19:15 |
| stevemar | lbragstad: the ec2 and s3 extensions are probably the one part of the keystone code base i am somewhat unfamiliar with | 19:16 |
| *** edmondsw has joined #openstack-keystone | 19:19 | |
| *** ddieterly has quit IRC | 19:19 | |
| stevemar | lbragstad: could be a lack fo tests | 19:19 |
| *** ayoung has quit IRC | 19:21 | |
| *** dflorea has joined #openstack-keystone | 19:21 | |
| *** dave-mccowan has quit IRC | 19:23 | |
| *** jaosorior_ has joined #openstack-keystone | 19:24 | |
| *** vkramskikh has quit IRC | 19:29 | |
| *** BrAsS_mOnKeY has quit IRC | 19:29 | |
| *** auggy has quit IRC | 19:31 | |
| *** ayoung has joined #openstack-keystone | 19:31 | |
| *** ChanServ sets mode: +v ayoung | 19:31 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 19:32 | |
| *** auggy has joined #openstack-keystone | 19:32 | |
| *** vkramskikh has joined #openstack-keystone | 19:33 | |
| *** code-R has quit IRC | 19:35 | |
| *** dave-mccowan has joined #openstack-keystone | 19:49 | |
| *** raildo has quit IRC | 19:51 | |
| *** voelzmo has quit IRC | 19:57 | |
| *** nkinder has joined #openstack-keystone | 19:57 | |
| *** clenimar has quit IRC | 19:58 | |
| *** jaosorior has quit IRC | 19:59 | |
| *** jaosorior_ is now known as jaosorior | 19:59 | |
| *** lamt has joined #openstack-keystone | 20:01 | |
| *** adrian_otto has joined #openstack-keystone | 20:01 | |
| *** jlwhite has quit IRC | 20:02 | |
| *** antwash has quit IRC | 20:02 | |
| *** maticue has quit IRC | 20:03 | |
| *** jlwhite has joined #openstack-keystone | 20:03 | |
| *** nkinder has quit IRC | 20:03 | |
| openstackgerrit | Merged openstack/keystone: Invalidate trust when the related project is deleted https://review.openstack.org/384444 | 20:04 |
| *** antwash has joined #openstack-keystone | 20:04 | |
| lbragstad | dstanek do you know if we fixed that bug where revocation events were too broad? | 20:06 |
| dstanek | lbragstad: I'm not entirely sure | 20:07 |
| lbragstad | dstanek for some reason I thought that was fixed in all the revocation event fixes you did | 20:07 |
| dstanek | It may have been. I closed a few bugs with that. Did we have a bug on longer for this? | 20:08 |
| lbragstad | dstanek i'm not sure - i'm playing with something locally and I seem to have transients in keystone.tests.unit.test_backend_sql.SqlTokenCacheInvalidationWithPKI.test_delete_unscoped_token | 20:09 |
| lbragstad | ^ that's one case of the transients | 20:09 |
| lbragstad | and it only happens when I run the tests concurrently | 20:09 |
| lbragstad | which made it smell like an overly generalized revocation event was interfering with the test | 20:09 |
| *** antwash has quit IRC | 20:12 | |
| *** gyee has quit IRC | 20:13 | |
| *** antwash has joined #openstack-keystone | 20:14 | |
| *** maticue has joined #openstack-keystone | 20:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Use issue_v3_token instead of issue_v2_token https://review.openstack.org/386665 | 20:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: refactor the token controller https://review.openstack.org/386726 | 20:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 20:15 |
| *** pcaruana has quit IRC | 20:18 | |
| lbragstad | dstanek i recreated it in the last patch of that series ^ | 20:19 |
| *** browne has joined #openstack-keystone | 20:20 | |
| *** sheel has quit IRC | 20:20 | |
| *** antwash has quit IRC | 20:23 | |
| *** jlwhite_ has joined #openstack-keystone | 20:23 | |
| *** jlwhite has quit IRC | 20:24 | |
| *** jlwhite_ is now known as jlwhite | 20:24 | |
| *** antwash has joined #openstack-keystone | 20:25 | |
| lbragstad | rderose nice! https://review.openstack.org/#/c/386102/ | 20:29 |
| dstanek | lbragstad: uggg.. | 20:44 |
| *** asettle has joined #openstack-keystone | 20:44 | |
| *** ddieterly has joined #openstack-keystone | 20:45 | |
| *** gyee has joined #openstack-keystone | 20:51 | |
| *** dave-mccowan has quit IRC | 21:03 | |
| *** michauds has quit IRC | 21:06 | |
| *** jlwhite_ has joined #openstack-keystone | 21:07 | |
| *** antwash has quit IRC | 21:07 | |
| *** jlwhite has quit IRC | 21:07 | |
| *** jlwhite_ is now known as jlwhite | 21:07 | |
| *** antwash has joined #openstack-keystone | 21:09 | |
| rderose | lbragstad: thanks man :) | 21:13 |
| rderose | lbragstad: have another one coming :) https://review.openstack.org/#/c/386136/ | 21:14 |
| lbragstad | rderose ah ha - sweet! | 21:14 |
| *** nkinder has joined #openstack-keystone | 21:18 | |
| *** thiagolib has quit IRC | 21:18 | |
| *** adrian_otto has quit IRC | 21:23 | |
| *** adrian_otto has joined #openstack-keystone | 21:25 | |
| *** gyee has quit IRC | 21:25 | |
| *** edmondsw has quit IRC | 21:26 | |
| *** adrian_otto has quit IRC | 21:30 | |
| *** adrian_otto has joined #openstack-keystone | 21:32 | |
| *** nkinder has quit IRC | 21:33 | |
| *** adrian_otto has quit IRC | 21:35 | |
| *** adrian_otto has joined #openstack-keystone | 21:40 | |
| *** adrian_otto has quit IRC | 21:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 21:46 |
| *** asettle has quit IRC | 21:49 | |
| *** maticue has quit IRC | 21:56 | |
| *** iurygregory_ has joined #openstack-keystone | 22:02 | |
| *** jperry has quit IRC | 22:06 | |
| *** maticue has joined #openstack-keystone | 22:09 | |
| *** jaosorior has quit IRC | 22:10 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v2_token https://review.openstack.org/386762 | 22:12 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Remove issue_v3_token in favor of issue_token https://review.openstack.org/386837 | 22:12 |
| lbragstad | dstanek i ended up fixing it ^ | 22:12 |
| lbragstad | we now have a provider interface of issue_token and validate_token | 22:13 |
| *** sdake_ has quit IRC | 22:14 | |
| *** lamt has quit IRC | 22:28 | |
| *** gagehugo has quit IRC | 22:43 | |
| *** sdake has joined #openstack-keystone | 22:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Remove backend dependencies from token provider https://review.openstack.org/386136 | 22:44 |
| *** sdake has quit IRC | 22:57 | |
| *** Marcellin__ has quit IRC | 22:57 | |
| *** sdake has joined #openstack-keystone | 22:58 | |
| *** sdake has quit IRC | 22:58 | |
| *** sdake has joined #openstack-keystone | 23:06 | |
| *** nicolasbock has quit IRC | 23:08 | |
| *** scarlisle has quit IRC | 23:11 | |
| *** mgagne_ is now known as mgagne | 23:12 | |
| *** browne has quit IRC | 23:14 | |
| *** sdake has quit IRC | 23:21 | |
| *** nkinder has joined #openstack-keystone | 23:22 | |
| *** nkinder has quit IRC | 23:28 | |
| *** nkinder has joined #openstack-keystone | 23:45 | |
| *** Guest63380 has joined #openstack-keystone | 23:46 | |
| *** tqtran has quit IRC | 23:48 | |
| *** ddieterly is now known as ddieterly[away] | 23:55 | |
| *** Guest63380 has quit IRC | 23:57 | |
| *** Zer0Byte__ has quit IRC | 23:58 | |
| *** nkinder has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!