| *** guoshan has quit IRC | 00:01 | |
| *** diazjf has quit IRC | 00:02 | |
| *** phalmos has quit IRC | 00:02 | |
| *** cnf has quit IRC | 00:03 | |
| *** diazjf has joined #openstack-keystone | 00:06 | |
| *** Krenair has quit IRC | 00:09 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix typo in access.py https://review.openstack.org/398244 | 00:11 |
|---|---|---|
| *** Krenair has joined #openstack-keystone | 00:13 | |
| *** dave-mccowan has joined #openstack-keystone | 00:20 | |
| *** agrebennikov has quit IRC | 00:28 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystoneauth: Correct betamax fixture for more strict IDNA https://review.openstack.org/398654 | 00:28 |
| morgan_ | stevemar: ^fixes betamax fixture | 00:28 |
| morgan_ | stevemar: test*. | 00:28 |
| *** asettle has joined #openstack-keystone | 00:31 | |
| *** spzala has joined #openstack-keystone | 00:31 | |
| *** Zer0Byte__ has quit IRC | 00:33 | |
| *** david-lyle_ is now known as david-lyle | 00:35 | |
| *** asettle has quit IRC | 00:35 | |
| *** hoangcx has joined #openstack-keystone | 00:37 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 00:38 |
| *** thinrichs has joined #openstack-keystone | 00:41 | |
| *** thinrichs has left #openstack-keystone | 00:41 | |
| *** chrisplo has joined #openstack-keystone | 00:41 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 00:44 |
| *** jaypipes has quit IRC | 00:45 | |
| *** cnf has joined #openstack-keystone | 00:49 | |
| *** guoshan has joined #openstack-keystone | 00:51 | |
| *** adrian_otto has quit IRC | 00:53 | |
| *** guoshan has quit IRC | 00:55 | |
| *** diazjf has quit IRC | 01:05 | |
| *** tqtran has quit IRC | 01:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Create idp_id as the domain_id for federated users https://review.openstack.org/398667 | 01:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Create idp_id as the domain_id for federated users https://review.openstack.org/398667 | 01:07 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Create idp_id as the domain_id for federated users https://review.openstack.org/398667 | 01:08 |
| openstackgerrit | Merged openstack/keystone: Fix typo in doc https://review.openstack.org/398599 | 01:11 |
| *** dave-mccowan has quit IRC | 01:18 | |
| openstackgerrit | howard lee proposed openstack/keystoneauth: Add __ne__ built-in function https://review.openstack.org/398294 | 01:18 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 01:25 |
| *** guoshan has joined #openstack-keystone | 01:34 | |
| *** zhangjl has joined #openstack-keystone | 01:35 | |
| *** spzala has quit IRC | 01:45 | |
| *** asettle has joined #openstack-keystone | 02:01 | |
| *** asettle has quit IRC | 02:06 | |
| *** blancos has joined #openstack-keystone | 02:09 | |
| blancos | Hi I'm interested in contributing to Keystone and I was wondering about the status of these blueprints: https://blueprints.launchpad.net/keystone/+spec/admin-readonly-role and https://wiki.openstack.org/wiki/DynamicPolicies | 02:14 |
| *** diazjf has joined #openstack-keystone | 02:18 | |
| *** diazjf has quit IRC | 02:21 | |
| stevemar | morgan_: thanks! you're the best :) | 02:22 |
| stevemar | aww i miss having morgan_ around in keystone{everything_else} land | 02:22 |
| *** hoangcx has quit IRC | 02:23 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Using assertIsNotNone() instead of assertNotEqual(None) https://review.openstack.org/397521 | 02:23 |
| *** adriant has quit IRC | 02:25 | |
| *** nkinder has joined #openstack-keystone | 02:29 | |
| *** adriant has joined #openstack-keystone | 02:35 | |
| *** namnh has joined #openstack-keystone | 02:43 | |
| *** dave-mccowan has joined #openstack-keystone | 02:49 | |
| *** blancos has quit IRC | 02:50 | |
| *** nkinder has quit IRC | 02:58 | |
| *** adrian_otto has joined #openstack-keystone | 02:59 | |
| *** adrian_otto has quit IRC | 03:04 | |
| *** adrian_otto1 has joined #openstack-keystone | 03:04 | |
| openstackgerrit | Merged openstack/keystoneauth: Correct betamax fixture for more strict IDNA https://review.openstack.org/398654 | 03:05 |
| *** asettle has joined #openstack-keystone | 03:32 | |
| *** dave-mccowan has quit IRC | 03:33 | |
| *** asettle has quit IRC | 03:36 | |
| *** maestropandy has joined #openstack-keystone | 03:38 | |
| *** maestropandy has left #openstack-keystone | 03:39 | |
| *** udesale has joined #openstack-keystone | 03:39 | |
| *** spzala has joined #openstack-keystone | 03:46 | |
| *** spzala has quit IRC | 03:51 | |
| *** adrian_otto1 has quit IRC | 04:13 | |
| *** deep_1 has joined #openstack-keystone | 04:18 | |
| *** hoangcx has joined #openstack-keystone | 04:24 | |
| *** GB21 has joined #openstack-keystone | 04:37 | |
| *** nicolasbock has quit IRC | 04:40 | |
| *** diazjf has joined #openstack-keystone | 04:47 | |
| *** guoshan has quit IRC | 04:50 | |
| *** guoshan has joined #openstack-keystone | 04:51 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 04:51 |
| *** guoshan has quit IRC | 05:01 | |
| *** asettle has joined #openstack-keystone | 05:02 | |
| *** guoshan has joined #openstack-keystone | 05:03 | |
| *** asettle has quit IRC | 05:07 | |
| *** jrichli has joined #openstack-keystone | 05:14 | |
| *** jrichli has left #openstack-keystone | 05:14 | |
| *** deep_1 has quit IRC | 05:31 | |
| *** deep_1 has joined #openstack-keystone | 05:32 | |
| *** guoshan has quit IRC | 05:34 | |
| *** adriant has quit IRC | 05:50 | |
| *** asettle has joined #openstack-keystone | 06:03 | |
| *** diazjf has quit IRC | 06:07 | |
| *** asettle has quit IRC | 06:08 | |
| *** guoshan has joined #openstack-keystone | 06:13 | |
| *** jaosorior has joined #openstack-keystone | 06:14 | |
| *** belmoreira has joined #openstack-keystone | 06:25 | |
| *** deep_1 has quit IRC | 06:33 | |
| *** jaosorior has quit IRC | 06:41 | |
| *** richm has quit IRC | 06:41 | |
| *** jaosorior has joined #openstack-keystone | 06:42 | |
| *** deep_1 has joined #openstack-keystone | 06:42 | |
| *** spzala has joined #openstack-keystone | 06:46 | |
| *** spzala has quit IRC | 06:51 | |
| *** namnh has quit IRC | 07:03 | |
| *** asettle has joined #openstack-keystone | 07:04 | |
| *** asettle has quit IRC | 07:08 | |
| *** pcaruana has joined #openstack-keystone | 07:18 | |
| openstackgerrit | Eric Brown proposed openstack/keystone: Remove entry_points to non-existent drivers https://review.openstack.org/398795 | 07:40 |
| *** jvarlamova has quit IRC | 07:50 | |
| *** deep_1 has quit IRC | 07:50 | |
| *** deep_1 has joined #openstack-keystone | 07:53 | |
| *** asettle has joined #openstack-keystone | 08:05 | |
| *** asettle has quit IRC | 08:09 | |
| *** guoshan has quit IRC | 08:31 | |
| *** guoshan has joined #openstack-keystone | 08:32 | |
| *** deep_1 has quit IRC | 08:36 | |
| *** amoralej|off is now known as amoralej | 08:44 | |
| *** jpich has joined #openstack-keystone | 08:49 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** asettle has joined #openstack-keystone | 09:06 | |
| *** jaosorior is now known as jaosorior_lunch | 09:08 | |
| *** asettle has quit IRC | 09:10 | |
| *** deep_1 has joined #openstack-keystone | 09:15 | |
| *** deep_1 has quit IRC | 09:19 | |
| *** jaosorior_lunch is now known as jaosorior | 09:43 | |
| *** openstackgerrit has quit IRC | 09:48 | |
| *** openstackgerrit has joined #openstack-keystone | 09:48 | |
| *** henrynash has quit IRC | 10:03 | |
| *** GB21 has quit IRC | 10:05 | |
| *** asettle has joined #openstack-keystone | 10:06 | |
| *** asettle has quit IRC | 10:11 | |
| *** deep_1 has joined #openstack-keystone | 10:16 | |
| *** hoangcx has quit IRC | 10:17 | |
| *** deep_1 has quit IRC | 10:21 | |
| *** zhangjl has quit IRC | 10:31 | |
| *** asettle has joined #openstack-keystone | 10:36 | |
| *** guoshan has quit IRC | 10:42 | |
| *** spzala has joined #openstack-keystone | 10:47 | |
| *** GB21 has joined #openstack-keystone | 10:49 | |
| *** spzala has quit IRC | 10:52 | |
| *** khamtamtun has joined #openstack-keystone | 11:06 | |
| openstackgerrit | zhangyanxian proposed openstack/python-keystoneclient: Fix some spelling mistaks https://review.openstack.org/398929 | 11:06 |
| openstackgerrit | zhangyanxian proposed openstack/python-keystoneclient: Fix some spelling mistaks in base.py & auth.py https://review.openstack.org/398929 | 11:08 |
| openstackgerrit | zhangyanxian proposed openstack/python-keystoneclient: Fix some spelling mistaks in base.py & auth.py https://review.openstack.org/398929 | 11:09 |
| *** richm has joined #openstack-keystone | 11:10 | |
| *** khamtamtun has quit IRC | 11:12 | |
| *** guoshan has joined #openstack-keystone | 11:13 | |
| *** kamtamtun has joined #openstack-keystone | 11:14 | |
| *** guoshan has quit IRC | 11:18 | |
| *** andreaf has quit IRC | 11:26 | |
| *** andreaf has joined #openstack-keystone | 11:26 | |
| *** nicolasbock has joined #openstack-keystone | 11:35 | |
| *** andreaf has quit IRC | 11:36 | |
| *** andreaf has joined #openstack-keystone | 11:36 | |
| *** andreaf has quit IRC | 11:39 | |
| *** andreaf has joined #openstack-keystone | 11:43 | |
| *** kamtamtun has quit IRC | 11:45 | |
| *** kamtamtun has joined #openstack-keystone | 11:52 | |
| *** kamtamtun has quit IRC | 11:53 | |
| *** aloga_ has joined #openstack-keystone | 11:55 | |
| *** zhugaoxiao has quit IRC | 12:01 | |
| *** zhugaoxiao has joined #openstack-keystone | 12:01 | |
| *** kamtamtun has joined #openstack-keystone | 12:04 | |
| *** kamtamtun has quit IRC | 12:05 | |
| *** guoshan has joined #openstack-keystone | 12:07 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| *** guoshan has quit IRC | 12:12 | |
| *** udesale has quit IRC | 12:18 | |
| *** raildo has quit IRC | 12:20 | |
| *** raildo has joined #openstack-keystone | 12:26 | |
| *** dave-mccowan has joined #openstack-keystone | 12:31 | |
| *** henrynash has joined #openstack-keystone | 12:38 | |
| *** ChanServ sets mode: +v henrynash | 12:38 | |
| *** rodrigods has quit IRC | 12:40 | |
| *** rodrigods has joined #openstack-keystone | 12:40 | |
| *** catintheroof has joined #openstack-keystone | 12:46 | |
| *** edmondsw has joined #openstack-keystone | 12:48 | |
| *** markvoelker has quit IRC | 12:50 | |
| *** amoralej is now known as amoralej|lunch | 12:51 | |
| *** aloga_ has quit IRC | 12:53 | |
| *** GB21 has quit IRC | 12:56 | |
| *** chlong has joined #openstack-keystone | 13:00 | |
| *** guoshan has joined #openstack-keystone | 13:01 | |
| *** spzala has joined #openstack-keystone | 13:03 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 13:03 |
| *** guoshan has quit IRC | 13:06 | |
| *** spzala has quit IRC | 13:08 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 13:10 |
| rodrigods | dstanek, around? | 13:11 |
| *** lamt has joined #openstack-keystone | 13:14 | |
| *** henrynash has quit IRC | 13:14 | |
| *** deep_1 has joined #openstack-keystone | 13:20 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 13:22 |
| *** deep_1 has quit IRC | 13:41 | |
| *** nk2527 has joined #openstack-keystone | 13:45 | |
| *** spzala has joined #openstack-keystone | 13:47 | |
| BlackDex | Hello there | 13:48 |
| BlackDex | i get these errors | 13:48 |
| BlackDex | keystoneauth1.exceptions.http.NotFound: Could not find endpoint: e6fed1859ab64cef8a7fd22c80b53d7b (HTTP 404) (Request-ID: req-c5318008-d26b-4ede-b7fd-677dc2a1d240) | 13:48 |
| BlackDex | what is going wrong? | 13:48 |
| *** markvoelker has joined #openstack-keystone | 13:51 | |
| *** spzala has quit IRC | 13:51 | |
| *** markvoelker has quit IRC | 13:56 | |
| *** guoshan has joined #openstack-keystone | 13:56 | |
| dstanek | rodrigods: yes | 13:59 |
| rodrigods | dstanek, maybe you know how to help... when configuring federation on Apache (the Location stuff for Shibboleth, for example) | 14:00 |
| dstanek | rodrigods: what's the trouble? | 14:00 |
| rodrigods | it is not working well with the /identity URI vs using the port :5000, for example | 14:01 |
| rodrigods | this is for DevStack | 14:01 |
| *** guoshan has quit IRC | 14:01 | |
| *** amoralej|lunch is now known as amoralej | 14:02 | |
| dstanek | rodrigods: i've not had any issues that i can recall | 14:04 |
| dstanek | i do this: https://github.com/dstanek/ansible-role-keystone-sp/blob/master/tasks/_configure_apache.yml | 14:04 |
| rodrigods | dstanek, hmmm /identity before /v3 in Location | 14:05 |
| rodrigods | think that's it :) | 14:05 |
| dstanek | rodrigods: yeah. in devstack the keystone URLs follow /identity | 14:06 |
| rodrigods | dstanek, thought would be enough to have starting from /v3, but Location expects the correct URL - forgot about that | 14:06 |
| dstanek | rodrigods: yeah, that gets match by apache on the URL coming in | 14:07 |
| rodrigods | thanks dstanek | 14:07 |
| *** maestropandy has joined #openstack-keystone | 14:08 | |
| dstanek | np | 14:09 |
| *** maestropandy has left #openstack-keystone | 14:09 | |
| *** jdennis has joined #openstack-keystone | 14:13 | |
| *** jperry has joined #openstack-keystone | 14:18 | |
| *** ravelar has joined #openstack-keystone | 14:23 | |
| *** phalmos has joined #openstack-keystone | 14:29 | |
| *** phalmos has quit IRC | 14:34 | |
| *** adrian_otto has joined #openstack-keystone | 14:35 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Fix some spelling mistaks in base.py & auth.py https://review.openstack.org/398929 | 14:35 |
| dstanek | ^ that's my favorite commit message | 14:35 |
| *** asettle__ has joined #openstack-keystone | 14:36 | |
| *** asettle__ has quit IRC | 14:37 | |
| *** asettle__ has joined #openstack-keystone | 14:38 | |
| *** asettle has quit IRC | 14:38 | |
| *** adrian_otto has quit IRC | 14:40 | |
| *** asettle__ is now known as asettle | 14:40 | |
| *** jaosorior has quit IRC | 14:41 | |
| *** agrebennikov has joined #openstack-keystone | 14:41 | |
| *** phalmos has joined #openstack-keystone | 14:42 | |
| *** adrian_otto has joined #openstack-keystone | 14:43 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:43 | |
| *** henrynash has joined #openstack-keystone | 14:46 | |
| *** ChanServ sets mode: +v henrynash | 14:46 | |
| stevemar | dstanek: lol | 14:49 |
| *** jaugustine has joined #openstack-keystone | 14:49 | |
| *** guoshan has joined #openstack-keystone | 14:50 | |
| *** chris_hultin is now known as chris_hultin|AWA | 14:53 | |
| *** guoshan has quit IRC | 14:55 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Token Verify Role Check https://review.openstack.org/391624 | 15:07 |
| ayoung | kfox1111, lbragstad ^^ adds in the in_process check. | 15:08 |
| lbragstad | ayoung ok i'll get around to reviewing that | 15:08 |
| openstackgerrit | melissaml proposed openstack/keystoneauth: Fix a typo in base.py https://review.openstack.org/399060 | 15:11 |
| *** adrian_otto has quit IRC | 15:11 | |
| *** adrian_otto has joined #openstack-keystone | 15:11 | |
| *** henrynash has quit IRC | 15:25 | |
| openstackgerrit | melissaml proposed openstack/keystone-specs: Fix typos in documents https://review.openstack.org/399074 | 15:25 |
| *** diazjf has joined #openstack-keystone | 15:37 | |
| *** jdennis has quit IRC | 15:40 | |
| *** guoshan has joined #openstack-keystone | 15:45 | |
| *** jdennis has joined #openstack-keystone | 15:45 | |
| mfisch | breton: I was going to add you to https://review.openstack.org/#/c/383333/ but then I realized I have no idea who you are ;) | 15:46 |
| *** guoshan has quit IRC | 15:49 | |
| *** markvoelker has joined #openstack-keystone | 15:52 | |
| breton | mfisch: bbobrov@mirantis.com :) | 15:55 |
| breton | mfisch: i am tackling it now and have no idea what's going on. | 15:55 |
| mfisch | breton: ah yes we met in Barcelona, I didnt connect the IRC nick thanks | 15:56 |
| *** markvoelker has quit IRC | 15:57 | |
| *** spzala has joined #openstack-keystone | 15:59 | |
| breton | mfisch: you said that you don't run into it in production, right? | 16:01 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone-specs: Devstack Plugin for Keystone https://review.openstack.org/395841 | 16:01 |
| *** nk2527 has quit IRC | 16:02 | |
| *** pcaruana has quit IRC | 16:10 | |
| *** ayoung has quit IRC | 16:10 | |
| *** adrian_otto has quit IRC | 16:15 | |
| breton | the patch fails a lot of v2-v3 intermix tests | 16:15 |
| *** chris_hultin|AWA is now known as chris_hultin | 16:16 | |
| breton | mfisch: why do you want it enabled by default? | 16:17 |
| breton | mfisch: does it give you any increase in performance? | 16:18 |
| mfisch | just seems like it should be | 16:18 |
| mfisch | but beyond that the fact that it fails CI means to me that the feature is broken possibly | 16:18 |
| breton | actually i don't see how it can help. | 16:18 |
| mfisch | so I'm concerned to use it at all | 16:18 |
| breton | because it takes the time to validate the token anyway | 16:19 |
| breton | so non-cache validation happens at token issuing time anyway | 16:19 |
| breton | so if issuing took 0.1s + validation 0.1s = 0.2s, now it takes issuing 0.15s + validation 0.05s | 16:20 |
| breton | which is still 0.2s | 16:20 |
| breton | what we need to do is to figure out whether it works in v2-v3 intermix cases when run under real server | 16:21 |
| breton | if yes, fix only tests | 16:21 |
| breton | if no, well... | 16:21 |
| mfisch | im on a call right now, give me 10 min | 16:25 |
| mfisch | breton: I have no real perf data right now to tell if its useful | 16:27 |
| *** chrisplo has quit IRC | 16:27 | |
| mfisch | but yeah figuring out if its a test issue or a real issue is important | 16:27 |
| mfisch | in my virtual openstack build I use I did not see issues with it | 16:27 |
| mfisch | but the load is very low | 16:27 |
| *** adrian_otto has joined #openstack-keystone | 16:31 | |
| *** henrynash has joined #openstack-keystone | 16:33 | |
| *** ChanServ sets mode: +v henrynash | 16:33 | |
| *** belmoreira has quit IRC | 16:35 | |
| * lbragstad stevemar dstanek dolphm ping regarding the policy meeting - see ttx's comment here -= https://review.openstack.org/#/c/398500/3 | 16:40 | |
| *** guoshan has joined #openstack-keystone | 16:45 | |
| *** guoshan has quit IRC | 16:50 | |
| *** rarora has left #openstack-keystone | 16:52 | |
| *** browne has joined #openstack-keystone | 16:55 | |
| dstanek | lbragstad: did we have not then just keystone peeps there? | 16:55 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone-specs: Devstack Plugin for Keystone https://review.openstack.org/395841 | 16:56 |
| lbragstad | dstanek if i recall correctly - i though nova had some sessions on policy previously | 17:00 |
| lbragstad | i assumed it to be a cross project meeting since whatever we do will more than likely affect other projects | 17:00 |
| openstackgerrit | Merged openstack/keystone-specs: Fix typos in documents https://review.openstack.org/399074 | 17:04 |
| dstanek | lbragstad: they definitely had policy sessions at previous summits | 17:05 |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Using assertIsNotNone() instead of assertNotEqual(None) https://review.openstack.org/397521 | 17:05 |
| *** ayoung has joined #openstack-keystone | 17:10 | |
| *** ChanServ sets mode: +v ayoung | 17:10 | |
| *** adrian_otto has quit IRC | 17:12 | |
| *** chrisplo has joined #openstack-keystone | 17:26 | |
| *** adrian_otto has joined #openstack-keystone | 17:41 | |
| openstackgerrit | Merged openstack/keystoneauth: Fix a typo in base.py https://review.openstack.org/399060 | 17:46 |
| *** Zer0Byte__ has joined #openstack-keystone | 17:47 | |
| *** ayoung has quit IRC | 17:55 | |
| *** asettle has quit IRC | 18:00 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 18:02 |
| *** browne has quit IRC | 18:02 | |
| rodrigods | rderose, so... it is expected that i can't delete a protocol after the federated_user is created? i mean... we have the foreign_key there, but this looks like a bug to me | 18:02 |
| rderose | rodrigods: hmm... | 18:03 |
| rderose | rodrigods: it's because of the foreign key? | 18:04 |
| rderose | what's the error? | 18:04 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 18:04 |
| rodrigods | rderose, http://paste.openstack.org/raw/589631/ | 18:04 |
| rderose | rodrigods: yeah, it's a bug | 18:05 |
| rderose | rodrigods: just not sure how we should handle it | 18:05 |
| rodrigods | rderose, i'd say to cascade delete everything | 18:05 |
| rodrigods | will create the ticket in launchpad | 18:05 |
| rderose | rodrigods: if you delete the protocol, should we delete the federated users associated with that protocol? | 18:05 |
| rodrigods | rderose, i guess yes? so it could be recreated with a different protocol? | 18:06 |
| *** markvoelker has joined #openstack-keystone | 18:07 | |
| *** henrynash has quit IRC | 18:07 | |
| rderose | rodrigods: sounds reasonable | 18:07 |
| *** henrynash has joined #openstack-keystone | 18:08 | |
| *** ChanServ sets mode: +v henrynash | 18:08 | |
| rderose | rodrigods: it will get trickier with account linking | 18:08 |
| rderose | rodrigods: lets say an ldap user and federated user are the same user | 18:08 |
| rderose | rodrigods: removing the protocol shouldn't delete the user, only the row in federated user | 18:09 |
| rderose | rodrigods: can the same protocol be used for multiple IdPs? | 18:09 |
| knikolla | as far as i know, a protocol is specific to a idp | 18:10 |
| rderose | knikolla: yeah, just looking at the api, it's specific to the idp | 18:10 |
| rodrigods | rderose, https://bugs.launchpad.net/keystone/+bug/1642692 | 18:12 |
| openstack | Launchpad bug 1642692 in OpenStack Identity (keystone) "Protocol can't be deleted after federated_user is created" [Undecided,New] | 18:12 |
| rodrigods | rderose, hmm, right | 18:12 |
| rodrigods | just the federated user, i guess | 18:12 |
| *** tqtran has joined #openstack-keystone | 18:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 18:17 |
| *** guoshan has joined #openstack-keystone | 18:18 | |
| *** henrynash has quit IRC | 18:18 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 18:18 |
| *** ayoung has joined #openstack-keystone | 18:21 | |
| *** ChanServ sets mode: +v ayoung | 18:21 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 18:21 |
| ayoung | rderose, YES! | 18:22 |
| ayoung | I've been waiting for domain->idp | 18:22 |
| *** guoshan has quit IRC | 18:22 | |
| rderose | ayoung: :) | 18:22 |
| rderose | ayoung: it's been giving me so much headaches | 18:23 |
| rderose | ayoung: lbragstad too :) | 18:23 |
| rderose | time to bite the bullet | 18:23 |
| ayoung | rderose, I wonder how we are going to deal with porting people forward? | 18:23 |
| ayoung | say an Idp does not have one right now, what do we do with it? Make it the default or federated domain to start? | 18:24 |
| rderose | ayoung: we can get the domain_id from the group in the mapping | 18:24 |
| rderose | ayoung: if it doesn't exist, we can auto create a federated_domain | 18:24 |
| ayoung | rderose, would be awesome if we could deduce from mappings | 18:25 |
| rderose | ayoung: we should be able to; planning to start that next | 18:25 |
| ayoung | if an IdP has a mapping set up for one of its protocols that maps to a specific domain, grab it | 18:25 |
| ayoung | cool | 18:25 |
| rderose | right | 18:25 |
| ayoung | rderose, so, one issue I am concerned with is mapping people to the same domain via LDAP and SAML | 18:27 |
| ayoung | someday oauth, but SAML is the current problem | 18:27 |
| rderose | ayoung: hmm... | 18:28 |
| ayoung | say we already have an LDAP set up, and they have been using the identity mapping code. How would Federated uses get correctly mapped to existing accounts? | 18:28 |
| rderose | ayoung: right, you connect thru ldap at work and federated at starbucks... the user should be under the same domain, correct? | 18:29 |
| rderose | ayoung: hmm... either way, we need to think this part through | 18:32 |
| rderose | ayoung: currently, we don't have a way to do this. we've have to expand mapping engine and also shadowing | 18:32 |
| rderose | ayoung: mapping would be easy, this federated user is this local user, but currently shadowing would create a new user | 18:34 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: WIP: Federated authentication via ECP functional tests https://review.openstack.org/324769 | 18:36 |
| ayoung | rderose, that was why Iwas so insistant that we use the same id-mapping mechanism | 18:42 |
| ayoung | rderose, but eventhen I suspect we would have a problem with the values being slightly different for protocol. | 18:43 |
| ayoung | rderose, the real path I want is from LDAP to Federation using SSSD and Kerberos or LDAP to X509 (or both) as those are more secure authN mechs | 18:44 |
| ayoung | But all of them should map to the same set of users | 18:44 |
| ayoung | rderose, say a user comes in via LDAP now. What would be the steps (even if required to hack the database) to make a federated user map to that same account today? | 18:45 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Devstack plugin to federate with testshib.org https://review.openstack.org/393932 | 18:47 |
| *** jpich has quit IRC | 18:47 | |
| rderose | ayoung: to do that, you would simply have to have a record in the federated_user table for the LDAP user | 18:49 |
| *** diazjf has quit IRC | 18:49 | |
| rderose | ayoung: now the user could auth via ldap and federation | 18:49 |
| ayoung | rderose, we don't have an API that can dothat yet, do we? | 18:49 |
| *** browne has joined #openstack-keystone | 18:49 | |
| rderose | no, working on it: | 18:49 |
| rderose | https://review.openstack.org/#/c/397410/ | 18:49 |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Extend user API to support federated attributes https://review.openstack.org/397410 | 18:50 |
| openstackgerrit | Ron De Rose proposed openstack/keystone-specs: Extend user API to support federated attributes https://review.openstack.org/397410 | 18:51 |
| ayoung | rderose, need to be able to delete, too. But I like that spec | 18:52 |
| *** diazjf has joined #openstack-keystone | 18:52 | |
| rderose | ayoung: oh yeah | 18:52 |
| rderose | ayoung: as I think about it, I keep adding to the spec, but I think it makes sense | 18:52 |
| ayoung | rderose, its still not really scalable, just reactionary, though | 18:52 |
| ayoung | we should be able to pre-seed the LDAP users en mass. | 18:53 |
| ayoung | I guess you could iterate to do that,though | 18:53 |
| rderose | ayoung: shadow mapping will do that for us | 18:53 |
| rderose | ayoung: but you still will want to do things like trusts and our user API should support all of that | 18:53 |
| *** dhellmann has joined #openstack-keystone | 18:54 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Devstack plugin to federate with testshib.org https://review.openstack.org/393932 | 18:54 |
| *** amoralej is now known as amoralej|off | 18:55 | |
| rderose | ayoung: and you may not want to bulk load all of your users, right? you may require users to request, approve, and then you can provision access | 18:55 |
| *** edtubill has joined #openstack-keystone | 18:56 | |
| *** adrian_otto has quit IRC | 18:56 | |
| *** henrynash has joined #openstack-keystone | 18:56 | |
| *** ChanServ sets mode: +v henrynash | 18:56 | |
| ayoung | rderose, different business requirement there. LDAP usually means "if I can query you, yo uare a Keystone user" . But I could see an approach that links from Federation to an existing domain of users, maybe matching on exitin username to some exteranl attribute | 18:57 |
| rderose | yeah, that would work | 18:58 |
| rderose | ayoung: so shadow mapping will do the en mass, extending the API will let you do everything else (delegation, account linking...) | 18:59 |
| ayoung | rderose, excellent. I'll track your spec, and maybe post a mailing list thread where we can talk through it. OK? | 19:00 |
| rderose | ayoung: sounds good | 19:00 |
| *** edtubill has quit IRC | 19:03 | |
| *** guoshan has joined #openstack-keystone | 19:19 | |
| mfisch | breton: stevemar I will do some perf tests wrt cache_on_issue today | 19:20 |
| *** guoshan has quit IRC | 19:23 | |
| chrisplo | rderose: I know our product doesn't want to mass import from LDAP, as it is we have custom liberty changes to prevent user list from listing LDAP, just users we've added to id_mapping | 19:29 |
| *** iurygregory has quit IRC | 19:29 | |
| rderose | chrisplo: I see, and that would still work | 19:30 |
| rderose | chrisplo: so you are doing this through federation or ldap plugin? | 19:31 |
| chrisplo | that particular piece was for LDAP, I'm working on ephemeral SAML integration now | 19:32 |
| rderose | chrisplo: cool | 19:33 |
| rderose | chrisplo: prior to newton the api won't return federated users via the API | 19:36 |
| rderose | chrisplo: however, we're shadowing federated users in newton, so the user API will return federated users | 19:37 |
| rderose | chrisplo: only federated users that have authenticated that is | 19:38 |
| chrisplo | i was looking at the spec this morning, I'm sadly not up to date | 19:38 |
| *** gyee has joined #openstack-keystone | 19:38 | |
| *** ChanServ sets mode: +v gyee | 19:38 | |
| chrisplo | shadow-users-newton spec that is, if that's what you're referring to | 19:40 |
| *** openstackgerrit has quit IRC | 19:48 | |
| *** openstackgerrit has joined #openstack-keystone | 19:48 | |
| *** edtubill has joined #openstack-keystone | 19:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 20:08 |
| lbragstad | gagehugo thanks for the feedback! | 20:08 |
| gagehugo | lbragstad anytime! I really do wish that doc existed before, I had some issues with how doctor worked and that would have saved me a bunch of time | 20:09 |
| lbragstad | gagehugo lol, me too | 20:09 |
| *** spzala has quit IRC | 20:13 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 20:16 |
| gagehugo | lbragstad I left a comment, but other than that one thing, I think it's good | 20:24 |
| *** adrian_otto has joined #openstack-keystone | 20:27 | |
| dstanek | "--os-auth-type: invalid choice: u'v3unscopedsaml'" .... grrrrrr | 20:32 |
| dstanek | rodrigods: any thoughts ^ | 20:40 |
| *** ayoung has quit IRC | 20:59 | |
| *** spzala has joined #openstack-keystone | 21:00 | |
| *** edtubill has quit IRC | 21:00 | |
| *** raildo has quit IRC | 21:00 | |
| breton | dstanek: we dropped that name | 21:02 |
| breton | dstanek: it is now v3saml or just saml | 21:02 |
| breton | dstanek: let me check | 21:02 |
| dstanek | breton: v3samlpassword seems to work. v3{un}scopedsaml is listed in my setup.cfg, but it doesn't appear to be working | 21:03 |
| breton | dstanek: right, v3samlpassword. | 21:04 |
| *** guoshan has joined #openstack-keystone | 21:20 | |
| *** guoshan has quit IRC | 21:25 | |
| *** jamielennox is now known as jamielennox|away | 21:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Require domain_id when registering Identity Providers https://review.openstack.org/399157 | 21:45 |
| stevemar | i have so many patches to review!!!! | 21:51 |
| mfisch | catch up next week when the US is out | 21:56 |
| stevemar | mfisch: seriously though, it's an awesome week for all non-US people | 21:57 |
| stevemar | mfisch: its like the whole world shits down a gear or two | 21:58 |
| mfisch | you all start your 8 weeks of paid vacations | 21:58 |
| gagehugo | everyone is sedated from too much turkey | 21:58 |
| mfisch | stevemar: so a quick update on cache_on_issue | 21:59 |
| mfisch | it seems to speed things up a small amount but it's within the error limit | 21:59 |
| mfisch | around 6% | 21:59 |
| mfisch | the runs were (in ms): without caching: 144, 118, 143 | 22:00 |
| mfisch | with caching: 127, 129, 122 | 22:00 |
| mfisch | so I dont think thats definitive | 22:00 |
| stevemar | you mean without pre_caching and with pre_caching? | 22:01 |
| *** adriant has joined #openstack-keystone | 22:01 | |
| stevemar | mfisch: yeah, the improvement wasn't going to be huge, i assumed | 22:02 |
| mfisch | cache_on_issue yeah | 22:02 |
| mfisch | serially its about 2% | 22:02 |
| mfisch | stevemar: also for newton we switched to pyMySQL - have you heard of any issues with that? I know mySQL-Python was deprecated ages ago | 22:03 |
| stevemar | mfisch: you asked at the summit, i haven't heard of any issues | 22:03 |
| mfisch | ok | 22:03 |
| mfisch | I'm going to ask ops | 22:04 |
| mfisch | rather know now than find out that 0.01% chance of dropping all tables or something | 22:04 |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Add reason to notifications for PCI-DSS https://review.openstack.org/396752 | 22:05 |
| ravelar | stevemar quick question on https://bugs.launchpad.net/keystone/+bug/1641821 | 22:09 |
| openstack | Launchpad bug 1641821 in OpenStack Identity (keystone) "admin guide: Cleanup LDAP" [Low,New] - Assigned to Richard (csravelar) | 22:09 |
| *** edmondsw has quit IRC | 22:09 | |
| *** jaugustine has quit IRC | 22:09 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add developer docs for keystone-manage doctor https://review.openstack.org/399163 | 22:16 |
| stevemar | ravelar: yessum | 22:18 |
| ravelar | stevemar, just wanted clarification when you mentioned that the keystone team recommended something other than a single ldap | 22:19 |
| stevemar | ravelar: https://developer.ibm.com/opentech/2015/08/14/configuring-keystone-with-ibms-bluepages-ldap/ | 22:20 |
| stevemar | basically that | 22:20 |
| stevemar | ravelar: you should be setting up another domain for the ldap | 22:20 |
| *** guoshan has joined #openstack-keystone | 22:21 | |
| ravelar | stevemar, ahh I see thanks :) | 22:21 |
| stevemar | ravelar: and a separate keystone.<domain_name>.conf file should be created for each (i think parts of the admin-guide already say this) | 22:22 |
| *** chris_hultin is now known as chris_hultin|AWA | 22:23 | |
| *** jamielennox|away is now known as jamielennox | 22:24 | |
| *** guoshan has quit IRC | 22:25 | |
| *** ravelar has quit IRC | 22:28 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystoneauth: Using assertIsNotNone() instead of assertNotEqual(None) https://review.openstack.org/397521 | 22:34 |
| rderose | stevemar: I think we need granular and domain level security compliance | 22:38 |
| stevemar | mmm | 22:38 |
| rderose | stevemar: you may want all users to have a certain password strength, but some passwords should never expire | 22:39 |
| rderose | stevemar: and by having a lockout ignore list, doesn't prevent us from having domain level blacklist/whitelist | 22:39 |
| stevemar | rderose: agreed. | 22:39 |
| stevemar | rderose: a list of domains that will not have PCI compliance would be the most backwards compatible i think | 22:40 |
| rderose | stevemar: true | 22:40 |
| stevemar | or the least amount for of changes for people to do | 22:41 |
| stevemar | so [security] blacklist_domain = Default | 22:41 |
| stevemar | but hmm, that still seems like a half measure, what if i want compliance for some parts of default domain, but not others | 22:42 |
| rderose | stevemar: yeah | 22:42 |
| stevemar | otherwise we'll end up being forced to use some options, or none of them | 22:43 |
| stevemar | rderose: maybe we can get henrynash to do the work ;) | 22:44 |
| stevemar | since he did it for ldap | 22:44 |
| rderose | stevemar: ha | 22:44 |
| rderose | stevemar: sure | 22:44 |
| rderose | stevemar: what did he do for ldap? | 22:44 |
| rderose | domain-level config? | 22:45 |
| stevemar | rderose: yep | 22:45 |
| stevemar | the whole, define ldap settings in a keystone.domainA.conf file | 22:45 |
| rderose | ah | 22:45 |
| rderose | stevemar: yeah, I think we'll granular and domain-level, but not sure I like doing this all in the config | 22:46 |
| rderose | stevemar: wanted to think thru the domain-level part, but in the meantime add the lockout ignore list | 22:47 |
| rderose | since that was an easy one | 22:47 |
| rderose | dam stevemar, another -1! why don't you just -1 everything I do :) | 22:49 |
| rderose | oh, that was just a soft -1 :) | 22:50 |
| *** jperry has quit IRC | 23:01 | |
| openstackgerrit | Merged openstack/keystone: Remove entry_points to non-existent drivers https://review.openstack.org/398795 | 23:08 |
| *** ayoung has joined #openstack-keystone | 23:10 | |
| *** ChanServ sets mode: +v ayoung | 23:10 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Lockout ignore user list https://review.openstack.org/398571 | 23:12 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Lockout ignore user list https://review.openstack.org/398571 | 23:14 |
| *** catintheroof has quit IRC | 23:29 | |
| *** chris_hultin|AWA is now known as chris_hultin | 23:30 | |
| *** catintheroof has joined #openstack-keystone | 23:30 | |
| stevemar | david-lyle: you gonna propose a release of doa-kerb? | 23:35 |
| *** catintheroof has quit IRC | 23:35 | |
| *** lamt has quit IRC | 23:37 | |
| david-lyle | stevemar: sure | 23:39 |
| *** agrebennikov has quit IRC | 23:41 | |
| *** dave-mccowan has quit IRC | 23:42 | |
| david-lyle | stevemar: last released version was from jamielennox's github repo | 23:44 |
| stevemar | david-lyle: lol | 23:44 |
| stevemar | terrible | 23:44 |
| jamielennox | ergh really? | 23:44 |
| david-lyle | yeah | 23:44 |
| stevemar | i guess we can't release it easily? is it even a real project? | 23:44 |
| david-lyle | openstack-ci is an owner too | 23:44 |
| stevemar | like under governance | 23:45 |
| stevemar | oh thats good | 23:45 |
| jamielennox | so the docs might say that, but i find it unlikely because i hate releasing myself | 23:45 |
| jamielennox | i'd much prefer to make zuul do it | 23:45 |
| david-lyle | source link is correct on PyPI | 23:45 |
| david-lyle | I'll add it to release so we can kill it | 23:46 |
| stevemar | ah there it is: https://github.com/openstack/governance/blob/master/reference/projects.yaml#L575-L577 | 23:46 |
| stevemar | david-lyle: yeah, i will propose the patch to kill it | 23:46 |
| stevemar | jamielennox: want me to kill ksc-kerb too? | 23:46 |
| david-lyle | ok | 23:46 |
| jamielennox | stevemar: yea, ksa all the way | 23:47 |
| stevemar | it's been deprecated for 9 mos | 23:47 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: [api] add changelog from 3.0 -> 3.7 https://review.openstack.org/399301 | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!