| ayoung | the Nova one still fails aon a tempest test. Not sure why, but it is trying to call an admin API that is not allowed without adming+project...they must set it some other way | 00:00 |
|---|---|---|
| ayoung | jamielennox, http://logs.openstack.org/48/384148/9/check/gate-grenade-dsvm-neutron-multinode-ubuntu-xenial/3ed7b7b/ | 00:01 |
| ayoung | Working on tempest once I can get a stable run with no changes. | 00:02 |
| *** ayoung has quit IRC | 00:07 | |
| *** lamt has quit IRC | 00:14 | |
| *** jamielennox is now known as jamielennox|away | 00:17 | |
| *** adrian_otto has joined #openstack-keystone | 00:20 | |
| *** jamielennox|away is now known as jamielennox | 00:23 | |
| *** ayoung has joined #openstack-keystone | 00:29 | |
| *** ChanServ sets mode: +v ayoung | 00:29 | |
| *** duonghq_ is now known as duonghq | 00:29 | |
| *** gyee has joined #openstack-keystone | 00:31 | |
| *** ChanServ sets mode: +v gyee | 00:31 | |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Remove CONF.os_inherit.enabled https://review.openstack.org/405679 | 00:32 |
| morgan | ayoung: commented on your RBAC spec | 00:33 |
| *** diazjf has joined #openstack-keystone | 00:33 | |
| *** code-R has joined #openstack-keystone | 00:34 | |
| ayoung | morgan, on https://review.openstack.org/#/c/391624/ ? Where? | 00:40 |
| *** hoangcx has joined #openstack-keystone | 00:41 | |
| morgan | clicked post, looks like it didn't go through the 1st time | 00:42 |
| morgan | it is posted now | 00:42 |
| morgan | ayoung: i assume if someone wants to just continue with the current policy implementation, they can do so for now. | 00:46 |
| ayoung | morgan, absolutely | 00:46 |
| morgan | perfect | 00:46 |
| *** jamielennox is now known as jamielennox|away | 00:46 | |
| ayoung | morgan, so the rules are fetch and cache | 00:47 |
| ayoung | no reason to fetch them on each token validation. THe way I originally wrote it was that you would do the rbac check in Keystone during token validation, but jamielennox|away pointed out that would break token caching. This is the compromise | 00:48 |
| morgan | ayoung: it just wasn't clear the way you had it phrased. | 00:48 |
| ayoung | I was trying to write out what happened the first time. Caching is discussed later | 00:49 |
| *** agrebennikov has quit IRC | 00:51 | |
| *** jamielennox|away is now known as jamielennox | 00:53 | |
| morgan | right, note what i said, adding "if needed" into that sentence makes it have a ton of wiggle room | 00:55 |
| morgan | either get each time, cache, do something else wild | 00:55 |
| morgan | none of my comments (i think) warranted a -1 | 00:56 |
| ayoung | morgan, so you like? Think we can get this for Ocata? | 00:56 |
| morgan | just answers in-line | 00:56 |
| morgan | i think it's doable | 00:56 |
| ayoung | answers posted | 00:56 |
| morgan | the biggest request i'd have is to implement a boot-strapping cli option | 00:57 |
| morgan | just for initial import vs needing to do OSC work | 00:57 |
| morgan | *every* time i stand up a cloud. you likely know the rules you want to apply initially. | 00:57 |
| morgan | and we can just directly inject them into the DB via the internal interfaces. | 00:57 |
| morgan | but again, not really a show-stopper if not doable | 00:58 |
| ayoung | I think bootstrap can set the default trivially. I need to figure out how to implement that without creating another table, though | 00:58 |
| morgan | i wouldn't do it via bootstrap | 00:58 |
| morgan | itself that is | 00:58 |
| morgan | i probably would isolate it to a separate command (just like dbsync is separate) | 00:58 |
| ayoung | Say we had a verb "ALL" | 00:58 |
| ayoung | and something the same for the verb patterns. | 00:58 |
| morgan | "ANY" :) | 00:58 |
| morgan | but yeah, that works for me | 00:59 |
| adriant | morgan: sadly didn't get a chance look over the MFA spec. Will look at it tonight. Just had my head too deep into billing and business logic... | 00:59 |
| ayoung | "ANY" "ANY" "Member" would make sense | 00:59 |
| morgan | adriant: np | 00:59 |
| morgan | adriant: i hope you find it covers the bases well | 00:59 |
| morgan | ayoung: yeah that is kind of my thought | 00:59 |
| morgan | ANY is better than ALL | 00:59 |
| morgan | ALL implies always | 00:59 |
| ayoung | morgan, ++ | 01:00 |
| ayoung | add that to the spec comments, would you? | 01:00 |
| morgan | sure. | 01:00 |
| ayoung | morgan, so long as admin implied Member, we can make the default be Member for any API | 01:01 |
| morgan | posted | 01:02 |
| morgan | added exactly what you said, "ANY" "ANY" "<role>" | 01:02 |
| morgan | i mean it might even be doable with bootstrap itself | 01:02 |
| *** code-R has quit IRC | 01:03 | |
| *** code-R has joined #openstack-keystone | 01:04 | |
| *** gyee has quit IRC | 01:06 | |
| *** zhangjl has joined #openstack-keystone | 01:08 | |
| *** edmondsw has joined #openstack-keystone | 01:13 | |
| *** edmondsw has quit IRC | 01:17 | |
| *** jrist has joined #openstack-keystone | 01:18 | |
| *** guoshan has joined #openstack-keystone | 01:18 | |
| *** dave-mccowan has joined #openstack-keystone | 01:24 | |
| *** liujiong has joined #openstack-keystone | 01:37 | |
| *** code-R has quit IRC | 01:39 | |
| openstackgerrit | ayoung proposed openstack/keystone: URL pattern based RBAC Management Interface https://review.openstack.org/401808 | 01:46 |
| *** edmondsw has joined #openstack-keystone | 01:49 | |
| *** browne has quit IRC | 01:50 | |
| *** edmondsw has quit IRC | 01:54 | |
| *** diazjf has quit IRC | 02:02 | |
| *** adrian_otto has quit IRC | 02:16 | |
| *** tqtran has quit IRC | 02:18 | |
| *** dave-mccowan has quit IRC | 02:20 | |
| *** edmondsw has joined #openstack-keystone | 02:26 | |
| *** dave-mccowan has joined #openstack-keystone | 02:30 | |
| *** edmondsw has quit IRC | 02:30 | |
| *** guoshan has quit IRC | 02:40 | |
| *** Ephur has quit IRC | 02:52 | |
| *** guoshan has joined #openstack-keystone | 02:53 | |
| *** namnh has joined #openstack-keystone | 02:55 | |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Remove CONF.os_inherit.enabled https://review.openstack.org/405679 | 03:01 |
| *** edmondsw has joined #openstack-keystone | 03:02 | |
| *** edmondsw has quit IRC | 03:07 | |
| *** jamielennox is now known as jamielennox|away | 03:11 | |
| *** diazjf has joined #openstack-keystone | 03:12 | |
| *** diazjf has quit IRC | 03:16 | |
| *** browne has joined #openstack-keystone | 03:17 | |
| *** browne has quit IRC | 03:18 | |
| openstackgerrit | ayoung proposed openstack/keystone: Refactor Authorization: https://review.openstack.org/387161 | 03:19 |
| *** jamielennox|away is now known as jamielennox | 03:20 | |
| stevemar | i find it funny that morgan and ayoung are both in full keystone mode at the same time | 03:21 |
| *** browne has joined #openstack-keystone | 03:22 | |
| *** masber has joined #openstack-keystone | 03:26 | |
| *** masber has quit IRC | 03:26 | |
| *** cheran has quit IRC | 03:27 | |
| openstackgerrit | Merged openstack/keystone-specs: Fix python version to 2.7 for docs https://review.openstack.org/405074 | 03:28 |
| *** dave-mccowan has quit IRC | 03:28 | |
| *** jamielennox is now known as jamielennox|away | 03:30 | |
| *** jamielennox|away is now known as jamielennox | 03:37 | |
| openstackgerrit | ayoung proposed openstack/keystone: Refactor is_admin https://review.openstack.org/387710 | 03:38 |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 03:38 |
| openstackgerrit | ayoung proposed openstack/oslo.policy: Convert Exceptions to failures. https://review.openstack.org/165908 | 03:44 |
| *** code-R has joined #openstack-keystone | 03:44 | |
| *** browne has quit IRC | 03:47 | |
| *** links has joined #openstack-keystone | 03:52 | |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Remove CONF.os_inherit.enabled https://review.openstack.org/405679 | 03:54 |
| openstackgerrit | ayoung proposed openstack/keystone: IAM Models https://review.openstack.org/184651 | 03:55 |
| *** nicolasbock has quit IRC | 03:56 | |
| *** guoshan has quit IRC | 03:59 | |
| ayoung | stevemar, what are we doing about APIs now with specs, since we moved the old API doc into the attick in keystone-specs? | 04:00 |
| stevemar | ayoung: they are all stored here: https://github.com/openstack/keystone/tree/master/api-ref/source | 04:01 |
| ayoung | stevemar, so they don't go in the specs anymore, right? | 04:01 |
| stevemar | you can propose a brief outline of the APIs within the spec, if you like, but nothing crazy detailed | 04:02 |
| ayoung | to what degree are we fleshing out the apis... | 04:02 |
| ayoung | ah ok | 04:02 |
| stevemar | enough to convey the idea | 04:02 |
| *** zhangjl has quit IRC | 04:02 | |
| *** Marcellin__ has quit IRC | 04:08 | |
| *** code-R has quit IRC | 04:11 | |
| *** kanikasingh has joined #openstack-keystone | 04:12 | |
| *** code-R has joined #openstack-keystone | 04:14 | |
| *** kanikasingh has quit IRC | 04:15 | |
| *** udesale has joined #openstack-keystone | 04:19 | |
| *** adrian_otto has joined #openstack-keystone | 04:20 | |
| *** zhangjl has joined #openstack-keystone | 04:24 | |
| *** code-R has quit IRC | 04:28 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Tokens with subsets of roles https://review.openstack.org/186979 | 04:37 |
| stevemar | ayoung: thank you for cleaning up your older specs | 04:39 |
| stevemar | crinkle: not sure if you're around yet, but folks are interested to hear your opinions on https://review.openstack.org/#/c/390948/ | 04:55 |
| stevemar | davechen: easy one: https://review.openstack.org/#/c/404806/ :) | 04:57 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/405816 | 05:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystoneauth: Updated from global requirements https://review.openstack.org/405817 | 05:06 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/405818 | 05:06 |
| ayoung | stevemar, wanted to get to that for a while | 05:06 |
| ayoung | stevemar, most of them are still good, but I've canned a couple. The endpoint subset one is going to come up again in the future, but I think we can conquer that one with RBAC....maybe. | 05:07 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/oslo.policy: Updated from global requirements https://review.openstack.org/405877 | 05:12 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/405889 | 05:13 |
| *** diazjf has joined #openstack-keystone | 05:14 | |
| *** voelzmo has joined #openstack-keystone | 05:16 | |
| *** voelzmo has quit IRC | 05:16 | |
| *** voelzmo has joined #openstack-keystone | 05:16 | |
| *** voelzmo has quit IRC | 05:23 | |
| *** guoshan has joined #openstack-keystone | 05:35 | |
| *** adriant has quit IRC | 05:43 | |
| *** jaosorior has joined #openstack-keystone | 06:06 | |
| *** code-R has joined #openstack-keystone | 06:11 | |
| openstackgerrit | Merged openstack/keystone: More info in schema validation error https://review.openstack.org/405006 | 06:12 |
| *** edmondsw has joined #openstack-keystone | 06:19 | |
| *** adrian_otto has quit IRC | 06:19 | |
| *** diazjf has quit IRC | 06:20 | |
| *** edmondsw has quit IRC | 06:23 | |
| davechen | stevemar: +2ed, not that easy ;) | 06:27 |
| crinkle | stevemar: commented | 06:32 |
| *** openstackgerrit has quit IRC | 06:33 | |
| *** openstackgerrit has joined #openstack-keystone | 06:41 | |
| openstackgerrit | Merged openstack/keystoneauth: Updated from global requirements https://review.openstack.org/405817 | 06:41 |
| *** richm has quit IRC | 06:42 | |
| *** josecastroleon has joined #openstack-keystone | 06:49 | |
| *** guoshan has quit IRC | 07:03 | |
| openstackgerrit | Merged openstack/oslo.policy: Updated from global requirements https://review.openstack.org/405877 | 07:08 |
| *** code-R_ has joined #openstack-keystone | 07:09 | |
| *** code-R has quit IRC | 07:10 | |
| *** jaosorior has quit IRC | 07:10 | |
| *** jaosorior has joined #openstack-keystone | 07:11 | |
| *** jrist has quit IRC | 07:14 | |
| *** jrist has joined #openstack-keystone | 07:15 | |
| *** edmondsw has joined #openstack-keystone | 07:16 | |
| *** voelzmo has joined #openstack-keystone | 07:17 | |
| *** jamielennox is now known as jamielennox|away | 07:18 | |
| *** edmondsw has quit IRC | 07:20 | |
| openstackgerrit | Merged openstack/keystone: Validate token issue input https://review.openstack.org/404806 | 07:21 |
| openstackgerrit | Merged openstack/keystone: Updated from global requirements https://review.openstack.org/405816 | 07:21 |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/405818 | 07:23 |
| *** voelzmo has quit IRC | 07:23 | |
| openstackgerrit | Merged openstack/keystone: Minor fix in role_assignments api-ref https://review.openstack.org/381777 | 07:26 |
| *** voelzmo has joined #openstack-keystone | 07:36 | |
| *** GB21 has joined #openstack-keystone | 07:36 | |
| *** rcernin has joined #openstack-keystone | 07:40 | |
| *** jamielennox|away is now known as jamielennox | 07:44 | |
| *** edmondsw has joined #openstack-keystone | 07:52 | |
| *** josecastroleon has quit IRC | 07:52 | |
| *** GB21 has quit IRC | 07:54 | |
| *** josecastroleon has joined #openstack-keystone | 07:55 | |
| *** edmondsw has quit IRC | 07:57 | |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** GB21 has joined #openstack-keystone | 08:07 | |
| *** amoralej|off is now known as amoralej | 08:15 | |
| *** edmondsw has joined #openstack-keystone | 08:29 | |
| *** edmondsw has quit IRC | 08:33 | |
| *** guoshan has joined #openstack-keystone | 08:47 | |
| *** GB21 has quit IRC | 08:56 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** code-R has joined #openstack-keystone | 09:01 | |
| *** zzzeek has joined #openstack-keystone | 09:01 | |
| *** code-R_ has quit IRC | 09:04 | |
| *** guoshan has quit IRC | 09:12 | |
| *** guoshan has joined #openstack-keystone | 09:14 | |
| *** zhangjl has left #openstack-keystone | 09:15 | |
| *** zhugaoxiao has joined #openstack-keystone | 09:16 | |
| *** GB21 has joined #openstack-keystone | 09:19 | |
| *** guoshan has quit IRC | 09:29 | |
| *** voelzmo has quit IRC | 09:29 | |
| *** aloga has quit IRC | 09:29 | |
| *** aloga has joined #openstack-keystone | 09:30 | |
| *** voelzmo has joined #openstack-keystone | 09:32 | |
| *** DinaBelova has quit IRC | 09:37 | |
| *** DinaBelova has joined #openstack-keystone | 09:39 | |
| *** edmondsw has joined #openstack-keystone | 09:41 | |
| *** asettle has joined #openstack-keystone | 09:42 | |
| *** GB21 has quit IRC | 09:45 | |
| *** edmondsw has quit IRC | 09:46 | |
| *** voelzmo has quit IRC | 09:47 | |
| *** rcernin has quit IRC | 09:49 | |
| *** rcernin has joined #openstack-keystone | 09:50 | |
| *** davechen is now known as davechen_afk | 09:52 | |
| *** zhugaoxiao has quit IRC | 09:54 | |
| *** code-R has quit IRC | 09:54 | |
| *** code-R has joined #openstack-keystone | 09:54 | |
| *** GB21 has joined #openstack-keystone | 09:58 | |
| *** liujiong has quit IRC | 10:09 | |
| *** voelzmo has joined #openstack-keystone | 10:19 | |
| *** code-R has quit IRC | 10:21 | |
| *** code-R has joined #openstack-keystone | 10:22 | |
| *** pnavarro has joined #openstack-keystone | 10:22 | |
| *** code-R_ has joined #openstack-keystone | 10:25 | |
| *** xiaoyang has quit IRC | 10:25 | |
| *** tesseract has joined #openstack-keystone | 10:27 | |
| *** code-R has quit IRC | 10:27 | |
| *** tesseract is now known as Guest79986 | 10:27 | |
| *** code-R_ has quit IRC | 10:32 | |
| *** code-R has joined #openstack-keystone | 10:32 | |
| *** asettle__ has joined #openstack-keystone | 10:39 | |
| *** asettle has quit IRC | 10:42 | |
| *** asettle__ is now known as asettle | 10:42 | |
| *** code-R_ has joined #openstack-keystone | 10:48 | |
| *** code-R has quit IRC | 10:51 | |
| *** hoangcx has quit IRC | 10:52 | |
| *** udesale has quit IRC | 10:54 | |
| *** duonghq has quit IRC | 10:57 | |
| *** richm has joined #openstack-keystone | 11:12 | |
| *** namnh has quit IRC | 11:15 | |
| *** nicolasbock has joined #openstack-keystone | 11:36 | |
| *** pnavarro has quit IRC | 11:37 | |
| *** GB21 has quit IRC | 11:50 | |
| samueldmq | good morning keystone | 11:55 |
| samueldmq | ayoung: hi, want to continue on https://review.openstack.org/279263 ? | 11:59 |
| *** GB21 has joined #openstack-keystone | 12:05 | |
| *** rcernin has quit IRC | 12:12 | |
| *** rcernin has joined #openstack-keystone | 12:15 | |
| *** thiagolib has quit IRC | 12:28 | |
| *** GB21 has quit IRC | 12:29 | |
| stevemar | crinkle: danke | 12:49 |
| stevemar | rodrigods: hmm, things are failing in ksc regardless of the test :( https://review.openstack.org/#/c/405889/1 | 12:50 |
| samueldmq | stevemar: o/ | 12:51 |
| stevemar | samueldmq: o\ | 12:56 |
| *** jrist has quit IRC | 12:59 | |
| *** rcernin has quit IRC | 13:06 | |
| *** rcernin has joined #openstack-keystone | 13:08 | |
| *** links has quit IRC | 13:17 | |
| *** lamt has joined #openstack-keystone | 13:17 | |
| ayoung | samueldmq, ah I might take another look after the current batch of patches around that | 13:19 |
| ayoung | samueldmq, did you take a look at the 3 I have doing similiar stuff? I need for Bug 968696 work | 13:20 |
| openstack | bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] https://launchpad.net/bugs/968696 - Assigned to Adam Young (ayoung) | 13:20 |
| *** dave-mccowan has joined #openstack-keystone | 13:21 | |
| ayoung | samueldmq, it starts here https://review.openstack.org/#/c/387161/6 | 13:21 |
| samueldmq | ayoung: so perhaps that patch is invalid ? or you think it just needs rework? | 13:22 |
| ayoung | samueldmq, I probably duplicated a lot of what you put in there. Sorry. We were on the same track | 13:22 |
| samueldmq | ayoung: no problem at all, you're probably more familiar with that code and can push it quickly, better. | 13:23 |
| samueldmq | ayoung: I'll abandon mine and focus on reviewing yours | 13:23 |
| ayoung | Didn't realize you had that in the works. But my guess is it would be hard to rebase your patch right now, as much as the code base has changed | 13:23 |
| *** jaosorior is now known as jaosorior_brb | 13:24 | |
| ayoung | samueldmq, TYVM. The fact that you worked through this means you will understand my code changes. Very valuable | 13:24 |
| samueldmq | ayoung: ++ no worries at all. I am happy to have you looking at that | 13:24 |
| samueldmq | ayoung: :) | 13:24 |
| ayoung | samueldmq, close to getting the is_admin_project check in to here and Nova... | 13:24 |
| ayoung | funny that Keystone is the worst project for it. | 13:24 |
| samueldmq | ayoung: hehe | 13:24 |
| *** dave-mcc_ has joined #openstack-keystone | 13:32 | |
| *** nishaYadav has joined #openstack-keystone | 13:34 | |
| *** nishaYadav is now known as Guest78891 | 13:35 | |
| *** dave-mccowan has quit IRC | 13:35 | |
| *** Guest78891 has quit IRC | 13:35 | |
| *** nishaYadav_ has joined #openstack-keystone | 13:35 | |
| *** openstackgerrit has joined #openstack-keystone | 13:37 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 13:37 |
| *** code-R_ has quit IRC | 13:37 | |
| nishaYadav_ | hey all o/ | 13:37 |
| stevemar | o\ | 13:38 |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 13:39 |
| ayoung | rodrigods, is Julia Varlamov your outreachy person? | 13:40 |
| stevemar | ayoung: nope, shes mirantis i think | 13:44 |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 13:48 |
| *** jvarlamova has joined #openstack-keystone | 13:48 | |
| ayoung | stevemar, so the LDAP code in Devstack has bit rotted. In an Ubuntu system, at least, the way you have to initialize open ldap seems to have changed | 13:49 |
| ayoung | I'm tempted to leave it in place for a while, but try to get an LDAP server set up as part of the Keystone devstack plugin instead | 13:50 |
| ayoung | rodrigods, ^^ probably something you should know, too | 13:51 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 13:56 |
| openstackgerrit | ayoung proposed openstack/keystone: Refactor Authorization: https://review.openstack.org/387161 | 14:04 |
| *** spzala has joined #openstack-keystone | 14:04 | |
| openstackgerrit | ayoung proposed openstack/keystone: Refactor is_admin https://review.openstack.org/387710 | 14:05 |
| openstackgerrit | ayoung proposed openstack/keystone: Add is_admin_project check to policy.json https://review.openstack.org/257636 | 14:06 |
| *** code-R has joined #openstack-keystone | 14:07 | |
| *** code-R_ has joined #openstack-keystone | 14:09 | |
| *** code-R has quit IRC | 14:11 | |
| *** faizy has joined #openstack-keystone | 14:21 | |
| ayoung | stevemar, samueldmq lbragstad dstanek instead of calling the rbac entity "url_pattern" should I call it "api_access_rule"? | 14:25 |
| samueldmq | ayoung: example ? | 14:25 |
| ayoung | samueldmq, in https://review.openstack.org/#/c/391624/ | 14:26 |
| samueldmq | ayoung: kk I'll review that | 14:26 |
| ayoung | I have a more readable version...I ran tox docs on it, but let me update | 14:26 |
| ayoung | I think I want to change that name... | 14:26 |
| ayoung | samueldmq, i would define an API as a verb + and URL pattern, and then this entity adds in the role required to execute that API | 14:27 |
| ayoung | calling the whole thing url_pattern is naming it for only one of its parts | 14:27 |
| *** marekd has joined #openstack-keystone | 14:28 | |
| *** ChanServ sets mode: +v marekd | 14:28 | |
| ayoung | Synecdoche | 14:29 |
| samueldmq | ayoung: gotcha, it could simply be "api": "rules" thus just 'api'' | 14:29 |
| samueldmq | ayoung: api_name might work too, as you want. I got what you meant by changing from url_pattern | 14:29 |
| ayoung | yeah, but having an api api would be funny sounding | 14:30 |
| ayoung | api_access is more specific | 14:30 |
| samueldmq | ++ | 14:30 |
| ayoung | so api_access_rule, while long, is more specific | 14:30 |
| ayoung | OK, keep that in mind while reading, and I will rewrite the spec to update it with that term | 14:31 |
| ayoung | samueldmq, so domains is a bad example | 14:33 |
| *** rcernin has quit IRC | 14:33 | |
| ayoung | as listing domains is not something we want just anyone to do | 14:34 |
| samueldmq | talking about 'GET /domains': 'admin' ? | 14:34 |
| ayoung | but, looking at glance, GET /images | 14:34 |
| ayoung | or GET /v2/servers | 14:34 |
| samueldmq | ok, that'd be 'GET /images': 'reader' | 14:34 |
| ayoung | samueldmq, right | 14:34 |
| ayoung | we need to set up a role inference rule from superior role to subordinate | 14:34 |
| ayoung | admin->member->reader | 14:35 |
| ayoung | service admins will probably be split off of admin, too | 14:35 |
| ayoung | so admin->image_admin | 14:35 |
| ayoung | and that way people that can admin glance cannot necessarily admin nova. | 14:35 |
| samueldmq | ayoung: that's the spec jamielennox and dolphm were working on, right ? | 14:35 |
| ayoung | but that would require policy.json changes, not just rbac | 14:35 |
| ayoung | samueldmq, yes | 14:35 |
| ayoung | they needed some more support from rbac enforcement before it was viable | 14:36 |
| samueldmq | ayoung: ok. we need to define a roadmap | 14:36 |
| samueldmq | agree in our meeting | 14:36 |
| ayoung | ++ | 14:36 |
| samueldmq | and start defining the taks to get there | 14:36 |
| *** amoralej is now known as amoralej|lunch | 14:36 | |
| samueldmq | and what spec/initiative addresses what | 14:36 |
| samueldmq | ayoung: brb, lunch time | 14:38 |
| *** code-R_ has quit IRC | 14:40 | |
| ayoung | samueldmq, I am thinkg maybe just `access_rule` instead of `api_access_rule` | 14:40 |
| dstanek | ayoung: i do like access_rule | 14:40 |
| *** code-R has joined #openstack-keystone | 14:40 | |
| samueldmq | ayoung: ++ | 14:40 |
| samueldmq | dstanek: o/ | 14:40 |
| ayoung | OK...that is clearer. I'll go with that in the next pass | 14:41 |
| *** rcernin has joined #openstack-keystone | 14:41 | |
| dstanek | samueldmq o/ | 14:42 |
| *** jamielennox is now known as jamielennox|away | 14:45 | |
| *** edmondsw has joined #openstack-keystone | 14:47 | |
| stevemar | ayoung: yeah, its definitely bit-rotted, been meaning to look at it for a while :( | 14:49 |
| stevemar | ayoung: maybe we can scam topol into looking at it again :P | 14:49 |
| *** edmondsw_ has joined #openstack-keystone | 14:49 | |
| ayoung | dstanek, I thinl he was trying to give you a high 5 | 14:49 |
| ayoung | stevemar, Heh | 14:49 |
| *** edmondsw_ has quit IRC | 14:50 | |
| ayoung | stevemar, I'm tempted to use 389ds instead of OpenLDAP for the keystone plugin, as I know that nkinder worked on that for a long time... | 14:50 |
| stevemar | dolphm: thanks for abandoning reviews | 14:55 |
| stevemar | err patches | 14:55 |
| *** rcernin has quit IRC | 14:55 | |
| dolphm | stevemar: you're welcome? | 14:56 |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Role Check Check from Middleware https://review.openstack.org/391624 | 14:57 |
| *** rcernin has joined #openstack-keystone | 14:58 | |
| ayoung | dolphm, hey, I addressed your performance concern on the "service catalog subset" review. I think it might actually help performance if we do it right | 14:58 |
| *** dave-mcc_ has quit IRC | 14:58 | |
| ayoung | https://review.openstack.org/#/c/160909/ | 14:58 |
| ayoung | you said " In our benchmarking, the most significant time impact of the service catalog is not in transmitting it, but in computing it for each token creation and validation request. " | 14:59 |
| ayoung | if we can short circuit that catalog computation and composition, it should speed up the token validation and creation processes. | 14:59 |
| *** amoralej|lunch is now known as amoralej | 15:03 | |
| *** jhesketh has quit IRC | 15:04 | |
| *** jaosorior_brb is now known as jaosorior | 15:06 | |
| *** jhesketh has joined #openstack-keystone | 15:06 | |
| *** jaosorior has quit IRC | 15:11 | |
| *** dave-mccowan has joined #openstack-keystone | 15:11 | |
| *** jaosorior has joined #openstack-keystone | 15:12 | |
| *** jaosorior has quit IRC | 15:13 | |
| *** jaosorior has joined #openstack-keystone | 15:13 | |
| *** ravelar has joined #openstack-keystone | 15:19 | |
| breton | morgan: ayoung: stevemar: am i being too paranoid with my concern in https://review.openstack.org/#/c/403866/ ? | 15:24 |
| ayoung | breton, there is no "too paranoid" only "not paranoid enough" | 15:26 |
| openstackgerrit | Ondřej Kobližek proposed openstack/python-keystoneclient: Fix Failing tests with openssl >= 1.1.0 https://review.openstack.org/406175 | 15:26 |
| ayoung | breton, I think you are dead on | 15:26 |
| ayoung | breton, feel free to up that to a -2 | 15:27 |
| *** nishaYadav_ has quit IRC | 15:27 | |
| ayoung | breton, I just -2ed it | 15:28 |
| ayoung | breton, maybe I am being too paranoid here, too, but there is no "too paranoid" with this kind of quahackery. | 15:29 |
| *** openstackgerrit has quit IRC | 15:33 | |
| *** knasim-wrs has joined #openstack-keystone | 15:35 | |
| *** DinaBelova has quit IRC | 15:44 | |
| *** DinaBelova has joined #openstack-keystone | 15:44 | |
| *** chlong has joined #openstack-keystone | 15:48 | |
| *** pnavarro has joined #openstack-keystone | 15:48 | |
| stevemar | turns out ironic got busted by the devstack change too | 15:49 |
| stevemar | still, only 2 projects, not bad | 15:49 |
| stevemar | breton: is rally fixed up now? | 15:49 |
| *** edmondsw has quit IRC | 15:49 | |
| *** knasim-wrs has quit IRC | 15:50 | |
| dstanek | i really hate that we don't have auto incrementing ids. makes it so hard to page through the data | 15:50 |
| *** edmondsw has joined #openstack-keystone | 15:50 | |
| morgan | dstanek: we could always move to autoinc for all internal PKS and make UUIDs secondary keys | 15:51 |
| *** Guest79986 has quit IRC | 15:54 | |
| *** edmondsw has quit IRC | 15:54 | |
| dstanek | morgan: similar to what i was just thinking. i was thinking that we can add a new 'order' column as autoinc and not expose that | 15:54 |
| dstanek | it's just an implementation detail | 15:55 |
| *** edmondsw has joined #openstack-keystone | 15:55 | |
| breton | stevemar: not yet, but the progress is good | 15:56 |
| breton | stevemar: we have fixed issues with devstack and gates and now fight issues with some assumptions in rally itself | 16:00 |
| ayoung | morgan, ++++ | 16:01 |
| *** chris_hultin|AWA is now known as chris_hultin | 16:03 | |
| *** rcernin has quit IRC | 16:05 | |
| *** voelzmo has quit IRC | 16:07 | |
| stevemar | breton: *nods* | 16:07 |
| morgan | dstanek: responded to your comments in MFA spec | 16:07 |
| morgan | dstanek: before i fix the 2 typos | 16:07 |
| dstanek | morgan: cool, i'll take a look | 16:08 |
| morgan | dstanek: the notifications and a "default" rule concept | 16:08 |
| morgan | notifications, not really seeing that as a CADF event | 16:08 |
| morgan | "no valid rules" (aka all required auth plugins are disabled) is not a good way to lock out users, we have "disabled=True" for those cases in the user objects | 16:09 |
| morgan | or disable the users' domain | 16:09 |
| morgan | etc. | 16:09 |
| morgan | if plugins are disabled in keystone.conf, we ignore them as "required". | 16:09 |
| morgan | for the default rules, i can see the use. I was unsure how to implement that cleanly. My goal was to implement this base feature and then work on adding in added featuresets such as defaults once we had this working. (possibly needs to be another table or in keystone.conf etc for "defaults") | 16:11 |
| *** david-lyle_ has joined #openstack-keystone | 16:17 | |
| dstanek | morgan: i'm just poking at it to see what you are thinking... just commented again | 16:17 |
| morgan | cool | 16:18 |
| *** david-lyle has quit IRC | 16:19 | |
| *** openstackgerrit has joined #openstack-keystone | 16:20 | |
| openstackgerrit | ayoung proposed openstack/keystone-specs: Allow a remote service to Validate Federation Mapping https://review.openstack.org/245588 | 16:20 |
| *** chlong has quit IRC | 16:20 | |
| *** chlong has joined #openstack-keystone | 16:21 | |
| morgan | dstanek: ++ responded again, in short keystone does not let auth happen, we will need to expand the error raised to say wich method is not valid | 16:24 |
| *** adrian_otto has joined #openstack-keystone | 16:24 | |
| dstanek | morgan: that shouldn't be too hard to implement this cycle. is someone going to be doing the client work for it? | 16:27 |
| morgan | adriant is going to help on both server and client fronts | 16:30 |
| morgan | he has approval from his PM to be working on this for the cycle. I expect I'll be on the hook for KSA changes though | 16:31 |
| morgan | if any are needed | 16:31 |
| *** jistr is now known as jistr|biab | 16:33 | |
| *** nkinder has quit IRC | 16:34 | |
| *** faizy has quit IRC | 16:36 | |
| *** tqtran has joined #openstack-keystone | 16:38 | |
| *** jaosorior has quit IRC | 16:38 | |
| stevemar | morgan: yep, it'll be nice to get it merged this cycle, since he went ahead and got the upstream time | 16:39 |
| *** diazjf has joined #openstack-keystone | 16:42 | |
| *** Zer0Byte__ has joined #openstack-keystone | 16:43 | |
| *** diazjf has quit IRC | 16:43 | |
| *** diazjf has joined #openstack-keystone | 16:44 | |
| *** rcernin has joined #openstack-keystone | 16:45 | |
| *** josecastroleon has quit IRC | 16:47 | |
| *** nkinder has joined #openstack-keystone | 16:47 | |
| *** tqtran_ has joined #openstack-keystone | 16:50 | |
| breton | stevemar: i think we got it fixed now | 16:52 |
| *** tqtran has quit IRC | 16:53 | |
| *** raildo has quit IRC | 16:56 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/406233 | 16:58 |
| *** code-R_ has joined #openstack-keystone | 16:59 | |
| *** code-R has quit IRC | 17:02 | |
| *** chlong has quit IRC | 17:02 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone: Updated from global requirements https://review.openstack.org/406233 | 17:10 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/406246 | 17:10 |
| *** asettle has quit IRC | 17:11 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor's caching symptoms https://review.openstack.org/406249 | 17:11 |
| openstackgerrit | David Stanek proposed openstack/keystone: Move redelegation fields out of extras https://review.openstack.org/276474 | 17:13 |
| *** spzala has quit IRC | 17:14 | |
| *** spzala has joined #openstack-keystone | 17:15 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor's caching symptoms https://review.openstack.org/406249 | 17:31 |
| *** chlong has joined #openstack-keystone | 17:41 | |
| *** rcernin has quit IRC | 17:45 | |
| *** rcernin has joined #openstack-keystone | 17:46 | |
| *** raildo has joined #openstack-keystone | 17:47 | |
| samueldmq | dstanek: hi | 17:48 |
| samueldmq | dstanek: I am looking at https://review.openstack.org/#/c/276474 | 17:48 |
| samueldmq | dstanek: a trust may not be redelegated, in which case redelegated_trust_id and redelegation_count are not present in the extras | 17:49 |
| samueldmq | dstanek: is this correct ? | 17:49 |
| samueldmq | breton: hi, does my reply to your comment in https://review.openstack.org/#/c/316991/ makes sense to you ? | 17:52 |
| *** jistr|biab is now known as jistr | 17:53 | |
| *** adrian_otto1 has joined #openstack-keystone | 17:56 | |
| *** adrian_otto has quit IRC | 17:58 | |
| *** faizy has joined #openstack-keystone | 18:03 | |
| *** pnavarro has quit IRC | 18:03 | |
| *** voelzmo has joined #openstack-keystone | 18:07 | |
| *** david-lyle_ is now known as david-lyle | 18:08 | |
| *** pnavarro has joined #openstack-keystone | 18:08 | |
| breton | samueldmq: thanks, i forgot about it. I will comment on it now. | 18:10 |
| *** asettle has joined #openstack-keystone | 18:11 | |
| *** diazjf has quit IRC | 18:13 | |
| *** code-R_ has quit IRC | 18:17 | |
| *** code-R has joined #openstack-keystone | 18:17 | |
| *** asettle has quit IRC | 18:19 | |
| samueldmq | breton: thanks | 18:19 |
| samueldmq | stevemar: please see my comment in bug 1616105 and let me know if that makes sense to you | 18:19 |
| openstack | bug 1616105 in python-keystoneclient "Request of large files raises a MemoryError due to logging" [High,In progress] https://launchpad.net/bugs/1616105 - Assigned to Tobias Diaz (int-0) | 18:19 |
| *** asettle has joined #openstack-keystone | 18:19 | |
| *** pnavarro has quit IRC | 18:19 | |
| *** asettle has quit IRC | 18:22 | |
| stevemar | breton: that is good news | 18:23 |
| *** daemontool has joined #openstack-keystone | 18:32 | |
| *** daemontool has quit IRC | 18:38 | |
| samueldmq | I would like to get a Python review around what to put in a try/except clause | 18:39 |
| samueldmq | if it is better to put only the portion raising the exception or a larger block | 18:39 |
| *** voelzmo has quit IRC | 18:39 | |
| samueldmq | L1297 in https://review.openstack.org/#/c/390948/7/keystone/identity/backends/ldap/common.py | 18:40 |
| samueldmq | cc dstanek ^ | 18:40 |
| *** voelzmo has joined #openstack-keystone | 18:40 | |
| *** voelzmo has quit IRC | 18:46 | |
| *** ravelar has quit IRC | 19:01 | |
| *** spzala has quit IRC | 19:02 | |
| *** adrian_otto1 has quit IRC | 19:04 | |
| *** ravelar has joined #openstack-keystone | 19:05 | |
| *** adrian_otto has joined #openstack-keystone | 19:06 | |
| *** code-R_ has joined #openstack-keystone | 19:10 | |
| *** code-R has quit IRC | 19:13 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Updated from global requirements https://review.openstack.org/406246 | 19:16 |
| *** diazjf has joined #openstack-keystone | 19:16 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/keystone: Domain included for role in list_role_assignment https://review.openstack.org/373516 | 19:21 |
| samueldmq | stevemar: ^ let's see what jenkins says, I've got a bunch of those erros related to that passlib warning locally | 19:22 |
| *** faizy has quit IRC | 19:24 | |
| *** adrian_otto has quit IRC | 19:27 | |
| *** ravelar has quit IRC | 19:27 | |
| morgan | samueldmq: ideallyyou shiould keep the section in the try as narrow as possible | 19:31 |
| morgan | samueldmq: so that you don't except on un-related calls. that said, if you are handling logic based on the exception, and the function continues, you will need to have the logic in the try block that would be impacted by the exception | 19:33 |
| *** serverascode has quit IRC | 19:34 | |
| *** ctracey has quit IRC | 19:34 | |
| *** jraim has quit IRC | 19:34 | |
| *** zhiyan has quit IRC | 19:34 | |
| *** morgan has quit IRC | 19:34 | |
| *** edtubill has joined #openstack-keystone | 19:37 | |
| *** diazjf has quit IRC | 19:39 | |
| *** jraim has joined #openstack-keystone | 19:42 | |
| *** diazjf has joined #openstack-keystone | 19:46 | |
| *** ctracey has joined #openstack-keystone | 19:47 | |
| *** josecastroleon has joined #openstack-keystone | 19:48 | |
| *** adrian_otto has joined #openstack-keystone | 19:49 | |
| *** serverascode has joined #openstack-keystone | 19:50 | |
| *** josecastroleon has quit IRC | 19:52 | |
| *** zhiyan has joined #openstack-keystone | 19:53 | |
| *** adrian_otto has quit IRC | 19:54 | |
| *** ravelar has joined #openstack-keystone | 19:56 | |
| *** pnavarro has joined #openstack-keystone | 20:05 | |
| *** adrian_otto has joined #openstack-keystone | 20:09 | |
| *** clenimar has quit IRC | 20:11 | |
| *** adrian_otto has quit IRC | 20:12 | |
| *** adrian_otto has joined #openstack-keystone | 20:13 | |
| *** code-R_ has quit IRC | 20:19 | |
| *** code-R has joined #openstack-keystone | 20:20 | |
| *** morgan has joined #openstack-keystone | 20:25 | |
| *** code-R has quit IRC | 20:25 | |
| *** code-R has joined #openstack-keystone | 20:25 | |
| *** pnavarro has quit IRC | 20:26 | |
| *** edmondsw has quit IRC | 20:28 | |
| *** diazjf has quit IRC | 20:30 | |
| *** code-R_ has joined #openstack-keystone | 20:30 | |
| *** pnavarro has joined #openstack-keystone | 20:31 | |
| *** diazjf has joined #openstack-keystone | 20:32 | |
| *** code-R has quit IRC | 20:33 | |
| samueldmq | morgan: agreed | 20:35 |
| samueldmq | morgan: would you mind to add your view to that review too ? :) | 20:36 |
| morgan | which one? | 20:36 |
| morgan | my bouncer was dead for the last 1hr or so | 20:36 |
| *** chlong has quit IRC | 20:42 | |
| *** amoralej is now known as amoralej|off | 20:51 | |
| *** chlong has joined #openstack-keystone | 20:55 | |
| *** raildo has quit IRC | 21:01 | |
| *** pnavarro has quit IRC | 21:03 | |
| *** iurygregory has quit IRC | 21:09 | |
| openstackgerrit | ayoung proposed openstack/keystone: Fernet token formatter with explicit role https://review.openstack.org/310074 | 21:21 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: api-ref update for roles assignments with names https://review.openstack.org/406366 | 21:22 |
| *** asettle has joined #openstack-keystone | 21:26 | |
| *** asettle has quit IRC | 21:28 | |
| *** Zer0Byte__ has quit IRC | 21:29 | |
| *** chris_hultin is now known as chris_hultin|AWA | 21:37 | |
| *** edtubill has quit IRC | 21:39 | |
| *** diazjf has quit IRC | 21:41 | |
| *** code-R_ has quit IRC | 21:43 | |
| *** diazjf has joined #openstack-keystone | 21:55 | |
| *** daemontool has joined #openstack-keystone | 22:04 | |
| morgan | ayoung: i agree with samueldmq's question. what does this explicit role buy us? | 22:04 |
| ayoung | morgan, ok here is the workflow | 22:04 |
| morgan | it isn't clear to me why we need the ID vs the name. | 22:04 |
| ayoung | I go to some 3rd party vendor and he says I can do something on your cloud | 22:05 |
| ayoung | in order to do it you have to send me a token | 22:05 |
| morgan | oh wait. nvm on my question | 22:05 |
| ayoung | I say "ok, but you are not getting everything what do you need" | 22:05 |
| ayoung | and he says Reader and I get a token with that role on it | 22:05 |
| morgan | derp. because id is better indexed. and fernet payload isn't exposed to the end user | 22:05 |
| ayoung | id is an override for Henry's domain specific roles | 22:06 |
| ayoung | ah, yes | 22:06 |
| ayoung | store the id in the fernet payload | 22:06 |
| morgan | yeah i got your part, i was missing the uuid vs name in the token part | 22:06 |
| morgan | how much does this expand the token size? | 22:06 |
| morgan | just making sure we don't run afoul of our upper fernet size limit (default) | 22:07 |
| * morgan guesses it is about 16bytes | 22:07 | |
| ayoung | the size is roughly one uuid larger, plus a little for encryption | 22:07 |
| morgan | just keep in mind we need to budget what goes in the token really well now. | 22:08 |
| ayoung | it is still under the limit. We can't add too much more on top of this, but I think these are actually smaller than the Federated version | 22:08 |
| morgan | yeah. probably | 22:08 |
| ayoung | we don't put groups in there, or anything other than the roleid | 22:08 |
| morgan | so stupid question... | 22:10 |
| morgan | actually i can just look at the code | 22:10 |
| morgan | will comment there | 22:10 |
| *** jamielennox|away is now known as jamielennox | 22:22 | |
| *** edtubill has joined #openstack-keystone | 22:23 | |
| *** chlong has quit IRC | 22:44 | |
| *** edtubill has quit IRC | 22:47 | |
| *** dave-mccowan has quit IRC | 22:55 | |
| *** daemontool has quit IRC | 23:13 | |
| *** dave-mccowan has joined #openstack-keystone | 23:16 | |
| *** lamt has quit IRC | 23:23 | |
| *** diazjf has quit IRC | 23:29 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!