| *** masber has joined #openstack-keystone | 00:02 | |
| *** xiaoyang has joined #openstack-keystone | 00:12 | |
| *** masber has quit IRC | 00:22 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Don't issue deprecation warning when nesting adapters https://review.openstack.org/406647 | 00:29 |
|---|---|---|
| *** hoangcx has joined #openstack-keystone | 00:55 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystonemiddleware: Pass ?allow_expired https://review.openstack.org/382100 | 01:01 |
| jamielennox | hey all, i'm looking for some feedback on how we should enforce policy on ^ | 01:04 |
| *** akshilv has joined #openstack-keystone | 01:12 | |
| akshilv | Hi | 01:12 |
| akshilv | I'm new to openstack contributions. Can anyone help me with how to work on a minor bug so that I understand the whole process? | 01:13 |
| *** zhangjl has joined #openstack-keystone | 01:21 | |
| *** liujiong has joined #openstack-keystone | 01:26 | |
| *** akshilv has quit IRC | 01:40 | |
| *** catintheroof has joined #openstack-keystone | 01:58 | |
| *** catintheroof has quit IRC | 02:06 | |
| *** nkinder has quit IRC | 02:23 | |
| *** annp has joined #openstack-keystone | 02:29 | |
| *** nkinder has joined #openstack-keystone | 02:39 | |
| *** shuquan_ has joined #openstack-keystone | 02:56 | |
| *** guoshan has joined #openstack-keystone | 02:57 | |
| *** udesale has joined #openstack-keystone | 03:30 | |
| *** adrian_otto has joined #openstack-keystone | 03:40 | |
| *** adrian_otto has quit IRC | 03:43 | |
| *** adrian_otto has joined #openstack-keystone | 03:45 | |
| *** code-R has quit IRC | 03:51 | |
| *** guoshan has quit IRC | 03:56 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: api-ref update for roles assignments with names https://review.openstack.org/406366 | 04:06 |
| *** adrian_otto has quit IRC | 04:11 | |
| *** udesale has quit IRC | 04:18 | |
| *** udesale has joined #openstack-keystone | 04:18 | |
| *** udesale_ has joined #openstack-keystone | 04:18 | |
| *** udesale_ has quit IRC | 04:18 | |
| *** udesale has quit IRC | 04:18 | |
| *** udesale has joined #openstack-keystone | 04:19 | |
| *** zhangjl1 has joined #openstack-keystone | 04:21 | |
| *** zhangjl has quit IRC | 04:22 | |
| *** code-R has joined #openstack-keystone | 04:40 | |
| *** code-R_ has joined #openstack-keystone | 04:41 | |
| *** code-R has quit IRC | 04:44 | |
| *** adrian_otto has joined #openstack-keystone | 04:50 | |
| *** guoshan has joined #openstack-keystone | 04:57 | |
| *** guoshan has quit IRC | 05:01 | |
| *** adrian_otto has quit IRC | 05:02 | |
| *** voelzmo has quit IRC | 05:04 | |
| *** adrian_otto has joined #openstack-keystone | 05:04 | |
| *** voelzmo has joined #openstack-keystone | 05:04 | |
| *** voelzmo has quit IRC | 05:09 | |
| *** adrian_otto has quit IRC | 05:12 | |
| *** adriant has quit IRC | 05:22 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: WIP: remove LDAP write support https://review.openstack.org/374482 | 05:30 |
| *** chrisplo has quit IRC | 05:37 | |
| *** GB21 has joined #openstack-keystone | 05:42 | |
| *** chrisplo has joined #openstack-keystone | 05:48 | |
| *** chrisplo has quit IRC | 05:52 | |
| *** mgagne has quit IRC | 05:53 | |
| *** mgagne has joined #openstack-keystone | 05:55 | |
| *** mgagne is now known as Guest51737 | 05:55 | |
| *** narasimha_SV has joined #openstack-keystone | 05:57 | |
| *** guoshan has joined #openstack-keystone | 05:57 | |
| *** guoshan has quit IRC | 06:02 | |
| *** chrisplo has joined #openstack-keystone | 06:03 | |
| narasimha_SV | http://paste.openstack.org/show/591383/ are these variables sufficient for LDAP backend for keystone | 06:06 |
| narasimha_SV | please correct me if any other values or any wrong confs are kept in the above | 06:06 |
| *** shuquan_ has quit IRC | 06:06 | |
| *** chrisplo has quit IRC | 06:08 | |
| *** shuquan has joined #openstack-keystone | 06:08 | |
| *** shuquan has quit IRC | 06:13 | |
| *** shuquan has joined #openstack-keystone | 06:15 | |
| *** adrian_otto has joined #openstack-keystone | 06:17 | |
| *** adrian_otto has quit IRC | 06:21 | |
| *** guoshan has joined #openstack-keystone | 06:33 | |
| *** udesale has quit IRC | 06:36 | |
| *** udesale has joined #openstack-keystone | 06:38 | |
| *** rcernin has quit IRC | 06:39 | |
| *** martinus- has joined #openstack-keystone | 06:46 | |
| *** zzzeek_ has joined #openstack-keystone | 06:47 | |
| *** tsufiev has quit IRC | 06:48 | |
| *** tsufiev_ has joined #openstack-keystone | 06:48 | |
| *** htruta` has joined #openstack-keystone | 06:48 | |
| *** mfisch has quit IRC | 06:49 | |
| *** dancn` has joined #openstack-keystone | 06:52 | |
| *** zzzeek has quit IRC | 06:52 | |
| *** chrome0_ has joined #openstack-keystone | 06:52 | |
| *** sileht_ has joined #openstack-keystone | 06:52 | |
| *** mfisch has joined #openstack-keystone | 06:53 | |
| *** dhellmann_ has joined #openstack-keystone | 06:53 | |
| *** mfisch has quit IRC | 06:53 | |
| *** mfisch has joined #openstack-keystone | 06:53 | |
| *** rha has quit IRC | 06:53 | |
| *** martinus__ has quit IRC | 06:53 | |
| *** chrome0 has quit IRC | 06:53 | |
| *** dancn has quit IRC | 06:53 | |
| *** htruta has quit IRC | 06:53 | |
| *** sileht has quit IRC | 06:53 | |
| *** dhellmann has quit IRC | 06:53 | |
| *** dhellmann_ is now known as dhellmann | 06:56 | |
| *** rha has joined #openstack-keystone | 06:56 | |
| *** sileht_ is now known as sileht | 06:58 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:59 | |
| *** masber has joined #openstack-keystone | 07:02 | |
| *** shuquan has quit IRC | 07:06 | |
| *** code-R_ has quit IRC | 07:13 | |
| *** code-R has joined #openstack-keystone | 07:13 | |
| *** shuquan_ has joined #openstack-keystone | 07:14 | |
| *** mkoderer___ is now known as mkoderer__ | 07:23 | |
| *** rcernin has joined #openstack-keystone | 07:28 | |
| *** rcernin has quit IRC | 07:29 | |
| *** voelzmo has joined #openstack-keystone | 07:29 | |
| *** voelzmo has quit IRC | 07:30 | |
| *** voelzmo has joined #openstack-keystone | 07:30 | |
| *** rcernin has joined #openstack-keystone | 07:32 | |
| *** faizy has joined #openstack-keystone | 07:48 | |
| *** mvk has quit IRC | 07:51 | |
| *** d0ugal has joined #openstack-keystone | 07:51 | |
| *** rcernin has quit IRC | 07:52 | |
| *** rcernin has joined #openstack-keystone | 07:59 | |
| *** rcernin has quit IRC | 08:01 | |
| *** aloga_ has joined #openstack-keystone | 08:01 | |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** rcernin has joined #openstack-keystone | 08:03 | |
| *** chrisplo has joined #openstack-keystone | 08:04 | |
| *** chrisplo has quit IRC | 08:09 | |
| *** hoonetorg has quit IRC | 08:12 | |
| *** pnavarro has joined #openstack-keystone | 08:19 | |
| *** mvk has joined #openstack-keystone | 08:22 | |
| *** zzzeek_ has quit IRC | 08:25 | |
| *** hoonetorg has joined #openstack-keystone | 08:28 | |
| *** afazekas has quit IRC | 08:29 | |
| *** zzzeek has joined #openstack-keystone | 08:33 | |
| *** afazekas has joined #openstack-keystone | 08:34 | |
| *** hoonetorg has quit IRC | 08:36 | |
| *** jistr is now known as jistr|mtgs | 08:36 | |
| *** faizy_ has joined #openstack-keystone | 08:37 | |
| *** faizy has quit IRC | 08:37 | |
| *** openstackgerrit has joined #openstack-keystone | 08:39 | |
| openstackgerrit | Julia Varlamova proposed openstack/keystone: Change DevStack plugin to setup multi-Keystone https://review.openstack.org/399472 | 08:39 |
| *** jamielennox is now known as jamielennox|away | 08:40 | |
| *** faizy has joined #openstack-keystone | 08:41 | |
| *** amoralej|off is now known as amoralej | 08:43 | |
| *** faizy_ has quit IRC | 08:44 | |
| *** hoonetorg has joined #openstack-keystone | 08:49 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** magic has joined #openstack-keystone | 09:01 | |
| *** xiaoyang has quit IRC | 09:05 | |
| *** xiaoyang has joined #openstack-keystone | 09:05 | |
| *** magic has quit IRC | 09:06 | |
| *** annp_ has joined #openstack-keystone | 09:06 | |
| *** annp has quit IRC | 09:07 | |
| *** asettle has joined #openstack-keystone | 09:08 | |
| *** g2 is now known as g2away | 09:14 | |
| *** hoonetorg has quit IRC | 09:16 | |
| *** markd_ has quit IRC | 09:20 | |
| *** narasimha_SV has quit IRC | 09:29 | |
| *** chrisplo has joined #openstack-keystone | 10:05 | |
| *** chrisplo has quit IRC | 10:09 | |
| shuquan_ | hi guys, i see current devstack support | 10:17 |
| shuquan_ | federate with testshib.org | 10:17 |
| shuquan_ | anyone used it before? | 10:17 |
| shuquan_ | https://review.openstack.org/#/c/393932/ | 10:18 |
| shuquan_ | Devstack plugin to federate with testshib.org | 10:18 |
| shuquan_ | this one | 10:18 |
| *** liujiong has quit IRC | 10:21 | |
| *** hoangcx has quit IRC | 10:26 | |
| *** guoshan has quit IRC | 10:27 | |
| *** annp_ has quit IRC | 10:32 | |
| *** mdavidson has joined #openstack-keystone | 10:39 | |
| *** zhangjl1 has quit IRC | 10:41 | |
| *** shuquan_ has quit IRC | 10:44 | |
| *** code-R_ has joined #openstack-keystone | 10:56 | |
| *** code-R has quit IRC | 11:00 | |
| *** tesseract has joined #openstack-keystone | 11:05 | |
| *** tesseract is now known as Guest17259 | 11:05 | |
| *** daemontool has joined #openstack-keystone | 11:11 | |
| *** GB21 has quit IRC | 11:15 | |
| *** udesale has quit IRC | 11:15 | |
| *** GB21 has joined #openstack-keystone | 11:17 | |
| *** Guest17259 has quit IRC | 11:21 | |
| *** masber has quit IRC | 11:23 | |
| *** tesseract- has joined #openstack-keystone | 11:24 | |
| *** faizy_ has joined #openstack-keystone | 11:26 | |
| *** faizy has quit IRC | 11:30 | |
| *** code-R has joined #openstack-keystone | 11:31 | |
| *** code-R_ has quit IRC | 11:34 | |
| *** nicolasbock has joined #openstack-keystone | 11:40 | |
| *** Daviey has quit IRC | 11:43 | |
| *** Daviey has joined #openstack-keystone | 11:43 | |
| *** chrisplo has joined #openstack-keystone | 12:05 | |
| *** GB21 has quit IRC | 12:07 | |
| *** code-R has quit IRC | 12:07 | |
| *** code-R has joined #openstack-keystone | 12:09 | |
| *** chrisplo has quit IRC | 12:10 | |
| *** code-R_ has joined #openstack-keystone | 12:14 | |
| *** code-R has quit IRC | 12:14 | |
| *** raildo has joined #openstack-keystone | 12:23 | |
| *** pnavarro has quit IRC | 12:25 | |
| *** faizy_ has quit IRC | 12:30 | |
| *** pnavarro has joined #openstack-keystone | 12:36 | |
| *** code-R has joined #openstack-keystone | 12:36 | |
| *** code-R_ has quit IRC | 12:39 | |
| *** pnavarro has quit IRC | 12:41 | |
| *** edmondsw has joined #openstack-keystone | 13:11 | |
| *** nishaYadav has joined #openstack-keystone | 13:20 | |
| nishaYadav | hey all! | 13:21 |
| stevemar | o/ | 13:22 |
| *** amoralej is now known as amoralej|lunch | 13:26 | |
| *** tesseract- has quit IRC | 13:27 | |
| nishaYadav | hi stevemar :D | 13:30 |
| stevemar | nishaYadav: hiya ;) | 13:30 |
| *** narasimha_SV has joined #openstack-keystone | 13:33 | |
| narasimha_SV | http://paste.openstack.org/show/591383/ are these configurations proper to have backend LDAP ? | 13:34 |
| *** clenimar has joined #openstack-keystone | 13:35 | |
| *** catintheroof has joined #openstack-keystone | 13:38 | |
| *** dave-mccowan has joined #openstack-keystone | 13:41 | |
| *** pnavarro has joined #openstack-keystone | 13:41 | |
| *** shuquan has joined #openstack-keystone | 13:41 | |
| *** shuquan has quit IRC | 13:46 | |
| *** ayoung has quit IRC | 13:53 | |
| *** lamt has joined #openstack-keystone | 14:01 | |
| *** catinthe_ has joined #openstack-keystone | 14:02 | |
| *** catintheroof has quit IRC | 14:04 | |
| *** amoralej|lunch is now known as amoralej | 14:04 | |
| *** shuquan has joined #openstack-keystone | 14:04 | |
| *** chrisplo has joined #openstack-keystone | 14:06 | |
| *** chrisplo has quit IRC | 14:10 | |
| *** code-R has quit IRC | 14:12 | |
| dstanek | o/ | 14:26 |
| *** nishaYadav_ has joined #openstack-keystone | 14:26 | |
| stevemar | o\ | 14:26 |
| openstackgerrit | Arthur Miranda proposed openstack/python-keystoneclient: Prevent attempts to "filter" find() calls by globally unique IDs https://review.openstack.org/375730 | 14:26 |
| *** spzala has joined #openstack-keystone | 14:27 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: api-ref update for roles assignments with names https://review.openstack.org/406366 | 14:27 |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: api-ref update for roles assignments with names https://review.openstack.org/406366 | 14:28 |
| *** nishaYadav has quit IRC | 14:29 | |
| *** narasimha_SV has quit IRC | 14:30 | |
| *** udesale has joined #openstack-keystone | 14:38 | |
| *** code-R has joined #openstack-keystone | 14:38 | |
| *** code-R_ has joined #openstack-keystone | 14:40 | |
| *** code-R has quit IRC | 14:43 | |
| *** aloga_ has quit IRC | 14:43 | |
| *** lamt has quit IRC | 14:46 | |
| *** g2away is now known as g2 | 14:46 | |
| *** edtubill has joined #openstack-keystone | 15:02 | |
| *** daemontool has quit IRC | 15:08 | |
| *** ayoung has joined #openstack-keystone | 15:12 | |
| *** ChanServ sets mode: +v ayoung | 15:12 | |
| *** GB21 has joined #openstack-keystone | 15:14 | |
| *** shuquan has quit IRC | 15:15 | |
| *** nishaYadav_ has quit IRC | 15:21 | |
| *** nishaYadav_ has joined #openstack-keystone | 15:25 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:34 | |
| *** chrisplo has joined #openstack-keystone | 15:37 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 15:38 |
| *** ravelar has joined #openstack-keystone | 15:38 | |
| lbragstad | rderose ^ | 15:38 |
| stevemar | lbragstad: nice | 15:39 |
| *** adrian_otto has joined #openstack-keystone | 15:40 | |
| rderose | lbragstad: cool | 15:41 |
| lbragstad | i wanted to get that proposed last week but i ran out of time. | 15:41 |
| *** chrisplo has quit IRC | 15:41 | |
| lbragstad | i'd like to get it reviewed before the keystone/horizon meeting this week | 15:42 |
| lbragstad | so - any reviews would be awesome :) | 15:42 |
| *** phalmos has joined #openstack-keystone | 15:44 | |
| stevemar | lbragstad: reviewed | 15:46 |
| dstanek | lbragstad: that's a good idea for all our schemas | 15:51 |
| lbragstad | dstanek what's that? | 15:52 |
| robcresswell | lbragstad: Looks like a nice change from a Horizon view. Anything that lets us cut down on config is great. | 15:54 |
| robcresswell | probably 3/4 of our config is just duplicated service config :( | 15:54 |
| lbragstad | robcresswell yeah - that feels like a pain to manage | 15:54 |
| *** briancline has quit IRC | 15:55 | |
| dstanek | lbragstad: it would be nice to publish our schemas | 15:56 |
| lbragstad | ah - i see what you mean | 15:58 |
| *** voelzmo has quit IRC | 16:01 | |
| *** GB21 has quit IRC | 16:01 | |
| *** spligak has quit IRC | 16:04 | |
| *** rcernin has quit IRC | 16:05 | |
| *** ayoung has quit IRC | 16:06 | |
| *** ayoung has joined #openstack-keystone | 16:07 | |
| *** ChanServ sets mode: +v ayoung | 16:07 | |
| *** GB21 has joined #openstack-keystone | 16:10 | |
| *** catintheroof has joined #openstack-keystone | 16:13 | |
| *** catinthe_ has quit IRC | 16:16 | |
| *** arunkant has quit IRC | 16:19 | |
| *** jaugustine has joined #openstack-keystone | 16:27 | |
| *** nishaYadav_ has quit IRC | 16:30 | |
| *** oomichi has quit IRC | 16:31 | |
| *** faizy_ has joined #openstack-keystone | 16:32 | |
| *** nishaYadav_ has joined #openstack-keystone | 16:33 | |
| *** nishaYadav_ has quit IRC | 16:34 | |
| *** faizy__ has joined #openstack-keystone | 16:34 | |
| *** agrebennikov has joined #openstack-keystone | 16:35 | |
| *** alex_xu has quit IRC | 16:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 16:35 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor's database symptoms https://review.openstack.org/407062 | 16:35 |
| *** erhudy has joined #openstack-keystone | 16:36 | |
| *** faizy_ has quit IRC | 16:36 | |
| *** mvk has quit IRC | 16:37 | |
| *** lamt has joined #openstack-keystone | 16:38 | |
| *** code-R_ has quit IRC | 16:41 | |
| *** code-R has joined #openstack-keystone | 16:41 | |
| *** antwash_ has joined #openstack-keystone | 16:43 | |
| *** antwash_ has quit IRC | 16:43 | |
| *** antwash_ has joined #openstack-keystone | 16:43 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 16:44 |
| *** antwash_ has quit IRC | 16:46 | |
| *** antwash_ has joined #openstack-keystone | 16:47 | |
| *** antwash_ has quit IRC | 16:48 | |
| *** antwash_ has joined #openstack-keystone | 16:48 | |
| *** antwash_ has quit IRC | 16:49 | |
| *** adrian_otto has quit IRC | 16:52 | |
| lbragstad | stevemar rderose dstanek hmm - i like the domain configuration route, because it would probably save us some work.. but i think it would require some dangerous policy changes | 16:58 |
| lbragstad | we currently suggest that only admins can interact with the domain config via the API | 16:59 |
| *** adrian_otto has joined #openstack-keystone | 16:59 | |
| lbragstad | which would have to change so that horizon can use non-admin tokens to get password requirements for non-admin users. | 16:59 |
| lbragstad | i'm documenting this in another iteration of the spec | 17:00 |
| rderose | lbragstad: hmm... and security compliance is global; not domain specific | 17:01 |
| lbragstad | rderose well - right now it is | 17:01 |
| rderose | :) | 17:01 |
| rderose | true | 17:01 |
| lbragstad | rderose but that could change in the future, right? | 17:01 |
| rderose | yes | 17:01 |
| *** antwash_ has joined #openstack-keystone | 17:02 | |
| *** catinthe_ has joined #openstack-keystone | 17:02 | |
| lbragstad | so - the security concern is loosening the policy around retrieving domain configuration | 17:03 |
| lbragstad | then non-admin users would be able to look at other options for their specific domain | 17:03 |
| *** catintheroof has quit IRC | 17:04 | |
| lbragstad | (i.e. things in the [ldap] or [identity] sections) | 17:04 |
| lbragstad | at the same time, the [security_compliance] section and the [ldap] sections seem mutually exclusive for a domain | 17:04 |
| *** browne has joined #openstack-keystone | 17:05 | |
| *** d0ugal has quit IRC | 17:07 | |
| *** antwash_ has quit IRC | 17:07 | |
| *** udesale has quit IRC | 17:08 | |
| *** tqtran has joined #openstack-keystone | 17:09 | |
| *** asettle has quit IRC | 17:09 | |
| *** iurygregory has joined #openstack-keystone | 17:11 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs: Expose password requirements through API https://review.openstack.org/407036 | 17:20 |
| *** chrisplo has joined #openstack-keystone | 17:21 | |
| *** adrian_otto1 has joined #openstack-keystone | 17:26 | |
| *** mvk has joined #openstack-keystone | 17:26 | |
| *** Guest51737 is now known as mgagne | 17:26 | |
| *** mgagne has quit IRC | 17:27 | |
| *** mgagne has joined #openstack-keystone | 17:27 | |
| morgan | morning. | 17:28 |
| *** adrian_otto has quit IRC | 17:28 | |
| *** gyee has joined #openstack-keystone | 17:30 | |
| *** oomichi has joined #openstack-keystone | 17:30 | |
| *** GB21 has quit IRC | 17:42 | |
| *** code-R has quit IRC | 17:42 | |
| *** code-R has joined #openstack-keystone | 17:43 | |
| *** richm has joined #openstack-keystone | 17:44 | |
| *** shuquan has joined #openstack-keystone | 17:47 | |
| *** harlowja has joined #openstack-keystone | 17:50 | |
| samueldmq | morgan: morning | 17:50 |
| samueldmq | crinkle: hey, are you around ? | 17:50 |
| samueldmq | crinkle: what does it take to make https://review.openstack.org/#/c/390948 work with anonymous binds ? | 17:51 |
| *** shuquan has quit IRC | 17:52 | |
| *** faizy_ has joined #openstack-keystone | 17:58 | |
| *** faizy__ has quit IRC | 18:01 | |
| crinkle | samueldmq: just conn.simple_bind_s() with no arguments I think | 18:01 |
| crinkle | i don't have that env up right this moment | 18:02 |
| samueldmq | crinkle: and how do we check if anonymous binds are supported ? is there a config option for it | 18:02 |
| samueldmq | crinkle: or we should just try and see? | 18:02 |
| *** spligak has joined #openstack-keystone | 18:03 | |
| crinkle | samueldmq: I think if user and password aren't set that implies the operator intends to bind anonymously | 18:04 |
| samueldmq | crinkle: and allowing it or not depends on their LDAP server, right? | 18:04 |
| crinkle | samueldmq: yes I believe so | 18:05 |
| *** adrian_otto1 has quit IRC | 18:06 | |
| *** adrian_otto has joined #openstack-keystone | 18:07 | |
| samueldmq | crinkle: kk. it would make sense for me to open another bug and say : keystone should attemp an anonymous LDAP bind if no credentials are provided | 18:07 |
| samueldmq | crinkle: it does not do that today, and that patch fixes "Set network connection timeout on Keystone Identity's LDAP backend to prevent stall on bind" | 18:07 |
| samueldmq | which can be related, but seems to be a separate thing | 18:07 |
| samueldmq | crinkle: not sure you agree and/or are okay with that | 18:08 |
| crinkle | samueldmq: okay, that is fine with me | 18:08 |
| samueldmq | crinkle: cool, do you want to submit the followup yourself ? | 18:09 |
| samueldmq | crinkle: it'd be fine to test it locally when you have that env up again, if possible | 18:09 |
| crinkle | samueldmq: sure I can submit it | 18:09 |
| samueldmq | crinkle: awesome, thanks! | 18:10 |
| samueldmq | rderose: hi | 18:19 |
| rderose | samueldmq: hi | 18:20 |
| samueldmq | rderose: hye, hope you're doing great | 18:20 |
| samueldmq | rderose: is there any consensus on "Federated attributes for users" vs "enhancing the mapping engine" ? | 18:20 |
| rderose | samueldmq: I don't know about versus, but we discussed in the last keystone meeting and there was support for this spec | 18:21 |
| samueldmq | rderose: they are different solution to the same problem, right ? | 18:22 |
| rderose | samueldmq: partly... extending the API, allows operators to query federated users in other to get their local user ID | 18:23 |
| samueldmq | rderose: and then assign roles, etc | 18:23 |
| ayoung | agrebennikov, so...I know I owe you an explanation | 18:23 |
| rderose | samueldmq: that part, yes | 18:23 |
| rderose | samueldmq: or delegation | 18:23 |
| ayoung | just adding the project BY ID as you requested is actually neither necesaary nor sufficient | 18:23 |
| samueldmq | rderose: it's also possible to create a user and know its ID even before it first connects | 18:24 |
| samueldmq | rderose: so it's possible to do that setup, which is why I understand it as covering what 'enhanced engine' proposes | 18:24 |
| rderose | samueldmq: currently no, you would need to create the user to get the user ID | 18:25 |
| rderose | samueldmq: I like the idea of giving operators the flexibility to provision in mass by utilizing shadow mapping or by utilizing the API | 18:25 |
| rderose | samueldmq: extending the user API also allows for de-provisioning | 18:26 |
| samueldmq | rderose: which is not covered with improving the engine (which is only provisioning) | 18:27 |
| rderose | samueldmq: correct | 18:27 |
| ayoung | agrebennikov, understand what I mean? You need the role assignments, too | 18:28 |
| samueldmq | rderose: so, operators have 2 options to provision resources to their federation users (create users with the extended user api OR use the extended map engine) | 18:28 |
| ayoung | and the roles | 18:28 |
| samueldmq | rderose: and to de-provision use the extended user api, filter on whatever federation fields you want, and clean it up | 18:28 |
| ayoung | and if those are not the same on both systems...well...who really cares. | 18:29 |
| rderose | samueldmq: yes, and there may be different use cases as to why you would want one over the other | 18:29 |
| samueldmq | rderose: agreed | 18:29 |
| rderose | samueldmq: yes | 18:29 |
| ayoung | Its only an issue if people are trying to do things by ID, but then the Keystone server AUth URL is different...so everything is different | 18:29 |
| *** faizy_ has quit IRC | 18:30 | |
| ayoung | agrebennikov, you will not want to honor the tokens issued by one Keystone server in another server where the IDs are different | 18:30 |
| samueldmq | rderose: I wonder if, in the future, it would be nice to know what projects were created to serve only federated users (with the extended mapping engine) | 18:30 |
| samueldmq | rderose: so that it is easier to make de-provisioning happen on that too | 18:30 |
| ayoung | samueldmq, there is no such thing | 18:30 |
| ayoung | a project can serve any user, from any domain | 18:30 |
| ayoung | federated or not | 18:31 |
| samueldmq | ayoung: yeah, I don't want ot overcomplicate things | 18:31 |
| samueldmq | nvm | 18:31 |
| rderose | samueldmq: the projects would be under the IdP's domain, so you could find them that way | 18:31 |
| ayoung | you could query active role assignments when you decomission, but there are deamons there | 18:31 |
| ayoung | rderose, no | 18:31 |
| rderose | :) | 18:31 |
| ayoung | rderose, we don't have a direct correspondance between IdP and domain, should not thinkg of things that way | 18:32 |
| ayoung | we have double-booked the term domain | 18:32 |
| ayoung | if we were smart back when we did this, we would have a different term for the top level of projects versus the top level ofidentiy | 18:32 |
| ayoung | but the split had not happened yet | 18:32 |
| ayoung | extended Map engine sounds like the right tool for the main set of uses | 18:33 |
| ayoung | the goal should be to make it so IdP managers can set up and amanage their own mappings | 18:33 |
| ayoung | and in order to do that we need restrictions | 18:33 |
| rderose | ayoung: hmm... ah, right | 18:33 |
| ayoung | rderose, which is where I suspect you were headed | 18:34 |
| ayoung | lets say we have domain DF1 (for federation) and IdP I1 | 18:34 |
| ayoung | we make a link, outside of mapping, that says the mapping for I1 can only map to DF1 | 18:34 |
| ayoung | then the IdP admin can set up whatever they want | 18:34 |
| ayoung | bu their users only ever go into DF1 | 18:35 |
| ayoung | might need to make it slightly more complex for groups: | 18:35 |
| ayoung | they can map users into DF1 and into groups in DF1 plus Default or something | 18:35 |
| rderose | ayoung: right and they could have access to projects outside of DF1 | 18:35 |
| ayoung | groups can be in a separate domain from the users they contain, and figuring out the mapping restrictions will let us scale the Human side | 18:35 |
| ayoung | But if We start by saying IdP to domain access is a distinct entity, outside (and preceding) the Federations mapping table we can then let IdP admins do their job | 18:36 |
| *** amoralej is now known as amoralej|off | 18:37 | |
| ayoung | And...to do that, it probably makes sense to say that a domain owns an IdP | 18:37 |
| ayoung | We can default the existing ones to the Admin domain | 18:37 |
| rderose | ayoung: why not create a new domain for the IdP? | 18:38 |
| rderose | instead of default to Admin | 18:39 |
| ayoung | rderose, we cn do that for the future, but we need backwards compat, too | 18:39 |
| ayoung | who owns it, and who they can map to are possibly two different things | 18:39 |
| ayoung | but maybe no | 18:39 |
| ayoung | I think not... | 18:40 |
| ayoung | OK, lets say that each IdP is owned by a domain | 18:40 |
| ayoung | we createa new role "idp_admin" that lets a user create and define the Idp, mapping, (and protocols ?) for that domain | 18:41 |
| samueldmq | rderose: I've +2ed, the concept looks solid and the spec is clear | 18:41 |
| rderose | samueldmq: ++ | 18:41 |
| samueldmq | rderose: impl details coming in implementation patches | 18:41 |
| ayoung | I think not on the protocols today, but that is due to how we implement (in HTTPD) | 18:41 |
| ayoung | But the mapping certainly | 18:41 |
| *** code-R has quit IRC | 18:42 | |
| *** code-R has joined #openstack-keystone | 18:43 | |
| *** narasimha_SV has joined #openstack-keystone | 18:43 | |
| narasimha_SV | I am trying to integrate keystone to use LDAP as backend | 18:43 |
| narasimha_SV | http://paste.openstack.org/show/591463/ | 18:43 |
| narasimha_SV | this is the error I am getting | 18:43 |
| narasimha_SV | http://paste.openstack.org/show/591383/ | 18:43 |
| narasimha_SV | these are my LDAP confs in keysonte.conf | 18:44 |
| rderose | ayoung: interesting, I was only thinking that IdP -> Domain relationship would just mean that the users and groups belonged to that domain | 18:44 |
| rderose | ayoung: currently, only admins can register new IdPs I imagine | 18:44 |
| ayoung | rderose, that is all true | 18:44 |
| ayoung | but the mapping is the part that is hard to get right | 18:45 |
| ayoung | if the protocol cold be done all inside Keystone, it would be possible to let an admin create the IdP, and then give the rest of the control to the idp_admin, but the HTTPD config is pretty much web server, multisite configruation changes | 18:46 |
| ayoung | we don't want non-admins messing with that | 18:46 |
| rderose | ayoung: true, but... if you extend the API, it's not hard. admins create the IdP and domain_admins manage the rest | 18:47 |
| ayoung | and, we don't want to pull it into Keystone (despite what dstanek thinks) because it is heavy lifting crypto that is probably not right to do in python | 18:47 |
| dstanek | narasimha_SV: are you actually using example.com domains or did you sanitize that? | 18:47 |
| rderose | ayoung: (probably not that easy :) ) | 18:48 |
| narasimha_SV | +dstanek: i created a local LDAP server in my environment to work with | 18:48 |
| ayoung | rderose, not code that we are quialified to maintain...SAML itself is a nasty beast, and add in the other forms of Federation, it is yuck... | 18:48 |
| dstanek | narasimha_SV: are all those dn settings correct? have you been able to query from the command line? | 18:48 |
| narasimha_SV | yes i am able to query from command line | 18:49 |
| rderose | ayoung: good point | 18:49 |
| dstanek | narasimha_SV: can you increase the logging so you can see the exact query being performed? | 18:50 |
| rderose | ayoung: what do you mean by the protocol being done inside of keystone? | 18:50 |
| stevemar | ravelar: o/ | 18:50 |
| rderose | ayoung: you mean all of the configuration stuff? | 18:50 |
| ayoung | rderose, when you create an IdP and a protocol, you create new suburls under OS-FEDERATION, but those need to be configurated per protocol in the APache server | 18:50 |
| narasimha_SV | ldapsearch -x -h localhost -p 1389 -b dc=example,dc=com "(uid=admin)" mail | 18:50 |
| ravelar | stevemar: o/ | 18:50 |
| ayoung | dstanek, is working on making SAML work 100% inside Keystone | 18:50 |
| agrebennikov | ayoung, I see your point. But there is other side of this. It's up to the administrator how to use it. I don't understand why anybody want to Block it if it is just the functionality extension. Does it Break anything? Does it have any security issue? | 18:51 |
| ayoung | I'm not certain it is the right approach | 18:51 |
| stevemar | ravelar: do you have any questions about my comments on the duplicate entry patch? | 18:51 |
| ayoung | agrebennikov, it is a support nightmare | 18:51 |
| narasimha_SV | this is the command fow which i am getting output | 18:51 |
| agrebennikov | what exactly? | 18:51 |
| agrebennikov | the option? | 18:51 |
| ayoung | agrebennikov, you are looking to do multisite sync at the API level. Lets define it that way and see what we need to do to make it happen | 18:51 |
| ravelar | stevemar: no it was clear, thanks for the feedback :) I made the changes and am just working on unit tests for all objects | 18:52 |
| agrebennikov | ayoung, exactly | 18:52 |
| agrebennikov | moreover | 18:52 |
| ayoung | agrebennikov, a token issues by one Keystone server will have garbage in it according to a non-synced keystone server if we go the way you are proposing | 18:52 |
| *** asettle has joined #openstack-keystone | 18:53 | |
| agrebennikov | as I was always saying - my very first usecase was to allow syncing up groups in LDAP with keystone, since there is no other way to do it for now | 18:53 |
| ayoung | it breaks trusts and the single-role tokens I was proposing | 18:53 |
| openstackgerrit | Ken'ichi Ohmichi proposed openstack/keystone: Remove CONF.os_inherit.enabled https://review.openstack.org/405679 | 18:53 |
| ayoung | agrebennikov, there is a way. You do it at the MySQL level. The rest of the world has come to peace with this. | 18:53 |
| agrebennikov | ayoung, examples? | 18:54 |
| *** d0ugal has joined #openstack-keystone | 18:54 | |
| ayoung | Or you Do full blown Keystone to Keystone federation | 18:54 |
| *** openstackstatus has joined #openstack-keystone | 18:54 | |
| *** ChanServ sets mode: +v openstackstatus | 18:54 | |
| ayoung | examples on Gallera multi-site? | 18:54 |
| agrebennikov | which is 15 times slower than just issuing the tokens? | 18:54 |
| ayoung | agrebennikov, So what | 18:55 |
| ayoung | agrebennikov, that should be a one time cost when a user goes to a different region | 18:55 |
| ayoung | but...I am not here to solve your problem | 18:55 |
| ayoung | use the Database layer. Was not my call to set things up this way, but I've had to live with it | 18:56 |
| stevemar | rodrigods: Ken'ichi should be ready to merge | 18:56 |
| ayoung | we can't start breaking the internal referntial integrity assumptions of Keyston | 18:56 |
| dstanek | ayoung: i thought you were assigned to solve all the problems :-) | 18:56 |
| ayoung | stevemar, who can we get that can help agrebennikov with the multisite Gallera stuff? It is beyond me | 18:56 |
| ayoung | dstanek, I am solveing the strategeric problems, making Keystone actually do what everything thinks it is doing but don't realize how broken it is | 18:57 |
| agrebennikov | wait please. I'm not asking to solve technical stuff. I'm bringing the usecases and the solution for them | 18:57 |
| agrebennikov | that's it | 18:57 |
| ayoung | agrebennikov, your use case is multi-site sync | 18:57 |
| ayoung | right? | 18:58 |
| stevemar | ravelar: thanks for working on it | 18:58 |
| agrebennikov | as well as I'm even bginging customers | 18:58 |
| ayoung | We can't do multisite at the API level | 18:58 |
| *** code-R has quit IRC | 18:58 | |
| ayoung | I understand that you liked LDAP as it works well with "Eventual consistency" | 18:58 |
| *** code-R has joined #openstack-keystone | 18:59 | |
| ayoung | BUt Gallera can do that as well, and that is the tool that we have | 18:59 |
| dstanek | ...or a custom driver? right? either way it's a data layer problem | 18:59 |
| ayoung | dstanek, I had proposed a notifications layer tool, but there are too many data consistency problems there | 19:02 |
| ayoung | what if you miss a notification because Keystone is down | 19:02 |
| ayoung | dstanek, this is what Gallera is supposed to do | 19:03 |
| dstanek | once there is a way to create projects for a federated user then federation would be a great solution | 19:05 |
| breton | my comment still stands. With the change there some tokens will be verifiable in 2 regions and some on only 1 | 19:05 |
| agrebennikov | ayoung, instead of allowing me to write 3-lines script for making it consistent you suggested me to create half-keyston-server stuff on top of private vpn connection between mamagement networks of the DCs. | 19:06 |
| ayoung | agrebennikov, it will not be a 3 line script | 19:06 |
| agrebennikov | breton, it is still Up To Admin how to maintain it. Nobody removes the role of the admin and his/her communication with the users | 19:06 |
| ayoung | agrebennikov, you are breaking so many assumptions of how Keystone is defined. | 19:07 |
| agrebennikov | do I? | 19:07 |
| ayoung | No way to confirm consistency | 19:07 |
| ayoung | yes, yes you are. | 19:07 |
| agrebennikov | but then how you allowd it to work for 5 years while the project could be stored in ldap? | 19:08 |
| agrebennikov | when IDs Were coming from ldap as well | 19:08 |
| ayoung | breton, I wonder, though, if this is an issue with Fernet tokens in general | 19:08 |
| ayoung | do we really need the Keystone servers to be able to confirm the keys they use with each other? | 19:08 |
| ayoung | I mean, you could make the same nightmare scenario now | 19:08 |
| ayoung | 2 keysones, distinct databases, share a key, and now...kablooey | 19:09 |
| agrebennikov | that's again up to the admin. If you use same keys actoss global cloud - you are all set | 19:09 |
| breton | ayoung: that would be a complete kablooey | 19:09 |
| breton | ayoung: nothing will work | 19:09 |
| ayoung | sharing 1/2 the data makes it only kablooey sometimes, fun to debug | 19:09 |
| breton | ayoung: because all ids are different | 19:09 |
| ayoung | breton, so agrebennikov wants to introduce a case where the IDs are the same 80% of the time...how often will that fail?> | 19:10 |
| ayoung | agrebennikov, if the role assignements are different, it all breaks | 19:10 |
| breton | ayoung: 20%? :) | 19:10 |
| ayoung | You need the Ids to be identical | 19:10 |
| ayoung | and that is for roles, role assignments, users, groups, and projects | 19:11 |
| ayoung | You need to be able to sync *everything* by ID or it will break | 19:11 |
| ayoung | not just projects | 19:11 |
| breton | ayoung: will there be a test making sure that it's only 20% so that when we add some new cool auth method it doesn't become 21%? :) | 19:11 |
| ayoung | breton, 20 == 21 for very large values of 20 | 19:11 |
| agrebennikov | please tell me guys why the hell you alow Roles to be the same? | 19:12 |
| agrebennikov | according to keystone concept Everything should be unoque | 19:12 |
| ayoung | agrebennikov, that story requires alcohol | 19:12 |
| agrebennikov | same with user IDs | 19:12 |
| agrebennikov | please, come | 19:12 |
| agrebennikov | liquor store is right next to my house, same as bbq | 19:13 |
| ayoung | agrebennikov, I feel your pain. But what you are asking for is a keystone to keystone sync at the API level. Not a trivial thing to implement | 19:13 |
| agrebennikov | ayoung, I'm completely pissed off telling the truth.... I'm Not asking You to implement the sync | 19:14 |
| *** adrian_otto has quit IRC | 19:14 | |
| agrebennikov | as an administrator >"I"< will do it | 19:14 |
| ayoung | agrebennikov, yes, but without it, what you proposed will break | 19:14 |
| agrebennikov | just let me do it | 19:14 |
| ayoung | No. | 19:14 |
| ayoung | agrebennikov, you are asking Me to support it | 19:15 |
| agrebennikov | nope | 19:15 |
| agrebennikov | I'll support my schema | 19:15 |
| agrebennikov | you only support an option | 19:15 |
| ayoung | you are asking Me, and the rest of the team, to build this mechanism into the supported version of Keystone that gets shipped to everython | 19:15 |
| ayoung | and it breaks a lot of stuff | 19:15 |
| agrebennikov | why same user's ID doesn't break stuff? Why same Domain IDs don't break stuff????? only projects for some reason | 19:16 |
| ayoung | agrebennikov, tell you waht...I am going to assign that question to you for Homework | 19:16 |
| breton | domain ids break stuff. | 19:16 |
| ayoung | I don't havethe time to walk you through it, but it has to do with the token validation repopulating the data for the role assignment. | 19:16 |
| ayoung | and now I need to shift gears | 19:17 |
| *** ayoung is now known as ayoung-afk | 19:17 | |
| agrebennikov | I already did that | 19:17 |
| agrebennikov | I actually Started with it | 19:17 |
| *** pnavarro has quit IRC | 19:17 | |
| *** asettle__ has joined #openstack-keystone | 19:18 | |
| *** adrian_otto has joined #openstack-keystone | 19:19 | |
| *** faizy has joined #openstack-keystone | 19:22 | |
| *** baffle_ has joined #openstack-keystone | 19:23 | |
| *** adrian_otto has quit IRC | 19:24 | |
| *** diazjf has joined #openstack-keystone | 19:25 | |
| *** odyssey4me_ has joined #openstack-keystone | 19:26 | |
| *** bapalm_ has joined #openstack-keystone | 19:26 | |
| *** gagehugo_ has joined #openstack-keystone | 19:27 | |
| *** voelzmo has joined #openstack-keystone | 19:27 | |
| *** voelzmo has quit IRC | 19:27 | |
| *** voelzmo has joined #openstack-keystone | 19:27 | |
| *** gagehugo has quit IRC | 19:28 | |
| *** asettle has quit IRC | 19:28 | |
| *** mvk has quit IRC | 19:28 | |
| *** agrebennikov has quit IRC | 19:28 | |
| *** clenimar has quit IRC | 19:28 | |
| *** rm_work has quit IRC | 19:28 | |
| *** bapalm has quit IRC | 19:28 | |
| *** jefrite has quit IRC | 19:28 | |
| *** odyssey4me has quit IRC | 19:28 | |
| *** baffle has quit IRC | 19:28 | |
| *** asettle__ is now known as asettle | 19:28 | |
| *** jefrite has joined #openstack-keystone | 19:30 | |
| *** rm_work has joined #openstack-keystone | 19:30 | |
| *** rm_work has quit IRC | 19:30 | |
| *** rm_work has joined #openstack-keystone | 19:30 | |
| *** gagehugo_ has quit IRC | 19:34 | |
| *** mvk has joined #openstack-keystone | 19:34 | |
| *** faizy has quit IRC | 19:34 | |
| *** clenimar has joined #openstack-keystone | 19:34 | |
| *** adrian_otto has joined #openstack-keystone | 19:35 | |
| *** gagehugo has joined #openstack-keystone | 19:35 | |
| *** agrebennikov has joined #openstack-keystone | 19:37 | |
| *** voelzmo has quit IRC | 19:43 | |
| *** code-R has quit IRC | 19:48 | |
| *** adrian_otto has quit IRC | 19:50 | |
| *** woodster_ has joined #openstack-keystone | 19:51 | |
| *** cbits has joined #openstack-keystone | 19:51 | |
| *** nkinder has quit IRC | 19:53 | |
| *** adrian_otto has joined #openstack-keystone | 19:54 | |
| *** voelzmo has joined #openstack-keystone | 20:01 | |
| *** arunkant has joined #openstack-keystone | 20:01 | |
| *** nkinder has joined #openstack-keystone | 20:06 | |
| *** gus has quit IRC | 20:08 | |
| *** gus has joined #openstack-keystone | 20:10 | |
| *** voelzmo has quit IRC | 20:13 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor federation file https://review.openstack.org/407188 | 20:16 |
| *** shuquan_ has joined #openstack-keystone | 20:25 | |
| *** diazjf has quit IRC | 20:25 | |
| *** adrian_otto has quit IRC | 20:29 | |
| *** adrian_otto has joined #openstack-keystone | 20:29 | |
| *** shuquan_ has quit IRC | 20:29 | |
| *** pnavarro has joined #openstack-keystone | 20:31 | |
| *** d0ugal has quit IRC | 20:32 | |
| *** edtubill has quit IRC | 20:34 | |
| *** adrian_otto has quit IRC | 20:39 | |
| *** adrian_otto has joined #openstack-keystone | 20:39 | |
| *** edmondsw has quit IRC | 20:41 | |
| *** asettle has quit IRC | 20:41 | |
| *** diazjf has joined #openstack-keystone | 20:45 | |
| *** edmondsw has joined #openstack-keystone | 20:47 | |
| *** edmondsw has quit IRC | 20:52 | |
| *** catinthe_ has quit IRC | 20:53 | |
| *** adrian_otto has quit IRC | 20:53 | |
| *** edmondsw has joined #openstack-keystone | 20:53 | |
| *** edmondsw has quit IRC | 20:58 | |
| *** Ephur has joined #openstack-keystone | 20:58 | |
| *** lamt has quit IRC | 21:03 | |
| *** voelzmo has joined #openstack-keystone | 21:05 | |
| *** voelzmo has quit IRC | 21:06 | |
| *** voelzmo has joined #openstack-keystone | 21:07 | |
| *** voelzmo_ has joined #openstack-keystone | 21:10 | |
| *** voelzmo has quit IRC | 21:10 | |
| *** jamielennox|away is now known as jamielennox | 21:13 | |
| *** spzala has quit IRC | 21:14 | |
| *** voelzmo_ has quit IRC | 21:18 | |
| *** edmondsw has joined #openstack-keystone | 21:25 | |
| *** Marcellin__ has joined #openstack-keystone | 21:25 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Rename doctor symptom in security_compliance https://review.openstack.org/407206 | 21:26 |
| *** edtubill has joined #openstack-keystone | 21:28 | |
| *** edmondsw has quit IRC | 21:29 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor federation file https://review.openstack.org/407188 | 21:34 |
| *** edmondsw has joined #openstack-keystone | 21:34 | |
| *** gyee has quit IRC | 21:37 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Add unit tests for doctor's database symptoms https://review.openstack.org/407062 | 21:38 |
| *** catintheroof has joined #openstack-keystone | 21:39 | |
| *** edtubill has quit IRC | 21:39 | |
| *** adriant has joined #openstack-keystone | 21:41 | |
| ayoung-afk | keystone-manage db_version lies | 21:46 |
| ayoung-afk | version 66 is not "blank database with not tables in it" | 21:46 |
| *** lamt has joined #openstack-keystone | 21:50 | |
| *** gyee has joined #openstack-keystone | 21:50 | |
| *** diazjf has quit IRC | 22:00 | |
| *** ayoung-afk has quit IRC | 22:00 | |
| *** adrian_otto has joined #openstack-keystone | 22:02 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Print name with duplicate error on user creation https://review.openstack.org/405104 | 22:04 |
| *** jaugustine has quit IRC | 22:08 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/python-keystoneclient: WIP: Do not skip test_acess https://review.openstack.org/407221 | 22:08 |
| *** ravelar has quit IRC | 22:10 | |
| openstackgerrit | Jamie Lennox proposed openstack/keystoneauth: Don't issue deprecation warning when nesting adapters https://review.openstack.org/406647 | 22:14 |
| *** diazjf has joined #openstack-keystone | 22:18 | |
| *** diazjf has quit IRC | 22:21 | |
| *** pnavarro has quit IRC | 22:23 | |
| *** phalmos has quit IRC | 22:25 | |
| *** ravelar has joined #openstack-keystone | 22:29 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:31 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Rename doctor symptom in security_compliance https://review.openstack.org/407206 | 22:33 |
| *** masber has joined #openstack-keystone | 22:37 | |
| *** rcernin has joined #openstack-keystone | 22:40 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 22:45 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update docs to require domain_id when registering Identity Providers https://review.openstack.org/399157 | 22:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update docs to require domain_id when registering Identity Providers https://review.openstack.org/399157 | 22:46 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 22:52 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update docs to require domain_id when registering Identity Providers https://review.openstack.org/399157 | 22:56 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - Require domain_id when registering Identity Providers https://review.openstack.org/399684 | 22:59 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Update docs to require domain_id when registering Identity Providers https://review.openstack.org/399157 | 23:00 |
| *** adrian_otto has quit IRC | 23:03 | |
| *** cbits has quit IRC | 23:03 | |
| jamielennox | stevemar, dolphm, lbragstad, others: i'd like some opinions on how we transition to a service token policy on https://review.openstack.org/#/c/382100/ | 23:10 |
| lbragstad | jamielennox sure thing - i'll add it to the queue | 23:10 |
| jamielennox | a) do we go full on oslo.policy or just say the service token must have these roles as a list | 23:10 |
| jamielennox | b) how do we turn on a sensible default in a backwards compat way | 23:10 |
| *** diazjf has joined #openstack-keystone | 23:14 | |
| *** spzala has joined #openstack-keystone | 23:15 | |
| *** ravelar has quit IRC | 23:19 | |
| *** ayoung-afk has joined #openstack-keystone | 23:19 | |
| *** spzala has quit IRC | 23:20 | |
| *** diazjf has quit IRC | 23:20 | |
| openstackgerrit | Brant Knudson proposed openstack/keystone: Correct minor issues in test schema https://review.openstack.org/407234 | 23:24 |
| *** masber has quit IRC | 23:33 | |
| *** cbits has joined #openstack-keystone | 23:34 | |
| *** cbits has quit IRC | 23:44 | |
| *** lamt has quit IRC | 23:44 | |
| *** spzala has joined #openstack-keystone | 23:47 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!