| *** itisha has quit IRC | 00:02 | |
| *** adrian_otto has quit IRC | 00:04 | |
| *** chris_hultin|AWA is now known as chris_hultin | 00:07 | |
| *** jrist_ has joined #openstack-keystone | 00:09 | |
| *** jrist has quit IRC | 00:10 | |
| *** jose-phillips has quit IRC | 00:14 | |
| *** spzala has quit IRC | 00:15 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:17 | |
| *** adrian_otto has joined #openstack-keystone | 00:23 | |
| *** mriedem has joined #openstack-keystone | 00:25 | |
| mriedem | what ksa exception would i expect on the client side for this? http://logs.openstack.org/65/416765/1/check/gate-tempest-dsvm-neutron-identity-v3-only-full-ubuntu-xenial-nv/faf1363/logs/apache/keystone.txt.gz#_2017-01-04_23_15_06_670 | 00:25 |
|---|---|---|
| mriedem | i guess just https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/exceptions/http.py#L114 ? | 00:27 |
| jamielennox | mriedem: i would guess so | 00:29 |
| jamielennox | the exceptions/http are all thrown based on status code | 00:29 |
| mriedem | AHA | 00:30 |
| mriedem | https://review.openstack.org/#/c/416599/ | 00:30 |
| mriedem | ah damn, sean made the check for that in our upgrade check command but not in n-cpu when talking to the placement api | 00:33 |
| mriedem | easy fix | 00:33 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Cascade delete federated_user fk https://review.openstack.org/415906 | 00:35 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: Fix issues with keystone-dsvm-py35-functional-v3-only on py35 https://review.openstack.org/412500 | 00:35 |
| *** chris_hultin|AWA is now known as chris_hultin | 00:36 | |
| *** chris_hultin is now known as chris_hultin|AWA | 00:37 | |
| *** mriedem has quit IRC | 00:41 | |
| *** stingaci has quit IRC | 00:44 | |
| *** hoangcx has joined #openstack-keystone | 00:47 | |
| *** Marcellin__ has quit IRC | 00:49 | |
| *** jamielennox is now known as jamielennox|away | 01:02 | |
| *** jose-phillips has joined #openstack-keystone | 01:03 | |
| *** diazjf has joined #openstack-keystone | 01:03 | |
| *** esp has quit IRC | 01:09 | |
| *** jose-phillips has quit IRC | 01:12 | |
| *** jamielennox|away is now known as jamielennox | 01:21 | |
| *** browne has quit IRC | 01:28 | |
| *** liujiong has joined #openstack-keystone | 01:28 | |
| *** stingaci has joined #openstack-keystone | 01:44 | |
| *** stingaci has quit IRC | 01:49 | |
| *** adrian_otto has quit IRC | 01:50 | |
| *** dave-mccowan has joined #openstack-keystone | 02:02 | |
| *** guoshan has joined #openstack-keystone | 02:02 | |
| *** stingaci has joined #openstack-keystone | 02:08 | |
| *** guoshan has quit IRC | 02:09 | |
| *** guoshan has joined #openstack-keystone | 02:09 | |
| *** esp has joined #openstack-keystone | 02:14 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone: Fixed 7 tests running twice in v3 identity https://review.openstack.org/416765 | 02:16 |
| gagehugo | lbragstad: ^ lemme know if that seems clearer or not | 02:18 |
| *** dave-mccowan has quit IRC | 02:33 | |
| *** trananhkma has quit IRC | 02:34 | |
| *** phalmos has joined #openstack-keystone | 02:36 | |
| *** phalmos_ has quit IRC | 02:36 | |
| *** esp has quit IRC | 02:39 | |
| *** dave-mccowan has joined #openstack-keystone | 02:55 | |
| *** harlowja has quit IRC | 03:05 | |
| *** tonyb has quit IRC | 03:05 | |
| *** jascott1 has quit IRC | 03:05 | |
| *** rha has quit IRC | 03:05 | |
| *** timss has quit IRC | 03:05 | |
| *** charz has quit IRC | 03:05 | |
| *** mancdaz has quit IRC | 03:05 | |
| *** jose-phillips has joined #openstack-keystone | 03:05 | |
| *** tonyb has joined #openstack-keystone | 03:05 | |
| *** mancdaz_ has joined #openstack-keystone | 03:05 | |
| *** timss has joined #openstack-keystone | 03:05 | |
| *** rha has joined #openstack-keystone | 03:06 | |
| *** rha has quit IRC | 03:06 | |
| *** rha has joined #openstack-keystone | 03:06 | |
| *** mancdaz_ is now known as mancdaz | 03:06 | |
| *** charz has joined #openstack-keystone | 03:06 | |
| *** jose-phillips has quit IRC | 03:06 | |
| *** jose-phillips has joined #openstack-keystone | 03:07 | |
| *** jose-phillips has quit IRC | 03:09 | |
| *** udesale has joined #openstack-keystone | 03:31 | |
| *** links has joined #openstack-keystone | 03:40 | |
| *** esp has joined #openstack-keystone | 03:44 | |
| openstackgerrit | Merged openstack/keystone: Correct timestamp format in token responses https://review.openstack.org/416372 | 03:50 |
| *** dave-mccowan has quit IRC | 03:54 | |
| *** guoshan has quit IRC | 03:57 | |
| *** esp has quit IRC | 04:19 | |
| *** dave-mccowan has joined #openstack-keystone | 04:23 | |
| *** nicolasbock has joined #openstack-keystone | 04:36 | |
| *** jose-phillips has joined #openstack-keystone | 04:55 | |
| openstackgerrit | Steve Martinelli proposed openstack/python-keystoneclient: use public interfaces of pep8 for hacking https://review.openstack.org/416829 | 04:55 |
| *** guoshan has joined #openstack-keystone | 04:57 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: use public interfaces of pep8 for hacking https://review.openstack.org/416830 | 04:58 |
| *** guoshan has quit IRC | 05:02 | |
| *** diazjf has joined #openstack-keystone | 05:03 | |
| *** jose-phillips has quit IRC | 05:22 | |
| *** jamielennox is now known as jamielennox|away | 05:23 | |
| *** jamielennox|away is now known as jamielennox | 05:30 | |
| *** guoshan has joined #openstack-keystone | 05:38 | |
| *** guoshan has quit IRC | 05:43 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: listing revoke events should be admin only https://review.openstack.org/416841 | 05:43 |
| *** guoshan has joined #openstack-keystone | 05:43 | |
| stevemar | lbragstad: poke for https://review.openstack.org/#/c/413869/ | 05:47 |
| *** guoshan has quit IRC | 05:55 | |
| *** guoshan has joined #openstack-keystone | 06:06 | |
| *** guoshan has quit IRC | 06:19 | |
| *** guoshan has joined #openstack-keystone | 06:35 | |
| *** richm has quit IRC | 06:42 | |
| *** hoangcx_ has joined #openstack-keystone | 06:54 | |
| *** hoangcx has quit IRC | 06:56 | |
| *** pcaruana has joined #openstack-keystone | 07:05 | |
| *** tesseract has joined #openstack-keystone | 07:09 | |
| *** rcernin has joined #openstack-keystone | 07:17 | |
| openstackgerrit | Shan Guo proposed openstack/keystone: Not retry on deadlock Transactions in backend https://review.openstack.org/416872 | 07:23 |
| *** guoshan has quit IRC | 07:26 | |
| *** guoshan has joined #openstack-keystone | 07:27 | |
| *** stingaci has quit IRC | 07:37 | |
| *** openstackgerrit has quit IRC | 07:50 | |
| *** hoangcx has joined #openstack-keystone | 07:53 | |
| *** zhugaoxiao has quit IRC | 07:54 | |
| *** abhishekk has joined #openstack-keystone | 07:54 | |
| *** zhugaoxiao has joined #openstack-keystone | 07:54 | |
| *** hoangcx_ has quit IRC | 07:56 | |
| *** stingaci has joined #openstack-keystone | 08:08 | |
| *** stingaci has quit IRC | 08:12 | |
| *** rha has quit IRC | 08:34 | |
| *** rha has joined #openstack-keystone | 08:43 | |
| *** rha has quit IRC | 08:43 | |
| *** rha has joined #openstack-keystone | 08:43 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** openstackgerrit has joined #openstack-keystone | 09:00 | |
| openstackgerrit | Shan Guo proposed openstack/keystone: Not retry on deadlock Transactions in backend https://review.openstack.org/416872 | 09:00 |
| *** zzzeek has joined #openstack-keystone | 09:03 | |
| *** asettle_ has joined #openstack-keystone | 09:08 | |
| openstackgerrit | melissaml proposed openstack/keystone-specs: Removes unnecessary utf-8 encoding https://review.openstack.org/416897 | 09:08 |
| *** openstackgerrit has quit IRC | 09:33 | |
| *** nicolasbock has quit IRC | 09:45 | |
| *** dikonoor has joined #openstack-keystone | 09:47 | |
| *** nicolasbock has joined #openstack-keystone | 09:52 | |
| *** mvk has quit IRC | 09:53 | |
| *** hoangcx has quit IRC | 09:57 | |
| *** nishaYadav has joined #openstack-keystone | 10:01 | |
| *** dikonoor has quit IRC | 10:02 | |
| *** sheel has joined #openstack-keystone | 10:03 | |
| *** nicolasbock has quit IRC | 10:10 | |
| *** nicolasbock has joined #openstack-keystone | 10:12 | |
| *** openstackstatus has quit IRC | 10:13 | |
| *** openstack has joined #openstack-keystone | 10:14 | |
| *** openstackstatus has joined #openstack-keystone | 10:15 | |
| *** ChanServ sets mode: +v openstackstatus | 10:15 | |
| *** delaf has joined #openstack-keystone | 10:16 | |
| delaf | hello ! | 10:16 |
| delaf | I try to understand how keystone logging works | 10:16 |
| delaf | I have an haproxy in front of keystone that adds a X-Unique-ID header, and i'm looking how I can tell keystone to log this header. It is possible ? | 10:18 |
| *** mvk has joined #openstack-keystone | 10:25 | |
| *** dikonoor has joined #openstack-keystone | 10:28 | |
| *** udesale has quit IRC | 10:28 | |
| *** udesale has joined #openstack-keystone | 10:36 | |
| *** guoshan has quit IRC | 10:41 | |
| *** liujiong has quit IRC | 10:47 | |
| *** dikonoor has quit IRC | 11:08 | |
| *** stingaci has joined #openstack-keystone | 11:09 | |
| *** udesale has quit IRC | 11:12 | |
| *** richm has joined #openstack-keystone | 11:13 | |
| *** stingaci has quit IRC | 11:15 | |
| *** dikonoor has joined #openstack-keystone | 11:16 | |
| *** asettle_ has quit IRC | 11:22 | |
| *** asettle_ has joined #openstack-keystone | 11:23 | |
| *** asettle_ is now known as asettle | 11:25 | |
| *** guoshan has joined #openstack-keystone | 11:42 | |
| *** timss has quit IRC | 11:44 | |
| *** timss has joined #openstack-keystone | 11:44 | |
| *** guoshan has quit IRC | 11:47 | |
| *** jgrassle1 has quit IRC | 11:55 | |
| *** tlbr_ has quit IRC | 11:55 | |
| *** rdo has quit IRC | 11:55 | |
| *** mtreinish has quit IRC | 11:55 | |
| *** sileht has quit IRC | 11:55 | |
| *** g2 has quit IRC | 11:55 | |
| *** afazekas has quit IRC | 11:55 | |
| *** Tridde has quit IRC | 11:55 | |
| *** htruta has quit IRC | 11:55 | |
| *** topol has quit IRC | 11:55 | |
| *** rvba has quit IRC | 11:55 | |
| *** rarora has quit IRC | 11:55 | |
| *** zeus has quit IRC | 11:55 | |
| *** gsilvis has quit IRC | 11:55 | |
| *** Anticimex has quit IRC | 11:55 | |
| *** jgrassler has joined #openstack-keystone | 11:55 | |
| *** htruta has joined #openstack-keystone | 11:55 | |
| *** zeus- has joined #openstack-keystone | 11:55 | |
| *** afazekas has joined #openstack-keystone | 11:55 | |
| *** rdo has joined #openstack-keystone | 11:55 | |
| *** rvba has joined #openstack-keystone | 11:55 | |
| *** topol_ has joined #openstack-keystone | 11:55 | |
| *** gsilvis has joined #openstack-keystone | 11:55 | |
| *** Trident has joined #openstack-keystone | 11:55 | |
| *** zeus- is now known as zeus | 11:56 | |
| *** mtreinish has joined #openstack-keystone | 11:56 | |
| *** rvba has quit IRC | 11:56 | |
| *** rvba has joined #openstack-keystone | 11:56 | |
| *** zeus is now known as Guest74290 | 11:56 | |
| *** BrAsS_mOnKeY has joined #openstack-keystone | 11:56 | |
| *** sileht has joined #openstack-keystone | 11:57 | |
| *** tlbr has joined #openstack-keystone | 11:57 | |
| *** serverascode has quit IRC | 11:59 | |
| *** serverascode has joined #openstack-keystone | 12:01 | |
| *** rarora has joined #openstack-keystone | 12:11 | |
| *** links has quit IRC | 12:13 | |
| *** voelzmo has joined #openstack-keystone | 12:16 | |
| *** nishaYadav has quit IRC | 12:18 | |
| *** links has joined #openstack-keystone | 12:25 | |
| samueldmq | morning keystone | 12:34 |
| *** catintheroof has quit IRC | 12:38 | |
| *** catintheroof has joined #openstack-keystone | 12:44 | |
| *** links has quit IRC | 12:55 | |
| *** catintheroof has quit IRC | 12:57 | |
| *** catintheroof has joined #openstack-keystone | 12:58 | |
| *** catintheroof has quit IRC | 13:02 | |
| *** catintheroof has joined #openstack-keystone | 13:04 | |
| *** edmondsw has joined #openstack-keystone | 13:05 | |
| *** links has joined #openstack-keystone | 13:07 | |
| *** voelzmo has quit IRC | 13:09 | |
| *** catintheroof has quit IRC | 13:11 | |
| *** openstackgerrit has joined #openstack-keystone | 13:18 | |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Prevent MemoryError when logging response bodies https://review.openstack.org/359292 | 13:18 |
| openstackgerrit | Samuel de Medeiros Queiroz proposed openstack/python-keystoneclient: Prevent MemoryError when logging response bodies https://review.openstack.org/359292 | 13:19 |
| samueldmq | jamielennox: stevemar ^ backport to ksc | 13:20 |
| samueldmq | jamielennox: stevemar: notice I've added the releasenote too, including with same file name. I am not sure that's the right process | 13:20 |
| stevemar | samueldmq: lgtm | 13:21 |
| samueldmq | stevemar: thanks | 13:22 |
| stevemar | looks like the keystone gate is broken | 13:25 |
| stevemar | our functional jobs are nuked | 13:25 |
| *** Anticimex has joined #openstack-keystone | 13:25 | |
| samueldmq | stevemar: gate-keystone-dsvm-functional-ubuntu-xenial ? | 13:26 |
| samueldmq | stevemar: do you have an example build failure ? | 13:26 |
| *** udesale has joined #openstack-keystone | 13:31 | |
| stevemar | samueldmq: just check the latest results https://review.openstack.org/#/q/project:openstack/keystone | 13:31 |
| stevemar | https://review.openstack.org/#/c/416872/ | 13:31 |
| stevemar | https://review.openstack.org/#/c/257636/ | 13:31 |
| stevemar | https://review.openstack.org/#/c/416841/ | 13:32 |
| stevemar | gate-keystone-dsvm-functional-ubuntu-xenialFAILURE in 18m 40s | 13:32 |
| stevemar | gate-keystone-dsvm-functional-v3-only-ubuntu-xenial-nvFAILURE in 20m 48s (non-voting) | 13:32 |
| stevemar | gate-keystone-dsvm-py35-functional-v3-only-ubuntu-xenial-nvFAILURE in 18m 32s (non-voting) | 13:32 |
| stevemar | i'm guessing the ones we +2'ed or +W'ed recently will bounce back once they are in the gate | 13:32 |
| samueldmq | stevemar: yeah, all of them fail trying to call either identity:create_identity_provider identity:create_service_provider | 13:33 |
| samueldmq | and identity:create_mapping | 13:33 |
| stevemar | yep | 13:33 |
| stevemar | back in an hour or two, kid is sick | 13:34 |
| *** d0ugal has quit IRC | 13:34 | |
| samueldmq | stevemar: kk I will look at it, take care | 13:35 |
| *** d0ugal has joined #openstack-keystone | 13:35 | |
| samueldmq | rodrigods: hi, you around ? | 13:44 |
| rodrigods | samueldmq, yep | 13:45 |
| samueldmq | rodrigods: perhaps "Federated authentication via ECP functional tests" has broken the functional tests gate | 13:45 |
| rodrigods | samueldmq, yeah... we kind know that | 13:45 |
| samueldmq | rodrigods: do you have any clue on why it's failing ? | 13:46 |
| rodrigods | this bug: https://review.openstack.org/#/c/415906/ | 13:46 |
| samueldmq | I observed that calling identity:create_identity_provider identity:create_service_provider, identity:create_identity_provider and identity:create_mapping | 13:46 |
| samueldmq | are returning 401 | 13:46 |
| samueldmq | rodrigods: kk, will look | 13:46 |
| *** catintheroof has joined #openstack-keystone | 13:47 | |
| rodrigods | samueldmq, this 401 error is new to me | 13:48 |
| samueldmq | rodrigods: yeah, it's a 403 actually | 13:49 |
| samueldmq | see https://review.openstack.org/#/c/416872/ as an example | 13:49 |
| *** itisha has joined #openstack-keystone | 13:51 | |
| rodrigods | samueldmq, the federated authentication via ecp patch doesn't run in the gate-keystone-dsvm-functional-ubuntu-xenial job | 13:51 |
| rodrigods | it only runs in the v3-only | 13:51 |
| rodrigods | so it is unrelated... let me check the logs there | 13:51 |
| rodrigods | samueldmq, was there a change to the policy files or something? | 13:52 |
| samueldmq | rodrigods: kk, it was the last change in those files (idp, sp and mapping test), that's why I was supposing to be it | 13:52 |
| samueldmq | rodrigods: looking at that right now, there was something related to cloud admin getting is_admin_project | 13:53 |
| samueldmq | rodrigods: https://github.com/openstack/keystone/commit/ef48072d94f780ebaacee8c3ddf02a68193fa74d | 13:54 |
| rodrigods | hmm | 13:54 |
| samueldmq | but that only changed cloudsample, is that used for those tests? | 13:54 |
| rodrigods | 21 days ago | 13:54 |
| samueldmq | and if so, do the tests use a not project-scoped token ? | 13:55 |
| rodrigods | maybe it is something else | 13:55 |
| dstanek | oh, fun | 13:55 |
| samueldmq | dstanek: o/ | 13:55 |
| rodrigods | let me spin up a devstack here | 13:56 |
| samueldmq | rodrigods: ++ trying to reproduce locally is a good first step | 13:57 |
| rodrigods | samueldmq, i'd say it is related to the latest change | 13:58 |
| rodrigods | this is a brand new issue | 13:58 |
| dstanek | the failing tests were not using the cloud policy | 13:58 |
| samueldmq | rodrigods: I think so too, however it's odd the policy neither the tests weren't touched in the last days | 13:58 |
| samueldmq | dstanek: cool | 13:59 |
| dstanek | http://logs.openstack.org/72/416872/2/check/gate-keystone-dsvm-functional-ubuntu-xenial/436da7e/logs/etc/keystone/policy.json.txt.gz | 13:59 |
| *** nishaYadav has joined #openstack-keystone | 13:59 | |
| nishaYadav | hey all! | 13:59 |
| samueldmq | it could be a change in the token used for performing the tests | 13:59 |
| samueldmq | in a such way the token does not meet admin_required anymore | 14:00 |
| rodrigods | samueldmq, yeah... that remembers me of an issue in keystoneclient tests triggered by a bug fix in keystone | 14:00 |
| samueldmq | nishaYadav: hi | 14:00 |
| nishaYadav | hi samueldmq ,rodrigods :) | 14:01 |
| rodrigods | hey nishaYadav :) | 14:01 |
| *** links has quit IRC | 14:02 | |
| dstanek | this seems sorta strange http://logs.openstack.org/72/416872/2/check/gate-keystone-dsvm-functional-ubuntu-xenial/436da7e/logs/apache/keystone.txt.gz?level=WARNING#_2017-01-05_09_10_48_785 | 14:04 |
| dstanek | is that normal? | 14:04 |
| samueldmq | looking | 14:04 |
| lbragstad | dstanek I've never seen that before | 14:04 |
| rodrigods | me neither | 14:04 |
| samueldmq | same here, seems odd | 14:05 |
| samueldmq | Could not find project: service | 14:05 |
| samueldmq | Could not find user: glance-swift | 14:05 |
| samueldmq | lots of could not find things | 14:05 |
| lbragstad | I wonder if that is a part of setup/tear down | 14:05 |
| samueldmq | perhaps it could be an issue in devstack too ? | 14:06 |
| rodrigods | samueldmq, ++ | 14:06 |
| rodrigods | dstanek, http://logs.openstack.org/06/415906/10/check/gate-tempest-dsvm-neutron-full-ubuntu-xenial/b6b5842/logs/apache/keystone.txt.gz?level=WARNING | 14:08 |
| rodrigods | dstanek, this is in the tempest job that works fine | 14:08 |
| *** spzala has joined #openstack-keystone | 14:09 | |
| rodrigods | samueldmq, dstanek, lbragstad there is some work from rderose which is changing the way we create idps, right? | 14:09 |
| rodrigods | requiring a domain_id? | 14:09 |
| dstanek | rodrigods: yeah, i saw that | 14:10 |
| dstanek | rodrigods: yes, he's working on that | 14:10 |
| dstanek | when did things start to fail? | 14:11 |
| samueldmq | https://review.openstack.org/#/c/399684/ | 14:11 |
| samueldmq | dstanek: I think yesterday, steve just noticed it this morning | 14:11 |
| rodrigods | not merged yet so not related :( | 14:11 |
| rodrigods | i'm creating a devstack here | 14:12 |
| rodrigods | will try to create an idp manually | 14:12 |
| rodrigods | using the admin credentials | 14:12 |
| lbragstad | hmm | 14:13 |
| lbragstad | yeah - rderose has a patch to require a domain id when creating an idp | 14:14 |
| dstanek | what about the timestamp thing that just merged? | 14:14 |
| lbragstad | dstanek ? | 14:15 |
| dstanek | 10 hours ago - http://git.openstack.org/cgit/openstack/keystone/commit/?id=b024931681a0c97768186f540355099e9e3226f6 | 14:16 |
| lbragstad | dstanek oh - that was just fixing docs, right? | 14:16 |
| dstanek | no, idea. i'm just throwing things out there. nothing else merged in keystone directly | 14:17 |
| samueldmq | yeah, that was just docs | 14:17 |
| *** Guest74290 is now known as zeus` | 14:18 | |
| rodrigods | http://logs.openstack.org/06/415906/10/check/gate-keystone-dsvm-functional-ubuntu-xenial/975ddf0/logs/apache/keystone.txt.gz?level=DEBUG#_2017-01-05_12_58_20_897 | 14:18 |
| rodrigods | is that normal? | 14:18 |
| *** zeus` is now known as zeus | 14:18 | |
| *** zeus has quit IRC | 14:18 | |
| *** zeus has joined #openstack-keystone | 14:18 | |
| rodrigods | "proceeding without project or domain scope" | 14:18 |
| lbragstad | hmm - that's weird | 14:19 |
| lbragstad | all of this is in the new functional testing stuff | 14:19 |
| samueldmq | perhaps we could query logstash to see when that failure started appearing | 14:19 |
| samueldmq | ? | 14:19 |
| samueldmq | rodrigods: is that a failure ? | 14:20 |
| rodrigods | samueldmq, looks strange getting a token without scope? | 14:21 |
| rodrigods | not sure if it is the case, but i would expect things to fail with a 403 because of that | 14:21 |
| samueldmq | for the tests, yes, it is strange | 14:21 |
| dstanek | rodrigods: unscoped token? | 14:21 |
| rodrigods | let me see if it happens in other cases | 14:21 |
| rodrigods | dstanek, the log message above, is it really getting a token without scope? | 14:22 |
| samueldmq | yeah, looks like admin_required would not be met in the case of an unscoped token | 14:22 |
| *** voelzmo has joined #openstack-keystone | 14:22 | |
| dstanek | where does that message come from? | 14:22 |
| rodrigods | dstanek, the logs from the failing test | 14:23 |
| *** voelzmo has quit IRC | 14:23 | |
| rodrigods | http://logs.openstack.org/22/404022/11/check/gate-keystone-dsvm-functional-ubuntu-xenial/9814400/logs/apache/keystone.txt.gz?level=DEBUG#_2017-01-04_22_59_06_556 | 14:24 |
| samueldmq | dstanek: https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L81 | 14:24 |
| rodrigods | this is a log from a test that doesn't fails | 14:24 |
| rodrigods | looks like it is the issue | 14:24 |
| rodrigods | since that "without scope" message doesn't appear here | 14:24 |
| samueldmq | rodrigods: can that ecp/federation tests have changed the tokens to unscoped or something like that ? | 14:25 |
| samueldmq | rodrigods: so it could be affecting these other tests ? | 14:25 |
| *** voelzmo has joined #openstack-keystone | 14:25 | |
| *** BrAsS_mOnKeY is now known as g2 | 14:25 | |
| rodrigods | samueldmq, don't think so | 14:26 |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/keystone: Fix issues with keystone-dsvm-py35-functional-v3-only on py35 https://review.openstack.org/412500 | 14:27 |
| rodrigods | samueldmq, think we can find in the logs the body of the POST http://198.72.124.160/identity/v3/auth/tokens request | 14:33 |
| samueldmq | rodrigods: I don't think we log token request bodies | 14:35 |
| rodrigods | samueldmq, tempest does | 14:35 |
| rodrigods | at least, locally, when a test fails, it prints all the requests made by its token client | 14:36 |
| rodrigods | samueldmq, http://logs.openstack.org/06/415906/10/check/gate-keystone-dsvm-functional-ubuntu-xenial/975ddf0/console.html#_2017-01-05_12_58_21_234262 you are right :( | 14:36 |
| samueldmq | rodrigods: there is a post /tokens jsut above http://logs.openstack.org/06/415906/10/check/gate-keystone-dsvm-functional-ubuntu-xenial/975ddf0/logs/apache/keystone.txt.gz?level=DEBUG#_2017-01-05_12_58_20_897 | 14:37 |
| samueldmq | rodrigods: but it also says RBAC: Proceeding without project or domain scope token_to_auth_context | 14:37 |
| samueldmq | rodrigods: you may patch tempest lib and add a Depends-On in the keystone patch | 14:38 |
| samueldmq | so you'll be able to see the token request body | 14:38 |
| rodrigods | hmm good idea | 14:38 |
| samueldmq | cool | 14:39 |
| samueldmq | gotta run now, will be back after lunch | 14:39 |
| rodrigods | ok | 14:39 |
| rodrigods | will submit that and see what happens | 14:39 |
| *** lamt has joined #openstack-keystone | 14:43 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: DO NOT MERGE: Test patch https://review.openstack.org/416993 | 14:46 |
| rodrigods | samueldmq, lbragstad, dstanek ^ | 14:46 |
| *** nishaYadav has quit IRC | 14:48 | |
| *** adrian_otto has joined #openstack-keystone | 14:50 | |
| dims | something broke? http://logs.openstack.org/65/416765/2/gate/gate-keystone-dsvm-functional-ubuntu-xenial/67a98bb/logs/testr_results.html.gz | 14:54 |
| dims | (not my review) | 14:54 |
| dims | samueldmq : rodrigods : same thing you were looking at? ^ | 14:55 |
| *** dikonoor has quit IRC | 14:56 | |
| rodrigods | dims, yes | 14:56 |
| lbragstad | http://logstash.openstack.org/#dashboard/file/logstash.json?query=message%3A%5C%22You%20are%20not%20authorized%20to%20perform%20the%20requested%20action%3A%20identity%3Acreate_mapping%5C%22 | 14:57 |
| lbragstad | all the results i'm seeing in ^ show it is affecting functional tests | 14:59 |
| dims | lbragstad : started breaking 2 hours ago? | 15:01 |
| dims | first timestamp seems to be 2017-01-05T07:58:21.244-05:00 | 15:01 |
| lbragstad | dims my query skills are a bit rusty - but that's what I came up with | 15:02 |
| rodrigods | fails locally too | 15:02 |
| rodrigods | running locally what i just submitted to gerrit | 15:03 |
| stevemar | samueldmq: rodrigods: what are the results? :) | 15:03 |
| lbragstad | seeing a *lot* of 403 for gate-keystone-dsvm-functional-ubuntu-xenial and gate-keystone-dsvm-functional-v3-only-ubuntu-xenial-nv | 15:04 |
| samueldmq | lbragstad: nice, If it starret failing 2 hours ago it should no be too hard to find a commit causing that | 15:04 |
| rodrigods | stevemar, looks like our functional tests are receiving an unscoped token | 15:04 |
| samueldmq | stevemar: yeah which causes the 403 | 15:04 |
| rodrigods | Body: {"auth": {"identity": {"methods": ["password"], "password": {"user": {"domain": {"id": "default"}, "id": "d7b1a0b0905a42bfab7e8d791bf8d4f9", "password": "secret"}}}}} | 15:04 |
| rodrigods | this is an unscoped request, right? | 15:05 |
| rodrigods | so the problem is in the caller | 15:05 |
| samueldmq | rodrigods: yeah. Could be in devstack? | 15:05 |
| *** chlong has joined #openstack-keystone | 15:05 | |
| rodrigods | or in project_config | 15:05 |
| samueldmq | Or Just the Way we are creating the token for the tests | 15:06 |
| samueldmq | But I guess se haven't changed that recently | 15:06 |
| samueldmq | Brb | 15:06 |
| *** udesale has quit IRC | 15:07 | |
| *** edtubill has joined #openstack-keystone | 15:10 | |
| rodrigods | samueldmq, stevemar, dstanek, lbragstad, dims found it!!!! | 15:14 |
| rodrigods | https://github.com/openstack/tempest/commit/5ac57dad9abbff792105eb675577cde890dc769c | 15:14 |
| rodrigods | reverting this commit locally fixes our tests | 15:14 |
| *** d34dh0r53 has quit IRC | 15:14 | |
| *** d34dh0r53 has joined #openstack-keystone | 15:14 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:14 | |
| dstanek | rodrigods: wow, really? | 15:15 |
| dims | crazy | 15:15 |
| *** lamt has quit IRC | 15:15 | |
| rodrigods | dstanek, yeah... our client in the tests uses this "service" argument | 15:15 |
| rodrigods | maybe they changed how the clients are constructed | 15:16 |
| dims | rodrigods : proposed a revert yet? :) | 15:16 |
| *** lamt has joined #openstack-keystone | 15:16 | |
| rodrigods | dims, not yet... trying to figure out if it is something we can fix in our side | 15:16 |
| *** spzala has quit IRC | 15:19 | |
| *** phalmos has quit IRC | 15:20 | |
| stevemar | rodrigods: dims proposed the revert: https://review.openstack.org/#/c/417009/ :P | 15:22 |
| samueldmq | Should we adopt the New Way? | 15:22 |
| *** voelzmo has quit IRC | 15:23 | |
| samueldmq | But anyways, that was backwards incompatible | 15:23 |
| *** voelzmo has joined #openstack-keystone | 15:23 | |
| rodrigods | samueldmq, think we should update our tests | 15:23 |
| rodrigods | it is not safe to use anything that is not in tempest.lib | 15:23 |
| rodrigods | will ask around to check what we can do to fix that in our side | 15:24 |
| *** ravelar has joined #openstack-keystone | 15:24 | |
| rodrigods | stevemar, thanks for the revert | 15:24 |
| samueldmq | Yeah lets see | 15:25 |
| samueldmq | However that commit says the was unused but we use it | 15:26 |
| samueldmq | So reverter is fair imo | 15:26 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: listing revoke events should be admin only https://review.openstack.org/416841 | 15:27 |
| stevemar | samueldmq: i made ^ depend on the revert, lets see what happens | 15:28 |
| *** jaugustine has joined #openstack-keystone | 15:28 | |
| samueldmq | stevemar ++ | 15:28 |
| samueldmq | dims nice find btw :) | 15:29 |
| dims | not me ... was rodrigods :) | 15:29 |
| samueldmq | Nice find you both :) | 15:30 |
| *** nishaYadav has joined #openstack-keystone | 15:32 | |
| *** catintheroof has quit IRC | 15:32 | |
| stevemar | let's still get keystone fixed | 15:37 |
| stevemar | sounds like the QA team will revert | 15:38 |
| *** agrebennikov has joined #openstack-keystone | 15:38 | |
| *** d0ugal has quit IRC | 15:38 | |
| *** d0ugal has joined #openstack-keystone | 15:41 | |
| *** guoshan has joined #openstack-keystone | 15:46 | |
| *** mvk has quit IRC | 15:47 | |
| *** guoshan has quit IRC | 15:50 | |
| *** spzala has joined #openstack-keystone | 15:52 | |
| *** spzala has quit IRC | 15:53 | |
| *** spzala has joined #openstack-keystone | 15:53 | |
| *** rcernin has quit IRC | 16:07 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Fix the usage of tempest.client.Manager class https://review.openstack.org/417030 | 16:07 |
| *** voelzmo has quit IRC | 16:08 | |
| *** voelzmo has joined #openstack-keystone | 16:08 | |
| rodrigods | stevemar, samueldmq, lbragstad, dstanek ^ | 16:08 |
| *** voelzmo has quit IRC | 16:08 | |
| *** voelzmo has joined #openstack-keystone | 16:09 | |
| *** voelzmo has quit IRC | 16:14 | |
| *** esp has joined #openstack-keystone | 16:15 | |
| *** tesseract has quit IRC | 16:21 | |
| *** adrian_otto has quit IRC | 16:22 | |
| *** catintheroof has joined #openstack-keystone | 16:32 | |
| *** diazjf has joined #openstack-keystone | 16:37 | |
| rodrigods | stevemar, http://logs.openstack.org/30/417030/1/check/gate-keystone-dsvm-functional-ubuntu-xenial/4cd3e4b/console.html ^ fixed the issue | 16:46 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP add query for unique_id in list_users https://review.openstack.org/414720 | 16:46 |
| *** browne has joined #openstack-keystone | 16:55 | |
| *** pcaruana has quit IRC | 16:58 | |
| *** hyakuhei has quit IRC | 16:59 | |
| *** hyakuhei has joined #openstack-keystone | 16:59 | |
| *** hyakuhei has quit IRC | 16:59 | |
| *** hyakuhei has joined #openstack-keystone | 16:59 | |
| *** spzala has quit IRC | 17:02 | |
| *** spzala has joined #openstack-keystone | 17:02 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: WIP: listing revoke events should be admin only https://review.openstack.org/416841 | 17:04 |
| *** spzala_ has joined #openstack-keystone | 17:04 | |
| *** spzala has quit IRC | 17:07 | |
| *** spzala_ has quit IRC | 17:08 | |
| *** jose-phillips has joined #openstack-keystone | 17:20 | |
| *** nishaYadav has quit IRC | 17:23 | |
| *** phalmos has joined #openstack-keystone | 17:24 | |
| *** diazjf has quit IRC | 17:24 | |
| *** adrian_otto has joined #openstack-keystone | 17:34 | |
| *** jose-phillips has quit IRC | 17:42 | |
| *** guoshan has joined #openstack-keystone | 17:47 | |
| *** guoshan has quit IRC | 17:52 | |
| *** jose-phillips has joined #openstack-keystone | 17:56 | |
| *** nishaYadav has joined #openstack-keystone | 17:59 | |
| *** nishaYadav is now known as Guest72214 | 18:00 | |
| *** spzala has joined #openstack-keystone | 18:04 | |
| *** browne has quit IRC | 18:10 | |
| *** Guest72214 has quit IRC | 18:17 | |
| *** stingaci has joined #openstack-keystone | 18:18 | |
| *** LiberalCarrot has joined #openstack-keystone | 18:19 | |
| *** LiberalCarrot has left #openstack-keystone | 18:19 | |
| *** nicolasbock has quit IRC | 18:37 | |
| openstackgerrit | Merged openstack/keystone-specs: Removes unnecessary utf-8 encoding https://review.openstack.org/416897 | 18:40 |
| *** mvk has joined #openstack-keystone | 18:45 | |
| *** browne has joined #openstack-keystone | 18:48 | |
| *** diazjf has joined #openstack-keystone | 18:49 | |
| *** asettle has quit IRC | 18:49 | |
| stevemar | dstanek: around? | 18:58 |
| stevemar | dstanek: can you take a look at https://review.openstack.org/#/c/416830/1/keystone/tests/unit/test_hacking_checks.py | 18:59 |
| samueldmq | jamielennox: hey, about that return-request-id-to-caller patches | 19:10 |
| samueldmq | jamielennox: does the property need to be "request_ids" (plural) ? I do not think that's the case for keystone calls | 19:10 |
| samueldmq | jamielennox: perhaps that'd be the case where there is service2service communication | 19:10 |
| samueldmq | I want to review that and potentially getting some help on approving it | 19:11 |
| samueldmq | it's been up for review for a long time at this point | 19:11 |
| *** rcernin has joined #openstack-keystone | 19:11 | |
| *** harlowja has joined #openstack-keystone | 19:16 | |
| *** voelzmo has joined #openstack-keystone | 19:21 | |
| *** stewie925 has joined #openstack-keystone | 19:41 | |
| stewie925 | hello all - keystone is deprecated in the latest version of devstack, is that right? | 19:42 |
| stewie925 | was trying to do "keystone --version" and it returned nothing | 19:42 |
| stevemar | stewie925: yep, for keystone CLI use 'python-openstackclient' | 19:46 |
| lamt | stewie925: if you want to use the cli client, you should be using the openstack client (osc). Try `openstack --version` | 19:46 |
| stewie925 | thanks so much! | 19:47 |
| *** markvoelker has quit IRC | 19:59 | |
| *** markvoelker has joined #openstack-keystone | 19:59 | |
| *** sirushti has quit IRC | 20:02 | |
| *** chlong has quit IRC | 20:03 | |
| stevemar | just a reminder, we are starting the keystone-horizon meeting now | 20:05 |
| gagehugo | stevemar: thanks | 20:06 |
| *** diazjf has quit IRC | 20:06 | |
| *** sirushti has joined #openstack-keystone | 20:08 | |
| *** adrian_otto has quit IRC | 20:11 | |
| *** jaugustine has quit IRC | 20:12 | |
| *** voelzmo has quit IRC | 20:13 | |
| *** voelzmo has joined #openstack-keystone | 20:18 | |
| *** adriant has joined #openstack-keystone | 20:33 | |
| *** catintheroof has quit IRC | 20:45 | |
| *** guoshan has joined #openstack-keystone | 20:49 | |
| *** guoshan has quit IRC | 20:54 | |
| *** diazjf has joined #openstack-keystone | 20:58 | |
| *** voelzmo has quit IRC | 21:02 | |
| edtubill | stevemar: Hey, so I've been having trouble with my federation environments (including saml) when I log in using horizon. | 21:06 |
| edtubill | stevemar: I see "Unable to retrieve usage information." when I go to the overview page. | 21:07 |
| *** voelzmo has joined #openstack-keystone | 21:07 | |
| edtubill | stevemar: and on the keystone log I see: "User ... has no access to project ..." | 21:07 |
| edtubill | anyone have any ideas? | 21:08 |
| *** ravelar has quit IRC | 21:19 | |
| *** ravelar has joined #openstack-keystone | 21:20 | |
| adriant | stevemar: you about? | 21:23 |
| adriant | also, morgan, you about? | 21:23 |
| morgan | hey. | 21:24 |
| adriant | morgan: do we still want to/have time for MFA changes? | 21:24 |
| morgan | yeah. I will have a lot more time after todau | 21:25 |
| morgan | done moving out of my old place. | 21:25 |
| adriant | oh fantastic! Moving is always a pain. | 21:25 |
| adriant | morgan: well I'll be about and mostly free to work on this next week | 21:28 |
| adriant | I have a new service deployment to oversee, but the dev side there is finally all done. | 21:28 |
| morgan | nice! gratz :) | 21:29 |
| *** voelzmo has quit IRC | 21:29 | |
| adriant | morgan: thanks! I'm *this* close to fully automating a large chunk of our signup and client on-boarding process. | 21:29 |
| morgan | woot | 21:30 |
| morgan | that always feels good. | 21:30 |
| adriant | yeah, and then after this feature I'll have time for some refactors, and hoping to move this project to openstack gerrit so it becomes more of a community thing. | 21:30 |
| adriant | Plus, as terrifying as it is, I have a working prototype for single domain HMT... | 21:31 |
| *** jaugustine has joined #openstack-keystone | 21:42 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement shadow mapping https://review.openstack.org/415895 | 21:45 |
| *** dave-mccowan has quit IRC | 21:47 | |
| lbragstad | dstanek i addressed your comments ^ but curious if you had any thoughts on the comment i had here - https://review.openstack.org/#/c/415895/1/keystone/federation/utils.py | 21:47 |
| *** guoshan has joined #openstack-keystone | 21:50 | |
| *** guoshan has quit IRC | 21:55 | |
| openstackgerrit | Merged openstack/keystone: Fix the usage of tempest.client.Manager class https://review.openstack.org/417030 | 21:56 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fix issues with keystone-dsvm-py35-functional-v3-only on py35 https://review.openstack.org/412500 | 21:59 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Fixed 7 tests running twice in v3 identity https://review.openstack.org/416765 | 22:00 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Correct invalid rst in api docs https://review.openstack.org/416711 | 22:00 |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Use assertGreater(len(x), y) instead of assertTrue(len(x) > y) https://review.openstack.org/412083 | 22:00 |
| *** chris_hultin is now known as chris_hultin|AWA | 22:04 | |
| stevemar | adriant: morgan i'm willing to consider letting MFA into keystone during the RC period, it's pretty isolated | 22:07 |
| *** darrenc is now known as darrenc_afk | 22:07 | |
| *** edtubill has quit IRC | 22:22 | |
| *** darrenc_afk is now known as darrenc | 22:25 | |
| openstackgerrit | Merged openstack/python-keystoneclient: Prevent MemoryError when logging response bodies https://review.openstack.org/359292 | 22:27 |
| dstanek | lbragstad: so i think my patch should be changed to use projects instead of roles. then your patch can add role support. | 22:30 |
| dstanek | really the point of the patch was to show how to change the mapping engine | 22:30 |
| *** ravelar has quit IRC | 22:30 | |
| lbragstad | dstanek gotch a | 22:33 |
| lbragstad | dstanek want me to work that into your patch? | 22:34 |
| *** dave-mccowan has joined #openstack-keystone | 22:36 | |
| *** SamYaple has quit IRC | 22:41 | |
| *** SamYaple has joined #openstack-keystone | 22:42 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient: Updated from global requirements https://review.openstack.org/414397 | 22:42 |
| *** phalmos has quit IRC | 22:48 | |
| *** dave-mccowan has quit IRC | 22:48 | |
| *** stewie925 has quit IRC | 22:50 | |
| *** guoshan has joined #openstack-keystone | 22:51 | |
| *** edmondsw has quit IRC | 22:51 | |
| dstanek | lbragstad: sure. or i can do it if you don't have the time | 22:53 |
| *** guoshan has quit IRC | 22:56 | |
| *** stingaci has quit IRC | 22:58 | |
| lbragstad | dstanek so your patch pulls roles from the mapping, but just to level set - we need to be pulling the project references (since that's what matches the spec)? | 23:00 |
| *** jaugustine has quit IRC | 23:08 | |
| dstanek | lbragstad: yeah, isn't that what you do in your patch? pull projects and then pull roles from the projects? | 23:09 |
| lbragstad | dstanek yep | 23:09 |
| lbragstad | https://review.openstack.org/#/c/415895/1/keystone/federation/utils.py line 579 | 23:09 |
| dstanek | lbragstad: yeah, so mine can be updated with a search and replace roles->projects and then you can add role support | 23:10 |
| lbragstad | dstanek sweet | 23:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Adds role mapping to the mapping engine https://review.openstack.org/410949 | 23:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Adds projects mapping to the mapping engine https://review.openstack.org/410949 | 23:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Add test class for shadow mapping https://review.openstack.org/414260 | 23:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone: Implement shadow mapping https://review.openstack.org/415895 | 23:18 |
| lbragstad | dstanek done ^ | 23:18 |
| openstackgerrit | Eric Brown proposed openstack/keystone: Remove references to Python 3.4 https://review.openstack.org/417235 | 23:22 |
| openstackgerrit | Eric Brown proposed openstack/keystoneauth: Remove references to Python 3.4 https://review.openstack.org/417236 | 23:28 |
| openstackgerrit | Eric Brown proposed openstack/keystonemiddleware: Remove references to Python 3.4 https://review.openstack.org/417237 | 23:31 |
| openstackgerrit | Eric Brown proposed openstack/python-keystoneclient: Remove references to Python 3.4 https://review.openstack.org/417238 | 23:33 |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Improve assertion in test https://review.openstack.org/417239 | 23:35 |
| rodrigods | lbragstad, ^ changed the assertion following your suggestion | 23:35 |
| *** diazjf has quit IRC | 23:45 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Improve assertion in test https://review.openstack.org/417239 | 23:45 |
| samueldmq | stevemar: dstanek: are we stopping to test things in python 3.4 ? is it correct to remove 3.4 classifiers ? | 23:46 |
| *** spzala has quit IRC | 23:46 | |
| lbragstad | rodrigods looks like the dependent patch hasn't merged yet - any reason to not work it into that? | 23:50 |
| *** guoshan has joined #openstack-keystone | 23:52 | |
| *** guoshan has quit IRC | 23:57 | |
| *** mvk has quit IRC | 23:57 | |
| rodrigods | lbragstad, didn't want to change stevemar's +A | 23:59 |
| rodrigods | since my -1 was ignored :P | 23:59 |
| lbragstad | rodrigods looks like it failed validation | 23:59 |
| lbragstad | s/validation/the gate check/ | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!