| *** thorst_ has joined #openstack-keystone | 00:00 | |
| *** antwash_ has joined #openstack-keystone | 00:00 | |
| *** antwash_ has quit IRC | 00:01 | |
| *** edmondsw has quit IRC | 00:04 | |
| *** portdirect is now known as portdirect_awayz | 00:10 | |
| *** thorst_ has quit IRC | 00:17 | |
| *** thorst_ has joined #openstack-keystone | 00:17 | |
| *** stingaci has joined #openstack-keystone | 00:17 | |
| *** thorst_ has quit IRC | 00:22 | |
| *** stingaci has quit IRC | 00:22 | |
| *** agrebennikov__ has quit IRC | 00:25 | |
| *** adrian_otto has joined #openstack-keystone | 00:36 | |
| *** thorst_ has joined #openstack-keystone | 00:42 | |
| *** portdirect_awayz is now known as authz | 00:43 | |
| *** thorst_ has quit IRC | 00:44 | |
| *** authz is now known as portdirect | 00:45 | |
| *** hoangcx has joined #openstack-keystone | 00:47 | |
| *** portdirect is now known as pd_ | 00:48 | |
| *** stingaci has joined #openstack-keystone | 00:50 | |
| *** stingaci has quit IRC | 00:54 | |
| *** browne has quit IRC | 00:56 | |
| *** jamielennox is now known as jamielennox|away | 01:02 | |
| *** jamielennox|away is now known as jamielennox | 01:17 | |
| *** stingaci has joined #openstack-keystone | 01:22 | |
| *** mvk has quit IRC | 01:26 | |
| *** stingaci has quit IRC | 01:27 | |
| *** esp_ has quit IRC | 01:27 | |
| *** markvoelker has joined #openstack-keystone | 01:27 | |
| stevemar | o/ | 01:33 |
|---|---|---|
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 01:33 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users tests https://review.openstack.org/423705 | 01:37 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 01:37 |
| *** r1chardj0n3s is now known as r1chardj0n3s_afk | 01:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 01:44 |
| stevemar | morgan: rderose catching up now from what happened today | 01:44 |
| rderose | stevemar: morgan has a couple patches up: https://review.openstack.org/#/c/424220/ | 01:45 |
| rderose | https://review.openstack.org/#/c/423909/ | 01:45 |
| stevemar | rderose: i noticed! | 01:45 |
| rderose | stevemar: :) but both require an API change (I think) | 01:46 |
| rderose | stevemar: I think morgan is also testing out a user options list that would dynamically add user attributes | 01:46 |
| rderose | stevemar: I still maintain that deprecation is out-of-scope for my PCI patch, but totally understand morgan's concern | 01:47 |
| rderose | stevemar: btw been working with zzzeek on this one: https://review.openstack.org/#/c/409874/ | 01:48 |
| rderose | stevemar: it's ready | 01:48 |
| stevemar | nice | 01:48 |
| stevemar | just looking through all my email | 01:48 |
| stevemar | lots of stuff to review | 01:48 |
| rderose | stevemar: cool | 01:48 |
| *** stingaci has joined #openstack-keystone | 01:55 | |
| *** adrian_otto has quit IRC | 01:56 | |
| *** stingaci has quit IRC | 01:59 | |
| *** Marcellin__ has quit IRC | 01:59 | |
| *** edmondsw has joined #openstack-keystone | 02:22 | |
| *** jlwhite has quit IRC | 02:26 | |
| *** stingaci has joined #openstack-keystone | 02:28 | |
| *** antwash has quit IRC | 02:28 | |
| *** stingaci has quit IRC | 02:32 | |
| *** jose-phillips has quit IRC | 02:44 | |
| *** harlowja has quit IRC | 02:44 | |
| *** ravelar has quit IRC | 02:48 | |
| *** thorst_ has joined #openstack-keystone | 02:49 | |
| *** thorst_ has quit IRC | 02:49 | |
| *** edmondsw has quit IRC | 02:51 | |
| *** edmondsw has joined #openstack-keystone | 02:52 | |
| *** edmondsw has quit IRC | 02:54 | |
| *** jlwhite has joined #openstack-keystone | 02:54 | |
| *** edmondsw has joined #openstack-keystone | 02:54 | |
| *** antwash has joined #openstack-keystone | 02:56 | |
| *** tovin07 has quit IRC | 02:56 | |
| *** edmondsw has quit IRC | 02:59 | |
| *** stingaci has joined #openstack-keystone | 03:01 | |
| *** stingaci has quit IRC | 03:05 | |
| *** tovin07 has joined #openstack-keystone | 03:07 | |
| *** chris_hultin|AWA is now known as chris_hultin | 03:17 | |
| *** chris_hultin is now known as chris_hultin|AWA | 03:21 | |
| *** jlwhite has quit IRC | 03:26 | |
| *** antwash has quit IRC | 03:27 | |
| *** stingaci has joined #openstack-keystone | 03:33 | |
| *** thorst_ has joined #openstack-keystone | 03:33 | |
| *** thorst_ has quit IRC | 03:34 | |
| *** stingaci has quit IRC | 03:37 | |
| *** furface has quit IRC | 03:37 | |
| *** nicolasbock has quit IRC | 03:54 | |
| *** jerrygb_ has quit IRC | 04:02 | |
| *** stingaci has joined #openstack-keystone | 04:06 | |
| *** antwash has joined #openstack-keystone | 04:08 | |
| *** jerrygb has joined #openstack-keystone | 04:09 | |
| *** antwash has quit IRC | 04:09 | |
| *** antwash has joined #openstack-keystone | 04:09 | |
| *** jerrygb has quit IRC | 04:10 | |
| *** stingaci has quit IRC | 04:10 | |
| stevemar | rderose / lbragstad https://review.openstack.org/#/c/414720/ is ready i think | 04:12 |
| rderose | cool, let me take a look | 04:12 |
| *** antdwash has joined #openstack-keystone | 04:25 | |
| *** jlwhite has joined #openstack-keystone | 04:26 | |
| morgan | stevemar: o/ | 04:34 |
| stevemar | morgan: o/ | 04:34 |
| morgan | stevemar: might have a patch ready that does the soft-options thing in like 10m | 04:34 |
| morgan | turns out it is a lot easier than i thought | 04:34 |
| *** MasterOfBugs has quit IRC | 04:34 | |
| morgan | also zzzeek helped a lot | 04:34 |
| morgan | (only for user so far) but it should be straight forward overall | 04:35 |
| stevemar | morgan: whats a soft-option? | 04:35 |
| morgan | define an option in code | 04:35 |
| morgan | like "ignore_password_expiry": | 04:35 |
| morgan | and then when you set that on [user] objects it is automatically stored in a dict like interface in a separate table | 04:36 |
| morgan | so we don't need a top-level column for each thing | 04:36 |
| morgan | meaning long term we can support queries on "all users that ignore password expiry" | 04:37 |
| morgan | and we can even support top-level options that could be set by non-admins | 04:37 |
| morgan | example: moving default_project_id to a user-settable option | 04:37 |
| morgan | and it also lays the framework for domain options, aka PCI-DSS options enabled per-domain | 04:38 |
| morgan | etc | 04:38 |
| *** stingaci has joined #openstack-keystone | 04:38 | |
| morgan | it basically is waht i was advocating to change 'extras' to, but only for the options we specifically define/support within keystone | 04:38 |
| morgan | anything not defined as a keystone-specific option falls through to 'extras' as per normal | 04:39 |
| stevemar | ah | 04:39 |
| stevemar | nice | 04:39 |
| stevemar | morgan: should the mfa_enabled and mfa_rules be done that way, too? | 04:39 |
| morgan | possible to do that instead | 04:39 |
| morgan | depends on how much MFA rules will be used. it is more expensive to store options in this manner than a standard orm relationship | 04:40 |
| morgan | because it is a per-user-per-option = a row when set | 04:40 |
| morgan | but in short, yes MFA rules and MFA enabled could be done this way | 04:40 |
| morgan | though MFA rules i would still put a specific API to set in place | 04:41 |
| stevemar | thats true | 04:41 |
| morgan | but the backend could use this new system | 04:41 |
| morgan | let me push the code (pre-tests) up and you can take a look and let me know which way you want me to go with MFA rules. | 04:42 |
| * stevemar looks at release schedule | 04:42 | |
| morgan | the only reason for the specific MFA rules API is because it'll be more likely to land. | 04:42 |
| *** antwash has quit IRC | 04:42 | |
| *** antdwash is now known as antwash | 04:42 | |
| morgan | vs trying to do policy work within the update-user mechanism | 04:42 |
| *** antdwash has joined #openstack-keystone | 04:42 | |
| *** stingaci has quit IRC | 04:42 | |
| *** antdwash has quit IRC | 04:43 | |
| *** antwash_ has joined #openstack-keystone | 04:43 | |
| morgan | ok here let me push this up | 04:43 |
| *** antwash_ has quit IRC | 04:43 | |
| morgan | you take a look, the next step is tests: define an option, set the option, load the option, delete the option, null the option, overwrite the option, set multiple options and make sure options not specified aren't touched | 04:44 |
| morgan | about ~6 tests to add | 04:44 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: WIP- Code-Defined Resource-specific Options https://review.openstack.org/424334 | 04:44 |
| morgan | it is currently based on the MFA rules bit, but i could un-wind that not too terribly | 04:44 |
| morgan | it isn't a ton of code | 04:45 |
| *** diazjf has joined #openstack-keystone | 04:49 | |
| *** diazjf has quit IRC | 04:50 | |
| stevemar | morgan: i had comments about the mfa code (first patch) | 04:50 |
| stevemar | otherwise it looks fine | 04:50 |
| stevemar | morgan: we may want to pop those attributes for v2 user API calls? | 04:51 |
| *** antwash_ has joined #openstack-keystone | 04:56 | |
| *** antwash_ has quit IRC | 04:56 | |
| *** antwash_ has joined #openstack-keystone | 04:57 | |
| *** dikonoor has joined #openstack-keystone | 04:59 | |
| morgan | yeah probably | 04:59 |
| morgan | but that is super easy to do. | 05:00 |
| morgan | esp. with the new options code | 05:00 |
| morgan | just use the resource object to pop the names off in the filter | 05:00 |
| *** chrisplo_ has quit IRC | 05:00 | |
| morgan | stevemar: so... | 05:00 |
| morgan | stevemar: thoughts? go with the option code and restructure. it makes the MFA rules stuff much much much simpler and no migration scripts | 05:00 |
| morgan | (at least for now, unless we want to snarf config values -> user option) | 05:01 |
| *** antwash_ has quit IRC | 05:02 | |
| *** chrisplo_ has joined #openstack-keystone | 05:03 | |
| morgan | stevemar: actually... no i think we want to maintain the values even in v2. | 05:04 |
| morgan | stevemar: now that i think about it | 05:04 |
| morgan | they would be no different in this case than "extras" | 05:04 |
| *** adrian_otto has joined #openstack-keystone | 05:08 | |
| *** dikonoor has quit IRC | 05:09 | |
| *** stingaci has joined #openstack-keystone | 05:11 | |
| *** jerrygb has joined #openstack-keystone | 05:11 | |
| *** adriant has quit IRC | 05:14 | |
| *** stingaci has quit IRC | 05:15 | |
| openstackgerrit | Steve Martinelli proposed openstack/keystone: Add user_mfa_rules table https://review.openstack.org/418166 | 05:15 |
| *** jerrygb has quit IRC | 05:16 | |
| stevemar | fixed minor comments ^ | 05:16 |
| *** henrynash has joined #openstack-keystone | 05:16 | |
| *** ChanServ sets mode: +v henrynash | 05:16 | |
| *** henrynash has quit IRC | 05:16 | |
| *** Jack_V has joined #openstack-keystone | 05:17 | |
| *** dikonoor has joined #openstack-keystone | 05:19 | |
| *** adrian_otto1 has joined #openstack-keystone | 05:19 | |
| *** severion has joined #openstack-keystone | 05:22 | |
| *** adrian_otto has quit IRC | 05:23 | |
| morgan | stevemar: hehe i'll be respinning that on top of the new options patch i think | 05:32 |
| stevemar | morgan: +2 your mfa stuff except the controller changes | 05:32 |
| stevemar | also needs routes :) | 05:32 |
| morgan | yep. | 05:32 |
| *** martinlopes has joined #openstack-keystone | 05:34 | |
| *** thorst_ has joined #openstack-keystone | 05:35 | |
| *** thorst_ has quit IRC | 05:40 | |
| *** adrian_otto1 has quit IRC | 05:41 | |
| *** stingaci has joined #openstack-keystone | 05:44 | |
| *** adrian_otto has joined #openstack-keystone | 05:46 | |
| *** stingaci has quit IRC | 05:48 | |
| *** adrian_otto has quit IRC | 05:51 | |
| stevemar | morgan: gn for now | 05:52 |
| *** adrian_otto has joined #openstack-keystone | 05:52 | |
| *** adrian_otto has quit IRC | 06:11 | |
| *** adrian_otto has joined #openstack-keystone | 06:11 | |
| *** stingaci has joined #openstack-keystone | 06:16 | |
| *** stingaci has quit IRC | 06:21 | |
| *** zzzeek has quit IRC | 06:29 | |
| *** harlowja has joined #openstack-keystone | 06:34 | |
| *** richm has quit IRC | 06:42 | |
| *** martinlopes has quit IRC | 06:43 | |
| *** stingaci has joined #openstack-keystone | 06:48 | |
| *** adrian_otto has quit IRC | 06:50 | |
| *** stingaci has quit IRC | 06:52 | |
| *** stingaci has joined #openstack-keystone | 06:57 | |
| *** jerrygb has joined #openstack-keystone | 07:00 | |
| *** stingaci has quit IRC | 07:01 | |
| *** martinlopes has joined #openstack-keystone | 07:05 | |
| *** jerrygb has quit IRC | 07:06 | |
| *** martinlopes has quit IRC | 07:06 | |
| openstackgerrit | Maroun Maroun proposed openstack/python-keystoneclient: Fix boto version strip regex https://review.openstack.org/424471 | 07:11 |
| *** chrisplo has joined #openstack-keystone | 07:24 | |
| *** harlowja has quit IRC | 07:26 | |
| *** chrisplo_ has quit IRC | 07:26 | |
| *** chrisplo has quit IRC | 07:28 | |
| *** mvk has joined #openstack-keystone | 07:35 | |
| *** thorst_ has joined #openstack-keystone | 07:36 | |
| *** tesseract has joined #openstack-keystone | 07:37 | |
| *** mvk has quit IRC | 07:40 | |
| *** thorst_ has quit IRC | 07:40 | |
| *** mvk has joined #openstack-keystone | 07:50 | |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** openstackgerrit has joined #openstack-keystone | 08:44 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware: Imported Translations from Zanata https://review.openstack.org/424510 | 08:44 |
| *** pcaruana has joined #openstack-keystone | 08:45 | |
| *** pnavarro has joined #openstack-keystone | 08:52 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** jerrygb has joined #openstack-keystone | 09:02 | |
| openstackgerrit | Maroun Maroun proposed openstack/python-keystoneclient: Fix boto version strip regex https://review.openstack.org/424471 | 09:06 |
| *** jerrygb has quit IRC | 09:08 | |
| *** thorst_ has joined #openstack-keystone | 09:30 | |
| *** thorst_ has quit IRC | 09:35 | |
| *** mvk has quit IRC | 09:41 | |
| openstackgerrit | Merged openstack/keystone: Add queries for federated attributes in list_users https://review.openstack.org/414720 | 09:56 |
| *** hoangcx has quit IRC | 10:06 | |
| *** thiagolib has joined #openstack-keystone | 10:14 | |
| *** mvk has joined #openstack-keystone | 10:16 | |
| *** sileht has quit IRC | 10:27 | |
| *** sileht has joined #openstack-keystone | 10:27 | |
| openstackgerrit | Rodrigo Duarte proposed openstack/keystone: Add missing parentheses https://review.openstack.org/424579 | 10:54 |
| *** jerrygb has joined #openstack-keystone | 11:04 | |
| *** jerrygb has quit IRC | 11:09 | |
| *** richm has joined #openstack-keystone | 11:11 | |
| *** aloga has quit IRC | 11:17 | |
| *** edmondsw has joined #openstack-keystone | 11:20 | |
| *** dikonoo has joined #openstack-keystone | 11:22 | |
| *** edmondsw has quit IRC | 11:24 | |
| *** dikonoor has quit IRC | 11:26 | |
| *** thorst_ has joined #openstack-keystone | 11:31 | |
| Dinesh_Bhor | Hi all, is there anyone who can help me in understanding what is the difference between 'is_admin' and 'is_admin_project' and in which case the 'is_admin_project' is used in policy checking? | 11:33 |
| *** sm1235 has quit IRC | 11:35 | |
| *** thorst_ has quit IRC | 11:36 | |
| *** nicolasbock has joined #openstack-keystone | 11:44 | |
| *** pd_ is now known as portdirect | 11:47 | |
| *** aloga has joined #openstack-keystone | 11:54 | |
| *** dikonoo has quit IRC | 12:03 | |
| *** catintheroof has joined #openstack-keystone | 12:16 | |
| *** gema has joined #openstack-keystone | 12:29 | |
| *** edmondsw has joined #openstack-keystone | 12:41 | |
| *** edmondsw has quit IRC | 12:45 | |
| *** thorst_ has joined #openstack-keystone | 12:47 | |
| *** jerrygb has joined #openstack-keystone | 13:05 | |
| *** jerrygb has quit IRC | 13:10 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 13:16 | |
| *** edmondsw has joined #openstack-keystone | 13:18 | |
| *** dave-mccowan has joined #openstack-keystone | 13:18 | |
| *** edmondsw has quit IRC | 13:20 | |
| *** edmondsw has joined #openstack-keystone | 13:20 | |
| *** jlwhite has quit IRC | 13:27 | |
| *** antwash has quit IRC | 13:27 | |
| *** severion has quit IRC | 13:39 | |
| *** v1k0d3n has quit IRC | 13:39 | |
| *** spotz_zzz is now known as spotz | 13:39 | |
| *** v1k0d3n has joined #openstack-keystone | 13:40 | |
| *** spotz is now known as spotz_zzz | 13:45 | |
| openstackgerrit | Merged openstack/keystonemiddleware: Imported Translations from Zanata https://review.openstack.org/424510 | 13:45 |
| openstackgerrit | Merged openstack/keystone: Add missing parentheses https://review.openstack.org/424579 | 13:55 |
| *** thiagolib has quit IRC | 13:58 | |
| *** lamt has joined #openstack-keystone | 14:01 | |
| *** v1k0d3n has quit IRC | 14:08 | |
| *** v1k0d3n has joined #openstack-keystone | 14:09 | |
| *** spotz_zzz is now known as spotz | 14:13 | |
| *** jperry has joined #openstack-keystone | 14:21 | |
| *** flaper87 has quit IRC | 14:24 | |
| *** thiagolib has joined #openstack-keystone | 14:27 | |
| *** agrebennikov__ has joined #openstack-keystone | 14:33 | |
| openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/keystone: Remove dogpile.core dependencies https://review.openstack.org/424673 | 14:35 |
| *** spotz is now known as spotz_zzz | 14:38 | |
| *** v1k0d3n has quit IRC | 14:39 | |
| *** severion has joined #openstack-keystone | 14:39 | |
| lbragstad | looks like https://review.openstack.org/#/c/403898/ is in need of a rebase | 14:42 |
| *** jerrygb has joined #openstack-keystone | 14:44 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 14:45 |
| *** jerrygb_ has joined #openstack-keystone | 14:47 | |
| *** jerrygb__ has joined #openstack-keystone | 14:49 | |
| *** jerrygb has quit IRC | 14:51 | |
| *** jerrygb_ has quit IRC | 14:52 | |
| *** severion has quit IRC | 14:52 | |
| *** v1k0d3n has joined #openstack-keystone | 14:52 | |
| *** lamt has quit IRC | 14:52 | |
| *** knikolla has joined #openstack-keystone | 14:54 | |
| knikolla | o/ | 14:54 |
| knikolla | yay, irc bouncer is back online | 14:54 |
| *** belmoreira has joined #openstack-keystone | 14:55 | |
| *** spotz_zzz is now known as spotz | 15:00 | |
| *** jerrygb has joined #openstack-keystone | 15:01 | |
| openstackgerrit | Samuel Pilla proposed openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 15:02 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:03 | |
| *** pnavarro has quit IRC | 15:05 | |
| *** jerrygb__ has quit IRC | 15:05 | |
| *** markvoelker has quit IRC | 15:18 | |
| *** pnavarro has joined #openstack-keystone | 15:19 | |
| *** chris_hultin is now known as chris_hultin|AWA | 15:19 | |
| *** markvoelker has joined #openstack-keystone | 15:21 | |
| *** jaosorior has joined #openstack-keystone | 15:25 | |
| *** ravelar has joined #openstack-keystone | 15:32 | |
| openstackgerrit | Maroun Maroun proposed openstack/python-keystoneclient: Fix boto version strip regex https://review.openstack.org/424700 | 15:34 |
| *** edtubill has joined #openstack-keystone | 15:36 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: Fixed unraised exception in _disallow_write for LDAP https://review.openstack.org/424704 | 15:36 |
| *** antwash has joined #openstack-keystone | 15:40 | |
| *** jlwhite has joined #openstack-keystone | 15:41 | |
| *** jaugustine has joined #openstack-keystone | 15:42 | |
| *** jose-phillips has joined #openstack-keystone | 15:42 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:43 | |
| dstanek | rderose: do enterprise tools force a password reset on the second login after an admin says you must reset? | 15:47 |
| *** adrian_otto has joined #openstack-keystone | 15:47 | |
| rderose | dstanek: I believe they force reset on the first login | 15:48 |
| dstanek | rderose: before you can actually use the system right? | 15:48 |
| rderose | dstanek: right | 15:49 |
| rderose | dstanek: you are forced on the change password screen | 15:49 |
| *** mvk has quit IRC | 15:49 | |
| dstanek | rderose: that's all i was really saying about our implementation. i'd rather it be like that | 15:50 |
| dstanek | then it's more like other systems and the change is much simplier | 15:50 |
| knikolla | we no longer require a token to change the password. maybe reject issuing tokens altogether until password is changed. | 15:52 |
| rderose | dstanek: I see the point, now that, that patch has merged | 15:52 |
| dstanek | knikolla: exactly | 15:53 |
| dstanek | rderose: the other bonus is that technically you would not need to have that list because we allow control of expiration date via the api right? | 15:54 |
| rderose | dstanek knikolla: I guess what don't like about though, is what password expires means. Does it mean you only have access to the system until the password expires. | 15:54 |
| rderose | dstanek: knikolla: I guess not | 15:54 |
| rderose | dstanek: knikolla: now it simply means, you need to update your password | 15:54 |
| knikolla | rderose: in my opinion, password expires means the ability of the password to give you a token. | 15:55 |
| dstanek | to me password expired means you need to change it now | 15:55 |
| rderose | dstanek: knikolla: okay, makes sense then | 15:55 |
| knikolla | password expired, no new token. if you have an old one, it should still be valid. this is how i see it. | 15:55 |
| knikolla | old token* | 15:55 |
| dstanek | since we allow self password changes for expired passwords we took off the extra 'you need to checkin with your admin' constraint | 15:56 |
| rderose | dstanek: we don't allow control over expiration via the API | 15:56 |
| *** antwash_ has joined #openstack-keystone | 15:56 | |
| dstanek | rderose: damn :-( | 15:56 |
| rderose | dstanek: but! | 15:56 |
| rderose | dstanek: we could add it :) | 15:56 |
| rderose | dstanek: however, it would only be valid for local users | 15:57 |
| rderose | dstanek: as it would have no impact on ldap users and probably should throw an error | 15:57 |
| dstanek | rderose: yeah, that may be something to bring up to morgan as a design alternative. | 15:58 |
| rderose | dstanek: currently, password expires is being returned in the response, but not allowed in the request | 15:58 |
| rderose | dstanek: yeah | 15:58 |
| dstanek | rderose: how do admins force their service users to not expire now? is that in a config? | 15:59 |
| morgan | dstanek: easy with my alternative | 15:59 |
| morgan | actually | 15:59 |
| dstanek | morgan: what was your alternative? an attribute on the user? | 16:00 |
| rderose | dstanek: ignore list | 16:00 |
| morgan | dstanek: yes. | 16:00 |
| morgan | dstanek: but it's a code-based option that is converted to an attribute | 16:00 |
| morgan | so no migrations needed, just define the option in code and then next release can start using it | 16:00 |
| morgan | (one migration ot implement the storage table per resource type) | 16:00 |
| morgan | it's extras... but indexable | 16:01 |
| morgan | and defined in code, with validators | 16:01 |
| dstanek | morgan: why not just add it to the model? | 16:01 |
| morgan | it is part of the model | 16:01 |
| morgan | hold on... | 16:01 |
| morgan | let me show you and example | 16:01 |
| dstanek | i mean the data model instead of using extas | 16:02 |
| morgan | it isn't "extras" | 16:02 |
| morgan | hold on, writing a commit message | 16:02 |
| dstanek | lol, ok | 16:03 |
| dstanek | rderose: ^ just make morgan mad and he'll write the code | 16:04 |
| *** jose-phillips has quit IRC | 16:05 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Code-Defined Resource-specific Options https://review.openstack.org/424334 | 16:05 |
| morgan | dstanek: ^ | 16:05 |
| morgan | dstanek: so, the workflow is you define an option in the code, aka "ignore_password_expiry" | 16:06 |
| rderose | dstanek: haha | 16:06 |
| rderose | dstanek: exactly | 16:06 |
| morgan | this has a type, and name, and a 4-character-id | 16:06 |
| morgan | if the "name" (in this case "ignore_password_expiry") is in the user update ref, it is extracted, validated, and stored in an associated attribute mapper (SQL dict representation) | 16:06 |
| *** dmellado has quit IRC | 16:07 | |
| morgan | when you load the user_ref, it is placed into the ref like any other attribute | 16:07 |
| morgan | the advantage here is no migration is needed to add a column per option | 16:07 |
| morgan | this opens the door for code-defined options for things like ignoring password expiry, domain-by-domain pci-dss enforcement | 16:07 |
| morgan | etc | 16:07 |
| morgan | each resource type would get an options table | 16:08 |
| rderose | morgan: sweet! | 16:08 |
| morgan | the exception would be if you expect the option to be used *every single time* | 16:08 |
| morgan | which case, you would make it a column | 16:08 |
| rderose | morgan: what about impact to the API? | 16:08 |
| morgan | like (for example) name | 16:08 |
| morgan | rderose: none | 16:08 |
| morgan | rderose: this is all done internally in the storage system | 16:08 |
| rderose | morgan: we're not adding attributes to the request, cool | 16:08 |
| *** jerrygb has quit IRC | 16:08 | |
| rderose | morgan: how about to the response? | 16:08 |
| morgan | the only possible change needed is schema changes | 16:08 |
| morgan | the response would now include these new values in the JSON | 16:09 |
| morgan | but only if they are set | 16:09 |
| morgan | if you want to unset an option, set the value to "None" in the update request | 16:09 |
| *** jerrygb has joined #openstack-keystone | 16:09 | |
| morgan | you can also set options on create, since it is hooked into ".from_dict" on the model | 16:09 |
| rderose | morgan: would be nice if we could hide from the response | 16:09 |
| morgan | you don't want to hide thise from the response | 16:10 |
| rderose | morgan: actually, maybe not | 16:10 |
| rderose | yeah, rethinking that | 16:10 |
| morgan | these are values on the Resource that would be applied on updates. | 16:10 |
| morgan | or set. | 16:10 |
| rderose | how about query parameters on these new attributes? | 16:10 |
| morgan | not implemented yet | 16:10 |
| rderose | okayu | 16:10 |
| morgan | but future proofed to be able to do that | 16:10 |
| rderose | gotcha | 16:10 |
| morgan | this design is specifically so we *can* filter/query on it | 16:10 |
| dstanek | morgan: i'll take a look | 16:11 |
| morgan | and it also allows us to look at implementing policy allowing updates for options by the user themself | 16:11 |
| morgan | and easing back .update_user or similar APIs from being "admin-only" | 16:11 |
| morgan | give it fidelity to say "these settings are settable by role XXXX" | 16:11 |
| morgan | or "object owner (self) in the case of a user" | 16:12 |
| morgan | (or a new API) *shrug* | 16:12 |
| rderose | morgan: wow! nice | 16:12 |
| morgan | the thought was to convert MFA rules over to this and your password expiry/lockout changes | 16:12 |
| *** antwash_ has quit IRC | 16:12 | |
| rderose | morgan: we can have our cake and eat too! | 16:12 |
| rderose | :) | 16:12 |
| morgan | code changes are much, much smaller and no special encoding for things in LDAP (Ldap will say "hah, no") without using the shadow-user mechanisms | 16:13 |
| morgan | and since this is tied to the main user object | 16:13 |
| morgan | it works with local and non-local users, options may not apply to non-local users | 16:13 |
| rderose | right | 16:13 |
| morgan | but it avoids wonkyness and creating a non-local user object | 16:13 |
| morgan | for a local user and vice versa | 16:13 |
| *** antwash_ has joined #openstack-keystone | 16:14 | |
| morgan | i've been meaning to implement this type of setup for a while now | 16:14 |
| morgan | this was me being frustrated at some choices from newton and needing to get it out | 16:14 |
| rderose | morgan: how do you set the options for nonlocal users? | 16:14 |
| morgan | to be fair, i haven't run the complete unit tests on it | 16:14 |
| morgan | as long as you can do an update to the user | 16:15 |
| *** dougshelley66 has joined #openstack-keystone | 16:15 | |
| morgan | which may need some changes | 16:15 |
| stevemar | dougshelley66: o/ | 16:15 |
| rderose | morgan: update will only be called by sql backend | 16:15 |
| stevemar | dougshelley66: i hear you have questions | 16:15 |
| dougshelley66 | hi stevemar | 16:15 |
| dougshelley66 | yes - my question is | 16:15 |
| morgan | right we might need to make some changes to allow Option | 16:15 |
| morgan | but eh for now it's local users only | 16:15 |
| dougshelley66 | the trove-api service seems to always be authenticating a token using the admin endpoint | 16:16 |
| dstanek | wife's here so it's lunch time. morgan, i'll take a deep look a little later. i'm very curious about the possiblilites | 16:16 |
| morgan | this is framework that makes a lot of this easier | 16:16 |
| dougshelley66 | via the keystoneauth1 component | 16:16 |
| morgan | dstanek: ++ | 16:16 |
| *** pcaruana has quit IRC | 16:16 | |
| rderose | morgan: yeah, you could use shadow users and call update to update the options from core | 16:16 |
| dougshelley66 | is there a way to get it to use public | 16:16 |
| dougshelley66 | seems like there is an "interface" option but we don't know how to set it | 16:16 |
| morgan | stevemar: https://review.openstack.org/#/c/424334/ | 16:16 |
| stevemar | dougshelley66: do you set the options in trove.conf file? | 16:16 |
| morgan | rderose: options are set in update_user for now | 16:16 |
| dougshelley66 | yes we have a keystone_authtoken section | 16:16 |
| stevemar | ah | 16:16 |
| dougshelley66 | but it wasn't clear if "interface" is valid in there? | 16:16 |
| dougshelley66 | is it? | 16:16 |
| morgan | rderose: but we can work through what that looks like for non-local users future looking | 16:17 |
| morgan | i'm thinking it's values that are still updatable just for values that aren't stored on non-local user object | 16:17 |
| stevemar | dougshelley66: you should be able to set interface... | 16:17 |
| stevemar | let me look up the option | 16:17 |
| morgan | this is all future proofing work + fix some architectural issues in one fell-swoop | 16:17 |
| dougshelley66 | oh ok - it didn't seem to dump that one in the CONF output | 16:17 |
| dougshelley66 | but we can trhy that | 16:18 |
| morgan | i feel bad it's ~500 lines, but ... it is what was needed. | 16:18 |
| morgan | and it's tested. | 16:18 |
| rderose | morgan: local and nonlocal are still tied to a user object. if you called driver.update and then shadow.update # update the options | 16:18 |
| morgan | right. | 16:18 |
| rderose | morgan: it would apply to all users (just a thought) | 16:18 |
| morgan | so we can make that work for options | 16:18 |
| morgan | :) | 16:18 |
| dougshelley66 | stevemar it isn't working - doesn't seem to pick it up | 16:18 |
| morgan | to start it'll probably be just for local users (current workflow) | 16:18 |
| morgan | but in short, look at the code | 16:19 |
| rderose | morgan: to keep simple ;) | 16:19 |
| rderose | cool, will do | 16:19 |
| *** lamt has joined #openstack-keystone | 16:20 | |
| *** phalmos has joined #openstack-keystone | 16:21 | |
| stevemar | dougshelley66: hmm... why isn't it picking it up.. | 16:22 |
| dougshelley66 | the trove-api.log dumps all the options of [keystone_authtoken] and i don't see it in there | 16:22 |
| dougshelley66 | if I hack keystoneauth1/identity/base.py and force interface = public, it works | 16:23 |
| dougshelley66 | but clearly that isn't a good solution :) | 16:23 |
| stevemar | :) | 16:23 |
| dougshelley66 | keystoneauth1 seems to have a option called interface...is it expected in a different CONF section? | 16:23 |
| morgan | rderose: fwiw, looks like it is passing unit tests *phew* | 16:24 |
| rderose | morgan: nice! | 16:24 |
| stevemar | dougshelley66: ah, maybe jamielennox intended it to be part of the session/adapter code instead of an option | 16:24 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change unit test class to a less generic name https://review.openstack.org/424726 | 16:25 |
| dougshelley66 | stevemar sure but it looks like you can specify --os-interface somewhere | 16:25 |
| stevemar | dougshelley66: yeah, with the adapter code | 16:25 |
| dougshelley66 | i assume that meant there was a CONF variable somewhere | 16:25 |
| stevemar | dougshelley66: where do you set the keystone session in trove? | 16:25 |
| stevemar | looks lik in here? https://github.com/openstack/trove/blob/master/trove/common/glance_remote.py | 16:26 |
| dougshelley66 | would this be done in apipaste? | 16:26 |
| *** phalmos has quit IRC | 16:26 | |
| dougshelley66 | hmm that code is only used in the multi-region setup | 16:26 |
| dougshelley66 | so not in-band to what i'm doing | 16:27 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change unit test class to a less generic name https://review.openstack.org/424727 | 16:28 |
| *** phalmos has joined #openstack-keystone | 16:28 | |
| stevemar | dougshelley66: hmm, where are you using it in trove then? | 16:29 |
| morgan | zzzeek: thanks for the help yesterday | 16:30 |
| stevemar | is lbragstad around today? | 16:30 |
| lbragstad | stevemar i am | 16:31 |
| dougshelley66 | i'm not certain - it seems like this is happening in the api service before "trove" code gets called | 16:31 |
| stevemar | dougshelley66: i suggest coming back in an hour or two and bugging jamielennox :) | 16:31 |
| samueldmq | hey all | 16:32 |
| samueldmq | anyone looking at bug #1659030 | 16:32 |
| openstack | bug 1659030 in OpenStack Identity (keystone) "The proxy server received an invalid response from an upstream server" [Undecided,New] https://launchpad.net/bugs/1659030 | 16:32 |
| samueldmq | The proxy server could not handle the request <em><a href="/v2.0/tokens">POST /v2.0/tokens</a></em>.<p> | 16:33 |
| samueldmq | Reason: <strong>Error reading from remote server</strong></p></p> | 16:33 |
| samueldmq | I've never seen that | 16:33 |
| dougshelley66 | stevemar ok thx | 16:33 |
| stevemar | dougshelley66: sorry for passing the buck :P | 16:35 |
| stevemar | samueldmq: i suspect its a misconfiguration, but we should look into it | 16:35 |
| stevemar | lbragstad we need a game plan for the last few patches | 16:35 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Add domain_id to the user table https://review.openstack.org/409874 | 16:36 |
| lbragstad | stevemar ok - https://etherpad.openstack.org/p/keystone-sprint-to-ocata | 16:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Refactor shadow users tests https://review.openstack.org/423705 | 16:36 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 16:36 |
| stevemar | lbragstad: i was hoping you (and dstanek?) could test out rderose's changes for adding domain id to the user table? | 16:36 |
| stevemar | using rolling upgrades of course | 16:36 |
| stevemar | i ask you because you had automation setup already when you tested the fernet credential setup | 16:37 |
| morgan | stevemar: when did we implement rolling upgrades? | 16:37 |
| lbragstad | yeah - i can do that this afternoon | 16:37 |
| lbragstad | morgan Newton | 16:37 |
| morgan | hmm. | 16:37 |
| morgan | so. in Q we can squash the old migrate repo down to "Newton" | 16:37 |
| lbragstad | morgan we don't have the project tag asserted for keystone yet because it's not tested in the gate | 16:37 |
| morgan | and stick with rolling upgrades from there | 16:37 |
| morgan | or in P we can squash? | 16:38 |
| stevemar | we can probably squash in P | 16:38 |
| morgan | ok lets plan to do that | 16:38 |
| stevemar | morgan: don't divert this train :P | 16:38 |
| morgan | stevemar: hahahahaha but i like being a diversion | 16:38 |
| stevemar | lbragstad: in the mean time, rderose and i will review morgan's patches for code defined option and MFA -- you good with that rderose? | 16:39 |
| stevemar | dstanek: you can float between helping lbragstad and reviewing morgan's patches | 16:39 |
| stevemar | that sound good to everyone? | 16:39 |
| morgan | stevemar: the MFA will probably be rebased on the option one if folks like it | 16:39 |
| morgan | stevemar: so review the option one first | 16:40 |
| morgan | if so, i'll rebase onto that and make the MFA thing no-migrations | 16:40 |
| morgan | so look at the mfa patches in light of that | 16:40 |
| lbragstad | yeah - that should work. I have a few meeting this afternoon but i'll block off some time to test manually | 16:40 |
| morgan | and if folks have no issues i'll start rolling the MFA stuff up (API wise) today | 16:41 |
| rderose | stevemar: hell yeah! | 16:41 |
| rderose | stevemar: just need to re-spin the setting the domain for federated users due to ravelar patch | 16:42 |
| knikolla | nice teamwork :) | 16:42 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Verbose breakup of method into seperate methods https://review.openstack.org/424740 | 16:42 |
| rderose | knikolla: ++ | 16:43 |
| lbragstad | who here is familiar with the id mapping stuff? | 16:43 |
| stevemar | lbragstad: henry is :P | 16:45 |
| *** diazjf has joined #openstack-keystone | 16:45 | |
| lbragstad | stevemar of course he is :) | 16:46 |
| lbragstad | stevemar alright - well i'm gonna take a stab at this, | 16:46 |
| stevemar | yesssh | 16:47 |
| *** dmellado has joined #openstack-keystone | 16:48 | |
| knikolla | lbragstad: which one is that? | 16:50 |
| *** dmellado has quit IRC | 16:53 | |
| openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/keystone: Remove dogpile.core dependencies https://review.openstack.org/424673 | 16:54 |
| *** browne has joined #openstack-keystone | 16:55 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: Set the domain for federated users https://review.openstack.org/423708 | 16:56 |
| lbragstad | stevemar https://bugs.launchpad.net/keystone/+bug/1658641 | 16:57 |
| openstack | Launchpad bug 1658641 in OpenStack Identity (keystone) "Moving/disabling LDAP users break Keystone queries depending on role ID" [Undecided,New] | 16:57 |
| lbragstad | knikolla id mapping is a specific backend/database for providing public ids for multi-domain backends that don't generate UUID-like ID (i think) | 16:58 |
| morgan | yes | 16:59 |
| morgan | we need ids to be somewhat controlled by keystone | 16:59 |
| morgan | if LDAP (multildap) all provide the same IDs we have issues | 16:59 |
| morgan | since IDs need to be globally unique | 16:59 |
| lbragstad | right | 16:59 |
| morgan | so we have mapping, which does Sha256(LDAP-provided-id, domain_id) | 16:59 |
| morgan | guaranteeing uniqueness | 16:59 |
| *** dmellado has joined #openstack-keystone | 16:59 | |
| morgan | and consistent | 16:59 |
| morgan | it is not uuid though | 17:00 |
| morgan | it is explicitly longer | 17:00 |
| knikolla | morgan: understood | 17:00 |
| *** tqtran has joined #openstack-keystone | 17:00 | |
| ayoung | morgan, I'm watching this https://www.youtube.com/watch?v=WvnXemaYQ50 | 17:00 |
| lbragstad | which is nice when you purge all mappings for a domain | 17:00 |
| ayoung | kubernetes uses the word namespace to mean what we call "projects" and "domains" | 17:00 |
| morgan | yep | 17:00 |
| ayoung | CLusterRoles are global roles (is_admin_project=True) | 17:01 |
| ayoung | and Roles are what we do | 17:01 |
| morgan | and we suck for calling our stuff domains and projects | 17:01 |
| morgan | (tenant was a better name) | 17:01 |
| ayoung | yep | 17:01 |
| ayoung | but we can call them all namespaces in the future | 17:01 |
| ayoung | since kubernetes is going to devour openstack anyway | 17:01 |
| ayoung | RoleBindings are role assignments | 17:02 |
| * ayoung should write up a translation doc | 17:02 | |
| openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/keystone: Remove dogpile.core dependencies https://review.openstack.org/424673 | 17:02 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP extend users API to add federated object https://review.openstack.org/418624 | 17:04 |
| ayoung | And they did the "You have to have a role to assign a role" | 17:04 |
| stevemar | lbragstad: i saw that bug, nice bug, should get fixed in P though | 17:06 |
| lbragstad | stevemar agreed - i'm not really sure how we can fix it besides documenting the behavior though | 17:06 |
| stevemar | lbragstad: oh we can probably do something | 17:07 |
| stevemar | lbragstad: maybe if an old ID is looked up and not found, we can self-clean | 17:07 |
| ayoung | lbragstad, watch https://www.youtube.com/watch?v=WvnXemaYQ50 when you get a chance | 17:08 |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Remove LDAP delete logic and associated tests https://review.openstack.org/424344 | 17:08 |
| morgan | stevemar: https://bugs.launchpad.net/keystone/+bug/1659051 | 17:10 |
| openstack | Launchpad bug 1659051 in OpenStack Identity (keystone) "Use CORS set_defaults" [Undecided,New] | 17:10 |
| *** dave-mccowan has quit IRC | 17:11 | |
| samueldmq | stevemar: perhaps I can query logstash to see how often that happen ? | 17:12 |
| morgan | stevemar: https://bugs.launchpad.net/keystone/+bug/1659053 | 17:13 |
| openstack | Launchpad bug 1659053 in OpenStack Identity (keystone) "use uuids with pycadf" [Undecided,New] | 17:13 |
| stevemar | morgan: both good bugs ++ | 17:16 |
| morgan | oooh weird | 17:21 |
| morgan | we don't call .latent() anywhere | 17:21 |
| morgan | looks like a bug in oslo.middleware | 17:23 |
| morgan | then | 17:23 |
| ayoung | morgan, guess who asks the first question at the end of the preso? | 17:27 |
| morgan | you? | 17:27 |
| morgan | ;) | 17:27 |
| ayoung | not I | 17:27 |
| morgan | who? | 17:27 |
| ayoung | morgan, I was not at kubeconf | 17:27 |
| morgan | ahh. topol? | 17:27 |
| ayoung | ++ | 17:27 |
| morgan | haha | 17:28 |
| ayoung | "I worked on a different open source project that..." | 17:28 |
| *** diazjf has quit IRC | 17:28 | |
| morgan | ayoung: topol has been learning from you how to phrase the questions :) | 17:28 |
| ayoung | morgan, I think the most interesting part of the K8S architecture is that K8S owns the service catalog | 17:29 |
| lbragstad | interesting - they have a mix of traditional and scoped rbac | 17:29 |
| ayoung | lbragstad, right | 17:29 |
| morgan | ayoung: yeah | 17:29 |
| lbragstad | morgan and i were just talking about unscoped roles | 17:30 |
| morgan | lbragstad: like i said we may want to revisit that | 17:30 |
| morgan | ^_^ | 17:30 |
| ayoung | lbragstad, so for the RBAC stuff, you go to the service catalog to get the name of the resource | 17:30 |
| ayoung | so where I have "match the URL" they just match the resource | 17:30 |
| lbragstad | that's if you're applying any scope to RBAC | 17:30 |
| ayoung | which means that, at the API server level, they need to be able to go from URL back to resource type | 17:30 |
| ayoung | lbragstad, actually for ClusterRoles, too | 17:31 |
| ayoung | lbragstad, so orthogonal to scope | 17:31 |
| lbragstad | form the presentatin it sounds like they keep namespaces and cluster roles mutually exclusive | 17:31 |
| lbragstad | from* | 17:31 |
| ayoung | lbragstad, yeah, it seems to. But they do the RBAC the same way from roles or cluster roles to resources | 17:32 |
| * lbragstad keeps watching | 17:32 | |
| ayoung | it would be like if we had a separate field in the token "Cluster_roles" and then policy was "cluster_role:admin:" which would not match the same thing as role:admin | 17:33 |
| lbragstad | right - or only make cluster roles available in unscoped tokens | 17:33 |
| lbragstad | available/viewable | 17:33 |
| dougshelley66 | jamielennox would you be able to answer a quick q | 17:34 |
| lbragstad | yes - https://youtu.be/WvnXemaYQ50?t=22m15s | 17:35 |
| dougshelley66 | jamielennox i notice that interface default to 'admin' here - https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/httpclient.py#L253 | 17:36 |
| ayoung | dougshelley66, hes in Australia | 17:36 |
| ayoung | probably dead asleep...or he should be | 17:36 |
| dougshelley66 | is there any way (like a conf setting) that we can override that | 17:36 |
| dougshelley66 | ayoung ah ok thx | 17:36 |
| dougshelley66 | well if anyone else can answer my question..... | 17:36 |
| dougshelley66 | :) | 17:36 |
| lbragstad | dougshelley66 he is usually in our keystone team meeting, and sometimes available after that | 17:36 |
| lbragstad | (which is in 20 minutes) | 17:37 |
| ayoung | dougshelley66, you want to change the default interface used for talking to keystone to be the public one instead of admin, cuz admin is inside the firewall? | 17:37 |
| dougshelley66 | yes exactly | 17:41 |
| dougshelley66 | is that possible | 17:41 |
| *** spilla has joined #openstack-keystone | 17:42 | |
| *** belmoreira has quit IRC | 17:42 | |
| *** adrian_otto has quit IRC | 17:43 | |
| *** mvk has joined #openstack-keystone | 17:44 | |
| *** d34dh0r53 is now known as ID-Ten-T | 17:45 | |
| openstackgerrit | Boris Bobrov proposed openstack/keystone: Enable trusts for federated users https://review.openstack.org/415545 | 17:45 |
| *** phalmos_ has joined #openstack-keystone | 17:47 | |
| *** ID-Ten-T is now known as blarnath | 17:48 | |
| *** blarnath is now known as d34dh0r53 | 17:48 | |
| *** phalmos has quit IRC | 17:50 | |
| *** dave-mccowan has joined #openstack-keystone | 17:51 | |
| *** jose-phillips has joined #openstack-keystone | 17:56 | |
| *** esp_ has joined #openstack-keystone | 17:58 | |
| *** nishaYadav has joined #openstack-keystone | 17:59 | |
| morgan | cough | 18:00 |
| stevemar | morgan: o/ | 18:00 |
| morgan | someone is slacking today | 18:00 |
| * morgan looks at stevemar, lbragstad, etc. | 18:01 | |
| * morgan looks at the clock | 18:01 | |
| stevemar | o_O | 18:01 |
| morgan | did we cancel the keystone meeting? | 18:01 |
| *** adrian_otto has joined #openstack-keystone | 18:03 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone: Change unit test class to a less generic name https://review.openstack.org/424727 | 18:19 |
| dougshelley66 | ayoung any thoughts? | 18:23 |
| ayoung | dougshelley66, use the V3 api, and have everything on both ports | 18:25 |
| ayoung | uneset the public_api value inside of keystone.conf | 18:25 |
| ayoung | unset | 18:25 |
| dougshelley66 | ayoung you are saying we need to change the configuration of keystone? | 18:29 |
| *** dave-mccowan has quit IRC | 18:30 | |
| dougshelley66 | i was hoping we could cause the client configuration to change (the client in this case is coming from the trove-api service) | 18:30 |
| ayoung | dougshelley66, if you use the V3 API, it should not matter admin vs public endpoint | 18:31 |
| ayoung | that is all trove | 18:31 |
| dougshelley66 | from what we can tell this is happening in the WSGI pipeline, it is calling the authtoken factory | 18:31 |
| dougshelley66 | during that instantiation, keystoneauth1 is attempting to contact keystone on the admin port | 18:32 |
| ayoung | dougshelley66, as I said, remove the public_api value inside keystone.conf | 18:37 |
| ayoung | that keeps it from using the right port | 18:37 |
| ayoung | But WSGI pipeline should be using Admin, as it is inside the Firewall. | 18:38 |
| dougshelley66 | in this case the customer has Trove configured in a VM | 18:39 |
| dougshelley66 | which only has access to the public endpionts | 18:39 |
| *** tesseract has quit IRC | 18:39 | |
| dougshelley66 | ayoung i'm not certain where to find "public_api"...I don't see that value in /etc/keystone/keystone.conf | 18:40 |
| ayoung | dougshelley66, public_uri? | 18:40 |
| ayoung | near the top... | 18:40 |
| ayoung | its off the top of my head | 18:40 |
| dougshelley66 | ah do you mean "public_endpoint"? | 18:40 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone.conf.sample#n27 | 18:41 |
| ayoung | dougshelley66, yeah | 18:41 |
| ayoung | it is a nasty piece of code | 18:41 |
| *** nishaYadav has quit IRC | 18:43 | |
| morgan | rderose: where should i move the option code to in shadow users backend | 18:47 |
| *** raildo has joined #openstack-keystone | 18:49 | |
| rderose | morgan: https://github.com/openstack/keystone/blob/master/keystone/identity/shadow_backends/sql.py | 18:50 |
| morgan | ayoung: https://review.openstack.org/#/c/424334/ | 18:50 |
| morgan | rderose: and it will keep all the same refs and such? | 18:50 |
| morgan | rderose: so the table will be the same, just move that bit of code andw e should be good? | 18:50 |
| morgan | (and the tests should work the same or do i need to call the update differently?) | 18:50 |
| *** diazjf has joined #openstack-keystone | 18:51 | |
| rderose | morgan: hmm... | 18:51 |
| morgan | rderose: because i don't see an update user call there? | 18:51 |
| morgan | this is attributes on the main User() ref object | 18:52 |
| rderose | morgan: yeah, you'd have to add an update method, the model could stay the same (I think) | 18:52 |
| rderose | morgan: for update, you would then make 2 calls in core.py => driver.update() and shadow.update() | 18:52 |
| morgan | well more to the point, how much extra code mechanism is needed to make that update method work | 18:52 |
| morgan | hm. | 18:53 |
| morgan | because the normal driver.update wouldn't affect non-local users? | 18:53 |
| rderose | because driver.update() may point to ldap | 18:53 |
| rderose | right | 18:53 |
| morgan | well considering ldap no longer does writes. | 18:53 |
| ayoung | morgan, options for what? | 18:54 |
| morgan | i think we need to re-think that | 18:54 |
| rderose | yep | 18:54 |
| morgan | rderose: so this is probably ok for now as is | 18:54 |
| rderose | morgan: the problem is list_users | 18:54 |
| ayoung | is that optional data? | 18:54 |
| morgan | ayoung: for any resource specific option furture looking | 18:54 |
| morgan | ayoung: rather than using "extras" or a top level column | 18:54 |
| rderose | morgan: yeah, I'm okay as is. it just would be really cool to be able to apply new attributes to ALL users | 18:54 |
| ayoung | morgan, I don't know what you mean. But I think I hate it. | 18:54 |
| rderose | ayoung: :) | 18:55 |
| morgan | ayoung: allows us to define in code "ignore_passwoird_expiry" [pci-dss] | 18:55 |
| morgan | rather than needing to lump it into keystone.config | 18:55 |
| morgan | (conf file) | 18:55 |
| morgan | or make a new column for everything | 18:55 |
| ayoung | per user.... | 18:55 |
| morgan | because it's absurd for limited/narrow use case | 18:55 |
| morgan | this is an option that would be per-<resource> | 18:55 |
| morgan | long term, if we had a domain that enforced pci-dss things like expiring passwords | 18:56 |
| morgan | or MFA | 18:56 |
| ayoung | because you made it general purpose | 18:56 |
| morgan | or... | 18:56 |
| morgan | whatever | 18:56 |
| morgan | we can implement | 18:56 |
| morgan | easily | 18:56 |
| ayoung | so we could do per-project stuff with this later, too | 18:56 |
| morgan | that is the plan | 18:56 |
| ayoung | Yep. I am sure of it. | 18:56 |
| ayoung | I hate it. | 18:56 |
| morgan | all of the resource-types managed by keystone would have options. | 18:56 |
| ayoung | +2 | 18:56 |
| morgan | the key is the option must be defined in code | 18:57 |
| morgan | or it wont be stored this way and will just fall into "extras" | 18:57 |
| morgan | this is not a generic key-value-store for anyone | 18:57 |
| morgan | i also see things that we have long been loathe to remove (default_projecT_id) | 18:57 |
| morgan | becoming one of these | 18:57 |
| samueldmq | 2 minutes left | 18:58 |
| *** dave-mccowan has joined #openstack-keystone | 18:58 | |
| samueldmq | just fyi | 18:58 |
| morgan | stevemar: wrong channel | 18:58 |
| samueldmq | no minutes left here | 18:58 |
| morgan | erm samueldmq ^ | 18:58 |
| morgan | hehe | 18:58 |
| *** phalmos_ has quit IRC | 18:58 | |
| stevemar | morgan: i had the right channel :P | 18:58 |
| samueldmq | lol | 18:58 |
| morgan | ayoung: anyway hate it or not, trying to unwind some ick we have in keystone that has required headaches for narrowly used features, but is supported across the whole of keystone | 18:59 |
| samueldmq | morgan: sorry :) looks like I missclicked | 18:59 |
| morgan | ayoung: figured your review on it would be good in either case :) | 18:59 |
| morgan | rderose: if you want to take a crack ad what moving the stuff to shadow users would look like... | 18:59 |
| rderose | morgan: yeah, was thinking that | 18:59 |
| morgan | rderose: but i think we can probably get away from that by putting some conditionals in since LDAP write is dead | 19:00 |
| morgan | needing to do two updates is problematic | 19:00 |
| morgan | but if we need to... then we can | 19:00 |
| rderose | morgan: the 2 update doesn't bother so much much as now when you call list_users, you'd have to tack on the extra attributes | 19:01 |
| morgan | rderose: how crazy would it be to migrate everything to shadow-user, and only fall through the basic stuff from LDAP. | 19:02 |
| morgan | so LDAP driver always layers behind sql at some point | 19:02 |
| morgan | since we require SQL for keystone to function | 19:02 |
| morgan | LDAP back end can be very narrowly scoped to the current properties we have for reading | 19:02 |
| morgan | everything else can be extracted via SQL and layered in. | 19:02 |
| morgan | including the options. | 19:03 |
| morgan | if you pass an option that would hit LDAP for store, we raise out a 403 [with information] | 19:03 |
| rderose | hmm... | 19:03 |
| morgan | we've already done most of this work by killing read/write ldap | 19:03 |
| rderose | morgan: right and all users that have authenticated are in sql already | 19:04 |
| morgan | and shadow user stuff is hidden from end users. | 19:04 |
| morgan | yep | 19:04 |
| morgan | i see a pike target here | 19:04 |
| rderose | :) | 19:04 |
| morgan | so on that note, we leave the options for now where they are | 19:04 |
| rderose | cool | 19:04 |
| knikolla | ++ interesting | 19:04 |
| morgan | and then all users get support once we make the next move | 19:04 |
| rderose | morgan: sounds good | 19:05 |
| morgan | rderose: ok cool, please let me know any other feedback on that patch then | 19:05 |
| morgan | knikolla: you should review too | 19:05 |
| rderose | morgan: thanks, will get to it this afternoon | 19:05 |
| morgan | rderose: because next step is to move MFA rules to it, the ignore_password_expiry and lockout, then continue from there | 19:05 |
| rderose | gotchea | 19:06 |
| rderose | *gotcha | 19:06 |
| morgan | rderose: and sooner = lands this cycle if no one complains. | 19:06 |
| rderose | right | 19:06 |
| knikolla | morgan: sounds good. | 19:07 |
| knikolla | i'm finally at a point where i can spend more than 50% of my time on keystone. | 19:07 |
| morgan | knikolla: https://review.openstack.org/#/c/424334/3 is the review ftr | 19:07 |
| morgan | adrian_otto: ping | 19:07 |
| morgan | actually... | 19:07 |
| *** phalmos has joined #openstack-keystone | 19:08 | |
| knikolla | morgan: if we remove a user_option from code, will there be a corresponding migration that cleans up everything with that id from the user_options table? | 19:11 |
| rderose | morgan: quick question, what about v2? are we filtering these options out for v2? | 19:12 |
| morgan | you could. you could also just leave it. when/if the user is updated if the option is no longer there it will be filtered out (we could explicitly do that in the update code), it also wont leak to the API if the option disappeared | 19:12 |
| morgan | rderose: no. i don't see a reason to, we long had "extra" this is no different | 19:12 |
| morgan | rderose: and v2 is disappearing soon(tm) anyway | 19:12 |
| rderose | morgan: ok, cool | 19:12 |
| morgan | knikolla: it might be worth adding a tiny bit more code to look for options and strip them from the DB if they are no longer registered... likewise | 19:13 |
| morgan | maybe we don't want to do that? | 19:13 |
| morgan | if the user is deleted... we're cascading the delete to this table anyway | 19:14 |
| *** MasterOfBugs has joined #openstack-keystone | 19:14 | |
| knikolla | morgan: i'm just being pedantic. leaving it there is probably fine for now. | 19:14 |
| morgan | if the option is removed, it will no longer show in the user_ref | 19:15 |
| morgan | it basically would just linger in the table but be unused | 19:15 |
| morgan | as it stands | 19:15 |
| morgan | and the value(s) would not be changable either w/o direct SQL access | 19:16 |
| knikolla | keystone-manage command for cleanup? | 19:16 |
| morgan | nah | 19:16 |
| morgan | if anything i'd put it in the storage code | 19:16 |
| morgan | make non-existent opts work like an explicit None | 19:17 |
| morgan | and pop them from the attribute map | 19:17 |
| morgan | so on update old options no longer defined disappear | 19:17 |
| adrian_otto | morgan: here | 19:17 |
| morgan | adrian_otto: sent you the question in a PM :) | 19:17 |
| morgan | didn't hit tab before i typed ^_^ | 19:17 |
| morgan | you already responded. | 19:17 |
| knikolla | morgan: that sounds better. | 19:20 |
| openstackgerrit | Richard Avelar proposed openstack/keystone: WIP extend users API to add federated object https://review.openstack.org/418624 | 19:21 |
| morgan | knikolla: ok added a comment to the review saying in futue patchset or in a followup | 19:21 |
| knikolla | morgan: ++ | 19:22 |
| morgan | so i think i need the rderose +1/+2, stevemar ok, and dstanek's view and it should be good to go | 19:22 |
| dstanek | morgan: where you planning on submitting a patch to remove the ability to change domain_id for a user? | 19:23 |
| morgan | dstanek: yes. but that was a little bit further down the list | 19:23 |
| morgan | once i was done with the bulk of this change so it could get some eyes. | 19:24 |
| dstanek | morgan: cool. just checking. if you don't have time i could whip it up. that would help simplify rderose's patch even further | 19:25 |
| morgan | crap.... looks like we don;'t block project domain_id updates | 19:26 |
| morgan | ...... | 19:26 |
| morgan | i know we had an option for that at some point | 19:26 |
| morgan | but it's just allowed afaict | 19:26 |
| morgan | *rolls eyes* | 19:26 |
| dstanek | morgan: it's not even deprecated? | 19:26 |
| morgan | looking but doesn't look like it | 19:26 |
| morgan | ah | 19:27 |
| morgan | controller blocks it | 19:27 |
| morgan | i'm going to push that down to the manager | 19:27 |
| morgan | so no going around that | 19:27 |
| openstackgerrit | Merged openstack/keystone: Add password expiration queries for PCI-DSS https://review.openstack.org/403898 | 19:27 |
| morgan | ok so project can't change domain, user is slated to be fixed now | 19:28 |
| morgan | domain can't (obviously) | 19:28 |
| morgan | looking at group, i think that is the last item | 19:28 |
| morgan | yep | 19:28 |
| morgan | ok will fix group, and user | 19:28 |
| morgan | will push the check for project/domain down to the manager | 19:29 |
| morgan | shortly | 19:29 |
| dstanek | sounds good, thansk | 19:29 |
| *** harlowja has joined #openstack-keystone | 19:41 | |
| knikolla | morgan: why restrict opt_ids to 4 characters? | 19:42 |
| stevemar | morgan: yeah, it happened at the manager | 19:46 |
| stevemar | err controller | 19:46 |
| openstackgerrit | Merged openstack/keystone: Fixed unraised exception in _disallow_write for LDAP https://review.openstack.org/424704 | 19:50 |
| stevemar | morgan: https://review.openstack.org/#/c/424673/ | 19:52 |
| *** diazjf has quit IRC | 19:54 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone: WIP: Remove LDAP delete logic and associated tests https://review.openstack.org/424344 | 19:54 |
| *** diazjf has joined #openstack-keystone | 19:57 | |
| *** flaper87 has joined #openstack-keystone | 19:59 | |
| *** adrian_otto has quit IRC | 20:12 | |
| morgan | knikolla: 4 characters for the id is a lot of options | 20:13 |
| morgan | knikolla: but also not massive space to consume in storage | 20:13 |
| morgan | it could have been an int, string(4) iirc is ~ same size as int. | 20:14 |
| morgan | but also can be more human friendly | 20:14 |
| rderose | morgan: if I'm creating a new option, am I adding it here: https://review.openstack.org/#/c/424334/3/keystone/identity/backends/identity_resource_options.py | 20:15 |
| morgan | rderose: correct | 20:15 |
| morgan | for identity | 20:15 |
| stevemar | morgan: 4 characters seems like a lot of options | 20:15 |
| morgan | stevemar: exactly | 20:15 |
| morgan | it is a lot of options | 20:15 |
| morgan | not expecting it to be tons of them used. but also future proofing | 20:16 |
| morgan | it might be USR1 USR2 GRP1 GRP2 | 20:16 |
| morgan | but that is better than 1400 1401 1402 | 20:16 |
| morgan | etc | 20:16 |
| morgan | imo | 20:16 |
| *** adrian_otto has joined #openstack-keystone | 20:17 | |
| *** martinlopes has joined #openstack-keystone | 20:22 | |
| *** diazjf has quit IRC | 20:23 | |
| *** adrian_otto has quit IRC | 20:24 | |
| morgan | dstanek: about to propose the fix for domain setting | 20:25 |
| *** nicodemus_ has joined #openstack-keystone | 20:29 | |
| *** jperry has quit IRC | 20:31 | |
| dstanek | morgan: nice | 20:33 |
| knikolla | morgan: ok cool! | 20:33 |
| *** jperry has joined #openstack-keystone | 20:33 | |
| *** diazjf has joined #openstack-keystone | 20:40 | |
| morgan | dstanek: looks like we already prevented it at the controller level, this moves it down to the manager to be much more direct about it | 20:42 |
| *** martinlopes has quit IRC | 20:43 | |
| *** thiagolib has quit IRC | 20:48 | |
| *** martinlopes has joined #openstack-keystone | 20:51 | |
| dstanek | morgan: for users too? | 20:52 |
| *** martinlopes has quit IRC | 20:53 | |
| morgan | dstanek: looks like. sortof.. anyway cleaning up the code and being more explicit | 20:53 |
| * morgan taps foot waiting... | 20:54 | |
| *** diazjf has quit IRC | 20:55 | |
| openstackgerrit | Maroun Maroun proposed openstack/python-keystoneclient: Fix boto version strip regex https://review.openstack.org/424848 | 21:00 |
| *** jerrygb_ has joined #openstack-keystone | 21:01 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/403916 | 21:03 |
| *** jerrygb has quit IRC | 21:03 | |
| *** jerrygb_ has quit IRC | 21:04 | |
| *** raildo has quit IRC | 21:05 | |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/403916 | 21:05 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/403916 | 21:05 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP - PCI-DSS Force users to change password upon first use https://review.openstack.org/403916 | 21:06 |
| stevemar | morgan: ugh meeeeeeetings | 21:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Remove code supporting moving resources between domains https://review.openstack.org/424850 | 21:08 |
| morgan | dstanek: ^ | 21:09 |
| morgan | stevemar: so, | 21:09 |
| *** dave-mccowan has quit IRC | 21:10 | |
| dstanek | morgan: looking... | 21:10 |
| *** adrian_otto has joined #openstack-keystone | 21:10 | |
| morgan | dstanek: it looks like we blocked it at the controller, but supported at the manager | 21:11 |
| morgan | this change consolidates blocking the domain_id change at the manager | 21:11 |
| morgan | prevents things slipping in by avoiding the user/project/group controllers | 21:11 |
| morgan | stevemar: looking for a view on https://review.openstack.org/#/c/424334/ before i start rebasing things on it | 21:11 |
| stevemar | morgan: thanks for spending time in keystone this week and previous | 21:12 |
| stevemar | helps us out a lot | 21:12 |
| *** antwash_ has quit IRC | 21:12 | |
| *** antwash_ has joined #openstack-keystone | 21:13 | |
| *** antwash_ has quit IRC | 21:17 | |
| knikolla | ++ | 21:17 |
| *** ravelar has quit IRC | 21:17 | |
| knikolla | especially the last minute rearchitecture of entire features | 21:17 |
| *** antwash_ has joined #openstack-keystone | 21:19 | |
| stevemar | morgan: why is the domain check not in a common place? | 21:20 |
| stevemar | keystone.common.manager.Manager | 21:20 |
| *** antwash_ has quit IRC | 21:20 | |
| stevemar | eh, its a metaclass | 21:20 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: Add auto-cleanup code for undefined options https://review.openstack.org/424855 | 21:21 |
| morgan | stevemar: because i didn't push it that far down. | 21:22 |
| morgan | would be easy to do so *shrug* | 21:22 |
| morgan | knikolla: ^ your comments on the auto-cleanup. | 21:22 |
| stevemar | eh | 21:22 |
| *** antwash has quit IRC | 21:23 | |
| knikolla | morgan: awesome! | 21:23 |
| morgan | knikolla: not the nits and name of table | 21:23 |
| morgan | but the auto-cleanup only in there | 21:23 |
| knikolla | morgan: yeah, i figured from the title. | 21:23 |
| morgan | i just need to know if i'm putting in the work to rebase things on the code-defined-options or if i should wait. | 21:24 |
| morgan | because if I am... I'll get to work. | 21:24 |
| stevemar | morgan: approved domain move, thats gonna conflict with some stuff | 21:24 |
| morgan | since time is a premium. | 21:24 |
| morgan | stevemar: that is fine. | 21:24 |
| morgan | i don't care about legit conflicts, i care about "is this worth putting the effort in *right now* | 21:25 |
| morgan | vs Pike. | 21:25 |
| morgan | i can play rebase games as needed | 21:25 |
| stevemar | morgan: thoughts on https://review.openstack.org/#/c/424673/ ? | 21:26 |
| *** antwash has joined #openstack-keystone | 21:26 | |
| stevemar | morgan: i don't remember the exact moves that were done in dogpile, but i think that is correct | 21:26 |
| morgan | i thought kvs was dead | 21:26 |
| morgan | i'd say no don't change it if we're removing kvs | 21:27 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP PCI-DSS Force users to change password upon first use https://review.openstack.org/424856 | 21:27 |
| *** Jack_V has quit IRC | 21:27 | |
| morgan | bah. deprecated in newton removal in pike | 21:28 |
| morgan | lets just hold for a couple weeks on that review | 21:28 |
| morgan | and watch the code evaporate as soon as RC is cut | 21:28 |
| dstanek | i think kvs is gone, gone. i think i had to leave some code in there for ldap or some other backend | 21:29 |
| * lbragstad needs a cup of coffee | 21:30 | |
| morgan | dstanek: no | 21:30 |
| morgan | dstanek: deprecated (we missed some things) as of N | 21:30 |
| morgan | so removing the core of it in pike | 21:30 |
| morgan | just the KVS core is left | 21:30 |
| morgan | dstanek: =/ | 21:31 |
| stevemar | hehe i +2'ed it | 21:31 |
| morgan | dstanek: otherwise it really would be gone gone already | 21:31 |
| morgan | stevemar: *shrug* my -1 is more procedural... why update code that is dead ina week | 21:31 |
| morgan | but i'm fine if you want to push it in | 21:32 |
| *** antwash has quit IRC | 21:32 | |
| morgan | feel free to +A it (i wouldn't complain) | 21:32 |
| stevemar | its technically more correct | 21:32 |
| dstanek | morgan: i didn't realize that anything was missed | 21:33 |
| morgan | dstanek: yeah we missed the entire kvscore when we removed the other kvs code | 21:33 |
| morgan | soooo we had to wait until Pike | 21:33 |
| morgan | because we only deprecated in NEwton | 21:33 |
| *** catintheroof has quit IRC | 21:35 | |
| stevemar | morgan: there was something else i thought? | 21:35 |
| morgan | token kvs backend | 21:35 |
| morgan | same thing | 21:35 |
| *** catintheroof has joined #openstack-keystone | 21:35 | |
| morgan | but caught witht he same deprecation message as kvscore | 21:35 |
| *** catintheroof has quit IRC | 21:35 | |
| *** nicodemus_ has quit IRC | 21:36 | |
| stevemar | thanks morgan | 21:36 |
| *** antwash has joined #openstack-keystone | 21:45 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone: MERGE-IN-PIKE: Remove KVS code https://review.openstack.org/424862 | 21:45 |
| morgan | dstanek: ^ ;) | 21:46 |
| *** portdirect is now known as portdirect_away | 21:46 | |
| morgan | stevemar: sooooo | 21:46 |
| *** pnavarro has quit IRC | 21:46 | |
| morgan | stevemar: back to the option code | 21:46 |
| stevemar | o/ | 21:46 |
| stevemar | morgan: omg you are tossing up so many things! i can't keep up! | 21:46 |
| morgan | stevemar: the option code is the key, if i am rebasing things around it or if we're holding MFA, password-expiry-things, etc | 21:47 |
| morgan | stevemar: i'm fine with rebasing around it, just need to know if i should spend the time/energy | 21:47 |
| *** thorst_ has quit IRC | 21:55 | |
| *** ravelar has joined #openstack-keystone | 21:58 | |
| rderose | morgan: playing with this now | 21:58 |
| *** antwash has quit IRC | 21:58 | |
| rderose | morgan: I should be able to just do something like this: USER_OPTIONS_LIST = [{'option_id': '1000', 'option_name': 'allow_password_expires'}] | 21:58 |
| rderose | right? | 21:59 |
| *** antwash has joined #openstack-keystone | 21:59 | |
| *** antwash has quit IRC | 22:06 | |
| rodrigods | stevemar, knikolla i wonder what the maintainers of testshib.org are thinking with the traffic increase | 22:09 |
| morgan | rderose: would need to create a new option object | 22:12 |
| morgan | rderose: in the list | 22:12 |
| rderose | morgan: ah, so: resource_options.ResourceOption('opt1', 'option1') | 22:13 |
| morgan | yah | 22:13 |
| rderose | gotcha, hx | 22:13 |
| rderose | *thx | 22:13 |
| morgan | and a validator if you want a different one than the basic one that does nothing | 22:13 |
| lbragstad | samueldmq glad to see your candidacy email :) | 22:13 |
| morgan | it also can only store things that can be serialized with oslo.serialization.jsonutils.dumps | 22:13 |
| rderose | morgan: hmmm... sqlalchemy.orm.exc.DetachedInstanceError: Parent instance <User at 0x7fc0ed347290> is not bound to a Session; lazy load operation of attribute 'options' cannot proceed | 22:13 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP PCI-DSS Force users to change password upon first use https://review.openstack.org/424856 | 22:14 |
| morgan | uh | 22:15 |
| morgan | hmm. it worked in my tests | 22:15 |
| rderose | morgan: yeah, still playing with it... | 22:16 |
| morgan | where did you hit that? | 22:16 |
| morgan | and can you provide an example? | 22:16 |
| *** spilla has quit IRC | 22:16 | |
| rderose | morgan: http://paste.openstack.org/show/596317/ | 22:16 |
| morgan | huh | 22:17 |
| rderose | morgan: https://review.openstack.org/#/c/424856/2/keystone/identity/backends/identity_resource_options.py | 22:17 |
| morgan | how did my test work then? | 22:17 |
| rderose | morgan: it may be me :) | 22:17 |
| morgan | hehe. i can poke at that as soon i am back from lunch | 22:17 |
| morgan | if you don't figure it out | 22:17 |
| morgan | fwiw, i had that issue early on, but have it all solved by the time my tests were written | 22:18 |
| morgan | ah hm. | 22:18 |
| morgan | i think i see it | 22:18 |
| rderose | cool, where | 22:18 |
| *** jperry has quit IRC | 22:19 | |
| morgan | i'll poke post lunch but i think the user.allows_password_expired doesn't do what you're actually looking for | 22:19 |
| rderose | ok | 22:20 |
| morgan | it might also be something where the test is just doing something weird. | 22:21 |
| morgan | in almost 100% of the cases you always have an active session when touching the models | 22:21 |
| rderose | hmm... okay, let me start undoing things and see if I can find the problem | 22:21 |
| openstackgerrit | Ron De Rose proposed openstack/keystone: WIP PCI-DSS Force users to change password upon first use https://review.openstack.org/424856 | 22:23 |
| *** MasterOfBugs has quit IRC | 22:33 | |
| *** pramodrj07 has joined #openstack-keystone | 22:33 | |
| *** martinlopes has joined #openstack-keystone | 22:34 | |
| *** adrian_otto has quit IRC | 22:41 | |
| *** antwash has joined #openstack-keystone | 22:45 | |
| *** lamt has quit IRC | 22:49 | |
| *** antwash has quit IRC | 22:50 | |
| rderose | morgan: okay so, if I download your patch and add this line: https://review.openstack.org/#/c/424856/3/keystone/identity/backends/identity_resource_options.py | 22:50 |
| rderose | morgan: I get this error: | 22:50 |
| *** david-lyle has quit IRC | 22:50 | |
| rderose | morgan: http://paste.openstack.org/show/596321/ | 22:50 |
| *** lamt has joined #openstack-keystone | 22:51 | |
| rderose | morgan: and looking at the sql_model.py, I'm seeing what's wrong | 22:51 |
| *** david-lyle has joined #openstack-keystone | 22:53 | |
| rderose | morgan: *I'm not seeing what's wrong | 22:57 |
| *** edmondsw has quit IRC | 22:58 | |
| *** jaugustine has quit IRC | 22:58 | |
| *** martinlopes has quit IRC | 22:59 | |
| *** spotz is now known as spotz_zzz | 23:03 | |
| *** harlowja has quit IRC | 23:08 | |
| *** adriant has joined #openstack-keystone | 23:09 | |
| *** jaosorior has quit IRC | 23:12 | |
| *** edtubill has quit IRC | 23:15 | |
| rderose | morgan: around? | 23:15 |
| *** rm_work has quit IRC | 23:16 | |
| rderose | morgan: tried changing it to eager loading, but still get the same error. need to run an errand, be back shortly. | 23:16 |
| *** rm_work has joined #openstack-keystone | 23:17 | |
| rderose | dstanek: is there anything you want me to change for this one: https://review.openstack.org/#/c/409874/? | 23:21 |
| rderose | dstanek: or, are you still reviewing it? | 23:21 |
| lbragstad | rderose i'm upgrade testing that one as we speak | 23:21 |
| rderose | lbragstad: sweet! | 23:21 |
| *** sudorandom has quit IRC | 23:22 | |
| *** ravelar1 has joined #openstack-keystone | 23:23 | |
| *** sudorandom has joined #openstack-keystone | 23:24 | |
| morgan | ok back. | 23:25 |
| morgan | rderose: i might need to just push the .options handling down into sqly.py only | 23:26 |
| rderose | morgan: ah, so out of the model? | 23:26 |
| morgan | yeah and down to just the backend where we are guaranteed to have a session | 23:27 |
| morgan | i don't know why my tests work... but anyway | 23:27 |
| *** ravelar1 has quit IRC | 23:28 | |
| rderose | morgan: hmm... yeah, it's strange | 23:28 |
| rderose | morgan: federated_user is almost identical and it works | 23:28 |
| morgan | easy, set a .resource_options attr in .from_dict() and then consume that at the bottom layer where we will instantiate the model | 23:28 |
| rderose | morgan: in terms user to federated_user relationship | 23:28 |
| rderose | morgan: something with to_dict that it doesn't like | 23:28 |
| morgan | yeah it's probably because i'm touching .options | 23:29 |
| morgan | in to_dict | 23:29 |
| morgan | so i'll stop doing that | 23:29 |
| morgan | easy | 23:29 |
| morgan | give me a few moments | 23:29 |
| rderose | okay | 23:29 |
| rderose | morgan: have to run, but back in about 30 | 23:29 |
| morgan | cool i should have it pushed by then | 23:30 |
| *** dave-mccowan has joined #openstack-keystone | 23:33 | |
| *** edmondsw has joined #openstack-keystone | 23:34 | |
| stevemar | jamielennox: around? | 23:36 |
| stevemar | jamielennox: can you verify https://review.openstack.org/#/c/423339/ ... ? | 23:36 |
| *** edmondsw has quit IRC | 23:38 | |
| gagehugo | lamt: ^ | 23:40 |
| samueldmq | lbragstad: o/ thanks | 23:42 |
| samueldmq | lbragstad: glad keystone will be on good hands regardless of the results | 23:42 |
| jamielennox | stevemar: i'm around | 23:43 |
| jamielennox | stevemar: that's something we can do? | 23:44 |
| openstackgerrit | Tin Lam proposed openstack/python-keystoneclient: Allow Multiple Filters of the Same Key https://review.openstack.org/423339 | 23:53 |
| *** antwash has joined #openstack-keystone | 23:53 | |
| lamt | stevemar: added a releasenote for spilla | 23:54 |
| *** thorst_ has joined #openstack-keystone | 23:57 | |
| *** thorst_ has quit IRC | 23:57 | |
| *** harlowja has joined #openstack-keystone | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!